@rubytech/create-maxy-code 0.1.539 → 0.1.541

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.539",
+  "version": "0.1.541",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/agent-slug/dist/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Static routes registered BEFORE the `/:slug` catch-all in
+ * `platform/ui/server/index.ts`. An agent slug equal to one of these is
+ * shadowed by the static route and 404s at `/{slug}` (only the bare root can
+ * reach such an agent, and only when it is the defaultAgent). This is the
+ * single source of truth for the shadowed set: the boot canary in
+ * `server/index.ts` reconciles it against the live `app.routes` registry
+ * (drift → `[route-shadow] drift` log), and the claude-session-manager
+ * reachability audit asserts its own copy equals this list via a cross-package
+ * test (the manager cannot import ui modules at build time). Edit this list
+ * only in lockstep with the static route registrations.
+ */
+export declare const SYSTEM_PATH_SLUGS: readonly ["public", "public-chat", "chat", "graph", "data", "browser"];
+/** Slugs the platform owns at the account root, independent of route order. */
+export declare const RESERVED_AGENT_SLUGS: readonly string[];
+/** Lowercase, starts with a letter, 3 to 50 characters, hyphens allowed. */
+export declare const AGENT_SLUG_PATTERN: RegExp;
+export type AgentSlugRefusal = "shape" | "reserved" | "shadowed";
+export type AgentSlugVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    reason: AgentSlugRefusal;
+};
+/**
+ * Which of the three rules a slug breaks, so a caller can report the cause
+ * rather than a bare "invalid". The serve path collapses this to a boolean;
+ * the write tools surface the reason to the operator.
+ */
+export declare function checkAgentSlug(slug: string): AgentSlugVerdict;
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/agent-slug/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,wEAAyE,CAAC;AAExG,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAQjD,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,QAA2B,CAAC;AAE3D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEtF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAK7D"}

package/payload/platform/lib/agent-slug/dist/index.js

@@ -0,0 +1,53 @@
+"use strict";
+// The one rule that decides whether a string may be a public-agent slug.
+//
+// It has two consumers that must never disagree: the serve path
+// (`platform/ui/app/lib/claude-agent/account.ts`, which decides whether a
+// request for `/{slug}` can reach an agent) and the write path (the admin MCP
+// agent-create / agent-update tools, which decide whether an agent may be
+// created under that slug). Before Task 2286 only the serve path applied it, so
+// an agent could be created under a slug its own router would refuse — written
+// to disk successfully, then 404ing at its own URL.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_SLUG_PATTERN = exports.RESERVED_AGENT_SLUGS = exports.SYSTEM_PATH_SLUGS = void 0;
+exports.checkAgentSlug = checkAgentSlug;
+/**
+ * Static routes registered BEFORE the `/:slug` catch-all in
+ * `platform/ui/server/index.ts`. An agent slug equal to one of these is
+ * shadowed by the static route and 404s at `/{slug}` (only the bare root can
+ * reach such an agent, and only when it is the defaultAgent). This is the
+ * single source of truth for the shadowed set: the boot canary in
+ * `server/index.ts` reconciles it against the live `app.routes` registry
+ * (drift → `[route-shadow] drift` log), and the claude-session-manager
+ * reachability audit asserts its own copy equals this list via a cross-package
+ * test (the manager cannot import ui modules at build time). Edit this list
+ * only in lockstep with the static route registrations.
+ */
+exports.SYSTEM_PATH_SLUGS = ["public", "public-chat", "chat", "graph", "data", "browser"];
+/** Slugs the platform owns at the account root, independent of route order. */
+exports.RESERVED_AGENT_SLUGS = [
+    "admin",
+    "api",
+    "assets",
+    "agent-assets",
+    "brand",
+    "bot",
+    "privacy",
+];
+/** Lowercase, starts with a letter, 3 to 50 characters, hyphens allowed. */
+exports.AGENT_SLUG_PATTERN = /^[a-z][a-z0-9-]{2,49}$/;
+/**
+ * Which of the three rules a slug breaks, so a caller can report the cause
+ * rather than a bare "invalid". The serve path collapses this to a boolean;
+ * the write tools surface the reason to the operator.
+ */
+function checkAgentSlug(slug) {
+    if (!exports.AGENT_SLUG_PATTERN.test(slug))
+        return { ok: false, reason: "shape" };
+    if (exports.RESERVED_AGENT_SLUGS.includes(slug))
+        return { ok: false, reason: "reserved" };
+    if (exports.SYSTEM_PATH_SLUGS.includes(slug))
+        return { ok: false, reason: "shadowed" };
+    return { ok: true };
+}
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/agent-slug/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,EAAE;AACF,gEAAgE;AAChE,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,oDAAoD;;;AAuCpD,wCAKC;AA1CD;;;;;;;;;;;GAWG;AACU,QAAA,iBAAiB,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAExG,+EAA+E;AAClE,QAAA,oBAAoB,GAAsB;IACrD,OAAO;IACP,KAAK;IACL,QAAQ;IACR,cAAc;IACd,OAAO;IACP,KAAK;IACL,SAAS;CACV,CAAC;AAEF,4EAA4E;AAC/D,QAAA,kBAAkB,GAAG,wBAAwB,CAAC;AAM3D;;;;GAIG;AACH,SAAgB,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,0BAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC1E,IAAI,4BAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAClF,IAAK,yBAAuC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACtG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/payload/platform/lib/agent-slug/src/index.ts

@@ -0,0 +1,53 @@
+// The one rule that decides whether a string may be a public-agent slug.
+//
+// It has two consumers that must never disagree: the serve path
+// (`platform/ui/app/lib/claude-agent/account.ts`, which decides whether a
+// request for `/{slug}` can reach an agent) and the write path (the admin MCP
+// agent-create / agent-update tools, which decide whether an agent may be
+// created under that slug). Before Task 2286 only the serve path applied it, so
+// an agent could be created under a slug its own router would refuse — written
+// to disk successfully, then 404ing at its own URL.
+
+/**
+ * Static routes registered BEFORE the `/:slug` catch-all in
+ * `platform/ui/server/index.ts`. An agent slug equal to one of these is
+ * shadowed by the static route and 404s at `/{slug}` (only the bare root can
+ * reach such an agent, and only when it is the defaultAgent). This is the
+ * single source of truth for the shadowed set: the boot canary in
+ * `server/index.ts` reconciles it against the live `app.routes` registry
+ * (drift → `[route-shadow] drift` log), and the claude-session-manager
+ * reachability audit asserts its own copy equals this list via a cross-package
+ * test (the manager cannot import ui modules at build time). Edit this list
+ * only in lockstep with the static route registrations.
+ */
+export const SYSTEM_PATH_SLUGS = ["public", "public-chat", "chat", "graph", "data", "browser"] as const;
+
+/** Slugs the platform owns at the account root, independent of route order. */
+export const RESERVED_AGENT_SLUGS: readonly string[] = [
+  "admin",
+  "api",
+  "assets",
+  "agent-assets",
+  "brand",
+  "bot",
+  "privacy",
+];
+
+/** Lowercase, starts with a letter, 3 to 50 characters, hyphens allowed. */
+export const AGENT_SLUG_PATTERN = /^[a-z][a-z0-9-]{2,49}$/;
+
+export type AgentSlugRefusal = "shape" | "reserved" | "shadowed";
+
+export type AgentSlugVerdict = { ok: true } | { ok: false; reason: AgentSlugRefusal };
+
+/**
+ * Which of the three rules a slug breaks, so a caller can report the cause
+ * rather than a bare "invalid". The serve path collapses this to a boolean;
+ * the write tools surface the reason to the operator.
+ */
+export function checkAgentSlug(slug: string): AgentSlugVerdict {
+  if (!AGENT_SLUG_PATTERN.test(slug)) return { ok: false, reason: "shape" };
+  if (RESERVED_AGENT_SLUGS.includes(slug)) return { ok: false, reason: "reserved" };
+  if ((SYSTEM_PATH_SLUGS as readonly string[]).includes(slug)) return { ok: false, reason: "shadowed" };
+  return { ok: true };
+}

package/payload/platform/lib/agent-slug/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}

package/payload/platform/package.json

@@ -10,8 +10,8 @@
     "pdf-lib": "^1.17.1"
   },
   "scripts": {
-    "build": "tsc -p lib/account-schema-regions/tsconfig.json && tsc -p lib/account-ingest-token/tsconfig.json && tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p lib/routine-templates/tsconfig.json && tsc -p lib/agent-dispatch-rule/tsconfig.json && tsc -p lib/learning-constants/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
-    "build:lib": "tsc -p lib/account-schema-regions/tsconfig.json && tsc -p lib/account-ingest-token/tsconfig.json && tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p lib/routine-templates/tsconfig.json && tsc -p lib/agent-dispatch-rule/tsconfig.json",
+    "build": "tsc -p lib/account-schema-regions/tsconfig.json && tsc -p lib/account-ingest-token/tsconfig.json && tsc -p lib/models/tsconfig.json && tsc -p lib/agent-slug/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p lib/routine-templates/tsconfig.json && tsc -p lib/agent-dispatch-rule/tsconfig.json && tsc -p lib/learning-constants/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
+    "build:lib": "tsc -p lib/account-schema-regions/tsconfig.json && tsc -p lib/account-ingest-token/tsconfig.json && tsc -p lib/models/tsconfig.json && tsc -p lib/agent-slug/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p lib/routine-templates/tsconfig.json && tsc -p lib/agent-dispatch-rule/tsconfig.json",
     "gen:canonical-tools": "node scripts/generate-canonical-tool-names.mjs",
     "build:memory": "tsc -p plugins/memory/mcp/tsconfig.json",
     "build:contacts": "tsc -p plugins/contacts/mcp/tsconfig.json",

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), linkedin-ingest-token (returns the account's durable LinkedIn ingest token — the one credential the Maxy LinkedIn Ingest Chrome extension needs in its options page; minted on first call then stable across restarts and new chat sessions, and never a conversation session key nor the admin browser's session_key, which the ingest route rejects; action='rotate' replaces it and invalidates every existing extension install), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires the client business owner's real name (ownerName), refusing a blank or the placeholder \"Owner\" and seeding it onto the sub-account's owner AdminUser and owner Person, and requires the owner's IANA timezone (timezone) — refusing a blank or a non-IANA value — seeding it onto the owner UserProfile marked owner-set so scheduling reads the owner's real zone from the start rather than the box's server default, while a managing house admin (its userId) is optional — when supplied it is validated as a live house admin and recorded as the sub-account's managingAdminUserId, and when omitted the sub-account is unmanaged and its passive-intake tasks route to the install's primary admin; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId, or to record one on an unmanaged account); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder \"Owner\", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the house-paired WhatsApp/Telegram inbound stream to a different sub-account, and does not affect a sub-account's own separately paired WhatsApp number), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, cpu-triage-start and cpu-triage-read (the two-call device CPU diagnostic — start spawns a detached sampling run across at least one full 120s reconcile cycle and returns a run handle immediately, read returns running/complete/failed with the per-core distribution; no admin tool blocks through a sampling window, and no spot reading is obtainable), plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), linkedin-ingest-token (returns the account's durable LinkedIn ingest token — the one credential the Maxy LinkedIn Ingest Chrome extension needs in its options page; minted on first call then stable across restarts and new chat sessions, and never a conversation session key nor the admin browser's session_key, which the ingest route rejects; action='rotate' replaces it and invalidates every existing extension install), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires the client business owner's real name (ownerName), refusing a blank or the placeholder \"Owner\" and seeding it onto the sub-account's owner AdminUser and owner Person, and requires the owner's IANA timezone (timezone) — refusing a blank or a non-IANA value — seeding it onto the owner UserProfile marked owner-set so scheduling reads the owner's real zone from the start rather than the box's server default, while a managing house admin (its userId) is optional — when supplied it is validated as a live house admin and recorded as the sub-account's managingAdminUserId, and when omitted the sub-account is unmanaged and its passive-intake tasks route to the install's primary admin; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId, or to record one on an unmanaged account); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder \"Owner\", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the house-paired WhatsApp/Telegram inbound stream to a different sub-account, and does not affect a sub-account's own separately paired WhatsApp number), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, the public-agent write tools (agent-create is the only supported way to create a public agent: it validates the slug against the same rule the router serves by, validates config.json against the servable schema, refuses an empty KNOWLEDGE, writes the four files with IDENTITY.md copied verbatim from the platform template, and projects the agent into the graph in the same call, reporting the verified projected count rather than assuming it; agent-update applies the same validation to a merged config, writes only the fields supplied, and re-projects, so the graph cannot fall behind the files; agent-delete removes the :Agent node and its owned knowledge projections before the directory and refuses the admin agent — writing these files by hand reaches none of those checks, which is what left an agent on disk and absent from the graph for a day), agent-image, plugin-toggle-enabled, premium-list, premium-deliver, skill-find, logs-read, cpu-triage-start and cpu-triage-read (the two-call device CPU diagnostic — start spawns a detached sampling run across at least one full 120s reconcile cycle and returns a run handle immediately, read returns running/complete/failed with the per-core distribution; no admin tool blocks through a sampling window, and no spot reading is obtainable), plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,7 +1,7 @@
 ---
 name: admin
 surface: platform
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), linkedin-ingest-token (returns the account's durable LinkedIn ingest token — the one credential the Maxy LinkedIn Ingest Chrome extension needs in its options page; minted on first call then stable across restarts and new chat sessions, and never a conversation session key nor the admin browser's session_key, which the ingest route rejects; action='rotate' replaces it and invalidates every existing extension install), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires the client business owner's real name (ownerName), refusing a blank or the placeholder "Owner" and seeding it onto the sub-account's owner AdminUser and owner Person, and requires the owner's IANA timezone (timezone) — refusing a blank or a non-IANA value — seeding it onto the owner UserProfile marked owner-set so scheduling reads the owner's real zone from the start rather than the box's server default, while a managing house admin (its userId) is optional — when supplied it is validated as a live house admin and recorded as the sub-account's managingAdminUserId, and when omitted the sub-account is unmanaged and its passive-intake tasks route to the install's primary admin; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId, or to record one on an unmanaged account); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder "Owner", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the house-paired WhatsApp/Telegram inbound stream to a different sub-account, and does not affect a sub-account's own separately paired WhatsApp number), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, cpu-triage-start and cpu-triage-read (the two-call device CPU diagnostic — start spawns a detached sampling run across at least one full 120s reconcile cycle and returns a run handle immediately, read returns running/complete/failed with the per-core distribution; no admin tool blocks through a sampling window, and no spot reading is obtainable), plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), linkedin-ingest-token (returns the account's durable LinkedIn ingest token — the one credential the Maxy LinkedIn Ingest Chrome extension needs in its options page; minted on first call then stable across restarts and new chat sessions, and never a conversation session key nor the admin browser's session_key, which the ingest route rejects; action='rotate' replaces it and invalidates every existing extension install), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires the client business owner's real name (ownerName), refusing a blank or the placeholder "Owner" and seeding it onto the sub-account's owner AdminUser and owner Person, and requires the owner's IANA timezone (timezone) — refusing a blank or a non-IANA value — seeding it onto the owner UserProfile marked owner-set so scheduling reads the owner's real zone from the start rather than the box's server default, while a managing house admin (its userId) is optional — when supplied it is validated as a live house admin and recorded as the sub-account's managingAdminUserId, and when omitted the sub-account is unmanaged and its passive-intake tasks route to the install's primary admin; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId, or to record one on an unmanaged account); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder "Owner", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the house-paired WhatsApp/Telegram inbound stream to a different sub-account, and does not affect a sub-account's own separately paired WhatsApp number), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, the public-agent write tools (agent-create is the only supported way to create a public agent: it validates the slug against the same rule the router serves by, validates config.json against the servable schema, refuses an empty KNOWLEDGE, writes the four files with IDENTITY.md copied verbatim from the platform template, and projects the agent into the graph in the same call, reporting the verified projected count rather than assuming it; agent-update applies the same validation to a merged config, writes only the fields supplied, and re-projects, so the graph cannot fall behind the files; agent-delete removes the :Agent node and its owned knowledge projections before the directory and refuses the admin agent — writing these files by hand reaches none of those checks, which is what left an agent on disk and absent from the graph for a day), agent-image, plugin-toggle-enabled, premium-list, premium-deliver, skill-find, logs-read, cpu-triage-start and cpu-triage-read (the two-call device CPU diagnostic — start spawns a detached sampling run across at least one full 120s reconcile cycle and returns a run handle immediately, read returns running/complete/failed with the per-core distribution; no admin tool blocks through a sampling window, and no spot reading is obtainable), plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
 account-owned-files: [{"file": "webchat-channel-bindings.json", "description": "Routes this account's inbound admin webchat messages. Written by the session manager's webchat-channel-store."}, {"file": "wa-channel-bindings.json", "description": "Routes this account's inbound WhatsApp messages. Written by the session manager's wa-channel-store, which runs on every brand whether or not the whatsapp plugin ships."}, {"file": "telegram-channel-bindings.json", "description": "Routes this account's inbound Telegram messages. Written by the session manager's telegram-channel-store, which runs on every brand whether or not the telegram plugin ships."}, {"file": "canonical-webchat-session.json", "description": "Pins the account's canonical webchat session. Written by the admin UI server."}, {"file": "session-titles.json", "description": "Operator renames of sessions. Written by the session manager's title stores."}, {"file": "agents-disabled.json", "description": "Names the agents the operator switched off. Written by the admin agents route; provision reads it to re-apply the disables and never creates it."}]
 tools:
   - name: system-status
@@ -100,6 +100,38 @@ tools:
     publicAllowlist: false
     adminAllowlist: true
     riskClass: read
+  - name: agent-create
+    publicAllowlist: false
+    adminAllowlist: true
+    riskClass: write_local
+  - name: agent-update
+    publicAllowlist: false
+    adminAllowlist: true
+    riskClass: write_local
+  - name: agent-delete
+    publicAllowlist: false
+    adminAllowlist: true
+    riskClass: write_local
+  - name: agent-image
+    publicAllowlist: false
+    adminAllowlist: true
+    riskClass: write_local
+  - name: plugin-toggle-enabled
+    publicAllowlist: false
+    adminAllowlist: true
+    riskClass: write_local
+  - name: premium-list
+    publicAllowlist: false
+    adminAllowlist: true
+    riskClass: read
+  - name: premium-deliver
+    publicAllowlist: false
+    adminAllowlist: true
+    riskClass: write_local
+  - name: skill-find
+    publicAllowlist: false
+    adminAllowlist: true
+    riskClass: read
   - name: logs-read
     publicAllowlist: false
     adminAllowlist: false

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -25,6 +25,7 @@ import { classifySpecialists } from "./specialist-registry.js";
 import { resolvePublicHostname } from "./lib/public-hostname.js";
 import { resolveAdminHostname } from "./lib/admin-hostname.js";
 import { publishSite } from "./tools/publish-site.js";
+import { createAgent, updateAgent, projectAgentViaPlatform } from "./tools/agent-write.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
 import { resolveIngestToken } from "./tools/linkedin-ingest-token.js";
 import { startCpuTriage, readCpuTriage } from "./tools/cpu-triage.js";
@@ -1541,6 +1542,141 @@ lifelineTool(server, "agent-list", "List all public (non-admin) agents with thei
         };
     }
 });
+// Task 2286 — public-agent CRUD. Before these tools existed there was no write
+// path at any layer, so an agent creating an agent wrote the four files by hand
+// and hand-rolled the projection POST. That reached no slug rule, no config
+// schema and no non-empty-knowledge check, and it is what left the `beagle`
+// agent on disk and absent from the graph for a day.
+const AGENT_WRITE_TAG = "[admin/agents]";
+/** One line per write. `projected` is the verified post-condition read from the
+ *  projection response, not the intention.
+ *
+ *  `projected` is meaningful for create and update only. A successful delete
+ *  logs `projected=0` because it removed the projection, so the
+ *  disk-without-graph failure signature is `action=create|update outcome=ok
+ *  projected=0` — grepping `outcome=ok projected=0` alone matches every
+ *  successful delete. */
+function logAgentWrite(action, slug, outcome, reason, detail, projected) {
+    console.error(`${AGENT_WRITE_TAG} op=agent-write action=${action} slug=${slug} accountId=${(ACCOUNT_ID ?? "").slice(0, 8)} ` +
+        `outcome=${outcome} reason=${reason} detail=${detail} projected=${projected}`);
+}
+lifelineTool(server, "agent-create", "Create a public agent: writes IDENTITY.md (copied verbatim from the platform template), SOUL.md, KNOWLEDGE.md and config.json, then projects the agent into the graph in the same call. Refuses a slug the router would not serve, a config that would not spawn, and an empty KNOWLEDGE, before writing anything. This is the only supported way to create a public agent — writing the files directly reaches none of these checks.", {
+    agentSlug: z.string().describe("Agent slug: lowercase, starts with a letter, 3-50 chars, hyphens allowed"),
+    displayName: z.string().describe("Name shown in the chat header"),
+    model: z.string().describe("Model id: claude-haiku-4-5, claude-sonnet-5, or claude-opus-5[1m]"),
+    soul: z.string().describe("SOUL.md body: personality and the operator-defined role"),
+    knowledge: z.string().describe("KNOWLEDGE.md body: the agent's only knowledge source. Must be non-empty"),
+    knowledgeKeywords: z.array(z.string()).optional().describe("Up to 5 keyword subscriptions"),
+    status: z.enum(["active", "inactive"]).optional().describe("Defaults to active"),
+    showAgentName: z.union([z.boolean(), z.literal("none")]).optional().describe("Chat header title: false for the business name, true for the agent display name, 'none' for logo only"),
+    accessMode: z.enum(["open", "gated", "paid"]).optional().describe("Defaults to open"),
+}, async ({ agentSlug, ...rest }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("agent-create");
+    // getAccountDir throws on an unresolvable account dir and createAgent
+    // rethrows an I/O error after cleaning up. wrapWithLifeline re-throws, so
+    // without this catch the failure leaves NO op=agent-write line — the
+    // unobservable-failure class this tool exists to close.
+    try {
+        const res = createAgent({ ...rest, slug: agentSlug, accountDir: getAccountDir(), platformRoot: PLATFORM_ROOT });
+        if (!res.ok) {
+            logAgentWrite("create", agentSlug, "refused", res.reason, res.detail, 0);
+            return { content: [{ type: "text", text: `Refused: ${res.reason} — ${res.detail}` }], isError: true };
+        }
+        const proj = await projectAgentViaPlatform({
+            platformPort: PLATFORM_PORT,
+            accountId: ACCOUNT_ID,
+            slug: agentSlug,
+            houseAdminScope: process.env.HOUSE_ADMIN_SCOPE,
+        });
+        logAgentWrite("create", agentSlug, "ok", proj.projected ? "none" : "projection-failed", proj.error ?? "-", proj.projected);
+        if (!proj.projected) {
+            return {
+                content: [{ type: "text", text: `Agent '${agentSlug}' was written to disk but NOT projected into the graph: ${proj.error}. It will not appear in /graph. Re-run agent-update to retry the projection.` }],
+                isError: true,
+            };
+        }
+        return { content: [{ type: "text", text: `Agent '${agentSlug}' created and projected. Reachable at /${agentSlug}.` }] };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logAgentWrite("create", agentSlug, "refused", "write-failed", msg, 0);
+        return { content: [{ type: "text", text: `agent-create failed: ${msg}` }], isError: true };
+    }
+});
+lifelineTool(server, "agent-update", "Update a public agent's SOUL.md, KNOWLEDGE.md or config fields, then re-project it into the graph in the same call. Only the fields supplied are written; config fields merge into the existing file. A refusal leaves the agent directory byte-identical. Use this instead of editing the files directly, or the graph falls behind the files.", {
+    agentSlug: z.string().describe("Agent slug"),
+    displayName: z.string().optional(),
+    model: z.string().optional().describe("claude-haiku-4-5, claude-sonnet-5, or claude-opus-5[1m]"),
+    soul: z.string().optional().describe("Replacement SOUL.md body"),
+    knowledge: z.string().optional().describe("Replacement KNOWLEDGE.md body. Must be non-empty when supplied"),
+    knowledgeKeywords: z.array(z.string()).optional().describe("Up to 5 keyword subscriptions"),
+    status: z.enum(["active", "inactive"]).optional(),
+    showAgentName: z.union([z.boolean(), z.literal("none")]).optional(),
+    accessMode: z.enum(["open", "gated", "paid"]).optional(),
+}, async ({ agentSlug, ...rest }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("agent-update");
+    // Same rethrow contract as agent-create: without this catch an
+    // unresolvable account dir or a write error leaves no op=agent-write line.
+    try {
+        const res = updateAgent({ ...rest, slug: agentSlug, accountDir: getAccountDir() });
+        if (!res.ok) {
+            logAgentWrite("update", agentSlug, "refused", res.reason, res.detail, 0);
+            return { content: [{ type: "text", text: `Refused: ${res.reason} — ${res.detail}` }], isError: true };
+        }
+        const proj = await projectAgentViaPlatform({
+            platformPort: PLATFORM_PORT,
+            accountId: ACCOUNT_ID,
+            slug: agentSlug,
+            houseAdminScope: process.env.HOUSE_ADMIN_SCOPE,
+        });
+        logAgentWrite("update", agentSlug, "ok", proj.projected ? "none" : "projection-failed", proj.error ?? "-", proj.projected);
+        if (!proj.projected) {
+            return {
+                content: [{ type: "text", text: `Agent '${agentSlug}' was updated on disk but NOT re-projected: ${proj.error}. /graph now shows stale state for this agent.` }],
+                isError: true,
+            };
+        }
+        return { content: [{ type: "text", text: `Agent '${agentSlug}' updated (${res.filesWritten.join(", ")}) and re-projected.` }] };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logAgentWrite("update", agentSlug, "refused", "write-failed", msg, 0);
+        return { content: [{ type: "text", text: `agent-update failed: ${msg}` }], isError: true };
+    }
+});
+lifelineTool(server, "agent-delete", "Delete a public agent: removes its :Agent node and owned knowledge projections from the graph first, then its directory. Refuses the admin agent. Calls the platform route that owns the ordering, so a graph failure preserves the files and the delete can be safely re-run.", {
+    agentSlug: z.string().describe("Agent slug"),
+}, async ({ agentSlug }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("agent-delete");
+    // Refused here as well as at the route so the refusal is attributable from
+    // the MCP log alone, without correlating against the platform log.
+    if (agentSlug === "admin") {
+        logAgentWrite("delete", agentSlug, "refused", "slug-unsafe", "reserved", 0);
+        return { content: [{ type: "text", text: "Refused: the admin agent cannot be deleted." }], isError: true };
+    }
+    const headers = { "x-maxy-caller-account": ACCOUNT_ID };
+    if (process.env.HOUSE_ADMIN_SCOPE)
+        headers["x-maxy-house-admin-scope"] = process.env.HOUSE_ADMIN_SCOPE;
+    try {
+        const res = await fetch(`http://127.0.0.1:${PLATFORM_PORT}/api/admin/agents/${agentSlug}?accountId=${ACCOUNT_ID}`, { method: "DELETE", headers, signal: AbortSignal.timeout(5000) });
+        if (!res.ok) {
+            const body = await res.text().catch(() => "");
+            const reason = res.status === 404 ? "not-found" : "delete-failed";
+            logAgentWrite("delete", agentSlug, "refused", reason, String(res.status), 0);
+            return { content: [{ type: "text", text: `Refused: ${reason} — ${res.status} ${body}`.trim() }], isError: true };
+        }
+        logAgentWrite("delete", agentSlug, "ok", "none", "-", 0);
+        return { content: [{ type: "text", text: `Agent '${agentSlug}' deleted from the graph and from disk.` }] };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logAgentWrite("delete", agentSlug, "refused", "delete-failed", msg, 0);
+        return { content: [{ type: "text", text: `Delete failed: ${msg}` }], isError: true };
+    }
+});
 eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream/error/session/public) are per-session — pass `sessionKey` (preferred) or the legacy `sessionId` alias to retrieve a single session's log from first [spawn] to final [process-exit]. type=agent-stream: per-session tool-use/tool-result archive (every `[tool-use]` and `[tool-result]` pair with full input + output JSON, plus raw Claude stream-json, agent events, and MCP server stderr via tee). USE THIS when investigating what an agent ACTUALLY did with its tools — server.log only carries `[persist] tool-call persisted` markers, not bodies. (`type=system` is a backwards-compatible alias for the same archive.) type=session: SSE events sent to client. type=error: Claude subprocess stderr (raw — NODE_DEBUG HTTP/NET/UNDICI traces land in agent-stream via the stream tee, not here). type=heartbeat: platform event dispatcher (check-due-events cron). type=public: public agent diagnostic log. type=server: platform server log. type=mcp: MCP server stderr (per-plugin raw), resolved under ~/.<brand>/logs — the platform config dir, not the account log dir. With a sessionKey, every mcp-*.log whose FILENAME carries that key is tailed, up to 20 files, and a truncated reply names the total that matched; an 8-character key prefix matches. The key is never matched against file contents, because MCP log lines carry no session key. type=vnc: VNC browser viewer lifecycle.", {
     type: z.enum(["agent-stream", "system", "session", "error", "heartbeat", "public", "server", "mcp", "vnc"]).optional(),
     lines: z.number().optional(),