@rubytech/create-maxy-code 0.1.542 → 0.1.543

package/payload/platform/services/claude-session-manager/dist/fs-watcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs-watcher.d.ts","sourceRoot":"","sources":["../src/fs-watcher.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAIvD,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,eAAe,EAErB,MAAM,oBAAoB,CAAA;AAsC3B,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAA;AACpD;;;;;;;;gCAQgC;AAChC,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAA;AAE7D,MAAM,WAAW,UAAU;IACzB;;mDAE+C;IAC/C,SAAS,EAAE,MAAM,CAAA;IACjB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B;mEAC+D;IAC/D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;qCAIiC;IACjC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB;;;;;2EAKuE;IACvE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,SAAS,CAAA;IACjB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;qBAOiB;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAW7B,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,+DAA+D;IAC/D,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB;;wBAEoB;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB;;oDAEgD;IAChD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;;;;;mBAOe;IACf,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC;2BACuB;IACvB,MAAM,EAAE,OAAO,CAAA;IACf;;;;yCAIqC;IACrC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACpC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAA;IACvB,GAAG,EAAE,UAAU,GAAG,IAAI,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAA;AAEtD,MAAM,WAAW,SAAS;IACxB,QAAQ,IAAI,IAAI,CAAA;IAChB,GAAG,IAAI,IAAI,CAAA;IACX,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,IAAI,CAAA;IACtC,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IAClD,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IACxD,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IAC7C,GAAG,IAAI,UAAU,EAAE,CAAA;IACnB;;;;;;;+EAO2E;IAC3E,eAAe,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IAC3D,6EAA6E;IAC7E,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/D;;;;;;4CAMwC;IACxC,oBAAoB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3D;;;;;;;;;mDAS+C;IAC/C,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1C,KAAK,IAAI,IAAI,CAAA;IACb;;;;2EAIuE;IACvE,UAAU,EAAE;QACV,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACpC,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KACvC,CAAA;CACF;AAyDD,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd;;;;sFAIkF;IAClF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;6EAIyE;IACzE,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B;;8EAE0E;IAC1E,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B;;+EAE2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,SAAS,CA22BZ"}
+{"version":3,"file":"fs-watcher.d.ts","sourceRoot":"","sources":["../src/fs-watcher.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAI5D,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,eAAe,EAErB,MAAM,oBAAoB,CAAA;AAsC3B,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAA;AACpD;;;;;;;;gCAQgC;AAChC,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAA;AAE7D,MAAM,WAAW,UAAU;IACzB;;mDAE+C;IAC/C,SAAS,EAAE,MAAM,CAAA;IACjB,0EAA0E;IAC1E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,wEAAwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B;mEAC+D;IAC/D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;qCAIiC;IACjC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB;;;;;2EAKuE;IACvE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,EAAE,SAAS,CAAA;IACjB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;qBAOiB;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAW7B,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,+DAA+D;IAC/D,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;IACtB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB;;wBAEoB;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB;;oDAEgD;IAChD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;;;;;mBAOe;IACf,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC;2BACuB;IACvB,MAAM,EAAE,OAAO,CAAA;IACf;;;;yCAIqC;IACrC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACpC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAA;IACvB,GAAG,EAAE,UAAU,GAAG,IAAI,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAA;AAEtD,MAAM,WAAW,SAAS;IACxB,QAAQ,IAAI,IAAI,CAAA;IAChB,GAAG,IAAI,IAAI,CAAA;IACX,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,IAAI,CAAA;IACtC,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IAClD,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IACxD,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IAC7C,GAAG,IAAI,UAAU,EAAE,CAAA;IACnB;;;;;;;+EAO2E;IAC3E,eAAe,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IAC3D,6EAA6E;IAC7E,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/D;;;;;;4CAMwC;IACxC,oBAAoB,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3D;;;;;;;;;mDAS+C;IAC/C,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1C,KAAK,IAAI,IAAI,CAAA;IACb;;;;2EAIuE;IACvE,UAAU,EAAE;QACV,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACpC,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KACvC,CAAA;CACF;AAyDD,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd;;;;sFAIkF;IAClF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;6EAIyE;IACzE,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B;;8EAE0E;IAC1E,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B;;+EAE2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,SAAS,CA22BZ"}

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts

@@ -1,6 +1,8 @@
 import { Hono } from 'hono';
+import type { AgentRole } from './types.js';
 import { type SpawnDeps } from './pty-spawner.js';
 import type { PtyCensusSnapshot } from './pty-census.js';
+import type { RoleCensus } from './role-census.js';
 import type { FsWatcher } from './fs-watcher.js';
 import type { SubagentInjectionTail } from './subagent-injection-tail.js';
 import type { RateLimiter } from './spawn-rate-limiter.js';
@@ -9,6 +11,35 @@ import { AccountTitleStores } from './account-title-stores.js';
 import { WaChannelStore } from './wa-channel-store.js';
 import { WebchatChannelStore } from './webchat-channel-store.js';
 import { TelegramChannelStore } from './telegram-channel-store.js';
+/** Task 2325 — the rc-spawn role, as supplied by the request body. Task 1468
+ *  widened this position to allow `undefined` because rc-spawn's role was
+ *  absent for a non-admin/non-public request; null now means "the body named
+ *  none", and the handler resolves it against the prior sidecar before
+ *  deciding whether that is an error. `passive` is not accepted here:
+ *  rc-spawn composes no persona at all (its --append-system-prompt segments
+ *  are reseat / voice / specialist-domains / authenticated-identity
+ *  fragments, never composeAppendSystemPrompt). */
+export declare function parseRcSpawnRole(body: {
+    role?: unknown;
+}): Extract<AgentRole, 'admin' | 'public'> | null;
+/** Task 2325 — the single place a /public-spawn wire role becomes a typed one.
+ *  Returns the wire role (always 'admin' or 'public', narrowed by the ROLES
+ *  allowlist above) and the persona role the spawn composes from. They differ
+ *  only for a passive spawn. Anything the allowlist does not name returns null
+ *  and the caller refuses; nothing falls through to 'admin'.
+ *
+ *  The passive condition reproduces the Task 1483 invariant exactly, moved
+ *  here from pty-spawner: a passive spawn rides `role:'public'` on the wire
+ *  and is never a specialist, so a passive flag on any other role or on a
+ *  specialist is ignored rather than silently registering a different (e.g.
+ *  full-admin) server surface while the allowlist locks to work-create. */
+export declare function parseSpawnRole(body: {
+    role?: unknown;
+    passive?: unknown;
+}, specialist: string | undefined): {
+    role: AgentRole;
+    agentRole: AgentRole;
+} | null;
 export declare const SESSION_ID_PATTERN: RegExp;
 export declare const RC_SPAWN_URL_WAIT_DEFAULT_MS = 60000;
 export interface HttpDeps extends Omit<SpawnDeps, 'onSessionReady' | 'watcher'> {
@@ -37,6 +68,10 @@ export interface HttpDeps extends Omit<SpawnDeps, 'onSessionReady' | 'watcher'>
      *  the live /rc-spawn handler) keep working unchanged; production index.ts
      *  always injects it. */
     webchatChannelStore?: WebchatChannelStore;
+    /** Task 2325 — the standing per-role spawn census. Optional so the existing
+     *  test deps factories keep working unchanged; production index.ts always
+     *  injects it. */
+    roleCensus?: RoleCensus;
     /** Per-session telegram channel binding, the telegram twin of
      *  webchatChannelStore. Optional for the same reason: test deps factories
      *  that run the live /rc-spawn handler keep working unchanged; production

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAkB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAoBxD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AAkED;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAg0GpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAa3B,OAAO,KAAK,EAAU,SAAS,EAAW,MAAM,YAAY,CAAA;AAK5D,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAoBlD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAQlE;;;;;;;mDAOmD;AACnD,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAE/C;AAED;;;;;;;;;;2EAU2E;AAC3E,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,IAAI,CAOlD;AAsFD,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;sBAEkB;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AAkED;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAw5GpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -59,7 +59,40 @@ import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathF
 import { basename, dirname, join } from 'node:path';
 import { validateUserTitle } from './user-title-store.js';
 import { credentialsPathForConfigDir, snapshotAuthForFailureReason } from './auth-snapshot.js';
+// Task 2325 — the wire subset of AgentRole. `passive` is a persona role
+// resolved at the /public-spawn boundary from role:'public' plus the passive
+// flag; it is deliberately absent here so no client can POST it directly.
 const ROLES = ['admin', 'public'];
+/** Task 2325 — the rc-spawn role, as supplied by the request body. Task 1468
+ *  widened this position to allow `undefined` because rc-spawn's role was
+ *  absent for a non-admin/non-public request; null now means "the body named
+ *  none", and the handler resolves it against the prior sidecar before
+ *  deciding whether that is an error. `passive` is not accepted here:
+ *  rc-spawn composes no persona at all (its --append-system-prompt segments
+ *  are reseat / voice / specialist-domains / authenticated-identity
+ *  fragments, never composeAppendSystemPrompt). */
+export function parseRcSpawnRole(body) {
+    return body.role === 'admin' || body.role === 'public' ? body.role : null;
+}
+/** Task 2325 — the single place a /public-spawn wire role becomes a typed one.
+ *  Returns the wire role (always 'admin' or 'public', narrowed by the ROLES
+ *  allowlist above) and the persona role the spawn composes from. They differ
+ *  only for a passive spawn. Anything the allowlist does not name returns null
+ *  and the caller refuses; nothing falls through to 'admin'.
+ *
+ *  The passive condition reproduces the Task 1483 invariant exactly, moved
+ *  here from pty-spawner: a passive spawn rides `role:'public'` on the wire
+ *  and is never a specialist, so a passive flag on any other role or on a
+ *  specialist is ignored rather than silently registering a different (e.g.
+ *  full-admin) server surface while the allowlist locks to work-create. */
+export function parseSpawnRole(body, specialist) {
+    const raw = body.role;
+    if (typeof raw !== 'string' || !ROLES.includes(raw))
+        return null;
+    const role = raw;
+    const agentRole = body.passive === true && role === 'public' && specialist === undefined ? 'passive' : role;
+    return { role, agentRole };
+}
 const CHANNELS = ['browser', 'whatsapp', 'telegram', 'webchat', 'email'];
 // Task 382 — body.conversationNodeId shape gate. The value is the
 // sessionId UUID (v4) minted by createNewAdminConversation in
@@ -1037,12 +1070,21 @@ export function buildHttpApp(deps) {
         const userId = typeof body.userId === 'string' && body.userId.length > 0 && body.userId.length <= 128
             ? body.userId
             : undefined;
-        const role = typeof body.role === 'string' ? body.role : '';
         const channel = typeof body.channel === 'string' ? body.channel : '';
         const hidden = body.hidden === true;
         const specialist = typeof body.specialist === 'string' && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist)
             ? body.specialist
             : undefined;
+        // Task 2325 — one parse, before any other use of the role. `role` is what
+        // arrived on the wire; `agentRole` is which persona it resolves to. They
+        // differ only for a passive spawn. `role` keeps its string-or-empty shape
+        // so every existing read of it, including the spawn-request log line's
+        // `role=${role || 'missing'}`, is unchanged.
+        const parsedRole = parseSpawnRole(body, specialist);
+        const role = parsedRole?.role ?? '';
+        const agentRole = parsedRole?.agentRole ?? null;
+        // Task 2325 — recorded before the guard so a refused spawn is counted.
+        deps.roleCensus?.record(agentRole);
         // Task 956 — public sessions are pinned to Sonnet 5 (operator decision:
         // admin-only Bypass/Opus; public stays Sonnet + fail-closed dontAsk). The
         // role==='public' force is the chokepoint covering every public spawn
@@ -1152,7 +1194,15 @@ export function buildHttpApp(deps) {
             : body.dormantPlugins == null ? 'absent' : typeof body.dormantPlugins;
         const initialMessageBytes = typeof body.initialMessage === 'string' ? Buffer.byteLength(body.initialMessage, 'utf8') : 0;
         deps.logger(`spawn-request senderId=${senderId || 'missing'} userId=${userId ? userId.slice(0, 8) : 'absent'} role=${role || 'missing'} channel=${channel || 'missing'} permissionMode=${typeof body.permissionMode === 'string' ? body.permissionMode : 'default'} channels=${Array.isArray(body.channels) ? body.channels.length : 0} attachmentDir=${typeof body.attachmentDir === 'string' ? 'set' : 'absent'} aboutOwner=${aboutOwnerShape} dormantPlugins=${dormantPluginsShape} tunnelUrl=${typeof body.tunnelUrl === 'string' ? 'set' : (body.tunnelUrl === null ? 'null' : 'absent')} initialMessageBytes=${initialMessageBytes}`);
-        if (!senderId || !ROLES.includes(role) || !CHANNELS.includes(channel)) {
+        if (!senderId || parsedRole === null || agentRole === null || !CHANNELS.includes(channel)) {
+            // Task 2325 — emitted only when the ROLE is what failed. The guard also
+            // covers a missing senderId and a bad channel, and naming those
+            // `role-unresolved` would make the line lie about its own cause, which
+            // is the exact defect class this task exists to remove. The 400 body
+            // below still reports all three fields.
+            if (parsedRole === null) {
+                deps.logger(`[spawn] op=role-unresolved sessionId=new role=${typeof body.role === 'string' ? body.role : String(body.role)} site=public-spawn`);
+            }
             timed(deps.logger, 'POST', '/public-spawn', 400, Date.now() - start);
             return c.json({ error: 'invalid-arguments', detail: { senderId: !!senderId, role, channel } }, 400);
         }
@@ -1282,7 +1332,7 @@ export function buildHttpApp(deps) {
                 if (!passive) {
                     // Task 2271 — `spawnCwd` here is the re-scoped value, so the audit
                     // follows a public-agent session into its own account's slug.
-                    attachPublicAudit(deps, tracker.sessionId, role, spawnCwd);
+                    attachPublicAudit(deps, tracker.sessionId, parsedRole.role, spawnCwd);
                     // Task 2262 — the exit notify is webchat machinery: the route it
                     // calls resolves the sessionId against the WEBCHAT gateway's
                     // publicSessions map to fire a slice-review, so a WhatsApp public
@@ -1292,7 +1342,7 @@ export function buildHttpApp(deps) {
                     // because a WhatsApp visitor's realised tool surface is exactly what
                     // Task 2260 wants audited.
                     if (channel !== 'whatsapp') {
-                        attachPublicExitNotify(tracker.sessionId, role, deps.logger);
+                        attachPublicExitNotify(tracker.sessionId, parsedRole.role, deps.logger);
                     }
                 }
                 attachSpecialistEndTurnAutoArchive(deps, tracker.sessionId, tracker.specialist);
@@ -1304,7 +1354,10 @@ export function buildHttpApp(deps) {
         }, {
             senderId,
             userId,
-            role: role,
+            // Task 2325 — the PERSONA role the spawn composes from, resolved by
+            // the boundary parse above. No cast: `agentRole` is non-null past the
+            // guard. The wire role stays on the sidecar (pty-spawner maps it back).
+            role: agentRole,
             channel: channel,
             channels,
             permissionMode,
@@ -1326,7 +1379,6 @@ export function buildHttpApp(deps) {
             waChannel,
             ...sessionIdFields,
             previousContext,
-            passive,
             targetAccountId,
             // Task 2271 — the RESOLVED variable, not the parsed field: when the
             // same-slug rule declines the re-scope, the sidecar stays at the house
@@ -2692,7 +2744,11 @@ export function buildHttpApp(deps) {
         // session-end review) supply no channel and get no sidecar. Task 852 widens
         // the accepted role to 'public' (authenticated-public WhatsApp person) and
         // the sidecar records the actual role.
-        const rcRole = body.role === 'admin' || body.role === 'public' ? body.role : undefined;
+        // Task 2325 — the BODY's role. Null when absent or unrecognised. A
+        // channel-bound resume legitimately omits it and inherits from its prior
+        // sidecar, so the refusal is not here; it is where both sources have been
+        // consulted, just below `priorSidecar`.
+        const rcRole = parseRcSpawnRole(body);
         const adminChannel = typeof body.channel === 'string' && CHANNELS.includes(body.channel)
             ? body.channel
             : undefined;
@@ -3035,11 +3091,46 @@ export function buildHttpApp(deps) {
         // yields null; the gate degrades to the not-resolvable identity form.
         // Task 1214 — widened from webchat-only to any channel-bound session so the
         // admin-role signal resolves for WhatsApp/Telegram resumes that omit role
-        // too (the voice-contract gate below keys on `adminBinding`). Every
-        // channel-less resume still skips the disk touch.
-        const priorSidecar = sessionId && (effectiveWebchatChannel || effectiveWaChannel || effectiveTelegramChannel)
+        // too (the voice-contract gate below keys on `adminBinding`).
+        // Task 2325 — widened again to EVERY resume, channel-bound or not, so the
+        // role can be inherited from disk before the refusal below. The dropped
+        // "channel-less resumes skip the disk touch" optimisation cost one small
+        // readFileSync on a path that then spawns a PTY. Without it, the bare
+        // `{ sessionId }` resumes that wedged-session recovery (index.ts, the
+        // recoverWedgedSession resumeSpawn) and the re-seat route send would be
+        // refused for carrying no role, when their role has been on disk all along.
+        const priorSidecar = sessionId
             ? readSidecar(sidecarPathForSessionId(effectiveAccountDir, sessionId), deps.logger).sidecar
             : null;
+        // Task 2325 — the session's role, from the body or inherited from disk.
+        // The refusal sits here rather than at the body parse because an absent
+        // `role` has THREE legitimate readings and only one of them is an error:
+        //   1. a channel-bound resume, which inherits from `priorSidecar` (Task
+        //      2260's own words: "a resume omits `role` in the body");
+        //   2. a one-shot admin job, which is not a channel conversation — those
+        //      now pass role:'admin' and are told apart by their absent `channel`,
+        //      which is what the classification-sidecar gate below reads;
+        //   3. a caller that simply supplied none on a FRESH spawn, which is the
+        //      error. Before this it became `undefined` and rode on, and
+        //      `sessionRole=undefined` was documented (Task 1468) as a value to
+        //      preserve rather than treated as a fault.
+        //
+        // The `mode === 'fresh'` half of the gate is load-bearing, not caution. A
+        // resume that inherits nothing is the claude.ai/code bridge: the bare
+        // admin-host branch of session-rc-spawn.ts posts `{ sessionId, name }`
+        // with no role and no channel, and wedged-session recovery posts
+        // `{ sessionId }`. Both resume a session whose role predates the request.
+        // Refusing them would take out a core operator surface to close a hole
+        // that only a fresh spawn can open: a resume composes no new persona,
+        // and rc-spawn composes none at all.
+        const effectiveRcRole = rcRole ?? priorSidecar?.role ?? null;
+        // Task 2325 — recorded before the refusal so a refused spawn is counted.
+        deps.roleCensus?.record(effectiveRcRole);
+        if (effectiveRcRole === null && mode === 'fresh') {
+            deps.logger(`[rc-spawn] op=role-unresolved sessionId=${sessionId ? sessionId.slice(0, 8) : 'new'} role=${String(body.role)} site=rc-spawn`);
+            timed(deps.logger, 'POST', '/rc-spawn', 400, Date.now() - start);
+            return c.json({ error: 'invalid-arguments', detail: { role: body.role ?? null } }, 400);
+        }
         // Task 850 — assemble the bound target set and choose the channel server:
         //   - ≥2 kinds: ONE unified `channel` server (one reply tool fanning to every
         //     target's existing gateway endpoint). The mature per-kind servers are
@@ -3136,7 +3227,9 @@ export function buildHttpApp(deps) {
                     gatewayUrl: effectiveTelegramChannel.gatewayUrl,
                     serverPath: effectiveTelegramChannel.serverPath,
                     nodeBin: deps.nodeBin,
-                    role: rcRole,
+                    // Task 2325 — the body role, unchanged in meaning; `?? undefined`
+                    // only bridges null to the optional parameter this builder declares.
+                    role: rcRole ?? undefined,
                 });
                 telegramPath = telegramChannelMcpConfigPath(sessionId, tmpdir());
                 try {
@@ -3159,7 +3252,7 @@ export function buildHttpApp(deps) {
         // which is every public spawn that can reply. Pushed after the channel argv
         // so `--strict-mcp-config` leaves exactly the per-spawn channel server
         // registered; `admin` and roleless spawns produce byte-identical argv.
-        const effectiveRcRole = rcRole ?? priorSidecar?.role;
+        // Task 2325 — resolved once, above, beside the refusal.
         const publicLockdown = effectiveRcRole === 'public' ? buildRcPublicLockdownArgv(channelServerName) : null;
         if (publicLockdown) {
             // A re-seat fork pushes its own caller-picked --permission-mode above,
@@ -3279,6 +3372,12 @@ export function buildHttpApp(deps) {
         // (effectiveAccountId !== house) spawns — fail-closed, no escalation.
         const acctIsHouse = isHouseAccount(deps.platformRoot, effectiveAccountId);
         const rcHouseAdminScope = houseAdminScopeFor({
+            // Task 2325 — the BODY's role, deliberately not `effectiveRcRole`. A
+            // resume that omits the role has never carried house scope (its old
+            // `undefined` was cast and failed the `role === 'admin'` test), and
+            // switching to the inherited role here would newly grant cross-account
+            // authority to every admin channel resume. That gap is real and
+            // pre-existing; deciding it is not this task's scope.
             role: rcRole,
             accountId: effectiveAccountId,
             isHouse: acctIsHouse,
@@ -3290,7 +3389,12 @@ export function buildHttpApp(deps) {
         // line makes the rc-spawn decision greppable per spawn.
         deps.logger(formatHouseScopeInjectLine({
             sessionId,
-            sessionRole: rcRole,
+            // Task 2325 — the session's role, so this line can no longer render
+            // `sessionRole=undefined`. A resume that inherits no role renders the
+            // explicit token `none`, matching the idiom this handler already uses
+            // for the same value below. A stringified absence read as a formatting
+            // artefact, which is how an unnamed role stayed invisible for two tasks.
+            sessionRole: effectiveRcRole ?? 'none',
             acctIsHouse,
             inject: rcHouseAdminScope !== null,
         }));
@@ -3509,18 +3613,31 @@ export function buildHttpApp(deps) {
         // when one exists. Non-fatal: the PTY here is already serving a live thread —
         // a failed classification sidecar must not tear it down, so it logs and the
         // session keeps running (the pre-fix reader-blind behaviour, no worse).
-        const classifyChannel = rcRole !== undefined ? adminChannel : undefined;
+        // Task 2325 — the sidecar is written for a channel conversation. What
+        // distinguishes one from a one-shot admin job is the CHANNEL, not whether
+        // a role was supplied: the LinkedIn ingest and the public session-end
+        // review are role:'admin' and pass no channel, and they still get no
+        // sidecar. Before this the absent role carried both meanings at once.
+        const classifyChannel = adminChannel;
         const classifySenderId = adminSenderId ?? effectiveWaChannel?.senderId ?? effectiveWebchatChannel?.key ?? effectiveTelegramChannel?.senderId;
-        if (sessionId && classifyChannel && classifySenderId) {
+        // Task 2325 — `effectiveRcRole !== null` joins the guard rather than being
+        // cast away. The sidecar's `role` is read back through an allowlist that
+        // rejects the whole row on a bad value, so a session with no resolvable
+        // role gets NO sidecar rather than one recording an absence.
+        if (sessionId && classifyChannel && classifySenderId && effectiveRcRole !== null) {
             const classifySidecarPath = sidecarPathForSessionId(effectiveAccountDir, sessionId);
             if (!existsSync(classifySidecarPath)) {
                 try {
                     writeSidecar(classifySidecarPath, {
                         senderId: classifySenderId,
-                        // Task 852 — the actual role from the body ('admin' | 'public'),
-                        // not a hardcoded 'admin'; rcRole is defined whenever
-                        // classifyChannel is.
-                        role: rcRole,
+                        // Task 852 — the actual role, not a hardcoded 'admin'. Task 2325
+                        // — the effective role (body, else inherited from disk),
+                        // non-null by the guard above. The old
+                        // `rcRole as 'admin' | 'public'` relied on this gate being
+                        // role-derived; the gate now reads the channel, so without the
+                        // guard a resume with a channel and no body role would have
+                        // written a cast `undefined` into the sidecar.
+                        role: effectiveRcRole,
                         channel: classifyChannel,
                         url: null,
                         startedAt: new Date().toISOString(),