@rubytech/create-maxy-code 0.1.542 → 0.1.544

package/payload/platform/plugins/admin/hooks/__tests__/public-tool-surface.test.sh

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+# Regression test for public-tool-surface.sh (Task 2339).
+#
+# The hook records the tool surface a public spawn REALISES: one line per tool
+# call classified against that spawn's own --allowed-tools set, and a per-turn
+# census. It is observability only and must never block, so every case here
+# asserts exit 0 as well as the emitted line.
+
+set -u
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/public-tool-surface.sh"
+if [[ ! -x "$HOOK" ]]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+ok()  { echo "PASS: $1"; PASS=$((PASS+1)); }
+bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL+1)); }
+
+SID=aa11bb22-cccc-dddd-eeee-ffff00001111
+ALLOW='mcp__whatsapp-channel__reply'
+
+# newlog -> prints a fresh LOG_DIR
+newlog() { local d; d=$(mktemp -d); printf '%s' "$d"; }
+
+# fire <logdir> <env-allowlist|-> <stdin-json> -> prints exit code; log at $1/server.log
+fire() {
+  local d="$1" allow="$2" input="$3" rc
+  if [[ "$allow" == "-" ]]; then
+    printf '%s' "$input" | env -u MAXY_PUBLIC_ALLOWED_TOOLS LOG_DIR="$d" bash "$HOOK" >/dev/null 2>&1
+  else
+    printf '%s' "$input" | env MAXY_PUBLIC_ALLOWED_TOOLS="$allow" LOG_DIR="$d" bash "$HOOK" >/dev/null 2>&1
+  fi
+  rc=$?
+  printf '%s' "$rc"
+}
+
+pre()  { printf '{"hook_event_name":"PreToolUse","tool_name":"%s","session_id":"%s"}' "$1" "$SID"; }
+stop() { printf '{"hook_event_name":"Stop","session_id":"%s"}' "$SID"; }
+ups()  { printf '{"hook_event_name":"UserPromptSubmit","session_id":"%s","prompt":"hi"}' "$SID"; }
+
+# --- 1. allowed tool -------------------------------------------------------
+D=$(newlog)
+RC=$(fire "$D" "$ALLOW" "$(pre "$ALLOW")")
+if [[ "$RC" == "0" ]]; then ok "allowed tool exits 0"; else bad "allowed tool exit $RC"; fi
+if /usr/bin/grep -qF "[public-surface] op=tool-realised sessionId=aa11bb22 tool=$ALLOW allowed=y" "$D/server.log"; then
+  ok "allowed tool logs allowed=y"
+else
+  bad "allowed=y line absent"
+fi
+
+# --- 2. disallowed native tool ---------------------------------------------
+D=$(newlog)
+RC=$(fire "$D" "$ALLOW" "$(pre Bash)")
+if [[ "$RC" == "0" ]]; then ok "disallowed tool exits 0"; else bad "disallowed tool exit $RC"; fi
+if /usr/bin/grep -qF "[public-surface] op=tool-realised sessionId=aa11bb22 tool=Bash allowed=n" "$D/server.log"; then
+  ok "disallowed tool logs allowed=n"
+else
+  bad "allowed=n line absent"
+fi
+
+# --- 3. no env stamp -> silent ---------------------------------------------
+D=$(newlog)
+RC=$(fire "$D" "-" "$(pre Bash)")
+if [[ "$RC" == "0" ]]; then ok "unstamped session exits 0"; else bad "unstamped exit $RC"; fi
+if [[ ! -f "$D/server.log" ]]; then ok "unstamped session writes nothing"; else bad "unstamped session wrote a log"; fi
+
+# --- 4. census with zero calls ---------------------------------------------
+D=$(newlog)
+RC=$(fire "$D" "$ALLOW" "$(stop)")
+if [[ "$RC" == "0" ]]; then ok "zero-call census exits 0"; else bad "zero-call census exit $RC"; fi
+if /usr/bin/grep -qF "[public-surface] op=realised-census sessionId=aa11bb22 calls=0 disallowed=0" "$D/server.log"; then
+  ok "census is emitted at zero"
+else
+  bad "zero census absent"
+fi
+
+# --- 5. census after one allowed and one disallowed call -------------------
+D=$(newlog)
+fire "$D" "$ALLOW" "$(pre "$ALLOW")" >/dev/null
+fire "$D" "$ALLOW" "$(pre Bash)" >/dev/null
+fire "$D" "$ALLOW" "$(stop)" >/dev/null
+if /usr/bin/grep -qF "[public-surface] op=realised-census sessionId=aa11bb22 calls=2 disallowed=1" "$D/server.log"; then
+  ok "census counts calls and disallowed"
+else
+  bad "census counts wrong"
+fi
+if [[ -z "$(ls -A "$D/public-surface" 2>/dev/null)" ]]; then
+  ok "census removes the tally"
+else
+  bad "tally survived the census"
+fi
+
+# --- 6. a second turn starts from zero -------------------------------------
+D=$(newlog)
+fire "$D" "$ALLOW" "$(pre Bash)" >/dev/null
+fire "$D" "$ALLOW" "$(stop)" >/dev/null
+fire "$D" "$ALLOW" "$(stop)" >/dev/null
+if [[ "$(/usr/bin/grep -cF 'op=realised-census sessionId=aa11bb22 calls=0 disallowed=0' "$D/server.log")" == "1" ]]; then
+  ok "the turn after a census starts from zero"
+else
+  bad "second census did not reset"
+fi
+
+# --- 7. unparseable stdin --------------------------------------------------
+D=$(newlog)
+RC=$(fire "$D" "$ALLOW" 'not json at all')
+if [[ "$RC" == "0" ]]; then ok "unparseable stdin exits 0"; else bad "unparseable stdin exit $RC"; fi
+if [[ ! -f "$D/server.log" ]]; then ok "unparseable stdin writes nothing"; else bad "unparseable stdin wrote a log"; fi
+
+# --- 8. a tool name containing a glob is compared literally -----------------
+D=$(newlog)
+RC=$(fire "$D" "$ALLOW" "$(pre '*')")
+if /usr/bin/grep -qF "tool=* allowed=n" "$D/server.log"; then
+  ok "a glob tool name is compared literally, not expanded"
+else
+  bad "glob tool name mishandled"
+fi
+
+# --- 9. multi-entry allowlist ----------------------------------------------
+D=$(newlog)
+fire "$D" "Read,$ALLOW" "$(pre Read)" >/dev/null
+if /usr/bin/grep -qF "tool=Read allowed=y" "$D/server.log"; then
+  ok "membership matches any entry of a multi-entry allowlist"
+else
+  bad "multi-entry allowlist mismatch"
+fi
+
+# --- 10. absent session_id still emits -------------------------------------
+D=$(newlog)
+fire "$D" "$ALLOW" '{"hook_event_name":"PreToolUse","tool_name":"Bash"}' >/dev/null
+if /usr/bin/grep -qF "sessionId=none tool=Bash allowed=n" "$D/server.log"; then
+  ok "a call with no session_id is still recorded"
+else
+  bad "no-session call was silent"
+fi
+
+# --- 11. a killed turn leaves no residue in the next turn's census ---------
+# The stuck-turn recycler kills a wedged PTY and resumes the SAME sessionId, so
+# the killed turn's Stop never fires. Without a turn-start reset its tally is
+# inherited and the next census over-counts, which is exactly the number the
+# task's verification asserts against that turn's tool_use count.
+D=$(newlog)
+for t in Bash Read ToolSearch; do fire "$D" "$ALLOW" "$(pre "$t")" >/dev/null; done
+# no Stop: the turn was killed here.
+fire "$D" "$ALLOW" "$(ups)" >/dev/null
+fire "$D" "$ALLOW" "$(pre "$ALLOW")" >/dev/null
+fire "$D" "$ALLOW" "$(stop)" >/dev/null
+if /usr/bin/grep -qF "op=realised-census sessionId=aa11bb22 calls=1 disallowed=0" "$D/server.log"; then
+  ok "a killed turn's tally does not leak into the next turn's census"
+else
+  bad "census inherited a killed turn's tally"
+fi
+
+# --- 12. the turn-start reset is silent and never blocks --------------------
+D=$(newlog)
+RC=$(fire "$D" "$ALLOW" "$(ups)")
+if [[ "$RC" == "0" ]]; then ok "turn-start reset exits 0"; else bad "turn-start reset exit $RC"; fi
+if [[ ! -f "$D/server.log" ]]; then ok "turn-start reset writes no log line"; else bad "turn-start reset wrote a log line"; fi
+
+echo "----"
+echo "PASS=$PASS FAIL=$FAIL"
+# The count is asserted, not just the failures: a case that stops running leaves
+# a green suite that tested less than it claims, and .husky/pre-commit reads only
+# the exit status.
+EXPECTED=19
+if [[ $((PASS+FAIL)) -ne "$EXPECTED" ]]; then
+  echo "FAIL: expected $EXPECTED cases, ran $((PASS+FAIL))" >&2
+  exit 1
+fi
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/public-tool-surface.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# public-tool-surface.sh — Task 2339. Records the tool surface a public spawn
+# REALISES: one line per tool call, plus a per-turn census.
+#
+# `tool-allowlist` (rc-public-lockdown.ts, pty-spawner.ts) records the surface a
+# spawn was GIVEN. `[public-surface] op=audit` (public-surface-audit.ts)
+# reconciles MCP server names from spawn-tee filenames, so it is structurally
+# blind to Read, Bash, Skill and ToolSearch: those spawn no MCP child and write
+# no tee file. On 2026-08-01 five such tools ran in a session spawned with a
+# one-tool allowlist and produced no log line at all.
+#
+# Registered on the matcher-less PreToolUse entry (which matches every tool,
+# native and MCP alike) and on the Stop entry. Fires only when
+# MAXY_PUBLIC_ALLOWED_TOOLS is set, which both spawn paths stamp for
+# role='public' only.
+#
+# Observability only: never blocks, exits 0 on every path, and writes to
+# server.log alone — a public visitor's PTY gains no new output.
+
+set -uo pipefail
+
+# No stamp means this is not a public spawn. Silent, and the common case.
+[ -n "${MAXY_PUBLIC_ALLOWED_TOOLS:-}" ] || exit 0
+
+# Log destination. LOG_DIR is stamped on the rc-spawn path and is brand-correct;
+# MAXY_HOOK_SERVER_LOG is the override post-tool-use-agent.sh already honours;
+# the literal is that hook's own default.
+if [ -n "${LOG_DIR:-}" ]; then
+  : "${MAXY_HOOK_SERVER_LOG:=$LOG_DIR/server.log}"
+fi
+: "${MAXY_HOOK_SERVER_LOG:=$HOME/.maxy-code/logs/server.log}"
+TALLY_DIR="$(dirname "$MAXY_HOOK_SERVER_LOG")/public-surface"
+
+emit() {
+  mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null || true
+  printf '%s\n' "$1" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
+}
+
+# No stdin (tty) — no call to classify. Fail-open.
+[ -t 0 ] && exit 0
+INPUT=$(cat)
+[ -n "$INPUT" ] || exit 0
+
+PARSED=$(printf '%s' "$INPUT" | python3 -c '
+import sys, json
+try:
+    d = json.load(sys.stdin)
+except Exception:
+    sys.exit(1)
+if not isinstance(d, dict):
+    sys.exit(1)
+def s(k):
+    v = d.get(k)
+    return v if isinstance(v, str) else ""
+print(s("hook_event_name"))
+print(s("tool_name"))
+print(s("session_id"))
+' 2>/dev/null) || exit 0
+
+{ IFS= read -r EVENT; IFS= read -r TOOL; IFS= read -r SID; } <<EOF
+$PARSED
+EOF
+EVENT="${EVENT:-}"
+TOOL="${TOOL:-}"
+SID="${SID:-}"
+
+# The 8-character form used by every other session-scoped line. An envelope with
+# no session_id still emits: a public session must never be silent, and `none`
+# is visibly not an id.
+SID8="${SID:0:8}"
+[ -n "$SID8" ] || SID8=none
+# Tally filename. Sanitised the way the rc-spawn channel-config writers sanitise
+# theirs, so no session id can escape the directory.
+KEY=$(printf '%s' "${SID:-none}" | tr -c 'A-Za-z0-9_-' '_')
+
+if [ "$EVENT" = "UserPromptSubmit" ]; then
+  # Turn start. Drop any tally left by a turn that never reached Stop — the
+  # stuck-turn recycler kills a wedged PTY and resumes the SAME sessionId, so
+  # that turn's Stop never fires and its tally would otherwise be counted into
+  # the next turn's census. Silent: the reset is not itself an observation.
+  rm -f "$TALLY_DIR/$KEY" 2>/dev/null || true
+  exit 0
+fi
+
+if [ "$EVENT" = "PreToolUse" ]; then
+  [ -n "$TOOL" ] || exit 0
+  ALLOWED=n
+  # -f so a tool name or allowlist entry containing a glob character is compared
+  # literally rather than expanded against the cwd.
+  set -f
+  OLDIFS=$IFS
+  IFS=','
+  for t in $MAXY_PUBLIC_ALLOWED_TOOLS; do
+    if [ "$t" = "$TOOL" ]; then ALLOWED=y; break; fi
+  done
+  IFS=$OLDIFS
+  set +f
+  emit "[public-surface] op=tool-realised sessionId=$SID8 tool=$TOOL allowed=$ALLOWED"
+  # Append one line per call rather than read-modify-writing a counter: an
+  # append needs no mutex, a counter would need the one hook-emit.sh carries.
+  mkdir -p "$TALLY_DIR" 2>/dev/null || true
+  printf '%s\n' "$ALLOWED" >>"$TALLY_DIR/$KEY" 2>/dev/null || true
+  exit 0
+fi
+
+if [ "$EVENT" = "Stop" ]; then
+  CALLS=0
+  DIS=0
+  if [ -f "$TALLY_DIR/$KEY" ]; then
+    while IFS= read -r v || [ -n "$v" ]; do
+      [ -n "$v" ] || continue
+      CALLS=$((CALLS+1))
+      if [ "$v" = "n" ]; then DIS=$((DIS+1)); fi
+    done <"$TALLY_DIR/$KEY"
+    rm -f "$TALLY_DIR/$KEY" 2>/dev/null || true
+  fi
+  # Emitted including zero, so a public session with no disallowed call is
+  # distinguishable from one this hook never saw.
+  emit "[public-surface] op=realised-census sessionId=$SID8 calls=$CALLS disallowed=$DIS"
+  exit 0
+fi
+
+exit 0

package/payload/platform/plugins/admin/mcp/dist/tools/agent-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-write.d.ts","sourceRoot":"","sources":["../../src/tools/agent-write.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,gBAAgB,GAChB,iBAAiB,GACjB,QAAQ,GACR,WAAW,CAAC;AAEhB,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA8BD,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CAsDnE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CA4CnE;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB/G"}
+{"version":3,"file":"agent-write.d.ts","sourceRoot":"","sources":["../../src/tools/agent-write.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,gBAAgB,GAChB,iBAAiB,GACjB,QAAQ,GACR,WAAW,CAAC;AAEhB,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA8BD,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CAkEnE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CA4CnE;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB/G"}

package/payload/platform/plugins/admin/mcp/dist/tools/agent-write.js

@@ -62,6 +62,14 @@ export function createAgent(args) {
         writeFileSync(resolve(dir, "SOUL.md"), args.soul);
         writeFileSync(resolve(dir, "KNOWLEDGE.md"), args.knowledge);
         writeFileSync(resolve(dir, "config.json"), `${JSON.stringify(config, null, 2)}\n`);
+        // Task 2342 — the agent's own turn instruction, created empty. Its whole
+        // body becomes the `## Instruction` block of every channel turn this agent
+        // answers. Empty resolves 'absent' at the resolver and refuses the turn,
+        // which is the correct closed state for an agent whose per-turn behaviour
+        // nobody has written yet; before 2342 such a turn silently borrowed
+        // agents/admin/INSTRUCTION.md. Written inside this try with the others so
+        // the rollback below still leaves no half-made agent.
+        writeFileSync(resolve(dir, "INSTRUCTION.md"), "");
     }
     catch (err) {
         // The directory did not exist before this call, so removing it restores the
@@ -70,7 +78,11 @@ export function createAgent(args) {
         rmSync(dir, { recursive: true, force: true });
         throw err;
     }
-    return { ok: true, slug: args.slug, filesWritten: ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md", "config.json"] };
+    return {
+        ok: true,
+        slug: args.slug,
+        filesWritten: ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md", "config.json", "INSTRUCTION.md"],
+    };
 }
 export function updateAgent(args) {
     const verdict = checkAgentSlug(args.slug);

package/payload/platform/plugins/admin/mcp/dist/tools/agent-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-write.js","sourceRoot":"","sources":["../../src/tools/agent-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAoD/D,SAAS,UAAU,CAAC,UAAkB,EAAE,IAAY;IAClD,OAAO,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;mCAEmC;AACnC,SAAS,WAAW,CAClB,IAA6B,EAC7B,IAOC;IAED,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACzB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACxE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzD,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAC1F,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAC9E,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAErF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,IAAI,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACzF,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CACxB,EAAE,EACF;QACE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ;QAC/B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CACF,CAAC;IACF,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC;IAC9E,CAAC;IAED,sEAAsE;IACtE,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gCAAgC,YAAY,EAAE,EAAE,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAErD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrD,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAErF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,4BAA4B,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;IAC9F,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACzF,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACtG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IACD,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC;AAWD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAiB;IAC7D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,uBAAuB,EAAE,IAAI,CAAC,SAAS;KACxC,CAAC;IACF,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;IAErF,MAAM,GAAG,GAAG,oBAAoB,IAAI,CAAC,YAAY,qBAAqB,IAAI,CAAC,IAAI,sBAAsB,IAAI,CAAC,SAAS,EAAE,CAAC;IACtH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,6BAA6B,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-write.js","sourceRoot":"","sources":["../../src/tools/agent-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAoD/D,SAAS,UAAU,CAAC,UAAkB,EAAE,IAAY;IAClD,OAAO,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;mCAEmC;AACnC,SAAS,WAAW,CAClB,IAA6B,EAC7B,IAOC;IAED,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACzB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACxE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzD,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;QAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAC1F,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAC9E,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAErF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,IAAI,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACzF,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CACxB,EAAE,EACF;QACE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ;QAC/B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CACF,CAAC;IACF,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC;IAC9E,CAAC;IAED,sEAAsE;IACtE,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,gCAAgC,YAAY,EAAE,EAAE,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAErD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrD,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACnF,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,oEAAoE;QACpE,0EAA0E;QAC1E,sDAAsD;QACtD,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAErF,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,4BAA4B,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;IAC9F,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACzF,CAAC;IAED,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACtG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IACD,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC;AAWD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAiB;IAC7D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,uBAAuB,EAAE,IAAI,CAAC,SAAS;KACxC,CAAC;IACF,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;IAErF,MAAM,GAAG,GAAG,oBAAoB,IAAI,CAAC,YAAY,qBAAqB,IAAI,CAAC,IAAI,sBAAsB,IAAI,CAAC,SAAS,EAAE,CAAC;IACtH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,6BAA6B,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,CAAC;AACH,CAAC"}

package/payload/platform/plugins/admin/skills/channel-instruction/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: channel-instruction
+description: "Set up or change what this account's agent does with an incoming channel message. Triggers when the owner says 'set up what my agent does with incoming messages', 'change how you handle WhatsApp messages', 'write my channel instruction', 'my agent replied to a customer and it shouldn't have', or asks why an incoming message got no answer."
+---
+
+# Channel instruction
+
+Invoked by the admin agent directly.
+
+A message arriving on a channel wakes a session and hands it a turn in two parts: a `## Context` block holding the message, and an `## Instruction` block holding this account's standing rules for what to do with it. This skill is about the file that supplies the second block.
+
+## The file
+
+`$ACCOUNT_DIR/agents/admin/INSTRUCTION.md`
+
+Its whole body becomes the `## Instruction` block, verbatim. The platform wraps it in nothing and adds no wording of its own, so that file is the entire instruction the agent gets on every channel turn. All three channels read it: WhatsApp, the admin webchat, and Telegram.
+
+The install creates the file empty. What goes in it is the account owner's, not the platform's.
+
+## An empty file refuses every message
+
+A file that is missing, unreadable, or holds only whitespace resolves to absent, and an absent instruction refuses the turn: no session wakes and no reply goes out. The sender gets silence.
+
+Nothing warns the owner in advance. The only trace is two lines in `server.log`, written at the moment a message was dropped:
+
+- `op=instruction-source accountId=<id> source=absent bytes=0`
+- `op=inbound … delivery=refused` for the same message
+
+So on an account whose channel is connected and whose file is empty, writing this file is the fix for "nobody is getting an answer". If the owner reports that, check this file before anything else.
+
+## Writing it
+
+Read the file first and tell the owner what is in it. Then find out what they want and write it.
+
+What belongs in it is the account's standing rules for handling an incoming message: who the agent may answer on its own and who it must not, what has to go to a person, what it must never say, how it should sound, and what it must always do before the turn ends.
+
+Two rules on how you write it:
+
+- Write only what the owner has told you. A rule they did not ask for is someone else's wording in their file, which is exactly what this file exists to keep out.
+- Never carry rules over from another account or from another owner's file.
+
+An edit takes effect on the next incoming message. No restart, no upgrade, no publish. So a change can be checked by sending one message to the account's channel and reading the reply.
+
+## What this file is not
+
+It is not the agent's identity or its personality. Those are `IDENTITY.md` and `SOUL.md` in the same directory, and they apply to every session, not just a channel turn. Editing this file changes what happens to incoming messages and nothing else.

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:4140a189871ed59fff6f5edd3c48c8836a40f6999c584a611164533d12021cd2
+content-hash: sha256:f14bd26752dbb6d11c821c26753ca43a5bd526f23e370067111fac8a4a6d4579
 brand: maxy-code
 product-name: Maxy
 ---
@@ -250,6 +250,7 @@ Inside the scope, `sh -c 'trap "" HUP; exec "$@"' sh <claudeBin> <args...>` keep
 | Step | Line shape |
 |------|-----------|
 | 1 | `[rc-spawn] op=request unitToken=<t> sessionId=<8|new> name=<…|none> mode=<resume|fresh> jsonl=<path|none>` |
+| 1b | `[rc-spawn] op=role-resolution sessionId=<8> source=<body\|sidecar\|unresolved> outcome=<ok\|missing\|parse-failed>` — channel-bound spawns only. `source` is where the session's role came from; `outcome` is the `readSidecar` verdict behind it, which separates a deleted classification sidecar from a corrupted one. `source=unresolved` means neither the body nor the sidecar produced a role, so the spawn took the public lockdown rather than running unrestricted. The `tool-allowlist` line cannot make that distinction: it renders `role=none` for an unresolved role and for a legitimately roleless spawn alike. |
 | 2 | `[rc-spawn] op=argv unitToken=<t> cwd=<dir> argv=<json>` (inner claude argv; the `systemd-run --scope` wrap is composed by the spawnPty adapter) |
 | 3 | `[rc-spawn] op=pty-spawned unitToken=<t> pid=<pid> openFds=<n>` (fd baseline) |
 | 4 | `[rc-spawn] op=child-output unitToken=<t> pid=<pid> head=<json>` (first ≤1 KB or 500 ms idle — claude's own words) |
@@ -1661,6 +1662,20 @@ Changes are per-account and take effect immediately.
 
 Brand isolation extends to the device filesystem. Every Maxy install provisions an SMB share scoped to that brand's install folder, credentialled by the brand's install owner and the Maxy PIN. A device that hosts more than one brand carries one share per brand; tearing one brand down never exposes another brand's files. See [Samba Share](./samba.md) for the credential model, per-OS mount syntax, and peer-brand lifecycle.
 
+## The Shared Folder
+
+Every install has one shared folder that all accounts can see. The house account writes it; every other account reads it.
+
+It exists so the house can publish something once and have every sub-account use it. Brand tokens are the first use: put the house palette, typography and report template in the shared folder, and a sub-account can produce a report in the house format without being sent a copy.
+
+Ask Maxy to "put this in the shared folder" from the house account, or "read the brand tokens from the shared folder" from any account.
+
+A sub-account that tries to write there is refused, and says the folder is read-only. That refusal is the correct behaviour, not a fault. If a sub-account needs something changed in the shared folder, the change is made from the house account.
+
+If the install's account records are in an odd state — no house account, or more than one — the folder becomes read-only for everyone until that is resolved. This is deliberate: with no single house account there is no one whose writes should be trusted.
+
+One limit worth knowing. The read-only rule covers Maxy's file tools and the Data page. It does not cover shell commands, which an account's own operator can still run against the folder on their own install. The rule is there to stop accounts from changing shared material by accident, not to defend against the person who owns the install.
+
 ---
 # What Wakes a Session
 Source: https://docs.getmaxy.com/channel-wake-and-prompt.md
@@ -5557,6 +5572,8 @@ The final step in the retrieval pipeline is injecting retrieved content into the
 
 The manager exposes three named spawn routes: `/rc-spawn` (a live `claude --remote-control` PTY — the operator sidebar, the channel admin, and the one-shot admin jobs), `/public-spawn` (the renamed `/spawn` — `spawnClaudeSession`, the zero-tool public surface), and the `rc-daemon` it drives. No route named `/spawn` remains; a manager boot line `[spawn-routes] live=[rc-spawn,public-spawn]` asserts this.
 
+**A public spawn may not name a specialist.** The zero-tool surface is built from four levers, and two of them — the `--allowed-tools` push and the resolved permission mode — branch on whether the spawn is a specialist rather than on whether it is public, so a specialist named on a public spawn would skip the allowlist entirely and resolve the caller's mode instead of the fail-closed `dontAsk`. Only the per-spawn `permissions.deny` and `--strict-mcp-config` bind on the public role alone. Neither production issuer sends the pairing: the channel bridge is the only caller whose role can be public and it carries no specialist field, while the cookie-auth session wrapper is admin-only. So the pairing is refused rather than reshaped — `/public-spawn` answers `400 specialist-not-permitted-on-public`, and `spawnClaudeSession` refuses it again with `reason=public-specialist-refused` at the single chokepoint every spawn route passes through. Refusing rather than narrowing the levers is deliberate: a narrowed lever would leave a specialist running silently on a one-tool surface. Every spawn that reaches `spawnClaudeSession` — which is every `/public-spawn`, that route being its only caller — logs the three deciding inputs together as `[spawn-lockdown] role=<role> specialist=<name|none> permissionMode=<mode>`. A refusal at either layer logs `op=public-specialist-refused` instead, told apart by `site=`.
+
 The channel PTY-bridge (`ensureEntry`) routes each inbound by role: an **admin** WhatsApp/Telegram inbound spawns on `/rc-spawn` (keyed by a deterministic per-sender sessionId so the thread resumes across restarts) and drives every turn via `/<id>/input`; a **non-admin** inbound spawns on `/public-spawn`. Each dispatch logs `[<channel>-adaptor] route role=<role> target=<rc-spawn|public-spawn> senderId=…`. LinkedIn ingest and the public session-end review also run on `/rc-spawn`, carrying their prompt as `initialMessage` with `closeAfterTurn` so the PTY stops after one assistant turn.
 
 ### Public agent paths

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,21 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-08-02 (0.1.544)
+
+- Every channel, including Telegram, now takes its turn instruction from the account's own file rather than text fixed in the code, and a build check stops any of the three services hardcoding it again.
+- Each public agent now has its own instruction file, created on install.
+- A session whose role cannot be determined is now refused rather than allowed through, and a specialist can no longer be requested on a session serving someone outside your team.
+- A frozen session serving someone outside your team is now restarted through the same restricted route it began on.
+
+## 2026-08-01 (0.1.543)
+
+- There is now a shared folder every account can read and only the main account can write to, and an upload route that could reach out of an account into it has been closed.
+- Every timestamp on screen now shows in the account's own timezone, with a build check that stops a new one slipping back to the browser's.
+- A sub-account reading its WhatsApp now resolves its own conversations, and past messages that arrived on its connection have been filed to it.
+- How the assistant is told to handle a WhatsApp turn is now set per account rather than fixed in the code, seeded on install.
+- A chat session that freezes is now set aside and restarted rather than left stuck.
+
 ## 2026-08-01 (0.1.542)
 
 - A public agent's web chat now runs in the account that owns it, including its branding, rather than always the main account. A standing check reports the same agent name claimed by two accounts.

package/payload/platform/plugins/docs/references/access-control.md

@@ -82,3 +82,17 @@ Changes are per-account and take effect immediately.
 ## Filesystem Access (SMB Share)
 
 Brand isolation extends to the device filesystem. Every {{productName}} install provisions an SMB share scoped to that brand's install folder, credentialled by the brand's install owner and the {{productName}} PIN. A device that hosts more than one brand carries one share per brand; tearing one brand down never exposes another brand's files. See [Samba Share](./samba.md) for the credential model, per-OS mount syntax, and peer-brand lifecycle.
+
+## The Shared Folder
+
+Every install has one shared folder that all accounts can see. The house account writes it; every other account reads it.
+
+It exists so the house can publish something once and have every sub-account use it. Brand tokens are the first use: put the house palette, typography and report template in the shared folder, and a sub-account can produce a report in the house format without being sent a copy.
+
+Ask {{productName}} to "put this in the shared folder" from the house account, or "read the brand tokens from the shared folder" from any account.
+
+A sub-account that tries to write there is refused, and says the folder is read-only. That refusal is the correct behaviour, not a fault. If a sub-account needs something changed in the shared folder, the change is made from the house account.
+
+If the install's account records are in an odd state — no house account, or more than one — the folder becomes read-only for everyone until that is resolved. This is deliberate: with no single house account there is no one whose writes should be trusted.
+
+One limit worth knowing. The read-only rule covers {{productName}}'s file tools and the Data page. It does not cover shell commands, which an account's own operator can still run against the folder on their own install. The rule is there to stop accounts from changing shared material by accident, not to defend against the person who owns the install.

package/payload/platform/plugins/docs/references/internals.md

@@ -357,6 +357,8 @@ The final step in the retrieval pipeline is injecting retrieved content into the
 
 The manager exposes three named spawn routes: `/rc-spawn` (a live `claude --remote-control` PTY — the operator sidebar, the channel admin, and the one-shot admin jobs), `/public-spawn` (the renamed `/spawn` — `spawnClaudeSession`, the zero-tool public surface), and the `rc-daemon` it drives. No route named `/spawn` remains; a manager boot line `[spawn-routes] live=[rc-spawn,public-spawn]` asserts this.
 
+**A public spawn may not name a specialist.** The zero-tool surface is built from four levers, and two of them — the `--allowed-tools` push and the resolved permission mode — branch on whether the spawn is a specialist rather than on whether it is public, so a specialist named on a public spawn would skip the allowlist entirely and resolve the caller's mode instead of the fail-closed `dontAsk`. Only the per-spawn `permissions.deny` and `--strict-mcp-config` bind on the public role alone. Neither production issuer sends the pairing: the channel bridge is the only caller whose role can be public and it carries no specialist field, while the cookie-auth session wrapper is admin-only. So the pairing is refused rather than reshaped — `/public-spawn` answers `400 specialist-not-permitted-on-public`, and `spawnClaudeSession` refuses it again with `reason=public-specialist-refused` at the single chokepoint every spawn route passes through. Refusing rather than narrowing the levers is deliberate: a narrowed lever would leave a specialist running silently on a one-tool surface. Every spawn that reaches `spawnClaudeSession` — which is every `/public-spawn`, that route being its only caller — logs the three deciding inputs together as `[spawn-lockdown] role=<role> specialist=<name|none> permissionMode=<mode>`. A refusal at either layer logs `op=public-specialist-refused` instead, told apart by `site=`.
+
 The channel PTY-bridge (`ensureEntry`) routes each inbound by role: an **admin** WhatsApp/Telegram inbound spawns on `/rc-spawn` (keyed by a deterministic per-sender sessionId so the thread resumes across restarts) and drives every turn via `/<id>/input`; a **non-admin** inbound spawns on `/public-spawn`. Each dispatch logs `[<channel>-adaptor] route role=<role> target=<rc-spawn|public-spawn> senderId=…`. LinkedIn ingest and the public session-end review also run on `/rc-spawn`, carrying their prompt as `initialMessage` with `closeAfterTurn` so the PTY stops after one assistant turn.
 
 ### Public agent paths

package/payload/platform/plugins/docs/references/platform.md

@@ -123,6 +123,7 @@ Inside the scope, `sh -c 'trap "" HUP; exec "$@"' sh <claudeBin> <args...>` keep
 | Step | Line shape |
 |------|-----------|
 | 1 | `[rc-spawn] op=request unitToken=<t> sessionId=<8|new> name=<…|none> mode=<resume|fresh> jsonl=<path|none>` |
+| 1b | `[rc-spawn] op=role-resolution sessionId=<8> source=<body\|sidecar\|unresolved> outcome=<ok\|missing\|parse-failed>` — channel-bound spawns only. `source` is where the session's role came from; `outcome` is the `readSidecar` verdict behind it, which separates a deleted classification sidecar from a corrupted one. `source=unresolved` means neither the body nor the sidecar produced a role, so the spawn took the public lockdown rather than running unrestricted. The `tool-allowlist` line cannot make that distinction: it renders `role=none` for an unresolved role and for a legitimately roleless spawn alike. |
 | 2 | `[rc-spawn] op=argv unitToken=<t> cwd=<dir> argv=<json>` (inner claude argv; the `systemd-run --scope` wrap is composed by the spawnPty adapter) |
 | 3 | `[rc-spawn] op=pty-spawned unitToken=<t> pid=<pid> openFds=<n>` (fd baseline) |
 | 4 | `[rc-spawn] op=child-output unitToken=<t> pid=<pid> head=<json>` (first ≤1 KB or 500 ms idle — claude's own words) |

package/payload/platform/plugins/filesystem/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "filesystem",
-  "description": "Account-scoped file access. Read, write, edit, list, glob, and grep files under the session's own account directory; the house admin may reach any sub-account's files by naming targetAccountId, gated fail-closed and confined to that account's directory.",
+  "description": "Account-scoped file access. Read, write, edit, list, glob, and grep files under the session's own account directory; the house admin may reach any sub-account's files by naming targetAccountId, gated fail-closed and confined to that account's directory; every account may read the install-wide shared folder via shared:true, and only the house account may write it.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/filesystem/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: filesystem
-description: "Account-scoped file access. Read, write, edit, list, glob, and grep files under the session's own account directory; the house admin may reach any sub-account's files by naming targetAccountId, gated fail-closed and confined to that account's directory."
+description: "Account-scoped file access. Read, write, edit, list, glob, and grep files under the session's own account directory; the house admin may reach any sub-account's files by naming targetAccountId, gated fail-closed and confined to that account's directory; every account may read the install-wide shared folder via shared:true, and only the house account may write it."
 tools:
   - name: file-read
     publicAllowlist: false
@@ -54,6 +54,16 @@ Omit `targetAccountId`. Every tool takes a `path` relative to your account direc
 
 Pass `targetAccountId` to operate on a sub-account's directory. This is honoured only for a house-scoped admin session. A sub-account, specialist, or public session that passes `targetAccountId` is refused with `cross-account-denied`; an account id that is not provisioned on disk is refused with `cross-account-target-not-provisioned`. The validity check re-scans the accounts dir on a miss, so a sub-account created at runtime this session resolves without a service restart (a stale boot-time cache no longer masks it). Use this to inspect or repair a client account's files from the house session without switching accounts.
 
+## Shared folder
+
+Pass `shared: true` to operate on the install-wide shared folder at `data/shared/` instead of an account directory. `path` is then relative to the shared root.
+
+Every account reads it: `file-read`, `file-list`, `file-glob` and `file-grep` are open to any session. Only the house account writes it: `file-write` and `file-edit` from any other account are refused with `shared-folder-read-only`. House-ness here is the account, not the session role, so a house specialist writes too. Under account-census drift (no house, or more than one) no account may write.
+
+`shared: true` together with `targetAccountId` is refused with `shared-and-target-exclusive` — `targetAccountId` selects an account root, and the shared folder is not an account. An install whose shared folder is missing refuses every shared call with `shared-folder-absent`; the installer creates the folder, and no tool call creates it on demand.
+
+Containment is identical to the account case: a path that escapes the shared root, including through a symlink into an account directory, is rejected before any filesystem operation.
+
 ## Boundaries
 
 Every path is confined to the resolved account directory. A path that escapes it — `../`, an absolute path outside the account root, or a symlink pointing out — is rejected before any filesystem operation. Reads and greps skip files over 5 MB; grep skips binary files.