@rubytech/create-maxy-code 0.1.543 → 0.1.545

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -27,7 +27,7 @@ import { parseWaChannelBody, sessionIdFieldsFor } from './public-spawn-session.j
 import { buildWebchatChannelMcpServers, buildWebchatChannelArgv, webchatChannelMcpConfigPath, WEBCHAT_CHANNEL_SERVER_NAME } from './webchat-channel-mcp.js';
 import { buildTelegramChannelMcpServers, buildTelegramChannelArgv, telegramChannelMcpConfigPath, TELEGRAM_CHANNEL_SERVER_NAME } from './telegram-channel-mcp.js';
 import { buildChannelMcpServers, buildChannelArgv, channelMcpConfigPath, CHANNEL_SERVER_NAME } from './channel-mcp.js';
-import { buildRcPublicLockdownArgv, formatToolAllowlistLine } from './rc-public-lockdown.js';
+import { buildRcPublicLockdownArgv, formatToolAllowlistLine, PUBLIC_ALLOWED_TOOLS_ENV, allowedToolsFromArgv, formatRoleResolutionLine, } from './rc-public-lockdown.js';
 import { mergeTarget, isMultiTarget, targetKinds } from './channel-targets.js';
 import { randomUUID, createHash } from 'node:crypto';
 import { execFile, execFileSync } from 'node:child_process';
@@ -1170,6 +1170,13 @@ export function buildHttpApp(deps) {
         // webchatChannel above. This door could attach webchat but never WhatsApp,
         // which is why the public WhatsApp route had nowhere to land before.
         const waChannel = parseWaChannelBody(body.waChannel);
+        // Task 2338 — the telegram twin. `parseWaChannelBody` is shape-identical
+        // for telegram (senderId + http gateway + absolute server path), so it is
+        // reused rather than duplicated. pty-spawner has accepted a
+        // `telegramChannel` arg since the public allowlist gained its telegram arm
+        // (pty-spawner.ts:844, public-allowlist.ts:24); this route could not supply
+        // one, so a public telegram spawn fell through to the deny-basis allowlist.
+        const telegramChannel = parseWaChannelBody(body.telegramChannel);
         // Task 2262 — the caller's deterministic per-sender id, so a public visitor
         // keeps one conversation across cold starts instead of meeting a fresh agent
         // every time. Shape-gated to the same UUID v4 pattern the other id fields on
@@ -1206,6 +1213,30 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'POST', '/public-spawn', 400, Date.now() - start);
             return c.json({ error: 'invalid-arguments', detail: { senderId: !!senderId, role, channel } }, 400);
         }
+        // Task 2274 — a public spawn may not name a specialist. `isPublic` and
+        // `isSpecialistSpawn` are independent in pty-spawner and the specialist
+        // branch wins at two of the four lockdown levers: the `--allowed-tools` push
+        // is skipped entirely, and `effectiveMode` resolves the caller-supplied mode
+        // (defaulting to `bypassPermissions`) instead of the fail-closed `dontAsk`.
+        // The `permissionMode` this body may also carry is parsed further down and
+        // would be honoured on that branch, which is why the refusal sits above the
+        // parse rather than beside it.
+        //
+        // Neither production issuer sends the combination: the channel bridge
+        // (`manager-client.ts`) is the only one whose role can be 'public' and it
+        // carries no `specialist` field, while the cookie-auth wrapper
+        // (`claude-sessions.ts`) types its role as the literal 'admin'. Refusing
+        // states that invariant at the door; `spawnClaudeSession` refuses the same
+        // pairing again at the chokepoint, so a future route cannot reinherit it.
+        //
+        // `specialist` here is the shape-gated value, so a body whose field failed
+        // the slug pattern resolved to undefined and is an ordinary public spawn —
+        // the same value the spawner would have seen.
+        if (role === 'public' && specialist !== undefined) {
+            deps.logger(`[spawn] op=public-specialist-refused site=public-spawn specialist=${specialist} channel=${channel} senderId=${senderId}`);
+            timed(deps.logger, 'POST', '/public-spawn', 400, Date.now() - start);
+            return c.json({ error: 'specialist-not-permitted-on-public', detail: { specialist } }, 400);
+        }
         // Task 1489 — a passive intake spawn rides role:'public' on this path but is
         // a trusted, sub-account-bound account manager, not an anonymous visitor. It
         // is exempt from the anonymous-visitor limiter: `!passive` keeps a manager's
@@ -1316,6 +1347,22 @@ export function buildHttpApp(deps) {
                 deps.logger(`[spawn] op=agent-account-scope route=public-spawn account=${agentAccountId} applied=true`);
             }
         }
+        // Task 2338 — the write-through /rc-spawn has always made (:3336, :3346,
+        // :3355) and this route never did. Without it a session first spawned here
+        // has no binding on disk, so the stuck-turn recycler has nothing to re-post
+        // and the respawn loses the visitor's reply transport. A public spawn is
+        // wa XOR webchat XOR telegram (pty-spawner.ts:1893), so at most one of
+        // these fires. Gated on a caller-supplied sessionId because that is the
+        // only id that exists before the spawn returns; a route that mints its own
+        // id has no session to key on and no recycler re-post to serve.
+        if (callerSessionId) {
+            if (waChannel)
+                deps.waChannelStore.set(callerSessionId, waChannel);
+            if (webchatChannel)
+                deps.webchatChannelStore?.set(callerSessionId, webchatChannel);
+            if (telegramChannel)
+                deps.telegramChannelStore?.set(callerSessionId, telegramChannel);
+        }
         const result = await spawnClaudeSession({
             ...deps,
             spawnCwd,
@@ -1377,6 +1424,7 @@ export function buildHttpApp(deps) {
             visitorId,
             webchatChannel,
             waChannel,
+            telegramChannel,
             ...sessionIdFields,
             previousContext,
             targetAccountId,
@@ -3099,9 +3147,15 @@ export function buildHttpApp(deps) {
         // `{ sessionId }` resumes that wedged-session recovery (index.ts, the
         // recoverWedgedSession resumeSpawn) and the re-seat route send would be
         // refused for carrying no role, when their role has been on disk all along.
-        const priorSidecar = sessionId
-            ? readSidecar(sidecarPathForSessionId(effectiveAccountDir, sessionId), deps.logger).sidecar
+        // Task 2267 — the whole read outcome, not just the sidecar. `readSidecar`
+        // returns `ok` | `missing` | `parse-failed` and both failure verdicts yield
+        // a null sidecar, so collapsing to `.sidecar` here made a damaged file
+        // indistinguishable from a session that legitimately has none. The lockdown
+        // gate below and the resolution line both read the verdict.
+        const priorSidecarRead = sessionId
+            ? readSidecar(sidecarPathForSessionId(effectiveAccountDir, sessionId), deps.logger)
             : null;
+        const priorSidecar = priorSidecarRead?.sidecar ?? null;
         // Task 2325 — the session's role, from the body or inherited from disk.
         // The refusal sits here rather than at the body parse because an absent
         // `role` has THREE legitimate readings and only one of them is an error:
@@ -3131,6 +3185,21 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'POST', '/rc-spawn', 400, Date.now() - start);
             return c.json({ error: 'invalid-arguments', detail: { role: body.role ?? null } }, 400);
         }
+        // Task 2267 — one line per channel-bound rc-spawn naming where the role came
+        // from. Emitted only for a channel-bound spawn: a one-shot admin job has no
+        // channel and no sidecar, so a line on every rc-spawn would be dominated by
+        // that benign case. `source=unresolved` is the fail-closed spawn, and the
+        // outcome behind it separates a deleted sidecar from a corrupted one.
+        // Hoisted from the Task 1214 voice gate below, which reads the same value
+        // and now shares this one binding.
+        const channelBound = !!(effectiveWebchatChannel || effectiveWaChannel || effectiveTelegramChannel);
+        if (sessionId && channelBound) {
+            deps.logger(formatRoleResolutionLine({
+                sessionId,
+                source: rcRole ? 'body' : priorSidecar?.role ? 'sidecar' : 'unresolved',
+                outcome: priorSidecarRead?.outcome ?? 'missing',
+            }));
+        }
         // Task 850 — assemble the bound target set and choose the channel server:
         //   - ≥2 kinds: ONE unified `channel` server (one reply tool fanning to every
         //     target's existing gateway endpoint). The mature per-kind servers are
@@ -3251,9 +3320,28 @@ export function buildHttpApp(deps) {
         // the first. `priorSidecar` is already read for any channel-bound session,
         // which is every public spawn that can reply. Pushed after the channel argv
         // so `--strict-mcp-config` leaves exactly the per-spawn channel server
-        // registered; `admin` and roleless spawns produce byte-identical argv.
+        // registered; an `admin` spawn produces byte-identical argv.
         // Task 2325 — resolved once, above, beside the refusal.
-        const publicLockdown = effectiveRcRole === 'public' ? buildRcPublicLockdownArgv(channelServerName) : null;
+        //
+        // Task 2267 — a null role on a channel-bound spawn takes the lockdown too.
+        // `effectiveRcRole` is null when neither the body nor the sidecar produced a
+        // role, and a live public session always had a sidecar written at spawn
+        // (pty-spawner kills the PTY when that write throws), so null on a
+        // channel-bound session means the file was damaged after the spawn
+        // succeeded, not that the session is legitimately roleless. Reaching here
+        // with null is always a resume: a fresh spawn with no resolvable role is
+        // refused with a 400 above, so no mode test is added. A roleless spawn with
+        // NO channel binding — the one-shot admin jobs and the bare claude.ai/code
+        // bridge resume — still produces byte-identical argv.
+        //
+        // The cost is stated rather than hidden. A channel-bound ADMIN resume whose
+        // sidecar is unreadable comes back holding only its channel reply tool, and
+        // stays that way on every later resume, because the sidecar write below is
+        // itself gated on a non-null role and so never repairs the file. The
+        // `op=role-resolution` line above is what makes that state greppable.
+        const publicLockdown = effectiveRcRole === 'public' || (effectiveRcRole === null && channelBound)
+            ? buildRcPublicLockdownArgv(channelServerName)
+            : null;
         if (publicLockdown) {
             // A re-seat fork pushes its own caller-picked --permission-mode above,
             // before the role is known. Two conflicting flags do not reliably
@@ -3295,7 +3383,9 @@ export function buildHttpApp(deps) {
         // overlay: a missing/empty/headingless file degrades to no voice segment and
         // never fails the spawn. `voiceBytes` rides the op=argv line as the
         // at-a-glance present/absent signal whose absence hid this bug.
-        const channelBound = !!(effectiveWebchatChannel || effectiveWaChannel || effectiveTelegramChannel);
+        // Task 2267 — `channelBound` was declared here; it is now resolved once,
+        // beside the role resolution above, because the public lockdown gate needs
+        // the same value earlier. Same expression, same meaning.
         let voiceBytes = 0;
         if (adminBinding && channelBound) {
             let voice = null;
@@ -3372,13 +3462,25 @@ export function buildHttpApp(deps) {
         // (effectiveAccountId !== house) spawns — fail-closed, no escalation.
         const acctIsHouse = isHouseAccount(deps.platformRoot, effectiveAccountId);
         const rcHouseAdminScope = houseAdminScopeFor({
-            // Task 2325 — the BODY's role, deliberately not `effectiveRcRole`. A
-            // resume that omits the role has never carried house scope (its old
-            // `undefined` was cast and failed the `role === 'admin'` test), and
-            // switching to the inherited role here would newly grant cross-account
-            // authority to every admin channel resume. That gap is real and
-            // pre-existing; deciding it is not this task's scope.
-            role: rcRole,
+            // Task 2335 — the SESSION's role (body, else prior sidecar), not the
+            // body's `rcRole` alone. A resume that omits the role — the stuck-turn
+            // recycler posts `{ sessionId, targetAccountId }` — used to fail the
+            // `role === 'admin'` test and come back with no cross-account authority
+            // while the same session's fresh spawn carried it. That divergence was
+            // measured on one house session as a single `inject=false` line between
+            // four `inject=true` lines, on the recycle resume 21s after a wedge kill.
+            // Inheriting is not a widening, for two reasons that hold together. The
+            // sidecar is read from `sidecarPathForSessionId(effectiveAccountDir, …)`
+            // above — the SAME account that decides `isHouse` — so an inherited role
+            // can only come from the resolved account's own record of this session;
+            // a sub-account session resumed against the house account finds no
+            // sidecar there and resolves null. And that record is read back through
+            // the `['admin','public']` allowlist in `parseSidecar`, which rejects the
+            // whole row on anything else, so the only role that can arrive here from
+            // disk and open the gate is the `admin` this session's own fresh spawn
+            // asserted on this account. `isHouse` still excludes every sub-account
+            // resume on top of that.
+            role: effectiveRcRole,
             accountId: effectiveAccountId,
             isHouse: acctIsHouse,
             isSpecialist: false,
@@ -3528,6 +3630,15 @@ export function buildHttpApp(deps) {
             strictMcp: publicLockdown !== null,
             mode: effectiveRcPermissionMode,
         }));
+        // Task 2339 — the realised-surface hook's only input. `tool-allowlist` above
+        // records the surface this spawn was GIVEN; nothing recorded the surface it
+        // REALISES, so five tools ran under a one-tool allowlist and produced no
+        // line. Stamped here rather than inside buildRcChildEnv so it lands after
+        // the last argv push and the value is this spawn's final `--allowed-tools`
+        // set. Public spawns only; its presence is the signal the hook keys on.
+        if (publicLockdown) {
+            env[PUBLIC_ALLOWED_TOOLS_ENV] = allowedToolsFromArgv(argv).join(',');
+        }
         deps.logger(`[rc-spawn] op=argv unitToken=${unitToken} cwd=${effectiveAccountDir} permissionMode=${effectiveRcPermissionMode} model=${effectiveRcModel ?? 'unset'} effort=${effectiveRcEffort ?? 'unset'} positionalBytes=${positionalBytes} voiceBytes=${voiceBytes} argv=${JSON.stringify([deps.claudeBin, ...argv])}`);
         emitRcLife(deps.logger, 'argv', 'rc-spawn', 'node-pty', rcLifeMode, unitToken, {
             cwd: effectiveAccountDir,
@@ -3679,6 +3790,11 @@ export function buildHttpApp(deps) {
                         // into the child env above (rcHouseAdminScope), so env and sidecar
                         // are one decision with two consumers and can never drift again.
                         houseAdminScope: rcHouseAdminScope,
+                        // Task 2338 — the route that produced this process. Only
+                        // /public-spawn composes a persona, so a `public` role recorded
+                        // here with route `rc-spawn` is a session running without its
+                        // soul file, which is what the persona audit counts.
+                        spawnRoute: 'rc-spawn',
                     }, deps.logger);
                     deps.watcher.refreshSidecar?.(sessionId);
                 }
@@ -3695,6 +3811,34 @@ export function buildHttpApp(deps) {
                     deps.watcher.refreshSidecar?.(sessionId);
             }
         }
+        // Task 2338 — the route stamp sits OUTSIDE the classification block above,
+        // and that placement is the whole point. That block is gated on a channel
+        // in the request BODY (`adminChannel`, :3037), and the resume shapes that
+        // matter here carry none: the claude.ai/code bridge posts
+        // `{ sessionId, name }` and wedged-session recovery posts `{ sessionId }`
+        // (see the note at :3390). Inside the block, a bare resume of a public
+        // session would leave `spawnRoute` reading `public-spawn` and the persona
+        // audit would report zero through a live defect — which is exactly the
+        // 2026-08-01 sequence this task exists to make visible.
+        //
+        // Patched, never written fresh: with no prior sidecar there is no row to
+        // record a route on, and inventing one here would bypass the role/channel
+        // allowlist the write above enforces. Patched only when the value would
+        // change, so a repeated rc-spawn resume does not rewrite the file each turn.
+        if (sessionId && priorSidecar && priorSidecar.spawnRoute !== 'rc-spawn') {
+            const routeSidecarPath = sidecarPathForSessionId(effectiveAccountDir, sessionId);
+            try {
+                const patched = updateSidecar(routeSidecarPath, { spawnRoute: 'rc-spawn' }, deps.logger);
+                if (patched)
+                    deps.watcher.refreshSidecar?.(sessionId);
+            }
+            catch (err) {
+                // Non-fatal, same contract as the classification write: the PTY here is
+                // already serving a live thread and a diagnostic write must not tear it
+                // down.
+                deps.logger(`[rc-spawn] op=spawn-route-patch-failed sessionId=${sessionId.slice(0, 8)} err=${JSON.stringify(err instanceof Error ? err.message : String(err))}`);
+            }
+        }
         // Task 626 — one-shot job (LinkedIn ingest, public session-end review):
         // stop the PTY once its single assistant turn lands `end_turn`. closeAfterTurn
         // implies a sessionId (validated above), so trackerKey === sessionId and the