@rubytech/create-maxy-code 0.1.548 → 0.1.549

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.548",
+  "version": "0.1.549",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"
@@ -13,7 +13,7 @@
     "build": "tsc",
     "bundle": "node scripts/bundle.js",
     "test": "npm run build && node --test 'dist/__tests__/*.test.js'",
-    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-plugin-tools-mcp-consistency.mjs && node ../../platform/scripts/check-risk-class.mjs && node ../../platform/scripts/check-specialist-tool-surface.mjs && node ../../platform/scripts/check-agent-contract.mjs && node ../../platform/scripts/check-routing-prose-bash.mjs && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-no-esm-require.mjs && node ../../platform/scripts/check-no-raw-mcp-registrations.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/scripts/check-architecture-skill-no-drift.mjs && node ../../platform/ui/scripts/check-brand-fonts.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && bash ../../platform/scripts/smoke-boot-services.sh && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
+    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-plugin-tools-mcp-consistency.mjs && node ../../platform/scripts/check-risk-class.mjs && node ../../platform/scripts/check-specialist-tool-surface.mjs && node ../../platform/scripts/check-agent-contract.mjs && node ../../platform/scripts/check-routing-prose-bash.mjs && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-no-esm-require.mjs && node ../../platform/scripts/check-no-raw-mcp-registrations.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/scripts/check-routine-roster-doc.mjs && node ../../platform/scripts/check-architecture-skill-no-drift.mjs && node ../../platform/ui/scripts/check-brand-fonts.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && bash ../../platform/scripts/smoke-boot-services.sh && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
   },
   "files": [
     "dist",

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:db7c14326a115e7d05b687b72bef0ba3892f1614ee46484e0e90414bf2c16f27
+content-hash: sha256:67fd64d3983bd1c788d6945201c05ee4afeb63fd02fb033123b63e364e915430
 brand: maxy-code
 product-name: Maxy
 ---
@@ -3664,13 +3664,15 @@ one, over the same automation set the routes list. The roster seed's own
 `descNull` counter is its narrow twin, scoped to seeded rows and so blind to
 exactly the operator-created ones most likely to carry no caption.
 
-**The shipped roster.** Every account starts with eleven routines —
+**The shipped roster.** Every account starts with thirteen routines —
 `start-of-day`, `inbound-check`, `end-of-day`, `appointment-reminder`,
 `commitment-chase`, `calendar-reconcile`, `contact-reconcile`, `crm-reconcile`,
-`finance-reconcile`, `channel-link-check`, `weekly-digest` — seeded
-`eventStatus:'suspended'` with `nextRun` NULL and no
-channel or destination, so `/routines` is a catalogue to enable rather than a
-blank page. The list query applies no status filter and `AUTOMATION_WHERE`
+`finance-reconcile`, `weekly-digest`, `channel-link-check`, `graph-health`,
+`filesystem-health`, in `/routines` display order. `ROUTINE_ROSTER_KEYS.length`
+is authoritative for the count and this list follows it. They are seeded
+`eventStatus:'suspended'` with `nextRun` NULL and no channel or destination, so
+`/routines` is a catalogue to enable rather than a blank page. The list query
+applies no status filter and `AUTOMATION_WHERE`
 admits them on `recurrence IS NOT NULL`, so they render with no change here.
 They cannot fire: every dispatch query in `check-due-events.ts` selects
 `eventStatus = 'scheduled'`, and the recurring one additionally requires

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,11 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-08-02 (0.1.549)
+
+- Telegram now answers on the address it tells you to use, fixing messages that never arrived after yesterday's per-account change.
+- The list of built-in routines in the docs is now checked against the routines that actually ship, so it cannot quietly fall out of date.
+
 ## 2026-08-02 (0.1.548)
 
 - Telegram now works per account: each bot has its own address and secret, a scheduled message goes to the right account, and a check reports any bot that is set up but never delivers.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -279,13 +279,15 @@ one, over the same automation set the routes list. The roster seed's own
 `descNull` counter is its narrow twin, scoped to seeded rows and so blind to
 exactly the operator-created ones most likely to carry no caption.
 
-**The shipped roster.** Every account starts with eleven routines —
+**The shipped roster.** Every account starts with thirteen routines —
 `start-of-day`, `inbound-check`, `end-of-day`, `appointment-reminder`,
 `commitment-chase`, `calendar-reconcile`, `contact-reconcile`, `crm-reconcile`,
-`finance-reconcile`, `channel-link-check`, `weekly-digest` — seeded
-`eventStatus:'suspended'` with `nextRun` NULL and no
-channel or destination, so `/routines` is a catalogue to enable rather than a
-blank page. The list query applies no status filter and `AUTOMATION_WHERE`
+`finance-reconcile`, `weekly-digest`, `channel-link-check`, `graph-health`,
+`filesystem-health`, in `/routines` display order. `ROUTINE_ROSTER_KEYS.length`
+is authoritative for the count and this list follows it. They are seeded
+`eventStatus:'suspended'` with `nextRun` NULL and no channel or destination, so
+`/routines` is a catalogue to enable rather than a blank page. The list query
+applies no status filter and `AUTOMATION_WHERE`
 admits them on `recurrence IS NOT NULL`, so they render with no change here.
 They cannot fire: every dispatch query in `check-due-events.ts` selects
 `eventStatus = 'scheduled'`, and the recurring one additionally requires

package/payload/platform/plugins/scheduling/PLUGIN.md

@@ -210,6 +210,12 @@ Use standard 5-field cron syntax: `minute hour day-of-month month day-of-week`.
 
 When `agentPrompt` is not among the fields, the line ends `(the instruction sent to the agent was not changed)`. That clause is the answer to "did my prompt rewrite land" — a confirmation without it means the dispatch prompt was written. Editing a meeting opens `Meeting updated:` and names the caller's own field names, not the stored `title`/`startsAt`/`endsAt`.
 
+## What the search vector holds
+
+A routine is findable by graph search through a vector built from its name and its description. `schedule-update` rebuilds that vector whenever a call changes either field, and it builds the text from the ROW, not from the call: an update that supplies only a description takes the name from the stored row, and one that supplies only a name takes the description. Building it from the call alone re-embedded a caption edit as `Event:  — <description>`, leaving the routine findable by its caption but not its title. The admin Routines page rebuilds the same text the same way.
+
+One line reports every rebuild, including a healthy one, so its absence cannot be read as a code path that stopped running: `[schedule-update] op=embed-recomputed eventId=<id> titled=<yes|no> nameSource=<param|stored|absent> chars=<n> wrote=<yes|no>`. `titled` is the assertion, since the vector itself cannot be read back to tell whether the title went into it. `nameSource` makes a `titled=no` actionable by separating a routine that genuinely has no name (`absent`) from a fallback that failed. `chars` is the length of the embedded text, the one figure that shows the input shrinking across successive edits. `wrote` is what keeps `titled` honest: the embedder returns nothing on any failure and the vector clause is then skipped, so `titled=yes wrote=no` means the text was correct but the row kept the vector it already had. The line is emitted after the write lands, so an id that turns out to be a meeting never produces one.
+
 ## Skip next
 
 For recurring events, `schedule-update` with `skipNext: true` advances `nextRun` by one cycle without triggering. Use when the user says "skip tomorrow's briefing" or similar.

package/payload/platform/scripts/check-routine-roster-doc.mjs

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+// check-routine-roster-doc.mjs — pre-commit gate (Task 2367).
+//
+// `platform/plugins/docs/references/admin-ui.md` carries one paragraph naming
+// the routines every account is seeded with. That paragraph is mirrored into
+// the generated platform-architecture SKILL.md and ships to every account, so
+// a routine added to ROUTINE_ROSTER and not to the paragraph is not an internal
+// docs nit: an agent asked what routines ship answers the stale number and
+// cannot name the ones it omits. That is exactly what happened between Task
+// 2214 (which took the roster from eleven to thirteen) and Task 2367.
+//
+// Three assertions, all against the same paragraph:
+//
+//   1. Every roster key appears in it as a backticked token. Checked by exact
+//      substring per key, so it holds whatever a future key looks like. This is
+//      the drift that actually happened.
+//   2. Every backticked key-SHAPED token in it is a roster key. A routine
+//      deleted from roster.ts leaves a key in the prose that names nothing, and
+//      assertion 1 cannot see that. Key-shaped means lowercase words joined by
+//      at least one hyphen, which is what every roster key has looked like
+//      since Task 2130. The cost of this rule is that an unrelated hyphenated
+//      term added to this paragraph fails the gate; the failure names the rule,
+//      so the fix is to move the term or correct the key. A hyphenless key
+//      would fall outside this scan but is still fully covered by assertion 1.
+//   3. The number-word for the roster length appears immediately before
+//      "routines". The count and the list state one fact twice, and gating
+//      only the list leaves half the defect free to recur. This is not an
+//      English parser: it maps the length through a fixed table and asserts a
+//      literal. A length with no word in the table is a hard failure naming
+//      the missing word, so the gate is fail-closed on its own blind spot.
+//
+// The roster is read as SOURCE TEXT, so this runs in a fresh worktree with no
+// install and no build. Precedent: readRiskClasses() in
+// platform/scripts/lib/canonical-tool-names.mjs parses tool-surface.ts the
+// same way.
+//
+// Ordering note: this gate runs BEFORE check-architecture-skill-no-drift.mjs in
+// .husky/pre-commit. A wrong edit to the paragraph fails both, and the drift
+// gate's message ("SKILL.md was out of sync") names the symptom rather than the
+// cause. Under `set -e` the first failure is the one the author reads.
+
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve, dirname, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SELF = fileURLToPath(import.meta.url);
+const MAXY_CODE_ROOT = resolve(dirname(SELF), '..', '..');
+
+const ROSTER_TS = resolve(MAXY_CODE_ROOT, 'platform/lib/routine-templates/src/roster.ts');
+const DOC = resolve(MAXY_CODE_ROOT, 'platform/plugins/docs/references/admin-ui.md');
+
+const PARAGRAPH_MARKER = '**The shipped roster.**';
+
+// Indexed by count. Extend when the roster outgrows it; a length past the end
+// is a hard failure below rather than a silent pass.
+const NUMBER_WORDS = [
+  'zero', 'one', 'two', 'three', 'four', 'five', 'six', 'seven', 'eight',
+  'nine', 'ten', 'eleven', 'twelve', 'thirteen', 'fourteen', 'fifteen',
+  'sixteen', 'seventeen', 'eighteen', 'nineteen', 'twenty',
+];
+
+// Assertion 2's scan only. Anchored inside backticks and requiring a hyphen, so
+// `nextRun` (uppercase), `/routines` (slash) and `check-due-events.ts` (dot)
+// are all excluded.
+const KEY_SHAPE = /`([a-z0-9]+(?:-[a-z0-9]+)+)`/g;
+
+const rel = (p) => relative(MAXY_CODE_ROOT, p);
+
+for (const p of [ROSTER_TS, DOC]) {
+  if (!existsSync(p)) {
+    console.error(`[roster-doc] FAIL missing file: ${rel(p)}`);
+    process.exit(1);
+  }
+}
+
+// The roster's key list, in roster order. The interface declaration
+// (`readonly key: string;`) carries no quotes and does not match.
+const rosterKeys = [...readFileSync(ROSTER_TS, 'utf8').matchAll(/^\s*key:\s*"([^"]+)",/gm)]
+  .map((m) => m[1]);
+
+if (rosterKeys.length === 0) {
+  console.error(`[roster-doc] FAIL parsed zero keys from ${rel(ROSTER_TS)} — the entry shape changed`);
+  process.exit(1);
+}
+
+const doc = readFileSync(DOC, 'utf8');
+const start = doc.indexOf(PARAGRAPH_MARKER);
+if (start === -1) {
+  console.error(`[roster-doc] FAIL ${rel(DOC)} has no paragraph starting "${PARAGRAPH_MARKER}"`);
+  process.exit(1);
+}
+const end = doc.indexOf('\n\n', start);
+const paragraph = end === -1 ? doc.slice(start) : doc.slice(start, end);
+
+// 1 — every roster key present, by exact backticked substring.
+const present = rosterKeys.filter((k) => paragraph.includes(`\`${k}\``));
+const missing = rosterKeys.filter((k) => !paragraph.includes(`\`${k}\``));
+
+// 2 — every key-shaped token present is a roster key.
+const rosterKeySet = new Set(rosterKeys);
+const shaped = new Set([...paragraph.matchAll(KEY_SHAPE)].map((m) => m[1]));
+const stale = [...shaped].filter((k) => !rosterKeySet.has(k));
+
+const problems = [];
+if (missing.length) problems.push(`  MISSING from the paragraph: ${missing.join(', ')}`);
+if (stale.length) problems.push(`  STALE in the paragraph (no such roster key): ${stale.join(', ')}`);
+
+// 3 — the count word.
+const expectedWord = NUMBER_WORDS[rosterKeys.length];
+if (expectedWord === undefined) {
+  problems.push(
+    `  no number word for ${rosterKeys.length} — add it to NUMBER_WORDS in ${rel(SELF)}`,
+  );
+} else if (!paragraph.includes(`${expectedWord} routines`)) {
+  const found = NUMBER_WORDS.find((w) => paragraph.includes(`${w} routines`));
+  problems.push(
+    `  count word: expected "${expectedWord} routines", found ${found ? `"${found} routines"` : 'no number word'}`,
+  );
+}
+
+if (problems.length) {
+  console.error(`[roster-doc] FAIL prose=${present.length} roster=${rosterKeys.length}`);
+  for (const l of problems) console.error(l);
+  process.exit(1);
+}
+
+console.log(`[roster-doc] ok prose=${present.length} roster=${rosterKeys.length}`);

package/payload/server/server.js

@@ -13057,6 +13057,12 @@ app10.post("/", async (c) => {
 });
 var telegram_default = app10;
 
+// server/telegram-mount.ts
+function mountTelegramRoutes(app77, telegramRoutes) {
+  app77.route("/api/telegram", telegramRoutes);
+  app77.route("/api/telegram/", telegramRoutes);
+}
+
 // server/routes/quickbooks.ts
 import { join as join30 } from "path";
 import { existsSync as existsSync22, readFileSync as readFileSync24, writeFileSync as writeFileSync9, mkdirSync as mkdirSync4, rmSync as rmSync3, renameSync as renameSync5 } from "fs";
@@ -32861,7 +32867,7 @@ app76.route("/api/webchat", createWebchatRoutes({
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
 app76.route("/api/webchat/greeting", webchat_greeting_default);
-app76.route("/api/telegram", telegram_default);
+mountTelegramRoutes(app76, telegram_default);
 app76.route("/api/quickbooks", quickbooks_default);
 app76.route("/api/onboarding", onboarding_default);
 app76.route("/api/admin", admin_default);