@rubytech/create-maxy-code 0.1.561 → 0.1.563

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/visits.ts

@@ -0,0 +1,93 @@
+import type { Handler, Logger, PortalEnv } from './_lib/types'
+import { readSessionCookie, resolveSession } from './_lib/session'
+import { q } from './_lib/log'
+
+/**
+ * One published visit, as an account's own page renders it.
+ *
+ * The ontology's own fields (`schema-construction.md`) and the portal person the
+ * visit is assigned to, and nothing else. A job sheet's contents are the
+ * account's to design, and they are files, which the Task 1910 exchange already
+ * carries — so nothing of theirs belongs in this shape.
+ */
+export interface VisitRow {
+  visitId: string
+  ownerId: string
+  jobId: string
+  status: string
+  startDate: string
+  purpose: string
+}
+
+/**
+ * The visits a signed-in person may read.
+ *
+ * TWO FILTERS, BOTH SERVER-SIDE, NEITHER REACHABLE FROM THE REQUEST. The
+ * account comes from the baked-in var for the reason `types.ts` gives at
+ * PORTAL_ACCOUNT_ID; the owner filter is applied when, and only when, the
+ * person's scope is `own`, read off the `people` join. No request parameter
+ * names either one, so there is no widening a caller can ask for.
+ *
+ * THIS FUNCTION IS THE ONLY READER OF `recordScope`, and that is deliberate. A
+ * scope column with no reader would be an unused column rather than a boundary.
+ * It ships here rather than being left for each account to write in its own copy
+ * of this tree, because a gate written once per client is a gate got wrong once
+ * per client — and this is the boundary that lets the surface sit on the open
+ * web.
+ */
+export async function processVisits(
+  sessionId: string,
+  env: PortalEnv,
+  log: Logger,
+  nowMs: number,
+): Promise<Handler> {
+  const session = await resolveSession(env.DB, sessionId, env.PORTAL_ACCOUNT_ID, nowMs)
+  if (!session) {
+    log('[data-portal] op=visits owner=none result=denied')
+    return { status: 401, payload: { ok: false, error: 'denied' } }
+  }
+
+  const scoped = session.recordScope === 'own'
+  // Read through the generation pointer, so a listing that races a push sees one
+  // generation whole rather than a half-built one — the same join `files.ts`
+  // makes against directory_state, for the same reason.
+  const sql =
+    `SELECT v.visitId AS visitId, v.ownerId AS ownerId, v.jobId AS jobId,
+            v.status AS status, v.startDate AS startDate, v.purpose AS purpose
+       FROM visits v
+       JOIN visits_state s
+         ON s.accountId = v.accountId AND s.currentGeneration = v.generation
+      WHERE v.accountId = ?` +
+    (scoped ? ' AND v.ownerId = ?' : '') +
+    ' ORDER BY v.startDate ASC, v.visitId ASC'
+  const stmt = env.DB.prepare(sql)
+  const bound = scoped
+    ? stmt.bind(env.PORTAL_ACCOUNT_ID, session.ownerId)
+    : stmt.bind(env.PORTAL_ACCOUNT_ID)
+  const rows = await bound.all<VisitRow>()
+  const visits = rows.results ?? []
+
+  // Counts and the scope, never a visitId or a purpose: those are a real
+  // person's job, and a Pages log is not where they belong.
+  log(
+    `[data-portal] op=visits owner=${q(session.ownerId)} account=${q(session.accountId)} ` +
+      `scope=${session.recordScope} visits=${visits.length} result=ok`,
+  )
+  return { status: 200, payload: { ok: true, visits } }
+}
+
+interface PagesContext {
+  request: Request
+  env: PortalEnv
+}
+
+export async function onRequestGet(context: PagesContext): Promise<Response> {
+  const sessionId = readSessionCookie(context.request.headers.get('cookie')) ?? ''
+  const { status, payload } = await processVisits(
+    sessionId,
+    context.env,
+    (line) => console.log(line),
+    Date.now(),
+  )
+  return Response.json(payload, { status })
+}

package/payload/platform/plugins/docs/references/deployment.md

@@ -201,11 +201,11 @@ The logs will show which service failed to start and why. Common causes:
 Each installed brand runs two per-brand `--user` systemd units (earlier platform fixes + — unit filenames are prefixed with the brand's `hostname` so two brands on the same device never share a unit file):
 
 - `{hostname}.service` — the admin + public HTTP server on `127.0.0.1:19201` (public port + 1). Restarted by the upgrade flow; short downtime is expected during steps 8→11 of an upgrade. An earlier fix: the unit carries two port env vars — `PORT=<public>` (canonical public port, read by the upgrade detector) and `MAXY_UI_INTERNAL_PORT=<public+1>` (the port maxy-ui actually binds).
-- `{hostname}-edge.service` — the always-on public listener on the configured port (default 19200). Reverse-proxies HTTP to the main brand service and handles `/websockify` (VNC) WebSocket upgrades locally. An earlier fix: also hosts `/api/admin/actions/*` and `/api/admin/version*` — the Software Update modal's own routes — so the log stream survives the brand service's restart window. Does NOT restart during an upgrade — the browser WebSocket stays connected by construction. The operator views the device's Chromium in the admin UI via the standalone `/browser` page (peer to `/graph` and `/data`) and on the Claude sign-in screen; both render CDP screencast frames over `/cdp-screencast`, not the framebuffer. Virtual-mode Chromium is headless, so nothing renders onto the X display and the `/websockify` upgrade has no remaining consumer; deleting that stack is separate work.
+- `{hostname}-edge.service` — the always-on public listener on the configured port (default 19200). Reverse-proxies HTTP to the main brand service and handles `/websockify` (VNC) WebSocket upgrades locally. An earlier fix: also hosts `/api/admin/actions/*` and `/api/admin/version*` — the Software Update modal's own routes — so they survive the brand service's restart window. It is restarted by the upgrade flow too (`packages/create-maxy-code/src/index.ts:5143`, after the brand service is stopped and before it is restarted), so the update stream drops near the end of every run and resumes by byte offset. It is not a connection that survives; the log file is what survives, and the browser's `EventSource` replays `Last-Event-ID` to pick the tail back up. The operator views the device's Chromium in the admin UI via the standalone `/browser` page (peer to `/graph` and `/data`) and on the Claude sign-in screen; both render CDP screencast frames over `/cdp-screencast`, not the framebuffer. Virtual-mode Chromium is headless, so nothing renders onto the X display and the `/websockify` upgrade has no remaining consumer; deleting that stack is separate work.
 
-Upgrade and Cloudflare setup run as detached actions: `systemd-run --user` transient units per invocation with stdout+stderr persisted to `~/.maxy/logs/actions/<actionId>.log` and streamed to the UI via SSE. No boot-time service file exists for these.
+The upgrade runs as a detached action: a `systemd-run --user --unit=maxy-action-<actionId> --collect` transient unit per invocation, with stdout+stderr persisted to `~/.<brand>/logs/actions/<actionId>.log` and streamed to the UI via SSE. The unit has its own cgroup, so it outlives both service restarts the installer performs. Its final log line is `[action-exit] code=<n>`, written by the wrapper, which is how the exit code survives a unit that `--collect` has already reaped. A sidecar `~/.<brand>/logs/actions/<actionId>.json` holds the package, start time and pre-upgrade version, so a modal reopened after a reload can still report what changed. No boot-time service file exists for these. Cloudflare setup is not an action; it runs PTY-native from admin chat.
 
-If an action looks stuck, read `~/.maxy/logs/actions/<actionId>.log` directly for the full output, or `journalctl --user --identifier=maxy-action-<actionId>` for systemd's record.
+If an action looks stuck, read `~/.<brand>/logs/actions/<actionId>.log` directly for the full output, or `journalctl --user --identifier=maxy-action-<actionId>` for systemd's record. The lifecycle lines are tagged `[admin-action]` and keyed by `actionId`; they land in `~/.<brand>/logs/edge.log`, not `server.log`, because these routes run on the edge process.
 
 ## Linux laptops: snap-confined Chromium replacement
 
@@ -314,14 +314,20 @@ Empty output from step 3 = brand.json resolved cleanly and the badge reflects th
 
 ## Upgrading
 
-To upgrade {{productName}} to the latest version, ask {{productName}}: "Upgrade {{productName}}." The platform checks the current device identity (hostname and port via `system-status`), then re-runs the installer with explicit `--hostname` and `--port` flags to preserve them across the upgrade.
+There are two ways to upgrade, and both run the same installer.
+
+From the dashboard, press the download icon in the sidebar header (see below). From chat, ask {{productName}}: "Upgrade {{productName}}." The platform checks the current device identity (hostname and port via `system-status`), then re-runs the installer with explicit `--hostname` and `--port` flags to preserve them across the upgrade.
 
 The docs plugin (this plugin) is upgraded in the same step — you always have the documentation that matches your installed version.
 
-### Automatic upgrade alert
+### Upgrading from the dashboard
+
+The sidebar header shows the version you are running, under the product name, at all times. When a newer one is published a download icon appears beside it. There is no icon when you are already up to date, so the icon appearing is itself the news. If you work with the sidebar collapsed to the narrow rail, the version and the icon are hidden with the rest of the header text and a small coloured dot on the brand icon carries the same signal.
+
+Pressing the icon opens the Software Update window, which shows the version you have against the version available and an Update button. Pressing Update runs the installer and streams its output into the window as it happens.
 
-{{productName}} checks for new releases on every admin session start — whenever you log in, reload the page, or return to the admin chat. When a newer version is available, the Software Update window opens automatically showing your current and the latest version, with a one-click Upgrade button. Dismissing the window (click outside or the close button) defers the alert until your next login or reload; no alert is shown when you are already on the latest version.
+Closing the window does not cancel the upgrade. The installer runs in its own background unit, so it keeps going whether or not anything is watching, and reopening the window reattaches to the run in progress.
 
-The upgrade runs inside a live terminal embedded in the Software Update window — you see each installation step stream as it happens, and any password prompts from `sudo` appear directly in the terminal for you to answer. Closing the window does not cancel the upgrade; re-opening it reattaches to the same shell so you can see what happened while disconnected.
+**The connection drops near the end of every upgrade, and that is expected.** The installer restarts the server as its last step, which cuts the browser's connection to it. The window says "Reconnecting" while that happens, then picks the output back up from exactly where it left off. Nothing is lost and nothing needs restarting. When it finishes, the window reports the exit code and whether the version actually moved.
 
-The header menu's version indicator still reflects real-time status: a green dot means you are up to date, and an accent-coloured dot means an upgrade is available. Opening the menu refreshes the version check, so a long-lived session can still surface an upgrade that became available after login without reloading the page.
+The window reports a genuine failure in two shapes worth knowing. If the installer exits non-zero it says so with the code. If it exits cleanly but the version did not change, it says that too, rather than claiming success.

package/payload/platform/plugins/docs/references/internals.md

@@ -238,6 +238,8 @@ There is exactly one place each datum is read from, and every subsystem reads it
 - **Default agent + account id** come from the canonical account config `data/accounts/<id>/account.json`, resolved via `resolveAccount` / `resolveDefaultAgentSlug` / `getDefaultAccountId` (`app/lib/claude-agent/account.ts`). The UI server's bare-root handler and branding loader read it through these helpers — never from `~/.<brand>/account.json`, which nothing writes. A `null` default means a genuinely unset `defaultAgent`; the root logs `[public-root] op=serve-default slug=<s>` on success and `op=no-default` only when the canonical default is truly empty.
 - **Identity files** (IDENTITY.md, SOUL.md, KNOWLEDGE.md) come from `agents/<slug>/` — keyed on the agent's slug, never the literal role. A public agent renamed to a slug `≠ "public"` (e.g. `maxy-info`) spawns from `agents/maxy-info/`. Admin reads `agents/admin/`. The spawn composer and the standing reachability audit resolve this directory through one shared function, `resolveAgentIdentityDir(accountDir, role, slug)` (`claude-session-manager/src/agent-identity-locator.ts`), so the path the audit vouches for is byte-identical to the path the spawn reads — the audit's `reachable=true` implies the spawn will find the files, and a slug whose files are misplaced is reported `reachable=false reason=files-missing file=<path>` without a visitor request.
 
+**What a public block contains.** A `role='public'` compose emits `<identity>`, `<soul>`, `<platform-boundary>`, `<data-stewardship>` and `<knowledge>`, and nothing else. The `<host>` section every other role gets is omitted: hostname, LAN IPv4, admin URL and tunnel URL are facts about the operator's machine, and a visitor's agent holds only what its author wrote. The two standing directives stay because they constrain behaviour rather than stating extractable facts. `op=public-persona-composed … hostBytes=0` is the per-spawn proof; non-zero on a public spawn is the regression signal, readable without reproducing a visitor turn.
+
 Which account is `<id>`? The slug is the address, and the address names the account. `resolvePublicAddressFromDisk` (`platform/ui/app/lib/claude-agent/public-address.ts`) walks every valid account for an active agent at the requested slug: exactly one claimant serves; the house serves when it is among several claimants and the others are refused by name; two or more non-house claimants serve nobody. The bare root `/` carries no slug and stays the house's door with the house's `defaultAgent`. The four public surfaces — the `/{slug}` page, `POST /api/chat`, `POST /api/session` and the visitor transcript reader — share that one resolver, and the resolved account rides `agentAccountId` to `/public-spawn`, which re-scopes the spawn onto it. A visitor's uploads follow the same account, and the reader locates them from the session's own sidecar `accountId` rather than re-deriving them from the slug, because a slug's owner can change after the session ran. Slugs are not unique across accounts, so a collision is reported on every refusal (`[webchat] op=address-collision`) and counted on every run of the `webchat-address-audit` loop.
 
 ### Observability

package/payload/platform/plugins/docs/references/platform.md

@@ -167,9 +167,11 @@ The Data search panel ranks results by combining vector similarity with keyword
 
 ## Software Update and Cloudflare Setup
 
-Both flows run on the native Claude Code PTY surface in admin chat. There is no in-app upgrade modal and no Cloudflare setup form — the agent invokes the relevant Bash command directly and its stdout streams into chat verbatim.
+Cloudflare setup runs on the native Claude Code PTY surface in admin chat: there is no Cloudflare setup form, the agent invokes the relevant Bash command directly and its stdout streams into chat verbatim.
 
-- **Software update.** Re-run the installer (`npx -y @rubytech/create-<brand>@latest`) from a shell; HeaderMenu's version row turns sage when `installed === latest`.
+Software update has two doors. The PTY one is the same shape: the agent runs the installer via Bash and its stdout streams into chat. The dashboard one is a modal over the edge-hosted `/api/admin/actions` routes, which run the installer as a `systemd-run` transient unit and stream its log back by byte offset. Both re-run the same installer; neither mutates state directly.
+
+- **Software update.** Re-run the installer (`npx -y @rubytech/create-<brand>@latest`), from a shell, from admin chat via the `upgrade` skill, or from the dashboard control in the sidebar brand head. The brand head shows the installed version at all times and grows a download icon only while `updateAvailable` is true.
 - **Cloudflare setup.** Operator asks in chat; the agent invokes `cloudflared` directly via the Bash tool, following the numbered steps in `plugins/cloudflare/references/manual-setup.md`. cloudflared's stdout and stderr stream into the PTY; the OAuth URL printed by `cloudflared tunnel login` is linkified by the terminal so the operator clicks it and authorises Cloudflare in their own browser.
 
 **Mid-turn stream-drop banners.** If a chat turn ends abruptly the bubble shows one of two messages depending on what actually happened. You see "Server is restarting — reconnect will happen automatically." only when the app server itself emits the restart signal — typically during a Software Update or a Cloudflare setup that re-launches the brand service. You see "Lost connection — retrying." when your browser's connection to the Pi dropped mid-stream while the server was still up — typically a flaky Wi-Fi moment or the tunnel hiccupping. Either way the chat resumes once the connection is back; the previously-rendered messages stay on screen so you don't lose context.

package/payload/platform/scripts/__tests__/public-prompt-gate-registered.test.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Task 2424 — every UserPromptSubmit hook must either carry the public gate or
+# be on the inert list. A fifth injecting hook added without a gate emits no
+# event and does not reproduce on demand: the only symptom is a stranger being
+# told something about the operator.
+#
+# Both writers are scanned. provision-account-dir.sh writes the array at account
+# creation; the account-settings-*.sh libs patch it onto accounts that already
+# exist, which is the only path that reaches client sub-accounts. Of the four
+# libs only mailbox-inject and public-surface touch this event — askgate patches
+# PreToolUse and pdf-conformance patches PostToolUse, so the filter skipping
+# them is correct rather than a broken parser.
+#
+# The guard is matched as a fixed string, never as a mention of the variable: a
+# hook that merely READS MAXY_PUBLIC_ALLOWED_TOOLS is not gated by it, and
+# counting it as gated is exactly the false green this test exists to avoid.
+set -uo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROV="$DIR/../lib/provision-account-dir.sh"
+HOOKS_DIR="$DIR/../../plugins/admin/hooks"
+GUARD='[ -n "${MAXY_PUBLIC_ALLOWED_TOOLS:-}" ]'
+INERT="archive-ingest-surface-gate.sh public-tool-surface.sh"
+PASS=0; FAIL=0
+
+ok()  { echo "PASS: $1"; PASS=$((PASS+1)); }
+bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL+1)); }
+
+# Every hook script named inside the provision heredoc's UserPromptSubmit array.
+# The script name is taken from the END of each `"command"` string, not from a
+# `hooks/` prefix: provision writes `bash $HOOKS_PATH/<name>.sh`, so the literal
+# directory never appears there and a prefix anchor silently matches nothing.
+PROV_HOOKS=$(python3 - "$PROV" <<'PY'
+import re, sys
+src = open(sys.argv[1], encoding="utf-8").read()
+m = re.search(r'"UserPromptSubmit"\s*:\s*\[(.*?)\n    \]', src, re.S)
+if not m:
+    print("")
+    sys.exit(0)
+cmds = re.findall(r'"command"\s*:\s*"([^"]*)"', m.group(1))
+names = [n.group(1) for n in (re.search(r'([A-Za-z0-9_.-]+\.sh)\s*$', c.strip()) for c in cmds) if n]
+print("\n".join(sorted(set(names))))
+PY
+)
+
+# Every hook script named by a backfill lib that patches the same array. Read
+# only from the `_<NAME>_CMD=` constant each lib registers, not from every `.sh`
+# in the file: these libs name their siblings in prose, and a bare `.sh` sweep
+# turns those comments into phantom registrations.
+BACKFILL_HOOKS=""
+for lib in "$DIR"/../lib/account-settings-*.sh; do
+  grep -q 'hooks\.UserPromptSubmit' "$lib" || continue
+  cmd_names=$(grep -oE "^_[A-Z0-9_]+_CMD='[^']*'" "$lib" | grep -oE "[A-Za-z0-9_.-]+\.sh'$" | tr -d "'")
+  if [ -z "$cmd_names" ]; then
+    bad "$(basename "$lib") patches UserPromptSubmit but names no _<NAME>_CMD script — the parser cannot see what it registers"
+  fi
+  BACKFILL_HOOKS="$BACKFILL_HOOKS
+$cmd_names"
+done
+
+ALL=$(printf '%s\n%s\n' "$PROV_HOOKS" "$BACKFILL_HOOKS" | grep -v '^$' | sort -u)
+
+if [ -z "$ALL" ]; then
+  bad "no UserPromptSubmit hooks found in either writer — the parser is broken, not the tree"
+else
+  ok "found $(printf '%s\n' "$ALL" | wc -l | tr -d ' ') registered UserPromptSubmit hooks across both writers"
+fi
+
+for h in $ALL; do
+  case " $INERT " in
+    *" $h "*) ok "$h is on the inert list"; continue ;;
+  esac
+  if [ ! -f "$HOOKS_DIR/$h" ]; then
+    bad "$h is registered but has no script at $HOOKS_DIR/$h"
+  elif grep -qF "$GUARD" "$HOOKS_DIR/$h"; then
+    ok "$h carries the public gate"
+  else
+    bad "$h is registered on UserPromptSubmit with no public gate and is not inert"
+  fi
+done
+
+# The guard and the inert list each exist twice: here, and as exported constants
+# in public-prompt-surface.ts, which the standing census matches against. Two
+# hand-maintained copies of one literal is the drift class that bites silently,
+# so assert them equal. Divergence is not silent here — the census would FATAL
+# every hook on every account and fail every install smoke run — but it would be
+# a false alarm, and the cause would not be obvious from that output.
+CENSUS_TS="$DIR/../../services/claude-session-manager/src/public-prompt-surface.ts"
+if [ ! -f "$CENSUS_TS" ]; then
+  bad "the census module is not at $CENSUS_TS — this test can no longer check the shared literals"
+else
+  if grep -qF "export const PUBLIC_GATE_GUARD = '$GUARD'" "$CENSUS_TS"; then
+    ok "the census module's PUBLIC_GATE_GUARD matches the guard this test greps for"
+  else
+    bad "PUBLIC_GATE_GUARD in $CENSUS_TS differs from this test's GUARD — the two would disagree about what 'gated' means"
+  fi
+  for h in $INERT; do
+    if grep -qF "'$h'," "$CENSUS_TS" || grep -qF "'$h'" "$CENSUS_TS"; then
+      ok "the census module lists $h as inert too"
+    else
+      bad "$h is inert here but not in $CENSUS_TS — the census would FATAL on it"
+    fi
+  done
+fi
+
+# The path the standing census reads must stay the path provision writes.
+if grep -qF 'ACCOUNT_SETTINGS="$ACCOUNT_DIR/.claude/settings.json"' "$PROV"; then
+  ok "the settings path the census reads is still the path provision writes"
+else
+  bad "provision no longer writes .claude/settings.json — the census path is stale"
+fi
+
+echo "----"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/payload/platform/scripts/smoke-boot-services.sh

@@ -284,6 +284,20 @@ run_one() {
     fi
   done
 
+  # Task 2424 — a public-prompt-surface drift line means some account has a
+  # per-turn hook that will inject operator context into a visitor's turn. The
+  # census fires once at boot, inside this window. Scoped to this one tag rather
+  # than widening the generic `fatal ` regex above, which would newly fail this
+  # gate on unrelated subsystems' pre-existing drift lines.
+  local drift_line
+  drift_line="$(grep -m1 -F '[public-prompt-surface] op=drift FATAL' "$log_file" || true)"
+  if [ -n "$drift_line" ]; then
+    echo "[smoke] service=$name reason=public-prompt-surface-drift matched=$drift_line" >&2
+    echo "--- log ($log_file) ---" >&2
+    cat "$log_file" >&2
+    return 1
+  fi
+
   echo "[smoke-boot] service=$name specialist-tool-drift=ok system-prompt-sentinels=ok identity-drift=ok boot=ok elapsed-ms=$elapsed_ms"
   return 0
 }

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAoB3B,OAAO,KAAK,EAAU,SAAS,EAAW,MAAM,YAAY,CAAA;AAK5D,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAoBlD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAQlE;;;;;;;;;;;mFAWmF;AACnF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAE/C;AAED;;;;;;;;;;2EAU2E;AAC3E,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,IAAI,CAOlD;AAsFD,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;sBAEkB;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AAkED;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA2mHpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAoB3B,OAAO,KAAK,EAAU,SAAS,EAAW,MAAM,YAAY,CAAA;AAK5D,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAoBlD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAQlE;;;;;;;;;;;mFAWmF;AACnF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAE/C;AAED;;;;;;;;;;2EAU2E;AAC3E,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,IAAI,CAOlD;AAsFD,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;sBAEkB;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AAkED;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA2nHpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -3502,7 +3502,13 @@ export function buildHttpApp(deps) {
                 return c.json({ error: 'spawn-failed', reason: composed.reason }, 503);
             }
             appendSegments.push(composed.block);
-            deps.logger(`[rc-spawn] op=public-persona-composed slug=${rcAgentSlug} identityBytes=${composed.identityBytes} soulBytes=${composed.soulBytes} knowledgeBytes=${composed.knowledgeBytes}`);
+            // Task 2424 — `hostBytes=0` is the healthy value here and the per-spawn
+            // proof that a visitor's block carries no host addresses; non-zero is the
+            // composer regressing, readable without reproducing a visitor turn.
+            // `blockBytes` bounds the whole composed surface, so an unexpected growth
+            // (a section reaching this path that should not) is visible as a number
+            // rather than needing the block itself.
+            deps.logger(`[rc-spawn] op=public-persona-composed slug=${rcAgentSlug} identityBytes=${composed.identityBytes} soulBytes=${composed.soulBytes} knowledgeBytes=${composed.knowledgeBytes} hostBytes=${composed.hostBytes} blockBytes=${Buffer.byteLength(composed.block, 'utf8')}`);
         }
         if (appendSegments.length > 0) {
             argv.push('--append-system-prompt', appendSegments.join('\n\n'));
@@ -3678,6 +3684,20 @@ export function buildHttpApp(deps) {
         // match to false — grep-able (`op=cwd-check` + `match=false`) with no
         // live repro needed.
         deps.logger(`[rc-spawn] op=cwd-check unitToken=${unitToken} resolved=${env.ACCOUNT_DIR} actual=${effectiveAccountDir} match=${env.ACCOUNT_DIR === effectiveAccountDir}`);
+        // Task 2339 — the realised-surface hook's only input. `tool-allowlist` below
+        // records the surface this spawn was GIVEN; nothing recorded the surface it
+        // REALISES, so five tools ran under a one-tool allowlist and produced no
+        // line. Stamped here rather than inside buildRcChildEnv so it lands after
+        // the last argv push and the value is this spawn's final `--allowed-tools`
+        // set. Public spawns only; its presence is the signal the hook keys on.
+        //
+        // Task 2424 — moved ABOVE the `tool-allowlist` line, which now reports this
+        // value. It used to be stamped after, so the line could not see it. The four
+        // per-turn hook gates also key on this variable, so its absence on a public
+        // spawn is what `publicToolsEnv=0` names.
+        if (publicLockdown) {
+            env[PUBLIC_ALLOWED_TOOLS_ENV] = allowedToolsFromArgv(argv).join(',');
+        }
         // Task 2260 — the realised tool surface, on EVERY rc-spawn. /rc-spawn emitted
         // no such line, which is why the incident session was invisible to every
         // tool-surface audit. An admin spawn reports count=0 strictMcp=n, which is
@@ -3688,16 +3708,12 @@ export function buildHttpApp(deps) {
             count: publicLockdown ? publicLockdown.allowedTools.length : 0,
             strictMcp: publicLockdown !== null,
             mode: effectiveRcPermissionMode,
+            // Task 2424 — read back from the env actually stamped, not from the
+            // allowlist computed above, so the line reports what reached the child.
+            publicToolsEnv: (env[PUBLIC_ALLOWED_TOOLS_ENV] ?? '')
+                .split(',')
+                .filter((t) => t.length > 0).length,
         }));
-        // Task 2339 — the realised-surface hook's only input. `tool-allowlist` above
-        // records the surface this spawn was GIVEN; nothing recorded the surface it
-        // REALISES, so five tools ran under a one-tool allowlist and produced no
-        // line. Stamped here rather than inside buildRcChildEnv so it lands after
-        // the last argv push and the value is this spawn's final `--allowed-tools`
-        // set. Public spawns only; its presence is the signal the hook keys on.
-        if (publicLockdown) {
-            env[PUBLIC_ALLOWED_TOOLS_ENV] = allowedToolsFromArgv(argv).join(',');
-        }
         deps.logger(`[rc-spawn] op=argv unitToken=${unitToken} cwd=${effectiveAccountDir} permissionMode=${effectiveRcPermissionMode} model=${effectiveRcModel ?? 'unset'} effort=${effectiveRcEffort ?? 'unset'} positionalBytes=${positionalBytes} voiceBytes=${voiceBytes} argv=${JSON.stringify([deps.claudeBin, ...argv])}`);
         emitRcLife(deps.logger, 'argv', 'rc-spawn', 'node-pty', rcLifeMode, unitToken, {
             cwd: effectiveAccountDir,