@rubytech/create-maxy-code 0.1.570 → 0.1.571

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.570",
+  "version": "0.1.571",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,12 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-08-06 (0.1.571)
+
+- Telegram no longer drops inbound messages that are not plain text: voice notes are transcribed into the turn text, and a live location renders as a single track on the map that fits its own viewport.
+- The Telegram media filename now stays inside its own directory, closing the outbound-guard redaction gap.
+- The Public spawn tool lockdown was verified against real evidence and archived, and a stray malformed-edit message is now kept inside its own share.
+
 ## 2026-08-06 (0.1.570)
 
 - Reading a PDF now injects the text layer, so values copied from a PDF are not transcribed by eye any more.

package/payload/platform/plugins/whatsapp/references/channels-whatsapp.md

@@ -278,7 +278,7 @@ Structured `isLocation` and `locationText` fields are set alongside the body but
 
 The wire carries no URL. `LiveLocationMessage` is ten fields, all coordinates and motion data; the tappable map on a handset is that client drawing the coordinates. There is nothing to store or forward but the numbers. The end of a share is not observable either, for the same reason no update is: nothing after the first message reaches a companion seat.
 
-**Operator reader.** `platform/ui/app/whatsapp/location-map.tsx` draws an OpenStreetMap tile block on any bubble whose whole trimmed body parses as a coordinate. Attribution is mandatory and load-bearing, not decoration. Tile policy, the census counters (`op=wa-location-census`) and the alarm conditions live in `.docs/whatsapp-location-map.md` in the source repo. That file is a platform-developer note: it ships to no install and is not reachable through `plugin-read`, which is why the operator-facing facts are stated here rather than linked.
+**Operator reader.** `platform/ui/app/whatsapp/location-map.tsx` draws an OpenStreetMap tile block on any bubble whose whole trimmed body parses as a coordinate. Attribution is mandatory and load-bearing, not decoration. Tile policy, the census alarm (`op=location-census-alarm`) and its conditions live in `.docs/whatsapp-location-map.md` in the source repo. That file is a platform-developer note: it ships to no install and is not reachable through `plugin-read`, which is why the operator-facing facts are stated here rather than linked.
 
 **Outbound is absent.** The delivery surface is the turn's own text plus `SendUserFile`; no code path sends a `locationMessage`. Putting a pin into a chat is unbuilt work, not a setting.
 

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAqB3B,OAAO,KAAK,EAAU,SAAS,EAAW,MAAM,YAAY,CAAA;AAM5D,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAoBlD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAQlE;;;;;;;;;;;mFAWmF;AACnF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAE/C;AAED;;;;;;;;;;2EAU2E;AAC3E,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,IAAI,CAOlD;AAsFD,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;sBAEkB;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;AACjB;;;;;gFAKgF;AAChF,WAAW,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CA8CT;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAkGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AAkED;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAmuHpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAqB3B,OAAO,KAAK,EAAU,SAAS,EAAW,MAAM,YAAY,CAAA;AAM5D,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAoBlD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAQlE;;;;;;;;;;;mFAWmF;AACnF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAE/C;AAED;;;;;;;;;;2EAU2E;AAC3E,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,IAAI,CAOlD;AAsFD,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;sBAEkB;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;AACjB;;;;;gFAKgF;AAChF,WAAW,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CA8CT;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAkGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AAkED;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA4vHpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -1122,11 +1122,12 @@ export function buildHttpApp(deps) {
         const initialMessage = typeof body.initialMessage === 'string' && body.initialMessage.length > 0
             ? body.initialMessage
             : undefined;
-        // Task 1483 — a WhatsApp passive account-manager spawn. `passive` selects the
+        // Task 1483 — a WhatsApp passive account-manager spawn selects the
         // work-create-only, no-reply surface; `targetAccountId` (shape-gated like an
-        // account dir) scopes the spawn to the sub-account. Both are ignored unless
-        // the role is public (passive rides the public restricted path).
-        const passive = body.passive === true;
+        // account dir) scopes the spawn to the sub-account. Task 2334 — the flag
+        // itself is read once, by `parseSpawnRole` above, and reaches every site in
+        // this handler as `agentRole === 'passive'`. A second read here would be a
+        // second definition of the same invariant.
         const targetAccountId = typeof body.targetAccountId === 'string' && /^[A-Za-z0-9_-]{1,64}$/.test(body.targetAccountId)
             ? body.targetAccountId
             : undefined;
@@ -1225,7 +1226,15 @@ export function buildHttpApp(deps) {
             ? `array(${body.dormantPlugins.length})`
             : body.dormantPlugins == null ? 'absent' : typeof body.dormantPlugins;
         const initialMessageBytes = typeof body.initialMessage === 'string' ? Buffer.byteLength(body.initialMessage, 'utf8') : 0;
-        deps.logger(`spawn-request senderId=${senderId || 'missing'} userId=${userId ? userId.slice(0, 8) : 'absent'} role=${role || 'missing'} channel=${channel || 'missing'} permissionMode=${typeof body.permissionMode === 'string' ? body.permissionMode : 'default'} channels=${Array.isArray(body.channels) ? body.channels.length : 0} attachmentDir=${typeof body.attachmentDir === 'string' ? 'set' : 'absent'} aboutOwner=${aboutOwnerShape} dormantPlugins=${dormantPluginsShape} tunnelUrl=${typeof body.tunnelUrl === 'string' ? 'set' : (body.tunnelUrl === null ? 'null' : 'absent')} initialMessageBytes=${initialMessageBytes}`);
+        // Task 2334 — `passive` and `specialist` sit beside `role=` because the three
+        // together are what the boundary parse resolves a persona from. Without them
+        // the line could not answer whether a passive-flagged specialist ever arrived,
+        // which is the question this task had to trace through the issuers instead.
+        // `body.passive === true` is the WIRE shape, deliberately not the resolved
+        // role: this line reports what was sent, and `role=` already reports what it
+        // resolved to. `specialist` is the shape-gated value, so a body whose field
+        // failed the slug pattern reports `absent` — what every downstream site sees.
+        deps.logger(`spawn-request senderId=${senderId || 'missing'} userId=${userId ? userId.slice(0, 8) : 'absent'} role=${role || 'missing'} passive=${body.passive === true} specialist=${specialist ?? 'absent'} channel=${channel || 'missing'} permissionMode=${typeof body.permissionMode === 'string' ? body.permissionMode : 'default'} channels=${Array.isArray(body.channels) ? body.channels.length : 0} attachmentDir=${typeof body.attachmentDir === 'string' ? 'set' : 'absent'} aboutOwner=${aboutOwnerShape} dormantPlugins=${dormantPluginsShape} tunnelUrl=${typeof body.tunnelUrl === 'string' ? 'set' : (body.tunnelUrl === null ? 'null' : 'absent')} initialMessageBytes=${initialMessageBytes}`);
         if (!senderId || parsedRole === null || agentRole === null || !CHANNELS.includes(channel)) {
             // Task 2325 — emitted only when the ROLE is what failed. The guard also
             // covers a missing senderId and a bad channel, and naming those
@@ -1264,10 +1273,13 @@ export function buildHttpApp(deps) {
         }
         // Task 1489 — a passive intake spawn rides role:'public' on this path but is
         // a trusted, sub-account-bound account manager, not an anonymous visitor. It
-        // is exempt from the anonymous-visitor limiter: `!passive` keeps a manager's
-        // requirement burst from being throttled, and keeps that burst from consuming
-        // (or being throttled by) the shared per-sender/global anonymous budget.
-        if (role === 'public' && !passive) {
+        // is exempt from the anonymous-visitor limiter: keeping a manager's
+        // requirement burst out of the limiter stops it being throttled, and stops it
+        // consuming (or being throttled by) the shared per-sender/global anonymous
+        // budget. Task 2334 — the exemption is expressed as `agentRole === 'public'`,
+        // which is exactly "the wire role was public and the passive resolution did
+        // not fire", rather than re-deriving that from the raw flag.
+        if (agentRole === 'public') {
             const decision = deps.publicSpawnLimiter.admit(senderId, channel);
             if (!decision.admitted) {
                 deps.logger(`spawn-rate-limited senderId=${senderId} channel=${channel} scope=${decision.scope} window=${decision.windowMs} cap=${decision.cap}`);
@@ -1328,7 +1340,11 @@ export function buildHttpApp(deps) {
         // assignment so the task always lands on a real admin. Undefined only when the
         // install has no live house admin at all (genuine drift — no edge is written).
         let assignedAdminUserId;
-        if (passive && role === 'public' && !specialist && targetAccountId) {
+        // Task 2334 — the three conjuncts this replaced (passive + role:'public' +
+        // no specialist) were the resolution rule restated. `agentRole === 'passive'`
+        // IS that rule, so the transcript scope can no longer diverge from the
+        // work-MCP graph scope, which reads the same resolved role in the spawner.
+        if (agentRole === 'passive' && targetAccountId) {
             const accountsRoot = join(dirname(deps.platformRoot), 'data', 'accounts');
             const accountJsonPath = join(accountsRoot, targetAccountId, 'account.json');
             if (!existsSync(accountJsonPath)) {
@@ -1401,7 +1417,11 @@ export function buildHttpApp(deps) {
                 // notify so its work-create is not logged as anonymous `role=public`
                 // activity and its exit does not emit a spurious webchat no-record. It
                 // gets the one-shot auto-close instead.
-                if (!passive) {
+                //
+                // Task 2334 — the resolved role. For a wire role of 'admin' this now
+                // enters the branch where the raw flag skipped it; both callees return
+                // immediately on `role !== 'public'` (:847, :877), so nothing changes.
+                if (agentRole !== 'passive') {
                     // Task 2271 — `spawnCwd` here is the re-scoped value, so the audit
                     // follows a public-agent session into its own account's slug.
                     attachPublicAudit(deps, tracker.sessionId, parsedRole.role, spawnCwd);
@@ -1418,8 +1438,13 @@ export function buildHttpApp(deps) {
                     }
                 }
                 attachSpecialistEndTurnAutoArchive(deps, tracker.sessionId, tracker.specialist);
-                attachPassiveEndTurnAutoClose(deps, tracker.sessionId, passive);
-                attachPassiveSpawnToolsCensus(deps, spawnCwd, tracker.sessionId, passive, Boolean(assignedAdminUserId));
+                // Task 2334 — the RESOLVED role, not the raw flag. `parseSpawnRole`
+                // already applied the Task 1483 invariant (a passive spawn rides
+                // role:'public' and is never a specialist); reading the raw boolean
+                // here re-derived it, and got it wrong for a passive flag on an admin
+                // spawn, which the invariant says to ignore and this attached anyway.
+                attachPassiveEndTurnAutoClose(deps, tracker.sessionId, agentRole === 'passive');
+                attachPassiveSpawnToolsCensus(deps, spawnCwd, tracker.sessionId, agentRole === 'passive', Boolean(assignedAdminUserId));
             },
             onUrlCaptured: notifyUrlCaptured,
             tunnelUrlOverride,