@rubytech/create-maxy-code 0.1.591 → 0.1.593

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts

@@ -23,6 +23,43 @@ import { TelegramChannelStore } from './telegram-channel-store.js';
  *  named agent's IDENTITY/SOUL/KNOWLEDGE via composeAppendSystemPrompt, the same
  *  composer /public-spawn uses. An admin spawn is unchanged and still composes
  *  only reseat / voice / specialist-domains / authenticated-identity fragments. */
+/** Task 2666 — the framing a channel server may be given, or null when the
+ *  spawn does not carry one.
+ *
+ *  A channel server has exactly two framings, and `admin` is the
+ *  higher-privilege one: its instruction block tells the agent the message "is
+ *  a message the operator has typed to you directly" and to act on it as their
+ *  instruction. Every site that reached it by exclusion — anything not
+ *  `'public'` becomes admin — turned each way of getting the role wrong into a
+ *  privilege elevation that emitted nothing, because a spawn that silently
+ *  became admin is byte-identical to a correct admin spawn.
+ *
+ *  So this answers the question and never invents an answer. `passive` is not a
+ *  channel framing and null means the role was never resolved; both return null
+ *  and the caller refuses the spawn. */
+export declare function channelFramingRole(role: AgentRole | null): 'admin' | 'public' | null;
+/** Task 2666 — the same value at the point of use, where null is unreachable
+ *  because the caller refused the spawn already.
+ *
+ *  A throw rather than a `!` assertion or a default. The compiler cannot narrow
+ *  through the `channelBound && framing === null` conjunction that guards the
+ *  attach blocks, and the two ways of silencing it are both worse than a crash:
+ *  `!` asserts an invariant it cannot check, and a default reintroduces exactly
+ *  the admin-by-exclusion this task removed. If the guard is ever conditioned
+ *  away, this is loud on the first spawn instead of quiet for ever. */
+export declare function requireChannelFraming(role: 'admin' | 'public' | null): 'admin' | 'public';
+/** Task 2666 — the telegram plugin's own public tools, out of the install-wide
+ *  public surface `loadToolSurface` built from every PLUGIN.md at boot.
+ *
+ *  Filtered to this one plugin rather than passed whole: a pinned public
+ *  telegram spawn registers only the telegram servers, so a public tool
+ *  declared on any other plugin would name a server that is not there — the
+ *  granted-but-uncallable failure this task's `op=mcp-registered` line exists
+ *  to make visible. Filtering states that boundary instead of relying on no
+ *  other plugin ever declaring one.
+ *
+ *  Sorted so the emitted argv is stable and the audit test can compare. */
+export declare function telegramPublicToolsFrom(publicSurface: ReadonlySet<string>): string[];
 export declare function parseRcSpawnRole(body: {
     role?: unknown;
 }): Extract<AgentRole, 'admin' | 'public'> | null;

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAqB3B,OAAO,KAAK,EAAU,SAAS,EAAW,MAAM,YAAY,CAAA;AAM5D,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAoBlD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAQlE;;;;;;;;;;;mFAWmF;AACnF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAE/C;AAED;;;;;;;;;;2EAU2E;AAC3E,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,IAAI,CAOlD;AAsFD,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAYlD,eAAO,MAAM,+BAA+B,QAAS,CAAA;AAIrD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;sBAEkB;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;mFAE+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;AACjB;;;;;gFAKgF;AAChF,WAAW,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CA8CT;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAkGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AAkED;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA+0HpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAsB3B,OAAO,KAAK,EAAU,SAAS,EAAW,MAAM,YAAY,CAAA;AAM5D,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAoBlD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAQlE;;;;;;;;;;;mFAWmF;AACnF;;;;;;;;;;;;;wCAawC;AACxC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,GAAG,IAAI,CAEpF;AAED;;;;;;;;uEAQuE;AACvE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,GAAG,QAAQ,CAKzF;AAED;;;;;;;;;;2EAU2E;AAC3E,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAGpF;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,CAE/C;AAED;;;;;;;;;;2EAU2E;AAC3E,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG,IAAI,CAOlD;AAsFD,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAYlD,eAAO,MAAM,+BAA+B,QAAS,CAAA;AAIrD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;sBAEkB;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;mFAE+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;AACjB;;;;;gFAKgF;AAChF,WAAW,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CA8CT;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAkGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AAkED;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA29HpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -27,6 +27,7 @@ import { requirePlatformPort } from './channel-spawn-tee.js';
 import { parseWaChannelBody, sessionIdFieldsFor } from './public-spawn-session.js';
 import { buildWebchatChannelMcpServers, buildWebchatChannelArgv, webchatChannelMcpConfigPath, WEBCHAT_CHANNEL_SERVER_NAME } from './webchat-channel-mcp.js';
 import { buildTelegramChannelMcpServers, buildTelegramChannelArgv, telegramChannelMcpConfigPath, TELEGRAM_CHANNEL_SERVER_NAME } from './telegram-channel-mcp.js';
+import { buildTelegramPluginMcpServers, TELEGRAM_PLUGIN_SERVER_NAME } from './telegram-plugin-mcp.js';
 import { buildChannelMcpServers, buildChannelArgv, channelMcpConfigPath, CHANNEL_SERVER_NAME } from './channel-mcp.js';
 import { buildRcPublicLockdownArgv, formatToolAllowlistLine, PUBLIC_ALLOWED_TOOLS_ENV, allowedToolsFromArgv, formatRoleResolutionLine, } from './rc-public-lockdown.js';
 import { resolvePublicSpawnModel } from './public-spawn-model.js';
@@ -78,6 +79,53 @@ const ROLES = ['admin', 'public'];
  *  named agent's IDENTITY/SOUL/KNOWLEDGE via composeAppendSystemPrompt, the same
  *  composer /public-spawn uses. An admin spawn is unchanged and still composes
  *  only reseat / voice / specialist-domains / authenticated-identity fragments. */
+/** Task 2666 — the framing a channel server may be given, or null when the
+ *  spawn does not carry one.
+ *
+ *  A channel server has exactly two framings, and `admin` is the
+ *  higher-privilege one: its instruction block tells the agent the message "is
+ *  a message the operator has typed to you directly" and to act on it as their
+ *  instruction. Every site that reached it by exclusion — anything not
+ *  `'public'` becomes admin — turned each way of getting the role wrong into a
+ *  privilege elevation that emitted nothing, because a spawn that silently
+ *  became admin is byte-identical to a correct admin spawn.
+ *
+ *  So this answers the question and never invents an answer. `passive` is not a
+ *  channel framing and null means the role was never resolved; both return null
+ *  and the caller refuses the spawn. */
+export function channelFramingRole(role) {
+    return role === 'admin' || role === 'public' ? role : null;
+}
+/** Task 2666 — the same value at the point of use, where null is unreachable
+ *  because the caller refused the spawn already.
+ *
+ *  A throw rather than a `!` assertion or a default. The compiler cannot narrow
+ *  through the `channelBound && framing === null` conjunction that guards the
+ *  attach blocks, and the two ways of silencing it are both worse than a crash:
+ *  `!` asserts an invariant it cannot check, and a default reintroduces exactly
+ *  the admin-by-exclusion this task removed. If the guard is ever conditioned
+ *  away, this is loud on the first spawn instead of quiet for ever. */
+export function requireChannelFraming(role) {
+    if (role === null) {
+        throw new Error('rc-spawn: channel framing unresolved at attach — the guard above must refuse first');
+    }
+    return role;
+}
+/** Task 2666 — the telegram plugin's own public tools, out of the install-wide
+ *  public surface `loadToolSurface` built from every PLUGIN.md at boot.
+ *
+ *  Filtered to this one plugin rather than passed whole: a pinned public
+ *  telegram spawn registers only the telegram servers, so a public tool
+ *  declared on any other plugin would name a server that is not there — the
+ *  granted-but-uncallable failure this task's `op=mcp-registered` line exists
+ *  to make visible. Filtering states that boundary instead of relying on no
+ *  other plugin ever declaring one.
+ *
+ *  Sorted so the emitted argv is stable and the audit test can compare. */
+export function telegramPublicToolsFrom(publicSurface) {
+    const prefix = `mcp__${TELEGRAM_PLUGIN_SERVER_NAME}__`;
+    return [...publicSurface].filter((n) => n.startsWith(prefix)).sort();
+}
 export function parseRcSpawnRole(body) {
     return body.role === 'admin' || body.role === 'public' ? body.role : null;
 }
@@ -2859,7 +2907,23 @@ export function buildHttpApp(deps) {
             typeof telegramChannelRaw.senderId === 'string' &&
             typeof telegramChannelRaw.gatewayUrl === 'string' &&
             typeof telegramChannelRaw.serverPath === 'string'
-            ? telegramChannelRaw
+            ? (() => {
+                const o = telegramChannelRaw;
+                // Task 2666 — the pin is admitted only as a matched PAIR of
+                // non-empty strings, and is OPTIONAL so the admin and specialist
+                // telegram spawns that come through this same door still validate.
+                // A half pin would confine one axis and leave the other free,
+                // which reads as protection while granting exactly what the pin
+                // exists to prevent.
+                const pinned = typeof o.botId === 'string' && o.botId.length > 0 &&
+                    typeof o.chatId === 'string' && o.chatId.length > 0;
+                return {
+                    senderId: o.senderId,
+                    gatewayUrl: o.gatewayUrl,
+                    serverPath: o.serverPath,
+                    ...(pinned ? { botId: o.botId, chatId: o.chatId } : {}),
+                };
+            })()
             : undefined;
         // Task-962 — recover an already-live but unresponsive webchat session. When
         // set, the already-live branch classifies the child busy vs wedged and
@@ -3308,8 +3372,17 @@ export function buildHttpApp(deps) {
             else {
                 const stored = deps.telegramChannelStore?.get(sessionId);
                 if (stored) {
-                    effectiveTelegramChannel = { senderId: stored.senderId, gatewayUrl: stored.gatewayUrl, serverPath: stored.serverPath };
-                    deps.logger(`[rc-spawn] op=telegram-channel-rebind sessionId=${sessionId.slice(0, 8)} senderId=${stored.senderId} source=store`);
+                    // Task 2666 — the pin comes back with the binding, so the second and
+                    // every later message of a public conversation keeps the rich
+                    // surface. Spread as a pair: the store admits both or neither.
+                    effectiveTelegramChannel = {
+                        senderId: stored.senderId,
+                        gatewayUrl: stored.gatewayUrl,
+                        serverPath: stored.serverPath,
+                        ...(stored.botId && stored.chatId ? { botId: stored.botId, chatId: stored.chatId } : {}),
+                    };
+                    deps.logger(`[rc-spawn] op=telegram-channel-rebind sessionId=${sessionId.slice(0, 8)} senderId=${stored.senderId} ` +
+                        `pinned=${stored.botId && stored.chatId ? 'yes' : 'no'} source=store`);
                 }
             }
         }
@@ -3395,9 +3468,35 @@ export function buildHttpApp(deps) {
             targetSet = mergeTarget(targetSet, { kind: 'whatsapp', ...effectiveWaChannel, accountId: effectiveAccountId });
         if (effectiveWebchatChannel)
             targetSet = mergeTarget(targetSet, { kind: 'webchat', ...effectiveWebchatChannel });
+        // Task 2666 — resolved ONCE for all three channel builders, and refused
+        // rather than defaulted. Before this, each builder took an optional role
+        // and filled an absent one in as 'admin' at the stamp, so a resume that
+        // carried no role framed a stranger's conversation as the operator's and
+        // logged nothing. Two of the three channel servers already threw on an
+        // absent value; the builders' own defaults meant they never saw one, so
+        // that strictness was unreachable.
+        //
+        // The cost is stated rather than hidden, as Task 2267 stated its own. That
+        // task chose 200-plus-lockdown for a channel-bound resume whose role will
+        // not resolve, which fails closed on TOOLS. It could not fail closed on
+        // framing, because the framing default was admin. Refusing covers both, and
+        // an admin whose sidecar is damaged now gets a named error instead of a
+        // session that silently comes back holding one tool and never repairs
+        // itself.
+        const channelFraming = channelFramingRole(effectiveRcRole);
+        if (channelBound && channelFraming === null) {
+            deps.logger(`[rc-spawn] op=channel-role-unresolved sessionId=${sessionId?.slice(0, 8) ?? 'none'} ` +
+                `role=${effectiveRcRole ?? 'none'} outcome=${priorSidecarRead?.outcome ?? 'missing'}`);
+            return c.json({ error: 'spawn-failed', reason: 'channel-role-unresolved' }, 503);
+        }
         let waPath = null;
         let webchatPath = null;
         let telegramPath = null;
+        // Task 2666 — the telegram tools this spawn is granted. Non-empty only when
+        // a pinned public telegram channel attached AND its config write succeeded,
+        // so a failed write cannot leave the allowlist naming a server that was
+        // never registered.
+        let telegramPublicExtraTools = [];
         // Task 2260 — the channel server this spawn actually registered, set inside
         // each branch below that succeeded in writing its --mcp-config (a write
         // failure leaves it null). The public lockdown reads it to name the one
@@ -3439,11 +3538,15 @@ export function buildHttpApp(deps) {
                     nodeBin: deps.nodeBin,
                     // Task 2290 — the account the gateway keys this session's hub entry on.
                     accountId: effectiveAccountId,
-                    // Task 2458 — the body role, same value and same bridging as the
-                    // telegram sibling below. The gateway branches this session's turn-end
-                    // delivery on it, so a public visitor's answer goes back down the
-                    // posting key instead of into the admin identity fan-out.
-                    role: rcRole ?? undefined,
+                    // Task 2458 — the gateway branches this session's turn-end delivery
+                    // on it, so a public visitor's answer goes back down the posting key
+                    // instead of into the admin identity fan-out.
+                    //
+                    // Task 2666 — the RESOLVED framing, not the body role. The body role
+                    // is null on a bare resume, which used to fall through the builder's
+                    // default to admin. Refused above when it will not resolve, so this
+                    // is non-null here.
+                    role: requireChannelFraming(channelFraming),
                     // Task 2356 — the spawn-tee inputs, so this server's stderr lands in
                     // logs/mcp-whatsapp-channel-<sessionId>.log.
                     platformRoot: deps.platformRoot,
@@ -3470,6 +3573,10 @@ export function buildHttpApp(deps) {
                     gatewayUrl: effectiveWebchatChannel.gatewayUrl,
                     serverPath: effectiveWebchatChannel.serverPath,
                     nodeBin: deps.nodeBin,
+                    // Task 2666 — this call site named NO role at all, so every webchat
+                    // spawn through this door took the builder's 'admin' default,
+                    // including a public one. The resolved framing is passed now.
+                    role: requireChannelFraming(channelFraming),
                     // Task 2356 — the spawn-tee inputs, so this server's stderr lands in
                     // logs/mcp-webchat-channel-<sessionId>.log.
                     platformRoot: deps.platformRoot,
@@ -3500,25 +3607,83 @@ export function buildHttpApp(deps) {
                     gatewayUrl: effectiveTelegramChannel.gatewayUrl,
                     serverPath: effectiveTelegramChannel.serverPath,
                     nodeBin: deps.nodeBin,
-                    // Task 2325 — the body role, unchanged in meaning; `?? undefined`
-                    // only bridges null to the optional parameter this builder declares.
-                    role: rcRole ?? undefined,
+                    // Task 2325 — `?? undefined` only bridges null to the optional
+                    // parameter this builder declares.
+                    //
+                    // Task 2666 — `effectiveRcRole`, not the body role. A resume omits
+                    // `role` (the wedged-session recovery and the re-seat send both post
+                    // `{ sessionId }` alone), so the body value resolved null and this
+                    // server booted with ADMIN framing on a public conversation: the
+                    // admin block tells the agent the message "is a message the operator
+                    // has typed to you directly" and to act on it as their instruction,
+                    // which handed a stranger's message operator authority. The lockdown
+                    // below and this task's pin gate already read `effectiveRcRole`, so
+                    // the framing was also the one axis that disagreed with the tool
+                    // grant on the same spawn. Resolved once above, and refused there
+                    // when it will not resolve, rather than mapped to a default here.
+                    role: requireChannelFraming(channelFraming),
                     // Task 2356 — the spawn-tee inputs, so this server's stderr lands in
                     // logs/mcp-telegram-channel-<sessionId>.log.
                     platformRoot: deps.platformRoot,
                     logDir: deps.logDir,
                     platformPort: requirePlatformPort(),
                 });
+                // Task 2666 — the pinned rich surface. Gated on the PAIR: without both
+                // a bot and a chat there is nothing to pin the tools to, and an
+                // unpinned grant would let a visitor's turn name any chat. Gated on
+                // role:'public' too, because an admin telegram spawn already holds this
+                // same plugin under the long prefix from the installed-plugin channel;
+                // registering it again here would give one session two live copies of
+                // the same MCP server.
+                const telegramPin = effectiveRcRole === 'public' && effectiveTelegramChannel.botId && effectiveTelegramChannel.chatId
+                    ? { botId: effectiveTelegramChannel.botId, chatId: effectiveTelegramChannel.chatId }
+                    : null;
+                const telegramPluginServers = telegramPin
+                    ? buildTelegramPluginMcpServers({
+                        sessionId,
+                        botId: telegramPin.botId,
+                        chatId: telegramPin.chatId,
+                        accountId: effectiveAccountId,
+                        nodeBin: deps.nodeBin,
+                        platformRoot: deps.platformRoot,
+                        logDir: deps.logDir,
+                        platformPort: requirePlatformPort(),
+                    })
+                    : {};
+                if (!telegramPin && effectiveRcRole === 'public') {
+                    // A public telegram spawn that reached here with no pin. Emitted
+                    // rather than left silent: the surface it gets is the pre-2666 single
+                    // entry, and without this line that is indistinguishable from a spawn
+                    // this feature was never meant to widen.
+                    deps.logger(`[telegram-public] op=pin-absent sessionId=${sessionId.slice(0, 8)} ` +
+                        `botId=${effectiveTelegramChannel.botId ?? 'none'} chatId=${effectiveTelegramChannel.chatId ?? 'none'}`);
+                }
                 telegramPath = telegramChannelMcpConfigPath(sessionId, tmpdir());
                 try {
-                    writeFileSync(telegramPath, JSON.stringify({ mcpServers: telegramServers }, null, 2), 'utf8');
+                    // Both servers in ONE config file, so the existing single
+                    // `--mcp-config` argv carries them. The dev-channels flag still names
+                    // `telegram-channel` alone: the plugin server is an ordinary MCP
+                    // server, not a development channel.
+                    writeFileSync(telegramPath, JSON.stringify({ mcpServers: { ...telegramServers, ...telegramPluginServers } }, null, 2), 'utf8');
                     argv.push(...buildTelegramChannelArgv(telegramPath));
                     channelServerName = TELEGRAM_CHANNEL_SERVER_NAME;
+                    if (telegramPin) {
+                        telegramPublicExtraTools = telegramPublicToolsFrom(deps.toolSurface.public);
+                        // The config write, with the count actually in the file. `count=N`
+                        // on the tool-allowlist line with no line here is the
+                        // argv-names-an-unregistered-server signature, and it is visible at
+                        // spawn with no visitor turn.
+                        deps.logger(`[telegram-public] op=mcp-registered sessionId=${sessionId.slice(0, 8)} ` +
+                            `server=${TELEGRAM_PLUGIN_SERVER_NAME} path=${telegramPath} tools=${telegramPublicExtraTools.length}`);
+                    }
                     deps.logger(`[rc-spawn] op=telegram-channel senderId=${effectiveTelegramChannel.senderId} gateway=${effectiveTelegramChannel.gatewayUrl} path=${telegramPath}`);
                     deps.logger(`[rc-spawn] op=channel-mcp-spawn channel=telegram node=${deps.nodeBin} exists=${existsSync(deps.nodeBin)}`);
                 }
                 catch (err) {
                     telegramPath = null;
+                    // Reset with it: granting tools whose server was never registered is
+                    // the exact failure the op=mcp-registered line exists to catch.
+                    telegramPublicExtraTools = [];
                     deps.logger(`[rc-spawn] op=telegram-channel-write-failed err=${JSON.stringify(err instanceof Error ? err.message : String(err))}`);
                 }
             }
@@ -3549,7 +3714,7 @@ export function buildHttpApp(deps) {
         // itself gated on a non-null role and so never repairs the file. The
         // `op=role-resolution` line above is what makes that state greppable.
         const publicLockdown = effectiveRcRole === 'public' || (effectiveRcRole === null && channelBound)
-            ? buildRcPublicLockdownArgv(channelServerName)
+            ? buildRcPublicLockdownArgv(channelServerName, telegramPublicExtraTools)
             : null;
         if (publicLockdown) {
             // A re-seat fork pushes its own caller-picked --permission-mode above,