@rubytech/create-maxy-code 0.1.591 → 0.1.593

package/payload/platform/services/claude-session-manager/dist/rc-public-lockdown.d.ts

@@ -14,12 +14,20 @@ export declare const DONTASK_DENY_BASIS = "mcp__none__deny-basis";
  *  the WhatsApp tool on those spawns would allowlist a tool that is not
  *  registered and leave the visitor unable to reply at all. */
 export declare function publicReplyToolFor(channelServerName: string | null): string;
-/** The exact argv fragment appended to a role:'public' rc-spawn. Three flags,
- *  no more: one allowlist entry, `--strict-mcp-config` so only the per-spawn
- *  channel server registers and none of the plugin servers do, and
+/** The exact argv fragment appended to a role:'public' rc-spawn: one
+ *  `--allowed-tools` per granted name, `--strict-mcp-config` so only the
+ *  per-spawn servers register and none of the plugin servers do, and
  *  `--permission-mode dontAsk`, which overrides the brand defaultMode and
- *  auto-denies every unlisted tool including Bash, Write, Edit and Read. */
-export declare function buildRcPublicLockdownArgv(channelServerName: string | null): {
+ *  auto-denies every unlisted tool including Bash, Write, Edit and Read.
+ *
+ *  Task 2666 — `extraTools` is the pinned telegram surface. Supplied by the
+ *  caller rather than read here: this module is pure, and the authority for
+ *  which tools are public is PLUGIN.md as parsed into `toolSurface.public`.
+ *  Naming them here would be a second registry free to drift from the manifest.
+ *  Absent or empty reproduces the pre-2666 argv byte for byte, which is what
+ *  holds WhatsApp and webchat at their single reply entry — this builder is
+ *  shared by all three channels, so widening it for one could widen all. */
+export declare function buildRcPublicLockdownArgv(channelServerName: string | null, extraTools?: readonly string[]): {
     argv: string[];
     allowedTools: string[];
 };

package/payload/platform/services/claude-session-manager/dist/rc-public-lockdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rc-public-lockdown.d.ts","sourceRoot":"","sources":["../src/rc-public-lockdown.ts"],"names":[],"mappings":"AAYA;;;;;;;4BAO4B;AAC5B,eAAO,MAAM,kBAAkB,0BAA0B,CAAA;AAEzD;;;;;+DAK+D;AAC/D,wBAAgB,kBAAkB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE3E;AAED;;;;4EAI4E;AAC5E,wBAAgB,yBAAyB,CACvC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAM5C;AAED;;;gCAGgC;AAChC,wBAAgB,uBAAuB,CAAC,CAAC,EAAE;IACzC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ;;;;yEAIqE;IACrE,cAAc,EAAE,MAAM,CAAA;CACvB,GAAG,MAAM,CAET;AAED;;;;;;8CAM8C;AAC9C,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAEnE;;;;;mDAKmD;AACnD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAMtE;AAED;;;;;;+EAM+E;AAC/E,wBAAgB,wBAAwB,CAAC,CAAC,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAAA;IACzC,OAAO,EAAE,IAAI,GAAG,SAAS,GAAG,cAAc,CAAA;CAC3C,GAAG,MAAM,CAET"}
+{"version":3,"file":"rc-public-lockdown.d.ts","sourceRoot":"","sources":["../src/rc-public-lockdown.ts"],"names":[],"mappings":"AAYA;;;;;;;4BAO4B;AAC5B,eAAO,MAAM,kBAAkB,0BAA0B,CAAA;AAEzD;;;;;+DAK+D;AAC/D,wBAAgB,kBAAkB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE3E;AAED;;;;;;;;;;;;4EAY4E;AAC5E,wBAAgB,yBAAyB,CACvC,iBAAiB,EAAE,MAAM,GAAG,IAAI,EAChC,UAAU,GAAE,SAAS,MAAM,EAAO,GACjC;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAW5C;AAED;;;gCAGgC;AAChC,wBAAgB,uBAAuB,CAAC,CAAC,EAAE;IACzC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,OAAO,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ;;;;yEAIqE;IACrE,cAAc,EAAE,MAAM,CAAA;CACvB,GAAG,MAAM,CAET;AAED;;;;;;8CAM8C;AAC9C,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAEnE;;;;;mDAKmD;AACnD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAMtE;AAED;;;;;;+EAM+E;AAC/E,wBAAgB,wBAAwB,CAAC,CAAC,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAAA;IACzC,OAAO,EAAE,IAAI,GAAG,SAAS,GAAG,cAAc,CAAA;CAC3C,GAAG,MAAM,CAET"}

package/payload/platform/services/claude-session-manager/dist/rc-public-lockdown.js

@@ -27,17 +27,31 @@ export const DONTASK_DENY_BASIS = 'mcp__none__deny-basis';
 export function publicReplyToolFor(channelServerName) {
     return channelServerName ? `mcp__${channelServerName}__reply` : DONTASK_DENY_BASIS;
 }
-/** The exact argv fragment appended to a role:'public' rc-spawn. Three flags,
- *  no more: one allowlist entry, `--strict-mcp-config` so only the per-spawn
- *  channel server registers and none of the plugin servers do, and
+/** The exact argv fragment appended to a role:'public' rc-spawn: one
+ *  `--allowed-tools` per granted name, `--strict-mcp-config` so only the
+ *  per-spawn servers register and none of the plugin servers do, and
  *  `--permission-mode dontAsk`, which overrides the brand defaultMode and
- *  auto-denies every unlisted tool including Bash, Write, Edit and Read. */
-export function buildRcPublicLockdownArgv(channelServerName) {
+ *  auto-denies every unlisted tool including Bash, Write, Edit and Read.
+ *
+ *  Task 2666 — `extraTools` is the pinned telegram surface. Supplied by the
+ *  caller rather than read here: this module is pure, and the authority for
+ *  which tools are public is PLUGIN.md as parsed into `toolSurface.public`.
+ *  Naming them here would be a second registry free to drift from the manifest.
+ *  Absent or empty reproduces the pre-2666 argv byte for byte, which is what
+ *  holds WhatsApp and webchat at their single reply entry — this builder is
+ *  shared by all three channels, so widening it for one could widen all. */
+export function buildRcPublicLockdownArgv(channelServerName, extraTools = []) {
     const tool = publicReplyToolFor(channelServerName);
-    return {
-        argv: ['--allowed-tools', tool, '--strict-mcp-config', '--permission-mode', 'dontAsk'],
-        allowedTools: [tool],
-    };
+    // Deduped rather than concatenated: a caller that passed the channel entry
+    // among its extras would otherwise push the same flag twice, and `count=` on
+    // the tool-allowlist line would overstate the surface — the same field the
+    // op=mcp-registered reconciliation is read against.
+    const allowedTools = [...new Set([tool, ...extraTools])];
+    const argv = [];
+    for (const t of allowedTools)
+        argv.push('--allowed-tools', t);
+    argv.push('--strict-mcp-config', '--permission-mode', 'dontAsk');
+    return { argv, allowedTools };
 }
 /** The realised-surface line, emitted at spawn time on EVERY rc-spawn. Shares
  *  the `tool-allowlist` tag with pty-spawner.ts so one grep covers both spawn

package/payload/platform/services/claude-session-manager/dist/rc-public-lockdown.js.map

@@ -1 +1 @@
-{"version":3,"file":"rc-public-lockdown.js","sourceRoot":"","sources":["../src/rc-public-lockdown.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,uEAAuE;AACvE,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE;AACF,gFAAgF;AAChF,0DAA0D;AAE1D;;;;;;;4BAO4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAA;AAEzD;;;;;+DAK+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,iBAAgC;IACjE,OAAO,iBAAiB,CAAC,CAAC,CAAC,QAAQ,iBAAiB,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAA;AACpF,CAAC;AAED;;;;4EAI4E;AAC5E,MAAM,UAAU,yBAAyB,CACvC,iBAAgC;IAEhC,MAAM,IAAI,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAClD,OAAO;QACL,IAAI,EAAE,CAAC,iBAAiB,EAAE,IAAI,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,SAAS,CAAC;QACtF,YAAY,EAAE,CAAC,IAAI,CAAC;KACrB,CAAA;AACH,CAAC;AAED;;;gCAGgC;AAChC,MAAM,UAAU,uBAAuB,CAAC,CAWvC;IACC,OAAO,uBAAuB,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,cAAc,EAAE,CAAA;AAChJ,CAAC;AAED;;;;;;8CAM8C;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAA;AAEnE;;;;;mDAKmD;AACnD,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;+EAM+E;AAC/E,MAAM,UAAU,wBAAwB,CAAC,CAIxC;IACC,OAAO,2CAA2C,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,CAAA;AACrH,CAAC"}
+{"version":3,"file":"rc-public-lockdown.js","sourceRoot":"","sources":["../src/rc-public-lockdown.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,uEAAuE;AACvE,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE;AACF,gFAAgF;AAChF,0DAA0D;AAE1D;;;;;;;4BAO4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAA;AAEzD;;;;;+DAK+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,iBAAgC;IACjE,OAAO,iBAAiB,CAAC,CAAC,CAAC,QAAQ,iBAAiB,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAA;AACpF,CAAC;AAED;;;;;;;;;;;;4EAY4E;AAC5E,MAAM,UAAU,yBAAyB,CACvC,iBAAgC,EAChC,aAAgC,EAAE;IAElC,MAAM,IAAI,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAClD,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;IACxD,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,KAAK,MAAM,CAAC,IAAI,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAA;IAC7D,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAA;IAChE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;AAC/B,CAAC;AAED;;;gCAGgC;AAChC,MAAM,UAAU,uBAAuB,CAAC,CAWvC;IACC,OAAO,uBAAuB,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,cAAc,EAAE,CAAA;AAChJ,CAAC;AAED;;;;;;8CAM8C;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAA;AAEnE;;;;;mDAKmD;AACnD,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;+EAM+E;AAC/E,MAAM,UAAU,wBAAwB,CAAC,CAIxC;IACC,OAAO,2CAA2C,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,OAAO,EAAE,CAAA;AACrH,CAAC"}

package/payload/platform/services/claude-session-manager/dist/telegram-channel-mcp.d.ts

@@ -16,10 +16,13 @@ export interface TelegramChannelMcpParams {
      *  fails to spawn and the channel never boots (Task 1402); callers pass the
      *  installer-resolved NODE_BIN. */
     nodeBin: string;
-    /** 'public' frames the channel server's instructions + reply-tool copy for an
-     *  anonymous visitor; omitted/'admin' keeps the operator framing. Carried to
-     *  the server as TG_CHANNEL_ROLE. */
-    role?: 'admin' | 'public';
+    /** Which framing the channel server gives this conversation, carried as
+     *  TG_CHANNEL_ROLE. REQUIRED (Task 2666): it was optional, and an omitted
+     *  value reached a resolver that answered 'admin', so every way of getting
+     *  the role wrong landed on the highest-privilege framing and emitted
+     *  nothing. Required here means the compiler asks each caller the question
+     *  rather than a default answering it. */
+    role: 'admin' | 'public';
     /** Task 2356 — spawn-tee inputs; see channel-spawn-tee.ts. Supplied by the
      *  caller because this module is pure. */
     platformRoot: string;

package/payload/platform/services/claude-session-manager/dist/telegram-channel-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"telegram-channel-mcp.d.ts","sourceRoot":"","sources":["../src/telegram-channel-mcp.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,4BAA4B,qBAAqB,CAAA;AAE9D;;mDAEmD;AACnD,eAAO,MAAM,2BAA2B,iCAAgD,CAAA;AAExF,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB;;;uCAGmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf;;yCAEqC;IACrC,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IACzB;8CAC0C;IAC1C,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,8BAA8B,CAC5C,CAAC,EAAE,wBAAwB,GAC1B,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CA4B/C;AAED,uEAAuE;AACvE,wBAAgB,8BAA8B,IAAI,MAAM,EAAE,CAEzD;AAED;;;kCAGkC;AAClC,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED;4EAC4E;AAC5E,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAExE"}
+{"version":3,"file":"telegram-channel-mcp.d.ts","sourceRoot":"","sources":["../src/telegram-channel-mcp.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,4BAA4B,qBAAqB,CAAA;AAE9D;;mDAEmD;AACnD,eAAO,MAAM,2BAA2B,iCAAgD,CAAA;AAExF,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB;;;uCAGmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf;;;;;8CAK0C;IAC1C,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;IACxB;8CAC0C;IAC1C,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,8BAA8B,CAC5C,CAAC,EAAE,wBAAwB,GAC1B,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CA8B/C;AAED,uEAAuE;AACvE,wBAAgB,8BAA8B,IAAI,MAAM,EAAE,CAEzD;AAED;;;kCAGkC;AAClC,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED;4EAC4E;AAC5E,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAExE"}

package/payload/platform/services/claude-session-manager/dist/telegram-channel-mcp.js

@@ -40,9 +40,11 @@ export function buildTelegramChannelMcpServers(p) {
                 TG_CHANNEL_SENDER_ID: p.senderId,
                 TG_CHANNEL_GATEWAY_URL: p.gatewayUrl,
                 TG_CHANNEL_SESSION_ID: p.sessionId,
-                // Only the public path stamps a non-admin role; the default admin spawn
-                // omits it so its env stays byte-identical to an admin-only build.
-                ...(p.role === 'public' ? { TG_CHANNEL_ROLE: 'public' } : {}),
+                // Task 2666 — stamped verbatim on BOTH roles, like the whatsapp and
+                // webchat twins. It used to be stamped only on the public path, so an
+                // admin spawn's env carried no role at all and the server inferred one;
+                // that inference is what a resume with no role silently rode into.
+                TG_CHANNEL_ROLE: p.role,
             },
         },
     };

package/payload/platform/services/claude-session-manager/dist/telegram-channel-mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"telegram-channel-mcp.js","sourceRoot":"","sources":["../src/telegram-channel-mcp.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,eAAe;AACf,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAEhF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAA;AAE9D;;mDAEmD;AACnD,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,4BAA4B,SAAS,CAAA;AAgCxF,MAAM,UAAU,8BAA8B,CAC5C,CAA2B;IAE3B,8EAA8E;IAC9E,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,4BAA4B;QACxC,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAA;IACF,OAAO;QACL,CAAC,4BAA4B,CAAC,EAAE;YAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,oBAAoB,EAAE,CAAC,CAAC,QAAQ;gBAChC,sBAAsB,EAAE,CAAC,CAAC,UAAU;gBACpC,qBAAqB,EAAE,CAAC,CAAC,SAAS;gBAClC,wEAAwE;gBACxE,mEAAmE;gBACnE,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D;SACF;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,8BAA8B;IAC5C,OAAO,CAAC,yCAAyC,EAAE,UAAU,4BAA4B,EAAE,CAAC,CAAA;AAC9F,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,4BAA4B,CAAC,SAAiB,EAAE,GAAW;IACzE,OAAO,IAAI,CAAC,GAAG,EAAE,yBAAyB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AAC7F,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,wBAAwB,CAAC,aAAqB;IAC5D,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,8BAA8B,EAAE,CAAC,CAAA;AAC7E,CAAC"}
+{"version":3,"file":"telegram-channel-mcp.js","sourceRoot":"","sources":["../src/telegram-channel-mcp.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,eAAe;AACf,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAEhF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAA;AAE9D;;mDAEmD;AACnD,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,4BAA4B,SAAS,CAAA;AAmCxF,MAAM,UAAU,8BAA8B,CAC5C,CAA2B;IAE3B,8EAA8E;IAC9E,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,4BAA4B;QACxC,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAA;IACF,OAAO;QACL,CAAC,4BAA4B,CAAC,EAAE;YAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,oBAAoB,EAAE,CAAC,CAAC,QAAQ;gBAChC,sBAAsB,EAAE,CAAC,CAAC,UAAU;gBACpC,qBAAqB,EAAE,CAAC,CAAC,SAAS;gBAClC,oEAAoE;gBACpE,sEAAsE;gBACtE,wEAAwE;gBACxE,mEAAmE;gBACnE,eAAe,EAAE,CAAC,CAAC,IAAI;aACxB;SACF;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,8BAA8B;IAC5C,OAAO,CAAC,yCAAyC,EAAE,UAAU,4BAA4B,EAAE,CAAC,CAAA;AAC9F,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,4BAA4B,CAAC,SAAiB,EAAE,GAAW;IACzE,OAAO,IAAI,CAAC,GAAG,EAAE,yBAAyB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AAC7F,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,wBAAwB,CAAC,aAAqB;IAC5D,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,8BAA8B,EAAE,CAAC,CAAA;AAC7E,CAAC"}

package/payload/platform/services/claude-session-manager/dist/telegram-channel-store.d.ts

@@ -1,9 +1,23 @@
 import type { Logger } from './types.js';
-/** The three launch fields the channel argv is rebuilt from. */
+/** The three launch fields the channel argv is rebuilt from, plus Task 2666's
+ *  optional pin.
+ *
+ *  The pin is optional because an admin or specialist telegram spawn sends
+ *  neither, and a session bound before 2666 has neither on disk. It is stored
+ *  rather than re-derived because a RESUME rebuilds the channel argv from this
+ *  record alone: without it, the second and every later message of a public
+ *  conversation would come back with no pin and silently drop to the pre-2666
+ *  single-tool surface. */
 export interface TelegramChannelBinding {
     senderId: string;
     gatewayUrl: string;
     serverPath: string;
+    /** The bot this conversation belongs to, its numeric Telegram id. */
+    botId?: string;
+    /** The chat this conversation belongs to: the sender in a DM, the group in a
+     *  group, the customer's chat in a business chat. Never derived here — the
+     *  spawn site supplies the same value it hands the file follower. */
+    chatId?: string;
 }
 export interface TelegramChannelEntry extends TelegramChannelBinding {
     boundAt: string;

package/payload/platform/services/claude-session-manager/dist/telegram-channel-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"telegram-channel-store.d.ts","sourceRoot":"","sources":["../src/telegram-channel-store.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAExC,gEAAgE;AAChE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,oBAAqB,SAAQ,sBAAsB;IAClE,OAAO,EAAE,MAAM,CAAA;CAChB;AAYD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0C;IACtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;gBAEnB,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAK5C;;gDAE4C;IAC5C,YAAY,IAAI,IAAI;IA0CpB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAIxD,4EAA4E;IAC5E,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,oBAAoB;IAO7E,8EAA8E;IAC9E,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAMlC,oDAAoD;IACpD,IAAI,IAAI,MAAM;IAId,OAAO,CAAC,aAAa;CAatB"}
+{"version":3,"file":"telegram-channel-store.d.ts","sourceRoot":"","sources":["../src/telegram-channel-store.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAExC;;;;;;;;2BAQ2B;AAC3B,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;yEAEqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,oBAAqB,SAAQ,sBAAsB;IAClE,OAAO,EAAE,MAAM,CAAA;CAChB;AAkBD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0C;IACtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;gBAEnB,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAK5C;;gDAE4C;IAC5C,YAAY,IAAI,IAAI;IA6CpB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAIxD,4EAA4E;IAC5E,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,oBAAoB;IAO7E,8EAA8E;IAC9E,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAMlC,oDAAoD;IACpD,IAAI,IAAI,MAAM;IAId,OAAO,CAAC,aAAa;CAatB"}

package/payload/platform/services/claude-session-manager/dist/telegram-channel-store.js

@@ -23,7 +23,13 @@ function isValidBinding(v) {
     const o = v;
     return (typeof o.senderId === 'string' && o.senderId.length > 0 &&
         typeof o.gatewayUrl === 'string' && o.gatewayUrl.length > 0 &&
-        typeof o.serverPath === 'string' && o.serverPath.length > 0);
+        typeof o.serverPath === 'string' && o.serverPath.length > 0 &&
+        // Task 2666 — absent is valid, present-and-wrong is not. A numeric botId
+        // would reach the plugin env as the string "111" and still pin, so the
+        // shape is checked rather than coerced: a record this store cannot vouch
+        // for is skipped, and the spawn falls back to the closed surface.
+        (o.botId === undefined || (typeof o.botId === 'string' && o.botId.length > 0)) &&
+        (o.chatId === undefined || (typeof o.chatId === 'string' && o.chatId.length > 0)));
 }
 export class TelegramChannelStore {
     bySessionId = new Map();
@@ -71,12 +77,15 @@ export class TelegramChannelStore {
                 continue;
             const rawBoundAt = value.boundAt;
             const boundAt = typeof rawBoundAt === 'string' && rawBoundAt.length > 0 ? rawBoundAt : new Date(0).toISOString();
-            this.bySessionId.set(sessionId, {
-                senderId: value.senderId,
-                gatewayUrl: value.gatewayUrl,
-                serverPath: value.serverPath,
-                boundAt,
-            });
+            // Task 2666 — the pin fields are spread rather than named, because a
+            // hand-listed reconstruction drops any field added later in silence:
+            // `set` already spreads, so a listed load and a spread write disagreed
+            // about what a binding is, and the pin survived a write and died on the
+            // next boot. The cost is that an unrecognised key in a hand-edited file
+            // is now kept in memory rather than dropped; nothing reads one, and the
+            // argv rebuild names the fields it wants.
+            const { senderId, gatewayUrl, serverPath, ...rest } = value;
+            this.bySessionId.set(sessionId, { senderId, gatewayUrl, serverPath, ...rest, boundAt });
             loaded += 1;
         }
         this.logger(`[claude-session-manager] telegram-channel-store-load ok entries=${loaded} path=${this.filePath}`);

package/payload/platform/services/claude-session-manager/dist/telegram-channel-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"telegram-channel-store.js","sourceRoot":"","sources":["../src/telegram-channel-store.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,6EAA6E;AAC7E,6CAA6C;AAC7C,EAAE;AACF,aAAa;AACb,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,yEAAyE;AACzE,6DAA6D;AAC7D,2EAA2E;AAC3E,mEAAmE;AACnE,EAAE;AACF,4BAA4B;AAC5B,8GAA8G;AAE9G,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAc7E,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7C,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACvD,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC3D,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAC5D,CAAA;AACH,CAAC;AAED,MAAM,OAAO,oBAAoB;IACd,WAAW,GAAG,IAAI,GAAG,EAAgC,CAAA;IACrD,QAAQ,CAAQ;IAChB,MAAM,CAAQ;IAE/B,YAAY,QAAgB,EAAE,MAAc;QAC1C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;gDAE4C;IAC5C,YAAY;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,uFAAuF,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YACnH,OAAM;QACR,CAAC;QACD,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,wFAAwF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAA;YAC5I,OAAM;QACR,CAAC;QACD,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,4FAA4F,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAA;YAChJ,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,mGAAmG,CAAC,CAAA;YAChH,OAAM;QACR,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YACnF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YACrE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,SAAQ;YACpC,MAAM,UAAU,GAAI,KAA+B,CAAC,OAAO,CAAA;YAC3D,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAChH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO;aACR,CAAC,CAAA;YACF,MAAM,IAAI,CAAC,CAAA;QACb,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,mEAAmE,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC;IAED,4EAA4E;IAC5E,GAAG,CAAC,SAAiB,EAAE,OAA+B;QACpD,MAAM,KAAK,GAAyB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;QACrF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACtC,IAAI,CAAC,aAAa,EAAE,CAAA;QACpB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,SAAiB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,GAAG;YAAE,IAAI,CAAC,aAAa,EAAE,CAAA;QAC7B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,oDAAoD;IACpD,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;IAC9B,CAAC;IAEO,aAAa;QACnB,MAAM,GAAG,GAAyC,EAAE,CAAA;QACpD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;QACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAA;QAClC,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;YACzD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,yEAAyE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5G,yEAAyE;QAC3E,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"telegram-channel-store.js","sourceRoot":"","sources":["../src/telegram-channel-store.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,6EAA6E;AAC7E,6CAA6C;AAC7C,EAAE;AACF,aAAa;AACb,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,yEAAyE;AACzE,6DAA6D;AAC7D,2EAA2E;AAC3E,mEAAmE;AACnE,EAAE;AACF,4BAA4B;AAC5B,8GAA8G;AAE9G,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AA4B7E,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7C,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACvD,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC3D,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC3D,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,kEAAkE;QAClE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAClF,CAAA;AACH,CAAC;AAED,MAAM,OAAO,oBAAoB;IACd,WAAW,GAAG,IAAI,GAAG,EAAgC,CAAA;IACrD,QAAQ,CAAQ;IAChB,MAAM,CAAQ;IAE/B,YAAY,QAAgB,EAAE,MAAc;QAC1C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;gDAE4C;IAC5C,YAAY;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,uFAAuF,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YACnH,OAAM;QACR,CAAC;QACD,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,wFAAwF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAA;YAC5I,OAAM;QACR,CAAC;QACD,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,4FAA4F,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAA;YAChJ,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,mGAAmG,CAAC,CAAA;YAChH,OAAM;QACR,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YACnF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YACrE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,SAAQ;YACpC,MAAM,UAAU,GAAI,KAA+B,CAAC,OAAO,CAAA;YAC3D,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAChH,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,0CAA0C;YAC1C,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;YAC3D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;YACvF,MAAM,IAAI,CAAC,CAAA;QACb,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,mEAAmE,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC;IAED,4EAA4E;IAC5E,GAAG,CAAC,SAAiB,EAAE,OAA+B;QACpD,MAAM,KAAK,GAAyB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;QACrF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACtC,IAAI,CAAC,aAAa,EAAE,CAAA;QACpB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,SAAiB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,GAAG;YAAE,IAAI,CAAC,aAAa,EAAE,CAAA;QAC7B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,oDAAoD;IACpD,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;IAC9B,CAAC;IAEO,aAAa;QACnB,MAAM,GAAG,GAAyC,EAAE,CAAA;QACpD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;QACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAA;QAClC,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;YACzD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,yEAAyE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5G,yEAAyE;QAC3E,CAAC;IACH,CAAC;CACF"}

package/payload/platform/services/claude-session-manager/dist/telegram-plugin-mcp.d.ts

@@ -0,0 +1,28 @@
+/** Must equal the plugin directory basename: `qualifyShortToolName` builds
+ *  `mcp__<plugin>__<tool>` and the allowlist entries have to name a server that
+ *  is actually registered. */
+export declare const TELEGRAM_PLUGIN_SERVER_NAME = "telegram";
+export interface TelegramPluginMcpParams {
+    sessionId: string;
+    /** The one bot this session may act as. */
+    botId: string;
+    /** The one chat this session may send to. */
+    chatId: string;
+    /** The account whose `account.json` holds the bot token. `toolDeps()` in the
+     *  plugin reads this as ACCOUNT_ID; without it every tool refuses with
+     *  `op=no-account`. */
+    accountId: string;
+    /** Absolute path to the node binary. On darwin the launchd server PATH
+     *  excludes an nvm node, so a bare `node` fails to spawn (Task 1402). */
+    nodeBin: string;
+    platformRoot: string;
+    logDir: string;
+    platformPort: string;
+}
+export interface TelegramPluginMcpServerEntry {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+}
+export declare function buildTelegramPluginMcpServers(p: TelegramPluginMcpParams): Record<string, TelegramPluginMcpServerEntry>;
+//# sourceMappingURL=telegram-plugin-mcp.d.ts.map

package/payload/platform/services/claude-session-manager/dist/telegram-plugin-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-plugin-mcp.d.ts","sourceRoot":"","sources":["../src/telegram-plugin-mcp.ts"],"names":[],"mappings":"AAqBA;;8BAE8B;AAC9B,eAAO,MAAM,2BAA2B,aAAa,CAAA;AAErD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAA;IACd;;2BAEuB;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB;6EACyE;IACzE,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,uBAAuB,GACzB,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CA4B9C"}

package/payload/platform/services/claude-session-manager/dist/telegram-plugin-mcp.js

@@ -0,0 +1,53 @@
+// Task 2666 — the per-spawn registration of the telegram PLUGIN server for a
+// public telegram spawn.
+//
+// Why this exists at all. A public spawn passes `--strict-mcp-config`, so the
+// only MCP servers it holds are the ones its own `--mcp-config` file names.
+// Admin and specialist spawns take the same plugin from the installed-plugin
+// channel under the LONG prefix (`mcp__plugin_telegram_telegram__…`); a public
+// spawn cannot, so it registers the identical entrypoint here under the SHORT
+// prefix `qualifyShortToolName` produces. The server name is therefore not a
+// free choice: it must equal the plugin directory basename, `telegram`, or
+// every granted tool name points at a server that is not registered — the
+// failure the Task 2403 comment in pty-spawner.ts records, where a spawn was
+// handed `--allowed-tools mcp__telegram-channel__reply` for a server nothing
+// registered and sat alive and idle with no way to answer.
+//
+// Pure (no fs, no process.env), like telegram-channel-mcp.ts, so it unit-tests
+// without node-pty and the caller owns the file write.
+import { join } from 'node:path';
+import { buildChannelSpawnTee } from './channel-spawn-tee.js';
+/** Must equal the plugin directory basename: `qualifyShortToolName` builds
+ *  `mcp__<plugin>__<tool>` and the allowlist entries have to name a server that
+ *  is actually registered. */
+export const TELEGRAM_PLUGIN_SERVER_NAME = 'telegram';
+export function buildTelegramPluginMcpServers(p) {
+    const tee = buildChannelSpawnTee({
+        nodeBin: p.nodeBin,
+        platformRoot: p.platformRoot,
+        logDir: p.logDir,
+        platformPort: p.platformPort,
+        sessionId: p.sessionId,
+        serverName: TELEGRAM_PLUGIN_SERVER_NAME,
+        serverPath: join(p.platformRoot, 'plugins', 'telegram', 'mcp', 'dist', 'index.js'),
+    });
+    return {
+        [TELEGRAM_PLUGIN_SERVER_NAME]: {
+            command: tee.command,
+            args: tee.args,
+            env: {
+                ...tee.env,
+                PLATFORM_ROOT: p.platformRoot,
+                ACCOUNT_ID: p.accountId,
+                // Task 2666 — the pin. Present ONLY on a public spawn, which is what
+                // makes its presence the plugin's own public-spawn signal: an admin
+                // spawn takes this plugin from the installed-plugin channel and never
+                // reaches this builder, so its tools see neither variable and behave
+                // exactly as they did before this task.
+                TG_PUBLIC_BOT_ID: p.botId,
+                TG_PUBLIC_CHAT_ID: p.chatId,
+            },
+        },
+    };
+}
+//# sourceMappingURL=telegram-plugin-mcp.js.map

package/payload/platform/services/claude-session-manager/dist/telegram-plugin-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-plugin-mcp.js","sourceRoot":"","sources":["../src/telegram-plugin-mcp.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yBAAyB;AACzB,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,uDAAuD;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAA;AA0BrD,MAAM,UAAU,6BAA6B,CAC3C,CAA0B;IAE1B,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,2BAA2B;QACvC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC;KACnF,CAAC,CAAA;IACF,OAAO;QACL,CAAC,2BAA2B,CAAC,EAAE;YAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,aAAa,EAAE,CAAC,CAAC,YAAY;gBAC7B,UAAU,EAAE,CAAC,CAAC,SAAS;gBACvB,qEAAqE;gBACrE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,wCAAwC;gBACxC,gBAAgB,EAAE,CAAC,CAAC,KAAK;gBACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM;aAC5B;SACF;KACF,CAAA;AACH,CAAC"}

package/payload/platform/services/claude-session-manager/dist/wa-channel-mcp.d.ts

@@ -18,11 +18,15 @@ export interface WaChannelMcpParams {
     accountId: string;
     /** Task 2458 — which role this session's channel server serves. The gateway
      *  branches its turn-end delivery on it: a public turn goes back down the
-     *  posting key, an admin turn fans out. Optional here and defaulted to 'admin'
-     *  at the stamp, so a caller that names no role produces the admin spawn it
-     *  already produced; the channel server itself refuses an ABSENT value, which
-     *  is what makes a missed stamp loud rather than silently admin. */
-    role?: 'admin' | 'public';
+     *  posting key, an admin turn fans out.
+     *
+     *  Task 2666 — REQUIRED. It was optional and defaulted to 'admin' at the
+     *  stamp, and the comment here claimed the channel server's refusal of an
+     *  absent value made a missed stamp loud. It could not: the default filled
+     *  the value in before the server ever saw it, so the refusal was
+     *  unreachable and a caller that named no role got the highest-privilege
+     *  framing in silence. Required means the compiler asks each caller. */
+    role: 'admin' | 'public';
     /** Task 2356 — the three values the spawn-tee shim needs. Supplied by the
      *  caller because this module is pure: `deps.platformRoot`, `deps.logDir`,
      *  and the manager's own PLATFORM_PORT. */

package/payload/platform/services/claude-session-manager/dist/wa-channel-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wa-channel-mcp.d.ts","sourceRoot":"","sources":["../src/wa-channel-mcp.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,sBAAsB,qBAAqB,CAAA;AAExD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAA;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB;;;uCAGmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf;;yEAEqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;wEAKoE;IACpE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IACzB;;+CAE2C;IAC3C,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,wBAAwB,CACtC,CAAC,EAAE,kBAAkB,GACpB,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAmCzC;AAED,uEAAuE;AACvE,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAEnD;AAED;;;kCAGkC;AAClC,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;4EAC4E;AAC5E,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAU7D"}
+{"version":3,"file":"wa-channel-mcp.d.ts","sourceRoot":"","sources":["../src/wa-channel-mcp.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,sBAAsB,qBAAqB,CAAA;AAExD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAA;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB;;;uCAGmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf;;yEAEqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;;;4EASwE;IACxE,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;IACxB;;+CAE2C;IAC3C,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,wBAAwB,CACtC,CAAC,EAAE,kBAAkB,GACpB,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAyCzC;AAED,uEAAuE;AACvE,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAEnD;AAED;;;kCAGkC;AAClC,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;4EAC4E;AAC5E,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAU7D"}

package/payload/platform/services/claude-session-manager/dist/wa-channel-mcp.js

@@ -39,12 +39,18 @@ export function buildWaChannelMcpServers(p) {
                 // Task 2290 — without this the gateway refuses the attach, because a
                 // nameless subscriber would receive every account's payloads for this phone.
                 WA_CHANNEL_ACCOUNT_ID: p.accountId,
-                // Task 2458 — stamped on BOTH roles, unlike the telegram twin. The
-                // channel server's resolveChannelRole throws on an absent or
-                // unrecognised value rather than defaulting to admin, because that
-                // default is exactly what sent a visitor's answer into the admin
-                // identity fan-out, which resolves no target for a visitor.
-                WA_CHANNEL_ROLE: p.role === 'public' ? 'public' : 'admin',
+                // Task 2458 — stamped on BOTH roles. The channel server's
+                // resolveChannelRole throws on an absent or unrecognised value rather
+                // than defaulting to admin, because that default is exactly what sent a
+                // visitor's answer into the admin identity fan-out, which resolves no
+                // target for a visitor.
+                //
+                // Task 2666 — passed through verbatim. The ternary here read as a
+                // narrowing but was a fallback: it turned an absent role into the
+                // string 'admin' BEFORE the server saw it, so the throw above could
+                // never fire and the strictness was decorative. `role` is required now,
+                // so there is nothing left to collapse.
+                WA_CHANNEL_ROLE: p.role,
             },
         },
     };

package/payload/platform/services/claude-session-manager/dist/wa-channel-mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"wa-channel-mcp.js","sourceRoot":"","sources":["../src/wa-channel-mcp.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,mBAAmB;AACnB,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,+CAA+C;AAE/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAA;AAwCxD,MAAM,UAAU,wBAAwB,CACtC,CAAqB;IAErB,qEAAqE;IACrE,6EAA6E;IAC7E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,sBAAsB;QAClC,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAA;IACF,OAAO;QACL,CAAC,sBAAsB,CAAC,EAAE;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,oBAAoB,EAAE,CAAC,CAAC,QAAQ;gBAChC,sBAAsB,EAAE,CAAC,CAAC,UAAU;gBACpC,qBAAqB,EAAE,CAAC,CAAC,SAAS;gBAClC,qEAAqE;gBACrE,6EAA6E;gBAC7E,qBAAqB,EAAE,CAAC,CAAC,SAAS;gBAClC,mEAAmE;gBACnE,6DAA6D;gBAC7D,mEAAmE;gBACnE,iEAAiE;gBACjE,4DAA4D;gBAC5D,eAAe,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;aAC1D;SACF;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,yCAAyC,EAAE,UAAU,sBAAsB,EAAE,CAAC,CAAA;AACxF,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AACvF,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,wBAAwB,EAAE,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,IAAI,GAAG,SAAS;QACpB,0EAA0E;QAC1E,wEAAwE;QACxE,8DAA8D;SAC7D,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC;SAClD,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,WAAW,EAAE,CAAA;IAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;AAChF,CAAC"}
+{"version":3,"file":"wa-channel-mcp.js","sourceRoot":"","sources":["../src/wa-channel-mcp.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,mBAAmB;AACnB,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,+CAA+C;AAE/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAA;AA4CxD,MAAM,UAAU,wBAAwB,CACtC,CAAqB;IAErB,qEAAqE;IACrE,6EAA6E;IAC7E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,sBAAsB;QAClC,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAA;IACF,OAAO;QACL,CAAC,sBAAsB,CAAC,EAAE;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,oBAAoB,EAAE,CAAC,CAAC,QAAQ;gBAChC,sBAAsB,EAAE,CAAC,CAAC,UAAU;gBACpC,qBAAqB,EAAE,CAAC,CAAC,SAAS;gBAClC,qEAAqE;gBACrE,6EAA6E;gBAC7E,qBAAqB,EAAE,CAAC,CAAC,SAAS;gBAClC,0DAA0D;gBAC1D,sEAAsE;gBACtE,wEAAwE;gBACxE,sEAAsE;gBACtE,wBAAwB;gBACxB,EAAE;gBACF,kEAAkE;gBAClE,kEAAkE;gBAClE,oEAAoE;gBACpE,wEAAwE;gBACxE,wCAAwC;gBACxC,eAAe,EAAE,CAAC,CAAC,IAAI;aACxB;SACF;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,yCAAyC,EAAE,UAAU,sBAAsB,EAAE,CAAC,CAAA;AACxF,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AACvF,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,wBAAwB,EAAE,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,IAAI,GAAG,SAAS;QACpB,0EAA0E;QAC1E,wEAAwE;QACxE,8DAA8D;SAC7D,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC;SAClD,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,WAAW,EAAE,CAAA;IAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;AAChF,CAAC"}

package/payload/platform/services/claude-session-manager/dist/webchat-channel-mcp.d.ts

@@ -17,9 +17,13 @@ export interface WebchatChannelMcpParams {
      *  installer-resolved NODE_BIN. */
     nodeBin: string;
     /** Task 756 — 'public' frames the channel server's instructions + reply-tool
-     *  copy for an anonymous visitor; omitted/'admin' keeps the operator framing
-     *  (Task 772). Carried to the server as WEBCHAT_CHANNEL_ROLE. */
-    role?: 'admin' | 'public';
+     *  copy for an anonymous visitor; 'admin' keeps the operator framing (Task
+     *  772). Carried to the server as WEBCHAT_CHANNEL_ROLE.
+     *
+     *  Task 2666 — REQUIRED. Optional plus an 'admin' default at the stamp meant
+     *  a caller that named no role silently got the operator framing, and the
+     *  server's strict resolver never saw the absence. */
+    role: 'admin' | 'public';
     /** Task 2356 — spawn-tee inputs; see channel-spawn-tee.ts. Supplied by the
      *  caller because this module is pure. */
     platformRoot: string;

package/payload/platform/services/claude-session-manager/dist/webchat-channel-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webchat-channel-mcp.d.ts","sourceRoot":"","sources":["../src/webchat-channel-mcp.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,2BAA2B,oBAAoB,CAAA;AAE5D;;uDAEuD;AACvD,eAAO,MAAM,0BAA0B,gCAA+C,CAAA;AAEtF,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAA;IACX,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB;;;uCAGmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf;;qEAEiE;IACjE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IACzB;8CAC0C;IAC1C,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,uBAAuB,GACzB,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CA8B9C;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,IAAI,MAAM,EAAE,CAExD;AAED;;;kCAGkC;AAClC,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;4EAC4E;AAC5E,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvE"}
+{"version":3,"file":"webchat-channel-mcp.d.ts","sourceRoot":"","sources":["../src/webchat-channel-mcp.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,2BAA2B,oBAAoB,CAAA;AAE5D;;uDAEuD;AACvD,eAAO,MAAM,0BAA0B,gCAA+C,CAAA;AAEtF,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAA;IACX,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB;;;uCAGmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf;;;;;;0DAMsD;IACtD,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;IACxB;8CAC0C;IAC1C,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,uBAAuB,GACzB,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAkC9C;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,IAAI,MAAM,EAAE,CAExD;AAED;;;kCAGkC;AAClC,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;4EAC4E;AAC5E,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvE"}

package/payload/platform/services/claude-session-manager/dist/webchat-channel-mcp.js

@@ -44,7 +44,11 @@ export function buildWebchatChannelMcpServers(p) {
                 // for BOTH roles: resolveChannelRole now throws on an absent or
                 // unrecognised value rather than defaulting to admin, because that
                 // default is what would silently re-register the retired reply tool.
-                WEBCHAT_CHANNEL_ROLE: p.role === 'public' ? 'public' : 'admin',
+                //
+                // Task 2666 — passed through verbatim. The ternary read as a narrowing
+                // but was a fallback: it turned an absent role into 'admin' BEFORE the
+                // server saw it, so the throw above could never fire.
+                WEBCHAT_CHANNEL_ROLE: p.role,
             },
         },
     };

package/payload/platform/services/claude-session-manager/dist/webchat-channel-mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"webchat-channel-mcp.js","sourceRoot":"","sources":["../src/webchat-channel-mcp.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,+EAA+E;AAC/E,eAAe;AACf,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAEhF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAA;AAE5D;;uDAEuD;AACvD,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,2BAA2B,SAAS,CAAA;AAgCtF,MAAM,UAAU,6BAA6B,CAC3C,CAA0B;IAE1B,8EAA8E;IAC9E,0EAA0E;IAC1E,uCAAuC;IACvC,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,2BAA2B;QACvC,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAA;IACF,OAAO;QACL,CAAC,2BAA2B,CAAC,EAAE;YAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,mBAAmB,EAAE,CAAC,CAAC,GAAG;gBAC1B,2BAA2B,EAAE,CAAC,CAAC,UAAU;gBACzC,0BAA0B,EAAE,CAAC,CAAC,SAAS;gBACvC,yEAAyE;gBACzE,gEAAgE;gBAChE,mEAAmE;gBACnE,qEAAqE;gBACrE,oBAAoB,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;aAC/D;SACF;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,6BAA6B;IAC3C,OAAO,CAAC,yCAAyC,EAAE,UAAU,2BAA2B,EAAE,CAAC,CAAA;AAC7F,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,IAAI,CAAC,GAAG,EAAE,wBAAwB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AAC5F,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,aAAqB;IAC3D,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,6BAA6B,EAAE,CAAC,CAAA;AAC5E,CAAC"}
+{"version":3,"file":"webchat-channel-mcp.js","sourceRoot":"","sources":["../src/webchat-channel-mcp.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,+EAA+E;AAC/E,eAAe;AACf,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAEhF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAA;AAE5D;;uDAEuD;AACvD,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,2BAA2B,SAAS,CAAA;AAoCtF,MAAM,UAAU,6BAA6B,CAC3C,CAA0B;IAE1B,8EAA8E;IAC9E,0EAA0E;IAC1E,uCAAuC;IACvC,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,2BAA2B;QACvC,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAA;IACF,OAAO;QACL,CAAC,2BAA2B,CAAC,EAAE;YAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,mBAAmB,EAAE,CAAC,CAAC,GAAG;gBAC1B,2BAA2B,EAAE,CAAC,CAAC,UAAU;gBACzC,0BAA0B,EAAE,CAAC,CAAC,SAAS;gBACvC,yEAAyE;gBACzE,gEAAgE;gBAChE,mEAAmE;gBACnE,qEAAqE;gBACrE,EAAE;gBACF,uEAAuE;gBACvE,uEAAuE;gBACvE,sDAAsD;gBACtD,oBAAoB,EAAE,CAAC,CAAC,IAAI;aAC7B;SACF;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,6BAA6B;IAC3C,OAAO,CAAC,yCAAyC,EAAE,UAAU,2BAA2B,EAAE,CAAC,CAAA;AAC7F,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,IAAI,CAAC,GAAG,EAAE,wBAAwB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AAC5F,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,aAAqB;IAC3D,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,6BAA6B,EAAE,CAAC,CAAA;AAC5E,CAAC"}

package/payload/platform/services/telegram-channel/dist/instructions.d.ts

@@ -1,6 +1,18 @@
 export type TelegramChannelRole = 'admin' | 'public';
-/** Resolve the channel role from the spawn env (TG_CHANNEL_ROLE). Anything
- *  other than the literal 'public' is admin — the safe default. */
+/** Resolve the channel role from the spawn env (TG_CHANNEL_ROLE). Strict, like
+ *  the whatsapp and webchat twins.
+ *
+ *  Task 2666 — this used to return 'admin' for anything that was not the
+ *  literal 'public', and called that the safe default. It is the opposite of
+ *  safe: admin is the HIGHEST-privilege framing on this door, and reaching it
+ *  by exclusion means every way of getting the role wrong lands there. A resume
+ *  that omitted the role booted a stranger's conversation with the block that
+ *  says the message "is a message the operator has typed to you directly" and
+ *  to act on it as their instruction, and it emitted nothing while doing so: a
+ *  spawn that silently became admin is byte-identical to a correct admin spawn.
+ *
+ *  Both spawn paths stamp the env, so an absent or unrecognised value means the
+ *  spawn is wrong and the channel must not boot. */
 export declare function resolveChannelRole(raw: string | undefined): TelegramChannelRole;
 export declare function channelInstructions(role: TelegramChannelRole): string;
 export declare function replyToolDescription(role: TelegramChannelRole): string;

package/payload/platform/services/telegram-channel/dist/instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEpD;mEACmE;AACnE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAE/E;AAmDD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAErE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAItE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAEtE;AAoBD,eAAO,MAAM,yBAAyB,QAkEiE,CAAA"}
+{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEpD;;;;;;;;;;;;;oDAaoD;AACpD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAM/E;AAkED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAErE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAItE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAEtE;AAoBD,eAAO,MAAM,yBAAyB,QAkEiE,CAAA"}

package/payload/platform/services/telegram-channel/dist/instructions.js

@@ -4,10 +4,26 @@
 // as an operator instruction — it answers a visitor. The black-box +
 // no-internals guardrails apply to both. Pure so the framing is unit-testable
 // without booting the MCP server.
-/** Resolve the channel role from the spawn env (TG_CHANNEL_ROLE). Anything
- *  other than the literal 'public' is admin — the safe default. */
+/** Resolve the channel role from the spawn env (TG_CHANNEL_ROLE). Strict, like
+ *  the whatsapp and webchat twins.
+ *
+ *  Task 2666 — this used to return 'admin' for anything that was not the
+ *  literal 'public', and called that the safe default. It is the opposite of
+ *  safe: admin is the HIGHEST-privilege framing on this door, and reaching it
+ *  by exclusion means every way of getting the role wrong lands there. A resume
+ *  that omitted the role booted a stranger's conversation with the block that
+ *  says the message "is a message the operator has typed to you directly" and
+ *  to act on it as their instruction, and it emitted nothing while doing so: a
+ *  spawn that silently became admin is byte-identical to a correct admin spawn.
+ *
+ *  Both spawn paths stamp the env, so an absent or unrecognised value means the
+ *  spawn is wrong and the channel must not boot. */
 export function resolveChannelRole(raw) {
-    return raw === 'public' ? 'public' : 'admin';
+    if (raw === 'public')
+        return 'public';
+    if (raw === 'admin')
+        return 'admin';
+    throw new Error(`telegram-channel: TG_CHANNEL_ROLE must be 'admin' or 'public' (got ${raw === undefined ? 'undefined' : JSON.stringify(raw)})`);
 }
 const NO_INTERNALS = `The platform you run on is a black box: never read, grep, or edit the platform install or its ` +
     `server bundle, and never restart platform services. If the platform itself is broken, describe ` +
@@ -49,6 +65,21 @@ const PUBLIC_INSTRUCTIONS = SPECIALIST_AUDIENCE +
     `question or do what the visitor asked within your remit, then (2) write that answer as the ` +
     `final text of your turn. That text is what reaches the visitor's chat, so never end a turn ` +
     `without it and never wait for confirmation before answering. ` +
+    // Task 2666 — a public spawn holds four Telegram tools now. Without this
+    // paragraph the agent keeps answering in plain text, because the block above
+    // tells it to write its answer as final text and names no tool: the surface
+    // would ship and nothing would use it.
+    `You can do more than write sentences in this chat, and a good answer often is not a paragraph. ` +
+    `Use telegram-card when the visitor is choosing between a small number of things: it posts your ` +
+    `text with tappable buttons under it, a button can open a web page inside Telegram, and giving ` +
+    `the same card a key lets you update that one message later instead of stacking new ones below ` +
+    `it. When you send a card, the card IS your answer — do not repeat it as your final text. ` +
+    `Use telegram-ask for a poll, a quiz, a checklist, a map pin, a venue or a contact card. ` +
+    `Use telegram-media-send for a photo, document, video, voice note or a set of images. ` +
+    `Use telegram-media-fetch to open a file the visitor sent you. ` +
+    `Beside a poll or a photo, still write the sentence that says what the visitor is looking at. ` +
+    `You act only as this bot and only in this chat: both are fixed for you, so never try to reach ` +
+    `another person or another conversation. ` +
     NO_INTERNALS;
 export function channelInstructions(role) {
     return role === 'public' ? PUBLIC_INSTRUCTIONS : ADMIN_INSTRUCTIONS;

package/payload/platform/services/telegram-channel/dist/instructions.js.map

@@ -1 +1 @@
-{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,qEAAqE;AACrE,8EAA8E;AAC9E,kCAAkC;AAIlC;mEACmE;AACnE,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;AAC9C,CAAC;AAED,MAAM,YAAY,GAChB,gGAAgG;IAChG,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,0EAA0E,CAAA;AAE5E,yEAAyE;AACzE,gFAAgF;AAChF,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,mFAAmF;AACnF,6EAA6E;AAC7E,8EAA8E;AAC9E,kFAAkF;AAClF,sEAAsE;AACtE,MAAM,mBAAmB,GACvB,iGAAiG;IACjG,wFAAwF;IACxF,kGAAkG;IAClG,4GAA4G,CAAA;AAE9G,MAAM,kBAAkB,GACtB,mBAAmB;IACnB,iEAAiE;IACjE,mGAAmG;IACnG,+FAA+F;IAC/F,8FAA8F;IAC9F,kGAAkG;IAClG,2FAA2F;IAC3F,yFAAyF;IACzF,0FAA0F;IAC1F,yFAAyF;IACzF,YAAY,CAAA;AAEd,MAAM,mBAAmB,GACvB,mBAAmB;IACnB,uEAAuE;IACvE,oGAAoG;IACpG,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,+DAA+D;IAC/D,YAAY,CAAA;AAEd,MAAM,UAAU,mBAAmB,CAAC,IAAyB;IAC3D,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAyB;IAC5D,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,2EAA2E;QAC7E,CAAC,CAAC,2EAA2E,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAyB;IAC5D,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,qCAAqC,CAAA;AACzG,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,iFAAiF;AACjF,kFAAkF;AAClF,wDAAwD;AACxD,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,sEAAsE;AACtE,4EAA4E;AAC5E,kDAAkD;AAClD,EAAE;AACF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GACpC,sDAAsD;IACtD,8NAA8N;IAC9N,8EAA8E;IAC9E,2FAA2F;IAC3F,mEAAmE;IACnE,sGAAsG;IACtG,oHAAoH;IACpH,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,wBAAwB;IACxB,uFAAuF;IACvF,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,gBAAgB;IAChB,sFAAsF;IACtF,6FAA6F;IAC7F,+EAA+E;IAC/E,wEAAwE;IACxE,sBAAsB;IACtB,uGAAuG;IACvG,8EAA8E;IAC9E,0EAA0E;IAC1E,uGAAuG;IACvG,iDAAiD;IACjD,gFAAgF;IAChF,mFAAmF;IACnF,oHAAoH;IACpH,yBAAyB;IACzB,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,mBAAmB;IACnB,8GAA8G;IAC9G,gHAAgH;IAChH,6BAA6B;IAC7B,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,2DAA2D;IAC3D,iHAAiH;IACjH,0EAA0E;IAC1E,2EAA2E;IAC3E,iFAAiF;IACjF,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,qEAAqE;IACrE,qEAAqE;IACrE,+EAA+E;IAC/E,6EAA6E;IAC7E,YAAY;IACZ,8GAA8G;IAC9G,6HAA6H;IAC7H,kIAAkI;IAClI,4EAA4E;IAC5E,qFAAqF;IACrF,qGAAqG,CAAA"}
+{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,qEAAqE;AACrE,8EAA8E;AAC9E,kCAAkC;AAIlC;;;;;;;;;;;;;oDAaoD;AACpD,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAA;IACrC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,OAAO,CAAA;IACnC,MAAM,IAAI,KAAK,CACb,sEAAsE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAC/H,CAAA;AACH,CAAC;AAED,MAAM,YAAY,GAChB,gGAAgG;IAChG,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,0EAA0E,CAAA;AAE5E,yEAAyE;AACzE,gFAAgF;AAChF,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,mFAAmF;AACnF,6EAA6E;AAC7E,8EAA8E;AAC9E,kFAAkF;AAClF,sEAAsE;AACtE,MAAM,mBAAmB,GACvB,iGAAiG;IACjG,wFAAwF;IACxF,kGAAkG;IAClG,4GAA4G,CAAA;AAE9G,MAAM,kBAAkB,GACtB,mBAAmB;IACnB,iEAAiE;IACjE,mGAAmG;IACnG,+FAA+F;IAC/F,8FAA8F;IAC9F,kGAAkG;IAClG,2FAA2F;IAC3F,yFAAyF;IACzF,0FAA0F;IAC1F,yFAAyF;IACzF,YAAY,CAAA;AAEd,MAAM,mBAAmB,GACvB,mBAAmB;IACnB,uEAAuE;IACvE,oGAAoG;IACpG,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,+DAA+D;IAC/D,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,uCAAuC;IACvC,iGAAiG;IACjG,iGAAiG;IACjG,gGAAgG;IAChG,gGAAgG;IAChG,2FAA2F;IAC3F,0FAA0F;IAC1F,uFAAuF;IACvF,gEAAgE;IAChE,+FAA+F;IAC/F,gGAAgG;IAChG,0CAA0C;IAC1C,YAAY,CAAA;AAEd,MAAM,UAAU,mBAAmB,CAAC,IAAyB;IAC3D,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAyB;IAC5D,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,2EAA2E;QAC7E,CAAC,CAAC,2EAA2E,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAyB;IAC5D,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,qCAAqC,CAAA;AACzG,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,iFAAiF;AACjF,kFAAkF;AAClF,wDAAwD;AACxD,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,sEAAsE;AACtE,4EAA4E;AAC5E,kDAAkD;AAClD,EAAE;AACF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GACpC,sDAAsD;IACtD,8NAA8N;IAC9N,8EAA8E;IAC9E,2FAA2F;IAC3F,mEAAmE;IACnE,sGAAsG;IACtG,oHAAoH;IACpH,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,wBAAwB;IACxB,uFAAuF;IACvF,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,gBAAgB;IAChB,sFAAsF;IACtF,6FAA6F;IAC7F,+EAA+E;IAC/E,wEAAwE;IACxE,sBAAsB;IACtB,uGAAuG;IACvG,8EAA8E;IAC9E,0EAA0E;IAC1E,uGAAuG;IACvG,iDAAiD;IACjD,gFAAgF;IAChF,mFAAmF;IACnF,oHAAoH;IACpH,yBAAyB;IACzB,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,mBAAmB;IACnB,8GAA8G;IAC9G,gHAAgH;IAChH,6BAA6B;IAC7B,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,2DAA2D;IAC3D,iHAAiH;IACjH,0EAA0E;IAC1E,2EAA2E;IAC3E,iFAAiF;IACjF,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,qEAAqE;IACrE,qEAAqE;IACrE,+EAA+E;IAC/E,6EAA6E;IAC7E,YAAY;IACZ,8GAA8G;IAC9G,6HAA6H;IAC7H,kIAAkI;IAClI,4EAA4E;IAC5E,qFAAqF;IACrF,qGAAqG,CAAA"}