@rubytech/create-maxy-code 0.1.592 → 0.1.594

package/payload/platform/services/claude-session-manager/dist/telegram-channel-store.js

@@ -23,7 +23,13 @@ function isValidBinding(v) {
     const o = v;
     return (typeof o.senderId === 'string' && o.senderId.length > 0 &&
         typeof o.gatewayUrl === 'string' && o.gatewayUrl.length > 0 &&
-        typeof o.serverPath === 'string' && o.serverPath.length > 0);
+        typeof o.serverPath === 'string' && o.serverPath.length > 0 &&
+        // Task 2666 — absent is valid, present-and-wrong is not. A numeric botId
+        // would reach the plugin env as the string "111" and still pin, so the
+        // shape is checked rather than coerced: a record this store cannot vouch
+        // for is skipped, and the spawn falls back to the closed surface.
+        (o.botId === undefined || (typeof o.botId === 'string' && o.botId.length > 0)) &&
+        (o.chatId === undefined || (typeof o.chatId === 'string' && o.chatId.length > 0)));
 }
 export class TelegramChannelStore {
     bySessionId = new Map();
@@ -71,12 +77,15 @@ export class TelegramChannelStore {
                 continue;
             const rawBoundAt = value.boundAt;
             const boundAt = typeof rawBoundAt === 'string' && rawBoundAt.length > 0 ? rawBoundAt : new Date(0).toISOString();
-            this.bySessionId.set(sessionId, {
-                senderId: value.senderId,
-                gatewayUrl: value.gatewayUrl,
-                serverPath: value.serverPath,
-                boundAt,
-            });
+            // Task 2666 — the pin fields are spread rather than named, because a
+            // hand-listed reconstruction drops any field added later in silence:
+            // `set` already spreads, so a listed load and a spread write disagreed
+            // about what a binding is, and the pin survived a write and died on the
+            // next boot. The cost is that an unrecognised key in a hand-edited file
+            // is now kept in memory rather than dropped; nothing reads one, and the
+            // argv rebuild names the fields it wants.
+            const { senderId, gatewayUrl, serverPath, ...rest } = value;
+            this.bySessionId.set(sessionId, { senderId, gatewayUrl, serverPath, ...rest, boundAt });
             loaded += 1;
         }
         this.logger(`[claude-session-manager] telegram-channel-store-load ok entries=${loaded} path=${this.filePath}`);

package/payload/platform/services/claude-session-manager/dist/telegram-channel-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"telegram-channel-store.js","sourceRoot":"","sources":["../src/telegram-channel-store.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,6EAA6E;AAC7E,6CAA6C;AAC7C,EAAE;AACF,aAAa;AACb,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,yEAAyE;AACzE,6DAA6D;AAC7D,2EAA2E;AAC3E,mEAAmE;AACnE,EAAE;AACF,4BAA4B;AAC5B,8GAA8G;AAE9G,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAc7E,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7C,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACvD,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC3D,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAC5D,CAAA;AACH,CAAC;AAED,MAAM,OAAO,oBAAoB;IACd,WAAW,GAAG,IAAI,GAAG,EAAgC,CAAA;IACrD,QAAQ,CAAQ;IAChB,MAAM,CAAQ;IAE/B,YAAY,QAAgB,EAAE,MAAc;QAC1C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;gDAE4C;IAC5C,YAAY;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,uFAAuF,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YACnH,OAAM;QACR,CAAC;QACD,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,wFAAwF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAA;YAC5I,OAAM;QACR,CAAC;QACD,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,4FAA4F,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAA;YAChJ,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,mGAAmG,CAAC,CAAA;YAChH,OAAM;QACR,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YACnF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YACrE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,SAAQ;YACpC,MAAM,UAAU,GAAI,KAA+B,CAAC,OAAO,CAAA;YAC3D,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAChH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO;aACR,CAAC,CAAA;YACF,MAAM,IAAI,CAAC,CAAA;QACb,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,mEAAmE,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC;IAED,4EAA4E;IAC5E,GAAG,CAAC,SAAiB,EAAE,OAA+B;QACpD,MAAM,KAAK,GAAyB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;QACrF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACtC,IAAI,CAAC,aAAa,EAAE,CAAA;QACpB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,SAAiB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,GAAG;YAAE,IAAI,CAAC,aAAa,EAAE,CAAA;QAC7B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,oDAAoD;IACpD,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;IAC9B,CAAC;IAEO,aAAa;QACnB,MAAM,GAAG,GAAyC,EAAE,CAAA;QACpD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;QACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAA;QAClC,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;YACzD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,yEAAyE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5G,yEAAyE;QAC3E,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"telegram-channel-store.js","sourceRoot":"","sources":["../src/telegram-channel-store.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,6EAA6E;AAC7E,6CAA6C;AAC7C,EAAE;AACF,aAAa;AACb,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,yEAAyE;AACzE,6DAA6D;AAC7D,2EAA2E;AAC3E,mEAAmE;AACnE,EAAE;AACF,4BAA4B;AAC5B,8GAA8G;AAE9G,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AA4B7E,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC7C,MAAM,CAAC,GAAG,CAA4B,CAAA;IACtC,OAAO,CACL,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACvD,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC3D,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC3D,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,kEAAkE;QAClE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAClF,CAAA;AACH,CAAC;AAED,MAAM,OAAO,oBAAoB;IACd,WAAW,GAAG,IAAI,GAAG,EAAgC,CAAA;IACrD,QAAQ,CAAQ;IAChB,MAAM,CAAQ;IAE/B,YAAY,QAAgB,EAAE,MAAc;QAC1C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;gDAE4C;IAC5C,YAAY;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,uFAAuF,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YACnH,OAAM;QACR,CAAC;QACD,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,wFAAwF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAA;YAC5I,OAAM;QACR,CAAC;QACD,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,4FAA4F,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAA;YAChJ,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,mGAAmG,CAAC,CAAA;YAChH,OAAM;QACR,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YACnF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YACrE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,SAAQ;YACpC,MAAM,UAAU,GAAI,KAA+B,CAAC,OAAO,CAAA;YAC3D,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAChH,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,0CAA0C;YAC1C,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;YAC3D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;YACvF,MAAM,IAAI,CAAC,CAAA;QACb,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,mEAAmE,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC;IAED,4EAA4E;IAC5E,GAAG,CAAC,SAAiB,EAAE,OAA+B;QACpD,MAAM,KAAK,GAAyB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;QACrF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACtC,IAAI,CAAC,aAAa,EAAE,CAAA;QACpB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,SAAiB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,GAAG;YAAE,IAAI,CAAC,aAAa,EAAE,CAAA;QAC7B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,oDAAoD;IACpD,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;IAC9B,CAAC;IAEO,aAAa;QACnB,MAAM,GAAG,GAAyC,EAAE,CAAA;QACpD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;QACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAA;QAClC,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;YACzD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,yEAAyE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5G,yEAAyE;QAC3E,CAAC;IACH,CAAC;CACF"}

package/payload/platform/services/claude-session-manager/dist/telegram-plugin-mcp.d.ts

@@ -0,0 +1,28 @@
+/** Must equal the plugin directory basename: `qualifyShortToolName` builds
+ *  `mcp__<plugin>__<tool>` and the allowlist entries have to name a server that
+ *  is actually registered. */
+export declare const TELEGRAM_PLUGIN_SERVER_NAME = "telegram";
+export interface TelegramPluginMcpParams {
+    sessionId: string;
+    /** The one bot this session may act as. */
+    botId: string;
+    /** The one chat this session may send to. */
+    chatId: string;
+    /** The account whose `account.json` holds the bot token. `toolDeps()` in the
+     *  plugin reads this as ACCOUNT_ID; without it every tool refuses with
+     *  `op=no-account`. */
+    accountId: string;
+    /** Absolute path to the node binary. On darwin the launchd server PATH
+     *  excludes an nvm node, so a bare `node` fails to spawn (Task 1402). */
+    nodeBin: string;
+    platformRoot: string;
+    logDir: string;
+    platformPort: string;
+}
+export interface TelegramPluginMcpServerEntry {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+}
+export declare function buildTelegramPluginMcpServers(p: TelegramPluginMcpParams): Record<string, TelegramPluginMcpServerEntry>;
+//# sourceMappingURL=telegram-plugin-mcp.d.ts.map

package/payload/platform/services/claude-session-manager/dist/telegram-plugin-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-plugin-mcp.d.ts","sourceRoot":"","sources":["../src/telegram-plugin-mcp.ts"],"names":[],"mappings":"AAqBA;;8BAE8B;AAC9B,eAAO,MAAM,2BAA2B,aAAa,CAAA;AAErD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAA;IACd;;2BAEuB;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB;6EACyE;IACzE,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,uBAAuB,GACzB,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CA4B9C"}

package/payload/platform/services/claude-session-manager/dist/telegram-plugin-mcp.js

@@ -0,0 +1,53 @@
+// Task 2666 — the per-spawn registration of the telegram PLUGIN server for a
+// public telegram spawn.
+//
+// Why this exists at all. A public spawn passes `--strict-mcp-config`, so the
+// only MCP servers it holds are the ones its own `--mcp-config` file names.
+// Admin and specialist spawns take the same plugin from the installed-plugin
+// channel under the LONG prefix (`mcp__plugin_telegram_telegram__…`); a public
+// spawn cannot, so it registers the identical entrypoint here under the SHORT
+// prefix `qualifyShortToolName` produces. The server name is therefore not a
+// free choice: it must equal the plugin directory basename, `telegram`, or
+// every granted tool name points at a server that is not registered — the
+// failure the Task 2403 comment in pty-spawner.ts records, where a spawn was
+// handed `--allowed-tools mcp__telegram-channel__reply` for a server nothing
+// registered and sat alive and idle with no way to answer.
+//
+// Pure (no fs, no process.env), like telegram-channel-mcp.ts, so it unit-tests
+// without node-pty and the caller owns the file write.
+import { join } from 'node:path';
+import { buildChannelSpawnTee } from './channel-spawn-tee.js';
+/** Must equal the plugin directory basename: `qualifyShortToolName` builds
+ *  `mcp__<plugin>__<tool>` and the allowlist entries have to name a server that
+ *  is actually registered. */
+export const TELEGRAM_PLUGIN_SERVER_NAME = 'telegram';
+export function buildTelegramPluginMcpServers(p) {
+    const tee = buildChannelSpawnTee({
+        nodeBin: p.nodeBin,
+        platformRoot: p.platformRoot,
+        logDir: p.logDir,
+        platformPort: p.platformPort,
+        sessionId: p.sessionId,
+        serverName: TELEGRAM_PLUGIN_SERVER_NAME,
+        serverPath: join(p.platformRoot, 'plugins', 'telegram', 'mcp', 'dist', 'index.js'),
+    });
+    return {
+        [TELEGRAM_PLUGIN_SERVER_NAME]: {
+            command: tee.command,
+            args: tee.args,
+            env: {
+                ...tee.env,
+                PLATFORM_ROOT: p.platformRoot,
+                ACCOUNT_ID: p.accountId,
+                // Task 2666 — the pin. Present ONLY on a public spawn, which is what
+                // makes its presence the plugin's own public-spawn signal: an admin
+                // spawn takes this plugin from the installed-plugin channel and never
+                // reaches this builder, so its tools see neither variable and behave
+                // exactly as they did before this task.
+                TG_PUBLIC_BOT_ID: p.botId,
+                TG_PUBLIC_CHAT_ID: p.chatId,
+            },
+        },
+    };
+}
+//# sourceMappingURL=telegram-plugin-mcp.js.map

package/payload/platform/services/claude-session-manager/dist/telegram-plugin-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-plugin-mcp.js","sourceRoot":"","sources":["../src/telegram-plugin-mcp.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yBAAyB;AACzB,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,uDAAuD;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAA;AA0BrD,MAAM,UAAU,6BAA6B,CAC3C,CAA0B;IAE1B,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,2BAA2B;QACvC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC;KACnF,CAAC,CAAA;IACF,OAAO;QACL,CAAC,2BAA2B,CAAC,EAAE;YAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,aAAa,EAAE,CAAC,CAAC,YAAY;gBAC7B,UAAU,EAAE,CAAC,CAAC,SAAS;gBACvB,qEAAqE;gBACrE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,wCAAwC;gBACxC,gBAAgB,EAAE,CAAC,CAAC,KAAK;gBACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM;aAC5B;SACF;KACF,CAAA;AACH,CAAC"}

package/payload/platform/services/claude-session-manager/dist/wa-channel-mcp.d.ts

@@ -18,11 +18,15 @@ export interface WaChannelMcpParams {
     accountId: string;
     /** Task 2458 — which role this session's channel server serves. The gateway
      *  branches its turn-end delivery on it: a public turn goes back down the
-     *  posting key, an admin turn fans out. Optional here and defaulted to 'admin'
-     *  at the stamp, so a caller that names no role produces the admin spawn it
-     *  already produced; the channel server itself refuses an ABSENT value, which
-     *  is what makes a missed stamp loud rather than silently admin. */
-    role?: 'admin' | 'public';
+     *  posting key, an admin turn fans out.
+     *
+     *  Task 2666 — REQUIRED. It was optional and defaulted to 'admin' at the
+     *  stamp, and the comment here claimed the channel server's refusal of an
+     *  absent value made a missed stamp loud. It could not: the default filled
+     *  the value in before the server ever saw it, so the refusal was
+     *  unreachable and a caller that named no role got the highest-privilege
+     *  framing in silence. Required means the compiler asks each caller. */
+    role: 'admin' | 'public';
     /** Task 2356 — the three values the spawn-tee shim needs. Supplied by the
      *  caller because this module is pure: `deps.platformRoot`, `deps.logDir`,
      *  and the manager's own PLATFORM_PORT. */

package/payload/platform/services/claude-session-manager/dist/wa-channel-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wa-channel-mcp.d.ts","sourceRoot":"","sources":["../src/wa-channel-mcp.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,sBAAsB,qBAAqB,CAAA;AAExD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAA;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB;;;uCAGmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf;;yEAEqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;wEAKoE;IACpE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IACzB;;+CAE2C;IAC3C,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,wBAAwB,CACtC,CAAC,EAAE,kBAAkB,GACpB,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAmCzC;AAED,uEAAuE;AACvE,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAEnD;AAED;;;kCAGkC;AAClC,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;4EAC4E;AAC5E,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAU7D"}
+{"version":3,"file":"wa-channel-mcp.d.ts","sourceRoot":"","sources":["../src/wa-channel-mcp.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,sBAAsB,qBAAqB,CAAA;AAExD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAA;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB;;;uCAGmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf;;yEAEqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;;;4EASwE;IACxE,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;IACxB;;+CAE2C;IAC3C,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,wBAAwB,CACtC,CAAC,EAAE,kBAAkB,GACpB,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAyCzC;AAED,uEAAuE;AACvE,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAEnD;AAED;;;kCAGkC;AAClC,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;4EAC4E;AAC5E,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAU7D"}

package/payload/platform/services/claude-session-manager/dist/wa-channel-mcp.js

@@ -39,12 +39,18 @@ export function buildWaChannelMcpServers(p) {
                 // Task 2290 — without this the gateway refuses the attach, because a
                 // nameless subscriber would receive every account's payloads for this phone.
                 WA_CHANNEL_ACCOUNT_ID: p.accountId,
-                // Task 2458 — stamped on BOTH roles, unlike the telegram twin. The
-                // channel server's resolveChannelRole throws on an absent or
-                // unrecognised value rather than defaulting to admin, because that
-                // default is exactly what sent a visitor's answer into the admin
-                // identity fan-out, which resolves no target for a visitor.
-                WA_CHANNEL_ROLE: p.role === 'public' ? 'public' : 'admin',
+                // Task 2458 — stamped on BOTH roles. The channel server's
+                // resolveChannelRole throws on an absent or unrecognised value rather
+                // than defaulting to admin, because that default is exactly what sent a
+                // visitor's answer into the admin identity fan-out, which resolves no
+                // target for a visitor.
+                //
+                // Task 2666 — passed through verbatim. The ternary here read as a
+                // narrowing but was a fallback: it turned an absent role into the
+                // string 'admin' BEFORE the server saw it, so the throw above could
+                // never fire and the strictness was decorative. `role` is required now,
+                // so there is nothing left to collapse.
+                WA_CHANNEL_ROLE: p.role,
             },
         },
     };

package/payload/platform/services/claude-session-manager/dist/wa-channel-mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"wa-channel-mcp.js","sourceRoot":"","sources":["../src/wa-channel-mcp.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,mBAAmB;AACnB,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,+CAA+C;AAE/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAA;AAwCxD,MAAM,UAAU,wBAAwB,CACtC,CAAqB;IAErB,qEAAqE;IACrE,6EAA6E;IAC7E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,sBAAsB;QAClC,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAA;IACF,OAAO;QACL,CAAC,sBAAsB,CAAC,EAAE;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,oBAAoB,EAAE,CAAC,CAAC,QAAQ;gBAChC,sBAAsB,EAAE,CAAC,CAAC,UAAU;gBACpC,qBAAqB,EAAE,CAAC,CAAC,SAAS;gBAClC,qEAAqE;gBACrE,6EAA6E;gBAC7E,qBAAqB,EAAE,CAAC,CAAC,SAAS;gBAClC,mEAAmE;gBACnE,6DAA6D;gBAC7D,mEAAmE;gBACnE,iEAAiE;gBACjE,4DAA4D;gBAC5D,eAAe,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;aAC1D;SACF;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,yCAAyC,EAAE,UAAU,sBAAsB,EAAE,CAAC,CAAA;AACxF,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AACvF,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,wBAAwB,EAAE,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,IAAI,GAAG,SAAS;QACpB,0EAA0E;QAC1E,wEAAwE;QACxE,8DAA8D;SAC7D,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC;SAClD,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,WAAW,EAAE,CAAA;IAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;AAChF,CAAC"}
+{"version":3,"file":"wa-channel-mcp.js","sourceRoot":"","sources":["../src/wa-channel-mcp.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,mBAAmB;AACnB,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,+CAA+C;AAE/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAA;AA4CxD,MAAM,UAAU,wBAAwB,CACtC,CAAqB;IAErB,qEAAqE;IACrE,6EAA6E;IAC7E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,sBAAsB;QAClC,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAA;IACF,OAAO;QACL,CAAC,sBAAsB,CAAC,EAAE;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,oBAAoB,EAAE,CAAC,CAAC,QAAQ;gBAChC,sBAAsB,EAAE,CAAC,CAAC,UAAU;gBACpC,qBAAqB,EAAE,CAAC,CAAC,SAAS;gBAClC,qEAAqE;gBACrE,6EAA6E;gBAC7E,qBAAqB,EAAE,CAAC,CAAC,SAAS;gBAClC,0DAA0D;gBAC1D,sEAAsE;gBACtE,wEAAwE;gBACxE,sEAAsE;gBACtE,wBAAwB;gBACxB,EAAE;gBACF,kEAAkE;gBAClE,kEAAkE;gBAClE,oEAAoE;gBACpE,wEAAwE;gBACxE,wCAAwC;gBACxC,eAAe,EAAE,CAAC,CAAC,IAAI;aACxB;SACF;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,yCAAyC,EAAE,UAAU,sBAAsB,EAAE,CAAC,CAAA;AACxF,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AACvF,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,wBAAwB,EAAE,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,IAAI,GAAG,SAAS;QACpB,0EAA0E;QAC1E,wEAAwE;QACxE,8DAA8D;SAC7D,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC;SAClD,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,WAAW,EAAE,CAAA;IAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;AAChF,CAAC"}

package/payload/platform/services/claude-session-manager/dist/webchat-channel-mcp.d.ts

@@ -17,9 +17,13 @@ export interface WebchatChannelMcpParams {
      *  installer-resolved NODE_BIN. */
     nodeBin: string;
     /** Task 756 — 'public' frames the channel server's instructions + reply-tool
-     *  copy for an anonymous visitor; omitted/'admin' keeps the operator framing
-     *  (Task 772). Carried to the server as WEBCHAT_CHANNEL_ROLE. */
-    role?: 'admin' | 'public';
+     *  copy for an anonymous visitor; 'admin' keeps the operator framing (Task
+     *  772). Carried to the server as WEBCHAT_CHANNEL_ROLE.
+     *
+     *  Task 2666 — REQUIRED. Optional plus an 'admin' default at the stamp meant
+     *  a caller that named no role silently got the operator framing, and the
+     *  server's strict resolver never saw the absence. */
+    role: 'admin' | 'public';
     /** Task 2356 — spawn-tee inputs; see channel-spawn-tee.ts. Supplied by the
      *  caller because this module is pure. */
     platformRoot: string;

package/payload/platform/services/claude-session-manager/dist/webchat-channel-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webchat-channel-mcp.d.ts","sourceRoot":"","sources":["../src/webchat-channel-mcp.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,2BAA2B,oBAAoB,CAAA;AAE5D;;uDAEuD;AACvD,eAAO,MAAM,0BAA0B,gCAA+C,CAAA;AAEtF,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAA;IACX,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB;;;uCAGmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf;;qEAEiE;IACjE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IACzB;8CAC0C;IAC1C,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,uBAAuB,GACzB,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CA8B9C;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,IAAI,MAAM,EAAE,CAExD;AAED;;;kCAGkC;AAClC,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;4EAC4E;AAC5E,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvE"}
+{"version":3,"file":"webchat-channel-mcp.d.ts","sourceRoot":"","sources":["../src/webchat-channel-mcp.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,2BAA2B,oBAAoB,CAAA;AAE5D;;uDAEuD;AACvD,eAAO,MAAM,0BAA0B,gCAA+C,CAAA;AAEtF,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAA;IACX,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAA;IAClB;;;uCAGmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf;;;;;;0DAMsD;IACtD,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;IACxB;8CAC0C;IAC1C,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,uBAAuB,GACzB,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAkC9C;AAED,uEAAuE;AACvE,wBAAgB,6BAA6B,IAAI,MAAM,EAAE,CAExD;AAED;;;kCAGkC;AAClC,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;4EAC4E;AAC5E,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvE"}

package/payload/platform/services/claude-session-manager/dist/webchat-channel-mcp.js

@@ -44,7 +44,11 @@ export function buildWebchatChannelMcpServers(p) {
                 // for BOTH roles: resolveChannelRole now throws on an absent or
                 // unrecognised value rather than defaulting to admin, because that
                 // default is what would silently re-register the retired reply tool.
-                WEBCHAT_CHANNEL_ROLE: p.role === 'public' ? 'public' : 'admin',
+                //
+                // Task 2666 — passed through verbatim. The ternary read as a narrowing
+                // but was a fallback: it turned an absent role into 'admin' BEFORE the
+                // server saw it, so the throw above could never fire.
+                WEBCHAT_CHANNEL_ROLE: p.role,
             },
         },
     };

package/payload/platform/services/claude-session-manager/dist/webchat-channel-mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"webchat-channel-mcp.js","sourceRoot":"","sources":["../src/webchat-channel-mcp.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,+EAA+E;AAC/E,eAAe;AACf,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAEhF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAA;AAE5D;;uDAEuD;AACvD,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,2BAA2B,SAAS,CAAA;AAgCtF,MAAM,UAAU,6BAA6B,CAC3C,CAA0B;IAE1B,8EAA8E;IAC9E,0EAA0E;IAC1E,uCAAuC;IACvC,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,2BAA2B;QACvC,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAA;IACF,OAAO;QACL,CAAC,2BAA2B,CAAC,EAAE;YAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,mBAAmB,EAAE,CAAC,CAAC,GAAG;gBAC1B,2BAA2B,EAAE,CAAC,CAAC,UAAU;gBACzC,0BAA0B,EAAE,CAAC,CAAC,SAAS;gBACvC,yEAAyE;gBACzE,gEAAgE;gBAChE,mEAAmE;gBACnE,qEAAqE;gBACrE,oBAAoB,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;aAC/D;SACF;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,6BAA6B;IAC3C,OAAO,CAAC,yCAAyC,EAAE,UAAU,2BAA2B,EAAE,CAAC,CAAA;AAC7F,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,IAAI,CAAC,GAAG,EAAE,wBAAwB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AAC5F,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,aAAqB;IAC3D,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,6BAA6B,EAAE,CAAC,CAAA;AAC5E,CAAC"}
+{"version":3,"file":"webchat-channel-mcp.js","sourceRoot":"","sources":["../src/webchat-channel-mcp.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,+EAA+E;AAC/E,eAAe;AACf,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAEhF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAA;AAE5D;;uDAEuD;AACvD,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,2BAA2B,SAAS,CAAA;AAoCtF,MAAM,UAAU,6BAA6B,CAC3C,CAA0B;IAE1B,8EAA8E;IAC9E,0EAA0E;IAC1E,uCAAuC;IACvC,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,2BAA2B;QACvC,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAA;IACF,OAAO;QACL,CAAC,2BAA2B,CAAC,EAAE;YAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,GAAG,GAAG,CAAC,GAAG;gBACV,mBAAmB,EAAE,CAAC,CAAC,GAAG;gBAC1B,2BAA2B,EAAE,CAAC,CAAC,UAAU;gBACzC,0BAA0B,EAAE,CAAC,CAAC,SAAS;gBACvC,yEAAyE;gBACzE,gEAAgE;gBAChE,mEAAmE;gBACnE,qEAAqE;gBACrE,EAAE;gBACF,uEAAuE;gBACvE,uEAAuE;gBACvE,sDAAsD;gBACtD,oBAAoB,EAAE,CAAC,CAAC,IAAI;aAC7B;SACF;KACF,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,6BAA6B;IAC3C,OAAO,CAAC,yCAAyC,EAAE,UAAU,2BAA2B,EAAE,CAAC,CAAA;AAC7F,CAAC;AAED;;;kCAGkC;AAClC,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,IAAI,CAAC,GAAG,EAAE,wBAAwB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AAC5F,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,aAAqB;IAC3D,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,6BAA6B,EAAE,CAAC,CAAA;AAC5E,CAAC"}

package/payload/platform/services/telegram-channel/dist/instructions.d.ts

@@ -1,6 +1,18 @@
 export type TelegramChannelRole = 'admin' | 'public';
-/** Resolve the channel role from the spawn env (TG_CHANNEL_ROLE). Anything
- *  other than the literal 'public' is admin — the safe default. */
+/** Resolve the channel role from the spawn env (TG_CHANNEL_ROLE). Strict, like
+ *  the whatsapp and webchat twins.
+ *
+ *  Task 2666 — this used to return 'admin' for anything that was not the
+ *  literal 'public', and called that the safe default. It is the opposite of
+ *  safe: admin is the HIGHEST-privilege framing on this door, and reaching it
+ *  by exclusion means every way of getting the role wrong lands there. A resume
+ *  that omitted the role booted a stranger's conversation with the block that
+ *  says the message "is a message the operator has typed to you directly" and
+ *  to act on it as their instruction, and it emitted nothing while doing so: a
+ *  spawn that silently became admin is byte-identical to a correct admin spawn.
+ *
+ *  Both spawn paths stamp the env, so an absent or unrecognised value means the
+ *  spawn is wrong and the channel must not boot. */
 export declare function resolveChannelRole(raw: string | undefined): TelegramChannelRole;
 export declare function channelInstructions(role: TelegramChannelRole): string;
 export declare function replyToolDescription(role: TelegramChannelRole): string;

package/payload/platform/services/telegram-channel/dist/instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEpD;mEACmE;AACnE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAE/E;AAmDD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAErE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAItE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAEtE;AAoBD,eAAO,MAAM,yBAAyB,QAkEiE,CAAA"}
+{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEpD;;;;;;;;;;;;;oDAaoD;AACpD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAM/E;AAkED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAErE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAItE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAEtE;AAoBD,eAAO,MAAM,yBAAyB,QAkEiE,CAAA"}

package/payload/platform/services/telegram-channel/dist/instructions.js

@@ -4,10 +4,26 @@
 // as an operator instruction — it answers a visitor. The black-box +
 // no-internals guardrails apply to both. Pure so the framing is unit-testable
 // without booting the MCP server.
-/** Resolve the channel role from the spawn env (TG_CHANNEL_ROLE). Anything
- *  other than the literal 'public' is admin — the safe default. */
+/** Resolve the channel role from the spawn env (TG_CHANNEL_ROLE). Strict, like
+ *  the whatsapp and webchat twins.
+ *
+ *  Task 2666 — this used to return 'admin' for anything that was not the
+ *  literal 'public', and called that the safe default. It is the opposite of
+ *  safe: admin is the HIGHEST-privilege framing on this door, and reaching it
+ *  by exclusion means every way of getting the role wrong lands there. A resume
+ *  that omitted the role booted a stranger's conversation with the block that
+ *  says the message "is a message the operator has typed to you directly" and
+ *  to act on it as their instruction, and it emitted nothing while doing so: a
+ *  spawn that silently became admin is byte-identical to a correct admin spawn.
+ *
+ *  Both spawn paths stamp the env, so an absent or unrecognised value means the
+ *  spawn is wrong and the channel must not boot. */
 export function resolveChannelRole(raw) {
-    return raw === 'public' ? 'public' : 'admin';
+    if (raw === 'public')
+        return 'public';
+    if (raw === 'admin')
+        return 'admin';
+    throw new Error(`telegram-channel: TG_CHANNEL_ROLE must be 'admin' or 'public' (got ${raw === undefined ? 'undefined' : JSON.stringify(raw)})`);
 }
 const NO_INTERNALS = `The platform you run on is a black box: never read, grep, or edit the platform install or its ` +
     `server bundle, and never restart platform services. If the platform itself is broken, describe ` +
@@ -49,6 +65,21 @@ const PUBLIC_INSTRUCTIONS = SPECIALIST_AUDIENCE +
     `question or do what the visitor asked within your remit, then (2) write that answer as the ` +
     `final text of your turn. That text is what reaches the visitor's chat, so never end a turn ` +
     `without it and never wait for confirmation before answering. ` +
+    // Task 2666 — a public spawn holds four Telegram tools now. Without this
+    // paragraph the agent keeps answering in plain text, because the block above
+    // tells it to write its answer as final text and names no tool: the surface
+    // would ship and nothing would use it.
+    `You can do more than write sentences in this chat, and a good answer often is not a paragraph. ` +
+    `Use telegram-card when the visitor is choosing between a small number of things: it posts your ` +
+    `text with tappable buttons under it, a button can open a web page inside Telegram, and giving ` +
+    `the same card a key lets you update that one message later instead of stacking new ones below ` +
+    `it. When you send a card, the card IS your answer — do not repeat it as your final text. ` +
+    `Use telegram-ask for a poll, a quiz, a checklist, a map pin, a venue or a contact card. ` +
+    `Use telegram-media-send for a photo, document, video, voice note or a set of images. ` +
+    `Use telegram-media-fetch to open a file the visitor sent you. ` +
+    `Beside a poll or a photo, still write the sentence that says what the visitor is looking at. ` +
+    `You act only as this bot and only in this chat: both are fixed for you, so never try to reach ` +
+    `another person or another conversation. ` +
     NO_INTERNALS;
 export function channelInstructions(role) {
     return role === 'public' ? PUBLIC_INSTRUCTIONS : ADMIN_INSTRUCTIONS;

package/payload/platform/services/telegram-channel/dist/instructions.js.map

@@ -1 +1 @@
-{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,qEAAqE;AACrE,8EAA8E;AAC9E,kCAAkC;AAIlC;mEACmE;AACnE,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;AAC9C,CAAC;AAED,MAAM,YAAY,GAChB,gGAAgG;IAChG,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,0EAA0E,CAAA;AAE5E,yEAAyE;AACzE,gFAAgF;AAChF,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,mFAAmF;AACnF,6EAA6E;AAC7E,8EAA8E;AAC9E,kFAAkF;AAClF,sEAAsE;AACtE,MAAM,mBAAmB,GACvB,iGAAiG;IACjG,wFAAwF;IACxF,kGAAkG;IAClG,4GAA4G,CAAA;AAE9G,MAAM,kBAAkB,GACtB,mBAAmB;IACnB,iEAAiE;IACjE,mGAAmG;IACnG,+FAA+F;IAC/F,8FAA8F;IAC9F,kGAAkG;IAClG,2FAA2F;IAC3F,yFAAyF;IACzF,0FAA0F;IAC1F,yFAAyF;IACzF,YAAY,CAAA;AAEd,MAAM,mBAAmB,GACvB,mBAAmB;IACnB,uEAAuE;IACvE,oGAAoG;IACpG,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,+DAA+D;IAC/D,YAAY,CAAA;AAEd,MAAM,UAAU,mBAAmB,CAAC,IAAyB;IAC3D,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAyB;IAC5D,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,2EAA2E;QAC7E,CAAC,CAAC,2EAA2E,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAyB;IAC5D,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,qCAAqC,CAAA;AACzG,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,iFAAiF;AACjF,kFAAkF;AAClF,wDAAwD;AACxD,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,sEAAsE;AACtE,4EAA4E;AAC5E,kDAAkD;AAClD,EAAE;AACF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GACpC,sDAAsD;IACtD,8NAA8N;IAC9N,8EAA8E;IAC9E,2FAA2F;IAC3F,mEAAmE;IACnE,sGAAsG;IACtG,oHAAoH;IACpH,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,wBAAwB;IACxB,uFAAuF;IACvF,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,gBAAgB;IAChB,sFAAsF;IACtF,6FAA6F;IAC7F,+EAA+E;IAC/E,wEAAwE;IACxE,sBAAsB;IACtB,uGAAuG;IACvG,8EAA8E;IAC9E,0EAA0E;IAC1E,uGAAuG;IACvG,iDAAiD;IACjD,gFAAgF;IAChF,mFAAmF;IACnF,oHAAoH;IACpH,yBAAyB;IACzB,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,mBAAmB;IACnB,8GAA8G;IAC9G,gHAAgH;IAChH,6BAA6B;IAC7B,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,2DAA2D;IAC3D,iHAAiH;IACjH,0EAA0E;IAC1E,2EAA2E;IAC3E,iFAAiF;IACjF,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,qEAAqE;IACrE,qEAAqE;IACrE,+EAA+E;IAC/E,6EAA6E;IAC7E,YAAY;IACZ,8GAA8G;IAC9G,6HAA6H;IAC7H,kIAAkI;IAClI,4EAA4E;IAC5E,qFAAqF;IACrF,qGAAqG,CAAA"}
+{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,qEAAqE;AACrE,8EAA8E;AAC9E,kCAAkC;AAIlC;;;;;;;;;;;;;oDAaoD;AACpD,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAA;IACrC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,OAAO,CAAA;IACnC,MAAM,IAAI,KAAK,CACb,sEAAsE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAC/H,CAAA;AACH,CAAC;AAED,MAAM,YAAY,GAChB,gGAAgG;IAChG,iGAAiG;IACjG,mGAAmG;IACnG,iGAAiG;IACjG,0EAA0E,CAAA;AAE5E,yEAAyE;AACzE,gFAAgF;AAChF,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,mFAAmF;AACnF,6EAA6E;AAC7E,8EAA8E;AAC9E,kFAAkF;AAClF,sEAAsE;AACtE,MAAM,mBAAmB,GACvB,iGAAiG;IACjG,wFAAwF;IACxF,kGAAkG;IAClG,4GAA4G,CAAA;AAE9G,MAAM,kBAAkB,GACtB,mBAAmB;IACnB,iEAAiE;IACjE,mGAAmG;IACnG,+FAA+F;IAC/F,8FAA8F;IAC9F,kGAAkG;IAClG,2FAA2F;IAC3F,yFAAyF;IACzF,0FAA0F;IAC1F,yFAAyF;IACzF,YAAY,CAAA;AAEd,MAAM,mBAAmB,GACvB,mBAAmB;IACnB,uEAAuE;IACvE,oGAAoG;IACpG,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,6FAA6F;IAC7F,+DAA+D;IAC/D,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,uCAAuC;IACvC,iGAAiG;IACjG,iGAAiG;IACjG,gGAAgG;IAChG,gGAAgG;IAChG,2FAA2F;IAC3F,0FAA0F;IAC1F,uFAAuF;IACvF,gEAAgE;IAChE,+FAA+F;IAC/F,gGAAgG;IAChG,0CAA0C;IAC1C,YAAY,CAAA;AAEd,MAAM,UAAU,mBAAmB,CAAC,IAAyB;IAC3D,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAyB;IAC5D,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,2EAA2E;QAC7E,CAAC,CAAC,2EAA2E,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAyB;IAC5D,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,qCAAqC,CAAA;AACzG,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,iFAAiF;AACjF,kFAAkF;AAClF,wDAAwD;AACxD,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,sEAAsE;AACtE,4EAA4E;AAC5E,kDAAkD;AAClD,EAAE;AACF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GACpC,sDAAsD;IACtD,8NAA8N;IAC9N,8EAA8E;IAC9E,2FAA2F;IAC3F,mEAAmE;IACnE,sGAAsG;IACtG,oHAAoH;IACpH,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,wBAAwB;IACxB,uFAAuF;IACvF,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,gBAAgB;IAChB,sFAAsF;IACtF,6FAA6F;IAC7F,+EAA+E;IAC/E,wEAAwE;IACxE,sBAAsB;IACtB,uGAAuG;IACvG,8EAA8E;IAC9E,0EAA0E;IAC1E,uGAAuG;IACvG,iDAAiD;IACjD,gFAAgF;IAChF,mFAAmF;IACnF,oHAAoH;IACpH,yBAAyB;IACzB,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,mBAAmB;IACnB,8GAA8G;IAC9G,gHAAgH;IAChH,6BAA6B;IAC7B,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,2DAA2D;IAC3D,iHAAiH;IACjH,0EAA0E;IAC1E,2EAA2E;IAC3E,iFAAiF;IACjF,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,qEAAqE;IACrE,qEAAqE;IACrE,+EAA+E;IAC/E,6EAA6E;IAC7E,YAAY;IACZ,8GAA8G;IAC9G,6HAA6H;IAC7H,kIAAkI;IAClI,4EAA4E;IAC5E,qFAAqF;IACrF,qGAAqG,CAAA"}

package/payload/platform/templates/agents/public/IDENTITY.md

@@ -6,15 +6,15 @@ You are a public-facing agent for a business. Your soul and your knowledge are p
 
 Everything you know is in this prompt — your soul and the knowledge given with it. Answer only from it. If the answer is not there, say plainly that it is outside what you can help with, and offer to pass the question to the business. Never fill a gap from general training knowledge, and never invent a fact about the business, its products, prices, or people.
 
-## You have one tool
+## Your tools
 
-You have exactly one tool: the reply tool for the channel you are talking on. It is how your answer reaches the visitor, so you call it for every reply you make. There is nothing else to call. You cannot search, look anything up, read files, run commands, or load skills, and there is no tool for any of it, so do not try. If a visitor asks for something that would need a lookup or an action, treat it as outside what you can help with and offer to pass it on. You answer; you do not act.
+Your tools are the ones this channel names for you, and there are no others. One of them is always the reply tool for the channel you are talking on: it is how your answer reaches the visitor, so you call it for every reply you make. Do not reach for a search, a lookup, a file, a command or a skill that is not on your list. If a visitor asks for something none of your tools can do, treat it as outside what you can help with and offer to pass it on.
 
 ## How you behave
 
 In your first message of every conversation, make clear in a natural way that the visitor is talking to an AI, not a human. This is a trust obligation, not optional, and it belongs in the greeting rather than bolted on after. Never impersonate a human at any point.
 
-You are read-only. You cannot create, change, or delete anything. If a visitor uploads a file, it is saved for the business to review — you cannot read it or act on its contents, so say so honestly.
+You are read-only over the business. You cannot create, change, or delete any of its records. A file a visitor sends is saved for the business to review, and you can open it only if one of your tools does that.
 
 Never describe your own workings, limits, or what you can and cannot call unless a visitor asks. Visitors care about the business, not how you are built. Stay within the scope of the knowledge you were given, and decline politely when a request falls outside it.
 

package/payload/server/server.js

@@ -7177,11 +7177,29 @@ function createScheduleInjectRoutes(deps) {
       console.error(`${TAG6} op=schedule-telegram-reject eventId=${eventId} destination=${destination} reason=unresolved-effective-account`);
       return c.json({ ok: false, error: "unresolved-effective-account" }, 403);
     }
-    if (resolution.kind === "ambiguous") {
-      console.error(`${TAG6} op=telegram-destination-ambiguous eventId=${eventId} destination=${destination} accounts=${resolution.count} dispatched=no`);
-      return c.json({ ok: false, error: "telegram-destination-ambiguous" }, 403);
+    let claimant;
+    if (resolution.kind === "one") {
+      claimant = resolution;
+    } else {
+      const mine = resolution.claimants.filter((c2) => c2.accountId === eventAccountId);
+      if (mine.length === 0) {
+        console.error(
+          `${TAG6} op=event-account-scope-mismatch eventId=${eventId} eventAccount=${eventAccountId ?? "-"} effectiveAccount=none claimants=${resolution.claimants.length} destination=${destination} dispatched=no`
+        );
+        return c.json({ ok: false, error: "event-account-scope-mismatch" }, 403);
+      }
+      if (mine.length > 1) {
+        console.error(
+          `${TAG6} op=telegram-destination-ambiguous eventId=${eventId} destination=${destination} accounts=${mine.length} scope=within-account dispatched=no`
+        );
+        return c.json({ ok: false, error: "telegram-destination-ambiguous" }, 403);
+      }
+      claimant = mine[0];
+      console.error(
+        `${TAG6} op=telegram-destination-narrowed eventId=${eventId} destination=${destination} claimants=${resolution.claimants.length} account=${claimant.accountId} botId=${claimant.botId}`
+      );
     }
-    const { accountId: effectiveAccount, botId, botToken } = resolution;
+    const { accountId: effectiveAccount, botId, botToken } = claimant;
     console.error(`${TAG6} op=effective-account eventId=${eventId} effectiveAccount=${effectiveAccount} botId=${botId}`);
     if (eventAccountId === null || eventAccountId !== effectiveAccount) {
       console.error(`${TAG6} op=event-account-scope-mismatch eventId=${eventId} eventAccount=${eventAccountId ?? "-"} effectiveAccount=${effectiveAccount} destination=${destination} dispatched=no`);
@@ -7189,8 +7207,8 @@ function createScheduleInjectRoutes(deps) {
     }
     const sendVerdict = checkTelegramChatSend({
       chatId: Number(destination),
-      allowChannels: resolution.allowChannels,
-      allowGroups: resolution.allowGroups
+      allowChannels: claimant.allowChannels,
+      allowGroups: claimant.allowGroups
     });
     console.error(
       `[telegram-outbound] op=channel-send botId=${botId} chatId=${destination} allowed=${sendVerdict.allowed ? "yes" : "no"} reason=${sendVerdict.reason} messageId=none`
@@ -39977,6 +39995,16 @@ function startEmitter(opts) {
             }
             continue;
           }
+          if (opts.onToolUse && !suppressing && event.type === "assistant") {
+            const pre = event.message;
+            if (pre && Array.isArray(pre.content)) {
+              for (const block of pre.content) {
+                if (block?.type === "tool_use" && typeof block.name === "string") {
+                  opts.onToolUse(block.name);
+                }
+              }
+            }
+          }
           for (const answer of answers.push(line)) {
             if (suppressing) {
               discardedAnswers += 1;
@@ -41215,7 +41243,17 @@ function buildTelegramSpawnRequest(input) {
     // session resolve under that account, not the manager's boot-time house
     // default. Mirror of the WhatsApp builder.
     targetAccountId: input.accountId,
-    telegramChannel: { senderId: channelKey, gatewayUrl: input.gatewayUrl, serverPath: input.serverPath },
+    // Task 2666 — the pin travels with the channel binding. Sent on EVERY role,
+    // not just public: the manager grants the rich tool surface only on
+    // role:'public', and putting a role branch here would be a second place
+    // that has to be kept in step with the manager's own gate.
+    telegramChannel: {
+      senderId: channelKey,
+      gatewayUrl: input.gatewayUrl,
+      serverPath: input.serverPath,
+      botId: input.botId,
+      chatId: input.chatId
+    },
     logContext: `channel=telegram-native role=${input.role} botId=${input.botId} senderId=${input.senderId}`
   };
 }
@@ -41239,6 +41277,10 @@ function buildTelegramEnsureSession(deps) {
       gatewayUrl: input.gatewayUrl,
       serverPath: input.serverPath,
       botId: input.botId,
+      // Task 2666 — the chat the public spawn's tools are pinned to. The same
+      // value handed to the file follower below, so a group answers into the
+      // group and a business chat into the customer's chat.
+      chatId: input.chatId,
       // Task 2615 — the builder keys both the channel key and the session id on
       // this when present, instead of on the sender.
       businessChatId: input.businessChatId ?? null,
@@ -41510,6 +41552,7 @@ function runTelegramPresenceCensus() {
 }
 
 // app/lib/telegram/gateway/native-file-follower.ts
+var TELEGRAM_CARD_TOOL = "mcp__telegram__telegram-card";
 var CHAT_ACTION_REFRESH_MS = 4e3;
 function startTelegramNativeFileFollower(input) {
   const entry2 = {
@@ -41532,6 +41575,7 @@ function startTelegramNativeFileFollower(input) {
   };
   let lastChatActionAt = Number.NEGATIVE_INFINITY;
   let turnOpen = false;
+  let cardSentThisTurn = false;
   let heartbeat = null;
   const send = (driver2) => {
     lastChatActionAt = Date.now();
@@ -41568,6 +41612,7 @@ function startTelegramNativeFileFollower(input) {
   };
   const onTurnComplete = () => {
     turnOpen = false;
+    cardSentThisTurn = false;
     if (input.backgroundActive?.() === true) return;
     stopHeartbeat();
     lastChatActionAt = Number.NEGATIVE_INFINITY;
@@ -41596,10 +41641,30 @@ function startTelegramNativeFileFollower(input) {
     onActivity,
     onTurnComplete,
     onTurnStart,
+    // Task 2666 — which tools this turn used. Only `telegram-card` matters: it
+    // posts the answer's own words WITH its buttons, so delivering the turn's
+    // final text beside it shows the visitor the same answer twice. A poll or a
+    // photo is a separate object and its accompanying sentence is usually the
+    // part that explains what it is, so those are left alone.
+    //
+    // Every card call posts or edits a message: `text` is required in
+    // CARD_SHAPE and card.ts always issues sendMessage or editMessageText
+    // before it reaches the optional answerCallbackQuery, so there is no card
+    // call that posts nothing and no bare acknowledgement to keep the text for.
+    onToolUse: (name) => {
+      if (name === TELEGRAM_CARD_TOOL) cardSentThisTurn = true;
+    },
     // Task 2521 — the answer reaches every bound door through the one fan-out.
     // Ungated by design: whatever woke the turn, the reader and the chats show
-    // the same thing.
+    // the same thing. Task 2666 adds the one exception above.
     onAnswer: async (answer) => {
+      if (cardSentThisTurn) {
+        cardSentThisTurn = false;
+        console.error(
+          `[telegram-public] op=text-suppressed sessionId=${input.sessionId.slice(0, 8)} messageId=${answer.messageId} reason=card-sent`
+        );
+        return;
+      }
       const targets = input.fanTargets?.() ?? [];
       if (targets.length === 0) return;
       noteAnswer(input.sessionId, answer.messageId);
@@ -43481,7 +43546,7 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
       }
     }
     if (hits.length === 0) return { kind: "none" };
-    if (hits.length > 1) return { kind: "ambiguous", count: hits.length };
+    if (hits.length > 1) return { kind: "ambiguous", claimants: hits };
     return { kind: "one", ...hits[0] };
   }
   // Task 2078 — the same binding the live inbound resolves. Without it a

package/payload/platform/lib/anthropic-key/dist/index.d.ts

@@ -1,22 +0,0 @@
-/**
- * Centralised Anthropic API key management.
- *
- * Provides read/write/validate operations for the Anthropic API key
- * used by the public agent. All consumers import from this module
- * instead of inlining the env-var-then-file lookup pattern.
- *
- * Follows the same shape as cloudflare/mcp/src/lib/cloudflared.ts
- * (readToken, writeToken, hasToken, validateToken).
- */
-export declare function readKey(): string | null;
-export declare function writeKey(key: string): void;
-export declare function hasKey(): boolean;
-export declare function deleteKey(): void;
-export type KeyStatus = "valid" | "billing" | "auth_error" | "missing" | "error";
-export interface KeyValidation {
-    status: KeyStatus;
-    message: string;
-}
-export declare function validateKey(key?: string): Promise<KeyValidation>;
-export declare function keyFilePath(): string;
-//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/anthropic-key/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAoEH,wBAAgB,OAAO,IAAI,MAAM,GAAG,IAAI,CAiDvC;AAMD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAiB1C;AAMD,wBAAgB,MAAM,IAAI,OAAO,CAEhC;AAaD,wBAAgB,SAAS,IAAI,IAAI,CAsBhC;AAUD,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC;AAEjF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAsFtE;AAOD,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}