@rubytech/create-maxy-code 0.1.62 → 0.1.64

package/dist/__tests__/installer-specialist-registration.test.js

@@ -0,0 +1,112 @@
+// Task 165 — installer must register every bundled specialist subagent
+// at $CLAUDE_CONFIG_DIR/agents/<name>.md so Claude Code's `--agent <name>`
+// discovery resolves. Pre-165 the installer left those names unreachable;
+// every recorder spawn silently fell back to the admin agent.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readlinkSync, lstatSync, rmSync, symlinkSync, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { registerSpecialistAgentsAt, SpecialistSymlinkCollision } from "../specialist-registration.js";
+function makeTemplates(dir, names) {
+    mkdirSync(dir, { recursive: true });
+    for (const n of names)
+        writeFileSync(join(dir, `${n}.md`), `---\nname: ${n}\ndescription: "x"\ntools: mcp__x__y\n---\n# ${n}\n`);
+}
+test("registers every bundled specialist as a symlink under agentsDir", () => {
+    const templatesDir = mkdtempSync(join(tmpdir(), "t165-tpl-"));
+    const agentsDir = mkdtempSync(join(tmpdir(), "t165-agents-"));
+    try {
+        const names = ["content-producer", "database-operator", "librarian", "personal-assistant", "project-manager", "research-assistant"];
+        makeTemplates(templatesDir, names);
+        const result = registerSpecialistAgentsAt(templatesDir, agentsDir);
+        assert.equal(result.skipped, null);
+        assert.deepEqual(result.registered.sort(), [...names].sort());
+        for (const n of names) {
+            const linkPath = join(agentsDir, `${n}.md`);
+            const stat = lstatSync(linkPath);
+            assert.ok(stat.isSymbolicLink(), `${n}.md must be a symlink`);
+            const target = resolve(agentsDir, readlinkSync(linkPath));
+            assert.equal(target, resolve(templatesDir, `${n}.md`));
+        }
+    }
+    finally {
+        rmSync(templatesDir, { recursive: true, force: true });
+        rmSync(agentsDir, { recursive: true, force: true });
+    }
+});
+test("re-run refreshes a stale symlink pointing at the wrong target", () => {
+    const templatesDir = mkdtempSync(join(tmpdir(), "t165-tpl-"));
+    const agentsDir = mkdtempSync(join(tmpdir(), "t165-agents-"));
+    try {
+        makeTemplates(templatesDir, ["database-operator"]);
+        // Seed a stale symlink at the destination pointing somewhere else.
+        const stalePath = join(templatesDir, "_stale.md");
+        writeFileSync(stalePath, "stale\n");
+        const linkPath = join(agentsDir, "database-operator.md");
+        symlinkSync(stalePath, linkPath);
+        const beforeTarget = resolve(agentsDir, readlinkSync(linkPath));
+        assert.equal(beforeTarget, resolve(stalePath));
+        registerSpecialistAgentsAt(templatesDir, agentsDir);
+        const afterTarget = resolve(agentsDir, readlinkSync(linkPath));
+        assert.equal(afterTarget, resolve(templatesDir, "database-operator.md"));
+    }
+    finally {
+        rmSync(templatesDir, { recursive: true, force: true });
+        rmSync(agentsDir, { recursive: true, force: true });
+    }
+});
+test("idempotent — second run leaves the same symlink", () => {
+    const templatesDir = mkdtempSync(join(tmpdir(), "t165-tpl-"));
+    const agentsDir = mkdtempSync(join(tmpdir(), "t165-agents-"));
+    try {
+        makeTemplates(templatesDir, ["database-operator"]);
+        registerSpecialistAgentsAt(templatesDir, agentsDir);
+        const linkPath = join(agentsDir, "database-operator.md");
+        const firstStat = lstatSync(linkPath);
+        const firstTarget = readlinkSync(linkPath);
+        registerSpecialistAgentsAt(templatesDir, agentsDir);
+        const secondStat = lstatSync(linkPath);
+        const secondTarget = readlinkSync(linkPath);
+        assert.equal(firstTarget, secondTarget);
+        assert.ok(secondStat.isSymbolicLink());
+        // The number of entries in agentsDir hasn't grown.
+        assert.deepEqual(readdirSync(agentsDir).sort(), ["database-operator.md"]);
+    }
+    finally {
+        rmSync(templatesDir, { recursive: true, force: true });
+        rmSync(agentsDir, { recursive: true, force: true });
+    }
+});
+test("skips with reason=no-templates-dir when templates dir is absent", () => {
+    const agentsDir = mkdtempSync(join(tmpdir(), "t165-agents-"));
+    const missingDir = join(agentsDir, "_definitely-not-here");
+    try {
+        const r = registerSpecialistAgentsAt(missingDir, agentsDir);
+        assert.equal(r.skipped, "no-templates-dir");
+        assert.deepEqual(r.registered, []);
+    }
+    finally {
+        rmSync(agentsDir, { recursive: true, force: true });
+    }
+});
+test("collides loudly on a regular file at the destination (no silent overwrite)", () => {
+    const templatesDir = mkdtempSync(join(tmpdir(), "t165-tpl-"));
+    const agentsDir = mkdtempSync(join(tmpdir(), "t165-agents-"));
+    try {
+        makeTemplates(templatesDir, ["database-operator"]);
+        // Drop a regular file at the destination — the installer must
+        // never clobber it. The function under test throws
+        // SpecialistSymlinkCollision; index.ts maps that to process.exit(1).
+        const linkPath = join(agentsDir, "database-operator.md");
+        writeFileSync(linkPath, "operator-owned\n");
+        assert.throws(() => registerSpecialistAgentsAt(templatesDir, agentsDir), (err) => err instanceof SpecialistSymlinkCollision && err.linkPath === linkPath);
+        // The regular file was not unlinked.
+        const stat = lstatSync(linkPath);
+        assert.ok(!stat.isSymbolicLink(), "regular file must remain untouched after collision");
+    }
+    finally {
+        rmSync(templatesDir, { recursive: true, force: true });
+        rmSync(agentsDir, { recursive: true, force: true });
+    }
+});

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, symlinkSync, unlinkSync, lstatSync, statSync, readlinkSync, realpathSync, accessSync, constants as fsConstants } from "node:fs";
+import { registerSpecialistAgentsAt, SpecialistSymlinkCollision } from "./specialist-registration.js";
 import { resolve, join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
 import { resolveInstallPortFromFs, buildMaxyUnitFile, buildClaudeSessionManagerUnitFile } from "./port-resolution.js";
@@ -2308,6 +2309,14 @@ function setupAccount() {
         logFile(`  [neo4j] passing NEO4J_URI=${neo4jUri} to seed`);
         shell("bash", [seedScript], { cwd: INSTALL_DIR, env: neo4jEnv });
     }
+    // Task 165 — register every bundled specialist subagent at
+    // $CLAUDE_CONFIG_DIR/agents/<name>.md. Claude Code's `--agent <name>`
+    // discovery only resolves under this path; without these symlinks,
+    // every `--agent database-operator` etc. silently runs as the admin
+    // agent on admin IDENTITY/SOUL scaffolding. Symlinks (not copies) so
+    // a `npx -y @rubytech/create-maxy-code` upgrade picks up template
+    // changes without a second seed run.
+    registerSpecialistAgents();
     // install-time defaults. Stamp `account.json` with the
     // brand's default plugin set + default outputStyle / thinkingView, and
     // write a minimal admin SOUL.md. The agent boots into a working state
@@ -2409,6 +2418,19 @@ function writeInstallDefaults(accountId) {
 //                                     correct brand regardless of who owns
 //                                     the shortcut symlink.
 // ---------------------------------------------------------------------------
+function registerSpecialistAgents() {
+    try {
+        registerSpecialistAgentsAt(join(INSTALL_DIR, "platform/templates/specialists/agents"), join(CLAUDE_CONFIG_DIR, "agents"), (line) => { console.log(line); logFile(line); });
+    }
+    catch (err) {
+        if (err instanceof SpecialistSymlinkCollision) {
+            console.error(`Setup failed: ${err.message}`);
+            console.error(`  Remove the file and re-run.`);
+            process.exit(1);
+        }
+        throw err;
+    }
+}
 function createTunnelSymlink(linkPath, target) {
     const targetAbs = resolve(target);
     let lstat = null;

package/dist/specialist-registration.js

@@ -0,0 +1,78 @@
+// Task 165 — bundled-specialist registration.
+//
+// Claude Code resolves `--agent <name>` by reading
+// `$CLAUDE_CONFIG_DIR/agents/<name>.md`. The installer ships every
+// bundled specialist as a file under
+// `<INSTALL_DIR>/platform/templates/specialists/agents/*.md`; this
+// module symlinks each into the per-brand `$CLAUDE_CONFIG_DIR/agents/`
+// so `claude --agent database-operator` resolves on first call.
+//
+// Idempotent. Re-running the installer after a template change
+// refreshes stale symlinks. A regular file at the destination is a
+// collision — never silently overwritten; the operator must remove it
+// explicitly (we throw and the caller decides whether to exit).
+//
+// Lives outside index.ts so unit tests can import the function without
+// triggering index.ts top-level installer code (which fatals on missing
+// brand.json in a test environment).
+import { existsSync, mkdirSync, readdirSync, lstatSync, readlinkSync, symlinkSync, unlinkSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+export class SpecialistSymlinkCollision extends Error {
+    linkPath;
+    constructor(linkPath) {
+        super(`${linkPath} collision (regular file) — remove and re-run`);
+        this.linkPath = linkPath;
+        this.name = "SpecialistSymlinkCollision";
+    }
+}
+export function registerSpecialistAgentsAt(templatesDir, agentsDir, log = () => { }) {
+    if (!existsSync(templatesDir)) {
+        log(`  [specialist-registration] SKIPPED reason=templates-dir-missing path=${templatesDir}`);
+        return { registered: [], skipped: 'no-templates-dir' };
+    }
+    mkdirSync(agentsDir, { recursive: true });
+    const entries = readdirSync(templatesDir).filter((n) => n.endsWith(".md"));
+    if (entries.length === 0) {
+        log(`  [specialist-registration] SKIPPED reason=no-bundled-specialists path=${templatesDir}`);
+        return { registered: [], skipped: 'no-bundled-specialists' };
+    }
+    const registered = [];
+    for (const file of entries.sort()) {
+        const targetAbs = join(templatesDir, file);
+        const linkPath = join(agentsDir, file);
+        const name = file.replace(/\.md$/, "");
+        replaceSpecialistSymlink(linkPath, targetAbs);
+        registered.push(name);
+        log(`  [specialist-registration] installer-specialist-registered name=${name} link=${targetAbs}`);
+    }
+    return { registered, skipped: null };
+}
+export function replaceSpecialistSymlink(linkPath, targetAbs) {
+    let lstat = null;
+    try {
+        lstat = lstatSync(linkPath);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "ENOENT")
+            throw err;
+    }
+    if (lstat === null) {
+        symlinkSync(targetAbs, linkPath);
+        return;
+    }
+    if (!lstat.isSymbolicLink()) {
+        throw new SpecialistSymlinkCollision(linkPath);
+    }
+    let resolvedTarget;
+    try {
+        resolvedTarget = resolve(dirname(linkPath), readlinkSync(linkPath));
+    }
+    catch {
+        resolvedTarget = "<unreadable>";
+    }
+    if (resolvedTarget === targetAbs)
+        return;
+    unlinkSync(linkPath);
+    symlinkSync(targetAbs, linkPath);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.62",
+  "version": "0.1.64",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -4,48 +4,70 @@ description: "Platform administration plugin. Provides system-status, public-hos
 tools:
   - name: system-status
     publicAllowlist: false
+    adminAllowlist: false
   - name: public-hostname
     publicAllowlist: false
+    adminAllowlist: false
   - name: brand-settings
     publicAllowlist: false
+    adminAllowlist: false
   - name: account-manage
     publicAllowlist: false
+    adminAllowlist: false
   - name: account-update
     publicAllowlist: false
+    adminAllowlist: false
   - name: admin-add
     publicAllowlist: false
+    adminAllowlist: true
   - name: admin-remove
     publicAllowlist: false
+    adminAllowlist: true
   - name: admin-list
     publicAllowlist: false
+    adminAllowlist: true
   - name: admin-update-pin
     publicAllowlist: false
+    adminAllowlist: true
   - name: agent-list
     publicAllowlist: false
+    adminAllowlist: true
   - name: agent-config-read
     publicAllowlist: false
+    adminAllowlist: true
   - name: logs-read
     publicAllowlist: false
+    adminAllowlist: false
   - name: plugin-read
     publicAllowlist: false
+    adminAllowlist: false
   - name: skill-load
     publicAllowlist: false
+    adminAllowlist: true
   - name: store-skill
     publicAllowlist: false
+    adminAllowlist: true
   - name: session-reset
     publicAllowlist: false
+    adminAllowlist: true
   - name: session-resume
     publicAllowlist: false
+    adminAllowlist: true
   - name: file-attach
     publicAllowlist: false
+    adminAllowlist: false
   - name: action-pending
     publicAllowlist: false
+    adminAllowlist: true
   - name: action-approve
     publicAllowlist: false
+    adminAllowlist: true
   - name: action-reject
     publicAllowlist: false
+    adminAllowlist: true
   - name: action-edit
     publicAllowlist: false
+    adminAllowlist: true
 hidden:
   - remote-auth-status
   - remote-auth-set-password

package/payload/platform/plugins/admin/hooks/__tests__/turn-completed-graph-write.test.sh

@@ -184,10 +184,11 @@ run_hook "admin" "" "$ENVELOPE"
 [[ -z "$HOOK_STDERR" ]] || fail "case-5 stderr must be empty, got: $HOOK_STDERR"
 
 # 5a. exactly ONE `trigger` log-ingest line carrying the operator session id
-#     and `lastTurnBytes=<n>` (Task 131 replaces `filteredRecords`).
-TRIGGER_COUNT=$(ingest_lines | grep -cE "^trigger sessionId=${OP_ID} turnIndex=0 transcriptBytes=[0-9]+ lastTurnBytes=[0-9]+$" || true)
+#     and `conversationBytes=<n>` (Task 165 — full transcript walker
+#     replaces last-turn-only extractor; field is renamed for clarity).
+TRIGGER_COUNT=$(ingest_lines | grep -cE "^trigger sessionId=${OP_ID} turnIndex=0 transcriptBytes=[0-9]+ conversationBytes=[0-9]+$" || true)
 if [[ "$TRIGGER_COUNT" -eq 1 ]]; then
-  pass "case-5a exactly one trigger line emitted via log-ingest carrying operator id + lastTurnBytes"
+  pass "case-5a exactly one trigger line emitted via log-ingest carrying operator id + conversationBytes"
 else
   fail "case-5a expected exactly 1 trigger line carrying ${OP_ID}, got $TRIGGER_COUNT (lines: $(ingest_lines))"
 fi
@@ -209,7 +210,9 @@ BODY_OK=$(printf '%s' "$RECORDER_BODY" | python3 -c '
 import sys, json
 op = sys.argv[1]
 INSTRUCTION = "update the graph with any new or missing information or intent"
-EXPECTED_LAST = "hello, assistant reply"
+# Task 165 — initialMessage carries the full transcript layout
+# "user: <text>\nassistant: <text>\n…", not just the last assistant text.
+EXPECTED_CONVERSATION = "user: hello operator\nassistant: hello, assistant reply"
 try:
   b = json.load(sys.stdin)
   msg = b.get("initialMessage") or ""
@@ -219,7 +222,7 @@ try:
     b.get("model") == "haiku",
     b.get("adminSessionId") == op,
     b.get("channel") == "browser",
-    msg == INSTRUCTION + "\n\n" + EXPECTED_LAST,
+    msg == INSTRUCTION + "\n\n" + EXPECTED_CONVERSATION,
     "Conversation id:" not in msg,
     "Conversation transcript:" not in msg,
     "originatingSessionId" not in b,
@@ -229,7 +232,7 @@ except Exception as e:
   print("parse-fail:"+str(e))
 ' "$OP_ID" 2>/dev/null)
 if [[ "$BODY_OK" == "yes" ]]; then
-  pass "case-5c body is Sidebar-shape with three overrides (specialist, model, initialMessage)"
+  pass "case-5c body carries full transcript layout (user: …\\nassistant: …) — Task 165"
 else
   fail "case-5c body shape wrong ($BODY_OK): $RECORDER_BODY"
 fi
@@ -249,9 +252,10 @@ else
   pass "case-5e no legacy stderr emissions"
 fi
 
-# --- Case 6 (Task 131): transcript has no assistant/user text → ---------
-#     trigger-skipped reason=last-turn-empty. The hook emits the trigger
-#     line first (lastTurnBytes=0) and then the new skip reason.
+# --- Case 6 (Task 165): transcript has zero qualifying records → --------
+#     trigger-skipped reason=conversation-empty. The hook emits the
+#     trigger line first (conversationBytes=0) and then the new skip
+#     reason.
 EMPTY_TRANSCRIPT=$(mktemp); TMPFILES+=("$EMPTY_TRANSCRIPT")
 printf '{"type":"system","summary":"noop"}\n' > "$EMPTY_TRANSCRIPT"
 EMPTY_ENVELOPE=$(python3 -c '
@@ -261,14 +265,47 @@ print(json.dumps({"session_id": sys.argv[1], "transcript_path": sys.argv[2]}))
 : > "$REQ_LOG"
 run_hook "admin" "" "$EMPTY_ENVELOPE"
 [[ "$HOOK_RC" -eq 0 ]] || fail "case-6 rc=$HOOK_RC"
-if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=last-turn-empty$"; then
-  pass "case-6 empty last-turn text → trigger-skipped reason=last-turn-empty emitted"
+if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=conversation-empty$"; then
+  pass "case-6 zero user/assistant records → trigger-skipped reason=conversation-empty emitted"
 else
-  fail "case-6 expected trigger-skipped last-turn-empty, got: $(ingest_lines)"
+  fail "case-6 expected trigger-skipped conversation-empty, got: $(ingest_lines)"
 fi
 # And no recorder-spawn POST is made.
 if grep -qE '^/api/admin/claude-sessions	' "$REQ_LOG"; then
-  fail "case-6 recorder-spawn must NOT be called when last-turn-empty"
+  fail "case-6 recorder-spawn must NOT be called when conversation-empty"
+fi
+
+# --- Case 7 (Task 165): three-turn conversation walks user/assistant/user
+#     in transcript order; layout is "user: …\nassistant: …\nuser: …". ---
+THREE_TURN_TRANSCRIPT=$(mktemp); TMPFILES+=("$THREE_TURN_TRANSCRIPT")
+{
+  printf '{"type":"user","message":{"role":"user","content":"hello"}}\n'
+  printf '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"what'"'"'s your business?"}]}}\n'
+  printf '{"type":"user","message":{"role":"user","content":"Smalleys"}}\n'
+} > "$THREE_TURN_TRANSCRIPT"
+THREE_ENVELOPE=$(python3 -c '
+import json, sys
+print(json.dumps({"session_id": sys.argv[1], "transcript_path": sys.argv[2]}))
+' "$OP_ID" "$THREE_TURN_TRANSCRIPT")
+: > "$REQ_LOG"
+run_hook "admin" "" "$THREE_ENVELOPE"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-7 rc=$HOOK_RC stderr=$HOOK_STDERR"
+THREE_BODY=$(grep -E '^/api/admin/claude-sessions	' "$REQ_LOG" | head -1 | cut -f2-)
+THREE_OK=$(printf '%s' "$THREE_BODY" | python3 -c '
+import sys, json
+INSTRUCTION = "update the graph with any new or missing information or intent"
+EXPECTED = "user: hello\nassistant: what'"'"'s your business?\nuser: Smalleys"
+try:
+  b = json.load(sys.stdin)
+  msg = b.get("initialMessage") or ""
+  print("yes" if msg == INSTRUCTION + "\n\n" + EXPECTED else "no:"+repr(msg))
+except Exception as e:
+  print("parse-fail:"+str(e))
+' 2>/dev/null)
+if [[ "$THREE_OK" == "yes" ]]; then
+  pass "case-7 three-turn conversation walks user/assistant/user in order"
+else
+  fail "case-7 expected multi-turn layout, got: $THREE_OK | body: $THREE_BODY"
 fi
 
 # --- Summary ------------------------------------------------------------

package/payload/platform/plugins/admin/hooks/turn-completed-graph-write.sh

@@ -23,8 +23,8 @@
 #     "database-operator"   (recursion guard)
 #   - Stop-hook stdin must be non-empty           → reason=empty-stdin
 #   - transcript_path must exist on disk          → reason=missing-transcript
-#   - a most-recent assistant or user turn        → reason=last-turn-empty
-#     must be extractable from the JSONL
+#   - at least one user or assistant record with   → reason=conversation-empty
+#     non-empty text must exist in the JSONL (Task 165)
 #
 # Input: Claude Code's Stop hook stdin shape
 #   { "session_id": "<intrinsic>", "transcript_path": "<jsonl path>", ... }
@@ -91,8 +91,12 @@ if [ -z "$ADMIN_SESSION_ID" ] || [ -z "$TRANSCRIPT_PATH" ] || [ ! -f "$TRANSCRIP
   exit 0
 fi
 
-# Extract the operator's most-recent turn text from the JSONL.
-LAST_TURN_TEXT=$(python3 - "$TRANSCRIPT_PATH" <<'PY'
+# Task 165 — walk every user/assistant record in transcript order; emit
+# "<type>: <text>" per record; join with "\n". The recorder needs the
+# whole exchange to infer operator-asserted facts that span multiple
+# turns (e.g. "hello / what's your business? / Smalleys"). The earlier
+# "last-turn-only" extractor stripped the framing the recorder needed.
+CONVERSATION_TEXT=$(python3 - "$TRANSCRIPT_PATH" <<'PY'
 import sys, json
 
 def block_text(block):
@@ -113,8 +117,7 @@ def record_text(rec):
     return ""
 
 path = sys.argv[1]
-last_assistant = ""
-last_user = ""
+turns = []
 try:
     with open(path, "r", encoding="utf-8") as f:
         for line in f:
@@ -123,26 +126,24 @@ try:
             try: rec = json.loads(line)
             except Exception: continue
             t = rec.get("type") if isinstance(rec, dict) else None
-            if t == "assistant":
-                tx = record_text(rec).strip()
-                if tx: last_assistant = tx
-            elif t == "user":
-                tx = record_text(rec).strip()
-                if tx: last_user = tx
+            if t not in ("user", "assistant"): continue
+            tx = record_text(rec).strip()
+            if not tx: continue
+            turns.append(f"{t}: {tx}")
 except Exception:
     pass
 
-print(last_assistant if last_assistant else last_user, end="")
+print("\n".join(turns), end="")
 PY
 )
 
-LAST_TURN_BYTES=$(printf '%s' "$LAST_TURN_TEXT" | wc -c | tr -d ' ')
+CONVERSATION_BYTES=$(printf '%s' "$CONVERSATION_TEXT" | wc -c | tr -d ' ')
 TRANSCRIPT_BYTES=$(wc -c <"$TRANSCRIPT_PATH" 2>/dev/null | tr -d ' ' || echo 0)
 
-emit_log "trigger sessionId=${ADMIN_SESSION_ID} turnIndex=0 transcriptBytes=${TRANSCRIPT_BYTES} lastTurnBytes=${LAST_TURN_BYTES}"
+emit_log "trigger sessionId=${ADMIN_SESSION_ID} turnIndex=0 transcriptBytes=${TRANSCRIPT_BYTES} conversationBytes=${CONVERSATION_BYTES}"
 
-if [ -z "$LAST_TURN_TEXT" ]; then
-  emit_log "trigger-skipped sessionId=${ADMIN_SESSION_ID} reason=last-turn-empty"
+if [ -z "$CONVERSATION_TEXT" ]; then
+  emit_log "trigger-skipped sessionId=${ADMIN_SESSION_ID} reason=conversation-empty"
   exit 0
 fi
 
@@ -153,9 +154,9 @@ fi
 SPAWN_BODY=$(python3 -c '
 import sys, json
 sid = sys.argv[1]
-last_turn = sys.argv[2]
+conversation = sys.argv[2]
 instruction = "update the graph with any new or missing information or intent"
-text = instruction + "\n\n" + last_turn
+text = instruction + "\n\n" + conversation
 body = {
   "adminSessionId": sid,
   "channel": "browser",
@@ -164,9 +165,9 @@ body = {
   "initialMessage": text,
 }
 print(json.dumps(body))
-' "$ADMIN_SESSION_ID" "$LAST_TURN_TEXT" 2>/dev/null)
+' "$ADMIN_SESSION_ID" "$CONVERSATION_TEXT" 2>/dev/null)
 
-INITIAL_BYTES=$(printf '%s\n\n%s' "update the graph with any new or missing information or intent" "$LAST_TURN_TEXT" | wc -c | tr -d ' ')
+INITIAL_BYTES=$(printf '%s\n\n%s' "update the graph with any new or missing information or intent" "$CONVERSATION_TEXT" | wc -c | tr -d ' ')
 emit_log "spawn-request sessionId=${ADMIN_SESSION_ID} specialist=database-operator initialMessageBytes=${INITIAL_BYTES}"
 
 SPAWN_RES_FILE=$(mktemp)

package/payload/platform/plugins/contacts/PLUGIN.md

@@ -4,22 +4,31 @@ description: "CRM contacts plugin. Provides contact-create, contact-lookup, cont
 tools:
   - name: contact-create
     publicAllowlist: false
+    adminAllowlist: false
   - name: contact-lookup
     publicAllowlist: false
+    adminAllowlist: false
   - name: contact-update
     publicAllowlist: false
+    adminAllowlist: false
   - name: contact-delete
     publicAllowlist: false
+    adminAllowlist: false
   - name: contact-list
     publicAllowlist: false
+    adminAllowlist: false
   - name: contact-export
     publicAllowlist: false
+    adminAllowlist: false
   - name: contact-erase
     publicAllowlist: false
+    adminAllowlist: false
   - name: group-create
     publicAllowlist: false
+    adminAllowlist: false
   - name: group-manage
     publicAllowlist: false
+    adminAllowlist: false
 always: false
 embed: false
 metadata: {"platform":{}}