@rubytech/create-maxy-code 0.1.83 → 0.1.85

package/payload/platform/plugins/cloudflare/PLUGIN.md

@@ -30,7 +30,7 @@ The plugin registers no agent-facing MCP tools. Every Cloudflare operation is dr
 
 | Script | Purpose |
 |---|---|
-| [`scripts/setup-tunnel.sh`](scripts/setup-tunnel.sh) | Autonomous end-to-end setup: OAuth login, tunnel resolve (operator-supplied identity), DNS route, config + state, service restart, post-restart verification. Invocation: `~/setup-tunnel.sh <brand> <port> <admin-hostname> [<public-hostname>] [<apex-hostname>]`. Required env: `STREAM_LOG_PATH`, `ACCOUNT_DIR`, AND exactly one of `TUNNEL_ID` (operator selected an existing tunnel from `/api/admin/cloudflare/tunnels`) or `TUNNEL_NAME` (operator typed a name to create) per the operator-selected-tunnel fix. The pre-fix derivation `${BRAND}-$(hostname -s)` is removed — the operator's logged-in Cloudflare account is the source of truth for which tunnel exists. Apex hostnames print an `ACTION REQUIRED` block for the dashboard record the CLI cannot create. Step 1 (wrappers faithfully relay third-party CLI) spawns `cloudflared tunnel login`, extracts the argotunnel URL from its stdout, mechanically opens it on the brand's VNC chromium using the install-time-resolved binary (`DISPLAY=${DISPLAY:-${BRAND_VNC_DISPLAY}} "${SETUP_TUNNEL_CHROMIUM_BIN}" <url> &` — `SETUP_TUNNEL_CHROMIUM_BIN` is read from `${MAXY_PLATFORM_ROOT}/config/chromium-binary.path` at script start so Ubuntu Noble laptop's snap-replaced Google Chrome is honoured by the install-time chromium resolver), then polls for `~/.cloudflared/cert.pem` while the operator clicks the zone row + Authorize on the VNC. 180 s budget with a 2-second `step=oauth-login result=awaiting-cert` heartbeat. No CDP auto-click, no DOM matcher. |
+| [`scripts/setup-tunnel.sh`](scripts/setup-tunnel.sh) | Autonomous end-to-end setup: OAuth login, tunnel resolve (operator-supplied identity), DNS route, config + state, service restart, post-restart verification. Invocation: `~/setup-tunnel.sh <brand> <port> <admin-hostname> [<public-hostname>] [<apex-hostname>]`. Required env: `STREAM_LOG_PATH`, `ACCOUNT_DIR`, AND exactly one of `TUNNEL_ID` (operator selected an existing tunnel — the agent enumerates them via `cloudflared tunnel list --output json` and presents the list in chat) or `TUNNEL_NAME` (operator typed a name to create) per the operator-selected-tunnel fix. The pre-fix derivation `${BRAND}-$(hostname -s)` is removed — the operator's logged-in Cloudflare account is the source of truth for which tunnel exists. Apex hostnames print an `ACTION REQUIRED` block for the dashboard record the CLI cannot create. Step 1 (wrappers faithfully relay third-party CLI) spawns `cloudflared tunnel login`, extracts the argotunnel URL from its stdout, mechanically opens it on the brand's VNC chromium using the install-time-resolved binary (`DISPLAY=${DISPLAY:-${BRAND_VNC_DISPLAY}} "${SETUP_TUNNEL_CHROMIUM_BIN}" <url> &` — `SETUP_TUNNEL_CHROMIUM_BIN` is read from `${MAXY_PLATFORM_ROOT}/config/chromium-binary.path` at script start so Ubuntu Noble laptop's snap-replaced Google Chrome is honoured by the install-time chromium resolver), then polls for `~/.cloudflared/cert.pem` while the operator clicks the zone row + Authorize on the VNC. 180 s budget with a 2-second `step=oauth-login result=awaiting-cert` heartbeat. No CDP auto-click, no DOM matcher. |
 | [`scripts/reset-tunnel.sh`](scripts/reset-tunnel.sh) | Deletes every tunnel on the brand's CF account and wipes `${CFG_DIR}`. Does not touch the platform service, stray CNAMEs, or token-mode connectors — those require dashboard cleanup or `pkill`. Invocation: `~/reset-tunnel.sh <brand>`. No polling blocks — every long-wait is bounded by `cloudflared`'s network round-trip, so no heartbeat contract applies. |
 
 ### Skills
@@ -49,18 +49,9 @@ The plugin registers no agent-facing MCP tools. Every Cloudflare operation is dr
 
 The agent loads these references on demand via `plugin-read` as the conversation requires. They are not auto-injected into the system prompt.
 
-### UI contract
-
-VNC surfacing is post-navigation, never on form submit. Two sites call `useDeviceUrlActions().onShowVnc()` and both fire only after a successful CDP nav: `DeviceUrlBlock` (tool-output URL clicks) and `ActionLogPanel.handleOauthRespawn` (the "Re-open on Pi browser" button rendered when an OAuth URL appears in the action log). The form (`cloudflare-setup-form`) must NOT call `onShowVnc()` on POST resolve — pre-warming the fullscreen overlay before the OAuth URL is on the brand chromium hides the form, the ActionLogPanel, and the very button operators must click. The `[browser-viewer] event=mount surface="overlay"` line must appear within 5 s of `[device-url:click] navigateResult=ok`, never before.
-
 ### Error envelope contract
 
-Every `POST /api/admin/cloudflare/setup` failure returns a `CloudflareSetupError` carrying — in addition to `field`, `message`, `output`, `correlationId`, `streamLogPath` — two structured fields the form relays into the chat as a fenced JSON block:
-
-- `inputsAlreadyHeld: { admin?: string; public?: string; apex?: string }` — the FQDNs the route composed from the submit body before `err()` fired. Pre-validation failures emit `{}` so absence is itself deterministic.
-- `discoveryResults: { tunnels: { id; name }[]; domains: string[] }` — the last-known snapshot from the process-lifetime `discoveryCache` Map that `GET /tunnels` and `GET /domains` write to on success.
-
-The chat relay appends both as a fenced ```` ```json ```` block under "Held by deterministic tools (do not re-solicit)". The admin agent's reply restates those values verbatim, names the literal error, and stops — re-soliciting is a doctrine violation. The retry-on-redeployment decision is owned by the route (2026-05-13 doctrine fix): `POST /api/admin/cloudflare/setup` looks up the most recent terminal `:Task {kind:"cloudflare-tunnel-login"}` on the conversation via `findMostRecentTerminalCloudflareTask`, and when the running bundle's mtime post-dates that Task's `completedAt` the respawn proceeds; otherwise the route returns the prior Task's `errorMessage` verbatim as the new envelope. The agent does not branch on `bundleMtime` and never narrates it (`[admin-reply-scrub]` records any leakage under `llm-narrates-internal-state`). The rule lives in IDENTITY.md § "Post-deterministic-error reply contract" and `.docs/agents.md` § "Intent Gate — post-deterministic-error reply contract". The shared `TunnelEntry` shape lives in [`platform/ui/app/lib/cloudflare-setup-types.ts`](../../ui/app/lib/cloudflare-setup-types.ts).
+`setup-tunnel.sh` emits structured `[tunnel-install] step=… result=… …` phase lines on stdout throughout its run and exits non-zero on failure. The agent streams stdout into chat verbatim as it arrives, names the literal exit code on failure, and cites `references/reset-guide.md` for the next action. The agent never paraphrases the script's output, never summarises an `ACTION REQUIRED` block, and never re-solicits values the operator already provided — re-soliciting is a doctrine violation. The general form of the post-deterministic-error reply contract (literal-error + held-values restatement) lives in IDENTITY.md § "Post-deterministic-error reply contract" and `.docs/agents.md` § "Intent Gate — post-deterministic-error reply contract"; admin-reply token scrub at `platform/ui/app/lib/admin-reply-scrub.ts` catches narration leakage under `llm-narrates-internal-state`.
 
 ## Identity model
 

package/payload/platform/plugins/cloudflare/scripts/__tests__/setup-tunnel-display-precedence.test.sh

@@ -0,0 +1,194 @@
+#!/usr/bin/env bash
+# setup-tunnel.sh OAuth display precedence — three-case test.
+#
+# Verifies that the chromium spawn in Step 1 (OAuth login) ALWAYS uses the
+# brand-declared VNC display from brand.json, never the PTY-inherited
+# DISPLAY env var. Covers the regression filed as task 221: PTY admin
+# agent inherits DISPLAY=:0 from systemd, which would route the OAuth
+# Authorize page onto the system display rather than the operator-visible
+# brand VNC.
+#
+# Cases:
+#   1. Positive  — brand.json vncDisplay=100, DISPLAY=:0 in env
+#                  → stream log shows `step=browser-spawn result=ok display=:100`.
+#   2. Negative  — brand.json missing vncDisplay field, DISPLAY=:0 in env
+#                  → exit non-zero with `result=error reason=brand-vnc-display-unresolved`.
+#   3. Negative  — brand.json file absent (MAXY_PLATFORM_ROOT set, file missing)
+#                  → exit non-zero with same reason.
+#
+# Mocks cloudflared (echo URL + sleep), systemd-run (no-op success), and
+# the brand chromium binary via PATH override. SETUP_TUNNEL_LOGIN_TIMEOUT=1
+# short-circuits the cert-poll so the positive case exits in ~1 s.
+#
+# Run: bash setup-tunnel-display-precedence.test.sh
+
+set -uo pipefail
+
+TEST_DIR="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")" && pwd)"
+SCRIPT_PATH="$(dirname "${TEST_DIR}")/setup-tunnel.sh"
+
+if [ ! -x "${SCRIPT_PATH}" ] && [ ! -r "${SCRIPT_PATH}" ]; then
+  echo "FAIL: setup-tunnel.sh not found at ${SCRIPT_PATH}"
+  exit 1
+fi
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "SKIP: jq is required for brand.json vncDisplay parsing in setup-tunnel.sh"
+  exit 0
+fi
+
+PASS=0
+FAIL=0
+
+run_case() {
+  local case_name="$1"
+  local brand_json_content="$2"   # empty means "do not write the file"
+  local expected_exit="$3"        # "nonzero" or a specific code; we only check non-zero vs result via grep
+  local expected_grep="$4"        # pattern to grep in stream log
+
+  WORK="$(mktemp -d -t maxy-display-test.XXXXXX)"
+  trap 'rm -rf "$WORK"' RETURN
+
+  # Fake $HOME for ${CFG_DIR}=${HOME}/.${BRAND}/cloudflared paths
+  export HOME="${WORK}/home"
+  mkdir -p "${HOME}/.testbrand/cloudflared"
+  # Ensure default OAuth cert path also empty so pre-flight cert-promotion is skipped
+  mkdir -p "${HOME}/.cloudflared"
+
+  # MAXY_PLATFORM_ROOT layout
+  export MAXY_PLATFORM_ROOT="${WORK}/platform"
+  mkdir -p "${MAXY_PLATFORM_ROOT}/config"
+  # Path INSIDE the file is the chromium binary; the file itself does not
+  # need to be executable. The script's check is `[ -x "${path}" ]` which
+  # requires an absolute path — `command -v true` returns the shell
+  # builtin name, not a path. Pick the first existing absolute file.
+  if [ -x /usr/bin/true ]; then TRUE_BIN=/usr/bin/true
+  elif [ -x /bin/true ]; then TRUE_BIN=/bin/true
+  else
+    echo "SKIP: no /usr/bin/true or /bin/true available for chromium-binary mock"
+    return 0
+  fi
+  printf '%s\n' "${TRUE_BIN}" > "${MAXY_PLATFORM_ROOT}/config/chromium-binary.path"
+
+  if [ -n "${brand_json_content}" ]; then
+    printf '%s' "${brand_json_content}" > "${MAXY_PLATFORM_ROOT}/config/brand.json"
+  fi
+
+  export STREAM_LOG_PATH="${WORK}/stream.log"
+  : > "${STREAM_LOG_PATH}"
+
+  # PATH-override mocks
+  PATH_DIR="${WORK}/bin"
+  mkdir -p "${PATH_DIR}"
+
+  cat > "${PATH_DIR}/cloudflared" <<'MOCK'
+#!/usr/bin/env bash
+# Mock cloudflared: emit a URL once, then sleep long enough that the
+# parent's cert-poll timeout fires.
+echo "Please open the following URL in your browser:"
+echo "https://dash.cloudflare.com/argotunnel?aud=test&callback=https%3A%2F%2Flogin.cloudflareaccess.org%2F"
+sleep 30
+MOCK
+  chmod +x "${PATH_DIR}/cloudflared"
+
+  cat > "${PATH_DIR}/systemd-run" <<'MOCK'
+#!/usr/bin/env bash
+# Mock systemd-run: succeed without launching anything.
+exit 0
+MOCK
+  chmod +x "${PATH_DIR}/systemd-run"
+
+  cat > "${PATH_DIR}/systemctl" <<'MOCK'
+#!/usr/bin/env bash
+# Mock systemctl: stop returns 5 (unit auto-collected) on the happy
+# `--user stop` path; list-unit-files prints nothing.
+case "${*}" in
+  *"stop"*) exit 5 ;;
+  *) exit 0 ;;
+esac
+MOCK
+  chmod +x "${PATH_DIR}/systemctl"
+
+  # stdbuf shim — macOS lacks GNU coreutils stdbuf. The script invokes
+  # `stdbuf -oL -eL cloudflared ...` purely for line-buffering of the
+  # cloudflared output; in this test the output is one short URL line so
+  # buffering doesn't matter. The shim strips the -o/-e flags and execs
+  # the rest of argv directly.
+  cat > "${PATH_DIR}/stdbuf" <<'MOCK'
+#!/usr/bin/env bash
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -i*|-o*|-e*) shift ;;
+    --) shift; break ;;
+    *) break ;;
+  esac
+done
+exec "$@"
+MOCK
+  chmod +x "${PATH_DIR}/stdbuf"
+
+  # Force DISPLAY=:0 to simulate PTY admin agent inheriting from systemd.
+  export DISPLAY=":0"
+  # Short-circuit cert-poll so positive case finishes in ~1 s.
+  export SETUP_TUNNEL_LOGIN_TIMEOUT=1
+  # Required by Step 2+3, but Step 1 cert-poll timeout exits before we
+  # get there; still set them so any drift surfaces a different failure.
+  export TUNNEL_NAME="setup-tunnel-display-test"
+
+  PATH="${PATH_DIR}:${PATH}" "${SCRIPT_PATH}" \
+    testbrand 19200 admin.test.bot \
+    > "${WORK}/stdout.log" 2> "${WORK}/stderr.log" &
+  SCRIPT_PID=$!
+
+  # Bound the wait — kill after 30 s as a safety net.
+  for _ in $(seq 1 60); do
+    if ! kill -0 "${SCRIPT_PID}" 2>/dev/null; then break; fi
+    sleep 0.5
+  done
+  if kill -0 "${SCRIPT_PID}" 2>/dev/null; then
+    kill -TERM "${SCRIPT_PID}" 2>/dev/null || true
+    sleep 1
+    kill -KILL "${SCRIPT_PID}" 2>/dev/null || true
+  fi
+  wait "${SCRIPT_PID}" 2>/dev/null
+  ACTUAL_EXIT=$?
+
+  if grep -qE "${expected_grep}" "${STREAM_LOG_PATH}"; then
+    echo "PASS: ${case_name}"
+    PASS=$((PASS + 1))
+  else
+    echo "FAIL: ${case_name}"
+    echo "  expected stream log to match: ${expected_grep}"
+    echo "  exit=${ACTUAL_EXIT}"
+    echo "  --- stream log ---"
+    sed 's/^/  /' "${STREAM_LOG_PATH}" || true
+    echo "  --- stderr ---"
+    sed 's/^/  /' "${WORK}/stderr.log" || true
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# Case 1 — Positive. vncDisplay=100, DISPLAY=:0 inherited.
+# Expect: chromium-spawn phase line carries display=:100, NOT :0.
+run_case "positive — brand.json vncDisplay=100 overrides inherited DISPLAY=:0" \
+  '{"vncDisplay": 100}' \
+  "nonzero" \
+  'step=browser-spawn result=ok.*display=:100'
+
+# Case 2 — Negative. brand.json present but no vncDisplay field.
+# Expect: hard-fail with reason=brand-vnc-display-unresolved.
+run_case "negative — brand.json missing vncDisplay → hard-fail" \
+  '{"port": 19200}' \
+  "nonzero" \
+  'step=browser-spawn result=error reason=brand-vnc-display-unresolved'
+
+# Case 3 — Negative. brand.json file absent altogether.
+# Expect: same hard-fail.
+run_case "negative — brand.json file absent → hard-fail" \
+  '' \
+  "nonzero" \
+  'step=browser-spawn result=error reason=brand-vnc-display-unresolved'
+
+echo ""
+echo "Summary: ${PASS} passed, ${FAIL} failed"
+[ "${FAIL}" -eq 0 ]

package/payload/platform/plugins/cloudflare/scripts/setup-tunnel.sh

@@ -16,8 +16,8 @@
 #
 # Step 1 owns the browser-spawn deterministically. The wrapper extracts
 # cloudflared's argotunnel URL from its stdout (regex below) and the moment
-# the URL surfaces, mechanically opens it on the Pi's VNC chromium via
-# `DISPLAY=${DISPLAY:-${BRAND_VNC_DISPLAY}} /usr/bin/chromium <url> &` — no reliance on
+# the URL surfaces, mechanically opens it on the brand's VNC chromium via
+# `DISPLAY=${BRAND_VNC_DISPLAY} /usr/bin/chromium <url> &` — no reliance on
 # cloudflared's optimistic xdg-open, no CDP auto-click, no DOM matcher.
 # The operator clicks the zone row + Authorize on the VNC themselves.
 # This is the wrappers-faithfully-relay-third-party-cli doctrine;
@@ -99,17 +99,22 @@ phase_line setup-tunnel step=start brand="${BRAND}" port="${PORT}" hostnames="${
 CFG_DIR="${HOME}/.${BRAND}/cloudflared"
 mkdir -p "${CFG_DIR}"
 
-# Per-brand X display. Each brand owns its own Xtigervnc display
-# so the Chromium tab opened to drive the OAuth Authorize click lands in
-# THIS brand's isolated VNC, not whichever brand booted first on a shared
-# device. Read from the brand manifest if MAXY_PLATFORM_ROOT is exported
-# (set by the systemd unit and by claude-agent::buildSpawnEnv); fall back
-# to the inherited DISPLAY env var, then to :99 for the default brand.
+# Per-brand X display. Each brand owns its own Xtigervnc display so the
+# Chromium tab opened to drive the OAuth Authorize click lands in THIS
+# brand's isolated VNC, not whichever brand booted first on a shared
+# device. brand.json `.vncDisplay` is the sole source of truth; the
+# PTY-agent's inherited DISPLAY (typically `:0` from the systemd unit) is
+# the WRONG surface and is never consulted. If brand.json is absent or
+# does not declare a numeric `vncDisplay`, the chromium-spawn site in
+# Step 1 hard-fails with `step=browser-spawn result=error
+# reason=brand-vnc-display-unresolved` rather than silently falling back
+# to a system display. Re-runs that skip Step 1 (cert.pem already in the
+# brand path) tolerate an unresolved display because no chromium spawns.
 SETUP_TUNNEL_BRAND_JSON=""
 if [ -n "${MAXY_PLATFORM_ROOT:-}" ] && [ -f "${MAXY_PLATFORM_ROOT}/config/brand.json" ]; then
   SETUP_TUNNEL_BRAND_JSON="${MAXY_PLATFORM_ROOT}/config/brand.json"
 fi
-BRAND_VNC_DISPLAY=":99"
+BRAND_VNC_DISPLAY=""
 if [ -n "${SETUP_TUNNEL_BRAND_JSON}" ] && command -v jq >/dev/null 2>&1; then
   _bvd=$(jq -r '.vncDisplay // empty' "${SETUP_TUNNEL_BRAND_JSON}" 2>/dev/null || true)
   if [ -n "${_bvd}" ] && [ "${_bvd}" -eq "${_bvd}" ] 2>/dev/null; then
@@ -185,8 +190,8 @@ fi
 #      $STREAM_LOG_PATH with prefix [script:setup-tunnel:cloudflared]
 #      (the chat-surface namespace — see _stream-log.sh header).
 #   2. Extract the authorize URL with a tolerant regex as it streams.
-#   3. The instant the URL is extracted, mechanically open it on the Pi
-#      VNC chromium via `DISPLAY=${DISPLAY:-${BRAND_VNC_DISPLAY}} /usr/bin/chromium <url> &`.
+#   3. The instant the URL is extracted, mechanically open it on the brand
+#      VNC chromium via `DISPLAY=${BRAND_VNC_DISPLAY} /usr/bin/chromium <url> &`.
 #      Fire-and-forget — chromium is already running with CDP enabled at
 #      :9222, so the invocation IPCs the URL into the running instance as
 #      a new tab. The spawn is intentionally NOT tracked in the EXIT trap:
@@ -237,7 +242,22 @@ if [ ! -f "${CFG_DIR}/cert.pem" ] && [ -f "${HOME}/.cloudflared/cert.pem" ]; the
 fi
 
 if [ ! -f "${CFG_DIR}/cert.pem" ]; then
-  phase_line setup-tunnel step=oauth-login cert_path="${CFG_DIR}/cert.pem" display="${DISPLAY:-${BRAND_VNC_DISPLAY}}"
+  # Brand owns the OAuth chromium display unconditionally. If brand.json
+  # didn't declare a numeric vncDisplay, the install is broken — refuse to
+  # spawn chromium on whatever DISPLAY the PTY agent happened to inherit
+  # (typically :0 from the systemd unit, which is NOT the operator-visible
+  # brand VNC). Doctrine block at top of file: brand wins, every time.
+  if [ -z "${BRAND_VNC_DISPLAY}" ]; then
+    phase_line setup-tunnel step=browser-spawn result=error \
+      reason=brand-vnc-display-unresolved \
+      brand_json="${SETUP_TUNNEL_BRAND_JSON:-unset}"
+    echo "ERROR: setup-tunnel.sh: brand VNC display could not be resolved." >&2
+    echo "       brand.json: ${SETUP_TUNNEL_BRAND_JSON:-unset}" >&2
+    echo "       Required: brand.json must declare numeric 'vncDisplay'." >&2
+    exit 1
+  fi
+
+  phase_line setup-tunnel step=oauth-login cert_path="${CFG_DIR}/cert.pem" display="${BRAND_VNC_DISPLAY}"
 
   URL_FILE="$(mktemp -t maxy-setup-tunnel-url.XXXXXX)"
   LAST_LINE_FILE="$(mktemp -t maxy-setup-tunnel-last.XXXXXX)"
@@ -267,7 +287,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
   # extracted as it streams. The subshell holds the whole pipeline so
   # PIPESTATUS[0] (cloudflared's exit code) is reachable later.
   (
-    DISPLAY="${DISPLAY:-${BRAND_VNC_DISPLAY}}" stdbuf -oL -eL cloudflared \
+    DISPLAY="${BRAND_VNC_DISPLAY}" stdbuf -oL -eL cloudflared \
       --origincert "${CFG_DIR}/cert.pem" tunnel login 2>&1 |
       while IFS= read -r line; do
         ts="$(stream_log_ts)"
@@ -342,7 +362,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
   # `/usr/bin/chromium` here would re-introduce the AppArmor SingletonLock
   # failure on the laptop.
   CHROMIUM_UNIT="maxy-oauth-chromium-${BRAND}-$$.service"
-  CHROMIUM_LAUNCH_DISPLAY="${DISPLAY:-${BRAND_VNC_DISPLAY}}"
+  CHROMIUM_LAUNCH_DISPLAY="${BRAND_VNC_DISPLAY}"
   CHROMIUM_SPAWN_ERR="$(mktemp -t maxy-oauth-chromium-err.XXXXXX)"
   if systemd-run --user \
       --unit="${CHROMIUM_UNIT}" \
@@ -462,12 +482,13 @@ fi
 # tunnel when the device is renamed while existing CNAMEs continue to
 # point at the old one.
 #
-# Contract: the form (rendered via /api/admin/cloudflare/tunnels list) is
-# the source of truth. The endpoint passes exactly one of:
+# Contract: the operator's logged-in Cloudflare account is the source of
+# truth. The agent enumerates existing tunnels via `cloudflared tunnel list
+# --output json` (presented in chat as a numbered list) and then invokes
+# this script with exactly one of:
 #   TUNNEL_ID   — operator selected an existing tunnel from the list
 #   TUNNEL_NAME — operator typed a name to create a new tunnel
-# The endpoint validates the exactly-one constraint; the script enforces it
-# again here as defence in depth. Setting both, or neither, is a misuse.
+# Setting both, or neither, is a misuse.
 # --------------------------------------------------------------------------
 
 if [ -n "${TUNNEL_ID:-}" ] && [ -n "${TUNNEL_NAME:-}" ]; then
@@ -478,9 +499,10 @@ fi
 if [ -z "${TUNNEL_ID:-}" ] && [ -z "${TUNNEL_NAME:-}" ]; then
   phase_line setup-tunnel step=tunnel-resolve result=error reason=neither-set
   echo "ERROR: TUNNEL_ID (selected) or TUNNEL_NAME (explicit-create) is required." >&2
-  echo "       The form derives one of these from operator input via" >&2
-  echo "       /api/admin/cloudflare/tunnels — re-run the form, do not" >&2
-  echo "       invoke this script directly without one of the env vars." >&2
+  echo "       The agent enumerates existing tunnels via" >&2
+  echo "       'cloudflared tunnel list --output json' and passes one of" >&2
+  echo "       these env vars on invocation. Do not invoke this script" >&2
+  echo "       directly without one of them set." >&2
   exit 1
 fi
 

package/payload/platform/plugins/cloudflare/skills/setup-tunnel/SKILL.md

@@ -26,13 +26,23 @@ Step 1's OAuth flow is a state machine over two observable variables: the brand-
 
 ### How inputs reach the script
 
-Inputs arrive through the `cloudflare-setup-form` component, not agent Q&A. The onboarding skill renders the form, the user submits admin/public/apex labels and the admin password in one action, and the `/api/admin/cloudflare/setup` endpoint runs (in this order):
+The agent collects inputs in plain chat, then invokes the script via Bash. Four inputs are needed: admin FQDN, optional public FQDN, optional apex FQDN, and the admin password. Ask in a single combined message when all four are already known; ask one question at a time when anything is ambiguous.
 
-1. `setRemotePassword(password)` — writes the hashed password.
-2. `~/setup-tunnel.sh <brand> <port> <admin-fqdn> [<public-fqdn>] [<apex-fqdn>]` — brand and port are resolved server-side from `brand.json` and `process.env.PORT`, never form inputs.
-3. For each submitted hostname that is not the admin FQDN and does not start with `public.`, writes it to `~/{configDir}/alias-domains.json` so `isPublicHost()` classifies it as public.
+Sequence:
 
-The script itself is unchanged; only its invocation path moved from "agent collects Q&A then Bash" to "form submits, endpoint spawns".
+1. **Set the admin password** before invoking the script. Use the same endpoint onboarding uses — `curl -X POST http://127.0.0.1:${PORT}/api/remote-auth/set-password -H 'Content-Type: application/json' -d '{"password":"…"}'` — where `${PORT}` is read from `brand.json`.
+2. **(Optional) enumerate existing tunnels** when the operator wants to pick from the logged-in account rather than create a new one. Invoke `cloudflared tunnel list --output json` via Bash, present the result as a numbered list, and let the operator type the number (use that tunnel's `id`) or a fresh name.
+3. **Invoke the script** with `~/setup-tunnel.sh <brand> <port> <admin-fqdn> [<public-fqdn>] [<apex-fqdn>]`. Pass either `TUNNEL_ID=<uuid>` (operator selected) or `TUNNEL_NAME=<name>` (operator named a new one) in env — exactly one. `STREAM_LOG_PATH` and `ACCOUNT_DIR` are resolved from `brand.json` and the `${HOME}/.${BRAND}/` layout.
+4. **Alias-domain classification.** For each non-admin hostname that does not start with `public.`, append it to `~/{configDir}/alias-domains.json` so `isPublicHost()` treats it as public. The platform server watches that file (`watchFile`, ~2 s pickup) — no restart needed. Use this idempotent Bash command per hostname (HOST is the FQDN, FILE is `~/.${BRAND}/alias-domains.json`):
+
+```bash
+FILE=~/.${BRAND}/alias-domains.json
+mkdir -p "$(dirname "$FILE")"
+[ -s "$FILE" ] || echo '[]' > "$FILE"
+jq --arg h "$HOST" '. + [$h] | unique' "$FILE" > "$FILE.tmp" && mv "$FILE.tmp" "$FILE"
+```
+
+Repeated calls with the same hostname are a no-op (the `| unique` filter dedupes). Mirrors the in-process `addAliasDomain()` helper at `platform/ui/app/lib/alias-domains.ts`.
 
 ### Invocation shape (reference)
 
@@ -88,13 +98,22 @@ The YAML and JSON rendering live in a pure Node helper at
 `scripts/__tests__/tunnel-ingress.test.ts` and invoked from the shell via
 `node --experimental-strip-types`.
 
-The agent does not invoke the script directly during onboarding — the endpoint does. The agent's responsibility is to render the form and relay the endpoint's script output verbatim when `_componentDone` arrives. If an `ACTION REQUIRED` block appears, quote it exactly — the operator needs the specific dashboard instructions it contains.
+The agent invokes the script directly via the Bash tool — there is no form, no endpoint relay. Stream the script's stdout into chat verbatim as it arrives; if an `ACTION REQUIRED` block appears, quote it exactly — the operator needs the specific dashboard instructions it contains.
+
+### Reading the stream log before narrating progress
+
+Chat narration is contingent on phase-line evidence, not on the script's overall `result=ok`. The script tees structured phase lines into the stream log as it runs (`[setup-tunnel] step=<phase> <key=value …>`). The agent reads them and narrates from them:
+
+- **Before claiming "the authorise page is open on the device's screen"** (or any equivalent), the agent must have seen `step=browser-spawn result=ok display=:<N>` in the stream log AND must have confirmed `:<N>` matches the brand VNC display recorded in `brand.json` `.vncDisplay` (the chat surface the operator watches). If the operator is on a Pi where the admin chat shares brand VNC `:100`, then `display=:100` is the only value consistent with "page is open on the device". Any other value means the page is on a screen the operator cannot see.
+- **If `display=:<N>` does not match `vncDisplay`,** the agent surfaces the literal `OAUTH_URL: <url>` line from the script's stdout and asks the operator to open it in their shared browser themselves. No claim that the spawn succeeded. The script's chromium spawn is treated as best-effort that may have landed on the wrong screen.
+- **If `step=browser-spawn result=error`,** the agent restates the literal `reason=…` and any `stderr=…` fields and stops, per the discipline rule below. The most common error in this site is `reason=brand-vnc-display-unresolved`, which means `brand.json` does not declare a numeric `vncDisplay` and the installer has to be re-run to fix the brand manifest before another setup attempt makes sense.
+- **The script's `result=ok` flag alone is not evidence that the page is operator-visible.** The display field is the gate. Read it, compare it to brand state, then narrate.
 
 ### When the script exits non-zero
 
-The endpoint returns `{ ok: false, field: "script", message, output }` and the form surfaces the error inline. Relay the output to the user, name the exit code, and cite `references/reset-guide.md` for the next action. Offer to re-render the form after any manual steps the script's error output named. Do not attempt a second invocation outside the form, a Playwright-driven dashboard inspection, or an alternative `cloudflared` command sequence. The discipline rule below applies.
+Relay the script's stdout to the operator verbatim, name the literal exit code, and cite `references/reset-guide.md` for the next action. Do not attempt a second invocation under a different flag combination, a Playwright-driven dashboard inspection, or an alternative `cloudflared` command sequence. The discipline rule below applies.
 
-When the failure reason is `timeout-waiting-cert` (operator did not click Authorize within the 180 s budget), the form surfaces the timeout and the operator can re-submit. The page is still on the Pi VNC; the operator can click Authorize there and the next form submit will complete via the cert-promotion pre-flight (the cert lands in `~/.cloudflared/cert.pem` after consent, and the wrapper's `mv` runs on the next invocation). Do not suggest `~/reset-tunnel.sh` — the cert path is intact and a fresh attempt is the only remediation needed.
+When the failure reason is `timeout-waiting-cert` (operator did not click Authorize within the 180 s budget), the page is still on the Pi VNC; the operator can click Authorize there and a fresh `~/setup-tunnel.sh` invocation will complete via the cert-promotion pre-flight (the cert lands in `~/.cloudflared/cert.pem` after consent, and the wrapper's `mv` runs on the next invocation). Do not suggest `~/reset-tunnel.sh` — the cert path is intact and a fresh attempt is the only remediation needed.
 
 ---
 
@@ -132,7 +151,7 @@ Example:
 
 Use this when the operator needs to do something only the Cloudflare dashboard can do: sign in, switch accounts, add a site, edit an apex CNAME, verify zone nameservers, delete a tunnel after stopping its replicas. The guide has one numbered click-path per operation. Quote the relevant click-path verbatim — the operator follows it in the browser. The agent does not drive dashboard mutations via Playwright or Chrome DevTools.
 
-The single exception is `list-cf-domains.sh`, which reads the domains attached to the logged-in account to populate the `cloudflare-setup-form` dropdowns. That script is deterministic (bash + raw CDP, no LLM in the decision path), invoked only by the `/api/admin/cloudflare/domains` route, and produces only a JSON `string[]` on stdout; no dashboard state is changed. Any dashboard scrape that is not this exact script is forbidden — the agent does not extend this carve-out to new scripts it writes, hypothesises, or finds. Adding a new sanctioned scrape surface requires a code change reviewed as a doctrine change, not an inline agent decision.
+The single exception is `list-cf-domains.sh`, which reads the domains attached to the logged-in account so the agent can present them in chat (e.g. when the operator needs to pick which domain to route a hostname under). The agent invokes the script directly via Bash with `list-cf-domains.sh <brand>` — no route wrapper. The script is deterministic (bash + raw CDP, no LLM in the decision path) and produces only a JSON `string[]` on stdout; no dashboard state is changed. Any dashboard scrape that is not this exact script is forbidden — the agent does not extend this carve-out to new scripts it writes, hypothesises, or finds. Adding a new sanctioned scrape surface requires a code change reviewed as a doctrine change, not an inline agent decision.
 
 ---
 
@@ -144,6 +163,6 @@ When the operator's request touches Cloudflare, the agent's permitted actions ar
 - Quote `references/manual-setup.md`, `references/reset-guide.md`, or `references/dashboard-guide.md`.
 - Verify reachability via plain HTTP (`curl -I https://<hostname>`).
 
-The agent does not drive Cloudflare dashboard mutations via Playwright or Chrome DevTools. The single sanctioned read-only scrape is `list-cf-domains.sh`, invoked only by the `/api/admin/cloudflare/domains` route — the LLM is not in its decision path. No other dashboard-automation surface is permitted; the agent does not generalise this exception to new scripts. The agent does not synthesise `cloudflared` flag combinations from web search or prior training. The agent does not call Cloudflare API or SDK from any language. The agent does not write or mutate `cert.pem`, `tunnel.state`, `config.yml`, or `alias-domains.json` directly — `setup-tunnel.sh` and the operator manage those files.
+The agent does not drive Cloudflare dashboard mutations via Playwright or Chrome DevTools. The single sanctioned read-only scrape is `list-cf-domains.sh`, invoked directly via Bash — the LLM is not in its decision path. No other dashboard-automation surface is permitted; the agent does not generalise this exception to new scripts. The agent does not synthesise `cloudflared` flag combinations from web search or prior training. The agent does not call Cloudflare API or SDK from any language. The agent does not write or mutate `cert.pem`, `tunnel.state`, `config.yml`, or `alias-domains.json` directly — `setup-tunnel.sh` and the operator manage those files.
 
 When a sanctioned surface fails, the agent reports the failure with the exact output, cites the recovery step from `references/reset-guide.md`, and stops. Improvisation — "let me try a different flag" or "let me check the dashboard myself" — is the behaviour this rule exists to prevent. See IDENTITY.md § Cloudflare operations for the unconditional form.

package/payload/platform/plugins/docs/references/cloudflare.md

@@ -8,33 +8,34 @@ Each installation has its own Cloudflare account. Sign-in is OAuth in the device
 |------|--------|
 | **Product identity** (Maxy vs Real Agent) | `brand.json` (`productName`, `configDir`) — known at install. |
 | **Cloudflare account identity** | `cert.pem` from OAuth. One account per brand per device. |
-| **Domain scope** (which zones the operator can route) | Live Cloudflare dashboard at form-render time via `list-cf-domains.sh`, not `brand.json`. Brand identity has no authority over which domains the operator's CF account holds. When the scrape returns an unexpected count (e.g. 1 on a two-zone account), the stream log's per-poll `phase=dom-scrape-poll n=<k> count=<n> domains=[…]` trajectory + the on-disk HTML dump at `~/{configDir}/logs/list-cf-domains-<ts>-count<n>-<mode>-pid<pid>.html` (earlier platform fixes — written on every scrape outcome, not just empty ones) give the operator everything they need to triage the cause without re-running. |
-| **CDP port the scrape attaches to** | `brand.json` (`cdpPort`, stamped at install time) — the same brand-scoped port `vnc.sh` binds Chromium to. `list-cf-domains.sh <brand>` requires the brand arg; the helper reads `${MAXY_PLATFORM_ROOT}/config/brand.json` (no silent default). Missing brand arg, missing brand.json, or missing `cdpPort` field each exit 1 with one of three named reasons (`brand-arg-missing`, `brand-config-missing`, `cdp-port-unresolved`); the route maps all three to `field=config` so the form renders a config card naming the brand instead of a Retry button — retrying would re-fire the same wrongly-resolved spawn. |
+| **Domain scope** (which zones the operator can route) | Live Cloudflare dashboard at script-invocation time via `list-cf-domains.sh`, not `brand.json`. Brand identity has no authority over which domains the operator's CF account holds. When the scrape returns an unexpected count (e.g. 1 on a two-zone account), the stream log's per-poll `phase=dom-scrape-poll n=<k> count=<n> domains=[…]` trajectory + the on-disk HTML dump at `~/{configDir}/logs/list-cf-domains-<ts>-count<n>-<mode>-pid<pid>.html` (earlier platform fixes — written on every scrape outcome, not just empty ones) give the operator everything they need to triage the cause without re-running. |
+| **CDP port the scrape attaches to** | `brand.json` (`cdpPort`, stamped at install time) — the same brand-scoped port `vnc.sh` binds Chromium to. `list-cf-domains.sh <brand>` requires the brand arg; the helper reads `${MAXY_PLATFORM_ROOT}/config/brand.json` (no silent default). Missing brand arg, missing brand.json, or missing `cdpPort` field each exit 1 with one of three named reasons (`brand-arg-missing`, `brand-config-missing`, `cdp-port-unresolved`); the agent reads the exit-code reason from stderr, names the brand, and stops — retrying would re-fire the same wrongly-resolved spawn. |
 | **Local tunnel state** | `~/{configDir}/cloudflared/` — `cert.pem`, `<UUID>.json`, `config.yml`, `tunnel.state`, `alias-domains.json`. |
 
 There is no token-based auth for the operator-owned path (Mode A). To switch Cloudflare accounts, run `reset-tunnel.sh` (which deletes the cert and every tunnel on the current account), then run `setup-tunnel.sh` again — `cloudflared tunnel login` inside the setup script will pick a fresh account when you sign in.
 
 ## Setup flow
 
-Ask the agent to set up Cloudflare. The agent first confirms the domain is already on your Cloudflare account (if not, it quotes the dashboard click-path — see below) and then renders a single form in chat. The form collects everything in one submission:
+Ask the agent to set up Cloudflare. The agent confirms the domain is already on your Cloudflare account (if not, it quotes the dashboard click-path — see below) and then collects the inputs in plain chat:
 
 - **Admin address** — the hostname that will serve the admin chat (e.g. `admin.yourdomain.com`).
 - **Public address** — optional hostname for the public agent (e.g. `public.yourdomain.com` or `chat.yourdomain.com`).
 - **Proxy apex** — optional bare-domain hostname (e.g. `yourdomain.com`) that should also serve the public agent.
 - **Admin password** — the password used to gate remote access to the admin surface.
 
-When you submit, the `/api/admin/cloudflare/setup` endpoint runs — in strict order — `setRemotePassword`, launches a `cloudflare-setup` action (earlier platform fixes: `systemd-run --user` transient unit wrapping `setup-tunnel.sh <brand> <port> <hostname...>`), and registers a post-exit handler that writes alias-domains for every non-`public.*` public or apex hostname (so e.g. `chat.yourdomain.com` is classified as public by `isPublicHost`) and closes the audit Task. When the post-exit handler observes the systemd-run unit gone before its terminal status was sampled (a known systemd-run cgroup race), it consults `tunnel.state` on disk and verifies the tunnel identity matches the form you submitted; if so, the audit Task closes `completed` despite the missed observation. Otherwise it closes `failed` with `endpoint-died-pre-reconcile` and the boot reconciler may still recover the Task at next restart. The script runs end-to-end:
+Once the agent has the four inputs, it sets the admin password via `curl -X POST http://127.0.0.1:${PORT}/api/remote-auth/set-password` (the same endpoint onboarding uses), optionally enumerates existing tunnels via `cloudflared tunnel list --output json` so you can pick from the logged-in account, and then invokes `~/setup-tunnel.sh <brand> <port> <admin-hostname> [<public-hostname>] [<apex-hostname>]` via the Bash tool with either `TUNNEL_ID=<uuid>` (selected) or `TUNNEL_NAME=<name>` (new) in env. After the script returns, the agent appends each non-`public.*` public or apex hostname to `~/{configDir}/alias-domains.json` so `isPublicHost()` classifies it as public.
 
-- `cloudflared tunnel login` — OAuth browser sign-in. The VNC browser opens the Cloudflare authorize page; pick the account that owns your domain, click Authorize. `cert.pem` lands.
-- Tunnel resolution from operator-supplied identity (operator-selected-tunnel fix). The form populates a tunnel-select dropdown from `GET /api/admin/cloudflare/tunnels` (which calls `cloudflared tunnel list --output json` on your logged-in account). You either pick an existing tunnel from the list or type a name to create a new one. The form posts EXACTLY ONE of `{tunnelId, tunnelName}`; the script enforces the same constraint as defence in depth. Pre-fix the script derived `${BRAND}-$(hostname -s)` locally; that broke the operator-state-is-authoritative doctrine and silently created orphan tunnels whenever the device hostname changed. Stream log emits `step=tunnel-resolve source=operator-selected|operator-created tunnel_id=… tunnel_name=…` once the UUID is known.
+The script runs end-to-end:
+
+- `cloudflared tunnel login` — OAuth browser sign-in. The script spawns the brand's VNC chromium pointed at the Cloudflare authorize page; pick the account that owns your domain, click Authorize. `cert.pem` lands.
+- Tunnel resolution from operator-supplied identity (operator-selected-tunnel fix). The script requires EXACTLY ONE of `TUNNEL_ID` or `TUNNEL_NAME` in env and exits 1 with a literal error on either-both-set or neither-set. Pre-fix the script derived `${BRAND}-$(hostname -s)` locally; that broke the operator-state-is-authoritative doctrine and silently created orphan tunnels whenever the device hostname changed. Stream log emits `step=tunnel-resolve source=operator-selected|operator-created tunnel_id=… tunnel_name=…` once the UUID is known.
 - **Zone pre-flight** — for every non-apex hostname the script queries `1.1.1.1` for the registrable parent's NS records and refuses the whole run if they don't point at Cloudflare. Stream log: `step=zone-preflight result=ok|error zones_on_account=… missing_parent_for=…`. Catches "domain not on Cloudflare"; does not catch "domain on a different Cloudflare account than `cert.pem` is bound to" — that case surfaces later via `tunnel-status`.
 - `cloudflared tunnel route dns` for each subdomain hostname. Apex hostnames cannot be routed this way — the script prints an **ACTION REQUIRED** block naming the exact dashboard record to add or edit. Stream log emits `step=route-dns hostname=… tunnel_id=…` before the call and `step=route-dns hostname=… result=ok|apex-skip|error` after; on error the bounded cloudflared stderr (≤400 chars) rides in the same phase line. **The script does not parse cloudflared's stdout** — exit code is the sole decision signal, so all three legitimate cloudflared output shapes (new record, overwrite, idempotent "already configured") are treated as success.
 - `config.yml` and `tunnel.state` written under `${CFG_DIR}`.
-- **Post-restart resume contract** — when the script exits cleanly, the form fires a client-side resume event. The chat hook ([useAdminChat.ts](../../../../platform/ui/app/useAdminChat.ts)) waits for the brand-service to come back via `/api/health` (down-then-up), re-binds the conversation to the new server process, and sends the "Cloudflare setup completed" marker as a normal hidden chat POST that re-invokes the agent in a fresh session. No relay queue, no boot-drain, no banner. Diagnostic: `grep '\[admin-resume\] reason=post-restart' ~/{configDir}/logs/server.log` (expect one line per restart cycle), `grep '\[client-event\] kind=post-restart-resume' ~/{configDir}/logs/server.log` for the operator-visible client trace. See `.docs/web-chat.md` "Post-restart resume contract" for the full client/server contract.
-- `systemctl --user restart ${BRAND}.service` — restarts the platform service so the new tunnel spawns via the service's `ExecStartPre=resume-tunnel.sh`.
+- `systemctl --user restart ${BRAND}.service` — restarts the platform service so the new tunnel spawns via the service's `ExecStartPre=resume-tunnel.sh`. The restart fires a few seconds after the script exits so the script does not kill its own cgroup when invoked via the Bash tool; the chat UI receives a `server_shutdown` SSE frame and reconnects automatically.
 - Post-restart verification — `ps -ef | grep '[c]loudflared'` confirms the connector is alive, then `curl -I https://<hostname>` against each subdomain (up to 60 s per host) confirms a non-530 response.
 
-When the endpoint returns, the form surfaces the script's output and the agent relays it verbatim in chat, including any `ACTION REQUIRED` block. If something fails along the way, the form stays open with a field-scoped error (admin label, public label, password, or script exit) so you can correct and retry without re-entering everything.
+The agent streams the script's stdout into chat verbatim as it arrives, including any `ACTION REQUIRED` block. If the script exits non-zero, the agent names the literal exit code and cites `reset-guide.md` for the next action — no retry under a different flag, no Playwright-driven dashboard inspection.
 
 ## Getting a domain on Cloudflare
 

package/payload/platform/scripts/seed-neo4j.sh

@@ -166,6 +166,18 @@ cat > "$ACCOUNT_SETTINGS" << SETTINGS_EOF
           { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
         ]
       },
+      {
+        "matcher": "mcp__plugin_memory_memory__memory-write",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" }
+        ]
+      },
+      {
+        "matcher": "mcp__plugin_memory_memory__memory-update",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" }
+        ]
+      },
       {
         "hooks": [
           { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }

package/payload/platform/services/claude-session-manager/dist/pty-spawner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pty-spawner.d.ts","sourceRoot":"","sources":["../src/pty-spawner.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAElE,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,iBAAiB,CAAA;AAC5D,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC9B,MAAM,sBAAsB,CAAA;AA+B7B,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,MAAM,kBAAkB,GAC1B,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,yBAAyB,GACzB,qBAAqB,GACrB,yBAAyB,CAAA;AAE7B,MAAM,MAAM,oBAAoB,GAC5B,wBAAwB,GACxB,yBAAyB,CAAA;AAE7B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,wBAAwB,CAAA;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,yBAAyB,CAAA;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,sBAAsB,GAAG,wBAAwB,CAAA;CAAE,CAAA;AAE9E,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS,CAAA;IAC5E,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB;qDACiD;IACjD,gBAAgB,EAAE,MAAM,CAAA;IACxB;6DACyD;IACzD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,SAAS,CAAA;IAClB,IAAI,EAAE,cAAc,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IACrD,wBAAwB,EAAE,MAAM,CAAA;IAChC;;;;;sBAKkB;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB;;mBAEe;IACf,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAA;IACjD;;;;;8EAK0E;IAC1E,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,eAAe,EAAE,MAAM,CAAA;IACvB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;;iEAM6D;IAC7D,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE;;;;;;;;;;2BAUuB;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;;4CAMwC;IACxC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;+DAI2D;IAC3D,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;QACtD,SAAS,EAAE,MAAM,CAAA;KAClB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;IAC7B;;sDAEkD;IAClD,2BAA2B,CAAC,EAAE,MAAM,CAAA;IACpC;;;;;;qEAMiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAK7C,CAAA;AAEF,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;yEAKqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,IAAI,CAAA;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,cAAc,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;IACzC,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;IACvC,iBAAiB,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;kEAG8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;0BAKsB;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,mBAAmB,CAAA;AAC9F,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAoE,CAAA;AAE1H,UAAU,oBAAoB;IAC5B,IAAI,EAAE,IAAI,CAAA;IACV,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB;;;kBAGc;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB,EAAE,MAAM,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd;;;;mBAIe;IACf,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;CAC1C;AAiBD;;;;;;sBAMsB;AACtB,wBAAgB,mBAAmB,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAmCzF;AAWD;;;;;;;;;;;;;;;;;;;;;;;sBAuBsB;AACtB,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAanF;AAED;;;;;;;;sBAQsB;AACtB,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/C;IACD,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACnC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC,CAqBA;AAED;;8DAE8D;AAC9D,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,cAAc,GAAG,WAAW,GAAG,QAAQ,GAAG,kBAAkB,GAAG,QAAQ,CAAC,EACtG,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBxB;AA6PD;8CAC8C;AAC9C,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEhE;AACD,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAgDD;;mEAEmE;AACnE,wBAAgB,iCAAiC,IAAI,IAAI,CAKxD;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CA+jB/F;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;;;;;;;;;YAqBY;AACZ,wBAAgB,oBAAoB,CAClC,IAAI,EAAE;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,UAAU,EAAE,MAAM,GACjB,IAAI,CAYN;AAmBD;0EAC0E;AAC1E,wBAAsB,WAAW,CAC/B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA+B/B"}
+{"version":3,"file":"pty-spawner.d.ts","sourceRoot":"","sources":["../src/pty-spawner.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAElE,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,iBAAiB,CAAA;AAC5D,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC9B,MAAM,sBAAsB,CAAA;AA+B7B,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,MAAM,kBAAkB,GAC1B,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,yBAAyB,GACzB,qBAAqB,GACrB,yBAAyB,CAAA;AAE7B,MAAM,MAAM,oBAAoB,GAC5B,wBAAwB,GACxB,yBAAyB,CAAA;AAE7B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,wBAAwB,CAAA;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,yBAAyB,CAAA;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,sBAAsB,GAAG,wBAAwB,CAAA;CAAE,CAAA;AAE9E,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS,CAAA;IAC5E,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB;qDACiD;IACjD,gBAAgB,EAAE,MAAM,CAAA;IACxB;6DACyD;IACzD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,SAAS,CAAA;IAClB,IAAI,EAAE,cAAc,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IACrD,wBAAwB,EAAE,MAAM,CAAA;IAChC;;;;;sBAKkB;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,WAAW,CAAA;IACxB;;mBAEe;IACf,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAA;IACjD;;;;;8EAK0E;IAC1E,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,eAAe,EAAE,MAAM,CAAA;IACvB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;;iEAM6D;IAC7D,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE;;;;;;;;;;2BAUuB;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;;4CAMwC;IACxC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;+DAI2D;IAC3D,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;QACtD,SAAS,EAAE,MAAM,CAAA;KAClB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;IAC7B;;sDAEkD;IAClD,2BAA2B,CAAC,EAAE,MAAM,CAAA;IACpC;;;;;;qEAMiE;IACjE,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAK7C,CAAA;AAEF,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;yEAKqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,IAAI,CAAA;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,cAAc,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;IACzC,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;IACvC,iBAAiB,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;kEAG8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;0BAKsB;IACtB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,mBAAmB,CAAA;AAC9F,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAoE,CAAA;AAE1H,UAAU,oBAAoB;IAC5B,IAAI,EAAE,IAAI,CAAA;IACV,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB;;;kBAGc;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB,EAAE,MAAM,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd;;;;mBAIe;IACf,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;CAC1C;AAiBD;;;;;;sBAMsB;AACtB,wBAAgB,mBAAmB,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAmCzF;AAWD;;;;;;;;;;;;;;;;;;;;;;;sBAuBsB;AACtB,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAanF;AAED;;;;;;;;sBAQsB;AACtB,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/C;IACD,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACnC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC,CAqBA;AAED;;8DAE8D;AAC9D,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,cAAc,GAAG,WAAW,GAAG,QAAQ,GAAG,kBAAkB,GAAG,QAAQ,CAAC,EACtG,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBxB;AA6PD;8CAC8C;AAC9C,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAEhE;AACD,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAgDD;;mEAEmE;AACnE,wBAAgB,iCAAiC,IAAI,IAAI,CAKxD;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAyjB/F;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;;;;;;;;;YAqBY;AACZ,wBAAgB,oBAAoB,CAClC,IAAI,EAAE;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,UAAU,EAAE,MAAM,GACjB,IAAI,CAYN;AAmBD;0EAC0E;AAC1E,wBAAsB,WAAW,CAC/B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA+B/B"}

package/payload/platform/services/claude-session-manager/dist/pty-spawner.js

@@ -620,24 +620,19 @@ export async function spawnClaudeSession(deps, args) {
             : '';
         deps.logger(`tool-allowlist role=${args.role} count=${allowed.length} excluded=${excludedSample}`);
     }
-    // Task 213 — admin operator spawns lose the memory write tools at the
-    // CLI deny gate. Evidence in session d2aaa85e (2026-05-21): the admin
-    // agent emitted `tool_use: memory-update` filling in for a recorder
-    // turn that produced none, writing nodes that violated the
-    // admin-does-not-write contract declared in IDENTITY.md. The recorder
-    // (database-operator specialist) owns these writers; admin must never
-    // hold them. Specialist spawns (recorder included) are governed by
-    // their agent-frontmatter `tools:` allowlist and are not affected by
-    // this disallow — the names below intentionally use the runtime
-    // post-Task-209 plugin namespace (`mcp__plugin_memory_memory__…`).
-    if (args.role === 'admin' && !isSpecialistSpawn) {
-        const disallowed = [
-            'mcp__plugin_memory_memory__memory-write',
-            'mcp__plugin_memory_memory__memory-update',
-        ];
-        argv.push('--disallowed-tools', disallowed.join(','));
-        deps.logger(`pty-spawn-disallowed role=admin source=spawn-disallow tools=${disallowed.join(',')}`);
-    }
+    // Task 222 — the admin memory-write/update revoke that Task 213 implemented
+    // at this CLI boundary has moved to the PreToolUse hook (see
+    // `platform/plugins/admin/hooks/pre-tool-use.sh`, wired in seed-neo4j.sh).
+    // The CLI `--disallowed-tools` flag was load-bearing in the wrong
+    // direction: it filters the tool surface of the spawned Claude Code
+    // process AND every in-window Task subagent spawned from it, so the
+    // admin-delegates-graph-write-to-database-operator contract introduced
+    // by Task 214 stopped working — database-operator's frontmatter listed
+    // the writers, but the inherited CLI deny stripped them. The hook gates
+    // the same two writers per-tool-use and can distinguish admin direct
+    // (block) from a Task subagent caller (allow), which the CLI flag
+    // could not.
+    //
     // Task 207 — `--permission-mode bypassPermissions` for specialist spawns
     // when the caller has not explicitly set one. Headless specialists have
     // no operator to consent to write-tool invocations; default mode blocks