@rubytech/create-maxy 1.0.880 → 1.0.883

package/payload/platform/lib/graph-write/src/__tests__/action-provenance-gate.test.ts

@@ -94,11 +94,12 @@ test("ACTION_PROVENANCE_LABELS includes the documented set", () => {
   }
 });
 
-test("writeNodeWithEdges rejects :Person write missing PRODUCED-from-Task edge", async () => {
+test("writeNodeWithEdges rejects :Person write missing any inbound PRODUCED edge (missing-provenance)", async () => {
   const { session } = makeStubSession({
-    preCheckLabelsByTarget: new Map([["other-target", ["Conversation"]]]),
+    preCheckLabelsByTarget: new Map([["other-target", ["LocalBusiness"]]]),
   });
   const relationships: GraphRelationship[] = [
+    // No inbound PRODUCED at all — neither Task nor Conversation nor Message.
     { type: "PART_OF", direction: "outgoing", targetNodeId: "other-target" },
   ];
   await assert.rejects(
@@ -112,7 +113,7 @@ test("writeNodeWithEdges rejects :Person write missing PRODUCED-from-Task edge",
         createdBy: { agent: "maxy-admin", session: "sess-1", tool: "memory-write" },
         expectedAccountId: TEST_ACCOUNT_ID,
       }),
-    /missing-action-provenance|Process provenance/i,
+    /missing-provenance/i,
   );
 });
 
@@ -156,16 +157,65 @@ test("writeNodeWithEdges accepts :Person write with no Task edge when agent='sys
   assert.equal(res.edgesCreated, 1);
 });
 
-test("writeNodeWithEdges rejects :Person write whose 'PRODUCED-incoming' source is NOT a :Task", async () => {
+// Task 997 — gate widened to accept :Conversation provenance for direct
+// admin asks. The wrapper auto-injects the inbound PRODUCED edge from the
+// active :AdminConversation via CONVERSATION_NODE_ID.
+test("writeNodeWithEdges accepts :Person write with PRODUCED-from-Conversation edge", async () => {
   const { session } = makeStubSession({
     preCheckLabelsByTarget: new Map([
-      ["other-id", ["Conversation"]],
+      // AdminConversation carries the parent :Conversation label too.
+      ["conv-id", ["Conversation", "AdminConversation"]],
     ]),
   });
   const relationships: GraphRelationship[] = [
-    // Inbound PRODUCED edge but the source is a Conversation, not a Task.
-    // Must reject — prevents bypass via spoofed PRODUCED edge from any node.
-    { type: "PRODUCED", direction: "incoming", targetNodeId: "other-id" },
+    { type: "PRODUCED", direction: "incoming", targetNodeId: "conv-id" },
+  ];
+  const res = await writeNodeWithEdges({
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    session: session as any,
+    labels: ["Person"],
+    props: { accountId: TEST_ACCOUNT_ID },
+    relationships,
+    createdBy: { agent: "maxy-admin", session: "sess-1", tool: "contact-create" },
+    expectedAccountId: TEST_ACCOUNT_ID,
+  });
+  assert.equal(res.edgesCreated, 1);
+});
+
+// Task 997 — Message subtypes (UserMessage, AssistantMessage, AdminMessage)
+// also qualify because the labels() array includes the parent :Message label.
+test("writeNodeWithEdges accepts :Person write with PRODUCED-from-Message edge", async () => {
+  const { session } = makeStubSession({
+    preCheckLabelsByTarget: new Map([
+      ["msg-id", ["Message", "UserMessage"]],
+    ]),
+  });
+  const relationships: GraphRelationship[] = [
+    { type: "PRODUCED", direction: "incoming", targetNodeId: "msg-id" },
+  ];
+  const res = await writeNodeWithEdges({
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    session: session as any,
+    labels: ["Person"],
+    props: { accountId: TEST_ACCOUNT_ID },
+    relationships,
+    createdBy: { agent: "maxy-admin", session: "sess-1", tool: "contact-create" },
+    expectedAccountId: TEST_ACCOUNT_ID,
+  });
+  assert.equal(res.edgesCreated, 1);
+});
+
+// Task 997 — defence-in-depth: the gate's source-label allowlist still
+// rejects PRODUCED edges from nodes outside {Task, Conversation, Message}.
+// Prevents bypass via a spoofed PRODUCED edge from any unrelated node.
+test("writeNodeWithEdges rejects :Person write with PRODUCED edge from a non-provenance-source label", async () => {
+  const { session } = makeStubSession({
+    preCheckLabelsByTarget: new Map([
+      ["business-id", ["LocalBusiness"]],
+    ]),
+  });
+  const relationships: GraphRelationship[] = [
+    { type: "PRODUCED", direction: "incoming", targetNodeId: "business-id" },
   ];
   await assert.rejects(
     () =>
@@ -178,7 +228,7 @@ test("writeNodeWithEdges rejects :Person write whose 'PRODUCED-incoming' source
         createdBy: { agent: "maxy-admin", session: "sess-1", tool: "memory-write" },
         expectedAccountId: TEST_ACCOUNT_ID,
       }),
-    /missing-action-provenance|Process provenance/i,
+    /missing-provenance/i,
   );
 });
 

package/payload/platform/lib/graph-write/src/conversation-provenance.ts

@@ -0,0 +1,140 @@
+// Task 997 — direct-ask provenance auto-injection.
+//
+// MCP tool wrappers that write to ACTION_PROVENANCE_LABELS call this helper
+// before `writeNodeWithEdges`. When the admin server has stamped
+// `CONVERSATION_NODE_ID` in the MCP spawn env (the elementId of the active
+// `:AdminConversation`), the helper:
+//   - verifies the source node exists, carries one of PROVENANCE_SOURCE_LABELS,
+//     and shares the write's accountId
+//   - prepends a synthetic inbound `:PRODUCED` edge to the relationships array
+//     so the gate inside `writeNodeWithEdges` accepts the write
+//
+// The injection is a no-op when:
+//   - the env var is unset (typical for autonomous workflow flows that pass an
+//     explicit `producedByTaskId` instead)
+//   - the labels being written do not require action provenance
+//   - the relationships array already carries an inbound `:PRODUCED` edge from
+//     any source (idempotency — explicit `producedByTaskId` already prepended
+//     one; a second source is redundant noise. If the caller's PRODUCED edge
+//     resolves to a node NOT in PROVENANCE_SOURCE_LABELS, the downstream gate
+//     rejects with `missing-provenance` — defence-in-depth covers that case)
+//
+// Loud-failure cases emit `[<logNamespace>] [provenance-missing] reason=<r>`
+// to stderr and return the original relationships array unchanged — the
+// downstream gate then fires `missing-provenance` so both observability
+// signals land in server.log.
+
+import type { Session } from "neo4j-driver";
+import {
+  ACTION_PROVENANCE_LABELS,
+  PROVENANCE_SOURCE_LABELS,
+} from "./index.js";
+import type { GraphRelationship } from "./index.js";
+
+export interface InjectConversationProvenanceParams {
+  session: Session;
+  /** The relationships array the caller is about to pass to `writeNodeWithEdges`. */
+  relationships: readonly GraphRelationship[];
+  /** The accountId of the write — must match the source node's accountId. */
+  accountId: string;
+  /** Labels of the node about to be written. Used to skip injection when provenance is not required. */
+  writeLabels: readonly string[];
+  /**
+   * Value of `process.env.CONVERSATION_NODE_ID` at call time. Passed as a
+   * parameter so tests can supply it without mutating process.env.
+   */
+  conversationNodeId: string | undefined;
+  /**
+   * Log namespace prefix — typically `"mcp:contacts"` or `"mcp:memory"`. Used
+   * to format the `[provenance-inject]` / `[provenance-missing]` lines so the
+   * operator can attribute the signal to a plugin.
+   */
+  logNamespace: string;
+  /** Tool name (e.g. "contact-create") for the inject/missing log lines. */
+  tool: string;
+}
+
+export async function injectConversationProvenance(
+  params: InjectConversationProvenanceParams,
+): Promise<GraphRelationship[]> {
+  const {
+    session,
+    relationships,
+    accountId,
+    writeLabels,
+    conversationNodeId,
+    logNamespace,
+    tool,
+  } = params;
+
+  const original = [...relationships];
+
+  if (!writeLabels.some((l) => ACTION_PROVENANCE_LABELS.has(l))) return original;
+  if (!conversationNodeId) return original;
+  if (hasInboundProducedEdge(original)) return original;
+
+  let lookup;
+  try {
+    lookup = await session.run(
+      `MATCH (n) WHERE elementId(n) = $id RETURN labels(n) AS labels, n.accountId AS accountId LIMIT 1`,
+      { id: conversationNodeId },
+    );
+  } catch (err) {
+    process.stderr.write(
+      `[${logNamespace}] [provenance-missing] tool=${tool} reason=driver-error message=${err instanceof Error ? err.message : String(err)} conversationNodeId=${conversationNodeId}\n`,
+    );
+    return original;
+  }
+
+  if (lookup.records.length === 0) {
+    process.stderr.write(
+      `[${logNamespace}] [provenance-missing] tool=${tool} reason=node-not-found conversationNodeId=${conversationNodeId}\n`,
+    );
+    return original;
+  }
+
+  const labels = lookup.records[0].get("labels") as string[];
+  const sourceAccountId = lookup.records[0].get("accountId") as string;
+  const sourceLabel = labels.find((l) => PROVENANCE_SOURCE_LABELS.has(l));
+
+  if (!sourceLabel) {
+    process.stderr.write(
+      `[${logNamespace}] [provenance-missing] tool=${tool} reason=wrong-source-label labels=${labels.join(",")} conversationNodeId=${conversationNodeId}\n`,
+    );
+    return original;
+  }
+
+  if (sourceAccountId !== accountId) {
+    process.stderr.write(
+      `[${logNamespace}] [provenance-missing] tool=${tool} reason=account-mismatch sourceAccountId=${sourceAccountId.slice(0, 8)} writeAccountId=${accountId.slice(0, 8)} conversationNodeId=${conversationNodeId}\n`,
+    );
+    return original;
+  }
+
+  process.stderr.write(
+    `[${logNamespace}] [provenance-inject] tool=${tool} from=${sourceLabel}:${conversationNodeId}\n`,
+  );
+
+  return [
+    {
+      type: "PRODUCED",
+      direction: "incoming",
+      targetNodeId: conversationNodeId,
+    },
+    ...original,
+  ];
+}
+
+/**
+ * Detect any pre-existing inbound `:PRODUCED` edge in the relationships
+ * array. Source-label validation is the downstream gate's job; here we only
+ * need to know whether the caller already provided one — if so, skip
+ * injection to avoid duplicate edges.
+ */
+function hasInboundProducedEdge(
+  relationships: readonly GraphRelationship[],
+): boolean {
+  return relationships.some(
+    (r) => r.type === "PRODUCED" && r.direction === "incoming",
+  );
+}

package/payload/platform/lib/graph-write/src/index.ts

@@ -3,6 +3,11 @@
 // `[graph-*]` log family colocated.
 export * from "./audit.js";
 
+// Task 997: re-export the conversation-provenance injector. MCP wrappers
+// (contacts, memory) import it from the package root so the helper, the
+// gate, and the label set live in one import surface.
+export * from "./conversation-provenance.js";
+
 /**
  * Write doctrine (Task 673): a node without at least one adjacency is noise,
  * not knowledge. `writeNodeWithEdges` is the single primitive every graph
@@ -13,21 +18,33 @@ export * from "./audit.js";
  * maps, and flat props are queryable — `MATCH (n) WHERE n.createdBySession
  * = $id RETURN n` is the forensic entry point).
  *
- * Process provenance doctrine (Task 885): writes targeting any label in
- * `ACTION_PROVENANCE_LABELS` (Person, UserProfile, AdminUser, Organization,
- * LocalBusiness, CloudflareTunnel, CloudflareHostname) must include exactly
- * one inbound `:PRODUCED` edge whose source is a `:Task` node. This makes
- * every durable LLM-tool-driven entity creation traversable from the Task
- * node that produced it, and forward from Task→Conversation via
- * `:RAISED_DURING`. Bootstrap writes (`createdBy.agent === 'system'`) are
- * exempt — installer / migration / lazy-create paths run as system writers.
+ * Process provenance doctrine (Task 885, widened by Task 997): writes
+ * targeting any label in `ACTION_PROVENANCE_LABELS` (Person, UserProfile,
+ * AdminUser, Organization, LocalBusiness, CloudflareTunnel,
+ * CloudflareHostname) must include at least one inbound `:PRODUCED` edge
+ * whose source carries one of `:Task`, `:Conversation`, or `:Message` (the
+ * label set is checked against the actual `labels()` of the target node, so
+ * subtype labels like `:AdminConversation`, `:UserMessage`, `:AssistantMessage`,
+ * and `:AdminMessage` all qualify). This makes every durable LLM-tool-driven
+ * entity creation traversable from either:
+ *   - the Task that produced it (autonomous workflows: onboarding skill,
+ *     cloudflare tunnel-login, etc.), or
+ *   - the Conversation/Message turn that triggered it (direct admin asks —
+ *     "add Anneke Roux as person" stamps a `:PRODUCED` edge from the active
+ *     `:AdminConversation` so the entity is traceable to its causal turn
+ *     without forcing the agent to mint a synthetic `:Task` per ask).
+ * Task 997 broadened the gate after the Task-only requirement created
+ * redundant-Task bloat for direct admin asks; the Task-mediated path stays
+ * canonical for autonomous workflows. Bootstrap writes
+ * (`createdBy.agent === 'system'`) are exempt — installer / migration /
+ * lazy-create paths run as system writers.
  *
  * Rejection paths (every one emits a stderr log the admin server pipes to
  * server.log, so orphan pressure is visible per-write not just in the
  * hourly [graph-health] signal):
  *   - zero relationships          → `[graph-write] reject reason=zero-relationships`
  *   - unresolved target id        → `[graph-write] reject reason=unresolved-target`
- *   - missing action provenance   → `[graph-write] reject reason=missing-action-provenance`
+ *   - missing provenance          → `[graph-write] reject reason=missing-provenance`
  *   - removed-feature write       → `[graph-write] reject reason=removed-feature`
  *     (`:ReviewAlert` and `:Event {actionTool:"review-digest-compose"}` are
  *     deleted features; the gate catches doctrine-compliant writers
@@ -42,16 +59,18 @@ export * from "./audit.js";
  */
 
 /**
- * Labels that require an inbound `:PRODUCED` edge from a `:Task` (Task 885).
- * Bootstrap writes with `createdBy.agent === 'system'` are exempt — that
- * carve-out covers PIN-setup `writeAdminUserAndPerson`, schema migrations,
- * and the lazy `loadUserProfile` MERGE path that bypasses this primitive
- * entirely (raw Cypher in `platform/ui/app/lib/neo4j-store.ts`).
+ * Labels that require an inbound `:PRODUCED` edge from a `:Task`,
+ * `:Conversation`, or `:Message` (Task 885, widened by Task 997). Bootstrap
+ * writes with `createdBy.agent === 'system'` are exempt — that carve-out
+ * covers PIN-setup `writeAdminUserAndPerson`, schema migrations, and the
+ * lazy `loadUserProfile` MERGE path that bypasses this primitive entirely
+ * (raw Cypher in `platform/ui/app/lib/neo4j-store.ts`).
  *
  * The set is intentionally not exhaustive — labels added here become a
  * blocking gate for every LLM-tool write of that label. Add a label only
- * after every legitimate writer of it can either (a) carry a Task-PRODUCED
- * edge, or (b) declare itself as `agent: 'system'`.
+ * after every legitimate writer of it can either (a) carry a PRODUCED edge
+ * from one of the accepted source families, or (b) declare itself as
+ * `agent: 'system'`.
  */
 export const ACTION_PROVENANCE_LABELS: ReadonlySet<string> = new Set([
   "Person",
@@ -63,6 +82,18 @@ export const ACTION_PROVENANCE_LABELS: ReadonlySet<string> = new Set([
   "CloudflareHostname",
 ]);
 
+/**
+ * Source labels that satisfy the inbound-PRODUCED gate. The check is
+ * performed against the full `labels()` array of the target node, so
+ * subtype labels (`:AdminConversation`, `:UserMessage`, etc.) qualify
+ * because they carry the parent `:Conversation` / `:Message` label too.
+ */
+export const PROVENANCE_SOURCE_LABELS: ReadonlySet<string> = new Set([
+  "Task",
+  "Conversation",
+  "Message",
+]);
+
 function requiresActionProvenance(labels: readonly string[]): boolean {
   for (const label of labels) {
     if (ACTION_PROVENANCE_LABELS.has(label)) return true;
@@ -70,7 +101,7 @@ function requiresActionProvenance(labels: readonly string[]): boolean {
   return false;
 }
 
-function findProducedFromTaskCandidates(
+function findProvenanceCandidates(
   relationships: readonly GraphRelationship[],
 ): GraphRelationship[] {
   return relationships.filter(
@@ -239,32 +270,42 @@ export async function writeNodeWithEdges(
       );
     }
 
-    // Process provenance gate (Task 885). Labels in
-    // ACTION_PROVENANCE_LABELS require a `:Task` source on at least one
-    // inbound :PRODUCED edge so every durable LLM-tool entity write is
-    // traversable from the Task that produced it. Bootstrap writes
-    // (createdBy.agent === 'system') are exempt — installer + migration
-    // paths predate any Task. The check runs INSIDE the transaction so
-    // the labels-by-target map is consistent with target resolution.
-    let producedByTaskId: string | null = null;
+    // Process provenance gate (Task 885, widened by Task 997). Labels in
+    // ACTION_PROVENANCE_LABELS require an inbound :PRODUCED edge from a
+    // node carrying one of PROVENANCE_SOURCE_LABELS (:Task, :Conversation,
+    // :Message — subtype labels qualify via the labels() array). This
+    // makes every durable LLM-tool entity write traversable to either the
+    // Task that produced it (autonomous workflows) or the
+    // Conversation/Message turn that triggered it (direct admin asks).
+    // Bootstrap writes (createdBy.agent === 'system') are exempt —
+    // installer + migration paths predate any provenance node. The check
+    // runs INSIDE the transaction so the labels-by-target map is
+    // consistent with target resolution.
+    let provenanceSourceId: string | null = null;
+    let provenanceSourceLabel: string | null = null;
     if (
       requiresActionProvenance(labels) &&
       (createdBy.agent ?? "") !== "system"
     ) {
-      const candidates = findProducedFromTaskCandidates(relationships);
-      const taskCandidates = candidates.filter((r) => {
-        const lbls = labelsByTarget.get(r.targetNodeId);
-        return Array.isArray(lbls) && lbls.includes("Task");
-      });
-      if (taskCandidates.length === 0) {
+      const candidates = findProvenanceCandidates(relationships);
+      const matched = candidates
+        .map((r) => {
+          const lbls = labelsByTarget.get(r.targetNodeId);
+          if (!Array.isArray(lbls)) return null;
+          const sourceLabel = lbls.find((l) => PROVENANCE_SOURCE_LABELS.has(l));
+          return sourceLabel ? { rel: r, sourceLabel } : null;
+        })
+        .filter((m): m is { rel: GraphRelationship; sourceLabel: string } => m !== null);
+      if (matched.length === 0) {
         process.stderr.write(
-          `[graph-write] reject reason=missing-action-provenance labels=${labelCsv} agent=${agentLabel}\n`
+          `[graph-write] reject reason=missing-provenance labels=${labelCsv} agent=${agentLabel}\n`
         );
         throw new Error(
-          `missing-action-provenance: write to ${labelCsv} requires an inbound :PRODUCED edge from a :Task (createdBy.agent='${agentLabel}'). Pass producedByTaskId on the write — call task-create at the start of the flow and thread the returned taskId through every subsequent memory-write for one of these labels.`
+          `missing-provenance: write to ${labelCsv} requires an inbound :PRODUCED edge from a :Task, :Conversation, or :Message (createdBy.agent='${agentLabel}'). Either pass producedByTaskId on the write (autonomous workflows: call task-create at the start of the flow and thread the returned taskId), or rely on the MCP wrapper's CONVERSATION_NODE_ID env-stamp injection (direct admin asks).`
         );
       }
-      producedByTaskId = taskCandidates[0].targetNodeId;
+      provenanceSourceId = matched[0].rel.targetNodeId;
+      provenanceSourceLabel = matched[0].sourceLabel;
     }
 
     let nodeRes;
@@ -337,7 +378,7 @@ export async function writeNodeWithEdges(
     }
 
     process.stderr.write(
-      `[graph-write] accepted labels=${labelCsv} edges=${edgesCreated} createdByAgent=${createdBy.agent ?? "unknown"} createdByTool=${createdBy.tool ?? createdBy.source ?? "unknown"} producedByTask=${producedByTaskId ?? "none"}\n`
+      `[graph-write] accepted labels=${labelCsv} edges=${edgesCreated} createdByAgent=${createdBy.agent ?? "unknown"} createdByTool=${createdBy.tool ?? createdBy.source ?? "unknown"} producedBy=${provenanceSourceLabel ?? "none"}:${provenanceSourceId ?? "none"}\n`
     );
 
     return { nodeId, labels: nodeLabels, edgesCreated };

package/payload/platform/plugins/admin/PLUGIN.md

@@ -68,6 +68,7 @@ Tools are available via the `admin` MCP server.
 | Manage plugins and settings | User asks to install, enable, disable, or configure plugins, or change account settings | `skills/plugin-management/SKILL.md` |
 | Manage specialists | User asks to install or remove a specialist subagent, or activate/deactivate premium plugin agents | `skills/specialist-management/SKILL.md` |
 | Generate print-quality PDF | User asks to create a PDF document, one-pager, brochure, or any HTML intended for print/download | `skills/a4-print-documents/SKILL.md` |
+| Plain-English explanation | User asks to explain, define, or pre-empts ("explain in plain English", "what does X mean", "define X", "I don't understand", "what is this"), or admin is about to return a reply containing a term not in the operator's prior turn | `skills/plainly/SKILL.md` |
 
 ## Hooks
 

package/payload/platform/plugins/admin/mcp/dist/__tests__/plugin-read-skill-resolution.test.js

@@ -53,15 +53,39 @@ describe("findSkillOwners", () => {
     });
 });
 describe("computePluginReadHint", () => {
-    it("returns the owning plugin name when exactly one sibling owns the skill", () => {
+    it("returns the owner and canonical SKILL.md path when one sibling owns the skill referenced via file", () => {
         seedSkill("cloudflare", "setup-tunnel");
         const hint = computePluginReadHint(root, "admin", "skills/setup-tunnel/SKILL.md");
-        expect(hint).toBe("cloudflare");
+        expect(hint).toEqual({ pluginName: "cloudflare", file: "skills/setup-tunnel/SKILL.md" });
     });
     it("returns null when no plugin owns the requested skill", () => {
         seedSkill("admin", "onboarding");
         const hint = computePluginReadHint(root, "admin", "skills/imaginary/SKILL.md");
         expect(hint).toBeNull();
     });
+    // Task 1000 — wrong-`pluginName` shape: the skill slug is buried inside
+    // pluginName instead of the file path. The hint must still surface both
+    // the corrected pluginName and the canonical SKILL.md file path.
+    it("hints when skills/<slug> is buried in pluginName and file defaults to PLUGIN.md", () => {
+        seedSkill("admin", "plainly");
+        const hint = computePluginReadHint(root, "admin/skills/plainly", "PLUGIN.md");
+        expect(hint).toEqual({ pluginName: "admin", file: "skills/plainly/SKILL.md" });
+    });
+    it("hints when skills/<slug> is buried in pluginName and file is the bare SKILL.md", () => {
+        seedSkill("admin", "plainly");
+        const hint = computePluginReadHint(root, "admin/skills/plainly", "SKILL.md");
+        expect(hint).toEqual({ pluginName: "admin", file: "skills/plainly/SKILL.md" });
+    });
+    it("hints with the real owner when the pluginName prefix is wrong (contacts/skills/plainly → admin)", () => {
+        seedSkill("admin", "plainly");
+        const hint = computePluginReadHint(root, "contacts/skills/plainly", "PLUGIN.md");
+        expect(hint).toEqual({ pluginName: "admin", file: "skills/plainly/SKILL.md" });
+    });
+    it("returns null when the skill name extracted from pluginName is ambiguous across plugins", () => {
+        seedSkill("admin", "plainly");
+        seedSkill("contacts", "plainly");
+        const hint = computePluginReadHint(root, "admin/skills/plainly", "PLUGIN.md");
+        expect(hint).toBeNull();
+    });
 });
 //# sourceMappingURL=plugin-read-skill-resolution.test.js.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/plugin-read-skill-resolution.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-read-skill-resolution.test.js","sourceRoot":"","sources":["../../src/__tests__/plugin-read-skill-resolution.test.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,oEAAoE;AACpE,6DAA6D;AAC7D,sCAAsC;AACtC,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEhF,IAAI,IAAY,CAAC;AAEjB,UAAU,CAAC,GAAG,EAAE;IACd,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACxC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAErD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;SACjF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClC,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QACvC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAEpD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAErD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,8BAA8B,CAAC,CAAC;QAElF,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAEjC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAE/E,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"plugin-read-skill-resolution.test.js","sourceRoot":"","sources":["../../src/__tests__/plugin-read-skill-resolution.test.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,oEAAoE;AACpE,6DAA6D;AAC7D,sCAAsC;AACtC,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEhF,IAAI,IAAY,CAAC;AAEjB,UAAU,CAAC,GAAG,EAAE;IACd,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACxC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAErD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;SACjF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClC,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QACvC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAEpD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAErD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,mGAAmG,EAAE,GAAG,EAAE;QAC3G,SAAS,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,8BAA8B,CAAC,CAAC;QAElF,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAEjC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAE/E,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,EAAE,WAAW,CAAC,CAAC;QAE9E,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,EAAE,UAAU,CAAC,CAAC;QAE7E,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;QACzG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,EAAE,WAAW,CAAC,CAAC;QAEjF,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9B,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEjC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,EAAE,WAAW,CAAC,CAAC;QAE9E,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -1622,12 +1622,14 @@ server.tool("plugin-read", "Read a plugin definition (PLUGIN.md) or one of its r
         const resolvedFile = file ?? "PLUGIN.md";
         const pluginPath = resolve(PLATFORM_ROOT, "plugins", pluginName, resolvedFile);
         if (!existsSync(pluginPath)) {
-            // Task 964 — when the agent guesses the wrong pluginName for a file
-            // path shaped like `skills/<n>/...`, surface the owning plugin so
-            // the next call is deterministic instead of falling through to Glob.
-            const owner = computePluginReadHint(PLATFORM_ROOT, pluginName, resolvedFile);
-            const hintText = owner ? ` Did you mean pluginName="${owner}"?` : "";
-            console.log(`[plugin-read] ${pluginName}/${resolvedFile} not-found hint=${owner ?? "none"}`);
+            // Task 964/1000 — when the agent's pluginName/file combination misses
+            // a skill that DOES live under `plugins/*/skills/<slug>/SKILL.md`,
+            // surface the corrected pluginName AND the canonical file path so
+            // the next call is deterministic. Both wrong-`file` and wrong-`pluginName`
+            // shapes feed through `computePluginReadHint`.
+            const hint = computePluginReadHint(PLATFORM_ROOT, pluginName, resolvedFile);
+            const hintText = hint ? ` Did you mean pluginName="${hint.pluginName}", file="${hint.file}"?` : "";
+            console.log(`[plugin-read] ${pluginName}/${resolvedFile} not-found hint=${hint ? hint.pluginName : "none"}`);
             return {
                 content: [{ type: "text", text: `Plugin file not found: ${pluginPath}.${hintText}` }],
                 isError: true,