@rubytech/create-realagent-code 0.1.254 → 0.1.256

package/dist/__tests__/plugin-install.test.js

@@ -4,7 +4,7 @@
 // permanent verification artifact.
 import test from "node:test";
 import assert from "node:assert/strict";
-import { parsePluginList, computeInstallActions, computeConfigureActions, parseExternalPlugins, } from "../lib/plugin-install.js";
+import { parsePluginList, computeInstallActions, parseExternalPlugins, } from "../lib/plugin-install.js";
 test("parsePluginList extracts name@marketplace tuples", () => {
     const stdout = `
   ❯ work@maxy-platform
@@ -24,63 +24,81 @@ test("parsePluginList returns empty array for empty stdout", () => {
     assert.deepEqual(parsePluginList(""), []);
     assert.deepEqual(parsePluginList("No plugins installed.\n"), []);
 });
+// `dirSrc` is the directory-source-marketplace discriminator passed as the
+// third argument. maxy-platform is directory-source; claude-plugins-official
+// is a remote (GitHub) marketplace that keeps version-pinned idempotence.
+const dirSrc = new Set(["maxy-platform"]);
 test("computeInstallActions: every desired plugin needs installing when none present", () => {
     const desired = [
         { name: "admin", marketplace: "maxy-platform" },
         { name: "telegram", marketplace: "claude-plugins-official" },
     ];
-    const { toInstall, alreadyInstalled } = computeInstallActions(desired, []);
+    const { toInstall, toResync, alreadyInstalled } = computeInstallActions(desired, [], dirSrc);
     assert.equal(toInstall.length, 2);
+    assert.equal(toResync.length, 0);
     assert.equal(alreadyInstalled.length, 0);
 });
-test("computeInstallActions: idempotent skip for exact name@marketplace match", () => {
+test("computeInstallActions: directory-source plugin already installed goes to resync, not skip", () => {
     const desired = [
         { name: "admin", marketplace: "maxy-platform" },
         { name: "telegram", marketplace: "claude-plugins-official" },
     ];
     const installed = [
         { name: "admin", marketplace: "maxy-platform" },
+        { name: "telegram", marketplace: "claude-plugins-official" },
     ];
-    const { toInstall, alreadyInstalled } = computeInstallActions(desired, installed);
-    assert.deepEqual(toInstall.map(p => p.name), ["telegram"]);
-    assert.deepEqual(alreadyInstalled.map(p => p.name), ["admin"]);
+    const { toInstall, toResync, alreadyInstalled } = computeInstallActions(desired, installed, dirSrc);
+    // admin's directory source changes in place with no version bump, so it must
+    // be re-synced even though it is already in `plugin list`. The remote
+    // telegram stays idempotent-skipped.
+    assert.deepEqual(toInstall.map(p => p.name), []);
+    assert.deepEqual(toResync.map(p => p.name), ["admin"]);
+    assert.deepEqual(alreadyInstalled.map(p => p.name), ["telegram"]);
 });
-test("computeInstallActions: name-only match skips install (legacy install state)", () => {
-    const desired = [{ name: "admin", marketplace: "maxy-platform" }];
-    const installed = [{ name: "admin", marketplace: "" }];
-    const { toInstall, alreadyInstalled } = computeInstallActions(desired, installed);
+test("computeInstallActions: full directory-marketplace set resyncs when every plugin already installed", () => {
+    const desired = [
+        { name: "admin", marketplace: "maxy-platform" },
+        { name: "work", marketplace: "maxy-platform" },
+    ];
+    const installed = [
+        { name: "admin", marketplace: "maxy-platform" },
+        { name: "work", marketplace: "maxy-platform" },
+    ];
+    const { toInstall, toResync, alreadyInstalled } = computeInstallActions(desired, installed, dirSrc);
+    assert.deepEqual(toResync.map(p => p.name), ["admin", "work"]);
     assert.equal(toInstall.length, 0);
-    assert.equal(alreadyInstalled.length, 1);
+    assert.equal(alreadyInstalled.length, 0);
 });
-test("computeConfigureActions: skip when no configureSecret declared", () => {
-    const installed = [{ name: "admin", marketplace: "maxy-platform" }];
-    const actions = computeConfigureActions(installed, {});
-    assert.equal(actions.length, 1);
-    assert.equal(actions[0].kind, "skip-no-secret-name");
+test("computeInstallActions: remote plugin already installed stays idempotent-skipped", () => {
+    const desired = [{ name: "telegram", marketplace: "claude-plugins-official" }];
+    const installed = [{ name: "telegram", marketplace: "claude-plugins-official" }];
+    const { toInstall, toResync, alreadyInstalled } = computeInstallActions(desired, installed, dirSrc);
+    assert.equal(toInstall.length, 0);
+    assert.equal(toResync.length, 0);
+    assert.deepEqual(alreadyInstalled.map(p => p.name), ["telegram"]);
 });
-test("computeConfigureActions: skip when env var absent", () => {
-    const installed = [{
-            name: "telegram",
-            marketplace: "claude-plugins-official",
-            configureSecret: "TELEGRAM_BOT_TOKEN",
-        }];
-    const actions = computeConfigureActions(installed, {});
-    assert.equal(actions.length, 1);
-    assert.equal(actions[0].kind, "skip-no-secret-value");
+test("computeInstallActions: directory-source plugin not yet installed goes to install (fresh build is clean)", () => {
+    const desired = [{ name: "admin", marketplace: "maxy-platform" }];
+    const { toInstall, toResync, alreadyInstalled } = computeInstallActions(desired, [], dirSrc);
+    assert.deepEqual(toInstall.map(p => p.name), ["admin"]);
+    assert.equal(toResync.length, 0);
+    assert.equal(alreadyInstalled.length, 0);
 });
-test("computeConfigureActions: configure when env var present", () => {
-    const installed = [{
-            name: "telegram",
-            marketplace: "claude-plugins-official",
-            configureSecret: "TELEGRAM_BOT_TOKEN",
-        }];
-    const actions = computeConfigureActions(installed, { TELEGRAM_BOT_TOKEN: "abc123" });
-    assert.equal(actions.length, 1);
-    assert.equal(actions[0].kind, "configure");
-    if (actions[0].kind === "configure") {
-        assert.equal(actions[0].secretValue, "abc123");
-        assert.equal(actions[0].plugin.name, "telegram");
-    }
+test("computeInstallActions: name-only match on a remote marketplace skips install (legacy install state)", () => {
+    const desired = [{ name: "telegram", marketplace: "claude-plugins-official" }];
+    const installed = [{ name: "telegram", marketplace: "" }];
+    const { toInstall, toResync, alreadyInstalled } = computeInstallActions(desired, installed, dirSrc);
+    assert.equal(toInstall.length, 0);
+    assert.equal(toResync.length, 0);
+    assert.equal(alreadyInstalled.length, 1);
+});
+test("computeInstallActions: name-only legacy match on a directory marketplace still resyncs", () => {
+    const desired = [{ name: "admin", marketplace: "maxy-platform" }];
+    const installed = [{ name: "admin", marketplace: "" }];
+    const { toInstall, toResync, alreadyInstalled } = computeInstallActions(desired, installed, dirSrc);
+    assert.equal(toInstall.length, 0);
+    assert.deepEqual(toResync.map(p => p.name), ["admin"]);
+    assert.equal(alreadyInstalled.length, 0);
 });
 test("parseExternalPlugins: undefined returns []", () => {
     assert.deepEqual(parseExternalPlugins(undefined), []);
@@ -88,12 +106,12 @@ test("parseExternalPlugins: undefined returns []", () => {
 });
 test("parseExternalPlugins: well-formed array round-trips", () => {
     const raw = [
-        { name: "telegram", marketplace: "claude-plugins-official", configureSecret: "TELEGRAM_BOT_TOKEN", channelPlugin: true },
+        { name: "telegram", marketplace: "claude-plugins-official", channelPlugin: true },
         { name: "discord", marketplace: "claude-plugins-official" },
     ];
     const out = parseExternalPlugins(raw);
     assert.deepEqual(out, [
-        { name: "telegram", marketplace: "claude-plugins-official", configureSecret: "TELEGRAM_BOT_TOKEN", channelPlugin: true },
+        { name: "telegram", marketplace: "claude-plugins-official", channelPlugin: true },
         { name: "discord", marketplace: "claude-plugins-official" },
     ]);
 });

package/dist/index.js

@@ -16,7 +16,7 @@ import { installAllBrewPackages } from "./brew-install.js";
 import { parseSwVers, isSupportedMacosVersion } from "./macos-version.js";
 import { decideChromiumAction, isSnapConfinedPath } from "./snap-chromium.js";
 import { classifyPortHolder } from "./preflight-port-classifier.js";
-import { parsePluginList, computeInstallActions, computeConfigureActions, parseExternalPlugins, } from "./lib/plugin-install.js";
+import { parsePluginList, computeInstallActions, parseExternalPlugins, } from "./lib/plugin-install.js";
 import { findPremiumMcpDirs } from "./lib/premium-mcp-discover.js";
 import { pickLanInterface, mergeSmbConf, formatSambaMarker, } from "./samba-provision.js";
 import { networkInterfaces, userInfo } from "node:os";
@@ -1997,15 +1997,45 @@ function registerLocalAndExternalPlugins() {
         logFile(`[plugin-install] ERROR brand.externalPlugins parse error=${JSON.stringify(msg.slice(0, 200))}`);
     }
     desired.push(...externals);
+    // The directory-source marketplaces are exactly the local trees discovered
+    // from on-disk marketplace.json above. Remote marketplaces (the Anthropic
+    // ones, GitHub externals) are never in this set, so they keep version-pinned
+    // idempotence. (Task 643.)
+    const directorySourceMarketplaces = new Set(localTrees.map(t => t.name));
     // Snapshot what's installed to compute the install set.
     const pluginList = spawnSync("claude", ["plugin", "list"], { stdio: "pipe", encoding: "utf-8", env: claudePluginEnv() });
     const installed = parsePluginList(pluginList.stdout ?? "");
-    const { toInstall, alreadyInstalled } = computeInstallActions(desired, installed);
+    const { toInstall, toResync, alreadyInstalled } = computeInstallActions(desired, installed, directorySourceMarketplaces);
     for (const ref of alreadyInstalled) {
         logFile(`[plugin-install] ${ref.name}@${ref.marketplace} idempotent=true`);
     }
+    // Single source of truth for the install invocation, shared by the resync
+    // and fresh-install loops so a future flag/timeout/scope change cannot drift
+    // between them.
+    const pluginInstall = (ref) => spawnSync("claude", ["plugin", "install", `${ref.name}@${ref.marketplace}`, "--scope", "user"], { stdio: "pipe", encoding: "utf-8", timeout: 120_000, env: claudePluginEnv() });
+    // Resync directory-source plugins (Task 643). A directory marketplace
+    // overwrites its tree in place on upgrade with no version bump, so the
+    // runtime cache snapshot the session loads from (installed_plugins.json
+    // `installPath`) freezes at first-install time — `plugin install` and
+    // `plugin update` both short-circuit on the pinned version and never
+    // re-copy. Uninstall then install is the only sequence that rebuilds the
+    // snapshot from the live tree; `install` reads the directory source live.
+    // The uninstall+install pair is not atomic: a failed reinstall leaves the
+    // plugin deregistered, surfaced by the ERROR line below — hardening tracked
+    // in Task 645.
+    for (const ref of toResync) {
+        spawnSync("claude", ["plugin", "uninstall", `${ref.name}@${ref.marketplace}`, "--scope", "user"], { stdio: "pipe", encoding: "utf-8", timeout: 120_000, env: claudePluginEnv() });
+        const install = pluginInstall(ref);
+        if (install.status === 0) {
+            logFile(`[plugin-install] recache ${ref.name}@${ref.marketplace}`);
+        }
+        else {
+            const stderrShort = (install.stderr ?? "").split("\n")[0]?.slice(0, 200) ?? "";
+            logFile(`[plugin-install] ERROR recache ${ref.name}@${ref.marketplace} exit=${install.status} stderr=${JSON.stringify(stderrShort)}`);
+        }
+    }
     for (const ref of toInstall) {
-        const install = spawnSync("claude", ["plugin", "install", `${ref.name}@${ref.marketplace}`, "--scope", "user"], { stdio: "pipe", encoding: "utf-8", timeout: 120_000, env: claudePluginEnv() });
+        const install = pluginInstall(ref);
         if (install.status === 0) {
             logFile(`[plugin-install] ${ref.name}@${ref.marketplace} idempotent=false`);
         }
@@ -2014,30 +2044,51 @@ function registerLocalAndExternalPlugins() {
             logFile(`[plugin-install] ERROR ${ref.name}@${ref.marketplace} exit=${install.status} stderr=${JSON.stringify(stderrShort)}`);
         }
     }
-    // Configure-token pass — only the externals carry configureSecret. For
-    // each, pipe `/<name>:configure <secret>` into a one-shot `claude`
-    // invocation. Missing env vars log SKIP and continue — pairing is a
-    // manual per-operator step per the channels-reference docs.
-    const configureActions = computeConfigureActions(externals, process.env);
-    for (const action of configureActions) {
-        if (action.kind === "skip-no-secret-name") {
-            // Local plugins and externals without configureSecret — nothing to do.
-            continue;
-        }
-        if (action.kind === "skip-no-secret-value") {
-            logFile(`[plugin-configure] SKIP ${action.plugin.name} reason=no-secret-in-env env-var=${action.plugin.configureSecret}`);
+    // Cache-vs-live audit (Task 643). Prove the per-plugin cache snapshot the
+    // runtime loads from now matches the live tree, so drift is a logged
+    // post-condition rather than a "no such skill" surprise in a later session.
+    // Read the authoritative load path from installed_plugins.json
+    // (`installPath`) rather than reconstructing the cache path from a pinned
+    // version string. Warn-only: a count mismatch is surfaced, not fatal — a
+    // benign skill directory without a SKILL.md must not abort the install.
+    const countSkills = (skillsDir) => {
+        if (!existsSync(skillsDir))
+            return 0;
+        let n = 0;
+        for (const entry of readdirSync(skillsDir)) {
+            if (existsSync(join(skillsDir, entry, "SKILL.md")))
+                n++;
+        }
+        return n;
+    };
+    let installedPluginsMap = {};
+    try {
+        const ipPath = join(CLAUDE_CONFIG_DIR, "plugins", "installed_plugins.json");
+        const parsed = JSON.parse(readFileSync(ipPath, "utf-8"));
+        installedPluginsMap = parsed.plugins ?? {};
+    }
+    catch {
+        // No readable installed_plugins.json — audit reports cache-skills=0; any
+        // failed install above already logged a recache/install ERROR line.
+    }
+    // `treeDirByMarketplace` is keyed on the directory-source marketplace names
+    // (= `directorySourceMarketplaces`), so a present tree dir is itself the
+    // directory-source test — no separate Set lookup needed.
+    const treeDirByMarketplace = new Map(localTrees.map(t => [t.name, t.dir]));
+    for (const ref of desired) {
+        const treeDir = treeDirByMarketplace.get(ref.marketplace);
+        if (!treeDir)
             continue;
-        }
-        // The piped-stdin form: `echo '/<name>:configure <secret>' | claude --print`
-        // is the documented one-shot configure path. We do not log the secret value.
-        const cmd = `/${action.plugin.name}:configure ${action.secretValue}`;
-        const configure = spawnSync("claude", ["--print", "--input-format", "text"], { input: cmd, stdio: ["pipe", "pipe", "pipe"], encoding: "utf-8", timeout: 60_000, env: claudePluginEnv() });
-        if (configure.status === 0) {
-            logFile(`[plugin-configure] ${action.plugin.name} ok env-var=${action.plugin.configureSecret}`);
-        }
-        else {
-            const stderrShort = (configure.stderr ?? "").split("\n")[0]?.slice(0, 200) ?? "";
-            logFile(`[plugin-configure] ERROR ${action.plugin.name} exit=${configure.status} stderr=${JSON.stringify(stderrShort)}`);
+        const liveSkills = countSkills(join(treeDir, ref.name, "skills"));
+        // The resync installs at `--scope user`, so audit that scope's snapshot —
+        // not whichever entry happens to be first, since a host may also carry a
+        // stale project-scope entry for the same plugin.
+        const entries = installedPluginsMap[`${ref.name}@${ref.marketplace}`] ?? [];
+        const installPath = (entries.find(e => e.scope === "user") ?? entries[0])?.installPath;
+        const cacheSkills = installPath ? countSkills(join(installPath, "skills")) : 0;
+        logFile(`[plugin-install] audit ${ref.name}@${ref.marketplace} live-skills=${liveSkills} cache-skills=${cacheSkills}`);
+        if (liveSkills !== cacheSkills) {
+            logFile(`[plugin-install] WARN cache-drift ${ref.name}@${ref.marketplace} live-skills=${liveSkills} cache-skills=${cacheSkills}`);
         }
     }
     // post-install assertion. The per-brand CLAUDE_CONFIG_DIR is the

package/dist/lib/plugin-install.js

@@ -28,15 +28,30 @@ export function parsePluginList(stdout) {
     return out;
 }
 /**
- * Given the desired plugins and what's already installed, return the
- * subset that still needs `claude plugin install <name>@<marketplace>`.
- * Idempotence rule: a plugin is "already installed" if either its
- * exact `<name>@<marketplace>` is in the installed set, OR a row exists
- * with the same name and any marketplace (the spawn would re-attach in
- * the operator's chosen scope). This mirrors the marketplace-add
- * idempotence used in src/index.ts:1012.
+ * Given the desired plugins, what's already installed, and which marketplaces
+ * are directory sources, classify each desired plugin into one of three
+ * buckets:
+ *
+ *   - `toResync`         — already installed AND from a directory-source
+ *                          marketplace. Directory marketplaces change content
+ *                          in place with no version bump, so `claude plugin
+ *                          install`/`update` short-circuit on the pinned
+ *                          version and never refresh the runtime cache snapshot
+ *                          (Task 643). These must be uninstalled then installed
+ *                          to rebuild the snapshot from the live tree.
+ *   - `alreadyInstalled` — already installed AND from a remote (version-pinned)
+ *                          marketplace. Keeps the original idempotent skip.
+ *   - `toInstall`        — not installed yet. A fresh install builds a correct
+ *                          cache snapshot, so directory-source and remote
+ *                          plugins are handled identically here.
+ *
+ * "Already installed" matches either the exact `<name>@<marketplace>` tuple OR
+ * a row with the same name and any marketplace (legacy install state). The
+ * directory-source decision is keyed on the marketplace name regardless of
+ * which form matched, so a legacy name-only row for a directory plugin still
+ * resyncs.
  */
-export function computeInstallActions(desired, installed) {
+export function computeInstallActions(desired, installed, directorySourceMarketplaces) {
     const byName = new Map();
     for (const i of installed) {
         if (!byName.has(i.name))
@@ -44,33 +59,23 @@ export function computeInstallActions(desired, installed) {
         byName.get(i.name).add(i.marketplace);
     }
     const toInstall = [];
+    const toResync = [];
     const alreadyInstalled = [];
     for (const d of desired) {
         const marketplaces = byName.get(d.name);
-        if (marketplaces && (marketplaces.has(d.marketplace) || marketplaces.has(""))) {
+        const isInstalled = !!marketplaces && (marketplaces.has(d.marketplace) || marketplaces.has(""));
+        const isDirectorySource = directorySourceMarketplaces.has(d.marketplace);
+        if (isInstalled && isDirectorySource) {
+            toResync.push(d);
+        }
+        else if (isInstalled) {
             alreadyInstalled.push(d);
         }
         else {
             toInstall.push(d);
         }
     }
-    return { toInstall, alreadyInstalled };
-}
-export function computeConfigureActions(installed, env) {
-    const out = [];
-    for (const p of installed) {
-        if (!p.configureSecret) {
-            out.push({ kind: "skip-no-secret-name", plugin: p });
-            continue;
-        }
-        const value = env[p.configureSecret];
-        if (typeof value !== "string" || value.length === 0) {
-            out.push({ kind: "skip-no-secret-value", plugin: p });
-            continue;
-        }
-        out.push({ kind: "configure", plugin: p, secretValue: value });
-    }
-    return out;
+    return { toInstall, toResync, alreadyInstalled };
 }
 /** Brand-config validator. brand.json#externalPlugins is optional; when
  *  present, each entry must declare name + marketplace as non-empty
@@ -96,9 +101,6 @@ export function parseExternalPlugins(raw) {
             throw new Error(`brand.json#externalPlugins[${e.name}] missing 'marketplace'`);
         }
         const ref = { name: e.name, marketplace: e.marketplace };
-        if (typeof e.configureSecret === "string" && e.configureSecret.length > 0) {
-            ref.configureSecret = e.configureSecret;
-        }
         if (e.channelPlugin === true) {
             ref.channelPlugin = true;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-realagent-code",
-  "version": "0.1.254",
+  "version": "0.1.256",
   "description": "Install Real Agent — Built for agents. By agents.",
   "bin": {
     "create-realagent-code": "./dist/index.js"

package/payload/platform/.docs/search-surface-contract.md

@@ -0,0 +1,58 @@
+# Search-surface parity contract
+
+Three operator/agent surfaces run the same `hybrid()` search engine
+(`platform/lib/graph-search`). The contract: **the same query yields the same
+node set on every surface** unless a surface declares an explicit, documented
+divergence.
+
+| Surface | Entry point | Labels default | Vector floor |
+|---|---|---|---|
+| Chat (agent recall) | `memory-search` MCP tool → `memorySearch()` | none set ⇒ all labels | `DEFAULT_VECTOR_THRESHOLD` (0.82) |
+| `/graph` admin page | `GET /api/admin/graph-search` | no chips ⇒ all labels; chips narrow | `DEFAULT_VECTOR_THRESHOLD` (0.82), `?threshold` overrides |
+| `/data` admin page | `GET /api/admin/graph-search?labels=FileArtifact` | `FileArtifact` only (files) | `DEFAULT_VECTOR_THRESHOLD` (0.82), `?threshold` overrides; show-all sends `?threshold=0` |
+
+## The two parity rules (Task 635)
+
+1. **All labels by default.** A caller that passes no labels (chat) or an empty
+   chip set (`/graph`) searches every label — the route forwards `undefined` to
+   `hybrid()`, the lib's no-label gate, which queries every vector index. The
+   `*` wildcard is a separate explicit opt-in to the same all-labels path (no
+   current caller sends it; `/data` sends a real `FileArtifact` label instead).
+   `/graph` no longer rejects an empty chip set with a 400; chips, when present,
+   narrow post-filter.
+
+2. **One vector floor, defined once.** `DEFAULT_VECTOR_THRESHOLD = 0.82` lives
+   in `platform/lib/graph-search/src/index.ts` and is the single source of
+   truth. Each *surface* opts into it as its default; `hybrid()` itself keeps
+   the `vectorThreshold === undefined ⇒ no floor` contract. Two literals of
+   0.82 in two files would be a drift vector — there is one constant, imported
+   by both the route (`src`) and `memory-search` (`dist`, so the lib must be
+   rebuilt for the memory plugin to see a change).
+
+## Declared divergences (allowed, by explicit caller or post-filter)
+
+- **`/data` is files-only.** It sends `labels=FileArtifact` — a deliberate
+  server-side caller filter to file nodes, not a parity break. (It also
+  triggers the route's `FileArtifact` index-reconcile branch before searching.)
+- **`graph-subgraph` pivot mask.** `GET /api/admin/graph-subgraph?q=…` runs
+  `hybrid()` with `expandHops: 0` and **no** vector floor. Its output is not a
+  result list — it is intersected with a clicked node's neighbourhood to
+  narrow a pivot. "Same query, same results" does not apply to an intersection
+  mask, so it intentionally stays unthresholded.
+- **Post-search projections** — the chat public-twin property rewrite and the
+  `/graph` Message→Conversation parent merge run after the engine returns and
+  do not change which nodes the engine selected.
+
+## Diagnostics
+
+```
+logs-read.sh --tail server 100 | grep -E '\[graph-search\]'
+```
+
+- `op=labels-default applied=all` — a no-chip `/graph` request took the
+  all-labels path. Its absence on a no-labels request is the regression signal.
+- `labels=all` (query line) — no chips (all labels); `labels=*` — explicit
+  wildcard opt-in; `labels=FileArtifact` — `/data` files search;
+  `labels=Person,…` — narrowed chip search.
+- `threshold=0.82` on a default request; `threshold=off` only when an explicit
+  `?threshold=0` was passed.

package/payload/platform/config/brand-registry.json

@@ -15,6 +15,14 @@
       "rfbPort": 5901,
       "websockifyPort": 6081,
       "cdpPort": 9223
+    },
+    {
+      "hostname": "siteoffice-code",
+      "configDir": ".siteoffice-code",
+      "vncDisplay": 101,
+      "rfbPort": 5902,
+      "websockifyPort": 6082,
+      "cdpPort": 9224
     }
   ]
 }

package/payload/platform/config/brand.json

@@ -68,12 +68,12 @@
   "plugins": {
     "core": ["admin", "memory", "docs", "cloudflare", "anthropic", "workflows", "work", "business-assistant", "contacts", "scheduling", "email", "prompt-optimiser", "browser"],
     "defaultEnabled": ["sales"],
-    "available": ["deep-research", "projects", "whatsapp", "replicate", "linkedin-import", "notion-import", "obsidian-import", "x-import"],
+    "available": ["deep-research", "projects", "whatsapp", "replicate", "linkedin-import", "notion-import", "obsidian-import", "x-import", "slides"],
     "excluded": ["telegram"]
   },
 
   "externalPlugins": [
-    { "name": "discord",  "marketplace": "claude-plugins-official", "configureSecret": "DISCORD_BOT_TOKEN", "channelPlugin": true },
+    { "name": "discord",  "marketplace": "claude-plugins-official", "channelPlugin": true },
     { "name": "imessage", "marketplace": "claude-plugins-official", "channelPlugin": true },
     { "name": "superpowers", "marketplace": "claude-plugins-official" },
     { "name": "code-review", "marketplace": "claude-plugins-official" }

package/payload/platform/lib/embed-client/dist/index.d.ts

@@ -0,0 +1,4 @@
+export declare const EMBED_INPUT_MAX_CHARS = 8000;
+export declare function embed(text: string): Promise<number[]>;
+export declare function embedBatch(texts: string[]): Promise<number[][]>;
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/embed-client/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAU1C,wBAAsB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAa3D;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAarE"}

package/payload/platform/lib/embed-client/dist/index.js

@@ -0,0 +1,53 @@
+"use strict";
+// Shared Ollama embed client. Single capped implementation used by every
+// process that writes a vector-indexed node outside the memory plugin (admin
+// MCP PIN setup, scheduling ICS ingest, UI lazy Person create). The memory
+// plugin's `lib/embeddings.ts` re-exports these so there is one cap constant
+// and one POST shape across the platform (Task 636). fetch-only — no node:fs —
+// so it is safe to bundle into the ESM payload.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMBED_INPUT_MAX_CHARS = void 0;
+exports.embed = embed;
+exports.embedBatch = embedBatch;
+const OLLAMA_URL = process.env.OLLAMA_URL ?? "http://localhost:11434";
+const EMBED_MODEL = process.env.EMBED_MODEL ?? "nomic-embed-text";
+// nomic-embed-text has a 2048-token context (~8k chars at ~4 chars/token).
+// An over-limit input makes the Ollama embed endpoint error; cap defensively so
+// an oversized body embeds (truncated) instead of throwing and aborting the
+// caller.
+exports.EMBED_INPUT_MAX_CHARS = 8000;
+function capInput(text) {
+    if (text.length <= exports.EMBED_INPUT_MAX_CHARS)
+        return text;
+    process.stderr.write(`[embed] op=truncate origBytes=${text.length} cappedBytes=${exports.EMBED_INPUT_MAX_CHARS}\n`);
+    return text.slice(0, exports.EMBED_INPUT_MAX_CHARS);
+}
+async function embed(text) {
+    const input = capInput(text);
+    const res = await fetch(`${OLLAMA_URL}/api/embed`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ model: EMBED_MODEL, input }),
+    });
+    if (!res.ok) {
+        const body = await res.text();
+        throw new Error(`Ollama embedding failed (${res.status}): ${body}`);
+    }
+    const data = (await res.json());
+    return data.embeddings[0];
+}
+async function embedBatch(texts) {
+    const input = texts.map(capInput);
+    const res = await fetch(`${OLLAMA_URL}/api/embed`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ model: EMBED_MODEL, input }),
+    });
+    if (!res.ok) {
+        const body = await res.text();
+        throw new Error(`Ollama batch embedding failed (${res.status}): ${body}`);
+    }
+    const data = (await res.json());
+    return data.embeddings;
+}
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/embed-client/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,gDAAgD;;;AAmBhD,sBAaC;AAED,gCAaC;AA7CD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,wBAAwB,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;AAElE,2EAA2E;AAC3E,gFAAgF;AAChF,4EAA4E;AAC5E,UAAU;AACG,QAAA,qBAAqB,GAAG,IAAI,CAAC;AAE1C,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAI,CAAC,MAAM,IAAI,6BAAqB;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,IAAI,CAAC,MAAM,gBAAgB,6BAAqB,IAAI,CACtF,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,6BAAqB,CAAC,CAAC;AAC9C,CAAC;AAEM,KAAK,UAAU,KAAK,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,YAAY,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;IAC9D,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,KAAe;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,YAAY,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;IAC9D,OAAO,IAAI,CAAC,UAAU,CAAC;AACzB,CAAC"}

package/payload/platform/lib/embed-client/src/index.ts

@@ -0,0 +1,53 @@
+// Shared Ollama embed client. Single capped implementation used by every
+// process that writes a vector-indexed node outside the memory plugin (admin
+// MCP PIN setup, scheduling ICS ingest, UI lazy Person create). The memory
+// plugin's `lib/embeddings.ts` re-exports these so there is one cap constant
+// and one POST shape across the platform (Task 636). fetch-only — no node:fs —
+// so it is safe to bundle into the ESM payload.
+
+const OLLAMA_URL = process.env.OLLAMA_URL ?? "http://localhost:11434";
+const EMBED_MODEL = process.env.EMBED_MODEL ?? "nomic-embed-text";
+
+// nomic-embed-text has a 2048-token context (~8k chars at ~4 chars/token).
+// An over-limit input makes the Ollama embed endpoint error; cap defensively so
+// an oversized body embeds (truncated) instead of throwing and aborting the
+// caller.
+export const EMBED_INPUT_MAX_CHARS = 8000;
+
+function capInput(text: string): string {
+  if (text.length <= EMBED_INPUT_MAX_CHARS) return text;
+  process.stderr.write(
+    `[embed] op=truncate origBytes=${text.length} cappedBytes=${EMBED_INPUT_MAX_CHARS}\n`,
+  );
+  return text.slice(0, EMBED_INPUT_MAX_CHARS);
+}
+
+export async function embed(text: string): Promise<number[]> {
+  const input = capInput(text);
+  const res = await fetch(`${OLLAMA_URL}/api/embed`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ model: EMBED_MODEL, input }),
+  });
+  if (!res.ok) {
+    const body = await res.text();
+    throw new Error(`Ollama embedding failed (${res.status}): ${body}`);
+  }
+  const data = (await res.json()) as { embeddings: number[][] };
+  return data.embeddings[0];
+}
+
+export async function embedBatch(texts: string[]): Promise<number[][]> {
+  const input = texts.map(capInput);
+  const res = await fetch(`${OLLAMA_URL}/api/embed`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ model: EMBED_MODEL, input }),
+  });
+  if (!res.ok) {
+    const body = await res.text();
+    throw new Error(`Ollama batch embedding failed (${res.status}): ${body}`);
+  }
+  const data = (await res.json()) as { embeddings: number[][] };
+  return data.embeddings;
+}

package/payload/platform/lib/embed-client/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}