@rubytech/create-realagent-code 0.1.593 → 0.1.595

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-realagent-code",
-  "version": "0.1.593",
+  "version": "0.1.595",
   "description": "Install Real Agent — Built for agents. By agents.",
   "bin": {
     "create-realagent-code": "./dist/index.js"
@@ -13,7 +13,7 @@
     "build": "tsc",
     "bundle": "node scripts/bundle.js",
     "test": "npm run build && node --test 'dist/__tests__/*.test.js'",
-    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-plugin-tools-mcp-consistency.mjs && node ../../platform/scripts/check-risk-class.mjs && node ../../platform/scripts/check-specialist-tool-surface.mjs && node ../../platform/scripts/check-agent-contract.mjs && node ../../platform/scripts/check-routing-prose-bash.mjs && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-no-esm-require.mjs && node ../../platform/scripts/check-no-raw-mcp-registrations.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/scripts/check-routine-roster-doc.mjs && node ../../platform/scripts/check-architecture-skill-no-drift.mjs && node ../../platform/ui/scripts/check-brand-fonts.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && bash ../../platform/scripts/smoke-boot-services.sh && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
+    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-plugin-tools-mcp-consistency.mjs && node ../../platform/scripts/check-risk-class.mjs && node ../../platform/scripts/check-specialist-tool-surface.mjs && node ../../platform/scripts/check-agent-contract.mjs && node ../../platform/scripts/check-routing-prose-bash.mjs && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-no-esm-require.mjs && node ../../platform/scripts/check-no-raw-mcp-registrations.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/scripts/check-routine-roster-doc.mjs && node ../../platform/scripts/check-architecture-skill-no-drift.mjs && node ../../platform/ui/scripts/check-brand-fonts.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && node ../../platform/scripts/check-orphan-dist.mjs && npm run bundle && bash ../../platform/scripts/smoke-boot-services.sh && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
   },
   "files": [
     "dist",

package/payload/platform/lib/telegram-button-labels/dist/index.d.ts

@@ -0,0 +1,19 @@
+/** Matches CARD_TTL_MS in the telegram MCP's card store. A label outlives its
+ *  card by no useful margin, and without a ceiling every callback data string
+ *  ever sent is kept for ever. */
+export declare const BUTTON_LABEL_TTL_MS: number;
+/** Scoped by bot AND chat, not by the data alone: two chats can use the same
+ *  callback data for different words. */
+export declare function buttonLabelKey(botId: string, chatId: string | number, data: string): string;
+/** Record every button on one keyboard, and drop every entry gone
+ *  BUTTON_LABEL_TTL_MS untouched. Compaction rides the write because the write
+ *  already rewrites the whole file. An empty list writes nothing: a card with no
+ *  buttons must not create the file. */
+export declare function writeButtonLabels(storeDir: string, entries: Array<{
+    key: string;
+    label: string;
+}>, now?: number): void;
+/** The stored wording for this key, or null. Null past the TTL, so a caller
+ *  falls back to the raw data rather than showing a label for a card long gone. */
+export declare function readButtonLabel(storeDir: string, key: string, now?: number): string | null;
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/telegram-button-labels/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkBA;;kCAEkC;AAClC,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAa3D;yCACyC;AACzC,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3F;AAoBD;;;wCAGwC;AACxC,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9C,GAAG,GAAE,MAAmB,GACvB,IAAI,CASN;AAED;mFACmF;AACnF,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAmB,GACvB,MAAM,GAAG,IAAI,CAIf"}

package/payload/platform/lib/telegram-button-labels/dist/index.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUTTON_LABEL_TTL_MS = void 0;
+exports.buttonLabelKey = buttonLabelKey;
+exports.writeButtonLabels = writeButtonLabels;
+exports.readButtonLabel = readButtonLabel;
+// Task 2673 — what a button SAID, keyed by what a press CARRIES.
+//
+// A press delivers only its callback data, so an operator reading the
+// conversation sees `[button: pax_1]` and not "1 passenger". The wording exists
+// once, in the keyboard the card tool sent, and was never persisted.
+//
+// This is a shared platform library rather than a key inside the telegram MCP's
+// own card store because the two sides live in different processes: the plugin
+// writes it and the webhook route reads it, and the route imports from
+// platform/lib and never from platform/plugins.
+//
+// Keyed on the callback data rather than the card key: the route holds botId,
+// chatId and data, and never the caller's key.
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const FILE = "telegram-button-labels.json";
+/** Matches CARD_TTL_MS in the telegram MCP's card store. A label outlives its
+ *  card by no useful margin, and without a ceiling every callback data string
+ *  ever sent is kept for ever. */
+exports.BUTTON_LABEL_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+function isEntry(v) {
+    if (!v || typeof v !== "object" || Array.isArray(v))
+        return false;
+    const e = v;
+    return typeof e.label === "string" && typeof e.at === "number" && Number.isFinite(e.at);
+}
+/** Scoped by bot AND chat, not by the data alone: two chats can use the same
+ *  callback data for different words. */
+function buttonLabelKey(botId, chatId, data) {
+    return `${botId}:${chatId}:${data}`;
+}
+function readAll(path) {
+    if (!(0, node_fs_1.existsSync)(path))
+        return {};
+    try {
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(path, "utf-8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return {};
+        const out = {};
+        for (const [k, v] of Object.entries(parsed)) {
+            if (isEntry(v))
+                out[k] = v;
+        }
+        return out;
+    }
+    catch {
+        // Unparseable state reads as "no label", which renders the raw data exactly
+        // as it did before this library existed. Throwing here would take a webhook
+        // down over a file no caller sees.
+        return {};
+    }
+}
+/** Record every button on one keyboard, and drop every entry gone
+ *  BUTTON_LABEL_TTL_MS untouched. Compaction rides the write because the write
+ *  already rewrites the whole file. An empty list writes nothing: a card with no
+ *  buttons must not create the file. */
+function writeButtonLabels(storeDir, entries, now = Date.now()) {
+    if (entries.length === 0)
+        return;
+    const path = (0, node_path_1.join)(storeDir, FILE);
+    const kept = {};
+    for (const [key, entry] of Object.entries(readAll(path))) {
+        if (now - entry.at < exports.BUTTON_LABEL_TTL_MS)
+            kept[key] = entry;
+    }
+    for (const e of entries)
+        kept[e.key] = { label: e.label, at: now };
+    (0, node_fs_1.writeFileSync)(path, JSON.stringify(kept, null, 2) + "\n", "utf-8");
+}
+/** The stored wording for this key, or null. Null past the TTL, so a caller
+ *  falls back to the raw data rather than showing a label for a card long gone. */
+function readButtonLabel(storeDir, key, now = Date.now()) {
+    const entry = readAll((0, node_path_1.join)(storeDir, FILE))[key];
+    if (!entry)
+        return null;
+    return now - entry.at >= exports.BUTTON_LABEL_TTL_MS ? null : entry.label;
+}
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/telegram-button-labels/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAoCA,wCAEC;AAwBD,8CAaC;AAID,0CAQC;AAvFD,iEAAiE;AACjE,EAAE;AACF,sEAAsE;AACtE,gFAAgF;AAChF,qEAAqE;AACrE,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,uEAAuE;AACvE,gDAAgD;AAChD,EAAE;AACF,8EAA8E;AAC9E,+CAA+C;AAC/C,qCAAkE;AAClE,yCAAiC;AAEjC,MAAM,IAAI,GAAG,6BAA6B,CAAC;AAE3C;;kCAEkC;AACrB,QAAA,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAO3D,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED;yCACyC;AACzC,SAAgB,cAAc,CAAC,KAAa,EAAE,MAAuB,EAAE,IAAY;IACjF,OAAO,GAAG,KAAK,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAC;QAClE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9E,MAAM,GAAG,GAA+B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YACvE,IAAI,OAAO,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,4EAA4E;QAC5E,mCAAmC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;wCAGwC;AACxC,SAAgB,iBAAiB,CAC/B,QAAgB,EAChB,OAA8C,EAC9C,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAA+B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,2BAAmB;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IACnE,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;mFACmF;AACnF,SAAgB,eAAe,CAC7B,QAAgB,EAChB,GAAW,EACX,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAA,gBAAI,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,2BAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;AACpE,CAAC"}

package/payload/platform/lib/telegram-button-labels/src/__tests__/store.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, it, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync, existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import {
+  BUTTON_LABEL_TTL_MS,
+  buttonLabelKey,
+  readButtonLabel,
+  writeButtonLabels,
+} from '../index.js'
+
+let dir: string
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'tg-labels-'))
+})
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true })
+})
+
+describe('button label store', () => {
+  it('keys on bot, chat and callback data, which is all a press carries', () => {
+    expect(buttonLabelKey('111', 999, 'pax_1')).toBe('111:999:pax_1')
+    expect(buttonLabelKey('111', '999', 'pax_1')).toBe('111:999:pax_1')
+  })
+
+  it('reads back a label written for that key', () => {
+    writeButtonLabels(dir, [{ key: buttonLabelKey('111', 999, 'pax_1'), label: '1 passenger' }])
+    expect(readButtonLabel(dir, buttonLabelKey('111', 999, 'pax_1'))).toBe('1 passenger')
+  })
+
+  it('returns null for a key never written', () => {
+    expect(readButtonLabel(dir, buttonLabelKey('111', 999, 'nope'))).toBeNull()
+  })
+
+  it('returns null past the ttl, and prunes it on the next write', () => {
+    const t0 = 1_000_000
+    const k = buttonLabelKey('111', 999, 'pax_1')
+    writeButtonLabels(dir, [{ key: k, label: '1 passenger' }], t0)
+    expect(readButtonLabel(dir, k, t0 + BUTTON_LABEL_TTL_MS)).toBeNull()
+    writeButtonLabels(dir, [{ key: buttonLabelKey('111', 999, 'pax_2'), label: '2 passengers' }], t0 + BUTTON_LABEL_TTL_MS)
+    const onDisk = JSON.parse(readFileSync(join(dir, 'telegram-button-labels.json'), 'utf-8')) as Record<string, unknown>
+    expect(Object.keys(onDisk)).toEqual(['111:999:pax_2'])
+  })
+
+  it('a later write for the same key replaces the label and refreshes its age', () => {
+    const t0 = 1_000_000
+    const k = buttonLabelKey('111', 999, 'pax_1')
+    writeButtonLabels(dir, [{ key: k, label: 'one' }], t0)
+    writeButtonLabels(dir, [{ key: k, label: 'ONE' }], t0 + 1)
+    expect(readButtonLabel(dir, k, t0 + 2)).toBe('ONE')
+  })
+
+  it('an unparseable file reads as no label and never throws', () => {
+    const path = join(dir, 'telegram-button-labels.json')
+    writeButtonLabels(dir, [{ key: 'a', label: 'b' }])
+    rmSync(path)
+    expect(readButtonLabel(dir, 'a')).toBeNull()
+    expect(existsSync(path)).toBe(false)
+  })
+
+  it('an empty entry list writes nothing, so a card with no buttons touches no file', () => {
+    writeButtonLabels(dir, [])
+    expect(existsSync(join(dir, 'telegram-button-labels.json'))).toBe(false)
+  })
+})

package/payload/platform/lib/telegram-button-labels/src/index.ts

@@ -0,0 +1,88 @@
+// Task 2673 — what a button SAID, keyed by what a press CARRIES.
+//
+// A press delivers only its callback data, so an operator reading the
+// conversation sees `[button: pax_1]` and not "1 passenger". The wording exists
+// once, in the keyboard the card tool sent, and was never persisted.
+//
+// This is a shared platform library rather than a key inside the telegram MCP's
+// own card store because the two sides live in different processes: the plugin
+// writes it and the webhook route reads it, and the route imports from
+// platform/lib and never from platform/plugins.
+//
+// Keyed on the callback data rather than the card key: the route holds botId,
+// chatId and data, and never the caller's key.
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+const FILE = "telegram-button-labels.json";
+
+/** Matches CARD_TTL_MS in the telegram MCP's card store. A label outlives its
+ *  card by no useful margin, and without a ceiling every callback data string
+ *  ever sent is kept for ever. */
+export const BUTTON_LABEL_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+
+interface LabelEntry {
+  label: string;
+  at: number;
+}
+
+function isEntry(v: unknown): v is LabelEntry {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return false;
+  const e = v as Record<string, unknown>;
+  return typeof e.label === "string" && typeof e.at === "number" && Number.isFinite(e.at);
+}
+
+/** Scoped by bot AND chat, not by the data alone: two chats can use the same
+ *  callback data for different words. */
+export function buttonLabelKey(botId: string, chatId: string | number, data: string): string {
+  return `${botId}:${chatId}:${data}`;
+}
+
+function readAll(path: string): Record<string, LabelEntry> {
+  if (!existsSync(path)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8")) as unknown;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    const out: Record<string, LabelEntry> = {};
+    for (const [k, v] of Object.entries(parsed as Record<string, unknown>)) {
+      if (isEntry(v)) out[k] = v;
+    }
+    return out;
+  } catch {
+    // Unparseable state reads as "no label", which renders the raw data exactly
+    // as it did before this library existed. Throwing here would take a webhook
+    // down over a file no caller sees.
+    return {};
+  }
+}
+
+/** Record every button on one keyboard, and drop every entry gone
+ *  BUTTON_LABEL_TTL_MS untouched. Compaction rides the write because the write
+ *  already rewrites the whole file. An empty list writes nothing: a card with no
+ *  buttons must not create the file. */
+export function writeButtonLabels(
+  storeDir: string,
+  entries: Array<{ key: string; label: string }>,
+  now: number = Date.now(),
+): void {
+  if (entries.length === 0) return;
+  const path = join(storeDir, FILE);
+  const kept: Record<string, LabelEntry> = {};
+  for (const [key, entry] of Object.entries(readAll(path))) {
+    if (now - entry.at < BUTTON_LABEL_TTL_MS) kept[key] = entry;
+  }
+  for (const e of entries) kept[e.key] = { label: e.label, at: now };
+  writeFileSync(path, JSON.stringify(kept, null, 2) + "\n", "utf-8");
+}
+
+/** The stored wording for this key, or null. Null past the TTL, so a caller
+ *  falls back to the raw data rather than showing a label for a card long gone. */
+export function readButtonLabel(
+  storeDir: string,
+  key: string,
+  now: number = Date.now(),
+): string | null {
+  const entry = readAll(join(storeDir, FILE))[key];
+  if (!entry) return null;
+  return now - entry.at >= BUTTON_LABEL_TTL_MS ? null : entry.label;
+}

package/payload/platform/lib/telegram-button-labels/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"],
+  "exclude": ["src/__tests__"]
+}

package/payload/platform/lib/telegram-button-labels/vitest.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    environment: "node",
+    globals: false,
+    include: ["src/__tests__/**/*.test.ts"],
+  },
+});

package/payload/platform/package.json

@@ -10,8 +10,9 @@
     "pdf-lib": "^1.17.1"
   },
   "scripts": {
-    "build": "tsc -p lib/account-schema-regions/tsconfig.json && tsc -p lib/account-ingest-token/tsconfig.json && tsc -p lib/models/tsconfig.json && tsc -p lib/agent-slug/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/shared-folder/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p lib/routine-templates/tsconfig.json && tsc -p lib/agent-dispatch-rule/tsconfig.json && tsc -p lib/canonical-instant/tsconfig.json && tsc -p lib/dispatch-read/tsconfig.json && tsc -p lib/dispatch-write/tsconfig.json && tsc -p lib/learning-constants/tsconfig.json && tsc -p lib/telegram-media/tsconfig.json && tsc -p lib/telegram-managed-bot/tsconfig.json && tsc -p lib/telegram-reach/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
-    "build:lib": "tsc -p lib/account-schema-regions/tsconfig.json && tsc -p lib/account-ingest-token/tsconfig.json && tsc -p lib/models/tsconfig.json && tsc -p lib/agent-slug/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/shared-folder/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p lib/routine-templates/tsconfig.json && tsc -p lib/agent-dispatch-rule/tsconfig.json && tsc -p lib/shared-folder/tsconfig.json && tsc -p lib/canonical-instant/tsconfig.json && tsc -p lib/dispatch-read/tsconfig.json && tsc -p lib/dispatch-write/tsconfig.json && tsc -p lib/telegram-media/tsconfig.json && tsc -p lib/telegram-managed-bot/tsconfig.json && tsc -p lib/telegram-reach/tsconfig.json",
+    "build": "tsc -p lib/account-schema-regions/tsconfig.json && tsc -p lib/account-ingest-token/tsconfig.json && tsc -p lib/models/tsconfig.json && tsc -p lib/agent-slug/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/shared-folder/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p lib/routine-templates/tsconfig.json && tsc -p lib/agent-dispatch-rule/tsconfig.json && tsc -p lib/canonical-instant/tsconfig.json && tsc -p lib/dispatch-read/tsconfig.json && tsc -p lib/dispatch-write/tsconfig.json && tsc -p lib/learning-constants/tsconfig.json && tsc -p lib/telegram-button-labels/tsconfig.json && tsc -p lib/telegram-media/tsconfig.json && tsc -p lib/telegram-managed-bot/tsconfig.json && tsc -p lib/telegram-reach/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
+    "build:lib": "tsc -p lib/account-schema-regions/tsconfig.json && tsc -p lib/account-ingest-token/tsconfig.json && tsc -p lib/models/tsconfig.json && tsc -p lib/agent-slug/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/shared-folder/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p lib/routine-templates/tsconfig.json && tsc -p lib/agent-dispatch-rule/tsconfig.json && tsc -p lib/shared-folder/tsconfig.json && tsc -p lib/canonical-instant/tsconfig.json && tsc -p lib/dispatch-read/tsconfig.json && tsc -p lib/dispatch-write/tsconfig.json && tsc -p lib/telegram-button-labels/tsconfig.json && tsc -p lib/telegram-media/tsconfig.json && tsc -p lib/telegram-managed-bot/tsconfig.json && tsc -p lib/telegram-reach/tsconfig.json",
+    "clean:dist": "node scripts/check-orphan-dist.mjs --remove",
     "gen:canonical-tools": "node scripts/generate-canonical-tool-names.mjs",
     "build:memory": "tsc -p plugins/memory/mcp/tsconfig.json",
     "build:contacts": "tsc -p plugins/contacts/mcp/tsconfig.json",

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Real Agent ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:c66d6d534933072b64b3b80ac132135ee30f82b6eb50a4a7950a6500cf0ca678
+content-hash: sha256:4d7fafd7d648ca6953247a413d12dd0be25fd9e0c6876f1afb5ece48b1c0acdc
 brand: realagent-code
 product-name: Real Agent
 ---
@@ -2866,7 +2866,9 @@ Real Agent asks for your bot token, then asks what kind of bot this is:
 
 - an **admin bot** — only your numeric Telegram IDs may message it, and it answers as your admin agent;
 - a **public bot** — customer-facing, with a DM policy, answering as one of your account's agents;
-- a **specialist bot** — bound to one of your own specialists, so messaging it runs that specialist with its own instructions and its own tools rather than your admin agent. You name the specialist and the numeric IDs allowed to reach it. Both are required: there is no open setting for this kind, because the specialist has real tools rather than the reply-only surface a public bot gets.
+- a **specialist bot** — bound to one of your own specialists, so messaging it runs that specialist with its own instructions and its own tools rather than your admin agent. You name the specialist and the numeric IDs allowed to reach it. Both are required: there is no open setting for this kind, because a specialist carries whatever tools its card gives it, while a public bot is held to a fixed set nobody can widen.
+
+A public Telegram bot holds five things and nothing else: the reply that carries its answer, cards with tappable buttons, polls and quizzes and map pins, outgoing photos and documents and voice notes, and the ability to open a file a visitor sent it. That set is fixed by the platform for every public agent on every account, so there is no tools setting on an agent to turn any of it on or off. A public bot on webchat or WhatsApp still has the reply alone, because those channels ship no equivalent set.
 
 It verifies the token, registers the bot's webhook on your brand's edge, stores the token under your brand's config (never in a shared system directory), and sets whichever agent or specialist will answer. The bot is now connected.
 
@@ -3010,6 +3012,13 @@ nobody, and a vote was dropped without a trace. A press on a job-sheet card is t
 one exception: the dispatch plugin applies the change and tells the presser
 itself, so Real Agent does not answer a second time.
 
+A card carries its own words, so when Real Agent sends a card with buttons
+it puts the answer in the card itself and does not add a sentence beside it. On a
+public bot, that following sentence is held back on purpose, so the visitor sees
+the card once and not the same thing twice. And when someone presses a button,
+your conversation view shows the button's own wording — "1 passenger", "One way"
+— rather than the code behind it.
+
 The same is now true of most of what Telegram sends. Reply to one of
 Real Agent's messages and it sees the message you replied to, so "yes, do
 that one" means something. React to a message with an emoji and it hears the
@@ -6455,7 +6464,7 @@ For subagents, the same spawn pushes `--add-dir` for every bundled plugin agents
 
 A boot gate refuses to start the manager when any admin-allowlisted tool `mcp__<plugin>__*` lacks a registered server. The signal is `boot-failed reason=mcp-allowlist-without-server plugin=<p> tool=<t>` followed by `process.exit(1)`. The remediation is a one-line edit to the named `PLUGIN.md`: add the `mcp:` block. The complementary observability emit `mcp-config-allowlist-coverage admin-tools=A admin-registered=R` (where `A === R`) confirms the invariant per boot.
 
-**Whether a plugin's server mounts is decided by the generated manifest, not the `mcp:` block.** A plugin ships its MCP as `mcp/`; the manifest generator ([`scripts/generate-plugin-manifests.mjs`](../../../../scripts/generate-plugin-manifests.mjs), run at bundle time over the payload) reads the plugin's `mcp-manifest:` frontmatter. `auto` emits an `mcpServers` block into the generated `.claude-plugin/plugin.json` — routed through `lib/mcp-spawn-tee`, carrying no per-session env (`LOG_DIR`/`SESSION_ID`/`ACCOUNT_ID`/`NEO4J_*`/`PLATFORM_ROOT` ride the PTY env block described above) — and copies the tee into the plugin's `lib/`; `skip` emits nothing, so Claude Code never spawns the server. The generator recognises two server shapes. A plugin-local `mcp/` (its `hasMcp` check: `mcp/dist/index.js` or `mcp/package.json`) uses `auto` or `skip`. A tool-plugin whose `mcp:` server is a shared `platform/lib/<name>` binary rather than a plugin-local `mcp/` (e.g. `graph`, served by `platform/lib/graph-mcp`) is annotated `mcp-manifest: shared-lib`: the generator emits that plugin's `mcp:` block verbatim into `mcpServers` — command, args (anchored on `${PLATFORM_ROOT}`, routed through the shared `lib/mcp-spawn-tee`), and env — which Claude Code expands at spawn from the PTY env block. No tee copy is made into the plugin, because both the tee and the server resolve from `${PLATFORM_ROOT}` outside the per-plugin cache. `graph` is the one shared-lib tool-plugin; every other tool-plugin ships a plugin-local `mcp/` and uses `auto`. A plugin with an `mcp:` block, no plugin-local `mcp/`, and no `mcp-manifest: shared-lib` annotation is a FATAL at generation time. Premium plugins import platform libs (`mcp-lifeline`, etc.) via a source-tree relative path; the bundler's premium-lib shipper (`packages/create-maxy-code/scripts/bundle.js`) rewrites that path and vendors each referenced `platform/lib/<name>` into `premium-plugins/<bundle>/lib/<name>/`, so the auto-mounted dist resolves its imports. The `mcp-allowlist-without-server` gate above proves only that a plugin's PLUGIN.md `mcp:` block matches its allowlist — it reads source, not the generated manifest — so a plugin left on `skip` passes that gate while its server silently never mounts (its tools are listed but not live). The `tool-registration` gate below closes that blind spot.
+**Whether a plugin's server mounts is decided by the generated manifest, not the `mcp:` block.** A plugin ships its MCP as `mcp/`; the manifest generator ([`scripts/generate-plugin-manifests.mjs`](../../../../scripts/generate-plugin-manifests.mjs), run at bundle time over the payload) reads the plugin's `mcp-manifest:` frontmatter. `auto` emits an `mcpServers` block into the generated `.claude-plugin/plugin.json` — routed through `lib/mcp-spawn-tee`, carrying no per-session env (`LOG_DIR`/`SESSION_ID`/`ACCOUNT_ID`/`NEO4J_*`/`PLATFORM_ROOT` ride the PTY env block described above) — and copies the tee into the plugin's `lib/`; `skip` emits nothing, so Claude Code never spawns the server. `skip` covers two shapes: a plugin whose canonical surface is a user-scoped MCP, and a plugin that registers zero tools and keeps `mcp/` only as a test host — `cloudflare` is the latter, so its `skip` is not a pointer to a server elsewhere. The generator recognises two server shapes. A plugin-local `mcp/` (its `hasMcp` check: `mcp/dist/index.js` or `mcp/package.json`) uses `auto` or `skip`. A tool-plugin whose `mcp:` server is a shared `platform/lib/<name>` binary rather than a plugin-local `mcp/` (e.g. `graph`, served by `platform/lib/graph-mcp`) is annotated `mcp-manifest: shared-lib`: the generator emits that plugin's `mcp:` block verbatim into `mcpServers` — command, args (anchored on `${PLATFORM_ROOT}`, routed through the shared `lib/mcp-spawn-tee`), and env — which Claude Code expands at spawn from the PTY env block. No tee copy is made into the plugin, because both the tee and the server resolve from `${PLATFORM_ROOT}` outside the per-plugin cache. `graph` is the one shared-lib tool-plugin; every other tool-plugin ships a plugin-local `mcp/` and uses `auto`. A plugin with an `mcp:` block, no plugin-local `mcp/`, and no `mcp-manifest: shared-lib` annotation is a FATAL at generation time. Premium plugins import platform libs (`mcp-lifeline`, etc.) via a source-tree relative path; the bundler's premium-lib shipper (`packages/create-maxy-code/scripts/bundle.js`) rewrites that path and vendors each referenced `platform/lib/<name>` into `premium-plugins/<bundle>/lib/<name>/`, so the auto-mounted dist resolves its imports. The `mcp-allowlist-without-server` gate above proves only that a plugin's PLUGIN.md `mcp:` block matches its allowlist — it reads source, not the generated manifest — so a plugin left on `skip` passes that gate while its server silently never mounts (its tools are listed but not live). The `tool-registration` gate below closes that blind spot.
 
 A second boot gate walks every specialist `.md` under `platform/templates/specialists/agents/`, every bundled `<plugin>/agents/` directory, and the per-account `<accountDir>/specialists/agents/` directory, parses each file's `tools:` frontmatter line (canonical long-prefix names), and classifies every tool name as one of: CC-native (Read, Bash, …), a tool the loaded `PLUGIN.md` set actually serves (matched as the long canonical name in `toolSurface.all`), a third-party MCP bridge (a `mcp__plugin_*` name whose plugin segment is NOT a maxy platform plugin — Playwright etc., upstream-owned, passes unconditionally), `unknown-tool-in-plugin` (maxy plugin namespace served but tool name absent), `unknown-plugin-namespace` (namespace served by nothing), `brand-excluded-plugin` (namespace served by nothing on this brand, **but** the brand's `brand.json#plugins.excluded` list names it), or `malformed-name` (not CC-native and not `mcp__`-shaped). The first three pass. The next two refuse boot with one `boot-failed reason=specialist-tool-drift specialist=<name> tool=<t> drift=<class> path=<…>` line per defect, then `process.exit(1)`. A maxy-plugin `mcp__plugin_*` name is validated against `toolSurface.all`, so a typo or stale long-prefix tool name still refuses boot rather than passing as a bridge; the build-time `check-canonical-tool-names.mjs` gate catches the same drift in instruction files before publish. `brand-excluded-plugin` is a structural pass: it lands in a per-specialist strip-list, the manager continues to boot, and at spawn time `pty-spawner` removes those tool names from the `--agent <name>` spawn's `--allowed-tools` argv. The complementary observability emit `specialist-tool-strip specialist=<name> plugin=<p> tools=<csv> reason=brand-excluded` fires one line per stripped (specialist, plugin) pair so an operator who reads `server.log` sees the brand filter doing work without cross-referencing `brand.json` against the template. The startup-self-test line `startup-self-test specialist-tool-drift=ok inspected=<N> stripped-specialists=<M>` confirms the gate ran and how many specialists carry strip-lists.
 

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,16 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-08-11 (0.1.595)
+
+- A Telegram bot no longer describes the card it just sent you. The card arrived and the bot then narrated it in a second message, because the rule that withholds that text never took effect.
+- Pressing a button now reads as the button's own label rather than the code behind it. A standing check reports if card text stops being withheld again.
+
+## 2026-08-11 (0.1.594)
+
+- A public Telegram bot no longer tells people it cannot do things it can. Its own description denied the tools it had actually been given, so it refused work it was equipped for.
+- Code deleted from the platform no longer ships anyway. Removing a source file left its compiled output behind, so retired code was still being packaged and installed.
+
 ## 2026-08-11 (0.1.593)
 
 - A public Telegram bot can now use buttons, media and the rest of the channel. It held no tool at all, so every answer it gave was plain text.

package/payload/platform/plugins/cloudflare/PLUGIN.md

@@ -28,6 +28,8 @@ Each installation has its own Cloudflare account. Two auth paths serve two opera
 
 The plugin registers no agent-facing MCP tools. Every Cloudflare operation is the agent invoking `cloudflared` or `wrangler` directly via Bash, or calling the Cloudflare API with a reused per-scope narrow token, with stdout/stderr streamed verbatim into the PTY chat (secrets redacted). The OAuth URL printed by `cloudflared tunnel login` is linkified by the native PTY; the operator clicks it in their own browser. The one shell helper is [bin/cf-token.sh](bin/cf-token.sh), a deterministic per-scope token resolver that faithfully relays the Cloudflare token API (it invents no flags and drives no dashboard); there is no wrapper around `cloudflared` or `wrangler`, no orchestrator state machine, no MCP-tool surface.
 
+The frontmatter carries `mcp-manifest: skip` because the manifest generator requires an annotation from any plugin with an `mcp/` directory, and `skip` is the value that emits no `mcpServers` block. It does not mean the tools live in a user-scoped server somewhere else: there are none. `mcp/` survives only as the test host for `bin/` and for the skill templates' Pages Functions; its entry point registers nothing.
+
 ### Skills
 
 | Skill | Purpose |

package/payload/platform/plugins/docs/references/internals.md

@@ -501,7 +501,7 @@ For subagents, the same spawn pushes `--add-dir` for every bundled plugin agents
 
 A boot gate refuses to start the manager when any admin-allowlisted tool `mcp__<plugin>__*` lacks a registered server. The signal is `boot-failed reason=mcp-allowlist-without-server plugin=<p> tool=<t>` followed by `process.exit(1)`. The remediation is a one-line edit to the named `PLUGIN.md`: add the `mcp:` block. The complementary observability emit `mcp-config-allowlist-coverage admin-tools=A admin-registered=R` (where `A === R`) confirms the invariant per boot.
 
-**Whether a plugin's server mounts is decided by the generated manifest, not the `mcp:` block.** A plugin ships its MCP as `mcp/`; the manifest generator ([`scripts/generate-plugin-manifests.mjs`](../../../../scripts/generate-plugin-manifests.mjs), run at bundle time over the payload) reads the plugin's `mcp-manifest:` frontmatter. `auto` emits an `mcpServers` block into the generated `.claude-plugin/plugin.json` — routed through `lib/mcp-spawn-tee`, carrying no per-session env (`LOG_DIR`/`SESSION_ID`/`ACCOUNT_ID`/`NEO4J_*`/`PLATFORM_ROOT` ride the PTY env block described above) — and copies the tee into the plugin's `lib/`; `skip` emits nothing, so Claude Code never spawns the server. The generator recognises two server shapes. A plugin-local `mcp/` (its `hasMcp` check: `mcp/dist/index.js` or `mcp/package.json`) uses `auto` or `skip`. A tool-plugin whose `mcp:` server is a shared `platform/lib/<name>` binary rather than a plugin-local `mcp/` (e.g. `graph`, served by `platform/lib/graph-mcp`) is annotated `mcp-manifest: shared-lib`: the generator emits that plugin's `mcp:` block verbatim into `mcpServers` — command, args (anchored on `${PLATFORM_ROOT}`, routed through the shared `lib/mcp-spawn-tee`), and env — which Claude Code expands at spawn from the PTY env block. No tee copy is made into the plugin, because both the tee and the server resolve from `${PLATFORM_ROOT}` outside the per-plugin cache. `graph` is the one shared-lib tool-plugin; every other tool-plugin ships a plugin-local `mcp/` and uses `auto`. A plugin with an `mcp:` block, no plugin-local `mcp/`, and no `mcp-manifest: shared-lib` annotation is a FATAL at generation time. Premium plugins import platform libs (`mcp-lifeline`, etc.) via a source-tree relative path; the bundler's premium-lib shipper (`packages/create-maxy-code/scripts/bundle.js`) rewrites that path and vendors each referenced `platform/lib/<name>` into `premium-plugins/<bundle>/lib/<name>/`, so the auto-mounted dist resolves its imports. The `mcp-allowlist-without-server` gate above proves only that a plugin's PLUGIN.md `mcp:` block matches its allowlist — it reads source, not the generated manifest — so a plugin left on `skip` passes that gate while its server silently never mounts (its tools are listed but not live). The `tool-registration` gate below closes that blind spot.
+**Whether a plugin's server mounts is decided by the generated manifest, not the `mcp:` block.** A plugin ships its MCP as `mcp/`; the manifest generator ([`scripts/generate-plugin-manifests.mjs`](../../../../scripts/generate-plugin-manifests.mjs), run at bundle time over the payload) reads the plugin's `mcp-manifest:` frontmatter. `auto` emits an `mcpServers` block into the generated `.claude-plugin/plugin.json` — routed through `lib/mcp-spawn-tee`, carrying no per-session env (`LOG_DIR`/`SESSION_ID`/`ACCOUNT_ID`/`NEO4J_*`/`PLATFORM_ROOT` ride the PTY env block described above) — and copies the tee into the plugin's `lib/`; `skip` emits nothing, so Claude Code never spawns the server. `skip` covers two shapes: a plugin whose canonical surface is a user-scoped MCP, and a plugin that registers zero tools and keeps `mcp/` only as a test host — `cloudflare` is the latter, so its `skip` is not a pointer to a server elsewhere. The generator recognises two server shapes. A plugin-local `mcp/` (its `hasMcp` check: `mcp/dist/index.js` or `mcp/package.json`) uses `auto` or `skip`. A tool-plugin whose `mcp:` server is a shared `platform/lib/<name>` binary rather than a plugin-local `mcp/` (e.g. `graph`, served by `platform/lib/graph-mcp`) is annotated `mcp-manifest: shared-lib`: the generator emits that plugin's `mcp:` block verbatim into `mcpServers` — command, args (anchored on `${PLATFORM_ROOT}`, routed through the shared `lib/mcp-spawn-tee`), and env — which Claude Code expands at spawn from the PTY env block. No tee copy is made into the plugin, because both the tee and the server resolve from `${PLATFORM_ROOT}` outside the per-plugin cache. `graph` is the one shared-lib tool-plugin; every other tool-plugin ships a plugin-local `mcp/` and uses `auto`. A plugin with an `mcp:` block, no plugin-local `mcp/`, and no `mcp-manifest: shared-lib` annotation is a FATAL at generation time. Premium plugins import platform libs (`mcp-lifeline`, etc.) via a source-tree relative path; the bundler's premium-lib shipper (`packages/create-maxy-code/scripts/bundle.js`) rewrites that path and vendors each referenced `platform/lib/<name>` into `premium-plugins/<bundle>/lib/<name>/`, so the auto-mounted dist resolves its imports. The `mcp-allowlist-without-server` gate above proves only that a plugin's PLUGIN.md `mcp:` block matches its allowlist — it reads source, not the generated manifest — so a plugin left on `skip` passes that gate while its server silently never mounts (its tools are listed but not live). The `tool-registration` gate below closes that blind spot.
 
 A second boot gate walks every specialist `.md` under `platform/templates/specialists/agents/`, every bundled `<plugin>/agents/` directory, and the per-account `<accountDir>/specialists/agents/` directory, parses each file's `tools:` frontmatter line (canonical long-prefix names), and classifies every tool name as one of: CC-native (Read, Bash, …), a tool the loaded `PLUGIN.md` set actually serves (matched as the long canonical name in `toolSurface.all`), a third-party MCP bridge (a `mcp__plugin_*` name whose plugin segment is NOT a maxy platform plugin — Playwright etc., upstream-owned, passes unconditionally), `unknown-tool-in-plugin` (maxy plugin namespace served but tool name absent), `unknown-plugin-namespace` (namespace served by nothing), `brand-excluded-plugin` (namespace served by nothing on this brand, **but** the brand's `brand.json#plugins.excluded` list names it), or `malformed-name` (not CC-native and not `mcp__`-shaped). The first three pass. The next two refuse boot with one `boot-failed reason=specialist-tool-drift specialist=<name> tool=<t> drift=<class> path=<…>` line per defect, then `process.exit(1)`. A maxy-plugin `mcp__plugin_*` name is validated against `toolSurface.all`, so a typo or stale long-prefix tool name still refuses boot rather than passing as a bridge; the build-time `check-canonical-tool-names.mjs` gate catches the same drift in instruction files before publish. `brand-excluded-plugin` is a structural pass: it lands in a per-specialist strip-list, the manager continues to boot, and at spawn time `pty-spawner` removes those tool names from the `--agent <name>` spawn's `--allowed-tools` argv. The complementary observability emit `specialist-tool-strip specialist=<name> plugin=<p> tools=<csv> reason=brand-excluded` fires one line per stripped (specialist, plugin) pair so an operator who reads `server.log` sees the brand filter doing work without cross-referencing `brand.json` against the template. The startup-self-test line `startup-self-test specialist-tool-drift=ok inspected=<N> stripped-specialists=<M>` confirms the gate ran and how many specialists carry strip-lists.
 

package/payload/platform/plugins/docs/references/telegram-guide.md

@@ -43,7 +43,9 @@ Tell {{productName}}: "Set up Telegram" or "Configure the Telegram bot." Setup r
 
 - an **admin bot** — only your numeric Telegram IDs may message it, and it answers as your admin agent;
 - a **public bot** — customer-facing, with a DM policy, answering as one of your account's agents;
-- a **specialist bot** — bound to one of your own specialists, so messaging it runs that specialist with its own instructions and its own tools rather than your admin agent. You name the specialist and the numeric IDs allowed to reach it. Both are required: there is no open setting for this kind, because the specialist has real tools rather than the reply-only surface a public bot gets.
+- a **specialist bot** — bound to one of your own specialists, so messaging it runs that specialist with its own instructions and its own tools rather than your admin agent. You name the specialist and the numeric IDs allowed to reach it. Both are required: there is no open setting for this kind, because a specialist carries whatever tools its card gives it, while a public bot is held to a fixed set nobody can widen.
+
+A public Telegram bot holds five things and nothing else: the reply that carries its answer, cards with tappable buttons, polls and quizzes and map pins, outgoing photos and documents and voice notes, and the ability to open a file a visitor sent it. That set is fixed by the platform for every public agent on every account, so there is no tools setting on an agent to turn any of it on or off. A public bot on webchat or WhatsApp still has the reply alone, because those channels ship no equivalent set.
 
 It verifies the token, registers the bot's webhook on your brand's edge, stores the token under your brand's config (never in a shared system directory), and sets whichever agent or specialist will answer. The bot is now connected.
 
@@ -187,6 +189,13 @@ nobody, and a vote was dropped without a trace. A press on a job-sheet card is t
 one exception: the dispatch plugin applies the change and tells the presser
 itself, so {{productName}} does not answer a second time.
 
+A card carries its own words, so when {{productName}} sends a card with buttons
+it puts the answer in the card itself and does not add a sentence beside it. On a
+public bot, that following sentence is held back on purpose, so the visitor sees
+the card once and not the same thing twice. And when someone presses a button,
+your conversation view shows the button's own wording — "1 passenger", "One way"
+— rather than the code behind it.
+
 The same is now true of most of what Telegram sends. Reply to one of
 {{productName}}'s messages and it sees the message you replied to, so "yes, do
 that one" means something. React to a message with an emoji and it hears the

package/payload/platform/scripts/__tests__/agent-identity-reconcile.test.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# Task 2671 — reconcile_all_accounts_identities converges every account's
+# public-agent IDENTITY.md against the shipped template. The failure it exists
+# for is silent: the re-sync it replaces ran for the house account alone, so a
+# sub-account's agent kept a stale prompt indefinitely and nothing said so.
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PLAT_SCRIPTS="$SCRIPT_DIR/.."
+PASS=0; FAIL=0; FAILED=()
+assert_eq() { if [ "$1" = "$2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected [$2] got [$1]"); fi; }
+
+. "$PLAT_SCRIPTS/lib/agent-identity-reconcile.sh"
+
+T=$(mktemp -d)
+TPL="$T/IDENTITY.md"
+printf '# Public Agent\n\nShipped text.\n' > "$TPL"
+export MAXY_PUBLIC_IDENTITY_TEMPLATE="$TPL"
+
+seed_account() {
+  # seed_account <accounts_dir> <account_id>
+  local root="$1/$2"
+  mkdir -p "$root/agents"
+  printf '{"accountId":"%s"}\n' "$2" > "$root/account.json"
+  echo "$root"
+}
+seed_agent() {
+  # seed_agent <account_root> <slug> <body>
+  mkdir -p "$1/agents/$2"
+  printf '%s' "$3" > "$1/agents/$2/IDENTITY.md"
+}
+
+ACCTS="$T/accounts"
+A1="$(seed_account "$ACCTS" aaaaaaaa-0000-0000-0000-000000000001)"
+A2="$(seed_account "$ACCTS" bbbbbbbb-0000-0000-0000-000000000002)"
+
+seed_agent "$A1" beagle 'STALE — you have no tools.'
+seed_agent "$A1" admin  'ADMIN identity, never touched.'
+seed_agent "$A1" passive 'PASSIVE identity, never touched.'
+# Byte-identical to the template, so `cp` rather than a command substitution:
+# `$(cat …)` strips the trailing newline and the copy would read as drift.
+mkdir -p "$A2/agents/fares" && cp "$TPL" "$A2/agents/fares/IDENTITY.md"
+# An agent dir with no IDENTITY.md: counted by nothing, created by nothing.
+mkdir -p "$A2/agents/halfmade"
+# A dir with no account.json is not an account.
+mkdir -p "$ACCTS/not-an-account/agents"
+
+OUT1="$(reconcile_all_accounts_identities "$ACCTS" 2>&1)"; RC1=$?
+
+assert_eq "$RC1" "0" "clean-run-exit-zero"
+assert_eq "$(printf '%s' "$OUT1" | grep -c 'accounts=2 agents=2 divergent=1')" "1" "summary-counts"
+assert_eq "$(cat "$A1/agents/beagle/IDENTITY.md")" "$(cat "$TPL")" "stale-rewritten"
+assert_eq "$(cat "$A1/agents/admin/IDENTITY.md")" "ADMIN identity, never touched." "admin-skipped"
+assert_eq "$(cat "$A1/agents/passive/IDENTITY.md")" "PASSIVE identity, never touched." "passive-skipped"
+assert_eq "$(printf '%s' "$OUT1" | grep -c 'agent=beagle status=updated')" "1" "stale-logged-updated"
+assert_eq "$(printf '%s' "$OUT1" | grep -c 'agent=fares status=already-current')" "1" "current-logged-current"
+assert_eq "$(printf '%s' "$OUT1" | grep -c 'agent=admin\|agent=passive\|agent=halfmade')" "0" "excluded-not-logged"
+assert_eq "$([ -e "$A2/agents/halfmade/IDENTITY.md" ] && echo yes || echo no)" "no" "never-creates"
+
+# Second run: same agent count, nothing left divergent. A zero that follows a
+# non-zero is the only zero that proves the pass runs — `divergent=0` on its own
+# is what a stopped counter prints too.
+OUT2="$(reconcile_all_accounts_identities "$ACCTS" 2>&1)"; RC2=$?
+assert_eq "$RC2" "0" "idempotent-exit-zero"
+assert_eq "$(printf '%s' "$OUT2" | grep -c 'accounts=2 agents=2 divergent=0')" "1" "idempotent-summary"
+
+# Missing template: reported per agent, counted divergent, never fatal, and the
+# agent's file is left exactly as it was rather than truncated.
+export MAXY_PUBLIC_IDENTITY_TEMPLATE="$T/absent.md"
+BEFORE="$(cat "$A1/agents/beagle/IDENTITY.md")"
+OUT3="$(reconcile_all_accounts_identities "$ACCTS" 2>&1)"; RC3=$?
+assert_eq "$RC3" "0" "no-template-not-fatal"
+assert_eq "$(printf '%s' "$OUT3" | grep -c 'status=no-template')" "2" "no-template-logged-per-agent"
+assert_eq "$(printf '%s' "$OUT3" | grep -c 'accounts=2 agents=2 divergent=2')" "1" "no-template-counted-divergent"
+assert_eq "$(cat "$A1/agents/beagle/IDENTITY.md")" "$BEFORE" "no-template-leaves-file"
+
+# An empty destination after a copy aborts the install: that state traps the
+# brand server in STARTING and was observed on a live device.
+export MAXY_PUBLIC_IDENTITY_TEMPLATE="$TPL"
+printf 'drifted again' > "$A1/agents/beagle/IDENTITY.md"
+CP_STUB="$T/bin"; mkdir -p "$CP_STUB"
+printf '#!/usr/bin/env bash\n: > "${@: -1}"\nexit 0\n' > "$CP_STUB/cp"; chmod +x "$CP_STUB/cp"
+OUT4="$(PATH="$CP_STUB:$PATH" reconcile_all_accounts_identities "$ACCTS" 2>&1)"; RC4=$?
+assert_eq "$RC4" "1" "empty-copy-is-fatal"
+assert_eq "$(printf '%s' "$OUT4" | grep -c 'status=empty-after-copy')" "1" "empty-copy-logged"
+assert_eq "$(printf '%s' "$OUT4" | grep -c 'FATAL')" "1" "empty-copy-fatal-line"
+
+# setup-account.sh runs under `set -euo pipefail`, and the reconciler is called
+# there as a bare command. A non-zero from any per-agent call therefore kills the
+# whole install, and it kills it on exactly the runs that had work to do — the
+# ones where an agent diverged. Reproduced before the fix: the summary line never
+# printed and the sourcing shell exited 1 after the first `status=updated`.
+export MAXY_PUBLIC_IDENTITY_TEMPLATE="$TPL"
+printf 'drifted under set -e' > "$A1/agents/beagle/IDENTITY.md"
+OUT5="$(bash -c '
+set -euo pipefail
+. "'"$PLAT_SCRIPTS"'/lib/agent-identity-reconcile.sh"
+reconcile_all_accounts_identities "'"$ACCTS"'"
+echo REACHED-END' 2>&1)"; RC5=$?
+assert_eq "$RC5" "0" "set-e-does-not-abort"
+assert_eq "$(printf '%s' "$OUT5" | grep -c 'REACHED-END')" "1" "set-e-reaches-end"
+assert_eq "$(printf '%s' "$OUT5" | grep -c 'accounts=2 agents=2 divergent=1')" "1" "set-e-summary-printed"
+
+rm -rf "$T"
+
+if [ "$FAIL" -gt 0 ]; then
+  printf 'FAIL %d, PASS %d\n' "$FAIL" "$PASS"
+  printf '  %s\n' "${FAILED[@]}"
+  exit 1
+fi
+printf 'PASS %d\n' "$PASS"