@rubytech/create-realagent-code 0.1.593 → 0.1.595

package/payload/platform/scripts/__tests__/check-orphan-dist.test.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# The orphan-dist gate. A compiled .js whose .ts was deleted must fail; a
+# nested path must map by its relative path, not its basename; a dist whose
+# whole project is gone must be reported as a project orphan rather than one
+# line per file; and a run that finds no dist tree at all must fail rather
+# than report a clean zero, because "measured nothing" and "found nothing"
+# are different answers.
+set -u
+GATE="$(cd "$(dirname "$0")/.." && pwd)/check-orphan-dist.mjs"
+[[ -f "$GATE" ]] || { echo "FAIL: gate script missing at $GATE" >&2; exit 1; }
+PASS=0; FAIL=0
+
+ROOT=$(mktemp -d)
+trap 'rm -rf "$ROOT"' EXIT
+
+reset_root() { rm -rf "$ROOT/platform"; mkdir -p "$ROOT/platform"; }
+
+# The plugins family nests its project under mcp/; lib and services do not.
+fam_base() { # $1=family $2=project $3=dist|src
+  if [[ "$1" == plugins ]]; then echo "$ROOT/platform/$1/$2/mcp/$3"; else echo "$ROOT/platform/$1/$2/$3"; fi
+}
+make_out() { local b; b="$(fam_base "$1" "$2" dist)"; mkdir -p "$b/$(dirname "$3")"; printf 'export {};\n' > "$b/$3"; }
+make_src() { local b; b="$(fam_base "$1" "$2" src)";  mkdir -p "$b/$(dirname "$3")"; printf 'export {};\n' > "$b/$3"; }
+
+check() { # $1=desc $2=expected-exit $3=expected substring (may be empty)
+  local desc="$1" expected="$2" needle="${3:-}" out got
+  out=$(node "$GATE" "$ROOT/platform" 2>&1); got=$?
+  if [[ "$got" -ne "$expected" ]]; then
+    echo "FAIL: $desc — expected exit $expected, got $got"; printf '%s\n' "$out" | sed 's/^/      /'
+    FAIL=$((FAIL+1)); return
+  fi
+  if [[ -n "$needle" ]] && ! printf '%s' "$out" | grep -qF -- "$needle"; then
+    echo "FAIL: $desc — output missing [$needle]"; printf '%s\n' "$out" | sed 's/^/      /'
+    FAIL=$((FAIL+1)); return
+  fi
+  echo "PASS: $desc"; PASS=$((PASS+1))
+}
+
+reset_root
+make_src plugins alpha index.ts; make_out plugins alpha index.js
+check "a compiled file with its source passes" 0 "orphans=0"
+
+reset_root
+make_src plugins alpha lib/nested.ts; make_out plugins alpha lib/nested.js
+check "a nested path maps by relative path, not basename" 0 "orphans=0"
+
+reset_root
+make_src lib beta index.ts; make_out lib beta index.js
+make_src services gamma index.ts; make_out services gamma index.js
+check "lib and services trees are scanned too" 0 "trees=2"
+
+reset_root
+make_src plugins alpha index.ts; make_out plugins alpha index.js
+make_out plugins alpha lib/gone.js
+check "a compiled file whose source was deleted fails" 1 "orphan=plugins/alpha/mcp/dist/lib/gone.js"
+
+reset_root
+make_out lib deleted-project index.js; make_out lib deleted-project helper.js
+check "a dist whose whole project is gone is one project orphan" 1 "orphan-project=lib/deleted-project/dist"
+
+reset_root
+check "no dist tree at all fails rather than reporting a clean zero" 1 "trees=0"
+
+# --remove deletes exactly what it reported, and leaves the live file alone.
+reset_root
+make_src plugins alpha index.ts; make_out plugins alpha index.js
+make_out plugins alpha lib/gone.js
+printf '{}\n' > "$(fam_base plugins alpha dist)/lib/gone.js.map"
+REMOVE_OUT=$(node "$GATE" "$ROOT/platform" --remove 2>&1); REMOVE_EXIT=$?
+if [[ ! -e "$(fam_base plugins alpha dist)/lib/gone.js" \
+   && ! -e "$(fam_base plugins alpha dist)/lib/gone.js.map" \
+   && -f "$(fam_base plugins alpha dist)/index.js" ]]; then
+  echo "PASS: --remove deletes the orphan and its sidecars, keeps the live file"; PASS=$((PASS+1))
+else
+  echo "FAIL: --remove did not delete exactly the orphan set"; FAIL=$((FAIL+1))
+fi
+
+# The removal must report the state on disk afterwards, not that a delete ran.
+if printf '%s' "$REMOVE_OUT" | grep -qF -- "removed=1 remaining=0" && [[ "$REMOVE_EXIT" -eq 0 ]]; then
+  echo "PASS: --remove re-scans and reports the post-condition"; PASS=$((PASS+1))
+else
+  echo "FAIL: --remove did not re-scan — expected 'removed=1 remaining=0' and exit 0, got exit $REMOVE_EXIT"
+  printf '%s\n' "$REMOVE_OUT" | sed 's/^/      /'; FAIL=$((FAIL+1))
+fi
+
+echo "---"; echo "PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/scripts/check-orphan-dist.mjs

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+// Reconciles every compiled output tree under platform/ against its sources.
+//
+// Why this is a standing check and not a log line: `tsc` never removes output
+// for a source that was deleted, and the bundler copies each tree — `dist`
+// included — into the payload that `npm publish` ships. The deletion emits no
+// event, and rebuilding does not surface the leftover, so nothing short of an
+// independent reconcile can see it.
+//
+// Every project compiles `rootDir: src` to `outDir: dist`, so `dist/<rel>.js`
+// maps to exactly one source, `src/<rel>.ts`. Two shapes of orphan exist:
+//   file    — the .ts was deleted, the project still exists. `tsc -b --clean`
+//             would remove it.
+//   project — the whole project was deleted; `dist` survives with no `src` and
+//             no tsconfig, so no tsc invocation can ever reach it. Reported
+//             once per directory rather than once per file.
+//
+// Usage: node check-orphan-dist.mjs [platformRoot] [--remove]
+// Exit 0 when every .js has a source. Exit 1 on any orphan, and exit 1 when no
+// dist tree was found at all — a zero-orphan pass must never be
+// indistinguishable from having measured nothing.
+//
+// With --remove it deletes exactly the set it just reported (each orphan .js
+// plus its .js.map/.d.ts/.d.ts.map sidecars; a project orphan's whole dist
+// directory) and then re-scans, so the exit code reflects the state on disk
+// afterwards rather than the fact that a delete was called. Sharing one rule
+// between the detector and the repair is what stops the two drifting apart.
+
+import { existsSync, readdirSync, rmSync } from "node:fs";
+import { join, resolve, relative, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const args = process.argv.slice(2);
+const remove = args.includes("--remove");
+const rootArg = args.find((a) => !a.startsWith("--"));
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const platformRoot = resolve(rootArg ?? join(scriptDir, ".."));
+
+// Each family maps a project directory to its dist/src pair. `sub` is the
+// directory between the project and its dist/src, empty where there is none.
+const FAMILIES = [
+  { dir: "plugins", sub: "mcp" },
+  { dir: "lib", sub: "" },
+  { dir: "services", sub: "" },
+];
+
+function subdirs(dir) {
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir, { withFileTypes: true })
+    .filter((e) => e.isDirectory())
+    .map((e) => e.name)
+    .sort();
+}
+
+function walkJs(dir, out) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) walkJs(full, out);
+    else if (entry.name.endsWith(".js")) out.push(full);
+  }
+  return out;
+}
+
+function scan() {
+  let trees = 0;
+  let files = 0;
+  const fileOrphans = [];
+  const projectOrphans = [];
+
+  for (const family of FAMILIES) {
+    const familyDir = join(platformRoot, family.dir);
+    for (const project of subdirs(familyDir)) {
+      const base = family.sub
+        ? join(familyDir, project, family.sub)
+        : join(familyDir, project);
+      const distDir = join(base, "dist");
+      if (!existsSync(distDir)) continue;
+      trees += 1;
+      const srcDir = join(base, "src");
+      if (!existsSync(srcDir)) {
+        projectOrphans.push(distDir);
+        files += walkJs(distDir, []).length;
+        continue;
+      }
+      for (const js of walkJs(distDir, [])) {
+        files += 1;
+        const rel = js.slice(distDir.length + 1);
+        if (!existsSync(join(srcDir, `${rel.slice(0, -3)}.ts`))) fileOrphans.push(js);
+      }
+    }
+  }
+  return { trees, files, fileOrphans, projectOrphans, total: fileOrphans.length + projectOrphans.length };
+}
+
+const rel = (p) => relative(platformRoot, p);
+
+function report(r) {
+  console.log(`[orphan-dist] trees=${r.trees} files=${r.files} orphans=${r.total}`);
+  for (const p of r.projectOrphans) console.log(`[orphan-dist] orphan-project=${rel(p)}`);
+  for (const f of r.fileOrphans) console.log(`[orphan-dist] orphan=${rel(f)}`);
+}
+
+const first = scan();
+report(first);
+
+if (first.trees === 0) {
+  console.error(
+    "[orphan-dist] FATAL: no dist tree found under platform/{plugins,lib,services} — " +
+      "the check measured nothing rather than finding nothing. Build platform first.",
+  );
+  process.exit(1);
+}
+
+if (remove && first.total > 0) {
+  for (const dir of first.projectOrphans) rmSync(dir, { recursive: true, force: true });
+  for (const js of first.fileOrphans) {
+    const stem = js.slice(0, -3);
+    for (const ext of [".js", ".js.map", ".d.ts", ".d.ts.map"]) {
+      rmSync(`${stem}${ext}`, { force: true });
+    }
+  }
+  // Re-scan rather than trust the delete. The exit code must reflect what is
+  // on disk now, not the fact that rmSync was called.
+  const after = scan();
+  console.log(`[orphan-dist] removed=${first.total - after.total} remaining=${after.total}`);
+  if (after.total > 0) {
+    console.error(
+      `[orphan-dist] FATAL: ${after.total} orphan(s) survived removal. Check permissions on the ` +
+        "paths listed above.",
+    );
+    process.exit(1);
+  }
+  process.exit(0);
+}
+
+if (first.total > 0) {
+  console.error(
+    `[orphan-dist] FATAL: ${first.total} compiled output(s) have no source. Their .ts was deleted and ` +
+      "the compiler left the .js behind, where the bundler copies it into the published payload. " +
+      "Run `npm run clean:dist` in platform/ to remove exactly this set.",
+  );
+  process.exit(1);
+}

package/payload/platform/scripts/lib/agent-identity-reconcile.sh

@@ -0,0 +1,122 @@
+# agent-identity-reconcile.sh — converge every account's public-agent IDENTITY.md
+# against the shipped template, and state the divergence count.
+#
+# Task 2671. The re-sync this replaces lived inside provision_account_dir, and
+# setup-account.sh calls that for the house account and no other, so an agent
+# created on a client sub-account keeps whatever identity text it was seeded
+# with for ever. Measured on laptop 192.168.88.10 on 2026-08-11: the house
+# account's agents were refreshed by that morning's install while
+# `5bc2c0e2/agents/beagle` still carried the 2026-07-31 text and
+# `.../fares` the 2026-08-04 one, both of them telling a spawn that now holds
+# five tools that it holds none.
+#
+# This is the identity twin of account-settings-reconcile.sh, written the same
+# way and for the same reason, and it is the file's only writer: the in-place
+# loop was deleted when this landed.
+#
+# IDENTITY.md is Rubytech-controlled and copied verbatim (agent-write.ts:113), so
+# an operator edit here is drift to be corrected, not content to preserve. That
+# is the one place this diverges from the settings reconciler, which leaves an
+# unparseable file alone because it may carry an operator edit worth keeping.
+#
+# Idempotent. Never creates an agent dir, never writes SOUL/KNOWLEDGE/config,
+# never echoes file contents.
+#
+# Sourced by setup-account.sh; also runnable standalone for a manual repair.
+
+# ensure_agent_identity <identity_file> <template_file> <account_id> <agent_slug>
+# Returns 0 when the file already matched the template, 1 when it diverged, and
+# 2 when the copy landed empty. Logs exactly one
+#   [identity-reconcile] account=<id> agent=<slug> status=<already-current|updated|rewrite-failed|empty-after-copy|no-template>
+ensure_agent_identity() {
+  local f="$1" tpl="$2" acct="$3" slug="$4"
+
+  if [ ! -s "$tpl" ]; then
+    echo "[identity-reconcile] account=$acct agent=$slug status=no-template"
+    return 1
+  fi
+
+  if cmp -s "$f" "$tpl"; then
+    echo "[identity-reconcile] account=$acct agent=$slug status=already-current"
+    return 0
+  fi
+
+  if ! cp "$tpl" "$f" 2>/dev/null; then
+    echo "[identity-reconcile] account=$acct agent=$slug status=rewrite-failed"
+    return 1
+  fi
+
+  # A 0-byte cp traps the brand server in STARTING: the reachability auditor
+  # then reports `reachable=false reason=files-missing IDENTITY.md:empty` every
+  # minute and the operator sees the splash for ever. Observed on
+  # 192.168.88.16 after a re-install, source 1655 bytes and destination 0. This
+  # is the one condition the pass refuses to continue past, carried over from
+  # the loop it replaces.
+  if [ ! -s "$f" ]; then
+    echo "[identity-reconcile] account=$acct agent=$slug status=empty-after-copy" >&2
+    return 2
+  fi
+
+  # Divergent, like every other non-matching outcome: `divergent=` counts files
+  # this pass had to act on, so a run that rewrote one and a run that rewrote
+  # none are distinguishable in the summary line.
+  echo "[identity-reconcile] account=$acct agent=$slug status=updated"
+  return 1
+}
+
+# reconcile_all_accounts_identities <accounts_dir>
+# Standing check + durable backfill across every account carrying an
+# account.json. Emits one status line per agent plus one summary line on every
+# run, including a zero count — silence is not evidence of convergence, and
+# `agents=0` on an install that has accounts is a stopped counter rather than a
+# clean pass.
+#
+# Returns 1 only when a copy landed empty, so the caller aborts before the brand
+# server starts. Every other failure is reported and stepped over.
+reconcile_all_accounts_identities() {
+  local accts="$1"
+  local tpl="${MAXY_PUBLIC_IDENTITY_TEMPLATE:-${TEMPLATES_DIR:-}/agents/public/IDENTITY.md}"
+  local n=0 agents=0 divergent=0 fatal=0
+  local acct acct_id agent_dir slug rc
+
+  if [ -d "$accts" ]; then
+    for acct in "$accts"/*/; do
+      [ -f "$acct/account.json" ] || continue
+      n=$((n + 1))
+      acct_id="$(basename "$acct")"
+      for agent_dir in "$acct/agents"/*/; do
+        [ -d "$agent_dir" ] || continue
+        slug="$(basename "$agent_dir")"
+        # admin has its own Rubytech identity; passive has a third (Task 1483),
+        # and re-syncing either from the public visitor template would replace a
+        # correct prompt with the wrong one.
+        [ "$slug" = "admin" ] && continue
+        [ "$slug" = "passive" ] && continue
+        # Never create. An agent dir with no IDENTITY.md is a half-made agent,
+        # which agent-create's rollback already prevents; seeding one here would
+        # make it look whole.
+        [ -f "$agent_dir/IDENTITY.md" ] || continue
+        agents=$((agents + 1))
+        # `|| rc=$?` rather than a bare call followed by `rc=$?`: setup-account.sh
+        # runs under `set -e`, and a bare call returning non-zero kills the
+        # install the first time any agent diverges — which is every upgrade
+        # that has work to do. The `||` puts the call in a tested context, the
+        # same shape account-settings-reconcile.sh uses for the same reason.
+        rc=0
+        ensure_agent_identity "$agent_dir/IDENTITY.md" "$tpl" "$acct_id" "$slug" || rc=$?
+        # if-blocks rather than `[ … ] && …` lists: an AND-list whose test fails
+        # returns non-zero, and as the last command in this loop body that is
+        # another way `set -e` kills the install.
+        if [ "$rc" -ne 0 ]; then divergent=$((divergent + 1)); fi
+        if [ "$rc" -eq 2 ]; then fatal=1; fi
+      done
+    done
+  fi
+
+  echo "[identity-reconcile] accounts=$n agents=$agents divergent=$divergent"
+  if [ "$fatal" -eq 1 ]; then
+    echo "  [setup] FATAL a public IDENTITY.md is empty after copy from $tpl ($(wc -c < "$tpl" 2>/dev/null || echo 0) bytes); aborting before the brand server starts" >&2
+    return 1
+  fi
+  return 0
+}

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -87,34 +87,16 @@ provision_account_dir() {
   cp "$TEMPLATES_DIR/agents/admin/IDENTITY.md" "$ACCOUNT_DIR/agents/admin/IDENTITY.md"
   # Task 1483 — the WhatsApp passive requirement-intake identity. Rubytech-
   # controlled and uniform (like admin), so it is re-seeded from the template on
-  # every provision, and excluded from the public re-sync loop below (which would
-  # otherwise clobber it with the public visitor IDENTITY).
+  # every provision.
   cp "$TEMPLATES_DIR/agents/passive/IDENTITY.md" "$ACCOUNT_DIR/agents/passive/IDENTITY.md"
 
-  # On re-provision, re-sync the Rubytech-controlled IDENTITY.md for every
-  # already-existing non-admin agent dir (security-load-bearing). Never create
-  # dirs; never write SOUL/KNOWLEDGE/config.
-  local _AGENT_DIR _AGENT_NAME
-  for _AGENT_DIR in "$ACCOUNT_DIR/agents"/*/; do
-    [ -d "$_AGENT_DIR" ] || continue
-    _AGENT_NAME="$(basename "$_AGENT_DIR")"
-    [ "$_AGENT_NAME" = "admin" ] && continue
-    # Task 1483 — passive has its own Rubytech IDENTITY (seeded above); it must
-    # NOT be re-synced from the public visitor template.
-    [ "$_AGENT_NAME" = "passive" ] && continue
-    [ -f "$_AGENT_DIR/IDENTITY.md" ] || continue
-    cp "$TEMPLATES_DIR/agents/public/IDENTITY.md" "$_AGENT_DIR/IDENTITY.md"
-    # Defensive verify — a 0-byte cp traps the brand server in STARTING (the
-    # reachability auditor reports `reachable=false reason=files-missing
-    # IDENTITY.md:empty` every minute). Observed on 192.168.88.16 after a
-    # re-install: source 1655 bytes, dest 0 bytes. Loud-fail here so the
-    # operator sees the bad write at install time, not the splash forever.
-    if [ ! -s "$_AGENT_DIR/IDENTITY.md" ]; then
-      echo "  [setup] FATAL agents/$_AGENT_NAME/IDENTITY.md is empty after copy from $TEMPLATES_DIR/agents/public/IDENTITY.md ($(wc -c < "$TEMPLATES_DIR/agents/public/IDENTITY.md") bytes); aborting before the brand server starts" >&2
-      return 1
-    fi
-    echo "  agents/$_AGENT_NAME/IDENTITY.md re-synced"
-  done
+  # Task 2671 — the public-agent IDENTITY.md re-sync that used to run here now
+  # lives in lib/agent-identity-reconcile.sh, called by setup-account.sh across
+  # EVERY account. It ran here for whichever single account was being
+  # provisioned, and setup-account.sh provisions the house account alone, so an
+  # agent on a client sub-account kept a stale prompt indefinitely. That
+  # reconciler is now the only writer of the file; re-adding a copy here would
+  # make it two.
 
   cp "$TEMPLATES_DIR/specialists/.claude-plugin/plugin.json" "$ACCOUNT_DIR/specialists/.claude-plugin/plugin.json"
 

package/payload/platform/scripts/setup-account.sh

@@ -77,3 +77,18 @@ reconcile_all_accounts_owned_dirs "$ACCOUNTS_DIR"
 # (Task 2475 retired the four one-hook backfill libs this replaced.)
 . "$SCRIPT_DIR/lib/account-settings-reconcile.sh"
 reconcile_all_accounts_settings "$ACCOUNTS_DIR"
+
+# ------------------------------------------------------------------
+# 5. Converge every public agent's IDENTITY.md on every account
+# ------------------------------------------------------------------
+# Task 2671. Same shape and same reason as step 4: the identity re-sync used to
+# live inside provision_account_dir, which this script calls for the house
+# account and no other, so an agent created on a client sub-account kept the
+# text it was seeded with for ever. Measured on 2026-08-11: a sub-account's
+# agents still carried a July prompt telling a five-tool Telegram spawn it held
+# none. This is now the single writer of a public agent's IDENTITY.md — the
+# in-place loop was deleted when it landed. Returns non-zero only when a copy
+# lands empty, which `set -e` turns into an abort before the brand server
+# starts, because that state traps the server in STARTING.
+. "$SCRIPT_DIR/lib/agent-identity-reconcile.sh"
+reconcile_all_accounts_identities "$ACCOUNTS_DIR"

package/payload/platform/services/claude-session-manager/dist/index.js

@@ -734,8 +734,13 @@ async function main() {
     // agent — the no-event detector for an active agent that is shadowed or
     // otherwise unrouted. Names the exact slug and cause without a visitor
     // request.
+    // Task 2671 — the shipped public identity, so each verdict can say whether the
+    // agent's copy still matches it. The install-time reconciler converges these
+    // files, but a hand edit afterwards writes nothing anywhere and is only read
+    // inside a spawn; this is the tick that sees it.
     const reachabilityAudit = createReachabilityAudit({
         accountDirs: provisionedAccountDirs,
+        publicIdentityTemplate: join(platformRoot, 'templates', 'agents', 'public', 'IDENTITY.md'),
         intervalMs: 60_000,
         logger: log,
     });