@rubytech/create-realagent 1.0.406

package/payload/platform/plugins/workflows/mcp/test-workflows.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Workflow MCP tool test suite.
+#
+# Exercises all 8 workflow tools via the MCP protocol to verify:
+#   - Creation: valid, missing plugin (draft), cycle detection, step limit
+#   - Type enforcement: "skill" and "subagent" rejected at schema level
+#   - Timeout validation: boundary checks (0, 120, 121, omitted)
+#   - Get / List / Update / Delete
+#   - Validation: re-validate draft workflows
+#   - Execution: draft/paused rejection
+#   - Run history queries
+#
+# Prerequisites: Neo4j running, Ollama running (for embeddings).
+# Uses the MCP SDK Client to communicate with the server — same protocol
+# path production uses.
+#
+# Usage: bash test-workflows.sh
+# Exit 0 = all tests pass, exit 1 = failure
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+echo "=== Workflow Test Suite ==="
+echo ""
+
+# ── Check prerequisites ──────────────────────────────────────
+
+# Neo4j connectivity check
+echo -n "Checking Neo4j... "
+NEO4J_URI="${NEO4J_URI:-bolt://localhost:7687}"
+if ! nc -z "$(echo "$NEO4J_URI" | sed 's|.*://||;s|:.*||')" "$(echo "$NEO4J_URI" | sed 's|.*:||')" 2>/dev/null; then
+  echo "SKIP — Neo4j not reachable at $NEO4J_URI"
+  echo "Tests require Neo4j. Run on the Pi or start Neo4j locally."
+  exit 0
+fi
+echo "OK"
+
+# Ollama check (needed for embeddings at workflow creation time)
+OLLAMA_URL="${OLLAMA_URL:-http://localhost:11434}"
+echo -n "Checking Ollama... "
+if ! curl -sf "$OLLAMA_URL/api/tags" >/dev/null 2>&1; then
+  echo "SKIP — Ollama not reachable at $OLLAMA_URL"
+  echo "Tests require Ollama for embedding generation."
+  exit 0
+fi
+echo "OK"
+
+# Build check
+echo -n "Checking build... "
+if [ ! -f "$SCRIPT_DIR/dist/index.js" ]; then
+  echo "not built — building now..."
+  (cd "$SCRIPT_DIR" && npm run build 2>&1) || {
+    echo "Build failed"
+    exit 1
+  }
+  echo "  Build complete"
+else
+  echo "OK"
+fi
+
+# PLATFORM_ROOT must be set
+if [ -z "${PLATFORM_ROOT:-}" ]; then
+  # Derive from script location: mcp/ → workflows/ → plugins/ → platform/
+  export PLATFORM_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+  echo "PLATFORM_ROOT set to: $PLATFORM_ROOT"
+fi
+
+echo ""
+
+# ── Run tests ─────────────────────────────────────────────────
+
+node "$SCRIPT_DIR/test-runner.mjs"

package/payload/platform/plugins/workflows/skills/workflow-manager/skill.md

@@ -0,0 +1,88 @@
+# Workflow Manager
+
+Create, test, and diagnose persistent workflows that automate recurring multi-step processes.
+
+## When to Suggest a Workflow
+
+The user describes a recurring process with two or more steps that involve different plugin tools. Examples: "every time a new contact signs up, send them a welcome message and schedule a follow-up", "when I get a new lead, create a contact, log it, and send a Telegram notification".
+
+Do not suggest workflows for single-tool operations or one-off tasks.
+
+## Gathering Requirements
+
+Ask the user conversationally:
+
+1. **What triggers this workflow?** Manual execution, scheduled (cron via scheduling plugin), or conversational ("run the follow-up workflow").
+2. **What are the steps?** Each step is a single MCP tool call on a specific plugin. Identify the plugin name and tool name for each step.
+3. **How do steps connect?** Which steps depend on output from earlier steps? Identify the `outputKey` for steps that produce data and the `{{outputKey.field}}` template variables for steps that consume it.
+4. **What happens on failure?** For each step: abort the workflow, skip and continue, or retry (up to 3 times)?
+5. **Any slow steps?** Steps calling tools that may take longer than 30 seconds (knowledge ingestion, external API calls) need an explicit `timeout` value (max 120 seconds).
+
+## Presenting for Review
+
+Before creating, show the user the planned workflow structure:
+
+- Workflow name and description
+- Each step numbered, showing: label, plugin/tool, parameters (with template variables highlighted), failure policy, and timeout if non-default
+- Dependency chain (which steps must complete before which)
+- Template variable flow (where data passes between steps)
+
+Wait for the user's confirmation before calling `workflow-create`.
+
+## Creating a Workflow
+
+Use `workflow-create` with these parameters:
+- `name` — short descriptive name (e.g. "New lead follow-up")
+- `description` — what the workflow does, used for semantic discovery
+- `steps` — array of step objects, each with:
+  - `type`: `"tool"` (the only supported type)
+  - `plugin`: plugin name (e.g. `"contacts"`, `"telegram"`, `"scheduling"`)
+  - `tool`: tool name within the plugin (e.g. `"contact-create"`, `"message"`)
+  - `params`: parameter object — use `{{outputKey.field}}` for values from prior steps
+  - `label`: human-readable description
+  - `dependsOn`: array of position indexes (as strings) for steps that must complete first — e.g. `["0"]` means "after step 0"
+  - `onFailure`: `"abort"` (default), `"skip"`, or `"retry"`
+  - `retryLimit`: 1-3, only when onFailure is `"retry"`
+  - `outputKey`: name to store this step's output under
+  - `timeout`: execution timeout in seconds (1-120, default 30)
+
+If creation returns `status: "draft"`, tell the user which plugin capabilities are missing and that the workflow will activate automatically once those plugins are installed and built.
+
+## Testing a Workflow
+
+After creation, verify the workflow works:
+
+1. Use `workflow-execute` with a test `context` object containing sample values for any runtime variables the workflow expects.
+2. Check the result: `status`, `stepsCompleted`, `stepsSkipped`, `stepsFailed`.
+3. If any steps failed, use `workflow-runs` to get the detailed run history, then examine per-step results to identify which step failed and why.
+
+## Diagnosing Failures
+
+When the user reports a workflow isn't working:
+
+1. Use `workflow-get` with the `workflowId` to check the workflow's current status and step configuration.
+2. If status is `"draft"` — missing plugins. Use `workflow-validate` to see which capabilities are unavailable.
+3. If status is `"paused"` — the user or the system paused it. Use `workflow-update` with `status: "active"` to resume (this re-validates capabilities first).
+4. If status is `"active"` but execution fails — use `workflow-runs` to find recent runs, then examine per-step errors:
+   - Template variable errors: a step references `{{outputKey.field}}` but the prior step didn't produce that output key or field
+   - Tool errors: the underlying MCP tool returned an error (check the step result's error message)
+   - Timeout errors: the step exceeded its timeout — consider increasing the `timeout` field via `workflow-update`
+
+## Managing Existing Workflows
+
+- **List**: `workflow-list` — optionally filter by `status` (`"active"`, `"paused"`, `"draft"`)
+- **View details**: `workflow-get` with `workflowId`
+- **Edit**: `workflow-update` — can change `name`, `description`, `steps` (full replacement), or `status`
+- **Pause/resume**: `workflow-update` with `status: "paused"` or `status: "active"`
+- **Re-validate**: `workflow-validate` — checks if draft workflows can now activate after plugin changes
+- **Delete**: `workflow-delete` — cascades to all steps, runs, and step results. Confirm with the user first.
+- **Run history**: `workflow-runs` — optionally filter by `workflowId` or `status`
+
+## Schedule Integration
+
+To run a workflow on a schedule, create a scheduling event with action dispatch:
+- Plugin: `scheduling`
+- Tool: `schedule-event`
+- Action: `{ plugin: "workflows", tool: "workflow-execute", args: { workflowId: "..." } }`
+
+The platform heartbeat cron dispatches the workflow at the scheduled time. The WorkflowRun captures `trigger: "schedule"`.

package/payload/platform/scripts/hooks/pre-commit

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# pre-commit hook — blocks commits where code files are staged but no documentation is staged.
+#
+# Doc directories: .docs/  platform/plugins/docs/  .tasks/
+# Install: ln -sf ../../platform/scripts/hooks/pre-commit .git/hooks/pre-commit
+
+set -euo pipefail
+
+STAGED=$(git diff --cached --name-only --diff-filter=ACMR 2>/dev/null || true)
+
+if [ -z "$STAGED" ]; then
+  exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# Classify staged files
+# ---------------------------------------------------------------------------
+CODE_STAGED=false
+DOCS_STAGED=false
+CODE_FILES=()
+
+# A file is "code" if it has a recognised source extension and lives in a
+# source directory.  Everything else (package.json, lock files, brand assets,
+# config, .gitignore, etc.) is ignored — only genuine code changes require
+# accompanying documentation.
+is_code_file() {
+  local f="$1"
+
+  # Must be in a source directory
+  case "$f" in
+    platform/ui/app/*|platform/plugins/*/mcp/src/*|platform/plugins/*/hooks/*|platform/scripts/*|site/src/*) ;;
+    *) return 1 ;;
+  esac
+
+  # Must have a source extension
+  case "$f" in
+    *.ts|*.tsx|*.js|*.jsx|*.mjs|*.cjs|*.sh|*.md|*.css) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+while IFS= read -r file; do
+  if [[ "$file" == .docs/* || "$file" == platform/plugins/docs/* || "$file" == .tasks/* ]]; then
+    DOCS_STAGED=true
+  elif is_code_file "$file"; then
+    CODE_STAGED=true
+    CODE_FILES+=("$file")
+  fi
+  # Files that are neither docs nor code (package.json, lock files, assets) are ignored
+done <<< "$STAGED"
+
+if [ "$CODE_STAGED" = false ] || [ "$DOCS_STAGED" = true ]; then
+  exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# Build specific hints from staged code paths (bash 3.2 compatible)
+# ---------------------------------------------------------------------------
+HINT_HOOKS=false
+HINT_MCP=false
+HINT_PLUGINS=false
+HINT_DEPLOYMENT=false
+HINT_WEBCHAT=false
+HINT_PLATFORM=false
+
+for file in "${CODE_FILES[@]}"; do
+  case "$file" in
+    platform/plugins/admin/hooks/*)   HINT_HOOKS=true ;;
+    platform/plugins/*/mcp/*)         HINT_MCP=true ;;
+    platform/plugins/*/PLUGIN.md|platform/plugins/*) HINT_PLUGINS=true ;;
+    platform/scripts/start.sh|platform/scripts/setup.sh) HINT_DEPLOYMENT=true ;;
+    site/*)                           HINT_WEBCHAT=true ;;
+    platform/*)                       HINT_PLATFORM=true ;;
+  esac
+done
+
+ANY_HINT=false
+for flag in $HINT_HOOKS $HINT_MCP $HINT_PLUGINS $HINT_DEPLOYMENT $HINT_WEBCHAT $HINT_PLATFORM; do
+  [ "$flag" = true ] && ANY_HINT=true && break
+done
+
+# ---------------------------------------------------------------------------
+# Block the commit
+# ---------------------------------------------------------------------------
+echo ""
+echo "┌──────────────────────────────────────────────────────────────┐"
+echo "│  COMMIT BLOCKED: documentation not updated                  │"
+echo "└──────────────────────────────────────────────────────────────┘"
+echo ""
+echo "Code files were staged but neither .docs/ nor platform/plugins/docs/"
+echo "contains any staged changes."
+echo ""
+
+if [ "$ANY_HINT" = true ]; then
+  echo "Based on the files you changed, update:"
+  [ "$HINT_HOOKS" = true ]      && echo "  • .docs/hooks.md"
+  [ "$HINT_MCP" = true ]        && echo "  • .docs/mcp-servers.md"
+  [ "$HINT_PLUGINS" = true ]    && echo "  • .docs/plugins.md"
+  [ "$HINT_DEPLOYMENT" = true ] && echo "  • .docs/deployment.md"
+  [ "$HINT_WEBCHAT" = true ]    && echo "  • .docs/web-chat.md"
+  [ "$HINT_PLATFORM" = true ]   && echo "  • .docs/platform.md"
+else
+  echo "Update the relevant files in:"
+  echo "  • .docs/"
+  echo "  • platform/plugins/docs/"
+fi
+
+echo ""
+echo "Stage the updated doc file(s) and re-commit."
+echo ""
+exit 1

package/payload/platform/scripts/resume-tunnel.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+# resume-tunnel.sh — Resume the Cloudflare tunnel on boot
+#
+# Called as ExecStartPre in maxy.service. Reads ~/.cloudflared/tunnel.state,
+# checks whether the recorded PID is still a running cloudflared process,
+# and spawns a new daemon if not. All failures exit 0 — this script must
+# never prevent maxy.service from starting.
+#
+# Dependencies: jq, cloudflared (both installed by create-maxy)
+
+set -uo pipefail
+
+STATE_FILE="$HOME/.cloudflared/tunnel.state"
+LOG_DIR="$HOME/.maxy/logs"
+LOG_FILE="$LOG_DIR/cloudflared.log"
+
+log() {
+  mkdir -p "$LOG_DIR"
+  echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] resume-tunnel: $1" >> "$LOG_FILE"
+}
+
+# No state file — no tunnel configured. Normal boot.
+if [ ! -f "$STATE_FILE" ]; then
+  exit 0
+fi
+
+# Parse state file
+if ! STATE=$(jq -r '.' "$STATE_FILE" 2>/dev/null); then
+  log "WARNING: tunnel.state is not valid JSON — skipping resume"
+  exit 0
+fi
+
+CONNECTOR_TOKEN=$(echo "$STATE" | jq -r '.connectorToken // empty')
+TUNNEL_ID=$(echo "$STATE" | jq -r '.tunnelId // empty')
+DOMAIN=$(echo "$STATE" | jq -r '.domain // empty')
+OLD_PID=$(echo "$STATE" | jq -r '.pid // empty')
+
+if [ -z "$CONNECTOR_TOKEN" ]; then
+  log "WARNING: tunnel.state has no connectorToken — skipping resume"
+  exit 0
+fi
+
+# Check if the recorded PID is still a running cloudflared process
+if [ -n "$OLD_PID" ] && [ "$OLD_PID" != "null" ]; then
+  if kill -0 "$OLD_PID" 2>/dev/null; then
+    # PID is alive — verify it's actually cloudflared (not a reused PID)
+    PROC_NAME=$(cat "/proc/$OLD_PID/comm" 2>/dev/null || true)
+    if [ "$PROC_NAME" = "cloudflared" ]; then
+      log "Tunnel already running (PID $OLD_PID) — skipping resume"
+      exit 0
+    fi
+    # PID alive but not cloudflared — stale PID from before reboot
+    log "PID $OLD_PID is alive but is '$PROC_NAME', not cloudflared — will start new daemon"
+  fi
+fi
+
+# Find cloudflared binary
+CLOUDFLARED_BIN=$(command -v cloudflared 2>/dev/null || true)
+if [ -z "$CLOUDFLARED_BIN" ]; then
+  log "ERROR: cloudflared binary not found — cannot resume tunnel"
+  exit 0
+fi
+
+# Start the tunnel daemon (detached, survives service restart)
+log "Resuming tunnel $TUNNEL_ID for $DOMAIN..."
+mkdir -p "$LOG_DIR"
+nohup "$CLOUDFLARED_BIN" tunnel run --token "$CONNECTOR_TOKEN" >> "$LOG_FILE" 2>&1 &
+NEW_PID=$!
+
+if [ -z "$NEW_PID" ] || [ "$NEW_PID" -le 0 ] 2>/dev/null; then
+  log "ERROR: failed to spawn cloudflared — no PID returned"
+  exit 0
+fi
+
+# Update state file with new PID
+UPDATED_STATE=$(echo "$STATE" | jq --argjson pid "$NEW_PID" --argjson ts "$(date +%s)000" \
+  '.pid = $pid | .startedAt = $ts')
+
+if echo "$UPDATED_STATE" > "$STATE_FILE.tmp" 2>/dev/null && mv "$STATE_FILE.tmp" "$STATE_FILE" 2>/dev/null; then
+  log "Tunnel resumed — PID $NEW_PID"
+else
+  rm -f "$STATE_FILE.tmp" 2>/dev/null
+  log "WARNING: tunnel started (PID $NEW_PID) but failed to update state file"
+fi
+
+exit 0

package/payload/platform/scripts/seed-neo4j.sh

@@ -0,0 +1,273 @@
+#!/usr/bin/env bash
+# ============================================================
+# seed-neo4j.sh — Phase 0 setup
+# Creates the account from templates and applies Neo4j schema.
+# Product knowledge is ingested post-installation via the admin
+# agent, not seeded as cypher.
+# ============================================================
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+TEMPLATES_DIR="$PROJECT_DIR/templates"
+ACCOUNTS_DIR="$PROJECT_DIR/config/accounts"
+NEO4J_DIR="$PROJECT_DIR/neo4j"
+
+NEO4J_URI="${NEO4J_URI:-bolt://localhost:7687}"
+NEO4J_USER="${NEO4J_USER:-neo4j}"
+
+# Read password from the file created during setup
+NEO4J_PASSWORD_FILE="$PROJECT_DIR/config/.neo4j-password"
+if [ -n "${NEO4J_PASSWORD:-}" ]; then
+  : # Explicit env var takes precedence
+elif [ -f "$NEO4J_PASSWORD_FILE" ]; then
+  NEO4J_PASSWORD=$(cat "$NEO4J_PASSWORD_FILE")
+else
+  echo "Error: Neo4j password not found."
+  echo "  Expected at: $NEO4J_PASSWORD_FILE"
+  echo "  Or set NEO4J_PASSWORD environment variable."
+  exit 1
+fi
+
+CYPHER_SHELL="cypher-shell"
+
+# ------------------------------------------------------------------
+# 1. Create account from templates
+# ------------------------------------------------------------------
+
+# Resolve existing account or generate a new UUID.
+# Re-runs must use the same ID — find any existing account directory.
+mkdir -p "$ACCOUNTS_DIR"
+EXISTING=$(find "$ACCOUNTS_DIR" -maxdepth 2 -name "account.json" | head -1)
+if [ -n "$EXISTING" ]; then
+  ACCOUNT_DIR="$(dirname "$EXISTING")"
+  ACCOUNT_ID="$(basename "$ACCOUNT_DIR")"
+else
+  ACCOUNT_ID="$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())')"
+  ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
+fi
+
+mkdir -p "$ACCOUNT_DIR/agents/admin" "$ACCOUNT_DIR/agents/public" "$ACCOUNT_DIR/.claude" "$ACCOUNT_DIR/specialists/.claude-plugin" "$ACCOUNT_DIR/specialists/agents"
+
+# Claude Code discovers project-level .claude/ (agents, settings) relative to the
+# nearest .git root. Without a .git in the account directory, Claude Code traverses
+# up to ~/maxy/.git and misses everything in accountDir/.claude/. Initialise a git
+# repo so the account directory IS the project root for Claude Code.
+[ -d "$ACCOUNT_DIR/.git" ] || git init -q "$ACCOUNT_DIR"
+
+# Claude Code permissions — project-level settings now work since the account dir
+# has .git. Write permissions to the account's own .claude/settings.json.
+ACCOUNT_SETTINGS="$ACCOUNT_DIR/.claude/settings.json"
+
+# Wildcard permissions for all plugin MCP servers (core + optional).
+# Including optional plugins here is safe — permissions without a running
+# MCP server are inert. This ensures tools are allowed when the user
+# enables an optional plugin, without requiring a re-seed.
+MAXY_PERMISSIONS='["Read","Edit","Write","Bash","Glob","Grep","Agent","mcp__memory__*","mcp__contacts__*","mcp__telegram__*","mcp__admin__*","mcp__cloudflare__*","mcp__tasks__*","mcp__scheduling__*","mcp__email__*","mcp__workflows__*","mcp__web__*","mcp__plugin_playwright_playwright__*"]'
+
+# Append wildcard permissions for any optional plugins not already covered
+PLUGINS_DIR="$(dirname "$0")/../plugins"
+if [ -d "$PLUGINS_DIR" ]; then
+  for PLUGIN_DIR in "$PLUGINS_DIR"/*/; do
+    PLUGIN_NAME="$(basename "$PLUGIN_DIR")"
+    # Skip plugins already in the static list
+    case "$MAXY_PERMISSIONS" in
+      *"mcp__${PLUGIN_NAME}__"*) continue ;;
+    esac
+    # Only add if plugin has an MCP server
+    if [ -d "$PLUGIN_DIR/mcp" ]; then
+      MAXY_PERMISSIONS="${MAXY_PERMISSIONS%]},\"mcp__${PLUGIN_NAME}__*\"]"
+    fi
+  done
+fi
+
+# Clean up stale agent-creation gate state files before writing settings.
+# A re-install must not inherit gate state from a previous install — that
+# state could have all gates true, which acts as a permanent bypass.
+rm -f /tmp/maxy-agent-create-state.json
+rm -f "$ACCOUNT_DIR/.claude/agent-create-state.json" 2>/dev/null || true
+
+# Always overwrite — Rubytech-controlled. Project-level settings take
+# precedence over global, so each account is properly isolated.
+#
+# Hook commands use $PLATFORM_ROOT (set by claude-agent.ts at spawn time)
+# to locate scripts relative to the platform installation, not the account dir.
+# $ACCOUNT_DIR is also available for hooks that need the account path.
+#
+# Hooks wired:
+#   SessionStart  — session-start.sh: IDENTITY loading + agent-creation state recovery
+#   PreToolUse    — pre-tool-use.sh: admin write boundaries
+#                   agent-creation-gate.sh: blocks Write/Edit/Bash to agent files without approval
+#   PostToolUse   — agent-creation-post.sh: creates gate state on plugin-read of public-agent-manager
+#   UserPromptSubmit — agent-creation-approval.sh: advances gates on user approval
+HOOKS_PATH="\$PLATFORM_ROOT/plugins/admin/hooks"
+cat > "$ACCOUNT_SETTINGS" << SETTINGS_EOF
+{
+  "permissions": {
+    "allow": $MAXY_PERMISSIONS
+  },
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash $HOOKS_PATH/session-start.sh \$ACCOUNT_DIR admin"
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash $HOOKS_PATH/pre-tool-use.sh admin"
+          },
+          {
+            "type": "command",
+            "command": "bash $HOOKS_PATH/agent-creation-gate.sh"
+          }
+        ]
+      },
+      {
+        "matcher": "Edit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash $HOOKS_PATH/pre-tool-use.sh admin"
+          },
+          {
+            "type": "command",
+            "command": "bash $HOOKS_PATH/agent-creation-gate.sh"
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash $HOOKS_PATH/pre-tool-use.sh admin"
+          },
+          {
+            "type": "command",
+            "command": "bash $HOOKS_PATH/agent-creation-gate.sh"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash $HOOKS_PATH/agent-creation-post.sh"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash $HOOKS_PATH/agent-creation-approval.sh"
+          }
+        ]
+      }
+    ]
+  }
+}
+SETTINGS_EOF
+
+# Always overwrite IDENTITY.md — Rubytech-controlled, pure behaviour.
+cp "$TEMPLATES_DIR/agents/admin/IDENTITY.md" "$ACCOUNT_DIR/agents/admin/IDENTITY.md"
+cp "$TEMPLATES_DIR/agents/public/IDENTITY.md" "$ACCOUNT_DIR/agents/public/IDENTITY.md"
+
+# Always overwrite specialist plugin — Rubytech-controlled, not user-editable.
+# Specialists are a Claude Code plugin loaded via --plugin-dir. The plugin lives at
+# accountDir/specialists/ with .claude-plugin/plugin.json and agents/*.md.
+# The admin agent dispatches them as specialists:{name} via the Agent tool.
+cp "$TEMPLATES_DIR/specialists/.claude-plugin/plugin.json" "$ACCOUNT_DIR/specialists/.claude-plugin/plugin.json"
+for specialist in "$TEMPLATES_DIR/specialists/agents/"*.md; do
+  [ -f "$specialist" ] && cp "$specialist" "$ACCOUNT_DIR/specialists/agents/$(basename "$specialist")"
+done
+
+# Clean up stale .claude/agents/*.md from previous seed format.
+# The old format placed specialists here as slash-command agents — that never worked
+# for programmatic dispatch. Safe to remove; .claude/ dir stays for settings.json.
+rm -f "$ACCOUNT_DIR/.claude/agents/"*.md 2>/dev/null || true
+
+# SOUL.md — user-controlled personalisation. Only create if missing. Never overwrite.
+[ -f "$ACCOUNT_DIR/agents/admin/SOUL.md" ] || cp "$TEMPLATES_DIR/agents/admin/SOUL.md" "$ACCOUNT_DIR/agents/admin/SOUL.md"
+[ -f "$ACCOUNT_DIR/agents/public/SOUL.md" ] || cp "$TEMPLATES_DIR/agents/public/SOUL.md" "$ACCOUNT_DIR/agents/public/SOUL.md"
+
+# config.json — user-controlled agent config (model, plugins, status). Only create if missing.
+# Onboarding Step 7 overwrites with the user's choices.
+[ -f "$ACCOUNT_DIR/agents/public/config.json" ] || cp "$TEMPLATES_DIR/agents/public/config.json" "$ACCOUNT_DIR/agents/public/config.json"
+
+# AGENTS.md — specialist registry. Pre-populated from templates, maintained by admin agent at runtime.
+# Always overwrite on re-seed (Rubytech-controlled initial state, like IDENTITY.md).
+# Dispatch format: specialists:{name} via the Agent tool.
+printf '# Installed Specialists\n\nDispatch via the Agent tool with `subagent_type: "specialists:{name}"`.\n\n' > "$ACCOUNT_DIR/agents/admin/AGENTS.md"
+for specialist in "$ACCOUNT_DIR/specialists/agents/"*.md; do
+  [ -f "$specialist" ] || continue
+  # Extract name and description from YAML frontmatter
+  _name=$(sed -n 's/^name: *//p' "$specialist" | head -1)
+  _desc=$(sed -n 's/^description: *"*//p' "$specialist" | sed 's/"$//' | head -1)
+  [ -z "$_name" ] && continue
+  # Skip Phase 1 stubs — not yet functional
+  echo "$_desc" | grep -qi "Phase 1" && continue
+  printf -- '- **specialists:%s**: %s\n' "$_name" "$_desc" >> "$ACCOUNT_DIR/agents/admin/AGENTS.md"
+done
+
+# Create account.json only if it doesn't exist (business config is in the graph).
+# Reads defaults from the template so there is a single source of truth.
+if [ ! -f "$ACCOUNT_DIR/account.json" ]; then
+  TEMPLATE="$TEMPLATES_DIR/account.json"
+  if [ -f "$TEMPLATE" ]; then
+    sed "s/\"accountId\": *\"[^\"]*\"/\"accountId\":\"$ACCOUNT_ID\"/" "$TEMPLATE" \
+      | sed "s/\"tier\": *\"[^\"]*\"/\"tier\":\"solo\"/" \
+      > "$ACCOUNT_DIR/account.json"
+  else
+    echo "ERROR: account.json template not found at $TEMPLATE" >&2
+    exit 1
+  fi
+fi
+
+# Backfill defaultAgent in account.json if missing (existing accounts pre-Task 108).
+# Uses the first non-admin agent directory that has a config.json.
+if [ -f "$ACCOUNT_DIR/account.json" ] && ! grep -q '"defaultAgent"' "$ACCOUNT_DIR/account.json"; then
+  _DEFAULT_SLUG=""
+  for _AGENT_DIR in "$ACCOUNT_DIR/agents"/*/; do
+    _AGENT_NAME="$(basename "$_AGENT_DIR")"
+    [ "$_AGENT_NAME" = "admin" ] && continue
+    [ -f "$_AGENT_DIR/config.json" ] && { _DEFAULT_SLUG="$_AGENT_NAME"; break; }
+  done
+  if [ -n "$_DEFAULT_SLUG" ]; then
+    # Insert defaultAgent before the closing brace
+    sed -i'' "s/}$/,\"defaultAgent\":\"$_DEFAULT_SLUG\"}/" "$ACCOUNT_DIR/account.json"
+    echo "  Backfilled defaultAgent=$_DEFAULT_SLUG in account.json"
+  fi
+fi
+
+echo "  Account $ACCOUNT_ID at $ACCOUNT_DIR"
+
+# ------------------------------------------------------------------
+# 2. Apply Neo4j schema (constraints + indexes only)
+# ------------------------------------------------------------------
+if ! command -v "$CYPHER_SHELL" &> /dev/null; then
+    echo "Error: cypher-shell not found. Install Neo4j or add cypher-shell to PATH."
+    exit 1
+fi
+
+echo "==> Connecting to Neo4j at $NEO4J_URI as $NEO4J_USER"
+
+echo "==> Applying schema (constraints, indexes, vector indexes)..."
+"$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" \
+    -f "$NEO4J_DIR/schema.cypher"
+
+echo "  Done."