@rubytech/create-sitedesk-code 0.1.340

package/dist/init-logging.js

@@ -0,0 +1,28 @@
+// Installer log-file initialization with diagnostic stderr emission on
+// failure. Extracted from index.ts so the failure path can be covered by
+// node:test without bringing in the rest of the installer's import-time side
+// effects.
+//
+// (maxy-code) — operator-observed silent exit between
+// `mkdirSync(LOG_DIR)` and the first `appendFileSync(LOG_FILE, header)`.
+// Both writes are guarded inside the same try/catch; a failure emits a
+// literal `[create-maxy] init-logging FAILED reason=<msg> log=<path>
+// persist=<path>` line to stderr and exits 1 so the operator always has a
+// forensic surface regardless of whether the log file ever opened.
+import { mkdirSync as realMkdirSync, appendFileSync as realAppendFileSync, } from "node:fs";
+export function runInitLogging(opts) {
+    const mkdir = opts.mkdirSyncImpl ?? ((p, o) => { realMkdirSync(p, o); });
+    const append = opts.appendFileSyncImpl ?? ((p, d) => { realAppendFileSync(p, d); });
+    const stderr = opts.stderrWriteImpl ?? ((c) => { process.stderr.write(c); });
+    const exit = opts.exitImpl ?? ((c) => { process.exit(c); });
+    try {
+        mkdir(opts.logDir, { recursive: true });
+        append(opts.logFile, opts.headerLines.join("\n") + "\n");
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        stderr(`[create-maxy] init-logging FAILED reason=${msg} log=${opts.logFile} persist=${opts.persistDir}\n`);
+        exit(1);
+        return;
+    }
+}

package/dist/install-immutability.js

@@ -0,0 +1,59 @@
+// Task 848 — OS-level platform boundary. After the installer deploys the
+// platform, three trees are made immutable with `chattr +i` so a
+// confused-but-compliant agent (same user, running under `bypassPermissions`)
+// cannot hand-edit platform code — writes fail with EPERM and the agent reports
+// the platform defect instead of patching the box:
+//   - server/          the built server bundle (Task 843, the incident target)
+//   - platform/        plugin code, scripts, templates, channel-service dist
+//   - premium-plugins/ premium bundle source
+//
+// platform/config/ is the sole runtime-writable subpath under a frozen root
+// (the booting server writes .<hostname>-version there; it also holds brand.json,
+// the chromium path, and the neo4j password), so it is un-frozen last — after its
+// `+i` parent, since immutability is per-inode and a `-i` child dir stays
+// writable. Linux/ext4 only — `chattr` does not exist on darwin, so off-Linux
+// platforms emit nothing and the deploy step is a no-op. This module is pure: it
+// returns the privileged argv but never executes it; the caller runs unprotect
+// before the deploy wipe on upgrade and protect as the final install action.
+import { join } from "node:path";
+/** Install-relative roots frozen immutable, in apply order. */
+const PROTECTED_ROOTS = ["server", "platform", "premium-plugins"];
+/** Install-relative subpaths under a frozen root that the running platform
+ *  writes to, so they are un-frozen after the roots are frozen. */
+const WRITABLE_EXCLUSIONS = ["platform/config"];
+/** `chattr -R +i` each protected root, then `chattr -R -i` each writable
+ *  exclusion; [] on any non-Linux platform. */
+export function protectCommands(installDir, platform) {
+    if (platform !== "linux")
+        return [];
+    const cmds = PROTECTED_ROOTS.map((root) => ({
+        command: "chattr",
+        args: ["-R", "+i", join(installDir, root)],
+    }));
+    for (const sub of WRITABLE_EXCLUSIONS) {
+        cmds.push({ command: "chattr", args: ["-R", "-i", join(installDir, sub)] });
+    }
+    return cmds;
+}
+/** `chattr -R -i` each protected root; [] on any non-Linux platform.
+ *  A writable exclusion needs no separate entry: the recursive `-i` on its
+ *  parent root descends into it and clears the flag. */
+export function unprotectCommands(installDir, platform) {
+    if (platform !== "linux")
+        return [];
+    return PROTECTED_ROOTS.map((root) => ({
+        command: "chattr",
+        args: ["-R", "-i", join(installDir, root)],
+    }));
+}
+/** True iff an `lsattr -d <path>` output line shows the immutable ('i') flag.
+ *  `lsattr -d` prints "<flags> <path>"; the immutable attribute uniquely
+ *  occupies the lowercase-'i' position in the flag field, so a substring test on
+ *  the first whitespace-delimited token is exact. Used to verify a freeze took:
+ *  `chattr -R` exits nonzero on the benign symlinks/special files an npm tree
+ *  always contains, so its aggregate exit code is not a reliable success signal —
+ *  re-reading the target's own immutable bit is. */
+export function lsattrShowsImmutable(lsattrLine) {
+    const flags = lsattrLine.trim().split(/\s+/)[0] ?? "";
+    return flags.includes("i");
+}

package/dist/launchd-plist.js

@@ -0,0 +1,68 @@
+// pure plist XML rendering for the macOS LaunchAgent supervisor.
+// Mirrors the apt-resolve.ts / port-resolution.ts pattern: inputs in, decision
+// out, no I/O. The installer wraps this with writeFileSync + spawnSync(
+// "launchctl", ["bootstrap", `gui/${uid}`, plistPath]) — all spawn/fs lives in
+// index.ts so this module can be unit-tested with concrete fixtures and no
+// side effects.
+//
+// The Linux supervisor (systemd-user persistent unit at
+// `~/.config/systemd/user/<service>.service`) has no analogue here: launchd's
+// LaunchAgent format is a property-list XML document at
+// `~/Library/LaunchAgents/<label>.plist`, and the bootstrap-into-domain flow
+// uses launchctl(1) instead of systemctl. Both supervisors achieve the same
+// success-criteria set: process registered with the user's session manager,
+// auto-restart on crash, restart on logout/login, RunAtLoad on reboot.
+/**
+ * Escape the five XML predefined entities, in order. Order matters: replace
+ * `&` first so an input of `<` doesn't double-escape via the `&` produced by
+ * the `<` rule. The output is safe to embed inside an XML <string> element.
+ */
+function xmlEscape(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&apos;");
+}
+/**
+ * Render a launchd LaunchAgent plist as XML. Pure: same input → same output
+ * forever. The caller writes this to `~/Library/LaunchAgents/<label>.plist`
+ * with mode 0644 and then runs `launchctl bootstrap gui/$UID <path>`.
+ *
+ * The output is the canonical plist 1.0 form launchd accepts — XML preamble,
+ * PLIST PUBLIC DOCTYPE, <plist version="1.0"> wrapping a single <dict>. Key
+ * order inside the dict mirrors Apple's LaunchAgent examples for grep-ability:
+ * Label, ProgramArguments, StandardOutPath, StandardErrorPath, [WorkingDirectory,]
+ * KeepAlive, RunAtLoad.
+ */
+export function renderPlist(spec) {
+    const lines = [];
+    lines.push(`<?xml version="1.0" encoding="UTF-8"?>`);
+    lines.push(`<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">`);
+    lines.push(`<plist version="1.0">`);
+    lines.push(`<dict>`);
+    lines.push(`  <key>Label</key>`);
+    lines.push(`  <string>${xmlEscape(spec.label)}</string>`);
+    lines.push(`  <key>ProgramArguments</key>`);
+    lines.push(`  <array>`);
+    for (const arg of spec.programArguments) {
+        lines.push(`    <string>${xmlEscape(arg)}</string>`);
+    }
+    lines.push(`  </array>`);
+    lines.push(`  <key>StandardOutPath</key>`);
+    lines.push(`  <string>${xmlEscape(spec.stdoutPath)}</string>`);
+    lines.push(`  <key>StandardErrorPath</key>`);
+    lines.push(`  <string>${xmlEscape(spec.stderrPath)}</string>`);
+    if (spec.workingDirectory !== undefined) {
+        lines.push(`  <key>WorkingDirectory</key>`);
+        lines.push(`  <string>${xmlEscape(spec.workingDirectory)}</string>`);
+    }
+    lines.push(`  <key>KeepAlive</key>`);
+    lines.push(`  ${spec.keepAlive ? "<true/>" : "<false/>"}`);
+    lines.push(`  <key>RunAtLoad</key>`);
+    lines.push(`  ${spec.runAtLoad ? "<true/>" : "<false/>"}`);
+    lines.push(`</dict>`);
+    lines.push(`</plist>`);
+    return lines.join("\n") + "\n";
+}

package/dist/lib/plugin-install.js

@@ -0,0 +1,126 @@
+// Pure-function support for the installer's plugin-install loop. The runtime
+// callers in src/index.ts wrap these with the actual `spawnSync` / fs reads;
+// keeping the logic side-effect-free here makes the install / configure
+// branches unit-testable without stubbing every shell invocation.
+/**
+ * `claude plugin list` prints rows like:
+ *   ❯ work@maxy-platform
+ *     Version: 0.1.0
+ *     Scope: local
+ *
+ * Parse the `<name>@<marketplace>` line so the installer can skip already-
+ * installed plugins. Plugins whose row lacks the `@` suffix (legacy
+ * installer state) are returned with marketplace='' so a name-only check
+ * still de-dupes.
+ */
+export function parsePluginList(stdout) {
+    const out = [];
+    for (const raw of stdout.split("\n")) {
+        const line = raw.replace(/^\s*❯\s+/, "").trim();
+        if (!line || !/^[a-z0-9][a-z0-9-]*(@[a-zA-Z0-9-]+)?$/.test(line))
+            continue;
+        const atIdx = line.indexOf("@");
+        if (atIdx < 0)
+            out.push({ name: line, marketplace: "" });
+        else
+            out.push({ name: line.slice(0, atIdx), marketplace: line.slice(atIdx + 1) });
+    }
+    return out;
+}
+/**
+ * Given the desired plugins, what's already installed, and which marketplaces
+ * are directory sources, classify each desired plugin into one of three
+ * buckets:
+ *
+ *   - `toResync`         — already installed AND from a directory-source
+ *                          marketplace. Directory marketplaces change content
+ *                          in place with no version bump, so `claude plugin
+ *                          install`/`update` short-circuit on the pinned
+ *                          version and never refresh the runtime cache snapshot
+ *                          (Task 643). These must be uninstalled then installed
+ *                          to rebuild the snapshot from the live tree.
+ *   - `alreadyInstalled` — already installed AND from a remote (version-pinned)
+ *                          marketplace. Keeps the original idempotent skip.
+ *   - `toInstall`        — not installed yet. A fresh install builds a correct
+ *                          cache snapshot, so directory-source and remote
+ *                          plugins are handled identically here.
+ *
+ * "Already installed" matches either the exact `<name>@<marketplace>` tuple OR
+ * a row with the same name and any marketplace (legacy install state). The
+ * directory-source decision is keyed on the marketplace name regardless of
+ * which form matched, so a legacy name-only row for a directory plugin still
+ * resyncs.
+ */
+export function computeInstallActions(desired, installed, directorySourceMarketplaces) {
+    const byName = new Map();
+    for (const i of installed) {
+        if (!byName.has(i.name))
+            byName.set(i.name, new Set());
+        byName.get(i.name).add(i.marketplace);
+    }
+    const toInstall = [];
+    const toResync = [];
+    const alreadyInstalled = [];
+    for (const d of desired) {
+        const marketplaces = byName.get(d.name);
+        const isInstalled = !!marketplaces && (marketplaces.has(d.marketplace) || marketplaces.has(""));
+        const isDirectorySource = directorySourceMarketplaces.has(d.marketplace);
+        if (isInstalled && isDirectorySource) {
+            toResync.push(d);
+        }
+        else if (isInstalled) {
+            alreadyInstalled.push(d);
+        }
+        else {
+            toInstall.push(d);
+        }
+    }
+    return { toInstall, toResync, alreadyInstalled };
+}
+/**
+ * After a directory-source resync (uninstall+install), confirm every resynced
+ * plugin is registered again. The resync installs at `--scope user`, so a
+ * plugin counts as registered only when its `name@marketplace` key carries a
+ * `scope: "user"` entry in installed_plugins.json. Returns the subset of
+ * `resynced` that is NOT so registered: a non-empty result means the
+ * uninstall+install pair left a plugin deregistered and the install must abort
+ * (Task 645). An unreadable installed_plugins.json is passed as {} by the
+ * caller, so every resynced ref is reported here.
+ */
+export function findUnregisteredResyncs(resynced, installedPluginsMap) {
+    return resynced.filter(ref => {
+        const entries = installedPluginsMap[`${ref.name}@${ref.marketplace}`] ?? [];
+        return !entries.some(e => e.scope === "user");
+    });
+}
+/** Brand-config validator. brand.json#externalPlugins is optional; when
+ *  present, each entry must declare name + marketplace as non-empty
+ *  strings. Other fields are optional. Returns a normalised array; throws
+ *  on any malformed entry (loud failure at install time beats silent
+ *  drop). */
+export function parseExternalPlugins(raw) {
+    if (raw === undefined || raw === null)
+        return [];
+    if (!Array.isArray(raw)) {
+        throw new Error("brand.json#externalPlugins must be an array");
+    }
+    const out = [];
+    for (const entry of raw) {
+        if (!entry || typeof entry !== "object") {
+            throw new Error("brand.json#externalPlugins entries must be objects");
+        }
+        const e = entry;
+        if (typeof e.name !== "string" || e.name.length === 0) {
+            throw new Error("brand.json#externalPlugins entry missing 'name'");
+        }
+        if (typeof e.marketplace !== "string" || e.marketplace.length === 0) {
+            throw new Error(`brand.json#externalPlugins[${e.name}] missing 'marketplace'`);
+        }
+        const ref = { name: e.name, marketplace: e.marketplace };
+        if (e.channelPlugin === true) {
+            ref.channelPlugin = true;
+        }
+        out.push(ref);
+    }
+    return out;
+}

package/dist/lib/premium-mcp-discover.js

@@ -0,0 +1,41 @@
+// Pure premium-plugin MCP directory discovery.
+//
+// Two shapes:
+//
+//   Standalone:   <installDir>/premium-plugins/<bundle>/mcp/package.json
+//   Bundle sub:   <installDir>/premium-plugins/<bundle>/plugins/<plugin>/mcp/package.json
+//
+// Recursive walks would match nested dirs that aren't real MCP plugins;
+// the explicit walk eliminates that class of false positive. Each level
+// is gated on isDirectory() before descending, so a stray file at any
+// level is ignored.
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+export function findPremiumMcpDirs(installDir) {
+    const root = join(installDir, "premium-plugins");
+    if (!existsSync(root))
+        return [];
+    const out = [];
+    for (const bundle of readdirSync(root, { withFileTypes: true })) {
+        if (!bundle.isDirectory())
+            continue;
+        // Standalone shape: premium-plugins/<bundle>/mcp/
+        const standaloneMcp = join(root, bundle.name, "mcp");
+        if (existsSync(join(standaloneMcp, "package.json"))) {
+            out.push(standaloneMcp);
+        }
+        // Bundle-sub shape: premium-plugins/<bundle>/plugins/<plugin>/mcp/
+        const pluginsRoot = join(root, bundle.name, "plugins");
+        if (!existsSync(pluginsRoot))
+            continue;
+        for (const plugin of readdirSync(pluginsRoot, { withFileTypes: true })) {
+            if (!plugin.isDirectory())
+                continue;
+            const mcpDir = join(pluginsRoot, plugin.name, "mcp");
+            if (!existsSync(join(mcpDir, "package.json")))
+                continue;
+            out.push(mcpDir);
+        }
+    }
+    return out.sort();
+}

package/dist/macos-version.js

@@ -0,0 +1,53 @@
+// pure macOS-version classification for the installer.
+//
+// The installer needs two darwin facts at pre-flight: the macOS version (from
+// `sw_vers`) and whether that version meets the floor required by Tasks 838
+// (modern `launchctl bootstrap gui/$UID …`) and 839 (Apple-Silicon Homebrew).
+// Older macOS partially succeeds, then breaks at the supervisor or brew-cellar
+// layer with cryptic errors — refusing loudly at pre-flight is the contract.
+//
+// Pure logic with no I/O — caller spawns `sw_vers`, captures stdout, and feeds
+// it through parseSwVers + isSupportedMacosVersion. Mirrors the apt-resolve.ts
+// pattern: inputs in, decision out, every branch testable with
+// real captured fixtures.
+/**
+ * Parse the stdout of macOS's `sw_vers` command. Real output has the shape:
+ *
+ *   ProductName: macOS
+ *   ProductVersion: 14.4.1
+ *   BuildVersion: 23E224
+ *
+ * Returns null when either ProductName or ProductVersion is absent — the
+ * caller treats null as "refuse with malformed-stdout diagnostic" rather than
+ * silently coercing to undefined and producing a confusing version check.
+ */
+export function parseSwVers(stdout) {
+    const productMatch = stdout.match(/^ProductName:\s*(.+)$/m);
+    const versionMatch = stdout.match(/^ProductVersion:\s*(.+)$/m);
+    if (!productMatch || !versionMatch)
+        return null;
+    return {
+        product: productMatch[1].trim(),
+        version: versionMatch[1].trim(),
+    };
+}
+/**
+ * True when `version`'s major component is ≥ 14 (the floor required by Tasks
+ * 838 + 839). Returns false for empty strings, non-numeric leading components,
+ * and any major < 14. A numeric-only check is sufficient — Apple's published
+ * macOS versions use a strict `MAJOR.MINOR[.PATCH]` integer scheme.
+ */
+export function isSupportedMacosVersion(version) {
+    const m = version.match(/^(\d+)\./);
+    if (!m) {
+        // Fall back to whole-version-as-integer for the macOS 14.0 / 15 form
+        // where the leading number isn't followed by a dot. Defence in depth —
+        // the regex above already handles "14.0", but a bare "14" should also
+        // pass.
+        const bare = version.match(/^(\d+)$/);
+        if (!bare)
+            return false;
+        return parseInt(bare[1], 10) >= 14;
+    }
+    return parseInt(m[1], 10) >= 14;
+}

package/dist/peer-brand-detect.js

@@ -0,0 +1,39 @@
+// pure peer-brand detection. Extracted from index.ts so the
+// "should we leave the system neo4j.service alone?" decision can be unit-
+// tested with concrete `.env` fixtures, no fs reads. Mirrors the apt-resolve
+// / port-resolution pattern: inputs in, decision out, no I/O.
+//
+// The installer's `setupDedicatedNeo4j()` wraps this with the fs reads of
+// `~/.<peer>/.env` and the `console.error` warning on read failure. This
+// module owns only the parsing + matching rule.
+/**
+ * Decide whether any peer brand on the same host depends on the apt-installed
+ * `neo4j.service` (port `defaultNeo4jPort`, conventionally 7687). Returns the
+ * first matching peer brand's hostname, or `null` if no peer pins that port.
+ *
+ * `peerEnvContents` is an iterable of `[hostname, envContent | null]` pairs.
+ * `null` content means the peer's `.env` is absent or unreadable — treated
+ * the same as "no evidence of dependency". The wrapper logs the read failure;
+ * this module stays decision-only.
+ *
+ * Matching rule: a peer pins the default port iff its `.env` contains a line
+ * matching `NEO4J_URI=bolt://localhost:<defaultNeo4jPort>` exactly. Any other
+ * scheme, host, or port → not a match. Self-references (peer hostname equal
+ * to the current install's hostname) are silently skipped so the caller can
+ * pass the full known-brand list without filtering first.
+ */
+export function findPeerBrandOnDefaultNeo4jPort(args) {
+    const { currentBrandHostname, defaultNeo4jPort, peerEnvContents } = args;
+    const expected = `bolt://localhost:${defaultNeo4jPort}`;
+    for (const [hostname, content] of peerEnvContents) {
+        if (hostname === currentBrandHostname)
+            continue;
+        if (content === null)
+            continue;
+        const match = content.match(/^NEO4J_URI=(.+)$/m);
+        if (match && match[1].trim() === expected) {
+            return hostname;
+        }
+    }
+    return null;
+}

package/dist/permissions-seed.js

@@ -0,0 +1,147 @@
+// Task 583 / Task 664 — Seed Claude Code's permission block so claude.ai/code
+// sessions never fall through to the Anthropic remote auto-classifier. The
+// classifier routes `Agent`/`Task` to `ask`, which surfaces as a permission
+// prompt that an unattended operator never clicks — observed as 4-minute
+// dead-air hangs on realagent-code.
+//
+// `defaultMode: "bypassPermissions"` is the load-bearing key: it resolves to
+// skip_all_permission_checks before any allow/deny matching, short-circuiting
+// Stage 1 for every tool. The Task 583 belt-and-suspenders `allow: ["*"]` was
+// redundant and is now actively rejected by Claude Code >= 2.1.167: `"*"` is
+// not a legal allow token, so the CLI renders a blocking "Settings Warning"
+// screen that, under `--remote-control` in a PTY, no operator dismisses — the
+// stdout bind banner never prints and every rc-spawn times out (Task 664).
+// The allow array is therefore empty and MUST stay "*"-free.
+//
+// Task 739 — this module also seeds an `autoMode` block. When a session is
+// toggled to `auto` permission mode at runtime (a shift-tab in claude.ai/code,
+// leaving bypass), the harness auto-classifier wakes up and soft-denies the
+// doctrine-sanctioned Cloudflare token mint/persist as a credential
+// escalation, because the install's own Cloudflare infrastructure is not in
+// the classifier's trusted environment out of the box. The autoMode block
+// declares that infrastructure trusted and the scoped token mint/persist
+// sanctioned, with `"$defaults"` retained first in both arrays so the
+// built-in exfiltration / force-push / prod-deploy guards stay intact. It is
+// belt-and-suspenders: bypassPermissions skips the classifier entirely, so
+// this block only takes effect when a session has left bypass for auto. The
+// classifier reads `autoMode` only from user-scope settings (this file),
+// never from a shared project settings.json, so this is the only seed surface.
+//
+// This module is the single writer for the brand-scoped settings.json
+// permissions and autoMode blocks. Account-scoped settings.json is written by
+// platform/scripts/setup-account.sh in lockstep with the permissions block
+// (the classifier ignores autoMode there, so it carries no autoMode block).
+import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+export const BYPASS_PERMISSIONS_BLOCK = Object.freeze({
+    defaultMode: "bypassPermissions",
+    allow: [],
+    deny: [],
+});
+// Task 739 — the auto-mode trust block. Each array leads with "$defaults" so
+// the harness's built-in environment scope and allow rules are inherited, not
+// replaced; the appended entries add this install's own Cloudflare surface on
+// top. The prose is the v3 block validated on the laptop with
+// `claude auto-mode config`/`critique` (2.1.169), with the one laptop-specific
+// absolute path removed in favour of a relationship phrase so the block ships
+// identically to every brand and machine. `<id>` stays a literal path segment:
+// this brand-scoped file is shared by every account in the install, so the
+// placeholder correctly denotes "the requesting account's own dir" while the
+// "never cross-account" clause does the enforcement.
+export const AUTO_MODE_BLOCK = Object.freeze({
+    environment: Object.freeze([
+        "$defaults",
+        "Organization: a Maxy Code admin agent that operates this single brand's OWN infrastructure. This install's own working tree and the per-account data dirs under data/accounts/<id>/ are its own scope.",
+        "api.cloudflare.com is the intended provider endpoint for Cloudflare API tokens held in this install. Sending those tokens to api.cloudflare.com is a Standard Credentials action. api.cloudflare.com is NOT a trusted destination for repo content, secrets, or bulk file uploads — the Data Exfiltration hard block applies normally to any such content (private-source files, secrets, Workers scripts or D1 dumps that embed secrets, whole-tree uploads).",
+    ]),
+    allow: Object.freeze([
+        "$defaults",
+        "Cloudflare token provisioning: minting a Cloudflare API token for THIS account's own zone/account, scoped to one of {Zone DNS edit, Pages, D1, Workers Scripts, Access apps/policies}, is sanctioned provisioning for the install's own infrastructure. Covered: POST to /accounts/{id}/tokens or /zones/{zone}/tokens where the request body's policies / permission-groups are visible in the transcript and limited to the named scopes, plus listing or revoking this account's own tokens. If the scope cannot be verified from the transcript, or is broader than the named scopes (e.g. account-wide Edit or Global API Key), treat as a Permission Grant soft block. Token creation where the agent inferred the scope from tool output rather than explicit instruction is NOT covered.",
+        "Cloudflare token persistence: writing this account's own narrowly-scoped Cloudflare API tokens (as minted above) to that same account's secrets directory data/accounts/<id>/secrets/ is intended local persistence, not Credential Leakage — scoped to this account's own Cloudflare service tokens, never to any .claude/ config path, and never cross-account.",
+    ]),
+});
+function isPermissionsCorrect(permissions) {
+    if (!permissions || typeof permissions !== "object")
+        return false;
+    const p = permissions;
+    if (p.defaultMode !== "bypassPermissions")
+        return false;
+    // Require an empty allow array. A "*"-bearing file (the pre-664 seed) is no
+    // longer correct, so this returns false and forces a rewrite on upgrade.
+    if (!Array.isArray(p.allow) || p.allow.length !== 0)
+        return false;
+    if (!Array.isArray(p.deny) || p.deny.length !== 0)
+        return false;
+    return true;
+}
+function stringArraysEqual(a, b) {
+    if (!Array.isArray(a) || a.length !== b.length)
+        return false;
+    return a.every((v, i) => v === b[i]);
+}
+function isAutoModeCorrect(autoMode) {
+    if (!autoMode || typeof autoMode !== "object")
+        return false;
+    const a = autoMode;
+    return (stringArraysEqual(a.environment, AUTO_MODE_BLOCK.environment) &&
+        stringArraysEqual(a.allow, AUTO_MODE_BLOCK.allow));
+}
+function freshAutoModeBlock() {
+    return {
+        environment: [...AUTO_MODE_BLOCK.environment],
+        allow: [...AUTO_MODE_BLOCK.allow],
+    };
+}
+export function seedBypassPermissionsSettings(configDir) {
+    const settingsPath = join(configDir, "settings.json");
+    let existing = {};
+    if (existsSync(settingsPath)) {
+        const text = readFileSync(settingsPath, "utf-8");
+        if (text.trim().length > 0) {
+            try {
+                const parsed = JSON.parse(text);
+                if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                    existing = parsed;
+                }
+            }
+            catch {
+                // Malformed JSON: treat as empty and overwrite with a well-formed
+                // file containing only the permissions and autoMode blocks. Any keys
+                // the prior file carried are unrecoverable from invalid JSON anyway.
+            }
+        }
+    }
+    const permissionsOk = isPermissionsCorrect(existing.permissions);
+    const autoModeOk = isAutoModeCorrect(existing.autoMode);
+    if (permissionsOk && autoModeOk) {
+        return { action: "noop", autoMode: "present", path: settingsPath };
+    }
+    mkdirSync(dirname(settingsPath), { recursive: true });
+    const merged = {
+        ...existing,
+        permissions: { ...BYPASS_PERMISSIONS_BLOCK, allow: [...BYPASS_PERMISSIONS_BLOCK.allow], deny: [] },
+        autoMode: freshAutoModeBlock(),
+    };
+    const tmpPath = `${settingsPath}.task583.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(merged, null, 2) + "\n");
+    renameSync(tmpPath, settingsPath);
+    return { action: "seeded", autoMode: autoModeOk ? "present" : "seeded", path: settingsPath };
+}
+export function assertBypassPermissionsSeed(configDir) {
+    const settingsPath = join(configDir, "settings.json");
+    if (!existsSync(settingsPath))
+        return { status: "missing", path: settingsPath };
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(settingsPath, "utf-8"));
+    }
+    catch {
+        return { status: "missing", path: settingsPath };
+    }
+    if (!parsed || typeof parsed !== "object")
+        return { status: "missing", path: settingsPath };
+    const record = parsed;
+    return isPermissionsCorrect(record.permissions) && isAutoModeCorrect(record.autoMode)
+        ? { status: "ok", path: settingsPath }
+        : { status: "missing", path: settingsPath };
+}

package/dist/pinned-binaries.js

@@ -0,0 +1,12 @@
+// Pinned upstream binaries installed by the Linux provisioner.
+//
+// removed the ttyd pin along with the embedded-terminal admin
+// stack. If a future installer step needs to download a pinned binary
+// (as ttyd did, because Debian Bookworm's apt does not carry it), the
+// conventions live here: version constant, SHA256-by-arch map, and a
+// `mapUnameToArch` helper plus a `downloadUrl` builder. SHA256 mismatch
+// must abort with a loud error and never write bytes — no silent
+// install of unverified content. This file is currently empty of
+// entries; it is kept as the canonical location for when the next
+// upstream-pinned binary is added.
+export {};

package/dist/platform-detect.js

@@ -0,0 +1,36 @@
+// wedge — pure platform classification for the installer.
+//
+// The installer's existing `isLinux()` checks (26 sites in index.ts) collapse
+// process.platform into a boolean and treat every non-Linux value as "skip
+// silently." Follow-up tasks 838/839/840 widen that to an explicit ternary
+// (linux | darwin | unsupported) so unsupported targets refuse loudly with a
+// log line operators can grep, instead of completing in a non-functional state.
+//
+// This module ships dead until those follow-ups land. Pure logic with no I/O —
+// caller injects process.platform so tests pass arbitrary fixtures without
+// touching the host's actual platform.
+/**
+ * Classify a Node process.platform value into the ternary the installer cares
+ * about. Anything not in { linux, darwin } returns "unsupported"; the caller
+ * decides whether to refuse the install or no-op.
+ */
+export function detectPlatform(nodePlatform) {
+    if (nodePlatform === "linux")
+        return "linux";
+    if (nodePlatform === "darwin")
+        return "darwin";
+    return "unsupported";
+}
+/**
+ * Narrow a Node process.platform to a SupportedPlatform or throw with the
+ * literal refusal message follow-up tasks log + grep on. Use this at install
+ * pre-flight where continuing on an unsupported OS would silently complete a
+ * broken install.
+ */
+export function requireSupportedPlatform(nodePlatform) {
+    const detected = detectPlatform(nodePlatform);
+    if (detected === "unsupported") {
+        throw new Error(`[create-maxy] platform=${nodePlatform} — refusing: only linux and darwin are supported`);
+    }
+    return detected;
+}