@rubytech/create-sitedesk-code 0.1.387 → 0.1.388

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-sitedesk-code",
-  "version": "0.1.387",
+  "version": "0.1.388",
   "description": "Install SiteDesk — automated back office for independent building contractors",
   "bin": {
     "create-sitedesk-code": "./dist/index.js"

package/payload/platform/config/brand.json

@@ -15,7 +15,7 @@
   "claudeSessionManagerPort": 19402,
   "commercialMode": false,
   "vertical": "schema-construction",
-  "shipsPremiumBundles": ["venture-studio", "writer-craft", "teaching", "sitedesk"],
+  "shipsPremiumBundles": ["sitedesk"],
   "primaryContainer": { "label": "Job", "term": "Jobs" },
 
   "defaultColors": {
@@ -53,9 +53,9 @@
 
   "plugins": {
     "core": ["admin", "memory", "docs", "cloudflare", "anthropic", "workflows", "work", "scheduling", "email", "contacts", "projects", "prompt-optimiser", "browser"],
-    "defaultEnabled": ["business-assistant", "sales"],
+    "defaultEnabled": ["business-assistant"],
     "available": ["connector", "telegram", "deep-research", "whatsapp", "replicate", "linkedin-import", "notion-import", "obsidian-import", "x-import", "slides"],
-    "excluded": []
+    "excluded": ["sales"]
   },
 
   "externalPlugins": [

package/payload/platform/plugins/.claude-plugin/marketplace.json

@@ -119,11 +119,6 @@
       "source": "./replicate",
       "version": "0.1.0"
     },
-    {
-      "name": "sales",
-      "source": "./sales",
-      "version": "0.1.0"
-    },
     {
       "name": "scheduling",
       "source": "./scheduling",

package/payload/platform/plugins/whatsapp/references/channels-whatsapp.md

@@ -101,13 +101,15 @@ The platform enforces this at multiple levels:
 | Term | Definition | Code |
 |------|-----------|------|
 | **Self phone** | The WhatsApp account's own phone number (the phone that scanned the QR code). Self-chat only. | `phonesMatch(senderPhone, selfPhone)` in `access-control.ts` |
-| **Admin phones** | Phones listed in `adminPhones` in `account.json`. The user's personal phone is auto-registered on QR link; additional phones are added via `whatsapp-config action: "add-admin-phone"`. Their admin session is scoped to the **house** account. | `isAdminPhone()` in `access-control.ts` — iterates `adminPhones` |
-| **Account managers** | Phones in the `accountManagers` map (`account.json`, phone → sub-account UUID), added via `whatsapp-config action: "add-account-manager"`. Their admin session is scoped to the **bound sub-account**, not the house. Disjoint from `adminPhones` — a phone is a house admin or a sub-account manager, never both. | `managedAccountFor()` in `access-control.ts`; the sub-account scope is applied in `ensureChannelSession` |
+| **Admin phones** | Phones listed in `adminPhones` in `account.json`. The user's personal phone is auto-registered on QR link; additional phones are added via `whatsapp-config action: "add-admin-phone"`. Their admin session is scoped to the **house** account. `adminPhones` is authoritative only on the account that owns the WhatsApp paired socket (the house): `add-admin-phone` is refused on any other account, and a list left on a non-socket (sub-)account is inert and purged at boot with `[admin-identity] op=purge-nonsocket-adminphone`. To answer "is this phone a manager?" read the house account's `adminPhones` + `accountManagers` only — never a sub-account's list. | `isAdminPhone()` in `access-control.ts` — iterates `adminPhones` |
+| **Account managers** | Phones in the `accountManagers` map (`account.json`, phone → sub-account UUID), added via `whatsapp-config action: "add-account-manager"`. Their admin session is scoped to the **bound sub-account**, not the house. Disjoint from `adminPhones` — a phone is a house admin or a sub-account manager, never both. | `managedAccountFor()` in `access-control.ts` resolves the sub-account **once**; `checkDmAccess` returns it as `effectiveAccountId`, and `ensureChannelSession` consumes that value without re-resolving |
 | **Public/unknown** | Any phone that is not self, not in `adminPhones`, and not in `accountManagers`. Subject to DM policy gating. | Everything else in `checkDmAccess()` |
 
 **Critical distinction:** The *self phone* is the paired device's number (the WhatsApp account SiteDesk controls). The *admin phone* is the user's personal phone (the phone they message *from*). These are typically different numbers. If the user's personal phone is not in `adminPhones` or `accountManagers`, their messages route as public — not admin.
 
-**Account-manager scoping — the two-account split.** A designated manager's inbound spawns an admin session scoped to their sub-account (its graph, skills, and `${USER_ID}` attribution). Replies and file delivery still go out over the **house's** paired WhatsApp device — the only WhatsApp socket — so the sub-account scope never redirects the transport. `ensureChannelSession` feeds the effective (sub-account) id to the spawn while keeping the connection (house) account for `startNativeFileFollower` and the reply path. A stale binding (deleted sub-account, or a phone wrongly also on `adminPhones`) is surfaced at boot by `account-manager-drift` and never silently mis-routes.
+**Account-manager scoping — the two-account split.** A designated manager's inbound spawns an admin session scoped to their sub-account (its graph, skills, and `${USER_ID}` attribution). Replies and file delivery still go out over the **house's** paired WhatsApp device — the only WhatsApp socket — so the sub-account scope never redirects the transport. The connection (house) account is kept for `startNativeFileFollower` and the reply path. A stale binding (a phone wrongly also on `adminPhones`) is surfaced at boot by `account-manager-drift` and never silently mis-routes.
+
+**Single source of truth + fail-closed.** The effective account is resolved **exactly once**, in the gate: `checkDmAccess` returns `effectiveAccountId` (the house account for owner/`adminPhones`/public, the bound sub-account for a manager), and that value threads through the inbound payload → gateway → `ensureChannelSession`, which spawns into it **without re-reading** the `accountManagers` map. There is no second resolution and no `?? accountId` house fallback: if a manager's bound sub-account is not a valid account, the inbound is **rejected** (no session spawned, no reply), never routed to the house. This closes the escalation where a divergence between two independent map reads handed a scoped manager a house-owner admin session. Observable signals: `op=account-manager-route … effectiveAccount=… source=gate` on a routed manager inbound; `op=account-manager-reject … reason=unresolved-effective-account` on the fail-closed drop; a standing `op=escalation-tripwire` belt that can only fire if a future change reintroduces the divergence.
 
 **`dmPolicy` behaviour (per-account):**
 

package/payload/platform/plugins/whatsapp/skills/manage-whatsapp-config/SKILL.md

@@ -31,6 +31,8 @@ Call `whatsapp-config action: list-admin-phones` and present the current list. A
 
 Each add/remove fires immediately — admin phones are managed per-action, independent of the form's batch submit.
 
+Admin phones are authoritative only on the account that owns the WhatsApp paired socket (the house). Adding an admin phone always applies to that account; the write is refused on any other account, because a phone in a sub-account's admin list is never consulted. To route a person to a specific sub-account, bind them as an account manager with `add-account-manager` instead — do not read or edit a sub-account's admin list to answer "is this phone a manager?".
+
 **Account managers:**
 
 An account manager is a phone bound to a specific sub-account. Its WhatsApp messages spawn an admin session scoped to that sub-account's agent, not the house. Use this when a person who manages one client sub-account should reach that sub-account's agent over WhatsApp.

package/payload/premium-plugins/.claude-plugin/marketplace.json

@@ -8,21 +8,6 @@
       "name": "sitedesk",
       "source": "./sitedesk",
       "version": "0.1.0"
-    },
-    {
-      "name": "teaching",
-      "source": "./teaching",
-      "version": "0.1.0"
-    },
-    {
-      "name": "venture-studio",
-      "source": "./venture-studio",
-      "version": "0.1.0"
-    },
-    {
-      "name": "writer-craft",
-      "source": "./writer-craft",
-      "version": "0.1.0"
     }
   ]
 }