@rubytech/create-sitedesk-code 0.1.506 → 0.1.508

package/payload/platform/plugins/voice-mirror/PLUGIN.md

@@ -7,18 +7,23 @@ tools:
   - name: voice-tag-content
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: voice-distil-profile
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: voice-retrieve-conditioning
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: voice-record-feedback
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: voice-ingest-session-text
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
 mcp:
   command: node
   args:

package/payload/platform/plugins/whatsapp/PLUGIN.md

@@ -5,39 +5,51 @@ tools:
   - name: whatsapp-login-start
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: whatsapp-login-wait
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: whatsapp-status
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-disconnect
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: whatsapp-config
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: whatsapp-activity
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-conversations
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-messages
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-conversation-graph-state
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-group-info
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: whatsapp-send-admin
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: whatsapp-reply
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
 metadata: {"platform":{"embed":["admin"]}}
 mcp:
   command: node

package/payload/platform/plugins/work/PLUGIN.md

@@ -5,48 +5,63 @@ tools:
   - name: work-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: work-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: work-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: work-get
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: work-relate
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: work-complete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: work-ready
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: session-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: session-name
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: session-metering
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: project-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: project-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: project-get
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: project-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: project-complete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
 metadata: {"platform":{"always":false,"embed":[],"pluginKey":"work"}}
 skills:
   - skills/execute-task/SKILL.md

package/payload/platform/plugins/workflows/PLUGIN.md

@@ -5,27 +5,35 @@ tools:
   - name: workflow-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: workflow-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: workflow-get
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: workflow-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: workflow-delete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: workflow-validate
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: workflow-execute
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: exec
   - name: workflow-runs
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
 metadata: {"platform":{"always":false,"embed":[],"pluginKey":"workflows"}}
 mcp:
   command: node

package/payload/platform/scripts/__tests__/provision-honours-disabled-agents.test.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Task 1996 — an upgrade must not re-deliver an agent the operator switched off.
+#
+# provision_account_dir wipes every core specialist and re-copies it from the
+# bundled templates on every run. Without this, disabling an agent lapses on the
+# next publish: the file reappears in the dispatchable directory, nothing logs,
+# and the card still reads "disabled". That is the no-event failure the task
+# names, so it is pinned here.
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PLAT_SCRIPTS="$SCRIPT_DIR/.."
+PROJECT_DIR="$(cd "$PLAT_SCRIPTS/.." && pwd)"
+TEMPLATES_DIR="$PROJECT_DIR/templates"
+PASS=0; FAIL=0; FAILED=()
+assert_absent() { if [ ! -e "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2: expected absent [$1]"); fi; }
+assert_present() { if [ -e "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2: expected present [$1]"); fi; }
+assert_eq() { if [ "$1" = "$2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected [$2] got [$1]"); fi; }
+
+. "$PLAT_SCRIPTS/lib/provision-account-dir.sh"
+export TEMPLATES_DIR PROJECT_DIR
+export SCRIPT_DIR="$PLAT_SCRIPTS"
+export USERS_FILE="/nonexistent/users.json"
+
+# A real shipped specialist, so the test exercises the same wipe-and-recopy loop
+# a publish runs rather than a synthetic filename.
+DISABLED_AGENT="coding-assistant.md"
+
+T1=$(mktemp -d); A1="$T1/acct"
+provision_account_dir "$A1" "dddddddd-dddd-dddd-dddd-dddddddddddd" "house" >/dev/null 2>&1
+assert_present "$A1/specialists/agents/$DISABLED_AGENT" "baseline-agent-delivered"
+
+# The operator disables it: the file moves to quarantine and the store names it.
+mkdir -p "$A1/specialists/agents-disabled"
+mv "$A1/specialists/agents/$DISABLED_AGENT" "$A1/specialists/agents-disabled/$DISABLED_AGENT"
+printf '{"disabled":["%s"]}\n' "$DISABLED_AGENT" > "$A1/agents-disabled.json"
+
+# The upgrade runs again.
+OUT="$(provision_account_dir "$A1" "dddddddd-dddd-dddd-dddd-dddddddddddd" "house" 2>&1)"
+
+assert_absent "$A1/specialists/agents/$DISABLED_AGENT" "disabled-agent-not-redelivered"
+assert_present "$A1/specialists/agents-disabled/$DISABLED_AGENT" "quarantined-copy-survives-upgrade"
+# Every other core specialist is still delivered: the guard removes what the
+# operator named, not the whole set.
+assert_present "$A1/specialists/agents/librarian.md" "other-agents-still-delivered"
+# The removal is reported, so an operator reading the publish output can see
+# which agents provisioning deliberately withheld.
+assert_eq "$(printf '%s' "$OUT" | grep -c "agents-withheld=1")" "1" "withheld-count-logged"
+rm -rf "$T1"
+
+# No store, no behaviour change: every core specialist is delivered.
+T2=$(mktemp -d); A2="$T2/acct"
+provision_account_dir "$A2" "eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee" "house" >/dev/null 2>&1
+assert_present "$A2/specialists/agents/$DISABLED_AGENT" "no-store-delivers-everything"
+rm -rf "$T2"
+
+# A malformed store withholds nothing rather than withholding everything: an
+# unreadable file is not evidence that the operator disabled an agent.
+T3=$(mktemp -d); A3="$T3/acct"
+provision_account_dir "$A3" "ffffffff-ffff-ffff-ffff-ffffffffffff" "house" >/dev/null 2>&1
+printf '{ not json\n' > "$A3/agents-disabled.json"
+OUT3="$(provision_account_dir "$A3" "ffffffff-ffff-ffff-ffff-ffffffffffff" "house" 2>&1)"
+assert_present "$A3/specialists/agents/$DISABLED_AGENT" "malformed-store-withholds-nothing"
+assert_eq "$(printf '%s' "$OUT3" | grep -c 'agents-disabled-store-unreadable')" "1" "malformed-store-reported"
+rm -rf "$T3"
+
+# Review finding: the withhold used `rm -f` unconditionally. In the drift state
+# the reconcile check exists to catch — store names it, file is live, quarantine
+# empty — that deletes the only copy of a premium `--` agent or an operator-edited
+# override, because the replace loop skips `*--*` and the copy loop only restores
+# templates. Withholding must move, never destroy.
+T4=$(mktemp -d); A4="$T4/acct"
+provision_account_dir "$A4" "aaaa1111-aaaa-1111-aaaa-111111111111" "house" >/dev/null 2>&1
+mkdir -p "$A4/specialists/agents"
+printf -- '---\nname: quoter\n---\n\nOperator edited this premium agent.\n' > "$A4/specialists/agents/sitedesk--quoter.md"
+printf '{"disabled":["sitedesk--quoter.md"]}\n' > "$A4/agents-disabled.json"
+provision_account_dir "$A4" "aaaa1111-aaaa-1111-aaaa-111111111111" "house" >/dev/null 2>&1
+
+assert_absent "$A4/specialists/agents/sitedesk--quoter.md" "premium-withheld-from-dispatch"
+assert_present "$A4/specialists/agents-disabled/sitedesk--quoter.md" "premium-preserved-not-destroyed"
+assert_eq "$(grep -c 'Operator edited this premium agent' "$A4/specialists/agents-disabled/sitedesk--quoter.md" 2>/dev/null || echo 0)" "1" "premium-content-intact"
+rm -rf "$T4"
+
+echo "PASS=$PASS FAIL=$FAIL"
+if [ "$FAIL" -gt 0 ]; then printf '%s\n' "${FAILED[@]}"; exit 1; fi

package/payload/platform/scripts/check-risk-class.mjs

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+// Publish-time gate: flag any `riskClass` declaration that contradicts what the
+// tool's own name says it does.
+//
+// The session manager throws at boot when a riskClass is absent or off-enum
+// (tool-surface.ts 'risk-class-missing' / 'risk-class-invalid'). It cannot
+// catch a class that is present, valid, and wrong — `whatsapp-send` declared
+// `read` parses fine, logs nothing, and stays invisible until a downstream
+// gate acts on it. That is a no-event failure, so it needs a standing check
+// rather than an event.
+//
+// The gate reports; it never rewrites a declaration. A contradiction is
+// resolved either by correcting the manifest or by adding a named exception
+// below with the reason it is not a mistake. An exception whose tool no longer
+// contradicts is itself reported: a suppression that outlives its cause
+// re-creates the blind spot the gate exists to remove.
+
+import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const MAXY_CODE_ROOT = resolve(__dirname, '..', '..')
+
+const PLUGIN_ROOTS = [
+  { root: join(MAXY_CODE_ROOT, 'platform', 'plugins'), depth: 1 },
+  { root: join(MAXY_CODE_ROOT, 'premium-plugins'), depth: 1 },
+  { root: join(MAXY_CODE_ROOT, 'premium-plugins'), depth: 2, mid: 'plugins' },
+]
+
+// A name that says the call sends something outward, declared as if it stays
+// on the device.
+const OUTWARD_SIGNAL = /-(send|reply|publish|deploy|delete|post)\b/
+const OUTWARD_CONTRADICTS = new Set(['read', 'write_local'])
+
+// A name that says the call only looks at something, declared as if it acts.
+const INWARD_SIGNAL = /-(read|list|search|status|info|get)\b/
+const INWARD_CONTRADICTS = new Set(['external', 'exec'])
+
+/** Named exceptions. Each entry suppresses exactly one tool+class pair and
+ *  must carry the reason the name signal is misleading for that tool. */
+const EXCEPTIONS = [
+  {
+    tool: 'joblogic-job-set-status',
+    riskClass: 'external',
+    reason: 'The -status suffix reads as a query, but this sets a job status on the remote JobLogic tenant. external is correct and the name signal is what is wrong here.',
+  },
+  {
+    tool: 'memory-delete',
+    riskClass: 'write_local',
+    reason: 'Soft-deletes a node in the local Neo4j graph. Trashed nodes still resolve by elementId; nothing leaves the device.',
+  },
+  {
+    tool: 'contact-delete',
+    riskClass: 'write_local',
+    reason: 'Removes a contact from the local graph. No remote address book is touched.',
+  },
+  {
+    tool: 'profile-delete',
+    riskClass: 'write_local',
+    reason: 'Removes a profile node from the local graph.',
+  },
+  {
+    tool: 'workflow-delete',
+    riskClass: 'write_local',
+    reason: 'Removes a workflow definition from the local graph. Any run history it produced is untouched.',
+  },
+]
+
+function collectPluginDirs() {
+  const dirs = []
+  for (const spec of PLUGIN_ROOTS) {
+    if (!existsSync(spec.root)) continue
+    for (const entry of readdirSync(spec.root)) {
+      if (entry.startsWith('.')) continue
+      const lvl1 = join(spec.root, entry)
+      if (!statSync(lvl1).isDirectory()) continue
+      if (spec.depth === 1) {
+        dirs.push(lvl1)
+        continue
+      }
+      const mid = join(lvl1, spec.mid)
+      if (!existsSync(mid) || !statSync(mid).isDirectory()) continue
+      for (const sub of readdirSync(mid)) {
+        if (sub.startsWith('.')) continue
+        const lvl2 = join(mid, sub)
+        if (statSync(lvl2).isDirectory()) dirs.push(lvl2)
+      }
+    }
+  }
+  return dirs
+}
+
+/** Independent of tool-surface.ts on purpose: a gate that shares the parser it
+ *  is checking cannot detect that parser drifting.
+ *
+ *  Task 1998 — `hidden:` entries carry the same name+riskClass shape as
+ *  `tools:` entries and are served by the same MCP server, so a hidden tool
+ *  can contradict its own name exactly as a visible one can. Scanning only
+ *  `tools:` would leave eight declarations outside the gate. */
+function declaredTools(manifestPath) {
+  const out = []
+  let current = null
+  let inTools = false
+  for (const line of readFileSync(manifestPath, 'utf8').split(/\r?\n/)) {
+    if (/^(tools|hidden):\s*$/.test(line)) { inTools = true; current = null; continue }
+    if (inTools && /^[A-Za-z_]/.test(line)) inTools = false
+    if (!inTools) continue
+    const name = line.match(/^\s+-\s+name:\s*(.+?)\s*$/)
+    if (name) { current = name[1]; continue }
+    const risk = line.match(/^\s+riskClass:\s*(.+?)\s*$/)
+    if (risk && current) { out.push({ tool: current, riskClass: risk[1].trim() }); current = null }
+  }
+  return out
+}
+
+const contradictions = []
+const matchedExceptions = new Set()
+let scanned = 0
+
+for (const dir of collectPluginDirs()) {
+  const manifest = join(dir, 'PLUGIN.md')
+  if (!existsSync(manifest)) continue
+  for (const { tool, riskClass } of declaredTools(manifest)) {
+    scanned++
+    let signal = null
+    if (OUTWARD_SIGNAL.test(tool) && OUTWARD_CONTRADICTS.has(riskClass)) signal = 'outward-name'
+    if (INWARD_SIGNAL.test(tool) && INWARD_CONTRADICTS.has(riskClass)) signal = 'inward-name'
+    if (!signal) continue
+    const excepted = EXCEPTIONS.find((e) => e.tool === tool && e.riskClass === riskClass)
+    if (excepted) { matchedExceptions.add(`${tool}:${riskClass}`); continue }
+    contradictions.push({ tool, riskClass, signal, plugin: dir.replace(`${MAXY_CODE_ROOT}/`, '') })
+  }
+}
+
+const stale = EXCEPTIONS.filter((e) => !matchedExceptions.has(`${e.tool}:${e.riskClass}`))
+
+for (const c of contradictions) {
+  console.error(`[risk-class] contradiction tool=${c.tool} declared=${c.riskClass} signal=${c.signal} plugin=${c.plugin}`)
+}
+for (const s of stale) {
+  console.error(`[risk-class] stale-exception tool=${s.tool} riskClass=${s.riskClass} — no longer contradicts; remove it from EXCEPTIONS`)
+}
+
+if (contradictions.length > 0 || stale.length > 0) {
+  console.error(`[gate] check-risk-class: FAIL (${contradictions.length} contradiction(s), ${stale.length} stale exception(s), ${scanned} tools scanned)`)
+  process.exit(1)
+}
+
+console.log(`[gate] check-risk-class: PASS (${scanned} tools scanned, ${EXCEPTIONS.length} named exception(s))`)

package/payload/platform/scripts/check-specialist-tool-surface.mjs

@@ -88,8 +88,11 @@ function parsePluginManifest(rawManifest) {
       if (nameLine) { tools.push(nameLine[1]); continue; }
     }
     if (mode === 'hidden') {
-      const item = line.match(/^\s+-\s+(.+?)\s*$/);
-      if (item) hidden.push(item[1]);
+      // Task 1998 — hidden entries carry the same `- name:` + `riskClass:`
+      // shape as tools entries. Names only here; the gate checks membership
+      // of the `all` surface, not consequence.
+      const nameLine = line.match(/^\s+-\s+name:\s*(.+?)\s*$/);
+      if (nameLine) hidden.push(nameLine[1]);
     }
   }
   return { tools, hidden, hasTools };

package/payload/platform/scripts/lib/canonical-tool-names.mjs

@@ -36,9 +36,12 @@ function extractFrontmatter(md) {
   return md.slice(3, end)
 }
 
-// Collect `- name: <x>` entries under a bare `tools:` block and `- <x>` entries
-// under a bare `hidden:` block. Both contribute names a specialist may list in
-// its `tools:` frontmatter, so both belong to the live set.
+// Collect `- name: <x>` entries under a bare `tools:` block and under a bare
+// `hidden:` block. Both contribute names a specialist may list in its `tools:`
+// frontmatter, so both belong to the live set. Task 1998 gave the hidden block
+// the same name+riskClass shape as tools, so the two branches now read alike;
+// this parser stays separate from tool-surface.ts on purpose, so a drift in one
+// shows up as a diff rather than as agreement between a parser and itself.
 function parseToolNames(frontmatter) {
   const lines = frontmatter.split('\n')
   const names = []
@@ -57,7 +60,7 @@ function parseToolNames(frontmatter) {
       const m = line.match(/^\s+-\s+name:\s*(.+?)\s*$/)
       if (m) names.push(m[1])
     } else if (mode === 'hidden') {
-      const m = line.match(/^\s+-\s+(.+?)\s*$/)
+      const m = line.match(/^\s+-\s+name:\s*(.+?)\s*$/)
       if (m) names.push(m[1])
     }
   }

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -29,7 +29,10 @@ provision_account_dir() {
   # Operator-data buckets (entity-anchored, flat) + tool-owned dirs. agents/ and
   # specialists/ are created above. The seeded SCHEMA.md is the single source of
   # the allowed top-level set, parsed at runtime by the fs-schema write guard.
-  local _seed_dirs=(projects contacts documents url-get output generated extracted uploads)
+  # `sites` joins the seed set because it is a home bucket in the /data browser
+  # (HOME_FIXED); an unseeded home bucket is reported by the standing
+  # home-parity audit as missing on every account that has not published a site.
+  local _seed_dirs=(projects contacts documents url-get output generated extracted uploads sites)
   local _d _seeded=0
   for _d in "${_seed_dirs[@]}"; do
     [ -d "$ACCOUNT_DIR/$_d" ] || { mkdir -p "$ACCOUNT_DIR/$_d" && _seeded=$((_seeded+1)); }
@@ -248,6 +251,49 @@ SETTINGS_EOF
     [ -f "$specialist" ] && cp "$specialist" "$ACCOUNT_DIR/specialists/agents/$(basename "$specialist")"
   done
 
+  # Task 1996 — the copy loop above re-delivers every core specialist, which
+  # would silently undo a disable on the next publish. specialists/agents/ is
+  # the dispatchable set (spawn-context.ts reads it), so an agent the operator
+  # switched off is removed again here. The quarantined copy under
+  # specialists/agents-disabled/ is never touched: it is the operator's own
+  # file, and for a premium or edited agent it is the only copy.
+  #
+  # An unreadable store withholds NOTHING. A corrupt file is not evidence that
+  # an agent was disabled, and withholding the whole set on a parse error would
+  # turn a bad byte into a fleet-wide loss of specialists.
+  if [ -f "$ACCOUNT_DIR/agents-disabled.json" ]; then
+    local _disabled_names _withheld=0
+    if _disabled_names="$(python3 -c '
+import json, sys
+with open(sys.argv[1]) as fh:
+    names = json.load(fh)["disabled"]
+if not isinstance(names, list):
+    raise SystemExit(1)
+for n in names:
+    if isinstance(n, str) and n.endswith(".md") and "/" not in n and ".." not in n:
+        print(n)
+' "$ACCOUNT_DIR/agents-disabled.json" 2>/dev/null)"; then
+      local _name
+      while IFS= read -r _name; do
+        [ -n "$_name" ] || continue
+        if [ -e "$ACCOUNT_DIR/specialists/agents/$_name" ]; then
+          # MOVE, never delete. In the drift state the standing parity check
+          # exists to catch (store names it, file is live, quarantine empty) a
+          # delete would destroy the only copy of a premium `--` agent or an
+          # operator-edited override: the replace loop above skips `*--*` and
+          # the copy loop only restores templates, so nothing re-delivers it.
+          mkdir -p "$ACCOUNT_DIR/specialists/agents-disabled"
+          mv -f "$ACCOUNT_DIR/specialists/agents/$_name" \
+                "$ACCOUNT_DIR/specialists/agents-disabled/$_name"
+          _withheld=$((_withheld + 1))
+        fi
+      done <<< "$_disabled_names"
+      echo "  specialists agents-withheld=$_withheld (disabled by operator)"
+    else
+      echo "  specialists agents-disabled-store-unreadable — withholding nothing"
+    fi
+  fi
+
   rm -f "$ACCOUNT_DIR/.claude/agents/"*.md 2>/dev/null || true
 
   # SOUL.md — user-controlled. Only create if missing. Never overwrite.

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.d.ts

@@ -15,7 +15,7 @@ export interface ReconcileResult extends ReconcileCounts {
 /** The single per-run summary line body. A non-zero count is the standing signal
  *  that an agent authored folders the hard guards could not prevent. Pure
  *  formatter so the emitter and its test share one wording. */
-export declare function formatReconcileLine(c: ReconcileCounts, homeMissing?: number, homeUnaudited?: number): string;
+export declare function formatReconcileLine(c: ReconcileCounts, homeMissing?: number, homeUnaudited?: number, agentDrift?: number): string;
 /** Parse the fenced ```allowed-top-level block from an account's SCHEMA.md —
  *  the same structured set fs-schema-guard.sh parses with awk. Returns the
  *  entry names (blank lines dropped). An absent block yields an empty set. */

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-dir-schema-reconcile.d.ts","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AAsFA,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD;;;;;0CAKsC;IACtC,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;+DAE+D;AAC/D,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,SAAI,EAAE,aAAa,SAAI,GAAG,MAAM,CAGlG;AAED;;8EAE8E;AAC9E,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAcpE;AA+ED;;;8EAG8E;AAC9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAoCpE;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B;AAyBD;;;;;;;;;;;;;iCAaiC;AACjC,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CA+CtD;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;CACb;AAED;oDACoD;AACpD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3C,yBAAyB,CAiB3B"}
+{"version":3,"file":"account-dir-schema-reconcile.d.ts","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AA2FA,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD;;;;;0CAKsC;IACtC,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;+DAE+D;AAC/D,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,eAAe,EAClB,WAAW,SAAI,EACf,aAAa,SAAI,EACjB,UAAU,SAAI,GACb,MAAM,CAGR;AAED;;8EAE8E;AAC9E,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAcpE;AA+ED;;;8EAG8E;AAC9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAoCpE;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B;AA0DD;;;;;;;;;;;;;iCAaiC;AACjC,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CA8DtD;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;CACb;AAED;oDACoD;AACpD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3C,yBAAyB,CAiB3B"}

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.js

@@ -64,6 +64,11 @@ const PROTECTED_TOP_LEVEL = new Set([
     'telegram-channel-bindings.json',
     'canonical-webchat-session.json',
     'session-titles.json',
+    // Task 1996 — names the agents the operator switched off. Platform-written at
+    // the account root every disable, declared by no plugin, so without this every
+    // account with a disabled agent reports it as a stray forever and the standing
+    // line stops naming only what an operator must act on.
+    'agents-disabled.json',
 ]);
 /** Buckets whose depth fs-schema-guard.sh checks, with the same 3-segment cap.
  *  Every other top-level bucket is tool-owned and unbounded — not walked. This
@@ -81,9 +86,9 @@ const FILE_NAME_RE = /^[a-z0-9-]+(\.[a-z0-9-]+)*$/;
 /** The single per-run summary line body. A non-zero count is the standing signal
  *  that an agent authored folders the hard guards could not prevent. Pure
  *  formatter so the emitter and its test share one wording. */
-export function formatReconcileLine(c, homeMissing = 0, homeUnaudited = 0) {
+export function formatReconcileLine(c, homeMissing = 0, homeUnaudited = 0, agentDrift = 0) {
     return `${TAG} stray-top-level=${c.strayTopLevel} over-deep=${c.overDeep} bad-name=${c.badName}`
-        + ` home-missing=${homeMissing} home-unaudited=${homeUnaudited}`;
+        + ` home-missing=${homeMissing} home-unaudited=${homeUnaudited} agent-drift=${agentDrift}`;
 }
 /** Parse the fenced ```allowed-top-level block from an account's SCHEMA.md —
  *  the same structured set fs-schema-guard.sh parses with awk. Returns the
@@ -256,6 +261,41 @@ function homeParity(accountDir) {
     const declared = [...regions.ontologyRoots, ...HOME_FIXED].filter((d, i, a) => a.indexOf(d) === i);
     return { declared, missing: declared.filter((d) => !existsSync(join(accountDir, d))) };
 }
+/**
+ * Task 1996 — agents recorded as disabled whose file is still in the
+ * dispatchable directory.
+ *
+ * Disabling MOVES the file out of `<accountDir>/specialists/agents/`, which is
+ * what `spawn-context.ts` reads to build the spawn manifest. If the store names
+ * an agent that is still there, the operator sees a card marked disabled while
+ * the agent keeps being dispatched. Nothing throws and nothing logs, so there is
+ * no event to hang a signal on: the only way to see it is to look.
+ *
+ * An absent or unreadable store returns null, which the caller counts as "not
+ * audited" rather than "clean". A parse error here is the admin route's
+ * `op=disabled-store status=parse-failed` business.
+ */
+function agentParity(accountDir) {
+    let raw;
+    try {
+        raw = readFileSync(join(accountDir, 'agents-disabled.json'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let names;
+    try {
+        names = JSON.parse(raw).disabled;
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(names))
+        return null;
+    const disabled = names.filter((n) => typeof n === 'string');
+    const stillOnDisk = disabled.filter((n) => existsSync(join(accountDir, 'specialists', 'agents', n)));
+    return { disabled: disabled.length, stillOnDisk };
+}
 /** One reconcile pass over every account under the accounts root: one op=strays
  *  line naming the unaccounted-for entries of each account that has any, then the
  *  single summary line. An account is any child dir with an account.json (the
@@ -280,6 +320,11 @@ export function runReconcile(deps) {
     // buckets was checked. Without this, an install where every account lacks a
     // schema reports home-missing=0 and reads as healthy.
     let homeUnaudited = 0;
+    // Task 1996 — per-run total of agents recorded as disabled that are still in
+    // the dispatchable directory. Zero on the summary line is the per-cycle proof
+    // that the check ran and found nothing, which is what makes the absence of an
+    // op=agent-parity line readable as "clean" rather than "never audited".
+    let agentDrift = 0;
     let entries;
     try {
         entries = readdirSync(deps.accountsRoot);
@@ -310,6 +355,14 @@ export function runReconcile(deps) {
                     `missing=${parity.missing.join(',')}`);
                 homeMissing += parity.missing.length;
             }
+            // Task 1996 — named only when the store and the disk disagree, mirroring
+            // op=strays and op=home-parity above.
+            const agents = agentParity(accountDir);
+            if (agents && agents.stillOnDisk.length > 0) {
+                deps.logger(`${TAG} op=agent-parity account=${entry} disabled=${agents.disabled} ` +
+                    `stillOnDisk=${agents.stillOnDisk.join(',')}`);
+                agentDrift += agents.stillOnDisk.length;
+            }
             total.strayTopLevel += c.strayTopLevel;
             total.overDeep += c.overDeep;
             total.badName += c.badName;
@@ -318,7 +371,7 @@ export function runReconcile(deps) {
             // best-effort: skip an account that throws unexpectedly
         }
     }
-    deps.logger(formatReconcileLine(total, homeMissing, homeUnaudited));
+    deps.logger(formatReconcileLine(total, homeMissing, homeUnaudited, agentDrift));
 }
 /** Standing periodic reconcile. Unref'd interval so it never holds the process
  *  open; each tick re-runs the pass best-effort. */