@rubytech/create-sitedesk-code 0.1.522 → 0.1.524

package/payload/platform/scripts/check-specialist-tool-surface.mjs

@@ -67,25 +67,39 @@ function qualifyShortToolName(plugin, tool) {
 }
 
 // Frontmatter walker for PLUGIN.md tools: + hidden: blocks. Returns
-// {tools: [string], hidden: [string], hasTools: boolean}. Names only;
-// the gate does not consult allowlist booleans because every declared
-// tool contributes to the `all` surface.
+// {tools, hidden, hasTools, specialistOnly}. The drift check needs names
+// only — every declared tool contributes to the `all` surface regardless of
+// allowlist. `specialistOnly` (Task 2132) additionally carries the names
+// declared unreachable from both the admin and public surfaces, which the
+// reachability check below resolves against the specialist grants.
 function parsePluginManifest(rawManifest) {
   const fmMatch = rawManifest.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-  if (!fmMatch) return { tools: [], hidden: [], hasTools: false };
+  if (!fmMatch) return { tools: [], hidden: [], hasTools: false, specialistOnly: [], manifestName: null };
   const lines = fmMatch[1].split(/\r?\n/);
+  // The MCP server namespace is the manifest's own `name:`, which for a nested
+  // premium sub-plugin differs from its directory: premium-plugins/real-agent/
+  // plugins/loop/PLUGIN.md declares `name: real-agent-loop`, and the agents
+  // that hold its tools name them `mcp__plugin_real-agent-loop_real-agent-loop__*`.
+  // Used for the reachability set only, so the drift classifier's directory-keyed
+  // `all` set keeps its existing behaviour (Task 2132).
+  const nameMatch = fmMatch[1].match(/^name:\s*(\S+)\s*$/m);
+  const manifestName = nameMatch ? nameMatch[1] : null;
   const tools = [];
   const hidden = [];
+  const flags = {};
   let mode = null; // 'tools' | 'hidden' | null
+  let cur = null;
   let hasTools = false;
   for (const line of lines) {
-    if (/^tools:\s*\[\s*\]\s*$/.test(line)) { mode = null; continue; }
-    if (/^tools:\s*$/.test(line)) { mode = 'tools'; hasTools = true; continue; }
-    if (/^hidden:\s*$/.test(line)) { mode = 'hidden'; continue; }
-    if (/^[A-Za-z_]/.test(line)) { mode = null; continue; }
+    if (/^tools:\s*\[\s*\]\s*$/.test(line)) { mode = null; cur = null; continue; }
+    if (/^tools:\s*$/.test(line)) { mode = 'tools'; hasTools = true; cur = null; continue; }
+    if (/^hidden:\s*$/.test(line)) { mode = 'hidden'; cur = null; continue; }
+    if (/^[A-Za-z_]/.test(line)) { mode = null; cur = null; continue; }
     if (mode === 'tools') {
       const nameLine = line.match(/^\s+-\s+name:\s*(.+?)\s*$/);
-      if (nameLine) { tools.push(nameLine[1]); continue; }
+      if (nameLine) { cur = nameLine[1]; tools.push(cur); flags[cur] = {}; continue; }
+      const flagLine = line.match(/^\s+(adminAllowlist|publicAllowlist):\s*(true|false)\s*$/);
+      if (flagLine && cur) { flags[cur][flagLine[1]] = flagLine[2] === 'true'; continue; }
     }
     if (mode === 'hidden') {
       // Task 1998 — hidden entries carry the same `- name:` + `riskClass:`
@@ -95,7 +109,10 @@ function parsePluginManifest(rawManifest) {
       if (nameLine) hidden.push(nameLine[1]);
     }
   }
-  return { tools, hidden, hasTools };
+  const specialistOnly = tools.filter(
+    (t) => flags[t]?.adminAllowlist === false && flags[t]?.publicAllowlist === false,
+  );
+  return { tools, hidden, hasTools, specialistOnly, manifestName };
 }
 
 // Per-brand tool surface: walk platform/plugins (minus excludedPlugins) +
@@ -109,15 +126,17 @@ export function loadBrandToolSurface(maxyCodeRoot, excludedPlugins, shippedPremi
   const { PLATFORM_PLUGINS, PREMIUM_ROOT } = rootsFor(maxyCodeRoot);
   const all = new Set();
   const maxyPluginSet = new Set();
+  const specialistOnlyAll = new Set();
   const visit = (root, name) => {
     if (excludedPlugins.has(name)) return;
     const manifestPath = join(root, name, 'PLUGIN.md');
     if (!existsSync(manifestPath)) return;
-    const { tools, hidden, hasTools } = parsePluginManifest(readFileSync(manifestPath, 'utf-8'));
+    const { tools, hidden, hasTools, specialistOnly, manifestName } = parsePluginManifest(readFileSync(manifestPath, 'utf-8'));
     if (!hasTools && hidden.length === 0) return;
     maxyPluginSet.add(name);
     for (const t of tools) all.add(canonicalToolName(name, t));
     for (const h of hidden) all.add(canonicalToolName(name, h));
+    for (const s of specialistOnly) specialistOnlyAll.add(canonicalToolName(manifestName ?? name, s));
   };
   if (existsSync(PLATFORM_PLUGINS)) {
     for (const name of readdirSync(PLATFORM_PLUGINS).sort()) {
@@ -138,7 +157,53 @@ export function loadBrandToolSurface(maxyCodeRoot, excludedPlugins, shippedPremi
       }
     }
   }
-  return { all, maxyPluginSet };
+  return { all, maxyPluginSet, specialistOnlyAll };
+}
+
+// Task 2132 — the inverse of the drift check. A tool declared
+// `adminAllowlist: false` + `publicAllowlist: false` is reachable only
+// through a specialist's frontmatter `tools:` list. When no agent names it,
+// the tool can never be called: no error, no log line, no failed run. That is
+// a no-event failure, so it needs a standing check rather than an event.
+// `maxy-graph-write_neo4j_cypher` sat unreachable from Task 081 until 2132,
+// taking conversation-archive-enrich's wire step down with it.
+export function collectGrantedTools(agentDirs) {
+  const granted = new Set();
+  for (const dir of agentDirs) {
+    let entries;
+    try { entries = readdirSync(dir); } catch { continue; }
+    for (const entry of entries) {
+      if (!entry.endsWith('.md')) continue;
+      if (SKIP_AGENT_BASENAMES.has(basename(entry, '.md').toUpperCase())) continue;
+      const fm = readFileSync(join(dir, entry), 'utf-8').match(/^---\r?\n([\s\S]*?)\r?\n---/);
+      if (!fm) continue;
+      const toolsLine = parseSpecialistToolsLine(fm[1]);
+      if (!toolsLine) continue;
+      for (const t of splitToolList(toolsLine)) granted.add(t);
+    }
+  }
+  return granted;
+}
+
+// Tools deliberately reachable by no agent, each with the reason it is not a
+// mistake. Empty by construction: every tool that would have sat here was
+// fixed in Task 2132 — fourteen admin-called ones moved onto the admin
+// surface, the graph write tool onto the librarian. An entry added later must
+// name why the tool is deliberately callable by nobody, and an entry whose
+// tool has since been granted is itself reported, because a suppression that
+// outlives its cause re-creates the blind spot.
+const REACHABILITY_EXCEPTIONS = new Map([]);
+
+export function findUnreachableTools(specialistOnlyAll, granted) {
+  const unreachable = [];
+  const staleExceptions = [];
+  for (const tool of [...specialistOnlyAll].sort()) {
+    const isGranted = granted.has(tool);
+    const excepted = REACHABILITY_EXCEPTIONS.has(tool);
+    if (!isGranted && !excepted) unreachable.push(tool);
+    if (isGranted && excepted) staleExceptions.push(tool);
+  }
+  return { unreachable, staleExceptions };
 }
 
 // Per-brand specialist-agent dirs: platform templates ship with every brand;
@@ -277,12 +342,16 @@ export function runForBrand(maxyCodeRoot, brandName) {
     throw err;
   }
   const shippedSet = new Set(shipped);
-  const { all, maxyPluginSet } = loadBrandToolSurface(maxyCodeRoot, excludedPlugins, shippedSet);
+  const { all, maxyPluginSet, specialistOnlyAll } = loadBrandToolSurface(maxyCodeRoot, excludedPlugins, shippedSet);
   const agentDirs = collectSpecialistDirs(maxyCodeRoot, shippedSet);
   const { defects, inspected } = assertSpecialistDrift(agentDirs, all, maxyPluginSet, excludedPlugins);
   const blocking = defects.filter(d => d.reason !== 'brand-excluded-plugin');
   const stripList = defects.filter(d => d.reason === 'brand-excluded-plugin');
-  return { blocking, stripList, inspected };
+  const { unreachable, staleExceptions } = findUnreachableTools(
+    specialistOnlyAll,
+    collectGrantedTools(agentDirs),
+  );
+  return { blocking, stripList, inspected, unreachable, staleExceptions };
 }
 
 function main(maxyCodeRoot) {
@@ -306,14 +375,21 @@ function main(maxyCodeRoot) {
         : d.specialistPath;
       console.error(`[specialist-tool-surface] specialist=${rel} tool=${d.tool} reason=${d.reason} brand=${brandName}`);
     }
-    totalBlocking += result.blocking.length;
-    if (result.blocking.length === 0) {
+    for (const tool of result.unreachable) {
+      console.error(`[specialist-tool-surface] unreachable-tool=${tool} reason=granted-by-no-agent brand=${brandName}`);
+    }
+    for (const tool of result.staleExceptions) {
+      console.error(`[specialist-tool-surface] stale-reachability-exception=${tool} reason=now-granted brand=${brandName}`);
+    }
+    totalBlocking += result.blocking.length + result.unreachable.length + result.staleExceptions.length;
+    if (result.blocking.length === 0 && result.unreachable.length === 0 && result.staleExceptions.length === 0) {
       console.log(`[specialist-tool-surface] ok brand=${brandName} inspected=${result.inspected}`);
     }
   }
   if (totalBlocking > 0) {
     console.error(`[specialist-tool-surface] FAIL: ${totalBlocking} defect(s) across ${brands.length} brand(s).`);
     console.error(`  Rename the tool in the listed file to a registered namespace, or move the plugin off the brand's plugins.excluded list.`);
+    console.error(`  An unreachable-tool is declared adminAllowlist:false + publicAllowlist:false and named by no agent: grant it to the specialist that needs it, put it on the admin surface, or remove the declaration.`);
     process.exit(1);
   }
 }

package/payload/platform/scripts/lib/__tests__/account-settings-mailbox-inject.test.sh

@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+# Regression test for account-settings-mailbox-inject.sh (Task 2157).
+#
+# The lib retrofits the per-turn <mailboxes> injection hook onto existing
+# accounts' .claude/settings.json on every install. provision-account-dir.sh
+# writes the UserPromptSubmit array at provision time only, and setup-account.sh
+# re-provisions the HOUSE account only, so a client sub-account created by the
+# admin-core account-lifecycle tool never gets the hook without this reconcile.
+#
+# Covers:
+#   1. Array with a sibling hook   -> updated, command appended, sibling preserved
+#   2. Re-run on the same file     -> already-set, file byte-identical
+#   3. Empty UserPromptSubmit array-> updated, whole entry created
+#   4. Command already present     -> already-set, no duplicate
+#   5. No .hooks.UserPromptSubmit  -> no-hooks, file untouched
+#   6. File absent                 -> absent
+#   7. Malformed JSON              -> rewrite-failed, file untouched
+#   8. settings.json is an array   -> rewrite-failed or no-hooks, file untouched
+#   9. reconcile_all_accounts_*    -> patches every account.json dir, skips others
+#  10. No temp file is ever left behind, on any path
+#
+# All cases assert the [backfill-2157] status token and the post-state of the file.
+
+set -u
+
+LIB="$(cd "$(dirname "$0")/.." && pwd)/account-settings-mailbox-inject.sh"
+if [ ! -f "$LIB" ]; then
+  echo "FAIL: $LIB not found" >&2
+  exit 1
+fi
+# shellcheck source=/dev/null
+. "$LIB"
+
+CMD='bash $PLATFORM_ROOT/plugins/admin/hooks/mailbox-inject.sh'
+SIB='bash $PLATFORM_ROOT/plugins/admin/hooks/datetime-inject.sh'
+
+PASS=0
+FAIL=0
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+ok()  { echo "PASS: $1"; PASS=$((PASS+1)); }
+bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL+1)); }
+
+# cmds <file> -> every command string in the UserPromptSubmit array, one per line
+cmds() { jq -r '[.hooks.UserPromptSubmit[]?.hooks[]?.command] | .[]' "$1" 2>/dev/null; }
+status_of() { printf '%s' "$1" | /usr/bin/sed 's/.*status=//'; }
+
+# --- 1. array with a sibling hook -> updated, sibling preserved -------------
+F="$TMP/a.json"
+printf '%s' "{\"hooks\":{\"UserPromptSubmit\":[{\"hooks\":[{\"type\":\"command\",\"command\":\"$SIB\"}]}]}}" > "$F"
+OUT=$(ensure_mailbox_inject_hook "$F")
+if [ "$(status_of "$OUT")" = "updated" ] \
+   && [ "$(cmds "$F" | /usr/bin/grep -cF "$CMD")" -eq 1 ] \
+   && [ "$(cmds "$F" | /usr/bin/grep -cF "$SIB")" -eq 1 ]; then
+  ok "existing array -> updated, sibling hook preserved"
+else
+  bad "case 1 (out=$OUT cmds=$(cmds "$F" | tr '\n' ' '))"
+fi
+
+# --- 2. re-run -> already-set, byte-identical -------------------------------
+B=$(shasum "$F" | /usr/bin/cut -d' ' -f1)
+OUT=$(ensure_mailbox_inject_hook "$F")
+A=$(shasum "$F" | /usr/bin/cut -d' ' -f1)
+if [ "$(status_of "$OUT")" = "already-set" ] && [ "$B" = "$A" ] \
+   && [ "$(cmds "$F" | /usr/bin/grep -cF "$CMD")" -eq 1 ]; then
+  ok "re-run -> already-set, file byte-identical, no duplicate"
+else
+  bad "case 2 (out=$OUT before=$B after=$A)"
+fi
+
+# --- 3. empty array -> updated, whole entry created -------------------------
+F="$TMP/b.json"; printf '%s' '{"hooks":{"UserPromptSubmit":[]}}' > "$F"
+OUT=$(ensure_mailbox_inject_hook "$F")
+if [ "$(status_of "$OUT")" = "updated" ] && [ "$(cmds "$F" | /usr/bin/grep -cF "$CMD")" -eq 1 ]; then
+  ok "empty array -> updated, entry created"
+else
+  bad "case 3 (out=$OUT cmds=$(cmds "$F" | tr '\n' ' '))"
+fi
+
+# --- 4. command already present in a later entry -> already-set, no dupe ----
+F="$TMP/c.json"
+printf '%s' "{\"hooks\":{\"UserPromptSubmit\":[{\"hooks\":[{\"type\":\"command\",\"command\":\"$SIB\"}]},{\"hooks\":[{\"type\":\"command\",\"command\":\"$CMD\"}]}]}}" > "$F"
+OUT=$(ensure_mailbox_inject_hook "$F")
+if [ "$(status_of "$OUT")" = "already-set" ] && [ "$(cmds "$F" | /usr/bin/grep -cF "$CMD")" -eq 1 ]; then
+  ok "command present in a later entry -> already-set, not duplicated"
+else
+  bad "case 4 (out=$OUT cmds=$(cmds "$F" | tr '\n' ' '))"
+fi
+
+# --- 5. no UserPromptSubmit -> no-hooks, untouched --------------------------
+F="$TMP/d.json"; printf '%s' '{"permissions":{}}' > "$F"
+B=$(shasum "$F" | /usr/bin/cut -d' ' -f1); OUT=$(ensure_mailbox_inject_hook "$F"); A=$(shasum "$F" | /usr/bin/cut -d' ' -f1)
+if [ "$(status_of "$OUT")" = "no-hooks" ] && [ "$B" = "$A" ]; then
+  ok "no UserPromptSubmit array -> no-hooks, file untouched"
+else
+  bad "case 5 (out=$OUT)"
+fi
+
+# --- 6. file absent -> absent ----------------------------------------------
+OUT=$(ensure_mailbox_inject_hook "$TMP/does-not-exist.json")
+if [ "$(status_of "$OUT")" = "absent" ]; then
+  ok "file absent -> absent"
+else
+  bad "case 6 (out=$OUT)"
+fi
+
+# --- 7. malformed JSON -> rewrite-failed, untouched -------------------------
+F="$TMP/e.json"; printf 'not json at all' > "$F"
+B=$(shasum "$F" | /usr/bin/cut -d' ' -f1); OUT=$(ensure_mailbox_inject_hook "$F"); A=$(shasum "$F" | /usr/bin/cut -d' ' -f1)
+if [ "$(status_of "$OUT")" = "rewrite-failed" ] && [ "$B" = "$A" ]; then
+  ok "malformed JSON -> rewrite-failed, file untouched"
+else
+  bad "case 7 (out=$OUT)"
+fi
+
+# --- 8. settings.json is a JSON array -> not patched, untouched -------------
+F="$TMP/f.json"; printf '%s' '[]' > "$F"
+B=$(shasum "$F" | /usr/bin/cut -d' ' -f1); OUT=$(ensure_mailbox_inject_hook "$F"); A=$(shasum "$F" | /usr/bin/cut -d' ' -f1)
+S=$(status_of "$OUT")
+if { [ "$S" = "no-hooks" ] || [ "$S" = "rewrite-failed" ]; } && [ "$B" = "$A" ]; then
+  ok "settings.json that is an array -> not patched, file untouched"
+else
+  bad "case 8 (out=$OUT before=$B after=$A)"
+fi
+
+# --- 9. reconcile walks account dirs only ----------------------------------
+R="$TMP/accts"; mkdir -p "$R/one/.claude" "$R/two/.claude" "$R/notanaccount/.claude"
+printf '%s' '{}' > "$R/one/account.json"; printf '%s' '{}' > "$R/two/account.json"
+for d in one two notanaccount; do
+  printf '%s' "{\"hooks\":{\"UserPromptSubmit\":[{\"hooks\":[{\"type\":\"command\",\"command\":\"$SIB\"}]}]}}" > "$R/$d/.claude/settings.json"
+done
+OUT=$(reconcile_all_accounts_mailbox_inject "$R")
+if [ "$(printf '%s' "$OUT" | /usr/bin/grep -c 'status=updated')" -eq 2 ] \
+   && [ "$(cmds "$R/one/.claude/settings.json" | /usr/bin/grep -cF "$CMD")" -eq 1 ] \
+   && [ "$(cmds "$R/two/.claude/settings.json" | /usr/bin/grep -cF "$CMD")" -eq 1 ] \
+   && [ "$(cmds "$R/notanaccount/.claude/settings.json" | /usr/bin/grep -cF "$CMD")" -eq 0 ]; then
+  ok "reconcile patches account.json dirs only"
+else
+  bad "case 9 (out=$OUT)"
+fi
+
+# --- 10. no temp file left behind on any path ------------------------------
+if [ "$(find "$TMP" -name '*.2157.tmp' | /usr/bin/wc -l | tr -d ' ')" -eq 0 ]; then
+  ok "no .2157.tmp file left behind on any path"
+else
+  bad "case 10 (strays: $(find "$TMP" -name '*.2157.tmp'))"
+fi
+
+# --- 11. never returns non-zero, even on the failure paths -----------------
+ensure_mailbox_inject_hook "$TMP/e.json" >/dev/null; r1=$?
+ensure_mailbox_inject_hook "$TMP/nope.json" >/dev/null; r2=$?
+reconcile_all_accounts_mailbox_inject "$TMP/no-such-dir" >/dev/null; r3=$?
+if [ "$r1" -eq 0 ] && [ "$r2" -eq 0 ] && [ "$r3" -eq 0 ]; then
+  ok "every path returns 0, so a caller running set -e is never aborted"
+else
+  bad "case 11 (malformed=$r1 absent=$r2 nodir=$r3)"
+fi
+
+echo "----"
+echo "PASS=$PASS FAIL=$FAIL"
+if [ $((PASS+FAIL)) -ne 11 ]; then
+  echo "FAIL: expected 11 cases, ran $((PASS+FAIL))" >&2
+  exit 1
+fi
+[ "$FAIL" -eq 0 ]

package/payload/platform/scripts/lib/account-settings-mailbox-inject.sh

@@ -0,0 +1,91 @@
+# account-settings-mailbox-inject.sh — retrofit the per-turn <mailboxes>
+# injection hook onto existing accounts' .claude/settings.json. Task 2157.
+#
+# provision-account-dir.sh writes the UserPromptSubmit array only at provision
+# time, and setup-account.sh re-provisions the HOUSE account only: a client
+# sub-account's settings.json is written once, at creation, by the admin-core
+# account-lifecycle tool, and no install ever rewrites it. Without this lib the
+# hook reaches house accounts only, and no device gate would notice, because the
+# verification account on a single-account install IS that install's house
+# account. Same shape as account-settings-askgate.sh (Task 1683) and
+# account-settings-pdf-conformance.sh (Task 1929).
+#
+# Requires jq. Idempotent. Never echoes file contents. Fail-open (nudge, not
+# brick): any unusable file logs a status and is left untouched.
+#
+# Sourced by setup-account.sh; also runnable standalone for a manual repair.
+
+# The exact command string provision-account-dir.sh writes. $PLATFORM_ROOT is a
+# literal in the settings file, resolved by Claude Code at hook-run time.
+_MBXINJECT_CMD='bash $PLATFORM_ROOT/plugins/admin/hooks/mailbox-inject.sh'
+
+# ensure_mailbox_inject_hook <settings_file>
+# Guarantees the UserPromptSubmit array carries the mailbox-inject command:
+# appends it to the first entry when the array exists without it, or adds a whole
+# entry when the array is empty. Logs exactly one
+# `[backfill-2157] file=<f> status=<absent|no-hooks|already-set|updated|rewrite-failed>`
+# to stdout. Always returns 0.
+ensure_mailbox_inject_hook() {
+  local f="$1"
+  if [ ! -f "$f" ]; then
+    echo "[backfill-2157] file=$f status=absent"
+    return 0
+  fi
+  # Patchable only when the file is valid JSON with a UserPromptSubmit array.
+  if ! jq -e '.hooks.UserPromptSubmit | type == "array"' "$f" >/dev/null 2>&1; then
+    if jq -e . "$f" >/dev/null 2>&1; then
+      echo "[backfill-2157] file=$f status=no-hooks"
+    else
+      echo "[backfill-2157] file=$f status=rewrite-failed"
+    fi
+    return 0
+  fi
+  local tmp="$f.2157.tmp"
+  if ! jq --arg cmd "$_MBXINJECT_CMD" '
+      .hooks.UserPromptSubmit |= (
+        if length == 0
+        then [{hooks: [{type: "command", command: $cmd}]}]
+        else
+          if any(.[]; (.hooks // []) | any(.[]; .command == $cmd))
+          then .
+          else (.[0].hooks = ((.[0].hooks // []) + [{type: "command", command: $cmd}]))
+          end
+        end)
+    ' "$f" > "$tmp" 2>/dev/null; then
+    rm -f "$tmp"
+    echo "[backfill-2157] file=$f status=rewrite-failed"
+    return 0
+  fi
+  # Semantic no-op? Compare canonical forms; leave the file byte-identical if so.
+  # `|| true` keeps a jq failure here (e.g. $f truncated by a concurrent writer
+  # between the type-check above and this read) from tripping a caller's `set -e`
+  # and aborting the whole install — this lib is fail-open by contract.
+  local before after
+  before="$(jq -S . "$f" 2>/dev/null || true)"
+  after="$(jq -S . "$tmp" 2>/dev/null || true)"
+  if [ "$before" = "$after" ]; then
+    rm -f "$tmp"
+    echo "[backfill-2157] file=$f status=already-set"
+    return 0
+  fi
+  if mv "$tmp" "$f"; then
+    echo "[backfill-2157] file=$f status=updated"
+  else
+    rm -f "$tmp"
+    echo "[backfill-2157] file=$f status=rewrite-failed"
+  fi
+  return 0
+}
+
+# reconcile_all_accounts_mailbox_inject <accounts_dir>
+# Standing check + backfill: every account dir with an account.json gets the
+# mailbox-inject hook ensured. Mirrors reconcile_all_accounts_askgate.
+reconcile_all_accounts_mailbox_inject() {
+  local accts="$1"
+  [ -d "$accts" ] || return 0
+  local acct
+  for acct in "$accts"/*/; do
+    [ -f "$acct/account.json" ] || continue
+    ensure_mailbox_inject_hook "$acct/.claude/settings.json"
+  done
+}

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -186,6 +186,7 @@ provision_account_dir() {
           { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" },
           { "type": "command", "command": "bash $HOOKS_PATH/prompt-optimiser-directive.sh" },
           { "type": "command", "command": "bash $HOOKS_PATH/datetime-inject.sh" },
+          { "type": "command", "command": "bash $HOOKS_PATH/mailbox-inject.sh" },
           { "type": "command", "command": "bash $HOOKS_PATH/preference-consult-directive.sh" }
         ]
       }

package/payload/platform/scripts/seed-neo4j.sh

@@ -369,4 +369,45 @@ IDENT_DROPPED=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J
     "MATCH (au:AdminUser) WHERE au.name IS NOT NULL REMOVE au.name RETURN count(au)" 2>/dev/null | tail -1 | tr -d ' \r')
 echo "  [identity-reconcile] namedExisting=${IDENT_NAMED:-0} createdOwned=${IDENT_CREATED:-0} droppedAuName=${IDENT_DROPPED:-0}"
 
+# ------------------------------------------------------------------
+# 8. Routine roster (Task 2130)
+# ------------------------------------------------------------------
+# Ten generic routines, seeded eventStatus='suspended' with nextRun NULL and no
+# channel or destination, so a fresh install has a catalogue to enable instead
+# of a blank /routines page. Running here rather than only at account creation
+# is what carries the roster to the EXISTING fleet: this script runs on every
+# upgrade, not just the first install.
+#
+# The roster, the MERGE and the whole [routine-seed] lifecycle live in
+# platform/lib/routine-templates so the sub-account path in the admin plugin
+# shares them verbatim. This script only supplies the process boundary; it logs
+# nothing itself.
+#
+# Never install-blocking, matching sections 5-7 above. An account with no
+# routines is degraded, not broken: the graph, the agent and every channel work,
+# and only /routines is empty. Aborting here would take down an install or a
+# whole-fleet upgrade over a transient Neo4j hiccup, after the schema, the root
+# :LocalBusiness and the owner :AdminUser had all already succeeded — and the
+# installer's shell() throws on any non-zero exit, so a failure here is not
+# recoverable further up.
+#
+# What makes that safe is that this change also ships the control: the
+# heartbeat's [schedule-audit] op=roster reconciles the expected roster against
+# what each account actually holds, every tick, naming the missing keys. A short
+# seed is loud whether or not it aborts the install, so blocking buys nothing
+# and costs a bricked upgrade.
+ROUTINE_SEED_CLI="$PROJECT_DIR/lib/routine-templates/dist/seed-cli.js"
+if [ ! -f "$ROUTINE_SEED_CLI" ]; then
+  echo "  [routine-seed] op=skipped reason=cli-missing path=$ROUTINE_SEED_CLI — platform/lib/routine-templates was not built before the payload was bundled; run 'npm run build:lib' in platform/ and re-bundle. /routines will be empty and [schedule-audit] op=roster will report every key missing." >&2
+elif ! command -v node &> /dev/null; then
+  echo "  [routine-seed] op=skipped reason=no-node — node is required by the routine-roster seed. /routines will be empty and [schedule-audit] op=roster will report every key missing." >&2
+else
+  NEO4J_URI="$NEO4J_URI" \
+  NEO4J_USER="$NEO4J_USER" \
+  NEO4J_PASSWORD="$NEO4J_PASSWORD" \
+  ROUTINE_SEED_ACCOUNT_ID="$ACCOUNT_ID" \
+    node "$ROUTINE_SEED_CLI" \
+    || echo "  [routine-seed] op=skipped reason=seed-failed — the routine roster did not seed; the account is otherwise fully provisioned. [schedule-audit] op=roster names the missing keys every tick, and the next upgrade re-seeds." >&2
+fi
+
 echo "  Done."

package/payload/platform/scripts/setup-account.sh

@@ -38,6 +38,8 @@ ACCOUNTS_DIR="$INSTALL_DIR/data/accounts"
 . "$SCRIPT_DIR/lib/account-settings-askgate.sh"
 # shellcheck source=lib/account-settings-pdf-conformance.sh
 . "$SCRIPT_DIR/lib/account-settings-pdf-conformance.sh"
+# shellcheck source=lib/account-settings-mailbox-inject.sh
+. "$SCRIPT_DIR/lib/account-settings-mailbox-inject.sh"
 # shellcheck source=lib/read-brand-json.sh
 . "$SCRIPT_DIR/lib/read-brand-json.sh"
 # Resolve brand-aware persistent users.json path before the resolver runs.
@@ -90,3 +92,16 @@ reconcile_all_accounts_askgate "$ACCOUNTS_DIR"
 # never runs the PDF gate. Reconcile every account on every install so the gate
 # reaches pre-1922 accounts. Idempotent; logs one [backfill-1929] line per account.
 reconcile_all_accounts_pdf_conformance "$ACCOUNTS_DIR"
+
+# ------------------------------------------------------------------
+# 6. Retrofit the per-turn <mailboxes> injection hook onto every account
+# ------------------------------------------------------------------
+# Standing check + durable backfill (Task 2157): provision_account_dir writes the
+# UserPromptSubmit array only at provision time, and this script re-provisions
+# only the house account. A client sub-account created by the account-lifecycle
+# tool keeps a settings.json without mailbox-inject.sh and never gets the
+# standing mailbox list, so its sessions go on learning attachment state by
+# polling one mail plugin and reading that plugin's miss as an account-wide fact.
+# Reconcile every account on every install. Idempotent; logs one [backfill-2157]
+# line per account.
+reconcile_all_accounts_mailbox_inject "$ACCOUNTS_DIR"

package/payload/platform/scripts/verify-skill-tool-surface.sh

@@ -58,6 +58,20 @@ EXPLICIT_OWNERSHIP = {
     "memory/document-ingest": "librarian",
     "memory/conversation-archive": "librarian",
     "memory/conversation-archive-enrich": "librarian",
+    # publish-site/SKILL.md:10 — "Invoked from `specialists:content-producer`".
+    # The admin plugin declares no `specialist:` field, so without this entry
+    # the skill defaults to admin-owned and its two tools resolve against the
+    # wrong surface (Task 2132).
+    "admin/publish-site": "content-producer",
+}
+
+# Generated catalogue skills. platform-architecture is assembled from the docs
+# mirror by scripts/assemble-architecture-skill.mjs and describes the whole
+# platform, so it names tools it never calls — a token there is documentation,
+# not a prescription. Token resolution does not apply; the forbidden-token rule
+# still does (Task 2132).
+CATALOGUE_SKILLS = {
+    "admin/platform-architecture",
 }
 
 # Skills that are explicitly admin-owned (loaded via plugin-read by the admin
@@ -138,6 +152,49 @@ def specialist_tools(specialist: str) -> set[str] | None:
     return {t for t in items if t}
 
 
+def scan_manifest_allowlists() -> tuple[set[str], set[str]]:
+    """Long-prefix names of (every declared tool, those declared
+    `adminAllowlist: true`).
+
+    The admin agent's surface is NOT the union of all enabled plugins: a tool
+    declared `adminAllowlist: false` is excluded from the admin spawn by
+    tool-surface.ts, so an admin-owned skill naming one prescribes a call its
+    own agent cannot make. That premise left fourteen tools unreachable and
+    invisible to this gate until Task 2132 — capabilities-here/SKILL.md names
+    its tool in the required backtick form and still passed.
+    """
+    declared: set[str] = set()
+    admin: set[str] = set()
+    for plugin in sorted(os.listdir(PLUGINS_DIR)):
+        manifest = os.path.join(PLUGINS_DIR, plugin, "PLUGIN.md")
+        if not os.path.exists(manifest):
+            continue
+        m = re.match(r"^---\n(.*?)\n---", open(manifest, encoding="utf-8").read(), re.S)
+        if not m:
+            continue
+        cur = None
+        in_tools = False
+        for line in m.group(1).split("\n"):
+            if re.match(r"^tools:\s*$", line):
+                in_tools = True
+                continue
+            if re.match(r"^[A-Za-z_]", line):
+                in_tools = False
+                cur = None
+                continue
+            if not in_tools:
+                continue
+            nm = re.match(r"^\s+-\s+name:\s*(.+?)\s*$", line)
+            if nm:
+                cur = nm.group(1)
+                declared.add(f"mcp__plugin_{plugin}_{plugin}__{cur}")
+                continue
+            aa = re.match(r"^\s+adminAllowlist:\s*(true|false)\s*$", line)
+            if aa and cur and aa.group(1) == "true":
+                admin.add(f"mcp__plugin_{plugin}_{plugin}__{cur}")
+    return declared, admin
+
+
 def extract_prescribed_tokens(text: str) -> set[str]:
     return set(TOKEN_RE.findall(text))
 
@@ -255,6 +312,7 @@ def main() -> int:
     summary: list[str] = []
     errors: list[str] = []
     pairs_checked = 0
+    all_declared_tools, admin_surface = scan_manifest_allowlists()
 
     for plugin in sorted(os.listdir(PLUGINS_DIR)):
         pdir = os.path.join(PLUGINS_DIR, plugin)
@@ -288,7 +346,24 @@ def main() -> int:
                 )
 
             if specialist is None:
-                # Admin-owned: only enforce forbidden-token rule.
+                # Admin-owned: forbidden-token rule, plus the admin surface.
+                # A prescribed tool that some manifest declares must also be
+                # `adminAllowlist: true`, or the admin cannot call it. Tokens
+                # no manifest declares are upstream bridges (Playwright and
+                # friends) and are left to the drift gate (Task 2132).
+                unresolved_admin = (
+                    []
+                    if ownership_key in CATALOGUE_SKILLS
+                    else sorted(
+                        t for t in prescribed
+                        if t in all_declared_tools and t not in admin_surface
+                    )
+                )
+                for tok in unresolved_admin:
+                    errors.append(
+                        f"[verify] skill={ownership_key} specialist=admin "
+                        f"unresolved={tok} reason=not-admin-allowlisted"
+                    )
                 for tok, ctx in forbidden:
                     errors.append(
                         f"[verify] skill={ownership_key} specialist=admin "
@@ -296,7 +371,8 @@ def main() -> int:
                     )
                 summary.append(
                     f"[verify] skill={ownership_key} specialist=admin (admin-owned) "
-                    f"tokens={len(prescribed)} forbidden={len(forbidden)}"
+                    f"tokens={len(prescribed)} unresolved={len(unresolved_admin)} "
+                    f"forbidden={len(forbidden)}"
                 )
                 continue
 
@@ -314,6 +390,19 @@ def main() -> int:
                     f"[verify] skill={ownership_key} specialist={specialist} "
                     f"unresolved={tok}"
                 )
+            # A skill that instructs execution of a tool-emitted `mergeCypher`
+            # must name the tool that executes it. The token rule above is
+            # name-based, so prose like "Run the `mergeCypher`" resolves
+            # nothing and passes — the blind spot that left
+            # conversation-archive-enrich's wire step unexecutable while this
+            # gate reported resolved=5/5 (Task 2132).
+            if "mergeCypher" in text and not any(
+                tok.endswith("write_neo4j_cypher") for tok in prescribed
+            ):
+                errors.append(
+                    f"[verify] skill={ownership_key} specialist={specialist} "
+                    f"mergecypher-unexecutable=no-write-cypher-tool-prescribed"
+                )
             for tok, ctx in forbidden:
                 errors.append(
                     f"[verify] skill={ownership_key} specialist={specialist} "

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAyB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAmUtD,CAAA"}
+{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAyB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAoUtD,CAAA"}