@rubytech/create-sitedesk-code 0.1.526 → 0.1.528

package/payload/platform/plugins/admin/mcp/dist/tools/logs-read-mcp.d.ts

@@ -0,0 +1,16 @@
+export declare const MCP_LOG_PREFIX = "mcp-";
+/**
+ * Most files one key may fan out to. The key is a substring match, so a short
+ * key matches many names — the measured device dir holds 552 `mcp-*` files.
+ * A truncated result always names the total, so the cap is never silent.
+ */
+export declare const MCP_KEY_MATCH_CAP = 20;
+/**
+ * Tail every `mcp-*.log` in `mcpLogDir` whose FILENAME contains `sessionKey`,
+ * up to `MCP_KEY_MATCH_CAP` files. An 8-character key prefix matches a
+ * filename carrying the full session id.
+ */
+export declare function readMcpLogsByKey(mcpLogDir: string, sessionKey: string, lines: number): string;
+/** Tail the most recently modified `mcp-*.log` in `mcpLogDir`. */
+export declare function readLatestMcpLog(mcpLogDir: string, lines: number): string;
+//# sourceMappingURL=logs-read-mcp.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/tools/logs-read-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs-read-mcp.d.ts","sourceRoot":"","sources":["../../src/tools/logs-read-mcp.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,cAAc,SAAS,CAAC;AAErC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAcpC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAmB7F;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAazE"}

package/payload/platform/plugins/admin/mcp/dist/tools/logs-read-mcp.js

@@ -0,0 +1,69 @@
+/**
+ * logs-read type=mcp — resolution and tail.
+ *
+ * The MCP stderr sink is written by `lib/mcp-spawn-tee` (src/index.ts:60-65)
+ * as `${LOG_DIR}/mcp-<server>-<sessionId>.log`, where that LOG_DIR is the
+ * session manager's `config.persistDir/logs` — `~/.<brand>/logs`, the admin
+ * MCP's CONFIG_DIR. It is NOT the per-account log dir, which is where
+ * logs-read looked until Task 2168.
+ *
+ * The session key lives in the FILENAME. No line inside the file carries it,
+ * so a content grep — the strategy every other per-session type uses —
+ * returns nothing here however the directory is resolved.
+ *
+ * Caller supplies the directory; this module never resolves one itself.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+export const MCP_LOG_PREFIX = "mcp-";
+/**
+ * Most files one key may fan out to. The key is a substring match, so a short
+ * key matches many names — the measured device dir holds 552 `mcp-*` files.
+ * A truncated result always names the total, so the cap is never silent.
+ */
+export const MCP_KEY_MATCH_CAP = 20;
+function isMcpLog(file) {
+    return file.startsWith(MCP_LOG_PREFIX) && file.endsWith(".log");
+}
+function missingDir(mcpLogDir) {
+    return `No MCP logs on this install yet (resolved dir does not exist on disk): ${mcpLogDir}. MCP server stderr is teed there on the first plugin spawn.`;
+}
+function tail(filePath, lines) {
+    return execFileSync("tail", ["-n", String(lines), filePath], { timeout: 5000 }).toString();
+}
+/**
+ * Tail every `mcp-*.log` in `mcpLogDir` whose FILENAME contains `sessionKey`,
+ * up to `MCP_KEY_MATCH_CAP` files. An 8-character key prefix matches a
+ * filename carrying the full session id.
+ */
+export function readMcpLogsByKey(mcpLogDir, sessionKey, lines) {
+    if (!existsSync(mcpLogDir))
+        return missingDir(mcpLogDir);
+    const matches = readdirSync(mcpLogDir)
+        .filter(f => isMcpLog(f) && f.includes(sessionKey))
+        .sort();
+    if (matches.length === 0) {
+        return `No ${MCP_LOG_PREFIX}*.log filename contains session key "${sessionKey}" (resolved dir: ${mcpLogDir}, prefix: ${MCP_LOG_PREFIX}). The key is matched against the FILENAME, not the file contents — MCP log lines carry no session key.`;
+    }
+    const shown = matches.slice(0, MCP_KEY_MATCH_CAP);
+    const header = matches.length > shown.length
+        ? `# MCP logs for session key: ${sessionKey}\n${matches.length} filenames matched, showing the first ${shown.length} — narrow the key to see the rest.`
+        : `# MCP logs for session key: ${sessionKey}`;
+    const sections = shown.map(file => `## ${file}\n${tail(resolve(mcpLogDir, file), lines)}`);
+    return `${header}\n\n${sections.join("\n\n")}`;
+}
+/** Tail the most recently modified `mcp-*.log` in `mcpLogDir`. */
+export function readLatestMcpLog(mcpLogDir, lines) {
+    if (!existsSync(mcpLogDir))
+        return missingDir(mcpLogDir);
+    const match = readdirSync(mcpLogDir)
+        .filter(isMcpLog)
+        .map(file => ({ file, mtime: statSync(resolve(mcpLogDir, file)).mtimeMs }))
+        .sort((a, b) => b.mtime - a.mtime)[0];
+    if (!match) {
+        return `No log file found for type 'mcp' (resolved dir: ${mcpLogDir}, prefix: ${MCP_LOG_PREFIX})`;
+    }
+    return `# ${match.file}\n\n${tail(resolve(mcpLogDir, match.file), lines)}`;
+}
+//# sourceMappingURL=logs-read-mcp.js.map

package/payload/platform/plugins/admin/mcp/dist/tools/logs-read-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs-read-mcp.js","sourceRoot":"","sources":["../../src/tools/logs-read-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB;IACnC,OAAO,0EAA0E,SAAS,8DAA8D,CAAC;AAC3J,CAAC;AAED,SAAS,IAAI,CAAC,QAAgB,EAAE,KAAa;IAC3C,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,UAAkB,EAAE,KAAa;IACnF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;SAClD,IAAI,EAAE,CAAC;IAEV,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,cAAc,wCAAwC,UAAU,oBAAoB,SAAS,aAAa,cAAc,yGAAyG,CAAC;IACjP,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAClD,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;QAC3B,CAAC,CAAC,+BAA+B,UAAU,KAAK,OAAO,CAAC,MAAM,yCAAyC,KAAK,CAAC,MAAM,oCAAoC;QACvJ,CAAC,CAAC,+BAA+B,UAAU,EAAE,CAAC;IAElD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3F,OAAO,GAAG,MAAM,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,KAAa;IAC/D,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC;SACjC,MAAM,CAAC,QAAQ,CAAC;SAChB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SAC1E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAExC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,mDAAmD,SAAS,aAAa,cAAc,GAAG,CAAC;IACpG,CAAC;IAED,OAAO,KAAK,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC"}

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what SiteDesk ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:15f533911e93c443dda2624cad785b44ee24ca5bcf5b992fbd96932226abd055
+content-hash: sha256:7106e5166b451f13c373e48b7eb6057846d8e385002c774fa6ba4db1b05aef6e
 brand: sitedesk-code
 product-name: SiteDesk
 ---
@@ -212,7 +212,7 @@ There is no dashboard, no settings panel, no menus. Everything is done through c
 
 The chat input auto-grows as you type — it expands to fit your message and shrinks back when you delete text. You can also drag the resize handle above the input to set a custom height.
 
-The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
+The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. The conversation column on the Chat page has its own width control: a small handle sits half way up the page just inside each side of the column, and dragging either one widens or narrows the reading measure. The column stays centred, so both handles do the same thing — dragging the left one out and the right one out by the same distance give the same width. It will not go below its default 760px and will not go wider than the chat panel itself; the messages, the input box and the jump-to-latest button all move together. Double-click either handle to go back to 760px. Your chosen width is remembered across reloads. The handles do not appear on a phone (below 640px), where the conversation already fills the width. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
 
 Page titles are brand-aware: the browser tab shows your product name (e.g. `Real Agent` instead of `SiteDesk`) on every shell — chat, graph, and data — so a non-default brand never leaks the default name in tab strips or browser history.
 
@@ -510,7 +510,8 @@ There is no per-conversation stream log that interleaves MCP stderr with agent e
 
 **Retrieve MCP diagnostic lines for a conversation:**
 
-- `logs-read { type: "mcp" }` → tails the most recent `mcp-<name>-*.log` (per-server, keyed by session).
+- `logs-read { type: "mcp" }` → tails the most recent `mcp-<name>-*.log` under `~/.<brand>/logs`, the platform config dir the tee writes to — not the account log dir, which holds no `mcp-*` at all.
+- `logs-read { type: "mcp", sessionKey }` → tails every `mcp-*.log` whose **filename** carries that key, one section per server, up to 20 files; a truncated reply names how many matched so the cap is never silent. An 8-character key prefix matches the full session id in the name. The key is never matched against file contents, because MCP log lines carry no session key.
 
 ## Failure-path observability contract
 
@@ -3799,6 +3800,23 @@ pass's summary line, which is what makes the absence of a per-account line
 readable as "clean" rather than "never audited" — grep the summary line, not the
 per-account one, to confirm the check is running.
 
+**An unregistered file-write fence is the same shape of failure.** The
+account-dir path guard refuses a file edit whose resolved path lands inside
+another account's directory, for every session including a house-scoped one, and
+the Bash snapshot pair watches the account's own layout. All of them live in the
+account's `.claude/settings.json`, and a hook that is not registered there runs
+never and emits nothing, so the silence reads identical to a clean account. The
+same pass therefore checks the five registrations per account and reports any
+absence as
+`[fs-reconcile] op=hook-registration account=<id8> missing=<matcher>:<hook>,…`,
+with `hooks-missing=0 hooks-unaudited=0` on the summary line as the per-cycle
+proof the fence is wired everywhere. An account whose settings cannot be read
+counts as unaudited rather than clean, so an install where none of them can be
+read never reports itself as fenced. The refusal itself is agent-facing and lands
+in the session's own child log as
+`[fs-guard] blocked path=<abs> reason=cross-account target=<id8>`, not in
+`server.log`.
+
 ### Graph
 
 | Mount | Purpose |
@@ -4009,15 +4027,72 @@ button** while it holds text — clicking empties the input, clears results
 | Mount | Purpose |
 |---|---|
 | `/browser` | `POST /launch` — launches Chromium on the resolved transport (native display or VNC) on demand. Backs the standalone `/browser` operator page. Lifeline tag `[admin/browser/launch]`. |
+| `/browser` | `GET /screencast-targets` — the page-target list behind the screencast viewer. Server-side hop to the CDP HTTP surface, which is loopback-only; filtered to `type:'page'`. `501` off the Linux display stack, `502` when Chromium is unreachable. |
+| `/browser` | `POST /screencast-event` — relay for the client half of the `[browser/screencast]` lifeline. Accepts a fixed op allowlist (`request`, `screencast-started`, `frame`, `input`, `teardown`); the server-side ops are refused so a client cannot emit a line that reads as a server decision. |
 
 The in-chat / artefact-embedded brand-VNC iframe components and the
 `/browser-iframe` event-beacon route were retired and stay
 deleted; the `/device-browser` (navigate-the-device-tab) route was also
 removed and is not restored. The standalone `/browser` page is a
-sanctioned operator surface peer to `/graph` and `/data`: it embeds the live
-VNC viewer (`/vnc-viewer.html`, popout `/vnc-popout.html`) and calls
-`/api/admin/browser/launch`. On darwin (no noVNC asset) it shows a "VNC surface
-not available" state.
+sanctioned operator surface peer to `/graph` and `/data`.
+
+**The human view is a CDP screencast, not a framebuffer.** `/browser`
+renders `CdpScreencastSurface`: frames arrive as CDP `Page.screencastFrame` and
+paint to a canvas, and the operator's clicks, scrolling and typing leave as
+`Input.dispatch*`. Interaction therefore lands on page coordinates rather than
+screen pixels, and the view is one tab chosen from a strip rather than the whole
+X display. `VncSurface` and `/vnc-viewer.html` still exist and still work, but
+nothing reaches them, and deleting that stack is separate work.
+
+**The Claude sign-in screen shows the same surface.** `AuthScreen` used to frame
+`/vnc-viewer.html` so the operator could complete the OAuth flow by looking at
+the browser on the X display; it now mounts `CdpScreencastSurface` too. Virtual
+mode runs Chromium headless (`--headless=new`, no `DISPLAY`), and a headless
+Chromium does not serve the ProcessSingleton socket — so the old mechanism, in
+which `claude auth login` exec'd `$BROWSER <url>` and a second Chromium handed
+the URL to the running instance, aborts with exit 21 and never opens the page.
+The wrapper `writeChromiumWrapper` generates therefore hands its URL to the
+running browser over CDP (`PUT /json/new`) instead of launching anything. Two
+details are load-bearing: the URL is percent-encoded into the query string,
+because that endpoint truncates a raw URL at its first `&`, and the id of the
+created target is recorded so the sign-in poll can tell the viewer which tab to
+show rather than leaving it on whichever tab CDP lists first.
+
+The transport is `/cdp-screencast` on the dashboard's own host and port, claimed
+by the edge listener before its `forwardUpgrade` catch-all. It is gated by
+`canAccessAdmin` and rejected on operator and public hosts (`reason` values
+`origin-operator-host` and `origin-public-host`, mirroring the websockify
+rejection), and it validates the target id against a fixed 32-hex charset because
+that id is interpolated into the upstream request line. Before replaying the
+upgrade to Chromium it drops the admin session cookie and the browser `Origin`:
+Chromium is launched with no `--remote-allow-origins`, so its DevTools endpoint
+has no allowlisted origin, and the proxy has already checked same-origin itself.
+
+Chromium's debugging port is bound to `127.0.0.1` on `${CDP_PORT}` and is never
+tunnelled or bound off-localhost. That port carries no authentication and total
+control of the browser, which is why the proxy is the only path to it. Per-brand
+isolation is the `CDP_PORT` import and nothing else, so two co-resident brands
+each view their own Chromium.
+
+Off the Linux display stack, and whenever Chromium is unreachable, the surface
+renders an explicit unavailable state. That is deliberate rather than cosmetic: a
+canvas that never receives a frame is indistinguishable from a black desktop,
+where the iframe it replaced failed visibly.
+
+Observability is `[browser/screencast]` correlated by `sid` across
+`request → gate → cdp-connected → screencast-started → frame → input → teardown
+→ socket-closed`, plus `[cdp-ws-census] liveSockets=<N> sessions=<M>` on every
+open and close. Diagnostic path:
+
+```
+logs-read.sh | grep -E '\[browser/screencast\]|\[cdp-ws-census\]'
+```
+
+then filter to one `sid` for a whole session. Frame lines are sampled, so a
+frozen `seq` against a live socket is the frozen-viewer signature. `liveSockets`
+climbing while `sessions` stays flat is the leak signature: an operator tab that
+closes without a clean teardown emits no action log of its own, so the standing
+reconcile pass closes client-dead sockets and reports `op=orphan-reap closed=<N>`.
 
 ### Diagnostics
 
@@ -4318,6 +4393,55 @@ on every admin page; double-click resets to half the available width
 (viewport minus sidebar), clamped to the per-pane min-width floors. The
 chosen width is remembered across reloads.
 
+**The /chat reading measure is operator-set.** `--webchat-measure` was a fixed
+760px; it is now the FLOOR of a range the operator drags, written inline on
+`.webchat-page` by `WebchatSplitter` so the message column, the composer and the
+jump-to-latest button — all three read the same property — stay aligned. Two
+handles, one just inside each column edge, vertically centred. The column is
+centre-aligned, so one symmetric rule drives both: `measure = 2 × |pointerX −
+panelCentreX|`, which is why the two handles are interchangeable. Envelope:
+760px ≤ measure ≤ the chat panel's own width; double-click either handle to
+revert to 760px and clear the stored value; the measure persists in
+`localStorage` under `maxy-webchat-measure-px` and re-clamps on window resize and
+on any panel-width change (sidebar drag, artefact open/close). No handle renders
+below a 640px viewport, where the media query already gives the column the full
+width. A measure wider than its panel does not overflow — the column just fills
+the panel — so that state emits nothing on its own; the standing check is
+`[admin-ui] op=webchat-measure-audit measurePx= panelPx= availPx= columnPx=
+handles= governed= fit=`, emitted on mount and on every re-clamp with identical
+consecutive readings suppressed. `columnPx` is the measured `.wa-thread-scroll`
+rect, not the property read back, so a property written to the wrong element
+shows as `measurePx=1200 columnPx=760`; `columnPx=-1` means no transcript is
+mounted (the greeting panel). `fit=false` or `handles=` disagreeing with
+`governed=` is the failure. A completed drag logs `[admin-ui] webchat-resize
+px=<final>`; a bare click logs nothing.
+
+**All four resize handles draw one pill.** The `/chat` column pills,
+the composer grip, and the sidebar and artefact splitters each paint a 3px-thick,
+48px-long rounded pill (32px long on the horizontal composer grip) in
+`--text-tertiary`, at half strength when idle and full strength on hover. Every
+box keeps its old size — 8px wide for the three vertical surfaces — so the pill
+got thinner and the grab target did not. Thickness and length come from
+`--resize-grip-thickness` / `--resize-grip-length`; the colour is read as
+`var(--text-tertiary)` on each pill rather than through an alias, because a
+`var()` inside a custom property is substituted on the element that DECLARES it,
+which would freeze the colour at the base `#9A9A9A` instead of the surface's own
+value (measured inside `.admin-shell`: `rgb(154,154,154)` through an alias,
+`rgb(138,133,122)` direct). A pill that never paints emits no event and does not
+reproduce on a re-open, and the measure audit above counts elements rather than
+pixels, so the standing check is `[admin-ui] op=resize-grip-audit
+surface=<column-left|column-right|sidebar> thicknessPx= lengthPx= color= opacity=
+boxPx= painted=`, emitted for the two column pills on mount and on every
+re-clamp, and for the sidebar splitter once per mount. `opacity=` is the strength
+the operator actually sees: the column pills carry it on the box and the two
+splitters carry it on the pill, and the line multiplies both, so a pill hidden at
+either level reports `opacity=0`.
+`painted=false` or `thicknessPx=0` means an invisible handle; `thicknessPx=8`
+means the box is painting and the pill rule never applied; a missing line for a
+surface that should be mounted is itself the alarm. `painted=false
+source=unavailable` is the expected reading wherever pseudo-element styles are
+not reported (the jsdom test environment), never a real zero.
+
 ## Health vs version
 
 Two endpoints, two surfaces, two restart-survival roles:
@@ -5315,7 +5439,7 @@ For estate-agent client work surfaced on the `/tasks` operator page, `work-creat
 
 Two surfaces feed the gate. (1) **Workflow path:** `memory-write` accepts an optional `producedByTaskId` parameter. When set, an inbound `:PRODUCED` edge from that Task is composed into the write's relationships before the gate runs — the typical agent-side pattern is to call `work-create` at the start of an autonomous flow, capture `taskId`, and pass it as `producedByTaskId` on every subsequent `memory-write` for a gated label. The gate verifies Task and write share the same `accountId`; mismatch is rejected loud. (2) **Direct-ask path:** the admin server resolves the active `:AdminConversation`'s `sessionId` UUID and stamps it as `SESSION_NODE_ID` in the spawn env at PTY-spawn time. The same stamp propagates onto specialist subagent spawns the admin dispatches so listing-curator, content-producer, database-operator etc. inherit the same conversation anchor. The `contact-create` and `memory-write` wrappers call `injectConversationProvenance` (exported from [`@maxy/graph-write`](../../../lib/graph-write/src/conversation-provenance.ts)) which MATCHes `(c:Conversation {sessionId, accountId})` — account isolation is part of the natural key, not a separate gate — and prepends the synthetic `:PRODUCED` edge (composed by Neo4j elementId, which the helper reads off the MATCH). No agent-visible schema field changes. `memory-write` uses the env-stamp only as a fallback when `producedByTaskId` is unset; `contact-create` has no `producedByTaskId` parameter today and relies on the env-stamp alone. Autonomous (cron-driven) specialists with no parent conversation legitimately have no env-stamp; those must thread `producedByTaskId`.
 
-A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one, which is how a resume the session manager redirected to a live fork re-points itself rather than staying on the dead source. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
+A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one. The link route runs only on a first click, when the task has no session yet; a click on an already-linked task navigates straight to `/chat?session=<id>` and writes nothing, so an edge is never re-pointed after it is first written. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
 
 Operator audit cyphers:
 - "What entities did this conversation's actions produce?" — `MATCH (c:AdminConversation {sessionId:$id})<-[:RAISED_DURING]-(t:Task)-[:PRODUCED]->(e) RETURN labels(e), e.name, t.kind, t.status`
@@ -5540,7 +5664,7 @@ The logs will show which service failed to start and why. Common causes:
 Each installed brand runs two per-brand `--user` systemd units (earlier platform fixes + — unit filenames are prefixed with the brand's `hostname` so two brands on the same device never share a unit file):
 
 - `{hostname}.service` — the admin + public HTTP server on `127.0.0.1:19201` (public port + 1). Restarted by the upgrade flow; short downtime is expected during steps 8→11 of an upgrade. An earlier fix: the unit carries two port env vars — `PORT=<public>` (canonical public port, read by the upgrade detector) and `MAXY_UI_INTERNAL_PORT=<public+1>` (the port maxy-ui actually binds).
-- `{hostname}-edge.service` — the always-on public listener on the configured port (default 19200). Reverse-proxies HTTP to the main brand service and handles `/websockify` (VNC) WebSocket upgrades locally. An earlier fix: also hosts `/api/admin/actions/*` and `/api/admin/version*` — the Software Update modal's own routes — so the log stream survives the brand service's restart window. Does NOT restart during an upgrade — the browser WebSocket stays connected by construction. The operator views this VNC display in the admin UI via the standalone `/browser` page (peer to `/graph` and `/data`).
+- `{hostname}-edge.service` — the always-on public listener on the configured port (default 19200). Reverse-proxies HTTP to the main brand service and handles `/websockify` (VNC) WebSocket upgrades locally. An earlier fix: also hosts `/api/admin/actions/*` and `/api/admin/version*` — the Software Update modal's own routes — so the log stream survives the brand service's restart window. Does NOT restart during an upgrade — the browser WebSocket stays connected by construction. The operator views the device's Chromium in the admin UI via the standalone `/browser` page (peer to `/graph` and `/data`) and on the Claude sign-in screen; both render CDP screencast frames over `/cdp-screencast`, not the framebuffer. Virtual-mode Chromium is headless, so nothing renders onto the X display and the `/websockify` upgrade has no remaining consumer; deleting that stack is separate work.
 
 Upgrade and Cloudflare setup run as detached actions: `systemd-run --user` transient units per invocation with stdout+stderr persisted to `~/.maxy/logs/actions/<actionId>.log` and streamed to the UI via SSE. No boot-time service file exists for these.
 

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,20 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-30 (0.1.528)
+
+- Where two or more accounts share one device, the assistant can no longer edit or write files belonging to a different account. Every account is now checked for that protection being in place.
+- Your account now has a designated address that outbound mail is sent from, so asking to send an email no longer gets refused for want of knowing which address to use. The mailbox status tells you which address is designated, or that none is.
+- Saving a draft now tells you exactly which parts of your signature were added, and a signature stored as formatted text now actually appears on the message instead of being silently dropped.
+- The remote browser now runs the browser itself rather than sharing a desktop screen, which means signing in to Claude inside it works. The drag handles for resizing panels are thinner and lighter, matching the reference design.
+
+## 2026-07-30 (0.1.527)
+
+- The remote browser page now shows a live picture of the browser you can click and type into directly, replacing the old screen-sharing view.
+- The Session button on an open task now opens the chat inside the dashboard instead of sending you out to a different site, and the new session starts already knowing the task's description and notes.
+- Posting to LinkedIn from the browser extension works again. It was being stopped before the post ever left the browser, and when it failed it blamed the wrong thing; a missing permission and an unreachable device are now reported as the different problems they are.
+- The page title is smaller and the chat column can be dragged wider or narrower.
+
 ## 2026-07-30 (0.1.526)
 
 - Asking WhatsApp to reconnect now answers as soon as the reconnect starts, instead of waiting on the old connection to die and leaving you with no reply at all.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -573,6 +573,23 @@ pass's summary line, which is what makes the absence of a per-account line
 readable as "clean" rather than "never audited" — grep the summary line, not the
 per-account one, to confirm the check is running.
 
+**An unregistered file-write fence is the same shape of failure.** The
+account-dir path guard refuses a file edit whose resolved path lands inside
+another account's directory, for every session including a house-scoped one, and
+the Bash snapshot pair watches the account's own layout. All of them live in the
+account's `.claude/settings.json`, and a hook that is not registered there runs
+never and emits nothing, so the silence reads identical to a clean account. The
+same pass therefore checks the five registrations per account and reports any
+absence as
+`[fs-reconcile] op=hook-registration account=<id8> missing=<matcher>:<hook>,…`,
+with `hooks-missing=0 hooks-unaudited=0` on the summary line as the per-cycle
+proof the fence is wired everywhere. An account whose settings cannot be read
+counts as unaudited rather than clean, so an install where none of them can be
+read never reports itself as fenced. The refusal itself is agent-facing and lands
+in the session's own child log as
+`[fs-guard] blocked path=<abs> reason=cross-account target=<id8>`, not in
+`server.log`.
+
 ### Graph
 
 | Mount | Purpose |
@@ -783,15 +800,72 @@ button** while it holds text — clicking empties the input, clears results
 | Mount | Purpose |
 |---|---|
 | `/browser` | `POST /launch` — launches Chromium on the resolved transport (native display or VNC) on demand. Backs the standalone `/browser` operator page. Lifeline tag `[admin/browser/launch]`. |
+| `/browser` | `GET /screencast-targets` — the page-target list behind the screencast viewer. Server-side hop to the CDP HTTP surface, which is loopback-only; filtered to `type:'page'`. `501` off the Linux display stack, `502` when Chromium is unreachable. |
+| `/browser` | `POST /screencast-event` — relay for the client half of the `[browser/screencast]` lifeline. Accepts a fixed op allowlist (`request`, `screencast-started`, `frame`, `input`, `teardown`); the server-side ops are refused so a client cannot emit a line that reads as a server decision. |
 
 The in-chat / artefact-embedded brand-VNC iframe components and the
 `/browser-iframe` event-beacon route were retired and stay
 deleted; the `/device-browser` (navigate-the-device-tab) route was also
 removed and is not restored. The standalone `/browser` page is a
-sanctioned operator surface peer to `/graph` and `/data`: it embeds the live
-VNC viewer (`/vnc-viewer.html`, popout `/vnc-popout.html`) and calls
-`/api/admin/browser/launch`. On darwin (no noVNC asset) it shows a "VNC surface
-not available" state.
+sanctioned operator surface peer to `/graph` and `/data`.
+
+**The human view is a CDP screencast, not a framebuffer.** `/browser`
+renders `CdpScreencastSurface`: frames arrive as CDP `Page.screencastFrame` and
+paint to a canvas, and the operator's clicks, scrolling and typing leave as
+`Input.dispatch*`. Interaction therefore lands on page coordinates rather than
+screen pixels, and the view is one tab chosen from a strip rather than the whole
+X display. `VncSurface` and `/vnc-viewer.html` still exist and still work, but
+nothing reaches them, and deleting that stack is separate work.
+
+**The Claude sign-in screen shows the same surface.** `AuthScreen` used to frame
+`/vnc-viewer.html` so the operator could complete the OAuth flow by looking at
+the browser on the X display; it now mounts `CdpScreencastSurface` too. Virtual
+mode runs Chromium headless (`--headless=new`, no `DISPLAY`), and a headless
+Chromium does not serve the ProcessSingleton socket — so the old mechanism, in
+which `claude auth login` exec'd `$BROWSER <url>` and a second Chromium handed
+the URL to the running instance, aborts with exit 21 and never opens the page.
+The wrapper `writeChromiumWrapper` generates therefore hands its URL to the
+running browser over CDP (`PUT /json/new`) instead of launching anything. Two
+details are load-bearing: the URL is percent-encoded into the query string,
+because that endpoint truncates a raw URL at its first `&`, and the id of the
+created target is recorded so the sign-in poll can tell the viewer which tab to
+show rather than leaving it on whichever tab CDP lists first.
+
+The transport is `/cdp-screencast` on the dashboard's own host and port, claimed
+by the edge listener before its `forwardUpgrade` catch-all. It is gated by
+`canAccessAdmin` and rejected on operator and public hosts (`reason` values
+`origin-operator-host` and `origin-public-host`, mirroring the websockify
+rejection), and it validates the target id against a fixed 32-hex charset because
+that id is interpolated into the upstream request line. Before replaying the
+upgrade to Chromium it drops the admin session cookie and the browser `Origin`:
+Chromium is launched with no `--remote-allow-origins`, so its DevTools endpoint
+has no allowlisted origin, and the proxy has already checked same-origin itself.
+
+Chromium's debugging port is bound to `127.0.0.1` on `${CDP_PORT}` and is never
+tunnelled or bound off-localhost. That port carries no authentication and total
+control of the browser, which is why the proxy is the only path to it. Per-brand
+isolation is the `CDP_PORT` import and nothing else, so two co-resident brands
+each view their own Chromium.
+
+Off the Linux display stack, and whenever Chromium is unreachable, the surface
+renders an explicit unavailable state. That is deliberate rather than cosmetic: a
+canvas that never receives a frame is indistinguishable from a black desktop,
+where the iframe it replaced failed visibly.
+
+Observability is `[browser/screencast]` correlated by `sid` across
+`request → gate → cdp-connected → screencast-started → frame → input → teardown
+→ socket-closed`, plus `[cdp-ws-census] liveSockets=<N> sessions=<M>` on every
+open and close. Diagnostic path:
+
+```
+logs-read.sh | grep -E '\[browser/screencast\]|\[cdp-ws-census\]'
+```
+
+then filter to one `sid` for a whole session. Frame lines are sampled, so a
+frozen `seq` against a live socket is the frozen-viewer signature. `liveSockets`
+climbing while `sessions` stays flat is the leak signature: an operator tab that
+closes without a clean teardown emits no action log of its own, so the standing
+reconcile pass closes client-dead sockets and reports `op=orphan-reap closed=<N>`.
 
 ### Diagnostics
 
@@ -1092,6 +1166,55 @@ on every admin page; double-click resets to half the available width
 (viewport minus sidebar), clamped to the per-pane min-width floors. The
 chosen width is remembered across reloads.
 
+**The /chat reading measure is operator-set.** `--webchat-measure` was a fixed
+760px; it is now the FLOOR of a range the operator drags, written inline on
+`.webchat-page` by `WebchatSplitter` so the message column, the composer and the
+jump-to-latest button — all three read the same property — stay aligned. Two
+handles, one just inside each column edge, vertically centred. The column is
+centre-aligned, so one symmetric rule drives both: `measure = 2 × |pointerX −
+panelCentreX|`, which is why the two handles are interchangeable. Envelope:
+760px ≤ measure ≤ the chat panel's own width; double-click either handle to
+revert to 760px and clear the stored value; the measure persists in
+`localStorage` under `maxy-webchat-measure-px` and re-clamps on window resize and
+on any panel-width change (sidebar drag, artefact open/close). No handle renders
+below a 640px viewport, where the media query already gives the column the full
+width. A measure wider than its panel does not overflow — the column just fills
+the panel — so that state emits nothing on its own; the standing check is
+`[admin-ui] op=webchat-measure-audit measurePx= panelPx= availPx= columnPx=
+handles= governed= fit=`, emitted on mount and on every re-clamp with identical
+consecutive readings suppressed. `columnPx` is the measured `.wa-thread-scroll`
+rect, not the property read back, so a property written to the wrong element
+shows as `measurePx=1200 columnPx=760`; `columnPx=-1` means no transcript is
+mounted (the greeting panel). `fit=false` or `handles=` disagreeing with
+`governed=` is the failure. A completed drag logs `[admin-ui] webchat-resize
+px=<final>`; a bare click logs nothing.
+
+**All four resize handles draw one pill.** The `/chat` column pills,
+the composer grip, and the sidebar and artefact splitters each paint a 3px-thick,
+48px-long rounded pill (32px long on the horizontal composer grip) in
+`--text-tertiary`, at half strength when idle and full strength on hover. Every
+box keeps its old size — 8px wide for the three vertical surfaces — so the pill
+got thinner and the grab target did not. Thickness and length come from
+`--resize-grip-thickness` / `--resize-grip-length`; the colour is read as
+`var(--text-tertiary)` on each pill rather than through an alias, because a
+`var()` inside a custom property is substituted on the element that DECLARES it,
+which would freeze the colour at the base `#9A9A9A` instead of the surface's own
+value (measured inside `.admin-shell`: `rgb(154,154,154)` through an alias,
+`rgb(138,133,122)` direct). A pill that never paints emits no event and does not
+reproduce on a re-open, and the measure audit above counts elements rather than
+pixels, so the standing check is `[admin-ui] op=resize-grip-audit
+surface=<column-left|column-right|sidebar> thicknessPx= lengthPx= color= opacity=
+boxPx= painted=`, emitted for the two column pills on mount and on every
+re-clamp, and for the sidebar splitter once per mount. `opacity=` is the strength
+the operator actually sees: the column pills carry it on the box and the two
+splitters carry it on the pill, and the line multiplies both, so a pill hidden at
+either level reports `opacity=0`.
+`painted=false` or `thicknessPx=0` means an invisible handle; `thicknessPx=8`
+means the box is painting and the pill rule never applied; a missing line for a
+surface that should be mounted is itself the alarm. `painted=false
+source=unavailable` is the expected reading wherever pseudo-element styles are
+not reported (the jsdom test environment), never a real zero.
+
 ## Health vs version
 
 Two endpoints, two surfaces, two restart-survival roles:

package/payload/platform/plugins/docs/references/deployment.md

@@ -201,7 +201,7 @@ The logs will show which service failed to start and why. Common causes:
 Each installed brand runs two per-brand `--user` systemd units (earlier platform fixes + — unit filenames are prefixed with the brand's `hostname` so two brands on the same device never share a unit file):
 
 - `{hostname}.service` — the admin + public HTTP server on `127.0.0.1:19201` (public port + 1). Restarted by the upgrade flow; short downtime is expected during steps 8→11 of an upgrade. An earlier fix: the unit carries two port env vars — `PORT=<public>` (canonical public port, read by the upgrade detector) and `MAXY_UI_INTERNAL_PORT=<public+1>` (the port maxy-ui actually binds).
-- `{hostname}-edge.service` — the always-on public listener on the configured port (default 19200). Reverse-proxies HTTP to the main brand service and handles `/websockify` (VNC) WebSocket upgrades locally. An earlier fix: also hosts `/api/admin/actions/*` and `/api/admin/version*` — the Software Update modal's own routes — so the log stream survives the brand service's restart window. Does NOT restart during an upgrade — the browser WebSocket stays connected by construction. The operator views this VNC display in the admin UI via the standalone `/browser` page (peer to `/graph` and `/data`).
+- `{hostname}-edge.service` — the always-on public listener on the configured port (default 19200). Reverse-proxies HTTP to the main brand service and handles `/websockify` (VNC) WebSocket upgrades locally. An earlier fix: also hosts `/api/admin/actions/*` and `/api/admin/version*` — the Software Update modal's own routes — so the log stream survives the brand service's restart window. Does NOT restart during an upgrade — the browser WebSocket stays connected by construction. The operator views the device's Chromium in the admin UI via the standalone `/browser` page (peer to `/graph` and `/data`) and on the Claude sign-in screen; both render CDP screencast frames over `/cdp-screencast`, not the framebuffer. Virtual-mode Chromium is headless, so nothing renders onto the X display and the `/websockify` upgrade has no remaining consumer; deleting that stack is separate work.
 
 Upgrade and Cloudflare setup run as detached actions: `systemd-run --user` transient units per invocation with stdout+stderr persisted to `~/.maxy/logs/actions/<actionId>.log` and streamed to the UI via SSE. No boot-time service file exists for these.
 

package/payload/platform/plugins/docs/references/internals.md

@@ -560,7 +560,7 @@ For estate-agent client work surfaced on the `/tasks` operator page, `work-creat
 
 Two surfaces feed the gate. (1) **Workflow path:** `memory-write` accepts an optional `producedByTaskId` parameter. When set, an inbound `:PRODUCED` edge from that Task is composed into the write's relationships before the gate runs — the typical agent-side pattern is to call `work-create` at the start of an autonomous flow, capture `taskId`, and pass it as `producedByTaskId` on every subsequent `memory-write` for a gated label. The gate verifies Task and write share the same `accountId`; mismatch is rejected loud. (2) **Direct-ask path:** the admin server resolves the active `:AdminConversation`'s `sessionId` UUID and stamps it as `SESSION_NODE_ID` in the spawn env at PTY-spawn time. The same stamp propagates onto specialist subagent spawns the admin dispatches so listing-curator, content-producer, database-operator etc. inherit the same conversation anchor. The `contact-create` and `memory-write` wrappers call `injectConversationProvenance` (exported from [`@maxy/graph-write`](../../../lib/graph-write/src/conversation-provenance.ts)) which MATCHes `(c:Conversation {sessionId, accountId})` — account isolation is part of the natural key, not a separate gate — and prepends the synthetic `:PRODUCED` edge (composed by Neo4j elementId, which the helper reads off the MATCH). No agent-visible schema field changes. `memory-write` uses the env-stamp only as a fallback when `producedByTaskId` is unset; `contact-create` has no `producedByTaskId` parameter today and relies on the env-stamp alone. Autonomous (cron-driven) specialists with no parent conversation legitimately have no env-stamp; those must thread `producedByTaskId`.
 
-A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one, which is how a resume the session manager redirected to a live fork re-points itself rather than staying on the dead source. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
+A task also carries a **workspace** edge, distinct from the two provenance ones above: `(t:Task)-[:WORKED_ON_IN]->(c:Conversation)` is the session an operator works the task in, written only by the `/tasks` page Session control. `RAISED_DURING` and `PART_OF` say where a task was *raised*, so neither can answer "which chat do I continue this task in" — a task raised in an unrelated conversation would resume that one. At most one such edge exists per task: the control's link route deletes any edge to a different Conversation before merging the new one. The link route runs only on a first click, when the task has no session yet; a click on an already-linked task navigates straight to `/chat?session=<id>` and writes nothing, so an edge is never re-pointed after it is first written. The `:Task` also carries `sessionSpawnRequestedAt`, stamped before the spawn and removed when the link lands, so a session that was created but never linked is countable rather than invisible.
 
 Operator audit cyphers:
 - "What entities did this conversation's actions produce?" — `MATCH (c:AdminConversation {sessionId:$id})<-[:RAISED_DURING]-(t:Task)-[:PRODUCED]->(e) RETURN labels(e), e.name, t.kind, t.status`

package/payload/platform/plugins/docs/references/platform.md

@@ -85,7 +85,7 @@ There is no dashboard, no settings panel, no menus. Everything is done through c
 
 The chat input auto-grows as you type — it expands to fit your message and shrinks back when you delete text. You can also drag the resize handle above the input to set a custom height.
 
-The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
+The admin interface is a three-pane layout: a sidebar on the left with navigation (Sessions, People, Agents, Projects, Tasks, Artefacts) and your recent conversations; the chat in the middle; and an artefact pane on the right that opens when you select a document, click a project, or open Browser, Data, or Graph from the menu, holding the surface side-by-side with the conversation so the chat stays live while you work in it. At the very top of the sidebar — above the nav rows — a borderless row holds two controls: a "+ New session" button on the left that spawns a fresh Claude Code session, and a Mode trigger on the right showing the current permission mode (Ask, Accept edits, Plan, or Auto). The sidebar's vertical order is: new-session strip first, then the nav (Sessions, People, Agents, Projects, Tasks, Artefacts), then the sessions list, then the footer. Both controls render as plain text-plus-icon affordances with no surrounding rectangle. The "+ New session" button is a text-width hit target — its clickable area is exactly the icon plus label, not the whole row — and shows no hover fill; the only hover feedback is the pointer cursor. The Mode trigger is pushed flush to the right edge of the row. Clicking the Mode trigger opens a popover downward from the row whose header reads "Mode" and lists the four permission modes with the current selection check-marked. The sidebar's nav rows swap the list view in place: Sessions shows recent conversations, Projects shows your active work projects, and Artefacts lists every KnowledgeDocument plus this account's agent templates (your admin agent's IDENTITY, SOUL, and KNOWLEDGE files plus one entry per enabled specialist). Each recent session row carries a three-state indicator: three pulsing dots when the session is busy (currently processing a turn), a solid sage dot when it is idle (live PTY waiting for input), and a hollow ring when it is archived (PTY exited, JSONL on disk for audit). The list itself splits into three views via a segmented control above the rows: **Active** shows every live session, **Archived** shows every JSONL on disk whose PTY has exited, and **All** shows both. The view choice persists across reloads. An "Include subagents" toggle inside the Active view surfaces specialist spawns (database-operator, premium-plugin agents, anything spawned with a `--agent` flag) which are hidden by default so the list reflects what you started directly. Each row also carries a small uppercase badge — `admin` for operator-driven sessions, the specialist name (for example `db-op`) for background work — so the source of any row is unambiguous at a glance. The People, Agents, and Tasks rows are graph shortcuts: clicking each opens the artefact-pane Graph filtered to every Person, every public Agent, or every Task in your account respectively, with no side-list, because the graph itself is the result. Public agents become first-class graph entities the moment you create them, with edges to their IDENTITY/SOUL/KNOWLEDGE files, edges to every knowledge document they have access to, and edges from every conversation they have handled, so a single Agents click reveals the whole shape of who knows what and who has been talking to whom. Click an artefact row to open the document. KnowledgeDocuments and your admin agent's templates are editable: type in the document and changes save automatically; specialist agent templates are read-only because they ship with SiteDesk and your edits would be overwritten on the next install. PDF artefacts render inline so you can read them without leaving the pane. If your browser doesn't have a built-in PDF viewer, a Download button appears instead. Artefacts that have no readable file backing them (orphan rows, files removed from disk, unsupported content types) show a one-line banner explaining the skip instead of opening to a blank pane. Click a project row to open the Graph view focused on that project's neighbourhood; clicking a second project swaps the focus rather than stacking on top. The sidebar's right edge is drag-resizable on every shell-hosted admin page (Sessions root, Chat, Graph, Browser, and Data): drag the handle to widen or narrow the sidebar, and your chosen width is remembered across reloads and shared across all of them. AdminShell mounts the drag handle itself, so every route that wraps its content in `<AdminShell>` gets sidebar resize for free; the handle does not render in the mobile drawer. The chat and artefact divider is also drag-resizable: drag the line between the columns to make either side wider; double-click it to reset to half of the available width (viewport minus sidebar), clamped to the chat and artefact min-width floors. Your chosen width is remembered across reloads. The conversation column on the Chat page has its own width control: a small handle sits half way up the page just inside each side of the column, and dragging either one widens or narrows the reading measure. The column stays centred, so both handles do the same thing — dragging the left one out and the right one out by the same distance give the same width. It will not go below its default 760px and will not go wider than the chat panel itself; the messages, the input box and the jump-to-latest button all move together. Double-click either handle to go back to 760px. Your chosen width is remembered across reloads. The handles do not appear on a phone (below 640px), where the conversation already fills the width. On wider screens (>1280px) all three panes are visible. The sidebar narrows at 1280px, the artefact pane hides at 1080px (Browser, Data, and Graph then open as full-window pages instead), and the sidebar collapses to a 56px icon rail at 820px. On every viewport the chat header reads left to right as a triptych: a dedicated sidebar toggle (the panel-right icon, which swaps to panel-right-open when the sidebar is showing), the brand mark next to the title in the centre, and the menu burger on the right. This header toggle is the sole sidebar-toggle button; the sidebar itself no longer carries a duplicate. The burger opens the navigation flyout: Dashboard, Data, Graph, Browser, and Chat at the top — Dashboard routes back to `/`, so every satellite page keeps a one-click way home, and the Chat item carries the Claude mark rather than a generic icon — then Public (the agents list) between the two dividers, and below the second divider the version row, Disconnect Claude, and Log out. Tap the sidebar toggle to show or hide the sidebar: on phones (<720px) it slides the drawer in or out, on wider screens it collapses or expands the sidebar column. The brand mark in the centre is decorative; clicks go through the dedicated toggle so the affordance is unambiguous. The drawer animation only fires on tap (220ms slide in or out); resizing your window across the 720px boundary snaps the layout without animation, so you never see a half-open flash. At ≤640px the session metadata pane stacks each label above its value instead of the desktop two-column grid, and the row of action buttons (Open in new tab / Download JSONL / View JSONL / Rename / Pin / Archive / End or Purge) collapses behind a single Actions trigger that opens a popover upward from the foot of the pane. Breakpoint summary: >1280px = full sidebar + chat + artefact pane (drag-resizable divider); 1280px→1080px = sidebar narrows; 1080px→820px = artefact pane hides (Browser/Data/Graph open as full-window pages instead); 820px→720px = sidebar collapses to 56px icon rail; ≤720px = sidebar becomes off-canvas drawer (vertical stack of nav, recents list, foot, the same shape as the desktop sidebar, just on top of the chat instead of beside it).
 
 Page titles are brand-aware: the browser tab shows your product name (e.g. `Real Agent` instead of `SiteDesk`) on every shell — chat, graph, and data — so a non-default brand never leaks the default name in tab strips or browser history.
 

package/payload/platform/plugins/docs/references/plugins-guide.md

@@ -186,7 +186,8 @@ There is no per-conversation stream log that interleaves MCP stderr with agent e
 
 **Retrieve MCP diagnostic lines for a conversation:**
 
-- `logs-read { type: "mcp" }` → tails the most recent `mcp-<name>-*.log` (per-server, keyed by session).
+- `logs-read { type: "mcp" }` → tails the most recent `mcp-<name>-*.log` under `~/.<brand>/logs`, the platform config dir the tee writes to — not the account log dir, which holds no `mcp-*` at all.
+- `logs-read { type: "mcp", sessionKey }` → tails every `mcp-*.log` whose **filename** carries that key, one section per server, up to 20 files; a truncated reply names how many matched so the cap is never silent. An 8-character key prefix matches the full session id in the name. The key is never matched against file contents, because MCP log lines carry no session key.
 
 ## Failure-path observability contract