@rubytech/create-sitedesk-code 0.1.527 → 0.1.529

package/payload/platform/plugins/admin/mcp/dist/tools/linkedin-ingest-token.d.ts

@@ -0,0 +1,10 @@
+export type IngestTokenAction = "show" | "rotate";
+export interface IngestTokenResult {
+    token: string;
+    /** True only when this call created the token. */
+    minted: boolean;
+    /** True only when this call replaced an existing token. */
+    rotated: boolean;
+}
+export declare function resolveIngestToken(accountsDir: string, accountId: string, action: IngestTokenAction): IngestTokenResult;
+//# sourceMappingURL=linkedin-ingest-token.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/tools/linkedin-ingest-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkedin-ingest-token.d.ts","sourceRoot":"","sources":["../../src/tools/linkedin-ingest-token.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,MAAM,EAAE,OAAO,CAAC;IAChB,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,GACxB,iBAAiB,CAMnB"}

package/payload/platform/plugins/admin/mcp/dist/tools/linkedin-ingest-token.js

@@ -0,0 +1,22 @@
+/**
+ * linkedin-ingest-token — hand the operator the LinkedIn extension's durable
+ * credential (Task 2208).
+ *
+ * The agent walks the operator through side-loading the extension and then has
+ * to supply a credential. Before this tool the docs pointed at a `session_key`
+ * cookie that is never minted, so the operator pasted conversation session keys
+ * and every capture came back 401. This is the deterministic source of the one
+ * value the extension needs.
+ *
+ * IDENTITY.md forbids the agent editing account.json directly, so the write
+ * goes through here rather than through Edit.
+ */
+import { ensureIngestToken, rotateIngestToken, } from "../../../../../lib/account-ingest-token/dist/index.js";
+export function resolveIngestToken(accountsDir, accountId, action) {
+    if (action === "rotate") {
+        return { token: rotateIngestToken(accountsDir, accountId), minted: false, rotated: true };
+    }
+    const { token, minted } = ensureIngestToken(accountsDir, accountId);
+    return { token, minted, rotated: false };
+}
+//# sourceMappingURL=linkedin-ingest-token.js.map

package/payload/platform/plugins/admin/mcp/dist/tools/linkedin-ingest-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkedin-ingest-token.js","sourceRoot":"","sources":["../../src/tools/linkedin-ingest-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uDAAuD,CAAC;AAY/D,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,SAAiB,EACjB,MAAyB;IAEzB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACpE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/tools/logs-read-mcp.d.ts

@@ -0,0 +1,16 @@
+export declare const MCP_LOG_PREFIX = "mcp-";
+/**
+ * Most files one key may fan out to. The key is a substring match, so a short
+ * key matches many names — the measured device dir holds 552 `mcp-*` files.
+ * A truncated result always names the total, so the cap is never silent.
+ */
+export declare const MCP_KEY_MATCH_CAP = 20;
+/**
+ * Tail every `mcp-*.log` in `mcpLogDir` whose FILENAME contains `sessionKey`,
+ * up to `MCP_KEY_MATCH_CAP` files. An 8-character key prefix matches a
+ * filename carrying the full session id.
+ */
+export declare function readMcpLogsByKey(mcpLogDir: string, sessionKey: string, lines: number): string;
+/** Tail the most recently modified `mcp-*.log` in `mcpLogDir`. */
+export declare function readLatestMcpLog(mcpLogDir: string, lines: number): string;
+//# sourceMappingURL=logs-read-mcp.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/tools/logs-read-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs-read-mcp.d.ts","sourceRoot":"","sources":["../../src/tools/logs-read-mcp.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,cAAc,SAAS,CAAC;AAErC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAcpC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAmB7F;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAazE"}

package/payload/platform/plugins/admin/mcp/dist/tools/logs-read-mcp.js

@@ -0,0 +1,69 @@
+/**
+ * logs-read type=mcp — resolution and tail.
+ *
+ * The MCP stderr sink is written by `lib/mcp-spawn-tee` (src/index.ts:60-65)
+ * as `${LOG_DIR}/mcp-<server>-<sessionId>.log`, where that LOG_DIR is the
+ * session manager's `config.persistDir/logs` — `~/.<brand>/logs`, the admin
+ * MCP's CONFIG_DIR. It is NOT the per-account log dir, which is where
+ * logs-read looked until Task 2168.
+ *
+ * The session key lives in the FILENAME. No line inside the file carries it,
+ * so a content grep — the strategy every other per-session type uses —
+ * returns nothing here however the directory is resolved.
+ *
+ * Caller supplies the directory; this module never resolves one itself.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+export const MCP_LOG_PREFIX = "mcp-";
+/**
+ * Most files one key may fan out to. The key is a substring match, so a short
+ * key matches many names — the measured device dir holds 552 `mcp-*` files.
+ * A truncated result always names the total, so the cap is never silent.
+ */
+export const MCP_KEY_MATCH_CAP = 20;
+function isMcpLog(file) {
+    return file.startsWith(MCP_LOG_PREFIX) && file.endsWith(".log");
+}
+function missingDir(mcpLogDir) {
+    return `No MCP logs on this install yet (resolved dir does not exist on disk): ${mcpLogDir}. MCP server stderr is teed there on the first plugin spawn.`;
+}
+function tail(filePath, lines) {
+    return execFileSync("tail", ["-n", String(lines), filePath], { timeout: 5000 }).toString();
+}
+/**
+ * Tail every `mcp-*.log` in `mcpLogDir` whose FILENAME contains `sessionKey`,
+ * up to `MCP_KEY_MATCH_CAP` files. An 8-character key prefix matches a
+ * filename carrying the full session id.
+ */
+export function readMcpLogsByKey(mcpLogDir, sessionKey, lines) {
+    if (!existsSync(mcpLogDir))
+        return missingDir(mcpLogDir);
+    const matches = readdirSync(mcpLogDir)
+        .filter(f => isMcpLog(f) && f.includes(sessionKey))
+        .sort();
+    if (matches.length === 0) {
+        return `No ${MCP_LOG_PREFIX}*.log filename contains session key "${sessionKey}" (resolved dir: ${mcpLogDir}, prefix: ${MCP_LOG_PREFIX}). The key is matched against the FILENAME, not the file contents — MCP log lines carry no session key.`;
+    }
+    const shown = matches.slice(0, MCP_KEY_MATCH_CAP);
+    const header = matches.length > shown.length
+        ? `# MCP logs for session key: ${sessionKey}\n${matches.length} filenames matched, showing the first ${shown.length} — narrow the key to see the rest.`
+        : `# MCP logs for session key: ${sessionKey}`;
+    const sections = shown.map(file => `## ${file}\n${tail(resolve(mcpLogDir, file), lines)}`);
+    return `${header}\n\n${sections.join("\n\n")}`;
+}
+/** Tail the most recently modified `mcp-*.log` in `mcpLogDir`. */
+export function readLatestMcpLog(mcpLogDir, lines) {
+    if (!existsSync(mcpLogDir))
+        return missingDir(mcpLogDir);
+    const match = readdirSync(mcpLogDir)
+        .filter(isMcpLog)
+        .map(file => ({ file, mtime: statSync(resolve(mcpLogDir, file)).mtimeMs }))
+        .sort((a, b) => b.mtime - a.mtime)[0];
+    if (!match) {
+        return `No log file found for type 'mcp' (resolved dir: ${mcpLogDir}, prefix: ${MCP_LOG_PREFIX})`;
+    }
+    return `# ${match.file}\n\n${tail(resolve(mcpLogDir, match.file), lines)}`;
+}
+//# sourceMappingURL=logs-read-mcp.js.map

package/payload/platform/plugins/admin/mcp/dist/tools/logs-read-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs-read-mcp.js","sourceRoot":"","sources":["../../src/tools/logs-read-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB;IACnC,OAAO,0EAA0E,SAAS,8DAA8D,CAAC;AAC3J,CAAC;AAED,SAAS,IAAI,CAAC,QAAgB,EAAE,KAAa;IAC3C,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,UAAkB,EAAE,KAAa;IACnF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;SAClD,IAAI,EAAE,CAAC;IAEV,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,cAAc,wCAAwC,UAAU,oBAAoB,SAAS,aAAa,cAAc,yGAAyG,CAAC;IACjP,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAClD,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;QAC3B,CAAC,CAAC,+BAA+B,UAAU,KAAK,OAAO,CAAC,MAAM,yCAAyC,KAAK,CAAC,MAAM,oCAAoC;QACvJ,CAAC,CAAC,+BAA+B,UAAU,EAAE,CAAC;IAElD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3F,OAAO,GAAG,MAAM,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,KAAa;IAC/D,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC;SACjC,MAAM,CAAC,QAAQ,CAAC;SAChB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SAC1E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAExC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,mDAAmD,SAAS,aAAa,cAAc,GAAG,CAAC;IACpG,CAAC;IAED,OAAO,KAAK,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC"}

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what SiteDesk ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:10d4f123ccb98ccdd68e27e8d22854fb1d9d5dfd985358ff1afa7f5361b25dfa
+content-hash: sha256:a4d904a0b258e267d582d5bd8e968e1de3734c6e60863c401ea5e1b185bccba5
 brand: sitedesk-code
 product-name: SiteDesk
 ---
@@ -510,7 +510,8 @@ There is no per-conversation stream log that interleaves MCP stderr with agent e
 
 **Retrieve MCP diagnostic lines for a conversation:**
 
-- `logs-read { type: "mcp" }` → tails the most recent `mcp-<name>-*.log` (per-server, keyed by session).
+- `logs-read { type: "mcp" }` → tails the most recent `mcp-<name>-*.log` under `~/.<brand>/logs`, the platform config dir the tee writes to — not the account log dir, which holds no `mcp-*` at all.
+- `logs-read { type: "mcp", sessionKey }` → tails every `mcp-*.log` whose **filename** carries that key, one section per server, up to 20 files; a truncated reply names how many matched so the cap is never silent. An 8-character key prefix matches the full session id in the name. The key is never matched against file contents, because MCP log lines carry no session key.
 
 ## Failure-path observability contract
 
@@ -2853,7 +2854,7 @@ Capture a LinkedIn profile or DM thread to your SiteDesk graph with one click. T
 5. Click the puzzle icon → pin **SiteDesk LinkedIn Ingest** → open its options.
 6. Paste two values:
    - **Admin host** — your tunnel URL, e.g. `https://your-tunnel.example.com`.
-   - **Session key** — open your admin browser, copy the value of `session_key` from the cookie. (Same key the admin uses to authenticate every other admin request.)
+   - **Ingest token** — ask your SiteDesk agent for the ingest token. It mints one on request and hands it to you in the chat. The same value keeps working: it survives restarts and new chat sessions, and it does not expire. This is not a conversation session key, and not the admin browser's `session_key`; the route accepts neither.
 7. Save. The pill is now armed.
 
 ## Use
@@ -2878,7 +2879,7 @@ The plugin will never create `:Communication`, `:ConversationArchive` rows (i.e.
 
 ## When the pill turns amber
 
-The pill shows **Sign in to SiteDesk** when your session key has expired. Click it to open the options page; paste a fresh `session_key` from your admin browser; save. The next click on the LinkedIn pill will succeed.
+The pill shows **Paste SiteDesk token** when the ingest token is missing or was refused. Click it to open the options page, ask your SiteDesk agent for the ingest token, paste it, and save. The next click on the LinkedIn pill will succeed. There is no sign-in step: the token is the whole credential, and the only way it stops working is if someone rotates it.
 
 ## When the pill turns red
 
@@ -3362,7 +3363,7 @@ The route (`server/routes/admin/routines.ts`) is account-scoped like `calendar.t
 | `GET /api/admin/routines/:eventId/runs` | One routine's `:RoutineRun` history, newest first. `limit` clamps to 1..500 and defaults to 50, so a caller that wants the full page must ask for it. |
 | `GET /api/admin/routines/:eventId/runs.csv` | The same projection as a `text/csv` attachment with `Content-Disposition`, and **no** limit, so it is not the same row set as a clamped `/runs` call. Re-parses its own output and returns 500 rather than serving a document with fewer rows than the query returned. Zero rows is 404, not a header-only file: the query cannot tell a routine with no runs from an `eventId` on another account. |
 | `PATCH /api/admin/routines/:eventId` | Edits `agentPrompt`, `recurrence`, and the `agentChannel`/`agentDestination` pair. Cron validation and the timezone-aware `nextRun` recompute copy the scheduling plugin's `schedule-update` tool. The binding is revalidated against the same house-authority rule, shared as `platform/lib/agent-dispatch-rule`; it is refused `partial-binding`, `invalid-channel`, `no-prompt`, `not-registered`, `cross-account`, `action-routine` (a routine that runs a tool keeps it — an agent binding outranks the action at fire time) or `clear-would-orphan` (clearing the only field holding a one-time routine inside the automation filter would hide it from every routines surface), and no refusal writes. Both fields as `null` clears the binding. An invalid cron is rejected 400 with no write. Only creation and deletion stay agent-only (`schedule-event`/`schedule-cancel`). |
-| `GET /api/admin/dispatch-destinations` | Every destination the session's account may bind a routine to, across both channels, each labelled by the authoritative list it came from (`House admin`, `Account manager`, `Telegram admin`). Computed from the same lists the validator reads and filtered by the same rule, so the picker cannot offer what the save refuses. |
+| `GET /api/admin/dispatch-destinations` | Every destination the session's account may bind a routine to, across both channels, each labelled by the authoritative list it came from (`House admin`, `Account manager`, `Telegram admin`), plus an optional `name`: a display-only person name resolved from `:Person` in the row's own account scope — the house for a `House admin` row, the managed sub-account for an `Account manager` row, and never for Telegram, whose destinations are chat ids. Computed from the same lists the validator reads and filtered by the same rule, so the picker cannot offer what the save refuses; `name` is never part of what Save posts, and a graph outage returns an unnamed roster rather than an error. |
 | `POST /api/admin/routines/:eventId/suspend` | Writes `eventStatus = 'suspended'` on a routine currently `'scheduled'`. 404s otherwise, so a second suspend is not a silent no-op. |
 | `POST /api/admin/routines/:eventId/resume` | Returns a suspended routine to `'scheduled'`. 404s if it is not suspended, 409s if it cannot be resumed. |
 | `POST /api/admin/routines/suspend-all` | Suspends every routine currently `'scheduled'` and marks each one. Returns the count. |
@@ -3396,6 +3397,18 @@ rows — a routine suspended one at a time carries no mark and stays suspended,
 which is what makes resume-all safe to press. The seeded roster is unmarked by
 construction, so resume-all never enables it.
 
+**The modal states why a routine is in the state it is in.** Every trigger,
+dispatch, suspend and resume appends one `[<iso>] <text>` line to the routine's
+own `notes`, and the detail modal lists that trail newest first under
+`History (<n> entries)`. So a suspended routine names its reason, the path that
+suspended it (`Suspended from chat`, `Suspended from the routines dashboard`,
+`Suspended by a suspend-all from the routines dashboard`) and the time, without
+reading the graph. Entries render as stored and none is dropped; the box scrolls.
+A routine with no trail says `No history recorded.`, which is the true state of a
+seeded roster routine that has never run. This is not the run history: a
+`:RoutineRun` node records a fire, and a status change is not a fire, so a
+suspension appears only here.
+
 Observability rides `[admin:routines]`: `op=list accountId=<8> count=<n>`,
 `op=get id=<8> found=<bool>`, `op=patch id=<8> fields=<…> outcome=ok|rejected
 reason=<invalid-cron|not-found> nextRun=<…> cron=<serialized>`, and
@@ -3405,6 +3418,15 @@ past-one-time|invalid-cron>`. A `count=0` while routines exist for the account i
 the account-scope-miss signature; the logged `cron=` on `outcome=ok` confirms the
 persisted expression without opening the graph.
 
+The panel can only show a reason that was written, and a suspend path that wrote
+no note emits no event of its own. The scheduling sweep's standing census closes
+that: `[schedule-audit] op=suspension-census` carries `unattributed=<n>`, the
+count of suspended routines whose notes never record the suspension, on every
+tick including zero. It sits outside the `other=` arithmetic, which reconciles
+status buckets against the row count rather than attribution. A routine seeded
+suspended and never touched carries no notes and is excluded, having nothing to
+attribute.
+
 Two scheduler-side lines close the loop, because a suspend that the sweep ignores
 looks identical to a healthy routine until it fires. `[schedule-sweep]
 op=skip-suspended account=<8> count=<n>` is emitted every sweep for every local
@@ -3799,6 +3821,23 @@ pass's summary line, which is what makes the absence of a per-account line
 readable as "clean" rather than "never audited" — grep the summary line, not the
 per-account one, to confirm the check is running.
 
+**An unregistered file-write fence is the same shape of failure.** The
+account-dir path guard refuses a file edit whose resolved path lands inside
+another account's directory, for every session including a house-scoped one, and
+the Bash snapshot pair watches the account's own layout. All of them live in the
+account's `.claude/settings.json`, and a hook that is not registered there runs
+never and emits nothing, so the silence reads identical to a clean account. The
+same pass therefore checks the five registrations per account and reports any
+absence as
+`[fs-reconcile] op=hook-registration account=<id8> missing=<matcher>:<hook>,…`,
+with `hooks-missing=0 hooks-unaudited=0` on the summary line as the per-cycle
+proof the fence is wired everywhere. An account whose settings cannot be read
+counts as unaudited rather than clean, so an install where none of them can be
+read never reports itself as fenced. The refusal itself is agent-facing and lands
+in the session's own child log as
+`[fs-guard] blocked path=<abs> reason=cross-account target=<id8>`, not in
+`server.log`.
+
 ### Graph
 
 | Mount | Purpose |
@@ -4024,7 +4063,21 @@ paint to a canvas, and the operator's clicks, scrolling and typing leave as
 `Input.dispatch*`. Interaction therefore lands on page coordinates rather than
 screen pixels, and the view is one tab chosen from a strip rather than the whole
 X display. `VncSurface` and `/vnc-viewer.html` still exist and still work, but
-nothing on `/browser` reaches them, and retiring that stack is separate work.
+nothing reaches them, and deleting that stack is separate work.
+
+**The Claude sign-in screen shows the same surface.** `AuthScreen` used to frame
+`/vnc-viewer.html` so the operator could complete the OAuth flow by looking at
+the browser on the X display; it now mounts `CdpScreencastSurface` too. Virtual
+mode runs Chromium headless (`--headless=new`, no `DISPLAY`), and a headless
+Chromium does not serve the ProcessSingleton socket — so the old mechanism, in
+which `claude auth login` exec'd `$BROWSER <url>` and a second Chromium handed
+the URL to the running instance, aborts with exit 21 and never opens the page.
+The wrapper `writeChromiumWrapper` generates therefore hands its URL to the
+running browser over CDP (`PUT /json/new`) instead of launching anything. Two
+details are load-bearing: the URL is percent-encoded into the query string,
+because that endpoint truncates a raw URL at its first `&`, and the id of the
+created target is recorded so the sign-in poll can tell the viewer which tab to
+show rather than leaving it on whichever tab CDP lists first.
 
 The transport is `/cdp-screencast` on the dashboard's own host and port, claimed
 by the edge listener before its `forwardUpgrade` catch-all. It is gated by
@@ -4384,6 +4437,32 @@ mounted (the greeting panel). `fit=false` or `handles=` disagreeing with
 `governed=` is the failure. A completed drag logs `[admin-ui] webchat-resize
 px=<final>`; a bare click logs nothing.
 
+**All four resize handles draw one pill.** The `/chat` column pills,
+the composer grip, and the sidebar and artefact splitters each paint a 3px-thick,
+48px-long rounded pill (32px long on the horizontal composer grip) in
+`--text-tertiary`, at half strength when idle and full strength on hover. Every
+box keeps its old size — 8px wide for the three vertical surfaces — so the pill
+got thinner and the grab target did not. Thickness and length come from
+`--resize-grip-thickness` / `--resize-grip-length`; the colour is read as
+`var(--text-tertiary)` on each pill rather than through an alias, because a
+`var()` inside a custom property is substituted on the element that DECLARES it,
+which would freeze the colour at the base `#9A9A9A` instead of the surface's own
+value (measured inside `.admin-shell`: `rgb(154,154,154)` through an alias,
+`rgb(138,133,122)` direct). A pill that never paints emits no event and does not
+reproduce on a re-open, and the measure audit above counts elements rather than
+pixels, so the standing check is `[admin-ui] op=resize-grip-audit
+surface=<column-left|column-right|sidebar> thicknessPx= lengthPx= color= opacity=
+boxPx= painted=`, emitted for the two column pills on mount and on every
+re-clamp, and for the sidebar splitter once per mount. `opacity=` is the strength
+the operator actually sees: the column pills carry it on the box and the two
+splitters carry it on the pill, and the line multiplies both, so a pill hidden at
+either level reports `opacity=0`.
+`painted=false` or `thicknessPx=0` means an invisible handle; `thicknessPx=8`
+means the box is painting and the pill rule never applied; a missing line for a
+surface that should be mounted is itself the alarm. `painted=false
+source=unavailable` is the expected reading wherever pseudo-element styles are
+not reported (the jsdom test environment), never a real zero.
+
 ## Health vs version
 
 Two endpoints, two surfaces, two restart-survival roles:
@@ -5606,7 +5685,7 @@ The logs will show which service failed to start and why. Common causes:
 Each installed brand runs two per-brand `--user` systemd units (earlier platform fixes + — unit filenames are prefixed with the brand's `hostname` so two brands on the same device never share a unit file):
 
 - `{hostname}.service` — the admin + public HTTP server on `127.0.0.1:19201` (public port + 1). Restarted by the upgrade flow; short downtime is expected during steps 8→11 of an upgrade. An earlier fix: the unit carries two port env vars — `PORT=<public>` (canonical public port, read by the upgrade detector) and `MAXY_UI_INTERNAL_PORT=<public+1>` (the port maxy-ui actually binds).
-- `{hostname}-edge.service` — the always-on public listener on the configured port (default 19200). Reverse-proxies HTTP to the main brand service and handles `/websockify` (VNC) WebSocket upgrades locally. An earlier fix: also hosts `/api/admin/actions/*` and `/api/admin/version*` — the Software Update modal's own routes — so the log stream survives the brand service's restart window. Does NOT restart during an upgrade — the browser WebSocket stays connected by construction. The operator views this VNC display in the admin UI via the standalone `/browser` page (peer to `/graph` and `/data`).
+- `{hostname}-edge.service` — the always-on public listener on the configured port (default 19200). Reverse-proxies HTTP to the main brand service and handles `/websockify` (VNC) WebSocket upgrades locally. An earlier fix: also hosts `/api/admin/actions/*` and `/api/admin/version*` — the Software Update modal's own routes — so the log stream survives the brand service's restart window. Does NOT restart during an upgrade — the browser WebSocket stays connected by construction. The operator views the device's Chromium in the admin UI via the standalone `/browser` page (peer to `/graph` and `/data`) and on the Claude sign-in screen; both render CDP screencast frames over `/cdp-screencast`, not the framebuffer. Virtual-mode Chromium is headless, so nothing renders onto the X display and the `/websockify` upgrade has no remaining consumer; deleting that stack is separate work.
 
 Upgrade and Cloudflare setup run as detached actions: `systemd-run --user` transient units per invocation with stdout+stderr persisted to `~/.maxy/logs/actions/<actionId>.log` and streamed to the UI via SSE. No boot-time service file exists for these.
 

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,19 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-30 (0.1.529)
+
+- The LinkedIn browser extension now signs in with its own long-lived key, handed to you by an admin tool, instead of borrowing a chat session's key. It keeps working when the session it was set up from ends.
+- The routine editing window has been fixed properly. It is sized to its contents, its dropdowns are styled like the rest of the product, it lists the real places a routine can send its result, and it builds every kind of schedule it offers instead of dropping you into a raw timing expression.
+- A suspended routine now shows why it was suspended, who did it and when, with the most recent entry first. Routines suspended without any reason recorded are counted so they can be found.
+
+## 2026-07-30 (0.1.528)
+
+- Where two or more accounts share one device, the assistant can no longer edit or write files belonging to a different account. Every account is now checked for that protection being in place.
+- Your account now has a designated address that outbound mail is sent from, so asking to send an email no longer gets refused for want of knowing which address to use. The mailbox status tells you which address is designated, or that none is.
+- Saving a draft now tells you exactly which parts of your signature were added, and a signature stored as formatted text now actually appears on the message instead of being silently dropped.
+- The remote browser now runs the browser itself rather than sharing a desktop screen, which means signing in to Claude inside it works. The drag handles for resizing panels are thinner and lighter, matching the reference design.
+
 ## 2026-07-30 (0.1.527)
 
 - The remote browser page now shows a live picture of the browser you can click and type into directly, replacing the old screen-sharing view.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -136,7 +136,7 @@ The route (`server/routes/admin/routines.ts`) is account-scoped like `calendar.t
 | `GET /api/admin/routines/:eventId/runs` | One routine's `:RoutineRun` history, newest first. `limit` clamps to 1..500 and defaults to 50, so a caller that wants the full page must ask for it. |
 | `GET /api/admin/routines/:eventId/runs.csv` | The same projection as a `text/csv` attachment with `Content-Disposition`, and **no** limit, so it is not the same row set as a clamped `/runs` call. Re-parses its own output and returns 500 rather than serving a document with fewer rows than the query returned. Zero rows is 404, not a header-only file: the query cannot tell a routine with no runs from an `eventId` on another account. |
 | `PATCH /api/admin/routines/:eventId` | Edits `agentPrompt`, `recurrence`, and the `agentChannel`/`agentDestination` pair. Cron validation and the timezone-aware `nextRun` recompute copy the scheduling plugin's `schedule-update` tool. The binding is revalidated against the same house-authority rule, shared as `platform/lib/agent-dispatch-rule`; it is refused `partial-binding`, `invalid-channel`, `no-prompt`, `not-registered`, `cross-account`, `action-routine` (a routine that runs a tool keeps it — an agent binding outranks the action at fire time) or `clear-would-orphan` (clearing the only field holding a one-time routine inside the automation filter would hide it from every routines surface), and no refusal writes. Both fields as `null` clears the binding. An invalid cron is rejected 400 with no write. Only creation and deletion stay agent-only (`schedule-event`/`schedule-cancel`). |
-| `GET /api/admin/dispatch-destinations` | Every destination the session's account may bind a routine to, across both channels, each labelled by the authoritative list it came from (`House admin`, `Account manager`, `Telegram admin`). Computed from the same lists the validator reads and filtered by the same rule, so the picker cannot offer what the save refuses. |
+| `GET /api/admin/dispatch-destinations` | Every destination the session's account may bind a routine to, across both channels, each labelled by the authoritative list it came from (`House admin`, `Account manager`, `Telegram admin`), plus an optional `name`: a display-only person name resolved from `:Person` in the row's own account scope — the house for a `House admin` row, the managed sub-account for an `Account manager` row, and never for Telegram, whose destinations are chat ids. Computed from the same lists the validator reads and filtered by the same rule, so the picker cannot offer what the save refuses; `name` is never part of what Save posts, and a graph outage returns an unnamed roster rather than an error. |
 | `POST /api/admin/routines/:eventId/suspend` | Writes `eventStatus = 'suspended'` on a routine currently `'scheduled'`. 404s otherwise, so a second suspend is not a silent no-op. |
 | `POST /api/admin/routines/:eventId/resume` | Returns a suspended routine to `'scheduled'`. 404s if it is not suspended, 409s if it cannot be resumed. |
 | `POST /api/admin/routines/suspend-all` | Suspends every routine currently `'scheduled'` and marks each one. Returns the count. |
@@ -170,6 +170,18 @@ rows — a routine suspended one at a time carries no mark and stays suspended,
 which is what makes resume-all safe to press. The seeded roster is unmarked by
 construction, so resume-all never enables it.
 
+**The modal states why a routine is in the state it is in.** Every trigger,
+dispatch, suspend and resume appends one `[<iso>] <text>` line to the routine's
+own `notes`, and the detail modal lists that trail newest first under
+`History (<n> entries)`. So a suspended routine names its reason, the path that
+suspended it (`Suspended from chat`, `Suspended from the routines dashboard`,
+`Suspended by a suspend-all from the routines dashboard`) and the time, without
+reading the graph. Entries render as stored and none is dropped; the box scrolls.
+A routine with no trail says `No history recorded.`, which is the true state of a
+seeded roster routine that has never run. This is not the run history: a
+`:RoutineRun` node records a fire, and a status change is not a fire, so a
+suspension appears only here.
+
 Observability rides `[admin:routines]`: `op=list accountId=<8> count=<n>`,
 `op=get id=<8> found=<bool>`, `op=patch id=<8> fields=<…> outcome=ok|rejected
 reason=<invalid-cron|not-found> nextRun=<…> cron=<serialized>`, and
@@ -179,6 +191,15 @@ past-one-time|invalid-cron>`. A `count=0` while routines exist for the account i
 the account-scope-miss signature; the logged `cron=` on `outcome=ok` confirms the
 persisted expression without opening the graph.
 
+The panel can only show a reason that was written, and a suspend path that wrote
+no note emits no event of its own. The scheduling sweep's standing census closes
+that: `[schedule-audit] op=suspension-census` carries `unattributed=<n>`, the
+count of suspended routines whose notes never record the suspension, on every
+tick including zero. It sits outside the `other=` arithmetic, which reconciles
+status buckets against the row count rather than attribution. A routine seeded
+suspended and never touched carries no notes and is excluded, having nothing to
+attribute.
+
 Two scheduler-side lines close the loop, because a suspend that the sweep ignores
 looks identical to a healthy routine until it fires. `[schedule-sweep]
 op=skip-suspended account=<8> count=<n>` is emitted every sweep for every local
@@ -573,6 +594,23 @@ pass's summary line, which is what makes the absence of a per-account line
 readable as "clean" rather than "never audited" — grep the summary line, not the
 per-account one, to confirm the check is running.
 
+**An unregistered file-write fence is the same shape of failure.** The
+account-dir path guard refuses a file edit whose resolved path lands inside
+another account's directory, for every session including a house-scoped one, and
+the Bash snapshot pair watches the account's own layout. All of them live in the
+account's `.claude/settings.json`, and a hook that is not registered there runs
+never and emits nothing, so the silence reads identical to a clean account. The
+same pass therefore checks the five registrations per account and reports any
+absence as
+`[fs-reconcile] op=hook-registration account=<id8> missing=<matcher>:<hook>,…`,
+with `hooks-missing=0 hooks-unaudited=0` on the summary line as the per-cycle
+proof the fence is wired everywhere. An account whose settings cannot be read
+counts as unaudited rather than clean, so an install where none of them can be
+read never reports itself as fenced. The refusal itself is agent-facing and lands
+in the session's own child log as
+`[fs-guard] blocked path=<abs> reason=cross-account target=<id8>`, not in
+`server.log`.
+
 ### Graph
 
 | Mount | Purpose |
@@ -798,7 +836,21 @@ paint to a canvas, and the operator's clicks, scrolling and typing leave as
 `Input.dispatch*`. Interaction therefore lands on page coordinates rather than
 screen pixels, and the view is one tab chosen from a strip rather than the whole
 X display. `VncSurface` and `/vnc-viewer.html` still exist and still work, but
-nothing on `/browser` reaches them, and retiring that stack is separate work.
+nothing reaches them, and deleting that stack is separate work.
+
+**The Claude sign-in screen shows the same surface.** `AuthScreen` used to frame
+`/vnc-viewer.html` so the operator could complete the OAuth flow by looking at
+the browser on the X display; it now mounts `CdpScreencastSurface` too. Virtual
+mode runs Chromium headless (`--headless=new`, no `DISPLAY`), and a headless
+Chromium does not serve the ProcessSingleton socket — so the old mechanism, in
+which `claude auth login` exec'd `$BROWSER <url>` and a second Chromium handed
+the URL to the running instance, aborts with exit 21 and never opens the page.
+The wrapper `writeChromiumWrapper` generates therefore hands its URL to the
+running browser over CDP (`PUT /json/new`) instead of launching anything. Two
+details are load-bearing: the URL is percent-encoded into the query string,
+because that endpoint truncates a raw URL at its first `&`, and the id of the
+created target is recorded so the sign-in poll can tell the viewer which tab to
+show rather than leaving it on whichever tab CDP lists first.
 
 The transport is `/cdp-screencast` on the dashboard's own host and port, claimed
 by the edge listener before its `forwardUpgrade` catch-all. It is gated by
@@ -1158,6 +1210,32 @@ mounted (the greeting panel). `fit=false` or `handles=` disagreeing with
 `governed=` is the failure. A completed drag logs `[admin-ui] webchat-resize
 px=<final>`; a bare click logs nothing.
 
+**All four resize handles draw one pill.** The `/chat` column pills,
+the composer grip, and the sidebar and artefact splitters each paint a 3px-thick,
+48px-long rounded pill (32px long on the horizontal composer grip) in
+`--text-tertiary`, at half strength when idle and full strength on hover. Every
+box keeps its old size — 8px wide for the three vertical surfaces — so the pill
+got thinner and the grab target did not. Thickness and length come from
+`--resize-grip-thickness` / `--resize-grip-length`; the colour is read as
+`var(--text-tertiary)` on each pill rather than through an alias, because a
+`var()` inside a custom property is substituted on the element that DECLARES it,
+which would freeze the colour at the base `#9A9A9A` instead of the surface's own
+value (measured inside `.admin-shell`: `rgb(154,154,154)` through an alias,
+`rgb(138,133,122)` direct). A pill that never paints emits no event and does not
+reproduce on a re-open, and the measure audit above counts elements rather than
+pixels, so the standing check is `[admin-ui] op=resize-grip-audit
+surface=<column-left|column-right|sidebar> thicknessPx= lengthPx= color= opacity=
+boxPx= painted=`, emitted for the two column pills on mount and on every
+re-clamp, and for the sidebar splitter once per mount. `opacity=` is the strength
+the operator actually sees: the column pills carry it on the box and the two
+splitters carry it on the pill, and the line multiplies both, so a pill hidden at
+either level reports `opacity=0`.
+`painted=false` or `thicknessPx=0` means an invisible handle; `thicknessPx=8`
+means the box is painting and the pill rule never applied; a missing line for a
+surface that should be mounted is itself the alarm. `painted=false
+source=unavailable` is the expected reading wherever pseudo-element styles are
+not reported (the jsdom test environment), never a real zero.
+
 ## Health vs version
 
 Two endpoints, two surfaces, two restart-survival roles:

package/payload/platform/plugins/docs/references/deployment.md

@@ -201,7 +201,7 @@ The logs will show which service failed to start and why. Common causes:
 Each installed brand runs two per-brand `--user` systemd units (earlier platform fixes + — unit filenames are prefixed with the brand's `hostname` so two brands on the same device never share a unit file):
 
 - `{hostname}.service` — the admin + public HTTP server on `127.0.0.1:19201` (public port + 1). Restarted by the upgrade flow; short downtime is expected during steps 8→11 of an upgrade. An earlier fix: the unit carries two port env vars — `PORT=<public>` (canonical public port, read by the upgrade detector) and `MAXY_UI_INTERNAL_PORT=<public+1>` (the port maxy-ui actually binds).
-- `{hostname}-edge.service` — the always-on public listener on the configured port (default 19200). Reverse-proxies HTTP to the main brand service and handles `/websockify` (VNC) WebSocket upgrades locally. An earlier fix: also hosts `/api/admin/actions/*` and `/api/admin/version*` — the Software Update modal's own routes — so the log stream survives the brand service's restart window. Does NOT restart during an upgrade — the browser WebSocket stays connected by construction. The operator views this VNC display in the admin UI via the standalone `/browser` page (peer to `/graph` and `/data`).
+- `{hostname}-edge.service` — the always-on public listener on the configured port (default 19200). Reverse-proxies HTTP to the main brand service and handles `/websockify` (VNC) WebSocket upgrades locally. An earlier fix: also hosts `/api/admin/actions/*` and `/api/admin/version*` — the Software Update modal's own routes — so the log stream survives the brand service's restart window. Does NOT restart during an upgrade — the browser WebSocket stays connected by construction. The operator views the device's Chromium in the admin UI via the standalone `/browser` page (peer to `/graph` and `/data`) and on the Claude sign-in screen; both render CDP screencast frames over `/cdp-screencast`, not the framebuffer. Virtual-mode Chromium is headless, so nothing renders onto the X display and the `/websockify` upgrade has no remaining consumer; deleting that stack is separate work.
 
 Upgrade and Cloudflare setup run as detached actions: `systemd-run --user` transient units per invocation with stdout+stderr persisted to `~/.maxy/logs/actions/<actionId>.log` and streamed to the UI via SSE. No boot-time service file exists for these.
 

package/payload/platform/plugins/docs/references/linkedin-extension.md

@@ -11,7 +11,7 @@ Capture a LinkedIn profile or DM thread to your SiteDesk graph with one click. T
 5. Click the puzzle icon → pin **SiteDesk LinkedIn Ingest** → open its options.
 6. Paste two values:
    - **Admin host** — your tunnel URL, e.g. `https://your-tunnel.example.com`.
-   - **Session key** — open your admin browser, copy the value of `session_key` from the cookie. (Same key the admin uses to authenticate every other admin request.)
+   - **Ingest token** — ask your SiteDesk agent for the ingest token. It mints one on request and hands it to you in the chat. The same value keeps working: it survives restarts and new chat sessions, and it does not expire. This is not a conversation session key, and not the admin browser's `session_key`; the route accepts neither.
 7. Save. The pill is now armed.
 
 ## Use
@@ -36,7 +36,7 @@ The plugin will never create `:Communication`, `:ConversationArchive` rows (i.e.
 
 ## When the pill turns amber
 
-The pill shows **Sign in to SiteDesk** when your session key has expired. Click it to open the options page; paste a fresh `session_key` from your admin browser; save. The next click on the LinkedIn pill will succeed.
+The pill shows **Paste SiteDesk token** when the ingest token is missing or was refused. Click it to open the options page, ask your SiteDesk agent for the ingest token, paste it, and save. The next click on the LinkedIn pill will succeed. There is no sign-in step: the token is the whole credential, and the only way it stops working is if someone rotates it.
 
 ## When the pill turns red
 

package/payload/platform/plugins/docs/references/plugins-guide.md

@@ -186,7 +186,8 @@ There is no per-conversation stream log that interleaves MCP stderr with agent e
 
 **Retrieve MCP diagnostic lines for a conversation:**
 
-- `logs-read { type: "mcp" }` → tails the most recent `mcp-<name>-*.log` (per-server, keyed by session).
+- `logs-read { type: "mcp" }` → tails the most recent `mcp-<name>-*.log` under `~/.<brand>/logs`, the platform config dir the tee writes to — not the account log dir, which holds no `mcp-*` at all.
+- `logs-read { type: "mcp", sessionKey }` → tails every `mcp-*.log` whose **filename** carries that key, one section per server, up to 20 files; a truncated reply names how many matched so the cap is never silent. An 8-character key prefix matches the full session id in the name. The key is never matched against file contents, because MCP log lines carry no session key.
 
 ## Failure-path observability contract
 

package/payload/platform/plugins/email/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "email",
-  "description": "Email — one or more dedicated email mailboxes per account, each addressable by a `mailbox` selector. Retrieval: email-graph-query for stored email-thread history as :ConversationArchive {source:'email'} with :Section chunks (recall, search, 'threads about X', 'what did Y send?'); email-read / email-search for live IMAP inbox previews (with best-effort per-archive section hints from the graph); email-fetch-body for the COMPLETE decoded body of one message (by uid or message_id) when a preview is not enough; email-fetch-attachment for the extracted TEXT of one attachment (PDF via pdftotext, text/* by decode) when data sits inside a file rather than the body. Ingestion (operator-initiated, human-in-the-loop): email-fetch lists new messages, email-ingest writes the operator-approved subset via the conversation-archive pipeline. Sending: email-send (new), email-reply (threaded — resolves the original via IMAP Message-ID search), email-draft (compose to the mailbox Drafts folder, unsent, for operator review; pass messageId for a threaded draft-reply), email-draft-edit (revise a stored draft, located by its Drafts UID or, when Gmail has renumbered it, its draft Message-ID), email-draft-send (dispatch a stored draft by Drafts UID, then remove it), email-draft-list (read the Drafts folder back and confirm what is actually in it — the only tool that can verify a draft's presence). Deleting: email-delete (move named UIDs from email-read/email-search to the mailbox Trash — recoverable, never an expunge). Config: email-provider-info (pre-password host + app-password lookup from an address alone), email-setup, email-signature-set (install the signature every email-draft then appends automatically — never hand-write a signature into a draft body), email-status, email-otp-extract.",
+  "description": "Email — one or more dedicated email mailboxes per account, each addressable by a `mailbox` selector. Retrieval: email-graph-query for stored email-thread history as :ConversationArchive {source:'email'} with :Section chunks (recall, search, 'threads about X', 'what did Y send?'); email-read / email-search for live IMAP inbox previews (with best-effort per-archive section hints from the graph); email-fetch-body for the COMPLETE decoded body of one message (by uid or message_id) when a preview is not enough; email-fetch-attachment for the extracted TEXT of one attachment (PDF via pdftotext, text/* by decode) when data sits inside a file rather than the body. Ingestion (operator-initiated, human-in-the-loop): email-fetch lists new messages, email-ingest writes the operator-approved subset via the conversation-archive pipeline. Sending: email-send (new), email-reply (threaded — resolves the original via IMAP Message-ID search), email-draft (compose to the mailbox Drafts folder, unsent, for operator review; pass messageId for a threaded draft-reply), email-draft-edit (revise a stored draft, located by its Drafts UID or, when Gmail has renumbered it, its draft Message-ID), email-draft-send (dispatch a stored draft by Drafts UID, then remove it), email-draft-list (read the Drafts folder back and confirm what is actually in it — the only tool that can verify a draft's presence). Deleting: email-delete (move named UIDs from email-read/email-search to the mailbox Trash — recoverable, never an expunge). Config: email-provider-info (pre-password host + app-password lookup from an address alone), email-setup, email-signature-set (install the signature every email-draft then appends automatically — never hand-write a signature into a draft body), email-sending-identity-set (designate which attached mailbox this account sends from, so a send or draft that names no mailbox resolves it from the account instead of being refused), email-status, email-otp-extract.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/email/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: email
-description: "Email — one or more dedicated email mailboxes per account, each addressable by a `mailbox` selector. Retrieval: email-graph-query for stored email-thread history as :ConversationArchive {source:'email'} with :Section chunks (recall, search, 'threads about X', 'what did Y send?'); email-read / email-search for live IMAP inbox previews (with best-effort per-archive section hints from the graph); email-fetch-body for the COMPLETE decoded body of one message (by uid or message_id) when a preview is not enough; email-fetch-attachment for the extracted TEXT of one attachment (PDF via pdftotext, text/* by decode) when data sits inside a file rather than the body. Ingestion (operator-initiated, human-in-the-loop): email-fetch lists new messages, email-ingest writes the operator-approved subset via the conversation-archive pipeline. Sending: email-send (new), email-reply (threaded — resolves the original via IMAP Message-ID search), email-draft (compose to the mailbox Drafts folder, unsent, for operator review; pass messageId for a threaded draft-reply), email-draft-edit (revise a stored draft, located by its Drafts UID or, when Gmail has renumbered it, its draft Message-ID), email-draft-send (dispatch a stored draft by Drafts UID, then remove it), email-draft-list (read the Drafts folder back and confirm what is actually in it — the only tool that can verify a draft's presence). Deleting: email-delete (move named UIDs from email-read/email-search to the mailbox Trash — recoverable, never an expunge). Config: email-provider-info (pre-password host + app-password lookup from an address alone), email-setup, email-signature-set (install the signature every email-draft then appends automatically — never hand-write a signature into a draft body), email-status, email-otp-extract."
+description: "Email — one or more dedicated email mailboxes per account, each addressable by a `mailbox` selector. Retrieval: email-graph-query for stored email-thread history as :ConversationArchive {source:'email'} with :Section chunks (recall, search, 'threads about X', 'what did Y send?'); email-read / email-search for live IMAP inbox previews (with best-effort per-archive section hints from the graph); email-fetch-body for the COMPLETE decoded body of one message (by uid or message_id) when a preview is not enough; email-fetch-attachment for the extracted TEXT of one attachment (PDF via pdftotext, text/* by decode) when data sits inside a file rather than the body. Ingestion (operator-initiated, human-in-the-loop): email-fetch lists new messages, email-ingest writes the operator-approved subset via the conversation-archive pipeline. Sending: email-send (new), email-reply (threaded — resolves the original via IMAP Message-ID search), email-draft (compose to the mailbox Drafts folder, unsent, for operator review; pass messageId for a threaded draft-reply), email-draft-edit (revise a stored draft, located by its Drafts UID or, when Gmail has renumbered it, its draft Message-ID), email-draft-send (dispatch a stored draft by Drafts UID, then remove it), email-draft-list (read the Drafts folder back and confirm what is actually in it — the only tool that can verify a draft's presence). Deleting: email-delete (move named UIDs from email-read/email-search to the mailbox Trash — recoverable, never an expunge). Config: email-provider-info (pre-password host + app-password lookup from an address alone), email-setup, email-signature-set (install the signature every email-draft then appends automatically — never hand-write a signature into a draft body), email-sending-identity-set (designate which attached mailbox this account sends from, so a send or draft that names no mailbox resolves it from the account instead of being refused), email-status, email-otp-extract."
 tools:
   - name: email-provider-info
     publicAllowlist: false
@@ -14,6 +14,10 @@ tools:
     publicAllowlist: false
     adminAllowlist: false
     riskClass: write_local
+  - name: email-sending-identity-set
+    publicAllowlist: false
+    adminAllowlist: false
+    riskClass: write_local
   - name: email-read
     publicAllowlist: false
     adminAllowlist: false
@@ -106,13 +110,14 @@ Manages the agent's own dedicated email account — IMAP for reading, SMTP for s
 
 **Login vs alias — the default recipient set.** A config carries two addresses. `email` is the IMAP login: the address you authenticate as, and an address this mailbox owns. `agentAddress` is an *additional* alias to surface (often a per-agent address on a shared catch-all mailbox). When they differ, `email-read`, `email-search`, `email-otp-extract`, and `email-fetch` default to surfacing mail whose **To or Cc** carries **either** address — not the alias alone — because replies commonly arrive at the login address, and a reply or multi-party thread routinely Cc's the alias rather than To'ing it (a proposal sent from `info@` is answered to `info@`, not the `maxy@` alias; a thread copies `maxy@` on Cc). When no distinct alias is configured, no recipient filter is applied. Pass an explicit `to=` to narrow to a single address. Whenever the default filter hides messages from the fetched window, `email-read`/`email-search` append a `Recipient filter: kept N, hid M (to ∈ {…}); pass to="…" to change.` line — including when every message was hidden — so "I can't see it" is never indistinguishable from "it isn't there". `email-fetch` has no tool-output filter line; its kept-vs-hidden split is recorded in the stderr `diag("fetchSinceUid", "filter applied", …)` log instead.
 
-**Multiple mailboxes.** An account holds any number of mailboxes at once. Each is its own `:EmailAccount` node keyed by `(accountId, email)`, and `email-setup` adds one without touching the others (no destructive re-point to act on a second inbox). Every operational tool takes an optional `mailbox` argument naming which configured mailbox to act on. Resolution order: the named mailbox if given; the single configured mailbox when only one exists (so single-mailbox installs pass nothing); otherwise the call is refused with a line listing the stored mailbox identities, so the agent picks one rather than guessing an address. The poll high-water mark and the pending fetch/ingest batch are per-mailbox. `email-status` lists every attached mailbox.
+**Multiple mailboxes.** An account holds any number of mailboxes at once. Each is its own `:EmailAccount` node keyed by `(accountId, email)`, and `email-setup` adds one without touching the others (no destructive re-point to act on a second inbox). Every operational tool takes an optional `mailbox` argument naming which configured mailbox to act on. Resolution order: the named mailbox if given; the single configured mailbox when only one exists (so single-mailbox installs pass nothing); the mailbox designated as the account's **sending identity** when two or more exist and none was named; otherwise the call is refused with a line listing the stored mailbox identities and naming `email-sending-identity-set`, so the account is given an answer rather than the caller guessing an address. Exactly one mailbox carries the designation — the setter clears every sibling in the same write — and a graph holding two is refused naming both rather than one being elected. The poll high-water mark and the pending fetch/ingest batch are per-mailbox. `email-status` lists every attached mailbox.
 
 ## Capabilities
 
 - **Provider lookup:** `email-provider-info` — given just an email address, returns the inferred IMAP/SMTP hosts and the provider's app-password / trusted-application / IMAP-enable requirement, deterministically from the provider map. Call this BEFORE soliciting a password so the requirement is relayed first; most providers reject the normal login password. Returns "unknown" (operator supplies hosts) or "unsupported" (provider blocks IMAP/SMTP, e.g. Tuta).
 - **Setup:** `email-setup` — collect credentials in plain chat and connect IMAP/SMTP. Hosts are auto-inferred for known providers; supports alias addresses (`agentAddress`). For hosts where the client-visible Drafts folder is not the one flagged `\Drafts`, pass `draftsFolder` to name it explicitly (e.g. `INBOX.Drafts`).
-- **Signature:** `email-signature-set` — install the account's signature into the three files `email-draft` already reads at the account root (`email-signature.txt`, `.html`, `.font`). Plain text and HTML are stored and appended byte-for-byte; `font` is one CSS font-family value that wraps the HTML body and has no plain-text effect. **A part you omit is removed**, so a text-only call clears a stale HTML signature rather than leaving it to keep being appended; pass every part you want to keep on each call. A call with no parts at all is refused rather than treated as "erase everything". Because the append is deterministic and happens on every draft, a signature must never be written into a draft body by hand — that duplicates the stored one and drifts from it. Pass the operator's real signature read from its source of truth; reconstructing markup from memory or from stripped graph text is what put a dead logo URL into a client draft. Account-scoped, no `mailbox` selector: one signature per account.
+- **Signature:** `email-signature-set` — install the account's signature into the three files `email-draft` already reads at the account root (`email-signature.txt`, `.html`, `.font`). Plain text and HTML are stored and appended byte-for-byte; `font` is one CSS font-family value that wraps the HTML body and has no plain-text effect. A stored HTML signature lands on every draft, including one composed with no HTML body: the plugin derives an HTML body from the plain text (escaped, blank line to paragraph, single newline to line break) so the branded signature has somewhere to go, which makes that draft `multipart/alternative`. An account with no stored HTML signature derives nothing and its drafts stay `text/plain`. **A part you omit is removed**, so a text-only call clears a stale HTML signature rather than leaving it to keep being appended; pass every part you want to keep on each call. A call with no parts at all is refused rather than treated as "erase everything". Because the append is deterministic and happens on every draft, a signature must never be written into a draft body by hand — that duplicates the stored one and drifts from it. Pass the operator's real signature read from its source of truth; reconstructing markup from memory or from stripped graph text is what put a dead logo URL into a client draft. Account-scoped, no `mailbox` selector: one signature per account.
+- **Sending identity:** `email-sending-identity-set` — designate which attached mailbox is the account's own outbound address. Afterwards an `email-draft`, `email-send` or `email-reply` that names no `mailbox` composes from it, instead of being refused with a list of addresses. Exactly one mailbox carries the designation: the call clears it from every sibling in the same write, so uniqueness is a property of the write rather than of a later check. The address comes from the operator, never from inference — a routing rule, a signature or an inbound trigger names an address for a different purpose, and reading one of those as the sending address is what put a mailbox the operator never sends from into a draft brief. Re-running `email-setup` on a designated mailbox preserves the designation. `email-status` reports which mailbox holds it, and says so when a multi-mailbox account has none.
 - **Read inbox:** `email-read` — metadata only (UID, sender, subject, date), plus a best-effort `Archive`/`Archive-Section` hint when the IMAP message's `receivedAt` falls inside a stored `:ConversationArchive {source:'email'}` section, plus an `Attachments (N): filename (mime, size); …` footer when the message carries enclosures. Supports pagination (`before_uid`), folders (`inbox`/`sent`), filtering by sender/date/subject. Metadata is derived from IMAP `bodyStructure` — no bytes downloaded.
 - **Search inbox:** `email-search` — live IMAP search by sender, subject, body keyword, date range. Same per-archive hint and attachment footer as `email-read`.
 - **Delete (move to Trash):** `email-delete` — move the messages named by `uids` (from a prior `email-read`/`email-search`, scoped to a source `folder` of `inbox` or `sent`) into the mailbox's Trash folder. **Recoverable, never an expunge** — the message leaves the inbox and permanent removal is left to the operator's own mail client or the provider's Trash auto-purge; this tool never permanently deletes. Trash is resolved per provider: the `\Trash` special-use folder if advertised, else the first existing of `Trash`, `[Gmail]/Trash`, `Deleted Items`, `Deleted Messages`. `Junk` is never treated as Trash. A mailbox with no resolvable Trash yields a typed error and moves nothing — there is no silent expunge fallback. A `uid` that is already gone is counted not-moved without failing the rest; the result reports `Moved N of M message(s) to <Trash>`. It deletes only the UIDs you name, never by search criteria.