@rubytech/create-sitedesk-code 0.1.530 → 0.1.531

package/payload/platform/plugins/admin/skills/insight/SKILL.md

@@ -13,7 +13,7 @@ insight surface, and it is called only when the operator asks for it.
 
 Run the four passes now over the session so far, then keep going in this same session. Do NOT call `session-reset`, do NOT clear the context, do NOT end the session: the conversation continues afterward and the operator (or a parallel session) keeps working against the same live state. Use the tools you already have.
 
-Pass 1 — Technical learnings. Walk this session for operator corrections and self-detected mistakes. For each one, delegate one graph write to `database-operator` via the Task tool, persisting a Learning or Correction node per the schema. Count what you write.
+Pass 1 — Technical learnings. Walk this session for operator corrections and self-detected mistakes. For each one, delegate one graph write to `database-operator` via the Task tool, persisting a Learning node per the schema. Count what you write.
 
 Pass 2 — Operator-relationship updates. Walk this session for tonal signals, rejected phrasings, and working-style preferences. For each one worth carrying forward, Write the observation into `agents/admin/SOUL.md`, the account-scoped identity path the spawn composer reads. That path is the only identity file; never write a bare `SOUL.md` at the account root, which the composer never reads and the schema guard blocks. Count what you write.
 

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what SiteDesk ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:26053f4ab631d9ac1c16f933b73f9399ff975b2b3e80b9e14b792ea182e929d3
+content-hash: sha256:10987c045e406cec5ecac35344dbae665a350a08b55ef996d2691be4bff0605f
 brand: sitedesk-code
 product-name: SiteDesk
 ---
@@ -2855,13 +2855,16 @@ Capture a LinkedIn profile or DM thread to your SiteDesk graph with one click. T
 6. Paste two values:
    - **Admin host** — your tunnel URL, e.g. `https://your-tunnel.example.com`.
    - **Ingest token** — ask your SiteDesk agent for the ingest token. It mints one on request and hands it to you in the chat. The same value keeps working: it survives restarts and new chat sessions, and it does not expire. This is not a conversation session key, and not the admin browser's `session_key`; the route accepts neither.
-7. Save. The pill is now armed.
+7. Save. Pin the **SiteDesk LinkedIn Ingest** button in the Chrome toolbar so it is one click away.
 
 ## Use
 
-- **Profile** — open any `https://www.linkedin.com/in/<slug>/` page. An **Add to SiteDesk** pill appears in the top section. Click it. Within a few seconds the pill turns green: the profile is in your graph.
-- **DM thread** — open any `https://www.linkedin.com/messaging/thread/<id>/` conversation. The same pill appears. Click it; the full transcript is captured plus the participants and any explicit commitments (meetings booked, actions promised, prices discussed).
-- **Re-click** — the pill is idempotent. Re-clicking the same URL refreshes the document body and regenerates the summary; identities and entities `MERGE` rather than duplicate.
+Everything happens from the toolbar button. There is no button on the LinkedIn page itself, and that is deliberate: an extension that changes the page before LinkedIn's React finishes loading makes React throw the whole page away and rebuild it. This one only reads, and only when you click it.
+
+- **Profile** — open any `https://www.linkedin.com/in/<slug>/` page and click the toolbar button. Within a few seconds the badge shows a green tick: the profile is in your graph.
+- **DM thread** — open any `https://www.linkedin.com/messaging/thread/<id>/` conversation and click the same button. The full transcript is captured plus the participants and any explicit commitments (meetings booked, actions promised, prices discussed).
+- **Any other page** — the badge shows a grey `?` and nothing is sent. Open a profile or a thread first.
+- **Re-click** — capture is idempotent. Re-clicking the same URL refreshes the document body and regenerates the summary; identities and entities `MERGE` rather than duplicate.
 
 ## What lands in the graph
 
@@ -2877,14 +2880,20 @@ Soft signals ("interested in chatting", "would love to compare notes") stay in t
 
 The plugin will never create `:Communication`, `:ConversationArchive` rows (i.e. KnowledgeDocument nodes that carry `conversationIdentity`), or `:Message` nodes — those shapes are reserved for other flows (live chat, archive ingest).
 
-## When the pill turns amber
+## When the badge turns amber
+
+Hover the button for the full sentence.
 
-The pill shows **Paste SiteDesk token** when the ingest token is missing or was refused. Click it to open the options page, ask your SiteDesk agent for the ingest token, paste it, and save. The next click on the LinkedIn pill will succeed. There is no sign-in step: the token is the whole credential, and the only way it stops working is if someone rotates it.
+- **"rejected the ingest token"** — the token is missing or was refused. Open the options page, ask your SiteDesk agent for the ingest token, paste it, and save. There is no sign-in step: the token is the whole credential, and the only way it stops working is if someone rotates it.
+- **"never granted"** — the admin host was never allowed, so the request never left the browser. Open options, Save, and allow the Chrome prompt.
 
-## When the pill turns red
+## When the badge turns red
 
-- **Missing: ...** — LinkedIn shipped a DOM change and the extractor cannot find a required field. Open a console tab on the LinkedIn page and check the `[linkedin-ext-scrape]` log line for the field names. Drop a ticket pointing at the affected selector; the [`SKILL.md`](../../plugins/linkedin-extension/skills/linkedin-extension/SKILL.md) lists the selector table and the steps for adding a fallback.
-- **Capture failed** — the admin reached, but the request did not complete cleanly. Check the admin logs (`journalctl -u maxy.service | grep linkedin-ingest`). The `[linkedin-ingest-route]` lines name the reason (`schema`, `dispatch-failed`).
+- **"could not read this page"** — LinkedIn shipped a DOM change and the extractor cannot find a required field. The tooltip names the missing fields, and the service-worker console carries the same names on the `op=scrape` line. Drop a ticket pointing at the affected selector; the [`SKILL.md`](../../plugins/linkedin-extension/skills/linkedin-extension/SKILL.md) lists the selector table and the steps for adding a fallback.
+- **"did not answer"** — the host was allowed but nothing responded. Check the tunnel and the admin server.
+- **"unexpected status"** — the admin was reached but the request did not complete cleanly. Check the admin logs with `grep linkedin-ingest ~/.<brand>/logs/server.log`; the `[linkedin-ingest-auth]` and `[linkedin-ingest-route]` lines name the reason (`token-unknown`, `schema`, `dispatch-failed`).
+
+To read the extension's own side, open `chrome://extensions`, find SiteDesk LinkedIn Ingest, and click **service worker**. The `op=scrape`, `op=permission`, `op=fetch` and `op=state` lines are one capture end to end.
 
 ## Related plugins
 
@@ -3055,6 +3064,45 @@ The pass is one or two messages from the agent, then a short summary of what was
 
 You can tell the pass ran correctly by the final reply naming the five counts (learnings, tonal observations, graph updates, typed edges accepted, prose nodes scanned). The typed-edge pass is scoped by "what changed since the last completed insight pass," so two passes in a row never re-process the same nodes, and a session that never runs one simply defers its extraction to the next time you type `/insight`.
 
+# Learnings: how they accumulate, fade, and come back
+
+An `/insight` pass writes learnings. Until now that is all that happened to
+them: they landed in the graph and nothing ever read them again. A learning is
+now a thing with a life.
+
+**A learning carries a confidence.** It starts at 0.5. Every time a later
+session establishes the same thing again, the confidence moves most of the way
+toward certain without ever reaching it: `c + 0.15 × (1 − c)`, so 0.5 becomes
+0.575, then 0.64, and so on. When a session disputes it, 0.3 comes straight off
+and the learning is stamped with the date it was contradicted. If nobody
+mentions it for fourteen days it starts fading, at 0.05 a day, until it reaches
+zero.
+
+That means the brain forgets on its own. Something established once and never
+seen again drops out of sight in about a month; something confirmed every week
+stays near the top forever. You do not have to prune anything by hand.
+
+**Your session prompt carries titles, not text.** At the start of a session the
+agent is given the *titles* of the learnings currently above 0.4 confidence,
+capped at thirty, and nothing more. A title is a handle. When the conversation
+turns to something one of those titles names, the agent fetches the full text
+then, and only then. That is deliberate: injecting thirty full learnings into
+every session would cost a great deal of prompt for text that mostly goes
+unread.
+
+**When a learning has been disputed, the agent says so.** The recall also
+returns how many separate sessions produced the learning and whether one of
+them later contradicted it, so the agent can tell you "we established this
+once, and then later decided otherwise" rather than repeating a stale
+conclusion as settled fact.
+
+**What is not built yet.** Nothing runs this on a schedule. The extraction
+tools, the confidence curve, the fading and the session-start injection are all
+in place and work when driven by hand, but the overnight pass that walks every
+session closed since the previous night is a separate piece of work, filed as
+its own task and waiting on the routine-descriptions work to land first. Until
+then, `/insight` remains the way learnings get written.
+
 ---
 # Visitor Graph
 Source: https://docs.getmaxy.com/visitor-graph.md

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,13 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-30 (0.1.531)
+
+- Each WhatsApp connection is now recorded against the account it actually belongs to, rather than every connection being filed under the main account. A standing check reports any connection whose account has drifted, and an account created since the last restart is no longer mistaken for the main one.
+- Setting up WhatsApp for a sub-account is now reachable. Asking about a connection without naming an account now means your own account rather than the main one, the status view is no longer limited to the main account, and a sub-account line can run alongside the main one.
+- The assistant now learns from past sessions. It draws lessons out of earlier conversations, lets ones that stop being reconfirmed fade away, and brings only the relevant ones into a new conversation.
+- Capturing a page from the LinkedIn extension now happens from the toolbar button, replacing the floating marker that could be wiped away when the page redrew.
+
 ## 2026-07-30 (0.1.530)
 
 - Security fix: the WhatsApp connection library has been moved to a patched release, closing a critical flaw that allowed messages to be faked. Installs on the previous version should update.

package/payload/platform/plugins/docs/references/linkedin-extension.md

@@ -12,13 +12,16 @@ Capture a LinkedIn profile or DM thread to your SiteDesk graph with one click. T
 6. Paste two values:
    - **Admin host** — your tunnel URL, e.g. `https://your-tunnel.example.com`.
    - **Ingest token** — ask your SiteDesk agent for the ingest token. It mints one on request and hands it to you in the chat. The same value keeps working: it survives restarts and new chat sessions, and it does not expire. This is not a conversation session key, and not the admin browser's `session_key`; the route accepts neither.
-7. Save. The pill is now armed.
+7. Save. Pin the **SiteDesk LinkedIn Ingest** button in the Chrome toolbar so it is one click away.
 
 ## Use
 
-- **Profile** — open any `https://www.linkedin.com/in/<slug>/` page. An **Add to SiteDesk** pill appears in the top section. Click it. Within a few seconds the pill turns green: the profile is in your graph.
-- **DM thread** — open any `https://www.linkedin.com/messaging/thread/<id>/` conversation. The same pill appears. Click it; the full transcript is captured plus the participants and any explicit commitments (meetings booked, actions promised, prices discussed).
-- **Re-click** — the pill is idempotent. Re-clicking the same URL refreshes the document body and regenerates the summary; identities and entities `MERGE` rather than duplicate.
+Everything happens from the toolbar button. There is no button on the LinkedIn page itself, and that is deliberate: an extension that changes the page before LinkedIn's React finishes loading makes React throw the whole page away and rebuild it. This one only reads, and only when you click it.
+
+- **Profile** — open any `https://www.linkedin.com/in/<slug>/` page and click the toolbar button. Within a few seconds the badge shows a green tick: the profile is in your graph.
+- **DM thread** — open any `https://www.linkedin.com/messaging/thread/<id>/` conversation and click the same button. The full transcript is captured plus the participants and any explicit commitments (meetings booked, actions promised, prices discussed).
+- **Any other page** — the badge shows a grey `?` and nothing is sent. Open a profile or a thread first.
+- **Re-click** — capture is idempotent. Re-clicking the same URL refreshes the document body and regenerates the summary; identities and entities `MERGE` rather than duplicate.
 
 ## What lands in the graph
 
@@ -34,14 +37,20 @@ Soft signals ("interested in chatting", "would love to compare notes") stay in t
 
 The plugin will never create `:Communication`, `:ConversationArchive` rows (i.e. KnowledgeDocument nodes that carry `conversationIdentity`), or `:Message` nodes — those shapes are reserved for other flows (live chat, archive ingest).
 
-## When the pill turns amber
+## When the badge turns amber
+
+Hover the button for the full sentence.
+
+- **"rejected the ingest token"** — the token is missing or was refused. Open the options page, ask your SiteDesk agent for the ingest token, paste it, and save. There is no sign-in step: the token is the whole credential, and the only way it stops working is if someone rotates it.
+- **"never granted"** — the admin host was never allowed, so the request never left the browser. Open options, Save, and allow the Chrome prompt.
 
-The pill shows **Paste SiteDesk token** when the ingest token is missing or was refused. Click it to open the options page, ask your SiteDesk agent for the ingest token, paste it, and save. The next click on the LinkedIn pill will succeed. There is no sign-in step: the token is the whole credential, and the only way it stops working is if someone rotates it.
+## When the badge turns red
 
-## When the pill turns red
+- **"could not read this page"** — LinkedIn shipped a DOM change and the extractor cannot find a required field. The tooltip names the missing fields, and the service-worker console carries the same names on the `op=scrape` line. Drop a ticket pointing at the affected selector; the [`SKILL.md`](../../plugins/linkedin-extension/skills/linkedin-extension/SKILL.md) lists the selector table and the steps for adding a fallback.
+- **"did not answer"** — the host was allowed but nothing responded. Check the tunnel and the admin server.
+- **"unexpected status"** — the admin was reached but the request did not complete cleanly. Check the admin logs with `grep linkedin-ingest ~/.<brand>/logs/server.log`; the `[linkedin-ingest-auth]` and `[linkedin-ingest-route]` lines name the reason (`token-unknown`, `schema`, `dispatch-failed`).
 
-- **Missing: ...** — LinkedIn shipped a DOM change and the extractor cannot find a required field. Open a console tab on the LinkedIn page and check the `[linkedin-ext-scrape]` log line for the field names. Drop a ticket pointing at the affected selector; the [`SKILL.md`](../../plugins/linkedin-extension/skills/linkedin-extension/SKILL.md) lists the selector table and the steps for adding a fallback.
-- **Capture failed** — the admin reached, but the request did not complete cleanly. Check the admin logs (`journalctl -u maxy.service | grep linkedin-ingest`). The `[linkedin-ingest-route]` lines name the reason (`schema`, `dispatch-failed`).
+To read the extension's own side, open `chrome://extensions`, find SiteDesk LinkedIn Ingest, and click **service worker**. The `op=scrape`, `op=permission`, `op=fetch` and `op=state` lines are one capture end to end.
 
 ## Related plugins
 

package/payload/platform/plugins/docs/references/session-retrospective.md

@@ -12,3 +12,42 @@ You can run it whenever you want the brain brought up to date — for example be
 The pass is one or two messages from the agent, then a short summary of what was written. It runs inside the session you are already in: nothing happens in the background, no second session is spawned, and the session is not closed, reset, or cleared — the conversation continues straight afterward against the same live state. The typed-edge pass itself is delegated to the `database-operator` specialist so the writes land where graph writes are supposed to live.
 
 You can tell the pass ran correctly by the final reply naming the five counts (learnings, tonal observations, graph updates, typed edges accepted, prose nodes scanned). The typed-edge pass is scoped by "what changed since the last completed insight pass," so two passes in a row never re-process the same nodes, and a session that never runs one simply defers its extraction to the next time you type `/insight`.
+
+# Learnings: how they accumulate, fade, and come back
+
+An `/insight` pass writes learnings. Until now that is all that happened to
+them: they landed in the graph and nothing ever read them again. A learning is
+now a thing with a life.
+
+**A learning carries a confidence.** It starts at 0.5. Every time a later
+session establishes the same thing again, the confidence moves most of the way
+toward certain without ever reaching it: `c + 0.15 × (1 − c)`, so 0.5 becomes
+0.575, then 0.64, and so on. When a session disputes it, 0.3 comes straight off
+and the learning is stamped with the date it was contradicted. If nobody
+mentions it for fourteen days it starts fading, at 0.05 a day, until it reaches
+zero.
+
+That means the brain forgets on its own. Something established once and never
+seen again drops out of sight in about a month; something confirmed every week
+stays near the top forever. You do not have to prune anything by hand.
+
+**Your session prompt carries titles, not text.** At the start of a session the
+agent is given the *titles* of the learnings currently above 0.4 confidence,
+capped at thirty, and nothing more. A title is a handle. When the conversation
+turns to something one of those titles names, the agent fetches the full text
+then, and only then. That is deliberate: injecting thirty full learnings into
+every session would cost a great deal of prompt for text that mostly goes
+unread.
+
+**When a learning has been disputed, the agent says so.** The recall also
+returns how many separate sessions produced the learning and whether one of
+them later contradicted it, so the agent can tell you "we established this
+once, and then later decided otherwise" rather than repeating a stale
+conclusion as settled fact.
+
+**What is not built yet.** Nothing runs this on a schedule. The extraction
+tools, the confidence curve, the fading and the session-start injection are all
+in place and work when driven by hand, but the overnight pass that walks every
+session closed since the previous night is a separate piece of work, filed as
+its own task and waiting on the routine-descriptions work to land first. Until
+then, `/insight` remains the way learnings get written.

package/payload/platform/plugins/linkedin-extension/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "linkedin-extension",
-  "description": "One-click LinkedIn ingest. Ships a manifest-v3 Chrome extension that injects an Add-to-SiteDesk pill into `linkedin.com/in/*` profiles and `linkedin.com/messaging/thread/*` DM threads. Each click scrapes the page DOM, POSTs to the admin `linkedin-ingest` route, which dispatches `database-operator` against the generic `document-ingest` skill. The plugin is the **first consumer** of the generic communication-ingest path; every future communication surface (email, Telegram, WhatsApp, group chats, voice memos) plugs into the same backend. Opt-in per brand.",
+  "description": "One-click LinkedIn ingest. Ships a manifest-v3 Chrome extension whose toolbar button captures the current `linkedin.com/in/*` profile or `linkedin.com/messaging/thread/*` DM thread. A click injects the extractors into that tab under `activeTab`, reads the page DOM without writing to it, POSTs to the admin `linkedin-ingest` route, which dispatches `database-operator` against the generic `document-ingest` skill. The plugin is the **first consumer** of the generic communication-ingest path; every future communication surface (email, Telegram, WhatsApp, group chats, voice memos) plugs into the same backend. Opt-in per brand.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/linkedin-extension/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: linkedin-extension
-description: "One-click LinkedIn ingest. Ships a manifest-v3 Chrome extension that injects an Add-to-SiteDesk pill into `linkedin.com/in/*` profiles and `linkedin.com/messaging/thread/*` DM threads. Each click scrapes the page DOM, POSTs to the admin `linkedin-ingest` route, which dispatches `database-operator` against the generic `document-ingest` skill. The plugin is the **first consumer** of the generic communication-ingest path; every future communication surface (email, Telegram, WhatsApp, group chats, voice memos) plugs into the same backend. Opt-in per brand."
+description: "One-click LinkedIn ingest. Ships a manifest-v3 Chrome extension whose toolbar button captures the current `linkedin.com/in/*` profile or `linkedin.com/messaging/thread/*` DM thread. A click injects the extractors into that tab under `activeTab`, reads the page DOM without writing to it, POSTs to the admin `linkedin-ingest` route, which dispatches `database-operator` against the generic `document-ingest` skill. The plugin is the **first consumer** of the generic communication-ingest path; every future communication surface (email, Telegram, WhatsApp, group chats, voice memos) plugs into the same backend. Opt-in per brand."
 tools: []
 always: false
 embed: false
@@ -26,10 +26,10 @@ Re-clicking the same URL refreshes the KD body and regenerates the summary. Pers
 ```
 Chrome extension                    Hono admin                Specialist
 ─────────────────                    ──────────                ──────────
-content/profile.js  ──POST──>  /api/admin/linkedin-ingest  ──>  database-operator
-content/thread.js                      requireAdminSession        document-ingest skill
-                                       schema validate            memory-ingest tools
-                                       spawn database-operator    graph writes
+toolbar click                  /api/admin/linkedin-ingest  ──>  database-operator
+  inject extractors.js                 requireIngestToken         document-ingest skill
+  read the page  ──POST──>             schema validate            memory-ingest tools
+  badge + tooltip                      spawn database-operator    graph writes
 ```
 
 The route's job is auth + schema + dispatch. Extraction logic lives in `document-ingest`; ontology decisions live in the schema reference. The extension is the only LinkedIn-bespoke part.
@@ -37,11 +37,8 @@ The route's job is auth + schema + dispatch. Extraction logic lives in `document
 ## Files
 
 - `extension/manifest.json` — manifest v3
-- `extension/content/profile.js` — content script for `linkedin.com/in/*`
-- `extension/content/thread.js` — content script for `linkedin.com/messaging/thread/*`
-- `extension/background/sw.js` — service worker handling POSTs
-- `extension/options/options.{html,js}` — admin host + bearer token entry
-- `extension/assets/pill.css` — pill styling
+- `extension/background/sw.js` — service worker. Owns the capture: injects on toolbar click, reads, POSTs, reports via badge + tooltip
+- `extension/options/options.{html,js}` — admin host + ingest token entry
 - `extension/README.md` — developer install guide
 - `extension/__tests__/{profile,thread}.test.ts` — jsdom extractor tests
 - `extension/__tests__/fixtures/{profile,thread}.html` — frozen DOM fixtures captured 2026-05-22

package/payload/platform/plugins/linkedin-extension/extension/README.md

@@ -9,35 +9,38 @@ Unpacked-extension dev build. No Chrome Web Store publication.
 3. **Load unpacked** → select this `extension/` directory.
 4. Click the new puzzle icon → open **SiteDesk LinkedIn Ingest** options.
 5. Paste your admin host (e.g. `https://your-tunnel.example.com`) and your **ingest token**. Ask your SiteDesk agent for the ingest token; it mints one on request and gives it to you in the chat. The token is stable, so this is a one-time paste unless someone rotates it. Save.
-6. Chrome asks you to allow the extension to talk to that host. **Allow it.** The pill cannot post without it, so declining saves nothing.
+6. Chrome asks you to allow the extension to talk to that host. **Allow it.** Captures cannot post without it, so declining saves nothing.
 
 ## Use
 
 - Open any `https://www.linkedin.com/in/<slug>/` profile or `https://www.linkedin.com/messaging/thread/<id>/` thread.
-- Click the **Add to SiteDesk** pill at the top of the page.
-- The pill turns green and writes one `:KnowledgeDocument` plus the entities the body assertively states.
+- Click the **SiteDesk LinkedIn Ingest** button in the Chrome toolbar. Pin it first if it is hidden behind the puzzle icon.
+- The badge shows a green tick and SiteDesk writes one `:KnowledgeDocument` plus the entities the body assertively states.
 
-The pill tells you which thing is wrong:
+There is no button on the page itself. The extension reads the page only when you click, and never changes it: an extension that alters the HTML before LinkedIn's React hydrates raises React error #418, which makes React throw the page away and rebuild it. That is what the old in-page pill did to every profile you opened.
 
-| Pill | Meaning | Fix |
+The badge says what happened; hover the button for the full sentence:
+
+| Badge | Meaning | Fix |
 |---|---|---|
-| **Paste SiteDesk token** (amber) | the ingest token is missing or was refused | ask the agent for the ingest token, paste it in options |
-| **Grant access** (amber) | the admin host was never allowed, so the post never left the browser | open options, Save, allow the prompt |
-| **SiteDesk unreachable** (red) | the host was allowed but did not answer | check the tunnel and the admin server |
-| **Capture failed** (red) | the admin rejected the payload, or the extension's own service worker did not answer | read the service-worker console: `reason=extract` is a rejected payload, `reason=worker-unreachable` is the worker |
+| `✓` green | captured | nothing to do |
+| `…` grey | capture in progress | wait |
+| `!` amber, "rejected the ingest token" | the token is missing or was refused | ask your SiteDesk agent for the ingest token, paste it in options |
+| `!` amber, "never granted" | the admin host was never allowed, so the post never left the browser | open options, Save, allow the prompt |
+| `!` red, "did not answer" | the host was allowed but did not answer | check the tunnel and the admin server |
+| `!` red, "unexpected status" | the admin rejected the payload | read the service-worker console for the `op=fetch` line |
+| `!` red, "could not read this page" | the extractors found no required field | LinkedIn's markup moved; the tooltip names the missing fields |
+| `?` grey | the tab is not a profile or DM thread | open one first |
 
 ## File layout
 
 | File | Role |
 |---|---|
-| `manifest.json` | MV3 manifest. Declares profile + thread content scripts. |
-| `content/extractors.js` | Pure DOM extractor functions. Loaded first into each content-script context. |
-| `content/profile.js` | Profile pill + click handler. |
-| `content/thread.js` | Thread pill + click handler. |
-| `background/sw.js` | Service worker. Checks the admin-host grant, then POSTs envelopes to the admin route. |
+| `manifest.json` | MV3 manifest. No content scripts and no standing host permission: `activeTab` plus `scripting` grant access to the tab you click. |
+| `content/extractors.js` | Pure DOM extractor functions, injected on click. |
+| `background/sw.js` | Service worker. Owns the whole capture: injects, reads, POSTs, and reports through the badge and tooltip. |
 | `options/options.html` + `options/options.js` | Admin host + ingest-token entry. |
-| `assets/pill.css` | Pill styling. |
-| `__tests__/` | jsdom unit tests for the extractors, run via vitest from `platform/ui`. |
+| `__tests__/` | jsdom fixtures for the extractors, run via vitest from `platform/ui`. |
 
 ## How the wire works
 
@@ -45,7 +48,7 @@ The extension does no extraction or graph-write logic — those live in `platfor
 
 ## Updating selectors
 
-LinkedIn ships DOM changes from time to time. When the pill misses a field:
+LinkedIn ships DOM changes from time to time. When a capture reports missing fields:
 
 1. Save the current page as `__tests__/fixtures/<kind>.html` (overwrite).
 2. Update the primary selector in `content/extractors.js`; keep the prior one as fallback if older clients may still serve it.

package/payload/platform/plugins/linkedin-extension/extension/background/sw.js

@@ -1,5 +1,12 @@
-// Service worker. Receives envelopes from content scripts, POSTs them
-// to the admin host with the ingest token stored in extension options.
+// Service worker. Owns the whole capture: a toolbar click injects the
+// extractors into the active tab, reads the page, and POSTs the envelope to
+// the admin host with the ingest token stored in extension options.
+//
+// Task 2221 — capture moved here from an in-page pill. The pill was prepended
+// into LinkedIn's `main` before React hydrated, which raised React #418 and
+// had the tree regenerated, destroying the pill and degrading the page. The
+// extension now injects only on an explicit click, under `activeTab`, so it
+// holds no standing access to linkedin.com and never mutates the page.
 //
 // Task 2185 — the manifest's static host_permissions cover linkedin.com only,
 // so the admin host has to be granted at runtime from the options page before
@@ -82,17 +89,93 @@ async function postEnvelope(envelope) {
   return { ok: true }
 }
 
-chrome.runtime.onMessage.addListener(function (msg, _sender, sendResponse) {
-  if (!msg || msg.type !== 'linkedin-ingest' || !msg.envelope) {
-    sendResponse({ ok: false, reason: 'extract', detail: 'bad-message' })
-    return false
+// Injected into the page by chrome.scripting with `func`, so it is serialised
+// and cannot close over anything in this file. Everything it needs is inline.
+//
+// It reads the DOM and returns; it never writes. That is the whole point of
+// Task 2221: the previous in-page pill was prepended into `main` before React
+// hydrated, which raised React #418 ("Hydration failed ... this tree will be
+// regenerated on the client") and the regeneration took the pill with it. An
+// extension that only reads cannot mismatch hydration.
+function captureInPage() {
+  const ex = globalThis.MaxyLinkedinExtractors
+  if (!ex) return { ok: false, reason: 'extract', detail: 'extractors-missing' }
+  const path = location.pathname
+  let kind = null
+  if (/^\/in\/[^/]+/.test(path)) kind = 'profile'
+  else if (/^\/messaging\/thread\/[^/]+/.test(path)) kind = 'thread'
+  if (!kind) return { ok: false, reason: 'wrong-page', detail: path }
+  const result = kind === 'profile' ? ex.extractProfile(document) : ex.extractThread(document)
+  if (!result.ok) return { ok: false, reason: 'extract', detail: result.missing.join(',') }
+  return {
+    ok: true,
+    kind: kind,
+    pageUrl: location.href.split('?')[0].split('#')[0],
+    payload: result.payload,
   }
-  postEnvelope(msg.envelope).then(sendResponse).catch(function (err) {
-    sendResponse({ ok: false, reason: 'extract', detail: err && err.message ? err.message : String(err) })
-  })
-  return true // async sendResponse
-})
+}
+
+// Badge carries the glyph, title carries the sentence. A toolbar button cannot
+// both fire onClicked and open a popup — declaring `default_popup` suppresses
+// onClicked — so the tooltip is where the reason lives. A badge alone cannot
+// separate Task 2185's three reasons from Task 2208's token states.
+const STATES = {
+  busy: { text: '…', color: '#46596d', title: 'Capturing…' },
+  ok: { text: '✓', color: '#2e7d32', title: 'Captured to SiteDesk' },
+  auth: { text: '!', color: '#b8860b', title: 'SiteDesk rejected the ingest token. Open options and paste a fresh one.' },
+  permission: { text: '!', color: '#b8860b', title: 'The SiteDesk admin host was never granted. Open options and save to grant it.' },
+  unreachable: { text: '!', color: '#b00020', title: 'The SiteDesk admin host did not answer. Check the tunnel and the admin server.' },
+  server: { text: '!', color: '#b00020', title: 'SiteDesk answered with an unexpected status.' },
+  extract: { text: '!', color: '#b00020', title: 'Could not read this page.' },
+  'wrong-page': { text: '?', color: '#46596d', title: 'Open a LinkedIn profile or DM thread first.' },
+}
+
+async function setState(tabId, state, detail) {
+  const s = STATES[state] || STATES.extract
+  const title = detail ? s.title + ' (' + detail + ')' : s.title
+  await chrome.action.setBadgeText({ tabId: tabId, text: s.text })
+  await chrome.action.setBadgeBackgroundColor({ tabId: tabId, color: s.color })
+  await chrome.action.setTitle({ tabId: tabId, title: title })
+  console.log(TAG + ' op=state tabId=' + tabId + ' state=' + state + (detail ? ' detail=' + detail : ''))
+}
+
+async function runCapture(tab) {
+  const dispatchId = crypto.randomUUID()
+  await setState(tab.id, 'busy')
 
-chrome.action.onClicked.addListener(function () {
-  chrome.runtime.openOptionsPage()
+  let injected
+  try {
+    await chrome.scripting.executeScript({ target: { tabId: tab.id }, files: ['content/extractors.js'] })
+    injected = await chrome.scripting.executeScript({ target: { tabId: tab.id }, func: captureInPage })
+  } catch (err) {
+    // activeTab was not granted, or this is a page no extension may touch.
+    return setState(tab.id, 'wrong-page', err && err.message ? err.message : String(err))
+  }
+
+  const scraped = injected && injected[0] ? injected[0].result : null
+  if (!scraped || !scraped.ok) {
+    const reason = scraped ? scraped.reason : 'extract'
+    console.error(TAG + ' op=scrape dispatchId=' + dispatchId + ' ok=false reason=' + reason)
+    return setState(tab.id, reason, scraped ? scraped.detail : 'no-result')
+  }
+  console.log(TAG + ' op=scrape dispatchId=' + dispatchId + ' kind=' + scraped.kind + ' ok=true')
+
+  const envelope = {
+    source: 'linkedin',
+    kind: scraped.kind,
+    capturedAt: new Date().toISOString(),
+    pageUrl: scraped.pageUrl,
+    dispatchId: dispatchId,
+  }
+  envelope[scraped.kind] = scraped.payload
+
+  const posted = await postEnvelope(envelope)
+  if (posted.ok) return setState(tab.id, 'ok')
+  return setState(tab.id, posted.reason, posted.detail)
+}
+
+chrome.action.onClicked.addListener(function (tab) {
+  runCapture(tab).catch(function (err) {
+    setState(tab.id, 'extract', err && err.message ? err.message : String(err))
+  })
 })

package/payload/platform/plugins/linkedin-extension/extension/manifest.json

@@ -2,32 +2,17 @@
   "manifest_version": 3,
   "name": "SiteDesk LinkedIn Ingest",
   "version": "0.1.0",
-  "description": "Add an Add-to-SiteDesk pill to LinkedIn profiles and DM threads. One click captures the page and posts to your SiteDesk admin.",
-  "permissions": ["storage", "activeTab"],
-  "host_permissions": ["https://www.linkedin.com/*"],
+  "description": "Click the toolbar button on a LinkedIn profile or DM thread to capture it into your SiteDesk admin.",
+  "permissions": ["storage", "activeTab", "scripting"],
   "optional_host_permissions": ["http://*/*", "https://*/*"],
   "background": {
     "service_worker": "background/sw.js"
   },
-  "content_scripts": [
-    {
-      "matches": ["https://www.linkedin.com/in/*"],
-      "js": ["content/extractors.js", "content/profile.js"],
-      "css": ["assets/pill.css"],
-      "run_at": "document_idle"
-    },
-    {
-      "matches": ["https://www.linkedin.com/messaging/thread/*"],
-      "js": ["content/extractors.js", "content/thread.js"],
-      "css": ["assets/pill.css"],
-      "run_at": "document_idle"
-    }
-  ],
   "options_ui": {
     "page": "options/options.html",
     "open_in_tab": true
   },
   "action": {
-    "default_title": "SiteDesk LinkedIn Ingest — open options"
+    "default_title": "Capture this LinkedIn page to SiteDesk"
   }
 }

package/payload/platform/plugins/linkedin-extension/extension/options/options.html

@@ -17,8 +17,8 @@
   </head>
   <body>
     <h1>SiteDesk LinkedIn Ingest</h1>
-    <p>Point the extension at your SiteDesk admin host and paste your ingest token. Ask your SiteDesk agent for the token and it will give you one. The pill on LinkedIn will then post one-click captures to your admin.</p>
-    <p>On Save, Chrome asks you to allow this extension to talk to that host. The capture pill cannot post without it, so declining leaves the extension unconfigured.</p>
+    <p>Point the extension at your SiteDesk admin host and paste your ingest token. Ask your SiteDesk agent for the token and it will give you one. The toolbar button will then post one-click captures to your admin.</p>
+    <p>On Save, Chrome asks you to allow this extension to talk to that host. Captures cannot post without it, so declining leaves the extension unconfigured.</p>
 
     <label for="admin-host">Admin host</label>
     <input id="admin-host" type="url" placeholder="https://your-tunnel.example.com" />

package/payload/platform/plugins/linkedin-extension/extension/options/options.js

@@ -96,7 +96,7 @@ async function save() {
   console.log(TAG + ' op=permission origin=' + origin + ' granted=' + granted)
   if (!granted) {
     return setStatus(
-      'Access to ' + origin + ' was declined, so nothing was saved. The pill cannot post without it.',
+      'Access to ' + origin + ' was declined, so nothing was saved. Captures cannot post without it.',
       true,
     )
   }

package/payload/platform/plugins/memory/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "memory",
-  "description": "Graph memory plugin. Provides memory-search (with optional `fields` projection for known-shape lookups), memory-write, memory-update, memory-edge (create/delete typed directed edges between pre-existing nodes), memory-update-by-name (repair surface that resolves an elementId from a (label, name, accountId) tuple when search cannot return one), memory-lookup-by-name (deterministic read surface that returns nodes by case-insensitive exact `name` match — a Person, which carries no `name`, is matched on its composed `givenName` + `familyName` display name instead — optionally constrained by labels, bypassing the memory-search ranking stack so a present entity is never missed because a diluted query ranked it below the cut), and the :Report surface (memory-report-write / memory-report-read-latest / memory-report-list) for reading from, writing to, and updating the Neo4j knowledge graph. Includes conversational memory — organic preference learning, evidence-backed recall, and transparent 'what do you know about me?' responses. Document ingestion goes through memory-ingest; the dispatched specialist produces typed-section JSON in-turn from the loaded ontology. Operator-solicited reclassify of an already-stored thread-shaped KD (today: email-thread KDs) is exposed as `kd-classify <attachmentId>` — runs a body-growth gate (proceed iff body grew ≥25% since the last classify, or first-ever classify), stages the body to a temp file under `$ACCOUNT_DIR/tmp/`, and returns a dispatch envelope for the `librarian`; on success `memory-ingest` replaces the prior :Section children and stamps `lastClassifiedAt` + `lastClassifiedBodyLength` on the parent KD. Two modes: `document` (default) for unstructured PDF/web content → :KnowledgeDocument (keyed on `attachmentId`) + :Section, and `chat` for conversation transcripts → :ConversationArchive (keyed on `conversationIdentity`) + :Section chunks; two parent labels, two writer paths chosen by which identity property is set. Conversation-archive Phase 2 splits across two read-only tools: `conversation-archive-list-chunks` pages chunk bodies for the dispatched specialist to read in-turn; `conversation-archive-derive-insights` converts the specialist's per-chunk claims into operator-facing proposals with per-kind cypher. `conversation-archive-enrich-rejection` records (or undoes) durable per-row rejections so already-triaged claims do not re-surface on re-runs. Ships five skills: `conversational-memory`, `document-ingest`, `conversation-archive` (source-agnostic transcript ingest for WhatsApp, Telegram, Signal, LinkedIn DMs, Zoom, meeting minutes, iMessage, Slack), `conversation-archive-mcp` (operator-initiated MCP-driven ingest for Granola, Otter, Circleback meetings — sibling of `conversation-archive` sharing the same writer surface and identity formula), and `conversation-archive-enrich` (per-row operator-gated insight derivation over a named archive's chunks). Ships three thinking-tool skills: `challenge` (adversarial retrieval — strongest counter-evidence from the graph for a given claim), `connect` (bridge-finding between two topics via shared graph neighbors), and `emerge` (clusters uncategorised KnowledgeDocument and Section nodes into operator-approved Concept proposals).",
+  "description": "Graph memory plugin. Provides memory-search (with optional `fields` projection for known-shape lookups), memory-write, memory-update, memory-edge (create/delete typed directed edges between pre-existing nodes), memory-update-by-name (repair surface that resolves an elementId from a (label, name, accountId) tuple when search cannot return one), memory-lookup-by-name (deterministic read surface that returns nodes by case-insensitive exact `name` match — a Person, which carries no `name`, is matched on its composed `givenName` + `familyName` display name instead — optionally constrained by labels, bypassing the memory-search ranking stack so a present entity is never missed because a diluted query ranked it below the cut), and the :Report surface (memory-report-write / memory-report-read-latest / memory-report-list) for reading from, writing to, and updating the Neo4j knowledge graph. Includes conversational memory — organic preference learning, evidence-backed recall, and transparent 'what do you know about me?' responses. Document ingestion goes through memory-ingest; the dispatched specialist produces typed-section JSON in-turn from the loaded ontology. Operator-solicited reclassify of an already-stored thread-shaped KD (today: email-thread KDs) is exposed as `kd-classify <attachmentId>` — runs a body-growth gate (proceed iff body grew ≥25% since the last classify, or first-ever classify), stages the body to a temp file under `$ACCOUNT_DIR/tmp/`, and returns a dispatch envelope for the `librarian`; on success `memory-ingest` replaces the prior :Section children and stamps `lastClassifiedAt` + `lastClassifiedBodyLength` on the parent KD. Two modes: `document` (default) for unstructured PDF/web content → :KnowledgeDocument (keyed on `attachmentId`) + :Section, and `chat` for conversation transcripts → :ConversationArchive (keyed on `conversationIdentity`) + :Section chunks; two parent labels, two writer paths chosen by which identity property is set. Conversation-archive Phase 2 splits across two read-only tools: `conversation-archive-list-chunks` pages chunk bodies for the dispatched specialist to read in-turn; `conversation-archive-derive-insights` converts the specialist's per-chunk claims into operator-facing proposals with per-kind cypher. `conversation-archive-enrich-rejection` records (or undoes) durable per-row rejections so already-triaged claims do not re-surface on re-runs. Ships five skills: `conversational-memory`, `document-ingest`, `conversation-archive` (source-agnostic transcript ingest for WhatsApp, Telegram, Signal, LinkedIn DMs, Zoom, meeting minutes, iMessage, Slack), `conversation-archive-mcp` (operator-initiated MCP-driven ingest for Granola, Otter, Circleback meetings — sibling of `conversation-archive` sharing the same writer surface and identity formula), and `conversation-archive-enrich` (per-row operator-gated insight derivation over a named archive's chunks). Ships three thinking-tool skills: `challenge` (adversarial retrieval — strongest counter-evidence from the graph for a given claim), `connect` (bridge-finding between two topics via shared graph neighbors), and `emerge` (clusters uncategorised KnowledgeDocument and Section nodes into operator-approved Concept proposals). The learnings surface is three tools plus the `learnings-recall` skill: `learnings-scan` pages session transcripts off disk (requiring CLAUDE_CONFIG_DIR, refusing without it rather than guessing a projects root), `learnings-derive` reconciles the turn's claims into `:Learning` writes on a confidence curve (create at 0.5, reinforce as c + 0.15(1-c), contradict by 0.3 with contradictedAt stamped) and optionally runs the decay pass, and `learnings-recall` is the only path from a title injected into a system prompt to its full body.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/memory/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: memory
-description: "Graph memory plugin. Provides memory-search (with optional `fields` projection for known-shape lookups), memory-write, memory-update, memory-edge (create/delete typed directed edges between pre-existing nodes), memory-update-by-name (repair surface that resolves an elementId from a (label, name, accountId) tuple when search cannot return one), memory-lookup-by-name (deterministic read surface that returns nodes by case-insensitive exact `name` match — a Person, which carries no `name`, is matched on its composed `givenName` + `familyName` display name instead — optionally constrained by labels, bypassing the memory-search ranking stack so a present entity is never missed because a diluted query ranked it below the cut), and the :Report surface (memory-report-write / memory-report-read-latest / memory-report-list) for reading from, writing to, and updating the Neo4j knowledge graph. Includes conversational memory — organic preference learning, evidence-backed recall, and transparent 'what do you know about me?' responses. Document ingestion goes through memory-ingest; the dispatched specialist produces typed-section JSON in-turn from the loaded ontology. Operator-solicited reclassify of an already-stored thread-shaped KD (today: email-thread KDs) is exposed as `kd-classify <attachmentId>` — runs a body-growth gate (proceed iff body grew ≥25% since the last classify, or first-ever classify), stages the body to a temp file under `$ACCOUNT_DIR/tmp/`, and returns a dispatch envelope for the `librarian`; on success `memory-ingest` replaces the prior :Section children and stamps `lastClassifiedAt` + `lastClassifiedBodyLength` on the parent KD. Two modes: `document` (default) for unstructured PDF/web content → :KnowledgeDocument (keyed on `attachmentId`) + :Section, and `chat` for conversation transcripts → :ConversationArchive (keyed on `conversationIdentity`) + :Section chunks; two parent labels, two writer paths chosen by which identity property is set. Conversation-archive Phase 2 splits across two read-only tools: `conversation-archive-list-chunks` pages chunk bodies for the dispatched specialist to read in-turn; `conversation-archive-derive-insights` converts the specialist's per-chunk claims into operator-facing proposals with per-kind cypher. `conversation-archive-enrich-rejection` records (or undoes) durable per-row rejections so already-triaged claims do not re-surface on re-runs. Ships five skills: `conversational-memory`, `document-ingest`, `conversation-archive` (source-agnostic transcript ingest for WhatsApp, Telegram, Signal, LinkedIn DMs, Zoom, meeting minutes, iMessage, Slack), `conversation-archive-mcp` (operator-initiated MCP-driven ingest for Granola, Otter, Circleback meetings — sibling of `conversation-archive` sharing the same writer surface and identity formula), and `conversation-archive-enrich` (per-row operator-gated insight derivation over a named archive's chunks). Ships three thinking-tool skills: `challenge` (adversarial retrieval — strongest counter-evidence from the graph for a given claim), `connect` (bridge-finding between two topics via shared graph neighbors), and `emerge` (clusters uncategorised KnowledgeDocument and Section nodes into operator-approved Concept proposals)."
+description: "Graph memory plugin. Provides memory-search (with optional `fields` projection for known-shape lookups), memory-write, memory-update, memory-edge (create/delete typed directed edges between pre-existing nodes), memory-update-by-name (repair surface that resolves an elementId from a (label, name, accountId) tuple when search cannot return one), memory-lookup-by-name (deterministic read surface that returns nodes by case-insensitive exact `name` match — a Person, which carries no `name`, is matched on its composed `givenName` + `familyName` display name instead — optionally constrained by labels, bypassing the memory-search ranking stack so a present entity is never missed because a diluted query ranked it below the cut), and the :Report surface (memory-report-write / memory-report-read-latest / memory-report-list) for reading from, writing to, and updating the Neo4j knowledge graph. Includes conversational memory — organic preference learning, evidence-backed recall, and transparent 'what do you know about me?' responses. Document ingestion goes through memory-ingest; the dispatched specialist produces typed-section JSON in-turn from the loaded ontology. Operator-solicited reclassify of an already-stored thread-shaped KD (today: email-thread KDs) is exposed as `kd-classify <attachmentId>` — runs a body-growth gate (proceed iff body grew ≥25% since the last classify, or first-ever classify), stages the body to a temp file under `$ACCOUNT_DIR/tmp/`, and returns a dispatch envelope for the `librarian`; on success `memory-ingest` replaces the prior :Section children and stamps `lastClassifiedAt` + `lastClassifiedBodyLength` on the parent KD. Two modes: `document` (default) for unstructured PDF/web content → :KnowledgeDocument (keyed on `attachmentId`) + :Section, and `chat` for conversation transcripts → :ConversationArchive (keyed on `conversationIdentity`) + :Section chunks; two parent labels, two writer paths chosen by which identity property is set. Conversation-archive Phase 2 splits across two read-only tools: `conversation-archive-list-chunks` pages chunk bodies for the dispatched specialist to read in-turn; `conversation-archive-derive-insights` converts the specialist's per-chunk claims into operator-facing proposals with per-kind cypher. `conversation-archive-enrich-rejection` records (or undoes) durable per-row rejections so already-triaged claims do not re-surface on re-runs. Ships five skills: `conversational-memory`, `document-ingest`, `conversation-archive` (source-agnostic transcript ingest for WhatsApp, Telegram, Signal, LinkedIn DMs, Zoom, meeting minutes, iMessage, Slack), `conversation-archive-mcp` (operator-initiated MCP-driven ingest for Granola, Otter, Circleback meetings — sibling of `conversation-archive` sharing the same writer surface and identity formula), and `conversation-archive-enrich` (per-row operator-gated insight derivation over a named archive's chunks). Ships three thinking-tool skills: `challenge` (adversarial retrieval — strongest counter-evidence from the graph for a given claim), `connect` (bridge-finding between two topics via shared graph neighbors), and `emerge` (clusters uncategorised KnowledgeDocument and Section nodes into operator-approved Concept proposals). The learnings surface is three tools plus the `learnings-recall` skill: `learnings-scan` pages session transcripts off disk (requiring CLAUDE_CONFIG_DIR, refusing without it rather than guessing a projects root), `learnings-derive` reconciles the turn's claims into `:Learning` writes on a confidence curve (create at 0.5, reinforce as c + 0.15(1-c), contradict by 0.3 with contradictedAt stamped) and optionally runs the decay pass, and `learnings-recall` is the only path from a title injected into a system prompt to its full body."
 account-owned-dirs: [{"dir": "archive", "description": "Archived obsidian imports and their embedded attachments."}]
 tools:
   - name: memory-search
@@ -167,6 +167,18 @@ tools:
     publicAllowlist: false
     adminAllowlist: true
     riskClass: read
+  - name: learnings-scan
+    publicAllowlist: false
+    adminAllowlist: true
+    riskClass: read
+  - name: learnings-derive
+    publicAllowlist: false
+    adminAllowlist: true
+    riskClass: write_local
+  - name: learnings-recall
+    publicAllowlist: false
+    adminAllowlist: true
+    riskClass: read
 hidden:
   - name: session-compact
     riskClass: write_local
@@ -185,6 +197,7 @@ skills:
   - skills/challenge/SKILL.md
   - skills/connect/SKILL.md
   - skills/emerge/SKILL.md
+  - skills/learnings-recall/SKILL.md
 always: true
 embed: false
 mcp:
@@ -200,6 +213,7 @@ mcp:
     SESSION_ID: ${SESSION_ID}
     AGENT_SLUG: ${AGENT_SLUG}
     AGENT_SLUG_SCOPE: ${AGENT_SLUG_SCOPE}
+    CLAUDE_CONFIG_DIR: ${CLAUDE_CONFIG_DIR}
 mcp-manifest: auto
 ---