@rubytech/create-siteoffice-code 0.1.256

package/payload/platform/services/claude-session-manager/dist/agent-identity-locator.d.ts

@@ -0,0 +1,23 @@
+export type AgentRole = 'admin' | 'public';
+/** The single source of truth for the directory a spawn reads an agent's
+ *  identity files from. Admin always reads `agents/admin`; a public agent
+ *  reads `agents/<slug>` (Task 638 — keyed on the agent slug, not the role).
+ *  The spawn composer (`system-prompt.ts`) and the standing reachability audit
+ *  (`public-agent-reachability.ts`) both resolve through THIS function, so the
+ *  directory the audit vouches for is byte-identical to the one the spawn
+ *  reads — drift is impossible by construction, not by parallel literals. */
+export declare function resolveAgentIdentityDir(accountDir: string, role: AgentRole, slug: string): string;
+export interface IdentityFilesVerdict {
+    present: boolean;
+    /** First missing/empty file when `present` is false, e.g. `SOUL.md:ENOENT`
+     *  or `KNOWLEDGE.md:empty`. Undefined when present. */
+    detail?: string;
+}
+/** Whether the identity files a `role=public` spawn requires — IDENTITY.md,
+ *  SOUL.md and KNOWLEDGE.md, each non-empty — are present in `dir`. The check
+ *  order mirrors the composer's (IDENTITY → SOUL → KNOWLEDGE) so the reported
+ *  first-failing file matches the composer's refusal reason. The audit runs
+ *  this against `resolveAgentIdentityDir(accountDir, 'public', slug)`, so
+ *  `present:true` means the spawn will not refuse on a missing identity file. */
+export declare function publicIdentityFilesPresent(dir: string): IdentityFilesVerdict;
+//# sourceMappingURL=agent-identity-locator.d.ts.map

package/payload/platform/services/claude-session-manager/dist/agent-identity-locator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-identity-locator.d.ts","sourceRoot":"","sources":["../src/agent-identity-locator.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAA;AAE1C;;;;;;6EAM6E;AAC7E,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjG;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB;2DACuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;iFAKiF;AACjF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAO5E"}

package/payload/platform/services/claude-session-manager/dist/agent-identity-locator.js

@@ -0,0 +1,29 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/** The single source of truth for the directory a spawn reads an agent's
+ *  identity files from. Admin always reads `agents/admin`; a public agent
+ *  reads `agents/<slug>` (Task 638 — keyed on the agent slug, not the role).
+ *  The spawn composer (`system-prompt.ts`) and the standing reachability audit
+ *  (`public-agent-reachability.ts`) both resolve through THIS function, so the
+ *  directory the audit vouches for is byte-identical to the one the spawn
+ *  reads — drift is impossible by construction, not by parallel literals. */
+export function resolveAgentIdentityDir(accountDir, role, slug) {
+    return join(accountDir, 'agents', role === 'public' ? slug : 'admin');
+}
+/** Whether the identity files a `role=public` spawn requires — IDENTITY.md,
+ *  SOUL.md and KNOWLEDGE.md, each non-empty — are present in `dir`. The check
+ *  order mirrors the composer's (IDENTITY → SOUL → KNOWLEDGE) so the reported
+ *  first-failing file matches the composer's refusal reason. The audit runs
+ *  this against `resolveAgentIdentityDir(accountDir, 'public', slug)`, so
+ *  `present:true` means the spawn will not refuse on a missing identity file. */
+export function publicIdentityFilesPresent(dir) {
+    for (const name of ['IDENTITY.md', 'SOUL.md', 'KNOWLEDGE.md']) {
+        const path = join(dir, name);
+        if (!existsSync(path))
+            return { present: false, detail: `${name}:ENOENT` };
+        if (readFileSync(path, 'utf-8').length === 0)
+            return { present: false, detail: `${name}:empty` };
+    }
+    return { present: true };
+}
+//# sourceMappingURL=agent-identity-locator.js.map

package/payload/platform/services/claude-session-manager/dist/agent-identity-locator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-identity-locator.js","sourceRoot":"","sources":["../src/agent-identity-locator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIhC;;;;;;6EAM6E;AAC7E,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,IAAe,EAAE,IAAY;IACvF,OAAO,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AACvE,CAAC;AASD;;;;;iFAKiF;AACjF,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,CAAA;QAC1E,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAA;IAClG,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC"}

package/payload/platform/services/claude-session-manager/dist/auth-snapshot.d.ts

@@ -0,0 +1,4 @@
+export type AuthSnapshot = 'dead' | 'expired' | 'unknown';
+export declare function credentialsPathForConfigDir(claudeConfigDir: string): string;
+export declare function snapshotAuthForFailureReason(credentialsPath: string | undefined): AuthSnapshot;
+//# sourceMappingURL=auth-snapshot.d.ts.map

package/payload/platform/services/claude-session-manager/dist/auth-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-snapshot.d.ts","sourceRoot":"","sources":["../src/auth-snapshot.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;AAEzD,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wBAAgB,4BAA4B,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAqB9F"}

package/payload/platform/services/claude-session-manager/dist/auth-snapshot.js

@@ -0,0 +1,50 @@
+/**
+ * Task 576 — auth-snapshot.
+ *
+ * Read-only, no-dependency snapshot of the OAuth credentials file used
+ * by the http-server spawn-failure path to surface `reason=auth-refresh-failed`
+ * to the operator instead of the generic `pid-file-timeout`. Lives in
+ * claude-session-manager so the failure path stays in one tree; the
+ * authoritative refresh + lock logic continues to live in
+ * `platform/ui/app/lib/claude-auth.ts`.
+ *
+ * Returns one of:
+ *  - `dead`    — token expired AND no refresh token available
+ *  - `expired` — token expired but a refresh token is on disk
+ *  - `unknown` — token still valid, or the file is missing / unreadable
+ *                (not auth's fault — let the original failure reason stand)
+ */
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+export function credentialsPathForConfigDir(claudeConfigDir) {
+    return resolve(claudeConfigDir, '.credentials.json');
+}
+export function snapshotAuthForFailureReason(credentialsPath) {
+    if (!credentialsPath)
+        return 'unknown';
+    let raw;
+    try {
+        raw = readFileSync(credentialsPath, 'utf-8');
+    }
+    catch {
+        return 'unknown';
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return 'unknown';
+    }
+    const oauth = parsed.claudeAiOauth;
+    if (!oauth || typeof oauth !== 'object')
+        return 'unknown';
+    const expiresAt = oauth.expiresAt;
+    if (typeof expiresAt !== 'number' || !Number.isFinite(expiresAt))
+        return 'unknown';
+    if (expiresAt > Date.now())
+        return 'unknown'; // not the auth path's fault
+    const refreshToken = oauth.refreshToken;
+    return typeof refreshToken === 'string' && refreshToken.length > 0 ? 'expired' : 'dead';
+}
+//# sourceMappingURL=auth-snapshot.js.map

package/payload/platform/services/claude-session-manager/dist/auth-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-snapshot.js","sourceRoot":"","sources":["../src/auth-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAInC,MAAM,UAAU,2BAA2B,CAAC,eAAuB;IACjE,OAAO,OAAO,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,eAAmC;IAC9E,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAA;IACtC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAA+B,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAoD,CAAA;IACzE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACzD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IAClF,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAA,CAAC,4BAA4B;IACzE,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;IACvC,OAAO,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;AACzF,CAAC"}

package/payload/platform/services/claude-session-manager/dist/brand-foreign-filter.d.ts

@@ -0,0 +1,30 @@
+export type PremiumBundleMode = {
+    mode: 'all';
+} | {
+    mode: 'allowlist';
+    allow: ReadonlySet<string>;
+} | {
+    mode: 'none';
+};
+/** Read brand.json and resolve `shipsPremiumBundles` into one of the three
+ *  modes paths.ts already enforces for the UI. Missing file, malformed JSON,
+ *  or missing field defaults to `'none'` (fail-closed). */
+export declare function readBrandShipsPremiumBundles(platformRoot: string, logger: (line: string) => void): PremiumBundleMode;
+export interface AgentDirCandidate {
+    /** Absolute path to the `<bundle>/agents/` dir. */
+    path: string;
+    /** Plugin / bundle directory name (the parent of `agents/`). */
+    bundle: string;
+    /** True when this candidate sits under the premium-plugins root. */
+    premium: boolean;
+}
+export interface FilterResult {
+    kept: AgentDirCandidate[];
+    skipped: AgentDirCandidate[];
+}
+/** Filter candidate agents/ dirs against the resolved premium-bundle mode.
+ *  Non-premium candidates (platform/plugins/) are always kept. Premium
+ *  candidates are kept if mode is 'all', or if mode is 'allowlist' and the
+ *  bundle name is in the allow set; otherwise dropped. */
+export declare function filterBrandForeignAgentDirs(candidates: readonly AgentDirCandidate[], premiumMode: PremiumBundleMode): FilterResult;
+//# sourceMappingURL=brand-foreign-filter.d.ts.map

package/payload/platform/services/claude-session-manager/dist/brand-foreign-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand-foreign-filter.d.ts","sourceRoot":"","sources":["../src/brand-foreign-filter.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpB;;2DAE2D;AAC3D,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC7B,iBAAiB,CAgCnB;AAED,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAA;IACZ,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAA;IACd,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,iBAAiB,EAAE,CAAA;IACzB,OAAO,EAAE,iBAAiB,EAAE,CAAA;CAC7B;AAED;;;0DAG0D;AAC1D,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,SAAS,iBAAiB,EAAE,EACxC,WAAW,EAAE,iBAAiB,GAC7B,YAAY,CAiBd"}

package/payload/platform/services/claude-session-manager/dist/brand-foreign-filter.js

@@ -0,0 +1,86 @@
+// Brand-foreign premium-bundle filter for the boot-time agents/ walk.
+//
+// The manager walks `<premium-plugins>/<bundle>/agents/` for every bundle
+// present on disk. On a brand whose installer ships every premium bundle but
+// only intends to USE a subset, foreign-bundle specialist files (e.g.
+// real-agent's listing-curator on a maxy-code install) reach the drift
+// assertion and refuse boot the moment any of their declared tools is not in
+// the active brand's tool surface.
+//
+// The fix: brand.json#shipsPremiumBundles is the same field paths.ts already
+// resolves for the UI. Three modes, matching the canonical resolver:
+//
+//   true         → 'all'       — ship every premium bundle on disk
+//   string[]     → 'allowlist' — ship only the named bundle directories
+//   false/absent → 'none'      — ship no premium bundles
+//
+// Premium bundles outside the resolved mode are dropped at agents/ walk time
+// with one `agents-dir-skipped path=<p> reason=brand-foreign-bundle bundle=<n>`
+// line per drop. `platform/plugins/` candidates are never filtered.
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/** Read brand.json and resolve `shipsPremiumBundles` into one of the three
+ *  modes paths.ts already enforces for the UI. Missing file, malformed JSON,
+ *  or missing field defaults to `'none'` (fail-closed). */
+export function readBrandShipsPremiumBundles(platformRoot, logger) {
+    const path = join(platformRoot, 'config', 'brand.json');
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf-8');
+    }
+    catch {
+        logger(`brand-config-missing path=${path} ships-premium-bundles=none`);
+        return { mode: 'none' };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        logger(`brand-config-malformed path=${path} err=${err instanceof Error ? err.message : String(err)} ships-premium-bundles=none`);
+        return { mode: 'none' };
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return { mode: 'none' };
+    const v = parsed.shipsPremiumBundles;
+    if (v === true) {
+        logger(`brand-config-loaded path=${path} ships-premium-bundles=all`);
+        return { mode: 'all' };
+    }
+    if (Array.isArray(v)) {
+        const allow = new Set();
+        for (const x of v) {
+            if (typeof x === 'string' && x.length > 0)
+                allow.add(x);
+        }
+        logger(`brand-config-loaded path=${path} ships-premium-bundles=${allow.size === 0 ? 'none' : Array.from(allow).sort().join(',')}`);
+        return { mode: 'allowlist', allow };
+    }
+    // false, null, missing — fail-closed: no premium bundles.
+    return { mode: 'none' };
+}
+/** Filter candidate agents/ dirs against the resolved premium-bundle mode.
+ *  Non-premium candidates (platform/plugins/) are always kept. Premium
+ *  candidates are kept if mode is 'all', or if mode is 'allowlist' and the
+ *  bundle name is in the allow set; otherwise dropped. */
+export function filterBrandForeignAgentDirs(candidates, premiumMode) {
+    const kept = [];
+    const skipped = [];
+    for (const c of candidates) {
+        if (!c.premium) {
+            kept.push(c);
+            continue;
+        }
+        if (premiumMode.mode === 'all') {
+            kept.push(c);
+        }
+        else if (premiumMode.mode === 'allowlist' && premiumMode.allow.has(c.bundle)) {
+            kept.push(c);
+        }
+        else {
+            skipped.push(c);
+        }
+    }
+    return { kept, skipped };
+}
+//# sourceMappingURL=brand-foreign-filter.js.map

package/payload/platform/services/claude-session-manager/dist/brand-foreign-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand-foreign-filter.js","sourceRoot":"","sources":["../src/brand-foreign-filter.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,sEAAsE;AACtE,uEAAuE;AACvE,6EAA6E;AAC7E,mCAAmC;AACnC,EAAE;AACF,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,yDAAyD;AACzD,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,oEAAoE;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAOhC;;2DAE2D;AAC3D,MAAM,UAAU,4BAA4B,CAC1C,YAAoB,EACpB,MAA8B;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;IACvD,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,6BAA6B,IAAI,6BAA6B,CAAC,CAAA;QACtE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACzB,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,+BAA+B,IAAI,QAAQ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAA;QAChI,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACzB,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAClE,MAAM,CAAC,GAAI,MAA4C,CAAC,mBAAmB,CAAA;IAC3E,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,MAAM,CAAC,4BAA4B,IAAI,4BAA4B,CAAC,CAAA;QACpE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACxB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;QAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,MAAM,CAAC,4BAA4B,IAAI,0BAA0B,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAClI,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;IACrC,CAAC;IACD,0DAA0D;IAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAgBD;;;0DAG0D;AAC1D,MAAM,UAAU,2BAA2B,CACzC,UAAwC,EACxC,WAA8B;IAE9B,MAAM,IAAI,GAAwB,EAAE,CAAA;IACpC,MAAM,OAAO,GAAwB,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACZ,SAAQ;QACV,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACd,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACd,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC"}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.d.ts

@@ -0,0 +1,7 @@
+/** Long-prefix name served by the installed-plugin channel (admin + specialist
+ *  spawns). plugin === server === plugin directory basename. */
+export declare function canonicalToolName(plugin: string, tool: string): string;
+/** Short-prefix name served by the per-spawn `--mcp-config` channel, retained
+ *  only for public-agent spawns. */
+export declare function qualifyShortToolName(plugin: string, tool: string): string;
+//# sourceMappingURL=canonical-tool-names.d.ts.map

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-tool-names.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.ts"],"names":[],"mappings":"AAaA;gEACgE;AAChE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED;oCACoC;AACpC,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE"}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.d.ts

@@ -0,0 +1,5 @@
+/** Directory basenames of maxy platform plugins that expose a tool surface. */
+export declare const MAXY_MCP_PLUGINS: readonly string[];
+/** Every canonical maxy MCP tool name (long prefix), sorted. */
+export declare const CANONICAL_MAXY_TOOL_NAMES: readonly string[];
+//# sourceMappingURL=canonical-tool-names.generated.d.ts.map

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAiB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAgLtD,CAAA"}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js

@@ -0,0 +1,205 @@
+// GENERATED — do not edit by hand.
+// Source: platform/plugins/*/PLUGIN.md (tools: + hidden: blocks).
+// Regenerate: cd platform && npm run gen:canonical-tools
+// Gate: platform/scripts/check-canonical-tool-names.mjs fails the build on drift.
+//
+// Canonical long-prefix names every maxy MCP tool is served under by the
+// installed-plugin channel: mcp__plugin_<dir>_<dir>__<tool>.
+/** Directory basenames of maxy platform plugins that expose a tool surface. */
+export const MAXY_MCP_PLUGINS = [
+    "admin",
+    "aeo",
+    "browser",
+    "contacts",
+    "email",
+    "graph",
+    "graph-viewer",
+    "memory",
+    "outlook",
+    "replicate",
+    "scheduling",
+    "telegram",
+    "url-get",
+    "whatsapp",
+    "work",
+    "workflows",
+];
+/** Every canonical maxy MCP tool name (long prefix), sorted. */
+export const CANONICAL_MAXY_TOOL_NAMES = [
+    "mcp__plugin_admin_admin__account-manage",
+    "mcp__plugin_admin_admin__account-update",
+    "mcp__plugin_admin_admin__action-approve",
+    "mcp__plugin_admin_admin__action-edit",
+    "mcp__plugin_admin_admin__action-pending",
+    "mcp__plugin_admin_admin__action-reject",
+    "mcp__plugin_admin_admin__admin-add",
+    "mcp__plugin_admin_admin__admin-identity-authenticate",
+    "mcp__plugin_admin_admin__admin-list",
+    "mcp__plugin_admin_admin__admin-remove",
+    "mcp__plugin_admin_admin__admin-update-pin",
+    "mcp__plugin_admin_admin__agent-config-read",
+    "mcp__plugin_admin_admin__agent-list",
+    "mcp__plugin_admin_admin__brand-settings",
+    "mcp__plugin_admin_admin__capabilities-here",
+    "mcp__plugin_admin_admin__logs-read",
+    "mcp__plugin_admin_admin__plugin-read",
+    "mcp__plugin_admin_admin__public-hostname",
+    "mcp__plugin_admin_admin__publish-site",
+    "mcp__plugin_admin_admin__qr-generate",
+    "mcp__plugin_admin_admin__remote-auth-set-password",
+    "mcp__plugin_admin_admin__remote-auth-status",
+    "mcp__plugin_admin_admin__session-reset",
+    "mcp__plugin_admin_admin__session-resume",
+    "mcp__plugin_admin_admin__skill-load",
+    "mcp__plugin_admin_admin__store-skill",
+    "mcp__plugin_admin_admin__system-status",
+    "mcp__plugin_admin_admin__wifi",
+    "mcp__plugin_aeo_aeo__aeo-audit-page",
+    "mcp__plugin_aeo_aeo__aeo-emit-jsonld",
+    "mcp__plugin_aeo_aeo__aeo-write-llms-txt",
+    "mcp__plugin_browser_browser__browser-click",
+    "mcp__plugin_browser_browser__browser-console-messages",
+    "mcp__plugin_browser_browser__browser-evaluate",
+    "mcp__plugin_browser_browser__browser-fill",
+    "mcp__plugin_browser_browser__browser-fill-form",
+    "mcp__plugin_browser_browser__browser-handle-dialog",
+    "mcp__plugin_browser_browser__browser-hover",
+    "mcp__plugin_browser_browser__browser-navigate",
+    "mcp__plugin_browser_browser__browser-pdf-save",
+    "mcp__plugin_browser_browser__browser-press-key",
+    "mcp__plugin_browser_browser__browser-render",
+    "mcp__plugin_browser_browser__browser-resize",
+    "mcp__plugin_browser_browser__browser-screenshot",
+    "mcp__plugin_browser_browser__browser-select-option",
+    "mcp__plugin_browser_browser__browser-snapshot",
+    "mcp__plugin_browser_browser__browser-tabs",
+    "mcp__plugin_browser_browser__browser-type",
+    "mcp__plugin_browser_browser__browser-wait-for",
+    "mcp__plugin_contacts_contacts__contact-create",
+    "mcp__plugin_contacts_contacts__contact-delete",
+    "mcp__plugin_contacts_contacts__contact-erase",
+    "mcp__plugin_contacts_contacts__contact-export",
+    "mcp__plugin_contacts_contacts__contact-list",
+    "mcp__plugin_contacts_contacts__contact-lookup",
+    "mcp__plugin_contacts_contacts__contact-update",
+    "mcp__plugin_contacts_contacts__group-create",
+    "mcp__plugin_contacts_contacts__group-manage",
+    "mcp__plugin_email_email__email-fetch",
+    "mcp__plugin_email_email__email-graph-query",
+    "mcp__plugin_email_email__email-ingest",
+    "mcp__plugin_email_email__email-otp-extract",
+    "mcp__plugin_email_email__email-provider-info",
+    "mcp__plugin_email_email__email-read",
+    "mcp__plugin_email_email__email-reply",
+    "mcp__plugin_email_email__email-search",
+    "mcp__plugin_email_email__email-send",
+    "mcp__plugin_email_email__email-setup",
+    "mcp__plugin_email_email__email-status",
+    "mcp__plugin_graph-viewer_graph-viewer__graph-render",
+    "mcp__plugin_graph_graph__maxy-graph-get_neo4j_schema",
+    "mcp__plugin_graph_graph__maxy-graph-read_neo4j_cypher",
+    "mcp__plugin_graph_graph__maxy-graph-write_neo4j_cypher",
+    "mcp__plugin_memory_memory__conversation-archive-derive-insights",
+    "mcp__plugin_memory_memory__conversation-archive-enrich-rejection",
+    "mcp__plugin_memory_memory__conversation-archive-list-chunks",
+    "mcp__plugin_memory_memory__conversation-list",
+    "mcp__plugin_memory_memory__conversation-memory-expunge",
+    "mcp__plugin_memory_memory__conversation-search",
+    "mcp__plugin_memory_memory__graph-prune-denylist-add",
+    "mcp__plugin_memory_memory__graph-prune-denylist-list",
+    "mcp__plugin_memory_memory__graph-prune-denylist-remove",
+    "mcp__plugin_memory_memory__image-fetch",
+    "mcp__plugin_memory_memory__kd-classify",
+    "mcp__plugin_memory_memory__memory-archive-write",
+    "mcp__plugin_memory_memory__memory-brain-capture-recent",
+    "mcp__plugin_memory_memory__memory-compiled-truth-history",
+    "mcp__plugin_memory_memory__memory-delete",
+    "mcp__plugin_memory_memory__memory-dream-run",
+    "mcp__plugin_memory_memory__memory-edge",
+    "mcp__plugin_memory_memory__memory-edit-attachment",
+    "mcp__plugin_memory_memory__memory-empty-trash",
+    "mcp__plugin_memory_memory__memory-find-candidates",
+    "mcp__plugin_memory_memory__memory-ingest",
+    "mcp__plugin_memory_memory__memory-ingest-extract",
+    "mcp__plugin_memory_memory__memory-ingest-web",
+    "mcp__plugin_memory_memory__memory-list-attachments",
+    "mcp__plugin_memory_memory__memory-lookup-by-name",
+    "mcp__plugin_memory_memory__memory-node-exists",
+    "mcp__plugin_memory_memory__memory-read-attachment",
+    "mcp__plugin_memory_memory__memory-reindex",
+    "mcp__plugin_memory_memory__memory-rename-attachment",
+    "mcp__plugin_memory_memory__memory-report-list",
+    "mcp__plugin_memory_memory__memory-report-read-latest",
+    "mcp__plugin_memory_memory__memory-report-write",
+    "mcp__plugin_memory_memory__memory-restore",
+    "mcp__plugin_memory_memory__memory-review-queue",
+    "mcp__plugin_memory_memory__memory-search",
+    "mcp__plugin_memory_memory__memory-typed-edge-pass",
+    "mcp__plugin_memory_memory__memory-update",
+    "mcp__plugin_memory_memory__memory-update-by-name",
+    "mcp__plugin_memory_memory__memory-write",
+    "mcp__plugin_memory_memory__obsidian-vault-import",
+    "mcp__plugin_memory_memory__profile-delete",
+    "mcp__plugin_memory_memory__profile-read",
+    "mcp__plugin_memory_memory__profile-update",
+    "mcp__plugin_memory_memory__session-compact",
+    "mcp__plugin_memory_memory__session-compact-status",
+    "mcp__plugin_outlook_outlook__outlook-account-register",
+    "mcp__plugin_outlook_outlook__outlook-calendar-event",
+    "mcp__plugin_outlook_outlook__outlook-calendar-list",
+    "mcp__plugin_outlook_outlook__outlook-contacts-list",
+    "mcp__plugin_outlook_outlook__outlook-mail-list",
+    "mcp__plugin_outlook_outlook__outlook-mail-search",
+    "mcp__plugin_outlook_outlook__outlook-mailbox-info",
+    "mcp__plugin_replicate_replicate__image-generate",
+    "mcp__plugin_replicate_replicate__replicate-key-store",
+    "mcp__plugin_replicate_replicate__replicate-key-verify",
+    "mcp__plugin_scheduling_scheduling__schedule-archive-ics",
+    "mcp__plugin_scheduling_scheduling__schedule-cancel",
+    "mcp__plugin_scheduling_scheduling__schedule-event",
+    "mcp__plugin_scheduling_scheduling__schedule-export-ics",
+    "mcp__plugin_scheduling_scheduling__schedule-get",
+    "mcp__plugin_scheduling_scheduling__schedule-import-ics",
+    "mcp__plugin_scheduling_scheduling__schedule-list",
+    "mcp__plugin_scheduling_scheduling__schedule-update",
+    "mcp__plugin_scheduling_scheduling__time-resolve",
+    "mcp__plugin_telegram_telegram__message",
+    "mcp__plugin_telegram_telegram__message-history",
+    "mcp__plugin_telegram_telegram__telegram-webhook-register",
+    "mcp__plugin_url-get_url-get__url-get",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-activity",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-config",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-conversation-graph-state",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-conversations",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-disconnect",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-group-info",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-login-start",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-login-wait",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-messages",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-send",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-send-document",
+    "mcp__plugin_whatsapp_whatsapp__whatsapp-status",
+    "mcp__plugin_work_work__project-complete",
+    "mcp__plugin_work_work__project-create",
+    "mcp__plugin_work_work__project-get",
+    "mcp__plugin_work_work__project-list",
+    "mcp__plugin_work_work__project-update",
+    "mcp__plugin_work_work__session-list",
+    "mcp__plugin_work_work__session-name",
+    "mcp__plugin_work_work__work-complete",
+    "mcp__plugin_work_work__work-create",
+    "mcp__plugin_work_work__work-get",
+    "mcp__plugin_work_work__work-list",
+    "mcp__plugin_work_work__work-ready",
+    "mcp__plugin_work_work__work-relate",
+    "mcp__plugin_work_work__work-update",
+    "mcp__plugin_workflows_workflows__workflow-create",
+    "mcp__plugin_workflows_workflows__workflow-delete",
+    "mcp__plugin_workflows_workflows__workflow-execute",
+    "mcp__plugin_workflows_workflows__workflow-get",
+    "mcp__plugin_workflows_workflows__workflow-list",
+    "mcp__plugin_workflows_workflows__workflow-runs",
+    "mcp__plugin_workflows_workflows__workflow-update",
+    "mcp__plugin_workflows_workflows__workflow-validate",
+];
+//# sourceMappingURL=canonical-tool-names.generated.js.map

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-tool-names.generated.js","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,kEAAkE;AAClE,yDAAyD;AACzD,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO;IACP,KAAK;IACL,SAAS;IACT,UAAU;IACV,OAAO;IACP,OAAO;IACP,cAAc;IACd,QAAQ;IACR,SAAS;IACT,WAAW;IACX,YAAY;IACZ,UAAU;IACV,SAAS;IACT,UAAU;IACV,MAAM;IACN,WAAW;CACZ,CAAA;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,yCAAyC;IACzC,yCAAyC;IACzC,yCAAyC;IACzC,sCAAsC;IACtC,yCAAyC;IACzC,wCAAwC;IACxC,oCAAoC;IACpC,sDAAsD;IACtD,qCAAqC;IACrC,uCAAuC;IACvC,2CAA2C;IAC3C,4CAA4C;IAC5C,qCAAqC;IACrC,yCAAyC;IACzC,4CAA4C;IAC5C,oCAAoC;IACpC,sCAAsC;IACtC,0CAA0C;IAC1C,uCAAuC;IACvC,sCAAsC;IACtC,mDAAmD;IACnD,6CAA6C;IAC7C,wCAAwC;IACxC,yCAAyC;IACzC,qCAAqC;IACrC,sCAAsC;IACtC,wCAAwC;IACxC,+BAA+B;IAC/B,qCAAqC;IACrC,sCAAsC;IACtC,yCAAyC;IACzC,4CAA4C;IAC5C,uDAAuD;IACvD,+CAA+C;IAC/C,2CAA2C;IAC3C,gDAAgD;IAChD,oDAAoD;IACpD,4CAA4C;IAC5C,+CAA+C;IAC/C,+CAA+C;IAC/C,gDAAgD;IAChD,6CAA6C;IAC7C,6CAA6C;IAC7C,iDAAiD;IACjD,oDAAoD;IACpD,+CAA+C;IAC/C,2CAA2C;IAC3C,2CAA2C;IAC3C,+CAA+C;IAC/C,+CAA+C;IAC/C,+CAA+C;IAC/C,8CAA8C;IAC9C,+CAA+C;IAC/C,6CAA6C;IAC7C,+CAA+C;IAC/C,+CAA+C;IAC/C,6CAA6C;IAC7C,6CAA6C;IAC7C,sCAAsC;IACtC,4CAA4C;IAC5C,uCAAuC;IACvC,4CAA4C;IAC5C,8CAA8C;IAC9C,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qDAAqD;IACrD,sDAAsD;IACtD,uDAAuD;IACvD,wDAAwD;IACxD,iEAAiE;IACjE,kEAAkE;IAClE,6DAA6D;IAC7D,8CAA8C;IAC9C,wDAAwD;IACxD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,wDAAwD;IACxD,wCAAwC;IACxC,wCAAwC;IACxC,iDAAiD;IACjD,wDAAwD;IACxD,0DAA0D;IAC1D,0CAA0C;IAC1C,6CAA6C;IAC7C,wCAAwC;IACxC,mDAAmD;IACnD,+CAA+C;IAC/C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,8CAA8C;IAC9C,oDAAoD;IACpD,kDAAkD;IAClD,+CAA+C;IAC/C,mDAAmD;IACnD,2CAA2C;IAC3C,qDAAqD;IACrD,+CAA+C;IAC/C,sDAAsD;IACtD,gDAAgD;IAChD,2CAA2C;IAC3C,gDAAgD;IAChD,0CAA0C;IAC1C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,yCAAyC;IACzC,kDAAkD;IAClD,2CAA2C;IAC3C,yCAAyC;IACzC,2CAA2C;IAC3C,4CAA4C;IAC5C,mDAAmD;IACnD,uDAAuD;IACvD,qDAAqD;IACrD,oDAAoD;IACpD,oDAAoD;IACpD,gDAAgD;IAChD,kDAAkD;IAClD,mDAAmD;IACnD,iDAAiD;IACjD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,oDAAoD;IACpD,mDAAmD;IACnD,wDAAwD;IACxD,iDAAiD;IACjD,wDAAwD;IACxD,kDAAkD;IAClD,oDAAoD;IACpD,iDAAiD;IACjD,wCAAwC;IACxC,gDAAgD;IAChD,0DAA0D;IAC1D,sCAAsC;IACtC,kDAAkD;IAClD,gDAAgD;IAChD,kEAAkE;IAClE,uDAAuD;IACvD,oDAAoD;IACpD,oDAAoD;IACpD,qDAAqD;IACrD,oDAAoD;IACpD,kDAAkD;IAClD,8CAA8C;IAC9C,uDAAuD;IACvD,gDAAgD;IAChD,yCAAyC;IACzC,uCAAuC;IACvC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,qCAAqC;IACrC,qCAAqC;IACrC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,kCAAkC;IAClC,mCAAmC;IACnC,oCAAoC;IACpC,oCAAoC;IACpC,kDAAkD;IAClD,kDAAkD;IAClD,mDAAmD;IACnD,+CAA+C;IAC/C,gDAAgD;IAChD,gDAAgD;IAChD,kDAAkD;IAClD,oDAAoD;CACrD,CAAA"}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.js

@@ -0,0 +1,23 @@
+// Canonical (long-prefix) maxy MCP tool naming.
+//
+// Claude Code's installed-plugin channel serves every plugin MCP tool under
+// `mcp__plugin_<plugin>_<server>__<tool>`. For every platform plugin the
+// marketplace name, the MCP server key, and the directory basename are
+// identical, so the canonical name is `mcp__plugin_<dir>_<dir>__<tool>`.
+//
+// This helper is the single constructor of that name. tool-surface.ts builds
+// its admin/all surfaces through it; the per-spawn (public) channel keeps the
+// short prefix and uses `qualifyShortToolName`. The generated list of every
+// canonical name lives in `canonical-tool-names.generated.ts`, kept in lockstep
+// by the build gate `platform/scripts/check-canonical-tool-names.mjs`.
+/** Long-prefix name served by the installed-plugin channel (admin + specialist
+ *  spawns). plugin === server === plugin directory basename. */
+export function canonicalToolName(plugin, tool) {
+    return `mcp__plugin_${plugin}_${plugin}__${tool}`;
+}
+/** Short-prefix name served by the per-spawn `--mcp-config` channel, retained
+ *  only for public-agent spawns. */
+export function qualifyShortToolName(plugin, tool) {
+    return `mcp__${plugin}__${tool}`;
+}
+//# sourceMappingURL=canonical-tool-names.js.map

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-tool-names.js","sourceRoot":"","sources":["../src/canonical-tool-names.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,uEAAuE;AAEvE;gEACgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAY;IAC5D,OAAO,eAAe,MAAM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAA;AACnD,CAAC;AAED;oCACoC;AACpC,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,IAAY;IAC/D,OAAO,QAAQ,MAAM,KAAK,IAAI,EAAE,CAAA;AAClC,CAAC"}

package/payload/platform/services/claude-session-manager/dist/config.d.ts

@@ -0,0 +1,55 @@
+import type { HostContext } from './system-prompt.js';
+import { type PublicSpawnLimits } from './spawn-rate-limiter.js';
+export interface HostResolution extends HostContext {
+    /** Comma-separated list of detected interface names — non-null only when
+     *  lanIPv4 resolution failed. Surfaced as the `stderrTail` of a spawn
+     *  rejection so the operator sees what was searched. */
+    lanIPv4Diagnostic: string | null;
+}
+export interface ManagerConfig {
+    port: number;
+    persistDir: string;
+    claudeBin: string;
+    spawnCwd: string;
+    urlCaptureTimeoutMs: number;
+    killGraceMs: number;
+    jsonlReadMaxBytes: number;
+    /** Per-account concurrent specialist (`--agent`) PTYs. (N+1)th attempt
+     *  evicts the oldest idle specialist; rejects 503 if none are idle.
+     *  Env override: `CLAUDE_SESSION_MANAGER_SPECIALIST_CAP`. Default 3. */
+    specialistCap: number;
+    /** Slots reserved for operator (non-specialist) spawns. Specialist
+     *  spawns are rejected with 503 `operator-slots-reserved` once
+     *  `currentTotalLive >= totalPtyCap - operatorReserve`. Env:
+     *  `CLAUDE_SESSION_MANAGER_OPERATOR_RESERVE`. Default 2. */
+    operatorReserve: number;
+    /** Hard ceiling on concurrent PTYs the manager will hold open. Taken
+     *  as the min of `/proc/sys/kernel/pty/max` (Linux only; absent on
+     *  Darwin) and `CLAUDE_SESSION_MANAGER_TOTAL_PTY_CAP` (default 64). */
+    totalPtyCap: number;
+    /** Reaper TTL: a specialist row with `status: idle` and no JSONL whose
+     *  `updatedAt` is older than this is SIGTERMed. Env:
+     *  `CLAUDE_SESSION_MANAGER_RECORDER_IDLE_TTL_MS`. Default 120 000. */
+    recorderIdleTtlMs: number;
+    host: HostResolution;
+    /** per-account directory resolved at boot. Mirrors the
+     *  installer's `resolveInstallAccountId` walk: the first sub-directory of
+     *  `<installDir>/data/accounts/` containing `account.json`. Per-spawn the
+     *  composer reads `<accountDir>/agents/<role>/{IDENTITY.md,SOUL.md}` and
+     *  injects them as `<identity>` / `<soul>` sentinels in the
+     *  `--append-system-prompt` block; absence of an account dir refuses
+     *  manager start with `account-dir-unresolved` (no silent fallback to
+     *  stock Claude Code). */
+    accountDir: string;
+    /** per-`role=public` spawn rate limit. Loaded from
+     * `brand.json.publicSpawnLimits` if present, else defaults; env vars
+     * `MAXY_PUBLIC_SPAWN_CAP` / `MAXY_PUBLIC_SPAWN_WINDOW_MS` override every
+     * per-channel bucket (operator escape hatch). */
+    publicSpawnLimits: PublicSpawnLimits;
+    /** `brand.json.productName` ("Maxy", "Real Agent"). Used as the
+     *  `claude rc` session-name prefix so the Remote Control device renders
+     *  as `<productName> · <id>` in the composer instead of the OS hostname. */
+    brandProductName: string;
+}
+export declare function loadConfig(env?: NodeJS.ProcessEnv): ManagerConfig;
+//# sourceMappingURL=config.d.ts.map

package/payload/platform/services/claude-session-manager/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAA;AAGhC,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD;;4DAEwD;IACxD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB;;4EAEwE;IACxE,aAAa,EAAE,MAAM,CAAA;IACrB;;;gEAG4D;IAC5D,eAAe,EAAE,MAAM,CAAA;IACvB;;2EAEuE;IACvE,WAAW,EAAE,MAAM,CAAA;IACnB;;0EAEsE;IACtE,iBAAiB,EAAE,MAAM,CAAA;IACzB,IAAI,EAAE,cAAc,CAAA;IACpB;;;;;;;8BAO0B;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB;;;qDAGiD;IACjD,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;gFAE4E;IAC5E,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAiLD,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAuE9E"}