@rubytech/create-maxy-code 0.1.329 → 0.1.331

package/payload/platform/scripts/lib/resolve-account-dir.sh

@@ -1,184 +1,131 @@
-# resolve-account-dir.sh — identity-aware account resolver + orphan sweeper
+# resolve-account-dir.sh — house-account resolver + registry-membership reporter
 # Sourced by setup-account.sh and seed-neo4j.sh. Defines `resolve_and_sweep_account_dir`.
 #
+# Multi-account managed-service model (Task 983): an install may host N accounts
+# under data/accounts/ — exactly one carries role:"house", the rest role:"client".
+# The registry is the set of dirs holding a parseable account.json. EVERY
+# registered account is durable: this resolver never trashes a dir with an
+# account.json. It resolves ACCOUNT_DIR/ACCOUNT_ID to the single role:"house"
+# account (or the sole account in the pre-migration window, before
+# setup-account.sh stamps role:"house").
+#
+# Sweep is LOG-ONLY this sprint. The destructive `mv` to .trash/ was removed to
+# eliminate any chance of deleting a registered account during the multi-account
+# rollout; restoring a guarded destructive sweep is tracked as a follow-up task.
+# Orphan dirs (no account.json) are reported, never moved.
+#
 # Invariant: the TypeScript `resolveAccount()` at platform/ui/app/lib/claude-agent.ts
-# is READ-ONLY. This bash helper is the SOLE sweep surface, because seed-time is
-# the only safe moment to mutate filesystem layout. Any future "share the logic"
-# refactor must preserve that asymmetry.
+# is READ-ONLY. This bash helper is the SOLE filesystem-mutation surface for the
+# account layout, because seed-time is the only safe moment to mutate it.
 #
 # Contract (inputs via env vars):
 #   ACCOUNTS_DIR — {installDir}/data/accounts
-#   USERS_FILE   — $HOME/<brand.configDir>/users.json
+#   USERS_FILE   — $HOME/<brand.configDir>/users.json   (read-tolerant; unused for sweep)
 #
 # Contract (outputs via env vars):
-#   ACCOUNT_ID   — resolved uuid (existing kept, or freshly minted)
-#   ACCOUNT_DIR  — full path to the live account dir
+#   ACCOUNT_ID   — resolved house uuid (existing kept, or freshly minted on fresh install)
+#   ACCOUNT_DIR  — full path to the live house account dir
 #
 # Exit:
-#   0 on success; non-zero on abort (multi-candidate + no unique identity match).
+#   0 on success; non-zero on abort (registry drift: zero-house with >1 candidate,
+#   or multiple houses).
 
-# Helper: classify account.json at $1 against userId $2.
-# Exit codes are trichotomous so callers can distinguish "definitely not a match"
-# from "could not determine" — the latter is a doctrine-level loud failure, not
-# a silent fall-through to orphan-classification.
-#   0 = admins[] contains userId (match)
-#   1 = account.json readable and parsed; userId absent from admins[] (no match)
-#   2 = account.json missing, unreadable, or unparseable (undetermined — caller must abort)
-_account_dir_matches() {
+# Helper: print the `role` field of the account.json at $1, or empty string when
+# absent/unparseable. Trichotomy is unnecessary here — a missing role just means
+# "not a house candidate"; corruption discipline lives in the enumeration step.
+_account_dir_role() {
   local config="$1/account.json"
-  local uid="$2"
-  [ -f "$config" ] || return 2
-  python3 - "$config" "$uid" <<'PY'
+  [ -f "$config" ] || { echo ""; return 0; }
+  python3 - "$config" <<'PY' 2>/dev/null || echo ""
 import json, sys
 try:
     cfg = json.load(open(sys.argv[1]))
 except Exception:
-    sys.exit(2)
-admins = cfg.get('admins') or []
-uid = sys.argv[2]
-for a in admins:
-    if isinstance(a, dict) and a.get('userId') == uid:
-        sys.exit(0)
-sys.exit(1)
+    print(""); sys.exit(0)
+print(cfg.get("role") or "")
 PY
 }
 
-# Two-pass resolver: enumerate+classify all candidates, then act.
-# Never mutates filesystem before the full classification is complete.
+# House-account resolver. Enumerate registered candidates (dirs with account.json),
+# classify by role, resolve the house (or sole-unlabelled), report orphans, and
+# emit the registry snapshot. Never mutates the filesystem layout.
 resolve_and_sweep_account_dir() {
   mkdir -p "$ACCOUNTS_DIR"
 
   # Enumerate candidates: direct children with account.json, basenames not starting with '.'
-  local candidates=()
+  local candidates=() orphans=()
   local dir base
   for dir in "$ACCOUNTS_DIR"/*/; do
     [ -d "$dir" ] || continue
     base="$(basename "$dir")"
     case "$base" in .*) continue ;; esac
-    [ -f "$dir/account.json" ] || continue
-    candidates+=("$base")
+    if [ -f "$dir/account.json" ]; then
+      candidates+=("$base")
+    else
+      orphans+=("$base")
+    fi
   done
 
-  # Read target userId from users.json (if present and valid)
-  local target_user_id=""
-  if [ -f "$USERS_FILE" ]; then
-    target_user_id=$(python3 - "$USERS_FILE" <<'PY' 2>/dev/null || true
-import json, sys
-try:
-    data = json.load(open(sys.argv[1]))
-    if isinstance(data, list) and data and isinstance(data[0], dict):
-        uid = data[0].get('userId')
-        if uid:
-            print(uid)
-except Exception:
-    pass
-PY
-)
-  fi
-
   local n=${#candidates[@]}
 
   # Case 0: no candidates — fresh install, mint new UUID.
-  # sub-scope F — atomic-mint discipline: refuse to mint a new
-  # accountId if any stub dir (subdir present, account.json missing) exists
-  # under data/accounts/. The root cause is install 1 minting accountId X
-  # then losing X/account.json (cron stamped X/logs/ first); the next
-  # install sees zero candidates and mints Y, orphaning X/logs/. The
-  # guard turns that silent regression into an operator-actionable abort.
+  # Atomic-mint discipline: refuse to mint if any stub dir (subdir present,
+  # account.json missing) exists — a half-provisioned account from a crashed
+  # prior install must be operator-repaired, not silently orphaned.
   if [ "$n" -eq 0 ]; then
-    local stub_dirs=()
-    for dir in "$ACCOUNTS_DIR"/*/; do
-      [ -d "$dir" ] || continue
-      base="$(basename "$dir")"
-      case "$base" in .*) continue ;; esac
-      [ -f "$dir/account.json" ] && continue
-      stub_dirs+=("$base")
-    done
-    if [ "${#stub_dirs[@]}" -gt 0 ]; then
-      echo "==> [seed] FAIL phase=mint reason=\"stub-account-dirs present (no account.json): ${stub_dirs[*]}\" — refusing to mint a fresh accountId; remove or repair the stub before re-running install" >&2
+    if [ "${#orphans[@]}" -gt 0 ]; then
+      echo "==> [seed] FAIL phase=mint reason=\"stub-account-dirs present (no account.json): ${orphans[*]}\" — refusing to mint a fresh accountId; remove or repair the stub before re-running install" >&2
       return 1
     fi
     ACCOUNT_ID="$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())')"
     ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
+    echo "==> [seed] op=registry-snapshot houses=0 clients=0"
     return 0
   fi
 
-  # Case 1: single candidate — accept (preserves legacy + fresh-install-pre-users.json).
-  # Log identity-match on exact match; WARN on mismatch (mirrors TS resolveAccount line 653 —
-  # accept-with-flag rather than abort because the users.json regeneration on PIN
-  # change would otherwise brick legitimate installs).
-  if [ "$n" -eq 1 ]; then
-    ACCOUNT_ID="${candidates[0]}"
-    ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
-    if [ -n "$target_user_id" ]; then
-      local rc=0
-      _account_dir_matches "$ACCOUNT_DIR" "$target_user_id" || rc=$?
-      case "$rc" in
-        0) echo "==> [seed] identity-match: kept=${ACCOUNT_ID:0:8} via userId=${target_user_id:0:8}" ;;
-        1) echo "==> [seed] WARN: single account does not match users.json userId=${target_user_id:0:8} — accepting but flagging" >&2 ;;
-        *) echo "==> [seed] identity-match FAILED: sole candidate $ACCOUNT_ID has unreadable or unparseable account.json — aborting" >&2
-           return 1 ;;
-      esac
-    fi
-    return 0
-  fi
-
-  # Case 2+: multi-candidate — identity-match-or-abort.
-  # First classify everything, THEN decide and act.
-  if [ -z "$target_user_id" ]; then
-    echo "==> [seed] identity-match FAILED: users.json missing or unreadable, $n candidates — aborting" >&2
-    for uuid in "${candidates[@]}"; do echo "    candidate: $uuid" >&2; done
-    return 1
-  fi
-
-  local matches=()
-  local orphans=()
-  local rc
+  # Classify candidates by role.
+  local houses=() clients=() uuid role
   for uuid in "${candidates[@]}"; do
-    rc=0
-    _account_dir_matches "$ACCOUNTS_DIR/$uuid" "$target_user_id" || rc=$?
-    case "$rc" in
-      0) matches+=("$uuid") ;;
-      1) orphans+=("$uuid") ;;
-      *) echo "==> [seed] identity-match FAILED: candidate $uuid has unreadable or unparseable account.json — aborting" >&2
-         for u in "${candidates[@]}"; do echo "    candidate: $u" >&2; done
-         return 1 ;;
+    role="$(_account_dir_role "$ACCOUNTS_DIR/$uuid")"
+    case "$role" in
+      house) houses+=("$uuid") ;;
+      *)     clients+=("$uuid") ;;   # client OR unlabelled (legacy)
     esac
   done
 
-  if [ "${#matches[@]}" -eq 0 ]; then
-    echo "==> [seed] identity-match FAILED: $n candidates, none match users.json userId=${target_user_id:0:8} — aborting" >&2
-    for uuid in "${candidates[@]}"; do echo "    candidate: $uuid" >&2; done
-    return 1
-  fi
+  # Pre-action registry snapshot — the count the post-seed census must match.
+  echo "==> [seed] op=registry-snapshot houses=${#houses[@]} clients=${#clients[@]}"
 
-  if [ "${#matches[@]}" -gt 1 ]; then
-    echo "==> [seed] identity-match FAILED: $n candidates, ${#matches[@]} match userId=${target_user_id:0:8} (ambiguous) — aborting" >&2
-    for uuid in "${candidates[@]}"; do echo "    candidate: $uuid" >&2; done
-    return 1
+  # Report orphans (dirs with no account.json). Log-only — never moved this sprint.
+  # Guard the empty-array expansion: under `set -u` (setup-account.sh uses
+  # `set -euo pipefail`), bash 3.2 treats "${orphans[@]}" on an empty array as an
+  # unbound variable and aborts.
+  local ts; ts=$(date -u +%Y%m%dT%H%M%SZ 2>/dev/null || echo unknown)
+  if [ "${#orphans[@]}" -gt 0 ]; then
+    for uuid in "${orphans[@]}"; do
+      echo "==> [seed] op=sweep uuid=${uuid:0:8} registered=false action=skipped-guarded ts=$ts"
+    done
   fi
 
-  ACCOUNT_ID="${matches[0]}"
-  ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
-  echo "==> [seed] identity-match: kept=${ACCOUNT_ID:0:8} via userId=${target_user_id:0:8}"
+  # Resolve the house.
+  if [ "${#houses[@]}" -eq 1 ]; then
+    ACCOUNT_ID="${houses[0]}"
+    ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
+    echo "==> [seed] house-resolved: ${ACCOUNT_ID:0:8}"
+    return 0
+  fi
 
-  # Sweep orphans. mv is the only destructive op; abort loud on failure before any further state change.
-  local trash_dir="$ACCOUNTS_DIR/.trash"
-  mkdir -p "$trash_dir"
-  local ts; ts=$(date -u +%Y%m%dT%H%M%SZ)
-  local moved=0 uuid dest
-  for uuid in "${orphans[@]}"; do
-    dest="$trash_dir/${uuid}-${ts}"
-    if ! mv "$ACCOUNTS_DIR/$uuid" "$dest"; then
-      echo "==> [seed] ERROR: failed to move $uuid → $dest — aborting" >&2
-      return 1
-    fi
-    echo "==> [seed] swept orphan: ${uuid:0:8} → .trash/${uuid:0:8}-${ts}"
-    moved=$((moved + 1))
-  done
-  if [ "$moved" -gt 0 ]; then
-    echo "==> [seed] orphan sweep: moved $moved → $ACCOUNTS_DIR/.trash/"
+  # Pre-migration tolerance: zero labelled house but exactly one account → it is
+  # the house (setup-account.sh stamps role:"house" on it).
+  if [ "${#houses[@]}" -eq 0 ] && [ "$n" -eq 1 ]; then
+    ACCOUNT_ID="${candidates[0]}"
+    ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
+    echo "==> [seed] house-resolved: ${ACCOUNT_ID:0:8} (sole account, pre-migration)"
+    return 0
   fi
 
-  return 0
+  # Genuine drift — loud-fail.
+  echo "==> [seed] FAIL phase=resolve-house reason=\"houses=${#houses[@]} total=$n — expected exactly one role:house (or a single unlabelled account)\" — aborting" >&2
+  for uuid in "${candidates[@]}"; do echo "    candidate: $uuid role=$(_account_dir_role "$ACCOUNTS_DIR/$uuid")" >&2; done
+  return 1
 }