@rubytech/create-maxy-code 0.1.411 → 0.1.414

package/payload/platform/plugins/filesystem/lib/mcp-spawn-tee/index.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * MCP spawn-tee — in-process stderr capture + lifecycle observability.
+ *
+ * Claude Code spawns each MCP server itself; the platform never holds a
+ * ChildProcess handle. This shim sits between Claude Code and the real MCP
+ * server: Claude Code runs `node <this> <real-entry>`, and the shim runs the
+ * real entry IN ITS OWN PROCESS via dynamic import() — one node runtime, not
+ * two. Before importing, it replaces process.stderr.write with a tee so every
+ * stderr byte the server writes is mirrored to the log sinks; stdin and stdout
+ * (the JSON-RPC channel) are never touched.
+ *
+ *   Claude Code CLI → shim (this file) = node running <real-entry> in-process
+ *        stdin/stdout : untouched (JSON-RPC channel)
+ *        stderr       : process.stderr.write teed → per-date + per-session + passthrough
+ *
+ * Destinations (Task 706) — unchanged:
+ *   - `${LOG_DIR}/mcp-<name>-stderr-<date>.log`  — per-date raw (back-compat;
+ *     the in-process mcp-stderr-tee and the [mcp-init-error] probe read it).
+ *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — per-session raw + lifecycle
+ *     lines. Authoritative sink. Absent when SESSION_ID is unset (enumeration
+ *     spawn) — then the per-date file is the fallback.
+ *   - `server.log` via the loopback log-ingest route — best-effort mirror of
+ *     the [mcp-helper] lifecycle lines.
+ *
+ * Lifecycle lines, correlation key `session=<id8> server=<name>` — unchanged:
+ *   [mcp-helper] op=spawn ... pid= entry=
+ *   [mcp-helper] op=boot  ... head=<first stderr bytes>
+ *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=
+ *
+ * Process model (Task 989): the shim IS the server's process. op=exit fires
+ * from process.on("exit"), so it covers a normal exit, a non-zero exit, an
+ * uncaught throw (code 1), and a catchable-signal exit (SIGTERM/SIGINT/SIGHUP,
+ * whose handlers record the signal name). An external SIGKILL is uncatchable
+ * and leaves no op=exit line — the per-session stderr tail already on disk and
+ * Claude Code's own transport-drop are the evidence for that death mode.
+ *
+ * The shim never writes to fd 1 (stdout) — that is the JSON-RPC channel.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
+const SERVER_NAME = process.env.MCP_SPAWN_TEE_NAME ?? "unknown";
+const LOG_DIR = process.env.LOG_DIR;
+const SESSION_ID = process.env.SESSION_ID;
+const PLATFORM_PORT = process.env.PLATFORM_PORT;
+const ENTRY = process.argv[2];
+const SESSION_ID8 = SESSION_ID ? SESSION_ID.slice(0, 8) : "—";
+const spawnStamp = Date.now();
+// Per-session raw + lifecycle log (Task 706). Empty SESSION_ID (enumeration
+// spawn) → undefined, and the per-date file is the fallback.
+const perSessionPath = LOG_DIR && SESSION_ID
+    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-${SESSION_ID}.log`)
+    : undefined;
+const perDatePath = LOG_DIR
+    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-stderr-${new Date(spawnStamp).toISOString().slice(0, 10)}.log`)
+    : undefined;
+// Rolling tail of entry stderr for op=exit. Capped so a chatty server cannot
+// grow the buffer without bound.
+const TAIL_CAP = 2048;
+let stderrTail = "";
+let bootEmitted = false;
+let exitEmitted = false;
+let exitSignal;
+// The real stderr writer, captured before the tee replaces it. Lifecycle lines
+// and stderr passthrough both go through this so they are never re-teed into
+// the per-date sink nor recursed back into the patched writer.
+const rawStderrWrite = process.stderr.write.bind(process.stderr);
+// LOG_DIR is created once, lazily, on the first successful append — not per
+// chunk. teeWrite runs on the server's own stderr hot path now, so a per-call
+// mkdirSync would be two syscalls per log line for nothing.
+let logDirReady = false;
+function appendSafe(path, data) {
+    if (!path || !LOG_DIR)
+        return;
+    try {
+        if (!logDirReady) {
+            (0, node_fs_1.mkdirSync)(LOG_DIR, { recursive: true });
+            logDirReady = true;
+        }
+        (0, node_fs_1.appendFileSync)(path, data);
+    }
+    catch {
+        /* unwritable destination — never mask primary output */
+    }
+}
+// Best-effort mirror of a lifecycle line to server.log via the loopback
+// log-ingest route. Fire-and-forget: the per-session file is authoritative, so
+// a dropped POST loses nothing. On the "exit" event the loop is stopping, so
+// the op=exit mirror may not flush — the per-session line, written sync, holds.
+function postToServerLog(suffix, level) {
+    if (!PLATFORM_PORT)
+        return;
+    try {
+        const ctrl = new AbortController();
+        const t = setTimeout(() => ctrl.abort(), 500);
+        t.unref?.(); // never let the abort timer keep the shim's event loop alive
+        void fetch(`http://127.0.0.1:${PLATFORM_PORT}/api/admin/log-ingest`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ tag: "mcp-helper", level, line: suffix }),
+            signal: ctrl.signal,
+        }).then(() => clearTimeout(t)).catch(() => clearTimeout(t));
+    }
+    catch {
+        /* fetch threw synchronously — best-effort only */
+    }
+}
+// Emit one [mcp-helper] lifecycle line: authoritative per-session file (sync,
+// survives process.exit), the shim's own stderr via the RAW writer (journald /
+// Claude Code visibility, never re-teed), and a best-effort server.log mirror.
+// `suffix` is the line body after the tag and carries no newline (the
+// log-ingest route rejects newlines).
+function emitLifecycle(suffix, level) {
+    const line = `[mcp-helper] ${suffix}\n`;
+    appendSafe(perSessionPath, line);
+    try {
+        rawStderrWrite(line);
+    }
+    catch { /* stderr closed */ }
+    postToServerLog(suffix, level);
+}
+if (!ENTRY) {
+    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason="no entry given (argv[2] missing)"`, "error");
+    process.exit(2);
+}
+// Replace process.stderr.write with a tee: mirror every server stderr byte to
+// the per-date and per-session sinks, keep a rolling tail for op=exit, emit
+// op=boot on the first bytes, then pass the write through to the real stderr.
+const teeWrite = ((...args) => {
+    const chunk = args[0];
+    appendSafe(perDatePath, chunk); // per-date raw (back-compat)
+    appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
+    const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+    stderrTail = (stderrTail + text).slice(-TAIL_CAP);
+    if (!bootEmitted) {
+        bootEmitted = true;
+        const head = text.split("\n")[0].slice(0, 200);
+        emitLifecycle(`op=boot session=${SESSION_ID8} server=${SERVER_NAME} head=${JSON.stringify(head)}`, "info");
+    }
+    return rawStderrWrite(...args); // passthrough
+});
+process.stderr.write = teeWrite;
+// Catchable-signal handling. The shim drives the exit ONLY when it is the sole
+// listener for the signal — i.e. the imported entry installed no handler of its
+// own. In that case it records the signal (so op=exit carries signal=<sig>) and
+// exits with 128+signum, mirroring the prior wrapper's exit-status convention.
+//
+// When the entry DID install a handler, the shim defers entirely and records
+// nothing: the entry's handler decides the exit code, and op=exit reflects that
+// exit verbatim. This matches the prior two-process model, where a child that
+// caught the signal and exited cleanly was observed as code=0 signal=— (a clean
+// self-exit), not as a signal death. Setting exitSignal here unconditionally
+// would mislabel every graceful signal-driven shutdown as a signal kill.
+function onSignal(sig, code) {
+    return () => {
+        if (process.listenerCount(sig) === 1) {
+            exitSignal = sig;
+            process.exit(code);
+        }
+    };
+}
+process.on("SIGTERM", onSignal("SIGTERM", 143));
+process.on("SIGINT", onSignal("SIGINT", 130));
+process.on("SIGHUP", onSignal("SIGHUP", 129));
+// op=exit, emitted once from the process "exit" event. Sync-only — the loop is
+// stopping. When a catchable signal caused the exit, report code=— signal=<sig>
+// to match the prior wrapper's format; otherwise code=<exit code> signal=—.
+process.on("exit", (code) => {
+    if (exitEmitted)
+        return;
+    exitEmitted = true;
+    const lifetimeMs = Date.now() - spawnStamp;
+    const tail = stderrTail.slice(-200);
+    const codeField = exitSignal ? "—" : String(code);
+    const level = exitSignal || code !== 0 ? "error" : "info";
+    emitLifecycle(`op=exit session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} ` +
+        `code=${codeField} signal=${exitSignal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`, level);
+});
+emitLifecycle(`op=spawn session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} entry=${ENTRY}`, "info");
+// Run the real MCP server in THIS process. Dynamic import() (not top-level
+// await — this file compiles to CommonJS) loads the ESM entry; a load-time
+// failure mirrors the old child spawn-error path (op=error, exit 127). The
+// op=exit handler is suppressed on this path so op=error stays the sole record.
+import((0, node_url_1.pathToFileURL)(ENTRY).href).catch((err) => {
+    const msg = err instanceof Error ? err.message : String(err);
+    exitEmitted = true;
+    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`import error: ${msg}`)}`, "error");
+    process.exit(127);
+});
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/filesystem/lib/mcp-spawn-tee/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/payload/platform/plugins/filesystem/mcp/dist/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/plugins/filesystem/mcp/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/filesystem/mcp/dist/index.js

@@ -0,0 +1,91 @@
+import { initStderrTee } from "../../../../lib/mcp-stderr-tee/dist/index.js";
+initStderrTee("filesystem");
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { eagerTool } from "../../../../lib/mcp-eager/dist/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { resolve } from "node:path";
+import { readPluginHouseScope } from "./lib/scope.js";
+import { fileRead } from "./tools/file-read.js";
+import { fileWrite } from "./tools/file-write.js";
+import { fileEdit } from "./tools/file-edit.js";
+import { fileList } from "./tools/file-list.js";
+import { fileGlob } from "./tools/file-glob.js";
+import { fileGrep } from "./tools/file-grep.js";
+// Cast to `any` to avoid TS2589 — the same accumulation limit the other
+// plugins hit when registering several typed tool signatures.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const server = new McpServer({ name: "maxy-filesystem", version: "0.1.0" });
+// Plugin-system boot tolerance: module-init must never throw; plugin-system
+// spawn enumerates tools/list before ACCOUNT_ID is set. Per-call refusal
+// preserves account isolation.
+const ownAccountId = process.env.ACCOUNT_ID ?? null;
+// Fail-closed read of the boundary — see readPluginHouseScope. Never trusts a
+// literal ${HOUSE_ADMIN_SCOPE} placeholder or an empty value as a real scope.
+const houseScope = readPluginHouseScope(process.env);
+const platformRoot = process.env.PLATFORM_ROOT ?? "";
+process.stderr.write(`[filesystem] boot accountId=${ownAccountId ?? "null"} houseScope=${houseScope ? "set" : "null"}\n`);
+function refuseNoAccount(toolName) {
+    process.stderr.write(`[filesystem] tool=${toolName} refuse reason=no-account-context\n`);
+    return {
+        content: [
+            {
+                type: "text",
+                text: `${toolName} cannot execute: this MCP instance was launched without ACCOUNT_ID/PLATFORM_ROOT (plugin-system metadata-only mode).`,
+            },
+        ],
+        isError: true,
+    };
+}
+/** Build the per-call context once from the spawn env. Null when the metadata-
+ *  only boot left ACCOUNT_ID/PLATFORM_ROOT unset. `accountsDir` mirrors
+ *  account.ts's `ACCOUNTS_DIR = resolve(PLATFORM_ROOT, "..", "data/accounts")`. */
+function ctx() {
+    if (!ownAccountId || !platformRoot)
+        return null;
+    return { ownAccountId, houseScope, accountsDir: resolve(platformRoot, "..", "data/accounts") };
+}
+const targetArg = z
+    .string()
+    .optional()
+    .describe("House admin only: a sub-account ID to operate on. Omit to operate on your own account. A non-house session that passes this is denied (cross-account-denied).");
+eagerTool(server, "file-read", "Read a UTF-8 file under the account directory. Pass a path relative to the account root; pass targetAccountId (house admin only) to read a sub-account's file.", { path: z.string().describe("Path relative to the account directory"), targetAccountId: targetArg }, async (a) => {
+    const c = ctx();
+    return c ? fileRead(a, c) : refuseNoAccount("file-read");
+});
+eagerTool(server, "file-write", "Write (create or overwrite) a UTF-8 file under the account directory, creating parent directories as needed.", {
+    path: z.string().describe("Path relative to the account directory"),
+    content: z.string().describe("Full file contents to write"),
+    targetAccountId: targetArg,
+}, async (a) => {
+    const c = ctx();
+    return c ? fileWrite(a, c) : refuseNoAccount("file-write");
+});
+eagerTool(server, "file-edit", "Replace a single unique occurrence of oldString with newString in a file under the account directory. Fails if oldString is absent or matches more than once.", {
+    path: z.string().describe("Path relative to the account directory"),
+    oldString: z.string().describe("Exact text to replace (must occur exactly once)"),
+    newString: z.string().describe("Replacement text"),
+    targetAccountId: targetArg,
+}, async (a) => {
+    const c = ctx();
+    return c ? fileEdit(a, c) : refuseNoAccount("file-edit");
+});
+eagerTool(server, "file-list", "List the entries of a directory under the account directory (name + type). Omit path to list the account root.", { path: z.string().optional().describe("Directory relative to the account root"), targetAccountId: targetArg }, async (a) => {
+    const c = ctx();
+    return c ? fileList(a, c) : refuseNoAccount("file-list");
+});
+eagerTool(server, "file-glob", "List files under the account directory matching a glob (**, *, ?), returned as paths relative to the account root.", { pattern: z.string().describe("Glob pattern, e.g. **/*.md"), targetAccountId: targetArg }, async (a) => {
+    const c = ctx();
+    return c ? fileGlob(a, c) : refuseNoAccount("file-glob");
+});
+eagerTool(server, "file-grep", "Search file contents under the account directory for a JavaScript regular expression, returning file:line:preview matches. Omit path to search the whole account.", {
+    pattern: z.string().describe("JavaScript regular expression"),
+    path: z.string().optional().describe("Subdirectory (relative) to limit the search"),
+    targetAccountId: targetArg,
+}, async (a) => {
+    const c = ctx();
+    return c ? fileGrep(a, c) : refuseNoAccount("file-grep");
+});
+const transport = new StdioServerTransport();
+await server.connect(transport);
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/filesystem/mcp/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,aAAa,CAAC,YAAY,CAAC,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,wEAAwE;AACxE,8DAA8D;AAC9D,8DAA8D;AAC9D,MAAM,MAAM,GAAQ,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAEjF,4EAA4E;AAC5E,yEAAyE;AACzE,+BAA+B;AAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;AACpD,8EAA8E;AAC9E,8EAA8E;AAC9E,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACrD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;AACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,YAAY,IAAI,MAAM,eAAe,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CACpG,CAAC;AAEF,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,QAAQ,qCAAqC,CAAC,CAAC;IACzF,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,GAAG,QAAQ,sHAAsH;aACxI;SACF;QACD,OAAO,EAAE,IAAa;KACvB,CAAC;AACJ,CAAC;AAED;;mFAEmF;AACnF,SAAS,GAAG;IACV,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,QAAQ,CACP,+JAA+J,CAChK,CAAC;AAEJ,SAAS,CACP,MAAM,EACN,WAAW,EACX,gKAAgK,EAChK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,EACnG,KAAK,EAAE,CAA6C,EAAE,EAAE;IACtD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC,CACF,CAAC;AAEF,SAAS,CACP,MAAM,EACN,YAAY,EACZ,8GAA8G,EAC9G;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACnE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAC3D,eAAe,EAAE,SAAS;CAC3B,EACD,KAAK,EAAE,CAA8D,EAAE,EAAE;IACvE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAC7D,CAAC,CACF,CAAC;AAEF,SAAS,CACP,MAAM,EACN,WAAW,EACX,+JAA+J,EAC/J;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IACnE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IACjF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAClD,eAAe,EAAE,SAAS;CAC3B,EACD,KAAK,EAAE,CAAmF,EAAE,EAAE;IAC5F,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC,CACF,CAAC;AAEF,SAAS,CACP,MAAM,EACN,WAAW,EACX,gHAAgH,EAChH,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,EAC9G,KAAK,EAAE,CAA8C,EAAE,EAAE;IACvD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC,CACF,CAAC;AAEF,SAAS,CACP,MAAM,EACN,WAAW,EACX,oHAAoH,EACpH,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,EAC1F,KAAK,EAAE,CAAgD,EAAE,EAAE;IACzD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC,CACF,CAAC;AAEF,SAAS,CACP,MAAM,EACN,WAAW,EACX,mKAAmK,EACnK;IACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IAC7D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IACnF,eAAe,EAAE,SAAS;CAC3B,EACD,KAAK,EAAE,CAA+D,EAAE,EAAE;IACxE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC,CACF,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAO,MAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/payload/platform/plugins/filesystem/mcp/dist/lib/__tests__/scope.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scope.test.d.ts.map

package/payload/platform/plugins/filesystem/mcp/dist/lib/__tests__/scope.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.test.d.ts","sourceRoot":"","sources":["../../../src/lib/__tests__/scope.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/filesystem/mcp/dist/lib/__tests__/scope.test.js

@@ -0,0 +1,89 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, mkdirSync, writeFileSync, symlinkSync, rmSync, realpathSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { resolveRoot, containedPath, readPluginHouseScope } from "../scope.js";
+// enumerateValidAccountIds only counts UUID-named dirs with a parseable
+// account.json, so the fixtures use real UUIDs.
+const HOUSE = "11111111-1111-4111-8111-111111111111";
+const CLIENT = "22222222-2222-4222-8222-222222222222";
+const GHOST = "33333333-3333-4333-8333-333333333333";
+let accountsDir;
+let outsideDir;
+beforeEach(() => {
+    accountsDir = mkdtempSync(join(tmpdir(), "xacct-accounts-"));
+    outsideDir = mkdtempSync(join(tmpdir(), "xacct-outside-"));
+    for (const id of [HOUSE, CLIENT]) {
+        mkdirSync(join(accountsDir, id), { recursive: true });
+        writeFileSync(join(accountsDir, id, "account.json"), JSON.stringify({ accountId: id }));
+    }
+    writeFileSync(join(outsideDir, "secret.txt"), "secret");
+});
+afterEach(() => {
+    rmSync(accountsDir, { recursive: true, force: true });
+    rmSync(outsideDir, { recursive: true, force: true });
+});
+const houseCtx = () => ({ ownAccountId: HOUSE, houseScope: HOUSE, accountsDir });
+const clientCtx = () => ({ ownAccountId: CLIENT, houseScope: null, accountsDir });
+describe("resolveRoot — fail-closed gate", () => {
+    it("no target → own account root", () => {
+        const r = resolveRoot(houseCtx(), undefined, "file-read");
+        expect(r).toEqual({ root: resolve(accountsDir, HOUSE), resolved: HOUSE });
+    });
+    it("house scope + valid target → target root", () => {
+        const r = resolveRoot(houseCtx(), CLIENT, "file-read");
+        expect(r).toEqual({ root: resolve(accountsDir, CLIENT), resolved: CLIENT });
+    });
+    it("non-house session + target → cross-account-denied", () => {
+        const r = resolveRoot(clientCtx(), HOUSE, "file-read");
+        expect(r).toEqual({ reject: "cross-account-denied" });
+    });
+    it("house scope + unknown target → cross-account-invalid-target", () => {
+        const r = resolveRoot(houseCtx(), GHOST, "file-read");
+        expect(r).toEqual({ reject: "cross-account-invalid-target" });
+    });
+    it("house scope + target == own → own root (self allowed)", () => {
+        const r = resolveRoot(houseCtx(), HOUSE, "file-read");
+        expect(r).toEqual({ root: resolve(accountsDir, HOUSE), resolved: HOUSE });
+    });
+});
+describe("readPluginHouseScope — fail-closed against loader substitution", () => {
+    it("returns the scope when a real value is set", () => {
+        expect(readPluginHouseScope({ HOUSE_ADMIN_SCOPE: HOUSE })).toBe(HOUSE);
+    });
+    it("returns null when absent (non-house session)", () => {
+        expect(readPluginHouseScope({})).toBeNull();
+    });
+    it("returns null when empty", () => {
+        expect(readPluginHouseScope({ HOUSE_ADMIN_SCOPE: "" })).toBeNull();
+    });
+    it("returns null for an unsubstituted ${...} placeholder (the escalation guard)", () => {
+        expect(readPluginHouseScope({ HOUSE_ADMIN_SCOPE: "${HOUSE_ADMIN_SCOPE}" })).toBeNull();
+    });
+});
+describe("containedPath — traversal guard", () => {
+    it("allows a legitimate file directly under root", () => {
+        const root = resolve(accountsDir, HOUSE);
+        const realRoot = realpathSync(root); // macOS resolves /var → /private/var
+        expect(containedPath(root, "SOUL.md")).toBe(join(realRoot, "SOUL.md"));
+    });
+    it("allows a nested not-yet-existing (create) path under root", () => {
+        const root = resolve(accountsDir, HOUSE);
+        const realRoot = realpathSync(root);
+        expect(containedPath(root, "agents/x/new.txt")).toBe(join(realRoot, "agents/x/new.txt"));
+    });
+    it("rejects ../ escape to a sibling account", () => {
+        const root = resolve(accountsDir, HOUSE);
+        expect(() => containedPath(root, `../${CLIENT}/account.json`)).toThrow("path-escape");
+    });
+    it("rejects an absolute path outside the account dir", () => {
+        const root = resolve(accountsDir, HOUSE);
+        expect(() => containedPath(root, "/etc/passwd")).toThrow("path-escape");
+    });
+    it("rejects a symlink that escapes the account dir", () => {
+        const root = resolve(accountsDir, HOUSE);
+        symlinkSync(outsideDir, join(root, "escape"));
+        expect(() => containedPath(root, "escape/secret.txt")).toThrow("path-escape");
+    });
+});
+//# sourceMappingURL=scope.test.js.map

package/payload/platform/plugins/filesystem/mcp/dist/lib/__tests__/scope.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/scope.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,oBAAoB,EAAY,MAAM,aAAa,CAAC;AAEzF,wEAAwE;AACxE,gDAAgD;AAChD,MAAM,KAAK,GAAG,sCAAsC,CAAC;AACrD,MAAM,MAAM,GAAG,sCAAsC,CAAC;AACtD,MAAM,KAAK,GAAG,sCAAsC,CAAC;AAErD,IAAI,WAAmB,CAAC;AACxB,IAAI,UAAkB,CAAC;AAEvB,UAAU,CAAC,GAAG,EAAE;IACd,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC7D,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3D,KAAK,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,GAAQ,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACtF,MAAM,SAAS,GAAG,GAAQ,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAEvF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC1D,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC9E,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,oBAAoB,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,oBAAoB,CAAC,EAAuB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,oBAAoB,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAuB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CACJ,oBAAoB,CAAC,EAAE,iBAAiB,EAAE,sBAAsB,EAAuB,CAAC,CACzF,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,qCAAqC;QAC1E,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,MAAM,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACzC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/filesystem/mcp/dist/lib/result.d.ts

@@ -0,0 +1,12 @@
+export interface ToolResult {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    /** Present and true only on error results, so `.isError` is well-typed on the
+     *  ok|err union that handlers return. */
+    isError?: true;
+}
+export declare const ok: (text: string) => ToolResult;
+export declare const err: (text: string) => ToolResult;
+//# sourceMappingURL=result.d.ts.map

package/payload/platform/plugins/filesystem/mcp/dist/lib/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/lib/result.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1C;6CACyC;IACzC,OAAO,CAAC,EAAE,IAAI,CAAC;CAChB;AAED,eAAO,MAAM,EAAE,GAAI,MAAM,MAAM,KAAG,UAAqD,CAAC;AACxF,eAAO,MAAM,GAAG,GAAI,MAAM,MAAM,KAAG,UAGjC,CAAC"}

package/payload/platform/plugins/filesystem/mcp/dist/lib/result.js

@@ -0,0 +1,6 @@
+export const ok = (text) => ({ content: [{ type: "text", text }] });
+export const err = (text) => ({
+    content: [{ type: "text", text }],
+    isError: true,
+});
+//# sourceMappingURL=result.js.map

package/payload/platform/plugins/filesystem/mcp/dist/lib/result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../../src/lib/result.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC;IAChD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjC,OAAO,EAAE,IAAI;CACd,CAAC,CAAC"}

package/payload/platform/plugins/filesystem/mcp/dist/lib/scope.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Read HOUSE_ADMIN_SCOPE for the plugin, fail-closed. HOUSE_ADMIN_SCOPE is the
+ * whole boundary: it is present in the spawn env ONLY for a house role:admin
+ * session (Task 1440). This plugin's PLUGIN.md also declares the key with a
+ * `${HOUSE_ADMIN_SCOPE}` placeholder so the value flows on loaders that pass
+ * only declared env keys — but an UNSET placeholder is substituted
+ * differently across spawn loaders: some yield empty, some leave the literal
+ * `${HOUSE_ADMIN_SCOPE}` string (which is truthy). Treating a literal
+ * placeholder or an empty value as "no scope" makes a non-house session
+ * deterministically fail-closed regardless of loader behaviour — the read
+ * never trusts a value it did not receive as a real scope. (This is why the
+ * plugin does not call the shared `readHouseAdminScope`, whose truthy test
+ * would accept the literal placeholder.)
+ */
+export declare function readPluginHouseScope(env: NodeJS.ProcessEnv): string | null;
+export interface Ctx {
+    /** The session's own account (spawn env ACCOUNT_ID). */
+    ownAccountId: string;
+    /** HOUSE_ADMIN_SCOPE from the spawn env; null for any non-house session. */
+    houseScope: string | null;
+    /** `<install>/data/accounts` — the root that all account dirs live under. */
+    accountsDir: string;
+}
+export type ResolveRootResult = {
+    root: string;
+    resolved: string;
+} | {
+    reject: "cross-account-denied" | "cross-account-invalid-target";
+};
+/**
+ * Resolve the account directory a tool call acts on, gated fail-closed. Emits
+ * the standing [xacct] decision line for every call and op=fs-root on allow.
+ * `root` is `<accountsDir>/<resolved>` — the strict filesystem root the caller
+ * must contain every path within.
+ */
+export declare function resolveRoot(ctx: Ctx, targetAccountId: string | undefined, tool: string): ResolveRootResult;
+/**
+ * Resolve `relPath` against the account `root` and prove it stays inside.
+ * Lexical containment rejects `../` and absolute-path escapes; a realpath check
+ * on the deepest EXISTING ancestor rejects symlink escapes and still permits a
+ * not-yet-existing (create) target. Throws Error("path-escape") after emitting
+ * op=path-escape-reject; the caller surfaces it as an isError tool result.
+ */
+export declare function containedPath(root: string, relPath: string): string;
+//# sourceMappingURL=scope.d.ts.map

package/payload/platform/plugins/filesystem/mcp/dist/lib/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/lib/scope.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,IAAI,CAK1E;AAED,MAAM,WAAW,GAAG;IAClB,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,MAAM,EAAE,sBAAsB,GAAG,8BAA8B,CAAA;CAAE,CAAC;AAExE;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,GAAG,EACR,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,IAAI,EAAE,MAAM,GACX,iBAAiB,CAqBnB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAenE"}

package/payload/platform/plugins/filesystem/mcp/dist/lib/scope.js

@@ -0,0 +1,86 @@
+// scope.ts — the security core of the `filesystem` plugin.
+//
+// Every file tool routes through here. `resolveRoot` runs the ONE landed
+// fail-closed resolver (account-scope) with a valid-account check over
+// `enumerateValidAccountIds`, emitting the [xacct] per-call decision line and
+// the op=fs-root line BEFORE any fs op. `containedPath` roots every path under
+// the resolved account dir and rejects traversal (../, absolute escape) and
+// symlink escapes, emitting op=path-escape-reject.
+//
+// The fail-closed backbone is structural, not conventional: HOUSE_ADMIN_SCOPE
+// is stamped into the spawn env ONLY for a non-specialist role:admin session on
+// the house account (Task 1440), so a sub-account, specialist, or public
+// session's plugin process carries houseScope=null and any targetAccountId it
+// passes resolves to cross-account-denied.
+import { resolve, dirname, sep } from "node:path";
+import { realpathSync, existsSync } from "node:fs";
+import { resolveEffectiveAccountCore } from "../../../../../lib/account-scope/dist/index.js";
+import { enumerateValidAccountIds } from "../../../../../lib/account-enumeration/dist/index.js";
+const short = (id) => id.slice(0, 8);
+/**
+ * Read HOUSE_ADMIN_SCOPE for the plugin, fail-closed. HOUSE_ADMIN_SCOPE is the
+ * whole boundary: it is present in the spawn env ONLY for a house role:admin
+ * session (Task 1440). This plugin's PLUGIN.md also declares the key with a
+ * `${HOUSE_ADMIN_SCOPE}` placeholder so the value flows on loaders that pass
+ * only declared env keys — but an UNSET placeholder is substituted
+ * differently across spawn loaders: some yield empty, some leave the literal
+ * `${HOUSE_ADMIN_SCOPE}` string (which is truthy). Treating a literal
+ * placeholder or an empty value as "no scope" makes a non-house session
+ * deterministically fail-closed regardless of loader behaviour — the read
+ * never trusts a value it did not receive as a real scope. (This is why the
+ * plugin does not call the shared `readHouseAdminScope`, whose truthy test
+ * would accept the literal placeholder.)
+ */
+export function readPluginHouseScope(env) {
+    const raw = env.HOUSE_ADMIN_SCOPE;
+    if (!raw)
+        return null;
+    if (raw.startsWith("${"))
+        return null;
+    return raw;
+}
+/**
+ * Resolve the account directory a tool call acts on, gated fail-closed. Emits
+ * the standing [xacct] decision line for every call and op=fs-root on allow.
+ * `root` is `<accountsDir>/<resolved>` — the strict filesystem root the caller
+ * must contain every path within.
+ */
+export function resolveRoot(ctx, targetAccountId, tool) {
+    const isValidAccountId = (id) => enumerateValidAccountIds(ctx.accountsDir).includes(id);
+    const eff = resolveEffectiveAccountCore({ ownAccountId: ctx.ownAccountId, houseScope: ctx.houseScope, targetAccountId }, isValidAccountId);
+    const targetField = targetAccountId ? short(targetAccountId) : "self";
+    const houseField = ctx.houseScope ? "true" : "false";
+    if ("reject" in eff) {
+        process.stderr.write(`[xacct] op=call tool=${tool} caller=${short(ctx.ownAccountId)} target=${targetField} houseScope=${houseField} decision=deny reason=${eff.reject}\n`);
+        return { reject: eff.reject };
+    }
+    process.stderr.write(`[xacct] op=call tool=${tool} caller=${short(ctx.ownAccountId)} target=${targetField} houseScope=${houseField} decision=allow reason=none\n`);
+    const root = resolve(ctx.accountsDir, eff.accountId);
+    process.stderr.write(`[xacct] op=fs-root root=data/accounts/${short(eff.accountId)}/\n`);
+    return { root, resolved: eff.accountId };
+}
+/**
+ * Resolve `relPath` against the account `root` and prove it stays inside.
+ * Lexical containment rejects `../` and absolute-path escapes; a realpath check
+ * on the deepest EXISTING ancestor rejects symlink escapes and still permits a
+ * not-yet-existing (create) target. Throws Error("path-escape") after emitting
+ * op=path-escape-reject; the caller surfaces it as an isError tool result.
+ */
+export function containedPath(root, relPath) {
+    const realRoot = realpathSync(root);
+    const abs = resolve(realRoot, relPath);
+    const escape = () => {
+        process.stderr.write(`[xacct] op=path-escape-reject path=${relPath} resolved=${short(realRoot.split(sep).pop() ?? "")}\n`);
+        throw new Error("path-escape");
+    };
+    if (abs !== realRoot && !abs.startsWith(realRoot + sep))
+        escape();
+    let ancestor = abs;
+    while (!existsSync(ancestor))
+        ancestor = dirname(ancestor);
+    const realAncestor = realpathSync(ancestor);
+    if (realAncestor !== realRoot && !realAncestor.startsWith(realRoot + sep))
+        escape();
+    return abs;
+}
+//# sourceMappingURL=scope.js.map

package/payload/platform/plugins/filesystem/mcp/dist/lib/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/lib/scope.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,mDAAmD;AACnD,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,8EAA8E;AAC9E,2CAA2C;AAC3C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAC7F,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAEhG,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,GAAQ,EACR,eAAmC,EACnC,IAAY;IAEZ,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAE,EAAE,CACtC,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,2BAA2B,CACrC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,EAC/E,gBAAgB,CACjB,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACrD,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,IAAI,WAAW,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,WAAW,eAAe,UAAU,yBAAyB,GAAG,CAAC,MAAM,IAAI,CACrJ,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,IAAI,WAAW,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,WAAW,eAAe,UAAU,+BAA+B,CAC7I,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAU,EAAE;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,OAAO,aAAa,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,CACrG,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;QAAE,MAAM,EAAE,CAAC;IAClE,IAAI,QAAQ,GAAG,GAAG,CAAC;IACnB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;QAAE,MAAM,EAAE,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/payload/platform/plugins/filesystem/mcp/dist/lib/walk.d.ts

@@ -0,0 +1,11 @@
+/**
+ * List regular files under `root`, returning paths RELATIVE to root with "/"
+ * separators. Symlinked entries are skipped (no escape). Stops at `cap` files.
+ */
+export declare function walkFiles(root: string, cap: number): string[];
+/**
+ * Translate a glob (`**`, `*`, `?`) to an anchored RegExp over "/"-joined
+ * relative paths. `*` and `?` do not cross "/"; `**` crosses any depth.
+ */
+export declare function globToRegExp(glob: string): RegExp;
+//# sourceMappingURL=walk.d.ts.map

package/payload/platform/plugins/filesystem/mcp/dist/lib/walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../../src/lib/walk.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAoB7D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAmBjD"}