@rubytech/create-maxy-code 0.1.411 → 0.1.414

package/payload/platform/plugins/memory/mcp/dist/index.js

@@ -41,6 +41,7 @@ import { profileRead } from "./tools/profile-read.js";
 import { memoryBrainCaptureRecent } from "./tools/memory-brain-capture-recent.js";
 import { profileUpdate } from "./tools/profile-update.js";
 import { profileDelete } from "./tools/profile-delete.js";
+import { resolveOwnerUserId } from "./lib/resolve-owner-userid.js";
 import { graphPruneDenylistAdd } from "./tools/graph-prune-denylist-add.js";
 import { graphPruneDenylistList } from "./tools/graph-prune-denylist-list.js";
 import { graphPruneDenylistRemove } from "./tools/graph-prune-denylist-remove.js";
@@ -59,6 +60,10 @@ import { getSession, closeDriver } from "./lib/neo4j.js";
 import { embed } from "./lib/embeddings.js";
 import { notTrashed } from "../../../../lib/graph-trash/dist/index.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
+import { resolve } from "node:path";
+import { enumerateValidAccountIds } from "../../../../lib/account-enumeration/dist/index.js";
+import { readHouseAdminScope } from "../../../../lib/account-scope/dist/index.js";
+import { makeResolveToolAccount } from "./index-testable.js";
 const server = new McpServer({
     name: "maxy-memory",
     version: "0.1.0",
@@ -74,17 +79,62 @@ const accountId = process.env.ACCOUNT_ID ?? null;
 // accountId`; `agentSlug` empty on a specialist spawn (provenance lost);
 // `agentScope` non-empty on the admin operator spawn (search wrongly scoped).
 process.stderr.write(`[memory] boot accountId=${accountId ?? "null"} sessionId=${process.env.SESSION_ID || "-"} agentSlug=${process.env.AGENT_SLUG || "-"} agentScope=${process.env.AGENT_SLUG_SCOPE || "-"}\n`);
-function refuseNoAccount(toolName) {
-    process.stderr.write(`[memory] tool=${toolName} refuse reason=no-account-context\n`);
-    return {
-        content: [
-            {
-                type: "text",
-                text: `${toolName} cannot execute: this MCP instance was launched without ACCOUNT_ID (plugin-system metadata-only mode). Per-account graph access requires ACCOUNT_ID at spawn.`,
+// The no-account refusal (formerly `refuseNoAccount`) is now handled inside
+// `resolveToolAccount` / `makeResolveToolAccount` (index-testable.ts), which
+// preserves the same message when the boot ACCOUNT_ID is null. Task 1455.
+// ---------------------------------------------------------------------------
+// Cross-account authority (Task 1455). A house-scoped admin session may set an
+// optional `targetAccountId` on any account-scoped tool to read/write a
+// sub-account's subgraph; omitting it is byte-identical to own-account.
+//
+// `houseScope` rides the spawn env (Task 1440, `HOUSE_ADMIN_SCOPE`). `accountsDir`
+// mirrors neo4j.ts's platform-root resolution (PLATFORM_ROOT env, else relative
+// to the compiled file): from dist/index.js, `../../../..` is `platform/`, and
+// accounts live at `<platform>/../data/accounts`. `enumerateValidAccountIds`
+// returns [] (never throws) on a missing dir, so a misresolved path fails CLOSED
+// — every target rejects invalid-target. The boot line makes that visible rather
+// than silent: a zero `validAccounts` on a provisioned install is the alarm.
+const houseScope = readHouseAdminScope();
+const accountsDir = resolve(process.env.PLATFORM_ROOT ?? resolve(import.meta.dirname, "../../../.."), "..", "data/accounts");
+process.stderr.write(`[xacct] boot houseScope=${houseScope ? "yes" : "no"} accountsDir=${accountsDir} validAccounts=${enumerateValidAccountIds(accountsDir).length}\n`);
+const resolveToolAccount = makeResolveToolAccount({
+    accountId,
+    houseScope,
+    isValid: (id) => enumerateValidAccountIds(accountsDir).includes(id),
+});
+// Single source for the operator-facing targetAccountId description — the LLM
+// reads this verbatim, so it must not drift across the 35 targetable tools.
+const XACCT_DESC = "House-scoped admin only: operate on the named sub-account subgraph instead of your own. Only a house-scoped session may set this; a non-house session that sets it is rejected.";
+// Boot account, captured before the tool handlers shadow `accountId` with the
+// resolved (possibly cross-account) id. A resolved id != this is a cross-account
+// call (the resolver only returns a target for a house-authorised session).
+const BOOT_ACCOUNT_ID = accountId;
+async function resolveProfileIdentity(toolName, crossAccount, resolvedAccountId, callerUserId) {
+    if (crossAccount) {
+        const owner = await resolveOwnerUserId(resolvedAccountId);
+        if (!owner) {
+            return {
+                reject: {
+                    content: [{
+                            type: "text",
+                            text: `${toolName} failed: target account ${resolvedAccountId.slice(0, 8)}… has no owner AdminUser to attribute the profile to — its graph root is unprovisioned (see Task 1359 seedAccountGraphRoot).`,
+                        }],
+                    isError: true,
+                },
+            };
+        }
+        process.stderr.write(`[xacct] op=identity tool=${toolName} target=${resolvedAccountId.slice(0, 8)} resolved-userId=${owner.slice(0, 8)}\n`);
+        return { userId: owner };
+    }
+    if (!callerUserId) {
+        return {
+            reject: {
+                content: [{ type: "text", text: `${toolName} requires an authenticated admin session with userId` }],
+                isError: true,
             },
-        ],
-        isError: true,
-    };
+        };
+    }
+    return { userId: callerUserId };
 }
 // Load the markdown schema sidecar once at startup. Every memory-write call
 // reads its required-property and synonym maps. If loading fails we throw —
@@ -242,9 +292,12 @@ eagerTool(server, "memory-search", "Search the knowledge graph using semantic ve
         .enum(["entity", "temporal", "event", "general", "none"])
         .optional()
         .describe("Hint that selects the per-class index mix (route-hint contract). Pass 'entity' for who/what-is-this lookups (vector-heavy, Person|Company|Concept filter), 'temporal' for when-did-this-happen (BM25-heavy over :Event with Timeline), 'event' for pure event listings, 'none' to skip graph lookup entirely (greetings/instructions). Omit or pass 'general' for the balanced default. Routing only takes effect when MAXY_GS_ROUTE is enabled; otherwise the value is recorded in the log line but does not change index selection."),
-}, async ({ query, labels, limit, expandHops, keywords, keywordMatch, agentSlug: toolAgentSlug, fields, retrievalClass }) => {
-    if (!accountId)
-        return refuseNoAccount("memory-search");
+    targetAccountId: z.string().optional().describe(XACCT_DESC),
+}, async ({ query, labels, limit, expandHops, keywords, keywordMatch, agentSlug: toolAgentSlug, fields, retrievalClass, targetAccountId }) => {
+    const scoped = resolveToolAccount("memory-search", targetAccountId);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     // AGENT_SLUG_SCOPE takes precedence over the tool param (security: public
     // agent server-level enforcement). Empty for the admin operator, so admin
     // falls through to the optional tool param (default: unscoped).
@@ -358,9 +411,12 @@ eagerTool(server, "memory-lookup-by-name", "Deterministic by-name entity lookup.
         .number()
         .optional()
         .describe("Maximum number of matching nodes to return (default 25)."),
-}, async ({ name, labels, limit }) => {
-    if (!accountId)
-        return refuseNoAccount("memory-lookup-by-name");
+    targetAccountId: z.string().optional().describe(XACCT_DESC),
+}, async ({ name, labels, limit, targetAccountId }) => {
+    const scoped = resolveToolAccount("memory-lookup-by-name", targetAccountId);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     const effectiveAgentSlug = envAgentScopeSlug;
     try {
         const hits = await memoryLookupByName({
@@ -425,9 +481,12 @@ lifelineTool(server, "conversation-archive-list-chunks", "Page through the :Sect
         .max(20)
         .optional()
         .describe("Chunks per page (1..20). Default 5."),
-}, async ({ archiveElementId, chunkOffset, chunkLimit }) => {
-    if (!accountId)
-        return refuseNoAccount("conversation-archive-list-chunks");
+    targetAccountId: z.string().optional().describe(XACCT_DESC),
+}, async ({ archiveElementId, chunkOffset, chunkLimit, targetAccountId }) => {
+    const scoped = resolveToolAccount("conversation-archive-list-chunks", targetAccountId);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     try {
         const result = await conversationArchiveListChunks({
             accountId,
@@ -504,9 +563,12 @@ lifelineTool(server, "conversation-archive-derive-insights", "Convert one chunk'
         .describe("Claims the dispatched specialist emitted in-turn from the chunk body. Zero is valid — pass [] to record an empty-chunk pass."),
     inlineRewrite: z.boolean().optional().describe("When true, count mention-claim subjects in this chunk and return those reaching inlineRewriteThreshold in inlineRewriteSignals. The calling skill accumulates signals across chunks; when an entity's cumulative count hits threshold, resolve it via memory-search and dispatch the compiled-truth-rewriter specialist."),
     inlineRewriteThreshold: z.number().int().min(1).optional().describe("Minimum mention-claim count for a subject to appear in inlineRewriteSignals. Default: 2."),
-}, async ({ archiveElementId, chunkElementId, claims, inlineRewrite, inlineRewriteThreshold }) => {
-    if (!accountId)
-        return refuseNoAccount("conversation-archive-derive-insights");
+    targetAccountId: z.string().optional().describe(XACCT_DESC),
+}, async ({ archiveElementId, chunkElementId, claims, inlineRewrite, inlineRewriteThreshold, targetAccountId }) => {
+    const scoped = resolveToolAccount("conversation-archive-derive-insights", targetAccountId);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     try {
         const result = await conversationArchiveDeriveInsights({
             accountId,
@@ -583,9 +645,12 @@ lifelineTool(server, "conversation-archive-enrich-rejection", "Record or undo a
     mode: z
         .enum(["record", "undo"])
         .describe("record = append rejection; undo = remove rejection (called after `wire`)."),
-}, async ({ archiveElementId, chunkElementId, kind, contentHash, mode }) => {
-    if (!accountId)
-        return refuseNoAccount("conversation-archive-enrich-rejection");
+    targetAccountId: z.string().optional().describe(XACCT_DESC),
+}, async ({ archiveElementId, chunkElementId, kind, contentHash, mode, targetAccountId }) => {
+    const scoped = resolveToolAccount("conversation-archive-enrich-rejection", targetAccountId);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     try {
         const result = await conversationArchiveEnrichRejection({
             accountId,
@@ -629,9 +694,12 @@ eagerTool(server, "memory-report-read-latest", "Return the most recent :Report n
         .max(20)
         .optional()
         .describe("Maximum number of reports to return, newest first. Default 1."),
-}, async ({ keyword, limit }) => {
-    if (!accountId)
-        return refuseNoAccount("memory-report-read-latest");
+    targetAccountId: z.string().optional().describe(XACCT_DESC),
+}, async ({ keyword, limit, targetAccountId }) => {
+    const scoped = resolveToolAccount("memory-report-read-latest", targetAccountId);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     try {
         const result = await memoryReportReadLatest({ accountId, keyword, limit });
         if (result.results.length === 0) {
@@ -686,9 +754,12 @@ eagerTool(server, "memory-report-list", "List :Report nodes, newest first, with
         .min(0)
         .optional()
         .describe("Zero-based offset for pagination. Default 0."),
-}, async ({ keyword, sourceWorkflow, limit, offset }) => {
-    if (!accountId)
-        return refuseNoAccount("memory-report-list");
+    targetAccountId: z.string().optional().describe(XACCT_DESC),
+}, async ({ keyword, sourceWorkflow, limit, offset, targetAccountId }) => {
+    const scoped = resolveToolAccount("memory-report-list", targetAccountId);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     try {
         const result = await memoryReportList({
             accountId,
@@ -736,9 +807,12 @@ eagerTool(server, "memory-compiled-truth-history", "Return the audit history of
     nodeId: z
         .string()
         .describe("elementId of the :Person | :Organization | :Concept whose revision history is being read."),
-}, async ({ nodeId }) => {
-    if (!accountId)
-        return refuseNoAccount("memory-compiled-truth-history");
+    targetAccountId: z.string().optional().describe(XACCT_DESC),
+}, async ({ nodeId, targetAccountId }) => {
+    const scoped = resolveToolAccount("memory-compiled-truth-history", targetAccountId);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     try {
         const result = await memoryCompiledTruthHistory({ accountId, nodeId });
         if (result.revisions.length === 0) {
@@ -793,9 +867,12 @@ if (!readOnly) {
             .string()
             .optional()
             .describe("Active Task elementId for autonomous-workflow writes. When set, an inbound :PRODUCED edge from this Task is composed into relationships before the write. Task must share the same accountId; mismatch is rejected. Omit for direct conversation asks — the platform composes the edge from the active conversation instead."),
-    }, async ({ labels, properties, scope, relationships, producedByTaskId }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-write");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ labels, properties, scope, relationships, producedByTaskId, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-write", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryWrite({
                 labels,
@@ -853,9 +930,12 @@ if (!readOnly) {
             .string()
             .optional()
             .describe("ISO 8601 timestamp the report describes. Defaults to now(). Override only when persisting a backdated report."),
-    }, async ({ title, body, keywords, sourceWorkflow, occurredAt }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-report-write");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ title, body, keywords, sourceWorkflow, occurredAt, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-report-write", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryReportWrite({
                 accountId,
@@ -896,9 +976,12 @@ if (!readOnly) {
         properties: z
             .record(z.string(), z.unknown())
             .describe("Properties to set or overwrite. Same restrictions as memory-update — embedding/accountId/createdAt are silently stripped; compiled-truth fields are refused unless the caller is the compiled-truth-rewriter specialist."),
-    }, async ({ label, name, properties }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-update-by-name");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ label, name, properties, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-update-by-name", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryUpdateByName({
                 label,
@@ -937,9 +1020,12 @@ if (!readOnly) {
         properties: z
             .record(z.string(), z.unknown())
             .describe("Properties to set or overwrite. Restricted keys (embedding, accountId, createdAt) are ignored. Compiled-truth fields are system-managed; only the compiled-truth-rewriter specialist may write them."),
-    }, async ({ nodeId, properties }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-update");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ nodeId, properties, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-update", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryUpdate({
                 nodeId,
@@ -978,9 +1064,12 @@ if (!readOnly) {
         toId: z.string().describe("elementId of the target node (from memory-search results)."),
         relationshipType: z.string().describe("Relationship type label — e.g. RELATES_TO, MENTIONS, WORKED_WITH. Uppercase-coerced. Underscore-prefixed types (_SOFT_DELETE, etc.) are reserved and rejected."),
         properties: z.record(z.string(), z.unknown()).optional().describe("Properties to set on the relationship on CREATE. Ignored on DELETE and on idempotent CREATE (MERGE-matched)."),
-    }, async ({ action, fromId, toId, relationshipType, properties }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-edge");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ action, fromId, toId, relationshipType, properties, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-edge", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryEdge({
                 action,
@@ -1014,9 +1103,13 @@ if (!readOnly) {
             };
         }
     });
-    eagerTool(server, "session-compact-status", "Check whether a session compaction summary exists in the graph. Returns the most recent summary title, date, and briefing text. Use this at session start to determine whether a prior session was compacted and its context should be restored.", {}, async () => {
-        if (!accountId)
-            return refuseNoAccount("session-compact-status");
+    eagerTool(server, "session-compact-status", "Check whether a session compaction summary exists in the graph. Returns the most recent summary title, date, and briefing text. Use this at session start to determine whether a prior session was compacted and its context should be restored.", {
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ targetAccountId }) => {
+        const scoped = resolveToolAccount("session-compact-status", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         const session = getSession();
         try {
             const result = await session.run(`MATCH (n:CreativeWork {accountId: $accountId})
@@ -1043,8 +1136,10 @@ if (!readOnly) {
     eagerTool(server, "session-compact", "Write a session summary to the knowledge graph. Call this when compacting context — provide the full briefing and the tool handles labelling, structure, and embedding.", {
         content: z.string().describe("The session briefing — what was discussed, decisions made, work in progress, open questions, and anything learned about the user or their business"),
     }, async ({ content }) => {
-        if (!accountId)
-            return refuseNoAccount("session-compact");
+        const scoped = resolveToolAccount("session-compact", undefined);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             // Write doctrine: session summaries link back to the
             // Conversation they summarise, so an operator searching a session's
@@ -1103,9 +1198,13 @@ if (!readOnly) {
             };
         }
     });
-    eagerTool(server, "memory-reindex", "Rebuild vector embeddings for all nodes missing embeddings. Run after seeding or bulk updates.", {}, async () => {
-        if (!accountId)
-            return refuseNoAccount("memory-reindex");
+    eagerTool(server, "memory-reindex", "Rebuild vector embeddings for all nodes missing embeddings. Run after seeding or bulk updates.", {
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-reindex", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryReindex(accountId);
             return {
@@ -1140,8 +1239,10 @@ if (!readOnly) {
         mimeType: z.string().describe("MIME type of the file"),
         attachmentId: z.string().describe("UUID of the file attachment — used as cache key for memory-ingest"),
     }, async ({ storagePath, filename, mimeType, attachmentId }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-ingest-extract");
+        const scoped = resolveToolAccount("memory-ingest-extract", undefined);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryIngestExtract({ storagePath, filename, mimeType, attachmentId });
             return {
@@ -1231,9 +1332,12 @@ if (!readOnly) {
         inlineRewrite: z.boolean().optional().describe("When true, after writing all sections and edges, run the inline compiled-truth reconciliation gate. Counts MENTIONS/REFERENCES edges from this document (KnowledgeDocument + its sections) to existing entities that carry compiledTruth. Entities with >= inlineRewriteThreshold such edges (default 2) and compiledTruthUpdatedAt older than 7 days are returned in inlineRewriteCandidates. Dispatch the compiled-truth-rewriter specialist for each before the skill returns. Disabled by default."),
         forceRewrite: z.boolean().optional().describe("When inlineRewrite is true, bypass the 7-day per-entity cooldown on compiledTruthUpdatedAt. All threshold-qualifying entities are returned as inlineRewriteCandidates regardless of when their truth was last rewritten."),
         inlineRewriteThreshold: z.number().int().min(1).optional().describe("Minimum MENTIONS/REFERENCES edge count from this source to an entity for it to qualify as an inline-rewrite candidate. Default: 2."),
-    }, async ({ attachmentId, conversationIdentity, source, archiveSha256, archiveSourceFile, participantElementIds, lastIngestedMessageHash, lastIngestedMessageAt, archiveTitle, cleanupPriorChunks, sessionIndex, documentSummary, anchorNodeId, anchorLabel, sections, documentEdges, orphanCandidates, scope, sourceUrl, sourceType, documentKeywords, userKeywords, sessionId: sessionIdOverride, inlineRewrite, forceRewrite, inlineRewriteThreshold }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-ingest");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ attachmentId, conversationIdentity, source, archiveSha256, archiveSourceFile, participantElementIds, lastIngestedMessageHash, lastIngestedMessageAt, archiveTitle, cleanupPriorChunks, sessionIndex, documentSummary, anchorNodeId, anchorLabel, sections, documentEdges, orphanCandidates, scope, sourceUrl, sourceType, documentKeywords, userKeywords, sessionId: sessionIdOverride, inlineRewrite, forceRewrite, inlineRewriteThreshold, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-ingest", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryIngest({
                 accountId,
@@ -1296,9 +1400,12 @@ if (!readOnly) {
     });
     eagerTool(server, "kd-classify", "Operator-solicited reclassify for any :KnowledgeDocument that carries a `body` property (today: email-thread KDs; future: any thread-shaped source). Reads the KD by attachmentId, decides via a body-growth gate (proceed iff body grew ≥25% since the last classify, or first-ever classify), stages the body to a temp file under $ACCOUNT_DIR/tmp/, and returns a dispatch envelope the admin agent hands to the `librarian` specialist. Librarian runs the document-ingest skill against the temp file; memory-ingest MERGEs by attachmentId, replacing any prior :Section children, and stamps lastClassifiedAt + lastClassifiedBodyLength on the KD so the next gate call has a baseline. Bodyless attachment KDs (PDFs etc.) are not supported here — they have no growth signal.", {
         attachmentId: z.string().describe("attachmentId of the :KnowledgeDocument to classify. For email threads, this is sha256(`email:<accountId>:<rootMessageId>`)."),
-    }, async ({ attachmentId }) => {
-        if (!accountId)
-            return refuseNoAccount("kd-classify");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ attachmentId, targetAccountId }) => {
+        const scoped = resolveToolAccount("kd-classify", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const text = await kdClassify({ accountId, attachmentId });
             return { content: [{ type: "text", text }] };
@@ -1336,9 +1443,12 @@ if (!readOnly) {
             .string()
             .optional()
             .describe("Skill-run UUID for provenance stamping. Falls back to SESSION_ID env var when absent."),
-    }, async ({ archiveType, ownerNodeId, rows, sessionId: sessionIdOverride }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-archive-write");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ archiveType, ownerNodeId, rows, sessionId: sessionIdOverride, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-archive-write", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryArchiveWrite({
                 archiveType,
@@ -1418,9 +1528,12 @@ if (!readOnly) {
             .string()
             .optional()
             .describe("Skill-run UUID for provenance stamping. Falls back to SESSION_ID env var when absent."),
-    }, async ({ ownerNodeId, extractedDir, mode, importId, filters, resolutions, selectiveIngestThreshold, sessionId: sessionIdOverride, }) => {
-        if (!accountId)
-            return refuseNoAccount("obsidian-vault-import");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ ownerNodeId, extractedDir, mode, importId, filters, resolutions, selectiveIngestThreshold, sessionId: sessionIdOverride, targetAccountId, }) => {
+        const scoped = resolveToolAccount("obsidian-vault-import", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await obsidianVaultImport({
                 accountId,
@@ -1469,9 +1582,12 @@ if (!readOnly) {
             "When present, used verbatim as `KnowledgeDocument.name` (capped at 200 chars). " +
             "When absent, the server falls back to the markdown H1, then a URL-derived slug, then the URL."),
         scope: z.string().optional().describe("Intended visibility scope (for logging). The actual scope is set when the agent subsequently calls memory-ingest."),
-    }, async ({ url, content, title, scope }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-ingest-web");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ url, content, title, scope, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-ingest-web", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryIngestWeb({
                 accountId,
@@ -1518,9 +1634,12 @@ if (!readOnly) {
         agentType: z.enum(["admin", "public"]).optional().describe("Scope to conversations matching c.agentType. Omit to scope across both."),
         limit: z.number().int().positive().optional().describe("Max candidates to return (default 200, hard cap 1000)."),
         dryRun: z.boolean().optional().describe("Preview matches without minting an actionable filterToken. Candidates are listed in the response, but no delete can be performed against them — caller must re-run without dryRun to receive a token."),
-    }, async ({ filter, agentType, limit, dryRun }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-find-candidates");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ filter, agentType, limit, dryRun, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-find-candidates", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryFindCandidates({ accountId, filter, agentType, limit, dryRun });
             if (result.items.length === 0) {
@@ -1561,9 +1680,12 @@ if (!readOnly) {
         "ranked discovery on general labels. Use this before any branch that claims a " +
         "singleton root is missing.", {
         label: z.enum(MEMORY_NODE_EXISTS_LABELS).describe("Installer-seeded singleton label. One of: LocalBusiness, AdminUser, UserProfile, Person."),
-    }, async ({ label }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-node-exists");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ label, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-node-exists", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryNodeExists({ accountId, label });
             const payload = JSON.stringify(result);
@@ -1588,9 +1710,12 @@ if (!readOnly) {
         filterToken: z.string().optional().describe("Opaque token from memory-find-candidates. Required for bulk-selector flows; the server re-runs the " +
             "canonical predicate on this elementId before trashing. Omit for single-node deletes where the caller " +
             "chose the target directly (e.g. from a memory-search result)."),
-    }, async ({ elementId, reason, filterToken }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-delete");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ elementId, reason, filterToken, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-delete", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryDelete({ accountId, elementId, reason, filterToken });
             const head = result.alreadyTrashed
@@ -1617,9 +1742,12 @@ if (!readOnly) {
         "node needs back (e.g. a fresh LocalBusiness was created while the old one was in trash) — " +
         "the error names the conflicting elementId so the caller can decide how to resolve.", {
         elementId: z.string().describe("Neo4j elementId of the trashed node to restore."),
-    }, async ({ elementId }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-restore");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ elementId, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-restore", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryRestore({ accountId, elementId });
             const cascade = result.cascade.sections + result.cascade.chunks > 0
@@ -1647,9 +1775,12 @@ if (!readOnly) {
         graceDays: z.number().int().min(0).optional().describe("Minimum age in days a trashed node must reach before it's eligible. Default 30."),
         dryRun: z.boolean().optional().describe("When true, lists candidates without deleting. Default false."),
         labels: z.array(z.string()).optional().describe("Optional whitelist of node labels — only nodes carrying any of these labels are eligible."),
-    }, async ({ graceDays, dryRun, labels }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-empty-trash");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ graceDays, dryRun, labels, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-empty-trash", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryEmptyTrash({ accountId, graceDays, dryRun, labels });
             const lines = [];
@@ -1673,9 +1804,13 @@ if (!readOnly) {
     });
     lifelineTool(server, "memory-list-attachments", "List stored file attachments for this account with their ingestion status. " +
         "Returns original filenames, sizes, upload dates, and whether each file has been ingested " +
-        "into the knowledge graph. Does not include web-ingested documents (those have no file on disk).", {}, async () => {
-        if (!accountId)
-            return refuseNoAccount("memory-list-attachments");
+        "into the knowledge graph. Does not include web-ingested documents (those have no file on disk).", {
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-list-attachments", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryListAttachments(accountId);
             if (result.entries.length === 0) {
@@ -1713,9 +1848,12 @@ if (!readOnly) {
         "extracted text for PDFs (via pdftotext), and metadata + HTTP URL for images. " +
         "Use this to show the user what's in a file or to prepare content for editing.", {
         attachmentId: z.string().describe("UUID of the attachment to read"),
-    }, async ({ attachmentId }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-read-attachment");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ attachmentId, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-read-attachment", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryReadAttachment(accountId, attachmentId);
             let text = `**${result.filename}** (${result.mimeType}, ${result.sizeBytes} bytes)\nStored: ${result.storedAt}\n`;
@@ -1740,9 +1878,12 @@ if (!readOnly) {
         "Only text/plain and text/markdown files are editable — PDFs and images are rejected.", {
         attachmentId: z.string().describe("UUID of the attachment to edit"),
         content: z.string().describe("The full replacement text content"),
-    }, async ({ attachmentId, content }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-edit-attachment");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ attachmentId, content, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-edit-attachment", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryEditAttachment({ accountId, attachmentId, content });
             let text = `Edited: ${result.filename} (${result.oldSizeBytes} → ${result.newSizeBytes} bytes)`;
@@ -1768,9 +1909,12 @@ if (!readOnly) {
         "is not renamed — it uses UUID-based naming. Only the human-readable metadata changes.", {
         attachmentId: z.string().describe("UUID of the attachment to rename"),
         newFilename: z.string().describe("The new filename (e.g. 'quarterly-report-q1.pdf')"),
-    }, async ({ attachmentId, newFilename }) => {
-        if (!accountId)
-            return refuseNoAccount("memory-rename-attachment");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ attachmentId, newFilename, targetAccountId }) => {
+        const scoped = resolveToolAccount("memory-rename-attachment", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await memoryRenameAttachment({ accountId, attachmentId, newFilename });
             if (result.oldFilename === result.newFilename) {
@@ -1874,9 +2018,12 @@ if (!readOnly) {
             .number()
             .optional()
             .describe("Maximum results (default 50 for conversations, 200 for messages)"),
-    }, async ({ sessionId, agentType, agentSlug, since, includeMessages, limit }) => {
-        if (!accountId)
-            return refuseNoAccount("conversation-list");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ sessionId, agentType, agentSlug, since, includeMessages, limit, targetAccountId }) => {
+        const scoped = resolveToolAccount("conversation-list", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         const startTime = Date.now();
         const dbSession = getSession();
         try {
@@ -2055,16 +2202,20 @@ if (!readOnly) {
             .describe("Operator-identity fields written to the OWNS-bound Person. Use canonical `telephone` (NOT `phone` — that is the schema synonym, not the canonical name). Tool throws if the AdminUser-OWNS-Person edge is missing rather than silently no-op."),
         mergeSourceIds: z.array(z.string()).optional()
             .describe("For mode 'merge': preferenceIds of sources to combine into this preference"),
-    }, async ({ category, key, value, source, mode, sessionId, profileFields, personFields, mergeSourceIds }) => {
-        if (!accountId)
-            return refuseNoAccount("profile-update");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ category, key, value, source, mode, sessionId, profileFields, personFields, mergeSourceIds, targetAccountId }) => {
+        const scoped = resolveToolAccount("profile-update", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
+        const crossAccount = accountId !== BOOT_ACCOUNT_ID;
         try {
-            if (!userId) {
-                return { content: [{ type: "text", text: "profile-update requires an authenticated admin session with userId" }], isError: true };
-            }
+            const ident = await resolveProfileIdentity("profile-update", crossAccount, accountId, userId);
+            if ("reject" in ident)
+                return ident.reject;
             const result = await profileUpdate({
                 accountId,
-                userId,
+                userId: ident.userId,
                 category,
                 key,
                 value,
@@ -2074,6 +2225,7 @@ if (!readOnly) {
                 profileFields: profileFields,
                 personFields,
                 mergeSourceIds,
+                bootstrapProfile: crossAccount,
             });
             return {
                 content: [{
@@ -2096,14 +2248,18 @@ if (!readOnly) {
         category: z.enum(["communication", "scheduling", "decision", "workflow", "content", "interaction"])
             .describe("Preference category"),
         key: z.string().describe("Preference key to delete"),
-    }, async ({ category, key }) => {
-        if (!accountId)
-            return refuseNoAccount("profile-delete");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ category, key, targetAccountId }) => {
+        const scoped = resolveToolAccount("profile-delete", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
+        const crossAccount = accountId !== BOOT_ACCOUNT_ID;
         try {
-            if (!userId) {
-                return { content: [{ type: "text", text: "profile-delete requires an authenticated admin session with userId" }], isError: true };
-            }
-            const result = await profileDelete({ accountId, userId, category, key });
+            const ident = await resolveProfileIdentity("profile-delete", crossAccount, accountId, userId);
+            if ("reject" in ident)
+                return ident.reject;
+            const result = await profileDelete({ accountId, userId: ident.userId, category, key });
             return {
                 content: [{
                         type: "text",
@@ -2130,14 +2286,18 @@ if (!readOnly) {
         "Use detail=true when the owner asks 'what do you know about me?' or when reviewing memory accuracy.", {
         detail: z.boolean().optional().describe("When true, returns per-preference confidence, source, evidence trail, and memory statistics. " +
             "Default false returns a compact summary for system prompt injection."),
-    }, async ({ detail }) => {
-        if (!accountId)
-            return refuseNoAccount("profile-read");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ detail, targetAccountId }) => {
+        const scoped = resolveToolAccount("profile-read", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
+        const crossAccount = accountId !== BOOT_ACCOUNT_ID;
         try {
-            if (!userId) {
-                return { content: [{ type: "text", text: "profile-read requires an authenticated admin session with userId" }], isError: true };
-            }
-            const result = await profileRead({ accountId, userId, detail: detail ?? false });
+            const ident = await resolveProfileIdentity("profile-read", crossAccount, accountId, userId);
+            if ("reject" in ident)
+                return ident.reject;
+            const result = await profileRead({ accountId, userId: ident.userId, detail: detail ?? false });
             return {
                 content: [{ type: "text", text: result.summary }],
             };
@@ -2166,10 +2326,13 @@ if (!readOnly) {
         "Use this when the operator asks 'what has the brain captured today?', 'show me recent mentions of X', or 'what ideas did I leave on the table this week?'.", {
         windowHours: z.number().int().optional().describe("Hours back from now. Default 24. Capped at 720 (30 days)."),
         limit: z.number().int().optional().describe("Max rows returned. Default 50, max 200."),
-    }, async ({ windowHours, limit }) => {
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ windowHours, limit, targetAccountId }) => {
         try {
-            if (!accountId)
-                return refuseNoAccount("memory-brain-capture-recent");
+            const scoped = resolveToolAccount("memory-brain-capture-recent", targetAccountId);
+            if ("reject" in scoped)
+                return scoped.reject;
+            const accountId = scoped.accountId;
             const result = await memoryBrainCaptureRecent({ accountId, windowHours, limit });
             return {
                 content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
@@ -2203,8 +2366,10 @@ if (!readOnly) {
         "per-device and survives upgrades.", {
         values: z.array(z.string().min(1)).min(1).describe("Substring values to add. Match is exact substring (case-sensitive) against string-typed properties only."),
     }, async ({ values }) => {
-        if (!accountId)
-            return refuseNoAccount("graph-prune-denylist-add");
+        const scoped = resolveToolAccount("graph-prune-denylist-add", undefined);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await graphPruneDenylistAdd(values);
             const lines = [
@@ -2229,8 +2394,10 @@ if (!readOnly) {
         "restored — audit entries on each affected node remain for forensic review.", {
         values: z.array(z.string().min(1)).min(1).describe("Substring values to remove (must match exactly as previously added)."),
     }, async ({ values }) => {
-        if (!accountId)
-            return refuseNoAccount("graph-prune-denylist-remove");
+        const scoped = resolveToolAccount("graph-prune-denylist-remove", undefined);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await graphPruneDenylistRemove(values);
             const lines = [
@@ -2257,9 +2424,12 @@ if (!readOnly) {
         "that should not propagate (e.g. wrong-account hostnames, fabricated identifiers).", {
         sessionId: z.string().min(1).describe("The Conversation node's sessionId to scope the expunge to."),
         pattern: z.string().min(1).describe("The substring to scrub from string properties on linked :Memory nodes."),
-    }, async ({ sessionId, pattern }) => {
-        if (!accountId)
-            return refuseNoAccount("conversation-memory-expunge");
+        targetAccountId: z.string().optional().describe(XACCT_DESC),
+    }, async ({ sessionId, pattern, targetAccountId }) => {
+        const scoped = resolveToolAccount("conversation-memory-expunge", targetAccountId);
+        if ("reject" in scoped)
+            return scoped.reject;
+        const accountId = scoped.accountId;
         try {
             const result = await conversationMemoryExpunge({ accountId, sessionId, pattern });
             const lines = [
@@ -2286,8 +2456,10 @@ if (!readOnly) {
 // graph-prune-denylist-list and conversation-search are read-only — available regardless of readOnly mode.
 lifelineTool(server, "graph-prune-denylist-list", "List the current operator-curated deny-list values used by the daily graph-prune cron. " +
     "Returns the substring values, the timestamp of the last edit, and the total count.", {}, () => {
-    if (!accountId)
-        return refuseNoAccount("graph-prune-denylist-list");
+    const scoped = resolveToolAccount("graph-prune-denylist-list", undefined);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     try {
         const result = graphPruneDenylistList();
         if (result.count === 0) {
@@ -2311,9 +2483,12 @@ eagerTool(server, "conversation-search", "Search conversation history using sema
         .number()
         .optional()
         .describe("Maximum number of results (default 10)"),
-}, async ({ query, limit: maxResults }) => {
-    if (!accountId)
-        return refuseNoAccount("conversation-search");
+    targetAccountId: z.string().optional().describe(XACCT_DESC),
+}, async ({ query, limit: maxResults, targetAccountId }) => {
+    const scoped = resolveToolAccount("conversation-search", targetAccountId);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     try {
         const queryEmbedding = await embed(query);
         const resultLimit = maxResults ?? 10;
@@ -2438,9 +2613,12 @@ lifelineTool(server, "memory-dream-run", "Operator-initiated dream-cycle: graph-
     operatorId: z.string().optional().describe("Identifier of the operator who triggered the run; appears in the report and log line."),
     phases: z.array(z.number().int().min(1).max(7)).optional().describe("Subset of phases to run. Default [1,2,3,4,5,6,7]. Order is fixed."),
     maxEventsPerRun: z.number().int().positive().optional().describe("Phase 4 cap on :TimelineEvent rows scanned per run. Default 200."),
-}, async ({ operatorId, phases, maxEventsPerRun }) => {
-    if (!accountId)
-        return refuseNoAccount("memory-dream-run");
+    targetAccountId: z.string().optional().describe(XACCT_DESC),
+}, async ({ operatorId, phases, maxEventsPerRun, targetAccountId }) => {
+    const scoped = resolveToolAccount("memory-dream-run", targetAccountId);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     try {
         const result = await memoryDreamRun({ accountId, operatorId, phases, maxEventsPerRun });
         return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
@@ -2455,9 +2633,12 @@ lifelineTool(server, "memory-dream-run", "Operator-initiated dream-cycle: graph-
 lifelineTool(server, "memory-review-queue", "Read-only summary of the dream-cycle's review queues (:OrphanCandidate, :CitationProposal). " +
     "Returns per-queue counts and a small sample so the operator can see whether to triage.", {
     sampleSize: z.number().int().positive().optional().describe("Sample rows per queue. Default 5, max 25."),
-}, async ({ sampleSize }) => {
-    if (!accountId)
-        return refuseNoAccount("memory-review-queue");
+    targetAccountId: z.string().optional().describe(XACCT_DESC),
+}, async ({ sampleSize, targetAccountId }) => {
+    const scoped = resolveToolAccount("memory-review-queue", targetAccountId);
+    if ("reject" in scoped)
+        return scoped.reject;
+    const accountId = scoped.accountId;
     try {
         const result = await memoryReviewQueue({ accountId, sampleSize });
         return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };