@rubytech/create-maxy-code 0.1.423 → 0.1.429

package/payload/platform/plugins/admin/hooks/__tests__/datetime-inject.test.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# Regression test for datetime-inject.sh.
+#
+# The hook injects a fresh <datetime> block as UserPromptSubmit additionalContext
+# every turn, reporting "now" in $MAXY_ACCOUNT_TZ (the operator's graph timezone,
+# stamped at spawn) or the server zone when that env is empty.
+#
+# Covers:
+#   1. MAXY_ACCOUNT_TZ set          -> exit 0, valid JSON, additionalContext has
+#      the <datetime> block, the named zone, and a UTC: line; source=graph.
+#   2. MAXY_ACCOUNT_TZ empty        -> exit 0, block falls back to the server zone
+#      and labels source as server-timezone.
+#   3. Breadcrumb                   -> $LOG_DIR/datetime-inject.log gains a line
+#      with source= and refresh=per-turn.
+#   4. python3 absent               -> exit 0, empty stdout (fail-open).
+#   5. node absent                  -> exit 0, empty stdout (fail-open).
+
+set -u
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/datetime-inject.sh"
+if [[ ! -x "$HOOK" ]]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+STDIN='{"hook_event_name":"UserPromptSubmit","prompt":"when is the meeting","session_id":"sess-abc123"}'
+
+# Case 1 — MAXY_ACCOUNT_TZ set: block reports that zone, source=graph.
+out=$(printf '%s' "$STDIN" | MAXY_ACCOUNT_TZ="Europe/London" LOG_DIR="" bash "$HOOK" 2>/dev/null); ex=$?
+if [[ "$ex" -eq 0 ]] && printf '%s' "$out" | python3 -c '
+import json, sys
+d = json.load(sys.stdin)
+h = d["hookSpecificOutput"]
+assert h["hookEventName"] == "UserPromptSubmit", "wrong hookEventName"
+ctx = h["additionalContext"]
+assert "<datetime>" in ctx and "</datetime>" in ctx, "no datetime block"
+assert "Europe/London" in ctx, "zone not named"
+assert "UTC:" in ctx, "no UTC line"
+assert "account-timezone" in ctx, "source label missing for graph tz"
+' 2>/dev/null; then
+  echo "PASS: MAXY_ACCOUNT_TZ set -> datetime block in named zone"; PASS=$((PASS+1))
+else
+  echo "FAIL: graph-tz injection (exit=$ex stdout=$out)" >&2; FAIL=$((FAIL+1))
+fi
+
+# Case 2 — MAXY_ACCOUNT_TZ empty: falls back to the server zone, labels it.
+out2=$(printf '%s' "$STDIN" | MAXY_ACCOUNT_TZ="" LOG_DIR="" bash "$HOOK" 2>/dev/null); ex2=$?
+if [[ "$ex2" -eq 0 ]] && printf '%s' "$out2" | python3 -c '
+import json, sys
+ctx = json.load(sys.stdin)["hookSpecificOutput"]["additionalContext"]
+assert "<datetime>" in ctx, "no datetime block"
+assert "server-timezone" in ctx, "server fallback not labelled"
+assert "UTC:" in ctx, "no UTC line"
+' 2>/dev/null; then
+  echo "PASS: empty MAXY_ACCOUNT_TZ -> server-zone fallback labelled"; PASS=$((PASS+1))
+else
+  echo "FAIL: server fallback (exit=$ex2 stdout=$out2)" >&2; FAIL=$((FAIL+1))
+fi
+
+# Case 2b — MAXY_ACCOUNT_TZ set but NOT a real IANA zone: the node validation
+# rejects it, falls back to the server zone, and labels the source neutrally as
+# "unavailable" (never falsely "unset" — the value was present, just unusable).
+out2b=$(printf '%s' "$STDIN" | MAXY_ACCOUNT_TZ="Not/AZone" LOG_DIR="" bash "$HOOK" 2>/dev/null); ex2b=$?
+if [[ "$ex2b" -eq 0 ]] && printf '%s' "$out2b" | python3 -c '
+import json, sys
+ctx = json.load(sys.stdin)["hookSpecificOutput"]["additionalContext"]
+assert "<datetime>" in ctx, "no datetime block"
+assert "server-timezone (account timezone unavailable)" in ctx, "invalid tz not labelled unavailable"
+assert "Not/AZone" not in ctx, "rejected zone leaked into the block"
+' 2>/dev/null; then
+  echo "PASS: set-but-invalid MAXY_ACCOUNT_TZ -> server fallback, labelled unavailable"; PASS=$((PASS+1))
+else
+  echo "FAIL: invalid-tz fallback (exit=$ex2b stdout=$out2b)" >&2; FAIL=$((FAIL+1))
+fi
+
+# Case 3 — breadcrumb carries source= and refresh=per-turn.
+LOGD=$(mktemp -d)
+printf '%s' "$STDIN" | MAXY_ACCOUNT_TZ="Europe/London" LOG_DIR="$LOGD" bash "$HOOK" >/dev/null 2>&1
+if [[ -f "$LOGD/datetime-inject.log" ]] \
+   && grep -q "\[datetime-inject\]" "$LOGD/datetime-inject.log" \
+   && grep -q "source=" "$LOGD/datetime-inject.log" \
+   && grep -q "refresh=per-turn" "$LOGD/datetime-inject.log"; then
+  echo "PASS: breadcrumb has source= and refresh=per-turn"; PASS=$((PASS+1))
+else
+  echo "FAIL: breadcrumb missing (log=$(cat "$LOGD/datetime-inject.log" 2>/dev/null))" >&2; FAIL=$((FAIL+1))
+fi
+rm -rf "$LOGD"
+
+# Case 4 — python3 absent -> fail-open (exit 0, empty stdout).
+FAKEBIN=$(mktemp -d)
+for util in cat printf env bash node date; do
+  src=$(command -v "$util" 2>/dev/null) && ln -sf "$src" "$FAKEBIN/$util" 2>/dev/null
+done
+nopy_out=$(printf '%s' "$STDIN" | PATH="$FAKEBIN" MAXY_ACCOUNT_TZ="Europe/London" bash "$HOOK" 2>/dev/null); nopy_exit=$?
+if [[ "$nopy_exit" -eq 0 && -z "$nopy_out" ]]; then
+  echo "PASS: python3 absent -> exit 0, empty stdout (fail-open)"; PASS=$((PASS+1))
+else
+  echo "FAIL: python3 absent (exit=$nopy_exit stdout=$nopy_out)" >&2; FAIL=$((FAIL+1))
+fi
+rm -rf "$FAKEBIN"
+
+# Case 5 — node absent -> fail-open (exit 0, empty stdout).
+FAKEBIN2=$(mktemp -d)
+for util in cat printf env bash python3 date; do
+  src=$(command -v "$util" 2>/dev/null) && ln -sf "$src" "$FAKEBIN2/$util" 2>/dev/null
+done
+nonode_out=$(printf '%s' "$STDIN" | PATH="$FAKEBIN2" MAXY_ACCOUNT_TZ="Europe/London" bash "$HOOK" 2>/dev/null); nonode_exit=$?
+if [[ "$nonode_exit" -eq 0 && -z "$nonode_out" ]]; then
+  echo "PASS: node absent -> exit 0, empty stdout (fail-open)"; PASS=$((PASS+1))
+else
+  echo "FAIL: node absent (exit=$nonode_exit stdout=$nonode_out)" >&2; FAIL=$((FAIL+1))
+fi
+rm -rf "$FAKEBIN2"
+
+echo "----"
+echo "PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/datetime-inject.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+# Task 1515 — UserPromptSubmit hook: inject a fresh <datetime> block as
+# additionalContext on every turn, so the agent always has the current instant
+# (date, time, timezone, weekday, and the raw UTC ISO) without hand-computing it
+# and without depending on Claude Code's spawn-time "Today's date" line going
+# stale. This is the per-turn current-time surface the datetime skill points at.
+#
+# The instant is computed fresh here every turn (refresh=per-turn). The timezone
+# is NOT computed here — it is the operator's own zone, resolved from their
+# UserProfile on the graph once per admin spawn and stamped into MAXY_ACCOUNT_TZ.
+# When MAXY_ACCOUNT_TZ is empty (a non-admin turn, an unset profile timezone, or
+# a neo4j hiccup at spawn) the block falls back to the server's own zone and
+# labels the source, so a reader can always tell which clock the agent saw.
+#
+# Mirrors prompt-optimiser-directive.sh: emit hookSpecificOutput.additionalContext
+# via python3, fail-open with exit 0 on every path. UserPromptSubmit output is
+# ADDED to the prompt, never substituted — the raw prompt always still reaches
+# the model.
+#
+# Input  (stdin, UserPromptSubmit contract): { "session_id": "...", ... } —
+#         session_id is used only for the breadcrumb; the prompt text is ignored
+#         (the block is standing and prompt-independent).
+# Output (stdout JSON):
+#   { "hookSpecificOutput": { "hookEventName": "UserPromptSubmit",
+#                             "additionalContext": "<datetime>...</datetime>" } }
+
+set -uo pipefail
+
+# Drain stdin FIRST, before any exit path. Claude Code writes the full
+# UserPromptSubmit payload (which carries the prompt text) to our stdin; if we
+# exit before reading it, a payload larger than the pipe buffer leaves the parent
+# blocked on write and then hit with EPIPE/SIGPIPE. The sibling
+# prompt-optimiser-directive.sh drains first for this exact reason. Only
+# session_id is used here (for the breadcrumb); the block is prompt-independent.
+HOOK_INPUT=$(cat 2>/dev/null || true)
+
+# Fail-open if either encoder is unavailable: python3 wraps the JSON envelope,
+# node formats the instant in the target zone (Intl has the full IANA database).
+command -v python3 >/dev/null 2>&1 || exit 0
+command -v node >/dev/null 2>&1 || exit 0
+
+# The operator's zone, stamped at spawn from the graph. Empty -> server zone.
+ACCOUNT_TZ="${MAXY_ACCOUNT_TZ:-}"
+
+# Format the current instant. node prints two tab-separated fields:
+#   1. the resolved IANA zone actually used (so the server-fallback names a real
+#      zone, not the string "server")
+#   2. the assembled block body
+# TZ_IN is passed as argv[1]; empty means "use the runtime's own zone".
+BLOCK=$(TZ_IN="$ACCOUNT_TZ" node -e '
+const tzIn = process.env.TZ_IN && process.env.TZ_IN.trim().length ? process.env.TZ_IN.trim() : null;
+const now = new Date();
+// Resolve the zone actually used. A supplied zone that Intl rejects falls back
+// to the runtime zone, so a bad stamp can never break the turn.
+let zone = tzIn;
+try { if (zone) new Intl.DateTimeFormat("en-GB", { timeZone: zone }); }
+catch { zone = null; }
+if (!zone) zone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+// zone === tzIn only when a non-empty, valid graph timezone was stamped; every
+// other case (env empty on a non-admin turn, or a stamped value Intl rejected)
+// falls back to the runtime zone. Label that neutrally as "unavailable" rather
+// than asserting "unset" — the [datetime-tz] spawn log distinguishes unset from
+// invalid from unavailable; here all the hook knows is the zone is not the graph one.
+const source = tzIn && zone === tzIn ? "account-timezone (graph)" : "server-timezone (account timezone unavailable)";
+const local = new Intl.DateTimeFormat("en-GB", {
+  weekday: "long", day: "numeric", month: "long", year: "numeric",
+  hour: "2-digit", minute: "2-digit", timeZone: zone, timeZoneName: "longOffset",
+}).format(now);
+const body = [
+  "Current date and time, read this rather than computing it by hand:",
+  "Now: " + local + " (" + zone + ")",
+  "UTC: " + now.toISOString(),
+  "Source: " + source,
+].join("\n");
+process.stdout.write(zone + "\t" + body);
+' 2>/dev/null) || exit 0
+
+[ -n "$BLOCK" ] || exit 0
+ZONE_USED="${BLOCK%%$'\t'*}"
+BODY="${BLOCK#*$'\t'}"
+CONTEXT="<datetime>
+$BODY
+</datetime>"
+
+OUT=$(printf '%s' "$CONTEXT" | python3 -c '
+import json, sys
+ctx = sys.stdin.read()
+print(json.dumps({
+    "hookSpecificOutput": {
+        "hookEventName": "UserPromptSubmit",
+        "additionalContext": ctx,
+    }
+}))
+' 2>/dev/null) || exit 0
+
+[ -n "$OUT" ] || exit 0
+printf '%s\n' "$OUT"
+
+# Breadcrumb: source (graph vs server-fallback) + refresh=per-turn so a future
+# staleness report can tell which clock was live each turn without reproduction.
+# Fail-open: a missing/unwritable LOG_DIR just skips the write.
+SID=$(printf '%s' "$HOOK_INPUT" | python3 -c 'import json,sys
+try:
+    print(json.load(sys.stdin).get("session_id","") or "?")
+except Exception:
+    print("?")' 2>/dev/null)
+SID=${SID:-?}
+if [ -n "$ACCOUNT_TZ" ] && [ "$ZONE_USED" = "$ACCOUNT_TZ" ]; then SRC=graph; else SRC=server-fallback; fi
+NOW_ISO=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "?")
+LINE="$NOW_ISO [datetime-inject] injected tz=$ZONE_USED source=$SRC refresh=per-turn session=$SID"
+if [ -n "${LOG_DIR:-}" ] && [ -d "$LOG_DIR" ]; then
+  printf '%s\n' "$LINE" >> "$LOG_DIR/datetime-inject.log" 2>/dev/null || true
+fi
+echo "$LINE" >&2 || true
+exit 0

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -27,7 +27,7 @@ import { publishSite } from "./tools/publish-site.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
 import { runCatalogueCensus } from "./lib/catalogue-census.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
-import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, } from "./tools/account-lifecycle.js";
+import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, readHouseAdminUserIds, setManagingAdmin, findClientAccountsManagedBy, reassignManagingAdmin, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, } from "./tools/account-lifecycle.js";
 function refusalGuidance(kind) {
     switch (kind) {
         case "unsafe-slug":
@@ -1085,6 +1085,17 @@ eagerTool(server, "admin-remove", "Remove an admin from this account. Removes th
     if (admins.length <= 1) {
         return { content: [{ type: "text", text: `${TAG} Cannot remove the last admin. At least one admin must remain on the account.` }], isError: true };
     }
+    // Task 1501 — never orphan a managed sub-account. A managing admin is always a
+    // house admin, so this bites only when removing from the house account: if
+    // `userId` is the managing admin of any client sub-account, refuse and name
+    // them so the operator reassigns each (account_reassign_admin) before retrying.
+    if (isHouseAccount(ACCOUNTS_ROOT, ACCOUNT_ID)) {
+        const managed = findClientAccountsManagedBy(ACCOUNTS_ROOT, userId);
+        if (managed.length > 0) {
+            process.stderr.write(`[account-lifecycle] op=admin-remove-reconcile userId=${userId.slice(0, 8)} managedAccounts=${managed.length} action=blocked\n`);
+            return { content: [{ type: "text", text: `${TAG} Cannot remove ${userId}: they are the managing admin of ${managed.length} client sub-account(s): ${managed.join(", ")}. Reassign each to another house admin with account_reassign_admin, then retry.` }], isError: true };
+        }
+    }
     // Resolve the admin's name from Neo4j (canonical) for the confirmation
     // message. Best-effort — fall back to userId if the graph is unreachable.
     let removedName = userId;
@@ -3256,9 +3267,23 @@ eagerTool(server, "account_list", "List every sub-account on this install (one h
         content: [{ type: "text", text: accounts.length ? lines.join("\n") : "No accounts found." }],
     };
 });
-eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\"), seeds default plugins, and seeds the account's graph root (a :LocalBusiness plus its owner :AdminUser) so you can populate it immediately. Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {}, async () => {
+eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). REQUIRES a managing admin: pass `adminUserId`, the userId of the house team member who will manage this client (get the choices from admin-list; ask the operator which one before creating). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\" and managingAdminUserId), seeds default plugins, and seeds the account's graph root (a :LocalBusiness plus its owner :AdminUser) so you can populate it immediately. Refuses if no adminUserId is given or if it is not a current house admin. Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {
+    adminUserId: z.string().describe("The userId of the house admin who will manage this client sub-account. Must be a current house admin (see admin-list). Required — creation is refused without it."),
+}, async ({ adminUserId }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("account_create");
+    // Task 1500 — every client sub-account must carry a responsible house admin.
+    // Refuse (tool error, never a silent default) when none is named, or when
+    // the named userId is not a current house admin.
+    if (!adminUserId || !adminUserId.trim()) {
+        process.stderr.write(`[account-lifecycle] op=create-refused reason=no-admin adminUserId=-\n`);
+        return { content: [{ type: "text", text: `account_create refused: name the managing house admin (adminUserId). Call admin-list to see the choices and ask the operator which one manages this client.` }], isError: true };
+    }
+    const houseAdminUserIds = readHouseAdminUserIds(ACCOUNTS_ROOT);
+    if (!houseAdminUserIds.includes(adminUserId)) {
+        process.stderr.write(`[account-lifecycle] op=create-refused reason=unknown-admin adminUserId=${adminUserId.slice(0, 8)}\n`);
+        return { content: [{ type: "text", text: `account_create refused: ${adminUserId} is not a current house admin. Call admin-list for the valid managing-admin choices.` }], isError: true };
+    }
     const newId = randomUUID();
     try {
         const accountDir = provisionClientAccount({
@@ -3302,11 +3327,26 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         finally {
             await seedSession.close();
         }
-        process.stderr.write(`[account-lifecycle] op=create accountId=${newId} dir-exists=${dirExists} root-seeded=${rootSeeded}\n`);
+        process.stderr.write(`[account-lifecycle] op=create accountId=${newId} dir-exists=${dirExists} root-seeded=${rootSeeded} managingAdmin=${adminUserId.slice(0, 8)}\n`);
         if (!rootSeeded) {
             return { content: [{ type: "text", text: `account_create FAILED: graph root not seeded for ${newId} (business+admin read-back failed). The account directory was scaffolded but is rootless — run account_delete ${newId} and retry.` }], isError: true };
         }
-        return { content: [{ type: "text", text: `Created client sub-account ${newId}. Switch to it from the sub-account picker to work in its data.` }] };
+        // Task 1500 — persist the validated managing admin on the new sub-account.
+        // Done after the root seed so a rootless failure never leaves a half-created
+        // account claiming a manager. Its own try: at this point the account is
+        // fully created and seeded, so a write failure must not be reported as a
+        // generic create failure (which would push the operator to retry and
+        // orphan a second account). Report the real state — created but unmanaged —
+        // with the recovery action.
+        try {
+            setManagingAdmin(ACCOUNTS_ROOT, newId, adminUserId);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`[account-lifecycle] op=create-admin-write-failed accountId=${newId} error=${msg}\n`);
+            return { content: [{ type: "text", text: `account_create: sub-account ${newId} was created and its graph root seeded, but recording the managing admin failed: ${msg}. The account exists with no managing admin — run account_delete ${newId} and retry.` }], isError: true };
+        }
+        return { content: [{ type: "text", text: `Created client sub-account ${newId}, managed by admin ${adminUserId}. Switch to it from the sub-account picker to work in its data.` }] };
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -3314,6 +3354,24 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         return { content: [{ type: "text", text: `account_create FAILED: ${msg}` }], isError: true };
     }
 });
+eagerTool(server, "account_reassign_admin", "Reassign a CLIENT sub-account's managing house admin. Pass `accountId` (the client sub-account) and `adminUserId` (the new managing admin's userId — must be a current house admin; get the choices from admin-list and ask the operator which team member takes it). Rewrites the sub-account's managingAdminUserId; the new admin is picked up on the next passive intake. Use it to repair a dangling managing admin (one whose house admin was removed) or to hand a client to a different team member. Refuses if the account is not a client sub-account, or if adminUserId is not a current house admin. Operator-only.", {
+    accountId: z.string().describe("The client sub-account (UUID) whose managing admin changes."),
+    adminUserId: z.string().describe("The userId of the house admin to become the managing admin. Must be a current house admin (see admin-list)."),
+}, async ({ accountId, adminUserId }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("account_reassign_admin");
+    const res = reassignManagingAdmin(ACCOUNTS_ROOT, accountId, adminUserId);
+    if (!res.ok) {
+        const msg = res.reason === "no-account"
+            ? `${accountId} is not a registered account on this install.`
+            : res.reason === "not-client"
+                ? `${accountId} is not a client sub-account (the house account has no managing admin).`
+                : `${adminUserId} is not a current house admin. Call admin-list for the valid managing-admin choices.`;
+        return { content: [{ type: "text", text: `account_reassign_admin refused: ${msg}` }], isError: true };
+    }
+    process.stderr.write(`[account-lifecycle] op=reassign accountId=${accountId} from=${res.previousAdminUserId ? res.previousAdminUserId.slice(0, 8) : "-"} to=${adminUserId.slice(0, 8)}\n`);
+    return { content: [{ type: "text", text: `Reassigned client sub-account ${accountId} to managing admin ${adminUserId}. It takes effect on the next passive intake.` }] };
+});
 eagerTool(server, "account_delete", "Archive a CLIENT sub-account: move its directory to data/accounts/.trash/ so it no longer appears in the sub-account list. Graph data is RETAINED — run account_purge with the typed confirmation to irreversibly delete it. Refuses to archive the house sub-account. Pass the accountId to archive.", {
     accountId: z.string().describe("The client accountId (UUID) to archive."),
 }, async ({ accountId }) => {