@rubytech/create-maxy-code 0.1.437 → 0.1.439

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -10,6 +10,7 @@ import { execFile, execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { writeAdminEntry, removeAdminFromAccount, logUsersAudit, formatAuditRowIds } from "../../../../lib/admins-write/dist/index.js";
 import { setAccessPassword as setAccessPasswordHash, clearAccessPassword as clearAccessPasswordHash, accessPasswordCollides } from "../../../../lib/admin-access-password/dist/index.js";
+import { resolveCredentialTarget } from "./credential-identity.js";
 import { embed } from "../../../../lib/embed-client/dist/index.js";
 import { requirePortEnv } from "../../../../lib/require-port-env/dist/index.js";
 import { deviceUrlBlock } from "../../../../lib/device-url/dist/index.js";
@@ -27,7 +28,7 @@ import { publishSite } from "./tools/publish-site.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
 import { runCatalogueCensus } from "./lib/catalogue-census.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
-import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, readHouseAdminUserIds, setManagingAdmin, findClientAccountsManagedBy, reassignManagingAdmin, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, } from "./tools/account-lifecycle.js";
+import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, isPlaceholderOwnerName, refuseClientAdminAdd, readHouseAdminUserIds, setManagingAdmin, findClientAccountsManagedBy, reassignManagingAdmin, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, } from "./tools/account-lifecycle.js";
 function refusalGuidance(kind) {
     switch (kind) {
         case "unsafe-slug":
@@ -53,6 +54,15 @@ const PLATFORM_ROOT = process.env.PLATFORM_ROOT ?? resolve(import.meta.dirname,
 // isolation in metadata-only mode.
 const ACCOUNT_ID = process.env.ACCOUNT_ID ?? null;
 process.stderr.write(`[admin] boot accountId=${ACCOUNT_ID ?? "null"}\n`);
+/** Task 1573 — the verified caller identity for credential tools: the session's
+ *  authenticated admin, carried as process.env.USER_ID, with empty treated as
+ *  "no verified identity". Post Task 1573 the rc-spawn env stamps this from the
+ *  authenticated admin (or empty), never the install owner via fallback, so a
+ *  credential tool can trust it as the operating identity. */
+function verifiedCaller() {
+    const u = process.env.USER_ID;
+    return u && u.length > 0 ? u : undefined;
+}
 function refuseNoAccount(toolName) {
     process.stderr.write(`[admin] tool=${toolName} refuse reason=no-account-context\n`);
     return {
@@ -866,8 +876,20 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
     if (!ACCOUNT_ID)
         return refuseNoAccount("admin-add");
     const TAG = "[admin]";
-    if (!name.trim()) {
-        return { content: [{ type: "text", text: `${TAG} Name is required.` }], isError: true };
+    // Task 1568 — a client sub-account carries one owner identity and no operator
+    // seats. Since Task 999 admin access is install-wide, so a seat here grants
+    // nothing (canAccessAdmin never reads admins[]). Refuse before any store
+    // write; the house account is where operators hold PIN logins and admins[].
+    const clientRefusal = refuseClientAdminAdd(isHouseAccount(ACCOUNTS_ROOT, ACCOUNT_ID), ACCOUNT_ID);
+    if (clientRefusal) {
+        process.stderr.write(`${clientRefusal.logLine}\n`);
+        return { content: [{ type: "text", text: `${TAG} ${clientRefusal.message}` }], isError: true };
+    }
+    // Task 1567 — the same name-required invariant as the owner-seat seeds: a
+    // blank name or the literal "Owner" placeholder is refused, never persisted.
+    if (isPlaceholderOwnerName(name)) {
+        process.stderr.write(`[admin-add] op=refused reason=no-name\n`);
+        return { content: [{ type: "text", text: `${TAG} A real name is required (it cannot be blank or the placeholder "Owner").` }], isError: true };
     }
     let users;
     try {
@@ -896,7 +918,7 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
         return { content: [{ type: "text", text: `${TAG} Unable to verify admin limit — cannot add admin.` }], isError: true };
     }
     // Resolve the calling user's identity from the session environment
-    const callerUserId = process.env.USER_ID;
+    const callerUserId = verifiedCaller(); // Task 1573 — empty USER_ID -> "unknown" actor, not ''
     // PIN: use provided or generate. Constraint: minimum 4 digits, no upper bound.
     let plaintextPin;
     if (rawPin) {
@@ -985,10 +1007,8 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
             // pruned silently, costing the admin pin during onboarding.
             const result = await session.run(`MERGE (au:AdminUser {userId: $userId})
            ON CREATE SET au.accountId = $accountId,
-                         au.name = $name,
                          au.createdAt = $createdAt
            ON MATCH SET au.accountId = COALESCE(au.accountId, $accountId),
-                        au.name = $name,
                         au.updatedAt = $createdAt
            WITH au
            MATCH (b:LocalBusiness {accountId: $accountId})
@@ -1019,21 +1039,22 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
              MERGE (au)-[:OWNS]->(newPerson)
              RETURN false AS reused
            }
-           RETURN reused`, { userId, name: trimmedName, createdAt, accountId: ACCOUNT_ID, givenName, familyName, personEmbedding });
+           RETURN reused`, { userId, createdAt, accountId: ACCOUNT_ID, givenName, familyName, personEmbedding });
             if (result.records.length > 0) {
                 personReused = result.records[0].get("reused");
             }
-            // post-write assertion mirroring the one in neo4j-store.ts.
-            // MATCH back the AdminUser we just wrote and verify every required
-            // field landed. Loud-fail the tool call if accountId or name is null
-            // so a Cypher regression that drops the field is grep-detectable.
+            // Task 1570 — post-write assertion on the canonical invariants: the
+            // AdminUser has its accountId, and an OWNS-Person in its own account with
+            // a non-empty givenName (the sole name source). A Cypher regression that
+            // drops the Person or its name is grep-detectable and loud-fails the tool.
             const verify = await session.run(`MATCH (au:AdminUser {userId: $userId})
+           OPTIONAL MATCH (au)-[:OWNS]->(p:Person) WHERE p.accountId = au.accountId
            RETURN coalesce(au.accountId, '') AS accountId,
-                  coalesce(au.name, '')      AS name`, { userId });
+                  coalesce(p.givenName, '')  AS givenName`, { userId });
             const verifiedAccountId = verify.records[0]?.get("accountId") || "";
-            const verifiedName = verify.records[0]?.get("name") || "";
-            if (!verifiedAccountId || !verifiedName) {
-                throw new Error(`post-write assertion failed: AdminUser userId=${userIdShort} accountId=${verifiedAccountId || "(null)"} name=${verifiedName || "(null)"} — required fields missing after MERGE`);
+            const verifiedGivenName = (verify.records[0]?.get("givenName") || "").trim();
+            if (!verifiedAccountId || !verifiedGivenName) {
+                throw new Error(`post-write assertion failed: AdminUser userId=${userIdShort} accountId=${verifiedAccountId || "(null)"} owned-Person givenName=${verifiedGivenName || "(null)"} — required fields missing after MERGE`);
             }
         }
         finally {
@@ -1067,7 +1088,7 @@ eagerTool(server, "admin-remove", "Remove an admin from this account. Removes th
     if (!ACCOUNT_ID)
         return refuseNoAccount("admin-remove");
     const TAG = "[admin]";
-    const callerUserId = process.env.USER_ID;
+    const callerUserId = verifiedCaller(); // Task 1573 — empty USER_ID -> "unknown" actor, not ''
     // Read account.json and validate
     let config;
     let admins;
@@ -1096,17 +1117,22 @@ eagerTool(server, "admin-remove", "Remove an admin from this account. Removes th
             return { content: [{ type: "text", text: `${TAG} Cannot remove ${userId}: they are the managing admin of ${managed.length} client sub-account(s): ${managed.join(", ")}. Reassign each to another house admin with account_reassign_admin, then retry.` }], isError: true };
         }
     }
-    // Resolve the admin's name from Neo4j (canonical) for the confirmation
-    // message. Best-effort — fall back to userId if the graph is unreachable.
+    // Resolve the admin's name from the owned Person (Task 1570 — the canonical
+    // and only name source, keyed on the AdminUser's own account) for the
+    // confirmation message. Best-effort — fall back to userId if the graph is
+    // unreachable or the owned Person is absent/nameless.
     let removedName = userId;
     try {
         const session = getSession();
         try {
-            const result = await session.run(`MATCH (au:AdminUser {userId: $userId}) RETURN au.name AS name LIMIT 1`, { userId });
+            const result = await session.run(`MATCH (au:AdminUser {userId: $userId})-[:OWNS]->(p:Person)
+           WHERE p.accountId = au.accountId
+           RETURN p.givenName AS givenName, p.familyName AS familyName LIMIT 1`, { userId });
             if (result.records.length > 0) {
-                const name = result.records[0].get("name");
-                if (name && name.trim())
-                    removedName = name.trim();
+                const givenName = result.records[0].get("givenName")?.trim() ?? "";
+                const familyName = result.records[0].get("familyName")?.trim() ?? "";
+                if (givenName)
+                    removedName = familyName ? `${givenName} ${familyName}` : givenName;
             }
         }
         finally {
@@ -1166,20 +1192,23 @@ eagerTool(server, "admin-list", "List all admins for this account with their nam
     if (admins.length === 0) {
         return { content: [{ type: "text", text: `${TAG} No admins configured for this account.` }] };
     }
-    // Enrich with names from Neo4j AdminUser (canonical). Best
-    // effort — render "(unknown)" for any userId without a graph entry.
+    // Enrich with names from each admin's owned Person (Task 1570 — the
+    // canonical and only name source, keyed on the AdminUser's own account).
+    // Best effort — render "(unknown)" for any userId with no named owned Person.
     const userMap = new Map();
     try {
         const session = getSession();
         try {
             const result = await session.run(`UNWIND $userIds AS uid
-           MATCH (au:AdminUser {userId: uid})
-           RETURN au.userId AS userId, au.name AS name`, { userIds: admins.map(a => a.userId) });
+           MATCH (au:AdminUser {userId: uid})-[:OWNS]->(p:Person)
+           WHERE p.accountId = au.accountId
+           RETURN uid AS userId, p.givenName AS givenName, p.familyName AS familyName`, { userIds: admins.map(a => a.userId) });
             for (const record of result.records) {
                 const uid = record.get("userId");
-                const name = record.get("name");
-                if (name && name.trim())
-                    userMap.set(uid, name.trim());
+                const givenName = record.get("givenName")?.trim() ?? "";
+                const familyName = record.get("familyName")?.trim() ?? "";
+                if (givenName)
+                    userMap.set(uid, familyName ? `${givenName} ${familyName}` : givenName);
             }
         }
         finally {
@@ -1198,17 +1227,21 @@ eagerTool(server, "admin-list", "List all admins for this account with their nam
 eagerTool(server, "admin-update-pin", "Update an existing admin user's PIN. Defaults to the calling admin if no userId is given. PIN must be at least 4 digits and unique across all users on the device. PINs are device-level: updating another admin's PIN does not require shared account membership — any admin on the device can rotate any other admin's PIN, matching the existing trust model used by admin-remove.", {
     userId: z.string().optional().describe("The userId of the admin whose PIN to update. Defaults to the caller (the admin invoking this tool)."),
     newPin: z.string().describe("The new PIN. Minimum 4 digits, no upper bound."),
-}, async ({ userId: targetUserId, newPin }) => {
+    confirm: z.boolean().optional().describe("Required (true) only when userId names a DIFFERENT admin than the caller — confirms a deliberate cross-identity PIN change."),
+}, async ({ userId: targetUserId, newPin, confirm }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("admin-update-pin");
     const TAG = "[admin-update-pin]";
-    const callerUserId = process.env.USER_ID;
-    const userId = targetUserId ?? callerUserId;
-    const userIdLabel = userId ? userId.slice(0, 8) : "unknown";
-    if (!userId) {
-        console.error(`${TAG} userId=${userIdLabel} result=user-not-found reason=no-caller-context`);
-        return { content: [{ type: "text", text: `${TAG} No userId supplied and no caller context — cannot update.` }], isError: true };
-    }
+    const callerUserId = verifiedCaller();
+    // Task 1573 — no ambient owner fallback. Self resolves to the verified
+    // caller; a cross-identity write needs an explicit userId + confirm.
+    const resolved = resolveCredentialTarget({ explicitUserId: targetUserId, callerUserId, confirm });
+    if (!resolved.ok) {
+        console.error(`${TAG} result=refused reason=${resolved.error.split(":")[0]}`);
+        return { content: [{ type: "text", text: `${TAG} ${resolved.error}` }], isError: true };
+    }
+    const userId = resolved.target;
+    const userIdLabel = userId.slice(0, 8);
     if (newPin.length < 4) {
         console.error(`${TAG} userId=${userIdLabel} result=too-short`);
         return { content: [{ type: "text", text: `${TAG} PIN must be at least 4 digits.` }], isError: true };
@@ -1252,7 +1285,7 @@ eagerTool(server, "admin-update-pin", "Update an existing admin user's PIN. Defa
     // (a pin rotation); the audited field is the pin.
     {
         const rows = formatAuditRowIds(users.map(u => u.userId));
-        logUsersAudit({ actor: callerUserId ?? "unknown", session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG }, { action: "set-pin", field: "pin", rowsBefore: rows, rowsAfter: rows });
+        logUsersAudit({ actor: callerUserId ?? "unknown", target: userId, explicitUserId: resolved.isCrossIdentity, session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG }, { action: "set-pin", field: "pin", rowsBefore: rows, rowsAfter: rows });
     }
     const self = userId === callerUserId;
     return {
@@ -2113,13 +2146,18 @@ lifelineTool(server, "remote-auth-set-password", "Set an admin's remote access p
     "Protects the admin interface when exposed over the tunnel — has no effect on the public endpoint or the tunnel itself.", {
     password: z.string(),
     userId: z.string().optional().describe("The admin to set the password for. Defaults to the calling admin. Use admin-list to find userIds."),
-}, async ({ password, userId }) => {
+    confirm: z.boolean().optional().describe("Required (true) only when userId names a DIFFERENT admin than the caller — confirms a deliberate cross-identity password change."),
+}, async ({ password, userId, confirm }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("remote-auth-set-password");
-    const targetUserId = userId ?? process.env.USER_ID;
-    if (!targetUserId) {
-        return { content: [{ type: "text", text: "No target admin: pass userId, or run as an identified admin." }], isError: true };
-    }
+    const callerUserId = verifiedCaller();
+    // Task 1573 — no ambient owner fallback. Self resolves to the verified
+    // caller; a cross-identity write needs an explicit userId + confirm.
+    const resolved = resolveCredentialTarget({ explicitUserId: userId, callerUserId, confirm });
+    if (!resolved.ok) {
+        return { content: [{ type: "text", text: resolved.error }], isError: true };
+    }
+    const targetUserId = resolved.target;
     let users;
     try {
         users = readUsersJson();
@@ -2148,8 +2186,8 @@ lifelineTool(server, "remote-auth-set-password", "Set an admin's remote access p
         return { content: [{ type: "text", text: `That password is already in use by another admin. Choose a different one.` }], isError: true };
     }
     try {
-        await setAccessPasswordHash(targetUserId, password, USERS_FILE, { actor: process.env.USER_ID ?? "unknown", session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG });
-        console.error(`[admin] remote-access-password set userId=${targetUserId.slice(0, 8)}`);
+        await setAccessPasswordHash(targetUserId, password, USERS_FILE, { actor: callerUserId ?? "unknown", target: targetUserId, explicitUserId: resolved.isCrossIdentity, session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG });
+        console.error(`[admin] remote-access-password set userId=${targetUserId.slice(0, 8)} actor=${(callerUserId ?? "unknown").slice(0, 8)} explicitUserId=${resolved.isCrossIdentity}`);
         return { content: [{ type: "text", text: `Remote access password set for userId ${targetUserId}.` }] };
     }
     catch (err) {
@@ -2160,9 +2198,17 @@ lifelineTool(server, "remote-auth-set-password", "Set an admin's remote access p
     }
 });
 lifelineTool(server, "remote-auth-revoke-password", "Revoke an admin's remote access password so they can no longer obtain a NEW remote session (an already-open session lapses within 24h). " +
-    "Does not affect any other admin's password and does not touch their PIN. Pass userId (from admin-list).", { userId: z.string().describe("The admin whose remote access password to revoke. Use admin-list to find userIds.") }, async ({ userId }) => {
+    "Does not affect any other admin's password and does not touch their PIN. Pass userId (from admin-list).", { userId: z.string().describe("The admin whose remote access password to revoke. Use admin-list to find userIds."),
+    confirm: z.boolean().optional().describe("Required (true) when userId names a DIFFERENT admin than the caller — confirms a deliberate cross-identity revoke.") }, async ({ userId, confirm }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("remote-auth-revoke-password");
+    const callerUserId = verifiedCaller();
+    // Task 1573 — actor is the verified caller, never ambient env; a revoke of
+    // another admin's password is a cross-identity write needing confirm.
+    const resolved = resolveCredentialTarget({ explicitUserId: userId, callerUserId, confirm });
+    if (!resolved.ok) {
+        return { content: [{ type: "text", text: resolved.error }], isError: true };
+    }
     let users;
     try {
         users = readUsersJson();
@@ -2182,8 +2228,8 @@ lifelineTool(server, "remote-auth-revoke-password", "Revoke an admin's remote ac
         return { content: [{ type: "text", text: "Refusing to revoke the last remaining remote access password — the install would have no remote access. Set another admin's password first." }], isError: true };
     }
     try {
-        clearAccessPasswordHash(userId, USERS_FILE, { actor: process.env.USER_ID ?? "unknown", session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG });
-        console.error(`[admin] remote-access-password revoked userId=${userId.slice(0, 8)}`);
+        clearAccessPasswordHash(userId, USERS_FILE, { actor: callerUserId ?? "unknown", target: userId, explicitUserId: resolved.isCrossIdentity, session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG });
+        console.error(`[admin] remote-access-password revoked userId=${userId.slice(0, 8)} actor=${(callerUserId ?? "unknown").slice(0, 8)} explicitUserId=${resolved.isCrossIdentity}`);
         return { content: [{ type: "text", text: `Remote access password revoked for userId ${userId}.` }] };
     }
     catch (err) {
@@ -3267,9 +3313,10 @@ eagerTool(server, "account_list", "List every sub-account on this install (one h
         content: [{ type: "text", text: accounts.length ? lines.join("\n") : "No accounts found." }],
     };
 });
-eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). REQUIRES a managing admin: pass `adminUserId`, the userId of the house team member who will manage this client (get the choices from admin-list; ask the operator which one before creating). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\" and managingAdminUserId), seeds default plugins, and seeds the account's graph root (a :LocalBusiness plus its owner :AdminUser) so you can populate it immediately. Refuses if no adminUserId is given or if it is not a current house admin. Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {
+eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). REQUIRES two things: `adminUserId`, the userId of the house team member who will manage this client (get the choices from admin-list; ask the operator which one before creating); and `ownerName`, the real name of the client business's owner (ask the operator for it — never invent it or reuse the house operator's name). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\" and managingAdminUserId), seeds default plugins, and seeds the account's graph root (a :LocalBusiness plus its owner :AdminUser and owner :Person carrying ownerName) so you can populate it immediately. Refuses if adminUserId is missing/not a house admin, or if ownerName is missing/blank/the placeholder \"Owner\". Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {
     adminUserId: z.string().describe("The userId of the house admin who will manage this client sub-account. Must be a current house admin (see admin-list). Required — creation is refused without it."),
-}, async ({ adminUserId }) => {
+    ownerName: z.string().describe("The real name of the client business's owner. Applied to both the owner AdminUser and owner Person for the new sub-account. Required — creation is refused when missing, blank, or the placeholder \"Owner\". Ask the operator; never reuse the house operator's name."),
+}, async ({ adminUserId, ownerName }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("account_create");
     // Task 1500 — every client sub-account must carry a responsible house admin.
@@ -3279,6 +3326,14 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         process.stderr.write(`[account-lifecycle] op=create-refused reason=no-admin adminUserId=-\n`);
         return { content: [{ type: "text", text: `account_create refused: name the managing house admin (adminUserId). Call admin-list to see the choices and ask the operator which one manages this client.` }], isError: true };
     }
+    // Task 1567 — the business owner's name is a hard precondition of the
+    // sub-account. Refuse before any scaffold so a nameless create leaves no
+    // partial account directory or rootless graph behind. The same predicate
+    // guards the seed (seedAccountGraphRoot) as a defence in depth.
+    if (isPlaceholderOwnerName(ownerName)) {
+        process.stderr.write(`[account-create] op=refused reason=no-owner-name\n`);
+        return { content: [{ type: "text", text: `account_create refused: give the client business owner's real name (ownerName). It cannot be blank or the placeholder "Owner". Ask the operator whose business this is.` }], isError: true };
+    }
     const houseAdminUserIds = readHouseAdminUserIds(ACCOUNTS_ROOT);
     if (!houseAdminUserIds.includes(adminUserId)) {
         process.stderr.write(`[account-lifecycle] op=create-refused reason=unknown-admin adminUserId=${adminUserId.slice(0, 8)}\n`);
@@ -3305,13 +3360,11 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         // MERGE-keyed on its own userId at accountId=house, so reusing it would
         // leave the client's account-scoped AdminUser MATCH empty.
         const ownerUserId = randomUUID();
-        let ownerName = "Owner";
-        try {
-            const users = JSON.parse(readFileSync(USERS_FILE, "utf-8"));
-            if (Array.isArray(users) && typeof users[0]?.name === "string")
-                ownerName = users[0].name;
-        }
-        catch { /* no users.json — default "Owner" */ }
+        // Task 1567 — ownerName is the validated business-owner name from the tool
+        // input (refused above if blank/placeholder). It is applied to both the
+        // owner AdminUser and the owner Person in seedAccountGraphRoot. It is never
+        // derived from the house operator's users.json — that seeded the wrong
+        // person's name and defaulted to the "Owner" placeholder.
         const seedSession = getSession();
         let rootSeeded = false;
         try {