@rubytech/create-maxy-code 0.1.437 → 0.1.439

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -30,6 +30,7 @@ import { mergeTarget, isMultiTarget, targetKinds } from './channel-targets.js';
 import { randomUUID, createHash } from 'node:crypto';
 import { execFile, execFileSync } from 'node:child_process';
 import { buildRcChildEnv, reapplyAdminLevers } from './rc-daemon.js';
+import { resolveSpawnUserId, formatMcpUserBindingLine } from './mcp-user-binding.js';
 import { runConnectorAuthLogin } from './connector-auth.js';
 import { isEffortLevel, isNewSessionEffortLevel, isPermissionMode, SONNET_MODEL } from '../../../lib/models/dist/index.js';
 import { spawnClaudeSession, stopSession, writeInterruptToPty, isLive, onPtyExit, livePtyCount, liveSessionIds, getPtyTrackerForTests, livePidForSession, classifyLiveness, priorExitedCountForSession, PERMISSION_MODES, openFdCount, registerRcSpawnPty, } from './pty-spawner.js';
@@ -2292,8 +2293,10 @@ export function buildHttpApp(deps) {
             : undefined;
         // Task 682 — per-session userId override. Server-resolved by the UI from the
         // authoritative users.json/account.json (never message content) and shape-
-        // validated here the same way as personId. Absent for owner self-phone and
-        // any unbound sender, where the boot-time deps.userId (owner) is used.
+        // validated here the same way as personId. Task 1573 — absent for owner
+        // self-phone and any unbound sender; USER_ID is then the authenticated
+        // adminUserId when present, else empty. The boot owner is no longer a
+        // fallback at this layer (see resolveSpawnUserId).
         const overrideUserId = typeof body.userId === 'string' && body.userId.length > 0 && body.userId.length <= 128
             ? body.userId
             : undefined;
@@ -2840,9 +2843,12 @@ export function buildHttpApp(deps) {
             }
             deps.logger(`[rc-spawn] op=voice-injected bytes=${voiceBytes}`);
         }
+        // Task 1573 — the authenticated admin identity, resolved from the body
+        // (validated PIN session) or the persisted sidecar. This, not the
+        // owner-defaulting overrideUserId, is the source of the child USER_ID.
+        const resolvedAdminUserId = adminUserId ?? priorSidecar?.adminUserId ?? null;
         if (effectiveWebchatChannel && adminBinding) {
             const resolvedName = authenticatedName ?? priorSidecar?.authenticatedName ?? null;
-            const resolvedAdminUserId = adminUserId ?? priorSidecar?.adminUserId ?? null;
             // `source` follows where the resolved name actually came from. When no
             // name resolves (resolved=0) it reports which signal marked the session
             // admin: the caller's body role, else the persisted sidecar.
@@ -2888,12 +2894,22 @@ export function buildHttpApp(deps) {
             acctIsHouse,
             inject: rcHouseAdminScope !== null,
         }));
+        // Task 1573 — stamp USER_ID from the authenticated admin identity, never
+        // the owner via `deps.userId`. An authenticated non-owner session whose body
+        // omitted `userId` used to fall back to the owner, so its admin MCP inherited
+        // the owner's USER_ID and rewrote the owner's credential row. Empty (no admin
+        // identity, unbound sender) is a documented-legal USER_ID. The reconciliation
+        // line compares the two independent identity signals (authenticated adminUserId
+        // vs server-resolved overrideUserId) and records the stamped USER_ID, so a
+        // future disagreement is greppable at spawn time.
+        const childUserId = resolveSpawnUserId({ resolvedAdminUserId, overrideUserId });
+        deps.logger(formatMcpUserBindingLine({ authenticatedAdmin: resolvedAdminUserId, resolvedOverride: overrideUserId, stampedUserId: childUserId }));
         // Task 606 — thread the validated per-session sessionId (fresh and resume
         // share the one var) so session-linked writes resolve SESSION_ID; logDir
         // so the child's MCP stderr-tee writes its readable per-server log.
         const env = buildRcChildEnv({
             accountId: effectiveAccountId,
-            userId: overrideUserId ?? deps.userId,
+            userId: childUserId,
             sessionId: sessionId ?? undefined,
             uiPort: process.env.MAXY_UI_INTERNAL_PORT ?? '',
             platformRoot: deps.platformRoot,