@rubytech/create-maxy-code 0.1.444 → 0.1.446

package/payload/platform/lib/storage-broker/src/cf-exec.ts

@@ -0,0 +1,73 @@
+// The only place the account-wide Cloudflare credential is used to touch
+// Cloudflare. Every method injects the house token into the child env and shells
+// wrangler. `run` is injectable so the wiring is unit-testable without wrangler.
+
+import { execFile } from "node:child_process";
+import type { HouseCredential } from "./house-credential.js";
+
+export type RunFn = (
+  cmd: string,
+  args: string[],
+  env: Record<string, string>,
+) => Promise<{ stdout: string }>;
+
+export interface CfExec {
+  d1List(): Promise<{ name: string; uuid: string }[]>;
+  d1Create(name: string): Promise<{ uuid: string }>;
+  d1Query(name: string, sql: string): Promise<unknown>;
+  r2List(): Promise<{ name: string }[]>;
+  r2Create(name: string): Promise<void>;
+}
+
+const defaultRun: RunFn = (cmd, args, env) =>
+  new Promise((resolve, reject) => {
+    execFile(cmd, args, { env }, (err, stdout, stderr) => {
+      if (err) {
+        reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}\n${stderr}`));
+        return;
+      }
+      resolve({ stdout: stdout.toString() });
+    });
+  });
+
+function parseJson(raw: string, context: string): unknown {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`storage-broker: ${context} returned non-JSON output: ${raw}`);
+  }
+}
+
+export function makeCfExec(cred: HouseCredential, run: RunFn = defaultRun): CfExec {
+  const env = {
+    ...process.env,
+    CLOUDFLARE_API_TOKEN: cred.apiToken,
+    CLOUDFLARE_ACCOUNT_ID: cred.accountId,
+  } as Record<string, string>;
+
+  return {
+    async d1List() {
+      const { stdout } = await run("wrangler", ["d1", "list", "--json"], env);
+      return parseJson(stdout, "d1 list") as { name: string; uuid: string }[];
+    },
+    async d1Create(name) {
+      const { stdout } = await run("wrangler", ["d1", "create", name, "--json"], env);
+      return parseJson(stdout, "d1 create") as { uuid: string };
+    },
+    async d1Query(name, sql) {
+      const { stdout } = await run(
+        "wrangler",
+        ["d1", "execute", name, "--remote", "--json", "--command", sql],
+        env,
+      );
+      return parseJson(stdout, "d1 execute");
+    },
+    async r2List() {
+      const { stdout } = await run("wrangler", ["r2", "bucket", "list", "--json"], env);
+      return parseJson(stdout, "r2 bucket list") as { name: string }[];
+    },
+    async r2Create(name) {
+      await run("wrangler", ["r2", "bucket", "create", name], env);
+    },
+  };
+}

package/payload/platform/lib/storage-broker/src/house-credential.ts

@@ -0,0 +1,32 @@
+// Reads the single account-wide Cloudflare credential from the house-only
+// config directory. This file is the one place the account-wide capability
+// lives; sub-account spawns never source it. Parses KEY=value lines without
+// polluting process.env (same discipline as reconcile-bookings' readEnvFile).
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export interface HouseCredential {
+  apiToken: string;
+  accountId: string;
+}
+
+export function readHouseCredential(platformRoot: string): HouseCredential {
+  const path = join(platformRoot, "config", "cloudflare-house.env");
+  let raw: string;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    throw new Error(`storage-broker: house credential not found at ${path}`);
+  }
+  const env: Record<string, string> = {};
+  for (const line of raw.split("\n")) {
+    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (m) env[m[1]] = m[2].trim();
+  }
+  const apiToken = env.CLOUDFLARE_API_TOKEN;
+  const accountId = env.CLOUDFLARE_ACCOUNT_ID;
+  if (!apiToken) throw new Error(`storage-broker: CLOUDFLARE_API_TOKEN missing in ${path}`);
+  if (!accountId) throw new Error(`storage-broker: CLOUDFLARE_ACCOUNT_ID missing in ${path}`);
+  return { apiToken, accountId };
+}

package/payload/platform/lib/storage-broker/src/index.ts

@@ -0,0 +1,14 @@
+// storage-broker: the per-account Cloudflare D1/R2 isolation core.
+//
+// The lib is pure and dependency-free at runtime: it opens no Neo4j connection
+// and shells no process on its own. Consumers inject a SessionLike (the ui
+// route uses neo4j-store's getSession; the remediation entry opens its own
+// driver) and, for cf-exec, a RunFn. That keeps every unit testable in
+// isolation and the isolation logic auditable in one place.
+
+export * from "./authorize.js";
+export * from "./registry.js";
+export * from "./house-credential.js";
+export * from "./cf-exec.js";
+export * from "./audit.js";
+export * from "./remediate.js";

package/payload/platform/lib/storage-broker/src/registry.ts

@@ -0,0 +1,85 @@
+// The ownership registry: which account owns which Cloudflare storage resource.
+//
+// Written with raw cypher MERGE stamped with system provenance, mirroring the
+// house-level seedAccountGraphRoot path in the admin plugin. It deliberately
+// does NOT go through graph-write's writeNodeWithEdges: that primitive's
+// accountId floor rejects a write whose props.accountId differs from the
+// writer process's ACCOUNT_ID, and the broker runs house-level, writing nodes
+// owned by many different sub-accounts. The owning accountId here is always the
+// trusted header value the service resolved, never an agent argument.
+
+// A minimal shape of a neo4j-driver Session, so this lib carries no runtime or
+// type dependency on neo4j-driver (mirrors the SeedSessionLike pattern used in
+// platform/plugins/admin/mcp/src/tools/account-lifecycle.ts).
+// Uses PromiseLike (not Promise) and get(): any so that a real neo4j-driver
+// Session — whose run() returns a Result (a PromiseLike, and whose records are
+// driver Records) — is structurally assignable under both v5 and v6 without a
+// cast at the call site.
+export interface SessionLike {
+  run(
+    cypher: string,
+    params?: Record<string, unknown>,
+  ): PromiseLike<{ records: Array<{ get(key: string): any }> }>;
+}
+
+export type ResourceKind = "d1" | "r2";
+
+export interface StorageResource {
+  accountId: string;
+  kind: ResourceKind;
+  name: string;
+  cfResourceId: string;
+}
+
+export async function registerResource(
+  session: SessionLike,
+  r: StorageResource,
+): Promise<void> {
+  // MERGE on (kind, name) — the ownership key. On a shared Cloudflare account a
+  // storage name maps to exactly one owner, so the write key must match the
+  // resolveOwner lookup key; keying on accountId too would let two accounts hold
+  // a node for the same name and make ownership ambiguous. accountId is set only
+  // ON CREATE and never overwritten ON MATCH, so a register can never silently
+  // reassign an existing resource to a different account.
+  await session.run(
+    `MERGE (r:StorageResource {kind: $kind, name: $name})
+       ON CREATE SET r.accountId = $accountId,
+                     r.createdByAgent = 'system',
+                     r.createdBySource = 'storage-broker',
+                     r.cfResourceId = $cfResourceId
+       ON MATCH SET  r.cfResourceId = $cfResourceId`,
+    { accountId: r.accountId, kind: r.kind, name: r.name, cfResourceId: r.cfResourceId },
+  );
+}
+
+export async function resolveOwner(
+  session: SessionLike,
+  kind: ResourceKind,
+  name: string,
+): Promise<string | null> {
+  const res = await session.run(
+    `MATCH (r:StorageResource {kind: $kind, name: $name})
+       RETURN r.accountId AS accountId LIMIT 1`,
+    { kind, name },
+  );
+  return res.records.length ? (res.records[0].get("accountId") as string) : null;
+}
+
+export async function listResources(
+  session: SessionLike,
+  accountId: string,
+  kind: ResourceKind,
+): Promise<StorageResource[]> {
+  const res = await session.run(
+    `MATCH (r:StorageResource {accountId: $accountId, kind: $kind})
+       RETURN r.name AS name, r.cfResourceId AS cfResourceId
+       ORDER BY r.name`,
+    { accountId, kind },
+  );
+  return res.records.map((rec) => ({
+    accountId,
+    kind,
+    name: rec.get("name") as string,
+    cfResourceId: rec.get("cfResourceId") as string,
+  }));
+}

package/payload/platform/lib/storage-broker/src/remediate.ts

@@ -0,0 +1,31 @@
+// The testable core of the operator-run remediation. The mapping from existing
+// resource name to owning account is operator-authored, and validation fails
+// closed on any resource absent from it: ownership is a recorded fact, never a
+// name-prefix guess. Token stripping removes every account-wide credential from
+// a sub-account secrets file while preserving everything else verbatim.
+
+export interface MappingResult {
+  ok: boolean;
+  missing: string[];
+}
+
+// Account-wide credentials stripped from a sub-account's cloudflare.env.
+// CLOUDFLARE_ACCOUNT_ID is intentionally kept: it is an identifier, not a
+// credential, and does not grant access on its own.
+const STRIP_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
+
+export function validateMapping(
+  enumerated: string[],
+  mapping: Record<string, string>,
+): MappingResult {
+  const missing = enumerated.filter((name) => !(name in mapping));
+  return { ok: missing.length === 0, missing };
+}
+
+export function stripAccountWideTokens(contents: string): string {
+  const kept = contents.split("\n").filter((line) => {
+    const key = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/)?.[1];
+    return !(key && STRIP_KEYS.includes(key));
+  });
+  return kept.join("\n");
+}

package/payload/platform/lib/storage-broker/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}

package/payload/platform/package.json

@@ -6,8 +6,8 @@
     "services/*"
   ],
   "scripts": {
-    "build": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
-    "build:lib": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json",
+    "build": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
+    "build:lib": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json",
     "gen:canonical-tools": "node scripts/generate-canonical-tool-names.mjs",
     "build:memory": "tsc -p plugins/memory/mcp/tsconfig.json",
     "build:contacts": "tsc -p plugins/contacts/mcp/tsconfig.json",

package/payload/platform/plugins/.claude-plugin/marketplace.json

@@ -134,6 +134,11 @@
       "source": "./slides",
       "version": "0.1.0"
     },
+    {
+      "name": "storage-broker",
+      "source": "./storage-broker",
+      "version": "0.1.0"
+    },
     {
       "name": "substack-import",
       "source": "./substack-import",

package/payload/platform/plugins/admin/hooks/lib/maxy-mcp-plugins.txt

@@ -13,6 +13,7 @@ outlook
 quickbooks
 replicate
 scheduling
+storage-broker
 telegram
 url-get
 whatsapp

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -28,7 +28,7 @@ import { publishSite } from "./tools/publish-site.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
 import { runCatalogueCensus } from "./lib/catalogue-census.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
-import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, isPlaceholderOwnerName, refuseClientAdminAdd, readHouseAdminUserIds, setManagingAdmin, findClientAccountsManagedBy, reassignManagingAdmin, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, classifyManagingAdmin, ownerNameStatus, readManagingAdminUserId, setOwnerName, } from "./tools/account-lifecycle.js";
+import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, isPlaceholderOwnerName, isBlankBusinessName, refuseClientAdminAdd, readHouseAdminUserIds, setManagingAdmin, findClientAccountsManagedBy, reassignManagingAdmin, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, classifyManagingAdmin, ownerNameStatus, readManagingAdminUserId, setOwnerName, } from "./tools/account-lifecycle.js";
 function refusalGuidance(kind) {
     switch (kind) {
         case "unsafe-slug":
@@ -3416,10 +3416,11 @@ eagerTool(server, "account_roster", "Canonical per-account identity roster for t
     process.stderr.write(`${TAG} op=roster accounts=${accounts.length} nameless-owners=${namelessOwners} absent-mgr=${absentMgr} dangling-mgr=${danglingMgr}\n`);
     return { content: [{ type: "text", text: accounts.length ? `Account roster:\n\n${lines.join("\n")}` : "No accounts found." }] };
 });
-eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). REQUIRES `ownerName`, the real name of the client business's owner (ask the operator for it — never invent it or reuse the house operator's name). OPTIONALLY takes `adminUserId`, the userId of the house team member who will manage this client (get the choices from admin-list; ask the operator, but omit it if the client is run by its owner rather than a house admin). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\", and managingAdminUserId when an admin is named), seeds default plugins, and seeds the account's graph root (a :LocalBusiness plus its owner :AdminUser and owner :Person carrying ownerName) so you can populate it immediately. Refuses if ownerName is missing/blank/the placeholder \"Owner\", or if a supplied adminUserId is not a current house admin. When no managing admin is set, that account's passive-intake tasks route to the install's primary admin. Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {
+eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). REQUIRES `businessName`, the real name of the client business itself, and `ownerName`, the real name of the client business's owner (ask the operator for both — never invent them or reuse the house operator's name). OPTIONALLY takes `adminUserId`, the userId of the house team member who will manage this client (get the choices from admin-list; ask the operator, but omit it if the client is run by its owner rather than a house admin). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\", and managingAdminUserId when an admin is named), seeds default plugins, and seeds the account's graph root (a :LocalBusiness carrying businessName plus its owner :AdminUser and owner :Person carrying ownerName) so you can populate it immediately and the sub-account picker shows the business name at once. Refuses if businessName is missing/blank, if ownerName is missing/blank/the placeholder \"Owner\", or if a supplied adminUserId is not a current house admin. When no managing admin is set, that account's passive-intake tasks route to the install's primary admin. Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {
     adminUserId: z.string().optional().describe("The userId of the house admin who will manage this client sub-account. Optional — omit it for a client run by its owner rather than a house admin (its passive-intake tasks then route to the install's primary admin). When supplied, it must be a current house admin (see admin-list) or creation is refused."),
+    businessName: z.string().describe("The real name of the client business itself. Written onto the new sub-account's :LocalBusiness so the sub-account picker/header shows it immediately. Required — creation is refused when missing or blank. Ask the operator for the client's real business name; never invent it."),
     ownerName: z.string().describe("The real name of the client business's owner. Applied to both the owner AdminUser and owner Person for the new sub-account. Required — creation is refused when missing, blank, or the placeholder \"Owner\". Ask the operator; never reuse the house operator's name."),
-}, async ({ adminUserId, ownerName }) => {
+}, async ({ adminUserId, businessName, ownerName }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("account_create");
     // Task 1630 — a managing admin is optional. `adminUserId` omitted/blank ⇒ the
@@ -3436,6 +3437,14 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         process.stderr.write(`[account-create] op=refused reason=no-owner-name\n`);
         return { content: [{ type: "text", text: `account_create refused: give the client business owner's real name (ownerName). It cannot be blank or the placeholder "Owner". Ask the operator whose business this is.` }], isError: true };
     }
+    // Task 1647 — the client business's own name is an equal hard precondition,
+    // refused before any scaffold so a nameless create leaves no partial account
+    // directory or rootless graph behind. The same predicate guards the seed
+    // (seedAccountGraphRoot) as defence in depth.
+    if (isBlankBusinessName(businessName)) {
+        process.stderr.write(`[account-create] op=refused reason=no-business-name\n`);
+        return { content: [{ type: "text", text: `account_create refused: give the client business's real name (businessName). It cannot be blank. Ask the operator what the client business is called.` }], isError: true };
+    }
     if (managingAdminUserId && !readHouseAdminUserIds(ACCOUNTS_ROOT).includes(managingAdminUserId)) {
         process.stderr.write(`[account-lifecycle] op=create-refused reason=unknown-admin adminUserId=${managingAdminUserId.slice(0, 8)}\n`);
         return { content: [{ type: "text", text: `account_create refused: ${managingAdminUserId} is not a current house admin. Call admin-list for the valid managing-admin choices, or omit adminUserId to leave the client unmanaged.` }], isError: true };
@@ -3474,6 +3483,7 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
                 accountId: newId,
                 ownerUserId,
                 ownerName,
+                businessName,
                 createdAt: new Date().toISOString(),
             });
             rootSeeded = businessSeeded && adminSeeded;