@rubytech/create-maxy-code 0.1.535 → 0.1.537

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -22,10 +22,12 @@ import { Hono } from 'hono';
 import { stream } from 'hono/streaming';
 import { existsSync, statSync, createReadStream, watchFile, unwatchFile, rmSync, mkdirSync, renameSync, readFileSync, writeFileSync, appendFileSync, openSync, readSync, closeSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { buildWaChannelMcpServers, buildWaChannelArgv, waChannelMcpConfigPath, isDevChannelPrompt } from './wa-channel-mcp.js';
-import { buildWebchatChannelMcpServers, buildWebchatChannelArgv, webchatChannelMcpConfigPath } from './webchat-channel-mcp.js';
-import { buildTelegramChannelMcpServers, buildTelegramChannelArgv, telegramChannelMcpConfigPath } from './telegram-channel-mcp.js';
-import { buildChannelMcpServers, buildChannelArgv, channelMcpConfigPath } from './channel-mcp.js';
+import { buildWaChannelMcpServers, buildWaChannelArgv, waChannelMcpConfigPath, isDevChannelPrompt, WA_CHANNEL_SERVER_NAME } from './wa-channel-mcp.js';
+import { parseWaChannelBody, sessionIdFieldsFor } from './public-spawn-session.js';
+import { buildWebchatChannelMcpServers, buildWebchatChannelArgv, webchatChannelMcpConfigPath, WEBCHAT_CHANNEL_SERVER_NAME } from './webchat-channel-mcp.js';
+import { buildTelegramChannelMcpServers, buildTelegramChannelArgv, telegramChannelMcpConfigPath, TELEGRAM_CHANNEL_SERVER_NAME } from './telegram-channel-mcp.js';
+import { buildChannelMcpServers, buildChannelArgv, channelMcpConfigPath, CHANNEL_SERVER_NAME } from './channel-mcp.js';
+import { buildRcPublicLockdownArgv, formatToolAllowlistLine } from './rc-public-lockdown.js';
 import { mergeTarget, isMultiTarget, targetKinds } from './channel-targets.js';
 import { randomUUID, createHash } from 'node:crypto';
 import { execFile, execFileSync } from 'node:child_process';
@@ -615,10 +617,15 @@ export function attachPassiveSpawnToolsCensus(deps, spawnCwd, sessionId, passive
     if (!onPtyExit(sessionId, emit))
         emit();
 }
-function attachPublicAudit(deps, sessionId, role) {
+/** Task 2271 — `cwd` is the session's OWN working directory, required rather
+ *  than defaulted to `deps.spawnCwd`: a re-scoped public spawn writes its
+ *  transcript under its own account's project slug, and a path built from the
+ *  boot house directory finds nothing, so the audit silently never attaches and
+ *  the only per-call record of what a stranger's session did goes dark. */
+function attachPublicAudit(deps, sessionId, role, cwd) {
     if (role !== 'public')
         return;
-    const jsonlPath = jsonlPathForSessionId(deps.spawnCwd, sessionId);
+    const jsonlPath = jsonlPathForSessionId(cwd, sessionId);
     if (!existsSync(jsonlPath))
         return;
     deps.publicToolAudit.attach(sessionId, jsonlPath);
@@ -777,7 +784,9 @@ export function buildHttpApp(deps) {
             return;
         if (!isLive(event.sessionId))
             return;
-        attachPublicAudit(deps, event.sessionId, event.row.role);
+        // Task 2271 — the row carries the session's own cwd (read from claude's PID
+        // file); the boot cwd is the fallback for a PID file that names none.
+        attachPublicAudit(deps, event.sessionId, event.row.role, event.row.cwd ?? deps.spawnCwd);
         attachPublicExitNotify(event.sessionId, event.row.role, deps.logger);
     });
     // Task 183 — dispatch jsonl modify/create events into the recorder
@@ -1054,6 +1063,25 @@ export function buildHttpApp(deps) {
         const targetAccountId = typeof body.targetAccountId === 'string' && /^[A-Za-z0-9_-]{1,64}$/.test(body.targetAccountId)
             ? body.targetAccountId
             : undefined;
+        // Task 2271 — the account whose agent directory, working directory and
+        // session scope this spawn must use. Distinct from `targetAccountId`, which
+        // the passive branch owns with different semantics, and from `accountId`,
+        // which every caller sends. Only a caller that resolved the agent slug from
+        // this account's own configuration sets it, so the webchat public path —
+        // whose spawns default to `agents/public`, a directory provisioning never
+        // creates on a sub-account — is untouched.
+        const agentAccountId = typeof body.agentAccountId === 'string' && /^[A-Za-z0-9_-]{1,64}$/.test(body.agentAccountId)
+            ? body.agentAccountId
+            : undefined;
+        // Fail closed on an unregistered target, exactly as /rc-spawn does
+        // (Task 983): a silent fall-through to the house would spawn the house's
+        // agent in front of a stranger who reached a sub-account's line.
+        const publicAccountsRoot = join(dirname(deps.platformRoot), 'data', 'accounts');
+        if (agentAccountId !== undefined && !existsSync(join(publicAccountsRoot, agentAccountId, 'account.json'))) {
+            deps.logger(`[spawn] op=account-reject route=public-spawn requested=${agentAccountId} reason=not-in-registry`);
+            timed(deps.logger, 'POST', '/public-spawn', 400, Date.now() - start);
+            return c.json({ error: 'agentAccountId not in this install registry' }, 400);
+        }
         // Task 346 — agent slug arrives on every spawn from the bridge.
         // Admin spawns send 'admin'; public spawns send the per-account default
         // (chat.ts) or the per-group/per-account/top-level resolver result
@@ -1095,6 +1123,17 @@ export function buildHttpApp(deps) {
             && typeof wc.serverPath === 'string' && wc.serverPath.startsWith('/')
             ? { key: wc.key, gatewayUrl: wc.gatewayUrl, serverPath: wc.serverPath }
             : undefined;
+        // Task 2262 — the WhatsApp channel for an enabled public-agent spawn. Same
+        // three-string contract /rc-spawn uses, gated to http + absolute path like
+        // webchatChannel above. This door could attach webchat but never WhatsApp,
+        // which is why the public WhatsApp route had nowhere to land before.
+        const waChannel = parseWaChannelBody(body.waChannel);
+        // Task 2262 — the caller's deterministic per-sender id, so a public visitor
+        // keeps one conversation across cold starts instead of meeting a fresh agent
+        // every time. Shape-gated to the same UUID v4 pattern the other id fields on
+        // this door use; anything else is discarded and the spawner mints its own.
+        const callerSessionId = typeof body.sessionId === 'string' && UUID_PATTERN.test(body.sessionId) ? body.sessionId : undefined;
+        const sessionIdFields = sessionIdFieldsFor(callerSessionId, (id) => findExistingJsonlForSessionId(deps.claudeConfigDir, id));
         // Task 939 — gated-visitor read-back block, rendered UI-side. Shape-gated
         // to a non-empty string with a generous ceiling; absent otherwise.
         const previousContext = typeof body.previousContext === 'string' && body.previousContext.length > 0 && body.previousContext.length <= 20000
@@ -1166,6 +1205,13 @@ export function buildHttpApp(deps) {
         // ignored here too, so the transcript scope can never diverge from the
         // work-MCP graph scope (which only sub-scopes under the same invariant).
         let spawnCwd = deps.spawnCwd;
+        // Task 2271 — the account directory a re-scoped public spawn reads its agent
+        // identity from, and the account id its sidecar is filed under. Held beside
+        // spawnCwd because they are three separate fields and re-scoping only one
+        // files the session under the wrong account. `rescopedAccountId` stays null
+        // when the re-scope is declined, so the three move together or not at all.
+        let spawnAccountDir = deps.accountDir;
+        let rescopedAccountId = null;
         // Task 1500/1630 — the house admin the passive intake :Task is ASSIGNED_TO,
         // threaded into the spawn so work-create links the edge. The sub-account's
         // `managingAdminUserId` is authoritative when it still names a live house
@@ -1199,9 +1245,33 @@ export function buildHttpApp(deps) {
             deps.logger(`[wa-passive] op=assign-resolve target=${targetAccountId} source=${assignee.source} admin=${assignee.userId ? assignee.userId.slice(0, 8) : '-'}`);
             spawnCwd = join(accountsRoot, targetAccountId);
         }
+        // Task 2271 — a session already running under another project slug keeps the
+        // scope its transcript was written under. The deterministic session id does
+        // not change with the cwd, and the resume decision scans every slug, so
+        // moving an in-flight session would hand `--resume` a transcript under one
+        // slug while the child ran in another. Refusing to enter that state is the
+        // design; new sessions get the new scope, and a live channel session takes
+        // no spawn door at all.
+        if (agentAccountId) {
+            const targetDir = join(publicAccountsRoot, agentAccountId);
+            const existingSlug = callerSessionId ? slugForExistingJsonl(deps.claudeConfigDir, callerSessionId) : null;
+            const targetSlug = projectSlugForCwd(targetDir);
+            if (existingSlug !== null && existingSlug !== targetSlug) {
+                deps.logger(`[spawn] op=agent-account-scope route=public-spawn account=${agentAccountId} applied=false reason=existing-transcript-other-slug slug=${existingSlug}`);
+            }
+            else {
+                spawnCwd = targetDir;
+                spawnAccountDir = targetDir;
+                rescopedAccountId = agentAccountId;
+                deps.logger(`[spawn] op=agent-account-scope route=public-spawn account=${agentAccountId} applied=true`);
+            }
+        }
         const result = await spawnClaudeSession({
             ...deps,
             spawnCwd,
+            // Task 2271 — the identity composer reads `agents/<slug>` from this.
+            accountDir: spawnAccountDir,
+            accountId: rescopedAccountId ?? deps.accountId,
             watcher: deps.watcher,
             onSessionReady: (tracker) => {
                 // Task 1483 — a passive intake rides role:'public' but is NOT a public
@@ -1210,8 +1280,20 @@ export function buildHttpApp(deps) {
                 // activity and its exit does not emit a spurious webchat no-record. It
                 // gets the one-shot auto-close instead.
                 if (!passive) {
-                    attachPublicAudit(deps, tracker.sessionId, role);
-                    attachPublicExitNotify(tracker.sessionId, role, deps.logger);
+                    // Task 2271 — `spawnCwd` here is the re-scoped value, so the audit
+                    // follows a public-agent session into its own account's slug.
+                    attachPublicAudit(deps, tracker.sessionId, role, spawnCwd);
+                    // Task 2262 — the exit notify is webchat machinery: the route it
+                    // calls resolves the sessionId against the WEBCHAT gateway's
+                    // publicSessions map to fire a slice-review, so a WhatsApp public
+                    // session can only ever produce `op=public-exit result=no-record`.
+                    // Same spurious line Task 1483 suppressed for passive, for the same
+                    // reason; the tool-audit above IS channel-agnostic and stays on,
+                    // because a WhatsApp visitor's realised tool surface is exactly what
+                    // Task 2260 wants audited.
+                    if (channel !== 'whatsapp') {
+                        attachPublicExitNotify(tracker.sessionId, role, deps.logger);
+                    }
                 }
                 attachSpecialistEndTurnAutoArchive(deps, tracker.sessionId, tracker.specialist);
                 attachPassiveEndTurnAutoClose(deps, tracker.sessionId, passive);
@@ -1241,9 +1323,15 @@ export function buildHttpApp(deps) {
             personId,
             visitorId,
             webchatChannel,
+            waChannel,
+            ...sessionIdFields,
             previousContext,
             passive,
             targetAccountId,
+            // Task 2271 — the RESOLVED variable, not the parsed field: when the
+            // same-slug rule declines the re-scope, the sidecar stays at the house
+            // with the other two levers.
+            agentAccountId: rescopedAccountId ?? undefined,
             assignedAdminUserId,
         });
         if (!result.ok) {
@@ -2953,6 +3041,12 @@ export function buildHttpApp(deps) {
         let waPath = null;
         let webchatPath = null;
         let telegramPath = null;
+        // Task 2260 — the channel server this spawn actually registered, set inside
+        // each branch below that succeeded in writing its --mcp-config (a write
+        // failure leaves it null). The public lockdown reads it to name the one
+        // reply tool the visitor may call, so the allowlist can never name a tool
+        // whose server is absent from this spawn.
+        let channelServerName = null;
         if (sessionId && isMultiTarget(targetSet)) {
             const unifiedServers = buildChannelMcpServers({ sessionId, targets: targetSet, nodeBin: deps.nodeBin });
             const unifiedPath = channelMcpConfigPath(sessionId, tmpdir());
@@ -2961,6 +3055,7 @@ export function buildHttpApp(deps) {
                 argv.push(...buildChannelArgv(unifiedPath));
                 waPath = unifiedPath;
                 webchatPath = unifiedPath;
+                channelServerName = CHANNEL_SERVER_NAME;
                 deps.logger(`[rc-spawn] op=channel-unified sessionId=${sessionId.slice(0, 8)} bound=[${targetKinds(targetSet).join(',')}] path=${unifiedPath}`);
                 deps.logger(`[rc-spawn] op=channel-mcp-spawn channel=unified node=${deps.nodeBin} exists=${existsSync(deps.nodeBin)}`);
             }
@@ -2981,6 +3076,7 @@ export function buildHttpApp(deps) {
                 try {
                     writeFileSync(waPath, JSON.stringify({ mcpServers: waServers }, null, 2), 'utf8');
                     argv.push(...buildWaChannelArgv(waPath));
+                    channelServerName = WA_CHANNEL_SERVER_NAME;
                     deps.logger(`[rc-spawn] op=wa-channel senderId=${effectiveWaChannel.senderId} gateway=${effectiveWaChannel.gatewayUrl} path=${waPath}`);
                     deps.logger(`[rc-spawn] op=channel-mcp-spawn channel=whatsapp node=${deps.nodeBin} exists=${existsSync(deps.nodeBin)}`);
                 }
@@ -3001,6 +3097,7 @@ export function buildHttpApp(deps) {
                 try {
                     writeFileSync(webchatPath, JSON.stringify({ mcpServers: webchatServers }, null, 2), 'utf8');
                     argv.push(...buildWebchatChannelArgv(webchatPath));
+                    channelServerName = WEBCHAT_CHANNEL_SERVER_NAME;
                     deps.logger(`[rc-spawn] op=webchat-channel key=${effectiveWebchatChannel.key} gateway=${effectiveWebchatChannel.gatewayUrl} path=${webchatPath}`);
                     deps.logger(`[rc-spawn] op=channel-mcp-spawn channel=webchat node=${deps.nodeBin} exists=${existsSync(deps.nodeBin)}`);
                 }
@@ -3026,6 +3123,7 @@ export function buildHttpApp(deps) {
                 try {
                     writeFileSync(telegramPath, JSON.stringify({ mcpServers: telegramServers }, null, 2), 'utf8');
                     argv.push(...buildTelegramChannelArgv(telegramPath));
+                    channelServerName = TELEGRAM_CHANNEL_SERVER_NAME;
                     deps.logger(`[rc-spawn] op=telegram-channel senderId=${effectiveTelegramChannel.senderId} gateway=${effectiveTelegramChannel.gatewayUrl} path=${telegramPath}`);
                     deps.logger(`[rc-spawn] op=channel-mcp-spawn channel=telegram node=${deps.nodeBin} exists=${existsSync(deps.nodeBin)}`);
                 }
@@ -3035,6 +3133,29 @@ export function buildHttpApp(deps) {
                 }
             }
         }
+        // Task 2260 — the public lockdown. `rcRole` alone is not the gate: a resume
+        // omits `role` in the body (the incident's second message was one), so a
+        // body-only test would restore the full admin surface on every message after
+        // the first. `priorSidecar` is already read for any channel-bound session,
+        // which is every public spawn that can reply. Pushed after the channel argv
+        // so `--strict-mcp-config` leaves exactly the per-spawn channel server
+        // registered; `admin` and roleless spawns produce byte-identical argv.
+        const effectiveRcRole = rcRole ?? priorSidecar?.role;
+        const publicLockdown = effectiveRcRole === 'public' ? buildRcPublicLockdownArgv(channelServerName) : null;
+        if (publicLockdown) {
+            // A re-seat fork pushes its own caller-picked --permission-mode above,
+            // before the role is known. Two conflicting flags do not reliably
+            // override, and per the pty-spawner doctrine a public spawn's mode is
+            // never caller-selectable, so drop any earlier pair rather than append a
+            // second. Logged when it fires: a public re-seat is not an ordinary shape.
+            for (let i = argv.length - 2; i >= 0; i--) {
+                if (argv[i] === '--permission-mode') {
+                    deps.logger(`[rc-spawn] op=public-mode-override stripped=${argv[i + 1]}`);
+                    argv.splice(i, 2);
+                }
+            }
+            argv.push(...publicLockdown.argv);
+        }
         // Task 889 — a webchat-bound admin rc session is the /chat admin surface.
         // Inject the authenticated-identity line (resolved name, or the explicit
         // not-resolvable form) so the agent states who it is talking to instead of
@@ -3224,7 +3345,15 @@ export function buildHttpApp(deps) {
         const settingsPermissionMode = resolveSettingsPermissionMode(deps.claudeConfigDir);
         // Task 928 — when the fork carries a picked mode, the argv flag governs (not
         // settings.json), so the lifeline and the sidecar must report the picked mode.
-        const effectiveRcPermissionMode = forkFromSessionId !== null && reseatPermissionMode ? reseatPermissionMode : settingsPermissionMode;
+        // Task 2260 — a locked-down public spawn carries an explicit
+        // `--permission-mode dontAsk`, which overrides the settings-resolved mode.
+        // Without this the op=argv line and the classification sidecar would both
+        // report bypassPermissions for a session that is not running under it.
+        const effectiveRcPermissionMode = publicLockdown
+            ? 'dontAsk'
+            : forkFromSessionId !== null && reseatPermissionMode
+                ? reseatPermissionMode
+                : settingsPermissionMode;
         // Task 956 — the model/effort the rc session actually runs under. A non-fork
         // admin spawn carries no --model/effort argv, so the binary reads
         // settings.json (pinned to Opus/medium by the rc-daemon); a fork rides its
@@ -3265,6 +3394,17 @@ export function buildHttpApp(deps) {
         // match to false — grep-able (`op=cwd-check` + `match=false`) with no
         // live repro needed.
         deps.logger(`[rc-spawn] op=cwd-check unitToken=${unitToken} resolved=${env.ACCOUNT_DIR} actual=${effectiveAccountDir} match=${env.ACCOUNT_DIR === effectiveAccountDir}`);
+        // Task 2260 — the realised tool surface, on EVERY rc-spawn. /rc-spawn emitted
+        // no such line, which is why the incident session was invisible to every
+        // tool-surface audit. An admin spawn reports count=0 strictMcp=n, which is
+        // what the unrestricted operator seat looks like written down. Shares the
+        // `tool-allowlist` tag with pty-spawner.ts so one grep covers both paths.
+        deps.logger(formatToolAllowlistLine({
+            role: effectiveRcRole ?? 'none',
+            count: publicLockdown ? publicLockdown.allowedTools.length : 0,
+            strictMcp: publicLockdown !== null,
+            mode: effectiveRcPermissionMode,
+        }));
         deps.logger(`[rc-spawn] op=argv unitToken=${unitToken} cwd=${effectiveAccountDir} permissionMode=${effectiveRcPermissionMode} model=${effectiveRcModel ?? 'unset'} effort=${effectiveRcEffort ?? 'unset'} positionalBytes=${positionalBytes} voiceBytes=${voiceBytes} argv=${JSON.stringify([deps.claudeBin, ...argv])}`);
         emitRcLife(deps.logger, 'argv', 'rc-spawn', 'node-pty', rcLifeMode, unitToken, {
             cwd: effectiveAccountDir,