@rubytech/create-maxy-code 0.1.546 → 0.1.547

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.546",
+  "version": "0.1.547",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -26,6 +26,7 @@ import { resolvePublicHostname } from "./lib/public-hostname.js";
 import { resolveAdminHostname } from "./lib/admin-hostname.js";
 import { publishSite } from "./tools/publish-site.js";
 import { createAgent, updateAgent, projectAgentViaPlatform } from "./tools/agent-write.js";
+import { checkDefaultAgent } from "./tools/account-default-agent.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
 import { resolveIngestToken } from "./tools/linkedin-ingest-token.js";
 import { startCpuTriage, readCpuTriage } from "./tools/cpu-triage.js";
@@ -787,19 +788,30 @@ eagerTool(server, "account-update", "Update a user-configurable setting in accou
         thinkingView: ["default", "expanded", "collapsed"],
         effort: ["low", "medium", "high", "max", "auto"],
     };
-    // defaultAgent: non-empty slug must reference an existing agent; empty string clears the field
+    // defaultAgent: non-empty slug must be slug-shaped AND reference an existing
+    // agent; empty string clears the field.
+    //
+    // Task 2347 — shape before existence. The stored value is read back by
+    // resolveDefaultAgentSlug and handed to readAgentFile, which interpolates
+    // it into a path; a traversal value's config.json exists on any
+    // multi-account install, so existence alone stored a path that led out of
+    // the account directory.
+    // `defaultAgentSlug` is the canonical value to store: the verdict's trimmed
+    // slug, empty for the clear operation. Storing the raw `value` instead
+    // would let `" sales "` be accepted here and then refused by the read
+    // door's shape rule, which sees the untrimmed string.
+    let defaultAgentSlug = "";
     if (field === "defaultAgent") {
-        const slug = value.trim();
-        if (slug) {
-            const agentConfigPath = join(getAccountDir(), "agents", slug, "config.json");
-            if (!existsSync(agentConfigPath)) {
-                return {
-                    content: [{ type: "text", text: `Agent '${slug}' not found — no config.json in agents/${slug}/` }],
-                    isError: true,
-                };
-            }
+        const verdict = checkDefaultAgent(getAccountDir(), value);
+        if (!verdict.ok) {
+            const slug = value.trim();
+            console.error(`[admin:account-update] rejected field=defaultAgent value="${value}" reason=${verdict.reason}`);
+            const text = verdict.reason === "shape"
+                ? `Invalid agent slug "${slug}" — must be lowercase, start with a letter, and be 3 to 50 characters with no path separators.`
+                : `Agent '${slug}' not found — no config.json in agents/${slug}/`;
+            return { content: [{ type: "text", text }], isError: true };
         }
-        // empty slug is valid — handled below as a delete operation
+        defaultAgentSlug = verdict.slug;
     }
     // Model fields accept any non-empty string (model IDs change frequently)
     const FREE_FORM_FIELDS = ["adminModel", "publicModel"];
@@ -822,22 +834,26 @@ eagerTool(server, "account-update", "Update a user-configurable setting in accou
         const configPath = join(getAccountDir(), "account.json");
         const config = await readAccountConfig();
         const oldDefault = field === "defaultAgent" ? config.defaultAgent ?? "(none)" : undefined;
-        if (field === "defaultAgent" && !value.trim()) {
-            delete config.defaultAgent;
+        if (field === "defaultAgent") {
+            if (defaultAgentSlug)
+                config.defaultAgent = defaultAgentSlug;
+            else
+                delete config.defaultAgent;
         }
         else {
             config[field] = value;
         }
+        const writtenValue = field === "defaultAgent" ? defaultAgentSlug : value;
         await writeFile(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-        console.error(`[admin:account-update] wrote field=${field} value="${value}" path=${configPath}`);
+        console.error(`[admin:account-update] wrote field=${field} value="${writtenValue}" path=${configPath}`);
         if (field === "defaultAgent") {
-            if (!value.trim()) {
+            if (!defaultAgentSlug) {
                 return {
                     content: [{ type: "text", text: `Default agent cleared (was "${oldDefault}"). Visitors to the root URL will see the first available agent, or a "no agents" message if none exist. Takes effect on next page load.` }],
                 };
             }
             return {
-                content: [{ type: "text", text: `Default agent changed from "${oldDefault}" to "${value}". Takes effect on next page load.` }],
+                content: [{ type: "text", text: `Default agent changed from "${oldDefault}" to "${defaultAgentSlug}". Takes effect on next page load.` }],
             };
         }
         return {