@rubytech/create-maxy-code 0.1.572 → 0.1.574

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -9,6 +9,8 @@ import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSyn
 import { writeAdminEntry, removeAdminFromAccount, logUsersAudit, formatAuditRowIds } from "../../../../lib/admins-write/dist/index.js";
 import { setAccessPassword as setAccessPasswordHash, clearAccessPassword as clearAccessPasswordHash, accessPasswordCollides } from "../../../../lib/admin-access-password/dist/index.js";
 import { resolveCredentialTarget } from "./credential-identity.js";
+import { isE164, isTelegramChatId } from "./binding-validate.js";
+import { classifyAdminBind } from "./admin-bind-classify.js";
 import { embed } from "../../../../lib/embed-client/dist/index.js";
 import { requirePortEnv } from "../../../../lib/require-port-env/dist/index.js";
 import { deviceUrlBlock } from "../../../../lib/device-url/dist/index.js";
@@ -259,7 +261,10 @@ async function readAccountConfig() {
 }
 const STAGING_ROOT = resolve(PLATFORM_ROOT, "../premium-plugins");
 const PLUGINS_DIR = resolve(PLATFORM_ROOT, "plugins");
-const CORE_PLUGINS = ["admin", "memory", "docs", "cloudflare"];
+// Task 2520 added telegram: it carries `surface: platform` and sits in every
+// brand's plugins.core, so a toggle-off here would leave the three surfaces
+// disagreeing about whether the plugin is core.
+const CORE_PLUGINS = ["admin", "memory", "docs", "cloudflare", "telegram"];
 // users.json lives under CONFIG_DIR (persistent) — see paths.ts comment for
 // the regression that motivated the move. Both platform/ui and this MCP plugin
 // resolve the same file via brand-aware $HOME/<configDir>, so the device-level
@@ -283,6 +288,32 @@ function readUsersJson() {
 function writeUsersJson(users) {
     writeFileSync(USERS_FILE, JSON.stringify(users, null, 2) + "\n", "utf-8");
 }
+/**
+ * Task 2531 — re-read users.json after a binding write and report what is
+ * actually on disk.
+ *
+ * "Called the writer" is not evidence the field landed. The whole reason a
+ * missing binding went unnoticed for the life of this install is that nothing
+ * ever checked the post-condition; the boot-time drift check reports it, but
+ * only on the NEXT boot. This closes that gap at the moment of the write.
+ * Returns the observed verdict and logs it either way.
+ */
+function verifyBindingWrite(tag, userId, want) {
+    let ok = false;
+    try {
+        const row = readUsersJson().find(u => u.userId === userId);
+        ok =
+            !!row &&
+                (want.phone === undefined || row.phone === want.phone) &&
+                (want.telegram === undefined || row.telegram === want.telegram);
+    }
+    catch {
+        ok = false;
+    }
+    const state = (v) => (v === undefined ? "absent" : "set");
+    console.error(`${tag} op=binding-write userId=${userId.slice(0, 8)} phone=${state(want.phone)} telegram=${state(want.telegram)} verified=${ok}`);
+    return ok;
+}
 function generateUniquePin(users, maxRetries = 10) {
     const existingPins = new Set(users.map(u => u.pin));
     for (let i = 0; i < maxRetries; i++) {
@@ -962,7 +993,9 @@ lifelineTool(server, "plugin-toggle-enabled", "Enable or disable a plugin in thi
 eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a device-level user entry (users.json) and adds them to this account's admins list (account.json). PIN must be at least 4 digits. If no PIN is provided, a unique 4-digit PIN is generated. Returns the userId and PIN to share with the new admin.\n\nIMPORTANT — retry behaviour: if the user already stated a specific PIN earlier in the conversation and a first admin-add call failed (e.g. tier cap reached, PIN collision), every retry MUST re-pass that PIN as the `pin` parameter. Omitting `pin` on the retry auto-generates a different 4-digit PIN, silently substituting what the user asked for.", {
     name: z.string().describe("Display name for the new admin (stored on the AdminUser node in Neo4j)."),
     pin: z.string().optional().describe("Optional PIN (minimum 4 digits). If omitted, a unique 4-digit PIN is generated."),
-}, async ({ name, pin: rawPin }) => {
+    phone: z.string().optional().describe("E.164 phone (e.g. +441234567890) binding this admin to their WhatsApp sender. Without it a WhatsApp turn from this person resolves to no admin and their answer reaches only the door it arrived on. Settable later with admin-bind."),
+    telegram: z.string().optional().describe("Telegram chat id binding this admin to their Telegram chat (negative for a group). Without it a Telegram turn from this person resolves to no admin. Settable later with admin-bind."),
+}, async ({ name, pin: rawPin, phone, telegram }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("admin-add");
     const TAG = "[admin]";
@@ -981,6 +1014,16 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
         process.stderr.write(`[admin-add] op=refused reason=no-name\n`);
         return { content: [{ type: "text", text: `${TAG} A real name is required (it cannot be blank or the placeholder "Owner").` }], isError: true };
     }
+    // Task 2531 — validate the bindings before any store write, so a malformed
+    // one cannot land a half-created admin.
+    if (phone !== undefined && !isE164(phone)) {
+        process.stderr.write(`[admin-add] op=refused reason=bad-phone\n`);
+        return { content: [{ type: "text", text: `${TAG} phone must be E.164, e.g. +441234567890.` }], isError: true };
+    }
+    if (telegram !== undefined && !isTelegramChatId(telegram)) {
+        process.stderr.write(`[admin-add] op=refused reason=bad-telegram\n`);
+        return { content: [{ type: "text", text: `${TAG} telegram must be a chat id (digits, optionally negative for a group).` }], isError: true };
+    }
     let users;
     try {
         users = readUsersJson();
@@ -1050,11 +1093,20 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
         accountDir: getAccountDir(),
         caller: "admin-add",
         audit: { actor: callerUserId ?? "unknown", session: process.env.SESSION_NODE_ID, logFile: USERS_AUDIT_LOG },
+        // Task 2531 — the channel bindings, written by the same chokepoint as the
+        // PIN so a new admin can be born reachable on their own channels.
+        phone,
+        telegram,
     });
     console.error(`[admin-auth-store] action=add userId=${userIdShort} result=${authResult.usersJsonResult} store=users${authResult.usersError ? ` error=${authResult.usersError}` : ""}`);
     if (authResult.usersJsonResult !== "ok") {
         return { content: [{ type: "text", text: `${TAG} Failed to write users.json: ${authResult.usersError ?? "unknown error"}` }], isError: true };
     }
+    // Task 2531 — the observed post-condition, re-read from disk. A binding that
+    // silently failed to land looks identical to one that was never asked for.
+    if (phone !== undefined || telegram !== undefined) {
+        verifyBindingWrite("[admin-add]", userId, { phone, telegram });
+    }
     console.error(`[admin-auth-store] action=add userId=${userIdShort} result=${authResult.accountJsonResult} store=account${authResult.accountError ? ` error=${authResult.accountError}` : ""}`);
     if (authResult.accountJsonResult === "fail") {
         return { content: [{ type: "text", text: `${TAG} users.json updated; account.json write FAILED — manual reconciliation needed: ${authResult.accountError ?? "unknown error"}` }], isError: true };
@@ -1385,6 +1437,89 @@ eagerTool(server, "admin-update-pin", "Update an existing admin user's PIN. Defa
         content: [{ type: "text", text: `PIN updated${self ? "" : ` for userId ${userId}`}. The new PIN takes effect on the next login.` }],
     };
 });
+lifelineTool(server, "admin-bind", "Bind an admin to their channels by setting the phone and/or Telegram chat id on their users.json entry. This is what lets one answer reach every channel that person holds: without it a WhatsApp or Telegram turn resolves to no admin and the answer reaches only the door it arrived on. Defaults to the calling admin; pass userId (from admin-list) to bind someone else, which additionally requires confirm=true because a binding decides whose identity an inbound resolves to. Sets only the fields supplied; an omitted field is left untouched. A new admin can be born bound by passing the same fields to admin-add.", {
+    userId: z.string().optional().describe("The userId of the admin to bind. Defaults to the caller (the admin invoking this tool)."),
+    phone: z.string().optional().describe("E.164 phone (e.g. +441234567890) binding this admin to their WhatsApp sender."),
+    telegram: z.string().optional().describe("Telegram chat id binding this admin to their Telegram chat (negative for a group)."),
+    confirm: z.boolean().optional().describe("Required (true) only when userId names a DIFFERENT admin than the caller — confirms a deliberate cross-identity binding."),
+}, async ({ userId: targetUserId, phone, telegram, confirm }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("admin-bind");
+    const TAG = "[admin-bind]";
+    // A binding decides which sender resolves AS this person, so it is a
+    // credential-class write: the same Task 1573 gate the PIN tools use. Without
+    // it any admin could point their own number at another admin's userId and
+    // have their inbound turns attributed to that person.
+    const callerUserId = verifiedCaller();
+    const resolved = resolveCredentialTarget({ explicitUserId: targetUserId, callerUserId, confirm });
+    if (!resolved.ok) {
+        console.error(`${TAG} result=refused reason=${resolved.error.split(":")[0]}`);
+        return { content: [{ type: "text", text: `${TAG} ${resolved.error}` }], isError: true };
+    }
+    const userId = resolved.target;
+    const label = userId.slice(0, 8);
+    const refuse = (reason, message) => {
+        console.error(`${TAG} userId=${label} result=refused reason=${reason}`);
+        return { content: [{ type: "text", text: `${TAG} ${message}` }], isError: true };
+    };
+    let users;
+    try {
+        users = readUsersJson();
+    }
+    catch (err) {
+        return refuse("users-json-read-failed", err instanceof Error ? err.message : String(err));
+    }
+    let admins;
+    try {
+        const config = await readAccountConfig();
+        admins = (config.admins ?? []);
+    }
+    catch (err) {
+        return refuse("account-config-read-failed", err instanceof Error ? err.message : String(err));
+    }
+    const verdict = classifyAdminBind({ userId, phone, telegram, users, admins });
+    if (verdict.kind !== "ok") {
+        const message = {
+            "nothing-to-set": "Supply phone, telegram, or both.",
+            "bad-phone": "phone must be E.164, e.g. +441234567890.",
+            "bad-telegram": "telegram must be a chat id (digits, optionally negative for a group).",
+            "no-such-user": `User ${userId} not found in users.json.`,
+            "not-an-admin": `User ${userId} is not an admin of this account.`,
+        };
+        return refuse(verdict.kind, message[verdict.kind]);
+    }
+    // The one chokepoint, same as admin-add. `verdict.pin` is the existing hash,
+    // so the credential is carried through untouched rather than rotated.
+    const result = writeAdminEntry({
+        userId,
+        pin: verdict.pin,
+        role: "admin",
+        usersFile: USERS_FILE,
+        accountDir: getAccountDir(),
+        caller: "admin-bind",
+        audit: {
+            actor: callerUserId ?? "unknown",
+            session: process.env.SESSION_NODE_ID,
+            logFile: USERS_AUDIT_LOG,
+            target: userId,
+            explicitUserId: resolved.isCrossIdentity,
+        },
+        phone,
+        telegram,
+    });
+    if (result.usersJsonResult !== "ok") {
+        return refuse("write-failed", `Failed to write users.json: ${result.usersError ?? "unknown error"}`);
+    }
+    if (!verifyBindingWrite(TAG, userId, { phone, telegram })) {
+        return refuse("not-verified", "The write reported success but the value is not on disk.");
+    }
+    const set = [phone !== undefined ? "phone" : null, telegram !== undefined ? "telegram" : null]
+        .filter(Boolean)
+        .join(" and ");
+    return {
+        content: [{ type: "text", text: `${TAG} Bound ${set} for ${label}. A turn from this person now reaches every channel they hold, not only the one it arrived on.` }],
+    };
+});
 lifelineTool(server, "agent-image", "Upload, update, or remove an agent's image. action=set: copy the file at filePath to the agent's assets directory and update config.json with image URL and shape. action=remove: delete the image file and clear the image fields from config.json. imageShape: 'circle' for avatars/icons, 'rounded' for logos.", {
     agentSlug: z.string().describe("Agent slug (e.g. 'coaching', 'sales')"),
     action: z.enum(["set", "remove"]),