@rubytech/create-realagent 1.0.831 → 1.0.833

package/payload/platform/scripts/lib/resolve-account-dir.sh

@@ -8,7 +8,9 @@
 #
 # Contract (inputs via env vars):
 #   ACCOUNTS_DIR — {installDir}/data/accounts
-#   USERS_FILE   — {installDir}/platform/config/users.json
+#   USERS_FILE   — $HOME/<brand.configDir>/users.json (Task 904 — was
+#                  {installDir}/platform/config/users.json pre-Task-904, but
+#                  that path lived in the installer's wipe zone)
 #
 # Contract (outputs via env vars):
 #   ACCOUNT_ID   — resolved uuid (existing kept, or freshly minted)
@@ -78,8 +80,26 @@ PY
 
   local n=${#candidates[@]}
 
-  # Case 0: no candidates — fresh install, mint new UUID
+  # Case 0: no candidates — fresh install, mint new UUID.
+  # Task 900 sub-scope F — atomic-mint discipline: refuse to mint a new
+  # accountId if any stub dir (subdir present, account.json missing) exists
+  # under data/accounts/. The Task 900 root cause was install 1 minting
+  # accountId X then losing X/account.json (cron stamped X/logs/ first); the
+  # next install saw zero candidates and minted Y, orphaning X/logs/. The
+  # guard turns that silent regression into an operator-actionable abort.
   if [ "$n" -eq 0 ]; then
+    local stub_dirs=()
+    for dir in "$ACCOUNTS_DIR"/*/; do
+      [ -d "$dir" ] || continue
+      base="$(basename "$dir")"
+      case "$base" in .*) continue ;; esac
+      [ -f "$dir/account.json" ] && continue
+      stub_dirs+=("$base")
+    done
+    if [ "${#stub_dirs[@]}" -gt 0 ]; then
+      echo "==> [seed] FAIL phase=mint reason=\"stub-account-dirs present (no account.json): ${stub_dirs[*]}\" — refusing to mint a fresh accountId; remove or repair the stub before re-running install" >&2
+      return 1
+    fi
     ACCOUNT_ID="$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())')"
     ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
     return 0

package/payload/platform/scripts/migrate-import.sh

@@ -376,7 +376,9 @@ if [ -f "$PINS_FILE" ]; then
       # users.json from .admin-pin, but only at install time — and install runs
       # before this script writes .admin-pin. Self-contained migration writes
       # users.json directly, mirroring seed-neo4j.sh's migration branch.
-      USERS_FILE="$INSTALL_DIR/platform/config/users.json"
+      # Task 904 — write to the persistent location (outside the install wipe
+      # zone) so subsequent installs do not overwrite this row with a stale backup.
+      USERS_FILE="$PIN_DIR/users.json"
       if [ ! -f "$USERS_FILE" ]; then
         USER_ID="$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())')"
         PIN_HASH="$(cat "$PIN_DIR/.admin-pin")"

package/payload/platform/scripts/seed-neo4j.sh

@@ -50,7 +50,15 @@ CYPHER_SHELL="cypher-shell"
 # no identity match aborts loud; .trash/ is operator-emptied, never auto-cleaned.
 # shellcheck source=lib/resolve-account-dir.sh
 . "$SCRIPT_DIR/lib/resolve-account-dir.sh"
-USERS_FILE="$PROJECT_DIR/config/users.json" resolve_and_sweep_account_dir
+# Resolve brand-aware persistent users.json path before the resolver runs.
+# Mirrors the resolution lower in this file (around the post-Task-904 USERS_FILE
+# block); duplicated here because resolve_and_sweep_account_dir runs first.
+_RESOLVER_CONFIG_DIR_NAME=".maxy"
+if [ -f "$PROJECT_DIR/config/brand.json" ]; then
+  _RESOLVER_BRAND_CFG_DIR=$(python3 -c "import json; print(json.load(open('$PROJECT_DIR/config/brand.json')).get('configDir',''))" 2>/dev/null || true)
+  [ -n "$_RESOLVER_BRAND_CFG_DIR" ] && _RESOLVER_CONFIG_DIR_NAME="$_RESOLVER_BRAND_CFG_DIR"
+fi
+USERS_FILE="$HOME/$_RESOLVER_CONFIG_DIR_NAME/users.json" resolve_and_sweep_account_dir
 
 mkdir -p "$ACCOUNT_DIR/agents/admin" "$ACCOUNT_DIR/.claude" "$ACCOUNT_DIR/specialists/.claude-plugin" "$ACCOUNT_DIR/specialists/agents"
 
@@ -376,9 +384,8 @@ echo "  Account $ACCOUNT_ID at $ACCOUNT_DIR"
 # ------------------------------------------------------------------
 
 CONFIG_DIR="$PROJECT_DIR/config"
-USERS_FILE="$CONFIG_DIR/users.json"
 
-# Resolve the brand-specific config directory for .admin-pin location.
+# Resolve the brand-specific config directory.
 # Mirrors the logic in platform/ui/app/lib/paths.ts.
 _CONFIG_DIR_NAME=".maxy"
 if [ -f "$CONFIG_DIR/brand.json" ]; then
@@ -386,6 +393,9 @@ if [ -f "$CONFIG_DIR/brand.json" ]; then
   [ -n "$_BRAND_CFG_DIR" ] && _CONFIG_DIR_NAME="$_BRAND_CFG_DIR"
 fi
 ADMIN_PIN_FILE="$HOME/$_CONFIG_DIR_NAME/.admin-pin"
+# Task 904 — users.json lives under $HOME/$_CONFIG_DIR_NAME, not the wipe zone.
+USERS_FILE="$HOME/$_CONFIG_DIR_NAME/users.json"
+mkdir -p "$HOME/$_CONFIG_DIR_NAME"
 
 # Only create users.json if it doesn't exist AND .admin-pin exists (migration case).
 # Fresh installs: users.json is created by set-pin POST during onboarding.