@rubytech/create-sitedesk-code 0.1.513 → 0.1.515

package/payload/platform/plugins/admin/hooks/fs-schema-guard.sh

@@ -5,6 +5,12 @@
 #   - the target's first path segment must be in the allowed top-level set
 #     (parsed from the fenced ```allowed-top-level block of the account's
 #     SCHEMA.md — our own structured data, not CLI prose);
+#   - a target whose first path segment is named in the fenced
+#     ```agent-denied-top-level block is blocked even though that name is in the
+#     allowed set: those entries are the account's control plane (identity,
+#     schema, credentials, agent settings, git dir), and none of them is ever
+#     authored by an agent file edit. The block message quotes the reason the
+#     fence carries for that name;
 #   - a target whose first path segment is a plugin-declared file (parsed from
 #     the fenced ```declared-files block of the same SCHEMA.md) is blocked even
 #     though that name is in the allowed set: the allowed set is a layout list,
@@ -18,7 +24,7 @@
 #
 # Exit codes: 0 = allow, 2 = block (stderr shown to the agent). Fail closed when
 # the tool call cannot be inspected (tty or empty stdin). Every block logs
-#   [fs-guard] blocked path=<rel> reason=<top-level|declared-file|over-deep|bad-name>
+#   [fs-guard] blocked path=<rel> reason=<top-level|account-machinery|declared-file|over-deep|bad-name>
 # No task numbers / internal refs in any operator-visible string.
 
 set -uo pipefail
@@ -88,6 +94,39 @@ if ! printf '%s\n' "$ALLOWED" | grep -qxF "$SEG0"; then
   exit 2
 fi
 
+# Account-machinery check. Some entries in the allowed set are the account's own
+# control plane rather than operator data: the identity file, the schema this
+# hook parses, the credential store, the agent's own settings and hooks, and the
+# git dir. The allowed set says which names may EXIST at the account root, not
+# which an agent may author, so each of these is named in a second fence together
+# with the reason it is off-limits. None of the five is authored through
+# Write/Edit/NotebookEdit: platform bash and Node write four of them, and git
+# itself writes .git, so denying them costs no legitimate writer. This denies
+# the agent's FILE-EDIT tools only, which is the whole surface the hook governs
+# — a Bash command still reaches these paths, and one sanctioned path relies on
+# that (the data-portal skill appends its fetch secret to secrets/ with a shell
+# redirect). The set and its reasons come from the account's own SCHEMA.md, so
+# the hook hard-codes no list. There is no owning plugin to name here, which is
+# why this fence carries a reason column the declared-files fence does not need.
+#
+# Not to be confused with the same phrase in account-dir-schema-reconcile.ts,
+# whose "account's own machinery" is the never-a-stray set and covers a
+# different membership (.quarantine and AGENTS.md are in it; secrets/ is not).
+#
+# No fence means nothing to deny, the same fail-open posture as the
+# missing-schema case above. Which accounts lack it is not uniform: setup-account.sh
+# re-provisions only the house account, and provision copies the template whole,
+# so the house account gains the fence on the next install while a client
+# sub-account — provisioned once, at creation — keeps a fence-less schema until a
+# durable backfill lands.
+DENIED=$(awk '/^```agent-denied-top-level$/{f=1;next} /^```$/{f=0} f' "$ACCOUNT_DIR/SCHEMA.md")
+if [ -n "$DENIED" ] && printf '%s\n' "$DENIED" | awk -F'\t' -v n="$SEG0" '$1==n{found=1} END{exit !found}'; then
+  WHY=$(printf '%s\n' "$DENIED" | awk -F'\t' -v n="$SEG0" '$1==n{print $2; exit}')
+  echo "[fs-guard] blocked path=$REL reason=account-machinery" >&2
+  echo "Blocked: '$SEG0' is this account's own machinery, not operator data: $WHY. Change it through the code that owns it." >&2
+  exit 2
+fi
+
 # Declared-file check. A file declared in the fence is written whole by platform
 # code, so an agent write to it is blocked even though the name is in the allowed
 # set: that set says which names may exist at the account root, not which an

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -21,6 +21,7 @@ import QRCode from "qrcode";
 import { getSession, closeDriver } from "./lib/neo4j.js";
 import { findSkillOwners, searchSkills, computePluginReadHint, loadSkill, parseRequiredInputs, adminAuthoringSkillBlock, skillSlugFromReadArgs, AUTHORING_DISPATCH_HINT } from "./skill-resolution.js";
 import { storeSkillToAccount } from "./store-skill-core.js";
+import { classifySpecialists } from "./specialist-registry.js";
 import { resolvePublicHostname } from "./lib/public-hostname.js";
 import { resolveAdminHostname } from "./lib/admin-hostname.js";
 import { publishSite } from "./tools/publish-site.js";
@@ -434,25 +435,22 @@ eagerTool(server, "system-status", "Check health of all SiteDesk platform servic
         }
         else {
             const content = readFileSync(agentsMdPath, "utf-8");
-            const entries = content.match(/^- \*\*specialists:([^*]+)\*\*/gm);
-            if (!entries || entries.length === 0) {
+            // Task 2016 — `missing` and `disabled` are different answers. An agent
+            // the operator switched off has no file here by design, and reporting
+            // that as a fault trains the operator to ignore the real ones.
+            const report = classifySpecialists({
+                agentsMd: content,
+                specialistsAgentsDir,
+                accountDir,
+                chromeUp,
+            });
+            if (report.registered === 0) {
                 checks.specialists = "not configured (AGENTS.md empty)";
             }
             else {
-                const lines = [];
-                for (const entry of entries) {
-                    const nameMatch = entry.match(/specialists:([^*]+)/);
-                    if (!nameMatch)
-                        continue;
-                    const name = nameMatch[1];
-                    const fileExists = existsSync(join(specialistsAgentsDir, `${name}.md`));
-                    let status = fileExists ? "ok" : "missing file";
-                    if (name === "personal-assistant" && !chromeUp) {
-                        status = "degraded — chrome not running";
-                    }
-                    lines.push(`  ${name}: ${status}`);
-                }
-                checks.specialists = `${entries.length} registered\n${lines.join("\n")}`;
+                checks.specialists =
+                    `${report.registered} registered, missing=${report.missing} disabled=${report.disabled}\n` +
+                        report.lines.join("\n");
             }
         }
     }