@rubytech/create-sitedesk-code 0.1.522 → 0.1.524

package/payload/platform/plugins/admin/hooks/mailbox-inject.sh

@@ -0,0 +1,299 @@
+#!/usr/bin/env bash
+# Task 2157 — UserPromptSubmit hook: inject a <mailboxes> block as
+# additionalContext on every turn, naming the Outlook mailboxes attached to this
+# account and the plugin that holds each, so a session never learns attachment
+# state by polling one mail plugin and reading that plugin's miss as an
+# account-wide fact (Task 2156's incident).
+#
+# Per-turn, not spawn-time: the delegated attach in that incident landed 27
+# minutes after the session spawned, so an env stamp would have been stale in the
+# very case this exists for.
+#
+# The hook is a READ-ONLY observer of the outlook plugin's store. It never writes
+# there, and in particular never performs the rename MailboxRegistry.migrateLegacy
+# does. Three fields leave the decrypt — mail, graphUserId, refreshTokenExpiry —
+# and no other blob field reaches stdout, stderr or the log.
+#
+# Mirrors datetime-inject.sh: drain stdin first, node for the reading, python3 for
+# the JSON envelope, exit 0 on every path, breadcrumb last. UserPromptSubmit
+# output is ADDED to the prompt, never substituted.
+#
+# Input  (stdin, UserPromptSubmit contract): { "session_id": "...", ... } —
+#         session_id is used only for the breadcrumb; the block is standing and
+#         prompt-independent.
+# Output (stdout JSON):
+#   { "hookSpecificOutput": { "hookEventName": "UserPromptSubmit",
+#                             "additionalContext": "<mailboxes>...</mailboxes>" } }
+
+set -uo pipefail
+
+# Drain stdin FIRST, before any exit path. Claude Code writes the full payload to
+# our stdin; exiting before reading it leaves the parent blocked on write and then
+# hit with EPIPE. Same reason the two sibling hooks drain first.
+HOOK_INPUT=$(cat 2>/dev/null || true)
+
+command -v python3 >/dev/null 2>&1 || exit 0
+command -v node >/dev/null 2>&1 || exit 0
+
+# --- account dir -----------------------------------------------------------
+# ACCOUNT_DIR is stamped unconditionally on the rc-spawn path (rc-daemon.ts
+# buildRcChildEnv) but only for admin/specialist on the pty-spawner path
+# (pty-spawner.ts, the `isSpecialistSpawn || role === admin` gate), so a
+# role:public webchat or passive WhatsApp spawn has none. The spawn cwd IS the
+# account dir on both paths (config.ts: spawnCwd defaults to accountDir), which
+# is how fs-schema-guard.sh already resolves it.
+ACCT=""
+if [ -n "${ACCOUNT_DIR:-}" ] && [ -d "${ACCOUNT_DIR}" ]; then
+  ACCT="$ACCOUNT_DIR"
+elif [ -f "$PWD/.claude/settings.json" ] && [ -d "$PWD/secrets" ]; then
+  ACCT="$PWD"
+fi
+
+# --- log dir ---------------------------------------------------------------
+# LOG_DIR is stamped ONLY on the rc-spawn path; pty-spawner never sets it and the
+# systemd unit does not carry it. CLAUDE_SESSION_MANAGER_PERSIST_DIR is on the
+# unit, and the manager itself derives its log dir as <persistDir>/logs, so that
+# fallback resolves to the same directory. Task 2173 covers the sibling hooks,
+# which have no such ladder and are silent on that path.
+LOGD=""
+if [ -n "${LOG_DIR:-}" ] && [ -d "${LOG_DIR}" ]; then
+  LOGD="$LOG_DIR"
+elif [ -n "${CLAUDE_SESSION_MANAGER_PERSIST_DIR:-}" ] && [ -d "${CLAUDE_SESSION_MANAGER_PERSIST_DIR}/logs" ]; then
+  LOGD="$CLAUDE_SESSION_MANAGER_PERSIST_DIR/logs"
+elif [ -n "$ACCT" ] && [ -d "$ACCT/logs" ]; then
+  LOGD="$ACCT/logs"
+fi
+
+SID=$(printf '%s' "$HOOK_INPUT" | python3 -c 'import json,sys
+try:
+    print(json.load(sys.stdin).get("session_id","") or "?")
+except Exception:
+    print("?")' 2>/dev/null)
+SID=${SID:-?}
+NOW_ISO=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "?")
+
+emit_log() {
+  local line="$NOW_ISO [mailbox-inject] $1 session=$SID"
+  if [ -n "$LOGD" ]; then
+    # stderr redirect FIRST: with the append first, bash emits its own
+    # "Permission denied" on an unwritable log before 2>/dev/null takes effect,
+    # and that escapes to the hook's stderr on every turn.
+    printf '%s\n' "$line" 2>/dev/null >> "$LOGD/mailbox-inject.log" || true
+  fi
+  echo "$line" >&2 || true
+}
+
+if [ -z "$ACCT" ]; then
+  emit_log "op=skip reason=no-account-dir"
+  exit 0
+fi
+ACCT_ID="$(basename "$ACCT")"
+
+# --- read the store --------------------------------------------------------
+# stderr is discarded because node prints the ENTIRE parsed source text on an
+# uncaught exception, which for a decrypted blob is the live access and refresh
+# tokens. The reader also try/catches every read and parse, so this is the second
+# of two independent guards, not the only one.
+READ_OUT=$(MBX_ACCOUNT_DIR="$ACCT" node -e '
+const fs=require("node:fs"),p=require("node:path"),c=require("node:crypto");
+const A=process.env.MBX_ACCOUNT_DIR||"";
+const OD=p.join(A,"secrets","outlook");
+const MD=p.join(OD,"mailboxes");
+const KP=p.join(OD,".key");
+const LP=p.join(OD,"tokens.enc");
+function probe(x){try{fs.statSync(x);return "present";}catch(e){return e.code==="ENOENT"?"absent":"error";}}
+function fail(r){process.stdout.write("skip\treason="+r+"\t");process.exit(0);}
+if(probe(OD)==="error")fail("unreadable-source");
+
+// The AES key is account-level and shared by every mailbox in the account. An
+// absent or malformed key is not a skip: it makes every blob unreadable, which
+// is a real state the block reports rather than hides.
+let key=null;
+if(probe(KP)==="present"){
+  try{const k=Buffer.from(fs.readFileSync(KP,"utf8").trim(),"base64");if(k.length===32)key=k;}catch(e){key=null;}
+}
+
+// Only mail, graphUserId and refreshTokenExpiry survive this function. The
+// decrypted blob goes out of scope with the tokens still inside it, and no error
+// object is ever printed: a JSON.parse SyntaxError message can quote its input.
+function readBlob(f){
+  if(!key)return null;
+  try{
+    const raw=fs.readFileSync(f,"utf8").trim();
+    if(!raw)return null;
+    const i=raw.indexOf(":");
+    if(i<1)return null;
+    const d=c.createDecipheriv("aes-256-cbc",key,Buffer.from(raw.slice(0,i),"hex"));
+    let s=d.update(raw.slice(i+1),"hex","utf8");s+=d.final("utf8");
+    const b=JSON.parse(s);
+    if(!b||typeof b!=="object")return null;
+    return {mail:(typeof b.mail==="string"&&b.mail.trim())?b.mail.trim():null,
+            gid:(typeof b.graphUserId==="string"&&b.graphUserId.trim())?b.graphUserId.trim():null,
+            rte:(typeof b.refreshTokenExpiry==="number")?b.refreshTokenExpiry:null};
+  }catch(e){return null;}
+}
+
+// mailboxStatus precedence: unreadable, blank-email, refresh-expired, ok.
+function classify(v){
+  if(!v)return "unreadable";
+  if(!v.mail)return "blank-email";
+  if(v.rte!==null&&Date.now()>v.rte)return "refresh-expired";
+  return "ok";
+}
+const boxes=[];
+function addBox(k,f){const v=readBlob(f);boxes.push({key:k,mail:v?v.mail:null,gid:v?v.gid:null,status:classify(v)});return v;}
+// sanitizeMailboxKey, verbatim from token-store.ts, so the legacy-dedupe test
+// below compares the same folded form the plugin would have written.
+function sanKey(k){return String(k).replace(/[^A-Za-z0-9._-]/g,"_");}
+
+// Keep only directories containing tokens.enc, exactly the registry gate. A
+// directory without one is what the revocation path leaves behind.
+const mdState=probe(MD);
+if(mdState==="error")fail("unreadable-source");
+if(mdState==="present"){
+  let ents=null;
+  try{ents=fs.readdirSync(MD,{withFileTypes:true});}catch(e){ents=null;}
+  if(ents===null)fail("unreadable-source");
+  for(const e of ents){
+    if(!e.isDirectory())continue;
+    const tf=p.join(MD,e.name,"tokens.enc");
+    if(probe(tf)!=="present")continue;
+    addBox(e.name,tf);
+  }
+}
+// The pre-migration single-mailbox layout. Read, never moved.
+//
+// migrateLegacy() moves it to mailboxes/<sanitizeMailboxKey(graphUserId)>/ and,
+// when that destination ALREADY holds a blob, unlinks the legacy copy instead.
+// A register writes through storeFor() without calling list(), so both files can
+// sit on disk at once until some outlook tool triggers the migration. Listing the
+// legacy file unconditionally would then show one mailbox twice, and count it
+// twice, where the plugin shows it once. Mirror the destination test as a
+// read-only skip: same key derivation, no rename, no unlink.
+if(probe(LP)==="present"){
+  const lv=addBox("legacy tokens.enc",LP);
+  const lkey=sanKey(lv?(lv.gid||"unknown"):"legacy-unreadable");
+  for(let i=0;i<boxes.length-1;i++){
+    if(boxes[i].key===lkey){boxes.pop();break;}
+  }
+}
+
+// Control characters and the angle brackets that frame the block can never
+// appear in a subject: the frame holds by construction, not by the invariants
+// that currently keep them out (sanitizeMailboxKey folds directory names, mail
+// comes from Graph, and shared-mailbox-add probes an address against Graph
+// before persisting it). Bounded length for the same reason.
+function clean(s){
+  const t=String(s).replace(/[\u0000-\u001f\u007f<>]/g," ").trim();
+  return t.length?t.slice(0,120):"(unnamed)";
+}
+function subject(b){return clean(b.mail||b.gid||b.key);}
+const readable=new Map();
+for(const b of boxes)if(b.status!=="unreadable")readable.set(b.key,b);
+
+const DP=p.join(OD,"delegated.json");
+// Mirrors DelegatedStore.read(): an absent or unparseable file means zero
+// entries, never zero block; per-entry drops for a non-string viaMailboxKey or a
+// non-number addedAt; keys normalised with trim+toLowerCase.
+// A Map, not an array: read() assigns into an object keyed by the NORMALISED
+// address, so two keys differing only in case or surrounding space collapse to
+// one record there. Pushing to an array would render such a mailbox once per key.
+const delegMap=new Map();
+let degraded=false;
+const dState=probe(DP);
+if(dState==="error")degraded=true;
+else if(dState==="present"){
+  try{
+    const o=JSON.parse(fs.readFileSync(DP,"utf8"));
+    if(o&&typeof o==="object"&&!Array.isArray(o)){
+      for(const kv of Object.entries(o)){
+        const a=kv[0],e=kv[1];
+        if(!e||typeof e!=="object")continue;
+        if(typeof e.viaMailboxKey!=="string")continue;
+        if(typeof e.addedAt!=="number")continue;
+        delegMap.set(String(a).trim().toLowerCase(),e.viaMailboxKey);
+      }
+    }else{degraded=true;}
+  }catch(e){degraded=true;}
+}
+const deleg=Array.from(delegMap,function(kv){return {addr:kv[0],via:kv[1]};});
+
+const SUFFIX={"ok":"signed in",
+  "refresh-expired":"signed in, needs re-authorising",
+  "blank-email":"signed in, no address on record — internal handle",
+  "unreadable":"attached, unreadable — internal handle"};
+const lines=[];
+for(const b of boxes.slice().sort(function(x,y){return subject(x).localeCompare(subject(y));})){
+  lines.push("- "+subject(b)+" — outlook plugin ("+SUFFIX[b.status]+")");
+}
+// A delegated entry is connected only when its viaMailboxKey names a mailbox
+// whose blob DECRYPTS, exactly the predicate MailboxRegistry.resolve() uses.
+// Matching directory presence would promise a mailbox every call refuses.
+for(const d of deleg.slice().sort(function(x,y){return x.addr.localeCompare(y.addr);})){
+  const g=readable.get(d.via);
+  lines.push(g
+    ? "- "+clean(d.addr)+" — outlook plugin (delegated via "+subject(g)+")"
+    : "- "+clean(d.addr)+" — outlook plugin (delegated, delegator no longer connected)");
+}
+
+const now=new Date().toISOString();
+const head="Outlook mailboxes attached to this account, read at "+now+". Read this rather than polling the plugin. Only the most recent <mailboxes> block is current.";
+const tail=["This list is internal. Use it to decide which tool to call; do not recite it to whoever is on the other end of a channel conversation.","This list covers the outlook plugin only. IMAP mailboxes are not listed here, so their absence above is not evidence they are unattached — call email-status for those.","Tools: outlook-* for outlook-plugin mailboxes, email-* for email-plugin mailboxes."];
+const body=[head].concat(lines.length?lines:["None attached."]).concat(tail).join("\n");
+
+// blank-email counts as usable: resolve() addresses a sole blank-email mailbox
+// through /me, filtering on readable rather than on status === ok.
+let usable=0,exp=0,unr=0;
+for(const b of boxes){
+  if(b.status==="ok"||b.status==="blank-email")usable++;
+  else if(b.status==="refresh-expired")exp++;
+  else unr++;
+}
+const m="outlook="+boxes.length+" delegated="+deleg.length+" usable="+usable+" expired="+exp+" unreadable="+unr+" degraded="+(degraded?"yes":"no");
+process.stdout.write("ok\t"+m+"\t"+body);
+' 2>/dev/null) || READ_OUT=""
+
+if [ -z "$READ_OUT" ]; then
+  emit_log "op=skip reason=reader-failed account=$ACCT_ID"
+  exit 0
+fi
+
+VERDICT="${READ_OUT%%$'\t'*}"
+REST="${READ_OUT#*$'\t'}"
+METRICS="${REST%%$'\t'*}"
+BODY="${REST#*$'\t'}"
+
+# Exhaustive on purpose. The shipped reader writes only the two-tab `ok` and
+# `skip` shapes, but if anything else ever reached this stdout the fall-through
+# would inject it as the block body AND interpolate it into the breadcrumb, where
+# an address would land in a log the admin route serves unauthenticated. Anything
+# that is not exactly `ok` is a skip, with a fixed reason rather than the payload.
+case "$VERDICT" in
+  skip) emit_log "op=skip ${METRICS} account=$ACCT_ID"; exit 0 ;;
+  ok)   : ;;
+  *)    emit_log "op=skip reason=reader-malformed account=$ACCT_ID"; exit 0 ;;
+esac
+
+CONTEXT="<mailboxes>
+$BODY
+</mailboxes>"
+
+ENVELOPE=$(printf '%s' "$CONTEXT" | python3 -c '
+import json, sys
+ctx = sys.stdin.read()
+print(json.dumps({
+    "hookSpecificOutput": {
+        "hookEventName": "UserPromptSubmit",
+        "additionalContext": ctx,
+    }
+}))
+' 2>/dev/null) || exit 0
+
+[ -n "$ENVELOPE" ] || exit 0
+printf '%s\n' "$ENVELOPE"
+
+case "$METRICS" in
+  *degraded=yes*) emit_log "op=degrade reason=delegated-unreadable account=$ACCT_ID" ;;
+esac
+emit_log "injected account=$ACCT_ID $METRICS imap=not-read source=disk refresh=per-turn"
+exit 0

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -29,6 +29,10 @@ import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
 import { startCpuTriage, readCpuTriage } from "./tools/cpu-triage.js";
 import { runCatalogueCensus } from "./lib/catalogue-census.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
+// Task 2130 — the same roster and the same MERGE seed-neo4j.sh runs for the
+// house account. Shared rather than reimplemented: two copies would drift, and
+// the drift would surface only as "the sub-accounts have different routines".
+import { seedRoutineRoster } from "../../../../lib/routine-templates/dist/index.js";
 import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, isPlaceholderOwnerName, isBlankBusinessName, isValidTimeZone, refuseClientAdminAdd, readHouseAdminUserIds, setManagingAdmin, findClientAccountsManagedBy, reassignManagingAdmin, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, classifyManagingAdmin, ownerNameStatus, readManagingAdminUserId, setOwnerName, } from "./tools/account-lifecycle.js";
 function refusalGuidance(kind) {
     switch (kind) {
@@ -3544,7 +3548,41 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         const managedNote = managingAdminUserId
             ? `managed by admin ${managingAdminUserId}`
             : `with no managing admin (its passive-intake tasks route to the primary admin; use account_reassign_admin to assign one)`;
-        return { content: [{ type: "text", text: `Created client sub-account ${newId}, ${managedNote}. Switch to it from the sub-account picker to work in its data.` }] };
+        // Task 2130 — seed the routine roster onto the new sub-account. Without
+        // this a client sub-account ships with a blank /routines page while the
+        // house account has ten, because seed-neo4j.sh only ever reaches the one
+        // account its resolver returns.
+        //
+        // Last, and never a create failure. At this point the account exists, is
+        // rooted and carries its managing admin, so reporting a generic failure
+        // would push the operator to retry and orphan a second account. It also
+        // runs after seedAccountGraphRoot on purpose: the seed resolves the
+        // timezone by reading back the owner :UserProfile that seed just wrote.
+        // A shortfall is reported in the success text and on stderr, where the
+        // heartbeat's op=roster drift check will keep reporting it every tick
+        // until it is fixed.
+        let rosterNote = "";
+        const rosterSession = getSession();
+        try {
+            const roster = await seedRoutineRoster({ session: rosterSession, accountId: newId });
+            if (roster.verify.actual < roster.verify.expected) {
+                process.stderr.write(`[account-lifecycle] op=create-roster accountId=${newId} result=short ` +
+                    `expected=${roster.verify.expected} actual=${roster.verify.actual}\n`);
+                rosterNote = ` Its Routines page is incomplete (${roster.verify.actual} of ${roster.verify.expected} seeded) — re-running the installer re-seeds every account.`;
+            }
+            else {
+                process.stderr.write(`[account-lifecycle] op=create-roster accountId=${newId} result=ok routines=${roster.verify.actual}\n`);
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`[account-lifecycle] op=create-roster accountId=${newId} result=failed error=${msg}\n`);
+            rosterNote = ` Its Routines page is empty — the routine seed failed (${msg}). Re-running the installer re-seeds every account.`;
+        }
+        finally {
+            await rosterSession.close();
+        }
+        return { content: [{ type: "text", text: `Created client sub-account ${newId}, ${managedNote}. Switch to it from the sub-account picker to work in its data.${rosterNote}` }] };
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);