@rubytech/create-sitedesk-code 0.1.526 → 0.1.528

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-sitedesk-code",
-  "version": "0.1.526",
+  "version": "0.1.528",
   "description": "Install SiteDesk — automated back office for independent building contractors",
   "bin": {
     "create-sitedesk-code": "./dist/index.js"

package/payload/platform/plugins/admin/hooks/__tests__/fs-schema-guard.test.sh

@@ -9,10 +9,15 @@
 #   5. Write to projects/Acme/deploy/sources/a.txt         -> BLOCK over-deep
 #   6. Write to projects/Acme/deploy/a.txt                 -> BLOCK over-deep
 #   7. Write to whim/x.txt (novel top-level)               -> BLOCK top-level
-#   8. Write to an absolute path outside the account dir   -> ALLOW (not our concern)
+#   8. Write to an absolute path outside the accounts root -> ALLOW (not our concern)
 #   9. NotebookEdit over-deep (notebook_path)              -> BLOCK over-deep
 #  10. Empty stdin (cannot inspect)                        -> BLOCK fail-closed
 #  11. Allowed-set parse matches the documented set        -> assertion
+#  12. Edit into a SIBLING account under the accounts root -> BLOCK cross-account
+#  13. Same, with HOUSE_ADMIN_SCOPE set (no house exception)-> BLOCK cross-account
+#  14. Same, from an account with no SCHEMA.md             -> BLOCK cross-account
+#  15. Write into a sibling dir with no account.json       -> ALLOW (not an account)
+#  16. Symlink under this account resolving into a sibling -> BLOCK cross-account
 set -u
 
 HOOK="$(cd "$(dirname "$0")/.." && pwd)/fs-schema-guard.sh"
@@ -37,6 +42,30 @@ cp "$TEMPLATE" "$ACCT_D/SCHEMA.md"
 awk '1; /^```allowed-top-level$/{print "jobs"}' "$ACCT_D/SCHEMA.md" > "$ACCT_D/SCHEMA.md.tmp" && mv "$ACCT_D/SCHEMA.md.tmp" "$ACCT_D/SCHEMA.md"
 mkdir -p "$ACCT_D/jobs/5-oaktree/Quotations"
 
+# A two-account accounts root, modelling data/accounts/<id>/. $ACCT and $ACCT_D
+# above are independent mktemp dirs with no shared account parent, so the
+# cross-account cases need their own root. Each account carries the account.json
+# marker the guard uses to recognise a sibling; `notanaccount` deliberately does
+# not, so the guard must leave it alone.
+ROOT=$(mktemp -d)
+trap 'rm -rf "$ACCT" "$ACCT_D" "$ROOT"' EXIT
+ACCT_OWN="$ROOT/68b50910-own"
+ACCT_SIB="$ROOT/5e99bba5-sibling"
+mkdir -p "$ACCT_OWN/documents" "$ACCT_SIB/sites/public" "$ROOT/notanaccount/sites"
+cp "$TEMPLATE" "$ACCT_OWN/SCHEMA.md"
+cp "$TEMPLATE" "$ACCT_SIB/SCHEMA.md"
+printf '{"accountId":"68b50910-own","role":"client"}' > "$ACCT_OWN/account.json"
+printf '{"accountId":"5e99bba5-sibling","role":"house"}' > "$ACCT_SIB/account.json"
+# An account with NO SCHEMA.md: the missing-schema fail-open governs its own
+# layout only and must not open the cross-account hole.
+ACCT_NOSCHEMA="$ROOT/f4fccf17-noschema"
+mkdir -p "$ACCT_NOSCHEMA"
+printf '{"accountId":"f4fccf17-noschema","role":"client"}' > "$ACCT_NOSCHEMA/account.json"
+# A symlink inside the own account pointing at the sibling. Containment must be
+# tested on the resolved path: a lexical check treats this as an own-account path
+# and the write lands in the sibling anyway.
+ln -s "$ACCT_SIB/sites" "$ACCT_OWN/documents/escape"
+
 PASS=0; FAIL=0
 # Run one case in the account dir as cwd.
 #   $1 name  $2 stdin  $3 expected_exit  $4 expected_log_re ("" = none)
@@ -53,6 +82,22 @@ run_case() {
   else echo "FAIL: $name (exit=$actual, want $exp; log want /$re/)" >&2; FAIL=$((FAIL+1)); fi
 }
 
+# Same contract as run_case, with HOUSE_ADMIN_SCOPE set for the single call. The
+# block must not consult it: a house session is fenced on the native path exactly
+# like a sub-account session, and the gated file tools are its cross-account route.
+run_case_house() {
+  local name="$1" stdin="$2" exp="$3" re="$4" acct="$5" ef actual
+  ef=$(mktemp)
+  ( cd "$acct" && printf '%s' "$stdin" | HOUSE_ADMIN_SCOPE=install-wide bash "$HOOK" >/dev/null 2>"$ef" )
+  actual=$?
+  local sc; sc=$(cat "$ef"); rm -f "$ef"
+  local ok=1
+  [ "$actual" -eq "$exp" ] || ok=0
+  if [ -n "$re" ] && ! printf '%s' "$sc" | grep -Eq "$re"; then ok=0; fi
+  if [ $ok -eq 1 ]; then echo "PASS: $name (exit=$actual)"; PASS=$((PASS+1));
+  else echo "FAIL: $name (exit=$actual, want $exp; log want /$re/)" >&2; FAIL=$((FAIL+1)); fi
+}
+
 mkenv() { printf '{"hook_event_name":"PreToolUse","tool_name":"%s","tool_input":{"%s":"%s"}}' "$1" "$2" "$3"; }
 
 run_case "non-write allow"       "$(mkenv Bash command 'ls')"                                  0 ""
@@ -172,5 +217,41 @@ NOREASON=$(awk '/^```agent-denied-top-level$/{f=1;next} /^```$/{f=0} f' "$ACCT/S
 if [ -z "$NOREASON" ]; then echo "PASS: deny-set reasons"; PASS=$((PASS+1));
 else echo "FAIL: deny-set reasons missing for [$NOREASON]" >&2; FAIL=$((FAIL+1)); fi
 
+# Cross-account: another account's data dir is refused for every session, and the
+# refusal names the target so the log says which account was reached for.
+run_case "xacct edit blocked" \
+  "$(mkenv Edit file_path "$ACCT_SIB/sites/public/index.html")" \
+  2 'reason=cross-account target=5e99bba5' "$ACCT_OWN"
+
+# A house-scoped session is fenced on the native path exactly like a sub-account
+# one: the gated file tools are the audited cross-account route.
+run_case_house "xacct blocked with house scope" \
+  "$(mkenv Edit file_path "$ACCT_SIB/sites/public/index.html")" \
+  2 'reason=cross-account' "$ACCT_OWN"
+
+# The block precedes the schema parse, so an account with no SCHEMA.md still
+# cannot reach a sibling — the fail-open governs its own layout only.
+run_case "xacct blocked without own schema" \
+  "$(mkenv Write file_path "$ACCT_SIB/sites/public/x.html")" \
+  2 'reason=cross-account' "$ACCT_NOSCHEMA"
+
+# A directory that merely shares the accounts root is not an account, so it is
+# not this hook's business.
+run_case "sibling without account marker allowed" \
+  "$(mkenv Write file_path "$ROOT/notanaccount/sites/x.html")" \
+  0 "" "$ACCT_OWN"
+
+# The own-account path is unchanged by the new verdict.
+run_case "own account absolute write allowed" \
+  "$(mkenv Write file_path "$ACCT_OWN/documents/a.pdf")" \
+  0 "" "$ACCT_OWN"
+
+# A path that is lexically inside this account but resolves into a sibling is
+# still cross-account. Containment is tested on the resolved path, so a symlink
+# planted under the own account does not become a way through.
+run_case "symlink into a sibling blocked" \
+  "$(mkenv Edit file_path "$ACCT_OWN/documents/escape/index.html")" \
+  2 'reason=cross-account target=5e99bba5' "$ACCT_OWN"
+
 echo "----- $PASS passed, $FAIL failed -----"
 [ $FAIL -eq 0 ]

package/payload/platform/plugins/admin/hooks/fs-schema-guard.sh

@@ -19,8 +19,12 @@
 #     most <bucket>/<entity>/<file> deep; documents/ may be at most
 #     <bucket>/<folder>/<file> deep. Tool-owned dirs pass at any depth.
 #
-# The hook governs the account dir only. A path resolving outside the account
-# dir (cwd) is allowed — platform-source writes are PLATFORM_BOUNDARY's concern.
+# The hook governs this account's dir, and refuses any target inside a SIBLING
+# account under the same accounts root (reason=cross-account) for every session,
+# house included. Containment is decided on the RESOLVED path, so a symlink
+# planted under this account that points into a sibling is refused rather than
+# read as an own-account path. A path outside the accounts root altogether is
+# allowed here — platform-source writes are PLATFORM_BOUNDARY's concern.
 #
 # Exit codes: 0 = allow, 2 = block (stderr shown to the agent). Fail closed when
 # the tool call cannot be inspected (tty or empty stdin). Every block logs
@@ -62,18 +66,46 @@ esac
 
 ACCOUNT_DIR="$PWD"
 
-# Resolve to an account-relative path; allow anything outside the account dir.
-REL=$(FILE_PATH="$FILE_PATH" ACCOUNT_DIR="$ACCOUNT_DIR" python3 -c '
+# Resolve the target to one of three verdicts:
+#   in    <rel>               inside this account
+#   xacct <accountName> <abs> inside a SIBLING account under the same accounts root
+#   out                       anywhere else
+# A sibling counts as an account only when it carries its own account.json — the
+# same marker the standing reconcile uses — so a directory that merely shares the
+# accounts root is never mistaken for one.
+RESOLVED=$(FILE_PATH="$FILE_PATH" ACCOUNT_DIR="$ACCOUNT_DIR" python3 -c '
 import os, sys
-fp = os.environ["FILE_PATH"]; acct = os.environ["ACCOUNT_DIR"]
-ab = fp if os.path.isabs(fp) else os.path.join(acct, fp)
-ab = os.path.normpath(ab); acct = os.path.normpath(acct)
-if ab == acct or not ab.startswith(acct + os.sep):
-    print("")  # outside the account dir (or the dir itself)
-else:
-    print(os.path.relpath(ab, acct))
-' 2>/dev/null || echo "")
-[ -z "$REL" ] && exit 0
+fp = os.environ["FILE_PATH"]; acct = os.path.realpath(os.environ["ACCOUNT_DIR"])
+ab = os.path.realpath(fp if os.path.isabs(fp) else os.path.join(acct, fp))
+if ab != acct and ab.startswith(acct + os.sep):
+    sys.stdout.write("in\t" + os.path.relpath(ab, acct)); sys.exit(0)
+root = os.path.dirname(acct)
+if ab.startswith(root + os.sep):
+    seg = os.path.relpath(ab, root).split(os.sep)[0]
+    if seg != os.path.basename(acct) and os.path.exists(os.path.join(root, seg, "account.json")):
+        sys.stdout.write("xacct\t" + seg + "\t" + ab); sys.exit(0)
+sys.stdout.write("out")
+' 2>/dev/null || echo "out")
+IFS=$'\t' read -r VERDICT PAYLOAD XABS <<< "$RESOLVED"
+
+# Another account's data directory is refused for EVERY session, house included.
+# The gated account-scoped file tools are the one cross-account route: they
+# resolve the caller's authority, reject path escapes, and log the decision. Two
+# routes to one capability would leave this one unlogged.
+#
+# Checked before the schema parse below on purpose. The missing-schema fail-open
+# governs this account's own layout; it must not hand out a sibling's files.
+if [ "$VERDICT" = "xacct" ]; then
+  echo "[fs-guard] blocked path=$XABS reason=cross-account target=$(printf '%s' "$PAYLOAD" | cut -c1-8)" >&2
+  echo "Blocked: '$XABS' is inside another account's data directory. A file edit reaches this account's data only. Cross-account file work goes through the account-scoped file tools, naming the target account explicitly." >&2
+  exit 2
+fi
+
+# Anything outside this account and not inside a sibling account is allowed here —
+# writes to the platform trees are the platform boundary's concern, enforced by
+# filesystem immutability rather than by this hook.
+[ "$VERDICT" = "in" ] || exit 0
+REL="$PAYLOAD"
 
 # Parse the allowed top-level set from the account's seeded SCHEMA.md.
 ALLOWED=""

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -27,6 +27,7 @@ import { resolveAdminHostname } from "./lib/admin-hostname.js";
 import { publishSite } from "./tools/publish-site.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
 import { startCpuTriage, readCpuTriage } from "./tools/cpu-triage.js";
+import { readMcpLogsByKey, readLatestMcpLog } from "./tools/logs-read-mcp.js";
 import { runCatalogueCensus } from "./lib/catalogue-census.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
 // Task 2130 — the same roster and the same MERGE seed-neo4j.sh runs for the
@@ -1503,7 +1504,7 @@ lifelineTool(server, "agent-list", "List all public (non-admin) agents with thei
         };
     }
 });
-eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream/error/session/public) are per-session — pass `sessionKey` (preferred) or the legacy `sessionId` alias to retrieve a single session's log from first [spawn] to final [process-exit]. type=agent-stream: per-session tool-use/tool-result archive (every `[tool-use]` and `[tool-result]` pair with full input + output JSON, plus raw Claude stream-json, agent events, and MCP server stderr via tee). USE THIS when investigating what an agent ACTUALLY did with its tools — server.log only carries `[persist] tool-call persisted` markers, not bodies. (`type=system` is a backwards-compatible alias for the same archive.) type=session: SSE events sent to client. type=error: Claude subprocess stderr (raw — NODE_DEBUG HTTP/NET/UNDICI traces land in agent-stream via the stream tee, not here). type=heartbeat: platform event dispatcher (check-due-events cron). type=public: public agent diagnostic log. type=server: platform server log. type=mcp: MCP server stderr (per-plugin raw). type=vnc: VNC browser viewer lifecycle.", {
+eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream/error/session/public) are per-session — pass `sessionKey` (preferred) or the legacy `sessionId` alias to retrieve a single session's log from first [spawn] to final [process-exit]. type=agent-stream: per-session tool-use/tool-result archive (every `[tool-use]` and `[tool-result]` pair with full input + output JSON, plus raw Claude stream-json, agent events, and MCP server stderr via tee). USE THIS when investigating what an agent ACTUALLY did with its tools — server.log only carries `[persist] tool-call persisted` markers, not bodies. (`type=system` is a backwards-compatible alias for the same archive.) type=session: SSE events sent to client. type=error: Claude subprocess stderr (raw — NODE_DEBUG HTTP/NET/UNDICI traces land in agent-stream via the stream tee, not here). type=heartbeat: platform event dispatcher (check-due-events cron). type=public: public agent diagnostic log. type=server: platform server log. type=mcp: MCP server stderr (per-plugin raw), resolved under ~/.<brand>/logs — the platform config dir, not the account log dir. With a sessionKey, every mcp-*.log whose FILENAME carries that key is tailed, up to 20 files, and a truncated reply names the total that matched; an 8-character key prefix matches. The key is never matched against file contents, because MCP log lines carry no session key. type=vnc: VNC browser viewer lifecycle.", {
     type: z.enum(["agent-stream", "system", "session", "error", "heartbeat", "public", "server", "mcp", "vnc"]).optional(),
     lines: z.number().optional(),
     sessionKey: z.string().optional(),
@@ -1522,11 +1523,21 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
         // every type, including those whose actual target file lived
         // elsewhere. Each branch now checks its own resolved path.
         const LOG_DIR = resolve(getAccountDir(), "logs");
+        // type=mcp alone is platform-scoped: `lib/mcp-spawn-tee` writes
+        // mcp-<server>-<sessionId>.log under the session manager's
+        // persistDir/logs, which is this CONFIG_DIR — never the account dir.
+        // Task 2168.
+        const MCP_LOG_DIR = resolve(CONFIG_DIR, "logs");
         // sessionKey is the single identifier on disk.
         // `sessionId` is retained as a legacy alias that maps to the
         // sessionKey-named file will collapse the alias in the UI.
         const idForResolve = sessionKey ?? sessionId;
         if (idForResolve) {
+            // The key is in the mcp log's filename, so this type resolves by
+            // filename in MCP_LOG_DIR rather than by exact name in LOG_DIR.
+            if (type === "mcp") {
+                return { content: [{ type: "text", text: readMcpLogsByKey(MCP_LOG_DIR, idForResolve, lines) }] };
+            }
             if (!existsSync(LOG_DIR)) {
                 return {
                     content: [{
@@ -1546,7 +1557,7 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
             const prefix = prefixMap[resolvedType];
             if (!prefix) {
                 return {
-                    content: [{ type: "text", text: `type=${resolvedType} is not per-session. Valid per-session types: agent-stream, error, session, public. For platform-scoped types (server, vnc, heartbeat, mcp) omit the id.` }],
+                    content: [{ type: "text", text: `type=${resolvedType} is not per-session. Valid per-session types: agent-stream, error, session, public, mcp. For platform-scoped types (server, vnc, heartbeat) omit the id.` }],
                     isError: true,
                 };
             }
@@ -1700,13 +1711,16 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
             }).toString();
             return { content: [{ type: "text", text: `# vnc-boot.log\n\n${result}` }] };
         }
+        // Platform-scoped, and the only type whose files live outside LOG_DIR.
+        if (resolvedType === "mcp") {
+            return { content: [{ type: "text", text: readLatestMcpLog(MCP_LOG_DIR, lines) }] };
+        }
         // agent-stream and the legacy system alias both map to
         // claude-agent-stream-. The fall-through default also covers them.
         const prefix = resolvedType === "error" ? "claude-agent-stderr-"
             : resolvedType === "session" ? "sse-events-"
                 : resolvedType === "public" ? "public-agent-stream-"
-                    : resolvedType === "mcp" ? "mcp-"
-                        : "claude-agent-stream-";
+                    : "claude-agent-stream-";
         // Find the most recently modified file with the matching prefix.
         // LOG_DIR may not exist yet on a Pi with no per-session logs; return
         // the resolved path in the error envelope so the operator can