@rubytech/create-sitedesk-code 0.1.527 → 0.1.529

package/payload/platform/plugins/admin/hooks/fs-schema-guard.sh

@@ -19,8 +19,12 @@
 #     most <bucket>/<entity>/<file> deep; documents/ may be at most
 #     <bucket>/<folder>/<file> deep. Tool-owned dirs pass at any depth.
 #
-# The hook governs the account dir only. A path resolving outside the account
-# dir (cwd) is allowed — platform-source writes are PLATFORM_BOUNDARY's concern.
+# The hook governs this account's dir, and refuses any target inside a SIBLING
+# account under the same accounts root (reason=cross-account) for every session,
+# house included. Containment is decided on the RESOLVED path, so a symlink
+# planted under this account that points into a sibling is refused rather than
+# read as an own-account path. A path outside the accounts root altogether is
+# allowed here — platform-source writes are PLATFORM_BOUNDARY's concern.
 #
 # Exit codes: 0 = allow, 2 = block (stderr shown to the agent). Fail closed when
 # the tool call cannot be inspected (tty or empty stdin). Every block logs
@@ -62,18 +66,46 @@ esac
 
 ACCOUNT_DIR="$PWD"
 
-# Resolve to an account-relative path; allow anything outside the account dir.
-REL=$(FILE_PATH="$FILE_PATH" ACCOUNT_DIR="$ACCOUNT_DIR" python3 -c '
+# Resolve the target to one of three verdicts:
+#   in    <rel>               inside this account
+#   xacct <accountName> <abs> inside a SIBLING account under the same accounts root
+#   out                       anywhere else
+# A sibling counts as an account only when it carries its own account.json — the
+# same marker the standing reconcile uses — so a directory that merely shares the
+# accounts root is never mistaken for one.
+RESOLVED=$(FILE_PATH="$FILE_PATH" ACCOUNT_DIR="$ACCOUNT_DIR" python3 -c '
 import os, sys
-fp = os.environ["FILE_PATH"]; acct = os.environ["ACCOUNT_DIR"]
-ab = fp if os.path.isabs(fp) else os.path.join(acct, fp)
-ab = os.path.normpath(ab); acct = os.path.normpath(acct)
-if ab == acct or not ab.startswith(acct + os.sep):
-    print("")  # outside the account dir (or the dir itself)
-else:
-    print(os.path.relpath(ab, acct))
-' 2>/dev/null || echo "")
-[ -z "$REL" ] && exit 0
+fp = os.environ["FILE_PATH"]; acct = os.path.realpath(os.environ["ACCOUNT_DIR"])
+ab = os.path.realpath(fp if os.path.isabs(fp) else os.path.join(acct, fp))
+if ab != acct and ab.startswith(acct + os.sep):
+    sys.stdout.write("in\t" + os.path.relpath(ab, acct)); sys.exit(0)
+root = os.path.dirname(acct)
+if ab.startswith(root + os.sep):
+    seg = os.path.relpath(ab, root).split(os.sep)[0]
+    if seg != os.path.basename(acct) and os.path.exists(os.path.join(root, seg, "account.json")):
+        sys.stdout.write("xacct\t" + seg + "\t" + ab); sys.exit(0)
+sys.stdout.write("out")
+' 2>/dev/null || echo "out")
+IFS=$'\t' read -r VERDICT PAYLOAD XABS <<< "$RESOLVED"
+
+# Another account's data directory is refused for EVERY session, house included.
+# The gated account-scoped file tools are the one cross-account route: they
+# resolve the caller's authority, reject path escapes, and log the decision. Two
+# routes to one capability would leave this one unlogged.
+#
+# Checked before the schema parse below on purpose. The missing-schema fail-open
+# governs this account's own layout; it must not hand out a sibling's files.
+if [ "$VERDICT" = "xacct" ]; then
+  echo "[fs-guard] blocked path=$XABS reason=cross-account target=$(printf '%s' "$PAYLOAD" | cut -c1-8)" >&2
+  echo "Blocked: '$XABS' is inside another account's data directory. A file edit reaches this account's data only. Cross-account file work goes through the account-scoped file tools, naming the target account explicitly." >&2
+  exit 2
+fi
+
+# Anything outside this account and not inside a sibling account is allowed here —
+# writes to the platform trees are the platform boundary's concern, enforced by
+# filesystem immutability rather than by this hook.
+[ "$VERDICT" = "in" ] || exit 0
+REL="$PAYLOAD"
 
 # Parse the allowed top-level set from the account's seeded SCHEMA.md.
 ALLOWED=""

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -26,7 +26,9 @@ import { resolvePublicHostname } from "./lib/public-hostname.js";
 import { resolveAdminHostname } from "./lib/admin-hostname.js";
 import { publishSite } from "./tools/publish-site.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
+import { resolveIngestToken } from "./tools/linkedin-ingest-token.js";
 import { startCpuTriage, readCpuTriage } from "./tools/cpu-triage.js";
+import { readMcpLogsByKey, readLatestMcpLog } from "./tools/logs-read-mcp.js";
 import { runCatalogueCensus } from "./lib/catalogue-census.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
 // Task 2130 — the same roster and the same MERGE seed-neo4j.sh runs for the
@@ -737,6 +739,42 @@ eagerTool(server, "capabilities-here", "Returns the live install set on the curr
         };
     }
 });
+eagerTool(server, "linkedin-ingest-token", "Returns this account's durable LinkedIn ingest token — the credential the SiteDesk LinkedIn Ingest Chrome extension needs in its options page. Call this whenever the operator is setting up that extension, or reports a capture failing with a rejected token, and hand them the value. The token is minted on the first call and stable from then on: it survives service restarts and new chat sessions and does not expire. It is NOT a conversation session key and NOT the admin browser's session_key — the ingest route accepts neither, and pasting one is the failure this tool exists to prevent. action='rotate' issues a replacement and invalidates the old one, so every extension install must then be re-pasted; only rotate when the operator asks or the token is believed leaked.", {
+    action: z
+        .enum(["show", "rotate"])
+        .optional()
+        .describe("show (default) mints on the first call then returns the stable token; rotate replaces it and invalidates every existing extension install"),
+}, async ({ action }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("linkedin-ingest-token");
+    const op = action === "rotate" ? "rotate" : "show";
+    try {
+        const result = resolveIngestToken(ACCOUNTS_ROOT, ACCOUNT_ID, op);
+        // The token value is never logged: it is a bearer secret.
+        process.stderr.write(`[linkedin-ingest-token] op=${op} accountId=${ACCOUNT_ID.slice(0, 8)} minted=${result.minted}\n`);
+        const note = result.rotated
+            ? "Rotated. Every existing extension install must be re-pasted with this value."
+            : result.minted
+                ? "Minted now. This is stable from here on."
+                : "Existing token, unchanged.";
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: `${note}\n\nIngest token: ${result.token}\n\nPaste this into the extension options page's "Ingest token" field, together with the admin host.`,
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[linkedin-ingest-token] op=${op} outcome=error reason=${msg}\n`);
+        return {
+            content: [{ type: "text", text: `linkedin-ingest-token failed: ${msg}` }],
+            isError: true,
+        };
+    }
+});
 eagerTool(server, "account-update", "Update a user-configurable setting in account.json. Valid fields: outputStyle (default|explanatory), thinkingView (default|expanded|collapsed), effort (low|medium|high|max|auto), adminModel (any Anthropic model ID), publicModel (any Anthropic model ID), defaultAgent (slug of an existing public agent, or empty string to clear). Changes take effect on the next session.", {
     field: z.enum(["outputStyle", "thinkingView", "effort", "adminModel", "publicModel", "defaultAgent"]),
     value: z.string(),
@@ -1503,7 +1541,7 @@ lifelineTool(server, "agent-list", "List all public (non-admin) agents with thei
         };
     }
 });
-eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream/error/session/public) are per-session — pass `sessionKey` (preferred) or the legacy `sessionId` alias to retrieve a single session's log from first [spawn] to final [process-exit]. type=agent-stream: per-session tool-use/tool-result archive (every `[tool-use]` and `[tool-result]` pair with full input + output JSON, plus raw Claude stream-json, agent events, and MCP server stderr via tee). USE THIS when investigating what an agent ACTUALLY did with its tools — server.log only carries `[persist] tool-call persisted` markers, not bodies. (`type=system` is a backwards-compatible alias for the same archive.) type=session: SSE events sent to client. type=error: Claude subprocess stderr (raw — NODE_DEBUG HTTP/NET/UNDICI traces land in agent-stream via the stream tee, not here). type=heartbeat: platform event dispatcher (check-due-events cron). type=public: public agent diagnostic log. type=server: platform server log. type=mcp: MCP server stderr (per-plugin raw). type=vnc: VNC browser viewer lifecycle.", {
+eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream/error/session/public) are per-session — pass `sessionKey` (preferred) or the legacy `sessionId` alias to retrieve a single session's log from first [spawn] to final [process-exit]. type=agent-stream: per-session tool-use/tool-result archive (every `[tool-use]` and `[tool-result]` pair with full input + output JSON, plus raw Claude stream-json, agent events, and MCP server stderr via tee). USE THIS when investigating what an agent ACTUALLY did with its tools — server.log only carries `[persist] tool-call persisted` markers, not bodies. (`type=system` is a backwards-compatible alias for the same archive.) type=session: SSE events sent to client. type=error: Claude subprocess stderr (raw — NODE_DEBUG HTTP/NET/UNDICI traces land in agent-stream via the stream tee, not here). type=heartbeat: platform event dispatcher (check-due-events cron). type=public: public agent diagnostic log. type=server: platform server log. type=mcp: MCP server stderr (per-plugin raw), resolved under ~/.<brand>/logs — the platform config dir, not the account log dir. With a sessionKey, every mcp-*.log whose FILENAME carries that key is tailed, up to 20 files, and a truncated reply names the total that matched; an 8-character key prefix matches. The key is never matched against file contents, because MCP log lines carry no session key. type=vnc: VNC browser viewer lifecycle.", {
     type: z.enum(["agent-stream", "system", "session", "error", "heartbeat", "public", "server", "mcp", "vnc"]).optional(),
     lines: z.number().optional(),
     sessionKey: z.string().optional(),
@@ -1522,11 +1560,21 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
         // every type, including those whose actual target file lived
         // elsewhere. Each branch now checks its own resolved path.
         const LOG_DIR = resolve(getAccountDir(), "logs");
+        // type=mcp alone is platform-scoped: `lib/mcp-spawn-tee` writes
+        // mcp-<server>-<sessionId>.log under the session manager's
+        // persistDir/logs, which is this CONFIG_DIR — never the account dir.
+        // Task 2168.
+        const MCP_LOG_DIR = resolve(CONFIG_DIR, "logs");
         // sessionKey is the single identifier on disk.
         // `sessionId` is retained as a legacy alias that maps to the
         // sessionKey-named file will collapse the alias in the UI.
         const idForResolve = sessionKey ?? sessionId;
         if (idForResolve) {
+            // The key is in the mcp log's filename, so this type resolves by
+            // filename in MCP_LOG_DIR rather than by exact name in LOG_DIR.
+            if (type === "mcp") {
+                return { content: [{ type: "text", text: readMcpLogsByKey(MCP_LOG_DIR, idForResolve, lines) }] };
+            }
             if (!existsSync(LOG_DIR)) {
                 return {
                     content: [{
@@ -1546,7 +1594,7 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
             const prefix = prefixMap[resolvedType];
             if (!prefix) {
                 return {
-                    content: [{ type: "text", text: `type=${resolvedType} is not per-session. Valid per-session types: agent-stream, error, session, public. For platform-scoped types (server, vnc, heartbeat, mcp) omit the id.` }],
+                    content: [{ type: "text", text: `type=${resolvedType} is not per-session. Valid per-session types: agent-stream, error, session, public, mcp. For platform-scoped types (server, vnc, heartbeat) omit the id.` }],
                     isError: true,
                 };
             }
@@ -1700,13 +1748,16 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
             }).toString();
             return { content: [{ type: "text", text: `# vnc-boot.log\n\n${result}` }] };
         }
+        // Platform-scoped, and the only type whose files live outside LOG_DIR.
+        if (resolvedType === "mcp") {
+            return { content: [{ type: "text", text: readLatestMcpLog(MCP_LOG_DIR, lines) }] };
+        }
         // agent-stream and the legacy system alias both map to
         // claude-agent-stream-. The fall-through default also covers them.
         const prefix = resolvedType === "error" ? "claude-agent-stderr-"
             : resolvedType === "session" ? "sse-events-"
                 : resolvedType === "public" ? "public-agent-stream-"
-                    : resolvedType === "mcp" ? "mcp-"
-                        : "claude-agent-stream-";
+                    : "claude-agent-stream-";
         // Find the most recently modified file with the matching prefix.
         // LOG_DIR may not exist yet on a Pi with no per-session logs; return
         // the resolved path in the error envelope so the operator can