@xmarts/genius-setup 1.11.0 → 1.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmarts/genius-setup",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "One-command, self-updating onboarding for Xmarts Genius (Brain MCP + per-turn injection + automatic session/time capture + presence heartbeat for honest time-tracking 'amarre' + plan/committee→Brain enforcement + CLAUDE.md protocol + MCP fan-out: provisions the consultant's granted MCP servers into Claude Code & Claude Desktop). Secret-free onboarding via single-use setup-token exchange. Installs once; self-updates daily so new tools/skills/features arrive with zero action.",
   "bin": {
     "genius-setup": "bin/genius-setup.js"

package/plugin/skills/genius-operator/SKILL.md

@@ -67,6 +67,7 @@ argument shape or hit an edge case.
 | Deploy / install / upgrade a **module** | `manage_module`, `deploy_module` | ✅ — see [manage-client-modules.md](references/manage-client-modules.md) |
 | Inspect a model's schema | `get_model_schema`, `list_models` | ✅ |
 | Read / search a client's source code | `code_read`, `code_search`, `search_webapp_code` | ✅ |
+| Give a **consultant a UI login** on a client | `execute_orm` (create `res.users`) | ✅ — see [provision-consultant-ui-access.md](references/provision-consultant-ui-access.md) |
 | Snapshot / restore / export the DB | `create_snapshot`, `restore_snapshot`, `export_database` | ✅ |
 | Restart Odoo | `trigger_restart` | ✅ |
 | Build a chart/dashboard | `create_echart` | ✅ *(same infra caveat as webapps)* |

package/plugin/skills/genius-operator/references/provision-consultant-ui-access.md

@@ -0,0 +1,101 @@
+# Provisioning a consultant a UI login on a client Odoo
+
+**The need (recurring):** a Genius consultant must log into a *client's* Odoo **UI**
+(`https://<client>/web/login`) to work visually — test screens, configure Studio, click
+through flows. Genius manages consultants centrally (`xma.consultant` on the master), but
+each client is a **separate Odoo database**; a master identity is **not** a login on the
+client. There is no SSO federation — the `xma_connect` gateway is HMAC machine-to-machine,
+not user identity. So the consultant needs a real `res.users` **in that client instance**.
+
+**Do NOT share the gateway service account** (`xma_genius@<client>`) or any other shared
+login. It has only `base.group_user` (headless), sharing a password kills the audit trail,
+and a plaintext password in a Claude session can be indexed by the Brain. Give each
+consultant their **own** audited user.
+
+## The pattern (scalable, sustainable, auditable)
+
+**Per-consultant internal user in the client instance, provisioned on demand through the
+Genius gateway, cloning an existing consultant's group profile, with a temp password the
+consultant changes on first login.**
+
+- **Auditable** — real per-person `res.users`; `create_uid`/`create_date`/login identify who.
+- **Consistent** — clone the groups of a consultant who already works that client (no
+  over/under-grant guesswork). If none exists, use the client's Sales-user baseline
+  (`base.group_user` + the Sales "All Documents" group).
+- **Central + repeatable** — one `execute_orm` through `target_client`; no per-client manual admin.
+- **Least-shared-secret** — temp password, changed on first login; deep "modify anything"
+  work happens through the consultant's Claude Code + gateway (full ORM/code), NOT the UI login.
+
+### UI login ≠ programmatic access — two distinct rails
+1. **UI login** (this doc) — for *visual* work. Modest groups (mirror an existing consultant).
+2. **Programmatic** (Claude Code + `beesmart_genius` MCP + `target_client`) — for reading
+   code, editing modules/webapps, running ORM. This already runs with full gateway access, so
+   a consultant rarely needs broad UI groups. Grant the UI the minimum for visual work; escalate
+   one group at a time only when a specific task in the UI is blocked.
+
+## Runbook (≈1 minute)
+
+Resolve the client UUID with `genius_capability_map` (its payload lists every client), then:
+
+**1. Probe the client:** confirm reachable, the consultant has no login yet, whether SMTP
+exists (usually not → no email invite → temp password), and an existing consultant to clone.
+```python
+U = env['res.users'].sudo()
+base_url = env['ir.config_parameter'].sudo().get_param('web.base.url')
+internal = [{'id': u.id, 'login': u.login, 'name': u.name}
+            for u in U.search([('share','=',False),('active','=',True)])]
+exists = U.search([('login','=','<consultant.email>')]).ids
+result = {'base_url': base_url, 'internal': internal, 'already_there': exists}
+```
+Pick the `source` user to clone (an existing consultant on this client). Odoo 19 uses
+`group_ids` (NOT `groups_id`) for direct groups on `res.users`.
+
+**2. Create the user** (clone groups + server-side temp password; suppress the reset-email
+attempt that fails with no SMTP):
+```python
+U = env['res.users'].sudo()
+LOGIN = '<consultant.email>'          # match their xmarts.com email for consistency
+if U.search([('login','=',LOGIN)]):
+    result = {'status': 'exists'}
+else:
+    env.cr.execute("SELECT replace(gen_random_uuid()::text,'-','')")
+    raw = env.cr.fetchone()[0]
+    pw = 'Xma-%s-%s-Ux!' % (raw[:6], raw[6:12])   # no spaces, meets complexity
+    src = U.browse(<source_uid>)                   # an existing consultant on this client
+    comp = src.company_id.id or env.company.id
+    user = U.with_context(no_reset_password=True, mail_create_nosubscribe=True).create({
+        'name': '<Consultant Name>', 'login': LOGIN, 'email': LOGIN, 'password': pw,
+        'company_id': comp, 'company_ids': [Command.set([comp])],
+        'group_ids': [Command.set(src.group_ids.ids)],
+    })
+    result = {'status':'created','uid':user.id,'password':pw,'groups':user.group_ids.ids}
+```
+
+**3. Verify** the hash persisted (login will work) — never read/expose the hash value:
+```python
+env.cr.execute("SELECT (password IS NOT NULL AND length(password)>20) FROM res_users WHERE id=<uid>")
+result = {'password_ok': bool(env.cr.fetchone()[0])}
+```
+
+**4. Deliver securely.** URL (`<base_url>/web/login`) + login are non-secret → inline is fine.
+The password is a secret: the session-capture hook redacts `password: <value>` (English
+keyword + value) both client- and server-side, so present it in **that exact form** — the
+owner sees it live, the Brain stores `[REDACTED]`. Also write it to `~/.genius/secrets/<client>_<consultant>_ui.txt`
+(chmod 600) for reliable relay. **Mandate a change on first login** (Preferences → Account
+Security) — that burns the transited temp value.
+
+**5. Give them Claude Code too** (so they can modify anything programmatically): on the
+master, `env['xma.consultant'].browse(<id>).write({'token_expiry_mode':'7d'})` then
+`.action_generate_setup_package()`; read the newest `xma.consultant.setup.wizard` for that
+consultant → its `npx_command`. They run it once in VSCode (Windows: PowerShell form). It
+installs the MCP + hooks + skills and self-updates daily. Confirm the client is in their
+`client_ids` so `target_client` routing works.
+
+## Notes / gotchas
+- **No `signup_token` in this estate** (auth_signup is partial on xmarts.net/clients) → the
+  reset-link flow is unreliable; use the temp-password path. (Brain: "signup_token roto".)
+- **Odoo 19:** `res.users` direct groups = `group_ids`; `all_group_ids` is computed (implied).
+- **Revoke** = archive the user on the client (`delete_record` → `active=False`), reversible.
+- **Don't** grant `base.group_system` (Settings/admin) by default — escalate per task only.
+- This is a per-`(consultant, client)` on-demand action, not an auto-hook: not every
+  consultant needs UI on every client.