@xmarts/genius-setup 1.11.0 → 1.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmarts/genius-setup",
-  "version": "1.11.0",
+  "version": "1.13.0",
   "description": "One-command, self-updating onboarding for Xmarts Genius (Brain MCP + per-turn injection + automatic session/time capture + presence heartbeat for honest time-tracking 'amarre' + plan/committee→Brain enforcement + CLAUDE.md protocol + MCP fan-out: provisions the consultant's granted MCP servers into Claude Code & Claude Desktop). Secret-free onboarding via single-use setup-token exchange. Installs once; self-updates daily so new tools/skills/features arrive with zero action.",
   "bin": {
     "genius-setup": "bin/genius-setup.js"

package/plugin/skills/genius-operator/SKILL.md

@@ -67,6 +67,7 @@ argument shape or hit an edge case.
 | Deploy / install / upgrade a **module** | `manage_module`, `deploy_module` | ✅ — see [manage-client-modules.md](references/manage-client-modules.md) |
 | Inspect a model's schema | `get_model_schema`, `list_models` | ✅ |
 | Read / search a client's source code | `code_read`, `code_search`, `search_webapp_code` | ✅ |
+| Give a **consultant a UI login** on a client | `execute_orm` (create `res.users`) | ✅ — see [provision-consultant-ui-access.md](references/provision-consultant-ui-access.md) |
 | Snapshot / restore / export the DB | `create_snapshot`, `restore_snapshot`, `export_database` | ✅ |
 | Restart Odoo | `trigger_restart` | ✅ |
 | Build a chart/dashboard | `create_echart` | ✅ *(same infra caveat as webapps)* |
@@ -77,6 +78,19 @@ argument shape or hit an edge case.
 33 tools are routable to clients in total. If a tool you need isn't listed, check
 [references/tool-catalog.md](references/tool-catalog.md) before concluding it's impossible.
 
+## Consultant needs to log into a client's UI → hand them credentials NOW
+
+If a consultant says any of *"necesito/quiero acceso a la UI de \<cliente\>"*, *"no puedo entrar
+a la instancia de \<cliente\>"*, *"how do I log into \<client\>"*, or *"olvidé mi contraseña de
+\<cliente\>"* — **provision it and give back URL + user + password on the spot. No waiting, no
+admin hop.** Every consultant has `odoo.write odoo.execute` on their **assigned** clients, so this
+runs in their own session via `target_client`. It is one idempotent `execute_orm` (creates on first
+ask, resets the temp password on re-ask). The **exact one-shot snippet + how to hand back the
+credential without leaking it to the Brain** is in
+[references/provision-consultant-ui-access.md](references/provision-consultant-ui-access.md) — read
+it and act. The only thing that can block you is the client not being in their assignments (then an
+admin assigns it); everything else is self-serve.
+
 ## Always orient before you act
 
 The Brain (`query_knowledge`) is the server-side source of truth and it remembers things this

package/plugin/skills/genius-operator/references/provision-consultant-ui-access.md

@@ -0,0 +1,169 @@
+# Provisioning a consultant a UI login on a client Odoo
+
+**The need (recurring):** a Genius consultant must log into a *client's* Odoo **UI**
+(`https://<client>/web/login`) to work visually — test screens, configure Studio, click
+through flows. Genius manages consultants centrally (`xma.consultant` on the master), but
+each client is a **separate Odoo database**; a master identity is **not** a login on the
+client. There is no SSO federation — the `xma_connect` gateway is HMAC machine-to-machine,
+not user identity. So the consultant needs a real `res.users` **in that client instance**.
+
+**Do NOT share the gateway service account** (`xma_genius@<client>`) or any other shared
+login. It has only `base.group_user` (headless), sharing a password kills the audit trail,
+and a plaintext password in a Claude session can be indexed by the Brain. Give each
+consultant their **own** audited user.
+
+## ⚡ Frictionless trigger — do this the moment a consultant asks
+
+**Trigger phrases** (any consultant, any session): *"necesito/quiero acceso a la UI de \<cliente\>"*,
+*"how do I log into \<client\>'s Odoo"*, *"no puedo entrar a la instancia de \<cliente\>"*,
+*"olvidé mi contraseña de \<cliente\>"*. → **Provision immediately and hand back URL + user +
+password. Do NOT make them wait or ask an admin.** Every consultant has `odoo.write odoo.execute`
+on their **assigned** clients, so this runs in their own session through `target_client`.
+
+**One shot (idempotent — creates on first ask, resets the temp password on re-ask):** run via
+`execute_orm` with `target_client=<client name or UUID>`. Resolve the requesting person's real
+name + xmarts.com email first (from `get_my_profile`, or the consultant record on the master).
+
+```python
+U = env['res.users'].sudo()
+NAME, LOGIN = '<Full Name>', '<person@xmarts.com>'   # the consultant who needs access
+env.cr.execute("SELECT replace(gen_random_uuid()::text, '-', '')")
+raw = env.cr.fetchone()[0]
+pw = 'Xma-%s-%s-Ux!' % (raw[:6], raw[6:12])           # temp, no spaces, meets complexity
+user = U.search([('login', '=', LOGIN)], limit=1)
+if user:
+    user.write({'password': pw, 'active': True})       # re-ask / forgot password -> fresh temp pw
+    status = 'reset'
+else:
+    # Clone the RICHEST non-admin consultant peer (best working profile, never over-grant
+    # Settings-admin). Filter service accounts / admin IN PYTHON — the gateway's anti-SQL
+    # guard mangles `like`/`%` domains (a `not like 'xma_%'` term silently returns nothing).
+    # Plain loop — execute_orm forbids lambda closures. Fall back to the Sales baseline if
+    # the client has no usable peer yet.
+    peers = U.search([('share', '=', False), ('active', '=', True), ('id', '!=', 1)])
+    sysg = env.ref('base.group_system', raise_if_not_found=False)
+    peer = U.browse(); best = -1
+    for p in peers:
+        lg = p.login or ''
+        if lg == 'admin' or lg.startswith('xma_'):
+            continue                                   # skip the admin + service accounts
+        if sysg and sysg.id in p.group_ids.ids:
+            continue                                   # never clone an admin's groups
+        n = len(p.group_ids)
+        if n > best:
+            best = n; peer = p
+    gids = peer.group_ids.ids if peer else []
+    if not gids:
+        base = env.ref('base.group_user', raise_if_not_found=False)
+        sales = env.ref('sales_team.group_sale_salesman', raise_if_not_found=False)
+        gids = [g.id for g in (base, sales) if g]
+    comp = (peer.company_id.id if peer else False) or env.company.id
+    user = U.with_context(no_reset_password=True, mail_create_nosubscribe=True).create({
+        'name': NAME, 'login': LOGIN, 'email': LOGIN, 'password': pw,
+        'company_id': comp, 'company_ids': [Command.set([comp])],
+        'group_ids': [Command.set(gids)]})
+    status = 'created'
+result = {'status': status, 'uid': user.id, 'login': user.login, 'password': pw,
+          'url': env['ir.config_parameter'].sudo().get_param('web.base.url') + '/web/login'}
+```
+
+Then **hand it back immediately**, formatting the secret so the capture hook redacts it from the
+Brain but the consultant still sees it live:
+
+```
+url:      <result.url>
+login:    <result.login>
+password: <result.password>      ← temp, change it on first login (Preferences → Account Security)
+```
+
+Only assigned clients are reachable (`target_client` refuses unassigned). If the client is NOT in
+their assignments, tell them to ask an admin to assign it — that is the only gate. Nothing else
+about this should require a human hop.
+
+## The pattern (scalable, sustainable, auditable)
+
+**Per-consultant internal user in the client instance, provisioned on demand through the
+Genius gateway, cloning an existing consultant's group profile, with a temp password the
+consultant changes on first login.**
+
+- **Auditable** — real per-person `res.users`; `create_uid`/`create_date`/login identify who.
+- **Consistent** — clone the groups of a consultant who already works that client (no
+  over/under-grant guesswork). If none exists, use the client's Sales-user baseline
+  (`base.group_user` + the Sales "All Documents" group).
+- **Central + repeatable** — one `execute_orm` through `target_client`; no per-client manual admin.
+- **Least-shared-secret** — temp password, changed on first login; deep "modify anything"
+  work happens through the consultant's Claude Code + gateway (full ORM/code), NOT the UI login.
+
+### UI login ≠ programmatic access — two distinct rails
+1. **UI login** (this doc) — for *visual* work. Modest groups (mirror an existing consultant).
+2. **Programmatic** (Claude Code + `beesmart_genius` MCP + `target_client`) — for reading
+   code, editing modules/webapps, running ORM. This already runs with full gateway access, so
+   a consultant rarely needs broad UI groups. Grant the UI the minimum for visual work; escalate
+   one group at a time only when a specific task in the UI is blocked.
+
+## Runbook (≈1 minute)
+
+Resolve the client UUID with `genius_capability_map` (its payload lists every client), then:
+
+**1. Probe the client:** confirm reachable, the consultant has no login yet, whether SMTP
+exists (usually not → no email invite → temp password), and an existing consultant to clone.
+```python
+U = env['res.users'].sudo()
+base_url = env['ir.config_parameter'].sudo().get_param('web.base.url')
+internal = [{'id': u.id, 'login': u.login, 'name': u.name}
+            for u in U.search([('share','=',False),('active','=',True)])]
+exists = U.search([('login','=','<consultant.email>')]).ids
+result = {'base_url': base_url, 'internal': internal, 'already_there': exists}
+```
+Pick the `source` user to clone (an existing consultant on this client). Odoo 19 uses
+`group_ids` (NOT `groups_id`) for direct groups on `res.users`.
+
+**2. Create the user** (clone groups + server-side temp password; suppress the reset-email
+attempt that fails with no SMTP):
+```python
+U = env['res.users'].sudo()
+LOGIN = '<consultant.email>'          # match their xmarts.com email for consistency
+if U.search([('login','=',LOGIN)]):
+    result = {'status': 'exists'}
+else:
+    env.cr.execute("SELECT replace(gen_random_uuid()::text,'-','')")
+    raw = env.cr.fetchone()[0]
+    pw = 'Xma-%s-%s-Ux!' % (raw[:6], raw[6:12])   # no spaces, meets complexity
+    src = U.browse(<source_uid>)                   # an existing consultant on this client
+    comp = src.company_id.id or env.company.id
+    user = U.with_context(no_reset_password=True, mail_create_nosubscribe=True).create({
+        'name': '<Consultant Name>', 'login': LOGIN, 'email': LOGIN, 'password': pw,
+        'company_id': comp, 'company_ids': [Command.set([comp])],
+        'group_ids': [Command.set(src.group_ids.ids)],
+    })
+    result = {'status':'created','uid':user.id,'password':pw,'groups':user.group_ids.ids}
+```
+
+**3. Verify** the hash persisted (login will work) — never read/expose the hash value:
+```python
+env.cr.execute("SELECT (password IS NOT NULL AND length(password)>20) FROM res_users WHERE id=<uid>")
+result = {'password_ok': bool(env.cr.fetchone()[0])}
+```
+
+**4. Deliver securely.** URL (`<base_url>/web/login`) + login are non-secret → inline is fine.
+The password is a secret: the session-capture hook redacts `password: <value>` (English
+keyword + value) both client- and server-side, so present it in **that exact form** — the
+owner sees it live, the Brain stores `[REDACTED]`. Also write it to `~/.genius/secrets/<client>_<consultant>_ui.txt`
+(chmod 600) for reliable relay. **Mandate a change on first login** (Preferences → Account
+Security) — that burns the transited temp value.
+
+**5. Give them Claude Code too** (so they can modify anything programmatically): on the
+master, `env['xma.consultant'].browse(<id>).write({'token_expiry_mode':'7d'})` then
+`.action_generate_setup_package()`; read the newest `xma.consultant.setup.wizard` for that
+consultant → its `npx_command`. They run it once in VSCode (Windows: PowerShell form). It
+installs the MCP + hooks + skills and self-updates daily. Confirm the client is in their
+`client_ids` so `target_client` routing works.
+
+## Notes / gotchas
+- **No `signup_token` in this estate** (auth_signup is partial on xmarts.net/clients) → the
+  reset-link flow is unreliable; use the temp-password path. (Brain: "signup_token roto".)
+- **Odoo 19:** `res.users` direct groups = `group_ids`; `all_group_ids` is computed (implied).
+- **Revoke** = archive the user on the client (`delete_record` → `active=False`), reversible.
+- **Don't** grant `base.group_system` (Settings/admin) by default — escalate per task only.
+- This is a per-`(consultant, client)` on-demand action, not an auto-hook: not every
+  consultant needs UI on every client.