@xmarts/genius-setup 1.12.0 → 1.13.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmarts/genius-setup",
-  "version": "1.12.0",
+  "version": "1.13.1",
   "description": "One-command, self-updating onboarding for Xmarts Genius (Brain MCP + per-turn injection + automatic session/time capture + presence heartbeat for honest time-tracking 'amarre' + plan/committee→Brain enforcement + CLAUDE.md protocol + MCP fan-out: provisions the consultant's granted MCP servers into Claude Code & Claude Desktop). Secret-free onboarding via single-use setup-token exchange. Installs once; self-updates daily so new tools/skills/features arrive with zero action.",
   "bin": {
     "genius-setup": "bin/genius-setup.js"

package/plugin/skills/genius-operator/SKILL.md

@@ -10,7 +10,11 @@ description: >
   deploy a webapp to a client, can't see/manage a client's modules, or whenever the work
   touches xma_genius, xma_connect, beesmart_genius, the Genius Brain, GEA Ecuador, or
   deploying/controlling anything on a client instance from the central — even if the user
-  doesn't name the tool. If you ever think "I don't have access to that client", read this
+  doesn't name the tool. ALSO use it the moment a consultant needs to LOG INTO a client's
+  Odoo UI / needs a login / user / password / access URL for a client instance (e.g.
+  "necesito acceso a la UI de X", "no puedo entrar a la instancia de X", "olvidé mi
+  contraseña de X", "how do I log into X") — provision it and hand back the credentials
+  on the spot. If you ever think "I don't have access to that client", read this
   skill first: you almost certainly do.
 ---
 
@@ -78,6 +82,19 @@ argument shape or hit an edge case.
 33 tools are routable to clients in total. If a tool you need isn't listed, check
 [references/tool-catalog.md](references/tool-catalog.md) before concluding it's impossible.
 
+## Consultant needs to log into a client's UI → hand them credentials NOW
+
+If a consultant says any of *"necesito/quiero acceso a la UI de \<cliente\>"*, *"no puedo entrar
+a la instancia de \<cliente\>"*, *"how do I log into \<client\>"*, or *"olvidé mi contraseña de
+\<cliente\>"* — **provision it and give back URL + user + password on the spot. No waiting, no
+admin hop.** Every consultant has `odoo.write odoo.execute` on their **assigned** clients, so this
+runs in their own session via `target_client`. It is one idempotent `execute_orm` (creates on first
+ask, resets the temp password on re-ask). The **exact one-shot snippet + how to hand back the
+credential without leaking it to the Brain** is in
+[references/provision-consultant-ui-access.md](references/provision-consultant-ui-access.md) — read
+it and act. The only thing that can block you is the client not being in their assignments (then an
+admin assigns it); everything else is self-serve.
+
 ## Always orient before you act
 
 The Brain (`query_knowledge`) is the server-side source of truth and it remembers things this

package/plugin/skills/genius-operator/references/provision-consultant-ui-access.md

@@ -12,6 +12,74 @@ login. It has only `base.group_user` (headless), sharing a password kills the au
 and a plaintext password in a Claude session can be indexed by the Brain. Give each
 consultant their **own** audited user.
 
+## ⚡ Frictionless trigger — do this the moment a consultant asks
+
+**Trigger phrases** (any consultant, any session): *"necesito/quiero acceso a la UI de \<cliente\>"*,
+*"how do I log into \<client\>'s Odoo"*, *"no puedo entrar a la instancia de \<cliente\>"*,
+*"olvidé mi contraseña de \<cliente\>"*. → **Provision immediately and hand back URL + user +
+password. Do NOT make them wait or ask an admin.** Every consultant has `odoo.write odoo.execute`
+on their **assigned** clients, so this runs in their own session through `target_client`.
+
+**One shot (idempotent — creates on first ask, resets the temp password on re-ask):** run via
+`execute_orm` with `target_client=<client name or UUID>`. Resolve the requesting person's real
+name + xmarts.com email first (from `get_my_profile`, or the consultant record on the master).
+
+```python
+U = env['res.users'].sudo()
+NAME, LOGIN = '<Full Name>', '<person@xmarts.com>'   # the consultant who needs access
+env.cr.execute("SELECT replace(gen_random_uuid()::text, '-', '')")
+raw = env.cr.fetchone()[0]
+pw = 'Xma-%s-%s-Ux!' % (raw[:6], raw[6:12])           # temp, no spaces, meets complexity
+user = U.search([('login', '=', LOGIN)], limit=1)
+if user:
+    user.write({'password': pw, 'active': True})       # re-ask / forgot password -> fresh temp pw
+    status = 'reset'
+else:
+    # Clone the RICHEST non-admin consultant peer (best working profile, never over-grant
+    # Settings-admin). Filter service accounts / admin IN PYTHON — the gateway's anti-SQL
+    # guard mangles `like`/`%` domains (a `not like 'xma_%'` term silently returns nothing).
+    # Plain loop — execute_orm forbids lambda closures. Fall back to the Sales baseline if
+    # the client has no usable peer yet.
+    peers = U.search([('share', '=', False), ('active', '=', True), ('id', '!=', 1)])
+    sysg = env.ref('base.group_system', raise_if_not_found=False)
+    peer = U.browse(); best = -1
+    for p in peers:
+        lg = p.login or ''
+        if lg == 'admin' or lg.startswith('xma_'):
+            continue                                   # skip the admin + service accounts
+        if sysg and sysg.id in p.group_ids.ids:
+            continue                                   # never clone an admin's groups
+        n = len(p.group_ids)
+        if n > best:
+            best = n; peer = p
+    gids = peer.group_ids.ids if peer else []
+    if not gids:
+        base = env.ref('base.group_user', raise_if_not_found=False)
+        sales = env.ref('sales_team.group_sale_salesman', raise_if_not_found=False)
+        gids = [g.id for g in (base, sales) if g]
+    comp = (peer.company_id.id if peer else False) or env.company.id
+    user = U.with_context(no_reset_password=True, mail_create_nosubscribe=True).create({
+        'name': NAME, 'login': LOGIN, 'email': LOGIN, 'password': pw,
+        'company_id': comp, 'company_ids': [Command.set([comp])],
+        'group_ids': [Command.set(gids)]})
+    status = 'created'
+result = {'status': status, 'uid': user.id, 'login': user.login, 'password': pw,
+          'url': env['ir.config_parameter'].sudo().get_param('web.base.url') + '/web/login'}
+```
+
+Then **hand it back immediately**, formatting the secret so the capture hook redacts it from the
+Brain but the consultant still sees it live:
+
+```
+url:      <result.url>
+login:    <result.login>
+password: <result.password>      ← temp, change it on first login (Preferences → Account Security)
+```
+
+Only assigned clients are reachable (`target_client` refuses unassigned). If the client is NOT in
+their assignments, tell them to ask an admin to assign it — that is the only gate. Nothing else
+about this should require a human hop.
+
 ## The pattern (scalable, sustainable, auditable)
 
 **Per-consultant internal user in the client instance, provisioned on demand through the