@xmarts/genius-setup 1.3.0 → 1.5.0

package/CLAUDE_PROTOCOL.md

@@ -0,0 +1,36 @@
+# Xmarts Genius — Protocolo de Consultor
+
+> Esta sección la instala/actualiza automáticamente `@xmarts/genius-setup`. No la edites a mano.
+
+## Cómo funciona (cero fricción)
+
+El Brain de Genius está conectado vía el MCP **`beesmart_genius`** y dos hooks de Claude Code:
+- **Inyección por turno** (UserPromptSubmit/SessionStart): en cada turno recibes automáticamente los
+  learnings, playbooks y patrones relevantes — no tienes que pedirlos.
+- **Captura automática** (SessionEnd/PreCompact/Stop): tus hallazgos y tu sesión se capturan solos al
+  final; no tienes que documentar manualmente.
+- **Auto-actualización**: el paquete se refresca solo en segundo plano (1×/día). Cuando agregamos tools,
+  skills o features, las recibes en tus turnos **sin hacer nada**.
+
+## Reglas Obligatorias (siempre activas)
+
+1. **ANTES de cada tarea**: usa `query_knowledge` (o `ask_brain`) para buscar conocimiento existente.
+2. **AL descubrir algo nuevo**: captura con `capture_learning` — título claro + resolución detallada.
+3. **AL resolver un error**: documenta error → fix (el Brain auto-detecta el par).
+4. **SIEMPRE usa `target_client`** para operar en un cliente (p.ej. `target_client="GEA Ecuador"`).
+5. **NUNCA te conectes directo al Odoo del cliente** — todo fluye por el MCP `beesmart_genius`.
+6. Tu tiempo se sugiere solo a partir de tu actividad; confírmalo cuando puedas en **My Week**
+   (`/mcp/webapp/my-week`). Solo el tiempo que confirmas cuenta como horas reales.
+
+## Tools (servidas dinámicamente por `beesmart_genius`)
+
+| Tool | Cuándo usar |
+|------|-------------|
+| `query_knowledge` | Antes de cada tarea — busca en el Brain |
+| `capture_learning` | Al descubrir algo nuevo |
+| `get_my_profile` | Ver tu perfil de consultor |
+| `search_read` / `execute_orm` + `target_client` | Consultar/operar data de cualquier cliente vía gateway |
+| `list_models` / `get_model_schema` + `target_client` | Inspeccionar esquema de un cliente |
+
+> La lista completa de tools (y skills como prompts) la sirve el MCP en tiempo real; al agregar nuevas,
+> aparecen automáticamente en tu sesión sin reconfigurar nada.

package/bin/genius-setup.js

@@ -2,18 +2,26 @@
 /**
  * @xmarts/genius-setup — one-command frictionless onboarding for Xmarts Genius.
  *
- *   npx @xmarts/genius-setup --token <bearer> [--base-url https://beesmart.digital] [--client "Acme"]
+ *   # Secret-free path (preferred — the setup link delivers no secret in the GET):
+ *   GENIUS_SETUP_TOKEN=<setup-token> npx @xmarts/genius-setup [--base-url https://beesmart.digital]
+ *
+ *   # Back-compat path (an already-resolved consultant Bearer):
+ *   GENIUS_TOKEN=<bearer> npx @xmarts/genius-setup [--base-url ...] [--client "Acme"]
  *
  * Idempotent + cross-platform (incl. Windows). It:
- *   1. writes ~/.genius/config.json (endpoints + token) and installs the per-turn
+ *   1. (if given GENIUS_SETUP_TOKEN) redeems the single-use setup token for the
+ *      consultant Bearer via a TLS POST to /xma/genius/v1/setup/exchange — the
+ *      Bearer never rides inside a GET-able bootstrap script;
+ *   2. writes ~/.genius/config.json (endpoints + token) and installs the per-turn
  *      inject hook (hooks/genius_inject.py) + the session-capture hook
  *      (hooks/genius_capture.py);
- *   2. registers the beesmart_genius MCP server in ~/.claude.json;
- *   3. wires per-turn injection (UserPromptSubmit) + SessionStart priming +
+ *   3. registers the beesmart_genius MCP server in ~/.claude.json;
+ *   4. wires per-turn injection (UserPromptSubmit) + SessionStart priming +
  *      SessionEnd/PreCompact/Stop capture into ~/.claude/settings.json — merged,
- *      never duplicated, with a timestamped backup first.
+ *      never duplicated, with a timestamped backup first;
+ *   5. installs/refreshes the Genius Protocol in ~/.claude/CLAUDE.md.
  * After this, the consultant has Brain + capture + feedback flowing with zero
- * further prompts. The token is the consultant's MCP Bearer (no new secret).
+ * further prompts, and the package self-updates daily.
  */
 'use strict';
 const fs = require('fs');
@@ -26,104 +34,202 @@ function arg(name, def) {
 }
 function log(msg) { process.stdout.write(msg + '\n'); }
 
-// (#pkg-4) Prefer GENIUS_TOKEN env over --token argv: argv leaks into the
-// process list and shell history. Warn if a token is passed on the CLI.
+const BASE = (arg('base-url', 'https://beesmart.digital')).replace(/\/+$/, '');
+const CLIENT = arg('client', '');
+
+// -----------------------------------------------------------------------------
+// Token resolution (priority order):
+//   1. GENIUS_TOKEN env       — an already-resolved consultant Bearer (back-compat
+//                               with links/commands minted before the exchange).
+//   2. --token argv           — same, but leaks to the process list (warn).
+//   3. GENIUS_SETUP_TOKEN /   — a single-use setup token we redeem ONCE, over TLS,
+//      --setup-token            for the Bearer. This is the secret-free path: the
+//                               Bearer is never embedded in a GET-able script.
+// -----------------------------------------------------------------------------
 let TOKEN = process.env.GENIUS_TOKEN || '';
 if (!TOKEN) {
   TOKEN = arg('token', '');
   if (TOKEN) log('WARN: passing --token on the CLI leaks it to the process list / shell history. Prefer GENIUS_TOKEN=... npx @xmarts/genius-setup');
 }
-const BASE = (arg('base-url', 'https://beesmart.digital')).replace(/\/+$/, '');
-const CLIENT = arg('client', '');
-if (!TOKEN) {
-  log('ERROR: a consultant Bearer token is required. Set GENIUS_TOKEN=<token> (preferred) or pass --token <token>.');
-  process.exit(1);
+const SETUP_TOKEN = process.env.GENIUS_SETUP_TOKEN || arg('setup-token', '');
+
+function exchangeSetupToken(setupToken, cb) {
+  // Redeem the single-use setup token for the consultant Bearer. The api_key
+  // crosses the wire exactly once, in this TLS POST body, to a caller holding
+  // the unguessable 256-bit token; the server consumes the token atomically.
+  let url;
+  try { url = new URL(BASE + '/xma/genius/v1/setup/exchange'); }
+  catch (e) { return cb(e); }
+  const mod = url.protocol === 'http:' ? require('http') : require('https');
+  const payload = JSON.stringify({
+    jsonrpc: '2.0', method: 'call', id: 1,
+    params: { setup_token: setupToken },
+  });
+  const req = mod.request({
+    hostname: url.hostname,
+    port: url.port || (url.protocol === 'http:' ? 80 : 443),
+    path: url.pathname,
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(payload),
+      // Cloudflare in front of beesmart.digital 403s the default Node UA.
+      'User-Agent': 'XmartsGenius-Setup/1.5.0',
+    },
+    timeout: 15000,
+  }, (res) => {
+    let data = '';
+    res.on('data', (c) => { data += c; });
+    res.on('end', () => {
+      try {
+        const parsed = JSON.parse(data);
+        const result = parsed.result || parsed;
+        if (result && result.status === 'ok' && result.api_key) {
+          cb(null, result.api_key);
+        } else {
+          cb(new Error((result && result.message) || 'exchange_failed'));
+        }
+      } catch (e) { cb(e); }
+    });
+  });
+  req.on('error', (e) => cb(e));
+  req.on('timeout', () => { req.destroy(new Error('exchange_timeout')); });
+  req.write(payload);
+  req.end();
 }
 
-const HOME = os.homedir();
-const GENIUS_DIR = path.join(HOME, '.genius');
-const HOOKS_DIR = path.join(GENIUS_DIR, 'hooks');
-const CLAUDE_DIR = path.join(HOME, '.claude');
+function runSetup(token) {
+  const HOME = os.homedir();
+  const GENIUS_DIR = path.join(HOME, '.genius');
+  const HOOKS_DIR = path.join(GENIUS_DIR, 'hooks');
+  const CLAUDE_DIR = path.join(HOME, '.claude');
 
-function ensureDir(d) { fs.mkdirSync(d, { recursive: true }); }
-function readJson(p) { try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return {}; } }
-function backup(p) {
-  if (fs.existsSync(p)) {
-    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
-    fs.copyFileSync(p, p + '.genius-bak-' + stamp);
+  function ensureDir(d) { fs.mkdirSync(d, { recursive: true }); }
+  function readJson(p) { try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return {}; } }
+  function backup(p) {
+    if (fs.existsSync(p)) {
+      const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+      fs.copyFileSync(p, p + '.genius-bak-' + stamp);
+    }
+  }
+  function writeJson(p, obj, secret) {
+    // (#pkg-3) secret files (token-bearing) are written 0600, never world-readable.
+    ensureDir(path.dirname(p));
+    fs.writeFileSync(p, JSON.stringify(obj, null, 2), secret ? { mode: 0o600 } : undefined);
+    if (secret) { try { fs.chmodSync(p, 0o600); } catch (_) {} }
   }
-}
-function writeJson(p, obj, secret) {
-  // (#pkg-3) secret files (token-bearing) are written 0600, never world-readable.
-  ensureDir(path.dirname(p));
-  fs.writeFileSync(p, JSON.stringify(obj, null, 2), secret ? { mode: 0o600 } : undefined);
-  if (secret) { try { fs.chmodSync(p, 0o600); } catch (_) {} }
-}
 
-// 1) ~/.genius/config.json + hook
-ensureDir(HOOKS_DIR);
-const cfg = {
-  base_url: BASE,
-  token: TOKEN,
-  capture_endpoint: BASE + '/xma/genius/v1/capture/transcript',
-  inject_endpoint: BASE + '/xma/genius/v1/inject',
-};
-if (CLIENT) cfg.target_client = CLIENT;
-writeJson(path.join(GENIUS_DIR, 'config.json'), cfg, true);  // secret: 0600
+  // 1) ~/.genius/config.json + hook
+  ensureDir(HOOKS_DIR);
+  const cfg = {
+    base_url: BASE,
+    token: token,
+    capture_endpoint: BASE + '/xma/genius/v1/capture/transcript',
+    inject_endpoint: BASE + '/xma/genius/v1/inject',
+  };
+  if (CLIENT) cfg.target_client = CLIENT;
+  writeJson(path.join(GENIUS_DIR, 'config.json'), cfg, true);  // secret: 0600
 
-// Copy the hooks shipped alongside this script (capture + per-turn inject).
-function copyHook(fname) {
-  const src = path.join(__dirname, '..', 'hooks', fname);
-  const dst = path.join(HOOKS_DIR, fname);
-  try {
-    fs.copyFileSync(src, dst);
-    try { fs.chmodSync(dst, 0o755); } catch (_) {}
-  } catch (e) {
-    log('WARN: could not copy hook from ' + src + ' (' + e.message + ')');
+  // Copy the hooks shipped alongside this script (capture + per-turn inject).
+  function copyHook(fname) {
+    const src = path.join(__dirname, '..', 'hooks', fname);
+    const dst = path.join(HOOKS_DIR, fname);
+    try {
+      fs.copyFileSync(src, dst);
+      try { fs.chmodSync(dst, 0o755); } catch (_) {}
+    } catch (e) {
+      log('WARN: could not copy hook from ' + src + ' (' + e.message + ')');
+    }
+    return dst;
   }
-  return dst;
-}
-const hookDst = copyHook('genius_capture.py');
-const injectDst = copyHook('genius_inject.py');
+  const hookDst = copyHook('genius_capture.py');
+  const injectDst = copyHook('genius_inject.py');
 
-// 2) ~/.claude.json mcpServers (merge, no clobber)
-const claudeJsonPath = path.join(HOME, '.claude.json');
-const claudeJson = readJson(claudeJsonPath);
-backup(claudeJsonPath);
-claudeJson.mcpServers = claudeJson.mcpServers || {};
-claudeJson.mcpServers['beesmart_genius'] = {
-  type: 'http',
-  url: BASE + '/mcp/consultant',
-  headers: { Authorization: 'Bearer ' + TOKEN },
-};
-writeJson(claudeJsonPath, claudeJson, true);  // contains the Bearer -> 0600
+  // 2) ~/.claude.json mcpServers (merge, no clobber)
+  const claudeJsonPath = path.join(HOME, '.claude.json');
+  const claudeJson = readJson(claudeJsonPath);
+  backup(claudeJsonPath);
+  claudeJson.mcpServers = claudeJson.mcpServers || {};
+  claudeJson.mcpServers['beesmart_genius'] = {
+    type: 'http',
+    url: BASE + '/mcp/consultant',
+    headers: { Authorization: 'Bearer ' + token },
+  };
+  writeJson(claudeJsonPath, claudeJson, true);  // contains the Bearer -> 0600
 
-// 3) ~/.claude/settings.json hooks (merge by command, no dup)
-const settingsPath = path.join(CLAUDE_DIR, 'settings.json');
-const settings = readJson(settingsPath);
-backup(settingsPath);
-settings.hooks = settings.hooks || {};
-function addHook(eventName, scriptPath) {
-  settings.hooks[eventName] = settings.hooks[eventName] || [];
-  const marker = path.basename(scriptPath);
-  const already = JSON.stringify(settings.hooks[eventName]).includes(marker);
-  if (!already) {
-    const cmd = `python3 ${JSON.stringify(scriptPath)} || true`;
-    settings.hooks[eventName].push({ hooks: [{ type: 'command', command: cmd }] });
+  // 3) ~/.claude/settings.json hooks (merge by command, no dup)
+  const settingsPath = path.join(CLAUDE_DIR, 'settings.json');
+  const settings = readJson(settingsPath);
+  backup(settingsPath);
+  settings.hooks = settings.hooks || {};
+  function addHook(eventName, scriptPath) {
+    settings.hooks[eventName] = settings.hooks[eventName] || [];
+    const marker = path.basename(scriptPath);
+    const already = JSON.stringify(settings.hooks[eventName]).includes(marker);
+    if (!already) {
+      const cmd = `python3 ${JSON.stringify(scriptPath)} || true`;
+      settings.hooks[eventName].push({ hooks: [{ type: 'command', command: cmd }] });
+    }
   }
+  // Capture (transcript -> Brain) on session boundaries.
+  ['SessionEnd', 'PreCompact', 'Stop'].forEach((e) => addHook(e, hookDst));
+  // Per-turn knowledge injection + session priming (consultant_access guarantee).
+  ['UserPromptSubmit', 'SessionStart'].forEach((e) => addHook(e, injectDst));
+  writeJson(settingsPath, settings);
+
+  // 4) ~/.claude/CLAUDE.md — install/refresh the Genius Protocol between auto-managed
+  //    markers (idempotent; never clobbers the consultant's surrounding content).
+  const BEGIN = '<!-- XMARTS-GENIUS-PROTOCOL:BEGIN (auto-managed by @xmarts/genius-setup) -->';
+  const END = '<!-- XMARTS-GENIUS-PROTOCOL:END -->';
+  try {
+    ensureDir(CLAUDE_DIR);
+    const claudeMdPath = path.join(CLAUDE_DIR, 'CLAUDE.md');
+    let existing = '';
+    try { existing = fs.readFileSync(claudeMdPath, 'utf8'); } catch (_) {}
+    const proto = fs.readFileSync(path.join(__dirname, '..', 'CLAUDE_PROTOCOL.md'), 'utf8').trim();
+    const block = BEGIN + '\n' + proto + '\n' + END;
+    let out;
+    if (existing.includes(BEGIN) && existing.includes(END)) {
+      out = existing.slice(0, existing.indexOf(BEGIN)) + block +
+            existing.slice(existing.indexOf(END) + END.length);
+    } else {
+      out = (existing ? existing.replace(/\s+$/, '') + '\n\n' : '') + block + '\n';
+    }
+    fs.writeFileSync(claudeMdPath, out);
+  } catch (e) {
+    log('WARN: could not write CLAUDE.md protocol (' + e.message + ')');
+  }
+
+  log('');
+  log('  Xmarts Genius is set up.');
+  log('  - MCP server     : beesmart_genius -> ' + BASE + '/mcp/consultant');
+  log('  - Capture hook   : ' + hookDst + '  (SessionEnd / PreCompact / Stop)');
+  log('  - Inject hook    : ' + injectDst + '  (UserPromptSubmit / SessionStart)');
+  log('  - Config         : ' + path.join(GENIUS_DIR, 'config.json'));
+  log('  - Protocol       : ' + path.join(CLAUDE_DIR, 'CLAUDE.md') + '  (auto-managed)');
+  if (CLIENT) log('  - Default client : ' + CLIENT);
+  log('');
+  log('  Restart Claude Code. Per-turn Brain injection + automatic capture + the Genius');
+  log('  protocol are now active. The package SELF-UPDATES daily in the background, so new');
+  log('  tools, skills and features arrive automatically — you never have to run this again.');
 }
-// Capture (transcript -> Brain) on session boundaries.
-['SessionEnd', 'PreCompact', 'Stop'].forEach((e) => addHook(e, hookDst));
-// Per-turn knowledge injection + session priming (consultant_access guarantee).
-['UserPromptSubmit', 'SessionStart'].forEach((e) => addHook(e, injectDst));
-writeJson(settingsPath, settings);
 
-log('');
-log('  Xmarts Genius is set up.');
-log('  - MCP server     : beesmart_genius -> ' + BASE + '/mcp/consultant');
-log('  - Capture hook   : ' + hookDst + '  (SessionEnd / PreCompact / Stop)');
-log('  - Inject hook    : ' + injectDst + '  (UserPromptSubmit / SessionStart)');
-log('  - Config         : ' + path.join(GENIUS_DIR, 'config.json'));
-if (CLIENT) log('  - Default client : ' + CLIENT);
-log('');
-log('  Restart Claude Code. Per-turn Brain injection + automatic capture are now active — no further prompts.');
+// -----------------------------------------------------------------------------
+// Entry point
+// -----------------------------------------------------------------------------
+if (TOKEN) {
+  // Already-resolved Bearer (back-compat path / self-update). No exchange.
+  runSetup(TOKEN);
+} else if (SETUP_TOKEN) {
+  // Secret-free path: redeem the single-use setup token for the Bearer.
+  exchangeSetupToken(SETUP_TOKEN, (err, key) => {
+    if (err || !key) {
+      log('ERROR: el enlace de setup ya fue usado o expiró. Pide a tu admin de Xmarts que regenere el link de setup.');
+      process.exit(1);
+    }
+    runSetup(key);
+  });
+} else {
+  log('ERROR: falta el token. Ejecuta el link de setup de Genius (recomendado) o define GENIUS_TOKEN=<token>.');
+  process.exit(1);
+}

package/hooks/genius_inject.py

@@ -22,6 +22,8 @@ import urllib.request
 HOME = os.path.expanduser("~")
 CFG_PATH = os.path.join(HOME, ".genius", "config.json")
 TIMEOUT = 3.5
+SELF_UPDATE_TTL = 86400  # at most once/day
+SELF_UPDATE_STAMP = os.path.join(HOME, ".genius", ".last_selfupdate")
 
 SESSION_PRIMER = (
     "[Xmarts Genius — Brain connected]\n"
@@ -77,10 +79,53 @@ def _inject(cfg, prompt):
         return ""
 
 
+def _maybe_self_update(cfg):
+    """Keep the consultant on the LATEST Genius package with ZERO action: at most
+    once/day, silently re-run the installer in the background. New hooks, MCP
+    tools, settings and the CLAUDE.md protocol then flow automatically — the
+    consultant never re-onboards. Detached + fully guarded; never blocks a turn.
+    """
+    import time
+    import subprocess
+    try:
+        token = cfg.get("token")
+        if not token:
+            return
+        if os.path.exists(SELF_UPDATE_STAMP) and (
+                time.time() - os.path.getmtime(SELF_UPDATE_STAMP)) < SELF_UPDATE_TTL:
+            return
+        # Stamp FIRST so a failing/slow npx never causes a retry storm.
+        try:
+            os.makedirs(os.path.dirname(SELF_UPDATE_STAMP), exist_ok=True)
+            with open(SELF_UPDATE_STAMP, "w") as fh:
+                fh.write(str(int(time.time())))
+        except Exception:
+            return
+        env = dict(os.environ)
+        env["GENIUS_TOKEN"] = token
+        base = cfg.get("base_url")
+        devnull = open(os.devnull, "w")
+        if os.name == "nt":
+            cmd = "npx -y @xmarts/genius-setup@latest"
+            if base:
+                cmd += ' --base-url "%s"' % base
+            subprocess.Popen(cmd, shell=True, env=env, stdout=devnull, stderr=devnull,
+                             stdin=subprocess.DEVNULL, creationflags=0x00000008)  # DETACHED_PROCESS
+        else:
+            args = ["npx", "-y", "@xmarts/genius-setup@latest"]
+            if base:
+                args += ["--base-url", base]
+            subprocess.Popen(args, env=env, stdout=devnull, stderr=devnull,
+                             stdin=subprocess.DEVNULL, start_new_session=True)
+    except Exception:
+        pass
+
+
 def main():
     cfg = _cfg()
     if not cfg.get("token"):
         return  # not configured -> silent no-op
+    _maybe_self_update(cfg)   # background, daily, zero-action upgrades
     event = _event()
     name = event.get("hook_event_name") or (
         "UserPromptSubmit" if event.get("prompt") else "SessionStart")

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@xmarts/genius-setup",
-  "version": "1.3.0",
-  "description": "One-command frictionless onboarding for Xmarts Genius (Brain MCP + per-turn injection + automatic session capture + Claude-session time telemetry).",
+  "version": "1.5.0",
+  "description": "One-command, self-updating onboarding for Xmarts Genius (Brain MCP + per-turn injection + automatic session/time capture + CLAUDE.md protocol). Secret-free onboarding via single-use setup-token exchange (no Bearer in the GET-able bootstrap). Installs once; self-updates daily so new tools/skills/features arrive with zero action.",
   "bin": {
     "genius-setup": "bin/genius-setup.js"
   },
@@ -9,6 +9,7 @@
     "bin/genius-setup.js",
     "hooks/genius_inject.py",
     "hooks/genius_capture.py",
+    "CLAUDE_PROTOCOL.md",
     "README.md"
   ],
   "engines": {