fraim-framework 2.0.199 → 2.0.200

package/dist/src/ai-hub/conversation-store.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AiHubConversationStore = exports.COMPANY_SCOPE_KEY = exports.MANAGER_SCOPE_KEY = void 0;
 exports.conversationScopeKey = conversationScopeKey;
+exports.migrateConversationStore = migrateConversationStore;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
@@ -93,6 +94,103 @@ function migrateScopeBuckets(store) {
     }
     return { version: 1, projects };
 }
+// Canonical comparison key for a project path (case-insensitive on win32), matching the
+// convention used by removeProject and the preferences store.
+function canonicalProjectPathKey(value) {
+    const resolved = path_1.default.resolve(value);
+    return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+// How much run history a record carries. Used to decide the winner when the same conversation id
+// exists in two buckets: the copy with real history must never be overwritten by a header-only
+// shell (which is exactly what a mis-filed slim PUT produces).
+function conversationRichness(conv) {
+    const value = conv;
+    const messages = Array.isArray(value?.messages) ? value.messages.length : 0;
+    const events = Array.isArray(value?.events) ? value.events.length : 0;
+    return messages + events;
+}
+// Place a raw conversation into a bucket, deduping by id. When the id already exists, keep the
+// richer copy (more run history); tie-break on newer lastUpdatedAt. Order-independent.
+function placeConversationInBucket(bucket, conv) {
+    const value = conv;
+    const id = value && typeof value.id === 'string' ? value.id : '';
+    if (!id) {
+        bucket.conversations.push(conv);
+        return;
+    }
+    const idx = bucket.conversations.findIndex((entry) => entry && entry.id === id);
+    if (idx < 0) {
+        bucket.conversations.push(conv);
+        return;
+    }
+    const existing = bucket.conversations[idx];
+    const existingScore = conversationRichness(existing);
+    const incomingScore = conversationRichness(conv);
+    if (incomingScore > existingScore) {
+        bucket.conversations[idx] = conv;
+    }
+    else if (incomingScore === existingScore
+        && timestampValue(value?.lastUpdatedAt) > timestampValue(existing.lastUpdatedAt)) {
+        bucket.conversations[idx] = conv;
+    }
+}
+// A conversation's identity is unique only WITHIN a bucket, and a bucket key is a project path.
+// The buggy client PUT path could file a conversation whose own projectPath points at project B
+// into project A's bucket (see docs/rca/hub-conversation-cross-project-leak.md), so the same run
+// appeared under two projects and the mis-filed copy was a header-only shell. This one-time,
+// idempotent, read-time migration relocates every project-scoped record back to the bucket that
+// matches its own projectPath, deduping so the copy with real run history wins. A bucket activeId
+// that pointed at a relocated record is cleared. Sentinel scope buckets (@manager/@company)
+// legitimately hold records whose projectPath points at a project, so they are left untouched.
+function migrateProjectBuckets(store) {
+    const projects = {};
+    const ensure = (key) => {
+        if (!projects[key])
+            projects[key] = { activeId: null, conversations: [] };
+        return projects[key];
+    };
+    // Preserve every existing bucket key and its activeId up front.
+    for (const [key, state] of Object.entries(store.projects || {})) {
+        ensure(key).activeId = state.activeId ?? null;
+    }
+    for (const [bucketKey, state] of Object.entries(store.projects || {})) {
+        const isSentinel = bucketKey === exports.MANAGER_SCOPE_KEY || bucketKey === exports.COMPANY_SCOPE_KEY;
+        for (const conv of (state.conversations || [])) {
+            if (!conv || typeof conv !== 'object')
+                continue;
+            const scope = conv.scope
+                ?? conv.invokedArea;
+            const ownPath = typeof conv.projectPath === 'string'
+                ? conv.projectPath
+                : '';
+            const mismatched = !isSentinel
+                && scope !== 'manager' && scope !== 'company'
+                && ownPath.length > 0
+                && canonicalProjectPathKey(ownPath) !== canonicalProjectPathKey(bucketKey);
+            if (!mismatched) {
+                placeConversationInBucket(ensure(bucketKey), conv);
+                continue;
+            }
+            // Relocate to the record's own project bucket.
+            placeConversationInBucket(ensure(path_1.default.resolve(ownPath)), conv);
+        }
+    }
+    // Any activeId that no longer resolves to a conversation in its bucket (because that record was
+    // relocated out) is stale — clear it so a project never points at another project's run.
+    for (const state of Object.values(projects)) {
+        if (state.activeId && !state.conversations.some((entry) => entry && entry.id === state.activeId)) {
+            state.activeId = null;
+        }
+    }
+    return { version: 1, projects };
+}
+// The full on-read migration pipeline, exported so a one-off maintenance/cleanup pass can heal an
+// existing store file through the EXACT same code path the store uses at runtime (rather than a
+// duplicated, drift-prone reimplementation). Operates on raw records, so it never drops a record
+// via normalization.
+function migrateConversationStore(store) {
+    return migrateProjectBuckets(migrateScopeBuckets(store));
+}
 function normalizeConversation(projectPath, raw) {
     if (!raw || typeof raw !== 'object')
         return null;
@@ -242,8 +340,10 @@ class AiHubConversationStore {
             if (raw.version !== 1 || !raw.projects || typeof raw.projects !== 'object') {
                 return { version: 1, projects: {} };
             }
-            // Issue #708: fold legacy manager/company-invoked runs into scope buckets on read.
-            return migrateScopeBuckets({ version: 1, projects: raw.projects });
+            // Issue #708: fold legacy manager/company-invoked runs into scope buckets on read, then
+            // relocate any project-scoped record mis-filed under the wrong project bucket back to its
+            // own project (see docs/rca/hub-conversation-cross-project-leak.md).
+            return migrateProjectBuckets(migrateScopeBuckets({ version: 1, projects: raw.projects }));
         }
         catch {
             return { version: 1, projects: {} };

package/dist/src/ai-hub/preferences.js

@@ -140,7 +140,9 @@ class AiHubPreferencesStore {
                     ? raw.recentJobInstructions
                     : {},
                 personaKey: typeof raw.personaKey === 'string' ? raw.personaKey : null,
-                apiKey: typeof raw.apiKey === 'string' && raw.apiKey.length > 0 ? raw.apiKey : undefined,
+                // Issue #750: apiKey is no longer a persisted field here at all — any
+                // legacy apiKey left over from a pre-#750 ai-hub-state.json is silently
+                // dropped, never read back. Identity comes from ~/.fraim/config.json only.
                 projects: normalizeAiHubProjectList(Array.isArray(raw.projects) ? raw.projects : [], projectPath, { removedProjectPaths }),
                 removedProjectPaths,
             };

package/dist/src/ai-hub/server.js

@@ -38,6 +38,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AiHubServer = exports.HostConfigStore = exports.DeploymentStore = void 0;
 exports.configureFraimForHubAgent = configureFraimForHubAgent;
+exports.buildOpenFileInvocation = buildOpenFileInvocation;
 exports.findAvailablePort = findAvailablePort;
 exports.findAvailablePortExcluding = findAvailablePortExcluding;
 const express_1 = __importDefault(require("express"));
@@ -61,6 +62,7 @@ const conversation_store_1 = require("./conversation-store");
 const remote_hub_gateway_1 = require("./remote-hub-gateway");
 const managed_browser_1 = require("./managed-browser");
 const managed_agent_paths_1 = require("../cli/utils/managed-agent-paths");
+const user_config_1 = require("../cli/utils/user-config");
 let personaHiringModule;
 let managerHiringModule;
 function loadPersonaHiringModule() {
@@ -973,28 +975,43 @@ function resolveSafeArtifactPath(rawPath, projectPath) {
     ];
     return safeRoots.some((root) => pathWithin(root, resolved)) ? resolved : null;
 }
-function hubOpenFile(filePath) {
-    return new Promise((resolve, reject) => {
-        const args = process.platform === 'win32'
-            ? [
+// Builds the OS "open this file with its default app" invocation. Exported for regression
+// testing (see tests/isolated/test-ai-hub-open-file.ts).
+//
+// Windows contract: the path travels via an ENVIRONMENT VARIABLE, never as a trailing `-Command`
+// argument. PowerShell re-parses trailing args on its own command line and mangles Windows paths —
+// it strips backslashes and truncates at the first space — so `Invoke-Item -LiteralPath $p`
+// received a broken path (e.g. `C:UserssidmaOneDriveCodeDrug`) and failed for every real artifact
+// path, which is why the Hub's "open file" button did nothing. `$env:FRAIM_OPEN_PATH` is read
+// directly from the environment and is not re-parsed, so the path arrives intact (verified against
+// paths containing spaces and backslashes).
+function buildOpenFileInvocation(filePath, platform = process.platform) {
+    if (platform === 'win32') {
+        return {
+            command: 'powershell.exe',
+            args: [
                 '-NoProfile',
                 '-ExecutionPolicy',
                 'Bypass',
                 '-Command',
-                '& { param($p) try { Invoke-Item -LiteralPath $p; exit 0 } catch { Write-Error $_; exit 1 } }',
-                filePath,
-            ]
-            : process.platform === 'darwin'
-                ? [filePath]
-                : [filePath];
-        const command = process.platform === 'win32'
-            ? 'powershell.exe'
-            : process.platform === 'darwin'
-                ? 'open'
-                : 'xdg-open';
+                'try { Invoke-Item -LiteralPath $env:FRAIM_OPEN_PATH; exit 0 } catch { Write-Error $_; exit 1 }',
+            ],
+            envPatch: { FRAIM_OPEN_PATH: filePath },
+        };
+    }
+    return {
+        command: platform === 'darwin' ? 'open' : 'xdg-open',
+        args: [filePath],
+        envPatch: {},
+    };
+}
+function hubOpenFile(filePath) {
+    return new Promise((resolve, reject) => {
+        const { command, args, envPatch } = buildOpenFileInvocation(filePath);
         const child = (0, child_process_1.spawn)(command, args, {
             stdio: ['ignore', 'ignore', 'pipe'],
             windowsHide: process.platform === 'win32',
+            env: { ...process.env, ...envPatch },
         });
         let stderr = '';
         child.stderr?.on('data', (chunk) => {
@@ -1051,53 +1068,15 @@ function deploymentBelongsToProject(deployment, projectPath, fallbackProjectPath
 // ---------------------------------------------------------------------------
 // Issue #512 (S3) — Hub bootstrap projection helpers.
 // ---------------------------------------------------------------------------
-// Resolve the user email used to key personal (L1) learnings. Reads
-// ~/.fraim/preferences.json (the existing user-prefs file) when present so the
-// Brain counts match the auto-load context; falls back to a sensible default
-// that resolveLearningUserId can refine against on-disk files.
-function getHubUserEmail() {
-    try {
-        const prefsPath = path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), 'preferences.json');
-        if (fs_1.default.existsSync(prefsPath)) {
-            const raw = JSON.parse(fs_1.default.readFileSync(prefsPath, 'utf8'));
-            if (typeof raw.userEmail === 'string' && raw.userEmail.length > 0)
-                return raw.userEmail;
-        }
-    }
-    catch {
-        // fall through to default
-    }
-    // #533: preferences.json may not carry the email yet — the proxy persists it on
-    // fraim_connect (see stdio-server). Until then, personal learnings are ALWAYS
-    // stamped `<email>-<type>.md`, so a single-user machine resolves deterministically
-    // from the on-disk files. This is what makes the avatar + personal learnings work.
-    const stamped = resolveSingleStampedUser();
-    if (stamped)
-        return stamped;
-    return 'fraim-user';
-}
-// Return the one user prefix stamped on the global learning files, or null if
-// there is not exactly one (so we never guess between multiple accounts).
-function resolveSingleStampedUser() {
-    try {
-        const dir = (0, project_fraim_paths_1.getUserFraimLearningsDir)();
-        if (!fs_1.default.existsSync(dir))
-            return null;
-        const prefixes = new Set();
-        for (const f of fs_1.default.readdirSync(dir)) {
-            if (f.startsWith('org-'))
-                continue;
-            const m = f.match(/^(.*)-(preferences|manager-coaching|mistake-patterns|validated-patterns)\.md$/);
-            if (m)
-                prefixes.add(m[1]);
-        }
-        if (prefixes.size === 1)
-            return Array.from(prefixes)[0];
-    }
-    catch {
-        // ignore unreadable dir
-    }
-    return null;
+// Issue #750: the Hub's identity — for persona/entitlement resolution, the
+// displayed "signed in as" email, and personal (L1) learnings keying — comes
+// from ~/.fraim/config.json's apiKey (architecture.md §4.3.4's "Global config
+// stores only identity"), the same credential every other FRAIM CLI/MCP
+// surface already reads via readUserFraimConfig(). There is no fallback: a
+// missing or invalid apiKey resolves to null (rendered as a "not connected"
+// state), never a guess from another local file.
+function resolveApiKey() {
+    return (0, user_config_1.readUserFraimConfig)().apiKey;
 }
 // Read persisted Get-started step states from ~/.fraim/install-state.json
 // (architecture §3.5) and ~/.fraim/preferences.json. Returns a partial — any
@@ -1177,21 +1156,13 @@ class AiHubServer {
             explicitPath: process.env.FRAIM_BROWSER_PATH || undefined,
         });
         this.hostRuntime = options.hostRuntime || (process.env.FRAIM_AI_HUB_FAKE_HOST === '1' ? new hosts_1.FakeHostRuntime() : new hosts_1.CliHostRuntime());
-        // Issue #701: the AI Hub is a loopback companion that never touches MongoDB directly —
-        // on every machine (dev, CI, prod) it resolves persona/manager-team state from the hosted
-        // server through the same code path. The hosted server is the sole owner of DB access.
-        // A dbService is used ONLY when explicitly injected (e.g. the hosted server embedding the
-        // Hub, or a test); it is never auto-created, so there is no dev/prod divergence.
-        this.dbService = options.dbService;
-        this.ownsDbService = false;
+        // Issue #701 / #749: the AI Hub is a loopback companion that runs on user machines and
+        // never touches a database. Persona and manager-team state resolve from the hosted server
+        // through the remote gateway; the hosted server is the sole owner of DB access.
         this.remoteGateway = options.remoteGateway ?? new remote_hub_gateway_1.HttpHubRemoteGateway();
         this.deploymentStore = options.deploymentStore ?? new DeploymentStore();
         this.hostConfigStore = options.hostConfigStore ?? new HostConfigStore();
         this.app.use(express_1.default.json({ limit: '10mb' }));
-        if (this.dbService) {
-            const { registerPaymentRoutes } = require('../routes/payment-routes');
-            registerPaymentRoutes(this.app, () => this.paymentRepo ?? null, this.dbService);
-        }
         // CORS + Chrome Private Network Access for browser extensions and Office add-in task panes
         // calling the Hub from a public origin (word-edit.officeapps.live.com, etc.).
         this.app.use((_req, res, next) => {
@@ -1207,8 +1178,7 @@ class AiHubServer {
         });
         // Payment success redirect: sync entitlement then bounce to the hub.
         // Stripe redirects here after a completed persona-hire checkout.
-        this.app.get('/ai-hub/payment-success', async (req, res) => {
-            const sessionId = req.query['session_id'];
+        this.app.get('/ai-hub/payment-success', (req, res) => {
             const email = req.query['email'];
             // Persist the buyer's email so bootstrap can look up entitlements by userId.
             if (email) {
@@ -1223,17 +1193,8 @@ class AiHubServer {
                     console.warn('[ai-hub] could not persist userEmail:', err);
                 }
             }
-            if (sessionId && this.dbService) {
-                try {
-                    const { syncPersonaEntitlementFromCheckoutSession } = await Promise.resolve().then(() => __importStar(require('../services/persona-entitlement-service')));
-                    const { stripe } = await Promise.resolve().then(() => __importStar(require('../config/stripe')));
-                    const session = await stripe.checkout.sessions.retrieve(sessionId);
-                    await syncPersonaEntitlementFromCheckoutSession(this.dbService, session, 'dashboard-link');
-                }
-                catch (err) {
-                    console.warn('[ai-hub] payment-success entitlement sync failed:', err);
-                }
-            }
+            // Issue #749: the Hub holds no DB. Entitlement is synced authoritatively by the backend
+            // Stripe webhook; the Hub re-reads status via the remote gateway on the next bootstrap.
             res.redirect('/ai-hub/?hired=1');
         });
         this.app.use('/ai-hub', express_1.default.static(resolveAiHubPublicDir()));
@@ -1322,20 +1283,6 @@ class AiHubServer {
     }
     async start(port) {
         this.httpPort = port;
-        if (this.dbService) {
-            try {
-                await this.dbService.connect();
-                const mongoClient = this.dbService.getClient();
-                if (mongoClient) {
-                    const PaymentRepositoryImpl = require('../db/payment-repository').PaymentRepository;
-                    this.paymentRepo = new PaymentRepositoryImpl(mongoClient);
-                }
-            }
-            catch (err) {
-                console.warn('[ai-hub] DB connect failed — personas will show as locked:', err);
-                this.dbService = undefined;
-            }
-        }
         await new Promise((resolve, reject) => {
             this.httpServer = this.app.listen(port, '127.0.0.1');
             this.httpServer.once('listening', () => resolve());
@@ -1406,10 +1353,6 @@ class AiHubServer {
         // #521: tear down the shared browser if WE launched it (stop() no-ops on a
         // browser the manager owns).
         this.managedBrowser.stop();
-        if (this.ownsDbService && this.dbService) {
-            await this.dbService.close();
-            this.dbService = undefined;
-        }
     }
     getHttpsPort() { return this.httpsPort; }
     knownProjects(projectPath, extras = []) {
@@ -1422,7 +1365,7 @@ class AiHubServer {
             ...extras,
         ], normalizedProjectPath, { removedProjectPaths: preferences.removedProjectPaths || [] });
     }
-    async bootstrapResponse(projectPath, apiKey) {
+    async bootstrapResponse(projectPath) {
         const normalizedProjectPath = path_1.default.resolve(projectPath || this.projectPath);
         const employees = this.hostRuntime.detectEmployees();
         let preferences = this.preferencesStore.load(normalizedProjectPath);
@@ -1449,9 +1392,12 @@ class AiHubServer {
             requiredPersonaKey: getProtectedPersonaForHubJob(job.id),
         }));
         const managerTemplates = (0, catalog_1.discoverManagerTemplates)(normalizedProjectPath, catalogOptions);
-        const resolvedApiKey = apiKey || preferences.apiKey;
+        // Issue #750: the apiKey always comes from ~/.fraim/config.json — no header
+        // override, no ai-hub-state.json copy, no fallback chain.
+        const resolvedApiKey = resolveApiKey();
         const { personas, subscriptionActive, workspaceId, userKey } = await this.computePersonas(resolvedApiKey);
         const managerTeam = await this.computeManagerTeam(resolvedApiKey);
+        const resolvedUserEmail = userKey ?? null;
         const projects = this.knownProjects(normalizedProjectPath);
         preferences = { ...preferences, projectPath: normalizedProjectPath, projects };
         this.preferencesStore.save(preferences);
@@ -1464,7 +1410,11 @@ class AiHubServer {
             title: 'AI Hub',
             remoteBaseUrl: (0, remote_hub_gateway_1.resolveFraimRemoteUrl)(),
             project,
-            preferences,
+            // Issue #750: `apiKey` is no longer a persisted AiHubPreferences field —
+            // it is overlaid on the wire response only, freshly resolved from
+            // ~/.fraim/config.json, so public/ai-hub/script.js's existing
+            // tfConnectedApiKey()/tfConnectedSurfaceUrl read path needs no changes.
+            preferences: { ...preferences, apiKey: resolvedApiKey },
             categories: (0, catalog_1.getAiHubCategories)(normalizedProjectPath, catalogOptions),
             jobs,
             managerTemplates,
@@ -1476,10 +1426,11 @@ class AiHubServer {
             // Issue #512 (S3) — additive manager-flow projections.
             firstRun: this.computeFirstRun(normalizedProjectPath, jobs.length, personas),
             teamContext: this.computeTeamContext(normalizedProjectPath),
-            brain: this.computeBrain(normalizedProjectPath, jobs.length + managerTemplates.length),
-            // #533: the resolved account email, so the profile card shows the real
-            // identity (not a hardcoded placeholder) and the client can display it.
-            userEmail: getHubUserEmail(),
+            brain: this.computeBrain(normalizedProjectPath, jobs.length + managerTemplates.length, resolvedUserEmail),
+            // #533/#750: the resolved account email (from the same ~/.fraim/config.json
+            // apiKey used for personas above), or null when not connected — so the
+            // profile card and personas can never disagree about who's signed in.
+            userEmail: resolvedUserEmail,
             // #744: the org cobrand identity (name/color/logo) from the org context
             // storage, or null when unset so the Hub falls back to FRAIM identity.
             orgBrand: (0, learning_context_builder_1.readOrgBrand)(normalizedProjectPath),
@@ -1866,8 +1817,19 @@ class AiHubServer {
     }
     // Issue #512 (S3, R14) — Brain summary: preserved-learning counts by scope +
     // registry catalog counts. A read projection; no new storage.
-    computeBrain(projectPath, jobCount) {
-        const learnings = (0, learning_context_builder_1.countPreservedLearnings)(projectPath, getHubUserEmail());
+    // Issue #750: `userEmail` is the config.json-resolved identity, or `null` when
+    // not connected. `organization`/`rawSignals` are identity-independent (org-*
+    // files and repo-level raw signals) and must always be counted regardless of
+    // connection state — only `manager`/`project` (L1, individual-keyed) are
+    // zeroed when not connected, rather than guessing an identity via
+    // resolveLearningUserId's single-stamped-user fallback (a legitimate
+    // convenience for MCP auto-load context, but not appropriate here).
+    computeBrain(projectPath, jobCount, userEmail) {
+        const learnings = (0, learning_context_builder_1.countPreservedLearnings)(projectPath, userEmail || '');
+        if (!userEmail) {
+            learnings.manager = 0;
+            learnings.project = 0;
+        }
         return {
             learnings,
             catalog: {
@@ -2053,51 +2015,48 @@ class AiHubServer {
         // Issue #701: manager team comes from the hosted server, not local Mongo.
         return this.remoteGateway.listManagerTeam(apiKey);
     }
+    // Issue #750: identity for routes that don't already call computePersonas()
+    // (which fetches this same hosted state for personas/manager-team). Always
+    // sources the apiKey from ~/.fraim/config.json; null means "not connected" —
+    // no local-guess fallback.
+    async resolveHubIdentity() {
+        const apiKey = resolveApiKey();
+        if (!apiKey)
+            return null;
+        const state = await this.remoteGateway.getPersonaState(apiKey);
+        return state?.userId ?? null;
+    }
+    // Issue #750: shared by the two learnings routes below. 'org' scope never
+    // needs identity (readPreservedLearnings/applyLearningEntryChange ignore the
+    // userId param for it); every other scope resolves through resolveHubIdentity,
+    // returning '' (not a guess) when not connected — callers distinguish
+    // "org" from "not connected" via the scope check they already have to make.
+    async resolveLearningIdentity(scope) {
+        if (scope === 'org')
+            return '';
+        return (await this.resolveHubIdentity()) || '';
+    }
     registerRoutes() {
-        // Issue #512: Serve the account and analytics pages from public/.
-        // These live outside of /ai-hub so they need explicit routes.
-        const publicDir = resolveAiHubPublicDir().replace(/[\\/]ai-hub$/, '');
-        if (!this.dbService) {
-            this.app.get(/^\/auth(\/.*)?$/, (req, res) => {
-                const parsed = new URL(req.originalUrl, 'http://127.0.0.1');
-                if (parsed.pathname === '/auth/sign-in.html' && !parsed.searchParams.has('hub_return')) {
-                    const rawSurface = parsed.searchParams.get('surface');
-                    const surface = rawSurface === 'account' || rawSurface === 'brain' || rawSurface === 'analytics'
-                        ? rawSurface
-                        : 'analytics';
-                    parsed.searchParams.set('hub_return', buildLocalHubReturnUrl(req, surface));
-                }
-                res.redirect(buildHostedPathUrl(parsed.pathname, parsed.search));
-            });
-            this.app.get(['/account', '/account/'], (req, res) => {
-                res.redirect(buildHostedAuthUrl('account', '/account/', buildLocalHubReturnUrl(req, 'account')));
-            });
-            this.app.get(['/analytics', '/analytics/'], (req, res) => {
-                res.redirect(buildHostedAuthUrl('analytics', '/analytics/', buildLocalHubReturnUrl(req, 'analytics')));
-            });
-        }
-        else {
-            this.app.get('/account', (_req, res) => {
-                const filePath = path_1.default.join(publicDir, 'account', 'index.html');
-                if (fs_1.default.existsSync(filePath)) {
-                    res.sendFile(filePath);
-                }
-                else {
-                    res.status(404).send('Account page not found.');
-                }
-            });
-            this.app.use('/account', express_1.default.static(path_1.default.join(publicDir, 'account')));
-            this.app.get('/analytics', (_req, res) => {
-                const filePath = path_1.default.join(publicDir, 'analytics', 'index.html');
-                if (fs_1.default.existsSync(filePath)) {
-                    res.sendFile(filePath);
-                }
-                else {
-                    res.status(404).send('Analytics page not found.');
-                }
-            });
-            this.app.use('/analytics', express_1.default.static(path_1.default.join(publicDir, 'analytics')));
-        }
+        // Issue #512 / #749: the account and analytics surfaces live outside /ai-hub. The
+        // on-machine Hub holds no DB, so it always redirects these (and /auth) to the hosted
+        // server, which owns the authenticated, DB-backed pages.
+        this.app.get(/^\/auth(\/.*)?$/, (req, res) => {
+            const parsed = new URL(req.originalUrl, 'http://127.0.0.1');
+            if (parsed.pathname === '/auth/sign-in.html' && !parsed.searchParams.has('hub_return')) {
+                const rawSurface = parsed.searchParams.get('surface');
+                const surface = rawSurface === 'account' || rawSurface === 'brain' || rawSurface === 'analytics'
+                    ? rawSurface
+                    : 'analytics';
+                parsed.searchParams.set('hub_return', buildLocalHubReturnUrl(req, surface));
+            }
+            res.redirect(buildHostedPathUrl(parsed.pathname, parsed.search));
+        });
+        this.app.get(['/account', '/account/'], (req, res) => {
+            res.redirect(buildHostedAuthUrl('account', '/account/', buildLocalHubReturnUrl(req, 'account')));
+        });
+        this.app.get(['/analytics', '/analytics/'], (req, res) => {
+            res.redirect(buildHostedAuthUrl('analytics', '/analytics/', buildLocalHubReturnUrl(req, 'analytics')));
+        });
         // Issue #478: Serve the PowerPoint task pane HTML and manifest.
         // Office JS appends query strings (?_host_Info=PowerPoint$Win32$...) to every
         // request, so we must strip them before resolving the file path. Use a custom
@@ -2149,8 +2108,6 @@ class AiHubServer {
                 }
                 catch { }
             }
-            // Read API key from header — query-param API keys are prohibited (§3.14)
-            const apiKey = typeof req.headers['x-fraim-api-key'] === 'string' ? req.headers['x-fraim-api-key'] : undefined;
             // #719: a bare reload (no projectPath query) must land on the last-recorded
             // workspace project, not the launch folder. The bootstrap saves its resolved
             // current path back into the projects list, so defaulting to the launch
@@ -2164,17 +2121,18 @@ class AiHubServer {
                     projectPath = recorded;
                 }
             }
-            res.json(await this.bootstrapResponse(projectPath || this.projectPath, apiKey));
+            res.json(await this.bootstrapResponse(projectPath || this.projectPath));
         });
         // Issue #512 (S3, R14) — Brain summary as a standalone route, returning the
         // same projection folded into bootstrap. Useful for the avatar→Brain view
         // without re-fetching the whole bootstrap payload.
-        this.app.get('/api/ai-hub/brain', (req, res) => {
+        this.app.get('/api/ai-hub/brain', async (req, res) => {
             const projectPath = typeof req.query.projectPath === 'string' && req.query.projectPath.length > 0
                 ? path_1.default.resolve(req.query.projectPath)
                 : this.projectPath;
             const jobCount = (0, catalog_1.discoverEmployeeJobs)(projectPath).length + (0, catalog_1.discoverManagerTemplates)(projectPath).length;
-            return res.json(this.computeBrain(projectPath, jobCount));
+            const userEmail = await this.resolveHubIdentity();
+            return res.json(this.computeBrain(projectPath, jobCount, userEmail));
         });
         // #533: read the PRESERVED learnings for a section + storage level so the
         // Company/Manager sections (machine level) and the project workspace (project
@@ -2187,7 +2145,7 @@ class AiHubServer {
             : (typeof (req.body && req.body.projectPath) === 'string' && req.body.projectPath.length > 0
                 ? path_1.default.resolve(req.body.projectPath)
                 : this.projectPath);
-        this.app.get('/api/ai-hub/learnings', (req, res) => {
+        this.app.get('/api/ai-hub/learnings', async (req, res) => {
             const scope = req.query.scope;
             if (typeof scope !== 'string' || !VALID_SCOPES.includes(scope)) {
                 return res.status(400).json({ error: `scope must be one of: ${VALID_SCOPES.join(', ')}` });
@@ -2195,7 +2153,11 @@ class AiHubServer {
             const level = (typeof req.query.level === 'string' && VALID_LEVELS.includes(req.query.level))
                 ? req.query.level : 'machine';
             try {
-                const entries = (0, learning_context_builder_1.readPreservedLearnings)(resolveProjectPath(req), getHubUserEmail(), scope, level);
+                const userEmail = await this.resolveLearningIdentity(scope);
+                if (scope !== 'org' && !userEmail) {
+                    return res.json({ scope, level, entries: [] });
+                }
+                const entries = (0, learning_context_builder_1.readPreservedLearnings)(resolveProjectPath(req), userEmail, scope, level);
                 return res.json({ scope, level, entries });
             }
             catch (error) {
@@ -2205,7 +2167,7 @@ class AiHubServer {
         // #533 §3: add / edit / delete a single learning entry — writes the real file
         // at the section's level (machine for the Manager/Company tabs, project for the
         // project workspace). The action targets exactly the card's file.
-        this.app.post('/api/ai-hub/learnings/entry', (req, res) => {
+        this.app.post('/api/ai-hub/learnings/entry', async (req, res) => {
             const b = (req.body || {});
             if (!['add', 'edit', 'delete'].includes(b.action || '')) {
                 return res.status(400).json({ error: 'action must be one of: add, edit, delete' });
@@ -2216,8 +2178,14 @@ class AiHubServer {
                 return res.status(400).json({ error: `category must be one of: ${VALID_CATEGORIES.join(', ')}` });
             const level = (b.level && VALID_LEVELS.includes(b.level)) ? b.level : 'machine';
             const ref = { scope: b.scope, level, category: b.category };
+            // Issue #750: writes to a personal-scope file need a resolved identity —
+            // fail explicitly rather than writing to a guessed or empty-string file.
+            const userEmail = await this.resolveLearningIdentity(b.scope);
+            if (b.scope !== 'org' && !userEmail) {
+                return res.status(400).json({ error: 'not_connected', message: 'No FRAIM identity resolved. Run `fraim setup` first.' });
+            }
             try {
-                const result = (0, learning_context_builder_1.applyLearningEntryChange)(resolveProjectPath(req), getHubUserEmail(), ref, b.action, {
+                const result = (0, learning_context_builder_1.applyLearningEntryChange)(resolveProjectPath(req), userEmail, ref, b.action, {
                     originalTitle: b.originalTitle,
                     severity: b.severity,
                     title: b.title,
@@ -2229,24 +2197,22 @@ class AiHubServer {
                 return res.status(400).json({ error: error instanceof Error ? error.message : 'Could not write learning.' });
             }
         });
-        // Issue #540/#701: POST /api/ai-hub/manager-team/assign
-        // Proxies to the hosted server (which owns the DB + seat enforcement). The Hub
-        // accepts the local X-Fraim-Api-Key header and forwards it as the hosted x-api-key.
+        // Issue #540/#701/#750: POST /api/ai-hub/manager-team/assign
+        // Proxies to the hosted server (which owns the DB + seat enforcement), using
+        // the Hub's own ~/.fraim/config.json apiKey — not a caller-supplied header.
         // Hosted returns 404 no_company_seat / 409 out_of_stock; those are passed through.
         this.app.post('/api/ai-hub/manager-team/assign', async (req, res) => {
-            const apiKey = typeof req.headers['x-fraim-api-key'] === 'string' ? req.headers['x-fraim-api-key'] : undefined;
             const { personaKey } = (req.body ?? {});
             if (!personaKey)
                 return res.status(400).json({ error: 'personaKey required' });
-            const result = await this.remoteGateway.assignManagerTeam(apiKey, personaKey);
+            const result = await this.remoteGateway.assignManagerTeam(resolveApiKey(), personaKey);
             return res.status(result.status).json(result.body);
         });
-        // Issue #540/#701: DELETE /api/ai-hub/manager-team/assign/:personaKey
+        // Issue #540/#701/#750: DELETE /api/ai-hub/manager-team/assign/:personaKey
         // Proxies the seat release to the hosted server.
         this.app.delete('/api/ai-hub/manager-team/assign/:personaKey', async (req, res) => {
-            const apiKey = typeof req.headers['x-fraim-api-key'] === 'string' ? req.headers['x-fraim-api-key'] : undefined;
             const { personaKey } = req.params;
-            await this.remoteGateway.removeManagerTeam(apiKey, personaKey);
+            await this.remoteGateway.removeManagerTeam(resolveApiKey(), personaKey);
             return res.status(204).end();
         });
         // Issue #708: manager/company scopes resolve to a project-independent sentinel bucket
@@ -2277,7 +2243,27 @@ class AiHubServer {
                 // deletes are honored (a conversation absent here is dropped).
                 const prior = this.conversationStore.loadProject(key);
                 const priorById = new Map(prior.conversations.map((entry) => [entry.id, entry]));
-                const conversations = body.conversations.map((incoming) => {
+                // Write-boundary guard for the cross-project leak (docs/rca/hub-conversation-cross-project-leak.md):
+                // a project PUT persists the client's current-project list, but that list can transiently
+                // include a conversation belonging to ANOTHER project (e.g. the just-finished run of the
+                // project the user switched away from). Never file such a record into this project bucket —
+                // its authoritative home is its own project bucket. Scope (manager/company) PUTs are exempt:
+                // their sentinel buckets legitimately hold records whose projectPath points at a project.
+                const belongsInBucket = (incoming) => {
+                    if (scope)
+                        return true;
+                    const incomingScope = incoming.scope
+                        ?? incoming.invokedArea;
+                    if (incomingScope === 'manager' || incomingScope === 'company')
+                        return false;
+                    const own = incoming && typeof incoming.projectPath === 'string' ? incoming.projectPath : '';
+                    if (!own)
+                        return true;
+                    return normalizedDirectoryPath(own) === normalizedDirectoryPath(key);
+                };
+                const conversations = body.conversations
+                    .filter((incoming) => belongsInBucket(incoming))
+                    .map((incoming) => {
                     const existing = incoming && incoming.id ? priorById.get(incoming.id) : undefined;
                     return existing ? { ...existing, ...incoming } : incoming;
                 });
@@ -2375,14 +2361,9 @@ class AiHubServer {
             const projects = this.preferencesStore.removeProject(projectPath, known.filter((project) => project.id !== entry.id), entry.folderPath);
             return res.json({ ok: true, projects });
         });
-        this.app.post('/api/ai-hub/api-key', (req, res) => {
-            const { apiKey } = req.body;
-            if (!apiKey || typeof apiKey !== 'string')
-                return res.status(400).json({ error: 'apiKey required' });
-            const prefs = this.preferencesStore.load(this.projectPath);
-            this.preferencesStore.save({ ...prefs, apiKey });
-            return res.json({ ok: true });
-        });
+        // Issue #750: POST /api/ai-hub/api-key is removed — there is no Hub-local
+        // apiKey to persist. Identity always comes from ~/.fraim/config.json
+        // (set by `fraim setup`), read fresh via resolveApiKey() on every request.
         this.app.post('/api/ai-hub/preferences', (req, res) => {
             const { personaKey } = req.body;
             const prefs = this.preferencesStore.load(this.projectPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-framework",
-  "version": "2.0.199",
+  "version": "2.0.200",
   "description": "FRAIM: AI Workforce Infrastructure — the organizational capability that turns AI agents into an accountable workforce, their operators into capable AI managers, and executives into leaders with clear optics on AI proficiency.",
   "main": "index.js",
   "bin": {

package/public/ai-hub/script.js

@@ -9631,23 +9631,15 @@ async function tfHandleConnectedAuthMessage(event) {
   }
 }
 
+// Issue #750: the Hub's identity comes from ~/.fraim/config.json (set by
+// `fraim setup`), not a Hub-local copy — there is nothing to persist here.
+// A key recovered via embedded sign-in is used for the rest of this browser
+// session only (in-memory); it does not survive a Hub restart, by design.
 async function tfRememberConnectedApiKey(apiKey) {
-  const changed = apiKey !== state.storedApiKey;
   state.storedApiKey = apiKey;
   if (state.bootstrap && state.bootstrap.preferences) {
     state.bootstrap.preferences.apiKey = apiKey;
   }
-  if (changed) {
-    try {
-      await requestJson('/api/ai-hub/api-key', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ apiKey }),
-      });
-    } catch (error) {
-      console.warn('[ai-hub] Could not persist connected auth key:', error);
-    }
-  }
 }
 
 // ---------------------------------------------------------------------------
@@ -10352,6 +10344,12 @@ async function tfSwitchProjectFolder(folderPath) {
     return;
   }
   state.projectPath = normalized.folderPath;
+  // Cross-project leak fix (docs/rca/hub-conversation-cross-project-leak.md): drop the previous
+  // project's active conversation on switch. Otherwise the just-finished run stays state.activeId
+  // while state.projectPath is the new project, and a debounced conversation PUT during the
+  // cached-bucket fast render below would flush that foreign conversation into the new project's
+  // bucket. hydrateConversationsFromServer recomputes the correct activeId for this project.
+  state.activeId = null;
   // #521 fix: the context cache (state._ctxCache) is keyed by context key only
   // (projectContext/projectBrief/projectRules), NOT by project — so without this
   // the new project's Brief section would render the PREVIOUS project's content
@@ -10850,6 +10848,12 @@ function tfWireShell() {
 // replacing the hardcoded "SM" placeholder. Falls back gracefully when the email
 // isn't known yet (e.g. before the proxy has persisted it).
 function tfAccountIdentity() {
+  // Issue #750: bootstrap.userEmail is `null` (not just missing) once the server
+  // has definitively resolved "no ~/.fraim/config.json apiKey" — distinct from
+  // the transient pre-bootstrap window where state.bootstrap doesn't exist yet.
+  if (state.bootstrap && state.bootstrap.userEmail === null) {
+    return { email: '', name: 'You', initials: '·', notConnected: true };
+  }
   const email = (state.bootstrap && state.bootstrap.userEmail) || '';
   if (!email || !email.includes('@')) {
     return { email: '', name: 'You', initials: '·' };
@@ -10869,7 +10873,7 @@ function tfPopulateAccountMenu() {
   const avEl = document.getElementById('am-av');
   const avatarBtn = document.getElementById('avatar-btn');
   if (nameEl) nameEl.textContent = id.name;
-  if (emailEl) emailEl.textContent = id.email;
+  if (emailEl) emailEl.textContent = id.notConnected ? 'Not connected — run `fraim setup`' : id.email;
   if (avEl) avEl.textContent = id.initials;
   if (avatarBtn) avatarBtn.textContent = id.initials;
 }