mercury-agent 0.8.1 → 0.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/src/core/global-admin.ts

@@ -1,12 +1,14 @@
 /**
- * Check if a caller is a global admin (configured in mercury.yaml / env).
- * Global admins are identified by `config.admins` and `config.dmAutoSpaceAdminIds`.
- * Platform-specific ID prefixes, + signs, and @domain suffixes are normalized.
+ * Matching of caller identities against configured user ids
+ * (`config.admins`, `config.dmAutoSpaceAdminIds`).
  *
- * WhatsApp callers arrive canonicalized to their phone JID, but older configs
- * may still list the LID digits (or vice versa when no mapping was known at
- * config time). When an alias lookup is provided, the caller's learned
- * LID↔phone counterpart is matched against the configured ids too.
+ * Configured ids come in loose formats (bare digits, `+` prefix, with or
+ * without platform prefix / domain suffix), while callers arrive as full
+ * canonical ids (e.g. `whatsapp:972542341444@s.whatsapp.net`). WhatsApp adds
+ * a second wrinkle: older configs may list the LID digits while callers are
+ * canonicalized to their phone JID (or vice versa when no mapping was known
+ * at config time). When an alias lookup is provided, the caller's learned
+ * LID↔phone counterpart from `wa_identity_aliases` is matched too.
  */
 
 /** Subset of Db used to resolve WhatsApp LID↔phone pairs. */
@@ -15,6 +17,44 @@ export interface WaAliasLookup {
   getWaLidForPn(pn: string): string | null;
 }
 
+const normalize = (s: string) =>
+  s
+    .replace(/^[^:]+:/, "")
+    .replace(/^[+]+/, "")
+    .replace(/@.*$/, "");
+
+/**
+ * Check whether a caller matches any id in a configured list, tolerating
+ * format differences (prefix, `+`, domain) and — with an alias lookup —
+ * the WhatsApp LID↔phone split.
+ */
+export function matchesConfiguredId(
+  callerId: string,
+  configuredIds: string[],
+  aliases?: WaAliasLookup,
+): boolean {
+  if (configuredIds.length === 0) return false;
+
+  const callerCandidates = new Set([normalize(callerId)]);
+
+  if (aliases) {
+    const jid = callerId.replace(/^[^:]+:/, "");
+    if (jid.endsWith("@s.whatsapp.net")) {
+      const lid = aliases.getWaLidForPn(jid);
+      if (lid) callerCandidates.add(normalize(lid));
+    } else if (jid.endsWith("@lid")) {
+      const pn = aliases.getWaPnForLid(jid);
+      if (pn) callerCandidates.add(normalize(pn));
+    }
+  }
+
+  return configuredIds.some((id) => callerCandidates.has(normalize(id)));
+}
+
+/**
+ * Check if a caller is a global admin (configured in mercury.yaml / env).
+ * Global admins are identified by `config.admins` and `config.dmAutoSpaceAdminIds`.
+ */
 export function isGlobalAdmin(
   callerId: string,
   config: { admins?: string; dmAutoSpaceAdminIds?: string },
@@ -35,26 +75,5 @@ export function isGlobalAdmin(
       : []),
   ];
 
-  const normalize = (s: string) =>
-    s
-      .replace(/^[^:]+:/, "")
-      .replace(/^[+]+/, "")
-      .replace(/@.*$/, "");
-
-  const callerCandidates = new Set([normalize(callerId)]);
-
-  if (aliases) {
-    const jid = callerId.replace(/^[^:]+:/, "");
-    if (jid.endsWith("@s.whatsapp.net")) {
-      const lid = aliases.getWaLidForPn(jid);
-      if (lid) callerCandidates.add(normalize(lid));
-    } else if (jid.endsWith("@lid")) {
-      const pn = aliases.getWaPnForLid(jid);
-      if (pn) callerCandidates.add(normalize(pn));
-    }
-  }
-
-  return globalAdmins.some(
-    (id) => id === callerId || callerCandidates.has(normalize(id)),
-  );
+  return matchesConfiguredId(callerId, globalAdmins, aliases);
 }

package/src/core/permissions.ts

@@ -1,4 +1,5 @@
 import type { Db } from "../storage/db.js";
+import { matchesConfiguredId } from "./global-admin.js";
 
 // ---------------------------------------------------------------------------
 // Built-in permissions (static, cannot be overridden)
@@ -231,5 +232,20 @@ export function resolveRole(
 
   db.upsertMember(spaceId, platformUserId, displayName);
 
-  return db.getRole(spaceId, platformUserId) ?? "member";
+  const role = db.getRole(spaceId, platformUserId) ?? "member";
+
+  // Seeded rows are keyed by the raw config string, which may differ from the
+  // canonical caller id (format looseness, WhatsApp LID vs phone JID). When the
+  // exact lookup misses but the caller matches a configured admin id, promote
+  // the canonical id so the row self-heals. Config admins are always admins —
+  // seedAdmins already re-promotes demoted ones on every re-seed.
+  if (
+    role === "member" &&
+    matchesConfiguredId(platformUserId, seededAdmins, db)
+  ) {
+    db.setRole(spaceId, platformUserId, "admin", "seed");
+    return "admin";
+  }
+
+  return role;
 }