ofiere-openclaw-plugin 4.56.7 → 4.56.9

package/dist/src/tools.js

@@ -1038,12 +1038,15 @@ async function handleUpdateTask(supabase, userId, params) {
                 updates.subagent_id = subCheck.subagentId;
             }
         }
-        // If task is being marked DONE or FAILED, auto-complete any linked scheduler events
+        // If task is being marked DONE or FAILED, auto-complete any linked scheduler events.
+        // A-4 plugin parity (2026-05-18) — scope by user_id so cross-tenant task_id
+        // can't trigger foreign scheduler flip via plugin tool path.
         if (params.status === "DONE" || params.status === "FAILED") {
             try {
                 await supabase
                     .from("scheduler_events")
                     .update({ status: "completed", next_run_at: null, updated_at: new Date().toISOString() })
+                    .eq("user_id", userId)
                     .eq("task_id", params.task_id);
             }
             catch (_schedErr) {
@@ -1143,7 +1146,7 @@ async function handleDeleteTask(supabase, userId, params) {
         if (!params.task_id)
             return err("Missing required field: task_id");
         const taskId = params.task_id;
-        await supabase.from("scheduler_events").delete().eq("task_id", taskId);
+        await supabase.from("scheduler_events").delete().eq("task_id", taskId).eq("user_id", userId);
         const { data: subtasks } = await supabase
             .from("tasks")
             .select("id")
@@ -1151,7 +1154,7 @@ async function handleDeleteTask(supabase, userId, params) {
             .eq("user_id", userId);
         if (subtasks && subtasks.length > 0) {
             for (const sub of subtasks) {
-                await supabase.from("scheduler_events").delete().eq("task_id", sub.id);
+                await supabase.from("scheduler_events").delete().eq("task_id", sub.id).eq("user_id", userId);
             }
             await supabase
                 .from("tasks")
@@ -1838,7 +1841,7 @@ function registerScheduleOps(api, supabase, userId) {
                     if (upd.status === "completed" || upd.status === "cancelled") {
                         upd.next_run_at = null;
                     }
-                    const { error } = await supabase.from("scheduler_events").update(upd).eq("id", params.id);
+                    const { error } = await supabase.from("scheduler_events").update(upd).eq("id", params.id).eq("user_id", userId);
                     if (error)
                         return err(error.message);
                     return ok({ message: "Event updated", ok: true });
@@ -1846,7 +1849,7 @@ function registerScheduleOps(api, supabase, userId) {
                 case "delete": {
                     if (!params.id)
                         return err("Missing required: id");
-                    const { error } = await supabase.from("scheduler_events").delete().eq("id", params.id);
+                    const { error } = await supabase.from("scheduler_events").delete().eq("id", params.id).eq("user_id", userId);
                     if (error)
                         return err(error.message);
                     return ok({ message: "Event deleted", ok: true });
@@ -1960,7 +1963,7 @@ function registerKnowledgeOps(api, supabase, userId) {
                             upd[k] = params[k];
                     if (Object.keys(upd).length === 0)
                         return err("No valid fields to update");
-                    const { error } = await supabase.from("knowledge_documents").update(upd).eq("id", params.id);
+                    const { error } = await supabase.from("knowledge_documents").update(upd).eq("id", params.id).eq("user_id", userId);
                     if (error)
                         return err(error.message);
                     return ok({ message: "Document updated", ok: true });
@@ -1968,7 +1971,7 @@ function registerKnowledgeOps(api, supabase, userId) {
                 case "delete": {
                     if (!params.id)
                         return err("Missing required: id");
-                    const { error } = await supabase.from("knowledge_documents").delete().eq("id", params.id);
+                    const { error } = await supabase.from("knowledge_documents").delete().eq("id", params.id).eq("user_id", userId);
                     if (error)
                         return err(error.message);
                     return ok({ message: "Document deleted", ok: true });
@@ -2313,7 +2316,9 @@ function registerWorkflowOps(api, supabase, userId) {
                     const wfId = (params.id || params.workflow_id);
                     if (!wfId)
                         return err("Missing required: id");
-                    await supabase.from("workflow_runs").delete().eq("workflow_id", wfId);
+                    // A-4 plugin parity (2026-05-18) — scope cascade so cross-tenant
+                    // workflow_id can't trigger foreign workflow_runs wipe via plugin.
+                    await supabase.from("workflow_runs").delete().eq("user_id", userId).eq("workflow_id", wfId);
                     const { error } = await supabase.from("workflows").delete().eq("id", wfId).eq("user_id", userId);
                     if (error)
                         return err(error.message);
@@ -2670,13 +2675,13 @@ function registerNotifyOps(api, supabase, userId, resolveAgent) {
                 case "mark_read": {
                     if (!params.id)
                         return err("Missing required: id");
-                    const { error } = await supabase.from("notifications").update({ read: true }).eq("id", params.id);
+                    const { error } = await supabase.from("notifications").update({ read: true }).eq("id", params.id).eq("user_id", userId);
                     if (error)
                         return err(error.message);
                     return ok({ message: "Notification marked as read", ok: true });
                 }
                 case "mark_all_read": {
-                    const { error } = await supabase.from("notifications").update({ read: true }).eq("read", false);
+                    const { error } = await supabase.from("notifications").update({ read: true }).eq("read", false).eq("user_id", userId);
                     if (error)
                         return err(error.message);
                     return ok({ message: "All notifications marked as read", ok: true });
@@ -2684,7 +2689,7 @@ function registerNotifyOps(api, supabase, userId, resolveAgent) {
                 case "delete": {
                     if (!params.id)
                         return err("Missing required: id");
-                    const { error } = await supabase.from("notifications").delete().eq("id", params.id);
+                    const { error } = await supabase.from("notifications").delete().eq("id", params.id).eq("user_id", userId);
                     if (error)
                         return err(error.message);
                     return ok({ message: "Notification deleted", ok: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofiere-openclaw-plugin",
-  "version": "4.56.7",
+  "version": "4.56.9",
   "type": "module",
   "description": "OpenClaw plugin for Ofiere PM - 18 meta-tools covering tasks, agents, projects, scheduling, knowledge, workflows, notifications, memory, prompts, constellation, space file management, execution plan builder, SOP management, agent brain, talent management, corporate frameworks, agent office canvas, and PM gate approvals",
   "keywords": [

package/src/tools.ts

@@ -1147,12 +1147,15 @@ async function handleUpdateTask(
       }
     }
 
-    // If task is being marked DONE or FAILED, auto-complete any linked scheduler events
+    // If task is being marked DONE or FAILED, auto-complete any linked scheduler events.
+    // A-4 plugin parity (2026-05-18) — scope by user_id so cross-tenant task_id
+    // can't trigger foreign scheduler flip via plugin tool path.
     if (params.status === "DONE" || params.status === "FAILED") {
       try {
         await supabase
           .from("scheduler_events")
           .update({ status: "completed", next_run_at: null, updated_at: new Date().toISOString() })
+          .eq("user_id", userId)
           .eq("task_id", params.task_id as string);
       } catch (_schedErr) {
         // Non-fatal: task update should still proceed
@@ -1264,7 +1267,7 @@ async function handleDeleteTask(
     if (!params.task_id) return err("Missing required field: task_id");
     const taskId = params.task_id as string;
 
-    await supabase.from("scheduler_events").delete().eq("task_id", taskId);
+    await supabase.from("scheduler_events").delete().eq("task_id", taskId).eq("user_id", userId);
 
     const { data: subtasks } = await supabase
       .from("tasks")
@@ -1274,7 +1277,7 @@ async function handleDeleteTask(
 
     if (subtasks && subtasks.length > 0) {
       for (const sub of subtasks) {
-        await supabase.from("scheduler_events").delete().eq("task_id", sub.id);
+        await supabase.from("scheduler_events").delete().eq("task_id", sub.id).eq("user_id", userId);
       }
       await supabase
         .from("tasks")
@@ -1990,13 +1993,13 @@ function registerScheduleOps(
           if (upd.status === "completed" || upd.status === "cancelled") {
             upd.next_run_at = null;
           }
-          const { error } = await supabase.from("scheduler_events").update(upd).eq("id", params.id);
+          const { error } = await supabase.from("scheduler_events").update(upd).eq("id", params.id).eq("user_id", userId);
           if (error) return err(error.message);
           return ok({ message: "Event updated", ok: true });
         }
         case "delete": {
           if (!params.id) return err("Missing required: id");
-          const { error } = await supabase.from("scheduler_events").delete().eq("id", params.id);
+          const { error } = await supabase.from("scheduler_events").delete().eq("id", params.id).eq("user_id", userId);
           if (error) return err(error.message);
           return ok({ message: "Event deleted", ok: true });
         }
@@ -2107,13 +2110,13 @@ function registerKnowledgeOps(
           const upd: Record<string, any> = {};
           for (const k of allowed) if ((params as any)[k] !== undefined) upd[k] = (params as any)[k];
           if (Object.keys(upd).length === 0) return err("No valid fields to update");
-          const { error } = await supabase.from("knowledge_documents").update(upd).eq("id", params.id);
+          const { error } = await supabase.from("knowledge_documents").update(upd).eq("id", params.id).eq("user_id", userId);
           if (error) return err(error.message);
           return ok({ message: "Document updated", ok: true });
         }
         case "delete": {
           if (!params.id) return err("Missing required: id");
-          const { error } = await supabase.from("knowledge_documents").delete().eq("id", params.id);
+          const { error } = await supabase.from("knowledge_documents").delete().eq("id", params.id).eq("user_id", userId);
           if (error) return err(error.message);
           return ok({ message: "Document deleted", ok: true });
         }
@@ -2464,7 +2467,9 @@ function registerWorkflowOps(
         case "delete": {
           const wfId = (params.id || params.workflow_id) as string;
           if (!wfId) return err("Missing required: id");
-          await supabase.from("workflow_runs").delete().eq("workflow_id", wfId);
+          // A-4 plugin parity (2026-05-18) — scope cascade so cross-tenant
+          // workflow_id can't trigger foreign workflow_runs wipe via plugin.
+          await supabase.from("workflow_runs").delete().eq("user_id", userId).eq("workflow_id", wfId);
           const { error } = await supabase.from("workflows").delete().eq("id", wfId).eq("user_id", userId);
           if (error) return err(error.message);
           return ok({ message: "Workflow and associated runs deleted", ok: true });
@@ -2840,18 +2845,18 @@ function registerNotifyOps(
         }
         case "mark_read": {
           if (!params.id) return err("Missing required: id");
-          const { error } = await supabase.from("notifications").update({ read: true }).eq("id", params.id);
+          const { error } = await supabase.from("notifications").update({ read: true }).eq("id", params.id).eq("user_id", userId);
           if (error) return err(error.message);
           return ok({ message: "Notification marked as read", ok: true });
         }
         case "mark_all_read": {
-          const { error } = await supabase.from("notifications").update({ read: true }).eq("read", false);
+          const { error } = await supabase.from("notifications").update({ read: true }).eq("read", false).eq("user_id", userId);
           if (error) return err(error.message);
           return ok({ message: "All notifications marked as read", ok: true });
         }
         case "delete": {
           if (!params.id) return err("Missing required: id");
-          const { error } = await supabase.from("notifications").delete().eq("id", params.id);
+          const { error } = await supabase.from("notifications").delete().eq("id", params.id).eq("user_id", userId);
           if (error) return err(error.message);
           return ok({ message: "Notification deleted", ok: true });
         }