@rubytech/create-maxy-code 0.1.109 → 0.1.111

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { execFileSync, spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, symlinkSync, unlinkSync, lstatSync, statSync, readlinkSync, realpathSync, accessSync, constants as fsConstants } from "node:fs";
+import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync } from "node:fs";
 import { registerSpecialistAgentsAt, SpecialistSymlinkCollision } from "./specialist-registration.js";
 import { resolve, join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
@@ -588,8 +588,8 @@ function runChromiumPostInstallGate(chromiumBin) {
 }
 /**
  * write the resolved Chromium absolute path to
- * `<INSTALL_DIR>/platform/config/chromium-binary.path` so vnc.sh,
- * writeChromiumWrapper, and setup-tunnel.sh all read the same value. Called
+ * `<INSTALL_DIR>/platform/config/chromium-binary.path` so vnc.sh and
+ * writeChromiumWrapper read the same value. Called
  * after deployPayload so the platform/config/ directory exists. Idempotent:
  * re-running the installer with the same RESOLVED_CHROMIUM_BIN is a no-op
  * write (writeFileSync overwrites in place).
@@ -1284,31 +1284,45 @@ function setupDedicatedNeo4j() {
         shell("cp", ["-r", "/etc/neo4j", confDir], { sudo: true });
     }
     // Idempotent per-brand state — runs on every install.
-    // sed `s|^#?key=.*|key=value|` no-ops when the file already has the target
-    // value; mkdir -p, chown -R, and unit-write are idempotent by definition.
-    // NEO4J_HOME=${dataDir} makes server.directories.run resolve per-brand to
-    // ${dataDir}/run, so the launcher's pre-flight does not collide with the
-    // system unit's /var/lib/neo4j/run/neo4j.pid (root cause). Plugins
-    // and import are sed-overridden because the apt base conf pins them to
-    // absolute /var/lib/neo4j/plugins and /var/lib/neo4j/import (shared).
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s/^#\\?server\\.bolt\\.listen_address=.*/server.bolt.listen_address=:${NEO4J_PORT}/`, `${confDir}/neo4j.conf`], { sudo: true });
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s/^#\\?server\\.http\\.listen_address=.*/server.http.listen_address=:${httpPort}/`, `${confDir}/neo4j.conf`], { sudo: true });
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s|^#\\?server\\.directories\\.data=.*|server.directories.data=${dataDir}/data|`, `${confDir}/neo4j.conf`], { sudo: true });
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s|^#\\?server\\.directories\\.logs=.*|server.directories.logs=${logDir}|`, `${confDir}/neo4j.conf`], { sudo: true });
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s|^#\\?server\\.directories\\.plugins=.*|server.directories.plugins=${dataDir}/plugins|`, `${confDir}/neo4j.conf`], { sudo: true });
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s|^#\\?server\\.directories\\.import=.*|server.directories.import=${dataDir}/import|`, `${confDir}/neo4j.conf`], { sudo: true });
-    // Verify config was updated — sed silently no-ops if the key format changed
-    const confContent = spawnSync("grep", [`server.bolt.listen_address=:${NEO4J_PORT}`, `${confDir}/neo4j.conf`], { stdio: "pipe" });
-    if (confContent.status !== 0) {
-        console.error(`  WARNING: neo4j.conf may not have been updated correctly — bolt port ${NEO4J_PORT} not found in config`);
-        logFile(`  WARNING: sed verification failed — bolt port ${NEO4J_PORT} not found in ${confDir}/neo4j.conf`);
-    }
+    // Older Neo4j 5.x templates ship a SECOND commented occurrence of these
+    // keys in the "Other Neo4j system properties" section. An in-place
+    // `sed s|^#?key=.*|key=value|` matches both and writes duplicate active
+    // lines; the 5.26.26 parser turns that into a fatal startup error.
+    // Delete-all-then-append guarantees exactly one active line per key
+    // regardless of how many commented occurrences the template ships.
+    const confPath = `${confDir}/neo4j.conf`;
+    const confKeys = [
+        ["server.bolt.listen_address", `:${NEO4J_PORT}`],
+        ["server.http.listen_address", `:${httpPort}`],
+        ["server.directories.data", `${dataDir}/data`],
+        ["server.directories.logs", logDir],
+        ["server.directories.plugins", `${dataDir}/plugins`],
+        ["server.directories.import", `${dataDir}/import`],
+    ];
+    for (const [key, value] of confKeys) {
+        const keyRe = key.replace(/\./g, "\\.");
+        console.log("  [privileged] sed -i (delete)");
+        shell("sed", ["-i", `/^#\\?${keyRe}=/d`, confPath], { sudo: true });
+        console.log("  [privileged] echo >>");
+        shell("sh", ["-c", `echo '${key}=${value}' >> ${confPath}`], { sudo: true });
+    }
+    // Verify exactly one active line per key. Any n>1 aborts the install
+    // BEFORE the systemd unit is written. n==0 means the append failed.
+    const activeCounts = [];
+    for (const [key] of confKeys) {
+        const r = spawnSync("sudo", ["grep", "-c", `^${key}=`, confPath], { stdio: "pipe" });
+        const n = parseInt((r.stdout?.toString() ?? "0").trim(), 10) || 0;
+        activeCounts.push(`${key}:${n}`);
+        if (n !== 1) {
+            const msg = `[neo4j-conf] FATAL ${key} active_count=${n}`;
+            console.error(`  ${msg}`);
+            logFile(`  ${msg}`);
+            throw new Error(msg);
+        }
+    }
+    const summary = `[neo4j-conf] keys_active=${activeCounts.join(",")}`;
+    console.log(`  ${summary}`);
+    logFile(`  ${summary}`);
     console.log("  [privileged] mkdir -p");
     shell("mkdir", ["-p", `${dataDir}/data`, `${dataDir}/plugins`, `${dataDir}/import`, logDir], { sudo: true });
     console.log("  [privileged] chown -R");
@@ -2174,11 +2188,10 @@ function setupVncViewer() {
 
     // Layer-6 beacon: emit event=rfb-connected and
     // event=rfb-error to the operator-grep lifecycle endpoint so
-    // server.log shows the noVNC outcome alongside [setup-tunnel] /
-    // [cloudflare-setup] / [device-url:click] / [http] / [websockify].
-    // Same-origin POST works whether the iframe is parented by the
-    // React BrowserViewer or by vnc-popout.html.
-    function reportBrowserViewerEvent(event, fields) {
+    // server.log shows the noVNC outcome alongside [device-url:click]
+    // / [http] / [websockify]. Same-origin POST works whether the
+    // iframe is parented by the React VNC viewer or by vnc-popout.html.
+    function reportVncIframeEvent(event, fields) {
       try {
         var body = JSON.stringify(Object.assign(
           { event: event, surface: 'iframe' },
@@ -2212,7 +2225,7 @@ function setupVncViewer() {
       rfb.addEventListener('connect', () => {
         status.classList.add('hidden');
         retryCount = 0;
-        reportBrowserViewerEvent('rfb-connected', {
+        reportVncIframeEvent('rfb-connected', {
           durationMs: Date.now() - connectStartedAt,
         });
       });
@@ -2222,7 +2235,7 @@ function setupVncViewer() {
         const detail = e.detail || {};
         const reason = detail.reason || (detail.clean === false ? 'Connection refused' : '');
         reportClientEvent('disconnect', reason || (detail.clean === false ? 'unclean-close' : 'normal'));
-        reportBrowserViewerEvent('rfb-error', {
+        reportVncIframeEvent('rfb-error', {
           durationMs: Date.now() - connectStartedAt,
           errorCode: detail.clean === false ? 'unclean-close' : 'normal',
           message: reason || '',
@@ -2422,27 +2435,6 @@ function writeEntitlementFromFlag(payload) {
     console.log(line);
     logFile(line);
 }
-// ---------------------------------------------------------------------------
-// Tunnel script shortcuts
-//
-// The cloudflare plugin's SKILL.md, PLUGIN.md, and reference docs encode the
-// invocation `~/setup-tunnel.sh` (and `~/reset-tunnel.sh`). The filesystem
-// reality is <INSTALL_DIR>/platform/plugins/cloudflare/scripts/*.sh. Without
-// the symlink the agent's first SKILL-compliant invocation fails with exit
-// 127 — the discipline-violation loop the symlink exists to close.
-//
-// Collision discipline (last-writer-wins across brands):
-//   - absent path                   → create
-//   - regular file                  → exit 1 (operator-owned file, do not clobber)
-//   - symlink → same target         → no-op
-//   - symlink → any other target    → overwrite (unlink + symlink)
-//                                     covers stale-same-brand, dangling,
-//                                     unreadable, and peer-brand cases.
-//                                     setup-tunnel.sh takes <brand> as argv
-//                                     so the script still operates on the
-//                                     correct brand regardless of who owns
-//                                     the shortcut symlink.
-// ---------------------------------------------------------------------------
 function registerSpecialistAgents() {
     try {
         registerSpecialistAgentsAt(join(INSTALL_DIR, "platform/templates/specialists/agents"), join(CLAUDE_CONFIG_DIR, "agents"), (line) => { console.log(line); logFile(line); });
@@ -2456,76 +2448,6 @@ function registerSpecialistAgents() {
         throw err;
     }
 }
-function createTunnelSymlink(linkPath, target) {
-    const targetAbs = resolve(target);
-    let lstat = null;
-    try {
-        lstat = lstatSync(linkPath);
-    }
-    catch (err) {
-        const code = err.code;
-        if (code !== "ENOENT") {
-            console.error(`Setup failed: ${linkPath} lstat failed: ${err.message}`);
-            console.error(`[create-maxy:error] ${linkPath} lstat failed: ${err.message}`);
-            process.exit(1);
-        }
-    }
-    if (lstat === null) {
-        symlinkSync(targetAbs, linkPath);
-        console.log(`  [create-maxy] symlink ${linkPath} → ${targetAbs}`);
-        logFile(`  symlink created: ${linkPath} → ${targetAbs}`);
-        return;
-    }
-    if (!lstat.isSymbolicLink()) {
-        console.error(`Setup failed: ${linkPath} collision (regular file)`);
-        console.error(`[create-maxy:collision] ${linkPath} already exists target=<regular-file>`);
-        console.error(`  Remove the file and re-run: npx -y @rubytech/create-maxy`);
-        process.exit(1);
-    }
-    // Brand isolation: a symlink at this path is either stale-same-brand,
-    // dangling, unreadable, or pointing at another brand. All four cases are resolved
-    // by last-writer-wins overwrite — setup-tunnel.sh takes <brand> as argv, so
-    // whichever brand's installer ran last owns the shortcut.
-    const resolvedTarget = (() => {
-        try {
-            return resolve(dirname(linkPath), readlinkSync(linkPath));
-        }
-        catch {
-            return "<unreadable>";
-        }
-    })();
-    if (resolvedTarget === targetAbs) {
-        console.log(`  [create-maxy] symlink ${linkPath} already points to ${targetAbs}`);
-        logFile(`  symlink unchanged: ${linkPath} → ${targetAbs}`);
-        return;
-    }
-    unlinkSync(linkPath);
-    symlinkSync(targetAbs, linkPath);
-    console.log(`  [create-maxy] symlink replaced: ${linkPath} → ${targetAbs}`);
-    logFile(`  symlink replaced: ${linkPath} was ${resolvedTarget}, now ${targetAbs}`);
-}
-function installTunnelScripts() {
-    const setupSrc = join(INSTALL_DIR, "platform/plugins/cloudflare/scripts/setup-tunnel.sh");
-    const resetSrc = join(INSTALL_DIR, "platform/plugins/cloudflare/scripts/reset-tunnel.sh");
-    const listSrc = join(INSTALL_DIR, "platform/plugins/cloudflare/scripts/list-cf-domains.sh");
-    const setupLink = resolve(process.env.HOME ?? "/root", "setup-tunnel.sh");
-    const resetLink = resolve(process.env.HOME ?? "/root", "reset-tunnel.sh");
-    const listLink = resolve(process.env.HOME ?? "/root", "list-cf-domains.sh");
-    for (const src of [setupSrc, resetSrc, listSrc]) {
-        try {
-            chmodSync(src, 0o755);
-        }
-        catch (err) {
-            console.error(`Setup failed: tunnel script missing or chmod failed: ${src}`);
-            console.error(`[create-maxy:error] tunnel script missing or chmod failed: ${src}`);
-            console.error(`  ${err.message}`);
-            process.exit(1);
-        }
-    }
-    createTunnelSymlink(setupLink, setupSrc);
-    createTunnelSymlink(resetLink, resetSrc);
-    createTunnelSymlink(listLink, listSrc);
-}
 // ---------------------------------------------------------------------------
 // Account discovery (shared by installService + the post-install summary)
 //
@@ -3238,27 +3160,6 @@ WantedBy=multi-user.target
             process.exit(1);
         }
     }
-    // Tunnel script smoke check — the cloudflare SKILL contract invokes
-    // ~/setup-tunnel.sh directly. If the install-time symlink creation in
-    // installTunnelScripts() didn't land, fail the install loudly here rather
-    // than shipping a missing-symlink gap that would loop the agent on exit 127.
-    for (const linkPath of [
-        resolve(process.env.HOME ?? "/root", "setup-tunnel.sh"),
-        resolve(process.env.HOME ?? "/root", "reset-tunnel.sh"),
-        resolve(process.env.HOME ?? "/root", "list-cf-domains.sh"),
-    ]) {
-        try {
-            accessSync(linkPath, fsConstants.X_OK);
-            console.log(`  [create-maxy] verify: ${linkPath} executable ✓`);
-        }
-        catch (err) {
-            console.error("");
-            console.error(`Setup failed: tunnel script symlink missing or not executable: ${linkPath}`);
-            console.error(`  [create-maxy:error] tunnel script symlink missing or not executable: ${linkPath}`);
-            console.error(`  ${err.message}`);
-            process.exit(1);
-        }
-    }
 }
 // ---------------------------------------------------------------------------
 // Samba provisioning. Runs after installService() so SMB never
@@ -3729,8 +3630,8 @@ try {
     installWhisperCpp();
     deployPayload(); // Must happen before ensureNeo4jPassword — restores config backup
     // write the resolved Chromium absolute path into the deployed
-    // platform/config/ so vnc.sh, writeChromiumWrapper, and setup-tunnel.sh
-    // all read the same value. Must run after deployPayload (config dir is
+    // platform/config/ so vnc.sh and writeChromiumWrapper read the same
+    // value. Must run after deployPayload (config dir is
     // a payload subdirectory). Linux-only; no-op on darwin/non-linux.
     writeChromiumBinaryPathFile();
     // scrub plaintext neo4j passwords from any pre-fix install-*.log.
@@ -3746,7 +3647,6 @@ try {
     if (ENTITLEMENT_PAYLOAD) {
         writeEntitlementFromFlag(ENTITLEMENT_PAYLOAD);
     }
-    installTunnelScripts(); // ~/setup-tunnel.sh, ~/reset-tunnel.sh — the SKILL contract
     installService();
     // Samba on the LAN. Runs after the brand systemd unit is up so
     // SMB provisioning never blocks the admin server starting; loud-fail per

package/dist/snap-chromium.js

@@ -1,7 +1,6 @@
 // pure decision: should the laptop installer replace snap-confined
 // Chromium with Google Chrome stable, and which absolute binary path should
-// vnc.sh / writeChromiumWrapper / setup-tunnel.sh / the Playwright env var
-// resolve to?
+// vnc.sh / writeChromiumWrapper / the Playwright env var resolve to?
 //
 // Mirrors apt-resolve.ts and port-resolution.ts: inputs
 // in, decision out, no I/O. The installer wraps this with the actual

package/dist/uninstall.js

@@ -330,22 +330,23 @@ export function exportData(exportPath) {
     console.log(`  Export complete: ${exportPath}`);
 }
 // ---------------------------------------------------------------------------
-// Step 3b: Remove tunnel script symlinks
+// Step 3b: Remove legacy tunnel shortcut symlinks
 //
-// installTunnelScripts() creates ~/setup-tunnel.sh and ~/reset-tunnel.sh as
-// symlinks into INSTALL_DIR. Must run BEFORE removeAppDirs removes INSTALL_DIR
-// so readlink-then-compare still works.
+// Older installer versions created ~/setup-tunnel and ~/reset-tunnel (with
+// the ".sh" suffix) as symlinks into INSTALL_DIR's cloudflare scripts
+// directory. The wrapper scripts and their installer hook were retired in
+// Task 288 (PTY-native cloudflared via Bash). This step removes any leftover
+// symlinks from previous installs. Must run BEFORE removeAppDirs removes
+// INSTALL_DIR so readlink-then-compare still works.
 //
 // Only unlink if the symlink's resolved target is inside this brand's
 // INSTALL_DIR. A symlink pointing elsewhere came from a different brand install
 // on the same home (unsupported but not destructive) — leave it alone.
 // ---------------------------------------------------------------------------
+const LEGACY_TUNNEL_SHORTCUTS = ["setup-tunnel", "reset-tunnel"].map((n) => `${n}.sh`);
 function removeTunnelSymlinks() {
-    log("3b", "Removing tunnel script symlinks...");
-    for (const linkPath of [
-        resolve(HOME, "setup-tunnel.sh"),
-        resolve(HOME, "reset-tunnel.sh"),
-    ]) {
+    log("3b", "Removing legacy tunnel shortcut symlinks...");
+    for (const linkPath of LEGACY_TUNNEL_SHORTCUTS.map((name) => resolve(HOME, name))) {
         let lstat;
         try {
             lstat = lstatSync(linkPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.109",
+  "version": "0.1.111",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/neo4j/schema.cypher

@@ -1071,9 +1071,12 @@ FOR (n:Task) ON (n.createdBySession);
 
 // ----------------------------------------------------------
 // CloudflareTunnel / CloudflareHostname — graph audit of
-// the tunnel-login deterministic flow. Written by the
-// /api/admin/cloudflare/setup endpoint after setup-tunnel.sh exits 0,
-// linked via (Task {kind:'cloudflare-tunnel-login'})-[:PRODUCED]->.
+// the tunnel-login flow. Historically written by the
+// /api/admin/cloudflare/setup endpoint after setup-tunnel.sh exits 0;
+// after Task 288 (PTY-native cloudflared) both the endpoint and the
+// wrapper script are gone. The constraints below remain so legacy
+// projections stay queryable, but no current writer emits these nodes.
+// Linked via (Task {kind:'cloudflare-tunnel-login'})-[:PRODUCED]->.
 // CloudflareHostname carries the routed FQDN; CloudflareTunnel
 // carries the connector identity. Source of truth remains the on-disk
 // cert.pem + tunnel.state + config.yml — these nodes are the graph

package/payload/platform/plugins/admin/PLUGIN.md

@@ -127,6 +127,7 @@ Tools are available via the `admin` MCP server.
 | Session reset / continue / resume | User asks to clear the session, start fresh, continue the last session, or pick up where they left off | `skills/session-management/SKILL.md` |
 | Commitment follow-through | A `<commitment-detected>` block appears in the prompt; the owner has just made a commitment that needs a backing mechanism | `skills/commitment-followthrough/SKILL.md` |
 | Show or download a file | User asks to view, attach, or download a file or document, or the current turn produces a document the owner needs to review | `skills/file-presentation/SKILL.md` |
+| Upgrade Maxy | User asks to upgrade, update, install the latest version, or accepts an upgrade offer | `skills/upgrade/SKILL.md` |
 
 ## Hooks
 

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -1803,7 +1803,7 @@ eagerTool(server, "session-resume", "Resume a previous session. Loads the select
 server.tool("remote-auth-set-password", "Set the remote access password. Hashes with scrypt and writes to the platform's brand-specific config directory with mode 0600. " +
     "Validates strength (8+ chars, digit, special character, no spaces anywhere). " +
     "Protects the admin interface when exposed over the tunnel — has no effect on the public endpoint or the tunnel itself. " +
-    "Set before `setup-tunnel.sh` — the script's post-restart verification curls the admin hostname and fails if remote-auth is not configured.", { password: z.string() }, async ({ password }) => {
+    "Set before configuring the Cloudflare tunnel — the post-restart `curl -I https://<admin-hostname>` verification fails if remote-auth is not configured.", { password: z.string() }, async ({ password }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("remote-auth-set-password");
     // Validate strength — same rules as the web server's validatePasswordStrength