@rubytech/create-maxy-code 0.1.110 → 0.1.111

package/dist/index.js

@@ -1284,31 +1284,45 @@ function setupDedicatedNeo4j() {
         shell("cp", ["-r", "/etc/neo4j", confDir], { sudo: true });
     }
     // Idempotent per-brand state — runs on every install.
-    // sed `s|^#?key=.*|key=value|` no-ops when the file already has the target
-    // value; mkdir -p, chown -R, and unit-write are idempotent by definition.
-    // NEO4J_HOME=${dataDir} makes server.directories.run resolve per-brand to
-    // ${dataDir}/run, so the launcher's pre-flight does not collide with the
-    // system unit's /var/lib/neo4j/run/neo4j.pid (root cause). Plugins
-    // and import are sed-overridden because the apt base conf pins them to
-    // absolute /var/lib/neo4j/plugins and /var/lib/neo4j/import (shared).
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s/^#\\?server\\.bolt\\.listen_address=.*/server.bolt.listen_address=:${NEO4J_PORT}/`, `${confDir}/neo4j.conf`], { sudo: true });
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s/^#\\?server\\.http\\.listen_address=.*/server.http.listen_address=:${httpPort}/`, `${confDir}/neo4j.conf`], { sudo: true });
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s|^#\\?server\\.directories\\.data=.*|server.directories.data=${dataDir}/data|`, `${confDir}/neo4j.conf`], { sudo: true });
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s|^#\\?server\\.directories\\.logs=.*|server.directories.logs=${logDir}|`, `${confDir}/neo4j.conf`], { sudo: true });
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s|^#\\?server\\.directories\\.plugins=.*|server.directories.plugins=${dataDir}/plugins|`, `${confDir}/neo4j.conf`], { sudo: true });
-    console.log("  [privileged] sed -i");
-    shell("sed", ["-i", `s|^#\\?server\\.directories\\.import=.*|server.directories.import=${dataDir}/import|`, `${confDir}/neo4j.conf`], { sudo: true });
-    // Verify config was updated — sed silently no-ops if the key format changed
-    const confContent = spawnSync("grep", [`server.bolt.listen_address=:${NEO4J_PORT}`, `${confDir}/neo4j.conf`], { stdio: "pipe" });
-    if (confContent.status !== 0) {
-        console.error(`  WARNING: neo4j.conf may not have been updated correctly — bolt port ${NEO4J_PORT} not found in config`);
-        logFile(`  WARNING: sed verification failed — bolt port ${NEO4J_PORT} not found in ${confDir}/neo4j.conf`);
-    }
+    // Older Neo4j 5.x templates ship a SECOND commented occurrence of these
+    // keys in the "Other Neo4j system properties" section. An in-place
+    // `sed s|^#?key=.*|key=value|` matches both and writes duplicate active
+    // lines; the 5.26.26 parser turns that into a fatal startup error.
+    // Delete-all-then-append guarantees exactly one active line per key
+    // regardless of how many commented occurrences the template ships.
+    const confPath = `${confDir}/neo4j.conf`;
+    const confKeys = [
+        ["server.bolt.listen_address", `:${NEO4J_PORT}`],
+        ["server.http.listen_address", `:${httpPort}`],
+        ["server.directories.data", `${dataDir}/data`],
+        ["server.directories.logs", logDir],
+        ["server.directories.plugins", `${dataDir}/plugins`],
+        ["server.directories.import", `${dataDir}/import`],
+    ];
+    for (const [key, value] of confKeys) {
+        const keyRe = key.replace(/\./g, "\\.");
+        console.log("  [privileged] sed -i (delete)");
+        shell("sed", ["-i", `/^#\\?${keyRe}=/d`, confPath], { sudo: true });
+        console.log("  [privileged] echo >>");
+        shell("sh", ["-c", `echo '${key}=${value}' >> ${confPath}`], { sudo: true });
+    }
+    // Verify exactly one active line per key. Any n>1 aborts the install
+    // BEFORE the systemd unit is written. n==0 means the append failed.
+    const activeCounts = [];
+    for (const [key] of confKeys) {
+        const r = spawnSync("sudo", ["grep", "-c", `^${key}=`, confPath], { stdio: "pipe" });
+        const n = parseInt((r.stdout?.toString() ?? "0").trim(), 10) || 0;
+        activeCounts.push(`${key}:${n}`);
+        if (n !== 1) {
+            const msg = `[neo4j-conf] FATAL ${key} active_count=${n}`;
+            console.error(`  ${msg}`);
+            logFile(`  ${msg}`);
+            throw new Error(msg);
+        }
+    }
+    const summary = `[neo4j-conf] keys_active=${activeCounts.join(",")}`;
+    console.log(`  ${summary}`);
+    logFile(`  ${summary}`);
     console.log("  [privileged] mkdir -p");
     shell("mkdir", ["-p", `${dataDir}/data`, `${dataDir}/plugins`, `${dataDir}/import`, logDir], { sudo: true });
     console.log("  [privileged] chown -R");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.110",
+  "version": "0.1.111",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/neo4j/schema.cypher

@@ -1071,9 +1071,12 @@ FOR (n:Task) ON (n.createdBySession);
 
 // ----------------------------------------------------------
 // CloudflareTunnel / CloudflareHostname — graph audit of
-// the tunnel-login deterministic flow. Written by the
-// /api/admin/cloudflare/setup endpoint after setup-tunnel.sh exits 0,
-// linked via (Task {kind:'cloudflare-tunnel-login'})-[:PRODUCED]->.
+// the tunnel-login flow. Historically written by the
+// /api/admin/cloudflare/setup endpoint after setup-tunnel.sh exits 0;
+// after Task 288 (PTY-native cloudflared) both the endpoint and the
+// wrapper script are gone. The constraints below remain so legacy
+// projections stay queryable, but no current writer emits these nodes.
+// Linked via (Task {kind:'cloudflare-tunnel-login'})-[:PRODUCED]->.
 // CloudflareHostname carries the routed FQDN; CloudflareTunnel
 // carries the connector identity. Source of truth remains the on-disk
 // cert.pem + tunnel.state + config.yml — these nodes are the graph

package/payload/platform/plugins/cloudflare/references/manual-setup.md

@@ -505,20 +505,20 @@ sudo cloudflared service uninstall
 If `admin.<yourdomain>` is rendering the public-agent UI, the tunnel is fine but the platform UI is treating the admin hostname as public. The platform UI classifies a host as public when either:
 
 - the hostname starts with `public.`, or
-- the hostname appears in `${CFG_DIR}/alias-domains.json`.
+- the hostname appears in `${HOME}/.${BRAND}/alias-domains.json` (note: brand root, **not** `${CFG_DIR}` — `alias-domains.json` lives one level above `cloudflared/`, because that's where the platform UI watches).
 
 Pre-Task-548 sessions populated this file via the now-deleted `tunnel-add-hostname` MCP tool, which wrote every routed hostname — including `admin.*` — into the alias set. The pollution persists across installs.
 
 **Diagnose:**
 
 ```
-cat "${CFG_DIR}/alias-domains.json"
+cat "${HOME}/.${BRAND}/alias-domains.json"
 ```
 
 If `admin.<yourdomain>` appears in the array, remove it:
 
 ```
-jq --arg H "admin.<yourdomain>" 'map(select(. != $H))' "${CFG_DIR}/alias-domains.json" > /tmp/alias.json && mv /tmp/alias.json "${CFG_DIR}/alias-domains.json"
+jq --arg H "admin.<yourdomain>" 'map(select(. != $H))' "${HOME}/.${BRAND}/alias-domains.json" > /tmp/alias.json && mv /tmp/alias.json "${HOME}/.${BRAND}/alias-domains.json"
 ```
 
 Replace `<yourdomain>` with your actual domain. The platform UI watches the file — no restart required; the next request to the admin hostname routes to the admin surface.

package/payload/platform/plugins/cloudflare/references/reset-guide.md

@@ -86,16 +86,18 @@ When the operator is unsure which records are stray, have them list the zone's C
 
 ### Remove a rogue entry from `alias-domains.json`
 
-`alias-domains.json` controls which hostnames the platform UI classifies as public (serving the public agent) rather than admin. A prior setup flow may have written an `admin.*` hostname into this file by mistake. Remove it manually:
+`alias-domains.json` controls which hostnames the platform UI classifies as public (serving the public agent) rather than admin. It lives at `${HOME}/.${BRAND}/alias-domains.json` — the brand root, **not** `${CFG_DIR}` (which is `${HOME}/.${BRAND}/cloudflared`). The platform UI watches the brand root; writing to `${CFG_DIR}/alias-domains.json` is invisible to the watcher.
+
+A prior setup flow may have written an `admin.*` hostname into this file by mistake. Remove it manually:
 
 ```
-cat "${CFG_DIR}/alias-domains.json"
+cat "${HOME}/.${BRAND}/alias-domains.json"
 ```
 
 If `admin.<yourdomain>` is listed, strip it:
 
 ```
-jq --arg H "admin.<yourdomain>" 'map(select(. != $H))' "${CFG_DIR}/alias-domains.json" > /tmp/alias.json && mv /tmp/alias.json "${CFG_DIR}/alias-domains.json"
+jq --arg H "admin.<yourdomain>" 'map(select(. != $H))' "${HOME}/.${BRAND}/alias-domains.json" > /tmp/alias.json && mv /tmp/alias.json "${HOME}/.${BRAND}/alias-domains.json"
 ```
 
 Replace `<yourdomain>` with the actual domain. The platform UI watches the file and reloads without a restart.

package/payload/platform/templates/specialists/agents/personal-assistant.md

@@ -23,7 +23,7 @@ These three rules win when anything else in this prompt conflicts with them.
 Each domain has a small set of tools and, where it exists, a skill that drives the multi-step flow. Match the brief to the domain, load the skill if one is named, and run the tools the skill prescribes.
 
 - **WhatsApp setup or config:** load `skill-load skillName=connect-whatsapp` for QR pairing and admin-phone setup; load `skill-load skillName=manage-whatsapp-config` for DM/group policies and admin-phone management. The skills carry the per-phase flow.
-- **Cloudflare tunnel:** load `skill-load skillName=setup-tunnel`. The skill names the four sanctioned surfaces (`setup-tunnel.sh`, `reset-tunnel.sh`, `manual-setup.md`, `dashboard-guide.md`) and the inputs to collect.
+- **Cloudflare tunnel:** load `skill-load skillName=setup-tunnel`. The skill drives `cloudflared` directly via Bash following `references/manual-setup.md`, `references/reset-guide.md`, and `references/dashboard-guide.md`. There is no shell-script wrapper; PTY stdout is the only surface.
 - **Every other domain** (scheduling, Telegram, email, Outlook, contacts, browser, platform admin) runs through the tool descriptions injected into your system prompt. The rules below apply across these domains regardless of which tool is invoked.
 
 ## Cross-domain rules