@rubytech/create-maxy-code 0.1.22 → 0.1.24

package/payload/server/server.js

@@ -7410,7 +7410,7 @@ app7.get("/group-info", async (c) => {
 var whatsapp_default = app7;
 
 // server/routes/onboarding.ts
-import { spawn, execFileSync as execFileSync2 } from "child_process";
+import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
 import { openSync, closeSync, writeFileSync as writeFileSync9, writeSync, existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync13, unlinkSync as unlinkSync2 } from "fs";
 import { resolve as resolve11, dirname as dirname4 } from "path";
 import { createHash, randomUUID as randomUUID6 } from "crypto";
@@ -7705,6 +7705,24 @@ app8.post("/set-pin", async (c) => {
     return c.json({ error: "PIN saved but admin role could not be recorded. See server log." }, 500);
   }
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
+  if (process.platform === "linux") {
+    const smbProc = spawnSync2("sudo", ["-n", "smbpasswd", "-a", "-s", "admin"], {
+      input: `${body.pin}
+${body.pin}
+`,
+      stdio: ["pipe", "pipe", "pipe"],
+      encoding: "utf-8",
+      timeout: 1e4
+    });
+    if (smbProc.status === 0) {
+      console.log(`[set-pin] smb-password-synced userId=${userId.slice(0, 8)}\u2026`);
+    } else {
+      const stderr = (smbProc.stderr ?? "").trim().slice(0, 200);
+      console.error(`[set-pin] smb-password-sync-failed exit=${smbProc.status} stderr=${JSON.stringify(stderr)}`);
+    }
+  } else {
+    console.log(`[set-pin] smb-password-sync-skipped reason=non-linux platform=${process.platform}`);
+  }
   try {
     const adminBind = await writeAdminUserAndPerson({
       userId,
@@ -9447,55 +9465,24 @@ app21.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app21;
 
 // app/lib/claude-agent/onboarding-prompt.ts
-var eligibleForInjection = /* @__PURE__ */ new Set();
-function markEligibleForInjection(managerSessionId) {
-  eligibleForInjection.add(managerSessionId);
-}
-function consumeInjectionSlot(managerSessionId) {
-  return eligibleForInjection.delete(managerSessionId);
-}
+var TAG19 = "[onboarding-prompt]";
 async function buildOnboardingPromptBlock(accountId) {
   const step = await loadOnboardingStep(accountId);
   const accountIdShort = accountId.slice(0, 8);
   if (step === null) {
-    const block2 = renderUnreachableBlock();
-    console.log(`[onboarding-inject] graph-unreachable accountId=${accountIdShort}`);
-    return { injected: true, block: block2, step: "graph-unreachable" };
-  }
-  if (step === 9) {
-    console.log(`[onboarding-inject] agent=admin accountId=${accountIdShort} step=9 injected=false`);
-    return { injected: false, reason: "complete" };
-  }
-  if (step === -1) {
-    const block2 = renderIncompleteBlock(-1);
-    console.log(`[onboarding-inject] agent=admin accountId=${accountIdShort} step=missing injected=true`);
-    return { injected: true, block: block2, step: "missing" };
-  }
-  const block = renderIncompleteBlock(step);
-  console.log(`[onboarding-inject] agent=admin accountId=${accountIdShort} step=${step} injected=true`);
-  return { injected: true, block, step };
-}
-function renderIncompleteBlock(currentStep) {
-  const stepAttr = currentStep < 0 ? "missing" : String(currentStep);
-  const resumeStep = currentStep < 0 ? 0 : currentStep + 1;
-  return [
-    `<onboarding-state currentStep="${stepAttr}" resumeStep="${resumeStep}">`,
-    `Onboarding is incomplete. Your first tool call this turn is \`skill-load\` with \`skillName=onboarding\`. Your second tool call is \`render-component\` for step ${resumeStep}, exactly as the skill body directs. Do not greet, do not summarise, do not write a preamble (\`let me check\`, \`let me figure out\`, \`let me list\` and similar phrasings are forbidden). The skill body is the only authority for what the operator sees next.`,
-    `</onboarding-state>`,
-    ""
-  ].join("\n");
-}
-function renderUnreachableBlock() {
-  return [
-    `<onboarding-state currentStep="unknown" graphUnreachable="true">`,
-    `Neo4j is unreachable, so onboarding state cannot be read. Do not assume onboarding is complete. Tell the operator the graph is unreachable, name the symptom in one line, and stop \u2014 do not improvise an onboarding flow without state, and do not silently skip the step the operator was on.`,
-    `</onboarding-state>`,
-    ""
-  ].join("\n");
+    console.log(`${TAG19} graph-unreachable accountId=${accountIdShort}`);
+  } else if (step === 9) {
+    console.log(`${TAG19} agent=admin accountId=${accountIdShort} step=9 complete`);
+  } else if (step === -1) {
+    console.log(`${TAG19} agent=admin accountId=${accountIdShort} step=missing`);
+  } else {
+    console.log(`${TAG19} agent=admin accountId=${accountIdShort} step=${step}`);
+  }
+  return { step };
 }
 
 // server/routes/admin/claude-sessions.ts
-var TAG19 = "[claude-session-manager:wrapper]";
+var TAG20 = "[claude-session-manager:wrapper]";
 function managerBase() {
   const port2 = Number(process.env.CLAUDE_SESSION_MANAGER_PORT ?? "19400");
   return `http://127.0.0.1:${port2}`;
@@ -9506,7 +9493,7 @@ app22.post("/", async (c) => {
   const cacheKey = c.get("cacheKey") ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(`${TAG19} reject reason=no-account-id`);
+    console.error(`${TAG20} reject reason=no-account-id`);
     return c.json({ error: "admin-account-not-resolved" }, 500);
   }
   let body = {};
@@ -9516,41 +9503,36 @@ app22.post("/", async (c) => {
   }
   const channel = typeof body.channel === "string" ? body.channel : "browser";
   const initialMessage = typeof body.initialMessage === "string" && body.initialMessage.trim() ? body.initialMessage : null;
+  let onboarding;
+  try {
+    const outcome = await buildOnboardingPromptBlock(senderId);
+    onboarding = { step: outcome.step };
+  } catch (err) {
+    console.error(`${TAG20} onboarding-resolve failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
   const upstream = await fetch(`${managerBase()}/spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
-    body: JSON.stringify({ senderId, role: "admin", channel })
+    body: JSON.stringify({ senderId, role: "admin", channel, accountId: senderId, onboarding })
   }).catch((err) => {
-    console.error(`${TAG19} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG20} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
   let spawnedSessionId = null;
-  if (upstream.ok) {
+  if (upstream.ok && initialMessage) {
     const buffered = await upstream.clone().json().catch(() => null);
     if (buffered && typeof buffered.sessionId === "string" && buffered.sessionId) {
       spawnedSessionId = buffered.sessionId;
-      markEligibleForInjection(spawnedSessionId);
     }
   }
   if (initialMessage && spawnedSessionId) {
-    const accountId = senderId;
-    let outboundBody = JSON.stringify({ text: initialMessage });
-    try {
-      const outcome = await buildOnboardingPromptBlock(accountId);
-      if (outcome.injected) {
-        outboundBody = JSON.stringify({ text: outcome.block + initialMessage });
-        consumeInjectionSlot(spawnedSessionId);
-      }
-    } catch (err) {
-      console.error(`${TAG19} initial-message-inject failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
     fetch(`${managerBase()}/${encodeURIComponent(spawnedSessionId)}/input`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: outboundBody
+      body: JSON.stringify({ text: initialMessage })
     }).catch((err) => {
-      console.error(`${TAG19} fetch-failed op=initial-input message=${err instanceof Error ? err.message : String(err)}`);
+      console.error(`${TAG20} fetch-failed op=initial-input message=${err instanceof Error ? err.message : String(err)}`);
     });
   }
   return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
@@ -9562,7 +9544,7 @@ app22.get("/", async (c) => {
   const upstream = await fetch(
     `${managerBase()}/list?senderId=${encodeURIComponent(senderId)}`
   ).catch((err) => {
-    console.error(`${TAG19} fetch-failed op=list message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG20} fetch-failed op=list message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -9592,7 +9574,7 @@ app22.post("/resume", async (c) => {
       claudeSessionId: body.claudeSessionId
     })
   }).catch((err) => {
-    console.error(`${TAG19} fetch-failed op=resume message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG20} fetch-failed op=resume message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -9605,7 +9587,7 @@ app22.delete("/:sessionId", async (c) => {
     `${managerBase()}/${encodeURIComponent(sessionId)}${purge}`,
     { method: "DELETE" }
   ).catch((err) => {
-    console.error(`${TAG19} fetch-failed op=delete message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG20} fetch-failed op=delete message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -9622,7 +9604,7 @@ app22.post("/:sessionId/archive", async (c) => {
       body
     }
   ).catch((err) => {
-    console.error(`${TAG19} fetch-failed op=archive message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG20} fetch-failed op=archive message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -9633,7 +9615,7 @@ app22.get("/:sessionId/meta", async (c) => {
   const upstream = await fetch(
     `${managerBase()}/${encodeURIComponent(sessionId)}/meta`
   ).catch((err) => {
-    console.error(`${TAG19} fetch-failed op=meta message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG20} fetch-failed op=meta message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -9650,7 +9632,7 @@ app22.patch("/:sessionId", async (c) => {
       body
     }
   ).catch((err) => {
-    console.error(`${TAG19} fetch-failed op=patch message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG20} fetch-failed op=patch message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -9659,36 +9641,15 @@ app22.patch("/:sessionId", async (c) => {
 app22.post("/:sessionId/input", async (c) => {
   const sessionId = c.req.param("sessionId");
   const rawBody = await c.req.text();
-  let outboundBody = rawBody;
-  const cacheKey = c.get("cacheKey") ?? "";
-  const accountId = getAccountIdForSession(cacheKey);
-  if (accountId && consumeInjectionSlot(sessionId)) {
-    let parsed = null;
-    try {
-      parsed = JSON.parse(rawBody);
-    } catch {
-      parsed = null;
-    }
-    if (parsed && typeof parsed.text === "string") {
-      try {
-        const outcome = await buildOnboardingPromptBlock(accountId);
-        if (outcome.injected) {
-          outboundBody = JSON.stringify({ ...parsed, text: outcome.block + parsed.text });
-        }
-      } catch (err) {
-        console.error(`${TAG19} onboarding-inject failed: ${err instanceof Error ? err.message : String(err)}`);
-      }
-    }
-  }
   const upstream = await fetch(
     `${managerBase()}/${encodeURIComponent(sessionId)}/input`,
     {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: outboundBody
+      body: rawBody
     }
   ).catch((err) => {
-    console.error(`${TAG19} fetch-failed op=input message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG20} fetch-failed op=input message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -9700,7 +9661,7 @@ app22.get("/:sessionId/log", async (c) => {
   const upstream = await fetch(
     `${managerBase()}/${encodeURIComponent(sessionId)}/log${follow}`
   ).catch((err) => {
-    console.error(`${TAG19} fetch-failed op=log message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG20} fetch-failed op=log message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -9816,13 +9777,13 @@ async function cdpNavigateNewTab(url, opts = {}) {
 // server/routes/admin/device-browser.ts
 var app25 = new Hono();
 app25.post("/navigate", async (c) => {
-  const TAG20 = "[device-url:click]";
+  const TAG21 = "[device-url:click]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG20} reject reason=body-not-json detail=${detail} browser=fallback navigateResult=error`);
+    console.error(`${TAG21} reject reason=body-not-json detail=${detail} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "Request body was not valid JSON" },
       400
@@ -9832,7 +9793,7 @@ app25.post("/navigate", async (c) => {
   const intent = typeof body.intent === "string" ? body.intent : "";
   const hostname2 = typeof body.hostname === "string" ? body.hostname : "";
   if (!url) {
-    console.error(`${TAG20} reject reason=missing-url intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`);
+    console.error(`${TAG21} reject reason=missing-url intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "url field is required" },
       400
@@ -9842,7 +9803,7 @@ app25.post("/navigate", async (c) => {
   try {
     parsed = new URL(url);
   } catch {
-    console.error(`${TAG20} reject reason=url-malformed intent=${JSON.stringify(intent)} url=${url} browser=fallback navigateResult=error`);
+    console.error(`${TAG21} reject reason=url-malformed intent=${JSON.stringify(intent)} url=${url} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "url is not a valid URL" },
       400
@@ -9850,7 +9811,7 @@ app25.post("/navigate", async (c) => {
   }
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
     console.error(
-      `${TAG20} reject reason=scheme-not-allowed scheme=${parsed.protocol} intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`
+      `${TAG21} reject reason=scheme-not-allowed scheme=${parsed.protocol} intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`
     );
     return c.json(
       {
@@ -9866,7 +9827,7 @@ app25.post("/navigate", async (c) => {
   const cdpOk = await ensureCdp(transport);
   if (!cdpOk) {
     console.error(
-      `${TAG20} intent=${JSON.stringify(intent)} browser=fallback navigateResult=cdp-unreachable hostname=${JSON.stringify(hostname2)}`
+      `${TAG21} intent=${JSON.stringify(intent)} browser=fallback navigateResult=cdp-unreachable hostname=${JSON.stringify(hostname2)}`
     );
     return c.json(
       {
@@ -9882,7 +9843,7 @@ app25.post("/navigate", async (c) => {
   const browser = outcome.result === "ok" ? "vnc" : "fallback";
   const detailStr = outcome.detail ? ` detail=${JSON.stringify(outcome.detail.length > 230 ? outcome.detail.slice(0, 227) + "..." : outcome.detail)}` : "";
   console.error(
-    `${TAG20} intent=${JSON.stringify(intent)} browser=${browser} navigateResult=${outcome.result} hostname=${JSON.stringify(hostname2)} targetId=${outcome.targetId ?? "none"}${detailStr}`
+    `${TAG21} intent=${JSON.stringify(intent)} browser=${browser} navigateResult=${outcome.result} hostname=${JSON.stringify(hostname2)} targetId=${outcome.targetId ?? "none"}${detailStr}`
   );
   if (outcome.result !== "ok") {
     return c.json(
@@ -9913,18 +9874,18 @@ var ALLOWED_EVENTS2 = /* @__PURE__ */ new Set([
 ]);
 var app26 = new Hono();
 app26.post("/", async (c) => {
-  const TAG20 = "[admin:events]";
+  const TAG21 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG20} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG21} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS2.has(event)) {
-    console.error(`${TAG20} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG21} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};