@rubytech/create-maxy-code 0.1.305 → 0.1.306

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.305",
+  "version": "0.1.306",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:1029bfc516fc6bed4265dcaffd6068d7ac72674d4e066c15c64e8c19df744b5e
+content-hash: sha256:9d8f9a898ee1cb0726e604e78f5fd1bf2c9660b76604d523ba1c4e3598092a98
 brand: maxy-code
 product-name: Maxy
 ---
@@ -41,6 +41,19 @@ Because Maxy runs locally, your data stays in your home. It never passes through
 
 **Public (visitors)** — anyone who reaches your public URL gets the public agent. It handles product enquiries, collects prospect details, and answers questions about your business. It cannot read or write your private data.
 
+## Install the Dashboard as an App
+
+The admin dashboard and the chat dashboard can be installed as standalone apps, so they open in their own window with their own icon instead of a browser tab. Installing changes nothing about how Maxy works — it is the same dashboard, just launched like any other app.
+
+**On a phone or tablet:**
+
+- **iPhone or iPad (Safari):** open the dashboard, tap the Share button, then **Add to Home Screen**. A Maxy icon appears on your home screen; tapping it opens the dashboard full-screen.
+- **Android (Chrome):** open the dashboard, then either tap the **Install** prompt Chrome offers, or open the browser menu and choose **Install app** / **Add to Home screen**.
+
+**On a computer (Chrome or Edge):** open the dashboard, then click the **Install** icon at the right of the address bar (or open the browser menu and choose **Install**). The dashboard opens in its own window from then on.
+
+The admin dashboard and the chat dashboard install as two separate apps, so you can keep both on your home screen or dock. Each one opens straight to its own screen.
+
 ## First Power-On (New Device)
 
 If your device has no WiFi configured and no ethernet cable connected, it creates a temporary WiFi network for setup:

package/payload/platform/plugins/docs/references/getting-started.md

@@ -14,6 +14,19 @@ Because {{productName}} runs locally, your data stays in your home. It never pas
 
 **Public (visitors)** — anyone who reaches your public URL gets the public agent. It handles product enquiries, collects prospect details, and answers questions about your business. It cannot read or write your private data.
 
+## Install the Dashboard as an App
+
+The admin dashboard and the chat dashboard can be installed as standalone apps, so they open in their own window with their own icon instead of a browser tab. Installing changes nothing about how {{productName}} works — it is the same dashboard, just launched like any other app.
+
+**On a phone or tablet:**
+
+- **iPhone or iPad (Safari):** open the dashboard, tap the Share button, then **Add to Home Screen**. A {{productName}} icon appears on your home screen; tapping it opens the dashboard full-screen.
+- **Android (Chrome):** open the dashboard, then either tap the **Install** prompt Chrome offers, or open the browser menu and choose **Install app** / **Add to Home screen**.
+
+**On a computer (Chrome or Edge):** open the dashboard, then click the **Install** icon at the right of the address bar (or open the browser menu and choose **Install**). The dashboard opens in its own window from then on.
+
+The admin dashboard and the chat dashboard install as two separate apps, so you can keep both on your home screen or dock. Each one opens straight to its own screen.
+
 ## First Power-On (New Device)
 
 If your device has no WiFi configured and no ethernet cable connected, it creates a temporary WiFi network for setup:

package/payload/server/public/sw.js

@@ -0,0 +1,24 @@
+// Minimal installable-PWA service worker for the admin, operator, and chat
+// shells. Its only job is to exist: browsers require a registered service
+// worker with a fetch handler before they offer "Install" / "Add to Home
+// Screen". It does NOT cache — no precaching, no offline app-shell, no runtime
+// cache. Offline support is a separate, out-of-scope capability.
+//
+// Served at the origin root (/sw.js) so its default scope is '/', covering
+// every surface. See app/lib/pwa.ts and .docs/pwa-installable-shells.md.
+
+self.addEventListener('install', () => {
+  // Activate this worker immediately instead of waiting for existing tabs to
+  // close, so a freshly-installed app controls its pages on first launch.
+  self.skipWaiting()
+})
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil(self.clients.claim())
+})
+
+self.addEventListener('fetch', () => {
+  // Network passthrough: no respondWith, so the browser handles every request
+  // exactly as it would without a service worker. Present only to satisfy the
+  // installability requirement.
+})

package/payload/server/server.js

@@ -1227,6 +1227,89 @@ import { resolve as resolve29, join as join22, basename as basename8 } from "pat
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
+// app/lib/pwa.ts
+var PWA_SURFACES = [
+  {
+    surface: "admin",
+    shellFile: "index.html",
+    manifestPath: "/manifest-admin.webmanifest",
+    nameSuffix: "",
+    startUrl: "/",
+    scope: "/",
+    id: "/?pwa=admin"
+  },
+  {
+    surface: "operator",
+    shellFile: "operator.html",
+    manifestPath: "/manifest-operator.webmanifest",
+    nameSuffix: " Operator",
+    startUrl: "/",
+    scope: "/",
+    id: "/?pwa=operator"
+  },
+  {
+    surface: "chat",
+    shellFile: "chat.html",
+    manifestPath: "/manifest-chat.webmanifest",
+    nameSuffix: " Chat",
+    startUrl: "/chat",
+    scope: "/chat",
+    id: "/chat?pwa=chat"
+  }
+];
+var MANIFEST_CONTENT_TYPE = "application/manifest+json";
+var SW_CONTENT_TYPE = "application/javascript";
+function pwaSurfaceForShell(file) {
+  return PWA_SURFACES.find((s) => s.shellFile === file);
+}
+function buildManifest(s, b) {
+  const name = `${b.productName}${s.nameSuffix}`;
+  return {
+    id: s.id,
+    name,
+    short_name: name,
+    start_url: s.startUrl,
+    scope: s.scope,
+    display: "standalone",
+    theme_color: b.themeColor,
+    background_color: b.backgroundColor,
+    icons: [{ src: b.iconPath, sizes: "any", purpose: "any" }]
+  };
+}
+function escAttr(s) {
+  return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function swRegisterScript(s) {
+  return [
+    "<script>",
+    "if('serviceWorker' in navigator){navigator.serviceWorker.register('/sw.js').catch(function(e){",
+    `try{fetch('/api/_client-error',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({kind:'event',source:'pwa',op:'sw-register-fail',surface:'${s.surface}',scope:'${s.scope}',err:String((e&&e.message)||e)}),keepalive:true}).catch(function(){});}catch(_){}`,
+    "});}",
+    "</script>"
+  ].join("\n");
+}
+function pwaHeadTags(s, b) {
+  return [
+    `<link rel="manifest" href="${escAttr(s.manifestPath)}">`,
+    `<link rel="apple-touch-icon" href="${escAttr(b.iconPath)}">`,
+    // Both the standards-based and the legacy Apple capable meta: Chromium
+    // deprecates `apple-mobile-web-app-capable` in favour of
+    // `mobile-web-app-capable`, while iOS Safari still reads the apple one.
+    '<meta name="mobile-web-app-capable" content="yes">',
+    '<meta name="apple-mobile-web-app-capable" content="yes">',
+    `<meta name="theme-color" content="${escAttr(b.themeColor)}">`,
+    swRegisterScript(s)
+  ].join("\n");
+}
+function pwaCensus(d) {
+  const manifestLinked = PWA_SURFACES.filter((s) => {
+    const html = d.shellHtml(s.shellFile);
+    return html != null && html.includes(`"${s.manifestPath}"`);
+  }).length;
+  const iconsPresent = d.iconExists() ? PWA_SURFACES.length : 0;
+  return { surfaces: PWA_SURFACES.length, manifestLinked, iconsPresent };
+}
+
 // server/webchat-descriptor.ts
 import { resolve, join as join2 } from "path";
 function webchatGatewayUrl() {
@@ -9153,7 +9236,7 @@ app9.post("/", async (c) => {
       const safe = typeof v === "string" ? truncate(v, 200) : typeof v === "number" || typeof v === "boolean" ? String(v) : JSON.stringify(v).slice(0, 200);
       return `${k}=${safe}`;
     }).join(" ");
-    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click"]);
+    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa"]);
     if (TAGGED_PREFIX_SOURCES.has(source)) {
       console.log(
         `[${source}] ts=${ts} ip=${ip} version=${version || "unknown"}${extra ? " " + extra : ""}`
@@ -11804,6 +11887,32 @@ function sortDirEntries(entries) {
     return aKey.localeCompare(bKey);
   });
 }
+var PROTECTED_DELETE_SEGMENTS = {
+  ".git": "git",
+  ".claude": "claude",
+  secrets: "secrets",
+  agents: "agents",
+  specialists: "specialists",
+  state: "state"
+};
+var PROTECTED_DELETE_BASENAMES = {
+  "account.json": "account-json",
+  "wa-channel-bindings.json": "channel-bindings",
+  "webchat-channel-bindings.json": "channel-bindings"
+};
+function isProtectedFromDeletion(relPath) {
+  const segments = relPath.split("/").filter(Boolean);
+  for (const seg of segments) {
+    if (Object.hasOwn(PROTECTED_DELETE_SEGMENTS, seg)) {
+      return { protected: true, rule: PROTECTED_DELETE_SEGMENTS[seg] };
+    }
+  }
+  const base = segments[segments.length - 1];
+  if (base && Object.hasOwn(PROTECTED_DELETE_BASENAMES, base)) {
+    return { protected: true, rule: PROTECTED_DELETE_BASENAMES[base] };
+  }
+  return { protected: false };
+}
 async function knowledgeDocOwnedByAccount(accountId, attachmentId) {
   if (!attachmentId) return false;
   const session = getSession();
@@ -12035,9 +12144,9 @@ app19.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   const base = basename6(absolute);
-  const segments = relPath.split("/").filter(Boolean);
-  if (base === "account.json" || segments.includes(".git")) {
-    console.error(`[data] file-delete blocked path="${relPath}" reason="protected"`);
+  const protection = isProtectedFromDeletion(relPath);
+  if (protection.protected) {
+    console.error(`[data] file-delete blocked path="${relPath}" reason="protected" rule="${protection.rule}"`);
     return c.json({ error: "Protected file \u2014 refusing to delete" }, 403);
   }
   try {
@@ -18188,10 +18297,11 @@ app49.post("/api/remote-auth/set-password", async (c) => {
 });
 app49.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
+var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
 app49.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
-  if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
+  if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/") || PWA_PUBLIC_PATHS.has(path2)) {
     await next();
     return;
   }
@@ -18338,6 +18448,17 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
   icon: brandIconPath,
   logoContainsName: !!BRAND.logoContainsName
 })}</script>`;
+var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
+var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
+var brandIconFsPath = resolve29(process.cwd(), "public", brandIconPath.replace(/^\//, ""));
+var brandIconExists = existsSync27(brandIconFsPath);
+var SW_SOURCE = (() => {
+  try {
+    return readFileSync26(resolve29(process.cwd(), "public", "sw.js"), "utf-8");
+  } catch {
+    return null;
+  }
+})();
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
@@ -18388,11 +18509,13 @@ function cachedHtml(file) {
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
-    const headInjection = file === "index.html" ? `${brandScript}
+    const pwaSurface = pwaSurfaceForShell(file);
+    const pwaHead = pwaSurface ? "\n" + pwaHeadTags(pwaSurface, { iconPath: brandIconPath, themeColor: brandThemeColor }) + "\n" : "";
+    const headInjection = (file === "index.html" ? `${brandScript}
 ${versionScript}
 ${clientErrorReporterScript}
 ` : `${brandScript}
-`;
+`) + pwaHead;
     html = html.replace("</head>", `${headInjection}</head>`);
     htmlCache.set(file, html);
   }
@@ -18534,6 +18657,30 @@ app49.post("/api/vnc/client-event", async (c) => {
 app49.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
+for (const pwa of PWA_SURFACES) {
+  app49.get(pwa.manifestPath, (c) => {
+    const manifest = buildManifest(pwa, {
+      productName: BRAND.productName,
+      iconPath: brandIconPath,
+      themeColor: brandThemeColor,
+      backgroundColor: brandBackgroundColor
+    });
+    c.header("Content-Type", MANIFEST_CONTENT_TYPE);
+    console.log(
+      `[pwa] op=manifest surface=${pwa.surface} brand=${BRAND.productName} status=200 ct=${MANIFEST_CONTENT_TYPE} icon=${brandIconPath} iconExists=${brandIconExists}`
+    );
+    return c.body(JSON.stringify(manifest));
+  });
+}
+app49.get("/sw.js", (c) => {
+  if (SW_SOURCE == null) {
+    console.error("[pwa] op=sw status=500 reason=sw-source-missing");
+    return c.text("Service worker unavailable", 500);
+  }
+  c.header("Content-Type", SW_CONTENT_TYPE);
+  console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
+  return c.body(SW_SOURCE);
+});
 app49.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
@@ -18591,6 +18738,21 @@ var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app49.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
+{
+  const census = pwaCensus({
+    shellHtml: (file) => {
+      try {
+        return cachedHtml(file);
+      } catch {
+        return null;
+      }
+    },
+    iconExists: () => brandIconExists
+  });
+  console.log(
+    `[pwa-census] surfaces=${census.surfaces} manifest-linked=${census.manifestLinked} icons-present=${census.iconsPresent}`
+  );
+}
 startAuthHealthHeartbeat();
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });