@rubytech/create-maxy-code 0.1.307 → 0.1.309

package/payload/platform/lib/models/dist/index.d.ts

@@ -11,4 +11,17 @@ export declare const MODEL_DISPLAY_NAMES: Record<string, string>;
 /** The dropdown label for a model id: friendly name when canonical, else the
  *  raw id (never misrepresents an off-map persisted lever). */
 export declare function modelDisplayName(id: string): string;
+/** The exact selectable model ids (no aliases). Server-side re-seat validation
+ *  (Task 876) uses this so a body-supplied model can never reach the spawn argv
+ *  unchecked — a removed model (e.g. claude-fable-5) or a bare alias ('opus')
+ *  is rejected before the fork. */
+export declare const SELECTABLE_MODELS: readonly string[];
+export declare function isSelectableModel(id: string): boolean;
+/** Strip Claude Code's `[1m]` context-extension suffix so a selectable id
+ *  (`claude-opus-4-8[1m]`) compares equal to the live API/JSONL `message.model`
+ *  (suffix stripped upstream → `claude-opus-4-8`). Ids without the suffix pass
+ *  through. The /chat picker uses this to decide whether a chosen model is a
+ *  real change from the running one — a raw `selected !== live` compare is
+ *  always true for `[1m]` models. */
+export declare function baseModelId(id: string): string;
 //# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/models/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,UAAU,wBAAwB,CAAC;AAChD,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAE9C,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIvD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;qEAEqE;AACrE,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAItD,CAAC;AAEF;+DAC+D;AAC/D,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,UAAU,wBAAwB,CAAC;AAChD,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAE9C,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIvD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;qEAEqE;AACrE,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAItD,CAAC;AAEF;+DAC+D;AAC/D,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;mCAGmC;AACnC,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAA4C,CAAC;AAC5F,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;qCAKqC;AACrC,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C"}

package/payload/platform/lib/models/dist/index.js

@@ -3,9 +3,11 @@
 // Templates, docs, and skills reference these values as strings;
 // all TypeScript consumers import from here.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MODEL_DISPLAY_NAMES = exports.MODEL_CONTEXT_WINDOW = exports.HAIKU_MODEL = exports.SONNET_MODEL = exports.OPUS_MODEL = void 0;
+exports.SELECTABLE_MODELS = exports.MODEL_DISPLAY_NAMES = exports.MODEL_CONTEXT_WINDOW = exports.HAIKU_MODEL = exports.SONNET_MODEL = exports.OPUS_MODEL = void 0;
 exports.contextWindow = contextWindow;
 exports.modelDisplayName = modelDisplayName;
+exports.isSelectableModel = isSelectableModel;
+exports.baseModelId = baseModelId;
 // Opus defaults to the 1M-context variant ([1m] is Claude Code's
 // context-extension suffix, valid in settings.json "model" and agent
 // frontmatter); Sonnet/Haiku stay on the standard 200k window.
@@ -34,4 +36,21 @@ exports.MODEL_DISPLAY_NAMES = {
 function modelDisplayName(id) {
     return exports.MODEL_DISPLAY_NAMES[id] ?? id;
 }
+/** The exact selectable model ids (no aliases). Server-side re-seat validation
+ *  (Task 876) uses this so a body-supplied model can never reach the spawn argv
+ *  unchecked — a removed model (e.g. claude-fable-5) or a bare alias ('opus')
+ *  is rejected before the fork. */
+exports.SELECTABLE_MODELS = [exports.OPUS_MODEL, exports.SONNET_MODEL, exports.HAIKU_MODEL];
+function isSelectableModel(id) {
+    return exports.SELECTABLE_MODELS.includes(id);
+}
+/** Strip Claude Code's `[1m]` context-extension suffix so a selectable id
+ *  (`claude-opus-4-8[1m]`) compares equal to the live API/JSONL `message.model`
+ *  (suffix stripped upstream → `claude-opus-4-8`). Ids without the suffix pass
+ *  through. The /chat picker uses this to decide whether a chosen model is a
+ *  real change from the running one — a raw `selected !== live` compare is
+ *  always true for `[1m]` models. */
+function baseModelId(id) {
+    return id.replace(/\[1m\]$/, "");
+}
 //# sourceMappingURL=index.js.map

package/payload/platform/lib/models/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,0DAA0D;AAC1D,iEAAiE;AACjE,6CAA6C;;;AAgB7C,sCAEC;AAaD,4CAEC;AA/BD,iEAAiE;AACjE,qEAAqE;AACrE,+DAA+D;AAClD,QAAA,UAAU,GAAG,qBAAqB,CAAC;AACnC,QAAA,YAAY,GAAG,mBAAmB,CAAC;AACnC,QAAA,WAAW,GAAG,kBAAkB,CAAC;AAEjC,QAAA,oBAAoB,GAA2B;IAC1D,CAAC,kBAAU,CAAC,EAAE,SAAS;IACvB,CAAC,oBAAY,CAAC,EAAE,OAAO;IACvB,CAAC,mBAAW,CAAC,EAAE,OAAO;CACvB,CAAC;AAEF,wEAAwE;AACxE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,4BAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC;AAED;;qEAEqE;AACxD,QAAA,mBAAmB,GAA2B;IACzD,CAAC,kBAAU,CAAC,EAAE,uBAAuB;IACrC,CAAC,oBAAY,CAAC,EAAE,YAAY;IAC5B,CAAC,mBAAW,CAAC,EAAE,WAAW;CAC3B,CAAC;AAEF;+DAC+D;AAC/D,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,2BAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,0DAA0D;AAC1D,iEAAiE;AACjE,6CAA6C;;;AAgB7C,sCAEC;AAaD,4CAEC;AAOD,8CAEC;AAQD,kCAEC;AAlDD,iEAAiE;AACjE,qEAAqE;AACrE,+DAA+D;AAClD,QAAA,UAAU,GAAG,qBAAqB,CAAC;AACnC,QAAA,YAAY,GAAG,mBAAmB,CAAC;AACnC,QAAA,WAAW,GAAG,kBAAkB,CAAC;AAEjC,QAAA,oBAAoB,GAA2B;IAC1D,CAAC,kBAAU,CAAC,EAAE,SAAS;IACvB,CAAC,oBAAY,CAAC,EAAE,OAAO;IACvB,CAAC,mBAAW,CAAC,EAAE,OAAO;CACvB,CAAC;AAEF,wEAAwE;AACxE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,4BAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC;AAED;;qEAEqE;AACxD,QAAA,mBAAmB,GAA2B;IACzD,CAAC,kBAAU,CAAC,EAAE,uBAAuB;IACrC,CAAC,oBAAY,CAAC,EAAE,YAAY;IAC5B,CAAC,mBAAW,CAAC,EAAE,WAAW;CAC3B,CAAC;AAEF;+DAC+D;AAC/D,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,2BAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;mCAGmC;AACtB,QAAA,iBAAiB,GAAsB,CAAC,kBAAU,EAAE,oBAAY,EAAE,mBAAW,CAAC,CAAC;AAC5F,SAAgB,iBAAiB,CAAC,EAAU;IAC1C,OAAO,yBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;;;qCAKqC;AACrC,SAAgB,WAAW,CAAC,EAAU;IACpC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/payload/platform/lib/models/src/index.ts

@@ -34,3 +34,22 @@ export const MODEL_DISPLAY_NAMES: Record<string, string> = {
 export function modelDisplayName(id: string): string {
   return MODEL_DISPLAY_NAMES[id] ?? id;
 }
+
+/** The exact selectable model ids (no aliases). Server-side re-seat validation
+ *  (Task 876) uses this so a body-supplied model can never reach the spawn argv
+ *  unchecked — a removed model (e.g. claude-fable-5) or a bare alias ('opus')
+ *  is rejected before the fork. */
+export const SELECTABLE_MODELS: readonly string[] = [OPUS_MODEL, SONNET_MODEL, HAIKU_MODEL];
+export function isSelectableModel(id: string): boolean {
+  return SELECTABLE_MODELS.includes(id);
+}
+
+/** Strip Claude Code's `[1m]` context-extension suffix so a selectable id
+ *  (`claude-opus-4-8[1m]`) compares equal to the live API/JSONL `message.model`
+ *  (suffix stripped upstream → `claude-opus-4-8`). Ids without the suffix pass
+ *  through. The /chat picker uses this to decide whether a chosen model is a
+ *  real change from the running one — a raw `selected !== live` compare is
+ *  always true for `[1m]` models. */
+export function baseModelId(id: string): string {
+  return id.replace(/\[1m\]$/, "");
+}

package/payload/platform/package.json

@@ -6,8 +6,8 @@
     "services/*"
   ],
   "scripts": {
-    "build": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
-    "build:lib": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json",
+    "build": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
+    "build:lib": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json",
     "gen:canonical-tools": "node scripts/generate-canonical-tool-names.mjs",
     "build:memory": "tsc -p plugins/memory/mcp/tsconfig.json",
     "build:contacts": "tsc -p plugins/contacts/mcp/tsconfig.json",

package/payload/platform/plugins/admin/PLUGIN.md

@@ -78,6 +78,7 @@ tools:
 hidden:
   - remote-auth-status
   - remote-auth-set-password
+  - remote-auth-revoke-password
   - qr-generate
   - wifi
 always: true

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -9,6 +9,7 @@ import { resolve, join } from "node:path";
 import { execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { writeAdminEntry, removeAdminFromAccount } from "../../../../lib/admins-write/dist/index.js";
+import { setAccessPassword as setAccessPasswordHash, clearAccessPassword as clearAccessPasswordHash, accessPasswordCollides } from "../../../../lib/admin-access-password/dist/index.js";
 import { embed } from "../../../../lib/embed-client/dist/index.js";
 import { requirePortEnv } from "../../../../lib/require-port-env/dist/index.js";
 import { deviceUrlBlock } from "../../../../lib/device-url/dist/index.js";
@@ -181,7 +182,6 @@ async function currentEntitlement() {
             : undefined,
     });
 }
-const REMOTE_PASSWORD_FILE = resolve(CONFIG_DIR, ".remote-password");
 // Resolve account directory
 function getAccountDir() {
     if (!ACCOUNT_ID) {
@@ -2034,12 +2034,30 @@ eagerTool(server, "session-resume", "Resume a previous session. Loads the select
         return refuseNoAccount("session-resume");
     return { content: [{ type: "text", text: "resumed" }] };
 });
-server.tool("remote-auth-set-password", "Set the remote access password. Hashes with scrypt and writes to the platform's brand-specific config directory with mode 0600. " +
-    "Validates strength (8+ chars, digit, special character, no spaces anywhere). " +
-    "Protects the admin interface when exposed over the tunnel — has no effect on the public endpoint or the tunnel itself. " +
-    "Set before configuring the Cloudflare tunnel — the post-restart `curl -I https://<admin-hostname>` verification fails if remote-auth is not configured.", { password: z.string() }, async ({ password }) => {
+server.tool("remote-auth-set-password", "Set an admin's remote access password — the outer password the tunnel asks for before the PIN screen. " +
+    "Each admin has their own; setting one does not affect any other admin's password. " +
+    "Defaults to the calling admin; pass userId (from admin-list) to set another admin's. " +
+    "Hashes with scrypt at mode 0600. Validates strength (8+ chars, digit, special character, no spaces anywhere). " +
+    "Protects the admin interface when exposed over the tunnel — has no effect on the public endpoint or the tunnel itself.", {
+    password: z.string(),
+    userId: z.string().optional().describe("The admin to set the password for. Defaults to the calling admin. Use admin-list to find userIds."),
+}, async ({ password, userId }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("remote-auth-set-password");
+    const targetUserId = userId ?? process.env.USER_ID;
+    if (!targetUserId) {
+        return { content: [{ type: "text", text: "No target admin: pass userId, or run as an identified admin." }], isError: true };
+    }
+    let users;
+    try {
+        users = readUsersJson();
+    }
+    catch (err) {
+        return { content: [{ type: "text", text: `${err instanceof Error ? err.message : String(err)}` }], isError: true };
+    }
+    if (!users.some((u) => u.userId === targetUserId)) {
+        return { content: [{ type: "text", text: `No admin with userId ${targetUserId} on this device.` }], isError: true };
+    }
     // Validate strength — same rules as the web server's validatePasswordStrength
     const checks = [
         { label: "at least 8 characters", met: password.length >= 8 },
@@ -2054,21 +2072,13 @@ server.tool("remote-auth-set-password", "Set the remote access password. Hashes
             isError: true,
         };
     }
+    if (await accessPasswordCollides(password, USERS_FILE, targetUserId)) {
+        return { content: [{ type: "text", text: `That password is already in use by another admin. Choose a different one.` }], isError: true };
+    }
     try {
-        const { scrypt, randomBytes } = await import("node:crypto");
-        const salt = randomBytes(32);
-        const hash = await new Promise((res, rej) => {
-            scrypt(password, salt, 64, { N: 16384, r: 8, p: 1 }, (err, key) => {
-                if (err)
-                    rej(err);
-                else
-                    res(key);
-            });
-        });
-        const stored = `${salt.toString("hex")}:${hash.toString("hex")}`;
-        const pwPath = REMOTE_PASSWORD_FILE;
-        await writeFile(pwPath, stored, { mode: 0o600 });
-        return { content: [{ type: "text", text: "Remote access password set." }] };
+        await setAccessPasswordHash(targetUserId, password, USERS_FILE);
+        console.error(`[admin] remote-access-password set userId=${targetUserId.slice(0, 8)}`);
+        return { content: [{ type: "text", text: `Remote access password set for userId ${targetUserId}.` }] };
     }
     catch (err) {
         return {
@@ -2077,6 +2087,40 @@ server.tool("remote-auth-set-password", "Set the remote access password. Hashes
         };
     }
 });
+server.tool("remote-auth-revoke-password", "Revoke an admin's remote access password so they can no longer obtain a NEW remote session (an already-open session lapses within 24h). " +
+    "Does not affect any other admin's password and does not touch their PIN. Pass userId (from admin-list).", { userId: z.string().describe("The admin whose remote access password to revoke. Use admin-list to find userIds.") }, async ({ userId }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("remote-auth-revoke-password");
+    let users;
+    try {
+        users = readUsersJson();
+    }
+    catch (err) {
+        return { content: [{ type: "text", text: `${err instanceof Error ? err.message : String(err)}` }], isError: true };
+    }
+    const target = users.find((u) => u.userId === userId);
+    if (!target) {
+        return { content: [{ type: "text", text: `No admin with userId ${userId} on this device.` }], isError: true };
+    }
+    if (!target.accessHash) {
+        return { content: [{ type: "text", text: `userId ${userId} has no remote access password to revoke.` }] };
+    }
+    const withHash = users.filter((u) => typeof u.accessHash === "string" && u.accessHash.length > 0);
+    if (withHash.length <= 1) {
+        return { content: [{ type: "text", text: "Refusing to revoke the last remaining remote access password — the install would have no remote access. Set another admin's password first." }], isError: true };
+    }
+    try {
+        clearAccessPasswordHash(userId, USERS_FILE);
+        console.error(`[admin] remote-access-password revoked userId=${userId.slice(0, 8)}`);
+        return { content: [{ type: "text", text: `Remote access password revoked for userId ${userId}.` }] };
+    }
+    catch (err) {
+        return {
+            content: [{ type: "text", text: `Failed to revoke: ${err instanceof Error ? err.message : String(err)}` }],
+            isError: true,
+        };
+    }
+});
 // ===================================================================
 // Utility tools
 // ===================================================================