@rubytech/create-maxy-code 0.1.363 → 0.1.365

package/payload/server/public/graph.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Graph — Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/graph-BIAaLslC.js"></script>
+  <script type="module" crossorigin src="/assets/graph-DfUM66RH.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-CAM3fms7.js">
   <link rel="modulepreload" crossorigin href="/assets/OperatorConversations-BwnO3IUP.js">
   <link rel="modulepreload" crossorigin href="/assets/graph-labels-CXt55mIP.js">

package/payload/server/server.js

@@ -6622,6 +6622,43 @@ app2.post("/send-document", async (c) => {
     return c.json({ error: String(err) }, 500);
   }
 });
+app2.post("/send-admin", async (c) => {
+  try {
+    const body = await c.req.json().catch(() => ({}));
+    const { phone, text } = body;
+    if (!phone || typeof phone !== "string") {
+      return c.json({ error: 'Missing required field "phone" (E.164 format, e.g. +441234567890).' }, 400);
+    }
+    if (!text || typeof text !== "string") {
+      return c.json({ error: 'Missing required field "text".' }, 400);
+    }
+    const account = resolveAccount();
+    if (!account) {
+      return c.json({ error: "No account configured." }, 500);
+    }
+    const adminPhones = readAdminPhones(account.accountDir);
+    if (!isAdminPhone(phone, adminPhones)) {
+      console.error(`[whatsapp:outbound] op=send-refused reason=not-admin-phone to=${phone}`);
+      return c.json(
+        { error: `Refused: ${phone} is not on the admin-phone list. Only a number registered with whatsapp-config add-admin-phone can receive an agent-initiated send.` },
+        403
+      );
+    }
+    const accountId = validateAccountId(body.accountId);
+    const sock = getSocket(accountId);
+    if (!sock) {
+      return c.json({ error: `WhatsApp account "${accountId}" is not connected.` }, 503);
+    }
+    const result = await sendTextMessage(sock, normalizeE164(phone), text, { accountId });
+    if (!result.success) {
+      return c.json({ error: result.error ?? "send failed" }, 500);
+    }
+    return c.json({ success: true, messageId: result.messageId });
+  } catch (err) {
+    console.error(`${TAG20} send-admin error: ${String(err)}`);
+    return c.json({ error: String(err) }, 500);
+  }
+});
 app2.get("/activity", (c) => {
   try {
     const accountId = c.req.query("accountId") ?? void 0;
@@ -10019,11 +10056,16 @@ var MAX_FILE_LEN = 300;
 var RATE_LIMIT_PER_MIN = 20;
 var WINDOW_MS = 60 * 1e3;
 var rateHits = /* @__PURE__ */ new Map();
-function checkRateLimit2(ip) {
+var ERROR_KINDS = /* @__PURE__ */ new Set(["uncaught", "unhandled-rejection", "subresource"]);
+function rateKey(ip, cls) {
+  return cls === "error" ? ip : `${ip} telemetry`;
+}
+function checkRateLimit2(ip, cls) {
+  const key = rateKey(ip, cls);
   const now = Date.now();
-  const rec = rateHits.get(ip);
+  const rec = rateHits.get(key);
   if (!rec || now - rec.windowStart >= WINDOW_MS) {
-    rateHits.set(ip, { windowStart: now, count: 1, blocked: 0, lastLoggedBlocked: 0 });
+    rateHits.set(key, { windowStart: now, count: 1, blocked: 0, lastLoggedBlocked: 0 });
     return { allow: true, blocked: 0, shouldLog: false };
   }
   rec.count++;
@@ -10059,6 +10101,14 @@ function rotateIfNeeded() {
     console.error(`[client-error] log rotation failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+function telemetryFloodGuard(c, ip) {
+  const rate = checkRateLimit2(ip, "telemetry");
+  if (rate.allow) return null;
+  if (rate.shouldLog) {
+    console.error(`[client-error-rate-limit] ip=${ip} class=telemetry blocked=${rate.blocked}`);
+  }
+  return c.text("Too many requests", 429);
+}
 var app10 = new Hono();
 app10.post("/", async (c) => {
   const client = resolveClientIp(
@@ -10066,31 +10116,24 @@ app10.post("/", async (c) => {
     c.req.header("x-forwarded-for")
   );
   const ip = client.ip || "unknown";
-  const rate = checkRateLimit2(ip);
-  if (!rate.allow) {
-    if (rate.shouldLog) {
-      console.error(`[client-error-rate-limit] ip=${ip} blocked=${rate.blocked}`);
-    }
-    return c.text("Too many requests", 429);
-  }
   let raw;
   try {
     raw = await c.req.text();
   } catch {
-    return c.text("Bad request", 400);
+    return telemetryFloodGuard(c, ip) ?? c.text("Bad request", 400);
   }
   if (Buffer.byteLength(raw) > MAX_BODY_SIZE) {
-    return c.text("Payload too large", 413);
+    return telemetryFloodGuard(c, ip) ?? c.text("Payload too large", 413);
   }
   let body;
   try {
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      return c.text("Invalid body", 400);
+      return telemetryFloodGuard(c, ip) ?? c.text("Invalid body", 400);
     }
     body = parsed;
   } catch {
-    return c.text("Invalid JSON", 400);
+    return telemetryFloodGuard(c, ip) ?? c.text("Invalid JSON", 400);
   }
   const kindRaw = typeof body.kind === "string" ? body.kind : "unknown";
   const allowedKinds = /* @__PURE__ */ new Set([
@@ -10105,6 +10148,14 @@ app10.post("/", async (c) => {
     "event"
   ]);
   const kind = allowedKinds.has(kindRaw) ? kindRaw : "unknown";
+  const cls = ERROR_KINDS.has(kind) ? "error" : "telemetry";
+  const rate = checkRateLimit2(ip, cls);
+  if (!rate.allow) {
+    if (rate.shouldLog) {
+      console.error(`[client-error-rate-limit] ip=${ip} class=${cls} blocked=${rate.blocked}`);
+    }
+    return c.text("Too many requests", 429);
+  }
   const msg = truncate(body.msg, MAX_MSG_LEN);
   const url = truncate(body.url, MAX_URL_LEN);
   const ua = truncate(body.ua, MAX_UA_LEN);
@@ -10122,7 +10173,7 @@ app10.post("/", async (c) => {
       const safe = typeof v === "string" ? truncate(v, 200) : typeof v === "number" || typeof v === "boolean" ? String(v) : JSON.stringify(v).slice(0, 200);
       return `${k}=${safe}`;
     }).join(" ");
-    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa"]);
+    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-freeze"]);
     if (TAGGED_PREFIX_SOURCES.has(source)) {
       console.log(
         `[${source}] ts=${ts} ip=${ip} version=${version || "unknown"}${extra ? " " + extra : ""}`