@rubytech/create-maxy-code 0.1.443 → 0.1.444

package/payload/server/public/chat.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Chat — Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/chat-DhD-NES_.js"></script>
+  <script type="module" crossorigin src="/assets/chat-Dq-X-ia8.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-Ck5AOu5v.js">
   <link rel="modulepreload" crossorigin href="/assets/useSubAccountSwitcher-s6WlRn52.js">
   <link rel="modulepreload" crossorigin href="/assets/file-download-Px4s0Bhp.js">
@@ -17,7 +17,7 @@
   <link rel="modulepreload" crossorigin href="/assets/useCopyFeedback-ByGUMN94.js">
   <link rel="modulepreload" crossorigin href="/assets/chevron-left-B3xSeEDR.js">
   <link rel="modulepreload" crossorigin href="/assets/rotate-ccw-C7BqkMec.js">
-  <link rel="modulepreload" crossorigin href="/assets/page-6fCnIb45.js">
+  <link rel="modulepreload" crossorigin href="/assets/page-BRfxFXyi.js">
   <link rel="stylesheet" crossorigin href="/assets/useSubAccountSwitcher-1izQvPiD.css">
   <link rel="stylesheet" href="/brand-defaults.css">
 </head>

package/payload/server/public/operator.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Operator — Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/operator-zcIfeB14.js"></script>
+  <script type="module" crossorigin src="/assets/operator-88m0DMl2.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-Ck5AOu5v.js">
   <link rel="modulepreload" crossorigin href="/assets/useSubAccountSwitcher-s6WlRn52.js">
   <link rel="modulepreload" crossorigin href="/assets/file-download-Px4s0Bhp.js">
@@ -19,7 +19,7 @@
   <link rel="modulepreload" crossorigin href="/assets/useCopyFeedback-ByGUMN94.js">
   <link rel="modulepreload" crossorigin href="/assets/chevron-left-B3xSeEDR.js">
   <link rel="modulepreload" crossorigin href="/assets/rotate-ccw-C7BqkMec.js">
-  <link rel="modulepreload" crossorigin href="/assets/page-6fCnIb45.js">
+  <link rel="modulepreload" crossorigin href="/assets/page-BRfxFXyi.js">
   <link rel="stylesheet" crossorigin href="/assets/useSubAccountSwitcher-1izQvPiD.css">
   <link rel="stylesheet" crossorigin href="/assets/AdminLoginScreens-CWMpccrR.css">
   <link rel="stylesheet" href="/brand-defaults.css">

package/payload/server/public/public.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Maxy</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/public-C0ehZCdE.js"></script>
+  <script type="module" crossorigin src="/assets/public-BX2MjsFY.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-Ck5AOu5v.js">
   <link rel="modulepreload" crossorigin href="/assets/useSubAccountSwitcher-s6WlRn52.js">
   <link rel="modulepreload" crossorigin href="/assets/file-download-Px4s0Bhp.js">
@@ -17,7 +17,7 @@
   <link rel="modulepreload" crossorigin href="/assets/useCopyFeedback-ByGUMN94.js">
   <link rel="modulepreload" crossorigin href="/assets/chevron-left-B3xSeEDR.js">
   <link rel="modulepreload" crossorigin href="/assets/rotate-ccw-C7BqkMec.js">
-  <link rel="modulepreload" crossorigin href="/assets/page-6fCnIb45.js">
+  <link rel="modulepreload" crossorigin href="/assets/page-BRfxFXyi.js">
   <link rel="stylesheet" crossorigin href="/assets/useSubAccountSwitcher-1izQvPiD.css">
   <link rel="stylesheet" href="/brand-defaults.css">
 </head>

package/payload/server/server.js

@@ -4179,8 +4179,9 @@ function resolveStoredAttachment(accountId, attachmentId) {
     return null;
   }
   if (!meta || typeof meta !== "object") return null;
-  const { filename, mimeType } = meta;
+  const { filename, mimeType, sizeBytes } = meta;
   if (typeof filename !== "string" || typeof mimeType !== "string") return null;
+  const resolvedSizeBytes = typeof sizeBytes === "number" ? sizeBytes : void 0;
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -4191,7 +4192,7 @@ function resolveStoredAttachment(accountId, attachmentId) {
   if (!dataFile) return null;
   const readableSibling = `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`;
   const readableTextPath = entries.some((e) => e.isFile() && e.name === readableSibling) ? resolve6(dir, readableSibling) : void 0;
-  return { attachmentId, filename, mimeType, path: resolve6(dir, dataFile.name), readableTextPath };
+  return { attachmentId, filename, mimeType, sizeBytes: resolvedSizeBytes, path: resolve6(dir, dataFile.name), readableTextPath };
 }
 async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer, explicitId) {
   const attachmentId = explicitId ?? randomUUID3();
@@ -7842,17 +7843,30 @@ function projectionFor(requestedAccountId) {
     houseAccountManagers
   });
 }
-function callerScopeDenial(c, requestedAccountId) {
+function evaluateCallerScope(c, requestedAccountId) {
   const callerAccountId = c.req.header("x-maxy-caller-account")?.trim() || null;
   const houseAdminScope = c.req.header("x-maxy-house-admin-scope")?.trim() || null;
   const decision = authorizeRecallRead({ requestedAccountId, callerAccountId, houseAdminScope });
+  return { decision, callerAccountId, houseAdminScope };
+}
+function callerScopeDenial(c, requestedAccountId) {
+  const { decision, callerAccountId, houseAdminScope } = evaluateCallerScope(c, requestedAccountId);
   if (decision.authorized) return null;
   console.error(`[whatsapp-read-tool] op=authz-deny requested=${requestedAccountId} caller=${callerAccountId ?? "none"} houseAdmin=${houseAdminScope ? "y" : "n"}`);
   return c.json({ error: decision.reason }, 403);
 }
+function houseSocketScopeDenial(c, op) {
+  const houseAccountId = resolveAccount()?.accountId ?? "";
+  const { decision, callerAccountId, houseAdminScope } = evaluateCallerScope(c, houseAccountId);
+  if (decision.authorized) return null;
+  console.error(`${TAG21} op=authz-deny route=${op} caller=${callerAccountId ?? "none"} houseAdmin=${houseAdminScope ? "y" : "n"}`);
+  return c.json({ ok: false, error: "Not authorized. The WhatsApp connection and its settings are house-scoped; this session may only act on its own account." }, 403);
+}
 var app2 = new Hono();
 app2.get("/status", (c) => {
   try {
+    const denial = houseSocketScopeDenial(c, "status");
+    if (denial) return denial;
     const live = getStatus();
     const liveIds = new Set(live.map((a) => a.accountId));
     const activeLoginIds = new Set(listActiveLoginAccountIds());
@@ -7880,6 +7894,8 @@ app2.get("/status", (c) => {
 });
 app2.post("/login/start", async (c) => {
   try {
+    const denial = houseSocketScopeDenial(c, "login/start");
+    if (denial) return denial;
     const body = await c.req.json().catch(() => ({}));
     const accountId = validateAccountId(body.accountId);
     const force = body.force ?? false;
@@ -7899,6 +7915,8 @@ app2.post("/login/start", async (c) => {
 });
 app2.post("/login/wait", async (c) => {
   try {
+    const denial = houseSocketScopeDenial(c, "login/wait");
+    if (denial) return denial;
     const body = await c.req.json().catch(() => ({}));
     const accountId = validateAccountId(body.accountId);
     const timeoutMs = body.timeoutMs ?? 6e4;
@@ -7917,6 +7935,8 @@ app2.post("/login/wait", async (c) => {
 });
 app2.post("/disconnect", async (c) => {
   try {
+    const denial = houseSocketScopeDenial(c, "disconnect");
+    if (denial) return denial;
     const body = await c.req.json().catch(() => ({}));
     const accountId = validateAccountId(body.accountId);
     await stopConnection(accountId);
@@ -7928,6 +7948,8 @@ app2.post("/disconnect", async (c) => {
 });
 app2.post("/reconnect", async (c) => {
   try {
+    const denial = houseSocketScopeDenial(c, "reconnect");
+    if (denial) return denial;
     const body = await c.req.json().catch(() => ({}));
     const accountId = validateAccountId(body.accountId);
     await startConnection(accountId);
@@ -7944,6 +7966,8 @@ app2.post("/config", async (c) => {
     if (!action || typeof action !== "string") {
       return c.json({ ok: false, error: 'Missing required field "action".' }, 400);
     }
+    const denial = houseSocketScopeDenial(c, `config action=${action}`);
+    if (denial) return denial;
     const account = resolveAccount();
     if (!account) {
       return c.json({ ok: false, error: "No account configured." }, 500);
@@ -8983,6 +9007,16 @@ function asString(content) {
 function tsOf(row) {
   return typeof row.timestamp === "string" ? row.timestamp : null;
 }
+function hasWebchatReply(content) {
+  if (!Array.isArray(content)) return false;
+  for (const block of content) {
+    if (block && typeof block === "object") {
+      const b = block;
+      if (b.type === "tool_use" && b.name === WEBCHAT_REPLY_TOOL) return true;
+    }
+  }
+  return false;
+}
 function joinTextBlocks(content) {
   if (!Array.isArray(content)) return "";
   const parts = [];
@@ -9075,8 +9109,10 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
         out.push({ kind: "agent-error", code, raw, ts });
         continue;
       }
+      if (hasWebchatReply(msg?.content)) turnCtx.repliedThisTurn = true;
       const isEnd = msg?.stop_reason === "end_turn";
-      out.push(...assistantTurns(msg?.content, ts, isEnd && turnCtx.lastChannelSource === "webchat"));
+      const promoteFinal = isEnd && turnCtx.lastChannelSource === "webchat" && !turnCtx.repliedThisTurn;
+      out.push(...assistantTurns(msg?.content, ts, promoteFinal));
       continue;
     }
     if (row.type === "queue-operation" && row.operation === "enqueue") {
@@ -9084,6 +9120,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
       if (content !== null && CHANNEL_WRAPPER2.test(content)) {
         const u = unwrapChannel(content);
         turnCtx.lastChannelSource = u.source;
+        turnCtx.repliedThisTurn = false;
         if (!isScheduleSource(content)) {
           out.push(operatorInboundTurn(u, ts));
           queuedPendingSuppress.set(u.text, (queuedPendingSuppress.get(u.text) ?? 0) + 1);
@@ -9097,6 +9134,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
       if (isChannelQueued) {
         const u = unwrapChannel(att.prompt);
         turnCtx.lastChannelSource = u.source;
+        turnCtx.repliedThisTurn = false;
         if (!isScheduleSource(att.prompt)) {
           renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress);
         }
@@ -9126,6 +9164,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
     if (isChannel) {
       const u = unwrapChannel(text);
       turnCtx.lastChannelSource = u.source;
+      turnCtx.repliedThisTurn = false;
       if (!isScheduleSource(text)) {
         renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress);
       }
@@ -10873,6 +10912,7 @@ function createWebchatRoutes(deps) {
     let text;
     let target;
     let files = [];
+    let clearSignal = false;
     const contentType = c.req.header("content-type") ?? "";
     const isMultipart = contentType.startsWith("multipart/form-data");
     if (isMultipart) {
@@ -10893,6 +10933,7 @@ function createWebchatRoutes(deps) {
         }
         target = rawTarget;
       }
+      clearSignal = formData.get("clearSignal") === "true";
     } else {
       const body = await c.req.json().catch(() => null);
       const typed = body?.text;
@@ -10907,14 +10948,25 @@ function createWebchatRoutes(deps) {
         }
         target = rawTarget;
       }
+      clearSignal = body?.clearSignal === true;
     }
     let deliveryKey = WEBCHAT_ADMIN_KEY;
     let deliverySessionId;
     let deliveryAccountId = accountId;
     const explicitTarget = target !== void 0;
+    let sendIdFromResolve;
     if (target === void 0) {
       const latest = latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccountId, multiAccount);
-      if (latest !== null) target = latest;
+      let sendTargetMode = "bootstrap";
+      if (clearSignal) {
+        sendTargetMode = "spawn-new";
+      } else if (latest !== null) {
+        target = latest;
+        sendTargetMode = "resume-latest";
+      }
+      const sendId2 = ++sendSeq;
+      sendIdFromResolve = sendId2;
+      console.error(`[webchat:inbound] op=send-target-resolve seq=${sendId2} mode=${sendTargetMode} hadLatest=${latest !== null} clearSignal=${clearSignal}`);
     }
     if (explicitTarget && target !== void 0) {
       const t = readTargetOwner(target);
@@ -11029,7 +11081,7 @@ ${note}` : note;
     if (deliveredIntId !== null) {
       console.log(`[webchat-interrupt] op=delivered intId=${deliveredIntId} sessionId=${deliverySessionId.slice(0, 8)}`);
     }
-    const sendId = ++sendSeq;
+    const sendId = sendIdFromResolve ?? ++sendSeq;
     let turnSessionId = deliverySessionId;
     if (turnSessionId === void 0) {
       let canonAccount;
@@ -11199,7 +11251,7 @@ ${note}` : note;
       }
     }
     const indicators = await fetchComposerIndicators(sessionId);
-    return c.json({ sessionId, projectDir, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
+    return c.json({ sessionId, projectDir, source, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
   app62.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
@@ -23472,15 +23524,15 @@ function createWebchatChannelRoutes(deps) {
     const finalBytes = typeof body?.finalBytes === "number" && Number.isFinite(body.finalBytes) ? body.finalBytes : 0;
     const k = key.slice(0, 8);
     const sid = sessionId.slice(0, 8);
-    if (interactive && finalBytes > 0) {
-      console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} replied=${replied ? "yes" : "no"} delivered=fallback bytes=${finalBytes}`);
-      return c.json({ ok: true, delivered: "fallback" });
-    }
     if (replied) {
-      console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} delivered=reply`);
+      console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} replied=yes delivered=reply bytes=${finalBytes}`);
       return c.json({ ok: true, delivered: "reply" });
     }
-    console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} delivered=none`);
+    if (interactive && finalBytes > 0) {
+      console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} replied=no delivered=fallback bytes=${finalBytes}`);
+      return c.json({ ok: true, delivered: "fallback" });
+    }
+    console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
   return app62;