@rubytech/create-maxy-code 0.1.459 → 0.1.461

package/payload/platform/scripts/voice-author-key-audit.sh

@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# ============================================================
+# voice-author-key-audit.sh
+#
+# Purpose
+# -------
+# Task 1701 — find voice-mirror keys that name no :AdminUser on their own
+# account. Two distinct findings, do not conflate them:
+#
+#   1. :VoiceProfile nodes whose userId matches no :AdminUser on the profile's
+#      accountId. Such a profile is unreachable by any seat that resolves
+#      identity properly: it is silent dead data that looks, in the graph, like
+#      a real operator profile.
+#   2. Content nodes carrying a voiceAuthor that matches no :AdminUser on the
+#      node's accountId. The corpus is attributed to an identity that does not
+#      exist, and personal distillation can never read it back.
+#
+# Finding (2) is the expected shape of the known Ecolec 'rob-mead' case: the
+# tag path was the one write path with no identity check before Task 1701.
+# Finding (1) should be empty on any install — both :VoiceProfile write paths
+# have anchored on (:AdminUser {accountId, userId}) since Task 676. A hit there
+# means something created an :AdminUser for an invented key, which is a
+# different defect from the one Task 1701 closes; report it, do not assume it.
+#
+# '__org__' is the reserved org key (Task 676). It legitimately names no
+# :AdminUser and anchors on :LocalBusiness, so it is excluded from both checks.
+#
+# READ-ONLY. This script never deletes and never re-keys. Findings sit on live
+# client accounts, so disposition is an operator decision, not an agent one.
+#
+# Usage
+# -----
+#   bash voice-author-key-audit.sh [--brand=NAME]
+#
+#   --brand=NAME   Brand name (e.g. "maxy-code", "sitedesk-code"). Auto-detected
+#                  when exactly one ~/.<brand>/.neo4j-password exists.
+#
+# Reads:
+#   ~/.<brand>/.neo4j-password   Neo4j password
+#   ~/.<brand>/.env              NEO4J_URI (override with the env var)
+#
+# Exit codes
+# ----------
+#   0  no unmatched keys
+#   1  unmatched keys found (details on stdout)
+#   2  usage, credential, or connection error
+# ============================================================
+set -euo pipefail
+
+BRAND=""
+for arg in "$@"; do
+  case "$arg" in
+    --brand=*) BRAND="${arg#*=}" ;;
+    -h|--help) sed -n '2,45p' "$0"; exit 0 ;;
+    *)
+      echo "[voice-author-key-audit] ERROR unknown argument: $arg" >&2
+      exit 2
+      ;;
+  esac
+done
+
+# Brand auto-detection mirrors dedupe-userprofile-ghosts.sh: exactly one
+# ~/.<brand>/.neo4j-password means the brand is unambiguous. Zero or several
+# means the operator must say which install to audit.
+if [ -z "$BRAND" ]; then
+  candidates=()
+  for pw in "$HOME"/.*/.neo4j-password; do
+    [ -f "$pw" ] && candidates+=("$pw")
+  done
+  if [ "${#candidates[@]}" -ne 1 ]; then
+    echo "[voice-author-key-audit] ERROR cannot auto-detect brand (${#candidates[@]} candidates); pass --brand=NAME" >&2
+    exit 2
+  fi
+  BRAND="$(basename "$(dirname "${candidates[0]}")")"
+  BRAND="${BRAND#.}"
+fi
+
+BRAND_DIR="$HOME/.$BRAND"
+PASSWORD_FILE="$BRAND_DIR/.neo4j-password"
+if [ ! -f "$PASSWORD_FILE" ]; then
+  echo "[voice-author-key-audit] ERROR no password file at $PASSWORD_FILE" >&2
+  exit 2
+fi
+NEO4J_PASSWORD="$(tr -d '\n' < "$PASSWORD_FILE")"
+
+if [ -z "${NEO4J_URI:-}" ] && [ -f "$BRAND_DIR/.env" ]; then
+  NEO4J_URI="$(grep -E '^NEO4J_URI=' "$BRAND_DIR/.env" | head -1 | cut -d= -f2- | tr -d '"' || true)"
+fi
+if [ -z "${NEO4J_URI:-}" ]; then
+  echo "[voice-author-key-audit] ERROR NEO4J_URI unset and not found in $BRAND_DIR/.env" >&2
+  exit 2
+fi
+
+if ! command -v cypher-shell >/dev/null 2>&1; then
+  echo "[voice-author-key-audit] ERROR cypher-shell not on PATH" >&2
+  exit 2
+fi
+
+run_cypher() {
+  if ! cypher-shell -a "$NEO4J_URI" -u "${NEO4J_USER:-neo4j}" -p "$NEO4J_PASSWORD" \
+      --format plain "$1"; then
+    echo "[voice-author-key-audit] ERROR cypher query failed against $NEO4J_URI" >&2
+    exit 2
+  fi
+}
+
+echo "[voice-author-key-audit] brand=$BRAND uri=$NEO4J_URI"
+
+# 1. :VoiceProfile keys naming no :AdminUser on the profile's own account.
+PROFILES="$(run_cypher "
+MATCH (p:VoiceProfile)
+WHERE p.userId <> '__org__'
+  AND NOT EXISTS {
+    MATCH (au:AdminUser {accountId: p.accountId, userId: p.userId})
+  }
+RETURN p.accountId AS accountId, p.userId AS userId, p.format AS format,
+       coalesce(p.scope, 'personal') AS scope
+ORDER BY accountId, userId, format;
+")"
+
+# 2. voiceAuthor stamps naming no :AdminUser on the node's own account,
+#    grouped by (account, key) with the node count so the blast radius of each
+#    invented key is visible.
+STAMPS="$(run_cypher "
+MATCH (n)
+WHERE n.voiceAuthor IS NOT NULL
+  AND n.voiceAuthor <> '__org__'
+  AND NOT EXISTS {
+    MATCH (au:AdminUser {accountId: n.accountId, userId: n.voiceAuthor})
+  }
+RETURN n.accountId AS accountId, n.voiceAuthor AS voiceAuthor, count(n) AS nodes
+ORDER BY accountId, voiceAuthor;
+")"
+
+# cypher-shell --format plain emits a header row; data rows are everything after.
+count_rows() {
+  printf '%s\n' "$1" | tail -n +2 | grep -c . || true
+}
+profile_rows="$(count_rows "$PROFILES")"
+stamp_rows="$(count_rows "$STAMPS")"
+
+echo "[voice-author-key-audit] --- :VoiceProfile keys naming no :AdminUser ---"
+if [ "$profile_rows" -eq 0 ]; then echo "(none)"; else printf '%s\n' "$PROFILES"; fi
+
+echo "[voice-author-key-audit] --- voiceAuthor stamps naming no :AdminUser ---"
+if [ "$stamp_rows" -eq 0 ]; then echo "(none)"; else printf '%s\n' "$STAMPS"; fi
+
+echo "[voice-author-key-audit] brand=$BRAND unmatched_profiles=$profile_rows unmatched_stamp_keys=$stamp_rows"
+
+if [ "$profile_rows" -gt 0 ] || [ "$stamp_rows" -gt 0 ]; then
+  echo "[voice-author-key-audit] FAIL unmatched keys found — disposition (delete or re-key) is an operator decision; this script changes nothing" >&2
+  exit 1
+fi
+
+echo "[voice-author-key-audit] OK no unmatched keys"

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAgB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAkCzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAGvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CAgBN;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA0+FpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAgB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAkCzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAGvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CAgBN;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA+gGpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -3306,7 +3306,9 @@ export function buildHttpApp(deps) {
         // non-allowlisted channel like whatsapp) prints an interactive prompt
         // ("Loading development channels … ❯ 1. I am using this for local
         // development … Enter to confirm") that a programmatic spawn cannot answer,
-        // hanging the boot until pid-bind-timeout. Detect it once and send Enter to
+        // hanging the boot until the bind wait elapses (a blocked child writes no
+        // pid file, so Task 1716 classifies it `outcome=failed`, and `blocker=` on
+        // op=bind-signal-absent names the screen). Detect it once and send Enter to
         // select option 1. The prompt is laid out with cursor-position escapes and
         // no literal spaces, so match on the ANSI/space-stripped letter stream.
         // Bounded startup keystroke only — inbound message submission stays a
@@ -3359,7 +3361,12 @@ export function buildHttpApp(deps) {
         // by `registerRcSpawnPty`) handles the tracker side — fd release +
         // tracker delete + the `kill … reason=process-exited` log.
         let pidFileSeen = false;
+        // Task 1716 — the second half of the bind verdict's discriminator. Set
+        // first, so a child that has already gone can never be read as still
+        // running by the decision below.
+        let ptyExited = false;
         pty.onExit((e) => {
+            ptyExited = true;
             const ranMs = Date.now() - start;
             if (!pidFileSeen) {
                 deps.logger(`[rc-spawn] op=early-exit unitToken=${unitToken} pid=${pty.pid} ranMs=${ranMs} exitCode=${e.exitCode} signal=${e.signal ?? 'none'}`);
@@ -3490,8 +3497,33 @@ export function buildHttpApp(deps) {
         // through the proxy unchanged so the client decides modal-vs-navigate
         // from one server-supplied value.
         const waitedMs = Date.now() - start;
-        const outcome = bridgeSessionId ? 'bound' : 'timeout';
-        const reason = outcome === 'bound' ? null : 'pid-bind-timeout';
+        // Task 1716 — the bind signal certifies that a remote-control BRIDGE
+        // exists, not that the session is usable. Device evidence 2026-07-17: a
+        // child can attach its channel, drain and serve a full turn while
+        // registering no bridge at all — no stdout banner, and a pid file carrying
+        // every field except `bridgeSessionId`. Both signals then correctly report
+        // "no bridge", so slug-absence alone cannot mean the spawn failed.
+        //
+        // The verdict is therefore derived from the child's real state at decision
+        // time, which is why a "failed" verdict cannot coexist with a healthy
+        // session by construction:
+        //   bound    — a slug arrived on either signal.
+        //   unbound  — no slug, but the child wrote its pid file and is still
+        //              running: usable, simply not navigable from claude.ai/code.
+        //   failed   — no slug and the child never became a running registered
+        //              session (it died, or is stuck on a blocking screen; the
+        //              `blocker=` field on op=bind-signal-absent names which).
+        const outcome = bridgeSessionId
+            ? 'bound'
+            : pidFileSeen && !ptyExited
+                ? 'unbound'
+                : 'failed';
+        // `reason` is the string the client renders in its error modal
+        // (Sidebar.tsx::resolveRcSpawnOutcome). Neither value names a pid bind:
+        // the wait has been on the stdout banner since Task 662, and the old
+        // `pid-bind-timeout` sent every reader to the wrong mechanism. Nor does
+        // `spawn-not-ready` claim an exit — a blocked-but-alive child never exits.
+        const reason = outcome === 'bound' ? null : outcome === 'unbound' ? 'bridge-unregistered' : 'spawn-not-ready';
         // Task 1406 — derive the child's first-turn auth verdict. A bound child
         // authenticated; an unbound child that printed `Not logged in` is the
         // file-healthy-but-child-unauthenticated signature this task closes. Emitted
@@ -3507,8 +3539,12 @@ export function buildHttpApp(deps) {
             // file produced a slug within the bound. This distinct marker names the
             // artifact the manager waited for and the CLI version that produced
             // neither, so a future CLI drift is read from one log line instead of
-            // re-derived by reproduction. `reason=pid-bind-timeout` (below) is kept
-            // unchanged so the client still renders the bind-timeout modal.
+            // re-derived by reproduction.
+            //
+            // Task 1716 — this line fires for BOTH non-bound outcomes, which are not
+            // the same event: `stdoutBytes` + `pidFileSeen` are what separate a dead
+            // child (near-silent, no pid file) from a healthy unbound one (chatty,
+            // pid file present, serving turns). Read them before concluding drift.
             //
             // Task 664 — scan the captured child stdout for the known blocking-screen
             // markers and name the matched one (`blocker=`). `bindBuf` holds the 8 KB