@rubytech/create-maxy-code 0.1.460 → 0.1.461

package/payload/server/server.js

@@ -6780,7 +6780,7 @@ ${result.result.text}` : result.result.text;
             spawnedAt: /* @__PURE__ */ new Date()
           });
           const replyP = deps.awaitReply(session_key, webchatTurnTimeoutMs());
-          await deps.handleInbound({
+          const { spawn: spawn4 } = await deps.handleInbound({
             role: "public",
             accountId: account.accountId,
             key: session_key,
@@ -6793,6 +6793,7 @@ ${result.result.text}` : result.result.text;
               name: publicTitle
             }
           });
+          if (spawn4) await spawn4;
           const reply = await replyP;
           if ("timeout" in reply) {
             controller.enqueue(
@@ -11881,7 +11882,7 @@ ${note}` : note;
         console.error(`[webchat:inbound] op=send-refused kind=${kind} reason=empty-text`);
         return c.json({ error: "text required" }, 400);
       }
-      console.log(`[webchat:inbound] op=send-accepted kind=${kind} files=${stored.length} bytes=${Buffer.byteLength(text, "utf8")}`);
+      console.log(`[webchat:inbound] op=send-parsed kind=${kind} files=${stored.length} bytes=${Buffer.byteLength(text, "utf8")}`);
     }
     let deliveredIntId = null;
     if (deliverySessionId !== void 0 && await managerActivity(deliverySessionId) === "busy") {
@@ -11893,11 +11894,8 @@ ${note}` : note;
       deliveredIntId = outcome.intId;
     }
     const adminUserId = requesterUserId ?? void 0;
-    if (deliverySessionId !== void 0) {
-      await deps.handleInbound({ role: "admin", accountId: deliveryAccountId, key: deliveryKey, text, sessionId: deliverySessionId, adminUserId });
-    } else {
-      await deps.handleInbound({ role: "admin", accountId: bootstrapAccountId, key: deliveryKey, text, adminUserId });
-    }
+    const inboundStartedAt = Date.now();
+    const inbound = deliverySessionId !== void 0 ? await deps.handleInbound({ role: "admin", accountId: deliveryAccountId, key: deliveryKey, text, sessionId: deliverySessionId, adminUserId }) : await deps.handleInbound({ role: "admin", accountId: bootstrapAccountId, key: deliveryKey, text, adminUserId });
     if (deliveredIntId !== null) {
       console.log(`[webchat-interrupt] op=delivered intId=${deliveredIntId} sessionId=${deliverySessionId.slice(0, 8)}`);
     }
@@ -11914,7 +11912,9 @@ ${note}` : note;
     }
     const keyDisplay2 = deliveryKey.startsWith("session:") ? deliveryKey.slice(0, "session:".length + 8) : WEBCHAT_ADMIN_KEY;
     const baseline = jsonlSizeBytes(locateSession(turnSessionId).projectDir, turnSessionId);
-    console.error(`[webchat:inbound] op=send-accepted key=${keyDisplay2} sendId=${sendId} baselineBytes=${baseline ?? "absent"}`);
+    console.error(
+      `[webchat:inbound] op=send-accepted key=${keyDisplay2} sendId=${sendId} baselineBytes=${baseline ?? "absent"} acceptMs=${Date.now() - inboundStartedAt} spawn=${inbound.spawn !== null ? "triggered" : "none"}`
+    );
     const turnTimer = setTimeout(() => {
       const now = jsonlSizeBytes(locateSession(turnSessionId).projectDir, turnSessionId);
       const grew = now !== null && (baseline === null || now > baseline);
@@ -24727,7 +24727,9 @@ var WebchatGateway = class _WebchatGateway {
       this.recovering = false;
     }
   }
-  /** Handle one inbound webchat message (browser POST → here). */
+  /** Handle one inbound webchat message (browser POST → here). Resolves when
+   *  the hub holds the message; the cold-start spawn is returned as a handle
+   *  (Task 1715 — see WebchatInboundResult). */
   async handleInbound(input) {
     const bytes = Buffer.byteLength(input.text, "utf8");
     const hadSubscriber = this.hub.hasSubscriber(input.key);
@@ -24761,38 +24763,56 @@ var WebchatGateway = class _WebchatGateway {
     }
     const existing = this.publicSessions.get(input.key);
     if (existing) existing.lastActivityAt = Date.now();
+    let spawn4 = null;
     if (!hadSubscriber && !this.spawning.has(input.key)) {
       this.spawning.add(input.key);
       console.error(`[webchat:inbound] op=spawn-trigger key=${input.key} role=${input.role}`);
-      try {
-        const spawned = await this.deps.ensureChannelSession({
+      spawn4 = this.runSpawn(input);
+      spawn4.catch(() => {
+      });
+    }
+    return { spawn: spawn4 };
+  }
+  /** Task 1715 — the cold-start spawn, run off the accept's path. Rejects on a
+   *  failed spawn so the public caller's SSE still errors; logs op=spawn-failed
+   *  first, because on the admin path the 200 has already been returned and this
+   *  line is the only attribution the failure gets. */
+  async runSpawn(input) {
+    const startedAt = Date.now();
+    try {
+      const spawned = await this.deps.ensureChannelSession({
+        accountId: input.accountId,
+        key: input.key,
+        role: input.role,
+        gatewayUrl: this.deps.gatewayUrl,
+        serverPath: this.deps.serverPath,
+        // Task 800 — only present on a session-targeted launch, so the
+        // default-path call shape stays byte-identical.
+        ...input.sessionId !== void 0 ? { sessionId: input.sessionId } : {},
+        // The authenticated admin's userId on an admin bootstrap inbound; the
+        // default-path call shape stays byte-identical when absent.
+        ...input.adminUserId !== void 0 ? { adminUserId: input.adminUserId } : {},
+        // Task 756 — public spawn params on a role:'public' inbound.
+        ...input.public !== void 0 ? { public: input.public } : {}
+      });
+      if (input.role === "public" && input.public && spawned && "sessionId" in spawned) {
+        this.publicSessions.set(input.key, {
+          sessionId: spawned.sessionId,
           accountId: input.accountId,
-          key: input.key,
-          role: input.role,
-          gatewayUrl: this.deps.gatewayUrl,
-          serverPath: this.deps.serverPath,
-          // Task 800 — only present on a session-targeted launch, so the
-          // default-path call shape stays byte-identical.
-          ...input.sessionId !== void 0 ? { sessionId: input.sessionId } : {},
-          // The authenticated admin's userId on an admin bootstrap inbound; the
-          // default-path call shape stays byte-identical when absent.
-          ...input.adminUserId !== void 0 ? { adminUserId: input.adminUserId } : {},
-          // Task 756 — public spawn params on a role:'public' inbound.
-          ...input.public !== void 0 ? { public: input.public } : {}
+          agentSlug: input.public.agentSlug,
+          sliceToken: input.public.sliceToken,
+          personId: input.public.personId,
+          lastActivityAt: Date.now()
         });
-        if (input.role === "public" && input.public && spawned && "sessionId" in spawned) {
-          this.publicSessions.set(input.key, {
-            sessionId: spawned.sessionId,
-            accountId: input.accountId,
-            agentSlug: input.public.agentSlug,
-            sliceToken: input.public.sliceToken,
-            personId: input.public.personId,
-            lastActivityAt: Date.now()
-          });
-        }
-      } finally {
-        this.spawning.delete(input.key);
       }
+    } catch (err) {
+      const reason = (err instanceof Error ? err.message : String(err)).replace(/\s+/g, " ");
+      console.error(
+        `[webchat:inbound] op=spawn-failed key=${keyDisplay(input.key)} role=${input.role} ms=${Date.now() - startedAt} reason=${reason}`
+      );
+      throw err;
+    } finally {
+      this.spawning.delete(input.key);
     }
   }
 };

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/passcode.ts

@@ -1,73 +0,0 @@
-// Passcode hashing for the data portal. PBKDF2-SHA256 via Web Crypto, which
-// exists identically in the Workers runtime and in Node's webcrypto, so these
-// functions are tested against real crypto rather than a fake.
-//
-// constantTimeEqual is hand-rolled deliberately: crypto.subtle.timingSafeEqual
-// is a Cloudflare extension with no Node equivalent, so depending on it would
-// make the comparison untestable here.
-
-export const PBKDF2_ITERATIONS = 600_000
-
-export function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean {
-  // Length is not secret; an early return on it leaks nothing a caller cannot
-  // already see. The byte loop below never short-circuits.
-  if (a.length !== b.length) return false
-  let diff = 0
-  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i]
-  return diff === 0
-}
-
-export function randomSaltHex(bytes: Uint8Array): string {
-  return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')
-}
-
-// Returns Uint8Array<ArrayBuffer>, not the bare Uint8Array: the bare form
-// widens to ArrayBufferLike, which Web Crypto will not accept as a BufferSource
-// because a SharedArrayBuffer could back it.
-function hexToBytes(hex: string): Uint8Array<ArrayBuffer> | null {
-  if (hex.length === 0 || hex.length % 2 !== 0 || !/^[0-9a-f]+$/i.test(hex)) return null
-  const out = new Uint8Array(hex.length / 2)
-  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16)
-  return out
-}
-
-export async function hashPasscode(
-  passcode: string,
-  saltHex: string,
-  iterations: number,
-): Promise<string> {
-  const salt = hexToBytes(saltHex)
-  if (!salt) throw new Error('salt must be hex')
-  const key = await crypto.subtle.importKey(
-    'raw',
-    new TextEncoder().encode(passcode),
-    'PBKDF2',
-    false,
-    ['deriveBits'],
-  )
-  const bits = await crypto.subtle.deriveBits(
-    { name: 'PBKDF2', salt, iterations, hash: 'SHA-256' },
-    key,
-    256,
-  )
-  return randomSaltHex(new Uint8Array(bits))
-}
-
-export async function verifyPasscode(
-  passcode: string,
-  saltHex: string,
-  expectedHashHex: string,
-  iterations: number,
-): Promise<boolean> {
-  const expected = hexToBytes(expectedHashHex)
-  if (!expected) return false
-  let actualHex: string
-  try {
-    actualHex = await hashPasscode(passcode, saltHex, iterations)
-  } catch {
-    return false
-  }
-  const actual = hexToBytes(actualHex)
-  if (!actual) return false
-  return constantTimeEqual(actual, expected)
-}