@rubytech/create-maxy-code 0.1.483 → 0.1.485

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.483",
+  "version": "0.1.485",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/package-lock.json

@@ -577,6 +577,10 @@
       "resolved": "plugins/filesystem/mcp",
       "link": true
     },
+    "node_modules/@maxy/google": {
+      "resolved": "plugins/google/mcp",
+      "link": true
+    },
     "node_modules/@maxy/graph-viewer": {
       "resolved": "plugins/graph-viewer/mcp",
       "link": true
@@ -585,6 +589,10 @@
       "resolved": "plugins/joblogic/mcp",
       "link": true
     },
+    "node_modules/@maxy/ledger": {
+      "resolved": "plugins/ledger/mcp",
+      "link": true
+    },
     "node_modules/@maxy/memory": {
       "resolved": "plugins/memory/mcp",
       "link": true
@@ -609,6 +617,10 @@
       "resolved": "plugins/scheduling/mcp",
       "link": true
     },
+    "node_modules/@maxy/storage-broker": {
+      "resolved": "plugins/storage-broker/mcp",
+      "link": true
+    },
     "node_modules/@maxy/telegram-channel": {
       "resolved": "services/telegram-channel",
       "link": true
@@ -617,6 +629,10 @@
       "resolved": "plugins/url-get/mcp",
       "link": true
     },
+    "node_modules/@maxy/voice-mirror-mcp": {
+      "resolved": "plugins/voice-mirror/mcp",
+      "link": true
+    },
     "node_modules/@maxy/webchat-channel": {
       "resolved": "services/webchat-channel",
       "link": true
@@ -5618,7 +5634,211 @@
       },
       "devDependencies": {
         "@types/node": "^22.0.0",
-        "typescript": "^5.7.0"
+        "typescript": "^5.7.0",
+        "vitest": "^4.1.10"
+      }
+    },
+    "plugins/cloudflare/mcp/node_modules/@vitest/expect": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.10.tgz",
+      "integrity": "sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.1.0",
+        "@types/chai": "^5.2.2",
+        "@vitest/spy": "4.1.10",
+        "@vitest/utils": "4.1.10",
+        "chai": "^6.2.2",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "plugins/cloudflare/mcp/node_modules/@vitest/pretty-format": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.10.tgz",
+      "integrity": "sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "plugins/cloudflare/mcp/node_modules/@vitest/runner": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.10.tgz",
+      "integrity": "sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/utils": "4.1.10",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "plugins/cloudflare/mcp/node_modules/@vitest/snapshot": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.10.tgz",
+      "integrity": "sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.10",
+        "@vitest/utils": "4.1.10",
+        "magic-string": "^0.30.21",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "plugins/cloudflare/mcp/node_modules/@vitest/spy": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.10.tgz",
+      "integrity": "sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "plugins/cloudflare/mcp/node_modules/@vitest/utils": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.10.tgz",
+      "integrity": "sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.10",
+        "convert-source-map": "^2.0.0",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "plugins/cloudflare/mcp/node_modules/vitest": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.10.tgz",
+      "integrity": "sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/expect": "4.1.10",
+        "@vitest/mocker": "4.1.10",
+        "@vitest/pretty-format": "4.1.10",
+        "@vitest/runner": "4.1.10",
+        "@vitest/snapshot": "4.1.10",
+        "@vitest/spy": "4.1.10",
+        "@vitest/utils": "4.1.10",
+        "es-module-lexer": "^2.0.0",
+        "expect-type": "^1.3.0",
+        "magic-string": "^0.30.21",
+        "obug": "^2.1.1",
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.3",
+        "std-env": "^4.0.0-rc.1",
+        "tinybench": "^2.9.0",
+        "tinyexec": "^1.0.2",
+        "tinyglobby": "^0.2.15",
+        "tinyrainbow": "^3.1.0",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
+        "why-is-node-running": "^2.3.0"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@opentelemetry/api": "^1.9.0",
+        "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
+        "@vitest/browser-playwright": "4.1.10",
+        "@vitest/browser-preview": "4.1.10",
+        "@vitest/browser-webdriverio": "4.1.10",
+        "@vitest/coverage-istanbul": "4.1.10",
+        "@vitest/coverage-v8": "4.1.10",
+        "@vitest/ui": "4.1.10",
+        "happy-dom": "*",
+        "jsdom": "*",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser-playwright": {
+          "optional": true
+        },
+        "@vitest/browser-preview": {
+          "optional": true
+        },
+        "@vitest/browser-webdriverio": {
+          "optional": true
+        },
+        "@vitest/coverage-istanbul": {
+          "optional": true
+        },
+        "@vitest/coverage-v8": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        },
+        "vite": {
+          "optional": false
+        }
+      }
+    },
+    "plugins/cloudflare/mcp/node_modules/vitest/node_modules/@vitest/mocker": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.10.tgz",
+      "integrity": "sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "4.1.10",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.21"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
       }
     },
     "plugins/connector/mcp": {
@@ -6395,6 +6615,18 @@
         }
       }
     },
+    "plugins/google/mcp": {
+      "name": "@maxy/google",
+      "version": "0.1.0",
+      "dependencies": {
+        "@modelcontextprotocol/sdk": "^1.12.1",
+        "zod": "^3.24.0"
+      },
+      "devDependencies": {
+        "@types/node": "^22.0.0",
+        "typescript": "^5.7.0"
+      }
+    },
     "plugins/graph-viewer/mcp": {
       "name": "@maxy/graph-viewer",
       "version": "0.1.0",
@@ -6424,6 +6656,19 @@
         "typescript": "^5.7.0"
       }
     },
+    "plugins/ledger/mcp": {
+      "name": "@maxy/ledger",
+      "version": "0.1.0",
+      "dependencies": {
+        "@modelcontextprotocol/sdk": "^1.12.1",
+        "neo4j-driver": "^5.28.1"
+      },
+      "devDependencies": {
+        "@types/node": "^22.0.0",
+        "typescript": "^5.7.0",
+        "vitest": "^4.1.2"
+      }
+    },
     "plugins/memory/mcp": {
       "name": "@maxy/memory",
       "version": "0.1.0",
@@ -6491,6 +6736,19 @@
         "vitest": "^4.1.2"
       }
     },
+    "plugins/storage-broker/mcp": {
+      "name": "@maxy/storage-broker",
+      "version": "0.1.0",
+      "dependencies": {
+        "@modelcontextprotocol/sdk": "^1.12.1",
+        "zod": "^3.24.0"
+      },
+      "devDependencies": {
+        "@types/node": "^22.0.0",
+        "typescript": "^5.7.0",
+        "vitest": "^4.1.7"
+      }
+    },
     "plugins/tasks/mcp": {
       "name": "@maxy/tasks",
       "version": "0.1.0",
@@ -6531,6 +6789,18 @@
         "vitest": "^4.1.2"
       }
     },
+    "plugins/voice-mirror/mcp": {
+      "name": "@maxy/voice-mirror-mcp",
+      "version": "0.1.0",
+      "dependencies": {
+        "@modelcontextprotocol/sdk": "^1.12.1",
+        "neo4j-driver": "^5.28.1"
+      },
+      "devDependencies": {
+        "@types/node": "^22.0.0",
+        "typescript": "^5.7.0"
+      }
+    },
     "plugins/waitlist/mcp": {
       "name": "@maxy/waitlist",
       "version": "0.1.0",

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:860985abfaeacef667442edd05ba359dfcdc734746919c2856550b4b2631e38f
+content-hash: sha256:103d5688cd9255611a9bf233effbaf7ffd8b45afa48b26d4f92b86febcfac1f5
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2237,26 +2237,33 @@ force Google's annual third-party security assessment. Calendar is only a
 
 ## Connecting an account
 
-`google-account-register` returns a consent URL. Relay it to the user: they open
-it on any device, sign in, and approve.
-
-What happens next depends on where they approved.
-
-**If they approved on the machine this install runs on**, the connection
-completes by itself and their browser shows a page naming the connected account.
-Nothing is pasted. That page asks them to return to the chat and say so — do
-that, then call `google-account-register-poll` to confirm.
-
-**If they approved on another device**, such as a phone, their browser lands on
-a page that **fails to load**. That is expected, not a fault: the vendor app is
-a Desktop client, so Google redirects to a loopback address on the install, and
-a phone has no route to it. The address bar still carries the code. Ask them to
-copy the **whole URL** from the address bar and pass it to
-`google-account-register-submit`, which completes the connection.
-
-Paste the entire URL — the tool pulls the code out. A bare code, a `code=...`
-fragment, and a value containing `%2F` all work too.
-`google-account-register-poll` reports the outcome at any point.
+`google-account-register` resolves which of two routes applies to this install
+and returns one `instruction` field plus a `readback` directive. Relay the
+`instruction` to the user verbatim. Do not narrate both routes or decide between
+them yourself; the tool already chose.
+
+The two routes behind that resolution:
+
+**Auto-opened** (`path: "auto-open"`), when the install's own browser is
+reachable. Register opens the Google sign-in in it, so no link is handed over.
+The user signs in and approves there and the connection completes by itself. A
+backup link comes back in `consentUrl` for the rare case the page did not open
+in front of them.
+
+**Paste** (`path: "paste"`), when no on-host browser is reachable, such as a
+browserless brand or a phone. Register returns a consent URL to relay. The user
+opens it, signs in, and approves; the loopback page then fails to load, which is
+expected, because the vendor app is a Desktop client that redirects to a
+loopback address the device cannot reach. The address bar still carries the
+code, so they copy the whole URL from it and pass it to
+`google-account-register-submit`. The tool pulls the code out of a whole URL, a
+bare code, a `code=...` fragment, or a value containing `%2F`.
+
+Either way, read the outcome back with `google-account-register-poll`, per the
+result's `readback` field: `registered` names the connected email, `pending`
+means it has not completed, `expired` means the code timed out and register
+should be re-run. Do not tell the user they are connected before poll returns
+`registered`.
 
 The register tool does not block and does not wait. A second register while one
 is already live is refused rather than overwriting it; that refusal names how

package/payload/platform/plugins/cloudflare/mcp/__tests__/template-config.test.ts

@@ -144,3 +144,29 @@ describe('device binding', () => {
     expect(text).toMatch(/accountId\s+TEXT NOT NULL DEFAULT ''/)
   })
 })
+
+const portalJs = () => readFileSync(join(TEMPLATE, 'portal.js'), 'utf8')
+const indexHtml = () => readFileSync(join(TEMPLATE, 'index.html'), 'utf8')
+
+describe('login error surfacing and passcode reveal (Task 1872)', () => {
+  it('maps each auth failure to a distinct message, not one opaque string', () => {
+    const js = portalJs()
+    expect(js).not.toMatch(/That did not work\./)
+    expect(js).toContain('Too many attempts. Try again later.')
+    expect(js).toContain('Enter both your name and your passcode.')
+    expect(js).toContain('That name and passcode did not match.')
+    expect(js).toContain('Something went wrong. Please try again in a moment.')
+    expect(js).toContain('Could not reach the server. Check your connection and try again.')
+  })
+
+  it('logs the status and error on the auth failure path', () => {
+    expect(portalJs()).toMatch(/console\.error\(\s*'\[data-portal\] auth failed'/)
+  })
+
+  it('ships a reveal control bound to the passcode field', () => {
+    const html = indexHtml()
+    expect(html).toMatch(/id="dp-reveal"/)
+    expect(html).toMatch(/aria-controls="dp-passcode"/)
+    expect(portalJs()).toMatch(/dp-reveal/)
+  })
+})

package/payload/platform/plugins/cloudflare/skills/data-portal/template/index.html

@@ -18,14 +18,22 @@
         <label class="dp-label" for="dp-owner">Your name</label>
         <input class="dp-input" id="dp-owner" name="owner" autocomplete="username" required />
         <label class="dp-label" for="dp-passcode">Passcode</label>
-        <input
-          class="dp-input"
-          id="dp-passcode"
-          name="passcode"
-          type="password"
-          autocomplete="current-password"
-          required
-        />
+        <div class="dp-field">
+          <input
+            class="dp-input"
+            id="dp-passcode"
+            name="passcode"
+            type="password"
+            autocomplete="current-password"
+            required
+          />
+          <button
+            type="button"
+            class="dp-reveal"
+            id="dp-reveal"
+            aria-controls="dp-passcode"
+          >Show passcode</button>
+        </div>
         <button class="dp-btn" type="submit">Sign in</button>
       </form>
 

package/payload/platform/plugins/cloudflare/skills/data-portal/template/portal.css

@@ -178,3 +178,28 @@ body {
   cursor: pointer;
   text-align: left;
 }
+
+/* Passcode field with its reveal control. The passcode is transcribed out of
+   band, so being able to check what was typed is the point of the toggle.
+   Reuses existing variables and declares no new :root value, which
+   portal-brand-css.mjs would drop. */
+.dp-field {
+  display: flex;
+  gap: 0.5rem;
+  align-items: stretch;
+}
+
+.dp-field .dp-input {
+  flex: 1;
+}
+
+.dp-reveal {
+  border: 1px solid var(--dp-rule);
+  border-radius: 0.375rem;
+  background: transparent;
+  color: var(--dp-muted);
+  padding: 0.375rem 0.625rem;
+  font: inherit;
+  cursor: pointer;
+  white-space: nowrap;
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/portal.js

@@ -192,6 +192,13 @@
       });
   }
 
+  function authFailureMessage(status) {
+    if (status === 429) return 'Too many attempts. Try again later.';
+    if (status === 400) return 'Enter both your name and your passcode.';
+    if (status === 401) return 'That name and passcode did not match.';
+    return 'Something went wrong. Please try again in a moment.';
+  }
+
   loginEl.addEventListener('submit', function (e) {
     e.preventDefault();
     say('Signing in…');
@@ -209,12 +216,12 @@
         });
       })
       .then(function (res) {
-        if (res.s === 429) {
-          say('Too many attempts. Try again later.');
-          return;
-        }
         if (!res.d.ok) {
-          say('That did not work.');
+          // The server returns the same denial for a wrong passcode and an
+          // unknown owner on purpose, so the message stays single and the
+          // console carries only the status class, never the reason.
+          console.error('[data-portal] auth failed', { status: res.s, error: res.d.error });
+          say(authFailureMessage(res.s));
           return;
         }
         document.getElementById('dp-passcode').value = '';
@@ -223,11 +230,20 @@
         say('');
         return refresh();
       })
-      .catch(function () {
-        say('That did not work.');
+      .catch(function (err) {
+        console.error('[data-portal] auth failed', { status: 'network', error: err });
+        say('Could not reach the server. Check your connection and try again.');
       });
   });
 
+  var revealEl = document.getElementById('dp-reveal');
+  var passcodeInput = document.getElementById('dp-passcode');
+  revealEl.addEventListener('click', function () {
+    var revealed = passcodeInput.type === 'text';
+    passcodeInput.type = revealed ? 'password' : 'text';
+    revealEl.textContent = revealed ? 'Show passcode' : 'Hide passcode';
+  });
+
   document.getElementById('dp-upload').addEventListener('submit', function (e) {
     e.preventDefault();
     var input = document.getElementById('dp-file');

package/payload/platform/plugins/docs/references/google-guide.md

@@ -11,26 +11,33 @@ force Google's annual third-party security assessment. Calendar is only a
 
 ## Connecting an account
 
-`google-account-register` returns a consent URL. Relay it to the user: they open
-it on any device, sign in, and approve.
-
-What happens next depends on where they approved.
-
-**If they approved on the machine this install runs on**, the connection
-completes by itself and their browser shows a page naming the connected account.
-Nothing is pasted. That page asks them to return to the chat and say so — do
-that, then call `google-account-register-poll` to confirm.
-
-**If they approved on another device**, such as a phone, their browser lands on
-a page that **fails to load**. That is expected, not a fault: the vendor app is
-a Desktop client, so Google redirects to a loopback address on the install, and
-a phone has no route to it. The address bar still carries the code. Ask them to
-copy the **whole URL** from the address bar and pass it to
-`google-account-register-submit`, which completes the connection.
-
-Paste the entire URL — the tool pulls the code out. A bare code, a `code=...`
-fragment, and a value containing `%2F` all work too.
-`google-account-register-poll` reports the outcome at any point.
+`google-account-register` resolves which of two routes applies to this install
+and returns one `instruction` field plus a `readback` directive. Relay the
+`instruction` to the user verbatim. Do not narrate both routes or decide between
+them yourself; the tool already chose.
+
+The two routes behind that resolution:
+
+**Auto-opened** (`path: "auto-open"`), when the install's own browser is
+reachable. Register opens the Google sign-in in it, so no link is handed over.
+The user signs in and approves there and the connection completes by itself. A
+backup link comes back in `consentUrl` for the rare case the page did not open
+in front of them.
+
+**Paste** (`path: "paste"`), when no on-host browser is reachable, such as a
+browserless brand or a phone. Register returns a consent URL to relay. The user
+opens it, signs in, and approves; the loopback page then fails to load, which is
+expected, because the vendor app is a Desktop client that redirects to a
+loopback address the device cannot reach. The address bar still carries the
+code, so they copy the whole URL from it and pass it to
+`google-account-register-submit`. The tool pulls the code out of a whole URL, a
+bare code, a `code=...` fragment, or a value containing `%2F`.
+
+Either way, read the outcome back with `google-account-register-poll`, per the
+result's `readback` field: `registered` names the connected email, `pending`
+means it has not completed, `expired` means the code timed out and register
+should be re-run. Do not tell the user they are connected before poll returns
+`registered`.
 
 The register tool does not block and does not wait. A second register while one
 is already live is refused rather than overwriting it; that refusal names how