@rubytech/create-maxy-code 0.1.49 → 0.1.57

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/src/lib/neo4j.ts

@@ -0,0 +1,47 @@
+import neo4j, { Driver, Session } from "neo4j-driver";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+let driver: Driver | null = null;
+
+function readPassword(): string {
+  if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
+  const passwordFile = resolve(
+    process.env.PLATFORM_ROOT ?? resolve(import.meta.dirname, "../../../.."),
+    "config/.neo4j-password",
+  );
+  try {
+    return readFileSync(passwordFile, "utf-8").trim();
+  } catch {
+    throw new Error(
+      `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`,
+    );
+  }
+}
+
+export function getDriver(): Driver {
+  if (!driver) {
+    const uri = process.env.NEO4J_URI;
+    if (!uri) {
+      throw new Error(
+        "[property-data] NEO4J_URI unset — refusing to default to bolt://localhost:7687",
+      );
+    }
+    const user = process.env.NEO4J_USER ?? "neo4j";
+    const password = readPassword();
+    console.error(`[property-data] resolved neo4j_uri=${uri}`);
+    driver = neo4j.driver(uri, neo4j.auth.basic(user, password));
+  }
+  return driver;
+}
+
+export function getSession(): Session {
+  return getDriver().session();
+}
+
+export async function closeDriver(): Promise<void> {
+  if (driver) {
+    await driver.close();
+    driver = null;
+  }
+}

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/src/lib/propertydata-api.ts

@@ -0,0 +1,135 @@
+import { getSession } from "./neo4j.js";
+import { decrypt } from "./crypto.js";
+
+// PropertyData API V1 client. Every endpoint is a GET against
+// https://api.propertydata.co.uk/<endpoint> with `key=<api-key>` plus
+// endpoint-specific query params. Response envelope:
+//
+//   { "status": "success", ...payload }
+//   { "status": "error", "message": "..." }
+//
+// The `propertyDataCall` helper returns either the parsed payload as a
+// JSON string ready for tool text content, or throws PropertyDataError /
+// KeyNotRegisteredError so the tool wrapper can produce a deterministic
+// error envelope.
+
+const BASE_URL = "https://api.propertydata.co.uk";
+const REQUEST_TIMEOUT_MS = 15_000;
+
+export class KeyNotRegisteredError extends Error {
+  constructor() {
+    super("key-not-registered");
+    this.name = "KeyNotRegisteredError";
+  }
+}
+
+export class PropertyDataError extends Error {
+  constructor(
+    public readonly status: number,
+    public readonly endpoint: string,
+    public readonly upstreamMessage: string,
+  ) {
+    super(`http-${status} from PropertyData endpoint=${endpoint}: ${upstreamMessage}`);
+    this.name = "PropertyDataError";
+  }
+}
+
+export class BadResponseError extends Error {
+  constructor(public readonly endpoint: string, public readonly length: number) {
+    super(`bad-response from PropertyData endpoint=${endpoint} (non-JSON, length=${length})`);
+    this.name = "BadResponseError";
+  }
+}
+
+export interface PropertyDataKey {
+  encryptedKey: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export async function loadAccountKey(accountId: string): Promise<PropertyDataKey | null> {
+  const session = getSession();
+  try {
+    const result = await session.run(
+      `MATCH (k:PropertyDataKey {accountId: $accountId})
+       RETURN k.encryptedKey AS encryptedKey,
+              k.createdAt AS createdAt,
+              k.updatedAt AS updatedAt`,
+      { accountId },
+    );
+    if (result.records.length === 0) return null;
+    const r = result.records[0];
+    return {
+      encryptedKey: r.get("encryptedKey"),
+      createdAt: r.get("createdAt") ?? "",
+      updatedAt: r.get("updatedAt") ?? "",
+    };
+  } finally {
+    await session.close();
+  }
+}
+
+export async function resolveAccountApiKey(accountId: string): Promise<string> {
+  const stored = await loadAccountKey(accountId);
+  if (!stored) throw new KeyNotRegisteredError();
+  return decrypt(stored.encryptedKey);
+}
+
+export interface CallOptions {
+  endpoint: string;
+  toolName: string;
+  accountId: string;
+  params: Record<string, string | number | undefined>;
+}
+
+export async function propertyDataCall(opts: CallOptions): Promise<string> {
+  const { endpoint, toolName, accountId, params } = opts;
+  const apiKey = await resolveAccountApiKey(accountId);
+
+  const search = new URLSearchParams();
+  search.set("key", apiKey);
+  for (const [k, v] of Object.entries(params)) {
+    if (v === undefined || v === null || v === "") continue;
+    search.set(k, String(v));
+  }
+  const url = `${BASE_URL}/${endpoint}?${search.toString()}`;
+
+  const postcode = params.postcode ?? "";
+  const start = Date.now();
+  const response = await fetch(url, {
+    headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+  });
+  const ms = Date.now() - start;
+
+  const statusTag = response.ok ? "ok" : `http-${Math.floor(response.status / 100)}xx`;
+  console.error(
+    `[property-data] tool=${toolName} account=${accountId} postcode=${postcode} status=${statusTag} ms=${ms}`,
+  );
+
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new PropertyDataError(response.status, endpoint, body.slice(0, 200));
+  }
+
+  const text = await response.text();
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new BadResponseError(endpoint, text.length);
+  }
+
+  if (
+    parsed &&
+    typeof parsed === "object" &&
+    !Array.isArray(parsed) &&
+    "status" in parsed &&
+    (parsed as { status: unknown }).status === "error"
+  ) {
+    const msg = String((parsed as { message?: unknown }).message ?? "unknown error");
+    throw new PropertyDataError(response.status, endpoint, msg);
+  }
+
+  return JSON.stringify(parsed, null, 2);
+}

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/src/tools/endpoints.ts

@@ -0,0 +1,27 @@
+import { propertyDataCall } from "../lib/propertydata-api.js";
+
+// Every endpoint tool takes the same shape: { accountId, ...params }.
+// Per-tool param schemas are enforced by zod in index.ts; this layer only
+// forwards values to the HTTP client.
+
+type Args = Record<string, unknown> & { accountId: string };
+
+function call(toolName: string, endpoint: string, args: Args): Promise<string> {
+  const { accountId, ...rest } = args;
+  return propertyDataCall({
+    endpoint,
+    toolName,
+    accountId,
+    params: rest as Record<string, string | number | undefined>,
+  });
+}
+
+export const valuationSale = (a: Args) => call("property-data-valuation-sale", "valuation-sale", a);
+export const valuationRent = (a: Args) => call("property-data-valuation-rent", "valuation-rent", a);
+export const prices = (a: Args) => call("property-data-prices", "prices", a);
+export const pricesRent = (a: Args) => call("property-data-prices-rent", "prices-rent", a);
+export const soldPrices = (a: Args) => call("property-data-sold-prices", "sold-prices", a);
+export const demand = (a: Args) => call("property-data-demand", "demand", a);
+export const yields = (a: Args) => call("property-data-yields", "yields", a);
+export const growth = (a: Args) => call("property-data-growth", "growth", a);
+export const nationalHpi = (a: Args) => call("property-data-national-hpi", "national-hpi", a);

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/src/tools/key-deregister.ts

@@ -0,0 +1,21 @@
+import { getSession } from "../lib/neo4j.js";
+
+export async function keyDeregister(params: { accountId: string }): Promise<void> {
+  const { accountId } = params;
+  const session = getSession();
+  try {
+    const result = await session.run(
+      `MATCH (k:PropertyDataKey {accountId: $accountId})
+       DELETE k
+       RETURN count(k) AS deleted`,
+      { accountId },
+    );
+    const deleted = result.records[0]?.get("deleted")?.toNumber?.() ?? 0;
+    if (deleted === 0) {
+      throw new Error("No PropertyData API key is registered for this account.");
+    }
+  } finally {
+    await session.close();
+  }
+  console.error(`[property-data] key-op op=deregister account=${accountId}`);
+}

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/src/tools/key-list.ts

@@ -0,0 +1,10 @@
+import { loadAccountKey } from "../lib/propertydata-api.js";
+
+export async function keyList(params: { accountId: string }): Promise<string> {
+  const key = await loadAccountKey(params.accountId);
+  console.error(`[property-data] key-op op=list account=${params.accountId}`);
+  if (!key) {
+    return "No PropertyData API key registered. Use property-data-key-register to add one.";
+  }
+  return `PropertyData API key registered (created: ${key.createdAt}, updated: ${key.updatedAt}). Key value is encrypted and cannot be retrieved.`;
+}

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/src/tools/key-register.ts

@@ -0,0 +1,58 @@
+import { getSession } from "../lib/neo4j.js";
+import { encrypt } from "../lib/crypto.js";
+import { PropertyDataError } from "../lib/propertydata-api.js";
+
+const BASE_URL = "https://api.propertydata.co.uk";
+const REQUEST_TIMEOUT_MS = 15_000;
+
+// Validate by hitting a cheap endpoint that returns success on any valid key:
+// /national-hpi takes no postcode and is rate-cheap. Treat a 200 as the key
+// passing PropertyData's authentication check; treat 401/403 as an explicit
+// key rejection so the operator gets an actionable message; treat anything
+// else as an unverified-key error (network, upstream outage).
+async function validateApiKey(apiKey: string): Promise<void> {
+  const url = `${BASE_URL}/national-hpi?key=${encodeURIComponent(apiKey)}`;
+  const response = await fetch(url, {
+    headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+  });
+  if (response.status === 401 || response.status === 403) {
+    throw new Error(`PropertyData rejected the API key (HTTP ${response.status}).`);
+  }
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new PropertyDataError(response.status, "national-hpi", body.slice(0, 200));
+  }
+}
+
+export async function keyRegister(params: {
+  apiKey: string;
+  accountId: string;
+}): Promise<void> {
+  const { apiKey, accountId } = params;
+
+  await validateApiKey(apiKey);
+
+  const encryptedKey = encrypt(apiKey);
+  const now = new Date().toISOString();
+
+  const session = getSession();
+  try {
+    await session.run(
+      `CREATE INDEX property_data_key_account IF NOT EXISTS
+       FOR (k:PropertyDataKey) ON (k.accountId)`,
+      {},
+    );
+
+    await session.run(
+      `MERGE (k:PropertyDataKey {accountId: $accountId})
+       ON CREATE SET k.encryptedKey = $encryptedKey, k.createdAt = $now, k.updatedAt = $now
+       ON MATCH  SET k.encryptedKey = $encryptedKey, k.updatedAt = $now`,
+      { accountId, encryptedKey, now },
+    );
+  } finally {
+    await session.close();
+  }
+
+  console.error(`[property-data] key-op op=register account=${accountId}`);
+}

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "Node16",
+    "moduleResolution": "Node16",
+    "lib": ["ES2022"],
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true
+  },
+  "include": ["src"],
+  "exclude": ["src/**/__tests__/**", "src/**/*.test.ts"]
+}

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/vitest.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    include: ["src/**/__tests__/**/*.test.ts"],
+    environment: "node",
+  },
+});

package/payload/premium-plugins/real-agent/plugins/property-data/skills/property-data/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: property-data
+description: "Given a UK postcode plus property attributes (type, bedrooms, area), return structured market data — comparable sold prices, asking-price baselines, demand index, rental yield, and growth signals — for valuation and negotiation workflows."
+---
+
+# Property Data
+
+Outcome: given a UK postcode and property attributes, return structured market evidence — comparables, asking prices, sold prices, demand, yield, growth — so the valuer composes a valuation brief and the negotiator backs an offer position with numbers, not prose.
+
+## When to use
+
+Trigger phrases:
+- "comps for [address|postcode]"
+- "what are properties going for in [postcode]"
+- "demand in [postcode]"
+- "yield on [bedrooms]-bed in [postcode]"
+- "asking prices around [postcode]"
+- "what's it worth — [postcode], [type], [beds]"
+- "sold prices on [street|postcode]"
+- "growth in [postcode]"
+
+## Inputs required
+
+- **Postcode** — UK outcode (e.g. `SN7`) or full postcode (e.g. `SN7 8AA`). The PropertyData endpoints accept either; outcode broadens the sample, full postcode tightens it.
+- **Property type** — one of: `detached`, `semi-detached`, `terraced`, `flat`. Required for valuation and price-distribution endpoints.
+- **Bedrooms** — integer. Required for valuation and yield endpoints.
+- **Internal area (sq ft)** — required for `valuation-sale` and `valuation-rent` point estimates. If unknown, fall back to `prices` / `prices-rent` for a distribution and state the area assumption.
+
+## Tools
+
+| Tool | Use for | Required inputs |
+|---|---|---|
+| `property-data-valuation-sale` | Point sale-price estimate | postcode, type, bedrooms, bathrooms, internal_area |
+| `property-data-valuation-rent` | Point rent estimate | postcode, type, bedrooms, bathrooms, internal_area |
+| `property-data-prices` | Asking-price distribution (mean / median / 80th pct) | postcode, type, bedrooms |
+| `property-data-prices-rent` | Rent asking-price distribution | postcode, type, bedrooms |
+| `property-data-sold-prices` | Land Registry sold transactions | postcode (max_age, type, bedrooms optional) |
+| `property-data-demand` | Supply count + days to sell-STC | postcode |
+| `property-data-yields` | Gross rental yield | postcode, bedrooms |
+| `property-data-growth` | Short and long-term price growth | postcode |
+| `property-data-national-hpi` | UK national HPI series | (none) |
+
+## Output
+
+Return the structured `data` payload directly to the caller (valuer / negotiator). Do not collapse it to prose — downstream skills (`comparable-finder`, `local-market-stats`, `pricing-scenario-builder`) consume the fields.
+
+## Failure modes
+
+- `Error: key-not-registered` — surface the registration prompt: "PropertyData API key not registered. Register it with `property-data-key-register`."
+- `Error: http-4xx` — bad input (usually invalid postcode or unsupported type). Restate the inputs the operator gave; do not retry blindly.
+- `Error: http-5xx` — PropertyData upstream outage. Surface the failure and fall back to Loop sold-prices (`loop-property-sold`) if available.
+- Empty `data` — the postcode has insufficient comparables. Broaden the postcode (full → outcode) and retry once; if still empty, surface "no PropertyData comparables for this postcode" and let the agent fall back.
+
+## Do not
+
+- Do not compose a valuation figure or asking-price range in this skill — that is the valuer's output contract, composed downstream from the structured data returned here.
+- Do not call any endpoint without a postcode argument (except `national-hpi`).
+- Do not invent fields not returned by PropertyData. If a field is absent, name it as a gap.

package/payload/server/{chunk-MEGIQYUD.js → chunk-2IKQERHN.js}

@@ -1,6 +1,6 @@
 import {
   getConversationOwner
-} from "./chunk-4P2MPERV.js";
+} from "./chunk-X3Y6ENKA.js";
 
 // node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
@@ -3732,12 +3732,40 @@ var emitMissingOnResolve = (..._args) => null;
 // app/lib/claude-agent/spawn-env.ts
 var getBundleMtimeIso = (..._args) => null;
 
-// app/lib/claude-agent/stream-log-writer.ts
-var appendStreamLogLine = (..._args) => null;
-
 // app/lib/claude-agent/summary-helpers.ts
 var stripAttachmentMetaSuffix = (..._args) => null;
 
+// ../lib/require-port-env/src/index.ts
+var MissingPortEnvError = class extends Error {
+  envName;
+  tag;
+  failLine;
+  constructor(envName, tag, failLine, message) {
+    super(message);
+    this.name = "MissingPortEnvError";
+    this.envName = envName;
+    this.tag = tag;
+    this.failLine = failLine;
+  }
+};
+var VALID_PORT_MIN = 1;
+var VALID_PORT_MAX = 65535;
+function requirePortEnv(envName, options = {}) {
+  const tag = options.tag ?? "port-env";
+  const failLine = options.failLine ?? "missing-port-env";
+  const raw2 = process.env[envName];
+  if (raw2 === void 0 || raw2 === "") {
+    const msg = `[${tag}] ${failLine} reason=missing-env env=${envName}`;
+    throw new MissingPortEnvError(envName, tag, failLine, msg);
+  }
+  const parsed = Number.parseInt(raw2, 10);
+  if (!Number.isInteger(parsed) || parsed < VALID_PORT_MIN || parsed > VALID_PORT_MAX || String(parsed) !== raw2.trim()) {
+    const msg = `[${tag}] ${failLine} reason=invalid-port-env env=${envName} value=${JSON.stringify(raw2)}`;
+    throw new MissingPortEnvError(envName, tag, failLine, msg);
+  }
+  return parsed;
+}
+
 // server/routes/_helpers.ts
 async function safeJson(c) {
   try {
@@ -4399,8 +4427,8 @@ export {
   reconcileEnabledPlugins,
   emitMissingOnResolve,
   getBundleMtimeIso,
-  appendStreamLogLine,
   stripAttachmentMetaSuffix,
+  requirePortEnv,
   safeJson,
   requireAdminSession,
   tryCookieBridgeForConversation,

package/payload/server/{chunk-XJVJ2B2Q.js → chunk-NPZKH5EC.js}

@@ -1,6 +1,6 @@
 import {
   getSession
-} from "./chunk-4P2MPERV.js";
+} from "./chunk-X3Y6ENKA.js";
 import {
   __commonJS,
   __toESM

package/payload/server/{chunk-4P2MPERV.js → chunk-X3Y6ENKA.js}

@@ -1,21 +1,8 @@
 // app/lib/neo4j-store.ts
 import neo4j from "neo4j-driver";
 import { randomUUID } from "crypto";
-import { spawn } from "child_process";
 import { readFileSync, readdirSync, existsSync, openSync, readSync, closeSync, statSync } from "fs";
 import { resolve } from "path";
-
-// ../lib/models/src/index.ts
-var OPUS_MODEL = "claude-opus-4-7";
-var SONNET_MODEL = "claude-sonnet-4-6";
-var HAIKU_MODEL = "claude-haiku-4-5";
-var MODEL_CONTEXT_WINDOW = {
-  [OPUS_MODEL]: 2e5,
-  [SONNET_MODEL]: 2e5,
-  [HAIKU_MODEL]: 2e5
-};
-
-// app/lib/neo4j-store.ts
 var PLATFORM_ROOT = process.env.MAXY_PLATFORM_ROOT ?? resolve(process.cwd(), "..");
 var driver = null;
 function readPassword() {
@@ -608,81 +595,6 @@ async function deleteConversation(conversationId) {
     await session.close();
   }
 }
-var SESSION_LABEL_MSG_CAP = 500;
-var SESSION_LABEL_TIMEOUT_MS = 15e3;
-var SESSION_LABEL_MODEL = HAIKU_MODEL;
-var SESSION_LABEL_MAX_WORDS = 6;
-var SESSION_LABEL_MAX_STDERR = 2048;
-var _spawnOverride = null;
-var SESSION_LABEL_SYSTEM = `You are a session labeler. Given the opening messages of a conversation with an AI assistant, produce a concise topic label.
-
-Rules:
-- Exactly 3 to 6 words
-- Summarize the user's intent, do not copy verbatim
-- Capitalize the first word only (sentence case)
-- No punctuation, no quotes
-- You MUST always produce a label. Vague, terse, or single-word messages still get a best-effort label (e.g. a one-word "hi" or an emoji becomes "Greeting"; an unintelligible fragment becomes "Unstructured note"). Never abstain.`;
-async function generateSessionLabel(messages) {
-  const cappedMessages = messages.map((m) => m.slice(0, SESSION_LABEL_MSG_CAP));
-  const userContent = cappedMessages.map((m, i) => `Message ${i + 1}: ${m}`).join("\n");
-  const prompt = `${SESSION_LABEL_SYSTEM}
-
-${userContent}`;
-  const args = [
-    "--print",
-    "--model",
-    SESSION_LABEL_MODEL,
-    "--max-turns",
-    "1",
-    "--permission-mode",
-    "dontAsk",
-    prompt
-  ];
-  return new Promise((resolve2) => {
-    let stdout = "";
-    let stderr = "";
-    const spawnFn = _spawnOverride ?? spawn;
-    const proc = spawnFn("claude", args, {
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    proc.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString("utf-8");
-    });
-    proc.stderr?.on("data", (chunk) => {
-      if (stderr.length < SESSION_LABEL_MAX_STDERR) {
-        stderr += chunk.toString("utf-8").slice(0, SESSION_LABEL_MAX_STDERR - stderr.length);
-      }
-    });
-    const timer = setTimeout(() => {
-      proc.kill("SIGTERM");
-      console.error("[persist] autoLabel: haiku subprocess timed out");
-      resolve2(null);
-    }, SESSION_LABEL_TIMEOUT_MS);
-    proc.on("error", (err) => {
-      clearTimeout(timer);
-      console.error(`[persist] autoLabel: subprocess error \u2014 ${err.message}`);
-      resolve2(null);
-    });
-    proc.on("close", (code) => {
-      clearTimeout(timer);
-      if (code !== 0) {
-        console.error(`[persist] autoLabel: subprocess exited code=${code}${stderr ? ` stderr=${stderr.trim().slice(0, 200)}` : ""}`);
-        resolve2(null);
-        return;
-      }
-      const text = stdout.trim();
-      if (!text) {
-        console.error("[persist] autoLabel: haiku returned empty response");
-        resolve2(null);
-        return;
-      }
-      const words = text.split(/\s+/).slice(0, SESSION_LABEL_MAX_WORDS);
-      const label = words.join(" ");
-      console.error(`[persist] autoLabel: haiku response="${label}"`);
-      resolve2(label);
-    });
-  });
-}
 async function renameConversation(conversationId, label) {
   let embedding = null;
   try {
@@ -1336,7 +1248,6 @@ async function deleteAgentProjection(accountId, slug) {
 }
 
 export {
-  HAIKU_MODEL,
   getSession,
   runAdminUserSelfHeal,
   embed,
@@ -1351,7 +1262,6 @@ export {
   verifyAndGetConversationUpdatedAt,
   listAdminSessions,
   deleteConversation,
-  generateSessionLabel,
   renameConversation,
   getUserTimezone,
   loadAdminUserName,

package/payload/server/{cloudflare-task-tracker-R6MMORFU.js → cloudflare-task-tracker-TL6R364J.js}

@@ -7,8 +7,8 @@ import {
   readTunnelState,
   recoverRunningCloudflareTasks,
   resolveUnitGoneVerdict
-} from "./chunk-XJVJ2B2Q.js";
-import "./chunk-4P2MPERV.js";
+} from "./chunk-NPZKH5EC.js";
+import "./chunk-X3Y6ENKA.js";
 import "./chunk-JSBRDJBE.js";
 export {
   CLOUDFLARE_TASK_DIAGNOSTICS,