@rubytech/create-maxy-code 0.1.57 → 0.1.58

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.57",
+  "version": "0.1.58",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/docs/references/admin-session.md

@@ -79,7 +79,7 @@ The Hono route `POST /api/admin/claude-sessions` at [`platform/ui/server/routes/
 
 **Body schema.** `{channel?, permissionMode?, initialMessage?}` for operator-driven UI spawns (cookie path — `senderId` resolved from the admin session cookie, `hidden: false`, no `specialist`). The recorder hook posts the loopback variant: `{specialist:'database-operator', initialMessage, originatingSessionId, channel?}` — no synthetic `senderId` marker. The wrapper rejects nothing structurally — string fields are coerced or defaulted (`channel` → `'browser'`, `permissionMode` → undefined, `initialMessage` → null if empty/whitespace) and the session manager validates the rest downstream. The loopback branch refuses the request with `400 originating-session-id-required` if `originatingSessionId` is missing or non-UUID, and `404 originating-session-not-found` if the manager has no StoredSession for it.
 
-**Auth surfaces.** Two: `cookie` (Sidebar — `requireAdminSession` validates `session_key` from query/body/multipart and resolves `senderId` from the in-memory session store) and `loopback` (recorder hook — `requireAdminSessionUnlessLoopbackSpawn` skips cookie auth when method is `POST`, path is exactly `/api/admin/claude-sessions`, and the request originates from `127.0.0.1`/`::1`; the handler then looks up the operator's `senderId` from `GET {managerBase}/<originatingSessionId>/meta`). Same trust boundary the claude-session-manager itself relies on — both bind 127.0.0.1 only. The Task-122-era `POST /recorder-spawn` sibling route is gone (Task 134). One route, one shape, two surfaces.
+**Auth surfaces.** Two: `cookie` (Sidebar — `requireAdminSession` validates `session_key` from query/body/multipart and resolves `senderId` from the in-memory session store) and `loopback` (recorder hook — `requireAdminSessionUnlessLoopbackSpawn` skips cookie auth when method is `POST`, path is exactly `/api/admin/claude-sessions`, the TCP peer is `127.0.0.1`/`::1`, **and** the request carries no `x-forwarded-for` header; the handler then looks up the operator's `senderId` from `GET {managerBase}/<originatingSessionId>/meta`). The XFF check distinguishes a real in-process recorder hook from a browser request that traversed `maxy-edge`'s reverse proxy and arrived on loopback with `peer=127.0.0.1` — same idiom `requestIsTlsTerminated` uses to disambiguate proxied vs direct TLS. Without the XFF gate, every edge-proxied "+ New session" click would mis-fire the bypass and 400 with `originating-session-id-required` (Task 143). Same trust boundary the claude-session-manager itself relies on — both bind 127.0.0.1 only. The Task-122-era `POST /recorder-spawn` sibling route is gone (Task 134). One route, one shape, two surfaces.
 
 **Forwarded endpoints.** Two upstream calls per spawn-with-message: `POST {managerBase}/spawn` (enriched body) returns `{sessionId}`; when `initialMessage` is set, the wrapper then issues `POST {managerBase}/<sessionId>/input { text: <initialMessage> }` synchronously so the PTY has its first turn stimulus before the operator types. The HTTP response streams the spawn upstream body straight through.
 
@@ -89,7 +89,7 @@ The Hono route `POST /api/admin/claude-sessions` at [`platform/ui/server/routes/
 
 After every completed operator admin turn, the Stop hook `platform/plugins/admin/hooks/turn-completed-graph-write.sh` dispatches one headless `database-operator` session to record any new or missing information from that turn into the Neo4j graph. Exactly four things happen — any deviation is a fault (2026-05-18 doctrine fix).
 
-1. **A new admin session is spawned the SAME way a Sidebar "New session" click spawns one.** The hook POSTs to `POST /api/admin/claude-sessions` — the exact same route the Sidebar uses. The Hono wrapper bypasses cookie auth via `requireAdminSessionUnlessLoopbackSpawn` on this exact method+path when the request originates from `127.0.0.1`. The body the hook sends carries only `{specialist:'database-operator', initialMessage, originatingSessionId, channel:'browser'}` — no synthetic `senderId` marker (Task 134 removed it; the loopback bypass is method+path-scoped). The wrapper resolves the operator's real `senderId` from `originatingSessionId` via `GET <managerBase>/<originatingSessionId>/meta`, then forwards a Sidebar-shape body to the manager: real operator `senderId`, `hidden: false`, `channel: 'browser'`, `role: 'admin'`, plus `specialist` and `originatingSessionId`. `aboutOwner` resolves against the operator's account; the recorder appears in the operator's sidebar as a sibling session of the originating one. `userId` is not exposed via `/meta` and is left undefined — `aboutOwner` falls through to senderId-only resolution, which returns the operator's account profile and is adequate for the recorder's single-turn lifecycle.
+1. **A new admin session is spawned the SAME way a Sidebar "New session" click spawns one.** The hook POSTs to `POST /api/admin/claude-sessions` — the exact same route the Sidebar uses. The Hono wrapper bypasses cookie auth via `requireAdminSessionUnlessLoopbackSpawn` on this exact method+path when the TCP peer is `127.0.0.1` **and** the request carries no `x-forwarded-for` header (the recorder is in-process; the edge proxy unconditionally stamps XFF on every browser request — Task 143). The body the hook sends carries only `{specialist:'database-operator', initialMessage, originatingSessionId, channel:'browser'}` — no synthetic `senderId` marker (Task 134 removed it; the loopback bypass is method+path-scoped). The wrapper resolves the operator's real `senderId` from `originatingSessionId` via `GET <managerBase>/<originatingSessionId>/meta`, then forwards a Sidebar-shape body to the manager: real operator `senderId`, `hidden: false`, `channel: 'browser'`, `role: 'admin'`, plus `specialist` and `originatingSessionId`. `aboutOwner` resolves against the operator's account; the recorder appears in the operator's sidebar as a sibling session of the originating one. `userId` is not exposed via `/meta` and is left undefined — `aboutOwner` falls through to senderId-only resolution, which returns the operator's account profile and is adequate for the recorder's single-turn lifecycle.
 2. **The spawned session's specialist is `database-operator`.**
 3. **The initial message is the operator's last turn, prefixed by a literal instruction.** Format:
    ```

package/payload/server/server.js

@@ -8107,8 +8107,10 @@ var requireAdminSessionUnlessLoopbackSpawn = async (c, next) => {
   if (c.req.method === "POST" && c.req.path === "/api/admin/claude-sessions") {
     const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
     const isLoopback = remoteAddr === "127.0.0.1" || remoteAddr === "::1" || remoteAddr === "::ffff:127.0.0.1";
-    if (isLoopback) {
-      console.log(`${TAG18} loopback-spawn-bypass remoteAddr=${remoteAddr}`);
+    const xff = c.req.header("x-forwarded-for");
+    const xffPresent = typeof xff === "string" && xff.length > 0;
+    if (isLoopback && !xffPresent) {
+      console.log(`${TAG18} loopback-spawn-bypass remoteAddr=${remoteAddr} xff=absent`);
       return next();
     }
   }