@rubytech/create-maxy-code 0.1.58 → 0.1.60

package/payload/premium-plugins/real-agent/plugins/loop/mcp/src/lib/key-store.ts

@@ -0,0 +1,221 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { homedir } from "node:os";
+import { getSession } from "./neo4j.js";
+import { encrypt, decrypt } from "./crypto.js";
+import { encryptWith, decryptWith } from "./file-crypto.js";
+
+// Storage abstraction so the same MCP body runs against Neo4j (platform mode)
+// or an on-disk encrypted file (standalone mode, spawned by Claude Code from
+// ~/.claude/). Selected by LOOP_STANDALONE at boot. Loop is multi-team — each
+// account can register many team keys — so the file backend stores a nested
+// map and the store API mirrors that.
+
+export interface LoopStoredKey {
+  teamName: string;
+  apiKey: string;
+  teamAddress: string;
+  agentId: string;
+  permissions: string[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+export type LoopKeyInput = Omit<LoopStoredKey, "createdAt" | "updatedAt">;
+
+export interface LoopKeyStore {
+  readonly backendName: string;
+  readonly backendPath: string;
+  loadAll(accountId: string): Promise<LoopStoredKey[]>;
+  save(accountId: string, key: LoopKeyInput): Promise<{ created: boolean }>;
+  delete(accountId: string, teamName: string): Promise<boolean>;
+}
+
+class Neo4jLoopKeyStore implements LoopKeyStore {
+  readonly backendName = "neo4j";
+  readonly backendPath = process.env.NEO4J_URI ?? "<unset>";
+
+  async loadAll(accountId: string): Promise<LoopStoredKey[]> {
+    const session = getSession();
+    try {
+      const result = await session.run(
+        `MATCH (k:LoopTeamKey {accountId: $accountId})
+         RETURN k.teamName AS teamName, k.encryptedKey AS encryptedKey,
+                k.teamAddress AS teamAddress, k.agentId AS agentId,
+                k.permissions AS permissions, k.createdAt AS createdAt,
+                k.updatedAt AS updatedAt
+         ORDER BY k.teamName`,
+        { accountId },
+      );
+      return result.records.map((r) => ({
+        teamName: r.get("teamName"),
+        apiKey: decrypt(r.get("encryptedKey")),
+        teamAddress: r.get("teamAddress") ?? "",
+        agentId: r.get("agentId") ?? "",
+        permissions: r.get("permissions") ?? [],
+        createdAt: r.get("createdAt") ?? "",
+        updatedAt: r.get("updatedAt") ?? "",
+      }));
+    } finally {
+      await session.close();
+    }
+  }
+
+  async save(accountId: string, key: LoopKeyInput): Promise<{ created: boolean }> {
+    const encryptedKey = encrypt(key.apiKey);
+    const now = new Date().toISOString();
+    const session = getSession();
+    try {
+      await session.run(
+        `CREATE INDEX loop_team_key_account_team IF NOT EXISTS
+         FOR (k:LoopTeamKey) ON (k.accountId, k.teamName)`,
+        {},
+      );
+      const result = await session.run(
+        `MERGE (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
+         ON CREATE SET
+           k.encryptedKey = $encryptedKey,
+           k.teamAddress = $teamAddress,
+           k.agentId = $agentId,
+           k.permissions = $permissions,
+           k.createdAt = $now,
+           k.updatedAt = $now
+         RETURN k.createdAt = $now AS created`,
+        {
+          teamName: key.teamName,
+          encryptedKey,
+          teamAddress: key.teamAddress,
+          agentId: key.agentId,
+          accountId,
+          permissions: key.permissions,
+          now,
+        },
+      );
+      return { created: Boolean(result.records[0]?.get("created")) };
+    } finally {
+      await session.close();
+    }
+  }
+
+  async delete(accountId: string, teamName: string): Promise<boolean> {
+    const session = getSession();
+    try {
+      const result = await session.run(
+        `MATCH (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
+         DELETE k
+         RETURN count(k) AS deleted`,
+        { teamName, accountId },
+      );
+      const deleted = result.records[0]?.get("deleted")?.toNumber?.() ?? 0;
+      return deleted > 0;
+    } finally {
+      await session.close();
+    }
+  }
+}
+
+const LABEL = "loop";
+
+interface FileEnvelope {
+  [accountId: string]: {
+    [teamName: string]: {
+      encryptedKey: string;
+      teamAddress: string;
+      agentId: string;
+      permissions: string[];
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
+}
+
+class FileLoopKeyStore implements LoopKeyStore {
+  readonly backendName = "file";
+  readonly backendPath: string;
+  private readonly storePath: string;
+  private readonly keyFilePath: string;
+
+  constructor() {
+    const home = homedir();
+    this.storePath = resolve(home, ".claude/.realagent-loop-key.enc");
+    this.keyFilePath = resolve(home, ".claude/.realagent-loop-encryption-key");
+    this.backendPath = this.storePath;
+  }
+
+  private ensureDir(): void {
+    mkdirSync(dirname(this.storePath), { recursive: true });
+  }
+
+  private readAll(): FileEnvelope {
+    if (!existsSync(this.storePath)) return {};
+    const blob = readFileSync(this.storePath, "utf-8").trim();
+    if (!blob) return {};
+    const json = decryptWith(blob, this.keyFilePath, LABEL);
+    return JSON.parse(json) as FileEnvelope;
+  }
+
+  private writeAll(env: FileEnvelope): void {
+    this.ensureDir();
+    const blob = encryptWith(JSON.stringify(env), this.keyFilePath, LABEL);
+    writeFileSync(this.storePath, blob, { mode: 0o600 });
+  }
+
+  async loadAll(accountId: string): Promise<LoopStoredKey[]> {
+    const env = this.readAll();
+    const account = env[accountId];
+    if (!account) return [];
+    return Object.entries(account)
+      .map(([teamName, entry]) => ({
+        teamName,
+        apiKey: decryptWith(entry.encryptedKey, this.keyFilePath, LABEL),
+        teamAddress: entry.teamAddress,
+        agentId: entry.agentId,
+        permissions: entry.permissions,
+        createdAt: entry.createdAt,
+        updatedAt: entry.updatedAt,
+      }))
+      .sort((a, b) => a.teamName.localeCompare(b.teamName));
+  }
+
+  async save(accountId: string, key: LoopKeyInput): Promise<{ created: boolean }> {
+    const env = this.readAll();
+    const account = env[accountId] ?? {};
+    const prev = account[key.teamName];
+    const now = new Date().toISOString();
+    const encryptedKey = encryptWith(key.apiKey, this.keyFilePath, LABEL);
+    account[key.teamName] = {
+      encryptedKey,
+      teamAddress: key.teamAddress,
+      agentId: key.agentId,
+      permissions: key.permissions,
+      createdAt: prev?.createdAt ?? now,
+      updatedAt: now,
+    };
+    env[accountId] = account;
+    this.writeAll(env);
+    return { created: !prev };
+  }
+
+  async delete(accountId: string, teamName: string): Promise<boolean> {
+    const env = this.readAll();
+    const account = env[accountId];
+    if (!account || !(teamName in account)) return false;
+    delete account[teamName];
+    if (Object.keys(account).length === 0) delete env[accountId];
+    else env[accountId] = account;
+    this.writeAll(env);
+    return true;
+  }
+}
+
+let cached: LoopKeyStore | null = null;
+
+export function selectLoopKeyStore(): LoopKeyStore {
+  if (cached) return cached;
+  cached = process.env.LOOP_STANDALONE === "1" ? new FileLoopKeyStore() : new Neo4jLoopKeyStore();
+  return cached;
+}
+
+export function _resetKeyStoreForTests(): void {
+  cached = null;
+}

package/payload/premium-plugins/real-agent/plugins/loop/mcp/src/lib/loop-api.ts

@@ -1,5 +1,4 @@
-import { getSession } from "./neo4j.js";
-import { decrypt } from "./crypto.js";
+import { selectLoopKeyStore } from "./key-store.js";
 
 // ─────────────────────────────────────────────────────────────────
 // Loop API V2 HTTP Client + Cross-Team Aggregation Engine
@@ -90,7 +89,7 @@ function unwrapEnvelope<T>(parsed: unknown, toolName: string, teamName: string):
 
 export interface LoopTeamKey {
   teamName: string;
-  encryptedKey: string;
+  apiKey: string;
   teamAddress: string;
   agentId: string;
   permissions: string[];
@@ -120,29 +119,7 @@ export interface AggregationResult<T> {
  * Load all LoopTeamKey nodes for an account from Neo4j.
  */
 export async function loadTeamKeys(accountId: string): Promise<LoopTeamKey[]> {
-  const session = getSession();
-  try {
-    const result = await session.run(
-      `MATCH (k:LoopTeamKey {accountId: $accountId})
-       RETURN k.teamName AS teamName, k.encryptedKey AS encryptedKey,
-              k.teamAddress AS teamAddress, k.agentId AS agentId,
-              k.permissions AS permissions, k.createdAt AS createdAt,
-              k.updatedAt AS updatedAt
-       ORDER BY k.teamName`,
-      { accountId }
-    );
-    return result.records.map((r) => ({
-      teamName: r.get("teamName"),
-      encryptedKey: r.get("encryptedKey"),
-      teamAddress: r.get("teamAddress") ?? "",
-      agentId: r.get("agentId") ?? "",
-      permissions: r.get("permissions") ?? [],
-      createdAt: r.get("createdAt") ?? "",
-      updatedAt: r.get("updatedAt") ?? "",
-    }));
-  } finally {
-    await session.close();
-  }
+  return selectLoopKeyStore().loadAll(accountId);
 }
 
 // Truncate to 200 chars, escape newlines, single line — `[loop] <tool> team=<t>
@@ -396,20 +373,7 @@ export async function aggregateAcrossTeams<T>(
       continue;
     }
 
-    let apiKey: string;
-    try {
-      apiKey = decrypt(key.encryptedKey);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(`[loop] decrypt failed for team=${key.teamName}: ${msg}`);
-      failures.push({
-        teamName: key.teamName,
-        reason: "Decryption failed",
-        kind: "other",
-      });
-      continue;
-    }
-
+    const apiKey = key.apiKey;
     const teamName = key.teamName;
     tasks.push({
       key,
@@ -512,8 +476,7 @@ export async function withTeamKey<T>(
     );
   }
 
-  const apiKey = decrypt(key.encryptedKey);
-  return execute(apiKey);
+  return execute(key.apiKey);
 }
 
 /**

package/payload/premium-plugins/real-agent/plugins/loop/mcp/src/tools/key-deregister.ts

@@ -1,27 +1,12 @@
-import { getSession } from "../lib/neo4j.js";
+import { selectLoopKeyStore } from "../lib/key-store.js";
 
 export async function keyDeregister(params: {
   teamName: string;
   accountId: string;
 }): Promise<void> {
-  const { teamName, accountId } = params;
-
-  const session = getSession();
-  try {
-    const result = await session.run(
-      `MATCH (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
-       DELETE k
-       RETURN count(k) AS deleted`,
-      { teamName, accountId }
-    );
-
-    const deleted = result.records[0]?.get("deleted")?.toNumber?.() ?? 0;
-    if (deleted === 0) {
-      throw new Error(`Team "${teamName}" not found.`);
-    }
-  } finally {
-    await session.close();
+  const deleted = await selectLoopKeyStore().delete(params.accountId, params.teamName);
+  if (!deleted) {
+    throw new Error(`Team "${params.teamName}" not found.`);
   }
-
-  console.error(`[loop] key-deregister team=${teamName} account=${accountId}`);
+  console.error(`[loop] key-deregister team=${params.teamName} account=${params.accountId}`);
 }

package/payload/premium-plugins/real-agent/plugins/loop/mcp/src/tools/key-register.ts

@@ -1,5 +1,4 @@
-import { getSession } from "../lib/neo4j.js";
-import { encrypt } from "../lib/crypto.js";
+import { selectLoopKeyStore } from "../lib/key-store.js";
 import { loopGet, LoopApiError } from "../lib/loop-api.js";
 
 interface LoopTeamResponse {
@@ -21,7 +20,7 @@ export async function keyRegister(params: {
   const { teamName, apiKey, accountId } = params;
   const permissions = params.permissions ?? ALL_PERMISSIONS;
 
-  // Validate key against Loop API — try /team endpoint
+  // Validate key against Loop API — try /team endpoint.
   let teamAddress = "";
   let agentId = "";
   let warning: string | undefined;
@@ -31,11 +30,10 @@ export async function keyRegister(params: {
       apiKey,
       "/team",
       "loop-key-register",
-      teamName
+      teamName,
     );
 
     if (Array.isArray(teamData) && teamData.length === 0) {
-      // 204 was converted to empty array — ambiguous scope
       warning =
         "Key accepted but Loop returned no team data (204). " +
         "Verify the key's scope in Loop's dashboard.";
@@ -47,49 +45,26 @@ export async function keyRegister(params: {
     if (err instanceof LoopApiError && err.status === 401) {
       throw new Error(
         `Loop API rejected the key for team "${teamName}" (HTTP 401). ` +
-        `Check that the key is valid and not expired.`
+          `Check that the key is valid and not expired.`,
       );
     }
-    // Network/timeout errors — still reject, key is unverified
     throw new Error(
-      `Could not validate key against Loop API: ${err instanceof Error ? err.message : String(err)}`
+      `Could not validate key against Loop API: ${err instanceof Error ? err.message : String(err)}`,
     );
   }
 
-  // Encrypt and store
-  const encryptedKey = encrypt(apiKey);
-  const now = new Date().toISOString();
+  const { created } = await selectLoopKeyStore().save(accountId, {
+    teamName,
+    apiKey,
+    teamAddress,
+    agentId,
+    permissions,
+  });
 
-  const writeSession = getSession();
-  try {
-    await writeSession.run(
-      `CREATE INDEX loop_team_key_account_team IF NOT EXISTS
-       FOR (k:LoopTeamKey) ON (k.accountId, k.teamName)`,
-      {}
-    );
-
-    const mergeResult = await writeSession.run(
-      `MERGE (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
-       ON CREATE SET
-         k.encryptedKey = $encryptedKey,
-         k.teamAddress = $teamAddress,
-         k.agentId = $agentId,
-         k.permissions = $permissions,
-         k.createdAt = $now,
-         k.updatedAt = $now
-       RETURN k.createdAt = $now AS created`,
-      { teamName, encryptedKey, teamAddress, agentId, accountId, permissions, now }
-    );
-
-    const created = mergeResult.records[0]?.get("created");
-    if (!created) {
-      throw new Error(`Team "${teamName}" is already registered for this account.`);
-    }
-  } finally {
-    await writeSession.close();
+  if (!created) {
+    throw new Error(`Team "${teamName}" is already registered for this account.`);
   }
 
   console.error(`[loop] key-register team=${teamName} account=${accountId}`);
-
   return { warning };
 }

package/payload/premium-plugins/real-agent/plugins/preval/.claude-plugin/plugin.json

@@ -0,0 +1,8 @@
+{
+  "name": "real-agent-preval",
+  "description": "Single-address pre-valuation pack. One full UK address in, 4-page A4 PDF out (cover · valuation · area · demand+trend+sources). Consumes the real-agent-property-data MCP — no MCP tools of its own.",
+  "version": "0.1.0",
+  "author": {
+    "name": "Rubytech LLC"
+  }
+}

package/payload/premium-plugins/real-agent/plugins/preval/PLUGIN.md

@@ -0,0 +1,39 @@
+---
+name: real-agent-preval
+description: "Single-address pre-valuation pack. One full UK address in, 4-page A4 PDF out (cover · valuation · area · demand+trend+sources). Consumes the real-agent-property-data MCP — no MCP tools of its own."
+skills:
+  - skills/property-preval/SKILL.md
+always: false
+metadata: {"platform":{"optional":true,"embed":["admin"]}}
+---
+
+# Real Agent — Preval
+
+Consumer sub-plugin. No MCP server, no new tools — only a skill (`property-preval`) that takes one full UK address and renders a 4-page A4 pre-valuation PDF by fanning out to 12 of the 22 `real-agent-property-data` MCP tools.
+
+## What it produces
+
+A 4-page A4 PDF and the source HTML, written to `~/Documents/Maxy/preval/<postcode>-<YYYY-MM-DD>/`:
+
+- **Page 1 — Cover.** Full address, postcode chip, generated-date meta strip.
+- **Page 2 — Valuation.** Average asking £, asking £/sqft, sold avg £, sold £/sqft. Nearest-sold comps table. Live asking comps grid.
+- **Page 3 — Area.** Crime rating, flood risk, council-tax band D cost, local area population. Crime breakdown panel + council-tax band table. Headline read.
+- **Page 4 — Demand, trend, sources.** Demand rating, days-on-market, turnover, for-sale count. 7y growth sparkline (£ and £/sqft). Rental-side mini-panel. Property-types doughnut. Sources/methodology block.
+
+## How the address routes
+
+The skill derives the postcode from the address (UK-postcode regex on the final token group), then fans out to **12** `real-agent-property-data` MCP tools in fixed call order:
+
+`prices`, `prices-per-sqf`, `sold-prices`, `sold-prices-per-sqf`, `growth`, `growth-psf`, `demand`, `demand-rent`, `property-types`, `crime`, `flood-risk`, `council-tax`.
+
+Two tools from the same MCP are **deliberately not called** by this skill:
+
+- `property-data-address-match-uprn` — UPRN is CRM hygiene, not preval data.
+- `property-data-planning-applications` — planning is a separate dev-precedent report.
+
+Operators can still reach those tools via the underlying `property-data` skill or directly through the MCP.
+
+## Dependencies
+
+- Requires `real-agent-property-data` enabled on the account with a registered PropertyData API key (`property-data-key-register`). Without a key every fan-out call returns `Error: key-not-registered` and the renderer raises before producing a PDF.
+- Requires Google Chrome at `/Applications/Google Chrome.app/Contents/MacOS/Google Chrome` (mac, headless `--print-to-pdf`). Same Chrome dependency as `property-market-report`.

package/payload/premium-plugins/real-agent/plugins/preval/skills/property-preval/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: property-preval
+description: Use when an operator asks for a pre-valuation pack for a single UK property — input is one full UK address, output is a 4-page A4 PDF covering valuation, area, and demand/trend. Triggers include "preval <address>", "pre-valuation for <address>", "what's <address> worth", "valuation pack for <address>", "market and area report for <address>".
+---
+
+# Property Preval
+
+Outcome: turn **one full UK address** into a 4-page A4 pre-valuation PDF the operator can send to a vendor before the appraisal visit. The skill owns the fan-out and the render; the operator supplies only the address.
+
+## Input
+
+A single string — the full UK address, ending in a valid UK postcode. Examples:
+
+- `47 Phoenix Drive, Bishop's Stortford, CM23 2UJ`
+- `Flat 3, 122 Kensington High Street, London, W8 4SG`
+
+The skill derives the postcode by matching the UK postcode regex on the final token group. If no postcode is matched, the skill stops and asks the operator for one.
+
+## Output
+
+A directory under `~/Documents/Maxy/preval/<postcode-compact>-<YYYY-MM-DD>/` containing:
+
+- `index.html` — single self-contained file.
+- `<slug>-<date>.pdf` — exactly 4 A4 pages. If `mdls -name kMDItemNumberOfPages` returns ≠ 4, the renderer raises rather than ship an overflowing report.
+
+Return the PDF path to the operator.
+
+## Tools the skill calls (in order)
+
+Fan-out is fixed at **12** `real-agent-property-data` MCP tools, keyed on the derived postcode (and address attributes where the tool needs them):
+
+1. `property-data-prices` — asking £ distribution + raw asking comps.
+2. `property-data-prices-per-sqf` — asking £/sqft.
+3. `property-data-sold-prices` — Land Registry sold transactions + raw sold comps.
+4. `property-data-sold-prices-per-sqf` — achieved £/sqft.
+5. `property-data-growth` — 7y price series.
+6. `property-data-growth-psf` — 7y £/sqft series.
+7. `property-data-demand` — for-sale, sales/mo, turnover, MoI, DoM, demand rating.
+8. `property-data-demand-rent` — rental-side demand pillar.
+9. `property-data-property-types` — mix doughnut (detached / semi / terraced / flat).
+10. `property-data-crime` — area crime rating + breakdown.
+11. `property-data-flood-risk` — area flood risk (full postcode only).
+12. `property-data-council-tax` — band D cost + per-property bands (full postcode only).
+
+## Tools the skill deliberately does NOT call
+
+- `property-data-address-match-uprn` — UPRN is CRM hygiene, not preval data.
+- `property-data-planning-applications` — planning is a separate dev-precedent report.
+
+Both remain available via the underlying `property-data` skill; preval omits them to keep the output focused and the credit cost at 12 per pack.
+
+## How to execute
+
+1. Match the postcode out of the address (`/[A-Z]{1,2}[0-9][A-Z0-9]?\s?[0-9][A-Z]{2}/i`). Stop and ask if no match.
+2. Run the 12 fan-out tools in the order above. Any `Error: key-not-registered` aborts the run — surface the registration prompt and stop.
+3. Assemble the `inputs.json` shape per `references/template-inputs.schema.json`.
+4. Run `python3 references/render.py inputs.json`. The renderer fills the template, writes the HTML, drives Chrome `--print-to-pdf`, and asserts page count = 4.
+5. Return the PDF path.
+
+## Observability
+
+Emit at start: `[preval] start address="<addr>" postcode=<pc>`.
+Emit at done:  `[preval] done pdf=<path> pages=<n> ms=<n>`.
+
+Each of the 12 fan-out calls produces its own `[property-data] tool=<name>` line in `server.log` (inherited contract — no new instrumentation).
+
+## Failure signatures
+
+- `pages=5` (or anything ≠ 4) in the `done` line → template overflow on one page. Diagnose with `pdftoppm -png -f 5 -l 5 <pdf>` to see which content bled, then trim that panel's padding.
+- `start` with no matching `done` within 60s → renderer crashed. Inspect with `grep -B2 -A20 '\[preval\] start address="<echoed>"' server.log`.
+- Wrong postcode derivation → check `grep '\[preval\] start' server.log | awk -F'postcode=' '{print $2}' | sort -u`; the regex must keep the inward part of the postcode (e.g. `CM23 2UJ`, not `CM23`).
+
+## Out of scope
+
+- Multi-address batch preval (CSV in → many PDFs out) — separate skill if needed.
+- Loop CRM auto-publish of the PDF onto a contact's record — separate skill.
+- A hero image on the cover via `property-socials` — preval cover is text-only by design.
+- Caching of MCP responses — 12 credits per pack is acceptable; cost optimisation is a Task 144B concern.