@rubytech/create-maxy-code 0.1.59 → 0.1.60

package/payload/platform/plugins/loop/mcp/dist/tools/key-register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"key-register.d.ts","sourceRoot":"","sources":["../../src/tools/key-register.ts"],"names":[],"mappings":"AAcA,wBAAsB,WAAW,CAAC,MAAM,EAAE;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA2EhC"}
+{"version":3,"file":"key-register.d.ts","sourceRoot":"","sources":["../../src/tools/key-register.ts"],"names":[],"mappings":"AAaA,wBAAsB,WAAW,CAAC,MAAM,EAAE;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAmDhC"}

package/payload/platform/plugins/loop/mcp/dist/tools/key-register.js

@@ -1,18 +1,16 @@
-import { getSession } from "../lib/neo4j.js";
-import { encrypt } from "../lib/crypto.js";
+import { selectLoopKeyStore } from "../lib/key-store.js";
 import { loopGet, LoopApiError } from "../lib/loop-api.js";
 const ALL_PERMISSIONS = ["properties", "people", "viewings", "feedback", "team", "marketing", "customer", "supplier"];
 export async function keyRegister(params) {
     const { teamName, apiKey, accountId } = params;
     const permissions = params.permissions ?? ALL_PERMISSIONS;
-    // Validate key against Loop API — try /team endpoint
+    // Validate key against Loop API — try /team endpoint.
     let teamAddress = "";
     let agentId = "";
     let warning;
     try {
         const teamData = await loopGet(apiKey, "/team", "loop-key-register", teamName);
         if (Array.isArray(teamData) && teamData.length === 0) {
-            // 204 was converted to empty array — ambiguous scope
             warning =
                 "Key accepted but Loop returned no team data (204). " +
                     "Verify the key's scope in Loop's dashboard.";
@@ -27,32 +25,17 @@ export async function keyRegister(params) {
             throw new Error(`Loop API rejected the key for team "${teamName}" (HTTP 401). ` +
                 `Check that the key is valid and not expired.`);
         }
-        // Network/timeout errors — still reject, key is unverified
         throw new Error(`Could not validate key against Loop API: ${err instanceof Error ? err.message : String(err)}`);
     }
-    // Encrypt and store
-    const encryptedKey = encrypt(apiKey);
-    const now = new Date().toISOString();
-    const writeSession = getSession();
-    try {
-        await writeSession.run(`CREATE INDEX loop_team_key_account_team IF NOT EXISTS
-       FOR (k:LoopTeamKey) ON (k.accountId, k.teamName)`, {});
-        const mergeResult = await writeSession.run(`MERGE (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
-       ON CREATE SET
-         k.encryptedKey = $encryptedKey,
-         k.teamAddress = $teamAddress,
-         k.agentId = $agentId,
-         k.permissions = $permissions,
-         k.createdAt = $now,
-         k.updatedAt = $now
-       RETURN k.createdAt = $now AS created`, { teamName, encryptedKey, teamAddress, agentId, accountId, permissions, now });
-        const created = mergeResult.records[0]?.get("created");
-        if (!created) {
-            throw new Error(`Team "${teamName}" is already registered for this account.`);
-        }
-    }
-    finally {
-        await writeSession.close();
+    const { created } = await selectLoopKeyStore().save(accountId, {
+        teamName,
+        apiKey,
+        teamAddress,
+        agentId,
+        permissions,
+    });
+    if (!created) {
+        throw new Error(`Team "${teamName}" is already registered for this account.`);
     }
     console.error(`[loop] key-register team=${teamName} account=${accountId}`);
     return { warning };

package/payload/platform/plugins/loop/mcp/dist/tools/key-register.js.map

@@ -1 +1 @@
-{"version":3,"file":"key-register.js","sourceRoot":"","sources":["../../src/tools/key-register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAU3D,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAEtH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAKjC;IACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,eAAe,CAAC;IAE1D,qDAAqD;IACrD,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,OAA2B,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,MAAM,EACN,OAAO,EACP,mBAAmB,EACnB,QAAQ,CACT,CAAC;QAEF,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,qDAAqD;YACrD,OAAO;gBACL,qDAAqD;oBACrD,6CAA6C,CAAC;QAClD,CAAC;aAAM,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpD,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,uCAAuC,QAAQ,gBAAgB;gBAC/D,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QACD,2DAA2D;QAC3D,MAAM,IAAI,KAAK,CACb,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,GAAG,CACpB;wDACkD,EAClD,EAAE,CACH,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,GAAG,CACxC;;;;;;;;4CAQsC,EACtC,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,CAC9E,CAAC;QAEF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,2CAA2C,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,4BAA4B,QAAQ,YAAY,SAAS,EAAE,CAAC,CAAC;IAE3E,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC"}
+{"version":3,"file":"key-register.js","sourceRoot":"","sources":["../../src/tools/key-register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAU3D,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAEtH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAKjC;IACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,eAAe,CAAC;IAE1D,sDAAsD;IACtD,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,OAA2B,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,MAAM,EACN,OAAO,EACP,mBAAmB,EACnB,QAAQ,CACT,CAAC;QAEF,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,qDAAqD;oBACrD,6CAA6C,CAAC;QAClD,CAAC;aAAM,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpD,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,uCAAuC,QAAQ,gBAAgB;gBAC7D,8CAA8C,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAkB,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE;QAC7D,QAAQ;QACR,MAAM;QACN,WAAW;QACX,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,2CAA2C,CAAC,CAAC;IAChF,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,4BAA4B,QAAQ,YAAY,SAAS,EAAE,CAAC,CAAC;IAC3E,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC"}

package/payload/platform/plugins/loop/mcp/src/index.ts

@@ -1,5 +1,5 @@
-import { initStderrTee } from "../../../../../../platform/lib/mcp-stderr-tee/dist/index.js";
-initStderrTee("loop");
+// Logging-tee was a platform-wrapper concern; the host owns the stderr pipe
+// in both platform and standalone (Claude Code native) spawn paths.
 
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -29,11 +29,11 @@ import { autoResponder } from "./tools/auto-responder.js";
 import { customerPreferences } from "./tools/customer-preferences.js";
 import { supplier } from "./tools/supplier.js";
 import { closeDriver } from "./lib/neo4j.js";
+import { selectLoopKeyStore } from "./lib/key-store.js";
 
-const accountId = process.env.ACCOUNT_ID;
-if (!accountId) {
-  throw new Error("ACCOUNT_ID environment variable is required");
-}
+// ACCOUNT_ID is the platform's tenant id; "local" is the single-tenant
+// standalone stand-in when spawned natively by Claude Code.
+const accountId = process.env.ACCOUNT_ID ?? "local";
 
 const server = new McpServer({
   name: "maxy-loop",
@@ -45,7 +45,10 @@ const ALL_PERMISSIONS = z.enum([
   "marketing", "customer", "supplier",
 ]);
 
-console.error(`[loop] server started, account=${accountId}`);
+const store = selectLoopKeyStore();
+console.error(
+  `[loop] server started, account=${accountId} backend=${store.backendName} path=${store.backendPath}`,
+);
 
 // Helper: wrap a tool function in standard error handling
 function toolHandler(fn: (p: Record<string, unknown>) => Promise<string>) {

package/payload/platform/plugins/loop/mcp/src/lib/file-crypto.ts

@@ -0,0 +1,54 @@
+import { randomBytes, createCipheriv, createDecipheriv } from "node:crypto";
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+
+// Standalone-mode crypto — see property-data's file-crypto.ts for the
+// shape and rationale. The two are duplicated rather than shared because
+// the MCPs are independent npm workspaces with no shared lib.
+
+const ALGORITHM = "aes-256-gcm";
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+
+function loadOrGenerateKey(keyFilePath: string, label: string): Buffer {
+  if (existsSync(keyFilePath)) {
+    const hex = readFileSync(keyFilePath, "utf-8").trim();
+    const buf = Buffer.from(hex, "hex");
+    if (buf.length !== KEY_LENGTH) {
+      throw new Error(
+        `[${label}] encryption key at ${keyFilePath} is ${buf.length} bytes, expected ${KEY_LENGTH}.`,
+      );
+    }
+    return buf;
+  }
+  const key = randomBytes(KEY_LENGTH);
+  writeFileSync(keyFilePath, key.toString("hex"), { mode: 0o600 });
+  console.error(`[${label}] encryption key generated at ${keyFilePath}`);
+  return key;
+}
+
+export function encryptWith(plaintext: string, keyFilePath: string, label: string): string {
+  const key = loadOrGenerateKey(keyFilePath, label);
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+  let encrypted = cipher.update(plaintext, "utf-8", "hex");
+  encrypted += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return `${iv.toString("hex")}:${encrypted}:${authTag}`;
+}
+
+export function decryptWith(encryptedValue: string, keyFilePath: string, label: string): string {
+  const parts = encryptedValue.split(":");
+  if (parts.length !== 3) {
+    throw new Error(`[${label}] bad encrypted envelope (expected iv:ct:tag)`);
+  }
+  const key = loadOrGenerateKey(keyFilePath, label);
+  const iv = Buffer.from(parts[0], "hex");
+  const ciphertext = parts[1];
+  const authTag = Buffer.from(parts[2], "hex");
+  const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+  decipher.setAuthTag(authTag);
+  let plaintext = decipher.update(ciphertext, "hex", "utf-8");
+  plaintext += decipher.final("utf-8");
+  return plaintext;
+}

package/payload/platform/plugins/loop/mcp/src/lib/key-store.ts

@@ -0,0 +1,221 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { homedir } from "node:os";
+import { getSession } from "./neo4j.js";
+import { encrypt, decrypt } from "./crypto.js";
+import { encryptWith, decryptWith } from "./file-crypto.js";
+
+// Storage abstraction so the same MCP body runs against Neo4j (platform mode)
+// or an on-disk encrypted file (standalone mode, spawned by Claude Code from
+// ~/.claude/). Selected by LOOP_STANDALONE at boot. Loop is multi-team — each
+// account can register many team keys — so the file backend stores a nested
+// map and the store API mirrors that.
+
+export interface LoopStoredKey {
+  teamName: string;
+  apiKey: string;
+  teamAddress: string;
+  agentId: string;
+  permissions: string[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+export type LoopKeyInput = Omit<LoopStoredKey, "createdAt" | "updatedAt">;
+
+export interface LoopKeyStore {
+  readonly backendName: string;
+  readonly backendPath: string;
+  loadAll(accountId: string): Promise<LoopStoredKey[]>;
+  save(accountId: string, key: LoopKeyInput): Promise<{ created: boolean }>;
+  delete(accountId: string, teamName: string): Promise<boolean>;
+}
+
+class Neo4jLoopKeyStore implements LoopKeyStore {
+  readonly backendName = "neo4j";
+  readonly backendPath = process.env.NEO4J_URI ?? "<unset>";
+
+  async loadAll(accountId: string): Promise<LoopStoredKey[]> {
+    const session = getSession();
+    try {
+      const result = await session.run(
+        `MATCH (k:LoopTeamKey {accountId: $accountId})
+         RETURN k.teamName AS teamName, k.encryptedKey AS encryptedKey,
+                k.teamAddress AS teamAddress, k.agentId AS agentId,
+                k.permissions AS permissions, k.createdAt AS createdAt,
+                k.updatedAt AS updatedAt
+         ORDER BY k.teamName`,
+        { accountId },
+      );
+      return result.records.map((r) => ({
+        teamName: r.get("teamName"),
+        apiKey: decrypt(r.get("encryptedKey")),
+        teamAddress: r.get("teamAddress") ?? "",
+        agentId: r.get("agentId") ?? "",
+        permissions: r.get("permissions") ?? [],
+        createdAt: r.get("createdAt") ?? "",
+        updatedAt: r.get("updatedAt") ?? "",
+      }));
+    } finally {
+      await session.close();
+    }
+  }
+
+  async save(accountId: string, key: LoopKeyInput): Promise<{ created: boolean }> {
+    const encryptedKey = encrypt(key.apiKey);
+    const now = new Date().toISOString();
+    const session = getSession();
+    try {
+      await session.run(
+        `CREATE INDEX loop_team_key_account_team IF NOT EXISTS
+         FOR (k:LoopTeamKey) ON (k.accountId, k.teamName)`,
+        {},
+      );
+      const result = await session.run(
+        `MERGE (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
+         ON CREATE SET
+           k.encryptedKey = $encryptedKey,
+           k.teamAddress = $teamAddress,
+           k.agentId = $agentId,
+           k.permissions = $permissions,
+           k.createdAt = $now,
+           k.updatedAt = $now
+         RETURN k.createdAt = $now AS created`,
+        {
+          teamName: key.teamName,
+          encryptedKey,
+          teamAddress: key.teamAddress,
+          agentId: key.agentId,
+          accountId,
+          permissions: key.permissions,
+          now,
+        },
+      );
+      return { created: Boolean(result.records[0]?.get("created")) };
+    } finally {
+      await session.close();
+    }
+  }
+
+  async delete(accountId: string, teamName: string): Promise<boolean> {
+    const session = getSession();
+    try {
+      const result = await session.run(
+        `MATCH (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
+         DELETE k
+         RETURN count(k) AS deleted`,
+        { teamName, accountId },
+      );
+      const deleted = result.records[0]?.get("deleted")?.toNumber?.() ?? 0;
+      return deleted > 0;
+    } finally {
+      await session.close();
+    }
+  }
+}
+
+const LABEL = "loop";
+
+interface FileEnvelope {
+  [accountId: string]: {
+    [teamName: string]: {
+      encryptedKey: string;
+      teamAddress: string;
+      agentId: string;
+      permissions: string[];
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
+}
+
+class FileLoopKeyStore implements LoopKeyStore {
+  readonly backendName = "file";
+  readonly backendPath: string;
+  private readonly storePath: string;
+  private readonly keyFilePath: string;
+
+  constructor() {
+    const home = homedir();
+    this.storePath = resolve(home, ".claude/.realagent-loop-key.enc");
+    this.keyFilePath = resolve(home, ".claude/.realagent-loop-encryption-key");
+    this.backendPath = this.storePath;
+  }
+
+  private ensureDir(): void {
+    mkdirSync(dirname(this.storePath), { recursive: true });
+  }
+
+  private readAll(): FileEnvelope {
+    if (!existsSync(this.storePath)) return {};
+    const blob = readFileSync(this.storePath, "utf-8").trim();
+    if (!blob) return {};
+    const json = decryptWith(blob, this.keyFilePath, LABEL);
+    return JSON.parse(json) as FileEnvelope;
+  }
+
+  private writeAll(env: FileEnvelope): void {
+    this.ensureDir();
+    const blob = encryptWith(JSON.stringify(env), this.keyFilePath, LABEL);
+    writeFileSync(this.storePath, blob, { mode: 0o600 });
+  }
+
+  async loadAll(accountId: string): Promise<LoopStoredKey[]> {
+    const env = this.readAll();
+    const account = env[accountId];
+    if (!account) return [];
+    return Object.entries(account)
+      .map(([teamName, entry]) => ({
+        teamName,
+        apiKey: decryptWith(entry.encryptedKey, this.keyFilePath, LABEL),
+        teamAddress: entry.teamAddress,
+        agentId: entry.agentId,
+        permissions: entry.permissions,
+        createdAt: entry.createdAt,
+        updatedAt: entry.updatedAt,
+      }))
+      .sort((a, b) => a.teamName.localeCompare(b.teamName));
+  }
+
+  async save(accountId: string, key: LoopKeyInput): Promise<{ created: boolean }> {
+    const env = this.readAll();
+    const account = env[accountId] ?? {};
+    const prev = account[key.teamName];
+    const now = new Date().toISOString();
+    const encryptedKey = encryptWith(key.apiKey, this.keyFilePath, LABEL);
+    account[key.teamName] = {
+      encryptedKey,
+      teamAddress: key.teamAddress,
+      agentId: key.agentId,
+      permissions: key.permissions,
+      createdAt: prev?.createdAt ?? now,
+      updatedAt: now,
+    };
+    env[accountId] = account;
+    this.writeAll(env);
+    return { created: !prev };
+  }
+
+  async delete(accountId: string, teamName: string): Promise<boolean> {
+    const env = this.readAll();
+    const account = env[accountId];
+    if (!account || !(teamName in account)) return false;
+    delete account[teamName];
+    if (Object.keys(account).length === 0) delete env[accountId];
+    else env[accountId] = account;
+    this.writeAll(env);
+    return true;
+  }
+}
+
+let cached: LoopKeyStore | null = null;
+
+export function selectLoopKeyStore(): LoopKeyStore {
+  if (cached) return cached;
+  cached = process.env.LOOP_STANDALONE === "1" ? new FileLoopKeyStore() : new Neo4jLoopKeyStore();
+  return cached;
+}
+
+export function _resetKeyStoreForTests(): void {
+  cached = null;
+}

package/payload/platform/plugins/loop/mcp/src/lib/loop-api.ts

@@ -1,5 +1,4 @@
-import { getSession } from "./neo4j.js";
-import { decrypt } from "./crypto.js";
+import { selectLoopKeyStore } from "./key-store.js";
 
 // ─────────────────────────────────────────────────────────────────
 // Loop API V2 HTTP Client + Cross-Team Aggregation Engine
@@ -90,7 +89,7 @@ function unwrapEnvelope<T>(parsed: unknown, toolName: string, teamName: string):
 
 export interface LoopTeamKey {
   teamName: string;
-  encryptedKey: string;
+  apiKey: string;
   teamAddress: string;
   agentId: string;
   permissions: string[];
@@ -120,29 +119,7 @@ export interface AggregationResult<T> {
  * Load all LoopTeamKey nodes for an account from Neo4j.
  */
 export async function loadTeamKeys(accountId: string): Promise<LoopTeamKey[]> {
-  const session = getSession();
-  try {
-    const result = await session.run(
-      `MATCH (k:LoopTeamKey {accountId: $accountId})
-       RETURN k.teamName AS teamName, k.encryptedKey AS encryptedKey,
-              k.teamAddress AS teamAddress, k.agentId AS agentId,
-              k.permissions AS permissions, k.createdAt AS createdAt,
-              k.updatedAt AS updatedAt
-       ORDER BY k.teamName`,
-      { accountId }
-    );
-    return result.records.map((r) => ({
-      teamName: r.get("teamName"),
-      encryptedKey: r.get("encryptedKey"),
-      teamAddress: r.get("teamAddress") ?? "",
-      agentId: r.get("agentId") ?? "",
-      permissions: r.get("permissions") ?? [],
-      createdAt: r.get("createdAt") ?? "",
-      updatedAt: r.get("updatedAt") ?? "",
-    }));
-  } finally {
-    await session.close();
-  }
+  return selectLoopKeyStore().loadAll(accountId);
 }
 
 // Truncate to 200 chars, escape newlines, single line — `[loop] <tool> team=<t>
@@ -396,20 +373,7 @@ export async function aggregateAcrossTeams<T>(
       continue;
     }
 
-    let apiKey: string;
-    try {
-      apiKey = decrypt(key.encryptedKey);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(`[loop] decrypt failed for team=${key.teamName}: ${msg}`);
-      failures.push({
-        teamName: key.teamName,
-        reason: "Decryption failed",
-        kind: "other",
-      });
-      continue;
-    }
-
+    const apiKey = key.apiKey;
     const teamName = key.teamName;
     tasks.push({
       key,
@@ -512,8 +476,7 @@ export async function withTeamKey<T>(
     );
   }
 
-  const apiKey = decrypt(key.encryptedKey);
-  return execute(apiKey);
+  return execute(key.apiKey);
 }
 
 /**

package/payload/platform/plugins/loop/mcp/src/tools/key-deregister.ts

@@ -1,27 +1,12 @@
-import { getSession } from "../lib/neo4j.js";
+import { selectLoopKeyStore } from "../lib/key-store.js";
 
 export async function keyDeregister(params: {
   teamName: string;
   accountId: string;
 }): Promise<void> {
-  const { teamName, accountId } = params;
-
-  const session = getSession();
-  try {
-    const result = await session.run(
-      `MATCH (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
-       DELETE k
-       RETURN count(k) AS deleted`,
-      { teamName, accountId }
-    );
-
-    const deleted = result.records[0]?.get("deleted")?.toNumber?.() ?? 0;
-    if (deleted === 0) {
-      throw new Error(`Team "${teamName}" not found.`);
-    }
-  } finally {
-    await session.close();
+  const deleted = await selectLoopKeyStore().delete(params.accountId, params.teamName);
+  if (!deleted) {
+    throw new Error(`Team "${params.teamName}" not found.`);
   }
-
-  console.error(`[loop] key-deregister team=${teamName} account=${accountId}`);
+  console.error(`[loop] key-deregister team=${params.teamName} account=${params.accountId}`);
 }

package/payload/platform/plugins/loop/mcp/src/tools/key-register.ts

@@ -1,5 +1,4 @@
-import { getSession } from "../lib/neo4j.js";
-import { encrypt } from "../lib/crypto.js";
+import { selectLoopKeyStore } from "../lib/key-store.js";
 import { loopGet, LoopApiError } from "../lib/loop-api.js";
 
 interface LoopTeamResponse {
@@ -21,7 +20,7 @@ export async function keyRegister(params: {
   const { teamName, apiKey, accountId } = params;
   const permissions = params.permissions ?? ALL_PERMISSIONS;
 
-  // Validate key against Loop API — try /team endpoint
+  // Validate key against Loop API — try /team endpoint.
   let teamAddress = "";
   let agentId = "";
   let warning: string | undefined;
@@ -31,11 +30,10 @@ export async function keyRegister(params: {
       apiKey,
       "/team",
       "loop-key-register",
-      teamName
+      teamName,
     );
 
     if (Array.isArray(teamData) && teamData.length === 0) {
-      // 204 was converted to empty array — ambiguous scope
       warning =
         "Key accepted but Loop returned no team data (204). " +
         "Verify the key's scope in Loop's dashboard.";
@@ -47,49 +45,26 @@ export async function keyRegister(params: {
     if (err instanceof LoopApiError && err.status === 401) {
       throw new Error(
         `Loop API rejected the key for team "${teamName}" (HTTP 401). ` +
-        `Check that the key is valid and not expired.`
+          `Check that the key is valid and not expired.`,
       );
     }
-    // Network/timeout errors — still reject, key is unverified
     throw new Error(
-      `Could not validate key against Loop API: ${err instanceof Error ? err.message : String(err)}`
+      `Could not validate key against Loop API: ${err instanceof Error ? err.message : String(err)}`,
     );
   }
 
-  // Encrypt and store
-  const encryptedKey = encrypt(apiKey);
-  const now = new Date().toISOString();
+  const { created } = await selectLoopKeyStore().save(accountId, {
+    teamName,
+    apiKey,
+    teamAddress,
+    agentId,
+    permissions,
+  });
 
-  const writeSession = getSession();
-  try {
-    await writeSession.run(
-      `CREATE INDEX loop_team_key_account_team IF NOT EXISTS
-       FOR (k:LoopTeamKey) ON (k.accountId, k.teamName)`,
-      {}
-    );
-
-    const mergeResult = await writeSession.run(
-      `MERGE (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
-       ON CREATE SET
-         k.encryptedKey = $encryptedKey,
-         k.teamAddress = $teamAddress,
-         k.agentId = $agentId,
-         k.permissions = $permissions,
-         k.createdAt = $now,
-         k.updatedAt = $now
-       RETURN k.createdAt = $now AS created`,
-      { teamName, encryptedKey, teamAddress, agentId, accountId, permissions, now }
-    );
-
-    const created = mergeResult.records[0]?.get("created");
-    if (!created) {
-      throw new Error(`Team "${teamName}" is already registered for this account.`);
-    }
-  } finally {
-    await writeSession.close();
+  if (!created) {
+    throw new Error(`Team "${teamName}" is already registered for this account.`);
   }
 
   console.error(`[loop] key-register team=${teamName} account=${accountId}`);
-
   return { warning };
 }

package/payload/platform/plugins/property-data/PLUGIN.md

@@ -87,7 +87,20 @@ Local stdio MCP that proxies the PropertyData UK market-analytics HTTP API (prop
 
 ## Security
 
-The PropertyData API key is encrypted at rest with AES-256-GCM. Encryption key lives at `~/<configDir>/.property-data-encryption-key` with mode `0600`. Never include the key value in responses; identify the key by registration timestamp only. If the operator asks for the key value, explain that keys are encrypted and cannot be retrieved — they must be re-registered from the PropertyData dashboard.
+The PropertyData API key is encrypted at rest with AES-256-GCM. The encryption-key file lives at `~/<configDir>/.property-data-encryption-key` (platform mode) or `~/.claude/.realagent-property-data-encryption-key` (standalone mode), both with mode `0600`. Never include the key value in responses; identify the key by registration timestamp only. If the operator asks for the key value, explain that keys are encrypted and cannot be retrieved — they must be re-registered from the PropertyData dashboard.
+
+## Standalone mode (`~/.claude/` spawn)
+
+The same `mcp/dist/index.js` boots in two environments, selected by env flag:
+
+| Env var | Platform mode | Standalone mode |
+|---|---|---|
+| `PROPERTY_DATA_STANDALONE` | unset | `"1"` |
+| `ACCOUNT_ID` | platform tenant id | absent (defaults to `"local"`) |
+| `NEO4J_URI` etc. | required | unused |
+| `PROPERTY_DATA_API_KEY` | unused | optional one-shot bypass (skips the store entirely) |
+
+In standalone mode keys live at `~/.claude/.realagent-property-data-key.enc`. See `.docs/realagent-mcps-standalone-mode.md` for the full contract.
 
 ## When to use these tools