@rubytech/create-maxy-code 0.1.59 → 0.1.61

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/src/lib/key-store.ts

@@ -0,0 +1,181 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { homedir } from "node:os";
+import { getSession } from "./neo4j.js";
+import { encrypt, decrypt } from "./crypto.js";
+import { encryptWith, decryptWith } from "./file-crypto.js";
+
+// Storage abstraction so the same MCP body runs against Neo4j (platform mode)
+// or an on-disk encrypted file (standalone mode, e.g. spawned by Claude Code
+// from ~/.claude/). Selected by the PROPERTY_DATA_STANDALONE env flag at
+// boot. See .docs/realagent-mcps-standalone-mode.md for the contract.
+
+export interface StoredKey {
+  apiKey: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface KeyStore {
+  readonly backendName: string;
+  readonly backendPath: string;
+  load(accountId: string): Promise<StoredKey | null>;
+  save(accountId: string, apiKey: string): Promise<void>;
+  delete(accountId: string): Promise<boolean>;
+}
+
+class Neo4jKeyStore implements KeyStore {
+  readonly backendName = "neo4j";
+  readonly backendPath = process.env.NEO4J_URI ?? "<unset>";
+
+  async load(accountId: string): Promise<StoredKey | null> {
+    const session = getSession();
+    try {
+      const result = await session.run(
+        `MATCH (k:PropertyDataKey {accountId: $accountId})
+         RETURN k.encryptedKey AS encryptedKey,
+                k.createdAt AS createdAt,
+                k.updatedAt AS updatedAt`,
+        { accountId },
+      );
+      if (result.records.length === 0) return null;
+      const r = result.records[0];
+      return {
+        apiKey: decrypt(r.get("encryptedKey")),
+        createdAt: r.get("createdAt") ?? "",
+        updatedAt: r.get("updatedAt") ?? "",
+      };
+    } finally {
+      await session.close();
+    }
+  }
+
+  async save(accountId: string, apiKey: string): Promise<void> {
+    const encryptedKey = encrypt(apiKey);
+    const now = new Date().toISOString();
+    const session = getSession();
+    try {
+      await session.run(
+        `CREATE INDEX property_data_key_account IF NOT EXISTS
+         FOR (k:PropertyDataKey) ON (k.accountId)`,
+        {},
+      );
+      await session.run(
+        `MERGE (k:PropertyDataKey {accountId: $accountId})
+         ON CREATE SET k.encryptedKey = $encryptedKey, k.createdAt = $now, k.updatedAt = $now
+         ON MATCH  SET k.encryptedKey = $encryptedKey, k.updatedAt = $now`,
+        { accountId, encryptedKey, now },
+      );
+    } finally {
+      await session.close();
+    }
+  }
+
+  async delete(accountId: string): Promise<boolean> {
+    const session = getSession();
+    try {
+      const result = await session.run(
+        `MATCH (k:PropertyDataKey {accountId: $accountId})
+         DELETE k
+         RETURN count(k) AS deleted`,
+        { accountId },
+      );
+      const deleted = result.records[0]?.get("deleted")?.toNumber?.() ?? 0;
+      return deleted > 0;
+    } finally {
+      await session.close();
+    }
+  }
+}
+
+// FileKeyStore — single key per accountId stored as an AES-256-GCM-encrypted
+// JSON blob. The file holds a map { [accountId]: { encryptedKey, createdAt,
+// updatedAt } } so it parallels the Neo4j shape, but in standalone mode the
+// accountId is "local" (only one).
+
+interface FileEnvelope {
+  [accountId: string]: { encryptedKey: string; createdAt: string; updatedAt: string };
+}
+
+const LABEL = "property-data";
+
+class FileKeyStore implements KeyStore {
+  readonly backendName = "file";
+  readonly backendPath: string;
+  private readonly storePath: string;
+  private readonly keyFilePath: string;
+
+  constructor() {
+    const home = homedir();
+    this.storePath = resolve(home, ".claude/.realagent-property-data-key.enc");
+    this.keyFilePath = resolve(home, ".claude/.realagent-property-data-encryption-key");
+    this.backendPath = this.storePath;
+  }
+
+  private ensureDir(): void {
+    mkdirSync(dirname(this.storePath), { recursive: true });
+  }
+
+  private readAll(): FileEnvelope {
+    if (!existsSync(this.storePath)) return {};
+    const blob = readFileSync(this.storePath, "utf-8").trim();
+    if (!blob) return {};
+    const json = decryptWith(blob, this.keyFilePath, LABEL);
+    return JSON.parse(json) as FileEnvelope;
+  }
+
+  private writeAll(env: FileEnvelope): void {
+    this.ensureDir();
+    const blob = encryptWith(JSON.stringify(env), this.keyFilePath, LABEL);
+    writeFileSync(this.storePath, blob, { mode: 0o600 });
+  }
+
+  async load(accountId: string): Promise<StoredKey | null> {
+    const env = this.readAll();
+    const entry = env[accountId];
+    if (!entry) return null;
+    // The encryptedKey field is double-encrypted: the file blob is decrypted
+    // above, the inner field is the original AES-GCM-wrapped key. Keep the
+    // inner layer so an unauthenticated read of decrypted JSON still doesn't
+    // expose the API key directly in process memory until decryptWith runs.
+    return {
+      apiKey: decryptWith(entry.encryptedKey, this.keyFilePath, LABEL),
+      createdAt: entry.createdAt,
+      updatedAt: entry.updatedAt,
+    };
+  }
+
+  async save(accountId: string, apiKey: string): Promise<void> {
+    const env = this.readAll();
+    const now = new Date().toISOString();
+    const encryptedKey = encryptWith(apiKey, this.keyFilePath, LABEL);
+    const prev = env[accountId];
+    env[accountId] = {
+      encryptedKey,
+      createdAt: prev?.createdAt ?? now,
+      updatedAt: now,
+    };
+    this.writeAll(env);
+  }
+
+  async delete(accountId: string): Promise<boolean> {
+    const env = this.readAll();
+    if (!(accountId in env)) return false;
+    delete env[accountId];
+    this.writeAll(env);
+    return true;
+  }
+}
+
+let cached: KeyStore | null = null;
+
+export function selectKeyStore(): KeyStore {
+  if (cached) return cached;
+  cached = process.env.PROPERTY_DATA_STANDALONE === "1" ? new FileKeyStore() : new Neo4jKeyStore();
+  return cached;
+}
+
+// Test seam — used by unit tests to reset the cached store between cases.
+export function _resetKeyStoreForTests(): void {
+  cached = null;
+}

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/src/lib/propertydata-api.ts

@@ -1,5 +1,4 @@
-import { getSession } from "./neo4j.js";
-import { decrypt } from "./crypto.js";
+import { selectKeyStore } from "./key-store.js";
 
 // PropertyData API V1 client. Every endpoint is a GET against
 // https://api.propertydata.co.uk/<endpoint> with `key=<api-key>` plus
@@ -42,37 +41,23 @@ export class BadResponseError extends Error {
 }
 
 export interface PropertyDataKey {
-  encryptedKey: string;
   createdAt: string;
   updatedAt: string;
 }
 
 export async function loadAccountKey(accountId: string): Promise<PropertyDataKey | null> {
-  const session = getSession();
-  try {
-    const result = await session.run(
-      `MATCH (k:PropertyDataKey {accountId: $accountId})
-       RETURN k.encryptedKey AS encryptedKey,
-              k.createdAt AS createdAt,
-              k.updatedAt AS updatedAt`,
-      { accountId },
-    );
-    if (result.records.length === 0) return null;
-    const r = result.records[0];
-    return {
-      encryptedKey: r.get("encryptedKey"),
-      createdAt: r.get("createdAt") ?? "",
-      updatedAt: r.get("updatedAt") ?? "",
-    };
-  } finally {
-    await session.close();
-  }
+  const stored = await selectKeyStore().load(accountId);
+  if (!stored) return null;
+  return { createdAt: stored.createdAt, updatedAt: stored.updatedAt };
 }
 
 export async function resolveAccountApiKey(accountId: string): Promise<string> {
-  const stored = await loadAccountKey(accountId);
+  // Bypass for one-shot CLI runs: explicit env var beats stored key.
+  const envKey = process.env.PROPERTY_DATA_API_KEY;
+  if (envKey && envKey.trim()) return envKey.trim();
+  const stored = await selectKeyStore().load(accountId);
   if (!stored) throw new KeyNotRegisteredError();
-  return decrypt(stored.encryptedKey);
+  return stored.apiKey;
 }
 
 export interface CallOptions {

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/src/tools/endpoints.ts

@@ -19,12 +19,12 @@ function call(toolName: string, endpoint: string, args: Args): Promise<string> {
 export const valuationSale = (a: Args) => call("property-data-valuation-sale", "valuation-sale", a);
 export const valuationRent = (a: Args) => call("property-data-valuation-rent", "valuation-rent", a);
 export const prices = (a: Args) => call("property-data-prices", "prices", a);
-export const pricesRent = (a: Args) => call("property-data-prices-rent", "prices-rent", a);
+export const pricesRent = (a: Args) => call("property-data-prices-rent", "rents", a);
 export const soldPrices = (a: Args) => call("property-data-sold-prices", "sold-prices", a);
 export const demand = (a: Args) => call("property-data-demand", "demand", a);
 export const yields = (a: Args) => call("property-data-yields", "yields", a);
 export const growth = (a: Args) => call("property-data-growth", "growth", a);
-export const nationalHpi = (a: Args) => call("property-data-national-hpi", "national-hpi", a);
+export const nationalHpi = (a: Args) => call("property-data-national-hpi", "national-data", a);
 
 // Task 144 — 10 additional read endpoints (£/sqft, area risk,
 // planning precedent, UPRN, demand-rent, property-type mix).

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/src/tools/key-deregister.ts

@@ -1,21 +1,9 @@
-import { getSession } from "../lib/neo4j.js";
+import { selectKeyStore } from "../lib/key-store.js";
 
 export async function keyDeregister(params: { accountId: string }): Promise<void> {
-  const { accountId } = params;
-  const session = getSession();
-  try {
-    const result = await session.run(
-      `MATCH (k:PropertyDataKey {accountId: $accountId})
-       DELETE k
-       RETURN count(k) AS deleted`,
-      { accountId },
-    );
-    const deleted = result.records[0]?.get("deleted")?.toNumber?.() ?? 0;
-    if (deleted === 0) {
-      throw new Error("No PropertyData API key is registered for this account.");
-    }
-  } finally {
-    await session.close();
+  const deleted = await selectKeyStore().delete(params.accountId);
+  if (!deleted) {
+    throw new Error("No PropertyData API key is registered for this account.");
   }
-  console.error(`[property-data] key-op op=deregister account=${accountId}`);
+  console.error(`[property-data] key-op op=deregister account=${params.accountId}`);
 }

package/payload/premium-plugins/real-agent/plugins/property-data/mcp/src/tools/key-register.ts

@@ -1,27 +1,45 @@
-import { getSession } from "../lib/neo4j.js";
-import { encrypt } from "../lib/crypto.js";
+import { selectKeyStore } from "../lib/key-store.js";
 import { PropertyDataError } from "../lib/propertydata-api.js";
 
 const BASE_URL = "https://api.propertydata.co.uk";
 const REQUEST_TIMEOUT_MS = 15_000;
 
-// Validate by hitting a cheap endpoint that returns success on any valid key:
-// /national-hpi takes no postcode and is rate-cheap. Treat a 200 as the key
-// passing PropertyData's authentication check; treat 401/403 as an explicit
-// key rejection so the operator gets an actionable message; treat anything
-// else as an unverified-key error (network, upstream outage).
+// Validate the key against PropertyData's /valuation-sale endpoint with no
+// inputs — a valid key returns HTTP 400 + body code 701 "Missing input:
+// property_type" (proof the key was accepted), without consuming a credit.
+// An invalid key returns auth failure (401/403) or a different upstream code.
+// Evidence: probing `/national-hpi` returns code X01 "Invalid API endpoint"
+// — that path does not exist on PropertyData; `/valuation-sale` does.
+
 async function validateApiKey(apiKey: string): Promise<void> {
-  const url = `${BASE_URL}/national-hpi?key=${encodeURIComponent(apiKey)}`;
+  // Probe /valuation-sale with one input. Evidence-backed envelopes:
+  //   invalid key → {code:"X03", message:"Invalid input: key"}
+  //   valid key   → {code:"701", message:"Missing input: property_type"} (no credit)
+  // PropertyData does not charge for missing-input errors, so this is a free probe.
+  const url = `${BASE_URL}/valuation-sale?key=${encodeURIComponent(apiKey)}&postcode=SW1A1AA`;
   const response = await fetch(url, {
     headers: { Accept: "application/json" },
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
   });
+  const body = await response.text().catch(() => "");
   if (response.status === 401 || response.status === 403) {
     throw new Error(`PropertyData rejected the API key (HTTP ${response.status}).`);
   }
+  let parsed: { status?: string; code?: string; message?: string } = {};
+  try { parsed = JSON.parse(body); } catch { /* fall through */ }
+  if (parsed.code === "X03") {
+    throw new Error(`PropertyData rejected the API key (code=X03 ${parsed.message ?? "Invalid input: key"}).`);
+  }
+  // 701 (missing-input) or status:"success" both prove the key was authenticated.
+  // Any other envelope: surface raw so the operator sees the upstream error.
+  if (parsed.status === "success" || parsed.code === "701") return;
+  if (parsed.status === "error") {
+    throw new Error(
+      `PropertyData validate probe returned unexpected envelope (code=${parsed.code ?? "?"} message=${parsed.message ?? "?"}).`,
+    );
+  }
   if (!response.ok) {
-    const body = await response.text().catch(() => "");
-    throw new PropertyDataError(response.status, "national-hpi", body.slice(0, 200));
+    throw new PropertyDataError(response.status, "valuation-sale", body.slice(0, 200));
   }
 }
 
@@ -30,29 +48,7 @@ export async function keyRegister(params: {
   accountId: string;
 }): Promise<void> {
   const { apiKey, accountId } = params;
-
   await validateApiKey(apiKey);
-
-  const encryptedKey = encrypt(apiKey);
-  const now = new Date().toISOString();
-
-  const session = getSession();
-  try {
-    await session.run(
-      `CREATE INDEX property_data_key_account IF NOT EXISTS
-       FOR (k:PropertyDataKey) ON (k.accountId)`,
-      {},
-    );
-
-    await session.run(
-      `MERGE (k:PropertyDataKey {accountId: $accountId})
-       ON CREATE SET k.encryptedKey = $encryptedKey, k.createdAt = $now, k.updatedAt = $now
-       ON MATCH  SET k.encryptedKey = $encryptedKey, k.updatedAt = $now`,
-      { accountId, encryptedKey, now },
-    );
-  } finally {
-    await session.close();
-  }
-
+  await selectKeyStore().save(accountId, apiKey);
   console.error(`[property-data] key-op op=register account=${accountId}`);
 }