@rubytech/create-maxy-code 0.1.59 → 0.1.61

package/payload/platform/plugins/loop/mcp/src/lib/key-store.ts

@@ -0,0 +1,221 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { homedir } from "node:os";
+import { getSession } from "./neo4j.js";
+import { encrypt, decrypt } from "./crypto.js";
+import { encryptWith, decryptWith } from "./file-crypto.js";
+
+// Storage abstraction so the same MCP body runs against Neo4j (platform mode)
+// or an on-disk encrypted file (standalone mode, spawned by Claude Code from
+// ~/.claude/). Selected by LOOP_STANDALONE at boot. Loop is multi-team — each
+// account can register many team keys — so the file backend stores a nested
+// map and the store API mirrors that.
+
+export interface LoopStoredKey {
+  teamName: string;
+  apiKey: string;
+  teamAddress: string;
+  agentId: string;
+  permissions: string[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+export type LoopKeyInput = Omit<LoopStoredKey, "createdAt" | "updatedAt">;
+
+export interface LoopKeyStore {
+  readonly backendName: string;
+  readonly backendPath: string;
+  loadAll(accountId: string): Promise<LoopStoredKey[]>;
+  save(accountId: string, key: LoopKeyInput): Promise<{ created: boolean }>;
+  delete(accountId: string, teamName: string): Promise<boolean>;
+}
+
+class Neo4jLoopKeyStore implements LoopKeyStore {
+  readonly backendName = "neo4j";
+  readonly backendPath = process.env.NEO4J_URI ?? "<unset>";
+
+  async loadAll(accountId: string): Promise<LoopStoredKey[]> {
+    const session = getSession();
+    try {
+      const result = await session.run(
+        `MATCH (k:LoopTeamKey {accountId: $accountId})
+         RETURN k.teamName AS teamName, k.encryptedKey AS encryptedKey,
+                k.teamAddress AS teamAddress, k.agentId AS agentId,
+                k.permissions AS permissions, k.createdAt AS createdAt,
+                k.updatedAt AS updatedAt
+         ORDER BY k.teamName`,
+        { accountId },
+      );
+      return result.records.map((r) => ({
+        teamName: r.get("teamName"),
+        apiKey: decrypt(r.get("encryptedKey")),
+        teamAddress: r.get("teamAddress") ?? "",
+        agentId: r.get("agentId") ?? "",
+        permissions: r.get("permissions") ?? [],
+        createdAt: r.get("createdAt") ?? "",
+        updatedAt: r.get("updatedAt") ?? "",
+      }));
+    } finally {
+      await session.close();
+    }
+  }
+
+  async save(accountId: string, key: LoopKeyInput): Promise<{ created: boolean }> {
+    const encryptedKey = encrypt(key.apiKey);
+    const now = new Date().toISOString();
+    const session = getSession();
+    try {
+      await session.run(
+        `CREATE INDEX loop_team_key_account_team IF NOT EXISTS
+         FOR (k:LoopTeamKey) ON (k.accountId, k.teamName)`,
+        {},
+      );
+      const result = await session.run(
+        `MERGE (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
+         ON CREATE SET
+           k.encryptedKey = $encryptedKey,
+           k.teamAddress = $teamAddress,
+           k.agentId = $agentId,
+           k.permissions = $permissions,
+           k.createdAt = $now,
+           k.updatedAt = $now
+         RETURN k.createdAt = $now AS created`,
+        {
+          teamName: key.teamName,
+          encryptedKey,
+          teamAddress: key.teamAddress,
+          agentId: key.agentId,
+          accountId,
+          permissions: key.permissions,
+          now,
+        },
+      );
+      return { created: Boolean(result.records[0]?.get("created")) };
+    } finally {
+      await session.close();
+    }
+  }
+
+  async delete(accountId: string, teamName: string): Promise<boolean> {
+    const session = getSession();
+    try {
+      const result = await session.run(
+        `MATCH (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
+         DELETE k
+         RETURN count(k) AS deleted`,
+        { teamName, accountId },
+      );
+      const deleted = result.records[0]?.get("deleted")?.toNumber?.() ?? 0;
+      return deleted > 0;
+    } finally {
+      await session.close();
+    }
+  }
+}
+
+const LABEL = "loop";
+
+interface FileEnvelope {
+  [accountId: string]: {
+    [teamName: string]: {
+      encryptedKey: string;
+      teamAddress: string;
+      agentId: string;
+      permissions: string[];
+      createdAt: string;
+      updatedAt: string;
+    };
+  };
+}
+
+class FileLoopKeyStore implements LoopKeyStore {
+  readonly backendName = "file";
+  readonly backendPath: string;
+  private readonly storePath: string;
+  private readonly keyFilePath: string;
+
+  constructor() {
+    const home = homedir();
+    this.storePath = resolve(home, ".claude/.realagent-loop-key.enc");
+    this.keyFilePath = resolve(home, ".claude/.realagent-loop-encryption-key");
+    this.backendPath = this.storePath;
+  }
+
+  private ensureDir(): void {
+    mkdirSync(dirname(this.storePath), { recursive: true });
+  }
+
+  private readAll(): FileEnvelope {
+    if (!existsSync(this.storePath)) return {};
+    const blob = readFileSync(this.storePath, "utf-8").trim();
+    if (!blob) return {};
+    const json = decryptWith(blob, this.keyFilePath, LABEL);
+    return JSON.parse(json) as FileEnvelope;
+  }
+
+  private writeAll(env: FileEnvelope): void {
+    this.ensureDir();
+    const blob = encryptWith(JSON.stringify(env), this.keyFilePath, LABEL);
+    writeFileSync(this.storePath, blob, { mode: 0o600 });
+  }
+
+  async loadAll(accountId: string): Promise<LoopStoredKey[]> {
+    const env = this.readAll();
+    const account = env[accountId];
+    if (!account) return [];
+    return Object.entries(account)
+      .map(([teamName, entry]) => ({
+        teamName,
+        apiKey: decryptWith(entry.encryptedKey, this.keyFilePath, LABEL),
+        teamAddress: entry.teamAddress,
+        agentId: entry.agentId,
+        permissions: entry.permissions,
+        createdAt: entry.createdAt,
+        updatedAt: entry.updatedAt,
+      }))
+      .sort((a, b) => a.teamName.localeCompare(b.teamName));
+  }
+
+  async save(accountId: string, key: LoopKeyInput): Promise<{ created: boolean }> {
+    const env = this.readAll();
+    const account = env[accountId] ?? {};
+    const prev = account[key.teamName];
+    const now = new Date().toISOString();
+    const encryptedKey = encryptWith(key.apiKey, this.keyFilePath, LABEL);
+    account[key.teamName] = {
+      encryptedKey,
+      teamAddress: key.teamAddress,
+      agentId: key.agentId,
+      permissions: key.permissions,
+      createdAt: prev?.createdAt ?? now,
+      updatedAt: now,
+    };
+    env[accountId] = account;
+    this.writeAll(env);
+    return { created: !prev };
+  }
+
+  async delete(accountId: string, teamName: string): Promise<boolean> {
+    const env = this.readAll();
+    const account = env[accountId];
+    if (!account || !(teamName in account)) return false;
+    delete account[teamName];
+    if (Object.keys(account).length === 0) delete env[accountId];
+    else env[accountId] = account;
+    this.writeAll(env);
+    return true;
+  }
+}
+
+let cached: LoopKeyStore | null = null;
+
+export function selectLoopKeyStore(): LoopKeyStore {
+  if (cached) return cached;
+  cached = process.env.LOOP_STANDALONE === "1" ? new FileLoopKeyStore() : new Neo4jLoopKeyStore();
+  return cached;
+}
+
+export function _resetKeyStoreForTests(): void {
+  cached = null;
+}

package/payload/platform/plugins/loop/mcp/src/lib/loop-api.ts

@@ -1,5 +1,4 @@
-import { getSession } from "./neo4j.js";
-import { decrypt } from "./crypto.js";
+import { selectLoopKeyStore } from "./key-store.js";
 
 // ─────────────────────────────────────────────────────────────────
 // Loop API V2 HTTP Client + Cross-Team Aggregation Engine
@@ -90,7 +89,7 @@ function unwrapEnvelope<T>(parsed: unknown, toolName: string, teamName: string):
 
 export interface LoopTeamKey {
   teamName: string;
-  encryptedKey: string;
+  apiKey: string;
   teamAddress: string;
   agentId: string;
   permissions: string[];
@@ -120,29 +119,7 @@ export interface AggregationResult<T> {
  * Load all LoopTeamKey nodes for an account from Neo4j.
  */
 export async function loadTeamKeys(accountId: string): Promise<LoopTeamKey[]> {
-  const session = getSession();
-  try {
-    const result = await session.run(
-      `MATCH (k:LoopTeamKey {accountId: $accountId})
-       RETURN k.teamName AS teamName, k.encryptedKey AS encryptedKey,
-              k.teamAddress AS teamAddress, k.agentId AS agentId,
-              k.permissions AS permissions, k.createdAt AS createdAt,
-              k.updatedAt AS updatedAt
-       ORDER BY k.teamName`,
-      { accountId }
-    );
-    return result.records.map((r) => ({
-      teamName: r.get("teamName"),
-      encryptedKey: r.get("encryptedKey"),
-      teamAddress: r.get("teamAddress") ?? "",
-      agentId: r.get("agentId") ?? "",
-      permissions: r.get("permissions") ?? [],
-      createdAt: r.get("createdAt") ?? "",
-      updatedAt: r.get("updatedAt") ?? "",
-    }));
-  } finally {
-    await session.close();
-  }
+  return selectLoopKeyStore().loadAll(accountId);
 }
 
 // Truncate to 200 chars, escape newlines, single line — `[loop] <tool> team=<t>
@@ -396,20 +373,7 @@ export async function aggregateAcrossTeams<T>(
       continue;
     }
 
-    let apiKey: string;
-    try {
-      apiKey = decrypt(key.encryptedKey);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(`[loop] decrypt failed for team=${key.teamName}: ${msg}`);
-      failures.push({
-        teamName: key.teamName,
-        reason: "Decryption failed",
-        kind: "other",
-      });
-      continue;
-    }
-
+    const apiKey = key.apiKey;
     const teamName = key.teamName;
     tasks.push({
       key,
@@ -512,8 +476,7 @@ export async function withTeamKey<T>(
     );
   }
 
-  const apiKey = decrypt(key.encryptedKey);
-  return execute(apiKey);
+  return execute(key.apiKey);
 }
 
 /**

package/payload/platform/plugins/loop/mcp/src/tools/key-deregister.ts

@@ -1,27 +1,12 @@
-import { getSession } from "../lib/neo4j.js";
+import { selectLoopKeyStore } from "../lib/key-store.js";
 
 export async function keyDeregister(params: {
   teamName: string;
   accountId: string;
 }): Promise<void> {
-  const { teamName, accountId } = params;
-
-  const session = getSession();
-  try {
-    const result = await session.run(
-      `MATCH (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
-       DELETE k
-       RETURN count(k) AS deleted`,
-      { teamName, accountId }
-    );
-
-    const deleted = result.records[0]?.get("deleted")?.toNumber?.() ?? 0;
-    if (deleted === 0) {
-      throw new Error(`Team "${teamName}" not found.`);
-    }
-  } finally {
-    await session.close();
+  const deleted = await selectLoopKeyStore().delete(params.accountId, params.teamName);
+  if (!deleted) {
+    throw new Error(`Team "${params.teamName}" not found.`);
   }
-
-  console.error(`[loop] key-deregister team=${teamName} account=${accountId}`);
+  console.error(`[loop] key-deregister team=${params.teamName} account=${params.accountId}`);
 }

package/payload/platform/plugins/loop/mcp/src/tools/key-register.ts

@@ -1,5 +1,4 @@
-import { getSession } from "../lib/neo4j.js";
-import { encrypt } from "../lib/crypto.js";
+import { selectLoopKeyStore } from "../lib/key-store.js";
 import { loopGet, LoopApiError } from "../lib/loop-api.js";
 
 interface LoopTeamResponse {
@@ -21,7 +20,7 @@ export async function keyRegister(params: {
   const { teamName, apiKey, accountId } = params;
   const permissions = params.permissions ?? ALL_PERMISSIONS;
 
-  // Validate key against Loop API — try /team endpoint
+  // Validate key against Loop API — try /team endpoint.
   let teamAddress = "";
   let agentId = "";
   let warning: string | undefined;
@@ -31,11 +30,10 @@ export async function keyRegister(params: {
       apiKey,
       "/team",
       "loop-key-register",
-      teamName
+      teamName,
     );
 
     if (Array.isArray(teamData) && teamData.length === 0) {
-      // 204 was converted to empty array — ambiguous scope
       warning =
         "Key accepted but Loop returned no team data (204). " +
         "Verify the key's scope in Loop's dashboard.";
@@ -47,49 +45,26 @@ export async function keyRegister(params: {
     if (err instanceof LoopApiError && err.status === 401) {
       throw new Error(
         `Loop API rejected the key for team "${teamName}" (HTTP 401). ` +
-        `Check that the key is valid and not expired.`
+          `Check that the key is valid and not expired.`,
       );
     }
-    // Network/timeout errors — still reject, key is unverified
     throw new Error(
-      `Could not validate key against Loop API: ${err instanceof Error ? err.message : String(err)}`
+      `Could not validate key against Loop API: ${err instanceof Error ? err.message : String(err)}`,
     );
   }
 
-  // Encrypt and store
-  const encryptedKey = encrypt(apiKey);
-  const now = new Date().toISOString();
+  const { created } = await selectLoopKeyStore().save(accountId, {
+    teamName,
+    apiKey,
+    teamAddress,
+    agentId,
+    permissions,
+  });
 
-  const writeSession = getSession();
-  try {
-    await writeSession.run(
-      `CREATE INDEX loop_team_key_account_team IF NOT EXISTS
-       FOR (k:LoopTeamKey) ON (k.accountId, k.teamName)`,
-      {}
-    );
-
-    const mergeResult = await writeSession.run(
-      `MERGE (k:LoopTeamKey {teamName: $teamName, accountId: $accountId})
-       ON CREATE SET
-         k.encryptedKey = $encryptedKey,
-         k.teamAddress = $teamAddress,
-         k.agentId = $agentId,
-         k.permissions = $permissions,
-         k.createdAt = $now,
-         k.updatedAt = $now
-       RETURN k.createdAt = $now AS created`,
-      { teamName, encryptedKey, teamAddress, agentId, accountId, permissions, now }
-    );
-
-    const created = mergeResult.records[0]?.get("created");
-    if (!created) {
-      throw new Error(`Team "${teamName}" is already registered for this account.`);
-    }
-  } finally {
-    await writeSession.close();
+  if (!created) {
+    throw new Error(`Team "${teamName}" is already registered for this account.`);
   }
 
   console.error(`[loop] key-register team=${teamName} account=${accountId}`);
-
   return { warning };
 }

package/payload/platform/plugins/preval/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "real-agent-preval",
-  "description": "Single-address pre-valuation pack. One full UK address in, 4-page A4 PDF out (cover · valuation · area · demand+trend+sources). Consumes the real-agent-property-data MCP — no MCP tools of its own.",
+  "description": "Single-address pre-valuation pitch pack. One full UK address in, 5-page A4 PDF out (cover · subject valuation · market context · comparables · recently with <brand>). Consumes the real-agent-property-data and real-agent-epc MCPs — no MCP tools of its own.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/preval/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: real-agent-preval
-description: "Single-address pre-valuation pack. One full UK address in, 4-page A4 PDF out (cover · valuation · area · demand+trend+sources). Consumes the real-agent-property-data MCP — no MCP tools of its own."
+description: "Single-address pre-valuation pitch pack. One full UK address in, 5-page A4 PDF out (cover · subject valuation · market context · comparables · recently with <brand>). Consumes the real-agent-property-data and real-agent-epc MCPs — no MCP tools of its own."
 skills:
   - skills/property-preval/SKILL.md
 always: false
@@ -9,31 +9,37 @@ metadata: {"platform":{"optional":true,"embed":["admin"]}}
 
 # Real Agent — Preval
 
-Consumer sub-plugin. No MCP server, no new tools — only a skill (`property-preval`) that takes one full UK address and renders a 4-page A4 pre-valuation PDF by fanning out to 12 of the 22 `real-agent-property-data` MCP tools.
+Consumer sub-plugin. No MCP server, no new tools — only a skill (`property-preval`) that takes one full UK address plus operator-supplied brand tokens, subject details, agent listings, and a market summary, and renders a **5-page A4 pre-valuation PDF** designed as a sales pitch for the listing.
 
 ## What it produces
 
-A 4-page A4 PDF and the source HTML, written to `~/Documents/Maxy/preval/<postcode>-<YYYY-MM-DD>/`:
+A 5-page A4 PDF and the source HTML, written to `~/Documents/Maxy/preval/<postcode-compact>-<YYYY-MM-DD>/`:
 
-- **Page 1 — Cover.** Full address, postcode chip, generated-date meta strip.
-- **Page 2 — Valuation.** Average asking £, asking £/sqft, sold avg £, sold £/sqft. Nearest-sold comps table. Live asking comps grid.
-- **Page 3 — Area.** Crime rating, flood risk, council-tax band D cost, local area population. Crime breakdown panel + council-tax band table. Headline read.
-- **Page 4 — Demand, trend, sources.** Demand rating, days-on-market, turnover, for-sale count. 7y growth sparkline (£ and £/sqft). Rental-side mini-panel. Property-types doughnut. Sources/methodology block.
+- **Page 1 — Cover.** Full-bleed subject hero photo with gradient scrim. Light brand wordmark top-left. Address in display-italic. Postcode chip. Four-up meta strip (Report · Address · Postcode · Generated). Lifted from the `property-market-report` cover contract.
+- **Page 2 — Subject valuation.** KPI strip (floor area, bedrooms, EPC rating, type). Valuation panel: headline range = `subject.sqft × sold £/sqft 70pc band` (Land Registry), asking £/sqft cross-check, operator adjustments (`subject.adjustments[]`) shown as a stacked list with colour-coded percentages, final indicative range pill. Falls back to "Estimate requires floor area" benchmark-only mode when sqft is missing.
+- **Page 3 — Market context.** Market summary headline + paragraphs with drop cap. KPI strip (avg asking £, avg sold £, £/sqft). Price-growth panel (YoY) + demand pill with gauge. 7-year sparkline of £ and £/sqft. Same patterns as `property-market-report`.
+- **Page 4 — Comparables.** Full-width Land Registry sold-transactions table (≤ 6 rows), stacked above a full-width live-asking-comparables tile grid (≤ 4 tiles). Never side-by-side — corrects the cramped two-column layout in v1 preval.
+- **Page 5 — Recently with `<brand>` + sources.** Operator-curated `agent_listings[]` rendered as a clickable tile grid with status badges (Sold / Under offer / For sale), then the sources & methodology block. The vendor reads this page and knows who to call.
 
-## How the address routes
+## Tool dependencies
 
-The skill derives the postcode from the address (UK-postcode regex on the final token group), then fans out to **12** `real-agent-property-data` MCP tools in fixed call order:
+The skill fans out to **13** MCP calls in parallel:
 
-`prices`, `prices-per-sqf`, `sold-prices`, `sold-prices-per-sqf`, `growth`, `growth-psf`, `demand`, `demand-rent`, `property-types`, `crime`, `flood-risk`, `council-tax`.
+- **12 PropertyData** tools (postcode-keyed): `prices`, `prices-per-sqf`, `sold-prices`, `sold-prices-per-sqf`, `growth`, `growth-psf`, `demand`, `demand-rent`, `property-types`, `crime`, `flood-risk`, `council-tax`.
+- **1 EPC** tool (address-keyed): `epc-lookup-by-address` for subject floor area + energy rating + lodgement date.
 
-Two tools from the same MCP are **deliberately not called** by this skill:
+`property-data-address-match-uprn` and `property-data-planning-applications` are deliberately not called (CRM hygiene and dev-precedent reports, respectively).
 
-- `property-data-address-match-uprn` — UPRN is CRM hygiene, not preval data.
-- `property-data-planning-applications` — planning is a separate dev-precedent report.
+## Failure handling
 
-Operators can still reach those tools via the underlying `property-data` skill or directly through the MCP.
+- **PropertyData key-not-registered** → abort with the `property-data-key-register` prompt. Market data is essential; the pack cannot render without it.
+- **EPC unavailable** — any of `key-not-registered`, `http-404 (no record)`, `http-429`, `http-500`, network failure, or EPC MCP not configured — is treated as a single class. The skill prompts the operator with the specific cause and offers two paths:
+  1. Paste `subject.sqft` directly → pack renders with EPC KPI cells showing "—" + cause sub-label, but the valuation maths still runs on the pasted sqft.
+  2. Decline → valuation panel switches to "Estimate requires floor area" benchmark-only mode; the pack still renders all five pages.
+- **PropertyData http-429** → back off and retry only the throttled tool (4 calls per 10 seconds upstream throttle).
 
-## Dependencies
+## External dependencies
 
-- Requires `real-agent-property-data` enabled on the account with a registered PropertyData API key (`property-data-key-register`). Without a key every fan-out call returns `Error: key-not-registered` and the renderer raises before producing a PDF.
-- Requires Google Chrome at `/Applications/Google Chrome.app/Contents/MacOS/Google Chrome` (mac, headless `--print-to-pdf`). Same Chrome dependency as `property-market-report`.
+- Requires `real-agent-property-data` enabled on the account with a registered PropertyData API key (`property-data-key-register`).
+- Requires `real-agent-epc` enabled with a registered EPC API key (`epc-key-register`) — failure modes above; not strictly blocking thanks to the paste-sqft fallback.
+- Requires Google Chrome at `/Applications/Google Chrome.app/Contents/MacOS/Google Chrome` for headless `--print-to-pdf`. Same Chrome dependency as `property-market-report`.