@rubytech/create-maxy 0.3.6 → 0.3.8

package/dist/index.js

@@ -280,6 +280,8 @@ function deployPayload() {
 }
 function buildPlatform() {
     log("8", TOTAL, "Installing dependencies and building...");
+    // Stop the running service before rebuilding (upgrade path)
+    spawnSync("systemctl", ["--user", "stop", "maxy"], { stdio: "pipe" });
     shell("npm", ["install", "--quiet"], { cwd: join(INSTALL_DIR, "platform") });
     shell("npm", ["run", "build"], { cwd: join(INSTALL_DIR, "platform") });
     shell("npm", ["install", "--quiet"], { cwd: join(INSTALL_DIR, "maxy") });
@@ -324,10 +326,10 @@ WantedBy=default.target
         spawnSync("sudo", ["loginctl", "enable-linger", user], { stdio: "inherit" });
     }
     catch { /* not critical */ }
-    // Reload and start
+    // Reload and (re)start
     spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "inherit" });
     spawnSync("systemctl", ["--user", "enable", "maxy"], { stdio: "inherit" });
-    spawnSync("systemctl", ["--user", "start", "maxy"], { stdio: "inherit" });
+    spawnSync("systemctl", ["--user", "restart", "maxy"], { stdio: "inherit" });
     // Wait for the server to come up
     console.log("  Waiting for web server...");
     for (let i = 0; i < 20; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Install Maxy — your personal AI assistant",
   "bin": {
     "create-maxy": "./dist/index.js"

package/payload/maxy/app/api/admin/session/route.ts

@@ -2,10 +2,27 @@ import { NextResponse } from 'next/server'
 import { registerSession } from '../../../lib/claude-agent'
 import { readFileSync, readdirSync, existsSync } from 'node:fs'
 import { resolve } from 'node:path'
+import { createHash } from 'node:crypto'
 
-const ADMIN_PIN = process.env.ADMIN_PIN
+const PERSISTENT_DIR = resolve(process.env.HOME ?? '/root', '.maxy')
+const PIN_FILE = resolve(PERSISTENT_DIR, '.admin-pin')
 const ACCOUNTS_DIR = resolve(process.cwd(), '../platform/config/accounts')
 
+function hashPin(pin: string): string {
+  return createHash('sha256').update(pin).digest('hex')
+}
+
+function getStoredPinHash(): string | null {
+  if (existsSync(PIN_FILE)) {
+    return readFileSync(PIN_FILE, 'utf-8').trim()
+  }
+  // Fallback to env var (legacy)
+  if (process.env.ADMIN_PIN) {
+    return hashPin(process.env.ADMIN_PIN)
+  }
+  return null
+}
+
 function getDefaultAccountId(): string | null {
   if (!existsSync(ACCOUNTS_DIR)) return null
   const entries = readdirSync(ACCOUNTS_DIR, { withFileTypes: true })
@@ -25,9 +42,11 @@ function getDefaultAccountId(): string | null {
  * Body: { pin: string }
  */
 export async function POST(req: Request) {
-  if (!ADMIN_PIN) {
+  const storedHash = getStoredPinHash()
+
+  if (!storedHash) {
     return NextResponse.json(
-      { error: 'Admin access is not configured. Set ADMIN_PIN environment variable.' },
+      { error: 'PIN not configured. Complete onboarding first.' },
       { status: 503 },
     )
   }
@@ -39,14 +58,11 @@ export async function POST(req: Request) {
     return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
   }
 
-  if (!body.pin || body.pin !== ADMIN_PIN) {
+  if (!body.pin || hashPin(body.pin) !== storedHash) {
     return NextResponse.json({ error: 'Invalid PIN' }, { status: 401 })
   }
 
-  const accountId = getDefaultAccountId()
-  if (!accountId) {
-    return NextResponse.json({ error: 'No account configured' }, { status: 503 })
-  }
+  const accountId = getDefaultAccountId() ?? 'default'
 
   const sessionKey = crypto.randomUUID()
   registerSession(sessionKey, 'admin', accountId)

package/payload/maxy/app/api/health/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from 'next/server'
+import { existsSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const INSTALL_DIR = resolve(process.cwd(), '..')
+const PIN_FILE = resolve(INSTALL_DIR, '.maxy', '.admin-pin')
+const HOME_PIN_FILE = resolve(process.env.HOME ?? '/root', '.maxy', '.admin-pin')
+
+/**
+ * GET /api/health
+ * Returns platform state for the onboarding flow.
+ */
+export async function GET() {
+  const pinConfigured = existsSync(PIN_FILE) || existsSync(HOME_PIN_FILE) || !!process.env.ADMIN_PIN
+
+  // TODO: check Claude Code auth status
+  const claudeAuthenticated = false
+
+  return NextResponse.json({
+    pin_configured: pinConfigured,
+    claude_authenticated: claudeAuthenticated,
+  })
+}

package/payload/maxy/app/api/onboarding/set-pin/route.ts

@@ -0,0 +1,44 @@
+import { NextResponse } from 'next/server'
+import { existsSync, writeFileSync, mkdirSync, readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { createHash } from 'node:crypto'
+
+const PERSISTENT_DIR = resolve(process.env.HOME ?? '/root', '.maxy')
+const PIN_FILE = resolve(PERSISTENT_DIR, '.admin-pin')
+
+function hashPin(pin: string): string {
+  return createHash('sha256').update(pin).digest('hex')
+}
+
+/**
+ * POST /api/onboarding/set-pin
+ * Sets the admin PIN. Only works when no PIN is configured.
+ * Body: { pin: string }
+ */
+export async function POST(req: Request) {
+  if (existsSync(PIN_FILE)) {
+    return NextResponse.json(
+      { error: 'PIN is already configured.' },
+      { status: 409 },
+    )
+  }
+
+  let body: { pin: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
+  }
+
+  if (!body.pin || body.pin.length < 4) {
+    return NextResponse.json(
+      { error: 'PIN must be at least 4 characters.' },
+      { status: 400 },
+    )
+  }
+
+  mkdirSync(PERSISTENT_DIR, { recursive: true })
+  writeFileSync(PIN_FILE, hashPin(body.pin), { mode: 0o600 })
+
+  return NextResponse.json({ ok: true })
+}

package/payload/maxy/app/page.tsx

@@ -3,6 +3,8 @@
 import { useState, useRef, useEffect, FormEvent } from 'react'
 import { ActivityEvent, type AdminEvent } from './admin/components/ActivityEvent'
 
+type AppState = 'loading' | 'set-pin' | 'enter-pin' | 'chat'
+
 interface Message {
   role: 'admin' | 'maxy'
   content?: string
@@ -10,8 +12,9 @@ interface Message {
 }
 
 export default function AdminPage() {
-  const [authenticated, setAuthenticated] = useState(false)
+  const [appState, setAppState] = useState<AppState>('loading')
   const [pin, setPin] = useState('')
+  const [confirmPin, setConfirmPin] = useState('')
   const [pinError, setPinError] = useState('')
   const [sessionKey, setSessionKey] = useState<string | null>(null)
   const [messages, setMessages] = useState<Message[]>([])
@@ -25,22 +28,80 @@ export default function AdminPage() {
     messagesEndRef.current?.scrollIntoView({ behavior: 'smooth' })
   }, [messages])
 
+  // Check platform state on mount
   useEffect(() => {
-    if (authenticated) inputRef.current?.focus()
-    else pinInputRef.current?.focus()
-  }, [authenticated])
+    async function checkHealth() {
+      try {
+        const res = await fetch('/api/health')
+        if (!res.ok) {
+          setAppState('set-pin')
+          return
+        }
+        const health = await res.json()
+        setAppState(health.pin_configured ? 'enter-pin' : 'set-pin')
+      } catch {
+        setAppState('set-pin')
+      }
+    }
+    checkHealth()
+  }, [])
 
-  async function handlePinSubmit(e: FormEvent) {
+  useEffect(() => {
+    if (appState === 'set-pin' || appState === 'enter-pin') {
+      setTimeout(() => pinInputRef.current?.focus(), 100)
+    }
+    if (appState === 'chat') {
+      setTimeout(() => inputRef.current?.focus(), 100)
+    }
+  }, [appState])
+
+  async function handleSetPin(e: FormEvent) {
     e.preventDefault()
     setPinError('')
 
+    if (pin.length < 4) {
+      setPinError('PIN must be at least 4 characters.')
+      return
+    }
+    if (pin !== confirmPin) {
+      setPinError('PINs do not match.')
+      return
+    }
+
     try {
-      const res = await fetch('/api/admin/session', {
+      const res = await fetch('/api/onboarding/set-pin', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ pin }),
       })
 
+      if (!res.ok) {
+        const data = await res.json().catch(() => ({}))
+        setPinError(data.error || 'Failed to set PIN.')
+        return
+      }
+
+      // PIN set — now log in with it
+      await doLogin(pin)
+    } catch {
+      setPinError('Could not connect.')
+    }
+  }
+
+  async function handleLogin(e: FormEvent) {
+    e.preventDefault()
+    setPinError('')
+    await doLogin(pin)
+  }
+
+  async function doLogin(pinValue: string) {
+    try {
+      const res = await fetch('/api/admin/session', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ pin: pinValue }),
+      })
+
       if (!res.ok) {
         const data = await res.json().catch(() => ({}))
         setPinError(data.error || 'Invalid PIN')
@@ -49,7 +110,9 @@ export default function AdminPage() {
 
       const data = await res.json()
       setSessionKey(data.session_key)
-      setAuthenticated(true)
+      setPin('')
+      setConfirmPin('')
+      setAppState('chat')
     } catch {
       setPinError('Could not connect.')
     }
@@ -97,16 +160,10 @@ export default function AdminPage() {
           if (payload === '[DONE]') continue
 
           let parsed: { type: string; [key: string]: unknown }
-          try {
-            parsed = JSON.parse(payload)
-          } catch {
-            continue
-          }
-
+          try { parsed = JSON.parse(payload) } catch { continue }
           if (parsed.type === 'done' || parsed.type === 'session_init') continue
 
           const event = parsed as AdminEvent
-
           setMessages(prev => {
             const updated = [...prev]
             const msg = updated[messageIndex]
@@ -136,12 +193,56 @@ export default function AdminPage() {
     }
   }
 
-  function handleSubmit(e: FormEvent) {
-    e.preventDefault()
-    sendMessage(input.trim())
+  // --- Loading ---
+  if (appState === 'loading') {
+    return (
+      <div className="chat-page admin-page">
+        <header className="chat-header">
+          <img src="/brand/maxy-black.png" alt="Maxy" className="chat-logo" />
+        </header>
+      </div>
+    )
+  }
+
+  // --- Set PIN (first boot) ---
+  if (appState === 'set-pin') {
+    return (
+      <div className="chat-page admin-page">
+        <header className="chat-header">
+          <img src="/brand/maxy-black.png" alt="Maxy" className="chat-logo" />
+          <h1 className="chat-tagline">Welcome to Maxy</h1>
+          <p className="chat-intro">Choose a PIN to secure your admin access.</p>
+        </header>
+        <div className="admin-pin-form">
+          <form onSubmit={handleSetPin}>
+            <input
+              ref={pinInputRef}
+              type="password"
+              value={pin}
+              onChange={e => setPin(e.target.value)}
+              placeholder="Choose a PIN"
+              className="chat-input"
+              autoFocus
+            />
+            <input
+              type="password"
+              value={confirmPin}
+              onChange={e => setConfirmPin(e.target.value)}
+              placeholder="Confirm PIN"
+              className="chat-input"
+            />
+            <button type="submit" className="chat-send" disabled={!pin || !confirmPin}>
+              Set PIN
+            </button>
+          </form>
+          {pinError && <p className="admin-pin-error">{pinError}</p>}
+        </div>
+      </div>
+    )
   }
 
-  if (!authenticated) {
+  // --- Enter PIN (returning user) ---
+  if (appState === 'enter-pin') {
     return (
       <div className="chat-page admin-page">
         <header className="chat-header">
@@ -150,7 +251,7 @@ export default function AdminPage() {
           <p className="chat-intro">Convenience as standard.</p>
         </header>
         <div className="admin-pin-form">
-          <form onSubmit={handlePinSubmit}>
+          <form onSubmit={handleLogin}>
             <input
               ref={pinInputRef}
               type="password"
@@ -173,6 +274,7 @@ export default function AdminPage() {
     )
   }
 
+  // --- Chat ---
   return (
     <div className="chat-page admin-page">
       <header className="chat-header">
@@ -206,7 +308,7 @@ export default function AdminPage() {
       </div>
 
       <div className="chat-input-area">
-        <form className="chat-form" onSubmit={handleSubmit}>
+        <form className="chat-form" onSubmit={(e) => { e.preventDefault(); sendMessage(input.trim()) }}>
           <input
             ref={inputRef}
             className="chat-input"