@rubytech/create-maxy 1.0.0

package/payload/maxy/app/api/onboarding/claude-auth/route.ts

@@ -0,0 +1,216 @@
+import { NextResponse } from 'next/server'
+import { spawn, spawnSync, execFileSync } from 'node:child_process'
+import { createConnection } from 'node:net'
+import { mkdirSync, openSync, closeSync, writeFileSync, writeSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { homedir } from 'node:os'
+
+const LOG_DIR = resolve(homedir(), '.maxy/logs')
+
+function ensureLogDir(): void {
+  mkdirSync(LOG_DIR, { recursive: true })
+}
+
+function logPath(name: string): string {
+  return resolve(LOG_DIR, `${name}.log`)
+}
+
+function checkAuthStatus(): boolean {
+  try {
+    execFileSync('claude', ['auth', 'status'], { encoding: 'utf-8', timeout: 5000 })
+    return true
+  } catch {
+    return false
+  }
+}
+
+function killVncStack(): void {
+  spawnSync('pkill', ['-f', 'Xtigervnc :99'], { stdio: 'pipe' })
+  spawnSync('pkill', ['-f', 'websockify.*6080'], { stdio: 'pipe' })
+  spawnSync('pkill', ['-f', 'chromium'], { stdio: 'pipe' })
+  spawnSync('rm', ['-f', '/tmp/.X99-lock', '/tmp/.X11-unix/X99'], { stdio: 'pipe' })
+}
+
+function killChromium(): void {
+  spawnSync('pkill', ['-f', 'chromium'], { stdio: 'pipe' })
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise(r => setTimeout(r, ms))
+}
+
+async function waitForPort(port: number, timeoutMs = 12000): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs
+  while (Date.now() < deadline) {
+    const ready = await new Promise<boolean>(resolve => {
+      const socket = createConnection(port, '127.0.0.1')
+      socket.setTimeout(500)
+      socket.once('connect', () => { socket.destroy(); resolve(true) })
+      socket.once('error', () => { socket.destroy(); resolve(false) })
+      socket.once('timeout', () => { socket.destroy(); resolve(false) })
+    })
+    if (ready) return true
+    await sleep(300)
+  }
+  return false
+}
+
+/**
+ * GET /api/onboarding/claude-auth
+ * Returns auth status.
+ */
+export async function GET() {
+  return NextResponse.json({ authenticated: checkAuthStatus() })
+}
+
+/**
+ * POST /api/onboarding/claude-auth
+ * - {} — start VNC stack + `claude auth login`
+ * - { action: "wait" } — poll for completion, kills chromium when authenticated
+ * - { action: "stop" } — kill VNC stack (manual cancel or post-auth cleanup)
+ */
+export async function POST(req: Request) {
+  let body: { action?: string } = {}
+  try { body = await req.json() } catch { /* empty = start */ }
+
+  if (body.action === 'stop') {
+    killVncStack()
+    return NextResponse.json({ stopped: true })
+  }
+
+  if (body.action === 'logout') {
+    try {
+      execFileSync('claude', ['auth', 'logout'], { encoding: 'utf-8', timeout: 8000 })
+    } catch { /* ignore — logout may fail if already logged out */ }
+    return NextResponse.json({ logged_out: true })
+  }
+
+  if (body.action === 'wait') {
+    const authenticated = checkAuthStatus()
+    if (authenticated) killChromium()
+    return NextResponse.json({ completed: authenticated, authenticated })
+  }
+
+  ensureLogDir()
+  killVncStack()
+  await sleep(400)
+
+  writeFileSync(logPath('tigervnc'), '')
+  writeFileSync(logPath('websockify'), '')
+  writeFileSync(logPath('claude-auth'), '')
+  writeFileSync(logPath('chromium'), '')
+
+  // 1. Xtigervnc — virtual X11 display :99 + VNC server on :5900, bypasses Wayland
+  const tigervncFd = openSync(logPath('tigervnc'), 'a')
+  spawn('Xtigervnc', [
+    ':99',
+    '-geometry', '1280x800',
+    '-depth', '24',
+    '-rfbport', '5900',
+    '-localhost',
+    '-SecurityTypes', 'None',
+    '-AlwaysShared',
+  ], {
+    detached: true,
+    stdio: ['ignore', tigervncFd, tigervncFd],
+  }).unref()
+
+  const vncReady = await waitForPort(5900)
+  if (!vncReady) {
+    return NextResponse.json({ error: 'VNC server failed to start' }, { status: 500 })
+  }
+
+  // 2. websockify — WebSocket bridge on :6080, serves noVNC static files
+  const websockifyFd = openSync(logPath('websockify'), 'a')
+  spawn('websockify', ['--web', '/usr/share/novnc', '6080', 'localhost:5900'], {
+    detached: true,
+    stdio: ['ignore', websockifyFd, websockifyFd],
+  }).unref()
+
+  const wsReady = await waitForPort(6080)
+  if (!wsReady) {
+    return NextResponse.json({ error: 'WebSocket proxy failed to start' }, { status: 500 })
+  }
+
+  // Chromium launcher: finds the right binary and injects flags that suppress
+  // the keyring prompt and force X11 display :99.
+  const binDir = resolve(homedir(), '.maxy/bin')
+  mkdirSync(binDir, { recursive: true })
+  const chromiumWrapper = resolve(binDir, 'chromium')
+  writeFileSync(chromiumWrapper, `#!/bin/bash
+LOG="${homedir()}/.maxy/logs/chromium.log"
+echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
+echo "  DISPLAY=$DISPLAY WAYLAND=$WAYLAND_DISPLAY XDG_SESSION_TYPE=$XDG_SESSION_TYPE" >> "$LOG"
+echo "  args: $*" >> "$LOG"
+
+# Check the virtual display is up
+if DISPLAY=:99 xdpyinfo >/dev/null 2>&1; then
+  echo "  xdpyinfo :99 OK" >> "$LOG"
+else
+  echo "  xdpyinfo :99 FAILED — display not ready" >> "$LOG"
+fi
+
+# Try the actual chromium binary first (/usr/bin/chromium on Pi Bookworm).
+# /usr/bin/chromium-browser is a Pi shell script that injects flags which may
+# override --ozone-platform=x11 and break rendering on a virtual X display.
+BIN=""
+for P in /usr/bin/chromium /usr/lib/chromium/chromium /usr/lib/chromium-browser/chromium-browser /usr/bin/chromium-browser /snap/bin/chromium; do
+  [ -x "$P" ] && BIN="$P" && break
+done
+if [ -z "$BIN" ]; then
+  echo "  ERROR: no chromium binary found" >> "$LOG"
+  exit 1
+fi
+echo "  launching $BIN" >> "$LOG"
+
+# nohup detaches chromium from this wrapper's process group so it outlives
+# claude auth login exiting (e.g. on timeout).
+nohup "$BIN" \\
+  --no-sandbox \\
+  --test-type \\
+  --disable-dev-shm-usage \\
+  --disable-gpu \\
+  --password-store=basic \\
+  --use-mock-keychain \\
+  --ozone-platform=x11 \\
+  --no-first-run \\
+  --no-default-browser-check \\
+  --window-size=1280,800 \\
+  --window-position=0,0 \\
+  "$@" >> "$LOG" 2>&1 &
+echo "  chromium PID: $!" >> "$LOG"
+`, { mode: 0o755 })
+
+  // Env: X11 display :99, Wayland suppressed. BROWSER=chromiumWrapper routes
+  // claude's browser-open call through our wrapper, which injects the keyring
+  // flags and finds the correct binary. This preserves the localhost:33051
+  // redirect URI that claude's local auth server needs to complete sign-in.
+  const x11Env = {
+    ...process.env,
+    DISPLAY: ':99',
+    WAYLAND_DISPLAY: '',
+    XDG_SESSION_TYPE: 'x11',
+    BROWSER: chromiumWrapper,
+    PATH: `${binDir}:${process.env.PATH ?? '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'}`,
+  }
+
+  // 3. claude auth login — pipe output to capture the auth URL in logs
+  const claudeAuthLogFd = openSync(logPath('claude-auth'), 'a')
+  const claudeProc = spawn('claude', ['auth', 'login'], {
+    env: x11Env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  claudeProc.unref()
+
+  const onClaudeOutput = (chunk: Buffer) => writeSync(claudeAuthLogFd, chunk)
+  claudeProc.stdout?.on('data', onClaudeOutput)
+  claudeProc.stderr?.on('data', onClaudeOutput)
+  claudeProc.once('close', () => closeSync(claudeAuthLogFd))
+
+  // Wait for claude to open the browser (via $BROWSER → chromiumWrapper).
+  // Chromium on Pi takes ~8-10s to render its first frame; give it time before
+  // the client connects VNC so the first connection sees actual content.
+  await sleep(8000)
+
+  return NextResponse.json({ started: true })
+}

package/payload/maxy/app/api/onboarding/set-pin/route.ts

@@ -0,0 +1,44 @@
+import { NextResponse } from 'next/server'
+import { existsSync, writeFileSync, mkdirSync, readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { createHash } from 'node:crypto'
+
+const PERSISTENT_DIR = resolve(process.env.HOME ?? '/root', '.maxy')
+const PIN_FILE = resolve(PERSISTENT_DIR, '.admin-pin')
+
+function hashPin(pin: string): string {
+  return createHash('sha256').update(pin).digest('hex')
+}
+
+/**
+ * POST /api/onboarding/set-pin
+ * Sets the admin PIN. Only works when no PIN is configured.
+ * Body: { pin: string }
+ */
+export async function POST(req: Request) {
+  if (existsSync(PIN_FILE)) {
+    return NextResponse.json(
+      { error: 'PIN is already configured.' },
+      { status: 409 },
+    )
+  }
+
+  let body: { pin: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
+  }
+
+  if (!body.pin || body.pin.length < 4) {
+    return NextResponse.json(
+      { error: 'PIN must be at least 4 characters.' },
+      { status: 400 },
+    )
+  }
+
+  mkdirSync(PERSISTENT_DIR, { recursive: true })
+  writeFileSync(PIN_FILE, hashPin(body.pin), { mode: 0o600 })
+
+  return NextResponse.json({ ok: true })
+}

package/payload/maxy/app/api/session/route.ts

@@ -0,0 +1,51 @@
+import { NextResponse } from 'next/server'
+import { registerSession } from '../../lib/claude-agent'
+import { readFileSync, readdirSync, existsSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const ACCOUNTS_DIR = resolve(process.cwd(), '../platform/config/accounts')
+
+/** Find the first account's ID. Phase 0: single account. */
+function getDefaultAccountId(): string | null {
+  if (!existsSync(ACCOUNTS_DIR)) return null
+  const entries = readdirSync(ACCOUNTS_DIR, { withFileTypes: true })
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue
+    const configPath = resolve(ACCOUNTS_DIR, entry.name, 'account.json')
+    if (!existsSync(configPath)) continue
+    const config = JSON.parse(readFileSync(configPath, 'utf-8'))
+    return config.accountId
+  }
+  return null
+}
+
+/**
+ * POST /api/session
+ * Creates a local session for the public chat agent.
+ * Returns a session_key for subsequent chat requests.
+ */
+export async function POST(req: Request) {
+  let body: { session_id: string }
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
+  }
+
+  if (!body.session_id || typeof body.session_id !== 'string') {
+    return NextResponse.json({ error: 'session_id required' }, { status: 400 })
+  }
+
+  const accountId = getDefaultAccountId()
+  if (!accountId) {
+    return NextResponse.json({ error: 'No account configured' }, { status: 503 })
+  }
+
+  const sessionKey = crypto.randomUUID()
+  registerSession(sessionKey, 'public', accountId)
+
+  return NextResponse.json({
+    session_key: sessionKey,
+    agent_id: 'public',
+  })
+}

package/payload/maxy/app/api/telegram/webhook/route.ts

@@ -0,0 +1,107 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { invokeAgent } from '../../../lib/claude-agent'
+
+const TELEGRAM_API = 'https://api.telegram.org'
+
+interface TelegramUpdate {
+  message?: {
+    chat: { id: number }
+    from?: { first_name?: string; last_name?: string; username?: string }
+    text?: string
+  }
+  callback_query?: {
+    id: string
+    message?: { chat: { id: number } }
+    data?: string
+  }
+}
+
+/**
+ * POST /api/telegram/webhook
+ * Handles incoming Telegram bot updates.
+ * Invokes the public agent and sends the response back via Telegram.
+ */
+export async function POST(req: NextRequest) {
+  const botToken = process.env.TELEGRAM_PUBLIC_BOT_TOKEN
+  if (!botToken) {
+    return NextResponse.json({ error: 'Bot token not configured' }, { status: 500 })
+  }
+
+  let update: TelegramUpdate
+  try {
+    update = await req.json()
+  } catch {
+    return NextResponse.json({ ok: true })
+  }
+
+  // Handle text messages
+  if (update.message?.text) {
+    const chatId = update.message.chat.id
+    const text = update.message.text
+
+    // Collect the full response from the agent
+    let responseText = ''
+    try {
+      for await (const event of invokeAgent({ type: 'public' }, text)) {
+        if (event.type === 'text') {
+          responseText += event.content
+        }
+      }
+    } catch (err) {
+      responseText = "I'm having trouble right now. Please try again in a moment."
+    }
+
+    if (responseText) {
+      await fetch(`${TELEGRAM_API}/bot${botToken}/sendMessage`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          chat_id: chatId,
+          text: responseText,
+          parse_mode: 'HTML',
+        }),
+      })
+    }
+  }
+
+  // Handle callback queries (inline keyboard buttons)
+  if (update.callback_query) {
+    const callbackId = update.callback_query.id
+    const chatId = update.callback_query.message?.chat.id
+    const data = update.callback_query.data
+
+    // Answer the callback to remove loading indicator
+    await fetch(`${TELEGRAM_API}/bot${botToken}/answerCallbackQuery`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ callback_query_id: callbackId }),
+    })
+
+    if (chatId && data) {
+      let responseText = ''
+      try {
+        for await (const event of invokeAgent({ type: 'public' }, data)) {
+          if (event.type === 'text') {
+            responseText += event.content
+          }
+        }
+      } catch {
+        responseText = "I'm having trouble right now. Please try again in a moment."
+      }
+
+      if (responseText) {
+        await fetch(`${TELEGRAM_API}/bot${botToken}/sendMessage`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            chat_id: chatId,
+            text: responseText,
+            parse_mode: 'HTML',
+          }),
+        })
+      }
+    }
+  }
+
+  return NextResponse.json({ ok: true })
+}