@rubytech/create-maxy 1.0.660 → 1.0.662

package/payload/server/server.js

@@ -1201,14 +1201,14 @@ var Hono = class _Hono {
    * app.route("/api", app2) // GET /api/user
    * ```
    */
-  route(path2, app33) {
+  route(path2, app35) {
     const subApp = this.basePath(path2);
-    app33.routes.map((r) => {
+    app35.routes.map((r) => {
       let handler;
-      if (app33.errorHandler === errorHandler) {
+      if (app35.errorHandler === errorHandler) {
         handler = r.handler;
       } else {
-        handler = async (c, next) => (await compose([], app33.errorHandler)(c, () => r.handler(c, next))).res;
+        handler = async (c, next) => (await compose([], app35.errorHandler)(c, () => r.handler(c, next))).res;
         handler[COMPOSED_HANDLER] = r.handler;
       }
       subApp.#addRoute(r.method, r.path, handler);
@@ -3855,6 +3855,8 @@ function terminalLog(phase, fields = {}) {
 // server/ws-proxy-terminal.ts
 var WS_PATH2 = "/admin/terminal/ws";
 var UPSTREAM_TIMEOUT_MS2 = 5e3;
+var FLOW_TICK_MS = 5e3;
+var FLOW_IDLE_EMIT_MS = 3e4;
 var HOP_BY_HOP2 = /* @__PURE__ */ new Set([
   "connection",
   "keep-alive",
@@ -3979,9 +3981,17 @@ function handleUpgrade2(req, clientSocket, head, opts) {
   let bytesUpstreamToClient = 0;
   let closedBy = null;
   let proxyOpened = false;
+  let lastUpstreamByteTs = 0;
+  let flowInterval = null;
+  let lastEmittedAt = 0;
+  let lastEmittedUpstreamBytes = 0;
   const finish = (side, reason) => {
     if (closedBy) return;
     closedBy = side;
+    if (flowInterval) {
+      clearInterval(flowInterval);
+      flowInterval = null;
+    }
     if (proxyOpened) {
       terminalLog("proxy-close", {
         corrId,
@@ -4025,9 +4035,28 @@ function handleUpgrade2(req, clientSocket, head, opts) {
     });
     upstream.on("data", (chunk) => {
       bytesUpstreamToClient += chunk.length;
+      lastUpstreamByteTs = Date.now();
     });
     clientSocket.pipe(upstream);
     upstream.pipe(clientSocket);
+    lastEmittedAt = Date.now();
+    lastEmittedUpstreamBytes = 0;
+    flowInterval = setInterval(() => {
+      const now = Date.now();
+      const idleMs = lastUpstreamByteTs === 0 ? now - lastEmittedAt : now - lastUpstreamByteTs;
+      const upstreamMoved = bytesUpstreamToClient !== lastEmittedUpstreamBytes;
+      const sinceLastEmit = now - lastEmittedAt;
+      if (upstreamMoved || sinceLastEmit >= FLOW_IDLE_EMIT_MS) {
+        terminalLog("proxy-flow", {
+          corrId,
+          clientBytes: bytesClientToUpstream,
+          upstreamBytes: bytesUpstreamToClient,
+          idleMs
+        });
+        lastEmittedAt = now;
+        lastEmittedUpstreamBytes = bytesUpstreamToClient;
+      }
+    }, FLOW_TICK_MS);
     clientSocket.once("close", (hadError) => {
       finish("client", hadError ? "error" : "normal");
     });
@@ -20870,7 +20899,7 @@ var ALL_GRAPH_LABELS = Object.freeze(
   Object.keys(GRAPH_LABEL_COLOURS)
 );
 var HIDDEN_BY_DEFAULT_LABELS = Object.freeze(
-  /* @__PURE__ */ new Set(["Chunk"])
+  /* @__PURE__ */ new Set(["Chunk", "GraphPreference"])
 );
 function isKnownLabel(label) {
   return Object.prototype.hasOwnProperty.call(GRAPH_LABEL_COLOURS, label);
@@ -21270,9 +21299,183 @@ app28.post("/", requireAdminSession, async (c) => {
 });
 var graph_restore_default = app28;
 
-// server/routes/admin/file-attach.ts
+// server/routes/admin/graph-labels-in-graph.ts
 var app29 = new Hono2();
-app29.post("/", async (c) => {
+app29.get("/", requireAdminSession, async (c) => {
+  const sessionKey = c.var.sessionKey;
+  const accountId = getAccountIdForSession(sessionKey);
+  if (!accountId) {
+    console.error('[graph-page] labels-in-graph-rejected reason="no account for session"');
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const started = Date.now();
+  const session = getSession();
+  try {
+    const hidden = [...HIDDEN_BY_DEFAULT_LABELS];
+    const result = await session.executeRead(async (tx) => {
+      return await tx.run(LABELS_IN_GRAPH_CYPHER, { accountId, hidden });
+    });
+    const record = result.records[0];
+    const rawLabels = record?.get("labels") ?? [];
+    const labels = [...new Set(rawLabels)].sort();
+    const elapsed = Date.now() - started;
+    console.error(
+      `[graph-page] labels-in-graph account=${accountId} labels=${labels.join(",")} ms=${elapsed}`
+    );
+    return c.json({ labels });
+  } catch (err) {
+    const elapsed = Date.now() - started;
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[graph-page] labels-in-graph-rejected account=${accountId} reason="${message}" ms=${elapsed}`
+    );
+    return c.json({ error: `Graph labels unavailable: ${message}` }, 503);
+  } finally {
+    try {
+      await session.close();
+    } catch {
+    }
+  }
+});
+var LABELS_IN_GRAPH_CYPHER = `
+  MATCH (n)
+  WHERE n.accountId = $accountId
+    AND NOT n:Trashed
+    AND n.deletedAt IS NULL
+  UNWIND labels(n) AS lbl
+  WITH DISTINCT lbl
+  WHERE NOT lbl IN $hidden
+  RETURN collect(lbl) AS labels
+`;
+var graph_labels_in_graph_default = app29;
+
+// server/routes/admin/graph-default-view.ts
+var app30 = new Hono2();
+app30.get("/", requireAdminSession, async (c) => {
+  const sessionKey = c.var.sessionKey;
+  const accountId = getAccountIdForSession(sessionKey);
+  const userId = getUserIdForSession(sessionKey);
+  if (!accountId || !userId) {
+    console.error('[graph-page] default-view-rejected reason="missing account or user context"');
+    return c.json({ error: "Account and user context required for default view" }, 401);
+  }
+  const started = Date.now();
+  const session = getSession();
+  try {
+    const result = await session.executeRead(async (tx) => {
+      return await tx.run(READ_CYPHER, { accountId, userId });
+    });
+    const record = result.records[0];
+    const rawLabels = record?.get("labels");
+    const rawIncludeTrashed = record?.get("includeTrashed");
+    const labels = Array.isArray(rawLabels) ? rawLabels : [];
+    const includeTrashed = rawIncludeTrashed === true;
+    const elapsed = Date.now() - started;
+    console.error(
+      `[graph-page] default-view-load account=${accountId} labels=${labels.join(",")} includeTrashed=${includeTrashed ? 1 : 0} ms=${elapsed}`
+    );
+    return c.json({ labels, includeTrashed });
+  } catch (err) {
+    const elapsed = Date.now() - started;
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[graph-page] default-view-rejected op=load account=${accountId} reason="${message}" ms=${elapsed}`
+    );
+    return c.json({ error: `Graph default view unavailable: ${message}` }, 503);
+  } finally {
+    try {
+      await session.close();
+    } catch {
+    }
+  }
+});
+app30.put("/", requireAdminSession, async (c) => {
+  const sessionKey = c.var.sessionKey;
+  const accountId = getAccountIdForSession(sessionKey);
+  const userId = getUserIdForSession(sessionKey);
+  if (!accountId || !userId) {
+    console.error('[graph-page] default-view-rejected reason="missing account or user context"');
+    return c.json({ error: "Account and user context required for default view" }, 401);
+  }
+  const body = await safeJson(c);
+  if (!body) {
+    return c.json({ error: "Request body must be JSON" }, 400);
+  }
+  const validation = validateBody2(body);
+  if (!validation.ok) {
+    console.error(
+      `[graph-page] default-view-rejected op=save account=${accountId} reason="${validation.reason}"`
+    );
+    return c.json({ error: validation.reason }, 400);
+  }
+  const { labels, includeTrashed } = validation;
+  const session = getSession();
+  try {
+    await session.executeWrite(async (tx) => {
+      return await tx.run(WRITE_CYPHER, {
+        accountId,
+        userId,
+        labels,
+        includeTrashed,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    });
+    console.error(
+      `[graph-page] default-view-save account=${accountId} labels=${labels.join(",")} includeTrashed=${includeTrashed ? 1 : 0}`
+    );
+    return c.json({ labels, includeTrashed });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[graph-page] default-view-rejected op=save account=${accountId} reason="${message}"`
+    );
+    return c.json({ error: `Failed to save graph default view: ${message}` }, 503);
+  } finally {
+    try {
+      await session.close();
+    } catch {
+    }
+  }
+});
+function validateBody2(body) {
+  if (!Array.isArray(body.labels)) {
+    return { ok: false, reason: "labels must be an array of strings" };
+  }
+  if (typeof body.includeTrashed !== "boolean") {
+    return { ok: false, reason: "includeTrashed must be a boolean" };
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const lbl of body.labels) {
+    if (typeof lbl !== "string") {
+      return { ok: false, reason: "labels must be an array of strings" };
+    }
+    if (!isKnownLabel(lbl)) {
+      return { ok: false, reason: `unknown label "${lbl}" \u2014 not registered in graph-labels.ts` };
+    }
+    if (isHiddenByDefault(lbl)) {
+      return { ok: false, reason: `label "${lbl}" is hidden by default and cannot be a default view selection` };
+    }
+    seen.add(lbl);
+  }
+  const labels = [...seen].sort();
+  return { ok: true, labels, includeTrashed: body.includeTrashed };
+}
+var READ_CYPHER = `
+  OPTIONAL MATCH (p:GraphPreference {accountId: $accountId, userId: $userId})
+  RETURN p.labels AS labels, p.includeTrashed AS includeTrashed
+`;
+var WRITE_CYPHER = `
+  MERGE (p:GraphPreference {accountId: $accountId, userId: $userId})
+  SET p.labels = $labels,
+      p.includeTrashed = $includeTrashed,
+      p.updatedAt = $updatedAt
+  RETURN p.labels AS labels
+`;
+var graph_default_view_default = app30;
+
+// server/routes/admin/file-attach.ts
+var app31 = new Hono2();
+app31.post("/", async (c) => {
   try {
     const body = await c.req.json();
     const { filePath, accountId } = body;
@@ -21295,11 +21498,11 @@ app29.post("/", async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var file_attach_default = app29;
+var file_attach_default = app31;
 
 // server/routes/admin/adherence.ts
-var app30 = new Hono2();
-app30.get("/", requireAdminSession, async (c) => {
+var app32 = new Hono2();
+app32.get("/", requireAdminSession, async (c) => {
   const agent = c.req.query("agent") ?? "admin";
   const includeBlock = c.req.query("block") === "1";
   const account = resolveAccount();
@@ -21320,32 +21523,34 @@ app30.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to read adherence ledger", agent }, 500);
   }
 });
-var adherence_default = app30;
+var adherence_default = app32;
 
 // server/routes/admin/index.ts
-var app31 = new Hono2();
-app31.route("/session", session_default2);
-app31.route("/chat", chat_default2);
-app31.route("/compact", compact_default);
-app31.route("/logs", logs_default);
-app31.route("/claude-info", claude_info_default);
-app31.route("/attachment", attachment_default);
-app31.route("/account", account_default);
-app31.route("/agents", agents_default);
-app31.route("/version", version_default);
-app31.route("/sessions", sessions_default);
-app31.route("/browser", browser_default);
-app31.route("/device-browser", device_browser_default);
-app31.route("/events", events_default);
-app31.route("/cloudflare", cloudflare_default);
-app31.route("/files", files_default);
-app31.route("/graph-search", graph_search_default);
-app31.route("/graph-subgraph", graph_subgraph_default);
-app31.route("/graph-delete", graph_delete_default);
-app31.route("/graph-restore", graph_restore_default);
-app31.route("/file-attach", file_attach_default);
-app31.route("/adherence", adherence_default);
-var admin_default = app31;
+var app33 = new Hono2();
+app33.route("/session", session_default2);
+app33.route("/chat", chat_default2);
+app33.route("/compact", compact_default);
+app33.route("/logs", logs_default);
+app33.route("/claude-info", claude_info_default);
+app33.route("/attachment", attachment_default);
+app33.route("/account", account_default);
+app33.route("/agents", agents_default);
+app33.route("/version", version_default);
+app33.route("/sessions", sessions_default);
+app33.route("/browser", browser_default);
+app33.route("/device-browser", device_browser_default);
+app33.route("/events", events_default);
+app33.route("/cloudflare", cloudflare_default);
+app33.route("/files", files_default);
+app33.route("/graph-search", graph_search_default);
+app33.route("/graph-subgraph", graph_subgraph_default);
+app33.route("/graph-delete", graph_delete_default);
+app33.route("/graph-restore", graph_restore_default);
+app33.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app33.route("/graph-default-view", graph_default_view_default);
+app33.route("/file-attach", file_attach_default);
+app33.route("/adherence", adherence_default);
+var admin_default = app33;
 
 // server/index.ts
 var PLATFORM_ROOT11 = process.env.MAXY_PLATFORM_ROOT || "";
@@ -21403,9 +21608,9 @@ watchFile(ALIAS_DOMAINS_PATH2, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app32 = new Hono2();
-app32.use("*", clientIpMiddleware);
-app32.use("*", async (c, next) => {
+var app34 = new Hono2();
+app34.use("*", clientIpMiddleware);
+app34.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -21428,7 +21633,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/g/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app32.use("*", async (c, next) => {
+app34.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -21468,7 +21673,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app32.post("/__remote-auth/login", async (c) => {
+app34.post("/__remote-auth/login", async (c) => {
   const clientIp = c.var.clientIp || "unknown";
   const rateLimited = checkRateLimit(clientIp);
   if (rateLimited) {
@@ -21504,7 +21709,7 @@ app32.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app32.get("/__remote-auth/logout", (c) => {
+app34.get("/__remote-auth/logout", (c) => {
   const cookieHeader = c.req.header("cookie");
   const token = parseCookie(cookieHeader, "__remote_session");
   if (token) invalidateRemoteSession(token);
@@ -21517,7 +21722,7 @@ app32.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app32.post("/__remote-auth/change-password", async (c) => {
+app34.post("/__remote-auth/change-password", async (c) => {
   const clientIp = c.var.clientIp || "unknown";
   const rateLimited = checkRateLimit(clientIp);
   if (rateLimited) {
@@ -21566,13 +21771,13 @@ app32.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app32.get("/__remote-auth/setup", (c) => {
+app34.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app32.post("/__remote-auth/set-initial-password", async (c) => {
+app34.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -21608,10 +21813,10 @@ app32.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app32.get("/api/remote-auth/status", (c) => {
+app34.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app32.post("/api/remote-auth/set-password", async (c) => {
+app34.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21641,9 +21846,9 @@ app32.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app32.route("/api/_client-error", client_error_default);
+app34.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app32.use("*", async (c, next) => {
+app34.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -21683,15 +21888,15 @@ function parseCookie(cookieHeader, name) {
     return null;
   }
 }
-app32.route("/api/health", health_default);
-app32.route("/api/session", session_default);
-app32.route("/api/chat", chat_default);
-app32.route("/api/group", group_default);
-app32.route("/api/access", access_default);
-app32.route("/api/telegram", telegram_default);
-app32.route("/api/whatsapp", whatsapp_default);
-app32.route("/api/onboarding", onboarding_default);
-app32.route("/api/admin", admin_default);
+app34.route("/api/health", health_default);
+app34.route("/api/session", session_default);
+app34.route("/api/chat", chat_default);
+app34.route("/api/group", group_default);
+app34.route("/api/access", access_default);
+app34.route("/api/telegram", telegram_default);
+app34.route("/api/whatsapp", whatsapp_default);
+app34.route("/api/onboarding", onboarding_default);
+app34.route("/api/admin", admin_default);
 var SAFE_SLUG_RE = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -21703,7 +21908,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app32.get("/agent-assets/:slug/:filename", (c) => {
+app34.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE.test(slug)) {
@@ -21738,7 +21943,7 @@ app32.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app32.get("/generated/:filename", (c) => {
+app34.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -21903,7 +22108,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml2(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app32.get("/", (c) => {
+app34.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -21911,12 +22116,12 @@ app32.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app32.get("/public", (c) => {
+app34.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app32.get("/chat", (c) => {
+app34.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -21935,9 +22140,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app32.use("/vnc-viewer.html", logViewerFetch);
-app32.use("/vnc-popout.html", logViewerFetch);
-app32.get("/vnc-popout.html", (c) => {
+app34.use("/vnc-viewer.html", logViewerFetch);
+app34.use("/vnc-popout.html", logViewerFetch);
+app34.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync26(resolve30(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -21950,7 +22155,7 @@ app32.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app32.post("/api/vnc/client-event", async (c) => {
+app34.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21971,20 +22176,20 @@ app32.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app32.get("/g/:slug", (c) => {
+app34.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app32.get("/graph", (c) => {
+app34.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app32.get("/data", (c) => {
+app34.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app32.get("/:slug", async (c, next) => {
+app34.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -21993,10 +22198,10 @@ app32.get("/:slug", async (c, next) => {
   }
   await next();
 });
-app32.use("/*", serveStatic({ root: "./public" }));
+app34.use("/*", serveStatic({ root: "./public" }));
 var port = parseInt(process.env.PORT ?? "19200", 10);
 var hostname = process.env.HOSTNAME ?? "0.0.0.0";
-var httpServer = serve({ fetch: app32.fetch, port, hostname });
+var httpServer = serve({ fetch: app34.fetch, port, hostname });
 attachVncWsProxy(httpServer, {
   isPublicHost,
   upstreamHost: "127.0.0.1",
@@ -22042,7 +22247,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app32.routes ?? []) {
+  for (const r of app34.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });