@rubytech/create-realagent 1.0.406

package/dist/index.js

@@ -0,0 +1,915 @@
+#!/usr/bin/env node
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync } from "node:fs";
+import { resolve, join } from "node:path";
+import { randomBytes } from "node:crypto";
+const PAYLOAD_DIR = resolve(import.meta.dirname, "../payload");
+// Brand manifest — read from payload to derive all brand-specific installation values.
+// The bundler stamps brand.json into the payload at build time.
+const BRAND_PATH = join(PAYLOAD_DIR, "platform", "config", "brand.json");
+if (!existsSync(BRAND_PATH)) {
+    console.error("FATAL: brand.json not found in payload. Package may be corrupted.");
+    process.exit(1);
+}
+let BRAND;
+try {
+    BRAND = JSON.parse(readFileSync(BRAND_PATH, "utf-8"));
+}
+catch (err) {
+    console.error(`FATAL: Failed to parse brand.json: ${err.message}`);
+    process.exit(1);
+}
+const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
+const LOG_DIR = resolve(process.env.HOME ?? "/root", BRAND.configDir, "logs");
+const LOG_FILE = join(LOG_DIR, `install-${new Date().toISOString().replace(/[:.]/g, "-")}.log`);
+// npm flags tuned for Raspberry Pi — reduce parallelism, increase patience
+const NPM_NET_FLAGS = [
+    "--fetch-retries=5",
+    "--fetch-retry-mintimeout=30000",
+    "--fetch-retry-maxtimeout=120000",
+    "--maxsockets=3",
+];
+// ---------------------------------------------------------------------------
+// Logging — timestamped to console AND persistent log file
+// ---------------------------------------------------------------------------
+function initLogging() {
+    mkdirSync(LOG_DIR, { recursive: true });
+    appendFileSync(LOG_FILE, [
+        "",
+        "=".repeat(64),
+        `  ${BRAND.productName} Install Log — ${new Date().toISOString()}`,
+        `  Node ${process.version} | ${process.platform} ${process.arch}`,
+        "=".repeat(64),
+        "",
+    ].join("\n") + "\n");
+}
+function logFile(msg) {
+    try {
+        appendFileSync(LOG_FILE, `[${new Date().toISOString()}] ${msg}\n`);
+    }
+    catch { /* fs full */ }
+}
+// Mirror all console output into the log file
+const _log = console.log;
+const _err = console.error;
+console.log = (...args) => { _log(...args); logFile(args.map(String).join(" ")); };
+console.error = (...args) => { _err(...args); logFile(`[ERROR] ${args.map(String).join(" ")}`); };
+// ---------------------------------------------------------------------------
+// Diagnostics — system state snapshot for post-mortem analysis
+// ---------------------------------------------------------------------------
+function logDiagnostics(label) {
+    logFile(`\n--- Diagnostics: ${label} ---`);
+    if (!isLinux()) {
+        logFile("  (not Linux — limited diagnostics)");
+        return;
+    }
+    const run = (cmd, args) => {
+        const r = spawnSync(cmd, args, { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });
+        return (r.stdout || r.stderr || "").trim();
+    };
+    logFile(`Disk:\n${run("df", ["-h", "/", "/tmp"])}`);
+    logFile(`Memory:\n${run("free", ["-h"])}`);
+    logFile(`Uptime: ${run("uptime", [])}`);
+    for (const host of ["registry.npmjs.org", "github.com"]) {
+        const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });
+        logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`);
+    }
+    const curl = spawnSync("curl", [
+        "-sf", "-o", "/dev/null",
+        "-w", "HTTP %{http_code} in %{time_total}s (dns: %{time_namelookup}s, connect: %{time_connect}s)",
+        "--connect-timeout", "10",
+        "https://registry.npmjs.org/",
+    ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 });
+    logFile(`Registry HTTP: ${curl.stdout?.trim() || `FAIL — ${curl.stderr?.trim()}`}`);
+    logFile(`--- End Diagnostics ---\n`);
+}
+/** Append the most recent npm debug log into our install log for post-mortem. */
+function captureNpmDebugLog() {
+    const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs");
+    if (!existsSync(logsDir))
+        return;
+    try {
+        const files = readdirSync(logsDir).filter(f => f.endsWith("-debug-0.log")).sort().reverse();
+        if (files[0]) {
+            const content = readFileSync(join(logsDir, files[0]), "utf-8");
+            logFile(`\n--- npm debug log: ${files[0]} (last 200 lines) ---`);
+            const lines = content.split("\n");
+            logFile(lines.slice(Math.max(0, lines.length - 200)).join("\n"));
+            logFile(`--- end npm debug log ---\n`);
+        }
+    }
+    catch { /* ignore */ }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function log(step, total, message) {
+    console.log(`[${step}/${total}] ${message}`);
+}
+function shell(command, args, options) {
+    const cmd = options?.sudo ? "sudo" : command;
+    const cmdArgs = options?.sudo ? [command, ...args] : args;
+    const start = Date.now();
+    logFile(`> ${cmd} ${cmdArgs.join(" ")}${options?.cwd ? ` [cwd: ${options.cwd}]` : ""}`);
+    const result = spawnSync(cmd, cmdArgs, {
+        stdio: "inherit",
+        timeout: options?.timeout ?? 300_000,
+        cwd: options?.cwd,
+    });
+    const dur = ((Date.now() - start) / 1000).toFixed(1);
+    if (result.signal) {
+        logFile(`  KILLED (${result.signal}) after ${dur}s`);
+        throw new Error(`Command killed (${result.signal}) after ${dur}s: ${cmd} ${cmdArgs.join(" ")}`);
+    }
+    if (result.status !== 0) {
+        logFile(`  FAILED (exit ${result.status}) after ${dur}s`);
+        throw new Error(`Command failed (exit ${result.status}) after ${dur}s: ${cmd} ${cmdArgs.join(" ")}`);
+    }
+    logFile(`  OK in ${dur}s`);
+}
+/** Wait until DNS resolves for a host. Returns true if recovered. */
+function waitForDns(host, maxSec = 60) {
+    for (let elapsed = 0; elapsed < maxSec; elapsed += 5) {
+        const r = spawnSync("host", ["-W", "3", host], { stdio: "pipe", timeout: 5_000 });
+        if (r.status === 0) {
+            logFile(`  DNS ${host}: recovered after ${elapsed}s`);
+            return true;
+        }
+        console.log(`  DNS ${host} not resolving — waiting (${elapsed}s/${maxSec}s)...`);
+        spawnSync("sleep", ["5"]);
+    }
+    return false;
+}
+/** Retry a shell command with exponential backoff. Runs network diagnostics between attempts. */
+function shellRetry(command, args, options, maxAttempts = 3, backoffSec = 20) {
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+            shell(command, args, options);
+            return;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            logFile(`  Attempt ${attempt}/${maxAttempts} error: ${msg}`);
+            if (attempt === maxAttempts) {
+                console.error(`  All ${maxAttempts} attempts failed.`);
+                logDiagnostics(`final failure — ${command}`);
+                if (command === "npm")
+                    captureNpmDebugLog();
+                throw err;
+            }
+            const wait = backoffSec * attempt;
+            console.log(`  Attempt ${attempt}/${maxAttempts} failed. Retrying in ${wait}s...`);
+            // On network errors, diagnose and wait for DNS recovery before retrying
+            if (/ETIMEDOUT|EAI_AGAIN|ECONNRESET|ENOTFOUND|ENETUNREACH/.test(msg)) {
+                console.log("  Network error — running diagnostics...");
+                logDiagnostics(`network failure — attempt ${attempt}`);
+                waitForDns("registry.npmjs.org");
+            }
+            if (command === "npm")
+                captureNpmDebugLog();
+            spawnSync("sleep", [String(wait)]);
+        }
+    }
+}
+function commandExists(cmd) {
+    try {
+        execFileSync("which", [cmd], { stdio: "pipe" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function nodeVersion() {
+    try {
+        const v = execFileSync("node", ["-v"], { encoding: "utf-8" }).trim();
+        return parseInt(v.replace("v", "").split(".")[0], 10);
+    }
+    catch {
+        return 0;
+    }
+}
+function isLinux() {
+    return process.platform === "linux";
+}
+function isArm64() {
+    return process.arch === "arm64";
+}
+// ---------------------------------------------------------------------------
+// Installation steps
+// ---------------------------------------------------------------------------
+const TOTAL = "10";
+function installSystemDeps() {
+    log("1", TOTAL, "System dependencies and network...");
+    if (!isLinux()) {
+        console.log("  Skipping Linux-specific setup (not on Linux).");
+        return;
+    }
+    shell("apt-get", ["update"], { sudo: true });
+    shell("apt-get", ["install", "-y", "curl", "git", "unzip", "jq", "avahi-daemon", "avahi-utils", "poppler-utils"], { sudo: true });
+    shell("apt-get", ["install", "-y", "tigervnc-standalone-server", "python3-websockify", "novnc", "xdg-utils", "chromium"], { sudo: true });
+    // Set hostname from brand manifest
+    try {
+        const currentHostname = execFileSync("hostname", [], { encoding: "utf-8" }).trim();
+        if (currentHostname !== BRAND.hostname) {
+            console.log(`  Setting hostname to '${BRAND.hostname}' (was '${currentHostname}')...`);
+            shell("hostnamectl", ["set-hostname", BRAND.hostname], { sudo: true });
+            shell("sed", ["-i", `s/127\\.0\\.1\\.1.*$/127.0.1.1\\t${BRAND.hostname}/`, "/etc/hosts"], { sudo: true });
+        }
+    }
+    catch { /* not critical */ }
+    // Avahi service file for LAN discovery
+    const avahiService = `<?xml version="1.0" standalone='no'?>
+<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
+<service-group>
+  <name replace-wildcards="yes">${BRAND.productName} on %h</name>
+  <service>
+    <type>_http._tcp</type>
+    <port>19200</port>
+    <txt-record>role=${BRAND.hostname}</txt-record>
+  </service>
+</service-group>`;
+    const avahiTmpPath = `/tmp/${BRAND.hostname}-avahi.service`;
+    const avahiDestPath = `/etc/avahi/services/${BRAND.hostname}.service`;
+    try {
+        writeFileSync(avahiTmpPath, avahiService);
+        shell("cp", [avahiTmpPath, avahiDestPath], { sudo: true });
+        shell("systemctl", ["enable", "avahi-daemon"], { sudo: true });
+        shell("systemctl", ["restart", "avahi-daemon"], { sudo: true });
+    }
+    catch { /* not critical */ }
+    // Disable WiFi power management — the Pi's WiFi driver aggressively sleeps
+    // the radio between transmissions, causing dropped DNS/mDNS packets and
+    // intermittent connection resets on LAN.
+    try {
+        const nmConfDir = "/etc/NetworkManager/conf.d";
+        const nmConfFile = join(nmConfDir, `${BRAND.hostname}-no-powersave.conf`);
+        if (existsSync("/usr/bin/nmcli") && !existsSync(nmConfFile)) {
+            console.log("  Disabling WiFi power save...");
+            writeFileSync(`/tmp/${BRAND.hostname}-no-powersave.conf`, "[connection]\nwifi.powersave = 2\n");
+            shell("cp", [`/tmp/${BRAND.hostname}-no-powersave.conf`, nmConfFile], { sudo: true });
+            spawnSync("sudo", ["systemctl", "restart", "NetworkManager"], { stdio: "pipe" });
+        }
+    }
+    catch { /* not critical — wired connections unaffected */ }
+    console.log(`  Device reachable at http://${BRAND.hostname}.local:19200`);
+}
+function installNodejs() {
+    if (commandExists("node") && nodeVersion() >= 20) {
+        log("2", TOTAL, `Node.js v${nodeVersion()} already installed.`);
+        return;
+    }
+    log("2", TOTAL, "Installing Node.js...");
+    if (!isLinux()) {
+        throw new Error("Automatic Node.js installation is only supported on Linux. Install Node.js 20+ manually.");
+    }
+    spawnSync("bash", ["-c", "curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -"], { stdio: "inherit" });
+    shell("apt-get", ["install", "-y", "nodejs"], { sudo: true });
+}
+function installClaudeCode() {
+    let needsInstall = true;
+    if (commandExists("claude")) {
+        try {
+            const installed = execFileSync("claude", ["--version"], { encoding: "utf-8", timeout: 10_000 }).trim();
+            let latest = null;
+            try {
+                latest = execFileSync("npm", ["view", "@anthropic-ai/claude-code", "version"], { encoding: "utf-8", timeout: 30_000 }).trim();
+            }
+            catch {
+                logFile("  Could not check latest version — will attempt install anyway");
+            }
+            if (latest && installed === latest) {
+                log("3", TOTAL, `Claude Code v${installed} already up to date.`);
+                needsInstall = false;
+            }
+            else {
+                log("3", TOTAL, `Upgrading Claude Code (${installed}${latest ? ` → ${latest}` : ""})...`);
+            }
+        }
+        catch {
+            log("3", TOTAL, "Claude Code found but version check failed. Reinstalling...");
+        }
+    }
+    else {
+        log("3", TOTAL, "Installing Claude Code...");
+    }
+    if (needsInstall) {
+        console.log("  This may take 15–30 minutes on Raspberry Pi...");
+        shellRetry("npm", ["install", "-g", ...NPM_NET_FLAGS, "--loglevel", "verbose", "@anthropic-ai/claude-code@latest"], { sudo: true, timeout: 2_400_000 }, // 40 min — Pi downloads can take 25+ min
+        3, 30);
+    }
+    console.log("  Registering claude-plugins-official marketplace...");
+    const marketplaceList = spawnSync("claude", ["plugin", "marketplace", "list"], { stdio: "pipe", encoding: "utf-8" });
+    if (marketplaceList.stderr)
+        process.stderr.write(marketplaceList.stderr);
+    if (!marketplaceList.stdout?.includes("claude-plugins-official")) {
+        shell("claude", ["plugin", "marketplace", "add", "anthropics/claude-plugins-official"]);
+    }
+    console.log("  Configuring git to use HTTPS for GitHub (plugin install support)...");
+    shell("git", ["config", "--global", "url.https://github.com/.insteadOf", "git@github.com:"]);
+    // Remove the Playwright plugin if previously installed. The programmatic MCP
+    // server in claude-agent.ts (with --cdp-endpoint) is the single correct path.
+    // The plugin creates a shadow server that intermittently handles tool calls
+    // without --cdp-endpoint, causing Chrome launch failures on ARM64.
+    const pluginList = spawnSync("claude", ["plugin", "list"], { stdio: "pipe", encoding: "utf-8" });
+    if (pluginList.stdout?.includes("playwright")) {
+        console.log("  Removing Playwright plugin (replaced by programmatic CDP server)...");
+        spawnSync("claude", ["plugin", "uninstall", "playwright"], { stdio: "inherit" });
+    }
+    // Ensure @playwright/mcp and all its dependencies (including playwright-core)
+    // are cached. Wipe any stale npx cache for it first — killed installs on Pi
+    // leave corrupt temp dirs that block subsequent npm operations.
+    console.log("  Pre-caching Playwright MCP server...");
+    const npxDir = resolve(process.env.HOME ?? "/root", ".npm/_npx");
+    const findResult = spawnSync("find", [npxDir, "-path", "*/@playwright/mcp/package.json", "-print", "-quit"], {
+        encoding: "utf-8", stdio: "pipe",
+    });
+    const existingCache = findResult.stdout?.trim();
+    if (existingCache) {
+        // Nuke the entire npx cache entry to avoid ENOTEMPTY errors
+        const cacheEntry = resolve(existingCache, "../../..");
+        spawnSync("rm", ["-rf", cacheEntry], { stdio: "pipe" });
+    }
+    // Fresh install — npx creates a clean cache with all deps
+    const npxResult = spawnSync("npx", ["-y", "@playwright/mcp@latest", "--version"], {
+        stdio: "pipe",
+        timeout: 180000,
+        encoding: "utf-8",
+    });
+    // Verify playwright-core landed
+    const verifyResult = spawnSync("find", [npxDir, "-path", "*/playwright-core/package.json", "-print", "-quit"], {
+        encoding: "utf-8", stdio: "pipe",
+    });
+    if (verifyResult.stdout?.trim()) {
+        console.log("  Playwright MCP server cached with all dependencies.");
+    }
+    else {
+        console.log(`  Warning: Playwright MCP cache may be incomplete (browser automation may not work).${npxResult.stderr ? ` npx stderr: ${npxResult.stderr.slice(0, 200)}` : ""}`);
+    }
+}
+function resetNeo4jAuth() {
+    const password = randomBytes(24).toString("base64url");
+    console.log("  Resetting Neo4j auth with fresh password...");
+    spawnSync("sudo", ["systemctl", "stop", "neo4j"], { stdio: "inherit" });
+    // Clear the system database (stores auth/roles) and dbms auth config.
+    // The neo4j user database (graph data) is preserved.
+    // set-initial-password only works before the system DB's first start,
+    // so we must delete it to make Neo4j treat the next start as initial.
+    spawnSync("sudo", ["rm", "-rf",
+        "/var/lib/neo4j/data/dbms",
+        "/var/lib/neo4j/data/databases/system",
+        "/var/lib/neo4j/data/transactions/system",
+    ], { stdio: "inherit" });
+    shell("neo4j-admin", ["dbms", "set-initial-password", password], { sudo: true });
+    shell("systemctl", ["start", "neo4j"], { sudo: true });
+    console.log("  Waiting for Neo4j to start...");
+    for (let i = 0; i < 15; i++) {
+        const check = spawnSync("cypher-shell", [
+            "-u", "neo4j", "-p", password,
+            "-a", "bolt://localhost:7687",
+            "RETURN 1",
+        ], { stdio: "pipe", timeout: 5000 });
+        if (check.status === 0)
+            break;
+        spawnSync("sleep", ["2"]);
+    }
+    return password;
+}
+/** Check Neo4j has a working password. Called AFTER deploy so config is in place. */
+function ensureNeo4jPassword() {
+    const passwordFile = join(INSTALL_DIR, "platform/config/.neo4j-password");
+    const configDir = resolve(INSTALL_DIR, "platform/config");
+    mkdirSync(configDir, { recursive: true });
+    // If password file exists, verify it works
+    if (existsSync(passwordFile)) {
+        const existingPassword = readFileSync(passwordFile, "utf-8").trim();
+        const check = spawnSync("cypher-shell", [
+            "-u", "neo4j", "-p", existingPassword,
+            "-a", "bolt://localhost:7687",
+            "RETURN 1",
+        ], { stdio: "pipe", timeout: 10000 });
+        if (check.status === 0) {
+            return; // Password works, data intact
+        }
+        console.log("  Stored password doesn't match Neo4j. Setting new password...");
+    }
+    else {
+        console.log("  No Neo4j password file found. Setting initial password...");
+    }
+    // Reset auth and set a new password. Graph data is preserved —
+    // only the auth config (/var/lib/neo4j/data/dbms/) is cleared.
+    const hasData = existsSync("/var/lib/neo4j/data/databases/neo4j");
+    if (hasData) {
+        console.log("  Neo4j has existing data. Resetting auth only (data preserved)...");
+        logFile("  Neo4j auth reset — clearing dbms auth, preserving databases + transactions");
+    }
+    const password = resetNeo4jAuth();
+    writeFileSync(passwordFile, password, { mode: 0o600 });
+    // Also save to persistent location (~/{configDir}/)
+    const persistDir = resolve(process.env.HOME ?? "/root", BRAND.configDir);
+    mkdirSync(persistDir, { recursive: true });
+    writeFileSync(join(persistDir, ".neo4j-password"), password, { mode: 0o600 });
+}
+function installNeo4j() {
+    if (commandExists("neo4j")) {
+        log("4", TOTAL, "Neo4j already installed.");
+        return;
+    }
+    log("4", TOTAL, "Installing Neo4j Community Edition 5...");
+    if (!isLinux()) {
+        throw new Error("Automatic Neo4j installation is only supported on Linux. Install Neo4j 5.11+ manually.");
+    }
+    console.log("  Installing Java 17...");
+    shell("apt-get", ["install", "-y", "openjdk-17-jre-headless"], { sudo: true });
+    spawnSync("bash", ["-c", "curl -fsSL https://debian.neo4j.com/neotechnology.gpg.key | sudo gpg --yes --dearmor -o /usr/share/keyrings/neo4j.gpg 2>/dev/null"], { stdio: "inherit" });
+    spawnSync("bash", ["-c", 'echo "deb [signed-by=/usr/share/keyrings/neo4j.gpg] https://debian.neo4j.com stable 5" | sudo tee /etc/apt/sources.list.d/neo4j.list'], { stdio: "inherit" });
+    shell("apt-get", ["update"], { sudo: true });
+    shell("apt-get", ["install", "-y", "neo4j"], { sudo: true });
+    shell("sed", ["-i", "s/#server.default_listen_address=0.0.0.0/server.default_listen_address=127.0.0.1/", "/etc/neo4j/neo4j.conf"], { sudo: true });
+    // Generate strong random password — stored in persistent location (~/{configDir}/)
+    const password = randomBytes(24).toString("base64url");
+    const persistDir = resolve(process.env.HOME ?? "/root", BRAND.configDir);
+    mkdirSync(persistDir, { recursive: true });
+    writeFileSync(join(persistDir, ".neo4j-password"), password, { mode: 0o600 });
+    // Also write to install dir (will be there when deploy step runs)
+    const configDir = resolve(INSTALL_DIR, "platform/config");
+    mkdirSync(configDir, { recursive: true });
+    writeFileSync(join(configDir, ".neo4j-password"), password, { mode: 0o600 });
+    shell("neo4j-admin", ["dbms", "set-initial-password", password], { sudo: true });
+    shell("systemctl", ["enable", "neo4j"], { sudo: true });
+    shell("systemctl", ["start", "neo4j"], { sudo: true });
+    console.log("  Neo4j started. Password stored securely.");
+}
+function ensureOllamaServing() {
+    const check = () => spawnSync("curl", ["-sf", "http://localhost:11434/api/tags"], {
+        stdio: "pipe", timeout: 5_000,
+    });
+    if (check().status === 0)
+        return;
+    // Log which ollama binary we're using and its version
+    const which = spawnSync("which", ["ollama"], { stdio: "pipe" });
+    const ollamaPath = which.stdout?.toString().trim() || "not found";
+    logFile(`  Ollama binary: ${ollamaPath}`);
+    const version = spawnSync("ollama", ["--version"], { stdio: "pipe", timeout: 5_000 });
+    logFile(`  Ollama version: ${version.stdout?.toString().trim() || version.stderr?.toString().trim() || `exit ${version.status}`}`);
+    // Check if systemd service exists
+    const svcCheck = spawnSync("systemctl", ["cat", "ollama"], { stdio: "pipe", timeout: 5_000 });
+    logFile(`  Ollama systemd service: ${svcCheck.status === 0 ? "exists" : "not found"}`);
+    // Check if port 11434 is already in use by something else
+    const portCheck = spawnSync("ss", ["-tlnp"], { stdio: "pipe", timeout: 5_000 });
+    const portLines = portCheck.stdout?.toString().split("\n").filter((l) => l.includes("11434")) || [];
+    if (portLines.length > 0)
+        logFile(`  Port 11434 in use: ${portLines.join("; ")}`);
+    console.log("  Starting Ollama server...");
+    logFile("  Ollama server not responding — starting ollama serve");
+    // Capture ollama serve output to a log file for diagnostics
+    const ollamaLog = join(LOG_DIR, "ollama-serve.log");
+    const logFd = openSync(ollamaLog, "a");
+    const child = spawn("ollama", ["serve"], {
+        stdio: ["ignore", logFd, logFd], detached: true,
+    });
+    child.unref();
+    closeSync(logFd);
+    logFile(`  Spawned ollama serve (PID ${child.pid}), log: ${ollamaLog}`);
+    for (let elapsed = 0; elapsed < 30; elapsed += 3) {
+        spawnSync("sleep", ["3"]);
+        // Check if process is still alive
+        const alive = child.pid && spawnSync("kill", ["-0", String(child.pid)], { stdio: "pipe" }).status === 0;
+        logFile(`  Poll ${elapsed + 3}s: pid ${child.pid} alive=${alive}`);
+        if (check().status === 0) {
+            logFile(`  Ollama server ready after ${elapsed + 3}s`);
+            return;
+        }
+        if (!alive) {
+            // Process died — read the log to find out why
+            const serveLog = readFileSync(ollamaLog, "utf-8").slice(-2000);
+            logFile(`  Ollama serve exited. Log tail:\n${serveLog}`);
+            console.error(`  Ollama serve exited unexpectedly. Log: ${ollamaLog}`);
+            throw new Error(`Ollama serve failed to start. Log: ${ollamaLog}\n${serveLog}`);
+        }
+    }
+    // Timed out — include diagnostics
+    const serveLog = readFileSync(ollamaLog, "utf-8").slice(-2000);
+    logFile(`  Ollama serve timed out after 30s. Log tail:\n${serveLog}`);
+    throw new Error(`Ollama server did not respond within 30s. Log: ${ollamaLog}\n${serveLog}`);
+}
+function installOllama() {
+    if (!commandExists("ollama")) {
+        log("5", TOTAL, "Installing Ollama...");
+        spawnSync("bash", ["-c", "curl -fsSL https://ollama.ai/install.sh | sh"], { stdio: "inherit" });
+    }
+    else {
+        log("5", TOTAL, "Ollama already installed.");
+    }
+    ensureOllamaServing();
+    console.log("  Pulling nomic-embed-text model (~300MB)...");
+    shellRetry("ollama", ["pull", "nomic-embed-text"], { timeout: 600_000 }, 3, 15);
+}
+function installCloudflared() {
+    if (commandExists("cloudflared")) {
+        log("6", TOTAL, "Cloudflared already installed.");
+        return;
+    }
+    log("6", TOTAL, "Installing cloudflared...");
+    if (!isLinux()) {
+        console.log("  Skipping — install manually for your platform.");
+        return;
+    }
+    const arch = isArm64() ? "arm64" : "amd64";
+    const debPath = "/tmp/cloudflared.deb";
+    shellRetry("curl", ["-fSL", "--progress-bar", `https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${arch}.deb`, "-o", debPath], { timeout: 120_000 }, 3, 10);
+    shell("dpkg", ["-i", debPath], { sudo: true });
+    spawnSync("rm", ["-f", debPath]);
+}
+function deployPayload() {
+    log("7", TOTAL, `Deploying ${BRAND.productName}...`);
+    if (!existsSync(PAYLOAD_DIR)) {
+        throw new Error(`Payload not found at ${PAYLOAD_DIR}. Package may be corrupted.`);
+    }
+    // Persistent config lives at ~/{configDir}/ — survives rm -rf ~/{installDir}
+    const persistentDir = resolve(process.env.HOME ?? "/root", BRAND.configDir);
+    const persistentPasswordFile = join(persistentDir, ".neo4j-password");
+    const persistentAccountsDir = join(persistentDir, "accounts");
+    // Migrate: if password is in old location, move to persistent
+    const oldPasswordFile = join(INSTALL_DIR, "platform/config/.neo4j-password");
+    if (existsSync(oldPasswordFile) && !existsSync(persistentPasswordFile)) {
+        mkdirSync(persistentDir, { recursive: true });
+        cpSync(oldPasswordFile, persistentPasswordFile);
+    }
+    const oldAccountsDir = join(INSTALL_DIR, "platform/config/accounts");
+    if (existsSync(oldAccountsDir) && !existsSync(persistentAccountsDir)) {
+        mkdirSync(persistentDir, { recursive: true });
+        cpSync(oldAccountsDir, persistentAccountsDir, { recursive: true });
+    }
+    // Sync runtime account data to persistent backup before wipe.
+    // The admin agent writes SOUL.md and other files at runtime — capture
+    // those changes so they survive the directory wipe that follows.
+    const liveAccountsDir = join(INSTALL_DIR, "platform/config/accounts");
+    if (existsSync(liveAccountsDir)) {
+        mkdirSync(persistentDir, { recursive: true });
+        cpSync(liveAccountsDir, persistentAccountsDir, { recursive: true, force: true });
+        console.log("  Backed up account data.");
+    }
+    // Wipe old platform/maxy/premium-plugins to prevent stale files
+    // The UI server directory in the payload is always named "maxy" regardless of brand
+    for (const dir of ["platform", "maxy", "premium-plugins", "docs", ".claude"]) {
+        const target = join(INSTALL_DIR, dir);
+        if (existsSync(target)) {
+            rmSync(target, { recursive: true });
+        }
+    }
+    mkdirSync(INSTALL_DIR, { recursive: true });
+    // Deploy payload
+    cpSync(PAYLOAD_DIR, INSTALL_DIR, {
+        recursive: true,
+        force: true,
+    });
+    // Link persistent config into install directory
+    const configDir = join(INSTALL_DIR, "platform/config");
+    mkdirSync(configDir, { recursive: true });
+    if (existsSync(persistentPasswordFile)) {
+        cpSync(persistentPasswordFile, join(configDir, ".neo4j-password"));
+        console.log("  Restored Neo4j password.");
+    }
+    if (existsSync(persistentAccountsDir)) {
+        cpSync(persistentAccountsDir, join(configDir, "accounts"), { recursive: true, force: true });
+        console.log("  Restored account data.");
+    }
+    // Write version marker so the running platform knows which create-maxy produced this deployment
+    writeFileSync(join(configDir, `.${BRAND.hostname}-version`), PKG_VERSION, "utf-8");
+    console.log(`  Deployed to ${INSTALL_DIR}`);
+}
+function buildPlatform() {
+    log("8", TOTAL, "Installing dependencies and building...");
+    // Stop the running service before rebuilding (upgrade path)
+    const svcName = BRAND.serviceName.replace(".service", "");
+    spawnSync("systemctl", ["--user", "stop", svcName], { stdio: "pipe" });
+    console.log(`  Installing platform dependencies (${join(INSTALL_DIR, "platform")})...`);
+    shellRetry("npm", ["install", ...NPM_NET_FLAGS], { cwd: join(INSTALL_DIR, "platform") }, 3, 15);
+    // MCP server dist/ files are pre-compiled in the payload — no build step needed.
+    // Server external dependencies (neo4j-driver, @anthropic-ai/sdk) are listed in
+    // maxy/package.json but NOT shipped as pre-built node_modules — npm pack silently
+    // strips files from nested node_modules (e.g. rxjs/package.json), breaking require().
+    // Install fresh on device to guarantee a complete dependency tree.
+    console.log(`  Installing server dependencies (${join(INSTALL_DIR, "maxy")})...`);
+    shellRetry("npm", ["install", "--omit=dev", ...NPM_NET_FLAGS], { cwd: join(INSTALL_DIR, "maxy") }, 3, 15);
+}
+function setupVncViewer() {
+    if (!isLinux())
+        return;
+    const novncSrc = "/usr/share/novnc";
+    const novncDest = join(INSTALL_DIR, "maxy/public/novnc");
+    if (!existsSync(join(novncSrc, "core"))) {
+        console.log("  noVNC not found — skipping VNC viewer setup.");
+        return;
+    }
+    console.log("  Installing VNC viewer...");
+    // Copy core/ and vendor/ (pako compression library) — both required by rfb.js
+    cpSync(join(novncSrc, "core"), join(novncDest, "core"), { recursive: true, force: true });
+    const vendorSrc = join(novncSrc, "vendor");
+    if (existsSync(vendorSrc)) {
+        cpSync(vendorSrc, join(novncDest, "vendor"), { recursive: true, force: true });
+    }
+    // Custom viewer: no toolbar, scales to fit, auto-connects
+    const html = `<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
+  <title>Connect Claude</title>
+  <style>
+    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    html, body { width: 100%; height: 100%; background: #111; overflow: hidden; }
+    #screen { position: relative; width: 100%; height: 100%; }
+  </style>
+</head>
+<body>
+  <div id="screen"></div>
+  <script type="module">
+    import RFB from '/novnc/core/rfb.js';
+    const p = new URLSearchParams(location.search);
+    const host = p.get('host') || location.hostname;
+    const port = p.get('port') || '6080';
+    const screen = document.getElementById('screen');
+    const rfb = new RFB(screen, 'ws://' + host + ':' + port + '/websockify');
+    rfb.scaleViewport = true;
+    rfb.clipViewport = true;
+    rfb.resizeSession = false;
+    rfb.addEventListener('disconnect', () => { setTimeout(() => location.reload(), 2000); });
+
+    // --- Clipboard bridge (local ↔ remote) ---
+    window.rfb = rfb;
+
+    // Paste bridge: patch noVNC keyboard handler to not intercept Ctrl/Cmd+V.
+    // Without this patch, noVNC calls preventDefault() on every keydown,
+    // which suppresses the browser paste event. By skipping Ctrl+V, the
+    // browser fires a paste event with clipboardData — works even on HTTP.
+    if (rfb._keyboard && rfb._keyboard._handleKeyDown) {
+      const orig = rfb._keyboard._handleKeyDown.bind(rfb._keyboard);
+      rfb._keyboard._handleKeyDown = function(e) {
+        if ((e.ctrlKey || e.metaKey) && (e.key === 'v' || e.key === 'V')) return;
+        return orig(e);
+      };
+    }
+
+    // Catch the paste event, sync text to VNC server clipboard, then
+    // send Ctrl+V keystrokes so the remote app pastes the synced content.
+    document.addEventListener('paste', (e) => {
+      e.preventDefault();
+      const text = (e.clipboardData || window.clipboardData)?.getData('text');
+      if (!text || !window.rfb) return;
+      window.rfb.clipboardPasteFrom(text);
+      setTimeout(() => {
+        window.rfb.sendKey(0xFFE3, 'ControlLeft', true);
+        window.rfb.sendKey(0x0076, 'v', true);
+        window.rfb.sendKey(0x0076, 'v', false);
+        window.rfb.sendKey(0xFFE3, 'ControlLeft', false);
+      }, 50);
+    });
+
+    // Copy bridge: when the remote clipboard changes, notify the parent frame.
+    rfb.addEventListener('clipboard', (e) => {
+      window.parent.postMessage({ type: 'vnc-clipboard', text: e.detail.text }, '*');
+    });
+  </script>
+</body>
+</html>`;
+    writeFileSync(join(INSTALL_DIR, "maxy/public/vnc-viewer.html"), html);
+    console.log("  VNC viewer ready at /vnc-viewer.html");
+}
+function setupAccount() {
+    log("9", TOTAL, "Setting up...");
+    const seedScript = join(INSTALL_DIR, "platform/scripts/seed-neo4j.sh");
+    if (existsSync(seedScript)) {
+        shell("bash", [seedScript], { cwd: INSTALL_DIR });
+    }
+}
+// ---------------------------------------------------------------------------
+// Cron Registration
+//
+// Registers platform cron jobs (heartbeat, email-fetch, email-auto-respond).
+// Uses BEGIN/END markers for idempotent replacement on re-install.
+// Crons persist across reboots — registered once at install time.
+// Email crons run unconditionally; scripts exit early if unconfigured.
+// ---------------------------------------------------------------------------
+const CRON_BLOCK_BEGIN = `# BEGIN ${BRAND.productName.toUpperCase()} CRONS`;
+const CRON_BLOCK_END = `# END ${BRAND.productName.toUpperCase()} CRONS`;
+function installCrons() {
+    if (!isLinux())
+        return;
+    const nodeBin = spawnSync("which", ["node"], { encoding: "utf-8" }).stdout.trim() || "/usr/bin/node";
+    const platformRoot = join(INSTALL_DIR, "platform");
+    const logDir = resolve(process.env.HOME ?? "/root", BRAND.configDir, "logs");
+    // Discover the account ID for the email-fetch cron
+    const accountsDir = join(INSTALL_DIR, "platform/config/accounts");
+    let accountId = "";
+    if (existsSync(accountsDir)) {
+        try {
+            const dirs = readdirSync(accountsDir);
+            for (const d of dirs) {
+                if (existsSync(join(accountsDir, d, "account.json"))) {
+                    accountId = d;
+                    break;
+                }
+            }
+        }
+        catch { /* no accounts yet — email crons will run without ACCOUNT_ID and exit early */ }
+    }
+    const accountEnv = accountId ? `ACCOUNT_ID=${accountId} ` : "";
+    const cronEntries = [
+        `* * * * * mkdir -p ${logDir} && PLATFORM_ROOT=${platformRoot} ${nodeBin} ${platformRoot}/plugins/scheduling/mcp/dist/scripts/check-due-events.js >> ${logDir}/check-due-events.log 2>&1`,
+        `* * * * * mkdir -p ${logDir} && PLATFORM_ROOT=${platformRoot} ${accountEnv}${nodeBin} ${platformRoot}/plugins/email/mcp/dist/scripts/email-fetch.js >> ${logDir}/email-fetch.log 2>&1`,
+        `* * * * * mkdir -p ${logDir} && PLATFORM_ROOT=${platformRoot} ${nodeBin} ${platformRoot}/plugins/email/mcp/dist/scripts/email-auto-respond.js >> ${logDir}/email-auto-respond.log 2>&1`,
+    ];
+    // Read existing crontab (empty string if none)
+    const existing = spawnSync("crontab", ["-l"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    const currentCrontab = existing.status === 0 ? existing.stdout : "";
+    // Strip any existing Maxy cron block
+    const blockPattern = new RegExp(`${CRON_BLOCK_BEGIN}[\\s\\S]*?${CRON_BLOCK_END}\\n?`, "g");
+    const cleaned = currentCrontab.replace(blockPattern, "").trimEnd();
+    // Build new crontab with Maxy block
+    const newBlock = [
+        CRON_BLOCK_BEGIN,
+        ...cronEntries,
+        CRON_BLOCK_END,
+    ].join("\n");
+    const newCrontab = cleaned ? `${cleaned}\n${newBlock}\n` : `${newBlock}\n`;
+    // Write the new crontab
+    const write = spawnSync("crontab", ["-"], {
+        input: newCrontab,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    if (write.status === 0) {
+        console.log("  Cron jobs: registered (heartbeat, email-fetch, email-auto-respond)");
+    }
+    else {
+        console.error(`  Cron jobs: failed to register — ${(write.stderr || "").trim()}`);
+        logFile(`  crontab write failed: ${write.stderr}`);
+    }
+}
+function installService() {
+    log("10", TOTAL, `Starting ${BRAND.productName}...`);
+    if (!isLinux()) {
+        console.log("  Skipping systemd service (not Linux). Start manually with:");
+        console.log(`  cd ${INSTALL_DIR}/maxy && MAXY_PLATFORM_ROOT=${INSTALL_DIR}/platform PORT=19200 HOSTNAME=0.0.0.0 KEEP_ALIVE_TIMEOUT=61000 node --require ./server-init.cjs server.js`);
+        return;
+    }
+    // Persist UDP buffer sizes for cloudflared QUIC stability (applied on every boot via sysctl.d)
+    const sysctlTmpPath = `/tmp/99-${BRAND.hostname}-quic.conf`;
+    const sysctlDestPath = `/etc/sysctl.d/99-${BRAND.hostname}-quic.conf`;
+    try {
+        const sysctlConf = "net.core.rmem_max=7340032\nnet.core.wmem_max=7340032\n";
+        writeFileSync(sysctlTmpPath, sysctlConf);
+        shell("cp", [sysctlTmpPath, sysctlDestPath], { sudo: true });
+        spawnSync("rm", ["-f", sysctlTmpPath]);
+        spawnSync("sudo", ["sysctl", "--system"], { stdio: "ignore", timeout: 10_000 });
+    }
+    catch { /* non-critical — values applied on next reboot */ }
+    // Create systemd user service
+    const serviceDir = resolve(process.env.HOME ?? "/root", ".config/systemd/user");
+    mkdirSync(serviceDir, { recursive: true });
+    const persistDir = resolve(process.env.HOME ?? "/root", BRAND.configDir);
+    mkdirSync(join(persistDir, "logs"), { recursive: true });
+    const serviceFile = `[Unit]
+Description=${BRAND.productName} AI Assistant
+After=neo4j.service
+
+[Service]
+Type=notify
+NotifyAccess=all
+WorkingDirectory=${INSTALL_DIR}/maxy
+ExecStartPre=/bin/bash ${INSTALL_DIR}/platform/scripts/vnc.sh start
+ExecStartPre=-/bin/bash ${INSTALL_DIR}/platform/scripts/resume-tunnel.sh
+ExecStart=/usr/bin/node --require ./server-init.cjs server.js
+ExecStopPost=/bin/bash ${INSTALL_DIR}/platform/scripts/vnc.sh stop
+Restart=on-failure
+RestartSec=5
+WatchdogSec=30
+TimeoutStartSec=60
+TimeoutStopSec=10
+Environment=NODE_ENV=production
+Environment=PORT=19200
+Environment=HOSTNAME=0.0.0.0
+Environment=KEEP_ALIVE_TIMEOUT=61000
+Environment=DISPLAY=:99
+Environment=PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
+Environment=MAXY_PLATFORM_ROOT=${INSTALL_DIR}/platform
+EnvironmentFile=-${persistDir}/.env
+StandardOutput=append:${persistDir}/logs/server.log
+StandardError=append:${persistDir}/logs/server.log
+
+[Install]
+WantedBy=default.target
+`;
+    writeFileSync(join(serviceDir, BRAND.serviceName), serviceFile);
+    // Enable lingering so user services run without login
+    try {
+        const user = execFileSync("whoami", [], { encoding: "utf-8" }).trim();
+        spawnSync("sudo", ["loginctl", "enable-linger", user], { stdio: "inherit" });
+    }
+    catch { /* not critical */ }
+    // Reload and (re)start
+    const unitName = BRAND.serviceName.replace(".service", "");
+    spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "inherit" });
+    spawnSync("systemctl", ["--user", "enable", unitName], { stdio: "inherit" });
+    spawnSync("systemctl", ["--user", "restart", unitName], { stdio: "inherit" });
+    // Wait for the server to come up
+    console.log("  Waiting for web server...");
+    let webServerUp = false;
+    for (let i = 0; i < 20; i++) {
+        try {
+            execFileSync("curl", ["-sf", "http://localhost:19200", "-o", "/dev/null"], { timeout: 3000 });
+            webServerUp = true;
+            break;
+        }
+        catch {
+            spawnSync("sleep", ["2"]);
+        }
+    }
+    if (!webServerUp) {
+        console.log(`  Server may still be starting. Check http://${BRAND.hostname}.local:19200 in a moment.`);
+    }
+    // Validate CDP: the programmatic Playwright MCP server connects to Chromium
+    // via --cdp-endpoint http://127.0.0.1:9222. Chromium is started by vnc.sh
+    // (ExecStartPre) before the web server. If CDP is not responding, browser
+    // automation will fail silently during onboarding sessions.
+    console.log("  Verifying browser automation (CDP on port 9222)...");
+    const cdpCheck = spawnSync("curl", ["-sf", "http://127.0.0.1:9222/json/version", "-o", "/dev/null"], {
+        timeout: 5000,
+        stdio: "pipe",
+    });
+    if (cdpCheck.status === 0) {
+        console.log("  Browser automation ready (CDP connected).");
+    }
+    else {
+        const vncLogPath = resolve(process.env.HOME ?? "/root", BRAND.configDir, "logs/vnc-boot.log");
+        let vncLog = "";
+        try {
+            vncLog = readFileSync(vncLogPath, "utf-8").slice(-2000);
+        }
+        catch {
+            vncLog = `(no boot log found at ${vncLogPath})`;
+        }
+        console.error("");
+        console.error("  ERROR: Browser automation unavailable — CDP port 9222 not responding.");
+        console.error("  Chromium should be started by vnc.sh (ExecStartPre). Check the boot log:");
+        console.error("");
+        console.error(vncLog);
+        process.exit(1);
+    }
+    // Register cron jobs after the service is running
+    installCrons();
+}
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+// Route to uninstall if --uninstall flag is present
+const _args = process.argv.slice(2);
+if (_args.includes("--uninstall")) {
+    const { runUninstall } = await import("./uninstall.js");
+    const exportIdx = _args.indexOf("--export-data");
+    const exportPath = exportIdx !== -1 ? _args[exportIdx + 1] : undefined;
+    const skipConfirm = _args.includes("--yes");
+    if (exportIdx !== -1 && !exportPath) {
+        console.error("--export-data requires a path argument.");
+        process.exit(1);
+    }
+    await runUninstall({ exportPath, skipConfirm });
+    process.exit(0);
+}
+const PKG_VERSION = JSON.parse(readFileSync(resolve(import.meta.dirname, "../package.json"), "utf-8")).version;
+initLogging();
+console.log("================================================================");
+console.log(`  ${BRAND.productName} — ${BRAND.tagline}.  (${BRAND.hostname} v${PKG_VERSION})`);
+console.log("================================================================");
+console.log(`  Install log: ${LOG_FILE}`);
+console.log("");
+logDiagnostics("pre-flight");
+try {
+    installSystemDeps();
+    installNodejs();
+    installClaudeCode();
+    installNeo4j();
+    installOllama();
+    installCloudflared();
+    deployPayload(); // Must happen before ensureNeo4jPassword — restores config backup
+    ensureNeo4jPassword(); // Now config/.neo4j-password is available if it existed before
+    buildPlatform();
+    setupVncViewer();
+    setupAccount();
+    installService();
+    console.log("");
+    console.log("================================================================");
+    console.log("");
+    console.log(`  Open in your browser: http://${BRAND.hostname}.local:19200`);
+    console.log("");
+    console.log("================================================================");
+}
+catch (err) {
+    console.error("");
+    console.error(`Setup failed: ${err instanceof Error ? err.message : String(err)}`);
+    console.error(`  Full log: ${LOG_FILE}`);
+    logDiagnostics("post-failure");
+    process.exit(1);
+}