@rubytech/create-realagent 1.0.654 → 1.0.655

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-realagent",
-  "version": "1.0.654",
+  "version": "1.0.655",
   "description": "Install Real Agent — Built for agents. By agents.",
   "bin": {
     "create-realagent": "./dist/index.js"

package/payload/platform/plugins/cloudflare/references/manual-setup.md

@@ -318,7 +318,7 @@ systemd-run --user --unit=maxy-tunnel-restart-<nonce>.service --on-active=3s --c
   /bin/systemctl --user restart "${BRAND}.service"
 ```
 
-The script then emits `[setup-tunnel] step=service-restart-dispatched` and `step=service-restart-armed exit=0` in the per-conversation stream log so operators see exactly when the restart was scheduled, exits 0, and the transient timer fires from outside the service's cgroup — semantically identical to this manual runbook's `systemctl --user restart`.
+The script then emits `[script:setup-tunnel] step=service-restart-dispatched` and `step=service-restart-armed exit=0` in the per-conversation stream log so operators see exactly when the restart was scheduled, exits 0, and the transient timer fires from outside the service's cgroup — semantically identical to this manual runbook's `systemctl --user restart`. (The `script:` prefix is Task 605's chat-surface namespace — see `_stream-log.sh` header.)
 
 When walking through manually you do **not** need `systemd-run` — your SSH shell already lives in a separate user-scope cgroup (`user@<uid>.service`), so the direct `systemctl restart` does not kill the caller. The script's extra indirection only matters when the caller *is* the service being restarted.
 

package/payload/platform/plugins/cloudflare/scripts/_stream-log.sh

@@ -7,27 +7,38 @@
 # per-conversation file the chat UI's server-side tailer reads.
 #
 # Contract (read by platform/ui/app/lib/script-stream-tailer.ts tailer and
-# .docs/platform.md):
-#   [<ISO-ts>] [<scope>] <kv …>
-#   [<ISO-ts>] [<scope>:<subprocess-tag>] <raw line>
-# Canonical regex — SCRIPT_STREAM_RE at platform/ui/app/lib/script-stream-tailer.ts:51:
-#   ^\[([^\]]+)\] \[([a-z][a-z0-9-]*)((?::[a-z0-9:_-]+)?)\] (.*)$
+# .docs/web-chat.md):
+#   [<ISO-ts>] [script:<scope>] <kv …>
+#   [<ISO-ts>] [script:<scope>:<subprocess-tag>] <raw line>
+# Canonical regex — SCRIPT_STREAM_RE at platform/ui/app/lib/script-stream-tailer.ts:
+#   ^\[([^\]]+)\] \[script:([a-z][a-z0-9-]*)((?::[a-z0-9:_-]+)?)\] (.*)$
+# The literal `script:` prefix is the chat-surface namespace (Task 605). It
+# separates chat-surface emitters from log-file-only scopes (`[mcp:<server>]`
+# from mcp-stderr-tee, `[init]` / `[api-wait-*]` / `[mcp-init-error]` /
+# `[subproc-stderr]` / `[compaction-*]` from claude-agent.ts) which share
+# the same per-conversation stream log but must NOT reach the chat UI.
+# Callers of phase_line / tee_subprocess / tee_subprocess_capture pass the
+# bare scope (e.g. `setup-tunnel`, `list-cf-domains`, `reset-tunnel:cloudflared`);
+# these helpers prepend `script:` to the stream-log write. Stderr mirrors
+# stay unprefixed — stderr is for direct-SSH operators and route-handler
+# `reason=<enum>` regex, not the chat-surface contract.
 # <scope> is any `[a-z][a-z0-9-]*` token (Task 592 generalised from the
 # pre-592 enum `setup-tunnel|reset-tunnel`, which silently filtered out the
 # `[list-cf-domains]` lines Task 589 emitted). <subprocess-tag> may contain
-# lowercase, digits, `-`, `_`, `:`. Adding a new <scope> requires no edit to
-# the regex — the shape is the only contract. Any prefix-shape change must
-# be made on both sides (this helper + script-stream-tailer.ts) atomically.
+# lowercase, digits, `-`, `_`, `:`. Adding a new chat-surface scope requires
+# no edit to the regex — the shape is the only contract. Any prefix-shape
+# change must be made on both sides (this helper + script-stream-tailer.ts)
+# atomically.
 #
 # Inner layers (e.g. a node/python helper a .sh wrapper spawns — Task 598's
 # `list-cf-domains.sh` → `list-cf-domains.ts` pattern) must write phase lines
-# directly to STREAM_LOG_PATH with the same prefix shape: stderr alone is
-# silently discarded by runFormSpawn on exit 0. The build-gate
-# `platform/ui/scripts/check-stream-log-contract.mjs` (Task 600) enforces this
-# by rejecting any .sh under `platform/plugins/*/scripts/` that sources this
-# helper and invokes an interpreter subprocess whose target does not pair a
-# STREAM_LOG_PATH env read with an append/write call. Opt out per invocation
-# with `# stream-log-contract: stderr-only (reason: <prose>)`.
+# directly to STREAM_LOG_PATH with the same prefix shape (including the
+# `script:` namespace): stderr alone is silently discarded by runFormSpawn on
+# exit 0. The build-gate `platform/ui/scripts/check-stream-log-contract.mjs`
+# (Task 600) enforces this by rejecting any .sh under `platform/plugins/*/scripts/`
+# that sources this helper and invokes an interpreter subprocess whose target
+# does not pair a STREAM_LOG_PATH env read with an append/write call. Opt out
+# per invocation with `# stream-log-contract: stderr-only (reason: <prose>)`.
 
 # Exit 1 loudly with the variable name and the invoking scope so direct-SSH
 # invocations fail fast and the operator reads exactly what to set. No
@@ -56,12 +67,16 @@ stream_log_ts() {
 # tool's stderr capture carries it. Both paths matter: the stream log is
 # the live tailer surface; stderr is the exit-time Bash-tool surface.
 #
+# The stream-log write carries the `script:` chat-surface namespace (Task 605);
+# the stderr mirror stays unprefixed because stderr is read by direct-SSH
+# operators and the route-handler `reason=<enum>` regex, not the chat UI.
+#
 # Usage: phase_line <scope> <key=value …>
 phase_line() {
   local scope="$1"; shift
   local ts
   ts="$(stream_log_ts)"
-  printf '[%s] [%s] %s\n' "${ts}" "${scope}" "$*" >> "${STREAM_LOG_PATH}"
+  printf '[%s] [script:%s] %s\n' "${ts}" "${scope}" "$*" >> "${STREAM_LOG_PATH}"
   printf '[%s] %s\n' "${scope}" "$*" >&2
 }
 
@@ -97,7 +112,7 @@ tee_subprocess() {
   "${buf_prefix[@]}" "$@" 2>&1 | while IFS= read -r line; do
     local ts
     ts="$(stream_log_ts)"
-    printf '[%s] [%s] %s\n' "${ts}" "${tag}" "${line}" >> "${STREAM_LOG_PATH}"
+    printf '[%s] [script:%s] %s\n' "${ts}" "${tag}" "${line}" >> "${STREAM_LOG_PATH}"
     printf '%s\n' "${line}" >&2
   done
   return "${PIPESTATUS[0]}"
@@ -132,7 +147,7 @@ tee_subprocess_capture() {
   "${buf_prefix[@]}" "$@" 2>&1 | while IFS= read -r line; do
     local ts
     ts="$(stream_log_ts)"
-    printf '[%s] [%s] %s\n' "${ts}" "${tag}" "${line}" >> "${STREAM_LOG_PATH}"
+    printf '[%s] [script:%s] %s\n' "${ts}" "${tag}" "${line}" >> "${STREAM_LOG_PATH}"
     printf '%s\n' "${line}"
   done
   return "${PIPESTATUS[0]}"

package/payload/platform/plugins/cloudflare/scripts/list-cf-domains.ts

@@ -91,15 +91,18 @@ function logPhase(line: string): void {
   // Stream log: direct write by the TS helper (not via wrapper tee) so phase
   // lines reach the per-conversation file the Task 592 tailer reads, even on
   // exit 0 where runFormSpawn discards `result.stderr`. Format parity with
-  // `_stream-log.sh phase_line`: `[<ISO-ts>] [<scope>] <content>\n`, asserted
-  // by the vitest regression under platform/ui/__tests__. Sync append so the
+  // `_stream-log.sh phase_line`: `[<ISO-ts>] [script:<scope>] <content>\n` —
+  // the `script:` prefix is Task 605's chat-surface namespace so the line
+  // passes the tightened tailer regex (`[mcp:*]` / `[init]` / `[api-wait-*]`
+  // lines in the same file are excluded by construction). Asserted by the
+  // vitest regression under platform/ui/__tests__. Sync append so the
   // terminal `phase=script-exit code=0 count=N` lands before process exit.
   const streamLogPath = process.env.STREAM_LOG_PATH;
   if (!streamLogPath || streamLogWriteFailed) return;
   try {
     appendFileSync(
       streamLogPath,
-      `[${new Date().toISOString()}] [list-cf-domains] ${line}\n`,
+      `[${new Date().toISOString()}] [script:list-cf-domains] ${line}\n`,
     );
   } catch (err) {
     streamLogWriteFailed = true;

package/payload/platform/plugins/cloudflare/scripts/setup-tunnel.sh

@@ -65,7 +65,8 @@ mkdir -p "${CFG_DIR}"
 # Control flow, rewritten per Task 556:
 #   1. CDP precheck on 127.0.0.1:9222 — loud failure if Chromium isn't up.
 #   2. Spawn cloudflared with stdout+stderr teed line-by-line to
-#      $STREAM_LOG_PATH with prefix [setup-tunnel:cloudflared].
+#      $STREAM_LOG_PATH with prefix [script:setup-tunnel:cloudflared]
+#      (Task 605's chat-surface namespace — see _stream-log.sh header).
 #   3. Extract the authorize URL with a tolerant regex as it streams.
 #   4. Drive the VNC Chromium to that URL via CDP `PUT /json/new?<url>`.
 #   5. Wait for ~/.cloudflared/cert.pem to land with bounded timeout.
@@ -113,7 +114,7 @@ if [ ! -f "${CFG_DIR}/cert.pem" ]; then
       --origincert "${CFG_DIR}/cert.pem" tunnel login 2>&1 |
       while IFS= read -r line; do
         ts="$(stream_log_ts)"
-        printf '[%s] [setup-tunnel:cloudflared] %s\n' "${ts}" "${line}" >> "${STREAM_LOG_PATH}"
+        printf '[%s] [script:setup-tunnel:cloudflared] %s\n' "${ts}" "${line}" >> "${STREAM_LOG_PATH}"
         printf '%s\n' "${line}" >&2
         printf '%s\n' "${line}" > "${LAST_LINE_FILE}"
         if [ ! -s "${URL_FILE}" ]; then
@@ -418,8 +419,8 @@ for H in "${HOSTNAMES[@]}"; do
   phase_line setup-tunnel step=route-dns hostname="${H}" tunnel_id="${TUNNEL_ID}"
   ROUTE_LOG="$(mktemp -t maxy-route-dns.XXXXXX)"
   # tee_subprocess_capture streams cloudflared's combined stdout+stderr
-  # into STREAM_LOG_PATH line-by-line with the [setup-tunnel:cloudflared]
-  # tag (live-tailable) AND passes the same output through this shell's
+  # into STREAM_LOG_PATH line-by-line with the [script:setup-tunnel:cloudflared]
+  # tag (live-tailable — Task 605 chat-surface namespace) AND passes the same output through this shell's
   # stdout so the `> "${ROUTE_LOG}"` redirection can capture it for the
   # failure-path phase_line. Exit code is cloudflared's PIPESTATUS[0].
   if tee_subprocess_capture setup-tunnel:cloudflared -- \

package/payload/server/server.js

@@ -11330,7 +11330,7 @@ function defaultRules() {
       name: "setup-tunnel.sh failed to persist step-7 completion",
       type: "silent-catch",
       logSource: "any",
-      pattern: "\\[setup-tunnel\\] step=onboarding-persist result=error",
+      pattern: "\\[script:setup-tunnel\\] step=onboarding-persist result=error",
       thresholdCount: 0,
       thresholdWindowMinutes: 0,
       suggestedAction: "[Task 562] setup-tunnel.sh could not persist step-7 completion before arming the service restart. Read the `reason` field on the failing phase line: `fs-flag-dir-failed` means `${ACCOUNT_DIR}/onboarding/` is not writable (chmod issue or disk full); `fs-flag-write-failed` means the flag file itself could not be written. Without the flag, the next admin session will re-ask the Cloudflare question the user just answered. Recovery: fix the permission/disk issue, then either re-run `~/setup-tunnel.sh` (the flag-write is idempotent) or call `onboarding-complete-step` with step 7 from the admin chat to mark step 7 complete explicitly."
@@ -18090,7 +18090,7 @@ import * as childProcess from "child_process";
 import { appendFileSync as appendFileSync6, createReadStream as createReadStream2, mkdirSync as mkdirSync12, statSync as statSync8 } from "fs";
 import { dirname as dirname7 } from "path";
 import { StringDecoder as StringDecoder2 } from "string_decoder";
-var SCRIPT_STREAM_RE = /^\[([^\]]+)\] \[([a-z][a-z0-9-]*)((?::[a-z0-9:_-]+)?)\] (.*)$/;
+var SCRIPT_STREAM_RE = /^\[([^\]]+)\] \[script:([a-z][a-z0-9-]*)((?::[a-z0-9:_-]+)?)\] (.*)$/;
 function parseLine(line) {
   const m = line.match(SCRIPT_STREAM_RE);
   if (!m) return void 0;
@@ -18185,6 +18185,11 @@ function startScriptStreamTailer(opts) {
 }
 var SCOPE_TOKEN_RE = /^[a-z][a-z0-9-]*$/;
 function writeRouteMilestone(streamLogPath, scope, line) {
+  if (scope.startsWith("script:")) {
+    throw new Error(
+      `writeRouteMilestone: scope "${scope}" must not start with "script:" \u2014 the helper prepends it (Task 605)`
+    );
+  }
   if (!SCOPE_TOKEN_RE.test(scope)) {
     throw new Error(
       `writeRouteMilestone: scope "${scope}" must match [a-z][a-z0-9-]* \u2014 the tailer regex won't match otherwise`
@@ -18193,7 +18198,7 @@ function writeRouteMilestone(streamLogPath, scope, line) {
   const ts = (/* @__PURE__ */ new Date()).toISOString();
   try {
     mkdirSync12(dirname7(streamLogPath), { recursive: true });
-    appendFileSync6(streamLogPath, `[${ts}] [${scope}] ${line}
+    appendFileSync6(streamLogPath, `[${ts}] [script:${scope}] ${line}
 `);
   } catch (err) {
     console.error(