@rubytech/create-realagent 1.0.697 → 1.0.700

package/payload/server/server.js

@@ -97,7 +97,7 @@ import {
   vncLog,
   waitForExit,
   writeChromiumWrapper
-} from "./chunk-IAIGB5WN.js";
+} from "./chunk-U3W5YIXU.js";
 
 // ../lib/graph-trash/dist/index.js
 var require_dist = __commonJS({
@@ -4571,12 +4571,10 @@ app.get("/", async (c) => {
   const whatsappAnyConnected = whatsappAccounts.some((a) => a.connected);
   const whatsappAnyStuck = whatsappAccounts.some((a) => Boolean(a.sessionStuckReason));
   let onboardingComplete;
-  if (pinConfigured && !claudeAuthenticated) {
-    const account = resolveAccount();
-    if (account) {
-      const step = await loadOnboardingStep(account.accountId);
-      onboardingComplete = step !== null && step >= 6;
-    }
+  const account = resolveAccount();
+  if (account) {
+    const step = await loadOnboardingStep(account.accountId);
+    if (step !== null) onboardingComplete = step >= 6;
   }
   const reviewDetector = getReviewDetectorSnapshot();
   return c.json({
@@ -4797,12 +4795,21 @@ app2.post("/", async (c) => {
         role: m.role,
         content: m.content
       }));
-      const uiMessages = neo4jMessages.filter((m) => m.content !== GREETING_DIRECTIVE).map((m) => ({
-        role: m.role === "user" ? "visitor" : "maxy",
-        content: m.content,
-        timestamp: new Date(m.createdAt).getTime() || Date.now(),
-        ...m.role === "user" ? { senderName: m.senderName } : {}
-      }));
+      const uiMessages = [];
+      for (const m of neo4jMessages) {
+        if (m.content === GREETING_DIRECTIVE) continue;
+        const ts = new Date(m.createdAt).getTime();
+        if (!Number.isFinite(ts) || ts === 0) {
+          console.error(`[session] dropped malformed createdAt messageId=${m.messageId ?? "unknown"} raw=${JSON.stringify(m.createdAt)}`);
+          continue;
+        }
+        uiMessages.push({
+          role: m.role === "user" ? "visitor" : "maxy",
+          content: m.content,
+          timestamp: ts,
+          ...m.role === "user" ? { senderName: m.senderName } : {}
+        });
+      }
       const sessionKey2 = crypto.randomUUID();
       registerResumedSession(sessionKey2, accountId, agentSlug, groupInfo.conversationId, agentMessages);
       setGroupContextForSession(sessionKey2, {
@@ -5624,15 +5631,24 @@ app4.get("/messages", async (c) => {
   try {
     const messages = await getMessagesSince(conversationId, since, POLL_LIMIT);
     console.error(`[group] poll id=${conversationId.slice(0, 8)}\u2026 visitor=${visitorId?.slice(0, 8) ?? "unknown"} since=${since} returned=${messages.length}`);
-    return c.json({
-      messages: messages.map((m) => ({
+    const mapped = [];
+    for (const m of messages) {
+      const ts = new Date(m.createdAt).getTime();
+      if (!Number.isFinite(ts) || ts === 0) {
+        console.error(`[group] dropped malformed createdAt messageId=${m.messageId} raw=${JSON.stringify(m.createdAt)}`);
+        continue;
+      }
+      mapped.push({
         messageId: m.messageId,
         role: m.role === "user" ? "visitor" : "maxy",
         content: m.content,
         senderName: m.senderName,
         senderVisitorId: m.senderVisitorId,
-        timestamp: new Date(m.createdAt).getTime() || Date.now()
-      })),
+        timestamp: ts
+      });
+    }
+    return c.json({
+      messages: mapped,
       hasMore: messages.length >= POLL_LIMIT
     });
   } catch (err) {
@@ -7593,10 +7609,11 @@ function rotateIfNeeded() {
 }
 var app9 = new Hono();
 app9.post("/", async (c) => {
-  const ip = resolveClientIp(
+  const client = resolveClientIp(
     c.env?.incoming?.socket?.remoteAddress,
     c.req.header("x-forwarded-for")
-  ) ?? "unknown";
+  );
+  const ip = client.ip || "unknown";
   const rate = checkRateLimit2(ip);
   if (!rate.allow) {
     if (rate.shouldLog) {
@@ -10459,6 +10476,14 @@ var FILTER_EXCLUDED_LABELS = Object.freeze(
     "ReviewAlert"
   ])
 );
+var AGENT_ACTION_LABELS = Object.freeze(
+  /* @__PURE__ */ new Set([
+    "ToolCall",
+    "StepResult",
+    "WorkflowStep",
+    "WorkflowRun"
+  ])
+);
 var CHILD_LABELS = Object.freeze(
   /* @__PURE__ */ new Set([
     "Message",
@@ -10512,6 +10537,8 @@ async function handleDefault(c, accountId) {
   const rawLabels = c.req.query("labels") ?? "";
   const labels = rawLabels.split(",").map((s) => s.trim()).filter(Boolean);
   const includeTrashed = c.req.query("includeTrashed") === "1";
+  const includeAgentActions = c.req.query("includeAgentActions") === "1";
+  const agentActionLabels = includeAgentActions ? [] : [...AGENT_ACTION_LABELS];
   if (labels.length === 0) {
     console.error(
       `[graph-page] load rejected reason=missing-filter account=${accountId} labels=`
@@ -10543,14 +10570,15 @@ async function handleDefault(c, accountId) {
   try {
     const countCypher = includeTrashed ? DEFAULT_COUNT_CYPHER_INCLUDE_TRASHED : DEFAULT_COUNT_CYPHER;
     const fetchCypher = includeTrashed ? DEFAULT_FETCH_CYPHER_INCLUDE_TRASHED : DEFAULT_FETCH_CYPHER;
+    const cypherParams = { accountId, labels, agentActionLabels };
     const result = await session.executeRead(async (tx) => {
-      const countResult = await tx.run(countCypher, { accountId, labels });
+      const countResult = await tx.run(countCypher, cypherParams);
       const matchedRaw = countResult.records[0]?.get("matched");
       const matched = typeof matchedRaw === "bigint" ? Number(matchedRaw) : Number(matchedRaw ?? 0);
       if (matched > CEILING) {
         return { overLimit: true, matched };
       }
-      const fetchResult = await tx.run(fetchCypher, { accountId, labels });
+      const fetchResult = await tx.run(fetchCypher, cypherParams);
       const record = fetchResult.records[0];
       const rawNodes = record?.get("nodes") ?? [];
       const rawEdges = record?.get("edges") ?? [];
@@ -10575,7 +10603,7 @@ async function handleDefault(c, accountId) {
     const edges = result.rawEdges.filter((e) => e && e.id != null);
     const trashedSuffix = includeTrashed ? " includeTrashed=1" : "";
     console.error(
-      `[graph-page] load mode=default account=${accountId} labels=${labels.join(",")}${trashedSuffix} nodes=${nodes.length} edges=${edges.length} ms=${elapsed}`
+      `[graph-page] load mode=default account=${accountId} agentActions=${includeAgentActions} labels=${labels.join(",")}${trashedSuffix} nodes=${nodes.length} edges=${edges.length} ms=${elapsed}`
     );
     return c.json({ nodes, edges });
   } catch (err) {
@@ -10598,11 +10626,13 @@ async function handleNeighbourhood(c, accountId) {
       400
     );
   }
+  const includeAgentActions = c.req.query("includeAgentActions") === "1";
+  const agentActionLabels = includeAgentActions ? [] : [...AGENT_ACTION_LABELS];
   const started = Date.now();
   const session = getSession();
   try {
     const result = await session.executeRead(async (tx) => {
-      return await tx.run(NEIGHBOURHOOD_CYPHER, { accountId, elementId });
+      return await tx.run(NEIGHBOURHOOD_CYPHER, { accountId, elementId, agentActionLabels });
     });
     const record = result.records[0];
     const rawNodes = record?.get("nodes") ?? [];
@@ -10619,7 +10649,7 @@ async function handleNeighbourhood(c, accountId) {
     const nodes = rawNodes.map((n) => pruneNode(n, warnedClasses, conversationWarnings));
     const edges = rawEdges.filter((e) => e && e.id != null);
     console.error(
-      `[graph-page] load mode=neighbourhood account=${accountId} elementId=${elementId} nodes=${nodes.length} edges=${edges.length} ms=${elapsed}`
+      `[graph-page] load mode=neighbourhood account=${accountId} agentActions=${includeAgentActions} elementId=${elementId} nodes=${nodes.length} edges=${edges.length} ms=${elapsed}`
     );
     return c.json({ nodes, edges });
   } catch (err) {
@@ -10638,6 +10668,7 @@ var DEFAULT_COUNT_CYPHER = `
   MATCH (n)
   WHERE n.accountId = $accountId
     AND any(lbl IN labels(n) WHERE lbl IN $labels)
+    AND NOT any(lbl IN labels(n) WHERE lbl IN $agentActionLabels)
     AND NOT n:Trashed
     AND n.deletedAt IS NULL
   RETURN count(n) AS matched
@@ -10651,6 +10682,7 @@ var DEFAULT_FETCH_CYPHER = `
   MATCH (n)
   WHERE n.accountId = $accountId
     AND any(lbl IN labels(n) WHERE lbl IN $labels)
+    AND NOT any(lbl IN labels(n) WHERE lbl IN $agentActionLabels)
     AND NOT n:Trashed
     AND n.deletedAt IS NULL
   WITH collect(n) AS nodes, collect(elementId(n)) AS nodeIds
@@ -10672,6 +10704,7 @@ var DEFAULT_COUNT_CYPHER_INCLUDE_TRASHED = `
   MATCH (n)
   WHERE n.accountId = $accountId
     AND any(lbl IN labels(n) WHERE lbl IN $labels)
+    AND NOT any(lbl IN labels(n) WHERE lbl IN $agentActionLabels)
     AND n.deletedAt IS NULL
   RETURN count(n) AS matched
 `;
@@ -10679,6 +10712,7 @@ var DEFAULT_FETCH_CYPHER_INCLUDE_TRASHED = `
   MATCH (n)
   WHERE n.accountId = $accountId
     AND any(lbl IN labels(n) WHERE lbl IN $labels)
+    AND NOT any(lbl IN labels(n) WHERE lbl IN $agentActionLabels)
     AND n.deletedAt IS NULL
   WITH collect(n) AS nodes, collect(elementId(n)) AS nodeIds
   UNWIND nodes AS n
@@ -10705,6 +10739,7 @@ var NEIGHBOURHOOD_CYPHER = `
     WHERE m.accountId = $accountId
       AND NOT m:Trashed
       AND m.deletedAt IS NULL
+      AND NOT any(lbl IN labels(m) WHERE lbl IN $agentActionLabels)
   WITH n, collect(DISTINCT m) AS neighbours
   WITH [n] + [x IN neighbours WHERE x IS NOT NULL] AS windowNodes
   WITH windowNodes, [x IN windowNodes | elementId(x)] AS windowIds
@@ -10932,10 +10967,18 @@ app28.get("/", requireAdminSession, async (c) => {
     console.error('[graph-page] labels-in-graph-rejected reason="no account for session"');
     return c.json({ error: "Account not found for session" }, 401);
   }
+  const includeAgentActions = c.req.query("includeAgentActions") === "1";
   const started = Date.now();
   const session = getSession();
   try {
-    const excluded = [...HIDDEN_BY_DEFAULT_LABELS, ...FILTER_EXCLUDED_LABELS];
+    const excludedSet = /* @__PURE__ */ new Set([
+      ...HIDDEN_BY_DEFAULT_LABELS,
+      ...FILTER_EXCLUDED_LABELS
+    ]);
+    if (includeAgentActions) {
+      for (const label of AGENT_ACTION_LABELS) excludedSet.delete(label);
+    }
+    const excluded = [...excludedSet];
     const result = await session.executeRead(async (tx) => {
       return await tx.run(LABELS_IN_GRAPH_CYPHER, { accountId, excluded });
     });
@@ -10950,7 +10993,7 @@ app28.get("/", requireAdminSession, async (c) => {
     const elapsed = Date.now() - started;
     const summary = labels.map((l) => `${l.label}:${l.nodeCount}:${l.relDegree}`).join(",");
     console.error(
-      `[graph-page] labels-in-graph account=${accountId} labels=${summary} ms=${elapsed}`
+      `[graph-page] labels-in-graph account=${accountId} agentActions=${includeAgentActions} labels=${summary} ms=${elapsed}`
     );
     return c.json({ labels });
   } catch (err) {
@@ -11234,6 +11277,19 @@ function startGraphHealthTimer() {
 }
 
 // server/index.ts
+function requestIsTlsTerminated(c) {
+  const remote = c.env?.incoming?.socket?.remoteAddress ?? "";
+  const peerIsLoopback = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+  if (!peerIsLoopback) return false;
+  const xfp = c.req.header("x-forwarded-proto") ?? "";
+  return xfp.toLowerCase() === "https";
+}
+function clientFrom(c) {
+  return resolveClientIp(
+    c.env?.incoming?.socket?.remoteAddress,
+    c.req.header("x-forwarded-for")
+  );
+}
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT6 ? join9(PLATFORM_ROOT6, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", domain: "getmaxy.com" };
@@ -11355,8 +11411,15 @@ function resolveRemoteAuthOpts() {
 }
 var MAX_LOGIN_BODY = 8 * 1024;
 app33.post("/__remote-auth/login", async (c) => {
-  const clientIp = c.var.clientIp || "unknown";
-  const rateLimited = checkRateLimit(clientIp);
+  const client = clientFrom(c);
+  const clientIp = client.ip || "unknown";
+  if (!requestIsTlsTerminated(c)) {
+    console.error(
+      `[remote-auth] login-refused-no-tls ip=${clientIp} resolvedKind=${client.kind} xfp=${c.req.header("x-forwarded-proto") ?? ""}`
+    );
+    return c.text("Remote access requires TLS", 400);
+  }
+  const rateLimited = checkRateLimit(client);
   if (rateLimited) {
     const remaining = parseInt(rateLimited.match(/(\d+)s/)?.[1] ?? "0", 10);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), lockoutSeconds: remaining || void 0 }), 200);
@@ -11374,13 +11437,14 @@ app33.post("/__remote-auth/login", async (c) => {
   }
   const valid = await verifyRemotePassword(password);
   if (!valid) {
-    recordFailedAttempt(clientIp);
+    recordFailedAttempt(client);
     console.error(`[remote-auth] login failed ip=${clientIp}`);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), error: "Invalid credentials", redirect }), 200);
   }
-  clearRateLimit(clientIp);
+  clearRateLimit(client);
   const token = createRemoteSession();
   console.error(`[remote-auth] login success ip=${clientIp}`);
+  console.error(`[remote-auth] cookie-flags secure=true sameSite=strict`);
   return new Response(null, {
     status: 302,
     headers: {
@@ -11390,7 +11454,7 @@ app33.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app33.get("/__remote-auth/logout", () => {
+app33.get("/__remote-auth/logout", (c) => {
   return new Response(null, {
     status: 302,
     headers: {
@@ -11401,8 +11465,9 @@ app33.get("/__remote-auth/logout", () => {
   });
 });
 app33.post("/__remote-auth/change-password", async (c) => {
-  const clientIp = c.var.clientIp || "unknown";
-  const rateLimited = checkRateLimit(clientIp);
+  const client = clientFrom(c);
+  const clientIp = client.ip || "unknown";
+  const rateLimited = checkRateLimit(client);
   if (rateLimited) {
     const remaining = parseInt(rateLimited.match(/(\d+)s/)?.[1] ?? "0", 10);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), lockoutSeconds: remaining || void 0 }), 200);
@@ -11422,7 +11487,7 @@ app33.post("/__remote-auth/change-password", async (c) => {
   }
   const valid = await verifyRemotePassword(currentPassword);
   if (!valid) {
-    recordFailedAttempt(clientIp);
+    recordFailedAttempt(client);
     console.error(`[remote-auth] change-password failed (wrong current) ip=${clientIp}`);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Current password is incorrect", redirect }), 200);
   }
@@ -11441,7 +11506,7 @@ app33.post("/__remote-auth/change-password", async (c) => {
   }
   try {
     await setRemotePassword(newPassword);
-    clearRateLimit(clientIp);
+    clearRateLimit(client);
     console.error(`[remote-auth] password changed ip=${clientIp}`);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), success: "Password changed successfully. Sign in with your new password.", redirect }), 200);
   } catch (err) {
@@ -11533,10 +11598,12 @@ app33.use("*", async (c, next) => {
     await next();
     return;
   }
+  const rawRemote = c.env?.incoming?.socket?.remoteAddress;
+  const rawXff = c.req.header("x-forwarded-for");
   const decision = canAccessAdmin({
     host,
-    remoteAddress: c.env?.incoming?.socket?.remoteAddress,
-    xForwardedFor: c.req.header("x-forwarded-for"),
+    remoteAddress: rawRemote,
+    xForwardedFor: rawXff,
     cookieHeader: c.req.header("cookie"),
     isPublicHost
   });
@@ -11549,11 +11616,12 @@ app33.use("*", async (c, next) => {
     await next();
     return;
   }
+  const disambig = `remoteAddress="${rawRemote ?? ""}" xff="${rawXff ?? ""}" resolvedKind=${decision.client.kind}`;
   if (decision.reason === "remote-unconfigured") {
-    console.error(`[remote-auth] not configured, redirecting to setup ip=${clientIp} path=${path2}`);
+    console.error(`[remote-auth] not configured, redirecting to setup ip=${clientIp} path=${path2} ${disambig}`);
     return c.redirect("/__remote-auth/setup");
   }
-  console.error(`[remote-auth] login required ip=${clientIp} path=${path2}`);
+  console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
 app33.route("/api/health", health_default);

package/payload/server/public/assets/architecture-YZFGNWBL-S9-oeq_x.js

@@ -1 +0,0 @@
-import"./chunk-K5T4RW27-CTTOezMH.js";import{n as e}from"./chunk-7N4EOEYR-GUck0jv1.js";export{e as createArchitectureServices};

package/payload/server/public/assets/channel-D3U0_a1j.js

@@ -1 +0,0 @@
-import{it as e,rt as t}from"./chunk-ICPOFSXX-Di63NBur.js";var n=(n,r)=>e.lang.round(t.parse(n)[r]);export{n as t};

package/payload/server/public/assets/chunk-426QAEUC-Wz6Bpsil.js

@@ -1 +0,0 @@
-import{h as e,p as t}from"./src-Bo15iQ7w.js";import{b as n}from"./chunk-ICPOFSXX-Di63NBur.js";var r=e(e=>{let{securityLevel:r}=n(),i=t(`body`);return r===`sandbox`&&(i=t((t(`#i${e}`).node()?.contentDocument??document).body)),i.select(`#${e}`)},`selectSvgElement`);export{r as t};

package/payload/server/public/assets/chunk-QZHKN3VN-BAQp1OEl.js

@@ -1 +0,0 @@
-import{h as e}from"./src-Bo15iQ7w.js";var t=class{constructor(e){this.init=e,this.records=this.init()}static{e(this,`ImperativeState`)}reset(){this.records=this.init()}};export{t};

package/payload/server/public/assets/classDiagram-6PBFFD2Q-6EGGLDD_.js

@@ -1 +0,0 @@
-import{h as e}from"./src-Bo15iQ7w.js";import"./chunk-ICPOFSXX-Di63NBur.js";import"./dist-CrzV1W3-.js";import"./chunk-5PVQY5BW-RhIfPCRB.js";import"./chunk-U2HBQHQK-BZnA7c4T.js";import"./chunk-FMBD7UC4-DaRrfk3s.js";import"./chunk-BSJP7CBP-CTsYuARh.js";import"./chunk-ZZ45TVLE-DBSm41oP.js";import"./chunk-YZCP3GAM-BAkNXu0G.js";import"./chunk-55IACEB6-CzqB8aoU.js";import"./chunk-EDXVE4YY-utELKGQK.js";import"./chunk-X2U36JSP-DpQ2OA_c.js";import"./chunk-5FUZZQ4R-BoTfWHuW.js";import"./chunk-ENJZ2VHE-CNHjq5xK.js";import"./chunk-336JU56O-BpATJiGl.js";import{i as t,n,r,t as i}from"./chunk-4TB4RGXK-CLXL19Wd.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/payload/server/public/assets/classDiagram-v2-HSJHXN6E-DfAV4tgE.js

@@ -1 +0,0 @@
-import{h as e}from"./src-Bo15iQ7w.js";import"./chunk-ICPOFSXX-Di63NBur.js";import"./dist-CrzV1W3-.js";import"./chunk-5PVQY5BW-RhIfPCRB.js";import"./chunk-U2HBQHQK-BZnA7c4T.js";import"./chunk-FMBD7UC4-DaRrfk3s.js";import"./chunk-BSJP7CBP-CTsYuARh.js";import"./chunk-ZZ45TVLE-DBSm41oP.js";import"./chunk-YZCP3GAM-BAkNXu0G.js";import"./chunk-55IACEB6-CzqB8aoU.js";import"./chunk-EDXVE4YY-utELKGQK.js";import"./chunk-X2U36JSP-DpQ2OA_c.js";import"./chunk-5FUZZQ4R-BoTfWHuW.js";import"./chunk-ENJZ2VHE-CNHjq5xK.js";import"./chunk-336JU56O-BpATJiGl.js";import{i as t,n,r,t as i}from"./chunk-4TB4RGXK-CLXL19Wd.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/payload/server/public/assets/clone-BoV8noAi.js

@@ -1 +0,0 @@
-import{i as e}from"./graphlib-B_mcXEVr.js";var t=4;function n(n){return e(n,t)}export{n as t};

package/payload/server/public/assets/gitGraph-7Q5UKJZL-BOC4CldZ.js

@@ -1 +0,0 @@
-import"./chunk-K5T4RW27-CTTOezMH.js";import{n as e}from"./chunk-67CJDMHE-mM1sFmlz.js";export{e as createGitGraphServices};