@rubytech/create-realagent 1.0.856 → 1.0.859

package/dist/__tests__/cdp-port-no-silent-fallback.test.js

@@ -0,0 +1,53 @@
+// Task 959 — structural gate against the recurrence-class
+// silent-fallback-masks-root-cause violation. The four runtime sites that
+// previously substituted `9222 + offset` for a missing brand.json.cdpPort
+// (paths.ts, admin/mcp/index.ts, vnc.sh, test-laptop-vnc-boot.sh) plus the
+// installer-side brand stamp at packages/create-maxy/src/index.ts have all
+// been swept to loud-fail. This test asserts the three greps from criterion
+// 2 of the task brief return zero matches; reintroducing any silent fallback
+// fails CI immediately.
+//
+// Compiles to dist/__tests__/cdp-port-no-silent-fallback.test.js and runs
+// via `node --test 'dist/__tests__/*.test.js'` per package.json's test
+// script. Greps run via `git grep` rooted at the repo top-level (resolved
+// relative to dist/__tests__/'s known offset) so the test is invariant to
+// the caller's cwd.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+const SELF_DIR = fileURLToPath(new URL(".", import.meta.url));
+// dist/__tests__/ → repo root is four levels up
+// (packages/create-maxy/dist/__tests__ → packages/create-maxy → packages → repo).
+const REPO_ROOT = resolve(SELF_DIR, "..", "..", "..", "..");
+function grepReturns(pattern, includes) {
+    const args = ["-RnE", pattern];
+    for (const inc of includes)
+        args.push(`--include=${inc}`);
+    args.push("platform/", "packages/");
+    // Exclude this test file (it embeds the patterns as string literals,
+    // which would otherwise self-match) and exclude the gitignored payload
+    // mirror generated by `npm run bundle`.
+    args.push("--exclude-dir=payload");
+    args.push("--exclude=cdp-port-no-silent-fallback.test.*");
+    const out = spawnSync("grep", args, { cwd: REPO_ROOT, encoding: "utf8" });
+    // grep exit 1 = no matches (success for this test); exit 0 = matches found
+    // (failure); exit 2 = grep error (test infrastructure fault).
+    if (out.status !== 0 && out.status !== 1) {
+        throw new Error(`grep error (status=${out.status}): ${out.stderr}`);
+    }
+    return (out.stdout ?? "").trim();
+}
+test("Task 959 grep 1: no `9222 + offset` arithmetic in source files", () => {
+    const matches = grepReturns("9222\\s*\\+\\s*\\w*offset", ["*.ts", "*.tsx", "*.sh"]);
+    assert.equal(matches, "", `silent-fallback regression — '9222 + offset' arithmetic reintroduced:\n${matches}`);
+});
+test("Task 959 grep 2: no jq `cdpPort // 9222` fallback in shell or TS", () => {
+    const matches = grepReturns("cdpPort\\s*//\\s*9222", ["*.sh", "*.ts"]);
+    assert.equal(matches, "", `silent-fallback regression — jq cdpPort // 9222 fallback reintroduced:\n${matches}`);
+});
+test("Task 959 grep 3: no `?? 9222` or `|| 9222` nullish-coalesce in TS", () => {
+    const matches = grepReturns("\\?\\?\\s*9222|\\|\\|\\s*9222", ["*.ts"]);
+    assert.equal(matches, "", `silent-fallback regression — '?? 9222' or '|| 9222' coalesce reintroduced:\n${matches}`);
+});

package/dist/index.js

@@ -473,7 +473,7 @@ function ensureNonSnapChromium() {
         throw new Error(`ensureNonSnapChromium: ${decision.reason}. apt install of \`chromium\` ran in installAptGroup(VNC stack) above; if its post-check passed but no chromium binary is on PATH, the system PATH is misconfigured.`);
     }
     if (decision.action === "install-google-chrome") {
-        console.log("  Detected snap-confined Chromium (Task 929) — installing Google Chrome stable...");
+        console.log("  Detected snap-confined Chromium — installing Google Chrome stable...");
         logFile(`  [snap-chromium] installing google-chrome-stable from Google's signed apt repo`);
         // Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe
         // composition runs through bash -c so the curl|gpg pipeline is one
@@ -495,7 +495,7 @@ function ensureNonSnapChromium() {
         ], { sudo: true });
         console.log("  [privileged] apt-get update");
         shell("apt-get", ["update"], { sudo: true });
-        installAptGroup("Google Chrome stable (Task 929)", ["google-chrome-stable"]);
+        installAptGroup("Google Chrome stable", ["google-chrome-stable"]);
         // Re-resolve after install to capture the now-installed absolute path.
         const postInstallWhich = which("google-chrome-stable");
         if (!postInstallWhich) {
@@ -518,7 +518,7 @@ function ensureNonSnapChromium() {
     // surfaces the contract breach with the install context still in scope.
     const finalRealpath = realpath(RESOLVED_CHROMIUM_BIN);
     if (isSnapConfinedPath(finalRealpath)) {
-        throw new Error(`ensureNonSnapChromium: resolved Chromium binary ${RESOLVED_CHROMIUM_BIN} realpaths to ${finalRealpath} which is under /snap/ — refusing to persist (Task 929).`);
+        throw new Error(`ensureNonSnapChromium: resolved Chromium binary ${RESOLVED_CHROMIUM_BIN} realpaths to ${finalRealpath} which is under /snap/ — refusing to persist.`);
     }
     console.log(`  Chromium binary: ${RESOLVED_CHROMIUM_BIN} (realpath=${finalRealpath ?? "?"})`);
     logFile(`  [snap-chromium] resolved bin=${RESOLVED_CHROMIUM_BIN} realpath=${finalRealpath ?? "null"}`);
@@ -1171,7 +1171,7 @@ function peerBrandUsingSystemUnit() {
             peerEnvContents.push([hostname, readFileSync(envPath, "utf-8")]);
         }
         catch (err) {
-            console.error(`  WARNING: unable to read peer brand .env at ${envPath} — treating as potential dependency to avoid data loss (Task 800): ${err instanceof Error ? err.message : String(err)}`);
+            console.error(`  WARNING: unable to read peer brand .env at ${envPath} — treating as potential dependency to avoid data loss: ${err instanceof Error ? err.message : String(err)}`);
             return hostname;
         }
     }
@@ -1302,7 +1302,7 @@ WantedBy=multi-user.target
     // mutually exclusive with the disable path: exactly one log line per install.
     const peerOnSystemUnit = peerBrandUsingSystemUnit();
     if (peerOnSystemUnit !== null) {
-        const keptActiveMsg = `  [neo4j] system unit kept active — peer brand ${peerOnSystemUnit} depends on port ${DEFAULT_NEO4J_PORT} (Task 800)`;
+        const keptActiveMsg = `  [neo4j] system unit kept active — peer brand ${peerOnSystemUnit} depends on port ${DEFAULT_NEO4J_PORT}`;
         console.log(keptActiveMsg);
         logFile(keptActiveMsg);
     }
@@ -1931,12 +1931,36 @@ function setupVncViewer() {
       } catch (e) { /* swallow */ }
     }
 
+    // Layer-6 beacon (Task 958): emit event=rfb-connected and
+    // event=rfb-error to the operator-grep lifecycle endpoint so
+    // server.log shows the noVNC outcome alongside [setup-tunnel] /
+    // [cloudflare-setup] / [device-url:click] / [http] / [websockify].
+    // Same-origin POST works whether the iframe is parented by the
+    // React BrowserViewer or by vnc-popout.html.
+    function reportBrowserViewerEvent(event, fields) {
+      try {
+        var body = JSON.stringify(Object.assign(
+          { event: event, surface: 'iframe' },
+          fields || {},
+        ));
+        fetch('/api/admin/browser-iframe/event', {
+          method: 'POST',
+          credentials: 'same-origin',
+          headers: { 'Content-Type': 'application/json' },
+          body: body,
+          keepalive: true,
+        }).catch(function() { /* swallow */ });
+      } catch (e) { /* swallow */ }
+    }
+    var connectStartedAt = 0;
+
     function connect() {
       status.classList.remove('hidden');
       status.querySelector('.status-spinner').style.display = '';
       status.querySelector('div:nth-child(2)').textContent =
         retryCount > 0 ? 'Reconnecting… (' + retryCount + ')' : 'Connecting to browser…';
       status.querySelector('.status-reason').textContent = '';
+      connectStartedAt = Date.now();
 
       const rfb = new RFB(screen, wsUrl);
       rfb.scaleViewport = true;
@@ -1947,6 +1971,9 @@ function setupVncViewer() {
       rfb.addEventListener('connect', () => {
         status.classList.add('hidden');
         retryCount = 0;
+        reportBrowserViewerEvent('rfb-connected', {
+          durationMs: Date.now() - connectStartedAt,
+        });
       });
 
       rfb.addEventListener('disconnect', (e) => {
@@ -1954,6 +1981,11 @@ function setupVncViewer() {
         const detail = e.detail || {};
         const reason = detail.reason || (detail.clean === false ? 'Connection refused' : '');
         reportClientEvent('disconnect', reason || (detail.clean === false ? 'unclean-close' : 'normal'));
+        reportBrowserViewerEvent('rfb-error', {
+          durationMs: Date.now() - connectStartedAt,
+          errorCode: detail.clean === false ? 'unclean-close' : 'normal',
+          message: reason || '',
+        });
         const reasonEl = status.querySelector('.status-reason');
         if (retryCount < MAX_RETRIES) {
           retryCount++;
@@ -2458,22 +2490,26 @@ function installService() {
     // Per-brand X display (Task 553). Same value used for the edge unit's
     // DISPLAY env (stamped via __VNC_DISPLAY__ a few lines down) so the main
     // brand service and the edge service agree on which display Chromium runs.
-    const VNC_DISPLAY = BRAND.vncDisplay ?? 99;
-    // Task 924 — derive the three additional brand-scoped ports from
-    // `vncDisplay` when brand.json omits them. Operator-set explicit values
-    // in brand.json win; the derivation rule is the deterministic fallback.
-    // Mirrors paths.ts and vnc.sh so all four sites compute the same numbers
-    // regardless of which one reads brand.json first.
-    const VNC_OFFSET = VNC_DISPLAY - 99;
-    // Parenthesise the deterministic derivation. Operator-precedence already
-    // groups (offset + base) ahead of nullish-coalesce, so this is purely a
-    // textual change for readability and to satisfy Task 954's grep audit
-    // (the runtime path was the real silent default; these are install-time
-    // deterministic fallbacks but the audit is a single regex over the
-    // codebase).
-    const RFB_PORT = BRAND.rfbPort ?? (5900 + VNC_OFFSET);
-    const WEBSOCKIFY_PORT_BRAND = BRAND.websockifyPort ?? (6080 + VNC_OFFSET);
-    const CDP_PORT_BRAND = BRAND.cdpPort ?? (9222 + VNC_OFFSET);
+    // Task 924 + 959 — brand.json (BRAND) is the single source of truth for
+    // these fields at install time. The vncDisplay-derived offset rule lives
+    // in the brand-creation tooling; at this point in the installer BRAND
+    // already represents a parsed, validated brand manifest, and any missing
+    // field is a brand-publish defect. Loud-fail rather than silently
+    // substituting an offset (silent-fallback-masks-root-cause recurrence).
+    if (typeof BRAND.vncDisplay !== "number") {
+        console.error(`[create-maxy] error reason=cdp-port-unresolved brand=${BRAND.configDir} field=vncDisplay`);
+        throw new Error(`brand.json missing required field: vncDisplay`);
+    }
+    const VNC_DISPLAY = BRAND.vncDisplay;
+    for (const field of ["rfbPort", "websockifyPort", "cdpPort"]) {
+        if (typeof BRAND[field] !== "number") {
+            console.error(`[create-maxy] error reason=cdp-port-unresolved brand=${BRAND.configDir} field=${field}`);
+            throw new Error(`brand.json missing required field: ${field}`);
+        }
+    }
+    const RFB_PORT = BRAND.rfbPort;
+    const WEBSOCKIFY_PORT_BRAND = BRAND.websockifyPort;
+    const CDP_PORT_BRAND = BRAND.cdpPort;
     // Task 924/938 pre-flight — refuse to write service files if any of the
     // three brand-scoped ports is already held by a process that is NOT this
     // brand's own on-demand browser nor a peer brand's edge stack.
@@ -2671,7 +2707,7 @@ function installService() {
     if (!installAccountId) {
         throw new Error(`installService: no account discovered at ${INSTALL_DIR}/data/accounts/<uuid>/account.json — ` +
             `setupAccount() (seed-neo4j.sh) should have created one. Refusing to write a systemd unit ` +
-            `without ACCOUNT_ID; the boot validator would FATAL on every restart (Task 955).`);
+            `without ACCOUNT_ID; the boot validator would FATAL on every restart.`);
     }
     const serviceFile = buildMaxyUnitFile({
         productName: BRAND.productName,

package/dist/port-resolution.js

@@ -76,7 +76,7 @@ export function buildMaxyUnitFile(o) {
         // with no Environment=ACCOUNT_ID line — bootValidator would FATAL on
         // every restart with reason=missing. Throw at build time so the install
         // aborts loudly instead of bricking the boot loop.
-        throw new Error("buildMaxyUnitFile: accountId is required — caller must resolve the on-disk account UUID before stamping the systemd unit (Task 955).");
+        throw new Error("buildMaxyUnitFile: accountId is required — caller must resolve the on-disk account UUID before stamping the systemd unit.");
     }
     const neo4jServiceDep = o.neo4jDedicated
         ? `neo4j-${o.brandHostname}.service`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-realagent",
-  "version": "1.0.856",
+  "version": "1.0.859",
   "description": "Install Real Agent — Built for agents. By agents.",
   "bin": {
     "create-realagent": "./dist/index.js"
@@ -10,7 +10,7 @@
     "build": "tsc",
     "bundle": "node scripts/bundle.js",
     "test": "npm run build && node --test 'dist/__tests__/*.test.js'",
-    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
+    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
   },
   "files": [
     "dist",

package/payload/platform/plugins/admin/hooks/pre-tool-use.sh

@@ -43,7 +43,7 @@ if [ "$AGENT_TYPE" = "admin" ]; then
         # Patterns intentionally cover both absolute (*/...) and relative
         # (no leading slash) paths so an agent can't bypass via cwd-relative writes.
         */platform/lib/entitlement/*|platform/lib/entitlement/*|*/entitlement.json|entitlement.json)
-          echo "Blocked: Admin agent cannot modify entitlement files at $FILE_PATH (Task 831). Effective tier and purchasedPlugins derive from a Rubytech-signed payload." >&2
+          echo "Blocked: Admin agent cannot modify entitlement files at $FILE_PATH. Effective tier and purchasedPlugins derive from a Rubytech-signed payload." >&2
           echo "[entitlement] tool-deny: tool=${TOOL_NAME} path=${FILE_PATH} field=entitlement-file" >&2
           exit 2
           ;;
@@ -76,7 +76,7 @@ if [ "$AGENT_TYPE" = "admin" ]; then
           ;;
         # Entitlement files via shell (Task 831) — same surface, blocked symmetrically
         *"platform/lib/entitlement/"*|*"entitlement.json"*)
-          echo "Blocked: Admin agent cannot reference entitlement files via shell (Task 831)." >&2
+          echo "Blocked: Admin agent cannot reference entitlement files via shell." >&2
           echo "[entitlement] tool-deny: tool=Bash path=entitlement-file field=entitlement-file" >&2
           exit 2
           ;;

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -50,20 +50,30 @@ function resolveBrandConfig() {
         if (!brand.productName) {
             throw new Error(`brand.json at ${brandPath} is missing the productName field`);
         }
-        // Task 924 — derive port set from `vncDisplay` ordinal offset when any
-        // of rfbPort/websockifyPort/cdpPort is missing. Mirrors paths.ts's
-        // deterministic fallback so an admin MCP probe sees the same per-brand
-        // numbers the rest of the platform binds.
-        const vncDisplay = typeof brand.vncDisplay === "number" ? brand.vncDisplay : 99;
-        const offset = vncDisplay - 99;
+        // Task 924 + 959 — brand.json is the single source of truth for the
+        // four brand-scoped port fields. An admin MCP probe must see the exact
+        // same numbers the rest of the platform binds; silent vncDisplay-derived
+        // fallback was a recurrence-class silent-fallback-masks-root-cause
+        // violation (Task 959) and is now loud-fail.
+        const brandLabel = String(brand.configDir).replace(/^\./, "");
+        if (typeof brand.vncDisplay !== "number") {
+            console.error(`[mcp:admin] error reason=cdp-port-unresolved brand=${brandLabel} path=${brandPath} field=vncDisplay json_keys=${Object.keys(brand).join(",")}`);
+            throw new Error(`brand.json at ${brandPath} missing required field: vncDisplay`);
+        }
+        for (const field of ["rfbPort", "websockifyPort", "cdpPort"]) {
+            if (typeof brand[field] !== "number") {
+                console.error(`[mcp:admin] error reason=cdp-port-unresolved brand=${brandLabel} path=${brandPath} field=${field} json_keys=${Object.keys(brand).join(",")}`);
+                throw new Error(`brand.json at ${brandPath} missing required field: ${field}`);
+            }
+        }
         return {
             configDir: brand.configDir,
             productName: brand.productName,
             commercialMode: brand.commercialMode === true,
-            vncDisplay,
-            rfbPort: typeof brand.rfbPort === "number" ? brand.rfbPort : 5900 + offset,
-            websockifyPort: typeof brand.websockifyPort === "number" ? brand.websockifyPort : 6080 + offset,
-            cdpPort: typeof brand.cdpPort === "number" ? brand.cdpPort : 9222 + offset,
+            vncDisplay: brand.vncDisplay,
+            rfbPort: brand.rfbPort,
+            websockifyPort: brand.websockifyPort,
+            cdpPort: brand.cdpPort,
         };
     }
     catch (err) {