@rubytech/create-realagent 1.0.871 → 1.0.873

package/payload/server/public/index.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Real Agent</title>
   <link rel="icon" href="/favicon.ico">
-  <script type="module" crossorigin src="/assets/admin-BSdV45P5.js"></script>
+  <script type="module" crossorigin src="/assets/admin-DAxwZDv9.js"></script>
   <link rel="modulepreload" crossorigin href="/assets/chunk-DD-I1_y5.js">
   <link rel="modulepreload" crossorigin href="/assets/jsx-runtime-DFrHsKhm.js">
   <link rel="modulepreload" crossorigin href="/assets/preload-helper-qlgyTAkD.js">

package/payload/server/server.js

@@ -48,6 +48,7 @@ import {
   launchAction,
   load,
   logPath,
+  passwordFingerprint,
   pickComponentBytes,
   preflushSliceOf,
   recordFailedAttempt,
@@ -83,7 +84,7 @@ import {
   vncLog,
   waitForExit,
   writeChromiumWrapper
-} from "./chunk-5U36PKG4.js";
+} from "./chunk-AQAST7T7.js";
 import {
   agentLogStream,
   clearSessionHistory,
@@ -653,6 +654,7 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
+import { randomUUID as randomUUID7 } from "crypto";
 import { readFileSync as readFileSync18, existsSync as existsSync23, watchFile } from "fs";
 import { resolve as resolve21, join as join11, basename as basename4 } from "path";
 import { homedir as homedir3 } from "os";
@@ -12658,6 +12660,26 @@ function startGraphHealthTimer() {
 // server/index.ts
 import { existsSync as existsSyncBoot } from "fs";
 import { resolve as resolveBoot } from "path";
+function buildHeadersJson(c) {
+  return JSON.stringify({
+    "content-type": c.req.header("content-type") ?? "",
+    "content-length": c.req.header("content-length") ?? "",
+    "user-agent": c.req.header("user-agent") ?? "",
+    "accept-charset": c.req.header("accept-charset") ?? "",
+    "x-forwarded-for": c.req.header("x-forwarded-for") ?? ""
+  });
+}
+function pwFields(password) {
+  const fp = passwordFingerprint(password);
+  return `pwHex=${fp.pwHex} pwLen=${fp.pwLen} pwCodepoints=${fp.pwCodepoints}`;
+}
+function outcomeFields(outcome) {
+  const parts = [];
+  if (outcome.saltHex !== void 0) parts.push(`saltHex=${outcome.saltHex}`);
+  if (outcome.derivedHex !== void 0) parts.push(`derivedHex=${outcome.derivedHex}`);
+  if (outcome.storedHex !== void 0) parts.push(`storedHex=${outcome.storedHex}`);
+  return parts.join(" ");
+}
 function requestIsTlsTerminated(c) {
   const remote = c.env?.incoming?.socket?.remoteAddress ?? "";
   const peerIsLoopback = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
@@ -12825,27 +12847,36 @@ app38.post("/__remote-auth/login", async (c) => {
     const remaining = parseInt(rateLimited.match(/(\d+)s/)?.[1] ?? "0", 10);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), lockoutSeconds: remaining || void 0 }), 200);
   }
+  const corr = randomUUID7();
+  const headersJson = buildHeadersJson(c);
   const body = await c.req.text();
   if (Buffer.byteLength(body) > MAX_LOGIN_BODY) {
     return c.text("Payload too large", 413);
   }
+  const bodyB64 = Buffer.from(body, "utf-8").toString("base64");
   const params = new URLSearchParams(body);
   const password = params.get("password")?.trim() ?? "";
   const rawRedirect = params.get("redirect")?.trim() || "/";
   const redirect = rawRedirect.startsWith("/") && !rawRedirect.startsWith("//") ? rawRedirect : "/";
   if (!password) {
-    console.error(`[remote-auth] login failed ip=${clientIp} why=empty-input hashBytes=0`);
+    console.error(
+      `[remote-auth] login failed ip=${clientIp} why=empty-input hashBytes=0 corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)}`
+    );
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), error: "Password is required", redirect }), 200);
   }
   const outcome = await verifyRemotePassword(password);
   if (!outcome.ok) {
     recordFailedAttempt(client);
-    console.error(`[remote-auth] login failed ip=${clientIp} why=${outcome.why} hashBytes=${outcome.hashBytes}`);
+    console.error(
+      `[remote-auth] login failed ip=${clientIp} why=${outcome.why} hashBytes=${outcome.hashBytes} corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)} ${outcomeFields(outcome)}`.trimEnd()
+    );
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), error: "Invalid credentials", redirect }), 200);
   }
   clearRateLimit(client);
   const token = createRemoteSession();
-  console.error(`[remote-auth] login success ip=${clientIp}`);
+  console.error(
+    `[remote-auth] login success ip=${clientIp} corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)} ${outcomeFields(outcome)}`
+  );
   console.error(`[remote-auth] cookie-flags secure=true sameSite=strict`);
   return new Response(null, {
     status: 302,
@@ -12877,10 +12908,13 @@ app38.post("/__remote-auth/change-password", async (c) => {
     const remaining = parseInt(rateLimited.match(/(\d+)s/)?.[1] ?? "0", 10);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), lockoutSeconds: remaining || void 0 }), 200);
   }
+  const corr = randomUUID7();
+  const headersJson = buildHeadersJson(c);
   const body = await c.req.text();
   if (Buffer.byteLength(body) > MAX_LOGIN_BODY) {
     return c.text("Payload too large", 413);
   }
+  const bodyB64 = Buffer.from(body, "utf-8").toString("base64");
   const params = new URLSearchParams(body);
   const currentPassword = params.get("current_password")?.trim() ?? "";
   const newPassword = params.get("new_password")?.trim() ?? "";
@@ -12888,13 +12922,17 @@ app38.post("/__remote-auth/change-password", async (c) => {
   const rawRedirect = params.get("redirect")?.trim() || "/";
   const redirect = rawRedirect.startsWith("/") && !rawRedirect.startsWith("//") ? rawRedirect : "/";
   if (!currentPassword || !newPassword || !confirmPassword) {
-    console.error(`[remote-auth] change-password failed ip=${clientIp} why=empty-input hashBytes=0`);
+    console.error(
+      `[remote-auth] change-password failed ip=${clientIp} why=empty-input hashBytes=0 corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(currentPassword)}`
+    );
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "All fields are required", redirect }), 200);
   }
   const outcome = await verifyRemotePassword(currentPassword);
   if (!outcome.ok) {
     recordFailedAttempt(client);
-    console.error(`[remote-auth] change-password failed ip=${clientIp} why=${outcome.why} hashBytes=${outcome.hashBytes}`);
+    console.error(
+      `[remote-auth] change-password failed ip=${clientIp} why=${outcome.why} hashBytes=${outcome.hashBytes} corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(currentPassword)} ${outcomeFields(outcome)}`.trimEnd()
+    );
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Current password is incorrect", redirect }), 200);
   }
   if (newPassword !== confirmPassword) {
@@ -12930,24 +12968,35 @@ app38.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
+  const clientIp = c.var.clientIp || "unknown";
+  const corr = randomUUID7();
+  const headersJson = buildHeadersJson(c);
   const body = await c.req.text();
   if (Buffer.byteLength(body) > MAX_LOGIN_BODY) {
     return c.text("Payload too large", 413);
   }
+  const bodyB64 = Buffer.from(body, "utf-8").toString("base64");
   const params = new URLSearchParams(body);
   const password = params.get("password") ?? "";
   const confirmPassword = params.get("confirm_password") ?? "";
   if (!password || !confirmPassword) {
-    const clientIp = c.var.clientIp || "unknown";
-    console.error(`[remote-auth] set-initial-password failed ip=${clientIp} why=empty-input hashBytes=0`);
+    console.error(
+      `[remote-auth] set-initial-password failed ip=${clientIp} why=empty-input hashBytes=0 corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)}`
+    );
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Both fields are required" }), 200);
   }
   if (password !== confirmPassword) {
+    console.error(
+      `[remote-auth] set-initial-password failed ip=${clientIp} why=mismatch-confirm hashBytes=0 corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)}`
+    );
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Passwords do not match" }), 200);
   }
   if (!isPasswordValid(password)) {
     const reqs = validatePasswordStrength(password);
     const failed = reqs.filter((r) => !r.met);
+    console.error(
+      `[remote-auth] set-initial-password failed ip=${clientIp} why=strength-fail hashBytes=0 corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)}`
+    );
     return c.html(renderLoginPage({
       ...resolveRemoteAuthOpts(),
       mode: "setup",
@@ -12956,11 +13005,14 @@ app38.post("/__remote-auth/set-initial-password", async (c) => {
   }
   try {
     await setRemotePassword(password);
-    const clientIp = c.var.clientIp || "unknown";
-    console.error(`[remote-auth] initial password set ip=${clientIp}`);
+    console.error(
+      `[remote-auth] initial password set ip=${clientIp} corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)}`
+    );
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "success" }), 200);
   } catch (err) {
-    console.error(`[remote-auth] initial password save failed: ${err}`);
+    console.error(
+      `[remote-auth] initial password save failed ip=${clientIp} corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)} err=${err}`
+    );
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });