@rubytech/create-realagent 1.0.873 → 1.0.874

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-realagent",
-  "version": "1.0.873",
+  "version": "1.0.874",
   "description": "Install Real Agent — Built for agents. By agents.",
   "bin": {
     "create-realagent": "./dist/index.js"

package/payload/server/maxy-edge.js

@@ -18,7 +18,7 @@ import {
   streamActionEvents,
   vncLog,
   websockifyLog
-} from "./chunk-AQAST7T7.js";
+} from "./chunk-5U36PKG4.js";
 import "./chunk-NDEQBCVI.js";
 import "./chunk-FHNFKJZN.js";
 import "./chunk-JSBRDJBE.js";

package/payload/server/server.js

@@ -48,7 +48,6 @@ import {
   launchAction,
   load,
   logPath,
-  passwordFingerprint,
   pickComponentBytes,
   preflushSliceOf,
   recordFailedAttempt,
@@ -84,7 +83,7 @@ import {
   vncLog,
   waitForExit,
   writeChromiumWrapper
-} from "./chunk-AQAST7T7.js";
+} from "./chunk-5U36PKG4.js";
 import {
   agentLogStream,
   clearSessionHistory,
@@ -654,7 +653,6 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { randomUUID as randomUUID7 } from "crypto";
 import { readFileSync as readFileSync18, existsSync as existsSync23, watchFile } from "fs";
 import { resolve as resolve21, join as join11, basename as basename4 } from "path";
 import { homedir as homedir3 } from "os";
@@ -12660,26 +12658,6 @@ function startGraphHealthTimer() {
 // server/index.ts
 import { existsSync as existsSyncBoot } from "fs";
 import { resolve as resolveBoot } from "path";
-function buildHeadersJson(c) {
-  return JSON.stringify({
-    "content-type": c.req.header("content-type") ?? "",
-    "content-length": c.req.header("content-length") ?? "",
-    "user-agent": c.req.header("user-agent") ?? "",
-    "accept-charset": c.req.header("accept-charset") ?? "",
-    "x-forwarded-for": c.req.header("x-forwarded-for") ?? ""
-  });
-}
-function pwFields(password) {
-  const fp = passwordFingerprint(password);
-  return `pwHex=${fp.pwHex} pwLen=${fp.pwLen} pwCodepoints=${fp.pwCodepoints}`;
-}
-function outcomeFields(outcome) {
-  const parts = [];
-  if (outcome.saltHex !== void 0) parts.push(`saltHex=${outcome.saltHex}`);
-  if (outcome.derivedHex !== void 0) parts.push(`derivedHex=${outcome.derivedHex}`);
-  if (outcome.storedHex !== void 0) parts.push(`storedHex=${outcome.storedHex}`);
-  return parts.join(" ");
-}
 function requestIsTlsTerminated(c) {
   const remote = c.env?.incoming?.socket?.remoteAddress ?? "";
   const peerIsLoopback = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
@@ -12847,36 +12825,27 @@ app38.post("/__remote-auth/login", async (c) => {
     const remaining = parseInt(rateLimited.match(/(\d+)s/)?.[1] ?? "0", 10);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), lockoutSeconds: remaining || void 0 }), 200);
   }
-  const corr = randomUUID7();
-  const headersJson = buildHeadersJson(c);
   const body = await c.req.text();
   if (Buffer.byteLength(body) > MAX_LOGIN_BODY) {
     return c.text("Payload too large", 413);
   }
-  const bodyB64 = Buffer.from(body, "utf-8").toString("base64");
   const params = new URLSearchParams(body);
   const password = params.get("password")?.trim() ?? "";
   const rawRedirect = params.get("redirect")?.trim() || "/";
   const redirect = rawRedirect.startsWith("/") && !rawRedirect.startsWith("//") ? rawRedirect : "/";
   if (!password) {
-    console.error(
-      `[remote-auth] login failed ip=${clientIp} why=empty-input hashBytes=0 corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)}`
-    );
+    console.error(`[remote-auth] login failed ip=${clientIp} why=empty-input hashBytes=0`);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), error: "Password is required", redirect }), 200);
   }
   const outcome = await verifyRemotePassword(password);
   if (!outcome.ok) {
     recordFailedAttempt(client);
-    console.error(
-      `[remote-auth] login failed ip=${clientIp} why=${outcome.why} hashBytes=${outcome.hashBytes} corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)} ${outcomeFields(outcome)}`.trimEnd()
-    );
+    console.error(`[remote-auth] login failed ip=${clientIp} why=${outcome.why} hashBytes=${outcome.hashBytes}`);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), error: "Invalid credentials", redirect }), 200);
   }
   clearRateLimit(client);
   const token = createRemoteSession();
-  console.error(
-    `[remote-auth] login success ip=${clientIp} corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)} ${outcomeFields(outcome)}`
-  );
+  console.error(`[remote-auth] login success ip=${clientIp}`);
   console.error(`[remote-auth] cookie-flags secure=true sameSite=strict`);
   return new Response(null, {
     status: 302,
@@ -12908,13 +12877,10 @@ app38.post("/__remote-auth/change-password", async (c) => {
     const remaining = parseInt(rateLimited.match(/(\d+)s/)?.[1] ?? "0", 10);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), lockoutSeconds: remaining || void 0 }), 200);
   }
-  const corr = randomUUID7();
-  const headersJson = buildHeadersJson(c);
   const body = await c.req.text();
   if (Buffer.byteLength(body) > MAX_LOGIN_BODY) {
     return c.text("Payload too large", 413);
   }
-  const bodyB64 = Buffer.from(body, "utf-8").toString("base64");
   const params = new URLSearchParams(body);
   const currentPassword = params.get("current_password")?.trim() ?? "";
   const newPassword = params.get("new_password")?.trim() ?? "";
@@ -12922,17 +12888,13 @@ app38.post("/__remote-auth/change-password", async (c) => {
   const rawRedirect = params.get("redirect")?.trim() || "/";
   const redirect = rawRedirect.startsWith("/") && !rawRedirect.startsWith("//") ? rawRedirect : "/";
   if (!currentPassword || !newPassword || !confirmPassword) {
-    console.error(
-      `[remote-auth] change-password failed ip=${clientIp} why=empty-input hashBytes=0 corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(currentPassword)}`
-    );
+    console.error(`[remote-auth] change-password failed ip=${clientIp} why=empty-input hashBytes=0`);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "All fields are required", redirect }), 200);
   }
   const outcome = await verifyRemotePassword(currentPassword);
   if (!outcome.ok) {
     recordFailedAttempt(client);
-    console.error(
-      `[remote-auth] change-password failed ip=${clientIp} why=${outcome.why} hashBytes=${outcome.hashBytes} corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(currentPassword)} ${outcomeFields(outcome)}`.trimEnd()
-    );
+    console.error(`[remote-auth] change-password failed ip=${clientIp} why=${outcome.why} hashBytes=${outcome.hashBytes}`);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Current password is incorrect", redirect }), 200);
   }
   if (newPassword !== confirmPassword) {
@@ -12968,35 +12930,24 @@ app38.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
-  const clientIp = c.var.clientIp || "unknown";
-  const corr = randomUUID7();
-  const headersJson = buildHeadersJson(c);
   const body = await c.req.text();
   if (Buffer.byteLength(body) > MAX_LOGIN_BODY) {
     return c.text("Payload too large", 413);
   }
-  const bodyB64 = Buffer.from(body, "utf-8").toString("base64");
   const params = new URLSearchParams(body);
   const password = params.get("password") ?? "";
   const confirmPassword = params.get("confirm_password") ?? "";
   if (!password || !confirmPassword) {
-    console.error(
-      `[remote-auth] set-initial-password failed ip=${clientIp} why=empty-input hashBytes=0 corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)}`
-    );
+    const clientIp = c.var.clientIp || "unknown";
+    console.error(`[remote-auth] set-initial-password failed ip=${clientIp} why=empty-input hashBytes=0`);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Both fields are required" }), 200);
   }
   if (password !== confirmPassword) {
-    console.error(
-      `[remote-auth] set-initial-password failed ip=${clientIp} why=mismatch-confirm hashBytes=0 corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)}`
-    );
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Passwords do not match" }), 200);
   }
   if (!isPasswordValid(password)) {
     const reqs = validatePasswordStrength(password);
     const failed = reqs.filter((r) => !r.met);
-    console.error(
-      `[remote-auth] set-initial-password failed ip=${clientIp} why=strength-fail hashBytes=0 corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)}`
-    );
     return c.html(renderLoginPage({
       ...resolveRemoteAuthOpts(),
       mode: "setup",
@@ -13005,14 +12956,11 @@ app38.post("/__remote-auth/set-initial-password", async (c) => {
   }
   try {
     await setRemotePassword(password);
-    console.error(
-      `[remote-auth] initial password set ip=${clientIp} corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)}`
-    );
+    const clientIp = c.var.clientIp || "unknown";
+    console.error(`[remote-auth] initial password set ip=${clientIp}`);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "success" }), 200);
   } catch (err) {
-    console.error(
-      `[remote-auth] initial password save failed ip=${clientIp} corr=${corr} bodyB64=${bodyB64} headers=${headersJson} ${pwFields(password)} err=${err}`
-    );
+    console.error(`[remote-auth] initial password save failed: ${err}`);
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });