@rubytech/create-sitedesk-code 0.1.340

package/payload/server/public/v.js

@@ -0,0 +1,244 @@
+/* Visitor-graph pixel (Task 357).
+ *
+ * Single IIFE. Plain JS. No build step. ~3 KB minified.
+ *
+ * Loaded by hosted listing pages:
+ *
+ *   <script defer src="https://<brand>/v.js" data-site="<slug>"></script>
+ *
+ * Emits to POST /v/event:
+ *
+ *   pageview  — once per session per URL (idempotent within 5s for SPA nav)
+ *   click     — DOM clicks on elements with data-track="<label>", or
+ *               anchors flagged data-track-gallery / data-track-floorplan
+ *   scroll    — roll-up: one event per milestone {25,50,75,100} crossed
+ *   dwell     — on visibility change to hidden / pagehide, sendBeacon
+ *
+ * Identity: the server resolves identity from the mxy_v cookie. The pixel
+ * sends visitorId from localStorage (mints one if absent) as a fallback so
+ * cross-tab and same-browser-no-cookie cases still cluster.
+ */
+(function () {
+  if (typeof window === 'undefined' || typeof document === 'undefined') return
+  var script = document.currentScript
+  if (!script) return
+  var siteSlug = script.getAttribute('data-site') || ''
+  var endpoint = new URL('/v/event', script.src).toString()
+
+  var CONSENT_KEY = 'mxy_consent'
+  var VISITOR_KEY = 'mxy_visitor_id'
+  var SESSION_KEY = 'mxy_session_id'
+  var SESSION_PV_KEY = 'mxy_session_pv'
+  var LAST_PV_KEY = 'mxy_last_pv'
+  var SCROLL_KEY = 'mxy_scroll_depth'
+  var DWELL_KEY = 'mxy_dwell_start'
+
+  // ─────────── PECR consent gate (Task 375) ───────────
+  // Reads the mxy_consent cookie set by /consent.js (and persisted server-side
+  // via POST /v/consent). When the visitor has not accepted, the pixel is a
+  // total no-op: no storage writes, no /v/event POSTs, no event listeners
+  // attached. A later flip yes ← rebooted via the mxy:consent-changed event.
+  function readConsentCookie() {
+    var raw = (typeof document !== 'undefined' && document.cookie) || ''
+    var parts = raw.split(';')
+    for (var i = 0; i < parts.length; i++) {
+      var kv = parts[i].trim().split('=')
+      if (kv[0] === CONSENT_KEY) return decodeURIComponent(kv.slice(1).join('='))
+    }
+    return null
+  }
+  function purgeAll() {
+    var keys = [VISITOR_KEY, SESSION_KEY, SESSION_PV_KEY, LAST_PV_KEY, SCROLL_KEY, DWELL_KEY]
+    for (var i = 0; i < keys.length; i++) {
+      try { localStorage.removeItem(keys[i]) } catch (_e) {}
+      try { sessionStorage.removeItem(keys[i]) } catch (_e) {}
+    }
+  }
+  var started = false
+  function start() {
+    if (started) return
+    started = true
+    boot()
+  }
+  // React to consent changes from the banner: yes→start (emit deferred
+  // pageview), yes→no→purge storage and detach listeners by setting a flag
+  // that all emit-paths check before sending.
+  var revoked = false
+  window.addEventListener('mxy:consent-changed', function (ev) {
+    var decision = (ev && ev.detail && ev.detail.decision) || readConsentCookie()
+    if (decision === 'yes') {
+      revoked = false
+      start()
+    } else if (decision === 'no') {
+      revoked = true
+      purgeAll()
+    }
+  })
+  if (readConsentCookie() !== 'yes') {
+    // Banner / server will fire mxy:consent-changed when the visitor accepts.
+    return
+  }
+  start()
+
+  function boot() {
+
+  function randomId() {
+    if (window.crypto && window.crypto.getRandomValues) {
+      var buf = new Uint8Array(16)
+      window.crypto.getRandomValues(buf)
+      return Array.prototype.map.call(buf, function (b) {
+        return ('0' + b.toString(16)).slice(-2)
+      }).join('')
+    }
+    return String(Date.now()) + '_' + Math.random().toString(36).slice(2, 10)
+  }
+
+  function getVisitorId() {
+    try {
+      var v = localStorage.getItem(VISITOR_KEY)
+      if (v) return v
+      var fresh = randomId()
+      localStorage.setItem(VISITOR_KEY, fresh)
+      return fresh
+    } catch (_e) {
+      return 'noltc-' + randomId()
+    }
+  }
+
+  function getSessionId() {
+    try {
+      var s = sessionStorage.getItem(SESSION_KEY)
+      if (s) return s
+      var fresh = randomId()
+      sessionStorage.setItem(SESSION_KEY, fresh)
+      return fresh
+    } catch (_e) {
+      return 'nots-' + randomId()
+    }
+  }
+
+  var visitorId = getVisitorId()
+  var sessionId = getSessionId()
+
+  function send(payload) {
+    if (revoked) return
+    payload.site = siteSlug
+    payload.vid = visitorId
+    payload.sid = sessionId
+    payload.url = location.href
+    payload.path = location.pathname
+    payload.title = (document.title || '').slice(0, 256)
+    payload.ts = Date.now()
+    try {
+      var body = JSON.stringify(payload)
+      if (navigator.sendBeacon) {
+        var blob = new Blob([body], { type: 'application/json' })
+        if (navigator.sendBeacon(endpoint, blob)) return
+      }
+      fetch(endpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: body,
+        credentials: 'include',
+        keepalive: true,
+      }).catch(function () { /* fire-and-forget */ })
+    } catch (_e) {
+      /* silently drop — pixel must never break the page */
+    }
+  }
+
+  // ─────────── pageview (idempotent within 5s for SPA nav) ───────────
+  function emitPageview() {
+    if (revoked) return
+    try {
+      var last = sessionStorage.getItem(LAST_PV_KEY)
+      if (last) {
+        var parsed = JSON.parse(last)
+        if (parsed && parsed.url === location.href && Date.now() - parsed.ts < 5000) {
+          return
+        }
+      }
+      sessionStorage.setItem(LAST_PV_KEY, JSON.stringify({ url: location.href, ts: Date.now() }))
+      sessionStorage.setItem(SESSION_PV_KEY, randomId()) // PageView id for milestone roll-up
+      sessionStorage.setItem(SCROLL_KEY, '0')
+    } catch (_e) { /* localStorage / sessionStorage disabled */ }
+
+    var pvId = ''
+    try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+    send({
+      type: 'pageview',
+      pvId: pvId,
+      referrer: document.referrer || '',
+    })
+  }
+
+  // ─────────── click tracking ───────────
+  document.addEventListener('click', function (ev) {
+    var el = ev.target && (ev.target.closest ? ev.target.closest('[data-track]') : null)
+    if (!el) return
+    var label = el.getAttribute('data-track') || 'unknown'
+    var pvId = ''
+    try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+    send({
+      type: 'click',
+      label: label.slice(0, 64),
+      pvId: pvId,
+      href: el.getAttribute('href') || '',
+    })
+  }, true)
+
+  // ─────────── scroll milestones (roll-up) ───────────
+  var scrollScheduled = false
+  function onScroll() {
+    if (scrollScheduled) return
+    scrollScheduled = true
+    requestAnimationFrame(function () {
+      scrollScheduled = false
+      var doc = document.documentElement
+      var max = Math.max(doc.scrollHeight, document.body.scrollHeight) - window.innerHeight
+      if (max <= 0) return
+      var pct = Math.floor(((window.scrollY || doc.scrollTop) / max) * 100)
+      var threshold = pct >= 100 ? 100 : pct >= 75 ? 75 : pct >= 50 ? 50 : pct >= 25 ? 25 : 0
+      if (threshold === 0) return
+      try {
+        var prev = parseInt(sessionStorage.getItem(SCROLL_KEY) || '0', 10) || 0
+        if (threshold <= prev) return
+        sessionStorage.setItem(SCROLL_KEY, String(threshold))
+      } catch (_e) {}
+      var pvId = ''
+      try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+      send({ type: 'scroll', depth: threshold, pvId: pvId })
+    })
+  }
+  window.addEventListener('scroll', onScroll, { passive: true })
+
+  // ─────────── dwell on unload / visibility change ───────────
+  try { sessionStorage.setItem(DWELL_KEY, String(Date.now())) } catch (_e) {}
+  function emitDwell() {
+    var start = 0
+    try { start = parseInt(sessionStorage.getItem(DWELL_KEY) || '0', 10) || 0 } catch (_e) {}
+    if (!start) return
+    var ms = Date.now() - start
+    if (ms < 250) return // ignore drive-bys
+    var pvId = ''
+    try { pvId = sessionStorage.getItem(SESSION_PV_KEY) || '' } catch (_e) {}
+    send({ type: 'dwell', ms: ms, pvId: pvId })
+  }
+  document.addEventListener('visibilitychange', function () {
+    if (document.visibilityState === 'hidden') emitDwell()
+  })
+  window.addEventListener('pagehide', emitDwell)
+
+  // SPA navigation hooks — many listing sites are client-routed.
+  var origPushState = history.pushState
+  history.pushState = function () {
+    var r = origPushState.apply(this, arguments)
+    setTimeout(emitPageview, 0)
+    return r
+  }
+  window.addEventListener('popstate', emitPageview)
+
+  // Boot.
+  emitPageview()
+  } // end boot()
+})()

package/payload/server/public/vnc-popout.html

@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Browser — Maxy</title>
+  <style>
+    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    html, body { width: 100%; height: 100%; overflow: hidden; background: #111; }
+    body { display: flex; flex-direction: column; font-family: 'DM Sans', -apple-system, BlinkMacSystemFont, sans-serif; }
+    .bar {
+      display: flex; align-items: center; justify-content: space-between;
+      padding: 8px 12px; border-bottom: 1px solid rgba(0,0,0,0.06);
+      background: #F5F2ED; flex-shrink: 0;
+    }
+    .bar__title { font-size: 13px; font-weight: 500; color: #1A1A1A; }
+    .bar__close {
+      border: none; background: transparent; cursor: pointer;
+      font-family: inherit; font-size: 13px; color: #6B6B6B;
+      padding: 4px 10px; border-radius: 6px;
+    }
+    .bar__close:hover { background: rgba(0,0,0,0.06); color: #1A1A1A; }
+    iframe { flex: 1; width: 100%; border: none; background: #111; }
+  </style>
+</head>
+<body>
+  <div class="bar">
+    <span class="bar__title" id="title">Browser</span>
+    <button class="bar__close" onclick="window.close()">Close</button>
+  </div>
+  <iframe id="viewer" title="Browser"></iframe>
+  <script>
+    // Only the `title` query parameter is read — the embedded viewer
+    // is always loaded from the same origin with no host/port hints.
+    // vnc-viewer.html derives its WebSocket URL from its own
+    // location.protocol + location.host and connects through the
+    // same-origin /websockify proxy on the Maxy server. Any legacy
+    // host/port query params passed by older callers are ignored.
+    const params = new URLSearchParams(location.search);
+    const title = params.get('title');
+    const brandName = (window.__BRAND__ && window.__BRAND__.productName) || 'Browser';
+
+    // Apply title: query param overrides, then brand name, then "Browser" fallback
+    const displayTitle = title || brandName;
+    document.getElementById('title').textContent = displayTitle;
+    document.title = displayTitle;
+    document.getElementById('viewer').title = displayTitle;
+
+    // Load the VNC viewer in the iframe — same origin, no host/port.
+    document.getElementById('viewer').src = '/vnc-viewer.html';
+
+    // Clipboard bridge: relay vnc-clipboard messages from the iframe
+    // to the main app window via BroadcastChannel
+    const channel = new BroadcastChannel('maxy-vnc-clipboard');
+
+    window.addEventListener('message', function(e) {
+      if (e.data && e.data.type === 'vnc-clipboard' && typeof e.data.text === 'string') {
+        channel.postMessage(e.data.text);
+      }
+    });
+  </script>
+</body>
+</html>

package/payload/server/server-init-line-stamper.cjs

@@ -0,0 +1,26 @@
+// Task 666 — pure line-stamper shared by server-init.cjs (install) and a vitest
+// (verification). Same logic as the manager's src/log-sink.ts createLineStamper,
+// duplicated because the UI preload is CommonJS and the manager is a separate
+// compiled package. Keep the two in lockstep.
+'use strict'
+
+function createLineStamper(opts) {
+  const now = (opts && opts.now) || (() => new Date())
+  let atLineStart = true
+  return function stamp(chunk) {
+    if (chunk.length === 0) return chunk
+    let out = ''
+    for (let i = 0; i < chunk.length; i++) {
+      if (atLineStart) {
+        out += now().toISOString() + ' '
+        atLineStart = false
+      }
+      const ch = chunk[i]
+      out += ch
+      if (ch === '\n') atLineStart = true
+    }
+    return out
+  }
+}
+
+module.exports = { createLineStamper }

package/payload/server/server-init.cjs

@@ -0,0 +1,251 @@
+/**
+ * Server initialization — preloaded via `node --require ./server-init.js server.js`
+ *
+ * Handles four concerns that the Next.js-generated server.js does not:
+ *   1. mDNS bypass: wraps http.createServer to 302-redirect *.local to LAN IP
+ *   2. systemd sd_notify: sends READY=1 on startup, WATCHDOG=1 every 15s
+ *   3. Graceful shutdown: drains connections on SIGTERM before exit
+ *   4. Startup logging
+ *
+ * Framework-agnostic — survives a Next.js replacement.
+ */
+
+'use strict'
+
+const http = require('node:http')
+const { spawnSync } = require('node:child_process')
+const { existsSync, readFileSync, writeFileSync } = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const { monitorEventLoopDelay } = require('node:perf_hooks')
+const { createLineStamper } = require('./server-init-line-stamper.cjs')
+
+// Task 666 — server.log receives these lines via systemd `append:`
+// (StandardOutput/Error), which bypasses journald, so the file carries no
+// timestamp of its own. Stamp EVERY UI-process line at the stdout/stderr sink so
+// each line is datable from itself. Installed before any other module logs (this
+// file is the `--require` preload). The timestamp goes BEFORE the `[tag]` so grep
+// substrings like `[server-init] start` stay intact. The manager process is a
+// separate systemd unit appending to the same server.log and installs its own
+// sink (src/install-log-sink.ts). Never hand-inline a timestamp in a log call —
+// the sink is the single source (supersedes the per-call Task 504 stamping).
+;(function installTimestampSink() {
+  const stamp = createLineStamper()
+  for (const stream of [process.stdout, process.stderr]) {
+    const orig = stream.write.bind(stream)
+    stream.write = function patchedWrite(chunk, enc, cb) {
+      let text = null
+      if (typeof chunk === 'string') text = chunk
+      else if (chunk instanceof Uint8Array) text = Buffer.from(chunk).toString('utf8')
+      if (text === null) return orig(chunk, enc, cb)
+      return orig(stamp(text), enc, cb)
+    }
+  }
+})()
+
+// ---------------------------------------------------------------------------
+// 0. Start counter — Task 173
+// ---------------------------------------------------------------------------
+//
+// Boot loops in the brand process are otherwise invisible: each cycle writes
+// one `[server-init] SIGTERM received` line, and the operator has to grep and
+// count to know the loop exists. Increment a persistent counter at every
+// fresh start and log it so a single `grep "[server-init] start"` answers
+// "is the brand process in a restart loop, and how deep?"
+//
+// The counter lives under /tmp keyed on ACCOUNT_ID so brands on the same
+// device do not collide. /tmp is cleared on reboot, which is correct
+// semantics: a clean reboot starts the count fresh; a restart loop in the
+// brand process keeps the same /tmp and shows count>1.
+
+function bumpStartCounter() {
+  const accountId = process.env.ACCOUNT_ID || 'default'
+  const counterPath = path.join('/tmp', `server-init-${accountId}-restart.count`)
+  let prior = 0
+  if (existsSync(counterPath)) {
+    try {
+      const raw = readFileSync(counterPath, 'utf8').trim()
+      const parsed = Number.parseInt(raw, 10)
+      if (Number.isFinite(parsed) && parsed >= 0) prior = parsed
+    } catch { /* unreadable counter — treat as 0 */ }
+  }
+  const next = prior + 1
+  try {
+    writeFileSync(counterPath, String(next), 'utf8')
+  } catch (err) {
+    // Counter persistence is best-effort; the start line still emits.
+    console.error(`[server-init] start-counter-write-failed path=${counterPath} err=${err && err.message ? err.message : String(err)}`)
+  }
+  console.error(`[server-init] start count=${next} account=${accountId} counter-path=${counterPath}`)
+}
+
+bumpStartCounter()
+
+// ---------------------------------------------------------------------------
+// 1. mDNS bypass — redirect *.local to LAN IP
+// ---------------------------------------------------------------------------
+
+function getLanIp() {
+  const nets = os.networkInterfaces()
+  let fallback = null
+  for (const entries of Object.values(nets)) {
+    if (!entries) continue
+    for (const entry of entries) {
+      if (entry.family !== 'IPv4' || entry.internal) continue
+      if (entry.address.startsWith('192.168.') || entry.address.startsWith('10.')) {
+        return entry.address
+      }
+      if (!fallback) fallback = entry.address
+    }
+  }
+  return fallback
+}
+
+// ---------------------------------------------------------------------------
+// Power health — surface Pi brownout/throttle + DHCP churn to server.log
+// ---------------------------------------------------------------------------
+//
+// A marginal PSU browns out under ollama embed current and the kernel logs
+// `Undervoltage detected!` to the journal, but the admin server never saw it.
+// Emit one greppable `[power-health]` line at boot and every 15 min reading the
+// real vcgencmd sticky word + unclean-reboot count + EXT5V input voltage. The
+// boot line also records the resolved LAN IP so DHCP churn across reboots is
+// visible. Pi-only: off-Pi (no vcgencmd) it logs one skipped line and starts no
+// interval.
+
+const powerHealth = require('./power-health.cjs')
+
+function phRun(cmd, args) {
+  try {
+    const r = spawnSync(cmd, args, { stdio: 'pipe', timeout: 5000, encoding: 'utf8' })
+    if (r.status !== 0 || typeof r.stdout !== 'string') return null
+    return r.stdout
+  } catch { return null }
+}
+
+try {
+  // Compute the status line once; the boot lines reuse it and the interval is
+  // armed off the same result, so vcgencmd/last are not probed twice at boot.
+  const bootStatus = powerHealth.buildStatusLine({ runner: phRun, now: new Date() })
+  for (const line of powerHealth.buildBootLines({ runner: phRun, now: new Date(), lanIp: getLanIp(), status: bootStatus })) {
+    console.error(line)
+  }
+  if (bootStatus !== null) {
+    const phInterval = setInterval(() => {
+      const line = powerHealth.buildStatusLine({ runner: phRun, now: new Date() })
+      if (line) console.error(line)
+    }, 15 * 60 * 1000)
+    phInterval.unref()
+  }
+} catch (err) {
+  console.error(`[power-health] init-failed err=${err && err.message ? err.message : String(err)}`)
+}
+
+// Paths that must NOT be redirected (API calls, static assets, VNC)
+const SKIP_REDIRECT_RE = /^\/(api|assets|brand|novnc|vnc-viewer|vnc-popout|favicon)/
+
+const _originalCreateServer = http.createServer.bind(http)
+
+http.createServer = function patchedCreateServer(...args) {
+  const requestListener = typeof args[0] === 'function' ? args[0] : args[1]
+  const opts = typeof args[0] === 'function' ? undefined : args[0]
+  function wrappedListener(req, res) {
+    const host = req.headers.host || ''
+    if (/^[a-z0-9-]+\.local(:|$)/.test(host) && !SKIP_REDIRECT_RE.test(req.url || '')) {
+      const ip = getLanIp()
+      if (ip) {
+        const port = host.includes(':') ? host.split(':')[1] : '19200'
+        res.writeHead(302, { Location: `http://${ip}:${port}${req.url || '/'}` })
+        res.end()
+        return
+      }
+    }
+    requestListener(req, res)
+  }
+  return opts
+    ? _originalCreateServer(opts, wrappedListener)
+    : _originalCreateServer(wrappedListener)
+}
+
+console.error('[server-init] mDNS bypass active (*.local → LAN IP)')
+
+// ---------------------------------------------------------------------------
+// 2. systemd sd_notify via systemd-notify command
+// ---------------------------------------------------------------------------
+
+const NOTIFY_SOCKET = process.env.NOTIFY_SOCKET
+
+function sdNotify(message) {
+  if (!NOTIFY_SOCKET) return
+  try {
+    spawnSync('systemd-notify', [message], { stdio: 'pipe', timeout: 3000 })
+  } catch { /* non-critical */ }
+}
+
+if (NOTIFY_SOCKET) {
+  // Send READY=1 once the event loop is established (next tick after server.js loads)
+  setImmediate(() => {
+    sdNotify('--ready')
+    console.error('[server-init] sd_notify READY=1 sent')
+  })
+
+  // Task 249: WATCHDOG_USEC is injected by systemd when Type=notify +
+  // WatchdogSec= is configured (microseconds, integer). Reading it at runtime
+  // means a future unit-file bump (e.g. 120 → 180) propagates without code
+  // changes. Ping every 15s regardless of deadline: trivially satisfies
+  // systemd's "≤ half-deadline" requirement for any deadline ≥ 30s, and
+  // gives the near-miss check 15s observation windows so a long block is
+  // surfaced within 15s of unblocking.
+  const WATCHDOG_USEC = Number.parseInt(process.env.WATCHDOG_USEC ?? '', 10)
+  const watchdogDeadlineMs = Number.isFinite(WATCHDOG_USEC) && WATCHDOG_USEC > 0
+    ? Math.floor(WATCHDOG_USEC / 1000)
+    : null
+
+  // monitorEventLoopDelay records every libuv tick's lag; a sync block of N
+  // seconds shows up as histogram.max ≈ N*1000 ms in the cycle where the
+  // block ends. When max crosses 50% of the deadline we emit one line so
+  // `grep '[server-init] watchdog ping miss' server.log` answers "did we
+  // approach the deadline, and how close" without needing systemd state or
+  // journald. Histogram is reset every cycle so max reflects this window.
+  // Only enabled when the deadline is known — no point recording samples no
+  // one reads.
+  const loopHist = watchdogDeadlineMs !== null ? monitorEventLoopDelay({ resolution: 50 }) : null
+  if (loopHist) loopHist.enable()
+
+  const watchdogInterval = setInterval(() => {
+    sdNotify('WATCHDOG=1')
+    if (loopHist && watchdogDeadlineMs !== null) {
+      const maxMs = loopHist.max / 1_000_000
+      loopHist.reset()
+      if (maxMs >= watchdogDeadlineMs / 2) {
+        console.error(`[server-init] watchdog ping miss lag-ms=${Math.round(maxMs)} deadline-ms=${watchdogDeadlineMs}`)
+      }
+    }
+  }, 15_000)
+  watchdogInterval.unref() // don't keep the process alive for this
+  console.error(`[server-init] watchdog enabled (ping-interval-ms=15000 deadline-ms=${watchdogDeadlineMs ?? 'unset'})`)
+} else {
+  console.error('[server-init] no NOTIFY_SOCKET, watchdog disabled')
+}
+
+// ---------------------------------------------------------------------------
+// 3. Graceful shutdown on SIGTERM
+// ---------------------------------------------------------------------------
+
+let shuttingDown = false
+
+function gracefulShutdown(signal) {
+  if (shuttingDown) return
+  shuttingDown = true
+  console.error(`[server-init] ${signal} received, shutting down...`)
+  sdNotify('STOPPING=1\nSTATUS=Draining connections')
+
+  // Give in-flight requests 5s to complete, then exit
+  setTimeout(() => {
+    console.error('[server-init] drain timeout, exiting')
+    process.exit(0)
+  }, 5_000).unref()
+}
+
+process.on('SIGTERM', () => gracefulShutdown('SIGTERM'))
+process.on('SIGINT', () => gracefulShutdown('SIGINT'))