@cparkerwebm/webmonterey 1.1.0 → 1.3.0

package/src/cli/audit.ts

@@ -0,0 +1,323 @@
+/*
+ * `webm audit [dist/client]` - the pre-launch checks that only a BUILD can answer.
+ *
+ * `webm doctor` reads source. Some things are only visible in the output: whether every image
+ * that reached the page has alt text, whether every internal link lands on a file the build
+ * produced (or a route the Worker serves), whether the sitemap the build wrote is complete and
+ * advertised. Each is the kind of thing a launch checklist says to "check" and nobody does
+ * exhaustively by hand on a forty-page site.
+ *
+ * Pure where it can be: `audit()` takes the built files and returns findings, so the rules are
+ * tested with literal HTML. `run()` reads dist/ and, unless told not to, makes one request per
+ * unique external link - the one part that needs a network.
+ *
+ * WHAT IT DOES NOT DO: write alt text. It lists the images that have none; the launch skill is
+ * what looks at each one and writes the words. An empty `alt=""` is a valid declaration that an
+ * image is decorative and is not reported - only a MISSING attribute is.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+
+export interface AuditInput {
+  /** Relative html path -> contents, for every page in the build. */
+  pages: Map<string, string>;
+  /** Whether a relative path exists in the build output. */
+  exists: (rel: string) => boolean;
+  /** Read a relative non-html file from the build, or null. */
+  read: (rel: string) => string | null;
+  /** wrangler.jsonc's run_worker_first, so an on-demand route is not reported as broken. */
+  workerFirst: string[];
+  /** The production origin, for sitemap and external-link decisions. Undefined while unset. */
+  origin?: string;
+}
+
+export interface AuditReport {
+  missingAlt: { page: string; src: string }[];
+  brokenInternal: { page: string; href: string }[];
+  /** Unique external URLs, for the caller to probe. */
+  external: string[];
+  sitemap: { problems: string[]; urls: number };
+}
+
+/** The value of one attribute on a tag, or null when absent. Quoted or bare. */
+export function attr(tag: string, name: string): string | null {
+  const m = new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, 'i').exec(tag);
+  if (!m) return null;
+  return m[1] ?? m[2] ?? m[3] ?? '';
+}
+
+/** Whether an attribute is present at all, with or without a value. */
+export function hasAttr(tag: string, name: string): boolean {
+  return new RegExp(`\\s${name}(?=[\\s=>/])`, 'i').test(tag);
+}
+
+/** Every `<img>` on a page that declares no alt attribute at all. */
+export function imagesWithoutAlt(html: string): string[] {
+  const out: string[] = [];
+  for (const m of html.matchAll(/<img\b[^>]*>/gi)) {
+    const tag = m[0];
+    if (hasAttr(tag, 'alt')) continue;
+    out.push(attr(tag, 'src') ?? '(no src)');
+  }
+  return out;
+}
+
+const SKIP_SCHEMES = /^(mailto:|tel:|sms:|javascript:|data:|#)/i;
+
+/** The hrefs on a page, split into internal paths and external URLs. */
+export function links(html: string, origin?: string): { internal: string[]; external: string[] } {
+  const internal = new Set<string>();
+  const external = new Set<string>();
+  for (const m of html.matchAll(/<a\b[^>]*>/gi)) {
+    const href = attr(m[0], 'href');
+    if (!href || SKIP_SCHEMES.test(href)) continue;
+    if (/^https?:\/\//i.test(href)) {
+      /* A link to the site's own origin is internal - check it as a path. */
+      if (origin && href.startsWith(origin)) internal.add(href.slice(origin.length) || '/');
+      else external.add(href);
+      continue;
+    }
+    if (href.startsWith('//')) {
+      external.add(`https:${href}`);
+      continue;
+    }
+    internal.add(href);
+  }
+  return { internal: [...internal], external: [...external] };
+}
+
+/**
+ * Does an internal href land somewhere? A file the build wrote, in any of the forms the asset
+ * router would serve it under, or a route the Worker answers.
+ */
+export function resolves(href: string, input: Pick<AuditInput, 'exists' | 'workerFirst'>): boolean {
+  let path = href.split('#')[0]!.split('?')[0]!;
+  try {
+    path = decodeURIComponent(path);
+  } catch {
+    /* leave it */
+  }
+  if (!path.startsWith('/')) return true; /* relative to the page; not worth a false positive */
+  if (path === '/') return input.exists('index.html');
+
+  const bare = path.replace(/\/$/, '');
+  const rel = bare.slice(1);
+  if (input.exists(rel) || input.exists(`${rel}.html`) || input.exists(`${rel}/index.html`)) {
+    return true;
+  }
+  return input.workerFirst.some((entry) =>
+    entry.endsWith('/*')
+      ? bare === entry.slice(0, -2) || bare.startsWith(entry.slice(0, -1))
+      : entry === bare || entry === `${bare}/`,
+  );
+}
+
+/** `<loc>` values out of a sitemap document. */
+export function locs(xml: string): string[] {
+  return [...xml.matchAll(/<loc>\s*([^<]+?)\s*<\/loc>/g)].map((m) => m[1]!);
+}
+
+/**
+ * The sitemap the build wrote: present, advertised in robots.txt, every child present, every URL
+ * on the production origin and landing on a page.
+ */
+export function auditSitemap(input: AuditInput): AuditReport['sitemap'] {
+  const problems: string[] = [];
+  const index = input.read('sitemap-index.xml');
+  if (!index) {
+    return {
+      problems: [
+        input.origin
+          ? 'sitemap-index.xml was not built'
+          : 'no sitemap - `domain` in webmonterey.json is unset, so nothing has an absolute URL',
+      ],
+      urls: 0,
+    };
+  }
+
+  const robots = input.read('robots.txt') ?? '';
+  if (!/^Sitemap:\s*\S+/m.test(robots)) problems.push('robots.txt has no Sitemap: line');
+
+  let urls = 0;
+  for (const childUrl of locs(index)) {
+    const childRel = childUrl.replace(/^https?:\/\/[^/]+\//, '');
+    const child = input.read(childRel);
+    if (!child) {
+      problems.push(`${childRel} is listed in the index and was not built`);
+      continue;
+    }
+    for (const url of locs(child)) {
+      urls++;
+      if (input.origin && !url.startsWith(input.origin)) {
+        problems.push(`${url} is not on ${input.origin}`);
+        continue;
+      }
+      const path = url.replace(/^https?:\/\/[^/]+/, '') || '/';
+      if (!resolves(path, input)) problems.push(`${url} is in the sitemap and has no page`);
+    }
+  }
+  if (urls === 0) problems.push('the sitemap lists no URLs');
+  return { problems, urls };
+}
+
+export function audit(input: AuditInput): AuditReport {
+  const missingAlt: AuditReport['missingAlt'] = [];
+  const brokenInternal: AuditReport['brokenInternal'] = [];
+  const external = new Set<string>();
+
+  for (const [page, html] of input.pages) {
+    for (const src of imagesWithoutAlt(html)) missingAlt.push({ page, src });
+    const found = links(html, input.origin);
+    for (const href of found.internal) {
+      if (!resolves(href, input)) brokenInternal.push({ page, href });
+    }
+    for (const url of found.external) external.add(url);
+  }
+
+  return {
+    missingAlt,
+    brokenInternal,
+    external: [...external].sort(),
+    sitemap: auditSitemap(input),
+  };
+}
+
+/* ── the command ─────────────────────────────────────────────────────────────────────────── */
+
+function walk(dir: string): string[] {
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir, { withFileTypes: true }).flatMap((e) => {
+    const full = join(dir, e.name);
+    return e.isDirectory() ? walk(full) : [full];
+  });
+}
+
+/** Strip // and /* comments so JSON.parse can read a .jsonc file. */
+function parseJsonc<T>(source: string): T {
+  const stripped = source
+    .replace(/\\"|"(?:\\"|[^"])*"|(\/\/.*|\/\*[\s\S]*?\*\/)/g, (m, comment) => (comment ? '' : m))
+    .replace(/,(\s*[}\]])/g, '$1');
+  return JSON.parse(stripped) as T;
+}
+
+/**
+ * One request per unique external URL. HEAD first; a 405 gets a GET, because plenty of servers
+ * refuse HEAD and answer GET. Failures are reported as warnings, not failures: many sites block
+ * anything that is not a browser, and a link that a bot cannot fetch is not necessarily broken.
+ */
+async function probe(urls: string[]): Promise<{ url: string; status: string }[]> {
+  const bad: { url: string; status: string }[] = [];
+  const queue = [...urls];
+  const worker = async () => {
+    for (let url = queue.shift(); url; url = queue.shift()) {
+      try {
+        let res = await fetch(url, {
+          method: 'HEAD',
+          redirect: 'follow',
+          signal: AbortSignal.timeout(8000),
+        });
+        if (res.status === 405 || res.status === 403) {
+          res = await fetch(url, {
+            method: 'GET',
+            redirect: 'follow',
+            signal: AbortSignal.timeout(8000),
+          });
+        }
+        if (res.status >= 400) bad.push({ url, status: String(res.status) });
+      } catch (error) {
+        bad.push({ url, status: error instanceof Error ? error.name : 'error' });
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: 6 }, worker));
+  return bad.sort((a, b) => a.url.localeCompare(b.url));
+}
+
+export async function run(argv: string[]): Promise<number> {
+  const dist = resolve(argv.find((a) => !a.startsWith('-')) ?? 'dist/client');
+  const noExternal = argv.includes('--no-external');
+
+  if (!existsSync(join(dist, 'index.html'))) {
+    console.error(`webm audit: no build at ${dist}. Run \`npm run build\` first.`);
+    return 1;
+  }
+
+  const siteRoot = process.cwd();
+  const files = walk(dist);
+  const rels = new Set(files.map((f) => relative(dist, f)));
+  const pages = new Map(
+    files
+      .filter((f) => f.endsWith('.html'))
+      .map((f) => [relative(dist, f), readFileSync(f, 'utf8')]),
+  );
+
+  const wranglerPath = ['wrangler.jsonc', 'wrangler.json']
+    .map((f) => join(siteRoot, f))
+    .find(existsSync);
+  const wrangler = wranglerPath
+    ? parseJsonc<{ assets?: { run_worker_first?: string[] } }>(readFileSync(wranglerPath, 'utf8'))
+    : null;
+
+  const sitePath = join(siteRoot, 'webmonterey.json');
+  const site = existsSync(sitePath)
+    ? (JSON.parse(readFileSync(sitePath, 'utf8')) as { domain?: string })
+    : {};
+  const origin = site.domain && site.domain !== 'CHANGEME' ? `https://${site.domain}` : undefined;
+
+  const report = audit({
+    pages,
+    exists: (rel) => rels.has(rel),
+    read: (rel) =>
+      rels.has(rel) && statSync(join(dist, rel)).isFile()
+        ? readFileSync(join(dist, rel), 'utf8')
+        : null,
+    workerFirst: wrangler?.assets?.run_worker_first ?? [],
+    origin,
+  });
+
+  let failed = 0;
+  const section = (ok: boolean, title: string) => console.log(`${ok ? '  ok ' : 'FAIL '} ${title}`);
+
+  section(report.missingAlt.length === 0, `Every image declares alt text (${pages.size} pages)`);
+  for (const { page, src } of report.missingAlt)
+    console.log(`       ${page}: <img src="${src}"> has no alt attribute`);
+  if (report.missingAlt.length) {
+    failed++;
+    console.log(
+      `       Write alt text for each - what the image shows, in context - or alt="" if it is decorative.`,
+    );
+  }
+
+  section(
+    report.brokenInternal.length === 0,
+    'Every internal link lands on a page or a Worker route',
+  );
+  for (const { page, href } of report.brokenInternal) console.log(`       ${page}: ${href}`);
+  if (report.brokenInternal.length) failed++;
+
+  section(
+    report.sitemap.problems.length === 0,
+    `The sitemap is complete and advertised (${report.sitemap.urls} URLs)`,
+  );
+  for (const p of report.sitemap.problems) console.log(`       ${p}`);
+  if (report.sitemap.problems.length) failed++;
+
+  if (noExternal) {
+    console.log(`  --  ${report.external.length} external links not probed (--no-external)`);
+  } else if (report.external.length) {
+    const bad = await probe(report.external);
+    console.log(
+      `${bad.length ? 'warn ' : '  ok '} ${report.external.length} external links respond (${bad.length} did not)`,
+    );
+    for (const { url, status } of bad) console.log(`       ${status.padEnd(12)} ${url}`);
+    if (bad.length)
+      console.log(
+        `       Open each in a browser before deciding it is broken - many sites refuse bots.`,
+      );
+  } else {
+    console.log('  ok  no external links');
+  }
+
+  console.log(`\n${failed === 0 ? 'audit clean' : `${failed} check(s) failed`}`);
+  return failed ? 1 : 0;
+}

package/src/cli/checks.test.ts

@@ -22,6 +22,7 @@ const base = (over: Partial<CheckContext> = {}): CheckContext => ({
   sync: { version: '1.0.0', skills: ['launch'] },
   mcp: { declared: mcpConfig().mcpServers, enabled: [...MCP_NAMES] },
   version: '1.0.0',
+  worker: { name: 'acme', deployments: 1, skipped: null },
   ...over,
 });
 
@@ -217,7 +218,7 @@ test('a site with components but no credit import warns', () => {
   const ctx = base({
     components: new Map([['src/components/regions/footer/footer.astro', '<footer>hi</footer>']]),
   });
-  const result = runCheck('agency-credit', ctx);
+  const result = runCheck('webmaster-credit', ctx);
   assert.equal(result.status, 'warn');
   assert.match(result.detail!, /footer component/);
 });
@@ -227,15 +228,15 @@ test('a footer that imports the credit passes', () => {
     components: new Map([
       [
         'src/components/regions/footer/footer.astro',
-        `import Credit from '@cparkerwebm/webmonterey/webmonterey/credits/Credit.astro';`,
+        `import Webmaster from '@cparkerwebm/webmonterey/webmonterey/webmaster/Webmaster.astro';`,
       ],
     ]),
   });
-  assert.equal(runCheck('agency-credit', ctx).status, 'pass');
+  assert.equal(runCheck('webmaster-credit', ctx).status, 'pass');
 });
 
 test('a site with no components yet is not nagged', () => {
-  assert.equal(runCheck('agency-credit', base()).status, 'pass');
+  assert.equal(runCheck('webmaster-credit', base()).status, 'pass');
 });
 
 test('a comment explaining a trap does not trip the check that enforces it', () => {
@@ -274,7 +275,7 @@ test("WebMonterey's own site is not asked to credit itself", () => {
     site: { client: 'WebMonterey', domain: 'webmonterey.com' },
     components: new Map([['src/components/regions/footer/footer.astro', '<footer>x</footer>']]),
   });
-  assert.equal(runCheck('agency-credit', ctx).status, 'pass');
+  assert.equal(runCheck('webmaster-credit', ctx).status, 'pass');
 });
 
 test('a cron with no custom entrypoint FAILS, and names the fix', () => {
@@ -405,7 +406,7 @@ test("a placeholder favicon still in public/ fails - it is the agency's mark on
    */
   const ctx = base({
     site: { client: 'Acme', domain: 'acme.com', launched: '2026-03-01' },
-    placeholders: ['public/favicon.svg', 'public/open-graph.png'],
+    placeholders: ['public/favicon.svg', 'public/opengraph.png'],
   });
   const result = runCheck('placeholder-branding', ctx);
   assert.equal(result.status, 'fail', 'a LAUNCHED site shipping the agency mark is a fault');
@@ -709,3 +710,42 @@ test('a server pointed at the wrong url is caught, and both urls are shown', ()
   assert.match(r.detail!, /example\.com/);
   assert.ok(r.detail!.includes(MCP_SERVERS.mdn.url));
 });
+
+/* --- the Worker exists --------------------------------------------------- */
+
+test('a Worker with no deployment warns and says how to create it', () => {
+  /* A repo, a database and nothing serving: the failure /webm:start used to end on. */
+  const r = runCheck(
+    'worker-exists',
+    base({ worker: { name: 'acme', deployments: 0, skipped: null } }),
+  );
+  assert.equal(r.status, 'warn');
+  assert.match(r.detail!, /"acme"/);
+  assert.match(r.detail!, /wrangler deploy/);
+  assert.match(r.detail!, /Settings → Builds/);
+});
+
+test('an unanswerable question skips with the reason, and is not a failure', () => {
+  const r = runCheck(
+    'worker-exists',
+    base({ worker: { name: 'acme', deployments: null, skipped: 'wrangler is not logged in' } }),
+  );
+  assert.equal(r.status, 'pass');
+  assert.match(r.detail!, /skipped: wrangler is not logged in/);
+});
+
+test('a deployed Worker passes', () => {
+  assert.equal(runCheck('worker-exists', base()).status, 'pass');
+});
+
+test('a launched site still declared staging fails, and the message names the search consequence', () => {
+  const r = runCheck(
+    'environment',
+    base({
+      site: { client: 'A', domain: 'a.com', environment: 'staging', launched: '2026-09-01' },
+    }),
+  );
+  assert.equal(r.status, 'fail');
+  assert.match(r.detail!, /noindex/);
+  assert.match(r.detail!, /out of search/);
+});

package/src/cli/checks.ts

@@ -32,6 +32,7 @@ export interface CheckContext {
   site: SiteConfig;
   /** Parsed wrangler.jsonc, or null when absent. */
   wrangler: {
+    name?: string;
     assets?: { run_worker_first?: string[] };
     compatibility_date?: string;
     triggers?: { crons?: string[] };
@@ -73,6 +74,12 @@ export interface CheckContext {
   };
   /** The installed package version. */
   version: string;
+  /**
+   * Whether the Worker named in wrangler.jsonc exists on the account, asked of wrangler by the
+   * doctor. `deployments` is how many it listed - null when the question was not asked, and
+   * `skipped` then says why: wrangler not installed, not logged in, no network.
+   */
+  worker: { name: string | null; deployments: number | null; skipped: string | null };
 }
 
 export interface Check {
@@ -676,14 +683,16 @@ export const CHECKS: Check[] = [
     },
   },
   {
-    id: 'agency-credit',
-    title: 'Something renders the agency credit',
-    silentAs: 'the site ships with no "Powered by WebMonterey" and nobody notices for months',
+    id: 'webmaster-credit',
+    title: 'Something renders the webmaster credit',
+    silentAs:
+      'the site ships with no "Powered by WebMonterey", the /webmaster page is orphaned, and nobody notices for months',
     run(ctx) {
       /*
        * The package ships no footer - it ships no components at all - so the credit is imported
        * by whichever site component renders the footer. That is the right seam and it is also
-       * easy to simply never do, which is how live client sites ended up without it.
+       * easy to simply never do, which is how live client sites ended up without it. Without it
+       * the /webmaster page the package injects is reachable from nothing.
        *
        * A warning, not a failure: a site mid-build has no footer yet, and failing there trains
        * people to ignore the doctor. `/webm:launch` is where it becomes blocking.
@@ -697,11 +706,11 @@ export const CHECKS: Check[] = [
       if (ctx.site.domain === 'webmonterey.com') return pass;
 
       for (const src of ctx.components.values()) {
-        if (/webmonterey\/credits/.test(stripComments(src))) return pass;
+        if (/webmonterey\/webmaster/.test(stripComments(src))) return pass;
       }
       return warn(
-        'no component imports @cparkerwebm/webmonterey/webmonterey/credits/Credit.astro. ' +
-          'The footer component is where it goes.',
+        'no component imports @cparkerwebm/webmonterey/webmonterey/webmaster/Webmaster.astro. ' +
+          'The footer component is where it goes; it links to the /webmaster page.',
       );
     },
   },
@@ -743,7 +752,9 @@ export const CHECKS: Check[] = [
   {
     id: 'environment',
     title: 'The declared environment matches where the site actually is',
-    silentAs: "a launched site whose client email is still being diverted to the agency's inbox",
+    silentAs:
+      "a launched site whose client email is still being diverted to the agency's inbox, and " +
+      'whose every page is noindex',
     run(ctx) {
       const declared = ctx.site.environment;
 
@@ -769,22 +780,51 @@ export const CHECKS: Check[] = [
       if (declared === 'staging' && isConfigured(ctx.site.launched)) {
         return fail(
           `this site launched on ${ctx.site.launched} but is still declared staging, so every ` +
-            `email it sends is being redirected away from its real recipients. Set ` +
-            `"environment": "production" in webmonterey.json.`,
+            `email it sends is being redirected away from its real recipients - and since 1.3.0 ` +
+            `every build of a staging site is a preview: noindex on every page, no canonical, ` +
+            `no sitemap, robots.txt disallowing everything. The live site is dropping out of ` +
+            `search. Set "environment": "production" in webmonterey.json.`,
         );
       }
 
       if (declared !== 'staging' && !isConfigured(ctx.site.launched)) {
         return warn(
           `this site has no launch date but is treated as production, so testing a form will ` +
-            `email the client's real contacts. Set "environment": "staging" in ` +
-            `webmonterey.json until /webm:launch.`,
+            `email the client's real contacts and every page is indexable on its workers.dev ` +
+            `hostname. Set "environment": "staging" in webmonterey.json until /webm:launch.`,
         );
       }
 
       return pass;
     },
   },
+  {
+    /*
+     * THE WORKER EXISTS. /webm:start used to end with a repo, a D1 database and an instruction
+     * to create the Worker in the dashboard by hand - and on one site nobody did. Nothing local
+     * notices: the build is green, every other check here is green, and the site is a
+     * workers.dev hostname that answers nothing. The Worker is the one resource whose absence
+     * has no symptom on disk, so this asks Cloudflare through wrangler - the one thing a laptop
+     * can ask - and steps aside with a note when it cannot.
+     */
+    id: 'worker-exists',
+    title: 'The Worker exists',
+    silentAs: 'a site with a repo, a database and nothing serving',
+    run(ctx) {
+      if (ctx.worker.skipped) return { status: 'pass', detail: `skipped: ${ctx.worker.skipped}` };
+      if (!ctx.worker.name) {
+        return warn('wrangler.jsonc names no Worker, so there is nothing to look for');
+      }
+      if (!ctx.worker.deployments) {
+        return warn(
+          `no deployment of a Worker named "${ctx.worker.name}" on this account. Create it once ` +
+            `from the laptop - npm run build && npx wrangler deploy - then connect the repo to ` +
+            `it in the dashboard (Worker → Settings → Builds). /webm:start, steps 5 and 6.`,
+        );
+      }
+      return pass;
+    },
+  },
   {
     id: 'seeded-files',
     title: 'The files Astro copies verbatim are present',

package/src/cli/doctor.ts

@@ -8,8 +8,10 @@
  *
  * Exit code is 1 on any failure, so it can gate a build or a go-live.
  */
+import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
-import { join, relative } from 'node:path';
+import { createRequire } from 'node:module';
+import { dirname, join, relative, resolve } from 'node:path';
 import { CHECKS, type CheckContext } from './checks.ts';
 import { loadSiteFiles } from '../integration/config.ts';
 
@@ -108,16 +110,90 @@ function readMcp(siteRoot: string): CheckContext['mcp'] {
   };
 }
 
+/**
+ * Ask wrangler whether the Worker exists - the one check here that leaves the machine.
+ *
+ * `wrangler deployments list --name <name> --json` is a read: it lists what is deployed and
+ * changes nothing. wrangler is resolved from the site upward, the way `npx` would find it,
+ * rather than downloaded - a doctor that installs things is not a doctor. Every way the question
+ * can go unanswered - no wrangler, not logged in, no network - is a SKIP with the reason, never
+ * a failure: the check exists to catch a missing Worker, and a laptop that cannot ask is not
+ * evidence of one.
+ *
+ * The two answers that matter are told apart by wrangler's own words: a missing Worker is
+ * "does not exist [code: 10007]"; a missing login is a request to set CLOUDFLARE_API_TOKEN, an
+ * authentication error, or a rejected token.
+ */
+function workerState(siteRoot: string, name: string | null | undefined): CheckContext['worker'] {
+  const worker = { name: name ?? null, deployments: null, skipped: null };
+  if (!worker.name) return worker;
+
+  /* Absolute, or createRequire refuses it - `webm doctor examples/minimal` passes a relative root. */
+  let bin: string;
+  try {
+    const require = createRequire(join(resolve(siteRoot), 'package.json'));
+    bin = join(dirname(require.resolve('wrangler/package.json')), 'bin/wrangler.js');
+  } catch {
+    return {
+      ...worker,
+      skipped: 'wrangler is not installed here, so the Worker was not looked for',
+    };
+  }
+
+  try {
+    const out = execFileSync(
+      process.execPath,
+      [bin, 'deployments', 'list', '--name', worker.name, '--json'],
+      {
+        cwd: siteRoot,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: 30_000,
+        env: { ...process.env, WRANGLER_SEND_METRICS: 'false', NO_COLOR: '1' },
+      },
+    );
+    const start = out.indexOf('[');
+    const parsed: unknown = start >= 0 ? JSON.parse(out.slice(start)) : [];
+    return { ...worker, deployments: Array.isArray(parsed) ? parsed.length : 0 };
+  } catch (error) {
+    const e = error as { stdout?: string; stderr?: string; message?: string };
+    const text = `${e.stdout ?? ''}\n${e.stderr ?? ''}\n${e.message ?? ''}`;
+    if (/code: 10007\]|does not exist on your account/i.test(text)) {
+      return { ...worker, deployments: 0 };
+    }
+    if (
+      /CLOUDFLARE_API_TOKEN|not (logged in|authenticated)|Authentication error|code: (10000|6111|9109)\]/i.test(
+        text,
+      )
+    ) {
+      return {
+        ...worker,
+        skipped:
+          'wrangler is not logged in (npx wrangler login), so whether the Worker exists was not checked',
+      };
+    }
+    const line = text
+      .split('\n')
+      .map((l) => l.replace(/\x1b\[[0-9;]*m/g, '').trim())
+      .find((l) => l && !l.startsWith('🪵'));
+    return { ...worker, skipped: `wrangler could not answer: ${line ?? 'no output'}` };
+  }
+}
+
 export function buildContext(siteRoot: string): CheckContext {
   const { site } = loadSiteFiles(siteRoot);
   const wranglerPath = ['wrangler.jsonc', 'wrangler.json']
     .map((f) => join(siteRoot, f))
     .find(existsSync);
   const syncPath = join(siteRoot, '.claude/skills/webm/.webm-sync.json');
+  const wrangler: CheckContext['wrangler'] = wranglerPath
+    ? parseJsonc(readFileSync(wranglerPath, 'utf8'))
+    : null;
 
   return {
     site,
-    wrangler: wranglerPath ? parseJsonc(readFileSync(wranglerPath, 'utf8')) : null,
+    wrangler,
+    worker: workerState(siteRoot, wrangler?.name),
     pages: readTree(siteRoot, 'src/pages', ['.astro', '.ts']),
     components: readTree(siteRoot, 'src/components', ['.astro', '.ts']),
     today: new Date().toISOString().slice(0, 10),

package/src/cli/scaffold.test.ts

@@ -2,6 +2,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { scaffold } from './scaffold.ts';
 import { MCP_NAMES, mcpConfig } from './mcp.ts';
+import { DENY_RULES } from './settings.ts';
 
 const files = (over = {}) =>
   scaffold({
@@ -235,3 +236,11 @@ test('the margin crosses a month and a year boundary correctly', () => {
   assert.equal(at('2026-01-05'), '2025-12-22');
   assert.equal(at('2026-03-05'), '2026-02-19', 'and February');
 });
+
+test('a session in a client repo cannot edit the package: node_modules is denied', () => {
+  const deny: string[] = json(files(), '.claude/settings.json').permissions.deny;
+  assert.deepEqual(deny, [...DENY_RULES], 'the one list in cli/settings.ts');
+  assert.ok(deny.includes('Edit(**/node_modules/**)'));
+  /* Claude Code checks Edit and Read rules only; a Write rule is ignored and warned about. */
+  assert.ok(!deny.some((r) => r.startsWith('Write(')), 'no Write rule');
+});