@rubytech/create-maxy-code 0.1.0

package/payload/platform/plugins/cloudflare/scripts/list-cf-domains.ts

@@ -0,0 +1,751 @@
+// Raw CDP scrape of the operator's Cloudflare dashboard to discover the
+// domains attached to the logged-in account. Output on stdout is a JSON
+// `string[]`, sorted and deduped. Every failure mode exits non-zero with
+// a `reason=<enum>` token on stderr tagged [list-cf-domains].
+//
+// Why raw CDP, not playwright:
+//   - `/json/new?about:blank` + WebSocket to the returned `webSocketDebuggerUrl`
+//     is ~120 LOC including retries and state machine.
+//   - Adds zero npm deps (Node 22 ships global `WebSocket`; no `ws`/`playwright`).
+//   - CDP is already bound to 127.0.0.1 by vnc.sh; the runtime surface is
+//     the same one setup-tunnel.sh uses for browser drive.
+//
+// Why URL-pattern extraction, not CSS selectors:
+//   - Cloudflare's SPA uses hashed, version-churning class names — a selector
+//     written today drifts within a dashboard redesign window.
+//   - The `/<accountId>/<domain>` URL shape is load-bearing for CF's own
+//     routing and cannot drift without breaking their entire dashboard; it
+//     is the most stable surface to key off.
+//
+// Why href-only (no page-text fallback): Task 599 removed an earlier
+// <main>-wide FQDN text walker ("Source B") after a reproduction returned
+// `count=1` with a bogus string (`leg.interest` — a static footer FQDN-shape
+// that hit the regex). The walker's non-empty result short-circuited the
+// poll-to-success branch before zones hydrated 500 ms later, silently
+// returning wrong data with `reason=ok`. The walker's intended role —
+// "defend against CF redesign removing href links" — is already served by
+// the existing `empty-or-drift` body-dump branch when href scraping returns
+// nothing; a silent fallback that produces wrong answers is strictly worse
+// than a loud drift signal with a snapshotted HTML dump for diagnosis.
+//
+// Why poll-to-stable: the CF dashboard lazy-loads its zone list after the
+// initial document-ready signal. A naive "return on first non-empty poll"
+// can race into a partial result (e.g. first zone rendered at t=500 ms, all
+// zones at t=1000 ms). The `scrapeDomains` poll waits for the observed count
+// to stabilise across two consecutive iterations before returning.
+//
+// Contract with the caller (list-cf-domains.sh → route → form):
+//   stdout on exit 0: JSON `string[]`  (empty array means signed-in-but-empty)
+//   stderr on any path: phase_line-formatted lines, `[list-cf-domains] …`
+//   exit 1: `reason=<enum>` on stderr; scrape-empty-but-no-error is exit 0
+//            with body dump (the enum exists so the caller can distinguish
+//            "selector drift" from "empty account" — both shapes arrive via
+//            stdout).
+
+import { appendFileSync, readFileSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+
+// CDP endpoint is resolved lazily inside `main()` so importing this module
+// for in-process tests (`scrapeCurrentPage` / `scrapeDomains` under JSDOM)
+// does not require an installed brand on disk.
+//
+// Task 954 source-of-truth contract:
+//   Runtime: brand.json `cdpPort` at `${MAXY_PLATFORM_ROOT}/config/brand.json`
+//     is authoritative. Wrapper exports MAXY_PLATFORM_ROOT and BRAND. Missing
+//     env / file / field → loud-fail with one of three named reasons. The
+//     pre-Task-954 silent CDP-port default made every non-Maxy brand fail
+//     `cdp-unreachable` because the helper hit Maxy's port instead of the
+//     brand's; Task 787 / NEO4J_URI sets the precedent that runtime config
+//     never falls back silently.
+//
+//   Test overrides: when BOTH `LIST_CF_DOMAINS_CDP_HOST` and
+//     `LIST_CF_DOMAINS_CDP_PORT` are set, they win over brand.json. The
+//     existing ECONNREFUSED vitest forces `127.0.0.1:1` (RFC 6335-reserved)
+//     this way without an installed brand. Production never sets these.
+
+// Phase budgets total 30s (enforced by the shell wrapper's `timeout`).
+// Individual steps get sub-budgets so an early stall does not eat the
+// whole envelope silently.
+const CONNECT_TIMEOUT_MS = 2_000;
+const NAVIGATE_TIMEOUT_MS = 15_000;
+const SIGNED_IN_POLL_MS = 10_000;
+const SCRAPE_POLL_MS = 10_000;
+const POLL_INTERVAL_MS = 500;
+
+type Reason =
+  | "cdp-unreachable"
+  | "target-create-failed"
+  | "ws-connect-failed"
+  | "not-signed-in"
+  | "navigate-failed"
+  | "table-wait-timeout"
+  | "runtime-error"
+  // Task 954 — config-class failures. The first three short-circuit before
+  // any CDP work begins; the route maps them to `field='config'` so the
+  // form renders a config-card naming the brand + path instead of a Retry
+  // button (retrying re-fires the same wrongly-resolved spawn — Task 787
+  // pattern).
+  | "brand-config-missing"
+  | "cdp-port-unresolved";
+
+// Sticky flag: once a stream-log write fails (EACCES, ENOENT, …), skip
+// subsequent file writes for the rest of this process. Repeated appends to an
+// unwritable path would spam stderr with identical `phase=stream-log-write-failed`
+// lines and crowd result.stderr that the route handler regex reads. Losing a
+// log line is strictly better than aborting the scrape — observability failure
+// must not mask the scrape's real signal.
+let streamLogWriteFailed = false;
+
+function logPhase(line: string): void {
+  // Stderr: preserved for direct-SSH invocation parity AND for runFormSpawn's
+  // in-memory `result.stderr`, which the route handler greps for `reason=<enum>`
+  // on non-zero exit. Removing this write would break the form's error-card path.
+  process.stderr.write(`[list-cf-domains] ${line}\n`);
+
+  // Stream log: direct write by the TS helper (not via wrapper tee) so phase
+  // lines reach the per-conversation file the Task 592 tailer reads, even on
+  // exit 0 where runFormSpawn discards `result.stderr`. Format parity with
+  // `_stream-log.sh phase_line`: `[<ISO-ts>] [script:<scope>] <content>\n` —
+  // the `script:` prefix is Task 605's chat-surface namespace so the line
+  // passes the tightened tailer regex (`[mcp:*]` / `[init]` / `[api-wait-*]`
+  // lines in the same file are excluded by construction). Asserted by the
+  // vitest regression under platform/ui/__tests__. Sync append so the
+  // terminal `phase=script-exit code=0 count=N` lands before process exit.
+  const streamLogPath = process.env.STREAM_LOG_PATH;
+  if (!streamLogPath || streamLogWriteFailed) return;
+  try {
+    appendFileSync(
+      streamLogPath,
+      `[${new Date().toISOString()}] [script:list-cf-domains] ${line}\n`,
+    );
+  } catch (err) {
+    streamLogWriteFailed = true;
+    const detail = (err instanceof Error ? err.message : String(err))
+      .slice(0, 200)
+      .replace(/"/g, "'");
+    process.stderr.write(
+      `[list-cf-domains] phase=stream-log-write-failed detail="${detail}"\n`,
+    );
+  }
+}
+
+function die(reason: Reason, detail = ""): never {
+  logPhase(`phase=error reason=${reason}${detail ? ` detail="${detail.replace(/"/g, "'").slice(0, 300)}"` : ""}`);
+  process.exit(1);
+}
+
+interface CdpEndpoint {
+  host: string;
+  port: number;
+  source: "env-override" | "brand.json";
+}
+
+// Task 954 — single source of truth for the CDP endpoint. Called once from
+// `main()` so the JSDOM scrape test (which imports `scrapeCurrentPage`
+// directly without invoking `main`) does not need an installed brand.
+function resolveCdpEndpoint(): CdpEndpoint {
+  const envHost = process.env.LIST_CF_DOMAINS_CDP_HOST;
+  const envPortRaw = process.env.LIST_CF_DOMAINS_CDP_PORT;
+  if (envHost !== undefined && envPortRaw !== undefined) {
+    const envPort = Number(envPortRaw);
+    if (!Number.isInteger(envPort) || envPort <= 0 || envPort > 65535) {
+      die(
+        "cdp-port-unresolved",
+        `LIST_CF_DOMAINS_CDP_PORT="${envPortRaw}" is not a valid integer port`,
+      );
+    }
+    return { host: envHost, port: envPort, source: "env-override" };
+  }
+
+  const brand = process.env.BRAND;
+  if (!brand) {
+    die(
+      "brand-config-missing",
+      "BRAND env var not set by wrapper — refusing to guess brand identity",
+    );
+  }
+  const platformRoot = process.env.MAXY_PLATFORM_ROOT;
+  if (!platformRoot) {
+    die(
+      "brand-config-missing",
+      "MAXY_PLATFORM_ROOT env var not set — wrapper must export it before spawn",
+    );
+  }
+  const brandPath = resolve(platformRoot, "config", "brand.json");
+  let raw: string;
+  try {
+    raw = readFileSync(brandPath, "utf-8");
+  } catch (err) {
+    // Distinct emission (not via `die`) so the path is named on the same line
+    // — config-card rendering on the route side keys off it.
+    logPhase(
+      `phase=error reason=brand-config-missing path=${brandPath} detail="${(err instanceof Error ? err.message : String(err)).replace(/"/g, "'").slice(0, 200)}"`,
+    );
+    process.exit(1);
+  }
+  let parsed: Record<string, unknown>;
+  try {
+    parsed = JSON.parse(raw) as Record<string, unknown>;
+  } catch (err) {
+    logPhase(
+      `phase=error reason=brand-config-missing path=${brandPath} detail="parse failed: ${(err instanceof Error ? err.message : String(err)).replace(/"/g, "'").slice(0, 160)}"`,
+    );
+    process.exit(1);
+  }
+  const cdpPort = parsed.cdpPort;
+  if (typeof cdpPort !== "number" || !Number.isInteger(cdpPort) || cdpPort <= 0 || cdpPort > 65535) {
+    // Names the keys actually present so a schema-drift incident surfaces
+    // immediately ("oh, brand.json renamed `cdpPort` to `cdp_port` in r123").
+    const keys = Object.keys(parsed).join(",");
+    logPhase(
+      `phase=error reason=cdp-port-unresolved brand=${brand} json_keys=${keys}`,
+    );
+    process.exit(1);
+  }
+  // Host stays 127.0.0.1 on the runtime path — vnc.sh binds Chromium's CDP
+  // server to localhost only, by construction. brand.json carries the port,
+  // not the host, because the host has never varied across brands.
+  return { host: "127.0.0.1", port: cdpPort, source: "brand.json" };
+}
+
+async function cdpVersion(host: string, port: number): Promise<void> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), CONNECT_TIMEOUT_MS);
+  try {
+    const res = await fetch(`http://${host}:${port}/json/version`, { signal: controller.signal });
+    if (!res.ok) die("cdp-unreachable", `HTTP ${res.status}`);
+  } catch (err) {
+    die("cdp-unreachable", err instanceof Error ? err.message : String(err));
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+interface CdpTarget {
+  id: string;
+  webSocketDebuggerUrl: string;
+}
+
+async function createTarget(host: string, port: number): Promise<CdpTarget> {
+  // `PUT /json/new?<url>` returns JSON describing the target. The URL goes
+  // as a query-string argument (not a ?url= key), matching Chromium's CDP
+  // server. about:blank avoids a wasted navigation — the real navigate
+  // happens over WS after we attach.
+  const endpoint = `http://${host}:${port}/json/new?about:blank`;
+  let res: Response;
+  try {
+    res = await fetch(endpoint, { method: "PUT", signal: AbortSignal.timeout(CONNECT_TIMEOUT_MS) });
+  } catch (err) {
+    die("target-create-failed", err instanceof Error ? err.message : String(err));
+  }
+  if (!res.ok) die("target-create-failed", `HTTP ${res.status}`);
+  const target = (await res.json()) as Partial<CdpTarget>;
+  if (!target.id || !target.webSocketDebuggerUrl) {
+    die("target-create-failed", "response missing id or webSocketDebuggerUrl");
+  }
+  return target as CdpTarget;
+}
+
+async function closeTarget(host: string, port: number, id: string): Promise<void> {
+  try {
+    await fetch(`http://${host}:${port}/json/close/${id}`, {
+      signal: AbortSignal.timeout(CONNECT_TIMEOUT_MS),
+    });
+  } catch {
+    // Best-effort on cleanup — a leaked target is recovered by the next vnc.sh
+    // restart; surfacing it as a failure would mask the real scrape error.
+  }
+}
+
+// Minimal CDP WebSocket client. We only need three commands: Page.enable,
+// Runtime.enable, Page.navigate, Runtime.evaluate. A full client would
+// manage sessions / targets / events — we just need request/response with
+// per-id correlation and an optional event stream for Page.frameNavigated
+// (which we do not actually need because Runtime.evaluate on location.href
+// is the authoritative signal).
+class CdpClient {
+  private ws: WebSocket;
+  private nextId = 1;
+  private pending = new Map<number, { resolve: (v: unknown) => void; reject: (e: Error) => void }>();
+
+  private constructor(ws: WebSocket) {
+    this.ws = ws;
+    this.ws.addEventListener("message", (ev) => this.onMessage(ev.data as string));
+    this.ws.addEventListener("error", () => {
+      for (const { reject } of this.pending.values()) reject(new Error("WebSocket error"));
+      this.pending.clear();
+    });
+    this.ws.addEventListener("close", () => {
+      for (const { reject } of this.pending.values()) reject(new Error("WebSocket closed"));
+      this.pending.clear();
+    });
+  }
+
+  static async connect(url: string): Promise<CdpClient> {
+    const ws = new WebSocket(url);
+    return await new Promise((resolvePromise, rejectPromise) => {
+      const timer = setTimeout(() => {
+        ws.close();
+        rejectPromise(new Error(`WebSocket connect timeout (${CONNECT_TIMEOUT_MS}ms)`));
+      }, CONNECT_TIMEOUT_MS);
+      ws.addEventListener("open", () => {
+        clearTimeout(timer);
+        resolvePromise(new CdpClient(ws));
+      }, { once: true });
+      ws.addEventListener("error", (ev) => {
+        clearTimeout(timer);
+        rejectPromise(new Error(`WebSocket error: ${(ev as ErrorEvent).message ?? "unknown"}`));
+      }, { once: true });
+    });
+  }
+
+  private onMessage(raw: string): void {
+    let msg: { id?: number; result?: unknown; error?: { message?: string } };
+    try {
+      msg = JSON.parse(raw);
+    } catch {
+      return;
+    }
+    if (typeof msg.id !== "number") return;
+    const waiter = this.pending.get(msg.id);
+    if (!waiter) return;
+    this.pending.delete(msg.id);
+    if (msg.error) {
+      waiter.reject(new Error(msg.error.message ?? "CDP error"));
+    } else {
+      waiter.resolve(msg.result);
+    }
+  }
+
+  send<T = unknown>(method: string, params: Record<string, unknown> = {}): Promise<T> {
+    const id = this.nextId++;
+    return new Promise<T>((resolvePromise, rejectPromise) => {
+      this.pending.set(id, {
+        resolve: resolvePromise as (v: unknown) => void,
+        reject: rejectPromise,
+      });
+      this.ws.send(JSON.stringify({ id, method, params }));
+    });
+  }
+
+  close(): void {
+    try { this.ws.close(); } catch { /* ws may already be closing */ }
+  }
+}
+
+interface EvaluateResult {
+  result: { type: string; value?: unknown; description?: string };
+  exceptionDetails?: { text?: string; exception?: { description?: string } };
+}
+
+async function evaluate<T = unknown>(cdp: CdpClient, expression: string): Promise<T> {
+  const res = await cdp.send<EvaluateResult>("Runtime.evaluate", {
+    expression,
+    returnByValue: true,
+    awaitPromise: false,
+  });
+  if (res.exceptionDetails) {
+    throw new Error(res.exceptionDetails.exception?.description ?? res.exceptionDetails.text ?? "evaluate threw");
+  }
+  return res.result.value as T;
+}
+
+// Detect whether the dashboard has redirected to a signed-in account path
+// (URL like `/<32-hex-accountId>/…`) or the unsigned-in `/login` flow.
+// Returns the accountId if signed in, null if still loading, false if
+// definitively signed-out.
+const ACCOUNT_ID_REGEX = /^\/([a-f0-9]{32})(?:\/|$)/;
+
+async function readAccountId(cdp: CdpClient): Promise<string | null | false> {
+  const pathname = await evaluate<string>(cdp, "location.pathname");
+  if (typeof pathname !== "string") return null;
+  if (pathname.startsWith("/login") || pathname.startsWith("/sign-in")) return false;
+  const match = pathname.match(ACCOUNT_ID_REGEX);
+  return match ? match[1] : null;
+}
+
+async function waitForSignedIn(cdp: CdpClient): Promise<string> {
+  const deadline = Date.now() + SIGNED_IN_POLL_MS;
+  while (Date.now() < deadline) {
+    const state = await readAccountId(cdp);
+    if (state === false) die("not-signed-in", "dashboard redirected to login");
+    if (typeof state === "string") {
+      logPhase(`phase=dashboard-nav-complete accountId=${state.slice(0, 8)}…`);
+      return state;
+    }
+    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+  }
+  // Timed out without seeing either pattern — treat as not-signed-in to
+  // prompt `tunnel-login`; a genuinely-slow dashboard that later resolves
+  // would be a false-negative we accept in exchange for deterministic UX.
+  die("not-signed-in", "no /<accountId>/… path reached within budget");
+}
+
+export interface ScrapeOutcome {
+  reason: "ok" | "no-account-id";
+  domains: string[];
+}
+
+// Pure scrape logic — extracts the zones on the current Cloudflare dashboard
+// page by matching `<a href="/<accountId>/<zone>…">` links. Exported for
+// direct in-process testing under JSDOM (see `list-cf-domains-scrape.test.ts`),
+// and serialised into `SCRAPE_EXPRESSION` below for execution inside the
+// operator's VNC Chromium via CDP `Runtime.evaluate`. The function takes its
+// document and location as arguments (rather than reading globals) so the
+// JSDOM test can pass in its window's document+location directly — test and
+// prod share the same implementation, with no duplication and no eval.
+//
+// Note: this function body is serialised via `Function.prototype.toString()`,
+// so it must be fully self-contained — no imports, no captures from outer
+// scope. Node-side helpers belong outside.
+export function scrapeCurrentPage(
+  document: Document,
+  location: Location,
+): ScrapeOutcome {
+  const accountIdMatch = location.pathname.match(/^\/([a-f0-9]{32})/);
+  if (!accountIdMatch) return { reason: "no-account-id", domains: [] };
+  const accountId = accountIdMatch[1];
+
+  const out = new Set<string>();
+  const pushIfDomain = (s: unknown): void => {
+    if (typeof s !== "string") return;
+    const t = s.trim().toLowerCase();
+    if (
+      !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/.test(
+        t,
+      )
+    )
+      return;
+    if (t.endsWith(".cloudflare.com") || t === "cloudflare.com") return;
+    out.add(t);
+  };
+
+  // The only scrape source: `/<accountId>/<host>` hrefs — the canonical CF
+  // routing pattern the overview page uses to link each zone to its
+  // management screens. Task 599 removed a full-<main> FQDN text walker
+  // after it returned a bogus FQDN-shaped string from static page copy
+  // (see module header). When this source returns empty, the caller's
+  // `empty-or-drift` branch snapshots the page HTML for diagnosis — loud
+  // drift signal, not silent wrong data.
+  const hrefPrefix = "/" + accountId + "/";
+  for (const a of document.querySelectorAll("a[href]")) {
+    const href = a.getAttribute("href") || "";
+    if (!href.startsWith(hrefPrefix)) continue;
+    const tail = href.slice(hrefPrefix.length).split("?")[0].split("#")[0];
+    const firstSegment = tail.split("/")[0];
+    pushIfDomain(firstSegment);
+  }
+
+  return { reason: "ok", domains: Array.from(out).sort() };
+}
+
+// The serialised form the CDP Runtime.evaluate executes inside the operator's
+// VNC Chromium. Deriving it from `scrapeCurrentPage.toString()` means the
+// browser-side and the test-side share one implementation — drift between
+// them is impossible by construction.
+export const SCRAPE_EXPRESSION = `(${scrapeCurrentPage.toString()})(document, location)`;
+
+// Minimum surface `scrapeDomains` needs from the CDP client: execute a JS
+// expression in the target page and return the serialised value. Typing the
+// dependency at this width lets the vitest regression inject a mock without
+// constructing a full CdpClient + WebSocket.
+export type CdpEvaluator = (expression: string) => Promise<unknown>;
+
+// Trailing-run length (consecutive polls at `max_count`) the complete-line
+// asserts before it declares `unstable=false`. Two iterations at 500 ms each
+// = 1 s of continuous observation at the high-water mark. Task 615 removed
+// the early-exit on this threshold (it shortcuts multi-zone accounts where
+// the first zone hydrates one poll ahead of the second — the plateau at the
+// intermediate count trips the threshold before the final zone arrives);
+// the threshold now only labels the exit, it does not gate it.
+const STABLE_POLL_THRESHOLD = 2;
+
+// Cap on `document.documentElement.outerHTML` captured into the dump file.
+// The observed Cloudflare dashboard outerHTML is ~1 MB; 5 MB is 5× headroom
+// and still fits comfortably in one `writeFile` syscall on the Pi. Pre-Task
+// 615 this was 100 KB — the dump ended mid-`<head>` CSS on every scrape,
+// rendering the forensic artifact premise of Task 608 silently broken: the
+// zone table lived past the cutoff and `grep <zone-host> <dump>` always
+// returned nothing, forcing re-scrapes to answer post-hoc questions.
+const OUTER_HTML_CAPTURE_MAX_CHARS = 5_000_000;
+
+// Cap the `domains=[…]` payload on per-poll and complete phase lines. The
+// extractor already implicitly bounds the list via the FQDN regex + Set
+// dedupe, but a pathological CF redesign could emit thousands of href
+// matches; the cap keeps the stream log readable without masking the real
+// capture size (the `count=` field carries the exact n).
+const DOMAINS_PAYLOAD_MAX_CHARS = 1000;
+
+function formatDomains(domains: string[]): string {
+  const joined = domains.join(",");
+  return joined.length > DOMAINS_PAYLOAD_MAX_CHARS
+    ? joined.slice(0, DOMAINS_PAYLOAD_MAX_CHARS - 3) + "..."
+    : joined;
+}
+
+type DumpMode = "stable" | "unstable" | "empty-or-drift";
+type DumpResult = { path: string; truncated: boolean } | { err: string };
+
+// Snapshot the operator's current dashboard HTML so post-hoc diagnosis of a
+// partial, unstable, or empty scrape has the exact DOM the scrape observed
+// at exit. Called on all three `scrapeDomains` exit paths — the filename's
+// `mode` field names which path fired, and the `pid<pid>` suffix prevents
+// collision if two invocations land in the same millisecond. Loud-fail
+// preserved: on any throw (evaluator rejected, CONFIG_DIR unset, writeFile
+// ENOENT), return `{err}` so the caller emits a separate
+// `phase=dump-write-failed` line and the complete line carries
+// `dump=failed`. The scrape's real signal must never be masked.
+async function dumpHtml(
+  evaluator: CdpEvaluator,
+  count: number,
+  mode: DumpMode,
+): Promise<DumpResult> {
+  try {
+    const html = (await evaluator(
+      `document.documentElement.outerHTML.slice(0, ${OUTER_HTML_CAPTURE_MAX_CHARS})`,
+    )) as string;
+    // CONFIG_DIR is set by list-cf-domains.sh before the spawn. A silent
+    // fallback would dump logs into the wrong brand's directory on a Real
+    // Agent install — a silent-miswrite masking the wrapper-side break it
+    // came from. Per Task 473 doctrine: loud-fail on absent runtime-derived
+    // values.
+    const configDir = process.env.CONFIG_DIR;
+    if (!configDir) {
+      throw new Error(
+        "CONFIG_DIR env var not set by wrapper — refusing to guess brand log directory",
+      );
+    }
+    const logDir = resolve(homedir(), configDir, "logs");
+    const ts = new Date().toISOString().replace(/[:.]/g, "-");
+    const dumpPath = resolve(
+      logDir,
+      `list-cf-domains-${ts}-count${count}-${mode}-pid${process.pid}.html`,
+    );
+    const htmlStr = typeof html === "string" ? html : String(html);
+    await writeFile(dumpPath, htmlStr, "utf-8");
+    // Heuristic: if the slice returned exactly OUTER_HTML_CAPTURE_MAX_CHARS,
+    // the source outerHTML almost certainly exceeded the cap and we
+    // truncated mid-document. The false positive (outerHTML exactly at the
+    // ceiling) is a rounding coincidence on the order of 1-in-5M and is
+    // acceptable — a loud truncation signal with a ~10^-7 false-positive
+    // rate is strictly better than silent truncation (the pre-Task-615
+    // failure mode at the 100 KB ceiling, which silently broke every scrape
+    // for five months). A downstream investigator seeing `truncated=true`
+    // can re-scrape with a larger cap or `outerHTML` unsliced.
+    const truncated = htmlStr.length >= OUTER_HTML_CAPTURE_MAX_CHARS;
+    return { path: dumpPath, truncated };
+  } catch (err) {
+    return {
+      err: (err instanceof Error ? err.message : String(err)).slice(0, 120),
+    };
+  }
+}
+
+// Render the `dump=<path>` field for a complete-line, and emit a separate
+// loud-fail `phase=dump-write-failed` line on failure. Keeps the on-success
+// complete line terse and routes every failure through the same observation
+// primitive so investigators have one grep pattern for all dump write errors.
+function dumpField(result: DumpResult, mode: DumpMode): string {
+  if ("path" in result) {
+    if (result.truncated) {
+      // Loud separate phase line — an investigator grepping for truncation
+      // incidents across the stream log has one exact pattern to match.
+      logPhase(
+        `phase=dump-truncated mode=${mode} path=${result.path} captured_bytes=${OUTER_HTML_CAPTURE_MAX_CHARS}`,
+      );
+      return `dump=${result.path} dump_truncated=true`;
+    }
+    return `dump=${result.path}`;
+  }
+  logPhase(
+    `phase=dump-write-failed mode=${mode} detail="${result.err.replace(/"/g, "'")}"`,
+  );
+  return "dump=failed";
+}
+
+export async function scrapeDomains(evaluator: CdpEvaluator): Promise<string[]> {
+  const deadline = Date.now() + SCRAPE_POLL_MS;
+  // Task 615: pure poll-to-deadline. The earlier "first N stable polls wins"
+  // heuristic short-circuited on the first plateau a multi-zone dashboard
+  // rendered — a 2-zone account whose second zone hydrates one poll later
+  // than the first would lock `count=1` before the second zone arrived.
+  // Removing early-exit entirely is the only formulation that eliminates the
+  // class: any "N-consec-at-max wins" variant still fires on the intermediate
+  // plateau (`[] [] [a] [a] [a,b] …` → threshold met at poll 4 before zone B
+  // observed). The cost is ~9 s of happy-path latency under the 10 s budget
+  // (still within onboarding tolerance). `max_count` tracks the high-water
+  // count; `consecutiveAtMax` tracks the trailing run at that water-mark;
+  // `seenDecrease` tracks any mid-trajectory count drop. `unstable=false`
+  // requires reaching max, ending at max, at least STABLE_POLL_THRESHOLD
+  // consecutive trailing polls at max, and no mid-trajectory decrease — so a
+  // trajectory like `[a][a][a][a,b]{never reaches 2 consecutive}` correctly
+  // reports `unstable=true` even though `final_count === max_count`.
+  let lastOutcome: ScrapeOutcome | null = null;
+  let maxCount = 0;
+  // Snapshot of the domains array at the most-recent observation of
+  // `maxCount`. Updated on every `>=` poll so it always reflects the latest
+  // capture at the high-water mark; returned at deadline when `maxCount > 0`.
+  let maxDomains: string[] = [];
+  let finalCount = 0;
+  let consecutiveAtMax = 0;
+  let seenDecrease = false;
+  let polls = 0;
+
+  while (Date.now() < deadline) {
+    polls += 1;
+    try {
+      const outcome = (await evaluator(SCRAPE_EXPRESSION)) as ScrapeOutcome;
+      lastOutcome = outcome;
+      const count = outcome.domains.length;
+
+      logPhase(
+        `phase=dom-scrape-poll n=${polls} count=${count} domains=[${formatDomains(outcome.domains)}]`,
+      );
+
+      if (outcome.reason === "ok" && count > 0) {
+        if (count > maxCount) {
+          // New high-water mark. Post-stable increases reset the run counter —
+          // the new stable window must also satisfy the threshold to qualify
+          // as `unstable=false`.
+          maxCount = count;
+          maxDomains = outcome.domains;
+          consecutiveAtMax = 1;
+        } else if (count === maxCount) {
+          maxDomains = outcome.domains;
+          consecutiveAtMax += 1;
+        } else {
+          // count > 0 && count < maxCount — the page shrunk mid-poll
+          // (virtual-scroll pagination, zone deletion concurrent with scrape,
+          // SPA re-render collapsing rows). Preserve the high-water snapshot;
+          // flag the trajectory as unstable.
+          seenDecrease = true;
+          consecutiveAtMax = 0;
+        }
+        finalCount = count;
+      } else {
+        // Empty poll or non-ok reason (no-account-id — SPA mid-navigation):
+        // the page momentarily showed no zones, breaking any trailing at-max
+        // run. Don't flip `seenDecrease` — treating a hydration gap as a
+        // "shrink" would be a false positive on the leading empty polls of
+        // every scrape. `finalCount` reflects the last poll's observed count
+        // (always 0 in this branch, since `scrapeCurrentPage` returns empty
+        // domains on any non-ok reason), so the stream log's `final_count`
+        // field accurately names what the last poll saw, not a stale value
+        // from an earlier successful observation.
+        consecutiveAtMax = 0;
+        finalCount = count;
+      }
+    } catch (err) {
+      logPhase(
+        `phase=scrape-retry n=${polls} err="${(err instanceof Error ? err.message : String(err)).slice(0, 120)}"`,
+      );
+    }
+    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+  }
+
+  // Deadline reached. Two branches:
+  //
+  // (i) We observed at least one non-empty poll. Return the max-count
+  //     snapshot (which, when `finalCount === maxCount`, is also the last
+  //     non-empty observation). `unstable=true` whenever any signal suggests
+  //     the page wasn't settled: shrinkage, end-below-max, or fewer than
+  //     STABLE_POLL_THRESHOLD consecutive trailing polls at max.
+  //
+  // (ii) Every poll was empty — either a genuinely empty account OR CF
+  //      drifted the href shape. The `empty-or-drift` dump is the operator's
+  //      single-artifact signal for distinguishing the two.
+  if (maxCount > 0) {
+    const unstable =
+      seenDecrease ||
+      finalCount !== maxCount ||
+      consecutiveAtMax < STABLE_POLL_THRESHOLD;
+    const mode: DumpMode = unstable ? "unstable" : "stable";
+    const dump = await dumpHtml(evaluator, maxCount, mode);
+    logPhase(
+      `phase=dom-scrape-complete result=ok count=${maxCount} total_polls=${polls} max_count=${maxCount} final_count=${finalCount} stable_polls=${consecutiveAtMax} unstable=${unstable} domains=[${formatDomains(maxDomains)}] ${dumpField(dump, mode)}`,
+    );
+    return maxDomains;
+  }
+
+  const dump = await dumpHtml(evaluator, 0, "empty-or-drift");
+  logPhase(
+    `phase=dom-scrape-complete result=empty-or-drift count=0 total_polls=${polls} max_count=0 final_count=0 stable_polls=0 lastReason=${lastOutcome?.reason ?? "unknown"} ${dumpField(dump, "empty-or-drift")}`,
+  );
+  return [];
+}
+
+async function navigate(cdp: CdpClient, url: string): Promise<void> {
+  const result = await cdp.send<{ errorText?: string }>("Page.navigate", { url });
+  if (result?.errorText) die("navigate-failed", `Page.navigate errorText="${result.errorText}"`);
+}
+
+async function waitForDocumentReady(cdp: CdpClient): Promise<void> {
+  const deadline = Date.now() + NAVIGATE_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    const state = await evaluate<string>(cdp, "document.readyState");
+    if (state === "complete" || state === "interactive") return;
+    await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+  }
+  die("navigate-failed", "document.readyState did not reach complete/interactive");
+}
+
+async function main(): Promise<void> {
+  const endpoint = resolveCdpEndpoint();
+  logPhase(`phase=script-start cdp=${endpoint.host}:${endpoint.port} source=${endpoint.source}`);
+
+  await cdpVersion(endpoint.host, endpoint.port);
+  logPhase(`phase=cdp-connect result=ok`);
+
+  const target = await createTarget(endpoint.host, endpoint.port);
+  logPhase(`phase=target-created targetId=${target.id.slice(0, 8)}…`);
+
+  let cdp: CdpClient;
+  try {
+    cdp = await CdpClient.connect(target.webSocketDebuggerUrl);
+  } catch (err) {
+    await closeTarget(endpoint.host, endpoint.port, target.id);
+    die("ws-connect-failed", err instanceof Error ? err.message : String(err));
+  }
+
+  try {
+    await cdp.send("Page.enable");
+    await cdp.send("Runtime.enable");
+
+    logPhase(`phase=dashboard-nav-start url=https://dash.cloudflare.com/`);
+    await navigate(cdp, "https://dash.cloudflare.com/");
+    await waitForDocumentReady(cdp);
+
+    const accountId = await waitForSignedIn(cdp);
+
+    const overviewUrl = `https://dash.cloudflare.com/${accountId}/domains/overview`;
+    logPhase(`phase=table-wait url=${overviewUrl}`);
+    await navigate(cdp, overviewUrl);
+    await waitForDocumentReady(cdp);
+
+    const domains = await scrapeDomains((expr) => evaluate(cdp, expr));
+
+    logPhase(`phase=target-closed`);
+    process.stdout.write(JSON.stringify(domains) + "\n");
+    logPhase(`phase=script-exit code=0 count=${domains.length}`);
+  } catch (err) {
+    // Only runtime errors that escaped the typed-reason paths land here.
+    die("runtime-error", err instanceof Error ? err.message : String(err));
+  } finally {
+    cdp.close();
+    await closeTarget(endpoint.host, endpoint.port, target.id);
+  }
+}
+
+// Entry-point gate: only run `main()` when this module is the script Node was
+// invoked with, not when imported by the vitest regressions that exercise
+// `scrapeCurrentPage` / `scrapeDomains` directly. Without the gate, importing
+// this module would trigger a live CDP connection attempt and process.exit(1)
+// inside the test process.
+if (process.argv[1] && process.argv[1] === fileURLToPath(import.meta.url)) {
+  main().catch((err: unknown) => {
+    die("runtime-error", err instanceof Error ? err.message : String(err));
+  });
+}