@rubytech/create-maxy-code 0.1.109 → 0.1.110

package/payload/platform/plugins/docs/references/admin-session.md

@@ -1,6 +1,6 @@
 # Admin Session — restart survival and SDK-resume contract
 
-The admin PIN-gated session-store is the in-memory `Map<sessionKey, Session>` at [`platform/ui/app/lib/claude-agent/session-store.ts`](../../../ui/app/lib/claude-agent/session-store.ts). Every `systemctl --user restart {brand}.service` (notably the one `setup-tunnel.sh` arms 3 s after `step=done` via `systemd-run --on-active=3s`) wipes that Map. This reference documents how an admin session survives the restart without forcing PIN re-entry, and how the SDK conversation chain is preserved across the gap.
+The admin PIN-gated session-store is the in-memory `Map<sessionKey, Session>` at [`platform/ui/app/lib/claude-agent/session-store.ts`](../../../ui/app/lib/claude-agent/session-store.ts). Every `systemctl --user restart {brand}.service` (notably the one the agent arms 3 s after Cloudflare-setup completion via `systemd-run --on-active=3s` to avoid the cgroup trap) wipes that Map. This reference documents how an admin session survives the restart without forcing PIN re-entry, and how the SDK conversation chain is preserved across the gap.
 
 ## Signed sessionKey
 

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -216,7 +216,7 @@ Two endpoints, two surfaces, two restart-survival roles:
   liveness. `processStartedAt` resets on every brand-service restart;
   Neo4j probe is bounded to 1 s and reports
   `conversationDb: 'ok' | 'error'`. Use this to confirm the brand
-  process came back after `setup-tunnel.sh`'s armed restart.
+  process came back after a Cloudflare-setup armed restart.
 - `GET /api/admin/version` (maxy-edge) — installer / brand version
   string. Hosted on `maxy-edge.service` so the Software Update modal
   can read it while the brand service is mid-restart.

package/payload/platform/plugins/docs/references/cloudflare.md

@@ -1,6 +1,6 @@
 # Cloudflare Tunnel — the dashboard is the source of truth
 
-Each installation has its own Cloudflare account. Sign-in is OAuth: the setup script prints the Cloudflare Authorize URL into the admin chat as a clickable link; click it, authorize in the new tab, and `cloudflared` writes `cert.pem` to the brand's config directory. The agent never reads or mutates Cloudflare account state directly — whatever you see in your logged-in dashboard is the single source of truth. When something needs doing on the account side (adding a domain, deleting a stray entry, switching accounts), the agent relays the click-paths; you run them in your browser.
+Each installation has its own Cloudflare account. Sign-in is OAuth: the agent invokes `cloudflared tunnel login` via Bash; the Cloudflare Authorize URL streams into the admin chat PTY and the native terminal renders it as a clickable link. Click it, authorise in your own browser, and `cloudflared` writes `cert.pem` to the brand's config directory. The agent never reads or mutates Cloudflare account state directly — whatever you see in your logged-in dashboard is the single source of truth. When something needs doing on the account side (adding a domain, deleting a stray entry, switching accounts), the agent relays the click-paths; you run them in your browser.
 
 ## Identity model
 
@@ -8,34 +8,25 @@ Each installation has its own Cloudflare account. Sign-in is OAuth: the setup sc
 |------|--------|
 | **Product identity** (Maxy vs Real Agent) | `brand.json` (`productName`, `configDir`) — known at install. |
 | **Cloudflare account identity** | `cert.pem` from OAuth. One account per brand per device. |
-| **Domain scope** (which zones the operator can route) | Live Cloudflare dashboard at script-invocation time via `list-cf-domains.sh`, not `brand.json`. Brand identity has no authority over which domains the operator's CF account holds. When the scrape returns an unexpected count (e.g. 1 on a two-zone account), the stream log's per-poll `phase=dom-scrape-poll n=<k> count=<n> domains=[…]` trajectory + the on-disk HTML dump at `~/{configDir}/logs/list-cf-domains-<ts>-count<n>-<mode>-pid<pid>.html` (earlier platform fixes — written on every scrape outcome, not just empty ones) give the operator everything they need to triage the cause without re-running. |
-| **CDP port the scrape attaches to** | `brand.json` (`cdpPort`, stamped at install time) — the same brand-scoped port `vnc.sh` binds Chromium to. `list-cf-domains.sh <brand>` requires the brand arg; the helper reads `${MAXY_PLATFORM_ROOT}/config/brand.json` (no silent default). Missing brand arg, missing brand.json, or missing `cdpPort` field each exit 1 with one of three named reasons (`brand-arg-missing`, `brand-config-missing`, `cdp-port-unresolved`); the agent reads the exit-code reason from stderr, names the brand, and stops — retrying would re-fire the same wrongly-resolved spawn. |
-| **Local tunnel state** | `~/{configDir}/cloudflared/` — `cert.pem`, `<UUID>.json`, `config.yml`, `tunnel.state`, `alias-domains.json`. |
+| **Domain scope** (which zones the operator can route) | Live Cloudflare dashboard — the operator picks the zone in the dashboard during OAuth or names it in chat. The agent does not enumerate zones programmatically. |
+| **Local tunnel state** | `~/{configDir}/cloudflared/` — `cert.pem`, `<UUID>.json`, `config.yml`, `alias-domains.json`. |
 
-There is no token-based auth for the operator-owned path (Mode A). To switch Cloudflare accounts, run `reset-tunnel.sh` (which deletes the cert and every tunnel on the current account), then run `setup-tunnel.sh` again — `cloudflared tunnel login` inside the setup script will pick a fresh account when you sign in.
+There is no token-based auth for the operator-owned path (Mode A). To switch Cloudflare accounts, the agent runs the reset flow from `plugins/cloudflare/references/reset-guide.md` (deletes the cert and every tunnel on the current account), then the manual-setup flow again — `cloudflared tunnel login` picks a fresh account when you sign in.
 
 ## Setup flow
 
-Ask the agent to set up Cloudflare. The agent confirms the domain is already on your Cloudflare account (if not, it quotes the dashboard click-path — see below) and then collects the inputs in plain chat:
+Ask the agent to set up Cloudflare. The agent confirms the domain is already on your Cloudflare account (if not, it quotes the dashboard click-path — see below) and collects the inputs in plain chat:
 
 - **Admin address** — the hostname that will serve the admin chat (e.g. `admin.yourdomain.com`).
 - **Public address** — optional hostname for the public agent (e.g. `public.yourdomain.com` or `chat.yourdomain.com`).
 - **Proxy apex** — optional bare-domain hostname (e.g. `yourdomain.com`) that should also serve the public agent.
 - **Admin password** — the password used to gate remote access to the admin surface.
 
-Once the agent has the four inputs, it sets the admin password via `curl -X POST http://127.0.0.1:${PORT}/api/remote-auth/set-password` (the same endpoint onboarding uses), optionally enumerates existing tunnels via `cloudflared tunnel list --output json` so you can pick from the logged-in account, and then invokes `~/setup-tunnel.sh <brand> <port> <admin-hostname> [<public-hostname>] [<apex-hostname>]` via the Bash tool with either `TUNNEL_ID=<uuid>` (selected) or `TUNNEL_NAME=<name>` (new) in env. After the script returns, the agent appends each non-`public.*` public or apex hostname to `~/{configDir}/alias-domains.json` so `isPublicHost()` classifies it as public.
+The agent then sets the admin password via `curl -X POST http://127.0.0.1:${PORT}/api/remote-auth/set-password` (same endpoint the local onboarding form uses), and works through `plugins/cloudflare/references/manual-setup.md` Steps 1–7 directly via the Bash tool. `cloudflared`'s stdout streams into the PTY verbatim. The OAuth URL is linkified by the terminal; click it in your own browser to authorise. After the tunnel is up, the agent appends each non-`public.*` public or apex hostname to `~/{configDir}/alias-domains.json` so `isPublicHost()` classifies it as public, and starts the brand's cloudflared user service.
 
-The script runs end-to-end:
+If any step's `cloudflared` invocation exits non-zero, the agent names the literal exit code, surfaces the stderr verbatim, and cites `reset-guide.md` for the next action — no retry under a different flag, no Playwright-driven dashboard inspection.
 
-- `cloudflared tunnel login` — OAuth sign-in. The script prints the Cloudflare authorize URL; the admin UI surfaces it as a clickable link above the log. Click the link, pick the account that owns your domain, click Authorize. `cert.pem` lands; the script picks it up via its 180 s cert-poll regardless of which browser tab completed the click.
-- Tunnel resolution from operator-supplied identity (operator-selected-tunnel fix). The script requires EXACTLY ONE of `TUNNEL_ID` or `TUNNEL_NAME` in env and exits 1 with a literal error on either-both-set or neither-set. Pre-fix the script derived `${BRAND}-$(hostname -s)` locally; that broke the operator-state-is-authoritative doctrine and silently created orphan tunnels whenever the device hostname changed. Stream log emits `step=tunnel-resolve source=operator-selected|operator-created tunnel_id=… tunnel_name=…` once the UUID is known.
-- **Zone pre-flight** — for every non-apex hostname the script queries `1.1.1.1` for the registrable parent's NS records and refuses the whole run if they don't point at Cloudflare. Stream log: `step=zone-preflight result=ok|error zones_on_account=… missing_parent_for=…`. Catches "domain not on Cloudflare"; does not catch "domain on a different Cloudflare account than `cert.pem` is bound to" — that case surfaces later via `tunnel-status`.
-- `cloudflared tunnel route dns` for each subdomain hostname. Apex hostnames cannot be routed this way — the script prints an **ACTION REQUIRED** block naming the exact dashboard record to add or edit. Stream log emits `step=route-dns hostname=… tunnel_id=…` before the call and `step=route-dns hostname=… result=ok|apex-skip|error` after; on error the bounded cloudflared stderr (≤400 chars) rides in the same phase line. **The script does not parse cloudflared's stdout** — exit code is the sole decision signal, so all three legitimate cloudflared output shapes (new record, overwrite, idempotent "already configured") are treated as success.
-- `config.yml` and `tunnel.state` written under `${CFG_DIR}`.
-- `systemctl --user restart ${BRAND}.service` — restarts the platform service so the new tunnel spawns via the service's `ExecStartPre=resume-tunnel.sh`. The restart fires a few seconds after the script exits so the script does not kill its own cgroup when invoked via the Bash tool; the chat UI receives a `server_shutdown` SSE frame and reconnects automatically.
-- Post-restart verification — `ps -ef | grep '[c]loudflared'` confirms the connector is alive, then `curl -I https://<hostname>` against each subdomain (up to 60 s per host) confirms a non-530 response.
-
-The agent streams the script's stdout into chat verbatim as it arrives, including any `ACTION REQUIRED` block. If the script exits non-zero, the agent names the literal exit code and cites `reset-guide.md` for the next action — no retry under a different flag, no Playwright-driven dashboard inspection.
+The setup-done claim only fires after the agent runs `curl -I https://<admin-hostname>` from outside the local network and the response shows a `200` line. That HTTP response is the only success terminal.
 
 ## Getting a domain on Cloudflare
 
@@ -49,19 +40,19 @@ Existing website traffic continues to work during and after the switch. Only DNS
 
 ## Reset / account switch
 
-Ask the agent to reset Cloudflare. The agent invokes `reset-tunnel.sh` on the device:
+Ask the agent to reset Cloudflare. The agent executes the reset flow from `plugins/cloudflare/references/reset-guide.md`:
 
 - Deletes every tunnel on the brand's current Cloudflare account (via the bound cert).
 - Wipes the brand's `${CFG_DIR}`.
-- Exits with the number of tunnels deleted.
+- Stops the brand's cloudflared user service.
 
-The script does **not** stop token-mode connector processes, delete stray misrouted CNAMEs in the dashboard, or touch the platform service. If any of those apply (agent will flag them), the agent guides you through the manual cleanup — `pkill -f 'cloudflared.*tunnel run --token'` on the device, or deleting the stray CNAME in the dashboard.
+The agent does **not** stop token-mode connector processes or delete stray misrouted CNAMEs in the dashboard. If any of those apply, the agent guides you through the manual cleanup — `pkill -f 'cloudflared.*tunnel run --token'` on the device, or deleting the stray CNAME in the dashboard.
 
 After reset, run setup again. The fresh `cloudflared tunnel login` will pick whichever Cloudflare account you sign into.
 
 ## Manual runbook
 
-When the scripted flow fails partway, or you want to walk through every step yourself, there's a step-by-step runbook at `plugins/cloudflare/references/manual-setup.md`. The runbook mirrors `setup-tunnel.sh` verbatim — every scripted step corresponds to a numbered runbook step with isolated command blocks, success conditions, and troubleshooting. Pick up the runbook at whichever step the script failed in.
+The step-by-step runbook at `plugins/cloudflare/references/manual-setup.md` is the contract the agent follows. It is also what an operator runs by hand when needed — every numbered step is an isolated `cloudflared` command block with success conditions and troubleshooting.
 
 ## Dashboard operations the CLI cannot do
 
@@ -71,17 +62,17 @@ The CLI cannot add a domain, switch accounts, edit an apex CNAME, or delete stra
 
 ### Tunnel won't start
 
-Ask the agent to check. The agent reads `systemctl --user status ${BRAND}.service` and `~/{configDir}/cloudflared/logs/cloudflared.log`. Common states:
+Ask the agent to check. The agent reads `systemctl --user status ${BRAND}-cloudflared.service` and the cloudflared log under `~/{configDir}/cloudflared/`. Common states:
 
-- **No cloudflared process running** — the service's `ExecStartPre=resume-tunnel.sh` exited cleanly but did not spawn the connector. Usually means `tunnel.state` is missing or `config.yml` was written with empty variables. The agent will re-run `setup-tunnel.sh`.
-- **`tunnel not found`** — the UUID in `config.yml` does not match any tunnel on the currently-bound account. Usually follows an account switch that didn't reset local state. The agent invokes `reset-tunnel.sh` and then a fresh setup.
+- **No cloudflared process running** — the cloudflared service exited or never started. The agent runs the manual-setup flow to re-issue tunnel creation.
+- **`tunnel not found`** — the UUID in `config.yml` does not match any tunnel on the currently-bound account. Usually follows an account switch that didn't reset local state. The agent runs the reset flow and then a fresh setup.
 
 ### URL returns 530
 
 DNS propagation or account mismatch. Wait 30–60 seconds and retry first. If the 530 persists:
 
-- The domain may be on a Cloudflare account different from the one `cert.pem` is bound to — re-running `setup-tunnel.sh` re-validates.
-- The UDP buffer for QUIC may be undersized on this device — check `cloudflared.log` for `failed to sufficiently increase receive buffer size`.
+- The domain may be on a Cloudflare account different from the one `cert.pem` is bound to — the agent re-runs the manual setup steps to re-validate.
+- The UDP buffer for QUIC may be undersized on this device — check the cloudflared log for `failed to sufficiently increase receive buffer size`.
 
 ### URL returns connection refused
 
@@ -104,8 +95,8 @@ The most common cause is wrong nameservers on the domain. The domain must use Cl
 
 ## What the agent does and does not do
 
-**Does:** invokes `setup-tunnel.sh` / `reset-tunnel.sh` via Bash, quotes click-paths from the reference files verbatim, verifies external reachability with `curl -I`.
+**Does:** invokes `cloudflared` directly via Bash, following `plugins/cloudflare/references/manual-setup.md` step by step; quotes click-paths from the reference files verbatim; verifies external reachability with `curl -I` and surfaces the response.
 
-**Does not:** drive the Cloudflare dashboard via Playwright, synthesise alternative `cloudflared` flag sequences, call any Cloudflare API or SDK, write or edit `cert.pem` / `tunnel.state` / `config.yml` / `alias-domains.json` directly.
+**Does not:** drive the Cloudflare dashboard via Playwright, synthesise alternative `cloudflared` flag sequences not in the runbook, call any Cloudflare API or SDK, write or edit `cert.pem` / `config.yml` directly outside the runbook's instructions.
 
-When a script or command fails, the agent reports the failure and cites the relevant recovery step. It does not improvise.
+When a command fails, the agent reports the failure and cites the relevant recovery step. It does not improvise.

package/payload/platform/plugins/docs/references/platform.md

@@ -111,7 +111,7 @@ The Data search panel ranks results by combining vector similarity with keyword
 Both flows run on the native Claude Code PTY surface in admin chat (Task 287). There is no in-app upgrade modal and no Cloudflare setup form — the agent invokes the relevant Bash command directly and its stdout streams into chat verbatim.
 
 - **Software update.** Re-run the installer (`npx -y @rubytech/create-<brand>@latest`) from a shell; HeaderMenu's version row turns sage when `installed === latest`.
-- **Cloudflare setup.** Operator asks in chat; the agent invokes `~/setup-tunnel.sh <brand> <port> <admin-hostname> [<public-hostname>] [<apex-hostname>]` via the Bash tool. The script's `[setup-tunnel] step=<phase> …` phase lines and cloudflared's own stdout stream into the PTY; the `OAUTH_URL: <url>` line is linkified by the terminal so the operator clicks it and authorises Cloudflare in their own browser.
+- **Cloudflare setup.** Operator asks in chat; the agent invokes `cloudflared` directly via the Bash tool, following the numbered steps in `plugins/cloudflare/references/manual-setup.md`. cloudflared's stdout and stderr stream into the PTY; the OAuth URL printed by `cloudflared tunnel login` is linkified by the terminal so the operator clicks it and authorises Cloudflare in their own browser.
 
 **Mid-turn stream-drop banners.** If a chat turn ends abruptly the bubble shows one of two messages depending on what actually happened. You see "Server is restarting — reconnect will happen automatically." only when the app server itself emits the restart signal — typically during a Software Update or a Cloudflare setup that re-launches the brand service. You see "Lost connection — retrying." when your browser's connection to the Pi dropped mid-stream while the server was still up — typically a flaky Wi-Fi moment or the tunnel hiccupping. Either way the chat resumes once the connection is back; the previously-rendered messages stay on screen so you don't lose context.
 

package/payload/platform/plugins/docs/references/plugins-guide.md

@@ -152,7 +152,7 @@ After this, every `console.error("[your-tool]...")` from any tool in the plugin
 
 **How the tee decides which file to write to:** the platform sets `STREAM_LOG_PATH` as an environment variable on every MCP server spawn, pointing to the conversation-scoped stream log. The MCP server does not know about conversations — it just trusts `STREAM_LOG_PATH`. Multiple concurrent conversations produce multiple concurrent MCP server processes, each teeing to its own file; no cross-conversation leakage.
 
-**Bash scripts stream straight into the PTY.** Maxy Code's admin and public chat run on the native Claude Code PTY (Task 287). The per-conversation server-side stream log that the retired web-UI dispatcher tailed is gone; agent-invoked shell scripts (`setup-tunnel.sh`, `reset-tunnel.sh`, `list-cf-domains.sh`) print `[<scope>] <key>=<value>` phase lines directly to stdout, which the PTY renders in chat verbatim.
+**Bash commands stream straight into the PTY.** Maxy Code's admin and public chat run on the native Claude Code PTY (Task 287). The per-conversation server-side stream log that the retired web-UI dispatcher tailed is gone; agent-invoked Bash commands (including direct `cloudflared` invocations for Cloudflare setup — Task 288) print their stdout and stderr directly, and the PTY renders the output in chat verbatim.
 
 **Retrieve MCP diagnostic lines for a conversation:**
 

package/payload/platform/plugins/docs/references/troubleshooting.md

@@ -190,7 +190,7 @@ If the initial Cloudflare login fails during setup, {{productName}} will fall ba
 Both flows run on the native Claude Code PTY surface in admin chat (Task 287). The retired action-runner / terminal-modal troubleshooting sections that lived here have been removed because those surfaces no longer exist; failures now manifest as plain stderr from the agent-invoked Bash command, visible in chat.
 
 - **Software update.** Re-run `npx -y @rubytech/create-<brand>@latest` from a shell; if the installer fails, its stdout is the diagnostic record. HeaderMenu turns sage when `installed === latest`.
-- **Cloudflare setup.** The agent invokes `~/setup-tunnel.sh` via Bash. Failures surface as the script's own `[setup-tunnel] step=… result=error reason=…` lines in chat plus a non-zero exit. Recovery paths live in the cloudflare plugin's `references/reset-guide.md` and `references/manual-setup.md`.
+- **Cloudflare setup.** The agent invokes `cloudflared` directly via Bash, following the cloudflare plugin's `references/manual-setup.md`. Failures surface as cloudflared's literal stderr plus a non-zero exit. Recovery paths live in `references/reset-guide.md` and `references/manual-setup.md`.
 
 ## Orphan Account Directory Archived to `.trash/`
 

package/payload/platform/scripts/check-no-task-id-leaks.mjs

@@ -2,7 +2,7 @@
 // Build-time gate: rejects `(Task NNN)` citations in operator-visible production
 // strings. Citations are allowed in inline comments and test titles/bodies only.
 //
-// Live repro that motivated the gate: setup-tunnel.sh on realagent 192.168.88.8
+// Live repro that motivated the gate: a setup script on realagent 192.168.88.8
 // emitted `Re-run the installer to provision Chromium.` to the
 // operator's chat surface — the citation made the operator chase task
 // history rather than execute the verb. Operator surfaces strip citations;

package/payload/platform/templates/agents/admin/IDENTITY.md

@@ -10,7 +10,7 @@ Your job is to do useful work for the operator. How useful you can be depends on
 
 ## Before you speak
 
-Before your first message, do reconnaissance. Treat your starting knowledge as whatever your tools can surface, not what the system prompt names. Search the memory graph for what's known about the operator and their business, read the profile, check today's calendar, active projects, open work, and recent conversations. Infer the domain from the plugins and skills installed; they were chosen for a reason and are evidence of what this operation does.
+Before your first message, do reconnaissance. Treat your starting knowledge as whatever your tools can surface, not what the system prompt names. Search the memory graph for what's known about the operator and their business, read the profile, check today's calendar, active projects, open work, and recent conversations. Infer the domain from the plugins and skills installed; they were chosen for a reason and are evidence of what this operation does. Check whether an upgrade is available for this install (the upgrade skill describes the lookup); if so, offer it in your first message.
 
 Then lead with what you found. When you have enough knowledge of the operator and their business to make a useful proposal, follow with one suited to where they are in their day; otherwise, gather more before proposing. Ask only the questions you genuinely could not answer through investigation. You are expected to drive the day, not to solicit instructions for it.
 

package/payload/platform/plugins/cloudflare/scripts/__tests__/tunnel-ingress.test.ts

@@ -1,241 +0,0 @@
-// acceptance grid for tunnel-ingress.ts pure layer.
-//
-// Runs under `node --test --experimental-strip-types` (no compile step). No
-// filesystem reads except via temp files written by the test itself; no
-// network; no shell-outs. Mirrors apt-resolve / samba-provision style.
-
-import test from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import {
-  renderConfigYml,
-  renderTunnelState,
-  readPersistedHostnames,
-  probeSambaStanza,
-  renderAccessPolicyActionRequired,
-  type IngressSpec,
-  type TunnelState,
-} from "../tunnel-ingress.ts";
-
-// ---------------------------------------------------------------------------
-// renderConfigYml
-// ---------------------------------------------------------------------------
-
-test("renderConfigYml: HTTPS-only matches expected shape byte-for-byte", () => {
-  const spec: IngressSpec = {
-    tunnelId: "abc-123",
-    credentialsPath: "/home/admin/.maxy/cloudflared/abc-123.json",
-    httpPort: 19200,
-    httpHostnames: ["admin.maxy.bot", "public.maxy.bot"],
-  };
-  assert.equal(
-    renderConfigYml(spec),
-    [
-      "tunnel: abc-123",
-      "credentials-file: /home/admin/.maxy/cloudflared/abc-123.json",
-      "ingress:",
-      "  - hostname: admin.maxy.bot",
-      "    service: http://localhost:19200",
-      "  - hostname: public.maxy.bot",
-      "    service: http://localhost:19200",
-      "  - service: http_status:404",
-      "",
-    ].join("\n"),
-  );
-});
-
-test("renderConfigYml: SSH+SMB appear AFTER http hostnames and BEFORE catch-all", () => {
-  const spec: IngressSpec = {
-    tunnelId: "t-id",
-    credentialsPath: "/creds.json",
-    httpPort: 19200,
-    httpHostnames: ["admin.maxy.bot"],
-    sshHostname: "ssh.maxy.bot",
-    smbHostname: "smb.maxy.bot",
-  };
-  const out = renderConfigYml(spec);
-  const idxHttp = out.indexOf("admin.maxy.bot");
-  const idxSsh = out.indexOf("ssh.maxy.bot");
-  const idxSmb = out.indexOf("smb.maxy.bot");
-  const idx404 = out.indexOf("http_status:404");
-  assert.ok(idxHttp < idxSsh, "HTTP before SSH");
-  assert.ok(idxSsh < idxSmb, "SSH before SMB");
-  assert.ok(idxSmb < idx404, "SMB before catch-all 404");
-  assert.match(out, /\s+service: ssh:\/\/localhost:22$/m);
-  assert.match(out, /\s+service: tcp:\/\/localhost:445$/m);
-});
-
-test("renderConfigYml: SSH only — no SMB block when smbHostname is null", () => {
-  const spec: IngressSpec = {
-    tunnelId: "t-id",
-    credentialsPath: "/creds.json",
-    httpPort: 19200,
-    httpHostnames: ["admin.maxy.bot"],
-    sshHostname: "ssh.maxy.bot",
-    smbHostname: null,
-  };
-  const out = renderConfigYml(spec);
-  assert.ok(out.includes("ssh.maxy.bot"));
-  assert.ok(!out.includes("tcp://localhost:445"));
-});
-
-test("renderConfigYml: empty string hostnames are treated as absent", () => {
-  const spec: IngressSpec = {
-    tunnelId: "t-id",
-    credentialsPath: "/creds.json",
-    httpPort: 19200,
-    httpHostnames: ["admin.maxy.bot"],
-    sshHostname: "",
-    smbHostname: "",
-  };
-  const out = renderConfigYml(spec);
-  assert.ok(!out.includes("ssh://localhost:22"));
-  assert.ok(!out.includes("tcp://localhost:445"));
-});
-
-// ---------------------------------------------------------------------------
-// renderTunnelState
-// ---------------------------------------------------------------------------
-
-test("renderTunnelState: base fields preserved when ssh/smb absent", () => {
-  const state: TunnelState = {
-    tunnelId: "abc",
-    tunnelName: "maxy",
-    domain: "admin.maxy.bot",
-    configPath: "/home/admin/.maxy/cloudflared/config.yml",
-    credentialsPath: "/home/admin/.maxy/cloudflared/abc.json",
-  };
-  const parsed = JSON.parse(renderTunnelState(state));
-  assert.deepEqual(parsed, {
-    tunnelId: "abc",
-    tunnelName: "maxy",
-    domain: "admin.maxy.bot",
-    configPath: "/home/admin/.maxy/cloudflared/config.yml",
-    credentialsPath: "/home/admin/.maxy/cloudflared/abc.json",
-  });
-});
-
-test("renderTunnelState: ssh/smb hostnames persist when present", () => {
-  const state: TunnelState = {
-    tunnelId: "abc",
-    tunnelName: "maxy",
-    domain: "admin.maxy.bot",
-    configPath: "/cfg.yml",
-    credentialsPath: "/creds.json",
-    sshHostname: "ssh.maxy.bot",
-    smbHostname: "smb.maxy.bot",
-  };
-  const parsed = JSON.parse(renderTunnelState(state));
-  assert.equal(parsed.sshHostname, "ssh.maxy.bot");
-  assert.equal(parsed.smbHostname, "smb.maxy.bot");
-});
-
-// ---------------------------------------------------------------------------
-// readPersistedHostnames
-// ---------------------------------------------------------------------------
-
-test("readPersistedHostnames: returns nulls when file missing", () => {
-  const got = readPersistedHostnames("/nope/does/not/exist.json");
-  assert.deepEqual(got, { sshHostname: null, smbHostname: null });
-});
-
-test("readPersistedHostnames: round-trips ssh/smb hostnames from disk", () => {
-  const dir = mkdtempSync(join(tmpdir(), "tunnel-state-"));
-  const path = join(dir, "tunnel.state");
-  try {
-    writeFileSync(
-      path,
-      JSON.stringify({
-        tunnelId: "abc",
-        tunnelName: "maxy",
-        domain: "admin.maxy.bot",
-        configPath: "/cfg.yml",
-        credentialsPath: "/creds.json",
-        sshHostname: "ssh.maxy.bot",
-        smbHostname: "smb.maxy.bot",
-      }),
-    );
-    const got = readPersistedHostnames(path);
-    assert.deepEqual(got, { sshHostname: "ssh.maxy.bot", smbHostname: "smb.maxy.bot" });
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("readPersistedHostnames: malformed JSON returns nulls (no throw)", () => {
-  const dir = mkdtempSync(join(tmpdir(), "tunnel-state-bad-"));
-  const path = join(dir, "tunnel.state");
-  try {
-    writeFileSync(path, "not json");
-    assert.deepEqual(readPersistedHostnames(path), { sshHostname: null, smbHostname: null });
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-// ---------------------------------------------------------------------------
-// probeSambaStanza
-// ---------------------------------------------------------------------------
-
-test("probeSambaStanza: true when [<brand>] header present", () => {
-  const dir = mkdtempSync(join(tmpdir(), "smb-probe-"));
-  const path = join(dir, "smb.conf");
-  try {
-    writeFileSync(path, "[global]\nworkgroup = WORKGROUP\n\n[maxy]\n   path = /home/admin\n");
-    assert.equal(probeSambaStanza("maxy", path), true);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("probeSambaStanza: false when only peer brand present (isolation)", () => {
-  const dir = mkdtempSync(join(tmpdir(), "smb-probe-peer-"));
-  const path = join(dir, "smb.conf");
-  try {
-    writeFileSync(path, "[global]\n\n[realagent]\n   path = /home/admin\n");
-    assert.equal(probeSambaStanza("maxy", path), false);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("probeSambaStanza: false when smb.conf missing", () => {
-  assert.equal(probeSambaStanza("maxy", "/nope/smb.conf"), false);
-});
-
-test("probeSambaStanza: brand names with regex meta characters are escaped", () => {
-  const dir = mkdtempSync(join(tmpdir(), "smb-probe-regex-"));
-  const path = join(dir, "smb.conf");
-  try {
-    writeFileSync(path, "[some.brand]\n   path = /x\n");
-    assert.equal(probeSambaStanza("some.brand", path), true);
-    assert.equal(probeSambaStanza("someXbrand", path), false);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-// ---------------------------------------------------------------------------
-// renderAccessPolicyActionRequired
-// ---------------------------------------------------------------------------
-
-test("renderAccessPolicyActionRequired: empty string when neither hostname set", () => {
-  assert.equal(
-    renderAccessPolicyActionRequired({ operatorEmail: "x@y.com" }),
-    "",
-  );
-});
-
-test("renderAccessPolicyActionRequired: lists each hostname with operator email", () => {
-  const out = renderAccessPolicyActionRequired({
-    sshHostname: "ssh.maxy.bot",
-    smbHostname: "smb.maxy.bot",
-    operatorEmail: "joel@example.com",
-  });
-  assert.match(out, /SSH: ssh\.maxy\.bot/);
-  assert.match(out, /SMB: smb\.maxy\.bot/);
-  assert.match(out, /Emails: joel@example\.com/);
-  assert.match(out, /Zero Trust → Access → Applications/);
-});

package/payload/platform/plugins/cloudflare/scripts/list-cf-domains.sh

@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-# Deterministic scrape of the operator's Cloudflare dashboard to discover
-# the domains on the logged-in account. Output on stdout is a JSON `string[]`,
-# sorted and deduped. Every failure exits non-zero with a `reason=<enum>`
-# token on stderr tagged `[list-cf-domains]`.
-#
-# Usage:
-#   list-cf-domains.sh <brand>
-#
-# brand arg is REQUIRED — the prior silent default (string
-# fallback to "maxy" when $1 was empty) made every non-Maxy brand's CF
-# setup form fail on first use because the wrapper's child node helper
-# read the Maxy CDP port from a hardcoded fallback. Missing arg now exits
-# 1 with `phase=error reason=brand-arg-missing`.
-#
-# The wrapper also resolves and exports MAXY_PLATFORM_ROOT from its own
-# script location so the .ts helper can read `<root>/config/brand.json` for
-# the brand's `cdpPort` (the source of truth). Direct-SSH invocation
-# works because the script lives at `<install>/platform/plugins/cloudflare/
-# scripts/`, making platform root three dirs up from the resolved script.
-#
-# Runtime: Node 22's `--experimental-strip-types` runs the .ts helper
-# directly, so no tsx / playwright / ws dependency exists.
-
-set -euo pipefail
-
-# Resolve symlinks before dirname — ~/list-cf-domains.sh is installed as a
-# symlink into $HOME, so the raw BASH_SOURCE[0] points at $HOME, not the
-# scripts directory.
-SCRIPT_DIR="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
-
-# Phase-line helper. Stream-log plumbing retired in Task 287 — every
-# observation goes straight to stdout for the PTY to render.
-phase_line() {
-  local scope=$1
-  shift
-  printf '[%s] %s\n' "${scope}" "$*"
-}
-
-if [ "$#" -lt 1 ] || [ -z "${1:-}" ]; then
-  phase_line list-cf-domains phase=error reason=brand-arg-missing
-  exit 1
-fi
-
-BRAND="${1}"
-CONFIG_DIR=".${BRAND}"
-mkdir -p "${HOME}/${CONFIG_DIR}/logs"
-
-# MAXY_PLATFORM_ROOT may be set by the calling environment. Direct-from-Bash
-# invocation has no such env so derive it from the resolved script location:
-# scripts/ → cloudflare/ → plugins/ → platform → install root (three dirs up).
-if [ -z "${MAXY_PLATFORM_ROOT:-}" ]; then
-  MAXY_PLATFORM_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
-fi
-
-phase_line list-cf-domains phase=script-start brand="${BRAND}" config_dir="${CONFIG_DIR}"
-
-TS_ENTRY="${SCRIPT_DIR}/list-cf-domains.ts"
-
-if [ ! -f "${TS_ENTRY}" ]; then
-  phase_line list-cf-domains phase=error reason=entry-missing path="${TS_ENTRY}"
-  exit 1
-fi
-
-# 30s hard ceiling. The node helper has its own per-phase budgets totalling
-# ~27s; the wrapper's extra 3s absorbs process startup and CF network jitter.
-# Use `timeout --preserve-status` so the exit code of a timeout is distinct
-# (124) from a helper-reported failure (1).
-HARD_TIMEOUT_SECS=30
-
-# Env passed through:
-#  - CONFIG_DIR    — consumed by the node helper when writing selector-drift
-#                    dumps to ~/.${BRAND}/logs/list-cf-domains-<ts>.html.
-#  - BRAND         — names the brand for log lines naming the brand on
-#                    config-class failures (helper does not derive it from
-#                    CONFIG_DIR to keep the two concerns independent).
-#  - MAXY_PLATFORM_ROOT — install root the helper reads `config/brand.json`
-#                    from for `cdpPort`. Resolved above so direct-SSH
-#                    invocation matches the systemd-spawned path.
-#
-# `node --experimental-strip-types` (stable in Node 22.22) runs the .ts file
-# natively: type annotations are stripped, no enums / decorators are used, so
-# no TS type-transform is needed. `--no-warnings` suppresses the experimental
-# banner which would otherwise leak into stderr and confuse the route parser.
-set +e
-CONFIG_DIR="${CONFIG_DIR}" BRAND="${BRAND}" MAXY_PLATFORM_ROOT="${MAXY_PLATFORM_ROOT}" \
-  timeout --preserve-status --signal=TERM "${HARD_TIMEOUT_SECS}" \
-  node --experimental-strip-types --no-warnings "${TS_ENTRY}"
-EXIT_CODE=$?
-set -e
-
-if [ "${EXIT_CODE}" -eq 124 ]; then
-  phase_line list-cf-domains phase=script-exit code=124 reason=wrapper-timeout budget_secs="${HARD_TIMEOUT_SECS}"
-  exit 1
-fi
-
-phase_line list-cf-domains phase=script-exit code="${EXIT_CODE}"
-exit "${EXIT_CODE}"