@rubytech/create-maxy-code 0.1.400 → 0.1.402

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.400",
+  "version": "0.1.402",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/config/brand.json

@@ -54,7 +54,7 @@
 
   "plugins": {
     "core": ["admin", "memory", "docs", "cloudflare", "anthropic", "workflows", "work", "scheduling", "email", "contacts", "projects", "prompt-optimiser", "browser"],
-    "defaultEnabled": ["business-assistant", "sales"],
+    "defaultEnabled": ["business-assistant", "sales", "web-designer"],
     "available": ["connector", "telegram", "deep-research", "whatsapp", "replicate", "linkedin-import", "notion-import", "obsidian-import", "x-import", "slides"],
     "excluded": ["joblogic"]
   },

package/payload/platform/plugins/cloudflare/bin/__tests__/cf-token.test.sh

@@ -48,7 +48,7 @@ echo "\$@" >> "\$SB/curl.log"
 url=""; for a in "\$@"; do case "\$a" in https://*) url="\$a";; esac; done
 case "\$url" in
   *"/tokens/permission_groups"*)
-    echo '{"success":true,"result":[{"id":"pg_pages","name":"Cloudflare Pages Write"},{"id":"pg_d1","name":"D1 Write"},{"id":"pg_dns","name":"DNS Write"},{"id":"pg_acc1","name":"Access: Apps and Policies Write"},{"id":"pg_acc2","name":"Access: Apps and Policies Write"}]}'
+    echo '{"success":true,"result":[{"id":"pg_pages","name":"Pages Write"},{"id":"pg_d1","name":"D1 Write"},{"id":"pg_dns","name":"DNS Write"},{"id":"pg_acc1","name":"Access: Apps and Policies Write"},{"id":"pg_acc2","name":"Access: Apps and Policies Write"}]}'
     ;;
   *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
   *"/tokens"*)        echo '{"success":true,"result":{"id":"tok1","value":"'"$SECRET_VALUE"'"}}';;
@@ -191,5 +191,100 @@ echo "$ERR" | grep -q "code=1001" && ok "failure code surfaced" || bad "code not
 no_leak "real failure"
 teardown
 
+# 9. pages exact-name: three custom-pages decoys ordered BEFORE the real group.
+#    The old fuzzy /pages.*(write|edit)/ + head -1 picks "Access: Custom Pages Write";
+#    exact-name must mint the real Pages Write + D1 Write ids and none of the decoys.
+setup "cfat_master_abc"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_x1","name":"Access: Custom Pages Write"},{"id":"pg_x2","name":"Account Custom Pages Write"},{"id":"pg_x3","name":"Custom Pages Write"},{"id":"pg_pages_real","name":"Pages Write"},{"id":"pg_d1_real","name":"D1 Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfat_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "pages exact-name skips custom-pages decoys" pages 0
+POSTLINE=$(grep -- "-X POST" "$SANDBOX/curl.log")
+echo "$POSTLINE" | grep -q "pg_pages_real" && ok "minted real Pages Write id" || bad "did not mint real pages id: $POSTLINE"
+echo "$POSTLINE" | grep -q "pg_d1_real" && ok "minted real D1 Write id" || bad "did not mint real d1 id"
+echo "$POSTLINE" | grep -qE "pg_x1|pg_x2|pg_x3" && bad "minted a custom-pages decoy id: $POSTLINE" || ok "no custom-pages decoy id minted"
+no_leak "pages exact-name"
+teardown
+
+# 10. dns exact-name on cfat_: skip the "Account DNS Settings Write" / "DNS Firewall
+#     Write" decoys, mint the real "DNS Write" id, AND nest the zone resource under
+#     the account resource (account-owned masters reject the flat zone.* with 1001).
+setup "cfat_master_abc"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_dnsx1","name":"Account DNS Settings Write"},{"id":"pg_dnsx2","name":"DNS Firewall Write"},{"id":"pg_dns_real","name":"DNS Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfat_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "dns exact-name cfat nests zone under account" dns 0
+POSTLINE=$(grep -- "-X POST" "$SANDBOX/curl.log")
+echo "$POSTLINE" | grep -q "pg_dns_real" && ok "minted real DNS Write id" || bad "did not mint real dns id: $POSTLINE"
+echo "$POSTLINE" | grep -qE "pg_dnsx1|pg_dnsx2" && bad "minted a dns decoy id: $POSTLINE" || ok "no dns decoy id minted"
+echo "$POSTLINE" | grep -qF '"resources":{"com.cloudflare.api.account.acc123":{"com.cloudflare.api.account.zone.*":"*"}}' && ok "cfat nests zone under account" || bad "zone resource not nested for cfat: $POSTLINE"
+no_leak "dns cfat nested"
+teardown
+
+# 11. dns exact-name on cfut_: the flat top-level zone resource is preserved, with
+#     no account nesting (user-owned masters accept the flat zone.* shape).
+setup "cfut_master_xyz"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_dns_real","name":"DNS Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfut_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "dns cfut keeps flat zone resource" dns 0
+POSTLINE=$(grep -- "-X POST" "$SANDBOX/curl.log")
+echo "$POSTLINE" | grep -qF '"resources":{"com.cloudflare.api.account.zone.*":"*"}' && ok "cfut flat zone resource" || bad "cfut resource not flat: $POSTLINE"
+echo "$POSTLINE" | grep -qF 'account.acc123":{' && bad "cfut wrongly nested under account: $POSTLINE" || ok "cfut not nested under account"
+no_leak "dns cfut flat"
+teardown
+
+# 12. a Cloudflare group rename surfaces as a NAMED miss, not a silent wrong-group
+#     mint: with only decoys present and no exact "DNS Write", the helper dies 1 and
+#     names the exact group it looked for.
+setup "cfat_master_abc"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_dnsx1","name":"Account DNS Settings Write"},{"id":"pg_dnsx2","name":"DNS Firewall Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfat_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "missing exact group fails closed" dns 1
+grep -q -- "-X POST" "$SANDBOX/curl.log" && bad "minted despite no exact group match" || ok "no mint on missing exact group"
+echo "$ERR" | grep -qF "no permission group named 'DNS Write'" && ok "die names the missing exact group" || bad "die message not named: $ERR"
+teardown
+
 echo "----"; echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]

package/payload/platform/plugins/cloudflare/bin/cf-token.sh

@@ -41,13 +41,17 @@ fi
 [ -n "$brand" ] || die "cannot derive brand from path; set CF_TOKEN_BRAND"
 
 # Scope table - resolved by case, never inferred.
-legacy=""
+# pages/d1/dns select their permission group by EXACT name (a broad substring once
+# picked "Access: Custom Pages Write" over "Pages Write"); access keeps a regex
+# because it legitimately enumerates duplicate-named candidates and functional-probes.
+legacy=""; names=""; regexes=""; zone_scoped=""
 case "$scope" in
   pages|d1) suffix="pages-d1"; key="CF_PAGES_D1_TOKEN"; legacy="CF_PAGES_TOKEN"
-            # per-group regexes separated by ';' (each may use '|' internally)
-            regexes="pages.*(write|edit);d1.*(write|edit)"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
+            # exact permission-group names separated by ';'
+            names="Pages Write;D1 Write"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
   dns)      suffix="dns"; key="CF_DNS_TOKEN"
-            regexes="dns.*(write|edit)"; res='{"com.cloudflare.api.account.zone.*":"*"}';;
+            # zone-scoped: res is set after the master-prefix routing (nesting differs)
+            names="DNS Write"; zone_scoped=1;;
   access)   suffix="access"; key="CF_ACCESS_TOKEN"
             regexes="access.*apps.*polic.*(write|edit)"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
 esac
@@ -74,9 +78,20 @@ case "$CLOUDFLARE_API_TOKEN" in
      die "unrecognised master token prefix (not cfat_/cfut_); refusing to guess an endpoint";;
 esac
 
+# Zone-scoped resource shape branches by master type. An account-owned (cfat_) master
+# rejects a flat zone.* resource with code 1001 "Must specify a zone for account owned
+# tokens, or nest zone under specific account resource"; nest it under the account.
+# A user-owned (cfut_) master accepts the flat zone.* shape.
+if [ -n "$zone_scoped" ]; then
+  case "$mtag" in
+    cfat) res='{"com.cloudflare.api.account.'"$ACC"'":{"com.cloudflare.api.account.zone.*":"*"}}';;
+    cfut) res='{"com.cloudflare.api.account.zone.*":"*"}';;
+  esac
+fi
+
 api_get() { curl -sS -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" "$1"; }
 
-# Resolve permission-group id(s) by name regex (case-insensitive).
+# Resolve permission-group id(s): access matches by regex, pages/d1/dns by exact name.
 pg_json="$(api_get "${base}/tokens/permission_groups")"
 echo "$pg_json" | jq -e '.success==true' >/dev/null 2>&1 || {
   code=$(echo "$pg_json" | jq -r '.errors[0].code // "?"')
@@ -85,6 +100,7 @@ echo "$pg_json" | jq -e '.success==true' >/dev/null 2>&1 || {
 }
 
 collect_ids() { echo "$pg_json" | jq -r --arg re "$1" '.result[] | select(.name|test($re;"i")) | .id'; }
+collect_exact() { echo "$pg_json" | jq -r --arg n "$1" '.result[] | select(.name==$n) | .id'; }
 
 mint_with() { # $1 = json permission_groups array -> echoes minted token value or empty
   local body
@@ -136,12 +152,12 @@ if [ "$scope" = "access" ]; then
 else
   pg_array='[]'
   OLDIFS=$IFS; IFS=';'
-  for rx in $regexes; do
-    id=$(collect_ids "$rx" | head -1)
+  for nm in $names; do
+    id=$(collect_exact "$nm" | head -1)
     [ -n "$id" ] || {
       IFS=$OLDIFS
       echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=error code=0" >&2
-      die "no permission group matched /${rx}/"; }
+      die "no permission group named '${nm}'"; }
     pg_array=$(echo "$pg_array" | jq -c --arg id "$id" '. + [{id:$id}]')
   done
   IFS=$OLDIFS

package/payload/platform/plugins/cloudflare/references/api.md

@@ -112,6 +112,8 @@ The master an operator provisions is usually **account-scoped** (`cfat_…`, cre
 
 Cross-type calls fail with a stable, recognizable signal: a `cfat_…` token at `/user/tokens/verify` returns `Invalid API Token`; a `cfut_…` token at any `/accounts/{id}/…` endpoint returns `9109`. The diagnostic is the verify call's JSON `errors[].code`.
 
+The prefix also governs the **resource shape** of a zone-scoped mint body, not just the endpoint. A `cfut_…` master accepts a flat zone resource — `"resources": { "com.cloudflare.api.account.zone.*": "*" }`. A `cfat_…` (account-owned) master **rejects** that flat shape with code `1001` ("Must specify a zone for account owned tokens, or nest zone under specific account resource"); it requires the zone resource nested under the account resource — `"resources": { "com.cloudflare.api.account.${ACC}": { "com.cloudflare.api.account.zone.*": "*" } }`. Non-zone scopes (Pages/D1/Access) already scope to `com.cloudflare.api.account.${ACC}` and need no branch.
+
 **Creating** a token stays an account-level, operator-owned concern — each account documents its own master token and its type (e.g. a per-account `secrets/cloudflare.README.md`). Where an account *can* mint an account-scoped token that is the cleaner default; but a skill that merely *consumes* a supplied token must detect the prefix and adapt, never assume it can mint at `/accounts/…`.
 
 ---
@@ -154,7 +156,7 @@ CLOUDFLARE_API_TOKEN="${PAGES_D1}" wrangler pages deploy ./dist --project-name <
 
 No `expires_on`: the per-scope token is permanent and reused, so decay is the job of the **reconcile pass** (§ Reconcile), not a per-token TTL — the old short-TTL guidance was never honored in practice and produced only never-expiring strays. Look up `<pages-edit-permission-group-id>` (and the ids for DNS Edit, D1 Edit, etc.) once via `GET /accounts/{account_id}/tokens/permission_groups`; they are stable per account. Before reusing or before reconciling, `GET …/tokens` (§ Curated endpoint map) shows what already exists, so a scope is never minted twice under different names.
 
-**Per-scope token resources.** Each reused per-scope token carries the resource that matches its operation class. The Pages-and-D1 token (`<brand>-pages-d1`) and the Access token (`<brand>-access`) are account-scoped: `"resources": { "com.cloudflare.api.account.${CLOUDFLARE_ACCOUNT_ID}": "*" }`. The DNS token (`<brand>-dns`) is zone-scoped, but since it is a single stable token reused across every zone the install routes, its resource covers the account's zones: `"resources": { "com.cloudflare.api.account.zone.*": "*" }`. A per-zone DNS token would defeat the one-stable-token-per-scope model (one token, reused, not one per zone); the minted token is still strictly narrower than the master, which already carries Zone DNS Edit over the zones in scope.
+**Per-scope token resources.** Each reused per-scope token carries the resource that matches its operation class. The Pages-and-D1 token (`<brand>-pages-d1`) and the Access token (`<brand>-access`) are account-scoped: `"resources": { "com.cloudflare.api.account.${CLOUDFLARE_ACCOUNT_ID}": "*" }`. The DNS token (`<brand>-dns`) is zone-scoped, and since it is a single stable token reused across every zone the install routes, its resource covers the account's zones — but the exact shape depends on the master's prefix (see § Token type — route endpoints by prefix): a `cfut_…` master takes the flat `"resources": { "com.cloudflare.api.account.zone.*": "*" }`, while a `cfat_…` master requires the zone nested under the account, `"resources": { "com.cloudflare.api.account.${CLOUDFLARE_ACCOUNT_ID}": { "com.cloudflare.api.account.zone.*": "*" } }` (the flat shape returns `1001` on an account-owned master). A per-zone DNS token would defeat the one-stable-token-per-scope model (one token, reused, not one per zone); the minted token is still strictly narrower than the master, which already carries Zone DNS Edit over the zones in scope.
 
 **Redaction is binding.** Every example above pipes the token into a variable or an `Authorization` header and never to stdout. The agent surfaces the operation as verb + target — "minting a Pages-deploy token", "creating CNAME `chat.example.com`" — never the secret. A failure surfaces the API error body with any `Authorization` value masked.
 

package/payload/platform/plugins/web-designer/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "web-designer",
-  "description": "Design and build a self-contained single-page website for any business and put it live on Cloudflare. Guided intake, brand extraction from an existing URL, a domain-neutral builder, social share tiles, and deploy with D1 form capture, gated access, and e-signing. Any install can enable it directly; it is not bundle-gated, not tied to a business category, and adds no background specialist worker, no graph write, and no memory write. Its only host coupling is one credential resolver that reads the Cloudflare token from the account secrets file inside maxy-code or from CLOUDFLARE_API_TOKEN as a standalone plugin. Trigger phrases include design me a website, build a landing page for this business, put this site live on its own domain.",
+  "description": "Design and build a self-contained single-page website for any business and put it live on Cloudflare. Guided intake, brand extraction from an existing URL, a domain-neutral builder, social share tiles, and deploy with D1 form capture, gated access, and e-signing. Ships one command, /website, that runs the pipeline end-to-end. Any install can enable it directly; it is not bundle-gated, not tied to a business category, and adds no background specialist worker, no graph write, and no memory write. Its only host coupling is one credential resolver that reads the Cloudflare token from the account secrets file inside maxy-code or from CLOUDFLARE_API_TOKEN as a standalone plugin. Trigger phrases include design me a website, build a landing page for this business, put this site live on its own domain.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/web-designer/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: web-designer
-description: "Design and build a self-contained single-page website for any business and put it live on Cloudflare. Guided intake, brand extraction from an existing URL, a domain-neutral builder, social share tiles, and deploy with D1 form capture, gated access, and e-signing. Any install can enable it directly; it is not bundle-gated, not tied to a business category, and adds no background specialist worker, no graph write, and no memory write. Its only host coupling is one credential resolver that reads the Cloudflare token from the account secrets file inside maxy-code or from CLOUDFLARE_API_TOKEN as a standalone plugin. Trigger phrases include design me a website, build a landing page for this business, put this site live on its own domain."
+description: "Design and build a self-contained single-page website for any business and put it live on Cloudflare. Guided intake, brand extraction from an existing URL, a domain-neutral builder, social share tiles, and deploy with D1 form capture, gated access, and e-signing. Ships one command, /website, that runs the pipeline end-to-end. Any install can enable it directly; it is not bundle-gated, not tied to a business category, and adds no background specialist worker, no graph write, and no memory write. Its only host coupling is one credential resolver that reads the Cloudflare token from the account secrets file inside maxy-code or from CLOUDFLARE_API_TOKEN as a standalone plugin. Trigger phrases include design me a website, build a landing page for this business, put this site live on its own domain."
 tools: []
 skills:
   - skills/web-intake/SKILL.md
@@ -24,6 +24,15 @@ Four skills, run in order or on their own:
 3. **`web-design`** — builds the self-contained single-page site tree from the brand pack, the operator's copy, and their photos, by substituting a domain-neutral template. Its structured-data type defaults to `LocalBusiness` and is operator-supplied; no business category is baked in.
 4. **`socials`** — renders Open Graph, square, and portrait share tiles plus per-platform captions for the built site, and wires the site's `og:image`.
 
+## Command entry point
+
+The plugin ships one slash command, `/website` (`commands/website.md`), a thin
+launcher over `web-intake` for the standalone and marketplace editions, where a
+`/`-invokable entry is the idiomatic surface. It carries no account assumptions and
+defers token and root resolution to `bin/resolve-cf.sh`, so the same command works
+in every edition. Inside maxy-code the skill triggers remain the primary surface and
+the command is an equivalent entry point.
+
 ## The resolver seam
 
 The plugin's only host coupling is `bin/resolve-cf.sh`. It resolves two things and prints them so the rest of the plugin is blind to which edition it runs in, and it never prints a token value:

package/payload/platform/plugins/web-designer/commands/website.md

@@ -0,0 +1,61 @@
+---
+description: Design and build a self-contained single-page website for a business and put it live on Cloudflare. Runs the web-intake pipeline end-to-end (guided intake, brand extraction from a URL, a domain-neutral build, social share tiles, and deploy).
+---
+
+# /website
+
+Turn photos, an existing website URL, and a few notes into a finished single-page
+site plus share-ready social tiles, then put it live.
+
+## Usage
+
+- `/website`, then describe the business in the follow-up
+- `/website "a landing page for Ridgeway Joinery, brand from ridgewayjoinery.co.uk, photos in ./photos"`
+- `/website "one-page site and social tiles for this cafe, contact form, put it live on its own domain"`
+
+## What the command does
+
+Runs the `web-intake` skill end-to-end. `web-intake` is the single entry
+orchestrator; this command hands it whatever the message and attachments already
+provide and lets it ask for the rest.
+
+1. Set the objective first: what the site is for, what a visitor should do, which
+   CTAs and forms, and whether anything needs gated access or signing.
+2. Run `brand-extract` against the website URL for the palette, logo, icon, and the
+   company facts it can read (design tokens supplied directly are used verbatim).
+3. Curate the supplied photos into a hero rotator and grids.
+4. Fill every remaining gap by asking the operator. Never invent a fact.
+5. Run `web-design` to build `site/index.html` + `site/llms.txt` with no
+   `{{ placeholder }}` left unfilled.
+6. Run `socials` to render Open Graph, square, and portrait tiles into
+   `site/socials/` and wire the site's `og:image`.
+7. Hand off to deploy when the operator wants the site live.
+
+## The core rule: ask, never invent
+
+Every placeholder is a fact about a real business. A fabricated phone number, a
+guessed founding year, an invented testimonial, or a made-up company number is a
+defect. Anything the sources do not supply is a question for the operator, not a
+plausible value to synthesise.
+
+## Editions
+
+The command carries no account assumptions. Where the Cloudflare token and the
+site-tree root come from is resolved by `bin/resolve-cf.sh`:
+
+- **Standalone / marketplace:** the token is read from `CLOUDFLARE_API_TOKEN` in the
+  environment, and the site tree lands under `$WEB_DESIGNER_SITE_ROOT` (or `./pages`).
+  Deploy follows the generic `wrangler pages deploy` sequence. E-signing and
+  browser-rendered social tiles are host dependencies, not self-contained in this
+  edition.
+- **Inside maxy-code:** the same command resolves the account's Cloudflare token and
+  account directory automatically and hands the built tree to `cloudflare:site-deploy`
+  unchanged. The skill triggers ("design me a website") remain the primary surface
+  there; this command is an equivalent entry point.
+
+## What you get back
+
+A self-contained `site/` directory: a scrollable single-page site, an `llms.txt`, a
+`socials/` folder of tiles at exact dimensions (1200x628 / 1200x1200 / 1080x1350)
+with a gallery and per-platform captions, and, when the operator asks, a live
+Cloudflare deployment with any wired form buckets.