@rubytech/create-maxy-code 0.1.451 → 0.1.453

package/payload/platform/lib/storage-broker/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,mEAAmE;AACnE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,4DAA4D;;;;;;;;;;;;;;;;AAE5D,iDAA+B;AAC/B,gDAA8B;AAC9B,wDAAsC;AACtC,+CAA6B;AAC7B,6CAA2B;AAC3B,iDAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,mEAAmE;AACnE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,4DAA4D;;;;;;;;;;;;;;;;AAE5D,iDAA+B;AAC/B,gDAA8B;AAC9B,wDAAsC;AACtC,+CAA6B;AAC7B,0DAAwC;AACxC,6CAA2B;AAC3B,iDAA+B"}

package/payload/platform/lib/storage-broker/dist/remediate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remediate.d.ts","sourceRoot":"","sources":["../src/remediate.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAOD,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAAE,EACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,aAAa,CAGf;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM/D"}
+{"version":3,"file":"remediate.d.ts","sourceRoot":"","sources":["../src/remediate.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAoBD,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAAE,EACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,aAAa,CAGf;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAM/D"}

package/payload/platform/lib/storage-broker/dist/remediate.js

@@ -10,7 +10,20 @@ exports.stripAccountWideTokens = stripAccountWideTokens;
 // Account-wide credentials stripped from a sub-account's cloudflare.env.
 // CLOUDFLARE_ACCOUNT_ID is intentionally kept: it is an identifier, not a
 // credential, and does not grant access on its own.
-const STRIP_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
+// Account-wide-reach tokens that must never persist in a sub-account secrets
+// file: the master and every scoped DATA token that reaches the whole shared
+// account. CF_STORAGE_TOKEN (D1+R2) and CF_CALENDAR_D1_TOKEN (D1) are house-code
+// data scopes (Task 1670) minted account-scoped, so a copy in a sub-account file
+// would let that tenant reach every other tenant's D1/R2 — strip them too. The
+// account's own zone/pages hosting tokens (CF_DNS_TOKEN, etc.) are narrow and
+// stay.
+const STRIP_KEYS = [
+    "CLOUDFLARE_API_TOKEN",
+    "CF_PAGES_D1_TOKEN",
+    "CF_PAGES_TOKEN",
+    "CF_STORAGE_TOKEN",
+    "CF_CALENDAR_D1_TOKEN",
+];
 function validateMapping(enumerated, mapping) {
     const missing = enumerated.filter((name) => !(name in mapping));
     return { ok: missing.length === 0, missing };

package/payload/platform/lib/storage-broker/dist/remediate.js.map

@@ -1 +1 @@
-{"version":3,"file":"remediate.js","sourceRoot":"","sources":["../src/remediate.ts"],"names":[],"mappings":";AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,wEAAwE;;AAYxE,0CAMC;AAED,wDAMC;AAnBD,yEAAyE;AACzE,0EAA0E;AAC1E,oDAAoD;AACpD,MAAM,UAAU,GAAG,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;AAEnF,SAAgB,eAAe,CAC7B,UAAoB,EACpB,OAA+B;IAE/B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"remediate.js","sourceRoot":"","sources":["../src/remediate.ts"],"names":[],"mappings":";AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,wEAAwE;;AAyBxE,0CAMC;AAED,wDAMC;AAhCD,yEAAyE;AACzE,0EAA0E;AAC1E,oDAAoD;AACpD,6EAA6E;AAC7E,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,QAAQ;AACR,MAAM,UAAU,GAAG;IACjB,sBAAsB;IACtB,mBAAmB;IACnB,gBAAgB;IAChB,kBAAkB;IAClB,sBAAsB;CACvB,CAAC;AAEF,SAAgB,eAAe,CAC7B,UAAoB,EACpB,OAA+B;IAE/B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/payload/platform/lib/storage-broker/src/__tests__/cf-exec.test.ts

@@ -1,6 +1,9 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { makeCfExec, type RunFn, type FetchFn } from "../cf-exec.js";
+import { mkdtempSync, mkdirSync, writeFileSync, appendFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { makeCfExec, makeHouseCfExec, type RunFn, type FetchFn } from "../cf-exec.js";
 
 const cred = { apiToken: "cfat_x", accountId: "acc-h" };
 
@@ -158,3 +161,27 @@ test("non-JSON output throws with the raw body", async () => {
   const cf = makeCfExec(cred, run);
   await assert.rejects(() => cf.d1List(), /not json/);
 });
+
+// Task 1670 — makeHouseCfExec resolves a scoped storage token from the house
+// minter via cf-token.sh and uses THAT token (never the minter) for wrangler.
+test("makeHouseCfExec runs wrangler with the scoped token, not the minter", async () => {
+  const platformRoot = mkdtempSync(join(tmpdir(), "house-cfexec-"));
+  const cfg = join(platformRoot, "config");
+  mkdirSync(cfg, { recursive: true });
+  const houseEnv = join(cfg, "cloudflare-house.env");
+  writeFileSync(houseEnv, "CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc-h\n");
+
+  let sawToken = "";
+  const run: RunFn = async (_cmd, args, env) => {
+    if (args.some((a) => a.endsWith("cf-token.sh"))) {
+      appendFileSync(houseEnv, "CF_STORAGE_TOKEN=scoped_tok\n");
+      return { stdout: "CF_STORAGE_TOKEN\n" };
+    }
+    sawToken = env.CLOUDFLARE_API_TOKEN;
+    return { stdout: "[]" };
+  };
+
+  const cf = await makeHouseCfExec(platformRoot, run);
+  await cf.d1List();
+  assert.equal(sawToken, "scoped_tok", "wrangler saw the scoped token, not the minter");
+});

package/payload/platform/lib/storage-broker/src/__tests__/house-scoped-token.test.ts

@@ -0,0 +1,48 @@
+// Task 1670 — resolveHouseScopedToken shells cf-token.sh against the house env
+// file and reads back the persisted key value. The cf-token.sh invocation is
+// mocked via the injected RunFn (it appends the key and echoes the key name).
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, appendFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { resolveHouseScopedToken } from "../house-scoped-token.js";
+import type { RunFn } from "../cf-exec.js";
+
+function houseFile(contents: string): string {
+  const dir = mkdtempSync(join(tmpdir(), "hst-"));
+  const p = join(dir, "cloudflare-house.env");
+  writeFileSync(p, contents);
+  return p;
+}
+
+test("mints and reads back the scoped token value", async () => {
+  const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\n");
+  const run: RunFn = async (_cmd, args) => {
+    assert.equal(args[1], "storage", "scope passed to cf-token.sh");
+    appendFileSync(p, "CF_STORAGE_TOKEN=minted_value\n");
+    return { stdout: "CF_STORAGE_TOKEN\n" };
+  };
+  const tok = await resolveHouseScopedToken("storage", p, "/x/cf-token.sh", run);
+  assert.equal(tok, "minted_value");
+});
+
+test("reuse: a pre-existing key resolves to its value", async () => {
+  const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\nCF_STORAGE_TOKEN=already_here\n");
+  // cf-token.sh reuse path writes nothing new, still echoes the key.
+  const run: RunFn = async () => ({ stdout: "CF_STORAGE_TOKEN\n" });
+  const tok = await resolveHouseScopedToken("storage", p, "/x/cf-token.sh", run);
+  assert.equal(tok, "already_here");
+});
+
+test("throws when the persisted key is absent after the run", async () => {
+  const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\n");
+  const run: RunFn = async () => ({ stdout: "CF_STORAGE_TOKEN\n" }); // writes nothing
+  await assert.rejects(() => resolveHouseScopedToken("storage", p, "/x/cf-token.sh", run));
+});
+
+test("throws when cf-token.sh returns no key name", async () => {
+  const p = houseFile("CLOUDFLARE_API_TOKEN=cfat_minter\nCLOUDFLARE_ACCOUNT_ID=acc\n");
+  const run: RunFn = async () => ({ stdout: "\n" });
+  await assert.rejects(() => resolveHouseScopedToken("storage", p, "/x/cf-token.sh", run));
+});

package/payload/platform/lib/storage-broker/src/__tests__/remediate.test.ts

@@ -19,3 +19,11 @@ test("strips only account-wide token lines, keeps the account id and scoped toke
     "CLOUDFLARE_ACCOUNT_ID=acc\nCLOUDFLARE_API_TOKEN=cfat_x\nCF_PAGES_D1_TOKEN=y\nCF_DNS_TOKEN=keep\n";
   assert.equal(stripAccountWideTokens(before), "CLOUDFLARE_ACCOUNT_ID=acc\nCF_DNS_TOKEN=keep\n");
 });
+
+// Task 1670 — the house-code data scopes reach the whole shared account, so a
+// stray copy in a sub-account file is a cross-tenant leak and must be stripped.
+test("strips the account-wide data scopes (storage, calendar-d1), keeps zone hosting tokens", () => {
+  const before =
+    "CLOUDFLARE_ACCOUNT_ID=acc\nCF_STORAGE_TOKEN=cfat_d1r2\nCF_CALENDAR_D1_TOKEN=cfat_d1\nCF_DNS_TOKEN=keep\n";
+  assert.equal(stripAccountWideTokens(before), "CLOUDFLARE_ACCOUNT_ID=acc\nCF_DNS_TOKEN=keep\n");
+});

package/payload/platform/lib/storage-broker/src/bin/remediate-run.ts

@@ -14,6 +14,7 @@ import { validateMapping, stripAccountWideTokens } from "../remediate.js";
 import { registerResource, type StorageResource } from "../registry.js";
 import { readHouseCredential } from "../house-credential.js";
 import { makeCfExec } from "../cf-exec.js";
+import { resolveHouseScopedToken } from "../house-scoped-token.js";
 
 export interface RemediationDeps {
   cfD1(): Promise<Array<{ name: string; cfResourceId: string }>>;
@@ -77,7 +78,9 @@ export async function runRemediation(deps: RemediationDeps): Promise<Remediation
 
 // --- on-device CLI (untested glue) ----------------------------------------
 
-function findMasterFromAccounts(accountsDir: string): { apiToken: string; accountId: string } | null {
+function findMasterFromAccounts(
+  accountsDir: string,
+): { apiToken: string; accountId: string; path: string } | null {
   if (!existsSync(accountsDir)) return null;
   for (const accountId of readdirSync(accountsDir)) {
     const p = join(accountsDir, accountId, "secrets", "cloudflare.env");
@@ -88,7 +91,7 @@ function findMasterFromAccounts(accountsDir: string): { apiToken: string; accoun
       if (m) env[m[1]] = m[2].trim();
     }
     if (env.CLOUDFLARE_API_TOKEN && env.CLOUDFLARE_ACCOUNT_ID) {
-      return { apiToken: env.CLOUDFLARE_API_TOKEN, accountId: env.CLOUDFLARE_ACCOUNT_ID };
+      return { apiToken: env.CLOUDFLARE_API_TOKEN, accountId: env.CLOUDFLARE_ACCOUNT_ID, path: p };
     }
   }
   return null;
@@ -110,10 +113,13 @@ async function main(): Promise<void> {
   const mapping = JSON.parse(readFileSync(mappingFile, "utf8")) as Record<string, string>;
 
   // The master is wherever it lives today: the house file if already relocated,
-  // else the first sub-account secrets file that still carries it.
+  // else the first sub-account secrets file that still carries it. masterFile is
+  // the file cf-token.sh mints the scoped enumeration token against.
   let master: { apiToken: string; accountId: string };
+  let masterFile: string;
   try {
     master = readHouseCredential(platformRoot);
+    masterFile = configPath;
   } catch {
     const found = findMasterFromAccounts(accountsDir);
     if (!found) {
@@ -121,10 +127,16 @@ async function main(): Promise<void> {
       process.exit(2);
       return;
     }
-    master = found;
+    master = { apiToken: found.apiToken, accountId: found.accountId };
+    masterFile = found.path;
   }
 
-  const cf = makeCfExec(master);
+  // Task 1670 — the master is a minter; enumerate D1/R2 through a scoped storage
+  // token minted from it, never the minter directly. `master` (the raw minter)
+  // is still what runRemediation relocates into the house file below.
+  const cfTokenSh = join(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+  const scoped = await resolveHouseScopedToken("storage", masterFile, cfTokenSh);
+  const cf = makeCfExec({ apiToken: scoped, accountId: master.accountId });
   const neo4j = (await import("neo4j-driver")) as any;
   const driver = neo4j.default.driver(
     process.env.NEO4J_URI,

package/payload/platform/lib/storage-broker/src/cf-exec.ts

@@ -3,7 +3,10 @@
 // wrangler. `run` is injectable so the wiring is unit-testable without wrangler.
 
 import { execFile } from "node:child_process";
+import { join } from "node:path";
 import type { HouseCredential } from "./house-credential.js";
+import { readHouseCredential } from "./house-credential.js";
+import { resolveHouseScopedToken } from "./house-scoped-token.js";
 
 export type RunFn = (
   cmd: string,
@@ -137,3 +140,22 @@ export function makeCfExec(
     },
   };
 }
+
+// Task 1670 — build a CfExec whose token is a D1+R2 "storage" scope minted from
+// the house minter, never the minter used directly (a minter cannot run
+// wrangler d1/r2 or hit the D1/R2 API — it returns 10000). cf-token.sh
+// mints-or-reuses and persists the scope house-side; the resolved value is used
+// for both the wrangler run env and the API Bearer. The two UI-route broker
+// sites and remediate-run construct their CfExec through the house minter this
+// way instead of `makeCfExec(readHouseCredential(...))`.
+export async function makeHouseCfExec(
+  platformRoot: string,
+  run: RunFn = defaultRun,
+  fetchFn: FetchFn = defaultFetch,
+): Promise<CfExec> {
+  const cred = readHouseCredential(platformRoot);
+  const houseEnvPath = join(platformRoot, "config", "cloudflare-house.env");
+  const cfTokenSh = join(platformRoot, "plugins/cloudflare/bin/cf-token.sh");
+  const scoped = await resolveHouseScopedToken("storage", houseEnvPath, cfTokenSh, run);
+  return makeCfExec({ apiToken: scoped, accountId: cred.accountId }, run, fetchFn);
+}

package/payload/platform/lib/storage-broker/src/house-scoped-token.ts

@@ -0,0 +1,72 @@
+// Task 1670 — the house credential is a minter. Each broker/calendar consumer
+// mints (and thereafter reuses) a scoped data token from it via cf-token.sh, the
+// single Cloudflare mint/reuse state machine. This wrapper shells that script
+// against the house env file and reads back the persisted key value. The mint
+// logic itself is not duplicated here — it lives only in cf-token.sh.
+
+import { readFileSync } from "node:fs";
+import { execFile } from "node:child_process";
+import type { RunFn } from "./cf-exec.js";
+
+const defaultRun: RunFn = (cmd, args, env) =>
+  new Promise((resolve, reject) => {
+    execFile(cmd, args, { env }, (err, stdout, stderr) => {
+      if (err) {
+        reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}\n${stderr}`));
+        return;
+      }
+      resolve({ stdout: stdout.toString() });
+    });
+  });
+
+function readKey(path: string, key: string): string | undefined {
+  for (const line of readFileSync(path, "utf8").split("\n")) {
+    const m = line.match(/^([A-Z0-9_]+)=(.*)$/);
+    if (m && m[1] === key) return m[2].trim();
+  }
+  return undefined;
+}
+
+/**
+ * Resolve a scoped data token (e.g. "storage" = D1+R2) from the house minter.
+ * Shells cf-token.sh, which mints or reuses the scope and persists the key into
+ * the house env file, echoing the key name. Reads that key back and returns its
+ * value. Throws if the key is absent after the run (never returns the minter).
+ */
+export async function resolveHouseScopedToken(
+  scope: string,
+  houseEnvPath: string,
+  cfTokenShPath: string,
+  run: RunFn = defaultRun,
+): Promise<string> {
+  const preexisting = readKey(houseEnvPath, keyForScope(scope)) !== undefined;
+  const { stdout } = await run(
+    "bash",
+    [cfTokenShPath, scope, houseEnvPath],
+    { ...process.env } as Record<string, string>,
+  );
+  const keyName = stdout.trim().split("\n").pop()?.trim() ?? "";
+  if (!keyName) throw new Error(`storage-broker: cf-token.sh ${scope} returned no key name`);
+  const value = readKey(houseEnvPath, keyName);
+  if (!value) {
+    throw new Error(`storage-broker: scoped token ${keyName} absent in ${houseEnvPath} after mint`);
+  }
+  console.error(
+    `[storage-broker] op=house-scoped-token src=house scope=${scope} action=${preexisting ? "reuse" : "mint"} result=active`,
+  );
+  return value;
+}
+
+// The persisted key name for each scope, mirroring cf-token.sh's scope table.
+// Used only to derive the mint/reuse action for the observability line; the
+// authoritative key is whatever cf-token.sh echoes.
+function keyForScope(scope: string): string {
+  switch (scope) {
+    case "storage":
+      return "CF_STORAGE_TOKEN";
+    case "calendar-d1":
+      return "CF_CALENDAR_D1_TOKEN";
+    default:
+      return "";
+  }
+}

package/payload/platform/lib/storage-broker/src/index.ts

@@ -10,5 +10,6 @@ export * from "./authorize.js";
 export * from "./registry.js";
 export * from "./house-credential.js";
 export * from "./cf-exec.js";
+export * from "./house-scoped-token.js";
 export * from "./audit.js";
 export * from "./remediate.js";

package/payload/platform/lib/storage-broker/src/remediate.ts

@@ -12,7 +12,20 @@ export interface MappingResult {
 // Account-wide credentials stripped from a sub-account's cloudflare.env.
 // CLOUDFLARE_ACCOUNT_ID is intentionally kept: it is an identifier, not a
 // credential, and does not grant access on its own.
-const STRIP_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
+// Account-wide-reach tokens that must never persist in a sub-account secrets
+// file: the master and every scoped DATA token that reaches the whole shared
+// account. CF_STORAGE_TOKEN (D1+R2) and CF_CALENDAR_D1_TOKEN (D1) are house-code
+// data scopes (Task 1670) minted account-scoped, so a copy in a sub-account file
+// would let that tenant reach every other tenant's D1/R2 — strip them too. The
+// account's own zone/pages hosting tokens (CF_DNS_TOKEN, etc.) are narrow and
+// stay.
+const STRIP_KEYS = [
+  "CLOUDFLARE_API_TOKEN",
+  "CF_PAGES_D1_TOKEN",
+  "CF_PAGES_TOKEN",
+  "CF_STORAGE_TOKEN",
+  "CF_CALENDAR_D1_TOKEN",
+];
 
 export function validateMapping(
   enumerated: string[],

package/payload/platform/plugins/admin/PLUGIN.md

@@ -180,6 +180,7 @@ Tools are available via the `admin` MCP server.
 
 ## Hooks
 
+- `hooks/quote-render-gate.sh` — **PreToolUse matcher=`mcp__plugin_browser_browser__browser-pdf-save`.** Makes the deterministic quote-render path the only route a client-facing quote PDF can reach a customer. Blocks (exit 2) a `browser-pdf-save` whose output path is a client-quote artefact (`memory/users/<phone>/documents/quote-<jobId>.pdf` or `…-breakdown.pdf`) when no render receipt exists at `quoting/jobs/<jobId>/render-receipt.json` — the receipt `quote-render` writes only after its reconcile / margin-leak / link-liveness gates all pass. A hand-authored quote (the SiteDesk 2026-07-14 bypass: `Write` HTML → `browser-pdf-save`, `quote-render` never called, an internal back-test caveat naming another client folded into the free-text region) has no receipt, so the print is refused rather than delivered. **Block message:** `Blocked: this client quote was not produced by the quote-render tool, so its fixed layout and the reconcile, margin-leak and link-liveness gates never ran. Run quote-render for this job (it files the document and its receipt), then print the client HTML path it returns to PDF.` **Log line** (stderr, on a block): `[quote-render] op=bypass jobId=<jobId> detail=client quote PDF has no render receipt` (or `reason=bad-jobid` when the filename does not resolve to a job). Every non-quote PDF — brochures, invoices, the admin-scope internal view — and the deterministic path itself (receipt present) pass at exit 0. **Fail-open** on an uninspectable call (tty / empty stdin / no `python3`): `browser-pdf-save` is a general-purpose tool and the agent never controls this hook's stdin, so failing open opens no bypass while never bricking unrelated PDFs.
 - `hooks/webfetch-preflight.mjs` — short-circuits WebFetch on JS-SPA shells with a structured `WEBFETCH_CANNOT_READ_JS_SPA` error so the agent surfaces a loud failure to the owner instead of paying the 60s extraction timeout. Fail-open on any internal error.
 - `hooks/askuserquestion-investigate-gate.sh` — PreToolUse matcher=`AskUserQuestion`. Blocks the question (exit 2) when no read-only investigation tool has fired since the latest real user turn in the session JSONL. The structural fix for the failure class where the agent fabricates a menu before evidence-gathering (session `c085ec2c-46fb-4b73-8865-68cf85866ea8` 2026-05-22 — "change remote access password" → invented options "Admin PIN / Cloudflare tunnel / WiFi password" with zero prior tool_use; post-correction the agent immediately fired `remote-auth-status` → `ToolSearch` → `remote-auth-set-password`, proving it knew the moves). **Allowlist** (exact, with trailing `__<tool>` suffix-match for namespaced `mcp__plugin_<plugin>_<server>__<tool>` aliases): `ToolSearch`, `Grep`, `Glob`, `Read`, `LS`, `NotebookRead`, `Bash`, `WebFetch`, `WebSearch`, plus the read-only admin / memory MCP tools (`*-status`, `*-list`, `*-read`, `skill-find`, `memory-find-candidates`, `profile-read`, `conversation-list`, `memory-list-attachments`, `memory-read-attachment`). **Block message:** `Blocked: AskUserQuestion requires at least one investigation tool (ToolSearch, Grep, Read, *-list, *-status, *-read, skill-find, ...) earlier in this turn. Search the operator's literal phrase first.` **Log line** (stderr, one per call): `[ask-gate] decision=<allow|block> sessionId=<id8> seen=<csv|-> reason=<allowlist-hit|no-investigation|fail-open-no-transcript|fail-open-parse-error>`. **Fail-open** on missing transcript or parse error — nudges, never bricks the UI.
 - `hooks/askuserquestion-channel-carrier-gate.sh` — PreToolUse matcher=`AskUserQuestion`, registered as a **second command on the same matcher** as the investigate-gate (either exit 2 blocks; the two guard different conditions). Blocks the question (exit 2) when the session has a native channel attached, because the Claude Code channel protocol carries only the two permission methods — there is no carrier for the `AskUserQuestion` elicitation, so on an rc-spawn channel (webchat/WhatsApp/Telegram) session the harness would block the turn awaiting a selection that can never arrive and the reader renders only delivered replies, wedging the turn (live SiteDesk incident session `1a085718` 2026-07-11: `/chat` stalled on the delivered "On it…" ack with no card). **Signal:** the rc-spawn writes the channel MCP registration as a config file in `os.tmpdir()` keyed by session id (`maxy-channel-<sid>.json` / `maxy-webchat-channel-<sid>.json` / `maxy-wa-channel-<sid>.json` / `maxy-telegram-channel-<sid>.json`, `sid` sanitized `[^A-Za-z0-9_-]→_` exactly as the writers do); its presence at tool-call time is the authoritative "channel attached to this session" marker. The hook resolves the tmpdir the way Node's `os.tmpdir()` does (`${TMPDIR:-/tmp}`, trailing slash stripped). Correct in both readings of the claude.ai/code scoping question: a Pi channel process sees the tmpfile (block); a claude.ai/code process on another host never sees the Pi tmpfile (fail-open → allow, that surface can answer the card). **Block message:** `Blocked: this is a native-channel session and AskUserQuestion cannot be delivered over a channel (the channel protocol carries no elicitation card, so the turn would wedge). Ask the same question as prose in your channel reply tool and wait for the operator's next message.` **Log line** (stderr, one per decisive call): `[ask-channel] decision=<allow|block> sessionId=<id8> channel=<attached|none> reason=<channel-attached|no-channel|fail-open-no-envelope|fail-open-no-session>`. **Fail-open** on no envelope, blank session id, or absent channel file — nudges, never bricks the UI. The complementary standing check (`interactive-wedge` in the session manager) catches any un-carried interactive tool_use that slips past this hook.

package/payload/platform/plugins/admin/hooks/__tests__/quote-render-gate.test.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# Regression test for quote-render-gate.sh.
+#
+# The gate is a PreToolUse hook on browser-pdf-save. It refuses a client-facing
+# quote PDF (memory/users/<phone>/documents/quote-<jobId>.pdf or
+# ...-breakdown.pdf) unless a render receipt exists for that jobId — proof the
+# deterministic quote-render path produced it. Everything else passes.
+#
+# Covers:
+#   A. client quote PDF, no receipt              → BLOCKED (exit 2)
+#   B. client quote PDF, receipt present         → ALLOWED (exit 0)
+#   C. client breakdown PDF, no receipt          → BLOCKED
+#   D. client breakdown PDF, receipt present     → ALLOWED
+#   E. non-quote PDF in the documents scope      → ALLOWED (not a quote artefact)
+#   F. internal quote PDF (admin scope)          → ALLOWED (not client-facing)
+#   G. quote-named PDF outside the client scope  → ALLOWED (only the documents scope is gated)
+#   H. empty stdin                               → ALLOWED (general-purpose tool, fail-open)
+#   I. a non-browser tool                        → ALLOWED (matcher defence-in-depth)
+#   J. jobId carrying a path traversal           → BLOCKED (never resolves a stray receipt)
+#   K. a block emits the op=bypass fault line
+
+set -u
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/quote-render-gate.sh"
+if [[ ! -x "$HOOK" ]]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+
+ACCT=$(mktemp -d)
+cleanup() { rm -rf "$ACCT"; }
+trap cleanup EXIT
+
+# A receipt for job-1 (present) — jobs job-2 / job-3 have none.
+mkdir -p "$ACCT/quoting/jobs/job-1"
+printf '{"jobId":"job-1"}' > "$ACCT/quoting/jobs/job-1/render-receipt.json"
+
+DOCS="$ACCT/memory/users/44700900000/documents"
+ADMIN="$ACCT/memory/admin/customers/44700900000"
+
+PASS=0
+FAIL=0
+
+# Run the hook with cwd = the account dir (as the PTY does), capturing exit + stderr.
+run_case() {
+  local name="$1" stdin="$2" expected_exit="$3"
+  local actual_exit
+  ( cd "$ACCT" && printf '%s' "$stdin" | bash "$HOOK" >/dev/null 2>/dev/null )
+  actual_exit=$?
+  if [[ "$actual_exit" -eq "$expected_exit" ]]; then
+    echo "PASS: $name (exit=$actual_exit)"
+    PASS=$((PASS + 1))
+  else
+    echo "FAIL: $name (expected exit=$expected_exit, got=$actual_exit)" >&2
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+envelope() { # tool_name, path
+  printf '{"hook_event_name":"PreToolUse","tool_name":"%s","tool_input":{"path":"%s"}}' "$1" "$2"
+}
+
+BROWSER="mcp__plugin_browser_browser__browser-pdf-save"
+
+run_case "A: client quote PDF, no receipt → BLOCKED" \
+  "$(envelope "$BROWSER" "$DOCS/quote-job-2.pdf")" 2
+
+run_case "B: client quote PDF, receipt present → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/quote-job-1.pdf")" 0
+
+run_case "C: client breakdown PDF, no receipt → BLOCKED" \
+  "$(envelope "$BROWSER" "$DOCS/quote-job-3-breakdown.pdf")" 2
+
+run_case "D: client breakdown PDF, receipt present → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/quote-job-1-breakdown.pdf")" 0
+
+run_case "E: non-quote PDF in documents scope → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/brochure.pdf")" 0
+
+run_case "F: internal quote PDF (admin scope) → ALLOWED" \
+  "$(envelope "$BROWSER" "$ADMIN/quote-job-2-internal.pdf")" 0
+
+run_case "G: quote-named PDF outside client scope → ALLOWED" \
+  "$(envelope "$BROWSER" "$ACCT/quote-job-2.pdf")" 0
+
+run_case "H: empty stdin → ALLOWED (fail-open)" \
+  "" 0
+
+run_case "I: non-browser tool → ALLOWED" \
+  '{"hook_event_name":"PreToolUse","tool_name":"Write","tool_input":{"file_path":"/x/memory/users/44700900000/documents/quote-job-2.pdf"}}' 0
+
+run_case "J: jobId path traversal → BLOCKED" \
+  "$(envelope "$BROWSER" "$DOCS/quote-...pdf")" 2
+
+# K: a block emits the op=bypass fault line on stderr.
+STDERR=$( cd "$ACCT" && printf '%s' "$(envelope "$BROWSER" "$DOCS/quote-job-2.pdf")" | bash "$HOOK" 2>&1 >/dev/null )
+if printf '%s' "$STDERR" | grep -q '\[quote-render\] op=bypass jobId=job-2'; then
+  echo "PASS: K: block emits op=bypass jobId=job-2"
+  PASS=$((PASS + 1))
+else
+  echo "FAIL: K: op=bypass line absent (got: $STDERR)" >&2
+  FAIL=$((FAIL + 1))
+fi
+
+echo "──────── quote-render-gate test summary ────────"
+echo "PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/quote-render-gate.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# quote-render-gate — PreToolUse gate on browser-pdf-save.
+#
+# A customer only ever receives the two client-facing quote documents from the
+# customer documents scope (memory/users/<phone>/documents/). This gate refuses
+# to print one to PDF unless the deterministic quote-render tool actually
+# produced it — proven by the render receipt quote-render writes on success
+# (quoting/jobs/<jobId>/render-receipt.json). No receipt for the job means the
+# quote was hand-authored off the deterministic path, so the fixed-layout
+# guarantee and the reconcile/margin/link gates never ran; the PDF is refused and
+# the bypass is surfaced as [quote-render] op=bypass, not delivered.
+#
+# Scope: only a .pdf under memory/users/<phone>/documents/ named
+# quote-<jobId>.pdf or quote-<jobId>-breakdown.pdf is gated. Every other PDF —
+# brochures, invoices, the admin-scope internal view — passes untouched.
+#
+# Exit codes: 0 = allow, 2 = block (stderr shown to the agent). Fail OPEN on an
+# uninspectable call (browser-pdf-save is a general-purpose tool; the bypass we
+# guard is an agent skipping quote-render, and the agent never controls this
+# hook's stdin, so failing open here opens no bypass). No task numbers or
+# internal refs in any operator-visible string.
+
+set -uo pipefail
+
+# No envelope (tty or empty stdin) → allow: cannot inspect, must not brick PDFs.
+if [ -t 0 ]; then exit 0; fi
+INPUT=$(cat)
+[ -z "$INPUT" ] && exit 0
+
+# Print the jobId of a gated client-quote artefact, or nothing for any other
+# call. The customer documents scope is a path convention, so match on it
+# structurally rather than resolving symlinks.
+JOBID=$(INPUT="$INPUT" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys
+try:
+    d = json.loads(os.environ["INPUT"])
+except Exception:
+    sys.exit(0)
+tool = d.get("tool_name", "") or ""
+if not tool.endswith("browser-pdf-save"):
+    sys.exit(0)
+path = (d.get("tool_input", {}) or {}).get("path", "") or ""
+if not path:
+    sys.exit(0)
+norm = os.path.normpath(path)
+m = re.search(r'(?:^|/)memory/users/[^/]+/documents/quote-(.+?)(?:-breakdown)?\.pdf$', norm)
+if not m:
+    sys.exit(0)
+print(m.group(1))
+PY
+)
+
+# Not a gated client-quote artefact → allow.
+[ -z "$JOBID" ] && exit 0
+
+# A jobId is a single path segment. A separator or traversal in it never keys a
+# legitimate receipt, so treat it as a bypass rather than resolving a stray file.
+case "$JOBID" in
+  */*|*..*)
+    echo "[quote-render] op=bypass jobId=$JOBID reason=bad-jobid" >&2
+    echo "Blocked: this looks like a client quote PDF but its name does not resolve to a job. Produce the quote with the quote-render tool, which files the document and its render receipt, then print the path it returns." >&2
+    exit 2
+    ;;
+esac
+
+# The receipt lives beside the job's figures, written by quote-render only after
+# every gate passed. Its presence is the proof the deterministic path ran.
+if [ -f "$PWD/quoting/jobs/$JOBID/render-receipt.json" ]; then
+  exit 0
+fi
+
+echo "[quote-render] op=bypass jobId=$JOBID detail=client quote PDF has no render receipt" >&2
+echo "Blocked: this client quote was not produced by the quote-render tool, so its fixed layout and the reconcile, margin-leak and link-liveness gates never ran. Run quote-render for this job (it files the document and its receipt), then print the client HTML path it returns to PDF." >&2
+exit 2

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:c170bc722cc54b4882abbe20267c10b8b007ace08d916b4e857ce0868f3769cb
+content-hash: sha256:8718b7135f79829576ed6a21c6a0bb39a62eaf8a8e772cec37124c3aa44dfdc7
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2044,7 +2044,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 
 1. **No app to register.** The client ID ships with the brand (`brand.json#outlookClientId`), and the installer stamps it onto the session-manager env, so there is zero operator Azure work. On a brand that ships an empty value the plugin stays inert until its vendor app exists — see `platform/plugins/outlook/references/auth.md` for the one-time-per-brand vendor provisioning runbook (a vendor step, not an operator or end-user step), including setting **Allow public client flows** to Yes.
 2. **Per account: register the Outlook account** — in admin chat, ask the agent to "register my Outlook account". The agent runs `outlook-account-register`, which returns a short user code and the URL `microsoft.com/devicelogin` and relays both to you.
-3. **Consent on any device** — open `microsoft.com/devicelogin` on your phone or laptop, enter the code, sign in to your Microsoft account, and consent to the requested scopes (`offline_access`, `User.Read`, `Mail.ReadWrite`, `Mail.Send`, `Calendars.ReadWrite`, `Contacts.Read`). `Mail.Send` enables sending and `Calendars.ReadWrite` enables calendar control; a mailbox last consented on an older read-only scope set must re-register before send or any calendar write succeeds. The agent finishes by calling `outlook-account-register-poll`.
+3. **Consent on any device** — open `microsoft.com/devicelogin` on your phone or laptop, enter the code, sign in to your Microsoft account, and consent to the requested scopes (`offline_access`, `User.Read`, `Mail.ReadWrite`, `Mail.Send`, `Calendars.ReadWrite`, `Contacts.Read`). `Mail.Send` enables sending and `Calendars.ReadWrite` enables calendar control; a mailbox last consented on an older read-only scope set must re-register before send or any calendar write succeeds. Nothing else to do: the server finishes the sign-in automatically once you consent, usually within about half a minute, and the mailbox is then connected.
 4. **Done.** Subsequent tool calls (mail, calendar, contacts) use the persisted refresh token transparently.
 5. **Several mailboxes on one account.** Register again to add a second mailbox; it is stored alongside the first, not in place of it. Every operational tool then takes an optional `mailbox` argument — an email address or graphUserId. With one mailbox, omit it. With two or more, name it; omitting it returns a refusal listing the connected mailboxes. `outlook-mailbox-list` shows every connected mailbox. Only one registration runs at a time per account; starting another while one is live returns an in-progress signal.
 
@@ -2054,8 +2054,8 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 |------|---------|
 | `outlook-account-register` | Start the device-code flow for this account. Returns a user code + `microsoft.com/devicelogin` URL immediately; does not block. |
 | `outlook-account-register-poll` | Finish the device-code flow. One check per call: returns pending, registered, expired, or denied. |
-| `outlook-mail-list` | Recent mail. Default top=25, folder=Inbox. `folder` takes a well-known name or alias (case/space-insensitive): Inbox, Sent Items/sent, Drafts, Deleted Items/trash, Junk Email/junk/spam, Archive, Outbox — or a raw folder id. Custom folder names are not resolved. |
-| `outlook-mail-search` | Microsoft Graph `$search` over the mailbox. Preview-only, like `outlook-mail-list`. |
+| `outlook-mail-list` | Mail newest-first. Default top=25, folder=Inbox. `folder` takes a well-known name or alias (case/space-insensitive): Inbox, Sent Items/sent, Drafts, Deleted Items/trash, Junk Email/junk/spam, Archive, Outbox — or a raw folder id. Custom folder names are not resolved. `since`/`before` (ISO date-times) narrow by receipt date. The 250-per-page figure is not a ceiling: the reply carries `nextCursor` when older mail remains — pass it back as `cursor` to page further back. Filter by sender/subject via `outlook-mail-search`. |
+| `outlook-mail-search` | Microsoft Graph `$search` (KQL) over the mailbox. Preview-only, like `outlook-mail-list`, and pages the same way via `nextCursor`/`cursor`. Put sender/subject/recipient/date filters in the query: `from:`, `to:`, `subject:`, `received>=`. Graph forbids `$search`+`$filter`, so a strict date window is on `outlook-mail-list`. |
 | `outlook-mail-fetch-body` | Complete body of one message by id (`GET /me/messages/{id}?$select=body`). HTML decoded to text, no preview cap. The full-read path — list/search return Microsoft's ~255-char preview only. Returns the envelope plus the whole body. |
 | `outlook-mail-reply` | Reply in-thread (`createReply` / `createReplyAll` + send). Threads natively via conversationId. `replyAll`, added cc/bcc, and account-scoped file attachments (up to 25 MB per file; files over Graph's ~3 MB inline limit use a chunked upload session). Body is plain text, prepended above the quote. Needs `Mail.ReadWrite` + `Mail.Send`. |
 | `outlook-mail-delete` | Move messages to Deleted Items (`POST /me/messages/{id}/move`). Recoverable — never hard-deletes. An id already gone is counted not-moved. Needs `Mail.ReadWrite`. |

package/payload/platform/plugins/cloudflare/bin/__tests__/cf-token.test.sh

@@ -48,7 +48,7 @@ echo "\$@" >> "\$SB/curl.log"
 url=""; for a in "\$@"; do case "\$a" in https://*) url="\$a";; esac; done
 case "\$url" in
   *"/tokens/permission_groups"*)
-    echo '{"success":true,"result":[{"id":"pg_pages","name":"Pages Write"},{"id":"pg_d1","name":"D1 Write"},{"id":"pg_dns","name":"DNS Write"},{"id":"pg_acc1","name":"Access: Apps and Policies Write"},{"id":"pg_acc2","name":"Access: Apps and Policies Write"}]}'
+    echo '{"success":true,"result":[{"id":"pg_pages","name":"Pages Write"},{"id":"pg_d1","name":"D1 Write"},{"id":"pg_r2","name":"Workers R2 Storage Write"},{"id":"pg_dns","name":"DNS Write"},{"id":"pg_acc1","name":"Access: Apps and Policies Write"},{"id":"pg_acc2","name":"Access: Apps and Policies Write"}]}'
     ;;
   *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
   *"/tokens"*)        echo '{"success":true,"result":{"id":"tok1","value":"'"$SECRET_VALUE"'"}}';;
@@ -353,5 +353,29 @@ grep -q "^CF_PAGES_D1_TOKEN=" "$OVERRIDE" && ok "override env received the minte
 echo "$ERR" | grep -q "src=house" && ok "override reports src=house" || bad "override src: $ERR"
 teardown
 
+# 17. storage scope (Task 1670): the broker's data token needs BOTH D1 Write and
+#     Workers R2 Storage Write, persisted under CF_STORAGE_TOKEN.
+setup "cfat_master_abc"
+run "storage mint D1+R2" storage 0
+[ "$OUT" = "CF_STORAGE_TOKEN" ] && ok "storage stdout is CF_STORAGE_TOKEN" || bad "storage out='$OUT'"
+POSTLINE=$(grep -- "-X POST" "$SANDBOX/curl.log")
+echo "$POSTLINE" | grep -q "pg_d1" && ok "storage minted D1 id" || bad "storage no D1 id: $POSTLINE"
+echo "$POSTLINE" | grep -q "pg_r2" && ok "storage minted R2 id" || bad "storage no R2 id: $POSTLINE"
+grep -q "^CF_STORAGE_TOKEN=" "$SECRETS" && ok "storage token persisted" || bad "storage not persisted"
+no_leak "storage mint"
+teardown
+
+# 18. calendar-d1 scope (Task 1670): the calendar's data token needs D1 Write
+#     ONLY (no R2), persisted under CF_CALENDAR_D1_TOKEN.
+setup "cfat_master_abc"
+run "calendar-d1 mint D1 only" calendar-d1 0
+[ "$OUT" = "CF_CALENDAR_D1_TOKEN" ] && ok "calendar-d1 stdout is CF_CALENDAR_D1_TOKEN" || bad "calendar-d1 out='$OUT'"
+POSTLINE=$(grep -- "-X POST" "$SANDBOX/curl.log")
+echo "$POSTLINE" | grep -q "pg_d1" && ok "calendar-d1 minted D1 id" || bad "calendar-d1 no D1 id: $POSTLINE"
+echo "$POSTLINE" | grep -q "pg_r2" && bad "calendar-d1 wrongly minted R2 id: $POSTLINE" || ok "calendar-d1 no R2 id"
+grep -q "^CF_CALENDAR_D1_TOKEN=" "$SECRETS" && ok "calendar-d1 token persisted" || bad "calendar-d1 not persisted"
+no_leak "calendar-d1 mint"
+teardown
+
 echo "----"; echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]