@rubytech/create-maxy-code 0.1.457 → 0.1.458

package/payload/platform/lib/storage-broker/src/__tests__/cf-exec.test.ts

@@ -35,6 +35,33 @@ function recordingFetch(response: { ok: boolean; status: number; body: string })
   return { fetchFn, calls };
 }
 
+// r2List follows the R2 pagination cursor, so its tests need a fetch that
+// returns a different response per call. recordingFetch returns one fixed
+// response for every call and stays as-is for the single-request paths.
+function sequenceFetch(responses: Array<{ ok: boolean; status: number; body: string }>) {
+  const calls: Array<{
+    url: string;
+    init: { method: string; headers: Record<string, string>; body?: string };
+  }> = [];
+  const fetchFn: FetchFn = async (url, init) => {
+    calls.push({ url, init });
+    const r = responses[calls.length - 1];
+    if (!r) throw new Error(`unexpected fetch call #${calls.length} to ${url}`);
+    return { ok: r.ok, status: r.status, text: async () => r.body };
+  };
+  return { fetchFn, calls };
+}
+
+function bucketPage(names: string[], cursor?: string) {
+  return JSON.stringify({
+    success: true,
+    errors: [],
+    messages: [],
+    result: { buckets: names.map((name) => ({ name, creation_date: "2026-01-01T00:00:00Z" })) },
+    result_info: cursor === undefined ? {} : { cursor, per_page: 20 },
+  });
+}
+
 test("d1List parses --json output and injects the house token", async () => {
   const { run, calls } = recordingRun(JSON.stringify([{ name: "gls-leads", uuid: "u1" }]));
   const cf = makeCfExec(cred, run);
@@ -156,12 +183,138 @@ test("r2List throws on a 200 whose body is not a success envelope, retaining the
   await assert.rejects(() => cf.r2List(), /unexpected/);
 });
 
+// `null` is valid JSON, so it survives parseJson and reaches the envelope
+// guard as a null parsed value. It must still surface its body like every other
+// malformed 2xx shape, never a bare TypeError with the body dropped.
+test("a 2xx body of JSON null throws with the body, not a TypeError", async () => {
+  const { fetchFn } = recordingFetch({ ok: true, status: 200, body: "null" });
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2List(), {
+    message: "storage-broker: r2 bucket list API error: null",
+  });
+});
+
 test("non-JSON output throws with the raw body", async () => {
   const { run } = recordingRun("not json");
   const cf = makeCfExec(cred, run);
   await assert.rejects(() => cf.d1List(), /not json/);
 });
 
+// Task 1665 — the R2 List-Buckets endpoint paginates by cursor. A single
+// unpaginated request silently truncates the bucket set on a large house
+// account, and the audit reads a truncated list as "those buckets are absent",
+// under-reporting strays. per_page is never sent: its default and cap are
+// unconfirmed, and omitting it makes the loop correct without guessing.
+test("r2List follows the pagination cursor and assembles every page", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets", "gls-docs"], "cur-1") },
+    { ok: true, status: 200, body: bucketPage(["acme-assets"]) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual(await cf.r2List(), [
+    { name: "gls-assets" },
+    { name: "gls-docs" },
+    { name: "acme-assets" },
+  ]);
+  assert.equal(calls.length, 2);
+  // The first request carries no query string; only follow-ups carry the cursor.
+  assert.equal(calls[0].url, "https://api.cloudflare.com/client/v4/accounts/acc-h/r2/buckets");
+  assert.equal(
+    calls[1].url,
+    "https://api.cloudflare.com/client/v4/accounts/acc-h/r2/buckets?cursor=cur-1",
+  );
+  assert.equal(calls[1].init.headers.Authorization, "Bearer cfat_x");
+});
+
+test("r2List never sends per_page", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "cur-1") },
+    { ok: true, status: 200, body: bucketPage(["gls-docs"]) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2List();
+  for (const c of calls) assert.equal(c.url.includes("per_page"), false);
+});
+
+test("r2List stops on an empty-string cursor", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "") },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual(await cf.r2List(), [{ name: "gls-assets" }]);
+  assert.equal(calls.length, 1);
+});
+
+test("r2List percent-encodes the cursor", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "a b+c/d=") },
+    { ok: true, status: 200, body: bucketPage([]) },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await cf.r2List();
+  assert.equal(
+    calls[1].url,
+    "https://api.cloudflare.com/client/v4/accounts/acc-h/r2/buckets?cursor=a%20b%2Bc%2Fd%3D",
+  );
+});
+
+test("r2List stops on a null cursor", async () => {
+  const { fetchFn, calls } = sequenceFetch([
+    {
+      ok: true,
+      status: 200,
+      body: JSON.stringify({
+        success: true,
+        errors: [],
+        messages: [],
+        result: { buckets: [{ name: "gls-assets" }] },
+        result_info: { cursor: null },
+      }),
+    },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  assert.deepEqual(await cf.r2List(), [{ name: "gls-assets" }]);
+  assert.equal(calls.length, 1);
+});
+
+test("r2List throws on a repeated cursor instead of looping forever", async () => {
+  const { fetchFn } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "cur-1") },
+    { ok: true, status: 200, body: bucketPage(["gls-docs"], "cur-1") },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2List(), /repeated pagination cursor: cur-1/);
+});
+
+// A cursor cycle of period >= 2 never repeats the immediately-previous cursor,
+// so it would spin forever — re-appending the same buckets each pass — under a
+// guard that only compares against the last cursor seen.
+test("r2List throws on a cursor cycle that does not repeat consecutively", async () => {
+  const { fetchFn } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "cur-a") },
+    { ok: true, status: 200, body: bucketPage(["gls-docs"], "cur-b") },
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "cur-a") },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2List(), /repeated pagination cursor: cur-a/);
+});
+
+test("r2List surfaces a mid-loop failure with its body, never a partial list", async () => {
+  const { fetchFn } = sequenceFetch([
+    { ok: true, status: 200, body: bucketPage(["gls-assets"], "cur-1") },
+    {
+      ok: false,
+      status: 403,
+      body: JSON.stringify({
+        success: false,
+        errors: [{ code: 10000, message: "Authentication error" }],
+      }),
+    },
+  ]);
+  const cf = makeCfExec(cred, throwingRun, fetchFn);
+  await assert.rejects(() => cf.r2List(), /403[\s\S]*Authentication error/);
+});
+
 // Task 1670 — makeHouseCfExec resolves a scoped storage token from the house
 // minter via cf-token.sh and uses THAT token (never the minter) for wrangler.
 test("makeHouseCfExec runs wrangler with the scoped token, not the minter", async () => {

package/payload/platform/lib/storage-broker/src/cf-exec.ts

@@ -52,6 +52,34 @@ function parseJson(raw: string, context: string): unknown {
   }
 }
 
+// The Cloudflare-API envelope, in one place. Both API-backed methods (r2List,
+// d1Create) share it: read the body exactly once, surface a non-2xx with its
+// body, parse, then require an explicit `success:true`. A 2xx whose body is not
+// a well-formed success envelope is an anomaly to surface with its body, never
+// a silently empty/uuid-less result. The raw `body` is returned alongside the
+// parsed value so callers can raise their own shaping errors on the original
+// bytes rather than a re-serialised copy.
+async function cfApiJson(
+  fetchFn: FetchFn,
+  url: string,
+  init: { method: string; headers: Record<string, string>; body?: string },
+  context: string,
+): Promise<{ parsed: unknown; body: string }> {
+  const res = await fetchFn(url, init);
+  const body = await res.text();
+  if (!res.ok) {
+    throw new Error(`storage-broker: ${context} failed: ${res.status}\n${body}`);
+  }
+  // `null` is valid JSON and survives parseJson, so the guard is optional-
+  // chained: a null parsed value must surface its body like any other malformed
+  // 2xx shape, never a bare TypeError with the body dropped.
+  const parsed = parseJson(body, context) as { success?: boolean } | null;
+  if (parsed?.success !== true) {
+    throw new Error(`storage-broker: ${context} API error: ${body}`);
+  }
+  return { parsed, body };
+}
+
 export function makeCfExec(
   cred: HouseCredential,
   run: RunFn = defaultRun,
@@ -76,30 +104,26 @@ export function makeCfExec(
       // so shelling it with --json is always rejected. The D1 API creates the
       // database and returns its record — incl. the uuid — as JSON directly.
       const url = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/d1/database`;
-      const res = await fetchFn(url, {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${cred.apiToken}`,
-          "Content-Type": "application/json",
+      const { parsed, body } = await cfApiJson(
+        fetchFn,
+        url,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${cred.apiToken}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify({ name }),
         },
-        body: JSON.stringify({ name }),
-      });
-      const body = await res.text();
-      if (!res.ok) {
-        throw new Error(`storage-broker: d1 create failed: ${res.status}\n${body}`);
-      }
-      const parsed = parseJson(body, "d1 create") as {
-        success?: boolean;
-        errors?: unknown;
-        result?: { uuid?: string };
-      };
-      // Require an explicit success envelope with a uuid. A 2xx whose body is
-      // not a well-formed `success:true` response is an anomaly to surface with
-      // its body, never a silently uuid-less create.
-      if (parsed.success !== true || typeof parsed.result?.uuid !== "string") {
+        "d1 create",
+      );
+      // The envelope guard lives in cfApiJson; a uuid-less 2xx success envelope
+      // is still an anomaly to surface with its body, never a silent create.
+      const uuid = (parsed as { result?: { uuid?: string } }).result?.uuid;
+      if (typeof uuid !== "string") {
         throw new Error(`storage-broker: d1 create API error: ${body}`);
       }
-      return { uuid: parsed.result.uuid };
+      return { uuid };
     },
     async d1Query(name, sql) {
       const { stdout } = await run(
@@ -113,27 +137,47 @@ export function makeCfExec(
       // `wrangler r2 bucket list` has no --json flag and emits human prose, so
       // it can neither be parsed nor honour the "never grep a CLI's prose"
       // doctrine. The R2 API returns the bucket set as JSON directly.
-      const url = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets`;
-      const res = await fetchFn(url, {
-        method: "GET",
-        headers: { Authorization: `Bearer ${cred.apiToken}` },
-      });
-      const body = await res.text();
-      if (!res.ok) {
-        throw new Error(`storage-broker: r2 bucket list failed: ${res.status}\n${body}`);
-      }
-      const parsed = parseJson(body, "r2 bucket list") as {
-        success?: boolean;
-        errors?: unknown;
-        result?: { buckets?: { name: string }[] };
-      };
-      // Require an explicit success envelope. A 2xx whose body is not a
-      // well-formed `success:true` response is an anomaly to surface with its
-      // body, never a silent empty bucket set.
-      if (parsed.success !== true) {
-        throw new Error(`storage-broker: r2 bucket list API error: ${body}`);
+      //
+      // The endpoint paginates: a single request returns only the first page,
+      // and the audit reads the missing remainder as "absent", under-reporting
+      // strays. Follow result_info.cursor to exhaustion instead. per_page is
+      // deliberately never sent — its default and maximum are unconfirmed, and
+      // omitting it takes whatever page size Cloudflare serves, so the loop is
+      // complete without guessing a value that could 400 the request.
+      const base = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets`;
+      const buckets: { name: string }[] = [];
+      const seen = new Set<string>();
+      let cursor: string | undefined;
+      for (;;) {
+        const url = cursor === undefined ? base : `${base}?cursor=${encodeURIComponent(cursor)}`;
+        const { parsed } = await cfApiJson(
+          fetchFn,
+          url,
+          { method: "GET", headers: { Authorization: `Bearer ${cred.apiToken}` } },
+          "r2 bucket list",
+        );
+        const page = parsed as {
+          result?: { buckets?: { name: string }[] };
+          result_info?: { cursor?: string | null };
+        };
+        for (const b of page.result?.buckets ?? []) buckets.push({ name: b.name });
+        // A missing, null, or empty cursor all mean "last page" — accept every
+        // documented last-page signal rather than depend on which one is sent.
+        const next = page.result_info?.cursor;
+        if (!next) return buckets;
+        // Any cursor seen before means the API is cycling rather than advancing,
+        // which would loop forever and re-append the same buckets each pass.
+        // Tracking every cursor (not just the last) also catches a cycle of
+        // period >= 2, which never repeats consecutively. Surface it instead of
+        // hanging the broker on an unbounded wait.
+        if (seen.has(next)) {
+          throw new Error(
+            `storage-broker: r2 bucket list returned a repeated pagination cursor: ${next}`,
+          );
+        }
+        seen.add(next);
+        cursor = next;
       }
-      return (parsed.result?.buckets ?? []).map((b) => ({ name: b.name }));
     },
     async r2Create(name) {
       await run("npx", ["wrangler", "r2", "bucket", "create", name], env);

package/payload/platform/lib/storage-broker/src/house-credential.ts

@@ -1,7 +1,11 @@
 // Reads the single account-wide Cloudflare credential from the house-only
 // config directory. This file is the one place the account-wide capability
-// lives; sub-account spawns never source it. Parses KEY=value lines without
-// polluting process.env (same discipline as reconcile-bookings' readEnvFile).
+// lives. House-only is a location convention plus the cf-token.sh caller gate,
+// NOT an OS permission: every account's session runs as the same unix user, so
+// a sub-account agent holding Bash can read this path directly. Task 1690
+// tracks the OS user separation that would make this a real boundary. Parses
+// KEY=value lines without polluting process.env (same discipline as
+// reconcile-bookings' readEnvFile).
 
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/payload/platform/plugins/cloudflare/bin/__tests__/cf-token.test.sh

@@ -298,8 +298,12 @@ setup "cfat_master_abc"
 HOUSE_DIR="$SANDBOX/acme-code/platform/config"; mkdir -p "$HOUSE_DIR"
 HOUSE_ENV="$HOUSE_DIR/cloudflare-house.env"
 ( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_master_abc" "acc123" > "$HOUSE_ENV" )
+# The caller gate (cases 18-22) admits only the house account, so this case
+# spawns as the house account.
+mkdir -p "$SANDBOX/acme-code/data/accounts/acc123"
+printf '{"role":"house"}\n' > "$SANDBOX/acme-code/data/accounts/acc123/account.json"
 of=$(mktemp); ef=$(mktemp)
-PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_BACKOFF_SECONDS=0 bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+ACCOUNT_ID=acc123 PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_BACKOFF_SECONDS=0 bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
 RC=$?; OUT=$(cat "$of"); ERR=$(cat "$ef"); rm -f "$of" "$ef"
 [ "$RC" -eq 0 ] && ok "house fallback resolves (exit=0)" || { bad "house fallback (exit=$RC)"; echo "  stderr: $ERR" >&2; }
 [ "$OUT" = "CF_PAGES_D1_TOKEN" ] && ok "house fallback stdout is canonical key" || bad "house out='$OUT'"
@@ -327,8 +331,9 @@ teardown
 
 # 15. fail-closed: stripped per-account file and NO house env reachable (no
 #     PLATFORM_ROOT, no CF_HOUSE_ENV) -> non-zero, no mint, and a message that
-#     names the missing credential source. This is the sub-account posture: a
-#     sub-account spawn carries no PLATFORM_ROOT, so it can never self-resolve.
+#     names the missing credential source. Reaching this branch means no house
+#     credential was found at all; the caller gate (cases 18-22) is what decides
+#     whether a reachable house credential may actually be used.
 setup "cfat_master_abc"
 ( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
 of=$(mktemp); ef=$(mktemp)
@@ -345,8 +350,13 @@ setup "cfat_master_abc"
 ( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
 OVERRIDE="$SANDBOX/acme-code/override-house.env"
 ( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_master_abc" "acc123" > "$OVERRIDE" )
+# The caller gate admits only the house account, and locates the accounts dir
+# from PLATFORM_ROOT. The PLATFORM_ROOT-derived house path does not exist here,
+# so a pass still proves CF_HOUSE_ENV won.
+mkdir -p "$SANDBOX/acme-code/data/accounts/acc123"
+printf '{"role":"house"}\n' > "$SANDBOX/acme-code/data/accounts/acc123/account.json"
 of=$(mktemp); ef=$(mktemp)
-CF_HOUSE_ENV="$OVERRIDE" CF_BACKOFF_SECONDS=0 bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+ACCOUNT_ID=acc123 PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_HOUSE_ENV="$OVERRIDE" CF_BACKOFF_SECONDS=0 bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
 RC=$?; ERR=$(cat "$ef"); rm -f "$of" "$ef"
 [ "$RC" -eq 0 ] && ok "CF_HOUSE_ENV override resolves (exit=0)" || bad "override (exit=$RC): $ERR"
 grep -q "^CF_PAGES_D1_TOKEN=" "$OVERRIDE" && ok "override env received the minted token" || bad "override not persisted"
@@ -377,5 +387,136 @@ grep -q "^CF_CALENDAR_D1_TOKEN=" "$SECRETS" && ok "calendar-d1 token persisted"
 no_leak "calendar-d1 mint"
 teardown
 
+# ---------------------------------------------------------------------------
+# Caller gate (Task 1646). The house env carries an account-wide master, so the
+# fallback must fire only for the house account. "House" mirrors
+# resolveHouseOrSoleAccountId: account.json role:"house", or the sole account.
+# The gate reads the caller's own account.json under
+# $(dirname $PLATFORM_ROOT)/data/accounts/$ACCOUNT_ID/, which the sandbox
+# layout already matches ($SANDBOX/acme-code/data/accounts/acc123).
+
+# 18. a sub-account caller must NOT resolve the house master: deny, non-zero,
+#     no mint, and nothing persisted to either file.
+setup "cfat_master_abc"
+( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
+ADIR="$SANDBOX/acme-code/data/accounts"
+mkdir -p "$ADIR/acc123" "$ADIR/house1"
+printf '{"role":"client"}\n' > "$ADIR/acc123/account.json"
+printf '{"role":"house"}\n'  > "$ADIR/house1/account.json"
+HOUSE_DIR="$SANDBOX/acme-code/platform/config"; mkdir -p "$HOUSE_DIR"
+HOUSE_ENV="$HOUSE_DIR/cloudflare-house.env"
+( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_master_abc" "acc123" > "$HOUSE_ENV" )
+of=$(mktemp); ef=$(mktemp)
+ACCOUNT_ID=acc123 PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_BACKOFF_SECONDS=0 \
+  bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+RC=$?; OUT=$(cat "$of"); ERR=$(cat "$ef"); rm -f "$of" "$ef"
+[ "$RC" -ne 0 ] && ok "sub-account denied the house master (exit=$RC)" || bad "sub-account NOT denied (exit=$RC)"
+grep -q -- "-X POST" "$SANDBOX/curl.log" && bad "minted for a sub-account" || ok "no mint for a sub-account"
+grep -q "^CF_PAGES_D1_TOKEN=" "$HOUSE_ENV" && bad "sub-account wrote a token to house env" || ok "house env untouched on deny"
+grep -q "^CF_PAGES_D1_TOKEN=" "$SECRETS" && bad "sub-account wrote a token to its own file" || ok "per-account file untouched on deny"
+echo "$ERR" | grep -q "action=deny" && ok "deny lifeline emitted" || bad "no deny lifeline: $ERR"
+echo "$ERR" | grep -q "reason=not-house" && ok "deny lifeline names the reason" || bad "no reason: $ERR"
+no_leak "sub-account deny"
+teardown
+
+# 19. the house account (role:"house") is allowed, preserving house-run hosting.
+setup "cfat_master_abc"
+( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
+ADIR="$SANDBOX/acme-code/data/accounts"; mkdir -p "$ADIR/acc123" "$ADIR/other1"
+printf '{"role":"house"}\n'  > "$ADIR/acc123/account.json"
+printf '{"role":"client"}\n' > "$ADIR/other1/account.json"
+HOUSE_DIR="$SANDBOX/acme-code/platform/config"; mkdir -p "$HOUSE_DIR"
+HOUSE_ENV="$HOUSE_DIR/cloudflare-house.env"
+( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_master_abc" "acc123" > "$HOUSE_ENV" )
+of=$(mktemp); ef=$(mktemp)
+ACCOUNT_ID=acc123 PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_BACKOFF_SECONDS=0 \
+  bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+RC=$?; OUT=$(cat "$of"); ERR=$(cat "$ef"); rm -f "$of" "$ef"
+[ "$RC" -eq 0 ] && ok "house caller allowed (exit=0)" || { bad "house caller denied (exit=$RC)"; echo "  stderr: $ERR" >&2; }
+[ "$OUT" = "CF_PAGES_D1_TOKEN" ] && ok "house caller stdout is canonical key" || bad "house caller out='$OUT'"
+grep -q "^CF_PAGES_D1_TOKEN=" "$HOUSE_ENV" && ok "house caller persisted to house env" || bad "house caller not persisted"
+teardown
+
+# 20. the sole unlabelled account IS the house account (resolveHouseOrSoleAccountId's
+#     second arm) -> allowed.
+setup "cfat_master_abc"
+( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
+ADIR="$SANDBOX/acme-code/data/accounts"; mkdir -p "$ADIR/acc123"
+printf '{"name":"only"}\n' > "$ADIR/acc123/account.json"
+HOUSE_DIR="$SANDBOX/acme-code/platform/config"; mkdir -p "$HOUSE_DIR"
+HOUSE_ENV="$HOUSE_DIR/cloudflare-house.env"
+( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_master_abc" "acc123" > "$HOUSE_ENV" )
+of=$(mktemp); ef=$(mktemp)
+ACCOUNT_ID=acc123 PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_BACKOFF_SECONDS=0 \
+  bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+RC=$?; ERR=$(cat "$ef"); rm -f "$of" "$ef"
+[ "$RC" -eq 0 ] && ok "sole unlabelled account allowed (exit=0)" || bad "sole account denied (exit=$RC): $ERR"
+teardown
+
+# 21. unset ACCOUNT_ID fails closed.
+setup "cfat_master_abc"
+( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
+ADIR="$SANDBOX/acme-code/data/accounts"; mkdir -p "$ADIR/acc123" "$ADIR/house1"
+printf '{"role":"client"}\n' > "$ADIR/acc123/account.json"
+printf '{"role":"house"}\n'  > "$ADIR/house1/account.json"
+HOUSE_DIR="$SANDBOX/acme-code/platform/config"; mkdir -p "$HOUSE_DIR"
+( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_master_abc" "acc123" > "$HOUSE_DIR/cloudflare-house.env" )
+of=$(mktemp); ef=$(mktemp)
+env -u ACCOUNT_ID PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_BACKOFF_SECONDS=0 \
+  bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+RC=$?; ERR=$(cat "$ef"); rm -f "$of" "$ef"
+[ "$RC" -ne 0 ] && ok "unset ACCOUNT_ID fails closed (exit=$RC)" || bad "unset ACCOUNT_ID allowed (exit=$RC)"
+echo "$ERR" | grep -q "reason=no-account-id" && ok "no-account-id reason surfaced" || bad "reason: $ERR"
+teardown
+
+# 22. a caller whose account.json is absent fails closed.
+setup "cfat_master_abc"
+( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
+ADIR="$SANDBOX/acme-code/data/accounts"; mkdir -p "$ADIR/acc123" "$ADIR/house1"
+printf '{"role":"house"}\n' > "$ADIR/house1/account.json"
+HOUSE_DIR="$SANDBOX/acme-code/platform/config"; mkdir -p "$HOUSE_DIR"
+( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_master_abc" "acc123" > "$HOUSE_DIR/cloudflare-house.env" )
+of=$(mktemp); ef=$(mktemp)
+ACCOUNT_ID=acc123 PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_BACKOFF_SECONDS=0 \
+  bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+RC=$?; ERR=$(cat "$ef"); rm -f "$of" "$ef"
+[ "$RC" -ne 0 ] && ok "missing account.json fails closed (exit=$RC)" || bad "missing account.json allowed"
+echo "$ERR" | grep -q "reason=no-account-json" && ok "no-account-json reason surfaced" || bad "reason: $ERR"
+teardown
+
+# 23. two role:"house" accounts is corruption: resolveAccountDir returns null
+#     rather than picking one, so the gate denies rather than trusting a
+#     self-declared house.
+setup "cfat_master_abc"
+( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
+ADIR="$SANDBOX/acme-code/data/accounts"; mkdir -p "$ADIR/acc123" "$ADIR/house2"
+printf '{"role":"house"}\n' > "$ADIR/acc123/account.json"
+printf '{"role":"house"}\n' > "$ADIR/house2/account.json"
+HOUSE_DIR="$SANDBOX/acme-code/platform/config"; mkdir -p "$HOUSE_DIR"
+( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_master_abc" "acc123" > "$HOUSE_DIR/cloudflare-house.env" )
+of=$(mktemp); ef=$(mktemp)
+ACCOUNT_ID=acc123 PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_BACKOFF_SECONDS=0 \
+  bash "$HELPER" pages "$SECRETS" >"$of" 2>"$ef"
+RC=$?; ERR=$(cat "$ef"); rm -f "$of" "$ef"
+[ "$RC" -ne 0 ] && ok "two houses fails closed (exit=$RC)" || bad "two houses allowed (exit=$RC)"
+echo "$ERR" | grep -q "reason=multiple-house-accounts" && ok "multiple-house reason surfaced" || bad "reason: $ERR"
+teardown
+
+# 24. the deny message names the scope actually requested, not a fixed list.
+setup "cfat_master_abc"
+( umask 077; printf 'CLOUDFLARE_ACCOUNT_ID=%s\n' "acc123" > "$SECRETS" )
+ADIR="$SANDBOX/acme-code/data/accounts"; mkdir -p "$ADIR/acc123" "$ADIR/house1"
+printf '{"role":"client"}\n' > "$ADIR/acc123/account.json"
+printf '{"role":"house"}\n'  > "$ADIR/house1/account.json"
+HOUSE_DIR="$SANDBOX/acme-code/platform/config"; mkdir -p "$HOUSE_DIR"
+( umask 077; printf 'CLOUDFLARE_API_TOKEN=%s\nCLOUDFLARE_ACCOUNT_ID=%s\n' "cfat_master_abc" "acc123" > "$HOUSE_DIR/cloudflare-house.env" )
+of=$(mktemp); ef=$(mktemp)
+ACCOUNT_ID=acc123 PLATFORM_ROOT="$SANDBOX/acme-code/platform" CF_BACKOFF_SECONDS=0 \
+  bash "$HELPER" dns "$SECRETS" >"$of" 2>"$ef"
+RC=$?; ERR=$(cat "$ef"); rm -f "$of" "$ef"
+echo "$ERR" | grep -q "scope=dns" && ok "deny lifeline names scope=dns" || bad "lifeline scope: $ERR"
+echo "$ERR" | grep -qF "'dns' scope" && ok "deny message names the dns scope" || bad "deny message scope: $ERR"
+teardown
+
 echo "----"; echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]

package/payload/platform/plugins/cloudflare/bin/cf-token.sh

@@ -32,10 +32,63 @@ case "$scope" in pages|d1|storage|calendar-d1|dns|access) ;; *) die "unknown sco
 # was used, surfaced on every lifeline so an operator can see hosting is on the
 # isolated path, not a stray per-account token. Single-tenant installs keep the
 # master in the per-account file, so no fallback fires and behaviour is unchanged.
-# The house env is locatable only from an admin/specialist spawn (PLATFORM_ROOT is
-# stamped there, never on a plain sub-account spawn), so this grants a sub-account
-# no self-hosting capability.
+#
+# The fallback is gated on the caller being the house account: the master is
+# account-wide (D1+R2 Edit and API Tokens Write), so handing it to a client
+# sub-account would defeat the 1631 storage boundary as well as leak Pages/DNS.
+# A specialist spawn is NOT a trust tier - it runs under whichever account owns
+# the session, and carries PLATFORM_ROOT exactly as an admin spawn does
+# (pty-spawner.ts:2174), so spawn shape cannot stand in for caller identity.
+#
+# WHAT THIS GATE IS AND IS NOT. It closes the SANCTIONED path: the platform no
+# longer mints an account-wide token on a sub-account's behalf through its own
+# supported seam. It is NOT a defence against a compromised or prompt-injected
+# specialist. Every account's session runs as the SAME OS user (no uid/gid is
+# dropped at spawn) and the house env path is deterministic, so an agent holding
+# Bash can read that file directly or export a false ACCOUNT_ID. Real enforcement
+# needs OS user separation; until that lands this is a boundary of intent, not of
+# permission. Do not cite this gate as proof a sub-account cannot reach the
+# master.
+#
+# "House" is an exact shell mirror of resolveAccountDir + isHouseAccount
+# (platform/services/claude-session-manager/src/config.ts:238-323) -- the same
+# predicate the spawn path uses to decide HOUSE_ADMIN_SCOPE, so the gate and
+# cross-account authority can never disagree about which account is the house.
+# Its three arms: exactly one role:"house" account (the caller must be it), no
+# house plus a single account (the caller is it), and anything else -- including
+# two or more role:"house" accounts -- is corruption and denies rather than
+# picking one silently. An account dir counts when it holds a parseable
+# account.json; like resolveAccountDir, the UUID shape of the dir name is not
+# re-validated here (provisioning enforces it).
 file_has_master() { grep -Eq '^[[:space:]]*CLOUDFLARE_API_TOKEN=.+' "$1" 2>/dev/null; }
+
+# deny_reason is deliberately global: the caller reads it for the lifeline.
+# Every other variable is local, so this function cannot clobber the scope
+# table's state (suffix/key/names/res/legacy/regexes/zone_scoped/mtag).
+deny_reason=""
+caller_is_house() {
+  local adir cfg role houses cands d r
+  deny_reason=""
+  [ -n "${ACCOUNT_ID:-}" ] || { deny_reason="no-account-id"; return 1; }
+  [ -n "${PLATFORM_ROOT:-}" ] || { deny_reason="no-platform-root"; return 1; }
+  adir="$(dirname "$PLATFORM_ROOT")/data/accounts"
+  cfg="${adir}/${ACCOUNT_ID}/account.json"
+  [ -r "$cfg" ] || { deny_reason="no-account-json"; return 1; }
+  role=$(jq -r '.role // empty' "$cfg" 2>/dev/null) || { deny_reason="unparseable-account-json"; return 1; }
+  houses=0; cands=0
+  for d in "$adir"/*/; do
+    [ -r "${d}account.json" ] || continue
+    cands=$((cands+1))
+    r=$(jq -r '.role // empty' "${d}account.json" 2>/dev/null) || r=""
+    [ "$r" = "house" ] && houses=$((houses+1))
+  done
+  if [ "$houses" -gt 1 ]; then deny_reason="multiple-house-accounts"; return 1; fi
+  if [ "$houses" -eq 1 ] && [ "$role" = "house" ]; then return 0; fi
+  if [ "$houses" -eq 0 ] && [ "$cands" -eq 1 ]; then return 0; fi
+  deny_reason="not-house"
+  return 1
+}
+
 src=account
 if ! file_has_master "$secrets"; then
   house="${CF_HOUSE_ENV:-}"
@@ -43,6 +96,10 @@ if ! file_has_master "$secrets"; then
     house="${PLATFORM_ROOT}/config/cloudflare-house.env"
   fi
   if [ -n "$house" ] && [ -r "$house" ] && file_has_master "$house"; then
+    if ! caller_is_house; then
+      echo "[cf-token] op=resolve scope=${scope} master=house action=deny result=error code=0 src=house caller=${ACCOUNT_ID:-unset} reason=${deny_reason}" >&2
+      die "account '${ACCOUNT_ID:-unset}' is not the house account, so it cannot mint the '${scope}' scope from the account-wide Cloudflare master, which is house-only. Run this from the house admin session."
+    fi
     secrets="$house"; src=house
   else
     echo "[cf-token] op=resolve scope=${scope} master=none action=resolve result=error code=0 src=account" >&2

package/payload/platform/plugins/cloudflare/references/api.md

@@ -53,7 +53,7 @@ chmod 600 "${SECRETS_DIR}/cloudflare.env"
 
 ### Multi-tenant installs — the master lives house-only
 
-The account-scoped storage above is correct for a single-tenant install (one Cloudflare account, one client). On a **multi-client install** (many client sub-accounts sharing one Cloudflare account, for example SiteDesk), an account-wide token in a sub-account's `cloudflare.env` lets that sub-account reach every other client's D1 and R2. There, the master lives house-only at `${PLATFORM_ROOT}/config/cloudflare-house.env` (a location no sub-account spawn sources), per-account `cloudflare.env` files carry no account-wide token, and a sub-account reaches D1/R2 only through the storage broker, which scopes every operation to the caller's account. See [`../../../../.docs/cloudflare-storage-isolation.md`](../../../../.docs/cloudflare-storage-isolation.md). The per-scope DNS/Pages/Access minting below stays admin-run, and its mint-or-reuse mechanism is unchanged; the one difference on a multi-tenant install is the source file. Because the per-account `cloudflare.env` no longer carries the master, `cf-token.sh` falls back to the house credential (`${PLATFORM_ROOT}/config/cloudflare-house.env`) for these scopes, mints and persists the scope token there, and reports `src=house` on its `[cf-token]` lifeline. That fallback is reachable only from an admin/specialist spawn (which alone carries `PLATFORM_ROOT`), so a sub-account still cannot self-resolve a hosting token.
+The account-scoped storage above is correct for a single-tenant install (one Cloudflare account, one client). On a **multi-client install** (many client sub-accounts sharing one Cloudflare account, for example SiteDesk), an account-wide token in a sub-account's `cloudflare.env` lets that sub-account reach every other client's D1 and R2. There, the master lives house-only at `${PLATFORM_ROOT}/config/cloudflare-house.env` (a location no sub-account spawn sources), per-account `cloudflare.env` files carry no account-wide token, and a sub-account reaches D1/R2 only through the storage broker, which scopes every operation to the caller's account. See [`../../../../.docs/cloudflare-storage-isolation.md`](../../../../.docs/cloudflare-storage-isolation.md). The per-scope DNS/Pages/Access minting below stays admin-run, and its mint-or-reuse mechanism is unchanged; the one difference on a multi-tenant install is the source file. Because the per-account `cloudflare.env` no longer carries the master, `cf-token.sh` falls back to the house credential (`${PLATFORM_ROOT}/config/cloudflare-house.env`) for these scopes, mints and persists the scope token there, and reports `src=house` on its `[cf-token]` lifeline. `cf-token.sh` gates that fallback on the caller being the house account (its `account.json` carries `role:"house"`, or it is the sole account), so the sanctioned path never mints a hosting token for a client sub-account; a denied caller gets an `action=deny` lifeline naming the reason. This gate is a boundary of intent, not of permission: every account's session runs as the same unix user and the house env path is deterministic, so an agent holding `Bash` can read the master directly or export a false `ACCOUNT_ID`. Do not cite the gate as proof a sub-account cannot reach the master. OS user separation is tracked separately.
 
 Load the master for a mint call:
 

package/payload/platform/plugins/cloudflare/skills/cloudflare/SKILL.md

@@ -29,7 +29,7 @@ This is the entry point for every Cloudflare task on the install. Pick the opera
 
 Neither the master token nor any per-scope token is ever written into a project tree, committed, or echoed into chat — the per-scope tokens persist only in the account-scoped secrets file, never in a deployable project tree.
 
-On a multi-client install where client sub-accounts share one Cloudflare account, the master lives house-only at `config/cloudflare-house.env` and sub-account D1/R2 data work goes through the storage broker, not raw `wrangler`. This skill's tunnel operations are per-brand isolated and unchanged. The admin-run scopes (Pages, DNS, Access) stay admin/house-run: because the per-account secrets file no longer carries the master, `cf-token.sh` resolves and mints those scope tokens against the house credential (`config/cloudflare-house.env`) and persists them there, surfacing `src=house` on its `[cf-token]` lifeline. Hosting a client site to Pages is therefore an admin/house action, never a sub-account one, consistent with the isolation posture. The house credential in `config/cloudflare-house.env` is a **minter**, not a data token, on **every** install, not only multi-tenant ones: the booking calendar and storage broker read it house-only fleet-wide (no per-account fallback), so they mint their own account-scoped data tokens from that minter — `CF_STORAGE_TOKEN` (D1 + R2) and `CF_CALENDAR_D1_TOKEN` (D1) — rather than use the minter directly, which returns `10000` on D1/R2. Multi-tenant installs add per-account isolation on top of this same file; single-tenant installs simply read their calendar/broker credential here. See `references/api.md` and `.docs/cloudflare-storage-isolation.md`.
+On a multi-client install where client sub-accounts share one Cloudflare account, the master lives house-only at `config/cloudflare-house.env` and sub-account D1/R2 data work goes through the storage broker, not raw `wrangler`. This skill's tunnel operations are per-brand isolated and unchanged. The admin-run scopes (Pages, DNS, Access) stay admin/house-run: because the per-account secrets file no longer carries the master, `cf-token.sh` resolves and mints those scope tokens against the house credential (`config/cloudflare-house.env`) and persists them there, surfacing `src=house` on its `[cf-token]` lifeline. Hosting a client site to Pages is therefore an admin/house action: `cf-token.sh` mints the Pages/DNS/Access scopes only for the house account (or the sole account on a single-tenant install) and denies any other caller with an `action=deny` lifeline. Run deploys from the house admin session. The house credential in `config/cloudflare-house.env` is a **minter**, not a data token, on **every** install, not only multi-tenant ones: the booking calendar and storage broker read it house-only fleet-wide (no per-account fallback), so they mint their own account-scoped data tokens from that minter — `CF_STORAGE_TOKEN` (D1 + R2) and `CF_CALENDAR_D1_TOKEN` (D1) — rather than use the minter directly, which returns `10000` on D1/R2. Multi-tenant installs add per-account isolation on top of this same file; single-tenant installs simply read their calendar/broker credential here. See `references/api.md` and `.docs/cloudflare-storage-isolation.md`.
 
 ### Resolve the per-scope token before any `wrangler` / API call (binding)