@rubytech/create-maxy-code 0.1.458 → 0.1.459

package/payload/platform/scripts/logs-read.sh

@@ -627,7 +627,7 @@ tail_mode() {
 # non-interactive SSH PATH. argv[1] selects the mode (timeline|scan); the
 # program is fed via -c so logs-read.sh stays a single self-contained file.
 JSONL_PY=$(cat <<'PY'
-import sys, os, re, json, glob
+import sys, os, re, json, glob, collections
 
 MODE = sys.argv[1] if len(sys.argv) > 1 else ''
 
@@ -776,7 +776,40 @@ def subagent_dir(projects_root, uuid):
 # failure (the task's target, flagged 'SUBAGENT ERROR' and counted) from the
 # parent session's own tool error (shown plainly, never counted as a subagent
 # error). Returns the count of SUBAGENT errors found (0 for the parent).
-def collect_events(path, source, events, is_sub):
+# A harness rejection is a call that NEVER REACHED its tool: the CLI refused the
+# model's arguments, so no MCP dispatch happened and no plugin line exists
+# anywhere (not in server.log, not in mcp-<server>-<sessionId>.log, not in
+# mcp-lifeline). Rendering it as a plain tool error reads as "the tool is broken"
+# when the tool was never called -- the confusion that produced a false
+# customer-facing fault report (task 1692).
+#
+# InputValidationError has two sub-classes and BOTH are rejections, because
+# neither dispatches. The label says 'never dispatched', not 'malformed', because
+# only the first is malformed:
+#   A. "...could not be parsed as JSON" -- args unparseable; the tool_use block
+#      carries __unparsedToolInput. 52 of 170 measured 2026-07-16.
+#   B. "...failed due to the following issue(s)" -- the JSON parsed fine and
+#      violated the schema (wrong type, missing required). No __unparsedToolInput.
+#      118 of 170, so the majority; calling it 'malformed' would be wrong.
+#
+# This is the ONLY class relabelled. Deliberately NOT covered, all of which keep
+# rendering as '‼ tool error':
+#   'Error: No such tool available:' / 'Unknown skill:' -- different fault, and
+#      the missing-tool case already has a PostToolUse hook (mcp-tool-missing.sh)
+#   'MCP error -32602'                -- reached the server; its SDK rejected it
+#   every unwrapped is_error payload  -- the tool ran and returned a failure
+#
+# The <tool_use_error> wrapper alone is NOT a rejection discriminator: measured
+# 2026-07-16 across 733 SiteDesk transcripts it wraps mostly built-in tools that
+# RAN and failed ('File has not been read yet' x60, 'File has been modified
+# since read' x16). Match the error class, not the wrapper.
+def is_rejection(text):
+    if not isinstance(text, str):
+        return False
+    return text.lstrip().startswith('<tool_use_error>InputValidationError:')
+
+
+def collect_events(path, source, events, is_sub, rejects=None):
     rows = load_jsonl(path)
     id2tool = {}
     for r in rows:
@@ -812,10 +845,18 @@ def collect_events(path, source, events, is_sub):
                 for b in content:
                     if isinstance(b, dict) and b.get('type') == 'tool_result' and b.get('is_error'):
                         tool = id2tool.get(b.get('tool_use_id'))
-                        flag = '‼ SUBAGENT ERROR' if is_sub else '‼ tool error'
-                        events.append((ts, source, 'error', '%s  tool=%s  error="%s"' % (flag, tool or '?', clip(result_text(b, r), 200))))
-                        if is_sub:
-                            n_err += 1
+                        body = result_text(b, r)
+                        if is_rejection(body):
+                            # Not a tool failure: the call never ran. Never
+                            # counted as a subagent error for the same reason.
+                            flag = '‼ REJECTED (never dispatched)'
+                            if rejects is not None:
+                                rejects[tool or '?'] += 1
+                        else:
+                            flag = '‼ SUBAGENT ERROR' if is_sub else '‼ tool error'
+                            if is_sub:
+                                n_err += 1
+                        events.append((ts, source, 'error', '%s  tool=%s  error="%s"' % (flag, tool or '?', clip(body, 200))))
             elif isinstance(content, str) and content.strip():
                 events.append((ts, source, 'text', 'user: ' + clip(content, 160)))
     return n_err
@@ -826,18 +867,25 @@ def timeline(projects_root, sessions_dir, key):
         sys.stderr.write('-- trailer: key=%s resolved=no reason=%s\n' % (key, via))
         return 1
     events = []
+    rejects = collections.Counter()
     if parent_path and os.path.exists(parent_path):
-        collect_events(parent_path, 'parent', events, False)
+        collect_events(parent_path, 'parent', events, False, rejects)
     sdir = subagent_dir(projects_root, uuid)
     sub_count = err_count = 0
     if sdir:
         for af in sorted(glob.glob(os.path.join(sdir, 'agent-*.jsonl'))):
             sub_count += 1
-            err_count += collect_events(af, agent_type(af) or os.path.basename(af)[:-6], events, True)
+            err_count += collect_events(af, agent_type(af) or os.path.basename(af)[:-6], events, True, rejects)
     events.sort(key=lambda e: e[0])
     print('# session %s  (resolved via %s)' % (uuid, via))
     print('#   parent:    %s' % (parent_path or '(no parent transcript on disk)'))
     print('#   subagents: %d   subagent-errors: %d' % (sub_count, err_count))
+    # Repetition is the diagnostic fact: one fat-fingered call is a typo, N
+    # identical ones against a single tool is a wedged loop. Counting it here
+    # makes that one greppable line instead of N unrelated ones.
+    if rejects:
+        top = '  '.join('%s x%d' % (t, n) for t, n in rejects.most_common())
+        print('#   rejections: %d  (%s)' % (sum(rejects.values()), top))
     print('')
     for ts, source, _kind, text in events:
         print('%s  [%s] %s' % (ts or ('-' * 24), source, text))
@@ -871,7 +919,13 @@ def scan(projects_root, limit):
             if isinstance(content, list):
                 for b in content:
                     if isinstance(b, dict) and b.get('type') == 'tool_result' and b.get('is_error'):
-                        errs.append((id2tool.get(b.get('tool_use_id')), result_text(b, r)))
+                        body = result_text(b, r)
+                        # A rejection is not a subagent failure: the subagent did
+                        # not fail, a call was never dispatched. Counting it here
+                        # would re-create the conflation the timeline just fixed.
+                        if is_rejection(body):
+                            continue
+                        errs.append((id2tool.get(b.get('tool_use_id')), body))
         if errs:
             parent_uuid = os.path.basename(os.path.dirname(os.path.dirname(af)))
             findings.append((af, agent_type(af), parent_uuid, errs))

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAuB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAgStD,CAAA"}
+{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAuB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAoStD,CAAA"}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js

@@ -276,6 +276,10 @@ export const CANONICAL_MAXY_TOOL_NAMES = [
     "mcp__plugin_storage-broker_storage-broker__storage-d1-query",
     "mcp__plugin_storage-broker_storage-broker__storage-r2-bucket-create",
     "mcp__plugin_storage-broker_storage-broker__storage-r2-bucket-list",
+    "mcp__plugin_storage-broker_storage-broker__storage-r2-object-delete",
+    "mcp__plugin_storage-broker_storage-broker__storage-r2-object-get",
+    "mcp__plugin_storage-broker_storage-broker__storage-r2-object-list",
+    "mcp__plugin_storage-broker_storage-broker__storage-r2-object-put",
     "mcp__plugin_telegram_telegram__message",
     "mcp__plugin_telegram_telegram__message-history",
     "mcp__plugin_telegram_telegram__telegram-webhook-register",

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-tool-names.generated.js","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,kEAAkE;AAClE,yDAAyD;AACzD,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO;IACP,KAAK;IACL,SAAS;IACT,WAAW;IACX,UAAU;IACV,OAAO;IACP,YAAY;IACZ,OAAO;IACP,cAAc;IACd,UAAU;IACV,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,cAAc;IACd,UAAU;IACV,MAAM;IACN,WAAW;CACZ,CAAA;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,yCAAyC;IACzC,yCAAyC;IACzC,kDAAkD;IAClD,sDAAsD;IACtD,yCAAyC;IACzC,yCAAyC;IACzC,uCAAuC;IACvC,wCAAwC;IACxC,iDAAiD;IACjD,yCAAyC;IACzC,iDAAiD;IACjD,yCAAyC;IACzC,sCAAsC;IACtC,yCAAyC;IACzC,wCAAwC;IACxC,oCAAoC;IACpC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,2CAA2C;IAC3C,4CAA4C;IAC5C,qCAAqC;IACrC,yCAAyC;IACzC,4CAA4C;IAC5C,oCAAoC;IACpC,sCAAsC;IACtC,0CAA0C;IAC1C,uCAAuC;IACvC,sCAAsC;IACtC,sDAAsD;IACtD,mDAAmD;IACnD,6CAA6C;IAC7C,wCAAwC;IACxC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,sCAAsC;IACtC,wCAAwC;IACxC,+BAA+B;IAC/B,qCAAqC;IACrC,sCAAsC;IACtC,yCAAyC;IACzC,4CAA4C;IAC5C,uDAAuD;IACvD,+CAA+C;IAC/C,2CAA2C;IAC3C,gDAAgD;IAChD,oDAAoD;IACpD,4CAA4C;IAC5C,+CAA+C;IAC/C,+CAA+C;IAC/C,gDAAgD;IAChD,6CAA6C;IAC7C,6CAA6C;IAC7C,iDAAiD;IACjD,oDAAoD;IACpD,+CAA+C;IAC/C,2CAA2C;IAC3C,2CAA2C;IAC3C,+CAA+C;IAC/C,iDAAiD;IACjD,uDAAuD;IACvD,iDAAiD;IACjD,qDAAqD;IACrD,+CAA+C;IAC/C,+CAA+C;IAC/C,8CAA8C;IAC9C,+CAA+C;IAC/C,6CAA6C;IAC7C,+CAA+C;IAC/C,+CAA+C;IAC/C,6CAA6C;IAC7C,6CAA6C;IAC7C,uCAAuC;IACvC,sCAAsC;IACtC,2CAA2C;IAC3C,2CAA2C;IAC3C,sCAAsC;IACtC,2CAA2C;IAC3C,4CAA4C;IAC5C,uCAAuC;IACvC,4CAA4C;IAC5C,8CAA8C;IAC9C,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,+CAA+C;IAC/C,qDAAqD;IACrD,sDAAsD;IACtD,uDAAuD;IACvD,wDAAwD;IACxD,sDAAsD;IACtD,mDAAmD;IACnD,oDAAoD;IACpD,sDAAsD;IACtD,iEAAiE;IACjE,2DAA2D;IAC3D,yDAAyD;IACzD,yDAAyD;IACzD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,sDAAsD;IACtD,uDAAuD;IACvD,2DAA2D;IAC3D,0DAA0D;IAC1D,wDAAwD;IACxD,qDAAqD;IACrD,sDAAsD;IACtD,gEAAgE;IAChE,qDAAqD;IACrD,oDAAoD;IACpD,iDAAiD;IACjD,kDAAkD;IAClD,wDAAwD;IACxD,oDAAoD;IACpD,wDAAwD;IACxD,wDAAwD;IACxD,qDAAqD;IACrD,uDAAuD;IACvD,sDAAsD;IACtD,mDAAmD;IACnD,oDAAoD;IACpD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,qDAAqD;IACrD,0DAA0D;IAC1D,wDAAwD;IACxD,0DAA0D;IAC1D,sDAAsD;IACtD,sDAAsD;IACtD,sDAAsD;IACtD,mDAAmD;IACnD,8DAA8D;IAC9D,sDAAsD;IACtD,iEAAiE;IACjE,kEAAkE;IAClE,6DAA6D;IAC7D,8CAA8C;IAC9C,wDAAwD;IACxD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,wDAAwD;IACxD,wCAAwC;IACxC,wCAAwC;IACxC,iDAAiD;IACjD,wDAAwD;IACxD,0DAA0D;IAC1D,0CAA0C;IAC1C,6CAA6C;IAC7C,wCAAwC;IACxC,mDAAmD;IACnD,+CAA+C;IAC/C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,8CAA8C;IAC9C,oDAAoD;IACpD,kDAAkD;IAClD,+CAA+C;IAC/C,mDAAmD;IACnD,2CAA2C;IAC3C,qDAAqD;IACrD,+CAA+C;IAC/C,sDAAsD;IACtD,gDAAgD;IAChD,2CAA2C;IAC3C,gDAAgD;IAChD,0CAA0C;IAC1C,0CAA0C;IAC1C,kDAAkD;IAClD,yCAAyC;IACzC,kDAAkD;IAClD,2CAA2C;IAC3C,yCAAyC;IACzC,2CAA2C;IAC3C,4CAA4C;IAC5C,mDAAmD;IACnD,uDAAuD;IACvD,4DAA4D;IAC5D,sDAAsD;IACtD,sDAAsD;IACtD,qDAAqD;IACrD,wDAAwD;IACxD,oDAAoD;IACpD,uDAAuD;IACvD,sDAAsD;IACtD,oDAAoD;IACpD,4CAA4C;IAC5C,iDAAiD;IACjD,iDAAiD;IACjD,sDAAsD;IACtD,kDAAkD;IAClD,sDAAsD;IACtD,gDAAgD;IAChD,uDAAuD;IACvD,iDAAiD;IACjD,kDAAkD;IAClD,gDAAgD;IAChD,mDAAmD;IACnD,mDAAmD;IACnD,6DAA6D;IAC7D,2DAA2D;IAC3D,2DAA2D;IAC3D,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;IAC/D,0DAA0D;IAC1D,6DAA6D;IAC7D,6DAA6D;IAC7D,8DAA8D;IAC9D,8DAA8D;IAC9D,8DAA8D;IAC9D,qDAAqD;IACrD,sDAAsD;IACtD,2DAA2D;IAC3D,iDAAiD;IACjD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,oDAAoD;IACpD,iEAAiE;IACjE,mDAAmD;IACnD,wDAAwD;IACxD,iDAAiD;IACjD,wDAAwD;IACxD,kDAAkD;IAClD,oDAAoD;IACpD,iDAAiD;IACjD,8DAA8D;IAC9D,4DAA4D;IAC5D,6DAA6D;IAC7D,qEAAqE;IACrE,mEAAmE;IACnE,wCAAwC;IACxC,gDAAgD;IAChD,0DAA0D;IAC1D,sCAAsC;IACtC,6DAA6D;IAC7D,kEAAkE;IAClE,8DAA8D;IAC9D,oEAAoE;IACpE,0DAA0D;IAC1D,kDAAkD;IAClD,gDAAgD;IAChD,kEAAkE;IAClE,uDAAuD;IACvD,oDAAoD;IACpD,oDAAoD;IACpD,qDAAqD;IACrD,oDAAoD;IACpD,kDAAkD;IAClD,oDAAoD;IACpD,gDAAgD;IAChD,yCAAyC;IACzC,uCAAuC;IACvC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,qCAAqC;IACrC,yCAAyC;IACzC,qCAAqC;IACrC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,kCAAkC;IAClC,mCAAmC;IACnC,oCAAoC;IACpC,oCAAoC;IACpC,kDAAkD;IAClD,kDAAkD;IAClD,mDAAmD;IACnD,+CAA+C;IAC/C,gDAAgD;IAChD,gDAAgD;IAChD,kDAAkD;IAClD,oDAAoD;CACrD,CAAA"}
+{"version":3,"file":"canonical-tool-names.generated.js","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,kEAAkE;AAClE,yDAAyD;AACzD,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO;IACP,KAAK;IACL,SAAS;IACT,WAAW;IACX,UAAU;IACV,OAAO;IACP,YAAY;IACZ,OAAO;IACP,cAAc;IACd,UAAU;IACV,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,cAAc;IACd,UAAU;IACV,MAAM;IACN,WAAW;CACZ,CAAA;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,yCAAyC;IACzC,yCAAyC;IACzC,kDAAkD;IAClD,sDAAsD;IACtD,yCAAyC;IACzC,yCAAyC;IACzC,uCAAuC;IACvC,wCAAwC;IACxC,iDAAiD;IACjD,yCAAyC;IACzC,iDAAiD;IACjD,yCAAyC;IACzC,sCAAsC;IACtC,yCAAyC;IACzC,wCAAwC;IACxC,oCAAoC;IACpC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,2CAA2C;IAC3C,4CAA4C;IAC5C,qCAAqC;IACrC,yCAAyC;IACzC,4CAA4C;IAC5C,oCAAoC;IACpC,sCAAsC;IACtC,0CAA0C;IAC1C,uCAAuC;IACvC,sCAAsC;IACtC,sDAAsD;IACtD,mDAAmD;IACnD,6CAA6C;IAC7C,wCAAwC;IACxC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,sCAAsC;IACtC,wCAAwC;IACxC,+BAA+B;IAC/B,qCAAqC;IACrC,sCAAsC;IACtC,yCAAyC;IACzC,4CAA4C;IAC5C,uDAAuD;IACvD,+CAA+C;IAC/C,2CAA2C;IAC3C,gDAAgD;IAChD,oDAAoD;IACpD,4CAA4C;IAC5C,+CAA+C;IAC/C,+CAA+C;IAC/C,gDAAgD;IAChD,6CAA6C;IAC7C,6CAA6C;IAC7C,iDAAiD;IACjD,oDAAoD;IACpD,+CAA+C;IAC/C,2CAA2C;IAC3C,2CAA2C;IAC3C,+CAA+C;IAC/C,iDAAiD;IACjD,uDAAuD;IACvD,iDAAiD;IACjD,qDAAqD;IACrD,+CAA+C;IAC/C,+CAA+C;IAC/C,8CAA8C;IAC9C,+CAA+C;IAC/C,6CAA6C;IAC7C,+CAA+C;IAC/C,+CAA+C;IAC/C,6CAA6C;IAC7C,6CAA6C;IAC7C,uCAAuC;IACvC,sCAAsC;IACtC,2CAA2C;IAC3C,2CAA2C;IAC3C,sCAAsC;IACtC,2CAA2C;IAC3C,4CAA4C;IAC5C,uCAAuC;IACvC,4CAA4C;IAC5C,8CAA8C;IAC9C,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,8CAA8C;IAC9C,+CAA+C;IAC/C,qDAAqD;IACrD,sDAAsD;IACtD,uDAAuD;IACvD,wDAAwD;IACxD,sDAAsD;IACtD,mDAAmD;IACnD,oDAAoD;IACpD,sDAAsD;IACtD,iEAAiE;IACjE,2DAA2D;IAC3D,yDAAyD;IACzD,yDAAyD;IACzD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,sDAAsD;IACtD,uDAAuD;IACvD,2DAA2D;IAC3D,0DAA0D;IAC1D,wDAAwD;IACxD,qDAAqD;IACrD,sDAAsD;IACtD,gEAAgE;IAChE,qDAAqD;IACrD,oDAAoD;IACpD,iDAAiD;IACjD,kDAAkD;IAClD,wDAAwD;IACxD,oDAAoD;IACpD,wDAAwD;IACxD,wDAAwD;IACxD,qDAAqD;IACrD,uDAAuD;IACvD,sDAAsD;IACtD,mDAAmD;IACnD,oDAAoD;IACpD,qDAAqD;IACrD,kDAAkD;IAClD,mDAAmD;IACnD,qDAAqD;IACrD,0DAA0D;IAC1D,wDAAwD;IACxD,0DAA0D;IAC1D,sDAAsD;IACtD,sDAAsD;IACtD,sDAAsD;IACtD,mDAAmD;IACnD,8DAA8D;IAC9D,sDAAsD;IACtD,iEAAiE;IACjE,kEAAkE;IAClE,6DAA6D;IAC7D,8CAA8C;IAC9C,wDAAwD;IACxD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,wDAAwD;IACxD,wCAAwC;IACxC,wCAAwC;IACxC,iDAAiD;IACjD,wDAAwD;IACxD,0DAA0D;IAC1D,0CAA0C;IAC1C,6CAA6C;IAC7C,wCAAwC;IACxC,mDAAmD;IACnD,+CAA+C;IAC/C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,8CAA8C;IAC9C,oDAAoD;IACpD,kDAAkD;IAClD,+CAA+C;IAC/C,mDAAmD;IACnD,2CAA2C;IAC3C,qDAAqD;IACrD,+CAA+C;IAC/C,sDAAsD;IACtD,gDAAgD;IAChD,2CAA2C;IAC3C,gDAAgD;IAChD,0CAA0C;IAC1C,0CAA0C;IAC1C,kDAAkD;IAClD,yCAAyC;IACzC,kDAAkD;IAClD,2CAA2C;IAC3C,yCAAyC;IACzC,2CAA2C;IAC3C,4CAA4C;IAC5C,mDAAmD;IACnD,uDAAuD;IACvD,4DAA4D;IAC5D,sDAAsD;IACtD,sDAAsD;IACtD,qDAAqD;IACrD,wDAAwD;IACxD,oDAAoD;IACpD,uDAAuD;IACvD,sDAAsD;IACtD,oDAAoD;IACpD,4CAA4C;IAC5C,iDAAiD;IACjD,iDAAiD;IACjD,sDAAsD;IACtD,kDAAkD;IAClD,sDAAsD;IACtD,gDAAgD;IAChD,uDAAuD;IACvD,iDAAiD;IACjD,kDAAkD;IAClD,gDAAgD;IAChD,mDAAmD;IACnD,mDAAmD;IACnD,6DAA6D;IAC7D,2DAA2D;IAC3D,2DAA2D;IAC3D,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;IAC/D,0DAA0D;IAC1D,6DAA6D;IAC7D,6DAA6D;IAC7D,8DAA8D;IAC9D,8DAA8D;IAC9D,8DAA8D;IAC9D,qDAAqD;IACrD,sDAAsD;IACtD,2DAA2D;IAC3D,iDAAiD;IACjD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,oDAAoD;IACpD,iEAAiE;IACjE,mDAAmD;IACnD,wDAAwD;IACxD,iDAAiD;IACjD,wDAAwD;IACxD,kDAAkD;IAClD,oDAAoD;IACpD,iDAAiD;IACjD,8DAA8D;IAC9D,4DAA4D;IAC5D,6DAA6D;IAC7D,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,wCAAwC;IACxC,gDAAgD;IAChD,0DAA0D;IAC1D,sCAAsC;IACtC,6DAA6D;IAC7D,kEAAkE;IAClE,8DAA8D;IAC9D,oEAAoE;IACpE,0DAA0D;IAC1D,kDAAkD;IAClD,gDAAgD;IAChD,kEAAkE;IAClE,uDAAuD;IACvD,oDAAoD;IACpD,oDAAoD;IACpD,qDAAqD;IACrD,oDAAoD;IACpD,kDAAkD;IAClD,oDAAoD;IACpD,gDAAgD;IAChD,yCAAyC;IACzC,uCAAuC;IACvC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,qCAAqC;IACrC,yCAAyC;IACzC,qCAAqC;IACrC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,kCAAkC;IAClC,mCAAmC;IACnC,oCAAoC;IACpC,oCAAoC;IACpC,kDAAkD;IAClD,kDAAkD;IAClD,mDAAmD;IACnD,+CAA+C;IAC/C,gDAAgD;IAChD,gDAAgD;IAChD,kDAAkD;IAClD,oDAAoD;CACrD,CAAA"}

package/payload/server/{chunk-F4D35LKL.js → chunk-POBXIHOF.js}

@@ -44,6 +44,39 @@ var compose = (middleware, onError, onNotFound) => {
   };
 };
 
+// node_modules/hono/dist/http-exception.js
+var HTTPException = class extends Error {
+  res;
+  status;
+  /**
+   * Creates an instance of `HTTPException`.
+   * @param status - HTTP status code for the exception. Defaults to 500.
+   * @param options - Additional options for the exception.
+   */
+  constructor(status = 500, options) {
+    super(options?.message, { cause: options?.cause });
+    this.res = options?.res;
+    this.status = status;
+  }
+  /**
+   * Returns the response object associated with the exception.
+   * If a response object is not provided, a new response is created with the error message and status code.
+   * @returns The response object.
+   */
+  getResponse() {
+    if (this.res) {
+      const newResponse = new Response(this.res.body, {
+        status: this.status,
+        headers: this.res.headers
+      });
+      return newResponse;
+    }
+    return new Response(this.message, {
+      status: this.status
+    });
+  }
+};
+
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
 
@@ -5886,6 +5919,7 @@ var clientIpMiddleware = async (c, next) => {
 };
 
 export {
+  HTTPException,
   HtmlEscapedCallbackPhase,
   resolveCallback,
   Hono2 as Hono,

package/payload/server/{chunk-64FGYKNZ.js → chunk-Q6W4U6HL.js}

@@ -8,6 +8,22 @@ function authorizeAccess(params) {
   return { allow: true, reason: "owner" };
 }
 
+// ../lib/storage-broker/src/object-limits.ts
+var R2_OBJECT_MAX_BYTES = 100 * 1024 * 1024;
+function base64Ceiling(bytes) {
+  return 4 * Math.ceil(bytes / 3);
+}
+var PUT_ENVELOPE_ALLOWANCE_BYTES = 64 * 1024;
+var R2_OBJECT_PUT_MAX_BODY_BYTES = base64Ceiling(R2_OBJECT_MAX_BYTES) + PUT_ENVELOPE_ALLOWANCE_BYTES;
+function formatMiB(bytes) {
+  return (bytes / 1024 / 1024).toFixed(1);
+}
+function tooLargeMessage(what, actualBytes) {
+  return `${what} is ${formatMiB(actualBytes)} MiB (${actualBytes} bytes), which exceeds the ${formatMiB(
+    R2_OBJECT_MAX_BYTES
+  )} MiB (${R2_OBJECT_MAX_BYTES} bytes) R2 object limit.`;
+}
+
 // ../lib/storage-broker/src/registry.ts
 async function registerResource(session, r) {
   await session.run(
@@ -120,6 +136,12 @@ function keyForScope(scope) {
 }
 
 // ../lib/storage-broker/src/cf-exec.ts
+function encodeObjectKey(key) {
+  return key.split("/").map(encodeURIComponent).join("/");
+}
+function objectUrl(accountId, bucket, key) {
+  return `https://api.cloudflare.com/client/v4/accounts/${accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects/${encodeObjectKey(key)}`;
+}
 var defaultFetch = (url, init) => fetch(url, init);
 var defaultRun2 = (cmd, args, env) => new Promise((resolve, reject) => {
   execFile2(cmd, args, { env }, (err, stdout, stderr) => {
@@ -219,6 +241,84 @@ function makeCfExec(cred, run = defaultRun2, fetchFn = defaultFetch) {
     },
     async r2Create(name) {
       await run("npx", ["wrangler", "r2", "bucket", "create", name], env);
+    },
+    // --- R2 objects (Task 1691) -------------------------------------------
+    //
+    // The v4 REST API exposes the object surface under
+    // /accounts/{id}/r2/buckets/{bucket}/objects and accepts the same Bearer
+    // token as the bucket endpoints (account-level Workers R2 Storage Write).
+    // The r2/api/tokens/ note that "Object Read & Write" is S3-only constrains
+    // the bucket-item-scoped *permission types*, not these endpoints.
+    //
+    // Doc-confirmed, never measured: no house Cloudflare credential exists on
+    // the dev machine. The design keeps the unmeasured facts unable to affect
+    // correctness — per_page is never sent, and nothing fails silently.
+    async r2ObjectList(bucket, prefix) {
+      const base = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects`;
+      const objects = [];
+      const seen = /* @__PURE__ */ new Set();
+      let cursor;
+      for (; ; ) {
+        const params = new URLSearchParams();
+        if (prefix !== void 0) params.set("prefix", prefix);
+        if (cursor !== void 0) params.set("cursor", cursor);
+        const qs = params.toString();
+        const { parsed, body } = await cfApiJson(
+          fetchFn,
+          qs ? `${base}?${qs}` : base,
+          { method: "GET", headers: { Authorization: `Bearer ${cred.apiToken}` } },
+          "r2 object list"
+        );
+        const page = parsed;
+        for (const o of page.result ?? []) {
+          objects.push({ key: o.key, size: o.size, etag: o.etag, lastModified: o.last_modified });
+        }
+        const truncated = page.result_info?.is_truncated;
+        const next = page.result_info?.cursor;
+        if (truncated === false) return objects;
+        if (truncated === true && !next) {
+          throw new Error(
+            `storage-broker: r2 object list reported truncated but gave no pagination cursor: ${body}`
+          );
+        }
+        if (!next) return objects;
+        if (seen.has(next)) {
+          throw new Error(
+            `storage-broker: r2 object list returned a repeated pagination cursor: ${next}`
+          );
+        }
+        seen.add(next);
+        cursor = next;
+      }
+    },
+    async r2ObjectGet(bucket, key) {
+      const res = await fetchFn(objectUrl(cred.accountId, bucket, key), {
+        method: "GET",
+        headers: { Authorization: `Bearer ${cred.apiToken}` }
+      });
+      if (!res.ok) {
+        throw new Error(
+          `storage-broker: r2 object get failed: ${res.status}
+${await res.text()}`
+        );
+      }
+      return new Uint8Array(await res.arrayBuffer());
+    },
+    async r2ObjectPut(bucket, key, body) {
+      await cfApiJson(
+        fetchFn,
+        objectUrl(cred.accountId, bucket, key),
+        { method: "PUT", headers: { Authorization: `Bearer ${cred.apiToken}` }, body },
+        "r2 object put"
+      );
+    },
+    async r2ObjectDelete(bucket, key) {
+      await cfApiJson(
+        fetchFn,
+        objectUrl(cred.accountId, bucket, key),
+        { method: "DELETE", headers: { Authorization: `Bearer ${cred.apiToken}` } },
+        "r2 object delete"
+      );
     }
   };
 }
@@ -282,6 +382,10 @@ function stripAccountWideTokens(contents) {
 
 export {
   authorizeAccess,
+  R2_OBJECT_MAX_BYTES,
+  base64Ceiling,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
+  tooLargeMessage,
   registerResource,
   resolveOwner,
   listResources,

package/payload/server/maxy-edge.js

@@ -16,7 +16,7 @@ import {
   sanitizeClientCorrId,
   vncLog,
   websockifyLog
-} from "./chunk-F4D35LKL.js";
+} from "./chunk-POBXIHOF.js";
 import "./chunk-PFF6I7KP.js";
 
 // server/edge.ts

package/payload/server/server.js

@@ -9,6 +9,7 @@ import {
   CLAUDE_CREDENTIALS_FILE,
   COMMERCIAL_MODE,
   GREETING_DIRECTIVE,
+  HTTPException,
   Hono,
   HtmlEscapedCallbackPhase,
   INSTALL_OWNER_FILE,
@@ -110,14 +111,17 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-F4D35LKL.js";
+} from "./chunk-POBXIHOF.js";
 import {
+  R2_OBJECT_MAX_BYTES,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
   authorizeAccess,
   listResources,
   makeHouseCfExec,
   registerResource,
-  resolveOwner
-} from "./chunk-64FGYKNZ.js";
+  resolveOwner,
+  tooLargeMessage
+} from "./chunk-Q6W4U6HL.js";
 import {
   __commonJS,
   __toESM
@@ -8664,6 +8668,65 @@ app2.get("/group-info", async (c) => {
 });
 var whatsapp_default = app2;
 
+// node_modules/hono/dist/middleware/body-limit/index.js
+var ERROR_MESSAGE = "Payload Too Large";
+var BodyLimitError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BodyLimitError";
+  }
+};
+var bodyLimit = (options) => {
+  const onError = options.onError || (() => {
+    const res = new Response(ERROR_MESSAGE, {
+      status: 413
+    });
+    throw new HTTPException(413, { res });
+  });
+  const maxSize = options.maxSize;
+  return async function bodyLimit2(c, next) {
+    if (!c.req.raw.body) {
+      return next();
+    }
+    const hasTransferEncoding = c.req.raw.headers.has("transfer-encoding");
+    const hasContentLength = c.req.raw.headers.has("content-length");
+    if (hasTransferEncoding && hasContentLength) {
+    }
+    if (hasContentLength && !hasTransferEncoding) {
+      const contentLength = parseInt(c.req.raw.headers.get("content-length") || "0", 10);
+      return contentLength > maxSize ? onError(c) : next();
+    }
+    let size = 0;
+    const rawReader = c.req.raw.body.getReader();
+    const reader = new ReadableStream({
+      async start(controller) {
+        try {
+          for (; ; ) {
+            const { done, value } = await rawReader.read();
+            if (done) {
+              break;
+            }
+            size += value.length;
+            if (size > maxSize) {
+              controller.error(new BodyLimitError(ERROR_MESSAGE));
+              break;
+            }
+            controller.enqueue(value);
+          }
+        } finally {
+          controller.close();
+        }
+      }
+    });
+    const requestInit = { body: reader, duplex: "half" };
+    c.req.raw = new Request(c.req.raw, requestInit);
+    await next();
+    if (c.error instanceof BodyLimitError) {
+      c.res = await onError(c);
+    }
+  };
+};
+
 // server/routes/storage-broker.ts
 import { join as join11, resolve as resolve11 } from "path";
 import { readdirSync as readdirSync6, readFileSync as readFileSync13, existsSync as existsSync8 } from "fs";
@@ -8674,9 +8737,9 @@ function platformRoot() {
 function caller(c) {
   return c.req.header("x-maxy-caller-account")?.trim() || null;
 }
-function log(action, kind, account, target, owner, result) {
+function log(action, kind, account, target, owner, result, reason) {
   console.error(
-    `[storage-broker] op=storage-broker resource=${kind} action=${action} account=${account} target=${target} owner=${owner ?? "none"} result=${result}`
+    `[storage-broker] op=storage-broker resource=${kind} action=${action} account=${account} target=${target} owner=${owner ?? "none"} result=${result}${reason ? ` reason=${reason}` : ""}`
   );
 }
 function cfExec() {
@@ -8774,9 +8837,146 @@ app3.post("/r2/create", async (c) => {
     await session.close();
   }
 });
+async function objectGate(c, action) {
+  const account = caller(c);
+  if (!account) return { ok: false, res: c.json({ error: "no-caller" }, 403) };
+  let body;
+  try {
+    body = await c.req.json();
+  } catch (err) {
+    if (err instanceof Error && err.name === "BodyLimitError") throw err;
+    return { ok: false, res: c.json({ error: "invalid-json" }, 400) };
+  }
+  const bucket = body.bucket;
+  if (!bucket || typeof bucket !== "string") {
+    return { ok: false, res: c.json({ error: "bucket-required" }, 400) };
+  }
+  const session = getSession();
+  let owner;
+  try {
+    owner = await resolveOwner(session, "r2", bucket);
+  } catch (err) {
+    return { ok: false, res: c.json({ error: String(err) }, 500) };
+  } finally {
+    await session.close();
+  }
+  const decision = authorizeAccess({ caller: account, owner, action });
+  log(action, "r2", account, bucket, owner, decision.allow ? "allow" : "deny");
+  if (!decision.allow) return { ok: false, res: c.json({ error: decision.reason }, 403) };
+  return { ok: true, bucket, body };
+}
+function readKey(body) {
+  const key = body.key;
+  return typeof key === "string" && key.length > 0 ? key : null;
+}
+app3.post("/r2/object/list", async (c) => {
+  const gate = await objectGate(c, "list");
+  if (!gate.ok) return gate.res;
+  const prefix = gate.body.prefix;
+  if (prefix !== void 0 && typeof prefix !== "string") {
+    return c.json({ error: "prefix-must-be-string" }, 400);
+  }
+  try {
+    const objects = await (await cfExec()).r2ObjectList(gate.bucket, prefix);
+    return c.json({ objects });
+  } catch (err) {
+    return c.json({ error: String(err) }, 500);
+  }
+});
+app3.post("/r2/object/get", async (c) => {
+  const gate = await objectGate(c, "read");
+  if (!gate.ok) return gate.res;
+  const key = readKey(gate.body);
+  if (!key) return c.json({ error: "key-required" }, 400);
+  try {
+    const cf = await cfExec();
+    const listed = await cf.r2ObjectList(gate.bucket, key);
+    const size = listed.find((o) => o.key === key)?.size;
+    if (typeof size !== "number" || !Number.isFinite(size) || size < 0) {
+      log("read", "r2", caller(c) ?? "none", key, caller(c), "deny", "size-unknown");
+      return c.json(
+        {
+          error: `${key} has no recorded size in ${gate.bucket}; refusing to transfer an object that cannot be bounded.`
+        },
+        409
+      );
+    }
+    if (size > R2_OBJECT_MAX_BYTES) {
+      log("read", "r2", caller(c) ?? "none", key, caller(c), "deny", "object-too-large");
+      return c.json({ error: tooLargeMessage(key, size) }, 413);
+    }
+    const bytes = await cf.r2ObjectGet(gate.bucket, key);
+    return c.json({ contentBase64: Buffer.from(bytes).toString("base64") });
+  } catch (err) {
+    return c.json({ error: String(err) }, 500);
+  }
+});
+app3.post(
+  "/r2/object/put",
+  // Task 1695 — before the body is buffered, not after. This process runs
+  // house-level and holds the account-wide credential, so an over-cap body
+  // buffered here is an OOM kill of the brand server. The handler cannot do this
+  // itself: objectGate's c.req.json() has already read the whole body by the time
+  // any handler code runs.
+  //
+  // Not redundant with the MCP's statSync check. Every account shares one unix
+  // user and the agent holds Bash, so these routes are reachable by curl with the
+  // MCP nowhere in the path; a cap enforced only there is bypassed by one
+  // command. The MCP check gives the precise, file-naming error; this one is what
+  // actually bounds house memory.
+  bodyLimit({
+    maxSize: R2_OBJECT_PUT_MAX_BODY_BYTES,
+    // The key is unknown here — the body is deliberately unparsed — so this names
+    // the limit rather than the object. The MCP names the file. The limit is
+    // stated in MiB like every other over-cap message, so an operator reading a
+    // route rejection and an MCP rejection can see they are one rule rather than
+    // two unrelated numbers.
+    //
+    // It logs, because a task filed on "the OOM emits nothing" must not ship a
+    // rejection that also emits nothing. On the content-length branch — the shape
+    // every real caller sends — no body is read and no handler runs, so this line
+    // is the only trace the request ever existed.
+    onError: (c) => {
+      log("write", "r2", caller(c) ?? "none", "*", null, "deny", "body-too-large");
+      return c.json(
+        {
+          error: `request body exceeds the ${(R2_OBJECT_PUT_MAX_BODY_BYTES / 1024 / 1024).toFixed(1)} MiB limit for an R2 object put (a base64-encoded ${(R2_OBJECT_MAX_BYTES / 1024 / 1024).toFixed(1)} MiB object plus its envelope).`
+        },
+        413
+      );
+    }
+  }),
+  async (c) => {
+    const gate = await objectGate(c, "write");
+    if (!gate.ok) return gate.res;
+    const key = readKey(gate.body);
+    if (!key) return c.json({ error: "key-required" }, 400);
+    const contentBase64 = gate.body.contentBase64;
+    if (typeof contentBase64 !== "string") return c.json({ error: "contentBase64-required" }, 400);
+    try {
+      const bytes = new Uint8Array(Buffer.from(contentBase64, "base64"));
+      await (await cfExec()).r2ObjectPut(gate.bucket, key, bytes);
+      return c.json({ ok: true });
+    } catch (err) {
+      return c.json({ error: String(err) }, 500);
+    }
+  }
+);
+app3.post("/r2/object/delete", async (c) => {
+  const gate = await objectGate(c, "write");
+  if (!gate.ok) return gate.res;
+  const key = readKey(gate.body);
+  if (!key) return c.json({ error: "key-required" }, 400);
+  try {
+    await (await cfExec()).r2ObjectDelete(gate.bucket, key);
+    return c.json({ ok: true });
+  } catch (err) {
+    return c.json({ error: String(err) }, 500);
+  }
+});
 var storage_broker_default = app3;
 async function runStorageAudit(root) {
-  const { reconcileStorage } = await import("./src-S7C4P6TT.js");
+  const { reconcileStorage } = await import("./src-3I2RYZFB.js");
   const session = getSession();
   try {
     const cf = await makeHouseCfExec(root);

package/payload/server/{src-S7C4P6TT.js → src-3I2RYZFB.js}

@@ -1,6 +1,9 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
+  R2_OBJECT_MAX_BYTES,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
   authorizeAccess,
+  base64Ceiling,
   listResources,
   makeCfExec,
   makeHouseCfExec,
@@ -10,11 +13,15 @@ import {
   resolveHouseScopedToken,
   resolveOwner,
   stripAccountWideTokens,
+  tooLargeMessage,
   validateMapping
-} from "./chunk-64FGYKNZ.js";
+} from "./chunk-Q6W4U6HL.js";
 import "./chunk-PFF6I7KP.js";
 export {
+  R2_OBJECT_MAX_BYTES,
+  R2_OBJECT_PUT_MAX_BODY_BYTES,
   authorizeAccess,
+  base64Ceiling,
   listResources,
   makeCfExec,
   makeHouseCfExec,
@@ -24,5 +31,6 @@ export {
   resolveHouseScopedToken,
   resolveOwner,
   stripAccountWideTokens,
+  tooLargeMessage,
   validateMapping
 };