@rubytech/create-maxy-code 0.1.458 → 0.1.460

package/payload/platform/lib/storage-broker/src/cf-exec.ts

@@ -14,14 +14,32 @@ export type RunFn = (
   env: Record<string, string>,
 ) => Promise<{ stdout: string }>;
 
-// The HTTP seam for the Cloudflare API. Injectable so r2List and d1Create are
+// The HTTP seam for the Cloudflare API. Injectable so the API-backed methods are
 // unit-testable without a network. Minimal subset of the global fetch: callers
 // read the body once via text() and branch on ok/status. `body` is set for the
-// POST paths (d1Create); GET paths (r2List) omit it.
+// POST/PUT paths (d1Create, r2ObjectPut); GET/DELETE paths omit it.
+//
+// Task 1691 widened both halves: `body` carries Uint8Array for the object-put
+// path, and `arrayBuffer` reads the raw object body for r2ObjectGet, which is
+// the one method whose response is not a JSON envelope. arrayBuffer is required
+// rather than optional: an optional member would force a fake-only fallback
+// branch in r2ObjectGet that never runs against a real fetch.
 export type FetchFn = (
   url: string,
-  init: { method: string; headers: Record<string, string>; body?: string },
-) => Promise<{ ok: boolean; status: number; text(): Promise<string> }>;
+  init: { method: string; headers: Record<string, string>; body?: string | Uint8Array },
+) => Promise<{
+  ok: boolean;
+  status: number;
+  text(): Promise<string>;
+  arrayBuffer(): Promise<ArrayBuffer>;
+}>;
+
+export interface R2Object {
+  key: string;
+  size: number;
+  etag: string;
+  lastModified: string;
+}
 
 export interface CfExec {
   d1List(): Promise<{ name: string; uuid: string }[]>;
@@ -29,9 +47,34 @@ export interface CfExec {
   d1Query(name: string, sql: string): Promise<unknown>;
   r2List(): Promise<{ name: string }[]>;
   r2Create(name: string): Promise<void>;
+  r2ObjectList(bucket: string, prefix?: string): Promise<R2Object[]>;
+  r2ObjectFind(bucket: string, key: string): Promise<R2Object | null>;
+  r2ObjectGet(bucket: string, key: string): Promise<Uint8Array>;
+  r2ObjectPut(bucket: string, key: string, body: Uint8Array): Promise<void>;
+  r2ObjectDelete(bucket: string, key: string): Promise<void>;
+}
+
+// An object key carries `/` as a real path separator (the data portal's
+// per-person prefixes), so it is encoded segment-wise rather than whole:
+// separators stay separators, and spaces and specials are escaped. This
+// encoding is not doc-confirmed; it is chosen so that a wrong guess surfaces as
+// a 404 carrying its body, never as a silently misfiled object.
+function encodeObjectKey(key: string): string {
+  return key.split("/").map(encodeURIComponent).join("/");
 }
 
-const defaultFetch: FetchFn = (url, init) => fetch(url, init);
+// The single-object endpoint, shared by get/put/delete so the three cannot drift
+// apart on encoding.
+function objectUrl(accountId: string, bucket: string, key: string): string {
+  return `https://api.cloudflare.com/client/v4/accounts/${accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects/${encodeObjectKey(key)}`;
+}
+
+// The cast is confined to this adapter. A Uint8Array is a valid fetch body at
+// runtime, but the DOM lib's BodyInit does not admit TypeScript's generic
+// Uint8Array<ArrayBufferLike>, so consumers compiled against DOM typings (the
+// ui server) reject the call the Node typings accept. Casting here keeps the
+// seam's own type honest for every caller and test.
+const defaultFetch: FetchFn = (url, init) => fetch(url, init as RequestInit);
 
 const defaultRun: RunFn = (cmd, args, env) =>
   new Promise((resolve, reject) => {
@@ -62,7 +105,7 @@ function parseJson(raw: string, context: string): unknown {
 async function cfApiJson(
   fetchFn: FetchFn,
   url: string,
-  init: { method: string; headers: Record<string, string>; body?: string },
+  init: { method: string; headers: Record<string, string>; body?: string | Uint8Array },
   context: string,
 ): Promise<{ parsed: unknown; body: string }> {
   const res = await fetchFn(url, init);
@@ -80,6 +123,81 @@ async function cfApiJson(
   return { parsed, body };
 }
 
+// The one pagination loop for the object listing, shared by r2ObjectList and
+// r2ObjectFind so the two cannot drift apart on cursor discipline — the same
+// reason objectUrl is shared by get/put/delete.
+//
+// 1665's rules live here and nowhere else: follow the cursor to exhaustion,
+// is_truncated is authoritative when present, a truncated page naming no cursor
+// is an anomaly to surface rather than a partial list, and a repeated cursor is
+// a cycle rather than progress. per_page is deliberately never sent — its
+// default is unconfirmed, and omitting it takes whatever page size Cloudflare
+// serves rather than guessing a value.
+//
+// It yields pages rather than returning a list, which is what lets r2ObjectFind
+// stop early: an async generator is pull-based, so a consumer that stops
+// iterating never triggers the next request.
+async function* r2ObjectPages(
+  fetchFn: FetchFn,
+  cred: HouseCredential,
+  bucket: string,
+  prefix?: string,
+): AsyncGenerator<R2Object[]> {
+  const base = `https://api.cloudflare.com/client/v4/accounts/${cred.accountId}/r2/buckets/${encodeURIComponent(bucket)}/objects`;
+  const seen = new Set<string>();
+  let cursor: string | undefined;
+  for (;;) {
+    const params = new URLSearchParams();
+    if (prefix !== undefined) params.set("prefix", prefix);
+    if (cursor !== undefined) params.set("cursor", cursor);
+    const qs = params.toString();
+    const { parsed, body } = await cfApiJson(
+      fetchFn,
+      qs ? `${base}?${qs}` : base,
+      { method: "GET", headers: { Authorization: `Bearer ${cred.apiToken}` } },
+      "r2 object list",
+    );
+    const page = parsed as {
+      result?: Array<{ key: string; size: number; etag: string; last_modified: string }>;
+      result_info?: { cursor?: string | null; is_truncated?: boolean };
+    };
+    const objects: R2Object[] = [];
+    for (const o of page.result ?? []) {
+      objects.push({ key: o.key, size: o.size, etag: o.etag, lastModified: o.last_modified });
+    }
+    yield objects;
+    const truncated = page.result_info?.is_truncated;
+    const next = page.result_info?.cursor;
+    // is_truncated is authoritative *when present*: a last page may still carry
+    // a cursor, and following it would issue a pointless request or trip the
+    // cycle guard below on a healthy response.
+    if (truncated === false) return;
+    // The API says there is more but names no cursor: the response is not the
+    // shape we understand. Surface it rather than stop, which would silently
+    // truncate the audit's listing — the failure this loop exists to prevent.
+    if (truncated === true && !next) {
+      throw new Error(
+        `storage-broker: r2 object list reported truncated but gave no pagination cursor: ${body}`,
+      );
+    }
+    // is_truncated absent: it is itself an unmeasured fact, so it must not be
+    // what decides correctness. Fall back to cursor presence — the rule r2List
+    // uses on the same envelope — so an envelope without the flag paginates
+    // rather than truncating silently.
+    if (!next) return;
+    // A cursor seen before means the API is cycling rather than advancing: it
+    // would loop forever, re-yielding the same objects each pass. Tracking every
+    // cursor (not just the last) also catches a cycle of period >= 2.
+    if (seen.has(next)) {
+      throw new Error(
+        `storage-broker: r2 object list returned a repeated pagination cursor: ${next}`,
+      );
+    }
+    seen.add(next);
+    cursor = next;
+  }
+}
+
 export function makeCfExec(
   cred: HouseCredential,
   run: RunFn = defaultRun,
@@ -182,6 +300,103 @@ export function makeCfExec(
     async r2Create(name) {
       await run("npx", ["wrangler", "r2", "bucket", "create", name], env);
     },
+
+    // --- R2 objects (Task 1691) -------------------------------------------
+    //
+    // The v4 REST API exposes the object surface under
+    // /accounts/{id}/r2/buckets/{bucket}/objects and accepts the same Bearer
+    // token as the bucket endpoints (account-level Workers R2 Storage Write).
+    // The r2/api/tokens/ note that "Object Read & Write" is S3-only constrains
+    // the bucket-item-scoped *permission types*, not these endpoints.
+    //
+    // The endpoint's existence and token class are doc-confirmed. Its behaviour
+    // was unmeasured until Task 1697, which probed the live v4 API on 2026-07-16
+    // from the laptop's own maxy-code install (no house Cloudflare credential
+    // exists on the dev Mac, which is why the tests fake the fetch seam). What
+    // that probe established, so nobody re-guesses it:
+    //
+    // - The listing is NOT in ascending UTF-8 binary order. `prefix=a/photo.jpg`
+    //   returns `a/photo.jpg.bak` before `a/photo.jpg`, so the exact key is not
+    //   the first element and `per_page=1` returns a neighbour. S3's
+    //   ListObjectsV2 ordering guarantee does not transfer to this endpoint.
+    // - HEAD is routed only for single-segment keys: any key containing "/"
+    //   returns 405 while GET on the identical URL returns 404.
+    // - A ranged GET is honoured at 2 MB and ignored at 12 B, so it cannot size
+    //   an object without an undocumented size threshold deciding correctness.
+    // - per_page is bounded 0..1000 (error 10029), and per_page=0 returns zero
+    //   objects with is_truncated:true — a loop trap. It is still never sent.
+    //
+    // The design keeps every unmeasured fact unable to affect correctness:
+    // per_page is never sent, order is never assumed, and nothing fails
+    // silently. Evidence:
+    // docs/superpowers/specs/2026-07-16-storage-broker-get-sizing-early-exit-design.md
+    async r2ObjectList(bucket, prefix) {
+      // The standing audit needs the complete set: a truncated object listing
+      // reads as "those objects are absent", producing false phantom rows and
+      // hiding real orphans — the same bug r2List had, one endpoint over. So
+      // this drains every page. r2ObjectFind is the caller that needs one
+      // record and must not pay for this.
+      const objects: R2Object[] = [];
+      for await (const page of r2ObjectPages(fetchFn, cred, bucket, prefix)) {
+        for (const o of page) objects.push(o);
+      }
+      return objects;
+    },
+    async r2ObjectFind(bucket, key) {
+      // Task 1697 — the size source for a get. Scans each page for the exact key
+      // and returns on the first match, so it holds one page rather than every
+      // object sharing the key as a prefix, and issues no request past the page
+      // carrying the match.
+      //
+      // Exact match, not prefix: a prefix of `a/photo.jpg` also matches
+      // `a/photo.jpg.bak`, and sizing the neighbour would either reject a legal
+      // get or admit an oversized one. Exiting on the match rather than on
+      // position is what makes this independent of listing order — measured
+      // 2026-07-16 against the live v4 API, the listing is NOT in ascending
+      // UTF-8 binary order, so the exact key is not the first element and
+      // `per_page=1` returns a neighbour.
+      //
+      // An absent key still drains every page, because proving absence requires
+      // seeing them all. That residual is accepted and permanent; nothing on
+      // this endpoint sizes one object in bounded work. See
+      // docs/superpowers/specs/2026-07-16-storage-broker-get-sizing-early-exit-design.md
+      for await (const page of r2ObjectPages(fetchFn, cred, bucket, key)) {
+        const hit = page.find((o) => o.key === key);
+        if (hit) return hit;
+      }
+      return null;
+    },
+    async r2ObjectGet(bucket, key) {
+      // The one method cfApiJson cannot wrap: get returns the raw object body,
+      // not a success envelope, so there is nothing to parse or assert
+      // success:true on. The error body is still retained on a non-2xx.
+      const res = await fetchFn(objectUrl(cred.accountId, bucket, key), {
+        method: "GET",
+        headers: { Authorization: `Bearer ${cred.apiToken}` },
+      });
+      if (!res.ok) {
+        throw new Error(
+          `storage-broker: r2 object get failed: ${res.status}\n${await res.text()}`,
+        );
+      }
+      return new Uint8Array(await res.arrayBuffer());
+    },
+    async r2ObjectPut(bucket, key, body) {
+      await cfApiJson(
+        fetchFn,
+        objectUrl(cred.accountId, bucket, key),
+        { method: "PUT", headers: { Authorization: `Bearer ${cred.apiToken}` }, body },
+        "r2 object put",
+      );
+    },
+    async r2ObjectDelete(bucket, key) {
+      await cfApiJson(
+        fetchFn,
+        objectUrl(cred.accountId, bucket, key),
+        { method: "DELETE", headers: { Authorization: `Bearer ${cred.apiToken}` } },
+        "r2 object delete",
+      );
+    },
   };
 }
 

package/payload/platform/lib/storage-broker/src/house-credential.ts

@@ -2,8 +2,10 @@
 // config directory. This file is the one place the account-wide capability
 // lives. House-only is a location convention plus the cf-token.sh caller gate,
 // NOT an OS permission: every account's session runs as the same unix user, so
-// a sub-account agent holding Bash can read this path directly. Task 1690
-// tracks the OS user separation that would make this a real boundary. Parses
+// a sub-account agent holding Bash can read this path directly. That is a
+// permanent property, not a pending gap: OS user separation was costed and
+// declined as disproportionate (Task 1690, archived undone), so nothing tracks
+// it. Do not cite this file's location or mode as a boundary. Parses
 // KEY=value lines without polluting process.env (same discipline as
 // reconcile-bookings' readEnvFile).
 

package/payload/platform/lib/storage-broker/src/index.ts

@@ -7,7 +7,9 @@
 // isolation and the isolation logic auditable in one place.
 
 export * from "./authorize.js";
+export * from "./object-limits.js";
 export * from "./registry.js";
+export * from "./resource-limits.js";
 export * from "./house-credential.js";
 export * from "./cf-exec.js";
 export * from "./house-scoped-token.js";

package/payload/platform/lib/storage-broker/src/object-limits.ts

@@ -0,0 +1,95 @@
+/**
+ * The byte cap on R2 object transfer, and the arithmetic the routes need to
+ * enforce it before they buffer anything.
+ *
+ * One number, one home (Task 1695). The storage-broker MCP tools and the house
+ * ui routes both read the cap from here, so the process that rejects a too-large
+ * file and the process that would otherwise buffer it cannot drift apart.
+ *
+ * Deliberately dependency-free: the MCP imports this module directly, without
+ * the rest of the lib (cf-exec, registry, audit, remediate), which it has no use
+ * for. The ui route reads it through the barrel.
+ */
+
+/**
+ * The maximum size, in bytes, of an object moved through storage-r2-object-get
+ * or storage-r2-object-put.
+ *
+ * Set independently of the email plugin's OUTBOUND_ATTACHMENT_MAX_BYTES (25 MiB)
+ * even though the payload class is the same. The two exist for different reasons
+ * and must be free to move for different reasons: email's tracks an SMTP-side
+ * rejection threshold, this one tracks house-process memory. Do not couple them.
+ *
+ * Not bounded by R2. A single-part upload may be up to 5 GiB (doc-confirmed:
+ * developers.cloudflare.com/r2/platform/limits/), roughly fifty times this, and
+ * the v4 REST API states no separate object-size limit. This cap is the only
+ * bound on either transfer.
+ *
+ * The bound is not small: at the cap a get still leaves the house process
+ * holding the object and its base64 form, roughly 2.4x the object. That cost was
+ * weighed and accepted when the number was chosen.
+ */
+export const R2_OBJECT_MAX_BYTES = 100 * 1024 * 1024;
+
+/** base64 emits 4 characters per 3 input bytes, padded up to the next quantum. */
+export function base64Ceiling(bytes: number): number {
+  return 4 * Math.ceil(bytes / 3);
+}
+
+/**
+ * The largest JSON body an object route's metadata envelope can legitimately
+ * carry: a bucket name, one key or prefix, and JSON punctuation. No payload term.
+ *
+ * Used twice, because it answers one question — how large can an envelope
+ * legitimately get. `/r2/object/list`, `get` and `delete` carry an envelope and
+ * nothing else, so this is their whole body limit (Task 1698). `put` carries the
+ * same envelope plus base64 object bytes, so it adds this to the base64 ceiling
+ * below, which is the allowance that keeps a legal at-cap put from being rejected
+ * by its own key.
+ *
+ * Deliberately one constant rather than two that happen to match. This is the
+ * opposite ruling to the email cap above, for the opposite reason: that pair must
+ * stay independent because the numbers track different constraints and would drift
+ * for different reasons. Here the constraint is identical, so a change to either
+ * use must move both.
+ *
+ * Sized from confirmed R2 limits rather than assumed. An object key is at most
+ * 1,024 bytes (developers.cloudflare.com/r2/platform/limits/) and a bucket name is
+ * 3-63 characters (developers.cloudflare.com/r2/buckets/create-buckets/), so a
+ * real envelope is about 1.1 KB, or roughly 6 KiB if every key byte takes a
+ * six-character \uXXXX escape. This clears that by about ten times and sits about
+ * 2,100 times below put's body limit: far above anything a real caller sends, far
+ * below anything that threatens house memory. Nothing here depends on either
+ * figure being exact.
+ */
+export const R2_OBJECT_ENVELOPE_MAX_BODY_BYTES = 64 * 1024;
+
+/**
+ * The largest JSON body /r2/object/put can legitimately carry.
+ *
+ * This bounds house memory; it does not adjudicate the last kilobyte. The exact
+ * decoded-byte rule lives in the MCP, which knows the source's size exactly.
+ */
+export const R2_OBJECT_PUT_MAX_BODY_BYTES =
+  base64Ceiling(R2_OBJECT_MAX_BYTES) + R2_OBJECT_ENVELOPE_MAX_BODY_BYTES;
+
+function formatMiB(bytes: number): string {
+  return (bytes / 1024 / 1024).toFixed(1);
+}
+
+/**
+ * The over-cap message, worded once so the MCP and the routes agree. Names the
+ * offending object and the limit, which is what makes the failure actionable
+ * rather than an opaque out-of-memory kill.
+ *
+ * Exact bytes accompany the MiB figures because MiB alone rounds: an object one
+ * byte over the cap reads "100.0 MiB, which exceeds the 100.0 MiB limit", which
+ * is a message that appears to contradict itself and invites the reader to treat
+ * the rejection as a bug. The bytes are what make it legible; the MiB is what
+ * makes it quick.
+ */
+export function tooLargeMessage(what: string, actualBytes: number): string {
+  return `${what} is ${formatMiB(actualBytes)} MiB (${actualBytes} bytes), which exceeds the ${formatMiB(
+    R2_OBJECT_MAX_BYTES,
+  )} MiB (${R2_OBJECT_MAX_BYTES} bytes) R2 object limit.`;
+}

package/payload/platform/lib/storage-broker/src/resource-limits.ts

@@ -0,0 +1,105 @@
+/**
+ * The bounds on the request bodies the resource-level routes will buffer:
+ * /d1/create, /d1/query and /r2/create (Task 1702).
+ *
+ * Parallel to object-limits.ts, which bounds the object routes. Kept separate
+ * because the facts differ: an object envelope is dominated by R2's 1,024-byte
+ * object key limit, and these routes carry no key at all. Coupling them would tie
+ * a D1 database name to R2's key limit, so a revision to either would move a bound
+ * that has no reason to move.
+ *
+ * These are bounds on house memory. They do not adjudicate the last byte of a name
+ * or a statement — the same stance object-limits.ts takes, for the same reason. The
+ * house process holds the account-wide credential, so an out-of-memory kill there
+ * takes the brand server down, and on the target hardware that is a hard freeze
+ * that emits nothing.
+ *
+ * Deliberately dependency-free, like object-limits.ts: the ui route reads these
+ * through the barrel, and nothing here needs the rest of the lib.
+ */
+
+/**
+ * Cloudflare's documented maximum SQL statement length.
+ *
+ * "Maximum SQL statement length | 100,000 bytes (100 KB)"
+ * https://developers.cloudflare.com/d1/platform/limits/
+ *
+ * Recorded because it is what governs a legitimate `sql`, and because
+ * D1_QUERY_MAX_BODY_BYTES below is only knowable as safe by way of it.
+ *
+ * A second, independent bound applies to the same string on the way out, and is
+ * recorded here so nobody rediscovers it as a bug: cf-exec's d1Query shells
+ * `execFile("npx", ["wrangler", "d1", "execute", ..., "--command", sql])`, so the
+ * decoded statement travels as a single argv element. Linux caps one such element
+ * at MAX_ARG_STRLEN = 131,072 bytes and fails execve with E2BIG above it
+ * (https://man7.org/linux/man-pages/man2/execve.2.html). That is a property of the
+ * spawn path, not of D1. It does not bind first: 100,000 < 131,072, so a statement
+ * D1 would accept always fits the spawn.
+ */
+export const D1_MAX_SQL_STATEMENT_BYTES = 100_000;
+
+/**
+ * The worst-case expansion of a byte when it is serialized into a JSON string.
+ *
+ * A single ASCII control byte becomes the six characters \uXXXX. Multi-byte
+ * characters are cheaper per byte — a 3-byte UTF-8 character also becomes six
+ * characters (2x), and a non-BMP character becomes a 12-character surrogate pair
+ * for 4 bytes (3x) — so 6 is a true ceiling over bytes, reached by ASCII.
+ *
+ * This is why a body limit is not simply the statement limit: the cap bounds the
+ * wire body, and escaping moves the two apart.
+ */
+export const JSON_STRING_WORST_CASE_EXPANSION = 6;
+
+/**
+ * The largest JSON body /d1/create or /r2/create can legitimately carry: a single
+ * resource name and JSON punctuation. No payload term, and no key term.
+ *
+ * Sized on headroom rather than a tight derivation, because only one of the two
+ * names it bounds has a documented hard limit:
+ *
+ * - R2 bucket name: 3-63 characters, lowercase letters, digits and hyphens.
+ *   https://developers.cloudflare.com/r2/buckets/create-buckets/
+ * - D1 database name: no documented limit. The API reference states only
+ *   `name: string`, "D1 database name" — no maxLength, pattern or charset.
+ *   https://developers.cloudflare.com/api/resources/d1/subresources/database/
+ *   The get-started guide gives guidance, not a limit: names "should use a
+ *   combination of ASCII characters, shorter than 32 characters".
+ *
+ * So a real body is under ~100 bytes and 64 KiB clears it by roughly 650x, while
+ * sitting ~2,100x below put's body limit: far above anything a real caller sends,
+ * far below anything that threatens house memory. Nothing here depends on either
+ * figure being exact. An undocumented D1 name limit cannot plausibly approach 64
+ * KiB, and a request body is the wrong place to discover that it had.
+ *
+ * Deliberately not R2_OBJECT_ENVELOPE_MAX_BODY_BYTES, which happens to hold the
+ * same value. That constant is governed by R2's object key limit; this one is not,
+ * and the two must be free to drift. Couple what is one fact; separate what merely
+ * matches today.
+ */
+export const STORAGE_RESOURCE_NAME_MAX_BODY_BYTES = 64 * 1024;
+
+/**
+ * The largest JSON body /d1/query can legitimately carry: a database name and a
+ * SQL statement.
+ *
+ * The envelope reasoning behind the object routes' bound does not govern this. A
+ * large but entirely legal migration or batch statement is not a 1,024-byte object
+ * key, so applying that constant here would reject correct queries.
+ *
+ * The bound is on the wire body, not the decoded statement, and JSON escaping moves
+ * those apart. The largest legal statement (D1_MAX_SQL_STATEMENT_BYTES) can present
+ * a wire body of up to
+ *
+ *   JSON_STRING_WORST_CASE_EXPANSION * 100,000 + 65,536 = 665,536 bytes
+ *
+ * so capping at 100,000 would 413 a statement D1 would have accepted. 1 MiB clears
+ * the worst case by about 1.6x and sits ~133x below put's body limit.
+ *
+ * It is a flat number rather than that expression, for legibility at the call site.
+ * The arithmetic is not decoration: it is the only thing that makes 1 MiB knowable
+ * as safe, so resource-limits.test.ts asserts the relationship. If D1 ever raises
+ * its statement limit above 163,840 bytes, that test fails rather than this route
+ * quietly beginning to refuse legal SQL.
+ */
+export const D1_QUERY_MAX_BODY_BYTES = 1024 * 1024;

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:d31a178be753e371f5773e362173eb0090115ababe81563d2b5f38890098202c
+content-hash: sha256:c7d0d9f383f8d9ee8ed50b8869ce43477e3cb5ebf62305a39041c072e34bfeb1
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2057,7 +2057,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-mail-list` | Mail newest-first. Default top=25, folder=Inbox. `folder` takes a well-known name or alias (case/space-insensitive): Inbox, Sent Items/sent, Drafts, Deleted Items/trash, Junk Email/junk/spam, Archive, Outbox — or a raw folder id. Custom folder names are not resolved. `since`/`before` (ISO date-times) narrow by receipt date. The 250-per-page figure is not a ceiling: the reply carries `nextCursor` when older mail remains — pass it back as `cursor` to page further back. Filter by sender/subject via `outlook-mail-search`. |
 | `outlook-mail-search` | Microsoft Graph `$search` (KQL) over the mailbox. Preview-only, like `outlook-mail-list`, and pages the same way via `nextCursor`/`cursor`. Put sender/subject/recipient/date filters in the query: `from:`, `to:`, `subject:`, `received>=`. Graph forbids `$search`+`$filter`, so a strict date window is on `outlook-mail-list`. |
 | `outlook-mail-fetch-body` | Complete body of one message by id (`GET /me/messages/{id}?$select=body`). HTML decoded to text, no preview cap. The full-read path — list/search return Microsoft's ~255-char preview only. Returns the envelope plus the whole body. |
-| `outlook-mail-attachment` | List or download a message's inbound attachments. With `messageId` alone, LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of file/item/reference) via `GET /me/messages/{id}/attachments` and `$select` (no bytes). With `messageId`+`attachmentId`, DOWNLOADS one file attachment: its bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — item/reference kinds, empty payloads, and anything over 25 MB are refused with nothing written. `outlook-mail-list` / `outlook-mail-search` / `outlook-mail-fetch-body` report `hasAttachments` so the agent knows when to call this. Needs `Mail.Read`. |
+| `outlook-mail-attachment` | List or download any message's attachments — received or draft. With `messageId` alone, LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of file/item/reference) via `GET /me/messages/{id}/attachments` and `$select` (no bytes). A draft is a message in the same collection, so passing a draftId lists what that draft carries; the returned `name`/`id` is what `outlook-draft-edit`'s `removeAttachments` takes. With `messageId`+`attachmentId`, DOWNLOADS one file attachment: its bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — item/reference kinds, empty payloads, and anything over 25 MB are refused with nothing written. `outlook-mail-list` / `outlook-mail-search` / `outlook-mail-fetch-body` report `hasAttachments` so the agent knows when to call this. Needs `Mail.Read`. |
 | `outlook-mail-reply` | Reply in-thread (`createReply` / `createReplyAll` + send). Threads natively via conversationId. `replyAll`, added cc/bcc, and account-scoped file attachments (up to 25 MB per file; files over Graph's ~3 MB inline limit use a chunked upload session). Body is plain text, prepended above the quote. Needs `Mail.ReadWrite` + `Mail.Send`. |
 | `outlook-mail-delete` | Move messages to Deleted Items (`POST /me/messages/{id}/move`). Recoverable — never hard-deletes. An id already gone is counted not-moved. Needs `Mail.ReadWrite`. |
 | `outlook-mail-otp-extract` | Poll the inbox for a one-time code from a sender (domain). Reads full bodies to extract it; optional subject regex and timeout (default 60 s). |
@@ -2071,9 +2071,9 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-contacts-list` | Top contacts. Default top=50. |
 | `outlook-mailbox-info` | Health probe for one mailbox — auth state, refresh-window, folder count. Name the mailbox with `mailbox` when several are attached. |
 | `outlook-mailbox-list` | Every connected mailbox with its email, scopes, and token health. Local only — no network — so it also flags a mailbox whose stored credentials cannot be read. |
-| `outlook-mail-send` | Send a message (`POST /me/sendMail`). to/cc/bcc arrays, subject, body, isHtml. Success asserted on Graph 202. Needs `Mail.Send`. |
-| `outlook-draft` | Create a draft in Drafts (`POST /me/messages`). Same body model. Returns the draft id. Needs `Mail.ReadWrite`. |
-| `outlook-draft-edit` | Update an existing draft in place (`PATCH /me/messages/{draftId}`). Graph drafts are mutable — pass draftId plus the fields to change (to/cc/bcc/subject/body/isHtml). Sent messages cannot be edited. Needs `Mail.ReadWrite`. |
+| `outlook-mail-send` | Send a message. No attachments → `POST /me/sendMail`; with attachments → draft, attach, send (`/me/sendMail` carries attachments inline and cannot fit a large file). to/cc/bcc arrays, subject, body, isHtml, attachments (account-dir paths, 25 MB/file). Success asserted on Graph 202; no message id on either route. Needs `Mail.Send` (+ `Mail.ReadWrite` to attach). |
+| `outlook-draft` | Create a draft in Drafts (`POST /me/messages`). Same body model, including attachments — files are attached before the id is returned, so the draft is ready to send. Returns the draft id. Needs `Mail.ReadWrite`. |
+| `outlook-draft-edit` | Update an existing draft in place (`PATCH /me/messages/{draftId}`) and/or add and remove attachments. Graph drafts are mutable — pass draftId plus the fields to change (to/cc/bcc/subject/body/isHtml/attachments/removeAttachments). `attachments` adds; `removeAttachments` takes files off by name or attachment id; both together replace a file in one call. Sent messages cannot be edited. Needs `Mail.ReadWrite`. |
 | `outlook-draft-send` | Send an existing draft by id (`POST /me/messages/{id}/send`). Graph consumes the draft, returns 202. Needs `Mail.Send`. |
 
 ## Observability
@@ -2148,7 +2148,7 @@ Latency triage: `mail-list count=0 elapsedMs<200` consistent → permissions iss
 
 ## Out of scope
 
-Mail move to arbitrary folders / flag, hard (permanent) delete, ingesting reviewed mail into the business graph (the `email-ingest` analogue), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.
+Mail move to arbitrary folders / flag, hard (permanent) delete, removing an attachment from a **sent** message (Graph forbids it), ingesting reviewed mail into the business graph (the `email-ingest` analogue), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments, with a draft's attachments editable in place (add, remove, replace) — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.
 
 ---
 # QuickBooks Online
@@ -2715,6 +2715,7 @@ Voice mirror is on by default for every drafting skill. To opt out for one, set
 - **Copy public figures** — voice mirror only learns from your own writing.
 - **Clone audio** — text only, no speech synthesis.
 - **Guess** — historical content stays `unknown` until you mark it. Maxy never auto-classifies your writing. (Automatic ingestion applies only to your live PTY sessions where authorship is certain.)
+- **Invent an identity** — a voice belongs to a real admin user on the account. Attribution is refused outright if it names anyone else, and nothing is written. A person's name is not an identity, so tagging someone's writing on a shared account needs their actual admin id, not their name.
 
 ## Status
 

package/payload/platform/plugins/cloudflare/PLUGIN.md

@@ -32,7 +32,9 @@ The plugin registers no agent-facing MCP tools. Every Cloudflare operation is th
 | Skill | Purpose |
 |---|---|
 | [cloudflare/SKILL.md](skills/cloudflare/SKILL.md) | The entry point for every Cloudflare operation. Routes each operation class to its reference, names the outcome contracts (tunnel external HTTP 200; hosting deployed URL; D1 round-trip), and states the tool-discipline + secret-redaction rules that bind the agent. |
-| [site-deploy/SKILL.md](skills/site-deploy/SKILL.md) | Assemble one canonical content tree into a live Pages deployment on its custom domain that survives the install device being offline. Names the single-source-tree convention, the reused per-scope token, the form-to-D1 trigger, Open Graph correctness, and the cache-busted live-`200` done-gate; defers the command blocks to `hosting-sites.md` and `d1-data-capture.md`. Admin-run; a content specialist hands the deploy off to it. |
+| [site-deploy/SKILL.md](skills/site-deploy/SKILL.md) | Assemble one canonical content tree into a live Pages deployment on its custom domain that survives the install device being offline. Names the single-source-tree convention, the reused per-scope token, the form-to-D1 trigger, the R2 binding trigger, Open Graph correctness, and the cache-busted live-`200` done-gate; defers the command blocks to `hosting-sites.md`, `d1-data-capture.md` and `r2-object-storage.md`. Admin-run; a content specialist hands the deploy off to it. |
+| [calendar-site/SKILL.md](skills/calendar-site/SKILL.md) | Assemble and deploy one account's public booking page — a static page plus edge Functions over a D1 `bookings` table — on its own custom domain, so a submission survives the install device being offline. Admin-run; defers the deploy and the live done-gate to `site-deploy`. |
+| [data-portal/SKILL.md](skills/data-portal/SKILL.md) | Stand up one account's gated file-drop portal on its own custom domain: each enrolled person signs in with their own passcode and can upload, list, download and delete only their own files, into one R2 bucket under a per-person prefix with a D1 manifest row per upload. The bucket is created by the owning account's own session — the broker registers ownership to the creator and never reassigns it — while the admin assembles and deploys. Admin-run; defers the deploy and the live done-gate to `site-deploy`. |
 
 ### References
 

package/payload/platform/plugins/cloudflare/bin/cf-token.sh

@@ -46,9 +46,10 @@ case "$scope" in pages|d1|storage|calendar-d1|dns|access) ;; *) die "unknown sco
 # specialist. Every account's session runs as the SAME OS user (no uid/gid is
 # dropped at spawn) and the house env path is deterministic, so an agent holding
 # Bash can read that file directly or export a false ACCOUNT_ID. Real enforcement
-# needs OS user separation; until that lands this is a boundary of intent, not of
-# permission. Do not cite this gate as proof a sub-account cannot reach the
-# master.
+# needs OS user separation, which was costed and declined as disproportionate
+# (Task 1690, archived undone). This is therefore permanently a boundary of
+# intent, not of permission -- no follow-up tracks closing it. Do not cite this
+# gate as proof a sub-account cannot reach the master.
 #
 # "House" is an exact shell mirror of resolveAccountDir + isHouseAccount
 # (platform/services/claude-session-manager/src/config.ts:238-323) -- the same