@rubytech/create-maxy-code 0.1.459 → 0.1.461

package/dist/__tests__/cron-heartbeat-registration.test.js

@@ -1,14 +1,15 @@
-// Acceptance gate for the restored scheduling-watcher heartbeat cron.
+// Acceptance gate for the per-brand cron block.
 //
-// The installer registers exactly ONE install-level cron line that ticks
-// check-due-events.js once a minute. These invariants protect the two
-// regressions that the original block caused (and that its narrowed
+// The installer registers exactly TWO install-level cron lines: the
+// scheduling-watcher heartbeat ticking check-due-events.js once a minute, and
+// (Task 1706) the log rotator every 15 minutes. These invariants protect the
+// two regressions that the original block caused (and that its narrowed
 // replacement must not reintroduce), plus the marker contract the admin
 // `system-status` check reads back.
 //
-//   (a) The block carries a single heartbeat entry — no email-fetch /
-//       email-auto-respond line. Those dispatchers act without an operator
-//       booking and stay unscheduled by the installer.
+//   (a) The block carries the heartbeat and the rotator and nothing else — no
+//       email-fetch / email-auto-respond line. Those dispatchers act without an
+//       operator booking and stay unscheduled by the installer.
 //   (b) The entry never `mkdir`s an account log dir. The legacy line ran
 //       `mkdir -p data/accounts/<id>/logs` every 60s, tripping
 //       setup-account/seed-neo4j's stub-account-dirs guard on reinstall.
@@ -22,7 +23,7 @@
 //       never stacks a second copy.
 import test from "node:test";
 import assert from "node:assert/strict";
-import { cronBlockMarkers, buildHeartbeatCronBlock, stripCronBlock, mergeHeartbeatBlock, } from "../cron-registration.js";
+import { cronBlockMarkers, buildBrandCronBlock, stripCronBlock, mergeBrandCronBlock, } from "../cron-registration.js";
 const OPTS = {
     productName: "maxy-code",
     platformRoot: "/home/me/maxy-code/platform",
@@ -32,7 +33,7 @@ const OPTS = {
     uiPort: 19201,
 };
 test("heartbeat entry carries MAXY_UI_INTERNAL_PORT so the dispatcher can reach the inject route (Task 1378)", () => {
-    const block = buildHeartbeatCronBlock(OPTS);
+    const block = buildBrandCronBlock(OPTS);
     assert.match(block, /MAXY_UI_INTERNAL_PORT=19201 /, "entry must export the UI internal port for schedule-inject");
 });
 test("markers are # BEGIN/END <PRODUCT_UPPER> CRONS (admin system-status contract)", () => {
@@ -40,41 +41,69 @@ test("markers are # BEGIN/END <PRODUCT_UPPER> CRONS (admin system-status contrac
     assert.equal(begin, "# BEGIN MAXY-CODE CRONS");
     assert.equal(end, "# END MAXY-CODE CRONS");
 });
-test("block has exactly one heartbeat entry, no email lines", () => {
-    const block = buildHeartbeatCronBlock(OPTS);
+test("block has exactly two entries — heartbeat and logs-rotate, no email lines", () => {
+    const block = buildBrandCronBlock(OPTS);
     const entries = block.split("\n").filter((l) => l.trim() && !l.trim().startsWith("#"));
-    assert.equal(entries.length, 1, "expected exactly one cron entry");
-    assert.match(entries[0], / # heartbeat$/, "entry must be tagged # heartbeat");
+    assert.equal(entries.length, 2, "expected exactly two cron entries");
+    assert.match(entries[0], / # heartbeat$/, "first entry must be tagged # heartbeat");
+    assert.match(entries[1], / # logs-rotate$/, "second entry must be tagged # logs-rotate");
     assert.doesNotMatch(block, /email-fetch/, "email-fetch must not be scheduled");
     assert.doesNotMatch(block, /email-auto-respond/, "email-auto-respond must not be scheduled");
 });
 test("heartbeat entry never mkdirs an account log dir (Task 039 guard)", () => {
-    const block = buildHeartbeatCronBlock(OPTS);
+    const block = buildBrandCronBlock(OPTS);
     assert.doesNotMatch(block, /mkdir/, "no mkdir in the cron line");
     assert.doesNotMatch(block, /data\/accounts/, "must not touch the seed-guard account dir");
     assert.match(block, />> \/home\/me\/\.maxy-code\/logs\/check-due-events\.log 2>&1/, "log must redirect to <persistDir>/logs");
 });
 test("NEO4J_URI is pinned to the brand bolt port, never defaulting 7687 (Task 571 guard)", () => {
-    const block = buildHeartbeatCronBlock(OPTS);
+    const block = buildBrandCronBlock(OPTS);
     assert.match(block, /NEO4J_URI=bolt:\/\/localhost:17687 /, "NEO4J_URI must pin the brand port");
     assert.doesNotMatch(block, /7687(?!.)/, "must not reference the default 7687 port");
 });
 test("entry runs check-due-events.js with PLATFORM_ROOT and no ACCOUNT_ID", () => {
-    const block = buildHeartbeatCronBlock(OPTS);
+    const block = buildBrandCronBlock(OPTS);
     assert.match(block, /PLATFORM_ROOT=\/home\/me\/maxy-code\/platform /);
     assert.match(block, /\/plugins\/scheduling\/mcp\/dist\/scripts\/check-due-events\.js/);
     assert.doesNotMatch(block, /ACCOUNT_ID=/, "watcher scans all accounts itself; no per-account scoping");
 });
 test("entry fires every minute", () => {
-    const block = buildHeartbeatCronBlock(OPTS);
+    const block = buildBrandCronBlock(OPTS);
     const entry = block.split("\n").find((l) => l.includes("check-due-events"));
     assert.match(entry, /^\* \* \* \* \* /, "must be a once-a-minute schedule");
 });
+test("Task 1706 — rotator entry ticks every 15 minutes with the logs dir as its argument", () => {
+    const block = buildBrandCronBlock(OPTS);
+    const entry = block.split("\n").find((l) => l.includes("logs-rotate.sh"));
+    assert.match(entry, /^\*\/15 \* \* \* \* /, "must be a quarter-hourly schedule");
+    assert.match(entry, /\/home\/me\/maxy-code\/platform\/scripts\/logs-rotate\.sh \/home\/me\/\.maxy-code\/logs /, "the logs dir must be passed explicitly — a co-resident brand must never rotate a sibling's logs");
+});
+test("Task 1706 — the rotator's own lines go to server.log, the file it bounds", () => {
+    const block = buildBrandCronBlock(OPTS);
+    const entry = block.split("\n").find((l) => l.includes("logs-rotate.sh"));
+    assert.match(entry, />> \/home\/me\/\.maxy-code\/logs\/server\.log 2>&1/);
+});
+test("Task 1706 — rotator entry inherits the heartbeat's guards: no mkdir, no account dir, no env", () => {
+    const block = buildBrandCronBlock(OPTS);
+    const entry = block.split("\n").find((l) => l.includes("logs-rotate.sh"));
+    assert.doesNotMatch(entry, /mkdir/, "no mkdir in the cron line (Task 039 guard)");
+    assert.doesNotMatch(entry, /data\/accounts/, "must not touch the seed-guard account dir");
+    assert.doesNotMatch(entry, /NEO4J_URI=/, "the rotator reads no env — its logs dir is an argument");
+});
+test("Task 1706 — system-status can name both entries from their trailing comments", () => {
+    // platform/plugins/admin/mcp/src/index.ts:466 matches /#\s*(.+)$/ per entry.
+    const block = buildBrandCronBlock(OPTS);
+    const names = block
+        .split("\n")
+        .filter((l) => l.trim() && !l.trim().startsWith("#"))
+        .map((l) => l.match(/#\s*(.+)$/)?.[1].trim());
+    assert.deepEqual(names, ["heartbeat", "logs-rotate"]);
+});
 test("stripCronBlock removes a present block and counts its entries", () => {
-    const tab = `MAILTO=""\n${buildHeartbeatCronBlock(OPTS)}\n`;
+    const tab = `MAILTO=""\n${buildBrandCronBlock(OPTS)}\n`;
     const { cleaned, removedEntries, matched } = stripCronBlock(tab, "maxy-code");
     assert.equal(matched, true);
-    assert.equal(removedEntries, 1);
+    assert.equal(removedEntries, 2);
     assert.equal(cleaned, 'MAILTO=""');
 });
 test("stripCronBlock is a no-op signal when no block is present", () => {
@@ -85,20 +114,20 @@ test("stripCronBlock is a no-op signal when no block is present", () => {
     assert.equal(cleaned, "0 3 * * * /usr/bin/backup.sh");
 });
 test("stripCronBlock escapes the brand name (hyphen/dot safe)", () => {
-    const block = buildHeartbeatCronBlock({ ...OPTS, productName: "real.agent-code" });
+    const block = buildBrandCronBlock({ ...OPTS, productName: "real.agent-code" });
     const { matched, removedEntries } = stripCronBlock(block, "real.agent-code");
     assert.equal(matched, true);
-    assert.equal(removedEntries, 1);
+    assert.equal(removedEntries, 2);
 });
-test("mergeHeartbeatBlock appends to an empty crontab", () => {
-    const block = buildHeartbeatCronBlock(OPTS);
-    const merged = mergeHeartbeatBlock("", block, "maxy-code");
+test("mergeBrandCronBlock appends to an empty crontab", () => {
+    const block = buildBrandCronBlock(OPTS);
+    const merged = mergeBrandCronBlock("", block, "maxy-code");
     assert.equal(merged, `${block}\n`);
 });
-test("mergeHeartbeatBlock replaces an existing block — idempotent re-install", () => {
-    const block = buildHeartbeatCronBlock(OPTS);
-    const once = mergeHeartbeatBlock(`0 3 * * * /usr/bin/backup.sh\n`, block, "maxy-code");
-    const twice = mergeHeartbeatBlock(once, block, "maxy-code");
+test("mergeBrandCronBlock replaces an existing block — idempotent re-install", () => {
+    const block = buildBrandCronBlock(OPTS);
+    const once = mergeBrandCronBlock(`0 3 * * * /usr/bin/backup.sh\n`, block, "maxy-code");
+    const twice = mergeBrandCronBlock(once, block, "maxy-code");
     assert.equal(once, twice, "re-applying the merge must not stack a second block");
     const blockCount = (twice.match(/# BEGIN MAXY-CODE CRONS/g) || []).length;
     assert.equal(blockCount, 1, "exactly one brand block after re-install");

package/dist/__tests__/launchd-plist.test.js

@@ -280,3 +280,29 @@ test("session-manager plist renders bash wrapper as sole ProgramArguments", () =
     assert.match(xml, /<key>KeepAlive<\/key>\s*<true\/>/);
     assert.match(xml, /<key>RunAtLoad<\/key>\s*<true\/>/);
 });
+test("Task 1706 — logs-rotate plist is a 15-minute one-shot taking the logs dir as an argument", () => {
+    const xml = renderPlist({
+        label: "com.rubytech.maxy-code-logs-rotate",
+        programArguments: [
+            "/Users/x/maxy-code/platform/scripts/logs-rotate.sh",
+            "/Users/x/.maxy-code/logs",
+        ],
+        stdoutPath: "/Users/x/.maxy-code/logs/server.log",
+        stderrPath: "/Users/x/.maxy-code/logs/server.log",
+        keepAlive: false,
+        runAtLoad: false,
+        startInterval: 900,
+    });
+    assert.match(xml, /<string>com\.rubytech\.maxy-code-logs-rotate<\/string>/);
+    // The logs dir is passed explicitly — a co-resident brand must never rotate a
+    // sibling's logs.
+    assert.match(xml, /<string>\/Users\/x\/maxy-code\/platform\/scripts\/logs-rotate\.sh<\/string>\s*<string>\/Users\/x\/\.maxy-code\/logs<\/string>/);
+    assert.match(xml, /<key>StartInterval<\/key>\s*<integer>900<\/integer>/);
+    // A periodic one-shot, not a supervised daemon — same shape as the heartbeat.
+    assert.match(xml, /<key>KeepAlive<\/key>\s*<false\/>/);
+    assert.match(xml, /<key>RunAtLoad<\/key>\s*<false\/>/);
+    // No wrapper: unlike the heartbeat the rotator sources no .env.
+    assert.doesNotMatch(xml, /\/bin\/bash/);
+    // The rotator's own lines go to server.log, the file it itself bounds.
+    assert.match(xml, /<key>StandardOutPath<\/key>\s*<string>\/Users\/x\/\.maxy-code\/logs\/server\.log<\/string>/);
+});

package/dist/cron-registration.js

@@ -1,11 +1,21 @@
-// Scheduling-watcher heartbeat cron — pure string builders.
+// Per-brand cron block — pure string builders.
 //
-// The installer registers ONE install-level cron line that ticks
-// `scheduling/mcp/dist/scripts/check-due-events.js` once a minute. The watcher
+// The installer registers TWO install-level cron lines inside one
+// BEGIN/END-delimited per-brand block.
+//
+// 1. The scheduling-watcher heartbeat, once a minute, ticking
+// `scheduling/mcp/dist/scripts/check-due-events.js`. The watcher
 // scans every account itself (listLocalAccountIds → data/accounts/*/account.json)
 // and only dispatches operator-created bookings whose time has come, so a
 // per-minute tick creates no activity of its own.
 //
+// 2. The log rotator (Task 1706), every 15 minutes, ticking
+// `platform/scripts/logs-rotate.sh`. cron is the mechanism because the platform
+// ships zero systemd timers — this block is the established per-brand periodic
+// surface, already merged idempotently here, already stripped by the
+// uninstaller, already read back by admin `system-status`. darwin has no cron;
+// its analogue is a StartInterval LaunchAgent authored in index.ts.
+//
 // Narrowed from the block removed in Task 039 (commit 08e64c1f7), which also
 // reintroduces neither regression that removal fixed:
 //   - No `mkdir` of an account log dir. Logs go to <persistDir>/logs, outside
@@ -29,16 +39,28 @@ export function cronBlockMarkers(productName) {
     const upper = productName.toUpperCase();
     return { begin: `# BEGIN ${upper} CRONS`, end: `# END ${upper} CRONS` };
 }
-/** The three-line cron block: BEGIN marker, the single heartbeat entry, END marker. */
-export function buildHeartbeatCronBlock(opts) {
+/** The four-line cron block: BEGIN marker, the heartbeat entry, the logs-rotate
+ *  entry, END marker. Each entry carries a trailing `# <name>` comment — admin
+ *  `system-status` names entries by exactly that (admin/mcp/src/index.ts:466),
+ *  so the block self-reports as "2 registered: heartbeat, logs-rotate". */
+export function buildBrandCronBlock(opts) {
     const { begin, end } = cronBlockMarkers(opts.productName);
     const script = `${opts.platformRoot}/plugins/scheduling/mcp/dist/scripts/check-due-events.js`;
     const log = `${opts.logDir}/check-due-events.log`;
-    const entry = `* * * * * PLATFORM_ROOT=${opts.platformRoot} ` +
+    const heartbeat = `* * * * * PLATFORM_ROOT=${opts.platformRoot} ` +
         `NEO4J_URI=bolt://localhost:${opts.neo4jPort} ` +
         `MAXY_UI_INTERNAL_PORT=${opts.uiPort} ` +
         `${opts.nodeBin} ${script} >> ${log} 2>&1 # heartbeat`;
-    return [begin, entry, end].join("\n");
+    // Task 1706. Every 15 minutes: at the ~1 MB/hour measured on sitedesk-code the
+    // live file stays within a megabyte of its 64 MiB bound. The rotator reads no
+    // env — its logs dir is a positional argument, so a co-resident brand can
+    // never rotate a sibling's logs. Its own lines go to server.log, the file it
+    // itself bounds; a dedicated rotator log would be one more unbounded file.
+    // cron's `>>` is open-append-close per tick, so it is unaffected by the
+    // rotator truncating that same file underneath it.
+    const rotateScript = `${opts.platformRoot}/scripts/logs-rotate.sh`;
+    const rotate = `*/15 * * * * ${rotateScript} ${opts.logDir} >> ${opts.logDir}/server.log 2>&1 # logs-rotate`;
+    return [begin, heartbeat, rotate, end].join("\n");
 }
 /** Escape a brand name for safe embedding in a RegExp (hyphens, dots). */
 function escapeRegExp(s) {
@@ -67,7 +89,7 @@ export function stripCronBlock(crontab, productName) {
  * fresh block. Re-running with the same block is idempotent — a re-install
  * replaces the block, never stacks a second copy.
  */
-export function mergeHeartbeatBlock(existing, block, productName) {
+export function mergeBrandCronBlock(existing, block, productName) {
     const { cleaned } = stripCronBlock(existing, productName);
     return cleaned ? `${cleaned}\n${block}\n` : `${block}\n`;
 }

package/dist/index.js

@@ -6,7 +6,7 @@ import { seedBypassPermissionsSettings, assertBypassPermissionsSeed } from "./pe
 import { resolve, join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
 import { resolveInstallPortFromFs, buildMaxyUnitFile, buildClaudeSessionManagerUnitFile, buildClaudePtysSliceUnitFile, buildCloudflaredSliceUnitFile, buildDarwinServiceEnvPath } from "./port-resolution.js";
-import { buildHeartbeatCronBlock, mergeHeartbeatBlock } from "./cron-registration.js";
+import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
 import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
 import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
 import { findPeerBrandOnDefaultNeo4jPort } from "./peer-brand-detect.js";
@@ -3503,10 +3503,11 @@ function resolveInstallAccountId() {
 // ---------------------------------------------------------------------------
 // Cron registration — scheduling-watcher heartbeat
 //
-// Registers ONE install-level cron line that ticks check-due-events.js every
-// minute (see cron-registration.ts for the line shape and the two regression
-// guards). Idempotent across re-installs via the BEGIN/END markers. Linux-only
-// — darwin runs under launchd and registers no cron. The email dispatchers are
+// Registers the per-brand cron block: check-due-events.js every minute, and
+// (Task 1706) logs-rotate.sh every 15 minutes. See cron-registration.ts for the
+// line shapes and the regression guards. Idempotent across re-installs via the
+// BEGIN/END markers. Linux-only — darwin runs under launchd and registers no
+// cron, so it gets LaunchAgent analogues for both. The email dispatchers are
 // deliberately NOT registered here.
 //
 // The log dir <persistDir>/logs is created earlier in installServiceLinux
@@ -3518,7 +3519,7 @@ function installCrons() {
     const nodeBin = spawnSync("which", ["node"], { encoding: "utf-8" }).stdout.trim() || "/usr/bin/node";
     const platformRoot = join(INSTALL_DIR, "platform");
     const logDir = join(resolve(process.env.HOME ?? "/root", BRAND.configDir), "logs");
-    const block = buildHeartbeatCronBlock({
+    const block = buildBrandCronBlock({
         productName: BRAND.productName,
         platformRoot,
         neo4jPort: NEO4J_PORT,
@@ -3531,14 +3532,14 @@ function installCrons() {
     });
     const existing = spawnSync("crontab", ["-l"], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
     const currentCrontab = existing.status === 0 ? existing.stdout : "";
-    const newCrontab = mergeHeartbeatBlock(currentCrontab, block, BRAND.productName);
+    const newCrontab = mergeBrandCronBlock(currentCrontab, block, BRAND.productName);
     const write = spawnSync("crontab", ["-"], {
         input: newCrontab,
         encoding: "utf-8",
         stdio: ["pipe", "pipe", "pipe"],
     });
     if (write.status === 0) {
-        console.log("  Cron jobs: registered (heartbeat)");
+        console.log("  Cron jobs: registered (heartbeat, logs-rotate)");
     }
     else {
         console.error(`  Cron jobs: failed to register — ${(write.stderr || "").trim()}`);
@@ -3846,7 +3847,7 @@ function installServiceDarwin() {
         console.log(`  Session manager not yet healthy on ${BRAND.claudeSessionManagerPort} — check ${join(logsDir, "server.log")}.`);
     }
     // Task 1403 — the scheduling heartbeat. On Linux a per-minute cron ticks
-    // check-due-events.js (installCrons/buildHeartbeatCronBlock); darwin has no
+    // check-due-events.js (installCrons/buildBrandCronBlock); darwin has no
     // cron and installCrons early-returns, so operator-created bookings would
     // never dispatch. Author a StartInterval=60 LaunchAgent as the timer analogue:
     // keepAlive=false (a periodic one-shot, not a supervised daemon). A bootstrap
@@ -3884,6 +3885,46 @@ function installServiceDarwin() {
         console.error(`  WARNING: heartbeat LaunchAgent ${hbLabel} bootstrap returned ${hbBoot.bootstrapStatus} after ${hbBoot.attempts} attempt(s): ${hbBoot.stderr} — scheduling ticks will not fire until a re-install succeeds.`);
         logFile(`  [create-maxy] launchd-plist=${hbLabel} loaded=false exit=${hbBoot.bootstrapStatus} attempts=${hbBoot.attempts}`);
     }
+    // Task 1706 — the log rotator. On Linux a */15 entry in the per-brand cron
+    // block ticks logs-rotate.sh (installCrons/buildBrandCronBlock); darwin has no
+    // cron and installCrons early-returns, so brand logs would grow unbounded.
+    // Author a StartInterval=900 LaunchAgent as the timer analogue: keepAlive=false
+    // (a periodic one-shot, not a supervised daemon). No wrapper script — unlike
+    // the heartbeat the rotator reads no env; its logs dir is a positional arg,
+    // which also means a co-resident brand can never rotate a sibling's logs. Its
+    // own lines go to server.log, the file it itself bounds. A bootstrap failure
+    // warns rather than aborting install — logs growing is a slow problem and the
+    // next installer run retries.
+    const lrLabel = `${launchdLabel()}-logs-rotate`;
+    const lrPlistPath = join(launchAgentsDir(), `${lrLabel}.plist`);
+    const lrScript = join(INSTALL_DIR, "platform", "scripts", "logs-rotate.sh");
+    const lrPlist = renderPlist({
+        label: lrLabel,
+        programArguments: [lrScript, logsDir],
+        stdoutPath: join(logsDir, "server.log"),
+        stderrPath: join(logsDir, "server.log"),
+        keepAlive: false,
+        runAtLoad: false,
+        startInterval: 900,
+    });
+    writeFileSync(lrPlistPath, lrPlist);
+    logFile(`  ${lrPlistPath} written (${lrPlist.length} bytes)`);
+    const lrBoot = bootstrapLaunchAgent((args) => {
+        const r = spawnSync("launchctl", args, { stdio: "pipe", encoding: "utf-8", timeout: 15_000 });
+        return { status: r.status, stderr: (r.stderr ?? "").toString() };
+    }, {
+        gui: gui(),
+        label: lrLabel,
+        plistPath: lrPlistPath,
+        logger: (line) => { console.log(`  ${line}`); logFile(`  ${line}`); },
+    });
+    if (lrBoot.ok) {
+        logFile(`  [create-maxy] launchd-plist=${lrLabel} loaded=true attempts=${lrBoot.attempts}`);
+    }
+    else {
+        console.error(`  WARNING: logs-rotate LaunchAgent ${lrLabel} bootstrap returned ${lrBoot.bootstrapStatus} after ${lrBoot.attempts} attempt(s): ${lrBoot.stderr} — brand logs will not be rotated until a re-install succeeds.`);
+        logFile(`  [create-maxy] launchd-plist=${lrLabel} loaded=false exit=${lrBoot.bootstrapStatus} attempts=${lrBoot.attempts}`);
+    }
     // Wait for the server to come up.
     console.log("  Waiting for web server...");
     let webServerUp = false;

package/dist/launchd-plist.js

@@ -55,7 +55,7 @@ export function buildSessionManagerWrapper(o) {
 /**
  * Bash wrapper for the darwin scheduling-heartbeat LaunchAgent (Task 1403).
  * launchd's StartInterval timer is the analogue of the Linux per-minute cron
- * (buildHeartbeatCronBlock) that ticks `check-due-events.js`. The wrapper
+ * (buildBrandCronBlock) that ticks `check-due-events.js`. The wrapper
  * sources the brand `.env` for NEO4J_URI + MAXY_UI_INTERNAL_PORT, exports
  * PLATFORM_ROOT (the tick's own env contract, matching the cron line's
  * `PLATFORM_ROOT=` prefix), and execs the tick once. launchd re-invokes it

package/dist/uninstall.js

@@ -79,14 +79,20 @@ function launchdLabel() {
     return `com.rubytech.${BRAND.hostname}`;
 }
 /** Every LaunchAgent label installServiceDarwin() creates for this brand: the
- *  main server, the claude-session-manager (Task 1395), and the scheduling
- *  heartbeat (Task 1403). A non-default (dedicated) brand also runs the
- *  per-brand Neo4j LaunchAgent (Task 1396). Uninstall boots out and removes all. */
+ *  main server, the claude-session-manager (Task 1395), the scheduling
+ *  heartbeat (Task 1403), and the log rotator (Task 1706). A non-default
+ *  (dedicated) brand also runs the per-brand Neo4j LaunchAgent (Task 1396).
+ *  Uninstall boots out and removes all.
+ *
+ *  This list is explicit, not a glob, so a LaunchAgent added to
+ *  installServiceDarwin() and not added here survives uninstall and keeps
+ *  ticking against a deleted install. Add both together, always. */
 function darwinLaunchdLabels() {
     const labels = [
         launchdLabel(),
         `${launchdLabel()}-claude-session-manager`,
         `${launchdLabel()}-heartbeat`,
+        `${launchdLabel()}-logs-rotate`,
     ];
     if ((BRAND.neo4jPort ?? SHARED_NEO4J_PORT) !== SHARED_NEO4J_PORT) {
         labels.push(`${launchdLabel()}-neo4j`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.459",
+  "version": "0.1.461",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/storage-broker/dist/__tests__/cf-exec.test.js

@@ -328,12 +328,15 @@ function objectPage(keys, opts = {}) {
         success: true,
         errors: [],
         messages: [],
-        result: keys.map((key) => ({
-            key,
-            size: 10,
-            etag: "e1",
-            last_modified: "2026-01-01T00:00:00Z",
-        })),
+        result: keys.map((k) => {
+            const entry = typeof k === "string" ? { key: k, size: 10 } : k;
+            return {
+                key: entry.key,
+                size: entry.size,
+                etag: "e1",
+                last_modified: "2026-01-01T00:00:00Z",
+            };
+        }),
         result_info: { cursor: opts.cursor ?? "", is_truncated: opts.truncated ?? false },
     });
 }
@@ -489,4 +492,111 @@ function objectPage(keys, opts = {}) {
     strict_1.default.deepEqual((await cf.r2ObjectList("b")).map((o) => o.key), ["a.jpg", "b.jpg"]);
     strict_1.default.equal(calls.length, 2);
 });
+// --- r2ObjectFind (Task 1697) ---------------------------------------------
+//
+// Sizing a get needs one record, not the prefix. These tests pin the two
+// properties that make the early exit safe: it matches the exact key, and it
+// stops at the page carrying it.
+(0, node_test_1.default)("r2ObjectFind returns the exact key when a prefix neighbour is listed first", async () => {
+    // Not hypothetical. Measured 2026-07-16 against the live v4 API: prefix=
+    // a/photo.jpg really does return a/photo.jpg.bak BEFORE a/photo.jpg, because
+    // the listing is not in ascending UTF-8 binary order. Taking the first element
+    // would size the neighbour, which either rejects a legal get or admits an
+    // oversized one.
+    const { fetchFn } = recordingFetch({
+        ok: true,
+        status: 200,
+        body: objectPage([
+            { key: "a/photo.jpg.bak", size: 999 },
+            { key: "a/photo.jpg", size: 3 },
+        ]),
+    });
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    const found = await cf.r2ObjectFind("b", "a/photo.jpg");
+    strict_1.default.equal(found?.key, "a/photo.jpg");
+    strict_1.default.equal(found?.size, 3);
+});
+(0, node_test_1.default)("r2ObjectFind sends the key as the prefix, encoded", async () => {
+    const { fetchFn, calls } = recordingFetch({ ok: true, status: 200, body: objectPage([]) });
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    await cf.r2ObjectFind("b", "person a/x.jpg");
+    strict_1.default.ok(calls[0].url.endsWith("/objects?prefix=person+a%2Fx.jpg"), calls[0].url);
+});
+(0, node_test_1.default)("r2ObjectFind stops at the page carrying the match and fetches no further page", async () => {
+    // The page says truncated with a cursor, so r2ObjectList would fetch page 2.
+    // sequenceFetch throws on an unexpected call, so a second fetch fails here.
+    const { fetchFn, calls } = sequenceFetch([
+        {
+            ok: true,
+            status: 200,
+            body: objectPage([{ key: "k", size: 7 }], { cursor: "c1", truncated: true }),
+        },
+    ]);
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    const found = await cf.r2ObjectFind("b", "k");
+    strict_1.default.equal(found?.size, 7);
+    strict_1.default.equal(calls.length, 1);
+});
+(0, node_test_1.default)("r2ObjectFind finds a match on a later page, never assuming position", async () => {
+    const { fetchFn, calls } = sequenceFetch([
+        { ok: true, status: 200, body: objectPage(["x.jpg"], { cursor: "c1", truncated: true }) },
+        { ok: true, status: 200, body: objectPage([{ key: "k", size: 5 }], { truncated: false }) },
+    ]);
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    const found = await cf.r2ObjectFind("b", "k");
+    strict_1.default.equal(found?.size, 5);
+    strict_1.default.equal(calls.length, 2);
+});
+(0, node_test_1.default)("r2ObjectFind returns null when the key is absent after exhausting pages", async () => {
+    const { fetchFn, calls } = sequenceFetch([
+        { ok: true, status: 200, body: objectPage(["k.bak"], { cursor: "c1", truncated: true }) },
+        { ok: true, status: 200, body: objectPage(["k.zzz"], { truncated: false }) },
+    ]);
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    strict_1.default.equal(await cf.r2ObjectFind("b", "k"), null);
+    strict_1.default.equal(calls.length, 2);
+});
+(0, node_test_1.default)("r2ObjectFind throws on a repeated cursor instead of looping forever", async () => {
+    const { fetchFn } = sequenceFetch([
+        { ok: true, status: 200, body: objectPage(["x"], { cursor: "c1", truncated: true }) },
+        { ok: true, status: 200, body: objectPage(["y"], { cursor: "c1", truncated: true }) },
+    ]);
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    await strict_1.default.rejects(() => cf.r2ObjectFind("b", "k"), /repeated pagination cursor/);
+});
+(0, node_test_1.default)("r2ObjectFind throws when truncated but no cursor is given", async () => {
+    const { fetchFn } = recordingFetch({
+        ok: true,
+        status: 200,
+        body: objectPage(["x"], { cursor: "", truncated: true }),
+    });
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    await strict_1.default.rejects(() => cf.r2ObjectFind("b", "k"), /truncated but gave no pagination cursor/);
+});
+(0, node_test_1.default)("r2ObjectFind retains the body on a non-2xx", async () => {
+    const { fetchFn } = recordingFetch({ ok: false, status: 403, body: '{"errors":[{"code":10000}]}' });
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    await strict_1.default.rejects(() => cf.r2ObjectFind("b", "k"), /10000/);
+});
+// Code review — the early exit changes observable behaviour on an anomalous
+// page, and an unpinned behaviour change is how a regression starts. Pinned as a
+// decision rather than left implicit.
+//
+// A page that reports truncated with no cursor is an anomaly r2ObjectList throws
+// on, because a partial listing would corrupt the audit. r2ObjectFind returns at
+// the match and never reaches that check, so the same response yields the size
+// instead of an error. That is correct: the size is Cloudflare's own record for
+// the exact key, the cap is enforced on it, and the anomaly concerns pages the
+// sizing does not need. The audit's behaviour on the same response is unchanged
+// and is pinned by "r2ObjectList throws when truncated but no cursor is given".
+(0, node_test_1.default)("r2ObjectFind returns a match found before an anomalous page's guard is reached", async () => {
+    const { fetchFn } = recordingFetch({
+        ok: true,
+        status: 200,
+        body: objectPage([{ key: "k", size: 4 }], { cursor: "", truncated: true }),
+    });
+    const cf = (0, cf_exec_js_1.makeCfExec)(cred, throwingRun, fetchFn);
+    const found = await cf.r2ObjectFind("b", "k");
+    strict_1.default.equal(found?.size, 4);
+});
 //# sourceMappingURL=cf-exec.test.js.map