@rubytech/create-maxy-code 0.1.460 → 0.1.462

package/payload/platform/plugins/cloudflare/mcp/__tests__/passcode.test.ts

@@ -1,74 +1,204 @@
 import { describe, it, expect } from 'vitest'
 import {
-  PBKDF2_ITERATIONS,
+  PASSCODE_ALPHABET,
+  PASSCODE_LENGTH,
+  PASSCODE_ENTROPY_BITS,
+  PasscodeTooWeakError,
+  assertPasscodeStrength,
   constantTimeEqual,
+  generatePasscode,
   hashPasscode,
   verifyPasscode,
   randomSaltHex,
-} from '../../skills/data-portal/template/functions/api/_lib/passcode'
+} from '../../skills/data-portal/template/functions/api/_lib/passcode.mjs'
 
 const SALT = '000102030405060708090a0b0c0d0e0f'
 
-describe('constantTimeEqual', () => {
-  it('is true for identical arrays', () => {
-    expect(constantTimeEqual(new Uint8Array([1, 2, 3]), new Uint8Array([1, 2, 3]))).toBe(true)
+describe('the pinned strength', () => {
+  it('is at least 128 bits', () => {
+    expect(PASSCODE_ENTROPY_BITS).toBeGreaterThanOrEqual(128)
   })
-  it('is false when a byte differs', () => {
-    expect(constantTimeEqual(new Uint8Array([1, 2, 3]), new Uint8Array([1, 2, 4]))).toBe(false)
+  it('states an entropy figure the alphabet and length actually produce', () => {
+    // 32 symbols is 5 bits each, exactly, because 256 divides by 32.
+    expect(PASSCODE_ALPHABET.length).toBe(32)
+    expect(PASSCODE_ENTROPY_BITS).toBe(PASSCODE_LENGTH * 5)
   })
-  it('is false for different lengths, without throwing', () => {
-    expect(constantTimeEqual(new Uint8Array([1, 2]), new Uint8Array([1, 2, 3]))).toBe(false)
+  it('draws from an alphabet with no repeats and no ambiguous characters', () => {
+    expect(new Set(PASSCODE_ALPHABET).size).toBe(PASSCODE_ALPHABET.length)
+    for (const c of 'ILOU') expect(PASSCODE_ALPHABET).not.toContain(c)
   })
-  it('compares every byte even after a mismatch (no early return)', () => {
-    // A first-byte mismatch and a last-byte mismatch must both be false.
-    // This does not measure timing; it pins that the function does not
-    // short-circuit in a way a rewrite could reintroduce.
-    expect(constantTimeEqual(new Uint8Array([9, 2, 3]), new Uint8Array([1, 2, 3]))).toBe(false)
-    expect(constantTimeEqual(new Uint8Array([1, 2, 9]), new Uint8Array([1, 2, 3]))).toBe(false)
+  it('survives the case normalisation verifyPasscode applies, without folding', () => {
+    // Task 1713 made verification case-insensitive. This pins WHY that costs no
+    // entropy, rather than leaving a comment to assert it.
+    //
+    // The argument: generation emits exactly one case, so uppercasing is the
+    // identity over the generated set, and the map from a generated passcode to
+    // its normalised form is injective. Two distinct generated passcodes can
+    // therefore never fold onto one string, and PASSCODE_ENTROPY_BITS still
+    // counts what it says it counts. Normalisation widens accepted INPUT, not
+    // the search space.
+    //
+    // If this ever goes red, the alphabet has grown a character whose case
+    // folds, and the entropy figure above is overstated.
+    for (const c of PASSCODE_ALPHABET) expect(c.toUpperCase()).toBe(c)
+    expect(new Set([...PASSCODE_ALPHABET].map((c) => c.toUpperCase())).size).toBe(
+      PASSCODE_ALPHABET.length,
+    )
+    const generated = Array.from({ length: 200 }, () => generatePasscode())
+    for (const pc of generated) expect(pc.toUpperCase()).toBe(pc)
+    // Compared against the count of DISTINCT originals, not against 200: this
+    // asserts injectivity alone, and does not quietly also assert that 200 draws
+    // never repeat (which is generatePasscode's claim, tested separately).
+    expect(new Set(generated.map((pc) => pc.toUpperCase())).size).toBe(new Set(generated).size)
+    expect(PASSCODE_ENTROPY_BITS).toBe(PASSCODE_LENGTH * 5)
+  })
+})
+
+describe('generatePasscode', () => {
+  it('mints a passcode at the pinned length, from the pinned alphabet', () => {
+    const pc = generatePasscode()
+    expect(pc).toHaveLength(PASSCODE_LENGTH)
+    for (const c of pc) expect(PASSCODE_ALPHABET).toContain(c)
+  })
+  it('does not repeat itself', () => {
+    const seen = new Set(Array.from({ length: 50 }, () => generatePasscode()))
+    expect(seen.size).toBe(50)
+  })
+  it('mints what the strength check accepts', () => {
+    expect(() => assertPasscodeStrength(generatePasscode())).not.toThrow()
+  })
+})
+
+describe('assertPasscodeStrength', () => {
+  it('refuses a six-digit number — the case the skill prose allowed', () => {
+    expect(() => assertPasscodeStrength('123456')).toThrow(PasscodeTooWeakError)
+  })
+  it('refuses with a named reason rather than a bare Error', () => {
+    try {
+      assertPasscodeStrength('123456')
+      throw new Error('should have refused')
+    } catch (e) {
+      expect(e).toBeInstanceOf(PasscodeTooWeakError)
+      expect((e as PasscodeTooWeakError).reason).toBe('passcode-too-weak')
+    }
+  })
+  it('refuses one character short', () => {
+    expect(() => assertPasscodeStrength('A'.repeat(PASSCODE_LENGTH - 1))).toThrow(
+      PasscodeTooWeakError,
+    )
+  })
+  it('refuses a character outside the alphabet', () => {
+    expect(() => assertPasscodeStrength('!'.repeat(PASSCODE_LENGTH))).toThrow(PasscodeTooWeakError)
+  })
+  it('refuses the ambiguous characters the alphabet excludes', () => {
+    expect(() => assertPasscodeStrength('I'.repeat(PASSCODE_LENGTH))).toThrow(PasscodeTooWeakError)
+  })
+  it('refuses an empty passcode', () => {
+    expect(() => assertPasscodeStrength('')).toThrow(PasscodeTooWeakError)
+  })
+  it('checks structure only, and does NOT claim to measure entropy', () => {
+    // This documents a limitation deliberately. A repeated character has ~no
+    // entropy yet passes, because length and alphabet are all a check on an
+    // arbitrary string can verify. Entropy comes from generatePasscode alone.
+    // If this ever throws, the check has grown a claim it cannot support.
+    expect(() => assertPasscodeStrength('A'.repeat(PASSCODE_LENGTH))).not.toThrow()
   })
 })
 
 describe('hashPasscode', () => {
-  it('is deterministic for the same passcode, salt and iterations', async () => {
-    const a = await hashPasscode('hunter2', SALT, 1000)
-    const b = await hashPasscode('hunter2', SALT, 1000)
-    expect(a).toBe(b)
-    expect(a).toMatch(/^[0-9a-f]{64}$/)
+  it('is deterministic for the same passcode and salt', async () => {
+    const pc = generatePasscode()
+    expect(await hashPasscode(pc, SALT)).toBe(await hashPasscode(pc, SALT))
+  })
+  it('returns 64 hex characters', async () => {
+    expect(await hashPasscode(generatePasscode(), SALT)).toMatch(/^[0-9a-f]{64}$/)
   })
   it('differs for a different passcode', async () => {
-    const a = await hashPasscode('hunter2', SALT, 1000)
-    const b = await hashPasscode('hunter3', SALT, 1000)
-    expect(a).not.toBe(b)
+    expect(await hashPasscode(generatePasscode(), SALT)).not.toBe(
+      await hashPasscode(generatePasscode(), SALT),
+    )
+  })
+  it('differs for the same passcode under a different salt', async () => {
+    const pc = generatePasscode()
+    const other = '0f0e0d0c0b0a09080706050403020100'
+    expect(await hashPasscode(pc, SALT)).not.toBe(await hashPasscode(pc, other))
   })
-  it('differs for a different salt', async () => {
-    const a = await hashPasscode('hunter2', SALT, 1000)
-    const b = await hashPasscode('hunter2', 'ffffffffffffffffffffffffffffffff', 1000)
-    expect(a).not.toBe(b)
+  it('refuses to hash a weak passcode rather than hashing it anyway', async () => {
+    // The mutation check: revert assertPasscodeStrength's call here and this
+    // fails. Without it the check is decoration and the fast hash is unsafe.
+    await expect(hashPasscode('123456', SALT)).rejects.toBeInstanceOf(PasscodeTooWeakError)
+  })
+  it('rejects a salt that is not hex', async () => {
+    await expect(hashPasscode(generatePasscode(), 'nothex')).rejects.toThrow()
   })
 })
 
 describe('verifyPasscode', () => {
   it('accepts the right passcode', async () => {
-    const h = await hashPasscode('hunter2', SALT, 1000)
-    expect(await verifyPasscode('hunter2', SALT, h, 1000)).toBe(true)
+    const pc = generatePasscode()
+    expect(await verifyPasscode(pc, SALT, await hashPasscode(pc, SALT))).toBe(true)
   })
   it('rejects the wrong passcode', async () => {
-    const h = await hashPasscode('hunter2', SALT, 1000)
-    expect(await verifyPasscode('hunter3', SALT, h, 1000)).toBe(false)
+    const stored = await hashPasscode(generatePasscode(), SALT)
+    expect(await verifyPasscode(generatePasscode(), SALT, stored)).toBe(false)
+  })
+  it('rejects rather than throws when the stored hash is malformed', async () => {
+    expect(await verifyPasscode(generatePasscode(), SALT, 'nothex')).toBe(false)
+  })
+  it('rejects a weak passcode at sign-in without throwing', async () => {
+    // A row hashed before the check existed must not crash the auth route.
+    expect(await verifyPasscode('123456', SALT, '0'.repeat(64))).toBe(false)
+  })
+  it('accepts a lowercase transcription of the passcode', async () => {
+    // The whole reason the alphabet excludes I, L, O and U is that a person
+    // transcribes this by hand. Crockford is case-insensitive on decode for
+    // that same reason. The mutation check: drop .toUpperCase() from
+    // verifyPasscode and this goes red.
+    const pc = generatePasscode()
+    const stored = await hashPasscode(pc, SALT)
+    expect(await verifyPasscode(pc.toLowerCase(), SALT, stored)).toBe(true)
+  })
+  it('accepts a mixed-case transcription of the passcode', async () => {
+    const pc = generatePasscode()
+    const stored = await hashPasscode(pc, SALT)
+    const mixed = [...pc].map((c, i) => (i % 2 ? c.toLowerCase() : c)).join('')
+    expect(await verifyPasscode(mixed, SALT, stored)).toBe(true)
   })
-  it('rejects a malformed stored hash without throwing', async () => {
-    expect(await verifyPasscode('hunter2', SALT, 'not-hex', 1000)).toBe(false)
+  it('still rejects the wrong passcode, lowercase included', async () => {
+    // Widening the accepted case must not widen the accepted passcode.
+    const stored = await hashPasscode(generatePasscode(), SALT)
+    expect(await verifyPasscode(generatePasscode().toLowerCase(), SALT, stored)).toBe(false)
+  })
+  it('returns false rather than throwing when the passcode is not a string', async () => {
+    // .toUpperCase() throws on a non-string, so it sits INSIDE this function's
+    // try. Move it out and this goes red. That placement is what keeps the
+    // documented never-throw contract true for the input class it covers.
+    // @ts-expect-error deliberately passing a non-string
+    expect(await verifyPasscode(null, SALT, '0'.repeat(64))).toBe(false)
   })
 })
 
-describe('randomSaltHex', () => {
-  it('renders bytes as lowercase hex', () => {
-    expect(randomSaltHex(new Uint8Array([0, 1, 255]))).toBe('0001ff')
+describe('constantTimeEqual', () => {
+  it('is true for identical arrays', () => {
+    expect(constantTimeEqual(new Uint8Array([1, 2, 3]), new Uint8Array([1, 2, 3]))).toBe(true)
+  })
+  it('is false when a byte differs', () => {
+    expect(constantTimeEqual(new Uint8Array([1, 2, 3]), new Uint8Array([1, 2, 4]))).toBe(false)
+  })
+  it('is false for different lengths, without throwing', () => {
+    expect(constantTimeEqual(new Uint8Array([1, 2]), new Uint8Array([1, 2, 3]))).toBe(false)
+  })
+  it('compares every byte even after a mismatch (no early return)', () => {
+    // A first-byte mismatch and a last-byte mismatch must both be false.
+    // This does not measure timing; it pins that the function does not
+    // short-circuit in a way a rewrite could reintroduce.
+    expect(constantTimeEqual(new Uint8Array([9, 2, 3]), new Uint8Array([1, 2, 3]))).toBe(false)
+    expect(constantTimeEqual(new Uint8Array([1, 2, 9]), new Uint8Array([1, 2, 3]))).toBe(false)
   })
 })
 
-describe('PBKDF2_ITERATIONS', () => {
-  it('is at least the OWASP floor for PBKDF2-SHA256', () => {
-    expect(PBKDF2_ITERATIONS).toBeGreaterThanOrEqual(600_000)
+describe('randomSaltHex', () => {
+  it('renders bytes as lowercase hex, zero-padded', () => {
+    expect(randomSaltHex(new Uint8Array([0, 15, 16, 255]))).toBe('000f10ff')
   })
 })

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-enrol.test.ts

@@ -0,0 +1,207 @@
+import { describe, it, expect } from 'vitest'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+import {
+  PASSCODE_ALPHABET,
+  PASSCODE_LENGTH,
+  verifyPasscode,
+} from '../../skills/data-portal/template/functions/api/_lib/passcode.mjs'
+
+const run = promisify(execFile)
+const SCRIPT = resolve(dirname(fileURLToPath(import.meta.url)), '../../bin/portal-enrol.mjs')
+
+const enrol = (args: string[]) => run('node', [SCRIPT, ...args])
+
+/** The script's contract: stdout is SQL and nothing else, so it pipes straight
+ * into `wrangler d1 execute --file=-`; the passcode goes to stderr, where the
+ * operator still sees it on their terminal but a pipe never carries it. The two
+ * streams are the whole point — a passcode on stdout would be fed to wrangler,
+ * which echoes the failing statement into its error output. */
+function parse(r: { stdout: string; stderr: string }) {
+  const passcode = /^passcode:\s*(\S+)$/m.exec(r.stderr)?.[1]
+  const sql = /^(INSERT INTO people .*)$/m.exec(r.stdout)?.[1]
+  return { passcode, sql }
+}
+
+const valuesOf = (sql: string) =>
+  /VALUES \('([^']*)', '((?:[^']|'')*)', '([0-9a-f]+)', '([0-9a-f]+)', '([^']*)'\)/.exec(sql)!
+
+/** Apply the emitted SQL to a real SQLite database built from the template's own
+ * schema.sql, the way `wrangler d1 execute` applies it to D1. A fake would model
+ * the constraint we are trying to prove we satisfy, which is how 1689 shipped a
+ * UNIQUE-violating upload: its fake accepted duplicates the schema rejected. */
+async function d1(dir: string) {
+  const { mkdtemp } = await import('node:fs/promises')
+  const { tmpdir } = await import('node:os')
+  const root = await mkdtemp(resolve(tmpdir(), dir))
+  const db = resolve(root, 'portal.db')
+  const schema = resolve(
+    dirname(fileURLToPath(import.meta.url)),
+    '../../skills/data-portal/template/schema.sql',
+  )
+  // SQL as an argv entry, not stdin: execFile has no `input` option. The schema
+  // goes via `.read` because it opens with a `--` comment, which sqlite3 would
+  // otherwise parse as a CLI option.
+  await run('sqlite3', [db, `.read ${schema}`])
+  return {
+    exec: (sql: string) => run('sqlite3', [db, sql]),
+    query: async (sql: string) => (await run('sqlite3', [db, sql])).stdout.trim(),
+  }
+}
+
+describe('portal-enrol', () => {
+  it('prints a passcode at the pinned length from the pinned alphabet', async () => {
+    const r = await enrol(['--owner', 'alice', '--name', 'Alice'])
+    const { passcode } = parse(r)
+    expect(passcode).toHaveLength(PASSCODE_LENGTH)
+    for (const c of passcode!) expect(PASSCODE_ALPHABET).toContain(c)
+  })
+
+  it('emits a hash the portal will actually accept for that passcode', async () => {
+    // This is the test that matters. It proves enrolment and the Worker agree,
+    // which is the whole reason the hash has one implementation rather than a
+    // twin in this script.
+    const r = await enrol(['--owner', 'alice', '--name', 'Alice'])
+    const { passcode, sql } = parse(r)
+    const [, , , salt, hash] = valuesOf(sql!)
+    expect(await verifyPasscode(passcode!, salt, hash)).toBe(true)
+  })
+
+  it('emits a hash that rejects a different passcode', async () => {
+    const a = await enrol(['--owner', 'alice', '--name', 'Alice'])
+    const [, , , salt, hash] = valuesOf(parse(a).sql!)
+    const b = await enrol(['--owner', 'bob', '--name', 'Bob'])
+    expect(await verifyPasscode(parse(b).passcode!, salt, hash)).toBe(false)
+  })
+
+  it('never puts the passcode in the SQL', async () => {
+    // A passcode reaching D1 or a log in plaintext is the one thing enrolment
+    // must never do.
+    const r = await enrol(['--owner', 'alice', '--name', 'Alice'])
+    const { passcode, sql } = parse(r)
+    expect(sql).not.toContain(passcode!)
+  })
+
+  it('does not repeat a passcode across enrolments', async () => {
+    const a = await enrol(['--owner', 'alice', '--name', 'Alice'])
+    const b = await enrol(['--owner', 'alice', '--name', 'Alice'])
+    expect(parse(a).passcode).not.toBe(parse(b).passcode)
+  })
+
+  it('does not repeat a salt across enrolments', async () => {
+    const saltOf = async (owner: string) => {
+      const r = await enrol(['--owner', owner, '--name', owner])
+      return valuesOf(parse(r).sql!)[3]
+    }
+    expect(await saltOf('alice')).not.toBe(await saltOf('bob'))
+  })
+
+  it('refuses an ownerId the isolation gate would reject', async () => {
+    // `alice` and `alice/2024` co-enrolled would breach the prefix isolation
+    // rule, so enrolment fails closed on the same charset the gate enforces.
+    await expect(enrol(['--owner', 'alice/2024', '--name', 'Alice'])).rejects.toThrow()
+    await expect(enrol(['--owner', 'Alice', '--name', 'Alice'])).rejects.toThrow()
+    await expect(enrol(['--owner', '../etc', '--name', 'Alice'])).rejects.toThrow()
+  })
+
+  it('refuses a missing owner or name', async () => {
+    await expect(enrol(['--name', 'Alice'])).rejects.toThrow()
+    await expect(enrol(['--owner', 'alice'])).rejects.toThrow()
+    await expect(enrol([])).rejects.toThrow()
+  })
+
+  it('escapes a quote in the name rather than breaking the statement', async () => {
+    const r = await enrol(['--owner', 'alice', '--name', "O'Brien"])
+    expect(parse(r).sql).toContain("'O''Brien'")
+  })
+
+  it('writes the row the schema declares, in order', async () => {
+    const r = await enrol(['--owner', 'alice', '--name', 'Alice'])
+    const { sql } = parse(r)
+    expect(sql).toContain('INSERT INTO people (ownerId, name, salt, hash, createdAt)')
+    const [, owner, name, salt, hash, createdAt] = valuesOf(sql!)
+    expect(owner).toBe('alice')
+    expect(name).toBe('Alice')
+    expect(salt).toMatch(/^[0-9a-f]{32}$/)
+    expect(hash).toMatch(/^[0-9a-f]{64}$/)
+    expect(Number.isNaN(Date.parse(createdAt))).toBe(false)
+  })
+
+  it('puts SQL and only SQL on stdout, so the documented pipe works', async () => {
+    // SKILL.md tells the agent to pipe stdout into `wrangler d1 execute`. Anything
+    // else on stdout goes into wrangler as SQL — and a passcode there would be
+    // echoed back in wrangler's syntax error, which is the one place a plaintext
+    // passcode must never reach.
+    const r = await enrol(['--owner', 'alice', '--name', 'Alice'])
+    expect(r.stdout.trim()).toMatch(/^INSERT INTO people [^\n]*;$/)
+    expect(r.stdout).not.toContain('passcode')
+  })
+
+  it('keeps the passcode off stdout entirely, on stderr where a pipe cannot take it', async () => {
+    const r = await enrol(['--owner', 'alice', '--name', 'Alice'])
+    const { passcode } = parse(r)
+    expect(passcode).toHaveLength(PASSCODE_LENGTH)
+    expect(r.stdout).not.toContain(passcode!)
+  })
+
+  it('rejects a newline in the name, which would break the pipeable contract', async () => {
+    await expect(enrol(['--owner', 'alice', '--name', 'Bob\nDROP'])).rejects.toThrow()
+  })
+
+  describe('against a real SQLite database built from schema.sql', () => {
+    it('applies cleanly', async () => {
+      const db = await d1('enrol-apply-')
+      const r = await enrol(['--owner', 'alice', '--name', 'Alice'])
+      await db.exec(parse(r).sql!)
+      expect(await db.query('SELECT ownerId, name FROM people;')).toBe('alice|Alice')
+    })
+
+    it('rotates a passcode by re-running, which is the ONLY sanctioned rotation path', async () => {
+      // SKILL.md: "Rotating a passcode is a re-run of the script for that person."
+      // A bare INSERT cannot do that — ownerId is TEXT PRIMARY KEY, so the second
+      // run dies on a UNIQUE violation in a SEPARATE process, AFTER the script has
+      // already printed a new passcode and exited 0. The operator hands out a
+      // passcode that never worked while the leaked one still does, and pcCheck
+      // revocation never fires. Rotation is exactly the case where a remedy that
+      // silently no-ops is worse than no remedy.
+      const db = await d1('enrol-rotate-')
+
+      const first = await enrol(['--owner', 'alice', '--name', 'Alice'])
+      await db.exec(parse(first).sql!)
+
+      const second = await enrol(['--owner', 'alice', '--name', 'Alice'])
+      await db.exec(parse(second).sql!)
+
+      const [salt, hash] = (await db.query("SELECT salt, hash FROM people WHERE ownerId='alice';"))
+        .split('|')
+      expect(await verifyPasscode(parse(second).passcode!, salt, hash)).toBe(true)
+      expect(await verifyPasscode(parse(first).passcode!, salt, hash)).toBe(false)
+    })
+
+    it('rotating leaves exactly one row, and does not reset createdAt', async () => {
+      // createdAt is when the person was enrolled. Rotation is not creation, so
+      // it does not move; nothing reads it, but a field that lies about what it
+      // holds is the defect this component keeps being reviewed for.
+      const db = await d1('enrol-one-row-')
+      const first = await enrol(['--owner', 'alice', '--name', 'Alice'])
+      await db.exec(parse(first).sql!)
+      const createdAt = await db.query("SELECT createdAt FROM people WHERE ownerId='alice';")
+
+      await db.exec(parse(await enrol(['--owner', 'alice', '--name', 'Alice'])).sql!)
+
+      expect(await db.query('SELECT COUNT(*) FROM people;')).toBe('1')
+      expect(await db.query("SELECT createdAt FROM people WHERE ownerId='alice';")).toBe(createdAt)
+    })
+
+    it('stores a crafted name as data rather than executing it', async () => {
+      const db = await d1('enrol-inject-')
+      const r = await enrol(['--owner', 'alice', '--name', "x'); DROP TABLE people; --"])
+      await db.exec(parse(r).sql!)
+      expect(await db.query("SELECT name FROM people WHERE ownerId='alice';")).toBe(
+        "x'); DROP TABLE people; --",
+      )
+    })
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/dist/index.js

@@ -1,14 +1,14 @@
-import { initStderrTee } from "../../../../lib/mcp-stderr-tee/dist/index.js";
-initStderrTee("cloudflare");
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 // The Cloudflare plugin exposes zero agent-facing tools. Every
 // Cloudflare operation is the agent invoking `cloudflared` directly via
 // the Bash tool, following the runbook in
 // platform/plugins/cloudflare/references/manual-setup.md, with
-// cloudflared stdout/stderr streamed verbatim into the PTY. The MCP
-// server process still spawns for lifecycle and stderr-tee consistency
-// with other plugins, but its tool list is empty by design.
+// cloudflared stdout/stderr streamed verbatim into the PTY. The plugin
+// declares `mcp-manifest: skip` and no `mcp:` block, so this entry is never
+// spawned as an MCP server: only the generated .claude-plugin/plugin.json
+// mcpServers block makes Claude Code spawn one (tool-registration-drift.ts).
+// Task 1721 removed its unreachable stderr-tee call.
 const server = new McpServer({
     name: "cloudflare",
     version: "0.4.0",

package/payload/platform/plugins/cloudflare/mcp/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,aAAa,CAAC,YAAY,CAAC,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,+DAA+D;AAC/D,wEAAwE;AACxE,0CAA0C;AAC1C,+DAA+D;AAC/D,oEAAoE;AACpE,uEAAuE;AACvE,4DAA4D;AAE5D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,+DAA+D;AAC/D,wEAAwE;AACxE,0CAA0C;AAC1C,+DAA+D;AAC/D,uEAAuE;AACvE,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,qDAAqD;AAErD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/cloudflare/mcp/package.json

@@ -8,7 +8,7 @@
     "build": "tsc",
     "start": "node dist/index.js",
     "test": "vitest run",
-    "typecheck:templates": "tsc --noEmit --strict --target es2022 --module esnext --moduleResolution bundler --lib es2022,dom ../skills/*/template/functions/api/*.ts ../skills/*/template/functions/api/_lib/*.ts"
+    "typecheck:templates": "tsc --noEmit --strict --allowJs --checkJs --target es2022 --module esnext --moduleResolution bundler --lib es2022,dom ../skills/*/template/functions/api/*.ts ../skills/*/template/functions/api/_lib/*.ts ../skills/*/template/functions/api/_lib/*.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1"

package/payload/platform/plugins/cloudflare/references/hosting-sites.md

@@ -33,6 +33,8 @@ If the site captures form data, add the `[[d1_databases]]` binding from `d1-data
 
 ## 3. Load the reused deploy token
 
+> **On a multi-tenant install, a client account does not run this step at all.** After the 1631 storage isolation, a client's `cloudflare.env` carries no master, and `cf-token.sh` denies it the `pages` scope (`reason=not-house`) — correctly, since that master is account-wide. A client account publishes with the `storage-pages-deploy` tool, which runs the deploy house-side; the project must already be recorded to the account by the house (`storage-pages-adopt`), because the project-to-folder mapping is not derivable and is never guessed. The rest of this section applies to the **house account and single-tenant installs**, where the master still lives in the account secrets file. If you are a client account and you reached a `not-house` denial here, that is this branch, not a broken token: use the tool.
+
 A Pages deploy needs **Account · Cloudflare Pages · Edit**. If the site has Pages Functions hitting D1, the token also needs **Account · D1 · Edit** (the single most common breakage — see `d1-data-capture.md`). The `pages` scope resolves the stable `<brand>-pages-d1` token, which carries both. Resolve it with the deterministic helper, which mints it once only if absent and reuses it thereafter. This is the one command; do not source the secrets file and hand the resulting `CLOUDFLARE_API_TOKEN` to `wrangler` — that variable holds the **master**, not the per-scope token, and `wrangler pages` then returns `Authentication error [code: 10000]`:
 
 ```bash

package/payload/platform/plugins/cloudflare/skills/calendar-site/SKILL.md

@@ -56,7 +56,7 @@ The booking-specific schema ships with the template: `schema.sql` creates both t
 
 ## Deploy through site-deploy
 
-Hand the assembled tree to `cloudflare:site-deploy`: it builds nothing for a static tree, runs `wrangler pages deploy public --project-name <project> --branch=main`, attaches the booking domain (creating the DNS record with the `<brand>-dns` token when the attach leaves validation pending), and reuses the same per-scope token. Everything in `site-deploy`'s auth, custom-domain, and DNS guidance applies unchanged.
+Hand the assembled tree to `cloudflare:site-deploy`: it builds nothing for a static tree, runs `wrangler pages deploy public --project-name <project> --branch=main`, attaches the booking domain (creating the DNS record with the `<brand>-dns` token when the attach leaves validation pending), and reuses the same per-scope token. Everything in `site-deploy`'s auth, custom-domain, and DNS guidance applies unchanged — including its multi-tenant branch: "admin-run" means a `role:"admin"` session, which on a multi-tenant install is **not** the same thing as the house. A client account's admin session is denied the `pages` scope (`reason=not-house`) and publishes with `storage-pages-deploy` instead.
 
 ## Done-gate
 

package/payload/platform/plugins/cloudflare/skills/data-portal/SKILL.md

@@ -43,11 +43,25 @@ Collect from the operator the portal's custom domain and the list of people, the
 `<accountDir>/data-portal.json` carrying `portalDomain`, `portalDbName`, `bucketName`, and a
 `people` array of `{ name, ownerId, prefix }`.
 
-For each person, generate a high-entropy passcode, print it to the operator **once**, and insert the
-person into D1 with only a PBKDF2 salt and hash. **A passcode is never stored in plaintext** — not
-in `data-portal.json`, not in a log line, nowhere on the device. The operator conveys it to the
-person out of band. Rotating a passcode is a re-run of this step for that person; there is no
-separate editor.
+For each person:
+
+```bash
+node platform/plugins/cloudflare/bin/portal-enrol.mjs --owner <ownerId> --name <name> \
+  | npx wrangler d1 execute <portalDbName> --remote --file=-
+```
+
+The script mints the passcode and prints it **once to stderr**, so it reaches the operator's terminal
+and never the pipe; stdout carries the `INSERT` alone. Do not hand-roll this: the passcode's length
+and alphabet are pinned in `template/functions/api/_lib/passcode.mjs`, the script is what applies
+them, and a passcode minted any other way is unpinned by definition. The script refuses an `ownerId`
+the isolation gate would reject, so a bad name fails here rather than after the row lands.
+
+The statement is an upsert on `ownerId`, which is what makes rotation a re-run rather than a
+constraint error.
+
+**A passcode is never stored in plaintext** — not in `data-portal.json`, not in a log line, nowhere
+on the device. The operator conveys it to the person out of band. Rotating a passcode is a re-run of
+the script for that person; there is no separate editor.
 
 Rotation also revokes: a session records a digest of the person's passcode hash at sign-in, and the
 session lookup requires it to still match, so re-running enrolment kills every live session for that
@@ -74,23 +88,12 @@ Hand the assembled tree to `cloudflare:site-deploy`. Both bindings — D1 and R2
 config in `wrangler.toml`, carried in the deploy payload under the Pages scope; the deploy needs no
 R2 token. Only the bucket *creation* in step 1 needs R2 write, and the broker holds that.
 
-## The portal needs a paid Cloudflare plan
-
-Check this before promising a date. Signing in costs one PBKDF2 derivation at the OWASP floor of
-600,000 iterations, measured at roughly 250ms of CPU. Workers Free allows **10ms of CPU per
-request**, so on a free plan authentication cannot succeed — and no OWASP-compliant setting fits
-either, since even 100,000 iterations costs about 40ms. Paid plans allow far more and are fine.
-
-The cost is tunable without a migration if it ever needs to be: `iterations` is stored per person
-row, so it is the enrolment-time value that binds, not a constant baked into the deployed code.
-
 ## Done-gate
 
 The portal is not done until all five hold on the live domain:
 
 1. A cache-busted request to the portal domain returns `HTTP/2 200`.
-2. Signing in with the right passcode returns `200` **within the CPU budget** rather than timing
-   out — this is the check that catches a free-plan deployment, and it fails nowhere else.
+2. Signing in with the right passcode returns `200`.
 3. A wrong passcode returns `401`; the **sixth** rapid wrong passcode returns `429` (five are
    allowed per fifteen minutes, per person, per IP).
 4. An upload as one person returns `200`, and the object is present in R2 under that person's
@@ -100,8 +103,7 @@ The portal is not done until all five hold on the live domain:
 
 A `502` on `/api/upload` with `op=r2-put result=failed` on every attempt is the expected signature of
 an R2 binding that did not deploy — check `wrangler.toml` reached the tree with its placeholder
-filled. An auth request that hangs or 500s while everything else works is the free-plan signature
-above, not a code fault.
+filled.
 
 Uploads are capped at 25 MiB and a larger one returns `413` with `result=too-large`.