@rubytech/create-maxy-code 0.1.460 → 0.1.462

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/passcode.mjs

@@ -0,0 +1,193 @@
+// Passcode generation, strength and hashing for the data portal.
+//
+// This module is JavaScript, not TypeScript, and that is deliberate: it has two
+// consumers on two runtimes. The Worker imports it (wrangler bundles JS), and
+// enrolment imports it from bare node on-device, which cannot load .ts. A second
+// copy of the hash for the enrolment side would drift, and the failure mode of
+// drift is that enrolment writes hashes the Worker rejects. JSDoc plus
+// `typecheck:templates --checkJs` keeps the type cover 1689 added.
+//
+// constantTimeEqual is hand-rolled deliberately: crypto.subtle.timingSafeEqual
+// is a Cloudflare extension with no Node equivalent, so depending on it would
+// make the comparison untestable here.
+
+/** Crockford base32: digits and letters minus I, L, O and U, which are the ones
+ * misread when the operator conveys a passcode to a person out of band. 32
+ * symbols is exactly 5 bits, and 256 divides by 32, so a masked random byte is
+ * an unbiased draw with no rejection sampling.
+ *
+ * How much of Crockford this portal takes, stated so nobody has to infer it
+ * from behaviour again (Task 1713):
+ *
+ *   ADOPTED  — the excluded letters, above, and case-insensitivity on decode.
+ *              The alphabet is uppercase and so is everything stored;
+ *              verifyPasscode uppercases what it is given, so a person may type
+ *              either case. That is the one normalisation point.
+ *   DECLINED — the letter-to-digit decode (I and L to 1, O to 0), check
+ *              symbols, and hyphen tolerance. None are implemented.
+ *
+ * So "Crockford" here means this alphabet plus the case rule, and nothing
+ * further. 1708 shipped the first half without the second, which is the gap
+ * 1713 closed; a future reader adding the rest should treat it as a new
+ * decision, not as finishing this one.
+ */
+export const PASSCODE_ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ'
+
+/** 26 x 5 bits = 130, which clears the 128-bit floor this portal's security
+ * rests on. Changing this constant changes that guarantee: see the note at
+ * hashPasscode before touching it. */
+export const PASSCODE_LENGTH = 26
+
+/** What PASSCODE_LENGTH and PASSCODE_ALPHABET buy, stated once so a test can
+ * pin it rather than a comment asserting it. */
+export const PASSCODE_ENTROPY_BITS = PASSCODE_LENGTH * 5
+
+/** Enrolment refused a passcode below the pinned strength. Named rather than a
+ * bare Error so a caller can tell a weak passcode from a broken salt. */
+export class PasscodeTooWeakError extends Error {
+  /** @param {string} detail */
+  constructor(detail) {
+    super(`passcode too weak: ${detail}`)
+    this.name = 'PasscodeTooWeakError'
+    /** @type {'passcode-too-weak'} */
+    this.reason = 'passcode-too-weak'
+  }
+}
+
+/** Mint a passcode. This is the ONLY source of passcode entropy in the portal —
+ * assertPasscodeStrength below cannot supply it, only check the shape.
+ * @returns {string} */
+export function generatePasscode() {
+  const bytes = new Uint8Array(PASSCODE_LENGTH)
+  crypto.getRandomValues(bytes)
+  let out = ''
+  // & 31 is unbiased here precisely because the alphabet is 32 long.
+  for (const b of bytes) out += PASSCODE_ALPHABET[b & 31]
+  return out
+}
+
+/** Refuse a passcode that is not the pinned length drawn from the pinned
+ * alphabet.
+ *
+ * This is a STRUCTURAL check and nothing more. It cannot measure entropy: a
+ * 26-character run of 'A' passes it. Do not describe it as enforcing
+ * PASSCODE_ENTROPY_BITS — an arbitrary string's entropy is not a computable
+ * property of the string. What it does buy is the case that motivated it: an
+ * enrolling agent satisfying "high-entropy passcode" with a six-digit number
+ * can no longer store one. Entropy itself comes from generatePasscode.
+ * @param {string} passcode
+ * @returns {void} */
+export function assertPasscodeStrength(passcode) {
+  if (typeof passcode !== 'string' || passcode.length !== PASSCODE_LENGTH) {
+    throw new PasscodeTooWeakError(`expected ${PASSCODE_LENGTH} characters`)
+  }
+  for (const c of passcode) {
+    if (!PASSCODE_ALPHABET.includes(c)) {
+      throw new PasscodeTooWeakError('character outside the pinned alphabet')
+    }
+  }
+}
+
+/** @param {Uint8Array} bytes @returns {string} */
+export function randomSaltHex(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')
+}
+
+/** Returns Uint8Array<ArrayBuffer>, not the bare Uint8Array: the bare form
+ * widens to ArrayBufferLike, which Web Crypto will not accept as a BufferSource
+ * because a SharedArrayBuffer could back it.
+ * @param {string} hex
+ * @returns {Uint8Array<ArrayBuffer> | null} */
+function hexToBytes(hex) {
+  if (hex.length === 0 || hex.length % 2 !== 0 || !/^[0-9a-f]+$/i.test(hex)) return null
+  const out = new Uint8Array(hex.length / 2)
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16)
+  return out
+}
+
+/** Hash a passcode for storage: one SHA-256 over salt || passcode.
+ *
+ * ONE fast hash, no key stretching, and that is safe ONLY because passcodes are
+ * machine-generated by generatePasscode at PASSCODE_LENGTH. Stretching exists to
+ * make guessing a HUMAN-CHOSEN password expensive; 130 random bits are
+ * unguessable however fast the hash is, which is why nobody stretches a
+ * magic-link token either.
+ *
+ * So: if anyone ever lets an operator choose a memorable passcode, key
+ * stretching must come back in the SAME change. The danger here is not the fast
+ * hash. It is a later relaxation of generated-only while the fast hash stays.
+ *
+ * The salt earns its keep even without stretching: two people holding the same
+ * passcode still get different stored hashes, and no precomputed table over the
+ * alphabet is reusable across rows.
+ * @param {string} passcode
+ * @param {string} saltHex
+ * @returns {Promise<string>} */
+export async function hashPasscode(passcode, saltHex) {
+  assertPasscodeStrength(passcode)
+  const salt = hexToBytes(saltHex)
+  if (!salt) throw new Error('salt must be hex')
+  const encoded = new TextEncoder().encode(passcode)
+  const message = new Uint8Array(salt.length + encoded.length)
+  message.set(salt, 0)
+  message.set(encoded, salt.length)
+  const digest = await crypto.subtle.digest('SHA-256', message)
+  return randomSaltHex(new Uint8Array(digest))
+}
+
+/** Verify a passcode against a stored salt and hash. Returns false rather than
+ * throwing on any malformed input, including a passcode that would not pass
+ * enrolment: sign-in is not the place to crash over a bad row.
+ * @param {string} passcode
+ * @param {string} saltHex
+ * @param {string} expectedHashHex
+ * @returns {Promise<boolean>} */
+export async function verifyPasscode(passcode, saltHex, expectedHashHex) {
+  const expected = hexToBytes(expectedHashHex)
+  if (!expected) return false
+  /** @type {string} */
+  let actualHex
+  try {
+    // Crockford is case-insensitive on decode, and 1708 chose this alphabet for
+    // the very reason that rule exists: a person transcribes the passcode by
+    // hand. Uppercasing here is the second half of that choice (Task 1713), so
+    // the case someone types stops being something they can get wrong.
+    //
+    // This is the ONE normalisation point. hashPasscode and
+    // assertPasscodeStrength stay strict on the canonical uppercase form, so
+    // what enrolment stores is unchanged and only accepted INPUT widens.
+    //
+    // Inside the try deliberately: a malformed PASSCODE must return false rather
+    // than throw, and .toUpperCase() throws on a non-string. Outside the try,
+    // that would break for exactly the input class it exists to cover.
+    // (Scoped to the passcode on purpose. The docblock above says "any
+    // malformed input", which is not quite true of expectedHashHex — a null one
+    // throws out of hexToBytes before this try is entered. Unreachable today,
+    // since schema.sql pins hash TEXT NOT NULL; tracked in Task 1718 rather
+    // than restated here as though it held.)
+    //
+    // The strength gate therefore applies to the normalised form: verification
+    // accepts any string whose uppercase form is a valid passcode. One
+    // consequence, left unguarded on purpose — 'ß' uppercases to 'SS', so a
+    // 25-character string containing it can normalise onto a 26-character
+    // passcode. Building one requires already knowing the passcode, so it costs
+    // nothing an attacker could spend, and a fourth check to close it would buy
+    // no security.
+    actualHex = await hashPasscode(passcode.toUpperCase(), saltHex)
+  } catch {
+    return false
+  }
+  const actual = hexToBytes(actualHex)
+  if (!actual) return false
+  return constantTimeEqual(actual, expected)
+}
+
+/** @param {Uint8Array} a @param {Uint8Array} b @returns {boolean} */
+export function constantTimeEqual(a, b) {
+  // Length is not secret; an early return on it leaks nothing a caller cannot
+  // already see. The byte loop below never short-circuits.
+  if (a.length !== b.length) return false
+  let diff = 0
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i]
+  return diff === 0
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/auth.ts

@@ -1,5 +1,5 @@
 import type { Handler, Logger, PortalEnv } from './_lib/types'
-import { PBKDF2_ITERATIONS, verifyPasscode } from './_lib/passcode'
+import { verifyPasscode } from './_lib/passcode.mjs'
 import { checkAndRecordAttempt, clearAttempts, rateScope } from './_lib/ratelimit'
 import { SESSION_COOKIE, SESSION_TTL_MS, mintSession, passcodeCheck } from './_lib/session'
 import { q } from './_lib/log'
@@ -17,11 +17,19 @@ interface AuthResult extends Handler {
 // them would enumerate who is enrolled.
 const DENIED: Handler = { status: 401, payload: { ok: false, error: 'denied' } }
 
-// A real-shaped salt and hash used only to burn the same PBKDF2 cost when the
-// owner does not exist. Without it, an unknown owner returns after one D1 read
-// (single-digit ms) while a known one spends ~250ms deriving — a timing oracle
-// three orders of magnitude wide, which enumerates the enrolled people outright
-// and makes the identical DENIED payload above cosmetic.
+// A real-shaped salt and hash used only to burn the same hash when the owner
+// does not exist, so the two paths cost the same and the identical DENIED
+// payload above is not merely cosmetic.
+//
+// Task 1708 re-measured this after replacing PBKDF2 with one SHA-256, because
+// the gap it closes shrank by four orders of magnitude and the dummy might have
+// stopped earning its place. It did not. Without it the delta is one hash —
+// measured at 43.8us (dev Mac, off-platform) — and published remote-timing work
+// resolves roughly 15-20us on a LAN and ~100us over the internet, so 43.8us sits
+// inside the demonstrated-resolvable band, and an attacker gets to pick a
+// Cloudflare PoP near the target. Keeping it costs 43.8us against a 10ms CPU
+// budget, which is 0.4% of it. Cheap enough not to think about; measurable
+// enough not to remove.
 const DUMMY_SALT = '00000000000000000000000000000000'
 const DUMMY_HASH = '0'.repeat(64)
 
@@ -52,20 +60,18 @@ export async function processAuth(
     return { status: 429, payload: { ok: false, error: 'too many attempts' } }
   }
 
-  const person = await env.DB.prepare(
-    'SELECT ownerId, salt, hash, iterations FROM people WHERE ownerId = ?',
-  )
+  const person = await env.DB.prepare('SELECT ownerId, salt, hash FROM people WHERE ownerId = ?')
     .bind(ownerId)
-    .first<{ ownerId: string; salt: string; hash: string; iterations: number }>()
+    .first<{ ownerId: string; salt: string; hash: string }>()
 
   if (!person) {
     // Burn the same work an enrolled owner would cost, then deny identically.
-    await verifyPasscode(passcode, DUMMY_SALT, DUMMY_HASH, PBKDF2_ITERATIONS)
+    await verifyPasscode(passcode, DUMMY_SALT, DUMMY_HASH)
     log(`[data-portal] op=auth owner=${q(ownerId)} result=denied reason=no-such-owner`)
     return DENIED
   }
 
-  const ok = await verifyPasscode(passcode, person.salt, person.hash, person.iterations)
+  const ok = await verifyPasscode(passcode, person.salt, person.hash)
   if (!ok) {
     log(`[data-portal] op=auth owner=${q(ownerId)} result=denied reason=bad-passcode`)
     return DENIED

package/payload/platform/plugins/cloudflare/skills/data-portal/template/schema.sql

@@ -4,16 +4,25 @@
 -- what they have dropped (manifest), and how hard they have been trying
 -- (auth_attempts). Everything is IF NOT EXISTS so re-applying is safe.
 
--- One row per enrolled person. No plaintext passcode is ever stored: the skill
--- generates the passcode, shows it to the operator once, and persists only the
--- PBKDF2 salt and hash. `iterations` is stored per row so the cost can be
--- raised later without invalidating existing rows.
+-- One row per enrolled person. No plaintext passcode is ever stored: the
+-- enrolment script generates the passcode, prints it to the operator once, and
+-- persists only the salt and a SHA-256 of salt || passcode.
+--
+-- There is no `iterations` column. Verification is a single fast hash, which is
+-- safe only because passcodes are machine-generated at a pinned length — see the
+-- note at hashPasscode in functions/api/_lib/passcode.mjs. A cost column here
+-- would imply a tunable that does not exist.
+--
+-- `iterations` was dropped outright rather than migrated because no portal had
+-- been deployed when it went (Task 1708). If you meet a `people` table that still
+-- has the column, this file will NOT remove it — IF NOT EXISTS is a no-op on an
+-- existing table — and enrolment's INSERT will fail on `iterations NOT NULL`.
+-- Drop the column by hand in that case; do not add it back here.
 CREATE TABLE IF NOT EXISTS people (
   ownerId    TEXT PRIMARY KEY,
   name       TEXT NOT NULL,
   salt       TEXT NOT NULL,
   hash       TEXT NOT NULL,
-  iterations INTEGER NOT NULL,
   createdAt  TEXT NOT NULL
 );
 

package/payload/platform/plugins/cloudflare/skills/site-deploy/SKILL.md

@@ -33,6 +33,8 @@ There is never a `sites/<brand>/` versus `output/<brand>-site/` pair, a `.bak` c
 
 ## Auth: reuse the per-scope token, never mint ad hoc
 
+> **Client accounts on a multi-tenant install do not use this section.** Post-1631 their secrets carry no master and `cf-token.sh` denies them the `pages` scope (`reason=not-house`). They publish with `storage-pages-deploy`, which deploys house-side against a project the house has recorded to them (`storage-pages-adopt`). A `not-house` denial here is that boundary working, not a token fault — do not try to mint around it. Everything below is the **house/single-tenant** path.
+
 Resolve the Pages-and-D1 token with the deterministic helper **before** any token `curl`, never a hand-built one:
 
 ```bash

package/payload/platform/plugins/connector/lib/mcp-spawn-tee/index.js

@@ -13,14 +13,15 @@
  *
  *   Claude Code CLI → shim (this file) = node running <real-entry> in-process
  *        stdin/stdout : untouched (JSON-RPC channel)
- *        stderr       : process.stderr.write teed → per-date + per-session + passthrough
+ *        stderr       : process.stderr.write teed → raw sink + passthrough
  *
- * Destinations (Task 706) — unchanged:
- *   - `${LOG_DIR}/mcp-<name>-stderr-<date>.log`  — per-date raw (back-compat;
- *     the in-process mcp-stderr-tee and the [mcp-init-error] probe read it).
- *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — per-session raw + lifecycle
- *     lines. Authoritative sink. Absent when SESSION_ID is unset (enumeration
- *     spawn) — then the per-date file is the fallback.
+ * Destinations:
+ *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — raw stderr + lifecycle lines.
+ *     The sole raw sink. Task 1721 retired the per-date twin: its date was
+ *     pinned at spawn, no reader ever parsed it, and mcp-stderr-tee wrote the
+ *     same file, so every line landed twice.
+ *   - `${LOG_DIR}/mcp-<name>-nosession.log`      — the same, for a spawn with
+ *     no SESSION_ID (enumeration). One fixed file per server.
  *   - `server.log` via the loopback log-ingest route — best-effort mirror of
  *     the [mcp-helper] lifecycle lines.
  *
@@ -49,13 +50,13 @@ const PLATFORM_PORT = process.env.PLATFORM_PORT;
 const ENTRY = process.argv[2];
 const SESSION_ID8 = SESSION_ID ? SESSION_ID.slice(0, 8) : "—";
 const spawnStamp = Date.now();
-// Per-session raw + lifecycle log (Task 706). Empty SESSION_ID (enumeration
-// spawn) → undefined, and the per-date file is the fallback.
-const perSessionPath = LOG_DIR && SESSION_ID
-    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-${SESSION_ID}.log`)
-    : undefined;
-const perDatePath = LOG_DIR
-    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-stderr-${new Date(spawnStamp).toISOString().slice(0, 10)}.log`)
+// The one raw sink (Task 1721). A sessionless spawn (rc-daemon stamps
+// SESSION_ID='' — rc-daemon.ts:513 — while still stamping LOG_DIR) shares one
+// fixed file per server rather than a date-named one: the date was never read
+// by any reader and named a process lifetime, not a day. Interleaved spawns in
+// the nosession file are separated by the [mcp-helper] op=spawn pid= lines.
+const rawSinkPath = LOG_DIR
+    ? (0, node_path_1.resolve)(LOG_DIR, SESSION_ID ? `mcp-${SERVER_NAME}-${SESSION_ID}.log` : `mcp-${SERVER_NAME}-nosession.log`)
     : undefined;
 // Rolling tail of entry stderr for op=exit. Capped so a chatty server cannot
 // grow the buffer without bound.
@@ -66,7 +67,7 @@ let exitEmitted = false;
 let exitSignal;
 // The real stderr writer, captured before the tee replaces it. Lifecycle lines
 // and stderr passthrough both go through this so they are never re-teed into
-// the per-date sink nor recursed back into the patched writer.
+// the raw sink nor recursed back into the patched writer.
 const rawStderrWrite = process.stderr.write.bind(process.stderr);
 // LOG_DIR is created once, lazily, on the first successful append — not per
 // chunk. teeWrite runs on the server's own stderr hot path now, so a per-call
@@ -115,7 +116,7 @@ function postToServerLog(suffix, level) {
 // log-ingest route rejects newlines).
 function emitLifecycle(suffix, level) {
     const line = `[mcp-helper] ${suffix}\n`;
-    appendSafe(perSessionPath, line);
+    appendSafe(rawSinkPath, line);
     try {
         rawStderrWrite(line);
     }
@@ -127,12 +128,11 @@ if (!ENTRY) {
     process.exit(2);
 }
 // Replace process.stderr.write with a tee: mirror every server stderr byte to
-// the per-date and per-session sinks, keep a rolling tail for op=exit, emit
+// the raw sink, keep a rolling tail for op=exit, emit
 // op=boot on the first bytes, then pass the write through to the real stderr.
 const teeWrite = ((...args) => {
     const chunk = args[0];
-    appendSafe(perDatePath, chunk); // per-date raw (back-compat)
-    appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
+    appendSafe(rawSinkPath, chunk); // raw sink (Task 1721)
     const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
     stderrTail = (stderrTail + text).slice(-TAIL_CAP);
     if (!bootEmitted) {

package/payload/platform/plugins/contacts/lib/mcp-spawn-tee/index.js

@@ -13,14 +13,15 @@
  *
  *   Claude Code CLI → shim (this file) = node running <real-entry> in-process
  *        stdin/stdout : untouched (JSON-RPC channel)
- *        stderr       : process.stderr.write teed → per-date + per-session + passthrough
+ *        stderr       : process.stderr.write teed → raw sink + passthrough
  *
- * Destinations (Task 706) — unchanged:
- *   - `${LOG_DIR}/mcp-<name>-stderr-<date>.log`  — per-date raw (back-compat;
- *     the in-process mcp-stderr-tee and the [mcp-init-error] probe read it).
- *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — per-session raw + lifecycle
- *     lines. Authoritative sink. Absent when SESSION_ID is unset (enumeration
- *     spawn) — then the per-date file is the fallback.
+ * Destinations:
+ *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — raw stderr + lifecycle lines.
+ *     The sole raw sink. Task 1721 retired the per-date twin: its date was
+ *     pinned at spawn, no reader ever parsed it, and mcp-stderr-tee wrote the
+ *     same file, so every line landed twice.
+ *   - `${LOG_DIR}/mcp-<name>-nosession.log`      — the same, for a spawn with
+ *     no SESSION_ID (enumeration). One fixed file per server.
  *   - `server.log` via the loopback log-ingest route — best-effort mirror of
  *     the [mcp-helper] lifecycle lines.
  *
@@ -49,13 +50,13 @@ const PLATFORM_PORT = process.env.PLATFORM_PORT;
 const ENTRY = process.argv[2];
 const SESSION_ID8 = SESSION_ID ? SESSION_ID.slice(0, 8) : "—";
 const spawnStamp = Date.now();
-// Per-session raw + lifecycle log (Task 706). Empty SESSION_ID (enumeration
-// spawn) → undefined, and the per-date file is the fallback.
-const perSessionPath = LOG_DIR && SESSION_ID
-    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-${SESSION_ID}.log`)
-    : undefined;
-const perDatePath = LOG_DIR
-    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-stderr-${new Date(spawnStamp).toISOString().slice(0, 10)}.log`)
+// The one raw sink (Task 1721). A sessionless spawn (rc-daemon stamps
+// SESSION_ID='' — rc-daemon.ts:513 — while still stamping LOG_DIR) shares one
+// fixed file per server rather than a date-named one: the date was never read
+// by any reader and named a process lifetime, not a day. Interleaved spawns in
+// the nosession file are separated by the [mcp-helper] op=spawn pid= lines.
+const rawSinkPath = LOG_DIR
+    ? (0, node_path_1.resolve)(LOG_DIR, SESSION_ID ? `mcp-${SERVER_NAME}-${SESSION_ID}.log` : `mcp-${SERVER_NAME}-nosession.log`)
     : undefined;
 // Rolling tail of entry stderr for op=exit. Capped so a chatty server cannot
 // grow the buffer without bound.
@@ -66,7 +67,7 @@ let exitEmitted = false;
 let exitSignal;
 // The real stderr writer, captured before the tee replaces it. Lifecycle lines
 // and stderr passthrough both go through this so they are never re-teed into
-// the per-date sink nor recursed back into the patched writer.
+// the raw sink nor recursed back into the patched writer.
 const rawStderrWrite = process.stderr.write.bind(process.stderr);
 // LOG_DIR is created once, lazily, on the first successful append — not per
 // chunk. teeWrite runs on the server's own stderr hot path now, so a per-call
@@ -115,7 +116,7 @@ function postToServerLog(suffix, level) {
 // log-ingest route rejects newlines).
 function emitLifecycle(suffix, level) {
     const line = `[mcp-helper] ${suffix}\n`;
-    appendSafe(perSessionPath, line);
+    appendSafe(rawSinkPath, line);
     try {
         rawStderrWrite(line);
     }
@@ -127,12 +128,11 @@ if (!ENTRY) {
     process.exit(2);
 }
 // Replace process.stderr.write with a tee: mirror every server stderr byte to
-// the per-date and per-session sinks, keep a rolling tail for op=exit, emit
+// the raw sink, keep a rolling tail for op=exit, emit
 // op=boot on the first bytes, then pass the write through to the real stderr.
 const teeWrite = ((...args) => {
     const chunk = args[0];
-    appendSafe(perDatePath, chunk); // per-date raw (back-compat)
-    appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
+    appendSafe(rawSinkPath, chunk); // raw sink (Task 1721)
     const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
     stderrTail = (stderrTail + text).slice(-TAIL_CAP);
     if (!bootEmitted) {

package/payload/platform/plugins/docs/references/admin-session.md

@@ -112,7 +112,7 @@ Each session row carries a usage icon (Lucide `Gauge`) that opens a modal with a
 
 ## Memory MCP write-path outcome lines
 
-Every write-path tool in the memory plugin MCP emits one structured line per invocation to `server.log` via the loopback `/api/admin/log-ingest` route. The operator can answer "did this write succeed?" from a single greppable surface — no need to cross-reference the per-process `mcp-memory-stderr-<date>.log`.
+Every write-path tool in the memory plugin MCP emits one structured line per invocation to `server.log` via the loopback `/api/admin/log-ingest` route. The operator can answer "did this write succeed?" from a single greppable surface — no need to cross-reference the per-session `mcp-memory-<sessionId>.log`.
 
 Line shapes:
 
@@ -137,10 +137,10 @@ grep '\[mcp:memory\] .* result=error' ~/.${brand}/logs/server.log | awk -F'reaso
 # Did the loopback POST itself fail? (Helper falls back to stderr and re-writes
 # the structured line, so the event is never lost — this just flags that the
 # session-manager's /api/admin/log-ingest was unreachable for some window.)
-grep '\[mcp:memory\] log-ingest-failed' ~/.${brand}/logs/mcp-memory-stderr-*.log
+grep '\[mcp:memory\] log-ingest-failed' ~/.${brand}/logs/mcp-memory-*.log
 ```
 
-The existing `mcp-memory-stderr-<date>.log` capture is unchanged on error paths — the new structured line is additive, not a relocation. Crash-mode debugging continues to read the stderr log; routine "did it land?" questions read `server.log`.
+The existing raw capture is unchanged on error paths — the new structured line is additive, not a relocation. Crash-mode debugging continues to read the raw sink `mcp-memory-<sessionId>.log`; routine "did it land?" questions read `server.log`.
 
 **Test contract.** Each of the 20 wired tools carries a `*-emit.test.ts` fixture under `platform/plugins/memory/mcp/src/tools/__tests__/` that mocks `fetch` and asserts the wire body. A refactor that drops `withWriteEvent` from any tool fails the matching tool's tests with a clear `expected "vi.fn()" to be called 1 times, but got 0 times` error, naming the tool. A shared helper at `__tests__/_helpers/emit-capture.ts` standardises the fetch capture + Neo4j Session stub so each tool test stays a few lines of mocks + one happy + one error assertion. Drift between the helper's body shape and the route's validator is pinned by an end-to-end test at `platform/ui/server/routes/admin/__tests__/log-ingest-mcp-end-to-end.test.ts`, which routes the helper's POST through the real Hono `log-ingest` route with a loopback `remoteAddress` shim.
 

package/payload/platform/plugins/docs/references/cloudflare.md

@@ -2,6 +2,8 @@
 
 Each installation has its own Cloudflare account. The **tunnel** sign-in is OAuth: the agent invokes `cloudflared tunnel login` via Bash; the Cloudflare Authorize URL streams into the admin chat PTY and the native terminal renders it as a clickable link. Click it, authorise in your own browser, and `cloudflared` writes `cert.pem` to the brand's config directory. For **everything else** (DNS, Pages, D1, Access) the agent uses the Cloudflare API, authenticated by a short-lived narrow token it mints from a master token you provision once in the dashboard (an advanced step the agent never automates). Some account-side jobs — adding a domain, switching accounts — are still easiest in your browser, and the agent relays those click-paths; the rest it can do directly via the API.
 
+Where one installation serves several client accounts from one Cloudflare account, that master is held by the house account alone, and a client account cannot mint from it — it is account-wide, so handing it to one client would hand them every other client's data. Publishing a client's website therefore runs house-side on the client's behalf: the client's session asks, the house does the deploy, and no Cloudflare token ever enters the client's account. Which website belongs to which client is recorded once by the house and is never inferred from folder names, so a site nobody has recorded cannot be published by anyone until it is.
+
 ## Identity model
 
 | Concept | Source |

package/payload/platform/plugins/docs/references/outlook-guide.md

@@ -34,7 +34,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-mailbox-info` | Health probe for one mailbox — auth state, refresh-window, folder count. Name the mailbox with `mailbox` when several are attached. |
 | `outlook-mailbox-list` | Every connected mailbox with its email, scopes, and token health. Local only — no network — so it also flags a mailbox whose stored credentials cannot be read. |
 | `outlook-mail-send` | Send a message. No attachments → `POST /me/sendMail`; with attachments → draft, attach, send (`/me/sendMail` carries attachments inline and cannot fit a large file). to/cc/bcc arrays, subject, body, isHtml, attachments (account-dir paths, 25 MB/file). Success asserted on Graph 202; no message id on either route. Needs `Mail.Send` (+ `Mail.ReadWrite` to attach). |
-| `outlook-draft` | Create a draft in Drafts (`POST /me/messages`). Same body model, including attachments — files are attached before the id is returned, so the draft is ready to send. Returns the draft id. Needs `Mail.ReadWrite`. |
+| `outlook-draft` | Create a draft in Drafts, either a new message or a threaded reply. Returns the draft id; never sends. Attachments are attached before the id is returned, so the draft is ready to send. Needs `Mail.ReadWrite`. **New message** (no `replyToMessageId`): `POST /me/messages`, requires `to` + `subject`, same body model as `outlook-mail-send`, threads under nothing. **Threaded reply** (`replyToMessageId` = the id of the message being answered): `POST /me/messages/{id}/createReply` — the draft carries the parent's conversationId, so it lands under the original. This is the only way to draft a reply without sending it: `outlook-mail-reply` threads but always sends. Graph sets the recipients and `RE:` subject from the original and composes the body above its own quote, matching what `outlook-mail-reply` sends, so the threaded path is **plain text only** — `to`, `subject`, and `isHtml: true` are **refused** (not ignored) when replying. `replyAll` includes everyone on the original; `cc`/`bcc` add recipients. |
 | `outlook-draft-edit` | Update an existing draft in place (`PATCH /me/messages/{draftId}`) and/or add and remove attachments. Graph drafts are mutable — pass draftId plus the fields to change (to/cc/bcc/subject/body/isHtml/attachments/removeAttachments). `attachments` adds; `removeAttachments` takes files off by name or attachment id; both together replace a file in one call. Sent messages cannot be edited. Needs `Mail.ReadWrite`. |
 | `outlook-draft-send` | Send an existing draft by id (`POST /me/messages/{id}/send`). Graph consumes the draft, returns 202. Needs `Mail.Send`. |
 
@@ -76,9 +76,9 @@ All log lines start with `[outlook-mcp]` and write to `server.log`. They are key
 | Send args | `send-args account=<id> recipients=<N> hasBody=<bool>` |
 | Sent | `sent account=<id> status=202 messageId=<id-or-null>` |
 | Send failed | `send-failed account=<id> error=<msg>` |
-| Draft request | `draft-request account=<id>` |
-| Draft created | `draft-created account=<id> id=<draftId>` |
-| Draft failed | `draft-failed account=<id> error=<msg>` |
+| Draft request | `draft-request account=<id> threaded=<bool>` |
+| Draft created | `draft-created account=<id> id=<draftId> threaded=<bool> convId=<id\|null>` |
+| Draft failed | `draft-failed account=<id> threaded=<bool> error=<msg>` |
 | Draft-send request | `draft-send-request account=<id> id=<draftId>` |
 | Draft sent | `draft-sent account=<id> id=<draftId> status=202` |
 | Draft-send failed | `draft-send-failed account=<id> id=<draftId> error=<msg>` |
@@ -91,8 +91,15 @@ ssh laptop 'grep -E "^\[outlook-mcp\]" ~/.maxy/logs/server.log | grep "account=<
 
 # Token-leak audit — must always return zero
 grep -rn -iE "Bearer |access_token=" ~/.maxy/logs/server.log | head
+
+# Threading audit — a threaded write that reports no conversation LOST its thread.
+# Must always return zero. Covers both outbound threaded paths (mail-reply and draft-created).
+grep -E "^\[outlook-mcp\] (mail-reply|draft-created)" ~/.maxy/logs/server.log \
+  | grep -E "threaded=true|op=reply" | grep -E "convId=(null)?( |$)" | head
 ```
 
+Threading triage: **absence of a `convId` on a threaded write means threading was lost.** `draft-created threaded=false convId=null` is correct and expected — a new message has no parent conversation. `draft-created threaded=true convId=null` is a fault: Graph returned a reply draft that names no conversation, and the reply will land detached from the original.
+
 Latency triage: `mail-list count=0 elapsedMs<200` consistent → permissions issue; `elapsedMs > 5000` → Graph slowness or DNS.
 
 ## Failure modes

package/payload/platform/plugins/docs/references/plugins-guide.md

@@ -161,7 +161,9 @@ import { initStderrTee } from "../../../../lib/mcp-stderr-tee/dist/index.js";
 initStderrTee("your-plugin-name");
 ```
 
-After this, every `console.error("[your-tool]...")` from any tool in the plugin appears as `[<iso-ts>] [mcp:your-plugin-name] [your-tool]...` in the per-conversation stream log `claude-agent-stream-{sessionId}.log`, alongside the usual agent events. The raw per-server file `mcp-your-plugin-name-stderr-{date}.log` is still produced for deep-dive grep.
+After this, every `console.error("[your-tool]...")` from any tool in the plugin is captured in the raw per-server file `mcp-your-plugin-name-{sessionId}.log`, written by the `mcp-spawn-tee` wrapper. That is where you grep.
+
+`initStderrTee` is *intended* to also mirror each line into the per-conversation stream log `claude-agent-stream-{sessionId}.log` as `[<iso-ts>] [mcp:your-plugin-name] [your-tool]...`, alongside the usual agent events. It does not currently do so: that destination is gated on `STREAM_LOG_PATH`, which no spawner sets, so the call is a no-op in production. Do not expect `[mcp:<name>]` lines in a conversation's stream log, and do not read their absence as the server having emitted nothing. Tracked as [`.tasks/1736-*.md`](../../../.tasks/1736-nothing-sets-stream-log-path-so-the-per-conversation-mcp-stream-log-does-not-exist.md).
 
 **Premium plugins.** Source lives at `premium-plugins/<bundle>/plugins/<name>/mcp/src/` — deeper than platform plugins, so the source-relative import to `platform/lib/mcp-stderr-tee/dist/index.js` uses more `../` segments. The bundler rewrites the compiled output to the canonical `../../../../lib/mcp-stderr-tee/dist/index.js` at staging time and ships `platform/lib/mcp-stderr-tee/{dist,package.json}` into `premium-plugins/<bundle>/lib/mcp-stderr-tee/` so the import resolves at deployed depth. The bundler fails loudly if `platform/lib/mcp-stderr-tee/package.json` is missing (it must pin `type` so install-location parent walks cannot mis-classify the dist file) or if any lib referenced by a rewritten import has no source dist.
 
@@ -172,7 +174,7 @@ After this, every `console.error("[your-tool]...")` from any tool in the plugin
 **Retrieve MCP diagnostic lines for a conversation:**
 
 - All servers: `logs-read { type: "system", sessionId: "..." }` → grep `[mcp:<name>]` on the returned stream log.
-- One server raw feed: `logs-read { type: "mcp" }` → tails the most recent `mcp-<name>-stderr-*.log` (per-plugin, not per-conversation).
+- One server raw feed: `logs-read { type: "mcp" }` → tails the most recent `mcp-<name>-*.log` (per-plugin, not per-conversation).
 
 **Tee-state markers** land in the stream log: `[platform] [mcp-tee-attach] server=<name> streamLogPath=...` when the tee wires up, `[platform] [mcp-tee-skip] server=<name> destination=... reason=...` when a destination fails (missing `LOG_DIR`, unwritable path, `STREAM_LOG_PATH` not set, etc.), `[platform] [mcp-tee-detach] server=<name>` on graceful shutdown. If a server invoked tools but no `[mcp:<name>]` lines appear in the conversation's log, look for the skip marker first.
 
@@ -180,16 +182,16 @@ After this, every `console.error("[your-tool]...")` from any tool in the plugin
 
 ## Failure-path observability contract (earlier platform fixes + earlier platform fixes)
 
-The `initStderrTee` wrapper writes to the per-conversation stream log and per-server raw file via `createWriteStream` — async, buffered. Any diagnostic `console.error(…)` followed by an immediate `process.exit(…)` is lost: the event loop never drains the WriteStream before the process terminates. Same race for any synchronous module-load throw: Node's uncaught-exception handler writes the stack to raw fd 2 and exits before the patched async stream flushes. The platform's `[mcp-init-error] tail="(no stderr file)"` line — operationally useless — is the public symptom of this race.
+The `initStderrTee` wrapper writes to the per-conversation stream log via `createWriteStream` — async, buffered. Any diagnostic `console.error(…)` followed by an immediate `process.exit(…)` is lost from *that* destination: the event loop never drains the WriteStream before the process terminates. Same race for any synchronous module-load throw: Node's uncaught-exception handler writes the stack to raw fd 2 and exits before the patched async stream flushes. The raw sink does not have this race — removed `initStderrTee`'s own raw file, and `mcp-spawn-tee` writes the sink with `appendFileSync`, which returns once the kernel has queued the write and so survives an immediate exit.
 
 **Two layers now close the gap, each load-bearing on its own:**
 
 1. **Plugin-side sync-write discipline.** Plugins that call `process.exit` during module load (rare — `graph-mcp` is the in-tree example; it spawns a child at boot to proxy upstream stdio) use `fs.appendFileSync` at every named exit path to guarantee the cause lands in both log destinations before exit. Lines follow the `[mcp:<name>] [<plugin-prefix>] <cause>` format so existing `grep '[mcp:<name>]'` investigator paths work. Each destination is wrapped in its own try/catch — an unwritable log must not mask the primary failure. This is the discipline propagated to any plugin author who knows their failure paths.
 
-2. **Parent-side `mcp-spawn-tee` wrapper.** Every node-based core MCP server is spawned via the `lib/mcp-spawn-tee` wrapper rather than `node <entry>` directly. The wrapper spawns the real entry with `stdio: ['inherit', 'inherit', 'pipe']` and writes child stderr chunks to `${LOG_DIR}/mcp-${name}-stderr-<date>.log` via `appendFileSync` while passing the same chunks through to its own stderr (Claude Code's consumer is unchanged). Synchronous `appendFileSync` survives `process.exit`, so the per-server file captures even (a) module-load throws before `initStderrTee` runs, (b) `MODULE_NOT_FOUND` on the entry script itself, and (c) anything else a plugin author missed. The wrapper writes `[mcp-spawn-tee-attached] server=<name> pid=<n>` on attach and forwards SIGTERM/SIGINT to the child. This is the layer that makes capture independent of plugin discipline. Playwright stays unwrapped because it spawns via `npx`, not `node`.
+2. **Parent-side `mcp-spawn-tee` wrapper.** Every node-based core MCP server is spawned via the `lib/mcp-spawn-tee` wrapper rather than `node <entry>` directly. The wrapper runs the real entry in its own process and writes stderr chunks to `${LOG_DIR}/mcp-${name}-${SESSION_ID}.log` (or `mcp-${name}-nosession.log` when `SESSION_ID` is unset) via `appendFileSync` while passing the same chunks through to its own stderr (Claude Code's consumer is unchanged). It is the only writer of that raw sink: retired the `mcp-${name}-stderr-<date>.log` twin, which `mcp-stderr-tee` also wrote, so every line used to land there twice. Synchronous `appendFileSync` survives `process.exit`, so the sink captures even (a) module-load throws before `initStderrTee` runs, (b) `MODULE_NOT_FOUND` on the entry script itself, and (c) anything else a plugin author missed. The wrapper writes `[mcp-spawn-tee-attached] server=<name> pid=<n>` on attach and forwards SIGTERM/SIGINT to the child. This is the layer that makes capture independent of plugin discipline. Playwright stays unwrapped because it spawns via `npx`, not `node`.
 
-A third layer closes the same gap from the platform side: when `claude-agent.ts` observes an `init` event with any MCP server reporting `status:"failed"`, it reads the last 512 bytes of `${LOG_DIR}/mcp-<name>-stderr-<date>.log` and emits `[mcp-init-error] server=<name> tail=<quoted>` into the stream log. Absent file → `tail="(no stderr file)"`; empty file → `tail="(empty)"`. With the spawn-tee wrapper now interposing on every core MCP, `tail="(no stderr file)"` means the wrapper itself is broken — file follow-up.
+A `[mcp-init-error]` probe on the platform side used to read the retired per-date file and tail it into the stream log. found no such probe in live code — `claude-agent.ts` has not carried one for some time — so the wrapper's own `[mcp-helper] op=boot` and `op=exit` lines are the record of a failed MCP boot.
 
-**Signal inventory after a failed session:** `[init] FAILED MCP servers: <names>` (names), `[mcp-init-error] server=<name> tail=…` (cause for each, from the platform's tail probe), `[mcp-spawn-tee-attached] server=<name> pid=<n>` (proof the wrapper attached), `[mcp-spawn-tee-exit] server=<name> code=<n>|signal=<s>` (proof the wrapper saw the exit), and optionally `[mcp:<name>] [<plugin>] …` from plugin-side sync-writes. Their union gives the investigator three independent sources for the same failure.
+**Signal inventory after a failed session:** `[init] FAILED MCP servers: <names>` (names), `[mcp-spawn-tee-attached] server=<name> pid=<n>` (proof the wrapper attached), `[mcp-spawn-tee-exit] server=<name> code=<n>|signal=<s>` (proof the wrapper saw the exit), and optionally `[mcp:<name>] [<plugin>] …` from plugin-side sync-writes. Their union gives the investigator independent sources for the same failure. (The two `[mcp-spawn-tee-*]` names are stale — the shim emits `[mcp-helper] op=spawn|boot|exit`; see [`.tasks/1737-*.md`](../../../.tasks/1737-mcp-spawn-tee-docs-promise-lifecycle-markers-and-a-child-process-that-task-989-removed.md).)
 
 **Boot-smoke as publish-time gate.** The memory MCP carries `scripts/boot-smoke.sh` that spawns `dist/index.js` with stub env, sleeps 2s, asserts `kill -0 <pid>`, and reports `[boot-smoke] memory ok|FAILED tail=<n-lines>`. Wired to `prepublish` in `plugins/memory/mcp/package.json`. The pattern is propagatable to other plugin MCPs — it's deliberately not generalised yet because each plugin's stub-env requirements differ (memory needs ACCOUNT_ID + PLATFORM_ROOT + NEO4J_URI + SESSION_ID; others differ).