@rubytech/create-maxy-code 0.1.478 → 0.1.479

package/payload/platform/plugins/cloudflare/skills/data-portal/template/portal.css

@@ -122,3 +122,59 @@ body {
   color: var(--dp-muted);
   padding: 0.75rem 0;
 }
+
+/* "Shared with you" — the folder tree the device publishes. Deliberately reuses
+   the existing variables and adds none: portal-brand-css.mjs rewrites the one
+   :root block from the brand palette and validates every value it finds there,
+   so a new variable declared here would either be dropped or fail that check. */
+.dp-shared {
+  margin-top: 28px;
+  border-top: 1px solid var(--dp-rule);
+  padding-top: 16px;
+}
+
+.dp-subtitle {
+  font-size: 15px;
+  font-weight: 600;
+  margin: 0 0 8px;
+  color: var(--dp-ink);
+}
+
+.dp-crumbs {
+  font-size: 13px;
+  color: var(--dp-muted);
+  margin-bottom: 10px;
+}
+
+/* Crumbs and folder rows are buttons (navigation is a fetch, not a page load),
+   so they need the button chrome stripped to sit beside the upload list's
+   anchors without looking like form controls. */
+.dp-crumb,
+.dp-folder-name {
+  background: none;
+  border: 0;
+  padding: 0;
+  font: inherit;
+  cursor: pointer;
+  color: var(--dp-accent);
+}
+
+.dp-crumb:hover,
+.dp-folder-name:hover {
+  text-decoration: underline;
+}
+
+.dp-folder-name {
+  font-weight: 600;
+}
+
+/* The file rows inside the tree are buttons too — same reset, but they must
+   match .dp-file-name's weight so the two lists read as one surface. */
+.dp-shared .dp-file-name {
+  background: none;
+  border: 0;
+  padding: 0;
+  font: inherit;
+  cursor: pointer;
+  text-align: left;
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/portal.js

@@ -16,6 +16,12 @@
   var loginEl = document.getElementById('dp-login');
   var panelEl = document.getElementById('dp-panel');
   var filesEl = document.getElementById('dp-files');
+  var sharedEl = document.getElementById('dp-shared');
+  var crumbsEl = document.getElementById('dp-crumbs');
+  var entriesEl = document.getElementById('dp-entries');
+
+  /* The folder currently open in the "shared with you" tree; '' is its root. */
+  var prefix = '';
 
   function say(msg) {
     statusEl.textContent = msg;
@@ -64,13 +70,103 @@
     });
   }
 
+  /* One crumb. A button rather than a link: navigating the tree is a fetch, not
+     a page load, and the session cookie stays where it is. */
+  function crumb(label, target) {
+    var b = document.createElement('button');
+    b.className = 'dp-crumb';
+    b.type = 'button';
+    b.textContent = label;
+    b.addEventListener('click', function () {
+      prefix = target;
+      refresh();
+    });
+    return b;
+  }
+
+  function renderCrumbs() {
+    crumbsEl.replaceChildren();
+    crumbsEl.appendChild(crumb('All folders', ''));
+    var parts = prefix ? prefix.split('/') : [];
+    parts.forEach(function (part, i) {
+      crumbsEl.appendChild(document.createTextNode(' / '));
+      crumbsEl.appendChild(crumb(part, parts.slice(0, i + 1).join('/')));
+    });
+  }
+
+  /* Every label goes through textContent, same rule as the upload list: these
+     names come off the device and are never trusted as markup. */
+  function renderEntries(entries) {
+    renderCrumbs();
+    entriesEl.replaceChildren();
+    if (!entries.length) {
+      entriesEl.appendChild(item('Nothing here.'));
+      return;
+    }
+    entries.forEach(function (e) {
+      var li = document.createElement('li');
+      li.className = 'dp-file-row';
+
+      var b = document.createElement('button');
+      b.className = e.kind === 'directory' ? 'dp-folder-name' : 'dp-file-name';
+      b.type = 'button';
+      b.textContent = e.kind === 'directory' ? e.name + '/' : e.name;
+      b.addEventListener('click', function () {
+        if (e.kind === 'directory') {
+          prefix = e.relPath;
+          refresh();
+        } else {
+          openShared(e.relPath);
+        }
+      });
+      li.appendChild(b);
+      entriesEl.appendChild(li);
+    });
+  }
+
+  /* These files live on the device, not in the portal's own store, so the
+     portal checks the device is reachable and then hands back a link that
+     expires. A device that is down says so plainly instead of failing as a
+     broken download. */
+  function openShared(relPath) {
+    say('Opening…');
+    api('/api/download?path=' + encodeURIComponent(relPath))
+      .then(function (r) {
+        return r.json().then(function (d) {
+          return { s: r.status, d: d };
+        });
+      })
+      .then(function (res) {
+        if (res.s === 503) {
+          say('That file is on the device, which is not reachable right now. Try again shortly.');
+          return;
+        }
+        if (!res.d.ok || !res.d.url) {
+          say('That file could not be opened.');
+          return;
+        }
+        say('');
+        window.location.assign(res.d.url);
+      })
+      .catch(function () {
+        say('That file could not be opened.');
+      });
+  }
+
   function refresh() {
-    return api('/api/files')
+    return api('/api/files?prefix=' + encodeURIComponent(prefix))
       .then(function (r) {
         return r.json();
       })
       .then(function (d) {
-        if (d.ok) render(d.files || []);
+        if (!d.ok) return;
+        render(d.files || []);
+        var entries = d.entries || [];
+        // Hidden at the root only: once inside a folder the section stays put,
+        // so an empty folder reads as empty rather than as the whole tree
+        // vanishing.
+        sharedEl.hidden = prefix === '' && entries.length === 0;
+        renderEntries(entries);
       })
       .catch(function () {
         say('Could not load your files.');

package/payload/platform/plugins/cloudflare/skills/data-portal/template/wrangler.toml

@@ -4,6 +4,7 @@
 #   __D1_DATABASE_NAME__ the D1 database name  (<accountId>-<purpose>)
 #   __D1_DATABASE_ID__   the id printed by `wrangler d1 create`
 #   __R2_BUCKET_NAME__   the R2 bucket name    (<accountId>-<purpose>)
+#   __PORTAL_INSTALL_ORIGIN__ the install's public origin (https://<tunnel-hostname>)
 name = "__PROJECT_NAME__"
 pages_build_output_dir = "."
 compatibility_date = "2024-01-01"
@@ -19,3 +20,14 @@ database_id = "__D1_DATABASE_ID__"
 [[r2_buckets]]
 binding = "BUCKET"
 bucket_name = "__R2_BUCKET_NAME__"
+
+# Where the install answers, so a download of a device-held file can be signed
+# and sent there. Public information — it is the hostname a client's browser
+# ends up at.
+#
+# Its partner, PORTAL_FETCH_SECRET, is deliberately NOT here. This file is
+# committed to the account's assembled tree and the deploy publishes the
+# directory it is handed, so a secret in it is a secret in a repo and one deploy
+# from being served. Set it with `wrangler pages secret put`.
+[vars]
+PORTAL_INSTALL_ORIGIN = "__PORTAL_INSTALL_ORIGIN__"

package/payload/platform/plugins/docs/references/cloudflare.md

@@ -101,6 +101,18 @@ The most common cause is wrong nameservers on the domain. The domain must use Cl
 - The `/data` page handles this itself: files over 95 MB are split into ~48 MB parts and sent one at a time under the cap, and the server reassembles them. No plan change or dashboard action is needed for uploads up to the 2 GB app ceiling.
 - Raising the proxied body limit is a paid-plan change made on the Cloudflare dashboard, not something the agent does.
 
+## The client file portal
+
+A portal gives named people their own passcode-protected page on a custom domain. Two things sit on it.
+
+**What they send you.** Anything they upload lands in the account's own storage, one area per person, and nobody sees anyone else's files.
+
+**What you have prepared for them.** The same page shows the account's deliverable folders — the work produced for that client. Which folders those are is not a setting to maintain: it follows the account's own filing structure, so a business whose work is organised into quotes sees quotes, and a business organised some other way sees that instead. Operator working data, the client's own uploads, and anything internal are never shown.
+
+Folder names and sizes are published to the portal on a schedule, so the client can browse even while the device is off. The files themselves stay on the device. Opening one checks the device is reachable and then hands the browser a link that expires after a few minutes; if the device is down the client is told exactly that, rather than getting a broken download.
+
+Each person is bound to one account when they are enrolled. Someone enrolled before this existed has no account bound and sees no folders until they are enrolled again.
+
 ## What the agent does and does not do
 
 **Does:** invokes `cloudflared` directly via Bash, following `plugins/cloudflare/references/manual-setup.md` step by step; quotes click-paths from the reference files verbatim; verifies external reachability with `curl -I` and surfaces the response.

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/portal-index-audit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=portal-index-audit.test.d.ts.map

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/portal-index-audit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-index-audit.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/portal-index-audit.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/portal-index-audit.test.js

@@ -0,0 +1,66 @@
+import { describe, it, expect } from "vitest";
+import { auditPortalIndex, formatPortalIndexAudit, STALE_AFTER_INTERVALS, } from "../lib/portal-index-audit.js";
+const HOUR = 3_600_000;
+const NOW = 1_800_000_000_000;
+const fresh = (ms) => ({
+    "acc-a": { lastPushMs: NOW - ms, rows: 41, exposed: ["output", "quotes"] },
+});
+describe("auditPortalIndex", () => {
+    it("reports a recently pushed account as healthy", () => {
+        const r = auditPortalIndex(["acc-a"], fresh(HOUR - 1), NOW, HOUR);
+        expect(r.stale).toBe(0);
+        expect(r.neverRan).toBe(0);
+        expect(r.accounts[0].ageMin).toBe(59);
+        expect(r.accounts[0].rows).toBe(41);
+    });
+    it("tolerates one missed cycle, flags two", () => {
+        // One miss is ordinary (a slow push, a device asleep at the tick). The
+        // threshold has to be loose enough that firing means something.
+        expect(auditPortalIndex(["acc-a"], fresh(HOUR * 1.5), NOW, HOUR).stale).toBe(0);
+        expect(auditPortalIndex(["acc-a"], fresh(HOUR * STALE_AFTER_INTERVALS + 1), NOW, HOUR).stale).toBe(1);
+    });
+    // The signature of the failure this module exists for: the spawn never fires,
+    // so no state is ever written and no other line is ever emitted.
+    it("reports an enrolled account with no state as never-ran, not as stale", () => {
+        const r = auditPortalIndex(["acc-a"], {}, NOW, HOUR);
+        expect(r.neverRan).toBe(1);
+        expect(r.stale).toBe(0);
+        expect(r.accounts[0].ageMin).toBeNull();
+    });
+    it("ignores accounts that have no portal", () => {
+        const r = auditPortalIndex([], fresh(HOUR * 99), NOW, HOUR);
+        expect(r.accounts).toEqual([]);
+        expect(r.stale).toBe(0);
+    });
+    it("survives a malformed state entry rather than throwing", () => {
+        const bad = { "acc-a": { rows: 1, exposed: [] } };
+        expect(auditPortalIndex(["acc-a"], bad, NOW, HOUR).neverRan).toBe(1);
+    });
+    it("never reports a negative age when a clock moves backwards", () => {
+        const r = auditPortalIndex(["acc-a"], fresh(-HOUR), NOW, HOUR);
+        expect(r.accounts[0].ageMin).toBe(0);
+        expect(r.accounts[0].stale).toBe(false);
+    });
+});
+describe("formatPortalIndexAudit", () => {
+    it("emits a summary line even when everything is healthy", () => {
+        // An audit that goes quiet on success is indistinguishable from an audit
+        // that stopped running — the exact defect this module closes.
+        const lines = formatPortalIndexAudit(auditPortalIndex(["acc-a"], fresh(60_000), NOW, HOUR));
+        expect(lines).toHaveLength(1);
+        expect(lines[0]).toBe("[portal-index] op=audit accounts=1 stale=0 never-ran=0");
+    });
+    it("names a stale account with its age and exposed set", () => {
+        const lines = formatPortalIndexAudit(auditPortalIndex(["acc-a"], fresh(HOUR * 3), NOW, HOUR));
+        expect(lines[0]).toContain("account=acc-a");
+        expect(lines[0]).toContain("ageMin=180");
+        expect(lines[0]).toContain("exposed=output,quotes");
+        expect(lines[0]).toContain("result=stale");
+    });
+    it("distinguishes never-ran from stale in the line itself", () => {
+        const lines = formatPortalIndexAudit(auditPortalIndex(["acc-a"], {}, NOW, HOUR));
+        expect(lines[0]).toContain("result=never-ran");
+        expect(lines[0]).toContain("rows=0");
+    });
+});
+//# sourceMappingURL=portal-index-audit.test.js.map

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/portal-index-audit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-index-audit.test.js","sourceRoot":"","sources":["../../src/__tests__/portal-index-audit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,GAEtB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,GAAG,GAAG,iBAAiB,CAAC;AAE9B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAoB,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;CAC3E,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,qBAAqB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,iEAAiE;IACjE,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAiC,CAAC;QACjF,MAAM,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5F,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,KAAK,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/scheduling/mcp/dist/lib/portal-index-audit.d.ts

@@ -0,0 +1,41 @@
+export interface PortalIndexEntry {
+    lastPushMs: number;
+    rows: number;
+    exposed: string[];
+}
+export type PortalIndexState = Record<string, PortalIndexEntry>;
+export interface PortalAccountAudit {
+    accountId: string;
+    /** No state entry at all: enrolled for a portal, never successfully pushed. */
+    neverRan: boolean;
+    /** Whole minutes since the last verified push; null when it never ran. */
+    ageMin: number | null;
+    rows: number | null;
+    exposed: string[];
+    stale: boolean;
+}
+export interface PortalIndexAuditResult {
+    accounts: PortalAccountAudit[];
+    stale: number;
+    neverRan: number;
+}
+/**
+ * Two intervals, not one: a single missed cycle is ordinary (a slow push, a
+ * device asleep at the tick). Two consecutive misses is a pattern, and the
+ * threshold has to be loose enough that the line means something when it fires.
+ */
+export declare const STALE_AFTER_INTERVALS = 2;
+/**
+ * @param portalAccountIds accounts carrying a data-portal.json — the enrolment
+ *   signal. An account absent from this list has no portal and is not audited.
+ * @param state the push's own success record, keyed by accountId.
+ * @param nowMs
+ * @param intervalMs the push's cadence.
+ */
+export declare function auditPortalIndex(portalAccountIds: string[], state: PortalIndexState, nowMs: number, intervalMs: number): PortalIndexAuditResult;
+/** One line per account needing attention, plus one summary line that fires
+ *  even when everything is healthy — an audit that goes quiet when it finds
+ *  nothing is indistinguishable from an audit that stopped running, which is
+ *  the exact defect this whole module exists to close. */
+export declare function formatPortalIndexAudit(result: PortalIndexAuditResult): string[];
+//# sourceMappingURL=portal-index-audit.d.ts.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/portal-index-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-index-audit.d.ts","sourceRoot":"","sources":["../../src/lib/portal-index-audit.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;AAE/D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,OAAO,CAAA;IACjB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,KAAK,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,kBAAkB,EAAE,CAAA;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAA;AAEtC;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,EAAE,EAC1B,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,sBAAsB,CA0BxB;AAED;;;0DAG0D;AAC1D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAgB/E"}

package/payload/platform/plugins/scheduling/mcp/dist/lib/portal-index-audit.js

@@ -0,0 +1,75 @@
+// Standing check: is each portal-serving account's folder index still being
+// refreshed?
+//
+// Every other signal in the index push is event-driven — the script logs when
+// it runs. So the one failure it cannot report is its own absence: if the
+// hourly spawn never fires, there is no line at all, the client's folder tree
+// silently freezes at whatever it last held, and silence is indistinguishable
+// from a clean run.
+//
+// This audit therefore must NOT depend on the thing it audits. It runs
+// in-process inside the heartbeat rather than as a spawned child, and it reads
+// only local files — the state the push writes on success, and the presence of
+// a data-portal.json. No D1, no Cloudflare credential, no second spawn that
+// could fail the same way.
+//
+// The push writes state ONLY after a verified write, so a stale entry means the
+// push stopped succeeding, not merely that it stopped logging.
+/**
+ * Two intervals, not one: a single missed cycle is ordinary (a slow push, a
+ * device asleep at the tick). Two consecutive misses is a pattern, and the
+ * threshold has to be loose enough that the line means something when it fires.
+ */
+export const STALE_AFTER_INTERVALS = 2;
+/**
+ * @param portalAccountIds accounts carrying a data-portal.json — the enrolment
+ *   signal. An account absent from this list has no portal and is not audited.
+ * @param state the push's own success record, keyed by accountId.
+ * @param nowMs
+ * @param intervalMs the push's cadence.
+ */
+export function auditPortalIndex(portalAccountIds, state, nowMs, intervalMs) {
+    const threshold = intervalMs * STALE_AFTER_INTERVALS;
+    const accounts = portalAccountIds.map((accountId) => {
+        const entry = state[accountId];
+        if (!entry || typeof entry.lastPushMs !== "number") {
+            // Never-ran is reported as its own condition rather than as infinite
+            // staleness: the remedies differ (a first run vs a broken cycle), and a
+            // brand-new portal must not look like a regression on its first tick.
+            return { accountId, neverRan: true, ageMin: null, rows: null, exposed: [], stale: false };
+        }
+        const ageMs = Math.max(0, nowMs - entry.lastPushMs);
+        return {
+            accountId,
+            neverRan: false,
+            ageMin: Math.floor(ageMs / 60_000),
+            rows: typeof entry.rows === "number" ? entry.rows : null,
+            exposed: Array.isArray(entry.exposed) ? entry.exposed : [],
+            stale: ageMs > threshold,
+        };
+    });
+    return {
+        accounts,
+        stale: accounts.filter((a) => a.stale).length,
+        neverRan: accounts.filter((a) => a.neverRan).length,
+    };
+}
+/** One line per account needing attention, plus one summary line that fires
+ *  even when everything is healthy — an audit that goes quiet when it finds
+ *  nothing is indistinguishable from an audit that stopped running, which is
+ *  the exact defect this whole module exists to close. */
+export function formatPortalIndexAudit(result) {
+    const lines = [];
+    for (const a of result.accounts) {
+        if (a.neverRan) {
+            lines.push(`[portal-index] op=audit account=${a.accountId} rows=0 result=never-ran`);
+        }
+        else if (a.stale) {
+            lines.push(`[portal-index] op=audit account=${a.accountId} rows=${a.rows} ageMin=${a.ageMin} ` +
+                `exposed=${a.exposed.join(",") || "none"} result=stale`);
+        }
+    }
+    lines.push(`[portal-index] op=audit accounts=${result.accounts.length} stale=${result.stale} never-ran=${result.neverRan}`);
+    return lines;
+}
+//# sourceMappingURL=portal-index-audit.js.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/portal-index-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal-index-audit.js","sourceRoot":"","sources":["../../src/lib/portal-index-audit.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,aAAa;AACb,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAC9E,oBAAoB;AACpB,EAAE;AACF,uEAAuE;AACvE,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,2BAA2B;AAC3B,EAAE;AACF,gFAAgF;AAChF,+DAA+D;AA2B/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,gBAA0B,EAC1B,KAAuB,EACvB,KAAa,EACb,UAAkB;IAElB,MAAM,SAAS,GAAG,UAAU,GAAG,qBAAqB,CAAA;IACpD,MAAM,QAAQ,GAAyB,gBAAgB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnD,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QACpD,OAAO;YACL,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC;YAClC,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YACxD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAC1D,KAAK,EAAE,KAAK,GAAG,SAAS;SACzB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;QAC7C,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM;KACpD,CAAC;AACJ,CAAC;AAED;;;0DAG0D;AAC1D,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,SAAS,0BAA0B,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CACR,mCAAmC,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,MAAM,GAAG;gBACjF,WAAW,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,eAAe,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CACR,oCAAoC,MAAM,CAAC,QAAQ,CAAC,MAAM,UAAU,MAAM,CAAC,KAAK,cAAc,MAAM,CAAC,QAAQ,EAAE,CAChH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/payload/platform/plugins/scheduling/mcp/dist/scripts/check-due-events.js

@@ -28,6 +28,7 @@ import cronParser from "cron-parser";
 const { parseExpression } = cronParser;
 import { chooseDispatchMode, dispatchAgentTurn, runStandingAudit, auditSelfCancels } from "./agent-turn-dispatch.js";
 import { spawn } from "node:child_process";
+import { auditPortalIndex, formatPortalIndexAudit, } from "../lib/portal-index-audit.js";
 import { shouldRunSentSweep, SENT_SWEEP_INTERVAL_MS, } from "../lib/sent-sweep-throttle.js";
 // ---------------------------------------------------------------------------
 // Brand-aware config directory — reads configDir from brand.json stamped at install time.
@@ -492,6 +493,110 @@ function maybeRunSentSweep(platformRoot) {
     });
     child.unref();
 }
+const PORTAL_INDEX_STATE_FILE = resolve(CONFIG_DIR, "portal-index-push-state.json");
+const PORTAL_INDEX_INTERVAL_MS = 60 * 60 * 1000;
+/**
+ * Publish each portal-serving account's deliverable folder index, at most hourly.
+ *
+ * Spawned rather than imported, for the same reason as the sent-copy sweep: the
+ * script lives in the cloudflare plugin and talks to Cloudflare's API, which does
+ * not belong inside the scheduling build.
+ *
+ * The script decides WHICH accounts have portals (a `data-portal.json` is the
+ * signal) and which folders each one exposes. Nothing about that is configured
+ * here, so this stays a spawn on a timer.
+ *
+ * State is written before the spawn, not after it completes: a push that hangs
+ * must not cause a fresh one to start behind it every minute.
+ */
+function maybeRunPortalIndexPush(platformRoot) {
+    let prev;
+    try {
+        prev = JSON.parse(readFileSync(PORTAL_INDEX_STATE_FILE, "utf8"));
+    }
+    catch {
+        prev = undefined;
+    }
+    const now = Date.now();
+    if (prev?.lastRunMs && now - prev.lastRunMs < PORTAL_INDEX_INTERVAL_MS)
+        return;
+    const script = resolve(platformRoot, "plugins/cloudflare/bin/portal-index-push.mjs");
+    if (!existsSync(script)) {
+        console.error(`[portal-index] skipped: ${script} not found`);
+        return;
+    }
+    try {
+        writeFileSync(PORTAL_INDEX_STATE_FILE, JSON.stringify({ lastRunMs: now }));
+    }
+    catch (err) {
+        console.error(`[portal-index] state write failed: ${err instanceof Error ? err.message : String(err)}`);
+        return;
+    }
+    const child = spawn(process.execPath, [script, "--all-accounts"], {
+        env: { ...process.env, PLATFORM_ROOT: platformRoot },
+        stdio: ["ignore", "inherit", "inherit"],
+        detached: true,
+    });
+    child.unref();
+}
+const PORTAL_AUDIT_STATE_FILE = resolve(CONFIG_DIR, "portal-index-audit-state.json");
+/**
+ * Standing check: is each portal-serving account's index still being refreshed?
+ *
+ * Runs IN-PROCESS, not as a spawn, and reads only local files. That is the
+ * whole point — every other signal in the push is event-driven, so the one
+ * failure none of them can report is the push not running at all. An audit that
+ * went through the same spawn, or needed the same Cloudflare credential, would
+ * be blind to exactly the case it exists for.
+ *
+ * Throttled to the push's own cadence so the summary line stays readable in a
+ * log that already carries a line a minute.
+ */
+function auditPortalIndexPush(platformRoot) {
+    let prev;
+    try {
+        prev = JSON.parse(readFileSync(PORTAL_AUDIT_STATE_FILE, "utf8"));
+    }
+    catch {
+        prev = undefined;
+    }
+    const now = Date.now();
+    if (prev?.lastRunMs && now - prev.lastRunMs < PORTAL_INDEX_INTERVAL_MS)
+        return;
+    const dataRoot = resolve(platformRoot, "..", "data");
+    const accountsDir = join(dataRoot, "accounts");
+    if (!existsSync(accountsDir))
+        return;
+    // A data-portal.json is the enrolment signal — the same one the push uses, so
+    // the two cannot disagree about which accounts are in scope.
+    let portalAccountIds = [];
+    try {
+        portalAccountIds = readdirSync(accountsDir).filter((d) => existsSync(join(accountsDir, d, "data-portal.json")));
+    }
+    catch {
+        return;
+    }
+    if (portalAccountIds.length === 0)
+        return;
+    let state = {};
+    try {
+        state = JSON.parse(readFileSync(join(dataRoot, "portal-index-state.json"), "utf8"));
+    }
+    catch {
+        // Absent state with portals enrolled is itself the never-ran signal, so an
+        // empty object is the correct input here rather than a reason to bail.
+        state = {};
+    }
+    for (const line of formatPortalIndexAudit(auditPortalIndex(portalAccountIds, state, now, PORTAL_INDEX_INTERVAL_MS))) {
+        console.error(line);
+    }
+    try {
+        writeFileSync(PORTAL_AUDIT_STATE_FILE, JSON.stringify({ lastRunMs: now }));
+    }
+    catch (err) {
+        console.error(`[portal-index] op=audit-state-write-failed err="${err instanceof Error ? err.message : String(err)}"`);
+    }
+}
 async function main() {
     if (!acquireLock()) {
         console.error("[check-due] another instance running, exiting");
@@ -672,6 +777,23 @@ async function main() {
         catch (err) {
             console.error(`[email-sent-sweep] spawn failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // --- Data-portal folder index (hourly) ---
+        // Guarded on the same principle: an optional hourly publish must not cost
+        // the every-minute dispatcher its completion line.
+        try {
+            maybeRunPortalIndexPush(process.env.PLATFORM_ROOT);
+        }
+        catch (err) {
+            console.error(`[portal-index] spawn failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        // Deliberately AFTER the spawn and independent of whether it succeeded:
+        // this is the check that speaks when the push does not.
+        try {
+            auditPortalIndexPush(process.env.PLATFORM_ROOT);
+        }
+        catch (err) {
+            console.error(`[portal-index] op=audit-failed err="${err instanceof Error ? err.message : String(err)}"`);
+        }
         console.error(`[check-due] done: ${processed} processed, ${dispatched} dispatched, ${errors} errors`);
     }
     finally {