@rubytech/create-maxy-code 0.1.491 → 0.1.493

package/payload/platform/lib/storage-broker/src/pages-output-dir.ts

@@ -0,0 +1,194 @@
+// Where a Pages deploy's assets actually start. Task 1917 — `wrangler pages
+// deploy <dir>` treats the positional argument as the asset root and overrides
+// `pages_build_output_dir`, so handing it the site root publishes a declared
+// output dir one level too deep and the served root 404s. Measured on glsmith
+// 2026-07-22: two trees with identical shape and config, one deployed by house
+// wrangler (document at the root, 200) and one by this broker (document
+// reachable only under /public/, root 404).
+//
+// Only the one key is interpreted, in any of the three config formats. This is
+// deliberately not a wrangler config parser: everything else in the file is
+// wrangler's business and stays wrangler's business.
+
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+
+// The filenames `wrangler pages deploy` discovers as its own configuration, in
+// wrangler's own precedence order (wrangler 4.112.0, wrangler-dist/cli.js:3189
+// — json, then jsonc, then toml). The order is load-bearing twice: it decides
+// which config declares the output dir here, and Task 1782 drops all three from
+// the upload so a config is never served publicly at /wrangler.toml, where it
+// would disclose the D1 database id and R2 bucket name.
+export const WRANGLER_CONFIG_NAMES = [
+  "wrangler.json",
+  "wrangler.jsonc",
+  "wrangler.toml",
+] as const;
+
+export type UploadDirSource = (typeof WRANGLER_CONFIG_NAMES)[number] | "site-root";
+
+export type UploadDirResolution = {
+  /** Absolute path to stage and hand wrangler as the asset root. */
+  uploadDir: string;
+  /** Which input decided it, so the caller logs the reason and not the value alone. */
+  source: UploadDirSource;
+  /** The verbatim declared value, present only when a config decided it. */
+  declared?: string;
+};
+
+const KEY = "pages_build_output_dir";
+
+/** Strips line comments and block comments that sit outside string literals.
+ *  JSON has no comments and jsonc does, so a jsonc file is de-commented before
+ *  JSON.parse. Scanning character-wise rather than by regex is what keeps a
+ *  `//` inside a value (a path like "a//b") from being eaten as a comment. */
+function stripJsonComments(text: string): string {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inString) {
+      out += c;
+      if (escaped) escaped = false;
+      else if (c === "\\") escaped = true;
+      else if (c === '"') inString = false;
+      continue;
+    }
+    if (c === '"') {
+      inString = true;
+      out += c;
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      out += "\n";
+      continue;
+    }
+    if (c === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    out += c;
+  }
+  return out;
+}
+
+/** Reads the one key from a TOML file's top level. Top level means before the
+ *  first `[section]` header: a key under `[env.preview]` is that environment's,
+ *  not the deploy's, and reading it would publish the wrong root. Nothing else
+ *  in the file is interpreted. */
+function readTomlKey(text: string): string | undefined {
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[")) return undefined;
+    const m = /^pages_build_output_dir\s*=\s*(?:"([^"]*)"|'([^']*)')\s*(?:#.*)?$/.exec(line);
+    if (m) return m[1] ?? m[2];
+  }
+  return undefined;
+}
+
+/** Reads the one key from a JSON or JSONC file's top level. A present key whose
+ *  value is not a string is an error rather than an ignore: the tree declared an
+ *  output dir, and publishing its parent instead is the defect this closes. */
+function readJsonKey(text: string, name: string, jsonc: boolean): string | undefined {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(jsonc ? stripJsonComments(text) : text);
+  } catch (err) {
+    throw new Error(`storage-broker: ${name} could not be parsed: ${String(err)}`);
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error(`storage-broker: ${name} is not an object`);
+  }
+  const value = (parsed as Record<string, unknown>)[KEY];
+  if (value === undefined) return undefined;
+  if (typeof value !== "string") {
+    throw new Error(`storage-broker: ${name} declares a non-string ${KEY}`);
+  }
+  return value;
+}
+
+/** True when `child` is not `root` or a descendant of it. */
+function escapes(root: string, child: string): boolean {
+  const rel = relative(root, child);
+  return rel.startsWith("..") || isAbsolute(rel);
+}
+
+function outsideError(name: string, declared: string, resolved: string, root: string): Error {
+  return new Error(
+    `storage-broker: ${name} declares ${KEY}="${declared}", which resolves to ${resolved}, outside the site root ${root}`,
+  );
+}
+
+/** Resolves the directory whose contents become the served root for `dir`.
+ *
+ *  A tree that declares nothing keeps the site root, which is what every deploy
+ *  did before Task 1917. A tree that declares an output dir gets that dir. A
+ *  tree that declares one which cannot be resolved is an error naming the path:
+ *  falling back to the site root here is exactly the defect this closes, because
+ *  the deploy then succeeds while serving the wrong root. */
+export async function resolveUploadDir(dir: string): Promise<UploadDirResolution> {
+  for (const name of WRANGLER_CONFIG_NAMES) {
+    let text: string;
+    try {
+      text = await readFile(join(dir, name), "utf8");
+    } catch {
+      continue; // absent, or not readable as a file: the next name is wrangler's next choice
+    }
+    const declared =
+      name === "wrangler.toml"
+        ? readTomlKey(text)
+        : readJsonKey(text, name, name === "wrangler.jsonc");
+    // A config that declares nothing leaves the site root as the asset root,
+    // which is wrangler's own behaviour for a Pages project with no output dir.
+    if (declared === undefined) return { uploadDir: dir, source: "site-root" };
+    const uploadDir = resolve(dir, declared);
+    // Confinement, lexically first. A declared value is file content, and
+    // resolving file content into a publish path through the route that holds
+    // the account-wide Cloudflare credential is the moment it has to be
+    // bounded. This pass costs no filesystem call and rejects the plain
+    // `"../.."` before anything is touched.
+    if (escapes(dir, uploadDir)) throw outsideError(name, declared, uploadDir, dir);
+    // lstat, not stat: the link itself is what matters here, and stat would
+    // report a link to a directory as a directory.
+    let info;
+    try {
+      info = await lstat(uploadDir);
+    } catch {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} does not exist`,
+      );
+    }
+    // A link is refused wherever it points. The staging copy takes the upload
+    // directory as its source and does not dereference, so a link source fails
+    // the copy outright; and a target that can change between this check and
+    // that copy is not something to publish from a route holding the
+    // account-wide credential.
+    if (info.isSymbolicLink()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is a symbolic link; the published root must be a real directory`,
+      );
+    }
+    if (!info.isDirectory()) {
+      throw new Error(
+        `storage-broker: ${name} declares ${KEY}="${declared}" but ${uploadDir} is not a directory`,
+      );
+    }
+    // Confinement again, on the real paths. The lexical pass above is blind to
+    // symlinks in the declared value's own parent segments: a declared "a/b"
+    // whose `a` links out of the tree stays inside by string comparison while
+    // resolving anywhere on disk, and the deploy would then publish whatever it
+    // resolves to. Both sides are resolved because the site root itself commonly
+    // arrives through a symlinked prefix (macOS /var, a linked account
+    // directory), which would otherwise read as an escape on its own.
+    const realDir = await realpath(dir);
+    const realUpload = await realpath(uploadDir);
+    if (escapes(realDir, realUpload)) throw outsideError(name, declared, realUpload, realDir);
+    return { uploadDir, source: name, declared };
+  }
+  return { uploadDir: dir, source: "site-root" };
+}

package/payload/platform/plugins/admin/PLUGIN.md

@@ -188,6 +188,7 @@ Tools are available via the `admin` MCP server.
 ## Hooks
 
 - `hooks/quote-render-gate.sh` — **PreToolUse matcher=`mcp__plugin_browser_browser__browser-pdf-save`.** Makes the deterministic quote-render path the only route a client-facing quote PDF can reach a customer. Blocks (exit 2) a `browser-pdf-save` whose output path is a client-quote artefact (`memory/users/<phone>/documents/quote-<jobId>.pdf` or `…-breakdown.pdf`) when no render receipt exists at `quoting/jobs/<jobId>/render-receipt.json` — the receipt `quote-render` writes only after its reconcile / margin-leak / link-liveness gates all pass. A hand-authored quote (the SiteDesk 2026-07-14 bypass: `Write` HTML → `browser-pdf-save`, `quote-render` never called, an internal back-test caveat naming another client folded into the free-text region) has no receipt, so the print is refused rather than delivered. **Block message:** `Blocked: this client quote was not produced by the quote-render tool, so its fixed layout and the reconcile, margin-leak and link-liveness gates never ran. Run quote-render for this job (it files the document and its receipt), then print the client HTML path it returns to PDF.` **Log line** (stderr, on a block): `[quote-render] op=bypass jobId=<jobId> detail=client quote PDF has no render receipt` (or `reason=bad-jobid` when the filename does not resolve to a job). Every non-quote PDF — brochures, invoices, the admin-scope internal view — and the deterministic path itself (receipt present) pass at exit 0. **Fail-open** on an uninspectable call (tty / empty stdin / no `python3`): `browser-pdf-save` is a general-purpose tool and the agent never controls this hook's stdin, so failing open opens no bypass while never bricking unrelated PDFs.
+- `hooks/quote-render-pdf-conformance.sh` — **PostToolUse matcher=`mcp__plugin_browser_browser__browser-pdf-save`.** The PDF-time companion to the PreToolUse `quote-render-gate`: the HTML gates run inside `quote-render` before the receipt, but the two PDF-only conformance checks cannot, because the PDF does not exist until `browser-pdf-save` runs. For a gated client-quote PDF (`memory/users/<phone>/documents/quote-<jobId>.pdf` or `…-breakdown.pdf`) whose render receipt names the source HTML, it blocks (exit 2) when the printed PDF's `/URI` annotation count is below the source HTML's absolute-link count (a rasterised or flattened print that dropped links) or when an embedded `https://` link does not answer 200 (a Sign-Online link a pending redeploy would 404). The offline `/URI`-count check runs first and short-circuits, so a link-loss regression never depends on the network. **Block message:** `Blocked: the printed quote PDF is missing links the document declared, or an embedded link is not live (…). Do not send it. If a Sign-Online link is not live yet, deploy the signing page first; then re-render and re-print so the PDF carries every link the document declares.` **Log line** (stderr, on a block): `[quote-render] op=bypass jobId=<jobId> reason=pdf-link-conformance detail=<uri-count …|link <url> -> <code>>`. Every non-quote PDF, and any call with no receipt (the PreToolUse gate owns that block), passes at exit 0. **Fail-open** on an uninspectable call (tty / empty stdin / no `python3` / receipt or PDF absent). **Reach on upgrade:** `provision-account-dir.sh` writes this PostToolUse matcher only at account-provision time, so accounts provisioned before it landed keep a stale matcher and need a settings backfill (tracked as a follow-up task), the same reach limit the AskUserQuestion carrier gate hit.
 - `hooks/webfetch-preflight.mjs` — short-circuits WebFetch on JS-SPA shells with a structured `WEBFETCH_CANNOT_READ_JS_SPA` error so the agent surfaces a loud failure to the owner instead of paying the 60s extraction timeout. Fail-open on any internal error.
 - `hooks/askuserquestion-investigate-gate.sh` — PreToolUse matcher=`AskUserQuestion`. Blocks the question (exit 2) when no read-only investigation tool has fired since the latest real user turn in the session JSONL. The structural fix for the failure class where the agent fabricates a menu before evidence-gathering (session `c085ec2c-46fb-4b73-8865-68cf85866ea8` 2026-05-22 — "change remote access password" → invented options "Admin PIN / Cloudflare tunnel / WiFi password" with zero prior tool_use; post-correction the agent immediately fired `remote-auth-status` → `ToolSearch` → `remote-auth-set-password`, proving it knew the moves). **Allowlist** (exact, with trailing `__<tool>` suffix-match for namespaced `mcp__plugin_<plugin>_<server>__<tool>` aliases): `ToolSearch`, `Grep`, `Glob`, `Read`, `LS`, `NotebookRead`, `Bash`, `WebFetch`, `WebSearch`, plus the read-only admin / memory MCP tools (`*-status`, `*-list`, `*-read`, `skill-find`, `memory-find-candidates`, `profile-read`, `conversation-list`, `memory-list-attachments`, `memory-read-attachment`). **Block message:** `Blocked: AskUserQuestion requires at least one investigation tool (ToolSearch, Grep, Read, *-list, *-status, *-read, skill-find, ...) earlier in this turn. Search the operator's literal phrase first.` **Log line** (stderr, one per call): `[ask-gate] decision=<allow|block> sessionId=<id8> seen=<csv|-> reason=<allowlist-hit|no-investigation|fail-open-no-transcript|fail-open-parse-error>`. **Fail-open** on missing transcript or parse error — nudges, never bricks the UI.
 - `hooks/askuserquestion-channel-carrier-gate.sh` — PreToolUse matcher=`AskUserQuestion`, registered as a **second command on the same matcher** as the investigate-gate (either exit 2 blocks; the two guard different conditions). Blocks the question (exit 2) when the session has a native channel attached, because the Claude Code channel protocol carries only the two permission methods — there is no carrier for the `AskUserQuestion` elicitation, so on an rc-spawn channel (webchat/WhatsApp/Telegram) session the harness would block the turn awaiting a selection that can never arrive and the reader renders only delivered replies, wedging the turn (live SiteDesk incident session `1a085718` 2026-07-11: `/chat` stalled on the delivered "On it…" ack with no card). **Signal:** the rc-spawn writes the channel MCP registration as a config file in `os.tmpdir()` keyed by session id (`maxy-channel-<sid>.json` / `maxy-webchat-channel-<sid>.json` / `maxy-wa-channel-<sid>.json` / `maxy-telegram-channel-<sid>.json`, `sid` sanitized `[^A-Za-z0-9_-]→_` exactly as the writers do); its presence at tool-call time is the authoritative "channel attached to this session" marker. The hook resolves the tmpdir the way Node's `os.tmpdir()` does (`${TMPDIR:-/tmp}`, trailing slash stripped). Correct in both readings of the claude.ai/code scoping question: a Pi channel process sees the tmpfile (block); a claude.ai/code process on another host never sees the Pi tmpfile (fail-open → allow, that surface can answer the card). **Block message:** `Blocked: this is a native-channel session and AskUserQuestion cannot be delivered over a channel (the channel protocol carries no elicitation card, so the turn would wedge). Ask the same question as prose in your channel reply tool and wait for the operator's next message.` **Log line** (stderr, one per decisive call): `[ask-channel] decision=<allow|block> sessionId=<id8> channel=<attached|none> reason=<channel-attached|no-channel|fail-open-no-envelope|fail-open-no-session>`. **Fail-open** on no envelope, blank session id, or absent channel file — nudges, never bricks the UI. The complementary standing check (`interactive-wedge` in the session manager) catches any un-carried interactive tool_use that slips past this hook; it scans every account's project-slug (not just the boot slug), so a client sub-account channel wedge is covered too. **Reach on upgrade:** `provision-account-dir.sh` writes this matcher only at account-provision time, and the upgrade path re-provisions only the house account — so an account provisioned before this gate landed keeps a stale matcher and re-wedges (live SiteDesk recurrence session `d39a22b0`, account `2078cb54`, 2026-07-15). `setup-account.sh` runs `reconcile_all_accounts_askgate` (`platform/scripts/lib/account-settings-askgate.sh`) on every install to retrofit the carrier gate onto every existing account's `settings.json` — idempotent surgical jq patch of the `AskUserQuestion` matcher, one `[backfill-1683] file=<f> status=<absent|no-hooks|already-set|updated|rewrite-failed>` line per account, contents never echoed.

package/payload/platform/plugins/admin/hooks/__tests__/quote-render-pdf-conformance.test.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# Regression test for quote-render-pdf-conformance.sh.
+#
+# PostToolUse hook on browser-pdf-save. For a gated client-quote PDF whose render
+# receipt names the source HTML, it blocks when the PDF dropped links (its /URI
+# count is below the HTML's absolute-link count) or when an embedded https link
+# is not live. Everything else passes; it fails open on anything uninspectable.
+#
+# Covers (all offline-deterministic — the one network case points at a closed
+# local port so the connection refusal is immediate and reproducible):
+#   A. non-quote PDF                                  → ALLOWED (not gated)
+#   B. quote PDF, no receipt                          → ALLOWED (PreToolUse owns that block)
+#   C. quote PDF, HTML has no absolute links          → ALLOWED (0 >= 0, no fetch)
+#   D. quote PDF, PDF /URI < HTML links               → BLOCKED (link-loss, no fetch)
+#   E. quote PDF, /URI ok but an https link is dead   → BLOCKED (link not live)
+#   F. quote PDF, /URI ok and the only link is 200    → not asserted (needs a live server)
+#   G. empty stdin                                    → ALLOWED (fail-open)
+#   H. non-browser tool                               → ALLOWED (matcher defence-in-depth)
+#   I. a block emits the op=bypass fault line
+
+set -u
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/quote-render-pdf-conformance.sh"
+if [[ ! -x "$HOOK" ]]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+
+ACCT=$(mktemp -d)
+cleanup() { rm -rf "$ACCT"; }
+trap cleanup EXIT
+
+DOCS="$ACCT/memory/users/44700900000/documents"
+mkdir -p "$DOCS"
+
+# Receipt + filed HTML for each scenario job. The receipt names the filed quote
+# HTML; the hook reads its absolute links and compares to the PDF's /URI count.
+mk_job() { # jobId, html_body, pdf_uri_repeat
+  local job="$1" body="$2" uris="$3"
+  mkdir -p "$ACCT/quoting/jobs/$job"
+  local html="$DOCS/quote-$job.html"
+  printf '%s' "$body" > "$html"
+  printf '{"jobId":"%s","filed":{"internal":"x","breakdown":"x","quote":"%s"}}' "$job" "$html" \
+    > "$ACCT/quoting/jobs/$job/render-receipt.json"
+  # A minimal PDF-ish file carrying `uris` copies of the /URI token.
+  { printf '%%PDF-1.4\n'; local i=0; while [[ $i -lt $uris ]]; do printf '/URI (x)\n'; i=$((i+1)); done; } \
+    > "$DOCS/quote-$job.pdf"
+}
+
+# C: no absolute links, PDF has none → allow.
+mk_job "clean" '<html><body><a href="#top">top</a><p>no links</p></body></html>' 0
+# D: two https links, PDF dropped them (0 /URI) → block on count.
+mk_job "dropped" '<html><body><a href="https://a.example/1">a</a><a href="https://b.example/2">b</a></body></html>' 0
+# E: one https link, PDF kept a /URI, but the link points at a closed local port → block on liveness.
+mk_job "dead" '<html><body><a href="https://127.0.0.1:1/never">sign</a></body></html>' 1
+
+PASS=0
+FAIL=0
+
+run_case() {
+  local name="$1" stdin="$2" expected_exit="$3" actual_exit
+  ( cd "$ACCT" && printf '%s' "$stdin" | bash "$HOOK" >/dev/null 2>/dev/null )
+  actual_exit=$?
+  if [[ "$actual_exit" -eq "$expected_exit" ]]; then
+    echo "PASS: $name (exit=$actual_exit)"; PASS=$((PASS + 1))
+  else
+    echo "FAIL: $name (expected exit=$expected_exit, got=$actual_exit)" >&2; FAIL=$((FAIL + 1))
+  fi
+}
+
+envelope() { printf '{"hook_event_name":"PostToolUse","tool_name":"%s","tool_input":{"path":"%s"}}' "$1" "$2"; }
+BROWSER="mcp__plugin_browser_browser__browser-pdf-save"
+
+run_case "A: non-quote PDF → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/brochure.pdf")" 0
+run_case "B: quote PDF, no receipt → ALLOWED (PreToolUse owns it)" \
+  "$(envelope "$BROWSER" "$DOCS/quote-nojob.pdf")" 0
+run_case "C: HTML has no absolute links → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/quote-clean.pdf")" 0
+run_case "D: PDF /URI below HTML link count → BLOCKED" \
+  "$(envelope "$BROWSER" "$DOCS/quote-dropped.pdf")" 2
+run_case "E: an embedded https link is not live → BLOCKED" \
+  "$(envelope "$BROWSER" "$DOCS/quote-dead.pdf")" 2
+run_case "G: empty stdin → ALLOWED (fail-open)" \
+  "" 0
+run_case "H: non-browser tool → ALLOWED" \
+  '{"hook_event_name":"PostToolUse","tool_name":"Write","tool_input":{"path":"'"$DOCS"'/quote-dropped.pdf"}}' 0
+
+# I: a block emits the op=bypass fault line on stderr.
+STDERR=$( cd "$ACCT" && printf '%s' "$(envelope "$BROWSER" "$DOCS/quote-dropped.pdf")" | bash "$HOOK" 2>&1 >/dev/null )
+if printf '%s' "$STDERR" | grep -q '\[quote-render\] op=bypass jobId=dropped reason=pdf-link-conformance'; then
+  echo "PASS: I: block emits op=bypass jobId=dropped"; PASS=$((PASS + 1))
+else
+  echo "FAIL: I: op=bypass line absent (got: $STDERR)" >&2; FAIL=$((FAIL + 1))
+fi
+
+echo "──────── quote-render-pdf-conformance test summary ────────"
+echo "PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/quote-render-pdf-conformance.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# quote-render-pdf-conformance — PostToolUse gate on browser-pdf-save.
+#
+# The companion to the PreToolUse quote-render-gate: that gate checks the
+# rendered HTML on the deterministic path (via the render receipt) before the
+# PDF is printed; the HTML the tool gated cannot yet be a PDF at PreToolUse, so
+# the two PDF-only conformance checks run here, once the PDF exists.
+#
+# For a gated client-quote PDF (memory/users/<phone>/documents/quote-<jobId>.pdf
+# or ...-breakdown.pdf) whose render receipt names the source HTML, it asserts:
+#   1. the PDF's /URI annotation count >= the source HTML's absolute-link count
+#      (a print that dropped links — a rasterised or flattened copy — carries
+#      fewer /URI than the HTML had anchors);
+#   2. every embedded https:// anchor in the source HTML answers 200 (a pending
+#      redeploy that would 404 the Sign-Online link is caught before the PDF is
+#      sent).
+# The /URI-count check is offline and runs first; the network fetch runs only
+# when the count check passes, so a link-loss regression never depends on the
+# network being up.
+#
+# Exit codes: 0 = allow, 2 = block (stderr shown to the agent). Fail OPEN on any
+# uninspectable call (tty / empty stdin / no python3 / no receipt / PDF not
+# written): the no-receipt case is already the PreToolUse gate's to block, and
+# browser-pdf-save is general-purpose, so failing open here bricks no unrelated
+# PDF. No task numbers or internal refs in any operator-visible string.
+
+set -uo pipefail
+
+if [ -t 0 ]; then exit 0; fi
+INPUT=$(cat)
+[ -z "$INPUT" ] && exit 0
+
+RESULT=$(INPUT="$INPUT" BASE="$PWD" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys, urllib.request
+
+try:
+    d = json.loads(os.environ["INPUT"])
+except Exception:
+    sys.exit(0)  # uninspectable envelope -> fail open
+
+tool = d.get("tool_name", "") or ""
+if not tool.endswith("browser-pdf-save"):
+    sys.exit(0)
+path = (d.get("tool_input", {}) or {}).get("path", "") or ""
+if not path:
+    sys.exit(0)
+norm = os.path.normpath(path)
+m = re.search(r'(?:^|/)memory/users/[^/]+/documents/quote-(.+?)(-breakdown)?\.pdf$', norm)
+if not m:
+    sys.exit(0)  # not a gated client-quote artefact
+jobid = m.group(1)
+if "/" in jobid or ".." in jobid:
+    sys.exit(0)  # the PreToolUse gate owns bad-jobid; here fail open
+variant = m.group(2)  # "-breakdown" or None
+
+base = os.environ["BASE"]
+receipt_path = os.path.join(base, "quoting", "jobs", jobid, "render-receipt.json")
+try:
+    receipt = json.load(open(receipt_path))
+except Exception:
+    sys.exit(0)  # no receipt -> PreToolUse gate already blocks; fail open
+
+filed = receipt.get("filed", {}) or {}
+html_path = filed.get("breakdown" if variant else "quote", "")
+if not html_path or not os.path.isfile(html_path) or not os.path.isfile(path):
+    sys.exit(0)  # nothing to compare against -> fail open
+
+html = open(html_path, encoding="utf-8", errors="replace").read()
+# Anchors that become a /URI annotation in the printed PDF: absolute http(s) or
+# mailto hrefs. Fragment and relative anchors do not, so they are not counted.
+uri_anchors = re.findall(r'href="((?:https?|mailto):[^"]*)"', html, re.I)
+https_anchors = [u for u in uri_anchors if u.lower().startswith("https:")]
+
+# /URI occurrences in the printed PDF. This is the same primitive the e-sign
+# stamp gate uses (grep -a -c '/URI'); on real browser-pdf-save output it was
+# measured to carry one greppable /URI per surviving link (base PDFs counted 4
+# to 6, one per anchor), so the count is a faithful per-link tally, not stream-
+# compressed away. A rasterised or flattened reprint drops to a lower count.
+uri_count = open(path, "rb").read().count(b"/URI")
+if uri_count < len(uri_anchors):
+    print("BLOCK|%s|uri-count pdf=%d html_links=%d" % (jobid, uri_count, len(uri_anchors)))
+    sys.exit(0)
+
+for u in https_anchors:
+    try:
+        with urllib.request.urlopen(u, timeout=6) as r:
+            code = r.status
+    except Exception as e:
+        code = getattr(e, "code", 0) or 0
+    if code != 200:
+        print("BLOCK|%s|link %s -> %s" % (jobid, u, code))
+        sys.exit(0)
+
+sys.exit(0)
+PY
+)
+
+case "$RESULT" in
+  BLOCK\|*)
+    rest=${RESULT#BLOCK|}
+    jobid=${rest%%|*}
+    detail=${rest#*|}
+    echo "[quote-render] op=bypass jobId=$jobid reason=pdf-link-conformance detail=$detail" >&2
+    echo "Blocked: the printed quote PDF is missing links the document declared, or an embedded link is not live ($detail). Do not send it. If a Sign-Online link is not live yet, deploy the signing page first; then re-render and re-print so the PDF carries every link the document declares." >&2
+    exit 2
+    ;;
+esac
+exit 0

package/payload/platform/plugins/admin/skills/agent-builder/references/agent-pattern.md

@@ -110,12 +110,24 @@ Two further clauses bind the Output contract itself. **Recency**, universal: a t
 claim carries the date it was observed, and a date the agent cannot see is one it flags, never
 one it infers. **Corroboration**, for agents whose deliverable is a pattern, a theme, a trend, a
 signal: the agent names the independent sources behind it and does not report one as established
-on a single occurrence. Corroboration is authoring guidance enforced by review, not by the gate,
-because the subset it applies to cannot be detected statically.
-
-`agent-grounding-drift.test.ts` fails if any shipped prompt carries either sentence anything
-other than exactly once, and fails if the number of prompts it inspected is not the number it
-expects. A new agent that skips them does not ship.
+on a single occurrence.
+
+Corroboration binds only that subset, and the subset cannot be read out of a prompt's text, so
+every prompt declares it. The flat specialists carry `pattern_deliverable: true` or
+`pattern_deliverable: false` as a frontmatter key; the role `IDENTITY.md` files, which have no
+frontmatter and are injected raw, carry the same marker as a trailing HTML comment
+`<!-- pattern_deliverable: true -->`. Absent is a gate failure, not a default. A prompt declaring
+true carries this sentence, character for character, as a third paragraph of its `## Grounding`
+section; a prompt declaring false does not carry it at all:
+
+> Where what you report is a pattern, a theme, a trend, or a signal, name the independent occurrences behind it; one occurrence is a single observation you report as such, never a pattern you assert.
+
+`agent-grounding-drift.test.ts` fails if any shipped prompt carries the provenance or
+person-attribute sentence anything other than exactly once, if a prompt does not declare
+`pattern_deliverable` exactly once, if a true-declaring prompt carries the corroboration sentence
+anything other than exactly once, if a false-declaring prompt carries it at all, and if the
+number of prompts it inspected is not the number it expects. The marker and the sentence cannot
+drift apart, and a new agent that skips any of the three does not ship.
 
 ## Skills owned
 

package/payload/platform/plugins/business-assistant/skills/e-sign/SKILL.md

@@ -92,6 +92,8 @@ Per-signer stamped copies (§ 6) are written alongside, in the same `<DOC_REF>`
 
 The § 1 default — an unguessable hex slug plus `noindex` — keeps a low-sensitivity document private by obscurity. For a **confidential** proposal to a **named** recipient, add a **Cloudflare Access** gate in front of the page so only allowlisted emails can load it at all. Gating is **additive**: the slug and `noindex` stay; the gate sits in front of them. It is never the default and never replaces them.
 
+> **Client account:** Access gating is the house's to apply. The broker offers no Access tool, and `cf-token.sh access` denies a client account that scope with the same `reason=not-house` it denies `pages`, so mint nothing here and run none of the calls below. Instead **request the gate**, handing the house three things: the **Pages project** carrying the document, the **document path or paths** to gate, and the **signer emails** (plus the business owner's) for the policy `include`. Say in the same request that **`/api/*` on that project is gated alongside those paths**, because gating the document path alone leaves `POST /api/accept` forgeable and `GET /api/status` world-readable, the bypass this section describes below. Never ask the client or the signer for a Cloudflare token (the callout that precedes § 0). Everything that follows (the One-Time PIN pre-flight, the app and policy calls, the `gate-probe`, and the neutral root portal) stays as written and is the house's to run.
+
 **One-Time PIN is the only correct identity provider here — and why.** The signer is an external party who belongs to **no** Cloudflare organization, so SSO, Google, GitHub, SAML and every other org-membership IdP cannot authenticate them. Cloudflare's built-in **One-Time PIN** emails a login code to **any allowlisted address** with no org membership required — exactly the external-signer case. Prescribe `onetimepin`; do not reach for another IdP type for an external signer (a higher-assurance provider is a separate capability, not this skill).
 
 **Load-bearing pre-flight — a gate requires an enabled login method.** Creating an Access application and policy does **not** enable a login method. If the org has **zero** identity providers when the gate goes live, the login page offers **nothing** and locks out *everyone, including the operator*. Before activating any Access app, list the org's IdPs and confirm the list is non-empty:
@@ -475,7 +477,15 @@ Dispatch runs **only** inside a live operator session on the account's own devic
 
 2. **For each unswept row, in order — stamp, send, then mark that one row swept:**
 
-   - **Stamp a per-signer copy from the persisted base — no browser, no network.** Dispatch must **never fetch the deployed page**: it may sit behind **Cloudflare Access**, so a headless fetch hits the Access login screen, not the document, and the PDF is garbage. The render-once base (§ 5) is what removes that dependency. Load `${ACCOUNT_DIR}/e-sign/<DOC_REF>/base.pdf`, append an **Electronic Acceptance Certificate** page, and write a per-signer copy alongside it — all with a pure PDF library (**`pdf-lib`**, run as a small Node script; pick another pure library if the account standardises on one, but it must add no browser and no network call):
+   - **Stamp a per-signer copy from the persisted base — no browser, no network.** Dispatch must **never fetch the deployed page**: it may sit behind **Cloudflare Access**, so a headless fetch hits the Access login screen, not the document, and the PDF is garbage. The render-once base (§ 5) is what removes that dependency. Load `${ACCOUNT_DIR}/e-sign/<DOC_REF>/base.pdf`, append an **Electronic Acceptance Certificate** page, and write a per-signer copy alongside it, all with a PDF library that loads the base and copies its pages through intact (**`pdf-lib`**, run as a small Node script). The stamp copies existing pages; it never renders them to an image. Rasterising the base (ghostscript to PNG, or any image-then-redraw rebuild) discards every link annotation and all selectable text, so the signer receives a flattened copy with dead links; it is prohibited whatever is or is not installed. A substitute for pdf-lib is allowed only if it imports existing PDF pages: pypdf, qpdf, or pdftk. A canvas-only generator such as reportlab cannot import a base and is not a substitute. Whatever the library, it adds no browser and no network call.
+
+     **Pre-flight: the page-copying library must resolve before any stamp runs.** A stamp attempted without it is the exact history this guards against, where a prior session met the missing library by rasterising instead of installing one:
+
+     ```bash
+     node -e 'import("pdf-lib").then(()=>console.log("ok"),e=>{console.error("pdf-lib missing: npm i pdf-lib at the account directory root");process.exit(1)})'
+     ```
+
+     On failure the one remediation is that install; a fallback that renders pages to images is never one. The stamp script itself:
 
      ```js
      // stamp.mjs — node, offline. Reads the persisted base, appends a certificate page,
@@ -507,6 +517,8 @@ Dispatch runs **only** inside a live operator session on the account's own devic
 
      The certificate fields come **from the D1 row**, not a re-fetch: `name`, `title` (an operator-defined field if present), `token`, `doc_ref`, `accepted_at`, the signing `method`, and the **verbatim intent/consent assertion** the signer ticked (§ 2). That makes the artifact self-contained evidence of who accepted, when, and on what stated basis.
 
+     **Post-stamp gate: prove fidelity before any send.** For both `base.pdf` and the stamped copy, count link annotations with `grep -a -c '/URI'` and measure page-1 text extent with ghostscript text extraction (`gs -q -dNOPAUSE -dBATCH -sDEVICE=txtwrite -dFirstPage=1 -dLastPage=1 -o - <file> | wc -c`). The stamped copy passes only when its `/URI` count and its page-1 text extent are each at least the base's. On either regression the stamp rasterised or otherwise flattened the base, so delete the stamped copy, skip both sends, and leave the row `swept = 0` so the next sweep re-surfaces it. This gate converts a link-stripped copy from a no-event failure (nothing logs until a signer clicks a dead link) into a rejection at stamp time. Record the base and stamped `/URI` counts alongside every dispatch, pass or fail, so a fidelity regression is a number rather than a complaint.
+
    - **Send twice via `email-send`**, each carrying `doc_ref`, `name`, `token`, `accepted_at`, and the **stamped** PDF (`signed-<token>.pdf`) as an attachment:
      - once to the **business owner's configured address** (read from configured business identity — never hard-code a recipient in this workflow);
      - once to the **signer's captured `email`** — this copy is the **statutory record provided to the signer**, the evidentiary copy the legal basis (intro) relies on.

package/payload/platform/plugins/cloudflare/bin/__tests__/portal-brand-css.test.sh

@@ -18,7 +18,7 @@ set -u
 
 BIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 SCRIPT="$BIN_DIR/portal-brand-css.mjs"
-TEMPLATE="$BIN_DIR/../skills/data-portal/template/public/portal.css"
+TEMPLATE="$BIN_DIR/../skills/data-portal/template/portal.css"
 [ -f "$SCRIPT" ] || { echo "FAIL: $SCRIPT not found" >&2; exit 1; }
 [ -f "$TEMPLATE" ] || { echo "FAIL: $TEMPLATE not found" >&2; exit 1; }
 # Case 2 strips the :root block with perl and diffs what is left. Without perl

package/payload/platform/plugins/cloudflare/bin/portal-index-push.mjs

@@ -198,6 +198,28 @@ export async function pushAccount(opts) {
   const current = Number(state[0]?.currentGeneration ?? 0)
   const next = current + 1
 
+  // Crash safety (Task 1923). A stage that died mid-batch — a D1 500 on one
+  // INSERT — leaves rows at `next` while the pointer stays at `current`. Every
+  // later run recomputes the same `next`, and its first colliding INSERT then
+  // hits UNIQUE(accountId, relPath, generation), so the index freezes at the
+  // stale generation until an operator hand-clears the orphans. Clearing `next`
+  // before staging lets a partial stage self-heal on the next cycle. Guarded on
+  // a non-zero count so the DELETE never precedes the flip on a clean cycle and
+  // the log line always means a recovered wedge. The count comes from a SELECT
+  // because the D1 client returns rows, not the affected-row meta.
+  const orphan = await client.query(
+    'SELECT COUNT(*) AS n FROM directory WHERE accountId = ? AND generation = ?',
+    [accountId, next],
+  )
+  const orphanCount = Number(orphan[0]?.n ?? 0)
+  if (orphanCount > 0) {
+    await client.query('DELETE FROM directory WHERE accountId = ? AND generation = ?', [
+      accountId,
+      next,
+    ])
+    log(`${TAG} op=stage-clear account=${accountId} generation=${next} cleared=${orphanCount}`)
+  }
+
   for (const row of rows) {
     await client.query(
       'INSERT INTO directory (accountId, relPath, sizeBytes, modifiedAt, indexedAt, isDir, generation) ' +