@rubytech/create-maxy-code 0.1.567 → 0.1.569

package/payload/platform/plugins/admin/hooks/quote-render-gate.sh

@@ -1,18 +1,30 @@
 #!/usr/bin/env bash
 # quote-render-gate — PreToolUse gate on browser-pdf-save.
 #
-# A customer only ever receives the two client-facing quote documents from the
-# customer documents scope (memory/users/<phone>/documents/). This gate refuses
-# to print one to PDF unless the deterministic quote-render tool actually
-# produced it — proven by the render receipt quote-render writes on success
-# (quoting/jobs/<jobId>/render-receipt.json). No receipt for the job means the
-# quote was hand-authored off the deterministic path, so the fixed-layout
-# guarantee and the reconcile/margin/link gates never ran; the PDF is refused and
-# the bypass is surfaced as [quote-render] op=bypass, not delivered.
+# A client-facing quote reaches a customer only when the deterministic
+# quote-render tool produced that exact document. The tool writes a render
+# receipt on success (quoting/jobs/<jobId>/render-receipt.json) naming the
+# documents it filed; this gate resolves the PDF's source HTML and requires its
+# content to match one of the client-facing documents that receipt names.
 #
-# Scope: only a .pdf under memory/users/<phone>/documents/ named
-# quote-<jobId>.pdf or quote-<jobId>-breakdown.pdf is gated. Every other PDF —
-# brochures, invoices, the admin-scope internal view — passes untouched.
+# Scope — three shapes, all resolved against the account dir:
+#   memory/users/<phone>/documents/quote-<jobId>[-breakdown].pdf
+#   jobs/<jobId>/quote/<anything>.pdf
+#   jobs/<jobId>/Quotations/<anything>.pdf
+# jobs/<jobId>/pricing/ is deliberately absent: it holds the internal priced
+# breakdown, always excluded with the admin-scope internal view. Every other PDF
+# — brochures, works orders, invoices — passes untouched.
+#
+# Why identity rather than existence. A receipt proves a render happened for the
+# job, not that this file is its output. On the 2026-08-05 bypass the job's
+# figures were rewritten after the render and the delivered document was written
+# later still, so an existence check would have authorised the print. Comparing
+# content, not paths, keeps an operator copy of a rendered document passing while
+# hand-authored content fails. filed.internal is not client-facing and is never a
+# permitted match.
+#
+# A missing source HTML blocks: the pipeline files the PDF beside the HTML it
+# printed from, so no local source means no proof of renderer origin.
 #
 # Exit codes: 0 = allow, 2 = block (stderr shown to the agent). Fail OPEN on an
 # uninspectable call (browser-pdf-save is a general-purpose tool; the bypass we
@@ -27,48 +39,104 @@ if [ -t 0 ]; then exit 0; fi
 INPUT=$(cat)
 [ -z "$INPUT" ] && exit 0
 
-# Print the jobId of a gated client-quote artefact, or nothing for any other
-# call. The customer documents scope is a path convention, so match on it
-# structurally rather than resolving symlinks.
-JOBID=$(INPUT="$INPUT" python3 - <<'PY' 2>/dev/null || true
-import os, json, re, sys
+# Prints nothing for an out-of-scope call, "allow" for a reconciling document,
+# or "block <reason> <jobId>".
+DECISION=$(INPUT="$INPUT" ACCT="$PWD" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys, hashlib
+
 try:
     d = json.loads(os.environ["INPUT"])
 except Exception:
     sys.exit(0)
-tool = d.get("tool_name", "") or ""
-if not tool.endswith("browser-pdf-save"):
+if not (d.get("tool_name", "") or "").endswith("browser-pdf-save"):
     sys.exit(0)
 path = (d.get("tool_input", {}) or {}).get("path", "") or ""
 if not path:
     sys.exit(0)
 norm = os.path.normpath(path)
+
+# The customer documents scope and the jobs bucket are path conventions, so
+# match on them structurally rather than resolving symlinks.
+jobid = None
 m = re.search(r'(?:^|/)memory/users/[^/]+/documents/quote-(.+?)(?:-breakdown)?\.pdf$', norm)
-if not m:
+if m:
+    jobid = m.group(1)
+else:
+    # `.+` rather than `[^/]+`: the bucket is matched recursively, so one mkdir
+    # cannot walk a hand-authored quote out of scope. The write gate and the
+    # Bash gate match the same buckets recursively; all three must agree.
+    m = re.search(r'(?:^|/)jobs/([^/]+)/(?:quote|Quotations)/.+\.pdf$', norm)
+    if m:
+        jobid = m.group(1)
+if jobid is None:
+    sys.exit(0)
+
+# A jobId is a single path segment. A separator or traversal in it never keys a
+# legitimate receipt, so treat it as a bypass rather than resolving a stray file.
+if "/" in jobid or ".." in jobid:
+    print("block bad-jobid " + jobid)
     sys.exit(0)
-print(m.group(1))
+
+base = os.environ.get("ACCT") or os.getcwd()
+abs_pdf = norm if os.path.isabs(norm) else os.path.join(base, norm)
+sibling = abs_pdf[:-4] + ".html"
+if not os.path.isfile(sibling):
+    print("block no-source-html " + jobid)
+    sys.exit(0)
+
+
+def sha256(p):
+    h = hashlib.sha256()
+    with open(p, "rb") as fh:
+        for chunk in iter(lambda: fh.read(1 << 16), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+try:
+    with open(os.path.join(base, "quoting", "jobs", jobid, "render-receipt.json")) as fh:
+        filed = (json.load(fh) or {}).get("filed") or {}
+except Exception:
+    print("block not-receipt-filed " + jobid)
+    sys.exit(0)
+
+try:
+    want = sha256(sibling)
+except Exception:
+    print("block no-source-html " + jobid)
+    sys.exit(0)
+
+for key in ("quote", "breakdown"):
+    cand = filed.get(key)
+    if not isinstance(cand, str) or not cand:
+        continue
+    cpath = cand if os.path.isabs(cand) else os.path.join(base, cand)
+    try:
+        if sha256(cpath) == want:
+            print("allow")
+            sys.exit(0)
+    except Exception:
+        continue
+print("block not-receipt-filed " + jobid)
 PY
 )
 
-# Not a gated client-quote artefact → allow.
-[ -z "$JOBID" ] && exit 0
+case "$DECISION" in
+  ""|allow) exit 0 ;;
+esac
 
-# A jobId is a single path segment. A separator or traversal in it never keys a
-# legitimate receipt, so treat it as a bypass rather than resolving a stray file.
-case "$JOBID" in
-  */*|*..*)
-    echo "[quote-render] op=bypass jobId=$JOBID reason=bad-jobid" >&2
+REASON=$(printf '%s' "$DECISION" | cut -d' ' -f2)
+JOBID=$(printf '%s' "$DECISION" | cut -d' ' -f3-)
+echo "[quote-render] op=bypass jobId=$JOBID reason=$REASON" >&2
+case "$REASON" in
+  no-source-html)
+    echo "Blocked: this client quote PDF has no source document beside it, so there is nothing to check it against. Produce the quote with the quote-render tool, which files the document and its render receipt, then print the path it returns." >&2
+    ;;
+  bad-jobid)
     echo "Blocked: this looks like a client quote PDF but its name does not resolve to a job. Produce the quote with the quote-render tool, which files the document and its render receipt, then print the path it returns." >&2
-    exit 2
+    ;;
+  *)
+    echo "Blocked: this client quote was not produced by the quote-render tool, so its fixed layout and the reconcile, margin-leak and link-liveness gates never ran. Run quote-render for this job (it files the document and its receipt), then print the client HTML path it returns to PDF." >&2
     ;;
 esac
-
-# The receipt lives beside the job's figures, written by quote-render only after
-# every gate passed. Its presence is the proof the deterministic path ran.
-if [ -f "$PWD/quoting/jobs/$JOBID/render-receipt.json" ]; then
-  exit 0
-fi
-
-echo "[quote-render] op=bypass jobId=$JOBID detail=client quote PDF has no render receipt" >&2
-echo "Blocked: this client quote was not produced by the quote-render tool, so its fixed layout and the reconcile, margin-leak and link-liveness gates never ran. Run quote-render for this job (it files the document and its receipt), then print the client HTML path it returns to PDF." >&2
 exit 2

package/payload/platform/plugins/admin/hooks/quote-render-pdf-conformance.sh

@@ -30,6 +30,184 @@ if [ -t 0 ]; then exit 0; fi
 INPUT=$(cat)
 [ -z "$INPUT" ] && exit 0
 
+# --- log sink ---------------------------------------------------------------
+# A hook's stderr on exit 0 is not an observable sink: measured 2026-08-06 on the
+# laptop's sitedesk-code install, no bracketed hook line has ever reached
+# server.log (live or rotated) or the JSONL transcripts. The sibling inject hooks
+# each write their own file under the resolved log dir; the header conformance
+# line below does the same, so a clean run is distinguishable from a check that
+# never ran. The ladder mirrors mailbox-inject.sh: LOG_DIR is stamped only on the
+# rc-spawn path, CLAUDE_SESSION_MANAGER_PERSIST_DIR is on the systemd unit and
+# resolves to the same directory, ACCOUNT_DIR/logs is the last resort.
+ACCT_DIR=""
+if [ -n "${ACCOUNT_DIR:-}" ] && [ -d "${ACCOUNT_DIR}" ]; then ACCT_DIR="$ACCOUNT_DIR"; fi
+LOGD=""
+if [ -n "${LOG_DIR:-}" ] && [ -d "${LOG_DIR}" ]; then
+  LOGD="$LOG_DIR"
+elif [ -n "${CLAUDE_SESSION_MANAGER_PERSIST_DIR:-}" ] && [ -d "${CLAUDE_SESSION_MANAGER_PERSIST_DIR}/logs" ]; then
+  LOGD="$CLAUDE_SESSION_MANAGER_PERSIST_DIR/logs"
+elif [ -n "$ACCT_DIR" ] && [ -d "$ACCT_DIR/logs" ]; then
+  LOGD="$ACCT_DIR/logs"
+fi
+SID=$(printf '%s' "$INPUT" | python3 -c 'import json,sys
+try:
+    print(json.load(sys.stdin).get("session_id","") or "?")
+except Exception:
+    print("?")' 2>/dev/null)
+SID=${SID:-?}
+NOW_ISO=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "?")
+
+emit_log() {
+  local line="$NOW_ISO [quote-render] $1 session=$SID"
+  if [ -n "$LOGD" ]; then
+    # stderr redirect FIRST: with the append first, bash emits its own
+    # "Permission denied" on an unwritable log before 2>/dev/null takes effect,
+    # and that escapes to the hook's stderr on every print.
+    printf '%s\n' "$line" 2>/dev/null >> "$LOGD/quote-render-conformance.log" || true
+  fi
+  echo "$line" >&2 || true
+}
+
+# --- per-physical-page running-header conformance ---------------------------
+# Chrome decides physical pagination at print time, so a document whose header is
+# a hand-placed div next to a hand-placed page break loses that header on any page
+# the content bled onto. This stage is deliberately receipt-free and path-
+# agnostic: template-seeded documents (budget estimates, valuations, works
+# orders, survey sheets) never pass through the quote renderer and so have no
+# receipt, and they are exactly the documents that reproduce the fault.
+#
+# It only ever gates a document that DECLARES a running header in a @page top
+# margin box, so a brochure or any document without one is never blocked.
+HRESULT=$(INPUT="$INPUT" BASE="$PWD" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys, subprocess, html as htmlmod
+
+def out(s):
+    print(s)
+    sys.exit(0)
+
+try:
+    d = json.loads(os.environ["INPUT"])
+except Exception:
+    sys.exit(0)  # uninspectable envelope -> fail open
+if not (d.get("tool_name", "") or "").endswith("browser-pdf-save"):
+    sys.exit(0)
+pdf = (d.get("tool_input", {}) or {}).get("path", "") or ""
+if not pdf or not os.path.isfile(pdf):
+    sys.exit(0)  # PDF not written -> nothing to inspect
+base = os.path.basename(pdf)
+
+# Source HTML: the render receipt for a gated client quote, else the sibling
+# .html beside the PDF. The sibling is the documented browser-pdf-save
+# convention (invoicing.md step 4, document-management.md step 4: print the HTML
+# to an absolute .pdf path alongside it, same name).
+src = ""
+m = re.search(r'(?:^|/)memory/users/[^/]+/documents/quote-(.+?)(-breakdown)?\.pdf$',
+              os.path.normpath(pdf))
+if m and "/" not in m.group(1) and ".." not in m.group(1):
+    try:
+        r = json.load(open(os.path.join(os.environ["BASE"], "quoting", "jobs",
+                                        m.group(1), "render-receipt.json")))
+        src = (r.get("filed", {}) or {}).get("breakdown" if m.group(2) else "quote", "")
+    except Exception:
+        src = ""
+if not src or not os.path.isfile(src):
+    sib = os.path.splitext(pdf)[0] + ".html"
+    src = sib if os.path.isfile(sib) else ""
+if not src:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-source-html" % base)
+try:
+    doc = open(src, encoding="utf-8", errors="replace").read()
+except Exception:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-source-html" % base)
+
+# The marker is the literal string content of a @top-* box. A content:url() logo
+# box carries no text and is skipped: only extractable text can be asserted per
+# page. EVERY declaration of each box is considered, not just the first, because
+# @page :first declares the same boxes with empty content to suppress them on
+# page 1 and CSS does not fix the order of the two rules — taking the first match
+# alone would read the suppression rule as "no running header" and silently skip
+# the check on any document that declared :first before @page.
+def unesc(s):
+    s = htmlmod.unescape(s)
+    s = re.sub(r'\\([0-9a-fA-F]{1,6})\s?', lambda g: chr(int(g.group(1), 16)), s)
+    return s.replace('\\"', '"').replace("\\\\", "\\").strip()
+
+marker = ""
+for box in ("top-center", "top-right", "top-left"):
+    for mm in re.finditer(r'@' + box + r'\s*\{[^}]*?content\s*:\s*"((?:[^"\\]|\\.)*)"', doc, re.S):
+        cand = unesc(mm.group(1))
+        if len(cand) >= 4:
+            marker = cand
+            break
+    if marker:
+        break
+if not marker:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-running-header" % base)
+
+try:
+    info = subprocess.run(["pdfinfo", pdf], capture_output=True, text=True, timeout=20)
+    pages = int(re.search(r'^Pages:\s+(\d+)', info.stdout, re.M).group(1))
+except Exception:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-poppler" % base)
+
+# The marker must be found in the TOP BAND of the page, not anywhere on it. A
+# running footer routinely repeats the same reference as the header (the GLS
+# footer is "… Builders Est. 1987 · Quote <ref>"), so a whole-page text match
+# reports a header on a page that has only a footer — measured on a real
+# 10-page print, where page 1 matched on its footer alone while its header was
+# correctly suppressed by @page :first. Cropping to the top 12% of the page
+# covers a top margin as deep as 30mm on A4 and excludes the footer entirely.
+sz = re.search(r'^Page size:\s+([\d.]+) x ([\d.]+)', info.stdout, re.M)
+pw, ph = (float(sz.group(1)), float(sz.group(2))) if sz else (595.0, 842.0)
+band = max(1, int(ph * 0.12))
+crop = ["-x", "0", "-y", "0", "-W", str(int(pw) + 1), "-H", str(band)]
+
+# @page :first suppresses the margin boxes on page 1, which carries its own
+# masthead instead; without it every physical page is expected to carry one.
+first = 2 if re.search(r'@page\s*:first', doc) else 1
+if pages < first:
+    out("LOG|op=pdf-header-conformance file=%s pages=%d pagesChecked=0 reason=single-page"
+        % (base, pages))
+
+def norm(s):
+    return re.sub(r'\s+', ' ', s).strip()
+
+want = norm(marker)
+missing = []
+for p in range(first, pages + 1):
+    try:
+        t = subprocess.run(["pdftotext", "-f", str(p), "-l", str(p)] + crop + [pdf, "-"],
+                           capture_output=True, text=True, timeout=20).stdout
+    except Exception:
+        out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-poppler" % base)
+    if want not in norm(t):
+        missing.append(p)
+
+checked = pages - first + 1
+if missing:
+    print("LOG|op=pdf-header-conformance file=%s pages=%d pagesChecked=%d pagesHeaderless=%d"
+          % (base, pages, checked, len(missing)))
+    out("HBLOCK|%s|pagesHeaderless=%d pages=%s"
+        % (base, len(missing), ",".join(str(x) for x in missing)))
+out("LOG|op=pdf-header-conformance file=%s pages=%d pagesChecked=%d pagesHeaderless=0"
+    % (base, pages, checked))
+PY
+)
+
+while IFS= read -r hline; do
+  case "$hline" in
+    LOG\|*) emit_log "${hline#LOG|}" ;;
+    HBLOCK\|*)
+      hrest=${hline#HBLOCK|}
+      hfile=${hrest%%|*}
+      hdetail=${hrest#*|}
+      emit_log "op=bypass file=$hfile reason=pdf-header-conformance detail=$hdetail"
+      echo "Blocked: this printed document has physical pages carrying no running header, so it would go out with unbranded pages ($hdetail). The header must be a property of the page itself, a page margin box, not a header block placed next to a declared page break, because the browser decides the real page boundaries at print time. Fix the document's print CSS, print it again, and check every page." >&2
+      exit 2
+      ;;
+  esac
+done <<< "$HRESULT"
+
 RESULT=$(INPUT="$INPUT" BASE="$PWD" python3 - <<'PY' 2>/dev/null || true
 import os, json, re, sys, urllib.request
 

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -203,6 +203,9 @@ if (ACCOUNT_ID) {
         const roster = runRosterCensus({
             agentsMdPath: resolve(accountDir, "agents", "admin", "AGENTS.md"),
             specialistsAgentsDir: resolve(accountDir, "specialists", "agents"),
+            // Task 2460 — the one directory the CLI resolves a subagent name from,
+            // written at every spawn by syncAccountAgentRegistry.
+            registryDir: resolve(accountDir, ".claude", "agents"),
             durableDirs: [resolve(PLATFORM_ROOT, "templates", "specialists", "agents")],
             durablePluginRoots: [
                 resolve(accountDir, "plugins"),
@@ -727,7 +730,7 @@ eagerTool(server, "account-manage", "Read the account configuration (tier, domai
         };
     }
 });
-eagerTool(server, "capabilities-here", "Returns the live install set on the current account as a single JSON object: enabledPlugins (account config), tier, adminModel, publicModel, installedPlatformSpecialists (disk), installedPremiumSpecialists (disk, gated by brand.shipsPremiumBundles), registeredAgentTypes (Claude Code agent registry under $CLAUDE_CONFIG_DIR/agents/), claudeAiConnectors (the claude.ai account connectors loaded for this client, each with an auth state of connected, needs-auth, or unreachable), and the brand block. Call this whenever you are about to make a claim about what this account can do, what is enabled, or what specialists are dispatchable. A connector listed here exists and is usable: do not deny a connector-backed request (Zoom, Dropbox, Microsoft 365, Cloudflare, Google) just because there is no skill or plugin for it — reach the connector tool, and authenticate it if its state is needs-auth. Do not infer install state from the platform-architecture skill — that skill is the catalogue of what the platform can ship, not what is enabled here.", {}, async () => {
+eagerTool(server, "capabilities-here", "Returns the live install set on the current account as a single JSON object: enabledPlugins (account config), tier, adminModel, publicModel, installedPlatformSpecialists (disk), installedPremiumSpecialists (disk, gated by brand.shipsPremiumBundles), registeredAgentTypes (this account's Claude Code agent registry, <accountDir>/.claude/agents/), claudeAiConnectors (the claude.ai account connectors loaded for this client, each with an auth state of connected, needs-auth, or unreachable), and the brand block. Call this whenever you are about to make a claim about what this account can do, what is enabled, or what specialists are dispatchable. A connector listed here exists and is usable: do not deny a connector-backed request (Zoom, Dropbox, Microsoft 365, Cloudflare, Google) just because there is no skill or plugin for it — reach the connector tool, and authenticate it if its state is needs-auth. Do not infer install state from the platform-architecture skill — that skill is the catalogue of what the platform can ship, not what is enabled here.", {}, async () => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("capabilities-here");
     const requestId = randomUUID();
@@ -745,6 +748,9 @@ eagerTool(server, "capabilities-here", "Returns the live install set on the curr
             platformRoot: PLATFORM_ROOT,
             premiumPluginsRoot,
             claudeConfigDir,
+            // Task 2460 — the account's own agent registry. The brand-wide root
+            // this used to read is retired and cleared on upgrade.
+            agentRegistryDir: resolve(getAccountDir(), ".claude", "agents"),
             // Task 1160 — enumerate the brand client's claude.ai connectors via
             // `claude mcp list`. Never rejects: resolves with whatever output the CLI
             // produced (empty on a missing binary, non-zero exit, or the 12s timeout