@rubytech/create-maxy-code 0.1.615 → 0.1.616

package/payload/platform/lib/mcp-spawn-tee/src/index.ts

@@ -24,10 +24,13 @@
  *   - `server.log` via the loopback log-ingest route — best-effort mirror of
  *     the [mcp-helper] lifecycle lines.
  *
- * Lifecycle lines, correlation key `session=<id8> server=<name>` — unchanged:
+ * Lifecycle lines, correlation key `session=<id8> server=<name>`:
  *   [mcp-helper] op=spawn ... pid= entry=
  *   [mcp-helper] op=boot  ... head=<first stderr bytes>
  *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=
+ *   [mcp-helper] op=fatal ... kind=uncaught|rejection deferred=yes|no
+ *                              disposition=survived|exit error=
+ *     preceded by an `op=fatal-stack` block carrying the full stack (Task 2787).
  *
  * Process model (Task 989): the shim IS the server's process. op=exit fires
  * from process.on("exit"), so it covers a normal exit, a non-zero exit, an
@@ -36,6 +39,17 @@
  * and leaves no op=exit line — the per-session stderr tail already on disk and
  * Claude Code's own transport-drop are the evidence for that death mode.
  *
+ * op=exit records THAT a fatal killed the process; it never records WHICH one,
+ * because Node's fatal printer writes beneath the tee (Task 2787). The op=fatal
+ * pair is what names the error.
+ *
+ * Task 2788 — a fatal no longer always kills. `disposition=` says what the guard
+ * did: the shim exits 1 only when it is the sole listener for the event AND no
+ * stdio transport is connected. A fatal on a connected transport is recorded
+ * and survived, because Claude Code's policy after a helper dies is one
+ * reconnect then stop, so killing a live server removes its whole tool surface
+ * for the rest of the session.
+ *
  * The shim never writes to fd 1 (stdout) — that is the JSON-RPC channel.
  */
 
@@ -118,11 +132,18 @@ function postToServerLog(suffix: string, level: "info" | "error"): void {
 // Claude Code visibility, never re-teed), and a best-effort server.log mirror.
 // `suffix` is the line body after the tag and carries no newline (the
 // log-ingest route rejects newlines).
-function emitLifecycle(suffix: string, level: "info" | "error"): void {
+//
+// Task 2787 — `mirror` is false for op=exit and op=fatal. Both fire while the
+// loop is stopping, so the async fetch cannot flush: server.log held 2 op=exit
+// lines against 160 op=spawn and 135 op=boot. The sync raw sink is the
+// authoritative carrier for those two; posting them was a near-total loss
+// dressed as a mirror. op=spawn/op=boot/op=error keep it — they fire while the
+// loop is live and land.
+function emitLifecycle(suffix: string, level: "info" | "error", mirror = true): void {
   const line = `[mcp-helper] ${suffix}\n`;
   appendSafe(rawSinkPath, line);
   try { rawStderrWrite(line); } catch { /* stderr closed */ }
-  postToServerLog(suffix, level);
+  if (mirror) postToServerLog(suffix, level);
 }
 
 if (!ENTRY) {
@@ -170,6 +191,102 @@ process.on("SIGTERM", onSignal("SIGTERM", 143));
 process.on("SIGINT", onSignal("SIGINT", 130));
 process.on("SIGHUP", onSignal("SIGHUP", 129));
 
+// Task 2787 — the fatal guard. Three measured facts drove it here rather than
+// into the 26 plugin entries: Node's default fatal printer writes to fd 2
+// BENEATH the JS `process.stderr.write` the tee replaces, so on both 18 Aug
+// deaths the stack reached neither the raw sink nor Claude Code's own
+// `Server stderr:` capture; the shim is the single seam every entry already
+// loads through; and 26 copies would have to stay in step for ever.
+//
+// The stack is written through appendSafe and rawStderrWrite directly, never
+// through teeWrite — the tee is the thing that was blind to it.
+
+/** The three fields a fatal contributes. A rejection reason need not be an
+ *  Error, in which case there is no stack and the stringified reason stands in
+ *  for all three. */
+function describeFatal(err: unknown): { name: string; message: string; stack: string } {
+  if (err instanceof Error) {
+    return { name: err.name, message: err.message, stack: err.stack ?? `${err.name}: ${err.message}` };
+  }
+  const s = String(err);
+  return { name: typeof err, message: s, stack: s };
+}
+
+/** Write a fatal's full stack as its own block, before the lifecycle line that
+ *  summarises it. Multi-line by nature, which is why it is not a field on that
+ *  line. Goes through appendSafe and the RAW writer — never teeWrite, which is
+ *  the thing Node's own fatal printer writes beneath. */
+function writeFatalStack(kind: "uncaught" | "rejection" | "import", stack: string): void {
+  const block = `[mcp-helper] op=fatal-stack session=${SESSION_ID8} server=${SERVER_NAME} kind=${kind}\n${stack}\n`;
+  appendSafe(rawSinkPath, block);
+  try { rawStderrWrite(block); } catch { /* stderr closed */ }
+}
+
+/** Task 2788 — has a stdio transport connected in this process?
+ *
+ *  `server.connect(transport)` calls `StdioServerTransport.start()`, whose body
+ *  is `this._stdin.on("data", …)`. So a stdin `data` listener exists if and only
+ *  if a stdio transport has started, and `close()` removes it again — a fatal
+ *  after the transport closed correctly reads as not connected.
+ *
+ *  Read at the moment of the fatal rather than latched at first connect, so a
+ *  transport that has since closed is not remembered as live. Nothing is
+ *  patched: all 26 plugin entries construct a StdioServerTransport and none
+ *  reads stdin itself, so this listener has exactly one source. The three
+ *  channel services carry no stdio transport, so every fatal in them still
+ *  exits — unchanged from before this task. */
+function transportConnected(): boolean {
+  return process.stdin.listenerCount("data") > 0;
+}
+
+// Task 2788 — the disposition. `disposition=` names what THIS guard did with
+// the process: `exit` means it called process.exit(1); `survived` means it
+// returned and left the process running.
+//
+// Claude Code owns the spawn (Task 706: no ChildProcess handle; Task 989: the
+// shim IS the server process) and its post-failure policy is one reconnect then
+// stop — measured on 18 Aug, when the retry died the same way 2.6s in and the
+// CLI never spawned again, leaving that session with `No such tool available`
+// for the rest of its life. Nothing in this tree can change that policy, so not
+// dying is the only mechanism available.
+//
+// The boundary is the connect, not a time window, because that is the fact that
+// separates "a live server hit a bad request" from "this server never came up".
+// Masking the second as the first would replace a visible outage with a silent
+// one.
+//
+//   * another listener present -> record and STAND DOWN, exactly as before. The
+//     email plugin installs its own pair (plugins/email/mcp/src/lib/setup-probe.ts)
+//     and deliberately survives errors it attributes to imapflow/nodemailer.
+//     The guard does not exit, so disposition=survived; if that handler then
+//     exits, the op=exit line that follows is the death record, and the census
+//     reads it as dark on its own terms.
+//   * sole listener, transport connected -> record and keep serving.
+//   * sole listener, no transport -> exit 1, which is Node's own default for an
+//     uncaught throw and (Node >= 15) for an unhandled rejection.
+//
+// The stack is written either way: surviving must not cost the diagnosis, which
+// is what Task 2787 exists to preserve.
+function onFatal(event: "uncaughtException" | "unhandledRejection", kind: "uncaught" | "rejection") {
+  return (err: unknown): void => {
+    const sole = process.listenerCount(event) === 1;
+    const exiting = sole && !transportConnected();
+    const d = describeFatal(err);
+    // The stack first, so it is on disk before anything else can fail.
+    writeFatalStack(kind, d.stack);
+    emitLifecycle(
+      `op=fatal session=${SESSION_ID8} server=${SERVER_NAME} kind=${kind} ` +
+      `deferred=${sole ? "no" : "yes"} disposition=${exiting ? "exit" : "survived"} ` +
+      `error=${JSON.stringify(JSON.stringify({ name: d.name, message: d.message }))}`,
+      "error",
+      false,
+    );
+    if (exiting) process.exit(1);
+  };
+}
+process.on("uncaughtException", onFatal("uncaughtException", "uncaught"));
+process.on("unhandledRejection", onFatal("unhandledRejection", "rejection"));
+
 // op=exit, emitted once from the process "exit" event. Sync-only — the loop is
 // stopping. When a catchable signal caused the exit, report code=— signal=<sig>
 // to match the prior wrapper's format; otherwise code=<exit code> signal=—.
@@ -184,6 +301,7 @@ process.on("exit", (code) => {
     `op=exit session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} ` +
     `code=${codeField} signal=${exitSignal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`,
     level,
+    false,
   );
 });
 
@@ -204,10 +322,19 @@ process.argv = [process.argv[0], ENTRY, ...process.argv.slice(3)];
 // Run the real MCP server in THIS process. Dynamic import() (not top-level
 // await — this file compiles to CommonJS) loads the ESM entry; a load-time
 // failure mirrors the old child spawn-error path (op=error, exit 127). The
-// op=exit handler is suppressed on this path so op=error stays the sole record.
+// op=exit handler is suppressed on this path so op=error stays the sole
+// lifecycle record.
+//
+// Task 2787 — this .catch() settles the rejection, so a throw during the
+// entry's module EVALUATION never reaches the uncaughtException guard above.
+// The stack is written here explicitly; without it a boot-time death leaves
+// its message on the op=error line and nothing else — no type, no frames. The
+// op=error line itself is unchanged: `describeFatal().message` is the same
+// value the old inline expression produced.
 import(pathToFileURL(ENTRY).href).catch((err: unknown) => {
-  const msg = err instanceof Error ? err.message : String(err);
+  const d = describeFatal(err);
   exitEmitted = true;
-  emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`import error: ${msg}`)}`, "error");
+  writeFatalStack("import", d.stack);
+  emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`import error: ${d.message}`)}`, "error");
   process.exit(127);
 });

package/payload/platform/plugins/admin/lib/mcp-spawn-tee/index.js

@@ -25,10 +25,13 @@
  *   - `server.log` via the loopback log-ingest route — best-effort mirror of
  *     the [mcp-helper] lifecycle lines.
  *
- * Lifecycle lines, correlation key `session=<id8> server=<name>` — unchanged:
+ * Lifecycle lines, correlation key `session=<id8> server=<name>`:
  *   [mcp-helper] op=spawn ... pid= entry=
  *   [mcp-helper] op=boot  ... head=<first stderr bytes>
  *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=
+ *   [mcp-helper] op=fatal ... kind=uncaught|rejection deferred=yes|no
+ *                              disposition=survived|exit error=
+ *     preceded by an `op=fatal-stack` block carrying the full stack (Task 2787).
  *
  * Process model (Task 989): the shim IS the server's process. op=exit fires
  * from process.on("exit"), so it covers a normal exit, a non-zero exit, an
@@ -37,6 +40,17 @@
  * and leaves no op=exit line — the per-session stderr tail already on disk and
  * Claude Code's own transport-drop are the evidence for that death mode.
  *
+ * op=exit records THAT a fatal killed the process; it never records WHICH one,
+ * because Node's fatal printer writes beneath the tee (Task 2787). The op=fatal
+ * pair is what names the error.
+ *
+ * Task 2788 — a fatal no longer always kills. `disposition=` says what the guard
+ * did: the shim exits 1 only when it is the sole listener for the event AND no
+ * stdio transport is connected. A fatal on a connected transport is recorded
+ * and survived, because Claude Code's policy after a helper dies is one
+ * reconnect then stop, so killing a live server removes its whole tool surface
+ * for the rest of the session.
+ *
  * The shim never writes to fd 1 (stdout) — that is the JSON-RPC channel.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -114,14 +128,22 @@ function postToServerLog(suffix, level) {
 // Claude Code visibility, never re-teed), and a best-effort server.log mirror.
 // `suffix` is the line body after the tag and carries no newline (the
 // log-ingest route rejects newlines).
-function emitLifecycle(suffix, level) {
+//
+// Task 2787 — `mirror` is false for op=exit and op=fatal. Both fire while the
+// loop is stopping, so the async fetch cannot flush: server.log held 2 op=exit
+// lines against 160 op=spawn and 135 op=boot. The sync raw sink is the
+// authoritative carrier for those two; posting them was a near-total loss
+// dressed as a mirror. op=spawn/op=boot/op=error keep it — they fire while the
+// loop is live and land.
+function emitLifecycle(suffix, level, mirror = true) {
     const line = `[mcp-helper] ${suffix}\n`;
     appendSafe(rawSinkPath, line);
     try {
         rawStderrWrite(line);
     }
     catch { /* stderr closed */ }
-    postToServerLog(suffix, level);
+    if (mirror)
+        postToServerLog(suffix, level);
 }
 if (!ENTRY) {
     emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason="no entry given (argv[2] missing)"`, "error");
@@ -165,6 +187,97 @@ function onSignal(sig, code) {
 process.on("SIGTERM", onSignal("SIGTERM", 143));
 process.on("SIGINT", onSignal("SIGINT", 130));
 process.on("SIGHUP", onSignal("SIGHUP", 129));
+// Task 2787 — the fatal guard. Three measured facts drove it here rather than
+// into the 26 plugin entries: Node's default fatal printer writes to fd 2
+// BENEATH the JS `process.stderr.write` the tee replaces, so on both 18 Aug
+// deaths the stack reached neither the raw sink nor Claude Code's own
+// `Server stderr:` capture; the shim is the single seam every entry already
+// loads through; and 26 copies would have to stay in step for ever.
+//
+// The stack is written through appendSafe and rawStderrWrite directly, never
+// through teeWrite — the tee is the thing that was blind to it.
+/** The three fields a fatal contributes. A rejection reason need not be an
+ *  Error, in which case there is no stack and the stringified reason stands in
+ *  for all three. */
+function describeFatal(err) {
+    if (err instanceof Error) {
+        return { name: err.name, message: err.message, stack: err.stack ?? `${err.name}: ${err.message}` };
+    }
+    const s = String(err);
+    return { name: typeof err, message: s, stack: s };
+}
+/** Write a fatal's full stack as its own block, before the lifecycle line that
+ *  summarises it. Multi-line by nature, which is why it is not a field on that
+ *  line. Goes through appendSafe and the RAW writer — never teeWrite, which is
+ *  the thing Node's own fatal printer writes beneath. */
+function writeFatalStack(kind, stack) {
+    const block = `[mcp-helper] op=fatal-stack session=${SESSION_ID8} server=${SERVER_NAME} kind=${kind}\n${stack}\n`;
+    appendSafe(rawSinkPath, block);
+    try {
+        rawStderrWrite(block);
+    }
+    catch { /* stderr closed */ }
+}
+/** Task 2788 — has a stdio transport connected in this process?
+ *
+ *  `server.connect(transport)` calls `StdioServerTransport.start()`, whose body
+ *  is `this._stdin.on("data", …)`. So a stdin `data` listener exists if and only
+ *  if a stdio transport has started, and `close()` removes it again — a fatal
+ *  after the transport closed correctly reads as not connected.
+ *
+ *  Read at the moment of the fatal rather than latched at first connect, so a
+ *  transport that has since closed is not remembered as live. Nothing is
+ *  patched: all 26 plugin entries construct a StdioServerTransport and none
+ *  reads stdin itself, so this listener has exactly one source. The three
+ *  channel services carry no stdio transport, so every fatal in them still
+ *  exits — unchanged from before this task. */
+function transportConnected() {
+    return process.stdin.listenerCount("data") > 0;
+}
+// Task 2788 — the disposition. `disposition=` names what THIS guard did with
+// the process: `exit` means it called process.exit(1); `survived` means it
+// returned and left the process running.
+//
+// Claude Code owns the spawn (Task 706: no ChildProcess handle; Task 989: the
+// shim IS the server process) and its post-failure policy is one reconnect then
+// stop — measured on 18 Aug, when the retry died the same way 2.6s in and the
+// CLI never spawned again, leaving that session with `No such tool available`
+// for the rest of its life. Nothing in this tree can change that policy, so not
+// dying is the only mechanism available.
+//
+// The boundary is the connect, not a time window, because that is the fact that
+// separates "a live server hit a bad request" from "this server never came up".
+// Masking the second as the first would replace a visible outage with a silent
+// one.
+//
+//   * another listener present -> record and STAND DOWN, exactly as before. The
+//     email plugin installs its own pair (plugins/email/mcp/src/lib/setup-probe.ts)
+//     and deliberately survives errors it attributes to imapflow/nodemailer.
+//     The guard does not exit, so disposition=survived; if that handler then
+//     exits, the op=exit line that follows is the death record, and the census
+//     reads it as dark on its own terms.
+//   * sole listener, transport connected -> record and keep serving.
+//   * sole listener, no transport -> exit 1, which is Node's own default for an
+//     uncaught throw and (Node >= 15) for an unhandled rejection.
+//
+// The stack is written either way: surviving must not cost the diagnosis, which
+// is what Task 2787 exists to preserve.
+function onFatal(event, kind) {
+    return (err) => {
+        const sole = process.listenerCount(event) === 1;
+        const exiting = sole && !transportConnected();
+        const d = describeFatal(err);
+        // The stack first, so it is on disk before anything else can fail.
+        writeFatalStack(kind, d.stack);
+        emitLifecycle(`op=fatal session=${SESSION_ID8} server=${SERVER_NAME} kind=${kind} ` +
+            `deferred=${sole ? "no" : "yes"} disposition=${exiting ? "exit" : "survived"} ` +
+            `error=${JSON.stringify(JSON.stringify({ name: d.name, message: d.message }))}`, "error", false);
+        if (exiting)
+            process.exit(1);
+    };
+}
+process.on("uncaughtException", onFatal("uncaughtException", "uncaught"));
+process.on("unhandledRejection", onFatal("unhandledRejection", "rejection"));
 // op=exit, emitted once from the process "exit" event. Sync-only — the loop is
 // stopping. When a catchable signal caused the exit, report code=— signal=<sig>
 // to match the prior wrapper's format; otherwise code=<exit code> signal=—.
@@ -177,7 +290,7 @@ process.on("exit", (code) => {
     const codeField = exitSignal ? "—" : String(code);
     const level = exitSignal || code !== 0 ? "error" : "info";
     emitLifecycle(`op=exit session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} ` +
-        `code=${codeField} signal=${exitSignal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`, level);
+        `code=${codeField} signal=${exitSignal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`, level, false);
 });
 emitLifecycle(`op=spawn session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} entry=${ENTRY}`, "info");
 // Task 2356 — present argv as a direct `node <entry>` invocation before the
@@ -194,11 +307,20 @@ process.argv = [process.argv[0], ENTRY, ...process.argv.slice(3)];
 // Run the real MCP server in THIS process. Dynamic import() (not top-level
 // await — this file compiles to CommonJS) loads the ESM entry; a load-time
 // failure mirrors the old child spawn-error path (op=error, exit 127). The
-// op=exit handler is suppressed on this path so op=error stays the sole record.
+// op=exit handler is suppressed on this path so op=error stays the sole
+// lifecycle record.
+//
+// Task 2787 — this .catch() settles the rejection, so a throw during the
+// entry's module EVALUATION never reaches the uncaughtException guard above.
+// The stack is written here explicitly; without it a boot-time death leaves
+// its message on the op=error line and nothing else — no type, no frames. The
+// op=error line itself is unchanged: `describeFatal().message` is the same
+// value the old inline expression produced.
 import((0, node_url_1.pathToFileURL)(ENTRY).href).catch((err) => {
-    const msg = err instanceof Error ? err.message : String(err);
+    const d = describeFatal(err);
     exitEmitted = true;
-    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`import error: ${msg}`)}`, "error");
+    writeFatalStack("import", d.stack);
+    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`import error: ${d.message}`)}`, "error");
     process.exit(127);
 });
 //# sourceMappingURL=index.js.map

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -628,7 +628,7 @@ eagerTool(server, "admin-hostname", "Resolve this account's admin hostname — t
         };
     }
 });
-lifelineTool(server, "publish-site", "Publish an already-extracted static-site tree under <accountDir>/sites/<slug>/. Validates the slug, scans the source for symlinks, refuses on ambiguous landing pages, performs a single mv, then refreshes llms.txt + llms-full.txt at the site root via the AEO writer (best-effort — failure never unwinds the mv). Returns the canonical path slug; pair with public-hostname to build the full URL. Refusals are structured (unsafe-slug | destination-occupied | symlink-in-source | zero-html | ambiguous-html), each carrying a fixed operator message.", {
+lifelineTool(server, "publish-site", "Publish an already-extracted static-site tree under <accountDir>/sites/<slug>/. Validates the slug, scans the source for symlinks, refuses on ambiguous landing pages, performs a single mv, then refreshes llms.txt + llms-full.txt at the site root via the AEO writer when siteOrigin is supplied (best-effort — failure never unwinds the mv; without siteOrigin the refresh is skipped and the response says so). Returns the canonical path slug; pair with public-hostname to build the full URL. Refusals are structured (unsafe-slug | destination-occupied | symlink-in-source | zero-html | ambiguous-html), each carrying a fixed operator message.", {
     source: z
         .string()
         .min(1)
@@ -641,6 +641,10 @@ lifelineTool(server, "publish-site", "Publish an already-extracted static-site t
         .string()
         .optional()
         .describe("Optional display name used in the generated llms.txt header. Defaults to the last slug segment."),
+    siteOrigin: z
+        .string()
+        .optional()
+        .describe('Absolute http(s) origin this site is served from, e.g. "https://maxy.institute". Required for the llms.txt refresh: without it the pair is not regenerated, because the account publishes several sites and their pages can only be told apart by URL. The publish itself succeeds either way.'),
     siteDescription: z
         .string()
         .optional()
@@ -656,6 +660,7 @@ lifelineTool(server, "publish-site", "Publish an already-extracted static-site t
             source: args.source,
             slug: args.slug,
             siteName: args.siteName,
+            siteOrigin: args.siteOrigin,
             siteDescription: args.siteDescription,
         }, { getSession });
         if (!result.ok) {
@@ -665,8 +670,11 @@ lifelineTool(server, "publish-site", "Publish an already-extracted static-site t
             return { content: [{ type: "text", text: body }] };
         }
         const aeoLine = result.aeo.ok
-            ? `aeo: ok wrote=${result.aeo.indexPath} indexBytes=${result.aeo.indexBytes}`
-            : `aeo: failed reason=${result.aeo.reason}`;
+            ? `aeo: ok wrote=${result.aeo.indexPath} indexBytes=${result.aeo.indexBytes} llms-full=${result.aeo.fullPath ??
+                `not-written reason=${result.aeo.fullRefusedReason}`}`
+            : result.aeo.reason === "no-site-origin"
+                ? "aeo: skipped reason=no-site-origin — llms.txt and llms-full.txt were left as they were; pass siteOrigin to refresh them"
+                : `aeo: failed reason=${result.aeo.reason}`;
         const body = `pathSlug: ${result.pathSlug}\n` +
             `kind: ${result.kind}\n` +
             `movedFiles: ${result.movedFiles}\n` +