@rubytech/create-sitedesk-code 0.1.429 → 0.1.432

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@maxy/sitedesk-job",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "@types/node": "^22.0.0",
+    "vitest": "^4.1.2"
+  }
+}

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/index.ts

@@ -0,0 +1,39 @@
+// sitedesk-job MCP server — apply-path toolification (Task 1540).
+//
+// Three pure-executor tools, all admin-side, over the operator's persisted
+// per-account artifacts under $ACCOUNT_DIR/quoting/ plus provided inputs:
+//   quote-engine-run   execute the already-persisted pricing engine → figures
+//   quote-render       figures + persisted render script → three reconciling HTML docs
+//   takeoff-compute    deterministic scale/area/count geometry → tagged quantity list
+//
+// The server embeds no item, rate, margin, roll-up, template, or fixed schema:
+// it runs the operator's own scripts, it is not a pricing model. Module init
+// never reads per-account env, so plugin enumeration with empty env boots the
+// registry without faulting (CLAUDE.md spawn-enumeration invariant).
+
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+import { logLine } from "./lib/log.js";
+import { registerTakeoffCompute } from "./tools/takeoff-compute.js";
+import { registerQuoteEngineRun } from "./tools/quote-engine-run.js";
+import { registerQuoteRender } from "./tools/quote-render.js";
+
+const accountId = process.env.ACCOUNT_ID ?? "local";
+
+const server = new McpServer({ name: "maxy-sitedesk-job", version: "0.1.0" });
+
+logLine(`[sitedesk-job] server started, account=${accountId}`);
+
+registerTakeoffCompute(server);
+registerQuoteEngineRun(server);
+registerQuoteRender(server);
+
+const transport = new StdioServerTransport();
+await server.connect(transport);
+
+function shutdown(): void {
+  process.exit(0);
+}
+process.on("SIGINT", shutdown);
+process.on("SIGTERM", shutdown);

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/__tests__/account.test.ts

@@ -0,0 +1,49 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { resolveAccountDir } from "../account.js";
+
+const SAVE = { ...process.env };
+
+describe("resolveAccountDir", () => {
+  beforeEach(() => {
+    delete process.env.ACCOUNT_DIR;
+    delete process.env.PLATFORM_ROOT;
+    delete process.env.ACCOUNT_ID;
+  });
+  afterEach(() => {
+    process.env = { ...SAVE };
+  });
+
+  it("returns ACCOUNT_DIR verbatim when set", () => {
+    process.env.ACCOUNT_DIR = "/data/accounts/acme";
+    expect(resolveAccountDir()).toBe("/data/accounts/acme");
+  });
+
+  it("derives from PLATFORM_ROOT + ACCOUNT_ID when ACCOUNT_DIR absent", () => {
+    process.env.PLATFORM_ROOT = "/opt/maxy/platform";
+    process.env.ACCOUNT_ID = "acme";
+    expect(resolveAccountDir()).toBe("/opt/maxy/data/accounts/acme");
+  });
+
+  it("returns null when neither ACCOUNT_DIR nor PLATFORM_ROOT+ACCOUNT_ID is resolvable", () => {
+    expect(resolveAccountDir()).toBeNull();
+  });
+
+  it("rejects an ACCOUNT_ID containing a path separator", () => {
+    process.env.PLATFORM_ROOT = "/opt/maxy/platform";
+    process.env.ACCOUNT_ID = "acme/evil";
+    expect(resolveAccountDir()).toBeNull();
+  });
+
+  it("rejects an ACCOUNT_ID containing a parent traversal", () => {
+    process.env.PLATFORM_ROOT = "/opt/maxy/platform";
+    process.env.ACCOUNT_ID = "..";
+    expect(resolveAccountDir()).toBeNull();
+  });
+
+  it("ignores an empty/whitespace ACCOUNT_DIR and falls back", () => {
+    process.env.ACCOUNT_DIR = "   ";
+    process.env.PLATFORM_ROOT = "/opt/maxy/platform";
+    process.env.ACCOUNT_ID = "acme";
+    expect(resolveAccountDir()).toBe("/opt/maxy/data/accounts/acme");
+  });
+});

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/__tests__/engine-run.test.ts

@@ -0,0 +1,105 @@
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { runEngine, writeFigures } from "../engine-run.js";
+
+// A fixture engine simulating the operator's own persisted script: reads
+// {methodPath, job, mode} on stdin, prices qty*rate, emits figures (quote) or a
+// per-level delta (verify). Its rate lives in the fixture method, never here.
+const GOOD_ENGINE = `
+import { readFileSync } from "node:fs";
+let input = "";
+process.stdin.on("data", (d) => (input += d));
+process.stdin.on("end", () => {
+  const { methodPath, job, mode } = JSON.parse(input);
+  const method = JSON.parse(readFileSync(methodPath, "utf8"));
+  const lines = job.lines.map((l, i) => ({ item: l.item ?? "line" + i, quantity: l.qty, quantitySource: "entered", sell: l.qty * method.rate, group: "all" }));
+  const total = lines.reduce((s, l) => s + l.sell, 0);
+  if (mode === "verify") {
+    const deltas = lines.map((l, i) => ({ level: "line", id: l.item, computed: l.sell, issued: job.lines[i].issued, delta: l.sell - job.lines[i].issued }));
+    deltas.push({ level: "total", id: "total", computed: total, issued: job.issuedTotal, delta: total - job.issuedTotal });
+    process.stdout.write(JSON.stringify({ deltas, worst: Math.max(...deltas.map((d) => Math.abs(d.delta))) }));
+    return;
+  }
+  process.stdout.write(JSON.stringify({ lines, groups: [{ name: "all", subtotal: total }], rollup: [], total, reconcile: { pass: true } }));
+});
+`;
+const THROW_ENGINE = `process.stdin.resume(); process.stderr.write("boom"); process.exit(1);`;
+const BADOUT_ENGINE = `process.stdin.resume(); process.stdout.write("not json at all");`;
+const NOTOTAL_ENGINE = `process.stdin.resume(); process.stdout.write(JSON.stringify({ lines: [], groups: [] }));`;
+
+let dir: string;
+const job = { lines: [{ item: "a", qty: 3, issued: 30 }, { item: "b", qty: 2, issued: 20 }], issuedTotal: 50, header: { phone: "44700900000" } };
+
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), "sd-engine-"));
+  mkdirSync(join(dir, "quoting"), { recursive: true });
+  writeFileSync(join(dir, "quoting", "engine.mjs"), GOOD_ENGINE);
+  writeFileSync(join(dir, "quoting", "engine-throw.mjs"), THROW_ENGINE);
+  writeFileSync(join(dir, "quoting", "engine-badout.mjs"), BADOUT_ENGINE);
+  writeFileSync(join(dir, "quoting", "engine-nototal.mjs"), NOTOTAL_ENGINE);
+  writeFileSync(join(dir, "quoting", "method.json"), JSON.stringify({ rate: 10 }));
+});
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+const eng = (name: string) => join(dir, "quoting", name);
+const method = () => join(dir, "quoting", "method.json");
+
+describe("runEngine — success", () => {
+  it("reproduces the job's total in quote mode", async () => {
+    const r = await runEngine({ accountDir: dir, enginePath: eng("engine.mjs"), methodPath: method(), job, mode: "quote" });
+    expect(r.ok).toBe(true);
+    if (r.ok) expect((r.figures as { total: number }).total).toBe(50);
+  });
+
+  it("returns an all-zero delta in verify mode when the engine matches history", async () => {
+    const r = await runEngine({ accountDir: dir, enginePath: eng("engine.mjs"), methodPath: method(), job, mode: "verify" });
+    expect(r.ok).toBe(true);
+    if (r.ok) expect((r.figures as { worst: number }).worst).toBe(0);
+  });
+});
+
+describe("runEngine — faults return zero figures and a distinct reason", () => {
+  it("engine-absent when the engine file is missing", async () => {
+    const r = await runEngine({ accountDir: dir, enginePath: eng("nope.mjs"), methodPath: method(), job, mode: "quote" });
+    expect(r).toMatchObject({ ok: false, reason: "engine-absent" });
+  });
+
+  it("method-absent when the method file is missing", async () => {
+    const r = await runEngine({ accountDir: dir, enginePath: eng("engine.mjs"), methodPath: eng("no-method.json"), job, mode: "quote" });
+    expect(r).toMatchObject({ ok: false, reason: "method-absent" });
+  });
+
+  it("script-error when the engine exits non-zero", async () => {
+    const r = await runEngine({ accountDir: dir, enginePath: eng("engine-throw.mjs"), methodPath: method(), job, mode: "quote" });
+    expect(r).toMatchObject({ ok: false, reason: "script-error" });
+  });
+
+  it("script-error when the engine emits non-JSON", async () => {
+    const r = await runEngine({ accountDir: dir, enginePath: eng("engine-badout.mjs"), methodPath: method(), job, mode: "quote" });
+    expect(r).toMatchObject({ ok: false, reason: "script-error" });
+  });
+
+  it("script-error when the quote output omits the total", async () => {
+    const r = await runEngine({ accountDir: dir, enginePath: eng("engine-nototal.mjs"), methodPath: method(), job, mode: "quote" });
+    expect(r).toMatchObject({ ok: false, reason: "script-error" });
+  });
+
+  it("returns script-error without crashing when the engine exits early under a large payload", async () => {
+    // 8000 lines serialise to ~180KB, well over the OS pipe buffer, so the stdin
+    // write races the early exit and raises EPIPE. Must surface as a clean fault.
+    const bigJob = { lines: Array.from({ length: 8000 }, (_, i) => ({ item: "item-" + i, qty: 1, issued: 1 })), issuedTotal: 8000, header: { phone: "44700900000" } };
+    const r = await runEngine({ accountDir: dir, enginePath: eng("engine-throw.mjs"), methodPath: method(), job: bigJob, mode: "quote" });
+    expect(r).toMatchObject({ ok: false, reason: "script-error" });
+  });
+});
+
+describe("writeFigures", () => {
+  it("persists figures to quoting/jobs/<jobId>/figures.json and returns the path", () => {
+    const p = writeFigures(dir, "job-xyz", { total: 50 });
+    expect(p).toBe(join(dir, "quoting", "jobs", "job-xyz", "figures.json"));
+    expect(existsSync(p)).toBe(true);
+    expect(JSON.parse(readFileSync(p, "utf8"))).toEqual({ total: 50 });
+  });
+});

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/__tests__/gates.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect } from "vitest";
+import { gateReconcile, gateMarginLeak, gateSignLink } from "../gates.js";
+
+describe("gateReconcile — displayed total must equal the engine total", () => {
+  it("passes when data-quote-total matches", () => {
+    expect(gateReconcile('<p data-quote-total="1250.00">Total £1,250</p>', 1250)).toEqual({ pass: true, shown: 1250 });
+  });
+  it("fails when the displayed total differs", () => {
+    expect(gateReconcile('<p data-quote-total="1300">x</p>', 1250)).toEqual({ pass: false, shown: 1300 });
+  });
+  it("fails closed when no data-quote-total is present", () => {
+    expect(gateReconcile("<p>Total £1,250</p>", 1250)).toEqual({ pass: false });
+  });
+  it("fails closed on an empty data-quote-total marker, even when the engine total is zero", () => {
+    expect(gateReconcile('<p data-quote-total="">x</p>', 0)).toEqual({ pass: false });
+  });
+});
+
+describe("gateMarginLeak — client docs must not carry cost/margin markers", () => {
+  it("fails when data-internal-only is present", () => {
+    expect(gateMarginLeak('<td data-internal-only>cost £900</td>').pass).toBe(false);
+  });
+  it("passes when no data-internal-only marker is present", () => {
+    expect(gateMarginLeak("<td>£1,250</td>").pass).toBe(true);
+  });
+});
+
+describe("gateSignLink — client quote's acceptance anchor must be absolute https", () => {
+  it("passes an absolute https href", () => {
+    const r = gateSignLink('<a data-esign-accept href="https://q.pages.dev/sign">Sign online</a>');
+    expect(r).toEqual({ pass: true, href: "https://q.pages.dev/sign" });
+  });
+  it("fails no-anchor when the marked anchor is absent", () => {
+    expect(gateSignLink('<a href="https://q.pages.dev/sign">Sign</a>')).toEqual({ pass: false, reason: "no-anchor" });
+  });
+  it("fails empty on an empty href", () => {
+    expect(gateSignLink('<a data-esign-accept href="">Sign</a>')).toEqual({ pass: false, href: "", reason: "empty" });
+  });
+  it("fails fragment on a bare fragment", () => {
+    expect(gateSignLink('<a data-esign-accept href="#">Sign</a>')).toEqual({ pass: false, href: "#", reason: "fragment" });
+  });
+  it("fails non-https on a file:// href", () => {
+    expect(gateSignLink('<a data-esign-accept href="file:///tmp/x">Sign</a>')).toEqual({ pass: false, href: "file:///tmp/x", reason: "non-https" });
+  });
+  it("fails non-https on an http:// href", () => {
+    expect(gateSignLink('<a data-esign-accept href="http://q/sign">Sign</a>')).toEqual({ pass: false, href: "http://q/sign", reason: "non-https" });
+  });
+  it("fails relative on a rooted path", () => {
+    expect(gateSignLink('<a data-esign-accept href="/sign">Sign</a>')).toEqual({ pass: false, href: "/sign", reason: "relative" });
+  });
+});

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/__tests__/geometry.test.ts

@@ -0,0 +1,83 @@
+import { describe, it, expect } from "vitest";
+import { computeTakeoff } from "../geometry.js";
+
+describe("computeTakeoff — bases", () => {
+  it("passes a printed dimension through exactly, keeping its unit", () => {
+    const r = computeTakeoff({ lines: [{ element: "external wall run", basis: "printed", value: 24.6, unit: "m" }] });
+    expect(r.lines[0]).toMatchObject({ element: "external wall run", quantity: 24.6, unit: "m", basis: "printed" });
+  });
+
+  it("passes an operator-supplied figure through exactly", () => {
+    const r = computeTakeoff({ lines: [{ element: "manholes", basis: "operator", value: 8, unit: "no." }] });
+    expect(r.lines[0].quantity).toBe(8);
+  });
+
+  it("derives a scaled length from a stated ratio", () => {
+    const r = computeTakeoff({ scale: { ratio: 50 }, lines: [{ element: "gable", basis: "scaled", measured: 0.5, kind: "length", unit: "m" }] });
+    expect(r.lines[0].quantity).toBe(25);
+  });
+
+  it("derives a scaled length from a known-dimension calibration", () => {
+    const r = computeTakeoff({ scale: { measuredRef: 100, actual: 5000 }, lines: [{ element: "gable", basis: "scaled", measured: 2, kind: "length" }] });
+    expect(r.lines[0].quantity).toBe(100); // factor 5000/100 = 50; 2*50
+  });
+
+  it("derives a scaled area as side x side x factor squared", () => {
+    const r = computeTakeoff({ scale: { ratio: 50 }, lines: [{ element: "kitchen floor", basis: "scaled", measured: 2, measuredB: 3, kind: "area", unit: "m2" }] });
+    expect(r.lines[0].quantity).toBe(15000); // 2*3*50^2
+  });
+
+  it("rolls up a list of counts by summation", () => {
+    const r = computeTakeoff({ lines: [{ element: "double sockets", basis: "count", count: [3, 4, 1] }] });
+    expect(r.lines[0].quantity).toBe(8);
+  });
+
+  it("passes a single count through", () => {
+    const r = computeTakeoff({ lines: [{ element: "double sockets", basis: "count", count: 8 }] });
+    expect(r.lines[0].quantity).toBe(8);
+  });
+});
+
+describe("computeTakeoff — cross-check", () => {
+  it("records agreement when a scaled quantity matches a printed figure within tolerance", () => {
+    const r = computeTakeoff({ scale: { ratio: 50 }, lines: [{ element: "gable", basis: "scaled", measured: 0.5, kind: "length", crossCheck: { value: 25, tolerance: 1 } }] });
+    expect(r.lines[0].crossCheck).toEqual({ printed: 25, delta: 0, disagree: false });
+  });
+
+  it("flags disagreement when a scaled quantity exceeds the printed figure by more than tolerance", () => {
+    const r = computeTakeoff({ scale: { ratio: 50 }, lines: [{ element: "gable", basis: "scaled", measured: 0.5, kind: "length", crossCheck: { value: 22, tolerance: 1 } }] });
+    expect(r.lines[0].crossCheck).toEqual({ printed: 22, delta: 3, disagree: true });
+  });
+});
+
+describe("computeTakeoff — counts split", () => {
+  it("reports how many lines are exact vs scale-approximated", () => {
+    const r = computeTakeoff({
+      scale: { ratio: 50 },
+      lines: [
+        { element: "wall", basis: "printed", value: 10 },
+        { element: "sockets", basis: "count", count: 4 },
+        { element: "floor", basis: "scaled", measured: 1, kind: "length" },
+      ],
+    });
+    expect(r.counts).toEqual({ exact: 2, scaled: 1 });
+  });
+});
+
+describe("computeTakeoff — faults (no partial list)", () => {
+  it("throws a named error when a scaled line has no scale", () => {
+    expect(() => computeTakeoff({ lines: [{ element: "gable", basis: "scaled", measured: 0.5, kind: "length" }] })).toThrow(/no scale/i);
+  });
+
+  it("throws a named error when a scaled area omits the second side", () => {
+    expect(() => computeTakeoff({ scale: { ratio: 50 }, lines: [{ element: "floor", basis: "scaled", measured: 2, kind: "area" }] })).toThrow(/second side/i);
+  });
+
+  it("throws a named error when a printed line omits its value", () => {
+    expect(() => computeTakeoff({ lines: [{ element: "wall", basis: "printed" }] })).toThrow(/value/i);
+  });
+
+  it("throws a named error when a calibration scale has a zero reference", () => {
+    expect(() => computeTakeoff({ scale: { measuredRef: 0, actual: 5000 }, lines: [{ element: "gable", basis: "scaled", measured: 2, kind: "length" }] })).toThrow(/scale/i);
+  });
+});

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/__tests__/render-run.test.ts

@@ -0,0 +1,111 @@
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { runRender } from "../render-run.js";
+
+// Fixture render scripts simulating the operator's own quoting/render.mjs: read
+// {figures, signUrl}, emit the three HTML docs. Brand/layout is theirs; the tool
+// only gates and files.
+const GOOD = `
+let input = "";
+process.stdin.on("data", (d) => (input += d));
+process.stdin.on("end", () => {
+  const { figures, signUrl } = JSON.parse(input);
+  const t = figures.total;
+  process.stdout.write(JSON.stringify({
+    internal: '<html><body><td data-internal-only>cost 900</td><p data-quote-total="' + t + '">Total ' + t + '</p></body></html>',
+    breakdown: '<html><body><p data-quote-total="' + t + '">Total ' + t + '</p></body></html>',
+    quote: '<html><body><p data-quote-total="' + t + '">Total ' + t + '</p><a data-esign-accept href="' + signUrl + '">Sign online</a></body></html>',
+  }));
+});
+`;
+const LEAK = GOOD.replace('breakdown: \'<html><body><p data-quote-total="\' + t + \'">Total \' + t + \'</p></body></html>\'',
+  'breakdown: \'<html><body><td data-internal-only>cost 900</td><p data-quote-total="\' + t + \'">Total \' + t + \'</p></body></html>\'');
+const DEADLINK = GOOD.replace('href="\' + signUrl + \'"', 'href=""');
+// internal doc shows a total one higher than the engine total → reconcile-fail
+const WRONGTOTAL = `
+let input = "";
+process.stdin.on("data", (d) => (input += d));
+process.stdin.on("end", () => {
+  const { figures, signUrl } = JSON.parse(input);
+  const t = figures.total;
+  process.stdout.write(JSON.stringify({
+    internal: '<html><body><p data-quote-total="' + (t + 1) + '">Total</p></body></html>',
+    breakdown: '<html><body><p data-quote-total="' + t + '">Total</p></body></html>',
+    quote: '<html><body><p data-quote-total="' + t + '">Total</p><a data-esign-accept href="' + signUrl + '">Sign</a></body></html>',
+  }));
+});
+`;
+const THROW = `process.stdin.resume(); process.exit(1);`;
+
+let dir: string;
+const figures = { total: 1250, header: { phone: "44700900000" }, lines: [] };
+const signUrl = "https://q.pages.dev/sign";
+const jobId = "job-1";
+
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), "sd-render-"));
+  mkdirSync(join(dir, "quoting"), { recursive: true });
+  writeFileSync(join(dir, "quoting", "render.mjs"), GOOD);
+  writeFileSync(join(dir, "quoting", "render-leak.mjs"), LEAK);
+  writeFileSync(join(dir, "quoting", "render-deadlink.mjs"), DEADLINK);
+  writeFileSync(join(dir, "quoting", "render-wrongtotal.mjs"), WRONGTOTAL);
+  writeFileSync(join(dir, "quoting", "render-throw.mjs"), THROW);
+});
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+const rs = (n: string) => join(dir, "quoting", n);
+
+describe("runRender — happy path files all three docs to their scopes", () => {
+  it("writes internal to admin scope, breakdown+quote to client scope, all gates green", async () => {
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render.mjs"), figures, signUrl, jobId });
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.reconcile).toEqual({ internal: true, breakdown: true, quote: true });
+    expect(r.signLink.pass).toBe(true);
+    expect(r.docs.internal).toBe(join(dir, "memory/admin/customers/44700900000/quote-job-1-internal.html"));
+    expect(r.docs.breakdown).toBe(join(dir, "memory/users/44700900000/documents/quote-job-1-breakdown.html"));
+    expect(r.docs.quote).toBe(join(dir, "memory/users/44700900000/documents/quote-job-1.html"));
+    expect(existsSync(r.docs.internal) && existsSync(r.docs.breakdown) && existsSync(r.docs.quote)).toBe(true);
+  });
+});
+
+describe("runRender — a failing gate is fail-closed and atomic (no doc filed)", () => {
+  it("margin-leak when a client doc carries data-internal-only", async () => {
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-leak.mjs"), figures, signUrl, jobId: "job-leak" });
+    expect(r).toMatchObject({ ok: false, reason: "margin-leak" });
+    expect(existsSync(join(dir, "memory/users/44700900000/documents/quote-job-leak.html"))).toBe(false);
+  });
+  it("sign-link when the client quote's acceptance href is dead", async () => {
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-deadlink.mjs"), figures, signUrl, jobId: "job-dead" });
+    expect(r).toMatchObject({ ok: false, reason: "sign-link" });
+    expect(existsSync(join(dir, "memory/admin/customers/44700900000/quote-job-dead-internal.html"))).toBe(false);
+  });
+  it("reconcile-fail when a doc's displayed total differs from the engine total", async () => {
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-wrongtotal.mjs"), figures, signUrl, jobId: "job-wt" });
+    expect(r).toMatchObject({ ok: false, reason: "reconcile-fail" });
+  });
+  it("render-error when the figures header phone contains a path traversal", async () => {
+    const evil = { total: 1250, header: { phone: "../../etc" }, lines: [] };
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render.mjs"), figures: evil, signUrl, jobId: "job-evil" });
+    expect(r).toMatchObject({ ok: false, reason: "render-error" });
+    expect(existsSync(join(dir, "memory/admin/customers/../../etc/quote-job-evil-internal.html"))).toBe(false);
+  });
+});
+
+describe("runRender — script faults", () => {
+  it("render-absent when the render script is missing", async () => {
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("nope.mjs"), figures, signUrl, jobId });
+    expect(r).toMatchObject({ ok: false, reason: "render-absent" });
+  });
+  it("render-error when the render script exits non-zero", async () => {
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-throw.mjs"), figures, signUrl, jobId });
+    expect(r).toMatchObject({ ok: false, reason: "render-error" });
+  });
+
+  it("returns render-error without crashing when the render script exits early under a large payload", async () => {
+    const bigFigures = { total: 1250, header: { phone: "44700900000" }, lines: Array.from({ length: 8000 }, (_, i) => ({ item: "i" + i })) };
+    const r = await runRender({ accountDir: dir, renderScriptPath: rs("render-throw.mjs"), figures: bigFigures, signUrl, jobId: "job-big" });
+    expect(r).toMatchObject({ ok: false, reason: "render-error" });
+  });
+});

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/account.ts

@@ -0,0 +1,20 @@
+import { join } from "node:path";
+
+/**
+ * Resolve the account-scoped workspace root. `ACCOUNT_DIR` is the canonical
+ * spawn-set var; fall back to `PLATFORM_ROOT` + `ACCOUNT_ID` exactly as the
+ * memory plugin's kd-classify resolver does. Returns `null` when neither is
+ * resolvable — the caller raises a precise no-account-context fault rather than
+ * running an engine at an empty path. Reading env per call (never at module
+ * init) keeps plugin enumeration with empty env from faulting.
+ */
+export function resolveAccountDir(): string | null {
+  const direct = process.env.ACCOUNT_DIR;
+  if (direct && direct.trim()) return direct;
+  const platformRoot = process.env.PLATFORM_ROOT;
+  const accountId = process.env.ACCOUNT_ID;
+  if (platformRoot && accountId && !accountId.includes("/") && !accountId.includes("..")) {
+    return join(platformRoot, "..", "data", "accounts", accountId);
+  }
+  return null;
+}

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/engine-run.ts

@@ -0,0 +1,80 @@
+// Execute the operator's already-persisted pricing engine as a child process.
+// The engine is the operator's own bespoke script; this module never regenerates
+// it, never parses the method, and embeds no rate/catalogue/roll-up. It fixes the
+// I/O boundary a generated engine conforms to: {methodPath, job, mode} on stdin,
+// figures JSON on stdout. A fault returns zero figures and a distinct cause.
+
+import { spawn } from "node:child_process";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+export type EngineFault = "engine-absent" | "method-absent" | "script-error";
+export type EngineMode = "quote" | "verify";
+
+export type EngineResult =
+  | { ok: true; figures: Record<string, unknown> }
+  | { ok: false; reason: EngineFault; detail: string };
+
+export interface RunEngineArgs {
+  accountDir: string;
+  enginePath: string; // absolute
+  methodPath: string; // absolute
+  job: unknown;
+  mode: EngineMode;
+}
+
+/** Spawn `node <enginePath>` in the account workspace, feed the job on stdin,
+ *  and return the parsed figures. Existence of engine and method is gated first
+ *  so a missing artifact is a named fault, never a script crash. */
+export async function runEngine(a: RunEngineArgs): Promise<EngineResult> {
+  if (!existsSync(a.enginePath)) {
+    return { ok: false, reason: "engine-absent", detail: `no engine at ${a.enginePath}` };
+  }
+  if (!existsSync(a.methodPath)) {
+    return { ok: false, reason: "method-absent", detail: `no method at ${a.methodPath}` };
+  }
+
+  const payload = JSON.stringify({ methodPath: a.methodPath, job: a.job, mode: a.mode });
+  const { code, stdout, stderr } = await new Promise<{ code: number | null; stdout: string; stderr: string }>((resolve) => {
+    const child = spawn("node", [a.enginePath], { cwd: a.accountDir });
+    let out = "";
+    let err = "";
+    child.stdout.on("data", (d) => (out += d));
+    child.stderr.on("data", (d) => (err += d));
+    child.on("error", (e) => resolve({ code: -1, stdout: out, stderr: String(e) }));
+    child.on("close", (c) => resolve({ code: c, stdout: out, stderr: err }));
+    // A script that exits before draining stdin closes the read end mid-write,
+    // raising EPIPE. Swallow it: the exit code from `close` carries the fault, so
+    // an early exit surfaces as script-error rather than crashing the server.
+    child.stdin.on("error", () => {});
+    child.stdin.write(payload);
+    child.stdin.end();
+  });
+
+  if (code !== 0) {
+    return { ok: false, reason: "script-error", detail: `engine exited ${code}: ${stderr.trim().slice(0, 400)}` };
+  }
+
+  let figures: Record<string, unknown>;
+  try {
+    figures = JSON.parse(stdout);
+  } catch {
+    return { ok: false, reason: "script-error", detail: `engine stdout was not JSON: ${stdout.trim().slice(0, 200)}` };
+  }
+
+  const required = a.mode === "quote" ? ["total", "reconcile"] : ["deltas"];
+  const missing = required.filter((k) => !(k in figures));
+  if (missing.length > 0) {
+    return { ok: false, reason: "script-error", detail: `engine output missing required field(s): ${missing.join(", ")}` };
+  }
+
+  return { ok: true, figures };
+}
+
+/** Persist figures to quoting/jobs/<jobId>/figures.json and return the path. */
+export function writeFigures(accountDir: string, jobId: string, figures: unknown): string {
+  const path = join(accountDir, "quoting", "jobs", jobId, "figures.json");
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(figures, null, 2));
+  return path;
+}

package/payload/premium-plugins/sitedesk/plugins/sitedesk-job/mcp/src/lib/gates.ts

@@ -0,0 +1,39 @@
+// The three deterministic, fail-closed gates quote-render enforces on the HTML
+// the operator's render script emits. They are structural checks over stable
+// attributes the render script marks — not business content:
+//   data-quote-total   the displayed grand total (reconcile against the engine)
+//   data-internal-only cost/margin-bearing figures (must be absent from client docs)
+//   data-esign-accept  the client quote's Sign-Online anchor (absolute https only)
+
+export interface ReconcileVerdict { pass: boolean; shown?: number }
+export interface LeakVerdict { pass: boolean }
+export interface SignLinkVerdict { pass: boolean; href?: string; reason?: "no-anchor" | "empty" | "fragment" | "non-https" | "relative" }
+
+/** The document's displayed grand total (data-quote-total) must equal the
+ *  engine total. No marker → fail closed (an unverifiable total is not shipped). */
+export function gateReconcile(html: string, engineTotal: number): ReconcileVerdict {
+  const m = html.match(/data-quote-total="([^"]*)"/i);
+  if (!m || m[1].trim() === "") return { pass: false };
+  const shown = Number(m[1]);
+  if (!Number.isFinite(shown)) return { pass: false };
+  return { pass: shown === engineTotal, shown };
+}
+
+/** A client document carrying a cost/margin marker (data-internal-only) is a
+ *  leak — the boundary is structural, not a matter of remembering to omit. */
+export function gateMarginLeak(html: string): LeakVerdict {
+  return { pass: !/\bdata-internal-only\b/i.test(html) };
+}
+
+/** The client quote's Sign-Online anchor href must be an absolute https URL —
+ *  the same verdict ladder the quote-generation link-liveness gate applies. */
+export function gateSignLink(html: string): SignLinkVerdict {
+  const tag = html.match(/<a[^>]*\bdata-esign-accept\b[^>]*>/i)?.[0];
+  if (!tag) return { pass: false, reason: "no-anchor" };
+  const href = tag.match(/href="([^"]*)"/i)?.[1] ?? "";
+  if (/^https:\/\//i.test(href)) return { pass: true, href };
+  if (href === "") return { pass: false, href, reason: "empty" };
+  if (href.startsWith("#")) return { pass: false, href, reason: "fragment" };
+  if (/^[a-z][a-z0-9+.-]*:/i.test(href)) return { pass: false, href, reason: "non-https" };
+  return { pass: false, href, reason: "relative" };
+}