@rubytech/create-maxy-code 0.1.125 → 0.1.127

package/payload/platform/plugins/graph-viewer/skills/render-graph/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: render-graph
+description: "Render an inline PNG of a Neo4j subgraph for the operator using the graph-render MCP tool. Use when the operator asks to 'see the graph', 'show me the subgraph around X', 'render the owner subgraph', or any request whose outcome is a picture of nodes-and-edges they can look at in chat. Never substitute Mermaid, ASCII, or any other graph stand-in: graph-render is the only correct surface, and if it refuses (foreign account, missing node, empty neighbourhood, draw error) surface the structured error to the operator and stop. The image uses the same palette and short-label strings as the admin /graph page; node positions will differ because the renderer is d3-force not vis-network."
+---
+
+# render-graph
+
+When the operator asks for a picture of a subgraph:
+
+1. Resolve the root node's `elementId` first — usually via `memory-search`
+   or another graph tool the operator already pointed you at. Never pass a
+   property like `name` as `nodeId`.
+2. Pick a `hopDepth` between 0 and 3. Default to 1 unless the operator
+   asks for the wider neighbourhood. Depth 3 on a busy node will hit the
+   200-node cap and return a `truncated` envelope.
+3. Call `graph-render` with `{ accountId, nodeId, hopDepth }`.
+4. If the result is `ok: true`, the image attaches itself to your reply.
+   Tell the operator how many nodes are in view and, if `truncated` is
+   present, that there were more nodes than the cap.
+5. If the result is `ok: false`, surface the structured `reason` and
+   `message` to the operator verbatim. Do not retry with a different
+   nodeId without their input. Do not fall back to Mermaid, ASCII, or any
+   other graph substitute.
+
+## Reasons graph-render can refuse
+
+- `scope` — the nodeId belongs to a different account, or does not exist.
+- `empty` — the root exists but its neighbourhood is empty after the
+  trash filter.
+- `cap-exceeded` — reserved for future use; today subgraphs above 200
+  nodes return `ok: true` with a `truncated` envelope.
+- `draw-error` — the canvas renderer failed. The message contains the
+  underlying error; if it mentions a missing font, the system font fallback
+  is unavailable on this device.
+- `invalid-input` — `hopDepth` was outside the 0-3 range.

package/payload/platform/scripts/check-plugin-tools-mcp-consistency.mjs

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+// Publish-time gate: every PLUGIN.md with a non-empty `tools:` frontmatter
+// block must also declare an `mcp:` block. The `tools:` block populates the
+// `--allowed-tools mcp__<plugin>__*` spawn argv; without a registered MCP
+// server the agent boots with permissions for tools that have no backend.
+//
+// The session manager throws the same defect at boot
+// (tool-surface.ts 'mcp-block-missing'), but boot is on the operator's
+// device — by then the bad payload has already been published and installed.
+// This gate fires before `npm publish`, in the prepublishOnly chain.
+//
+// Live repro: Task 357 added visitor-graph tools to buyers/PLUGIN.md without
+// the matching mcp: block; the slip-through is what motivates Task 368.
+
+import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const MAXY_CODE_ROOT = resolve(__dirname, '..', '..')
+
+const PLUGIN_ROOTS = [
+  // platform/plugins/<plugin>/PLUGIN.md
+  { root: join(MAXY_CODE_ROOT, 'platform', 'plugins'), depth: 1 },
+  // premium-plugins/<bundle>/PLUGIN.md           (shape b)
+  { root: join(MAXY_CODE_ROOT, 'premium-plugins'), depth: 1 },
+  // premium-plugins/<bundle>/plugins/<sub>/PLUGIN.md  (shape a)
+  { root: join(MAXY_CODE_ROOT, 'premium-plugins'), depth: 2, mid: 'plugins' },
+]
+
+function collectPluginDirs() {
+  const dirs = []
+  for (const spec of PLUGIN_ROOTS) {
+    if (!existsSync(spec.root)) continue
+    for (const entry of readdirSync(spec.root)) {
+      if (entry.startsWith('.')) continue
+      const lvl1 = join(spec.root, entry)
+      if (!statSync(lvl1).isDirectory()) continue
+      if (spec.depth === 1) {
+        dirs.push(lvl1)
+        continue
+      }
+      const midDir = join(lvl1, spec.mid)
+      if (!existsSync(midDir)) continue
+      if (!statSync(midDir).isDirectory()) continue
+      for (const sub of readdirSync(midDir)) {
+        if (sub.startsWith('.')) continue
+        const lvl2 = join(midDir, sub)
+        if (!statSync(lvl2).isDirectory()) continue
+        dirs.push(lvl2)
+      }
+    }
+  }
+  return dirs
+}
+
+function extractFrontmatter(md) {
+  if (!md.startsWith('---')) return null
+  const end = md.indexOf('\n---', 3)
+  if (end < 0) return null
+  return md.slice(3, end)
+}
+
+// Detect a top-level key in YAML frontmatter (key at column 0, followed by `:`).
+// The key may be bare (`tools:`) — empty value means "block follows on
+// subsequent indented lines" OR "empty list".
+function findTopLevelKey(frontmatter, key) {
+  const re = new RegExp(`^${key}\\s*:`, 'm')
+  return re.test(frontmatter)
+}
+
+// Returns true when the `tools:` block has at least one list entry. A bare
+// `tools:` with no children, or `tools: []`, is treated as empty (no surface).
+function hasNonEmptyToolsBlock(frontmatter) {
+  const lines = frontmatter.split('\n')
+  let inTools = false
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    if (/^tools\s*:/.test(line)) {
+      const after = line.replace(/^tools\s*:/, '').trim()
+      // Inline form: `tools: []` or `tools: [a, b]`
+      if (after.startsWith('[')) {
+        return /\[\s*[^\]\s]/.test(after)
+      }
+      if (after) {
+        // Single-line scalar (unusual for tools, but treat as non-empty).
+        return true
+      }
+      inTools = true
+      continue
+    }
+    if (inTools) {
+      if (/^\S/.test(line) && line.trim() !== '') {
+        // Top-level key after tools: — block ended.
+        return false
+      }
+      if (/^\s*-\s+/.test(line)) return true
+    }
+  }
+  return false
+}
+
+function checkPlugin(pluginDir) {
+  const manifestPath = join(pluginDir, 'PLUGIN.md')
+  if (!existsSync(manifestPath)) return null
+  const raw = readFileSync(manifestPath, 'utf-8')
+  const fm = extractFrontmatter(raw)
+  if (fm === null) return null
+  if (!hasNonEmptyToolsBlock(fm)) return null
+  if (findTopLevelKey(fm, 'mcp')) return null
+  return manifestPath
+}
+
+function main() {
+  const offenders = []
+  for (const dir of collectPluginDirs()) {
+    const offender = checkPlugin(dir)
+    if (offender) offenders.push({ dir, manifestPath: offender })
+  }
+  if (offenders.length === 0) {
+    console.log('[gate] check-plugin-tools-mcp-consistency: PASS')
+    return
+  }
+  for (const { dir, manifestPath } of offenders) {
+    const plugin = dir.split('/').pop()
+    console.error(
+      `[gate] FATAL: plugin=${plugin} has tools: block but no mcp: block.\n` +
+        `  manifest: ${manifestPath}\n` +
+        `  Spawns would pass --allowed-tools mcp__${plugin}__* with no registered server.\n` +
+        `  Add mcp: block or remove tools: entries.`,
+    )
+  }
+  process.exit(1)
+}
+
+main()

package/payload/platform/templates/specialists/agents/content-producer.md

@@ -3,7 +3,7 @@ name: content-producer
 description: "Visual production and static-site hosting. Reads from the populated graph to produce visual artifacts (image generation, PDF rendering, component delivery) and hosts already-prepared static sites by extracting attached archives via unzip-attachment then placing the tree under <accountDir>/sites/<slug>/ via publish-site. Delegate for: generating images, saving rendered pages as PDF, or any 'host this website' / 'publish this site' / 'put this online' intent carrying an HTML+assets archive. Not document ingestion: graph ingestion of any kind routes to specialists:database-operator. Static-site zips are extracted to disk for publication, never written to the graph."
 summary: "Produces visual output from your graph: generates images, renders pages to PDF, and hosts static websites you upload as a zip."
 model: claude-sonnet-4-6
-tools: Bash, mcp__memory__memory-search, mcp__replicate__image-generate, mcp__plugin_playwright_playwright__browser_navigate, mcp__plugin_playwright_playwright__browser_snapshot, mcp__plugin_playwright_playwright__browser_take_screenshot, mcp__plugin_playwright_playwright__browser_pdf_save, mcp__admin__file-attach, mcp__admin__plugin-read, mcp__admin__public-hostname
+tools: Bash, mcp__memory__memory-search, mcp__replicate__image-generate, mcp__plugin_playwright_playwright__browser_navigate, mcp__plugin_playwright_playwright__browser_snapshot, mcp__plugin_playwright_playwright__browser_take_screenshot, mcp__plugin_playwright_playwright__browser_pdf_save, mcp__admin__file-attach, mcp__admin__plugin-read, mcp__admin__public-hostname, mcp__admin__publish-site
 ---
 
 # Content Producer
@@ -34,9 +34,9 @@ Generate the HTML, navigate the Playwright browser to it, and capture with `brow
 
 ## Hosting websites
 
-When a brief carries a "host this website" / "publish this site" / "put this online" intent with a `.zip` of HTML and assets, run the two-skill chain in order: `skill-load skillName=unzip-attachment` then `skill-load skillName=publish-site`. Both ship deterministic Bash entries with mechanically enforced invariants (zip-slip guard, slug regex, refusal taxonomy). Follow the skill, do not paraphrase, do not improvise a fallback server.
+When a brief carries a "host this website" / "publish this site" / "put this online" intent with a `.zip` of HTML and assets, run `skill-load skillName=unzip-attachment` to extract, then call `mcp__admin__publish-site` directly. The tool owns slug validation, the symlink scan, the `mv`, the refusal taxonomy, and the post-publish llms.txt refresh — load `skill-load skillName=publish-site` only if you need the intent-router context. Do not improvise a fallback server.
 
-Confirm the slug with the operator before publishing. The slug is one or more `/`-separated segments under `<accountDir>/sites/`. Refusals are loud-fail; relay the operator message verbatim and stop. On success, emit the canonical path slug (`/sites/<slug>/` or `/sites/<slug>/<file>.html`) as one line for the operator to paste after their public-host root.
+Confirm the slug with the operator before publishing. The slug is one or more `/`-separated segments under `<accountDir>/sites/`. Refusals are loud-fail; relay the tool's `Operator action:` line verbatim and stop. On success, take the `pathSlug` from the tool response, call `mcp__admin__public-hostname`, and surface `https://<hostname><pathSlug>` to the operator as one line.
 
 ## File delivery