@rubytech/create-maxy-code 0.1.189 → 0.1.190

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.189",
+  "version": "0.1.190",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/neo4j/schema.cypher

@@ -459,7 +459,8 @@ FOR (n:LocalBusiness|Service|PriceSpecification|OpeningHoursSpecification|Organi
     |EmailAccount
     |Position|Credential|Agent|Idea|Concept
     |VoiceProfile|VoiceEdit|SocialPost|AEOAudit|Page
-    |TimelineEvent|CompiledTruthRevision|Report|OrphanCandidate|CitationProposal)
+    |TimelineEvent|CompiledTruthRevision|Report|OrphanCandidate|CitationProposal
+    |FileArtifact)
 ON EACH [n.name, n.firstName, n.lastName, n.givenName, n.familyName,
          n.title, n.currentTitle, n.summary, n.body, n.content, n.text, n.description, n.headline, n.abstract,
          n.email, n.note, n.label, n.value, n.message, n.preview, n.tagline,
@@ -1724,6 +1725,20 @@ OPTIONS {
   }
 };
 
+// Task 514: physical files on disk indexed as :FileArtifact so the /data
+// search box runs the same hybrid (vector + BM25) retrieval over files that
+// the agent runs over the graph. discoverIndexes() enrols this at boot; the
+// file-index reconciler populates f.embedding (768-d nomic-embed-text over
+// name + extracted content).
+CREATE VECTOR INDEX file_artifact_embedding IF NOT EXISTS
+FOR (f:FileArtifact) ON (f.embedding)
+OPTIONS {
+  indexConfig: {
+    `vector.dimensions`: 768,
+    `vector.similarity_function`: 'cosine'
+  }
+};
+
 CREATE CONSTRAINT orphan_candidate_id_unique IF NOT EXISTS
 FOR (o:OrphanCandidate) REQUIRE o.orphanCandidateId IS UNIQUE;
 

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, file-attach, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,7 +1,7 @@
 ---
 name: admin
 surface: platform
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, file-attach, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective) for managing the Maxy platform."
 tools:
   - name: system-status
     publicAllowlist: false
@@ -57,9 +57,6 @@ tools:
   - name: session-resume
     publicAllowlist: false
     adminAllowlist: true
-  - name: file-attach
-    publicAllowlist: false
-    adminAllowlist: false
   - name: action-pending
     publicAllowlist: false
     adminAllowlist: true
@@ -104,6 +101,8 @@ Platform management tools for both the admin and public agents. The `plugin-read
 
 Tools are available via the `admin` MCP server.
 
+**Admin-seat authoring-skill gate (Task 516).** `skill-load` and `plugin-read` refuse to return the body of a content-producer-owned authoring skill — `professional-document`, `a4-print-documents`, `publish-site` — when the caller is the admin seat (`MAXY_SESSION_ROLE=admin` with no `MAXY_SPECIALIST`). The refusal relays one line — "This deliverable is owned by content-producer. Dispatch it with the Agent tool and subagent_type content-producer." — so the admin's next action is the dispatch, not inline authoring. `plugin-read` extracts the skill slug from a `skills/<slug>/…` file path (or a slug buried in `pluginName`), so the raw-SKILL.md read path can't bypass the gate; `PLUGIN.md` and plain `references/*` reads are untouched. content-producer's own spawns carry `MAXY_SPECIALIST=content-producer` and resolve these skills normally (it reaches them via the native `Skill` tool regardless), and the public seat is out of scope. The gate is a pure name+env check before any filesystem read and fails open for any non-admin or unidentified seat — it never bricks a legitimate load. Each block emits `[admin-skill-gate] role=admin skill=<name> decision=block reason=content-producer-owned`. This is the enforcement layer; the IDENTITY.md delegation paragraph documents the intent but is not the gate ([[feedback_deterministic_means_remove_llm]], [[feedback_doctrine_paragraph_is_not_a_gate]]). Skills the admin invokes directly are deliberately excluded: `unzip-attachment` (its SKILL.md says "Invoked by the admin agent directly — admin owns all unzipping", then routes the extracted tree to a specialist) and `deck-pages` (admin-owned, a content-producer refusal target). The set is each skill's own SKILL.md "Invoked by" declaration, not the admin plugin's skill catalogue (which lists these admin-hosted skills for discovery — the catalogue is the inline path this gate closes).
+
 **Three-store admin auth invariant.** `admin-add` writes to all three identity stores (`users.json` PIN auth at the persistent `~/{configDir}/users.json` location , `account.json` `admins[]` role, Neo4j `:AdminUser`/`:Person` graph identity) with per-leg `[admin-auth-store]` log lines plus the `[admins-write]` chokepoint line, and returns `is_error: true` on any leg failure naming what's already written. `admin-update-pin` writes `users.json` only and emits the same `[admin-auth-store]` line. **Single chokepoint:** every `users.json` + `account.json admins[]` mutation routes through `platform/lib/admins-write` (`writeAdminEntry` for admin-add/set-pin, `removeAdminFromAccount` for admin-remove); the static check `grep -rnE 'admins\.push\|config\.admins\s*=' platform/ \| grep -v lib/admins-write` returns 0. Direct `Edit`/`Write` on `account.json` is blocked at the `pre-tool-use` hook — mutations go through `account-update`, `plugin-toggle-enabled`, or the `admin-*` tools. **Install + boot invariants:** the installer and admin-server boot walk every account.json admins[] vs users.json; `[install-invariant]` / `[admin-invariant] direction=… userId=<id8> source=<file>` fires per divergence with a `check complete divergences=<n>` summary. Log-only — does not block. See `.docs/agents.md` § "Three-store admin auth invariant" for the full contract.
 
 **AdminUser graph stamp + boot self-heal.** The seed cypher in `platform/scripts/seed-neo4j.sh` stamps `:AdminUser.accountId` + `:AdminUser.role='owner'` ON CREATE so the graph-write gate's account-scoped MATCH succeeds on the first user-domain write. Admin-server boot additionally runs `platform/ui/app/lib/adminuser-self-heal.ts` to repair legacy nodes whose `accountId` or `role` is null — emits `[adminuser-self-heal] healed=<N> userId=<8> accountId=<8>` once per boot, idempotent. The `graph-write-gate` reject log gains a `subReason=` field (`no-admin-user-node` / `admin-user-no-accountid` / `no-business-or-personal-profile`) for operator diagnosis. See `.docs/agents.md` § "AdminUser graph stamp contract" for the full contract.

package/payload/platform/plugins/admin/mcp/dist/__tests__/admin-authoring-skill-gate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admin-authoring-skill-gate.test.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/admin-authoring-skill-gate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-authoring-skill-gate.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/admin-authoring-skill-gate.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/admin/mcp/dist/__tests__/admin-authoring-skill-gate.test.js

@@ -0,0 +1,79 @@
+// Admin-seat authoring-skill gate (Task 516).
+//
+// Locks the pure decision helpers that make content-producer-owned
+// authoring skills unreachable from the admin seat via `skill-load` and
+// `plugin-read`. The MCP handlers in index.ts are thin glue over these —
+// they emit the dispatch-hint text and the `[admin-skill-gate]` line — so
+// the decision logic is tested here in isolation, mirroring the
+// loadSkill / findSkillOwners test convention (no stdio transport).
+import { describe, it, expect } from "vitest";
+import { CONTENT_PRODUCER_AUTHORING_SKILLS, isAdminSeat, skillSlugFromReadArgs, adminAuthoringSkillBlock, } from "../skill-resolution.js";
+const ADMIN = { MAXY_SESSION_ROLE: "admin", MAXY_SPECIALIST: "" };
+const CONTENT_PRODUCER = { MAXY_SESSION_ROLE: "admin", MAXY_SPECIALIST: "content-producer" };
+const PUBLIC = { MAXY_SESSION_ROLE: "public", MAXY_SPECIALIST: "" };
+describe("isAdminSeat", () => {
+    it("true only when role is admin and no specialist is set", () => {
+        expect(isAdminSeat(ADMIN)).toBe(true);
+        expect(isAdminSeat({ MAXY_SESSION_ROLE: "admin" })).toBe(true); // specialist undefined
+    });
+    it("false for a specialist seat even when role is admin", () => {
+        expect(isAdminSeat(CONTENT_PRODUCER)).toBe(false);
+    });
+    it("false for the public seat", () => {
+        expect(isAdminSeat(PUBLIC)).toBe(false);
+    });
+    it("false when role is unknown (fail-open — never block an unidentified seat)", () => {
+        expect(isAdminSeat({})).toBe(false);
+    });
+});
+describe("CONTENT_PRODUCER_AUTHORING_SKILLS", () => {
+    it("is exactly the three content-producer-invoked authoring/render/publish skills", () => {
+        expect([...CONTENT_PRODUCER_AUTHORING_SKILLS].sort()).toEqual(["a4-print-documents", "professional-document", "publish-site"].sort());
+    });
+    it("excludes admin-invoked skills (unzip-attachment, deck-pages)", () => {
+        // unzip-attachment SKILL.md: "Invoked by the admin agent directly".
+        // deck-pages is admin-owned (a content-producer refusal target).
+        expect(CONTENT_PRODUCER_AUTHORING_SKILLS.has("unzip-attachment")).toBe(false);
+        expect(CONTENT_PRODUCER_AUTHORING_SKILLS.has("deck-pages")).toBe(false);
+    });
+});
+describe("skillSlugFromReadArgs", () => {
+    it("extracts the slug from a skills/<slug>/SKILL.md file path", () => {
+        expect(skillSlugFromReadArgs("admin", "skills/professional-document/SKILL.md")).toBe("professional-document");
+    });
+    it("extracts the slug from a reference under the skill dir", () => {
+        expect(skillSlugFromReadArgs("admin", "skills/professional-document/references/x.md")).toBe("professional-document");
+    });
+    it("extracts the slug when buried in pluginName", () => {
+        expect(skillSlugFromReadArgs("admin/skills/publish-site", "PLUGIN.md")).toBe("publish-site");
+    });
+    it("returns undefined for PLUGIN.md and plain reference reads", () => {
+        expect(skillSlugFromReadArgs("admin", "PLUGIN.md")).toBeUndefined();
+        expect(skillSlugFromReadArgs("sales", "references/pricing.md")).toBeUndefined();
+    });
+});
+describe("adminAuthoringSkillBlock", () => {
+    it("blocks every content-producer-owned authoring skill from the admin seat", () => {
+        for (const slug of CONTENT_PRODUCER_AUTHORING_SKILLS) {
+            expect(adminAuthoringSkillBlock(slug, ADMIN)).toBe(true);
+        }
+    });
+    it("does not block the admin's own / admin-invoked skills", () => {
+        // unzip-attachment is admin-invoked (admin unzips then routes); deck-pages
+        // is admin-owned. plainly/voice-mirror/datetime are admin operational skills.
+        for (const slug of ["plainly", "voice-mirror", "datetime", "deck-pages", "unzip-attachment"]) {
+            expect(adminAuthoringSkillBlock(slug, ADMIN)).toBe(false);
+        }
+    });
+    it("never blocks the content-producer seat (it owns these skills)", () => {
+        expect(adminAuthoringSkillBlock("professional-document", CONTENT_PRODUCER)).toBe(false);
+    });
+    it("never blocks the public seat (out of scope)", () => {
+        expect(adminAuthoringSkillBlock("professional-document", PUBLIC)).toBe(false);
+    });
+    it("fail-open on an undefined slug or unidentified seat", () => {
+        expect(adminAuthoringSkillBlock(undefined, ADMIN)).toBe(false);
+        expect(adminAuthoringSkillBlock("professional-document", {})).toBe(false);
+    });
+});
+//# sourceMappingURL=admin-authoring-skill-gate.test.js.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/admin-authoring-skill-gate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-authoring-skill-gate.test.js","sourceRoot":"","sources":["../../src/__tests__/admin-authoring-skill-gate.test.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AACzE,0EAA0E;AAC1E,gEAAgE;AAChE,oEAAoE;AACpE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,iCAAiC,EACjC,WAAW,EACX,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,KAAK,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AAClE,MAAM,gBAAgB,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC;AAC7F,MAAM,MAAM,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AAEpE,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB;IACzF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,CAAC,CAAC,GAAG,iCAAiC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAC3D,CAAC,oBAAoB,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,CAAC,iCAAiC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,CAAC,iCAAiC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC,CAAC,IAAI,CAClF,uBAAuB,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC,CAAC,IAAI,CACzF,uBAAuB,CACxB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,qBAAqB,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACpE,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,KAAK,MAAM,IAAI,IAAI,iCAAiC,EAAE,CAAC;YACrD,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,2EAA2E;QAC3E,8EAA8E;QAC9E,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC7F,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,wBAAwB,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -18,7 +18,7 @@ import { createConnection } from "node:net";
 import { homedir, hostname as osHostname } from "node:os";
 import QRCode from "qrcode";
 import { getSession, closeDriver } from "./lib/neo4j.js";
-import { findSkillOwners, computePluginReadHint, loadSkill, parseRequiredInputs } from "./skill-resolution.js";
+import { findSkillOwners, computePluginReadHint, loadSkill, parseRequiredInputs, adminAuthoringSkillBlock, skillSlugFromReadArgs, AUTHORING_DISPATCH_HINT } from "./skill-resolution.js";
 import { resolvePublicHostname } from "./lib/public-hostname.js";
 import { publishSite } from "./tools/publish-site.js";
 function refusalGuidance(kind) {
@@ -1668,6 +1668,16 @@ eagerTool(server, "plugin-read", "Read a plugin definition (PLUGIN.md) or one of
         return refuseNoAccount("plugin-read");
     try {
         const resolvedFile = file ?? "PLUGIN.md";
+        // Task 516 — plugin-read is the raw-SKILL.md read path that would
+        // otherwise bypass the skill-load authoring gate. Block the admin seat
+        // from reading any content-producer-owned authoring skill's files
+        // (SKILL.md or its references); the slug is extracted from the file
+        // path or pluginName. Same fail-open contract as skill-load.
+        const authoringSlug = skillSlugFromReadArgs(pluginName, resolvedFile);
+        if (adminAuthoringSkillBlock(authoringSlug, process.env)) {
+            console.log(`[admin-skill-gate] role=admin skill=${authoringSlug} decision=block reason=content-producer-owned`);
+            return { content: [{ type: "text", text: AUTHORING_DISPATCH_HINT }], isError: true };
+        }
         const pluginPath = resolve(PLATFORM_ROOT, "plugins", pluginName, resolvedFile);
         if (!existsSync(pluginPath)) {
             // when the agent's pluginName/file combination misses
@@ -1796,6 +1806,15 @@ eagerTool(server, "skill-load", "Load a plugin skill's SKILL.md body by skill na
 }, async ({ skillName }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("skill-load");
+    // Task 516 — the admin seat may not load content-producer-owned
+    // authoring skills inline; it must dispatch content-producer instead.
+    // The gate is a pure name+env check before any filesystem read, and
+    // fails open for non-admin / unidentified seats (content-producer's own
+    // spawns carry MAXY_SPECIALIST and resolve normally).
+    if (adminAuthoringSkillBlock(skillName, process.env)) {
+        console.log(`[admin-skill-gate] role=admin skill=${skillName} decision=block reason=content-producer-owned`);
+        return { content: [{ type: "text", text: AUTHORING_DISPATCH_HINT }], isError: true };
+    }
     const start = Date.now();
     try {
         const outcome = await loadSkill(PLATFORM_ROOT, skillName);
@@ -1855,7 +1874,7 @@ eagerTool(server, "skill-load", "Load a plugin skill's SKILL.md body by skill na
 // sentinel that read like a successful render to the agent while the
 // chat surface saw nothing. Admin flows now use plain markdown for
 // reviewable artefacts and the `file-presentation` skill for downloadable
-// artefacts (the skill picks `SendUserFile` or `file-attach` by inventory).
+// artefacts (delivered via `SendUserFile`, the native Claude Code surface).
 // The :Component / :KnowledgeDocument
 // persistence pipeline is preserved for historical conversations that
 // already carry the rows; no new conversations write to it.
@@ -2551,99 +2570,6 @@ server.tool("premium-deliver", "Deliver a purchased premium plugin. Copies plugi
         content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
     };
 });
-// ---------------------------------------------------------------------------
-// file-attach — copy a generated file into the attachment store for download
-// ---------------------------------------------------------------------------
-eagerTool(server, "file-attach", "Attach a file from the account directory for delivery to the user on non-PTY chat " +
-    "surfaces (web chat, WhatsApp) where the platform UI mediates attachment rendering. " +
-    "On the native Claude Code PTY surface, `SendUserFile` is the delivery — `file-attach` " +
-    "returns an `attachmentId` envelope only and renders no chip there. Tool selection is " +
-    "by inventory: see the `file-presentation` skill. Copies the file into the attachment " +
-    "store and returns metadata the chat surface uses to present the download. The file " +
-    "must be within the account directory tree. The returned metadata is the operator-visible " +
-    "record of the attachment; quote it back to the user in plain text so they have the " +
-    "filename and size on screen.", {
-    filePath: z.string().describe("Absolute path to the file to attach"),
-}, async ({ filePath }) => {
-    if (!ACCOUNT_ID)
-        return refuseNoAccount("file-attach");
-    const TAG = "[file-attach]";
-    if (!filePath || !filePath.trim()) {
-        return {
-            content: [{ type: "text", text: `${TAG} filePath is required` }],
-            isError: true,
-        };
-    }
-    const accountDir = getAccountDir();
-    // --- Path validation: must be within the account directory ---
-    let resolvedPath;
-    try {
-        const { realpathSync: rp } = await import("node:fs");
-        resolvedPath = rp(filePath);
-        const accountResolved = rp(accountDir);
-        if (!resolvedPath.startsWith(accountResolved + "/")) {
-            const sanitised = filePath.replace(accountDir, "<account>/");
-            console.error(`${TAG} REJECTED path=${sanitised} reason=outside_account_directory`);
-            return {
-                content: [{ type: "text", text: `${TAG} Access denied: file is outside the account directory.` }],
-                isError: true,
-            };
-        }
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ENOENT") {
-            console.error(`${TAG} ENOENT path=${filePath}`);
-            return {
-                content: [{ type: "text", text: `${TAG} File not found: ${filePath}` }],
-                isError: true,
-            };
-        }
-        console.error(`${TAG} path validation error: ${err instanceof Error ? err.message : String(err)}`);
-        return {
-            content: [{ type: "text", text: `${TAG} Failed to validate file path: ${err instanceof Error ? err.message : String(err)}` }],
-            isError: true,
-        };
-    }
-    // --- Store in attachment store ---
-    const targetUrl = `http://127.0.0.1:${PLATFORM_PORT}/api/admin/file-attach`;
-    try {
-        const res = await fetch(targetUrl, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ filePath: resolvedPath, accountId: ACCOUNT_ID }),
-        });
-        const result = await res.json();
-        if (!res.ok || result.error) {
-            const msg = result.error || `HTTP ${res.status}`;
-            console.error(`${TAG} store failed url=${targetUrl} status=${res.status} error=${msg}`);
-            return {
-                content: [{ type: "text", text: `${TAG} Failed to attach file: ${msg} (url=${targetUrl})` }],
-                isError: true,
-            };
-        }
-        console.error(`${TAG} attached path=${resolvedPath} size=${result.sizeBytes} mime=${result.mimeType} id=${result.attachmentId}`);
-        return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        attachmentId: result.attachmentId,
-                        filename: result.filename,
-                        sizeBytes: result.sizeBytes,
-                        mimeType: result.mimeType,
-                    }),
-                }],
-        };
-    }
-    catch (err) {
-        const errMsg = err instanceof Error ? err.message : String(err);
-        console.error(`${TAG} fetch failed url=${targetUrl} error=${errMsg}`);
-        return {
-            content: [{ type: "text", text: `${TAG} Failed to attach file: could not reach platform server at ${targetUrl} (${errMsg})` }],
-            isError: true,
-        };
-    }
-});
 // ===================================================================
 // Action approval tools (EU AI Act Article 14 — human oversight)
 //