@rubytech/create-maxy-code 0.1.216 → 0.1.221

package/payload/platform/plugins/admin/hooks/pre-tool-use.sh

@@ -1,409 +0,0 @@
-#!/usr/bin/env bash
-# PreToolUse hook — enforces agent tool boundaries and approval gating.
-# Usage: pre-tool-use.sh <agent-type>
-# Receives tool call JSON on stdin (from Claude Code hook protocol).
-# Exit 0 = allow, exit 2 = block.
-
-set -uo pipefail
-
-AGENT_TYPE="${1:-public}"
-
-# Source the propagation emitter (Task 560). The library is fail-open;
-# any error path inside it logs to server.log and returns 0, so sourcing
-# never blocks the hook's primary allow/block contract.
-HOOKS_LIB_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)/lib"
-# shellcheck disable=SC1091
-[ -f "$HOOKS_LIB_DIR/hook-emit.sh" ] && source "$HOOKS_LIB_DIR/hook-emit.sh"
-
-# Read stdin — fail closed if unavailable
-if [ -t 0 ]; then
-  # No INPUT yet; propagate with agentId=unknown so the regression is visible.
-  if declare -F hook_emit_decision >/dev/null 2>&1; then
-    hook_emit_decision "unknown" "admin-tool-gate" "?" "block" \
-      "stdin-missing" "Blocked: Cannot determine tool call (no stdin). Failing closed." 2 0
-  fi
-  echo "Blocked: Cannot determine tool call (no stdin). Failing closed." >&2
-  exit 2
-fi
-INPUT=$(cat)
-TOOL_NAME=$(echo "$INPUT" | grep -o '"tool_name":"[^"]*"' | head -1 | cut -d'"' -f4)
-
-# Session id for propagation. Empty / parse-failure routes to "unknown" —
-# the propagator emits the record under agentId=unknown rather than dropping.
-SESSION_ID=$(printf '%s' "$INPUT" | python3 -c '
-import sys, json
-try:
-    print(json.load(sys.stdin).get("session_id", "") or "unknown")
-except Exception:
-    print("unknown")
-' 2>/dev/null || echo "unknown")
-
-# ---------------------------------------------------------------------------
-# Admin agent — code directory protection + approval gating
-# ---------------------------------------------------------------------------
-if [ "$AGENT_TYPE" = "admin" ]; then
-
-  # ── Orchestration-only authoring + research block (Task 529, 559, 566) ───
-  # The admin seat is orchestration + clarification + delivery only.
-  # Write/Edit/MultiEdit/Bash/WebFetch/WebSearch are specialist-owned —
-  # content-producer for authoring, research-assistant for research, the
-  # shell tools for whichever specialist owns the workflow that needs them.
-  # In-window Task subagents must keep these tools (Task 222 regression
-  # class). Maxy MCP `Agent`-spawned specialists are separate top-level
-  # `claude rc` processes — they have no `parent_tool_use_id` but pty-spawner
-  # stamps `MAXY_SPECIALIST=<name>` on the child env (pty-spawner.ts:1601).
-  #
-  # Discriminator (union of positive markers, never path-shape inference):
-  #   parent_tool_use_id non-empty  → in-window Task subagent (allow)
-  #   $MAXY_SPECIALIST non-empty    → maxy MCP Agent specialist (allow)
-  #   $MAXY_SESSION_ROLE = admin    → admin-direct (block, orchestration-only)
-  #   none of the above             → fail closed (missing-marker)
-  #
-  # Adding a future spawn shape that lands neither marker surfaces as a loud
-  # `reason=missing-marker` block, not a silent passthrough or a silent
-  # admin-direct block on legitimate specialist work.
-  case "$TOOL_NAME" in
-    Write|Edit|MultiEdit|Bash|WebFetch|WebSearch)
-      PARENT_TOOL_USE_ID=$(echo "$INPUT" | python3 -c '
-import sys, json
-try:
-    v = json.load(sys.stdin).get("parent_tool_use_id", "")
-    print(v if isinstance(v, str) else "")
-except Exception:
-    print("")
-' 2>/dev/null)
-      SPECIALIST="${MAXY_SPECIALIST:-}"
-      SESSION_ROLE="${MAXY_SESSION_ROLE:-}"
-      if [ -n "$PARENT_TOOL_USE_ID" ] || [ -n "$SPECIALIST" ]; then
-        # Subagent — passthrough. Tool name resolves on the subagent's
-        # own frontmatter `tools:` allowlist downstream.
-        SOURCE="task-subagent"
-        if [ -n "$SPECIALIST" ] && [ -n "$PARENT_TOOL_USE_ID" ]; then
-          SOURCE="task-subagent+mcp-specialist"
-        elif [ -n "$SPECIALIST" ]; then
-          SOURCE="mcp-specialist"
-        fi
-        echo "[admin-tool-gate] role=subagent parent_tool_use_id=${PARENT_TOOL_USE_ID:--} specialist=${SPECIALIST:--} session_role=${SESSION_ROLE:--} tool=${TOOL_NAME} decision=allow source=${SOURCE}" >&2
-      elif [ "$SESSION_ROLE" = "admin" ]; then
-        # Admin direct invocation — refuse with dispatch hint.
-        case "$TOOL_NAME" in
-          Write|Edit|MultiEdit)
-            OWNER="content-producer"
-            ;;
-          Bash)
-            OWNER="the specialist that owns the workflow needing shell access"
-            ;;
-          WebFetch|WebSearch)
-            OWNER="research-assistant"
-            ;;
-        esac
-        echo "[admin-tool-gate] role=admin parent_tool_use_id=- specialist=- session_role=admin tool=${TOOL_NAME} decision=block reason=orchestration-only owner=${OWNER}" >&2
-        hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-          "orchestration-only" \
-          "Blocked: \`${TOOL_NAME}\` is not callable from the admin seat. The admin seat is orchestration + clarification + delivery only — authoring, shell work, and web research are owned by specialists.
-Dispatch the work to ${OWNER} via the Agent tool."
-      else
-        # No positive marker — fail closed. A new spawn shape that lands
-        # neither parent_tool_use_id nor MAXY_SPECIALIST and is not the
-        # admin seat should surface visibly, not silently pass or silently
-        # block under the wrong reason.
-        echo "[admin-tool-gate] role=unknown parent_tool_use_id=- specialist=- session_role=${SESSION_ROLE:--} tool=${TOOL_NAME} decision=block reason=missing-marker" >&2
-        hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-          "missing-marker" \
-          "Blocked: \`${TOOL_NAME}\` call carries no positive role marker (no parent_tool_use_id, no MAXY_SPECIALIST, MAXY_SESSION_ROLE is not 'admin'). Failing closed so a new spawn shape cannot silently bypass orchestration gating."
-      fi
-      ;;
-  esac
-
-  # ── Code directory protection ────────────────────────────────────────────
-  case "$TOOL_NAME" in
-    Write|Edit)
-      FILE_PATH=$(echo "$INPUT" | grep -o '"file_path":"[^"]*"' | head -1 | cut -d'"' -f4)
-      case "$FILE_PATH" in
-        # Platform UI source (platform/ui/) — source lives here, not on device
-        */platform/ui/app/*|*/platform/ui/lib/*|*/platform/ui/*.ts|*/platform/ui/*.tsx|*/platform/ui/*.mjs)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "code-dir-protection-ui" \
-            "Blocked: Admin agent cannot modify platform UI source at $FILE_PATH"
-          ;;
-        # Compiled MCP servers, hooks, and scripts — what actually ships to device
-        */platform/plugins/*/mcp/dist/*|*/platform/plugins/*/hooks/*|*/platform/scripts/*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "code-dir-protection-platform" \
-            "Blocked: Admin agent cannot modify platform code at $FILE_PATH"
-          ;;
-        # Entitlement library — verifier source, compiled output, vendored
-        # pubkey, hash file, and any signed entitlement.json. Tampering here is the
-        # agent path to revenue bypass; the legitimate write path is the Rubytech
-        # issuance endpoint, never the agent's filesystem.
-        # Patterns intentionally cover both absolute (*/...) and relative
-        # (no leading slash) paths so an agent can't bypass via cwd-relative writes.
-        */platform/lib/entitlement/*|platform/lib/entitlement/*|*/entitlement.json|entitlement.json)
-          echo "[entitlement] tool-deny: tool=${TOOL_NAME} path=${FILE_PATH} field=entitlement-file" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "entitlement-file" \
-            "Blocked: Admin agent cannot modify entitlement files at $FILE_PATH. Effective tier and purchasedPlugins derive from a Rubytech-signed payload."
-          ;;
-        # account.json — agent must use the account-update
-        # MCP tool (or plugin-toggle-enabled for enabledPlugins changes), which
-        # whitelists editable fields server-side. Direct Edit/Write bypasses
-        # that whitelist; deny unconditionally including cwd-relative paths.
-        # adds */account.json and *account.json as a backstop so any
-        # layout the named patterns miss is still caught — the Adam Mackay
-        # incident showed a tier upgrade via raw Edit on account.json reach
-        # the disk, exactly the failure mode this hook exists to prevent.
-        */data/accounts/*/account.json|*/config/accounts/*/account.json|data/accounts/*/account.json|config/accounts/*/account.json|*/account.json|*account.json|account.json)
-          echo "[entitlement] tool-deny: tool=${TOOL_NAME} path=${FILE_PATH} field=account-json" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "account-json" \
-            "Blocked: Admin agent cannot edit account.json directly. Use the account-update or plugin-toggle-enabled MCP tools — they whitelist editable fields server-side and exclude tier and purchasedPlugins by design."
-          ;;
-        # Pending action queue — only the hook and MCP tools may write here
-        */pending-actions/*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "pending-actions" \
-            "Blocked: Admin agent cannot modify pending action files directly"
-          ;;
-      esac
-      ;;
-    Bash)
-      # Block shell commands referencing protected code directories or pending actions
-      case "$INPUT" in
-        *"platform/ui/app/"*|*"platform/ui/lib/"*|*"platform/plugins/"*"hooks/"*|*"platform/scripts/"*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "code-dir-protection-bash" \
-            "Blocked: Admin agent cannot run shell commands against code directories"
-          ;;
-        # Entitlement files via shell — same surface, blocked symmetrically
-        *"platform/lib/entitlement/"*|*"entitlement.json"*)
-          echo "[entitlement] tool-deny: tool=Bash path=entitlement-file field=entitlement-file" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "entitlement-shell" \
-            "Blocked: Admin agent cannot reference entitlement files via shell."
-          ;;
-        # account.json via shell — same rationale as Edit/Write block
-        *"data/accounts/"*"account.json"*|*"config/accounts/"*"account.json"*)
-          echo "[entitlement] tool-deny: tool=Bash path=account-json field=account-json" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "account-json-shell" \
-            "Blocked: Admin agent cannot edit account.json via shell. Use the account-update MCP tool."
-          ;;
-        *"pending-actions/"*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "pending-actions-shell" \
-            "Blocked: Admin agent cannot modify pending action files via shell"
-          ;;
-      esac
-      ;;
-  esac
-
-  # ── Base64 context-overflow guard ─────────────────────────────
-  # Block inline base64 payloads from reaching the model context. Two paths:
-  #
-  #   1. Bash command that ENCODES a binary file to base64/hex (the producer).
-  #   2. Write/Edit content carrying an inline `data:<mime>;base64,…` blob
-  #      (the consumer — agent quoting bytes from a prior tool_result into a
-  #      HTML/markdown Write).
-  #
-  # Either path landed ~33 KB of base64 in the SDK request and the next turn
-  # tripped `main_stream_stalled` at 180 s. The
-  # remediation is symmetric: the agent saves bytes to `$ACCOUNT_DIR/tmp/<sha1>.<ext>`
-  # and references the path (`<img src="./file">` or Read-by-path) instead of
-  # carrying bytes through the assistant turn.
-  #
-  # Parsing uses python3 (already a hook dependency at the action-id site
-  # below); grep on JSON is unsafe for content with escaped quotes or
-  # embedded newlines. Parse failure is fail-open (empty extracted string,
-  # no match, allow) — matches the playwright-file-guard fail-open contract.
-  # Single python3 invocation parses the JSON, runs the tool-specific
-  # regex match (avoiding BSD-vs-GNU grep interval-count incompatibilities —
-  # `grep -E '{4096,}'` errors with "invalid repetition count(s)" on macOS
-  # BSD grep under some pattern combinations), and prints the rejection
-  # outcome to stdout as `REJECT:<reason>:<bytes>` or `ALLOW`. The wrapping
-  # bash logic reads the verdict and emits the rejection log/stderr/exit-2.
-  # Parse failure prints `ALLOW` (fail-open, matching the playwright-file-
-  # guard contract for malformed stdin).
-  GUARD_VERDICT=$(echo "$INPUT" | python3 -c '
-import sys, json, re
-try:
-    d = json.load(sys.stdin)
-    tool = d.get("tool_name", "")
-    ti = d.get("tool_input", {}) or {}
-    if tool in ("Write", "Edit"):
-        # Write.content OR Edit.new_string can carry inline base64.
-        content = ti.get("content") or ti.get("new_string") or ""
-        if not isinstance(content, str):
-            print("ALLOW"); sys.exit(0)
-        # data:<mime>;base64,<≥4096 base64 chars> — threshold matches the
-        # doctrine paragraph in .docs/agents.md. The 4096-char body is
-        # ~3 KB binary, far above any legitimate inline icon.
-        m = re.search(r"data:[^;]+;base64,[A-Za-z0-9+/]{4096,}={0,2}", content)
-        if m:
-            print(f"REJECT:base64-write-content:{len(content)}")
-        else:
-            print("ALLOW")
-    elif tool == "Bash":
-        command = ti.get("command", "")
-        if not isinstance(command, str):
-            print("ALLOW"); sys.exit(0)
-        # Per-segment scan. A compound command like
-        #   cat in.b64 | base64 -d > out.bin; cat photo.png | base64
-        # contains both a legitimate decode AND a malicious encoder. A whole-
-        # command decode-flag check is fooled into allowing the encoder. Split
-        # on shell separators (;, &&, ||, &) and scan each segment as its own
-        # command — the encoder rejection fires when ANY segment is a bare
-        # base64 invocation without a paired decode flag in the SAME segment.
-        # Pipelines (|) keep the segment together because the encoder direction
-        # of `cat file | base64` lives across the pipe.
-        segments = re.split(r";|&&|\|\||(?<![|&])&(?![|&])", command)
-        rejected = None
-        for seg in segments:
-            if re.search(r"(?:^|[\s|;&])xxd[\t ]+-p(?![A-Za-z0-9_-])", seg):
-                rejected = "xxd-plain-hex"; break
-            if re.search(r"(?:^|[\s|;&])base64(?![A-Za-z0-9_-])", seg):
-                if not re.search(r"base64[\t ]+[^|]*(?:-d|-D|--decode)(?![A-Za-z0-9_])", seg):
-                    rejected = "base64-encoder"; break
-        if rejected:
-            print(f"REJECT:{rejected}:{len(command)}")
-        else:
-            print("ALLOW")
-    else:
-        print("ALLOW")
-except Exception:
-    print("ALLOW")
-' 2>/dev/null || echo "ALLOW")
-  case "$GUARD_VERDICT" in
-    REJECT:base64-write-content:*)
-      BYTES="${GUARD_VERDICT##*:}"
-      echo "[pre-tool-use] guard=base64-write-content bytes=${BYTES} action=reject" >&2
-      hook_block_with_emit "$SESSION_ID" "base64-guard" "${TOOL_NAME}" \
-        "base64-write-content" \
-        "Blocked: ${TOOL_NAME} content carries an inline base64 payload (>4 KB encoded). Inline binary in Write.content overloads the model context — the same path produced a main_stream_stalled at ~33 KB on 2026-05-09.
-Save the bytes to \$ACCOUNT_DIR/tmp/<sha1>.<ext> via Bash (e.g. 'base64 -d > out.png'), then reference the file from the document: <img src=\"./<file>\"> or Read-by-path. Do not carry binary bytes through the assistant turn."
-      ;;
-    REJECT:base64-encoder:*|REJECT:xxd-plain-hex:*)
-      REASON="${GUARD_VERDICT#REJECT:}"; REASON="${REASON%:*}"
-      BYTES="${GUARD_VERDICT##*:}"
-      echo "[pre-tool-use] guard=base64-tool-result bytes=${BYTES} tool=Bash reason=${REASON} action=reject" >&2
-      hook_block_with_emit "$SESSION_ID" "base64-guard" "Bash" \
-        "$REASON" \
-        "Blocked: Bash command would emit binary as inline base64/hex to stdout, which lands in the assistant turn and overloads the model context (the 2026-05-09 Rubytech-invoice path hit 66% context after a single ~33 KB tool_result).
-Instead: save the bytes directly to \$ACCOUNT_DIR/tmp/<sha1>.<ext> and operate on the file via path — Read for inspection, <img src=\"./<file>\"> for HTML embedding, the \`file-presentation\` skill for delivery. Decoding base64 (e.g. 'base64 -d in.b64 > out.bin') is allowed."
-      ;;
-    *)
-      : # ALLOW — fall through to approval gating below
-      ;;
-  esac
-
-  # ── Approval gating (EU AI Act Article 14 — human oversight) ─────────────
-  # Strip the mcp__<plugin>__ prefix to get the short tool name.
-  # Built-in tools (no prefix) pass through unchanged.
-  SHORT_NAME=$(echo "$TOOL_NAME" | sed 's/^mcp__[^_]*__//')
-
-  # Derive platform root from this hook's location:
-  #   platform/plugins/admin/hooks/pre-tool-use.sh → platform/
-  HOOK_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
-  PLATFORM_ROOT="${HOOK_DIR}/../../.."
-
-  # Resolve the single account directory (Phase 0).
-  ACCOUNTS_DIR="${PLATFORM_ROOT}/../data/accounts"
-  ACCOUNT_DIR=""
-  if [ -d "$ACCOUNTS_DIR" ]; then
-    ACCOUNT_DIR=$(find "$ACCOUNTS_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | head -1)
-  fi
-
-  # Default require-review tools — matches DEFAULT_REQUIRE_REVIEW in claude-agent.ts
-  DEFAULT_REQUIRE_REVIEW="email-send email-reply whatsapp-send whatsapp-send-document message contact-erase"
-
-  # Check if this tool requires approval review.
-  # 1. Read per-account override from account.json approvalPolicy (if it exists)
-  # 2. Fall back to the default require-review list
-  POLICY=""
-  if [ -n "$ACCOUNT_DIR" ] && [ -f "${ACCOUNT_DIR}/account.json" ]; then
-    # Check per-account override first (grep for the tool name in the approvalPolicy block)
-    OVERRIDE=$(grep -o "\"${SHORT_NAME}\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" "${ACCOUNT_DIR}/account.json" 2>/dev/null | head -1 | grep -o '"[^"]*"$' | tr -d '"')
-    if [ -n "$OVERRIDE" ]; then
-      POLICY="$OVERRIDE"
-    fi
-  fi
-
-  # If no per-account override, check the default list
-  if [ -z "$POLICY" ]; then
-    for TOOL in $DEFAULT_REQUIRE_REVIEW; do
-      if [ "$SHORT_NAME" = "$TOOL" ]; then
-        POLICY="require-review"
-        break
-      fi
-    done
-  fi
-
-  # If not in any policy, auto-execute (allow)
-  if [ "$POLICY" != "require-review" ]; then
-    exit 0
-  fi
-
-  # ── Special case: contact-erase preview calls pass through ───────────────
-  # The contact-erase tool has a two-step flow: first call with confirm:false
-  # returns a preview (data counts), second call with confirm:true executes.
-  # Only gate the destructive confirm:true call.
-  if [ "$SHORT_NAME" = "contact-erase" ]; then
-    if ! echo "$INPUT" | grep -q '"confirm"[[:space:]]*:[[:space:]]*true'; then
-      exit 0
-    fi
-  fi
-
-  # ── Queue the action for approval ───────────────────────────────────────
-  PENDING_DIR="${ACCOUNT_DIR}/pending-actions"
-  mkdir -p "$PENDING_DIR" 2>/dev/null
-
-  ACTION_ID="$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())' 2>/dev/null || date +%s%N)"
-  CREATED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-
-  # Write atomically: temp file + mv
-  TEMP=$(mktemp "${PENDING_DIR}/.tmp.XXXXXX" 2>/dev/null)
-  if [ -z "$TEMP" ]; then
-    hook_block_with_emit "$SESSION_ID" "approval-gate" "${TOOL_NAME}" \
-      "approval-queue-mktemp" \
-      "Blocked: Action requires approval but failed to create queue file (disk error). Failing closed."
-  fi
-
-  # The pending action file contains the full hook JSON (tool_name + tool_input)
-  # plus metadata. The MCP approval tools parse it with Node.js JSON.parse.
-  cat > "$TEMP" <<ENDJSON
-{
-  "actionId": "${ACTION_ID}",
-  "toolName": "${SHORT_NAME}",
-  "pluginName": "$(echo "$TOOL_NAME" | sed -n 's/^mcp__\([^_]*\)__.*/\1/p')",
-  "hookPayload": ${INPUT},
-  "state": "pending",
-  "createdAt": "${CREATED_AT}"
-}
-ENDJSON
-
-  if ! mv "$TEMP" "${PENDING_DIR}/${ACTION_ID}.json" 2>/dev/null; then
-    rm -f "$TEMP" 2>/dev/null
-    hook_block_with_emit "$SESSION_ID" "approval-gate" "${TOOL_NAME}" \
-      "approval-queue-mv" \
-      "Blocked: Action requires approval but failed to queue (filesystem error). Failing closed."
-  fi
-
-  # Record the queued-for-approval block in the propagation buffer; the
-  # readable summary still goes to stdout (CC attaches it as the agent's
-  # tool_result). hook_emit_decision is the no-exit variant — the
-  # subsequent echoes + exit 2 below remain the operator-facing surface.
-  hook_emit_decision "$SESSION_ID" "approval-gate" "${TOOL_NAME}" \
-    "block" "approval-queued" \
-    "Action ${ACTION_ID} queued for review" 2 0
-
-  # Extract a readable summary of the action for the agent to present
-  # tool_input is the second JSON value in the hook payload
-  echo "Action requires approval before execution."
-  echo ""
-  echo "Action ID: ${ACTION_ID}"
-  echo "Tool: ${SHORT_NAME}"
-  echo "Status: Queued for review"
-  echo ""
-  echo "The admin must approve this action before it can execute."
-  echo "Use action-approve to send, action-reject to cancel, or action-edit to modify."
-  exit 2
-fi

package/payload/premium-plugins/writer-craft/lib/mcp-eager/dist/index.d.ts

@@ -1,116 +0,0 @@
-/**
- * MCP eager-load helper.
- *
- * The Claude Code SDK marks every MCP tool as deferred-by-default: the model
- * cannot invoke an MCP tool until it has first called `ToolSearch` to load
- * the schema, which costs one extra turn per unique schema. The SDK's per-
- * tool override is `_meta["anthropic/alwaysLoad"]: true` on the tool's
- * `tools/list` entry, which `isDeferredTool` reads to flip the default.
- *
- * The MCP SDK exposes that channel only via `server.registerTool(name,
- * config, handler)`; the older `server.tool(name, desc, schema, handler)`
- * has no `_meta` parameter. This helper wraps the registerTool call so
- * every plugin's index.ts can opt a tool into eager-load with one line
- * matching the shape of the existing four-arg `server.tool` overload.
- *
- * Use for every tool that appears in `ADMIN_CORE_TOOLS` — the permission
- * allow-list IS the curation per the CEO review. Tools the
- * admin should not see should be removed from the allow-list, not merely
- * left deferred.
- */
-/** Wire-format metadata key the Claude Code SDK reads. */
-export declare const ALWAYS_LOAD_META_KEY: "anthropic/alwaysLoad";
-/**
- * Admin-seat detection. The rc-daemon exports `MAXY_SESSION_ROLE=admin` and
- * `MAXY_SPECIALIST=""` for the orchestrator process and its MCP plugin
- * children; specialist spawns set `MAXY_SPECIALIST=<name>`. A plugin process
- * inheriting the env can therefore decide at registration AND invocation
- * time whether it is loaded inside the admin seat.
- *
- * Mirrors `isAdminSeat` in platform/plugins/admin/mcp/src/skill-resolution.ts
- * — this is a duplicate at the library layer so plugins that cannot import
- * from the admin plugin (a sibling, not a dependency) share the same rule.
- */
-export declare function isAdminSeat(env?: NodeJS.ProcessEnv): boolean;
-/**
- * MCP refusal envelope returned when the admin seat invokes a specialist-
- * owned tool. The text names the dispatch route so the model's next action
- * is the `Agent` dispatch rather than a dead end.
- */
-export declare function adminBlockedResponse(toolName: string, owner: string): {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: true;
-};
-/**
- * Wrap a tool handler so any admin-seat invocation short-circuits with the
- * refusal envelope above and emits one `[admin-tool-gate]` line to stderr.
- *
- * Specialist seats pass through unchanged: this is the primitive Task 529
- * defines for closing the in-message authoring path that Task 516 could
- * not reach. The handler signature is preserved so existing call sites
- * substitute `eagerTool(... handler)` for `eagerTool(... withAdminGate(name,
- * owner, handler))` mechanically.
- */
-export declare function withAdminGate<H extends (...args: any[]) => any>(toolName: string, owner: string, handler: H): H;
-/**
- * Loose structural type for any object exposing a `registerTool` method. The
- * MCP SDK ships dual ESM/CJS packages with conditional exports, so importing
- * the concrete `McpServer` type here would force every consumer to compile
- * under the same resolution mode — they don't. Keep this contract minimal:
- * we only need the method to exist; we cast internally to drive the
- * upstream generic overloads which differ between SDK versions.
- */
-type EagerCapableServer = {
-    registerTool: (...args: any[]) => any;
-};
-/**
- * Local structural type for a Zod raw shape. We deliberately do NOT import
- * `ZodRawShape` from zod itself — plugin workspaces ship pinned zod v3 in
- * their nested `node_modules/zod`, while `platform/node_modules/zod` is v4,
- * and the two `ZodRawShape` types are structurally incompatible (v4
- * introduced the `_zod` brand on `ZodType`). A typed-by-value `unknown`
- * member is enough: TypeScript treats it as compatible with both v3 and v4
- * shapes, while still constraining the generic to "an object whose values
- * are zod-like" so the caller's destructured handler args stay typed via
- * the SDK's own overload resolution downstream.
- */
-type LocalZodRawShape = Record<string, unknown>;
-/**
- * Register an MCP tool that the Claude Code SDK eager-loads into the
- * model's prompt at session boot, bypassing the ToolSearch round-trip.
- *
- * Mirrors the four-arg `server.tool(name, description, inputSchema, handler)`
- * call shape — the only overload in use across our plugins — so callers
- * replace `server.tool(` with `eagerTool(server, ` mechanically.
- *
- * The helper deliberately does not constrain handler-arg types itself; the
- * downstream `server.registerTool` invocation inside this function passes
- * the shape through, and the upstream MCP SDK's overload (resolved against
- * the consumer's own zod version) infers the handler args.
- */
-export declare function eagerTool<Args extends LocalZodRawShape>(server: EagerCapableServer, name: string, description: string, inputSchema: Args, handler: (...args: any[]) => any): void;
-/**
- * Loose structural type for the legacy four-arg `server.tool(name, desc,
- * schema, handler)` call shape — used when the admin seat must register a
- * specialist-owned tool as deferred (not eager) so it does not appear in
- * the admin's eager tool list.
- */
-type DeferredCapableServer = {
-    tool: (name: string, description: string, inputSchema: any, handler: (...args: any[]) => any) => any;
-};
-/**
- * Register a tool that is eager for specialists but deferred + admin-gated
- * for the admin seat. The owning specialist name is named here so the
- * refusal envelope (and the `[admin-tool-gate]` log line) carries it.
- *
- * Use for every tool whose owner is a specialist (database-operator, writer-
- * craft, research-assistant, personal-assistant, content-producer). The
- * admin seat sees the tool only via ToolSearch — and any invocation from the
- * admin seat refuses with the dispatch hint.
- */
-export declare function eagerToolGated<Args extends LocalZodRawShape>(server: EagerCapableServer & DeferredCapableServer, name: string, owner: string, description: string, inputSchema: Args, handler: (...args: any[]) => any): void;
-export {};
-//# sourceMappingURL=index.d.ts.map

package/payload/premium-plugins/writer-craft/lib/mcp-eager/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,EAAG,sBAA+B,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IACrE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1C,OAAO,EAAE,IAAI,CAAC;CACf,CAYA;AAED;;;;;;;;;GASG;AAEH,wBAAgB,aAAa,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAC7D,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,CAAC,GACT,CAAC,CAYH;AAED;;;;;;;GAOG;AAEH,KAAK,kBAAkB,GAAG;IAAE,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,SAAS,gBAAgB,EACrD,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,IAAI,EAEjB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAC/B,IAAI,CAUN;AAED;;;;;GAKG;AAEH,KAAK,qBAAqB,GAAG;IAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,KAAK,GAAG,CAAA;CAAE,CAAC;AAEtI;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,SAAS,gBAAgB,EAC1D,MAAM,EAAE,kBAAkB,GAAG,qBAAqB,EAClD,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,IAAI,EAEjB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAC/B,IAAI,CAMN"}

package/payload/premium-plugins/writer-craft/lib/mcp-eager/dist/index.js

@@ -1,125 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ALWAYS_LOAD_META_KEY = void 0;
-exports.isAdminSeat = isAdminSeat;
-exports.adminBlockedResponse = adminBlockedResponse;
-exports.withAdminGate = withAdminGate;
-exports.eagerTool = eagerTool;
-exports.eagerToolGated = eagerToolGated;
-/**
- * MCP eager-load helper.
- *
- * The Claude Code SDK marks every MCP tool as deferred-by-default: the model
- * cannot invoke an MCP tool until it has first called `ToolSearch` to load
- * the schema, which costs one extra turn per unique schema. The SDK's per-
- * tool override is `_meta["anthropic/alwaysLoad"]: true` on the tool's
- * `tools/list` entry, which `isDeferredTool` reads to flip the default.
- *
- * The MCP SDK exposes that channel only via `server.registerTool(name,
- * config, handler)`; the older `server.tool(name, desc, schema, handler)`
- * has no `_meta` parameter. This helper wraps the registerTool call so
- * every plugin's index.ts can opt a tool into eager-load with one line
- * matching the shape of the existing four-arg `server.tool` overload.
- *
- * Use for every tool that appears in `ADMIN_CORE_TOOLS` — the permission
- * allow-list IS the curation per the CEO review. Tools the
- * admin should not see should be removed from the allow-list, not merely
- * left deferred.
- */
-/** Wire-format metadata key the Claude Code SDK reads. */
-exports.ALWAYS_LOAD_META_KEY = "anthropic/alwaysLoad";
-/**
- * Admin-seat detection. The rc-daemon exports `MAXY_SESSION_ROLE=admin` and
- * `MAXY_SPECIALIST=""` for the orchestrator process and its MCP plugin
- * children; specialist spawns set `MAXY_SPECIALIST=<name>`. A plugin process
- * inheriting the env can therefore decide at registration AND invocation
- * time whether it is loaded inside the admin seat.
- *
- * Mirrors `isAdminSeat` in platform/plugins/admin/mcp/src/skill-resolution.ts
- * — this is a duplicate at the library layer so plugins that cannot import
- * from the admin plugin (a sibling, not a dependency) share the same rule.
- */
-function isAdminSeat(env = process.env) {
-    return env.MAXY_SESSION_ROLE === "admin" && !(env.MAXY_SPECIALIST && env.MAXY_SPECIALIST.length > 0);
-}
-/**
- * MCP refusal envelope returned when the admin seat invokes a specialist-
- * owned tool. The text names the dispatch route so the model's next action
- * is the `Agent` dispatch rather than a dead end.
- */
-function adminBlockedResponse(toolName, owner) {
-    return {
-        content: [
-            {
-                type: "text",
-                text: `Tool \`${toolName}\` is owned by the \`${owner}\` specialist and is not callable from the admin seat. ` +
-                    `Dispatch \`${owner}\` with the Agent tool and pass the work as the brief.`,
-            },
-        ],
-        isError: true,
-    };
-}
-/**
- * Wrap a tool handler so any admin-seat invocation short-circuits with the
- * refusal envelope above and emits one `[admin-tool-gate]` line to stderr.
- *
- * Specialist seats pass through unchanged: this is the primitive Task 529
- * defines for closing the in-message authoring path that Task 516 could
- * not reach. The handler signature is preserved so existing call sites
- * substitute `eagerTool(... handler)` for `eagerTool(... withAdminGate(name,
- * owner, handler))` mechanically.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function withAdminGate(toolName, owner, handler) {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const wrapped = ((...args) => {
-        if (isAdminSeat(process.env)) {
-            process.stderr.write(`[admin-tool-gate] role=admin tool=${toolName} decision=block reason=specialist-owned owner=${owner}\n`);
-            return adminBlockedResponse(toolName, owner);
-        }
-        return handler(...args);
-    });
-    return wrapped;
-}
-/**
- * Register an MCP tool that the Claude Code SDK eager-loads into the
- * model's prompt at session boot, bypassing the ToolSearch round-trip.
- *
- * Mirrors the four-arg `server.tool(name, description, inputSchema, handler)`
- * call shape — the only overload in use across our plugins — so callers
- * replace `server.tool(` with `eagerTool(server, ` mechanically.
- *
- * The helper deliberately does not constrain handler-arg types itself; the
- * downstream `server.registerTool` invocation inside this function passes
- * the shape through, and the upstream MCP SDK's overload (resolved against
- * the consumer's own zod version) infers the handler args.
- */
-function eagerTool(server, name, description, inputSchema, 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-handler) {
-    server.registerTool(name, {
-        description,
-        inputSchema,
-        _meta: { [exports.ALWAYS_LOAD_META_KEY]: true },
-    }, handler);
-}
-/**
- * Register a tool that is eager for specialists but deferred + admin-gated
- * for the admin seat. The owning specialist name is named here so the
- * refusal envelope (and the `[admin-tool-gate]` log line) carries it.
- *
- * Use for every tool whose owner is a specialist (database-operator, writer-
- * craft, research-assistant, personal-assistant, content-producer). The
- * admin seat sees the tool only via ToolSearch — and any invocation from the
- * admin seat refuses with the dispatch hint.
- */
-function eagerToolGated(server, name, owner, description, inputSchema, 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-handler) {
-    if (isAdminSeat(process.env)) {
-        server.tool(name, description, inputSchema, withAdminGate(name, owner, handler));
-        return;
-    }
-    eagerTool(server, name, description, inputSchema, handler);
-}
-//# sourceMappingURL=index.js.map

package/payload/premium-plugins/writer-craft/lib/mcp-eager/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAkCA,kCAEC;AAOD,oDAeC;AAaD,sCAgBC;AAuCD,8BAiBC;AAqBD,wCAcC;AAlLD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,0DAA0D;AAC7C,QAAA,oBAAoB,GAAG,sBAA+B,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,SAAgB,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,OAAO,GAAG,CAAC,iBAAiB,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,QAAgB,EAAE,KAAa;IAIlE,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EACF,UAAU,QAAQ,wBAAwB,KAAK,yDAAyD;oBACxG,cAAc,KAAK,wDAAwD;aAC9E;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,8DAA8D;AAC9D,SAAgB,aAAa,CAC3B,QAAgB,EAChB,KAAa,EACb,OAAU;IAEV,8DAA8D;IAC9D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,IAAW,EAAE,EAAE;QAClC,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC,QAAQ,iDAAiD,KAAK,IAAI,CACxG,CAAC;YACF,OAAO,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAiB,CAAC;IACnB,OAAO,OAAO,CAAC;AACjB,CAAC;AA0BD;;;;;;;;;;;;GAYG;AACH,SAAgB,SAAS,CACvB,MAA0B,EAC1B,IAAY,EACZ,WAAmB,EACnB,WAAiB;AACjB,8DAA8D;AAC9D,OAAgC;IAEhC,MAAM,CAAC,YAAY,CACjB,IAAI,EACJ;QACE,WAAW;QACX,WAAW;QACX,KAAK,EAAE,EAAE,CAAC,4BAAoB,CAAC,EAAE,IAAI,EAAE;KACxC,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAWD;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAC5B,MAAkD,EAClD,IAAY,EACZ,KAAa,EACb,WAAmB,EACnB,WAAiB;AACjB,8DAA8D;AAC9D,OAAgC;IAEhC,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC"}