@rubytech/create-maxy-code 0.1.440 → 0.1.441

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.440",
+  "version": "0.1.441",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:81b544b4ce131682cab873b1c561b196496d3f57fade3f76245646e3fc16aacc
+content-hash: sha256:9f7fc73400d2f9cf942e2df6f544bc69b95abe820ac1ff9b529807c3c7fd6407
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2031,6 +2031,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 2. **Per account: register the Outlook account** — in admin chat, ask the agent to "register my Outlook account". The agent runs `outlook-account-register`, which returns a short user code and the URL `microsoft.com/devicelogin` and relays both to you.
 3. **Consent on any device** — open `microsoft.com/devicelogin` on your phone or laptop, enter the code, sign in to your Microsoft account, and consent to the requested scopes (`offline_access`, `User.Read`, `Mail.ReadWrite`, `Mail.Send`, `Calendars.ReadWrite`, `Contacts.Read`). `Mail.Send` enables sending and `Calendars.ReadWrite` enables calendar control; a mailbox last consented on an older read-only scope set must re-register before send or any calendar write succeeds. The agent finishes by calling `outlook-account-register-poll`.
 4. **Done.** Subsequent tool calls (mail, calendar, contacts) use the persisted refresh token transparently.
+5. **Several mailboxes on one account.** Register again to add a second mailbox; it is stored alongside the first, not in place of it. Every operational tool then takes an optional `mailbox` argument — an email address or graphUserId. With one mailbox, omit it. With two or more, name it; omitting it returns a refusal listing the connected mailboxes. `outlook-mailbox-list` shows every connected mailbox. Only one registration runs at a time per account; starting another while one is live returns an in-progress signal.
 
 ## Tools
 
@@ -2048,7 +2049,8 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-calendar-respond` | Accept, decline, or tentatively accept an invite. |
 | `outlook-calendar-freebusy` | Availability for one or more addresses over a window. |
 | `outlook-contacts-list` | Top contacts. Default top=50. |
-| `outlook-mailbox-info` | Health probe — auth state, refresh-window, folder count. |
+| `outlook-mailbox-info` | Health probe for one mailbox — auth state, refresh-window, folder count. Name the mailbox with `mailbox` when several are attached. |
+| `outlook-mailbox-list` | Every connected mailbox with its email, scopes, and token health. Local only — no network — so it also flags a mailbox whose stored credentials cannot be read. |
 | `outlook-mail-send` | Send a message (`POST /me/sendMail`). to/cc/bcc arrays, subject, body, isHtml. Success asserted on Graph 202. Needs `Mail.Send`. |
 | `outlook-draft` | Create a draft in Drafts (`POST /me/messages`). Same body model. Returns the draft id. Needs `Mail.ReadWrite`. |
 | `outlook-draft-send` | Send an existing draft by id (`POST /me/messages/{id}/send`). Graph consumes the draft, returns 202. Needs `Mail.Send`. |
@@ -2066,7 +2068,9 @@ All log lines start with `[outlook-mcp]` and write to `server.log`. They are key
 | Pending-store census | `pending-store-census account=<id> live=<N>` |
 | Pending cleared | `pending-cleared account=<id> verified=<bool>` |
 | /me failed post-token | `me-failed account=<id> status=<N>` |
-| Auth ok | `auth-ok account=<id> graphUserId=<id> scopes=<csv> tokenExpSec=<N>` |
+| Auth ok | `auth-ok account=<id> graphUserId=<id> mail=<addr> scopes=<csv> tokenExpSec=<N>` |
+| Registration already in flight | `register-in-progress account=<id>` (start refused; one device-code flow at a time) |
+| Credential resolve | `cred-resolve account=<id> mailbox=<id-or-empty> source=arg|sole|none|refused` — names the resolved mailbox and how it was chosen; `source=refused` is the ambiguity/not-found refusal |
 | Token refreshed | `token-refreshed account=<id> oldExpSec=<N> newExpSec=<N>` |
 | Refresh failed | `token-refresh-failed account=<id> reason=<err>` (terminal) |
 | Mail list | `mail-list op=resolve account=<id> folderIn=<name> folderResolved=<token> asRawId=<bool> count=<N> elapsedMs=<N>` (on error, `error=<msg>` replaces `count`) |
@@ -2081,6 +2085,7 @@ All log lines start with `[outlook-mcp]` and write to `server.log`. They are key
 | Scope insufficient | `scope-insufficient tool=<t> account=<id> missing=Calendars.ReadWrite` (stale read-only consent) |
 | Contacts list | `contacts-list account=<id> count=<N> elapsedMs=<N>` |
 | Mailbox info | `mailbox-info account=<id> tokenWithinRefreshWindow=<bool> folderCount=<N>` |
+| Mailbox list | `mailbox-list account=<id> count=<N> unreadable=<N>` (unreadable>0 flags an orphaned or corrupt mailbox store) |
 | Graph error | `graph-error account=<id> status=<N> code=<graphErrorCode> retryAfterMs=<N-or-null>` — writes flow through the same `callGraph` loop, so a failed write logs `graph-error` too |
 | On-prem rejected | `on-prem-rejected account=<id> mailServer=<host>` (terminal) |
 | Scope insufficient | `scope-insufficient account=<id> tool=<t> missing=Mail.Send` (terminal — re-register to grant send) |
@@ -2292,7 +2297,7 @@ A `pendingUnreconciled` number that stays above zero across several runs means t
 
 ## What this does not do
 
-One meeting type only (one length, one weekly window, one buffer). No syncing to Google or iCloud calendars: your meetings in Maxy are the source of truth. No rescheduling or cancellation links, reminders, or visitor time-zone selection. The booking page shows availability live from your device, so while your device is offline the page can still take a booking but may not show fresh open times until it is back.
+One meeting type only (one length, one weekly window, one buffer). No syncing to Google or iCloud calendars: your meetings in Maxy are the source of truth. No rescheduling or cancellation links, reminders, or visitor time-zone selection. The booking page shows open times from a snapshot your device publishes to the edge on a short timer, so the page keeps showing availability and taking bookings even while your device is offline — a slot that gets booked drops off at once, and times that have passed are never shown. If your device stays offline a long time the open times can go stale, but they never vanish; they refresh the moment it is back online.
 
 ---
 # LinkedIn Extension
@@ -3182,8 +3187,10 @@ Source: https://docs.getmaxy.com/graph.md
 # Graph View
 
 The **Graph** admin page (`/graph`) renders a force-directed view of your
-account's Neo4j subgraph. Labels on the canvas follow the zoom level, so you
-see the most useful identity at every scale.
+account's Neo4j subgraph. Node captions are hidden on first load so the
+whole-graph overview stays uncluttered, and appear the moment you interact.
+Once shown, captions follow the zoom level so you see the most useful identity
+at every scale.
 
 ## Default view
 
@@ -3239,11 +3246,25 @@ This is an in-page overlay, so the browser tab and address bar stay put. It is
 not the operating system's full-screen mode. The maximize button shows only on
 the `/graph` page, not where the graph is embedded in another pane.
 
+## Captions hidden on first load
+
+When you open `/graph` (or refresh the page) the whole graph auto-fits into the
+viewport, which on a busy graph would render every caption at once and overlap
+them into unreadable clutter. So captions start hidden. They appear on your
+first interaction of any kind — zoom, drag, a filter chip, a search, clicking a
+node — and stay visible for the rest of that visit. To get the clean
+caption-free overview back, reload the page.
+
+This is a one-off marker tied to page load, not a zoom threshold: after the
+first interaction, captions follow the zoom tiers below and do not hide again
+until the next reload.
+
 ## Conversation label tiers
 
 Conversation nodes carry the most operator-meaningful identity in the
 subgraph (the conversation name or summary, the date it started, the message
-count). They render in one of three tiers, switched by canvas scale:
+count). Once captions are showing they render in one of three tiers, switched
+by canvas scale:
 
 | Zoom | Label shape | Example |
 |------|-------------|---------|

package/payload/platform/plugins/cloudflare/skills/calendar-site/SKILL.md

@@ -24,7 +24,11 @@ A booking visitor and the admin look at the booking from opposite sides — the
 | Admin calendar (4 views) | the install, at `/calendar` on the admin host (resolve via `admin-hostname`) | admin sign-in | every time-bound item for the account — booked and imported meetings, agent-scheduled appointments, and tasks with a due date |
 | Public booking page | Cloudflare Pages, on the booking domain | open | free/busy only, never any meeting detail |
 
-Only the public page is deployed here, because it must stay reachable and keep capturing bookings even when the install device is briefly offline. The admin calendar is dynamic, account-scoped, and authenticated, so it is served by the install over the tunnel and is same-origin with its data. Do not try to put the admin calendar on Pages.
+Only the public page is deployed here, because it must stay reachable and keep capturing bookings even when the install device is offline. The admin calendar is dynamic, account-scoped, and authenticated, so it is served by the install over the tunnel and is same-origin with its data. Do not try to put the admin calendar on Pages.
+
+## Availability survives the device going offline
+
+The booking page does not fetch open times from the device. It reads them same-origin from its own edge Function, `functions/api/calendar/free-busy.ts`, which serves a snapshot stored in the D1 `availability_snapshot` table minus any slot already booked (so a taken slot disappears at once, and two visitors never see the same slot) and with past slots filtered out (so a stale snapshot never offers an expired time). The snapshot is kept fresh by a publish job the platform server arms on a short timer: while the device is online it pushes the account's computed free/busy into `availability_snapshot`; while the device is off it simply does not run and the edge keeps serving the last snapshot until the device returns. There is no per-account cron or setup; the server arms it for the account it resolves, which is the one account whose booking site this install serves.
 
 ## Set the availability window first
 
@@ -34,7 +38,7 @@ The public page shows open slots computed as the weekly window minus busy `:Meet
 <accountDir>/calendar-availability.json
 ```
 
-Collect from the operator, then write the file: the account `timezone` (IANA), the meeting `durationMins`, the `bufferMins` between meetings, and the `weekly` window as `{ mon: [["09:00","17:00"]], ... }` with an empty array for days that are closed. Also collect `daysAhead` (the booking horizon — a positive integer count of days the page lets visitors book into, e.g. `14`) and `allowMultiSlot` (a boolean: may a visitor combine consecutive open slots into one longer back-to-back booking? default `false`). Add the `apiBase` (the brand tunnel origin that serves free/busy, `https://<brand-tunnel-domain>`), the `bookingDomain` (the custom domain the page will answer on), and `bookingDbName` (the D1 database name chosen below). Re-running this skill with new numbers is how availability — including the horizon and the multi-slot choice — is changed later; there is no separate editor.
+Collect from the operator, then write the file: the account `timezone` (IANA), the meeting `durationMins`, the `bufferMins` between meetings, and the `weekly` window as `{ mon: [["09:00","17:00"]], ... }` with an empty array for days that are closed. Also collect `daysAhead` (the booking horizon — a positive integer count of days the page lets visitors book into, e.g. `14`) and `allowMultiSlot` (a boolean: may a visitor combine consecutive open slots into one longer back-to-back booking? default `false`). Add the `bookingDomain` (the custom domain the page will answer on) and `bookingDbName` (the D1 database name chosen below). Re-running this skill with new numbers is how availability — including the horizon and the multi-slot choice — is changed later; there is no separate editor. The device-side job that keeps the edge snapshot fresh is armed by the always-running platform server, so there is nothing per-account to schedule.
 
 ## Assemble the canonical tree
 
@@ -44,11 +48,11 @@ Copy the skill template into the one canonical Pages source path `site-deploy` e
 <accountDir>/pages/<project>/
 ```
 
-The template ships `public/index.html`, `public/booking.js`, `public/booking.css`, `functions/api/book.ts`, `wrangler.toml`, and `schema.sql`. The substitutions that make it concrete are: in `public/index.html`, set the `<meta name="api-base">` content to the `apiBase` value (the booking page fetches free/busy cross-origin from the brand tunnel), set `<meta name="days-ahead">` content to `daysAhead`, and set `<meta name="allow-multi-slot">` content to `allowMultiSlot` as the literal `true` or `false`; and fill `wrangler.toml`'s `__PROJECT_NAME__`, `__D1_DATABASE_NAME__`, and `__D1_DATABASE_ID__` from the project name and the database created below. Leave no `__...__` placeholder in the assembled tree.
+The template ships `public/index.html`, `public/booking.js`, `public/booking.css`, `functions/api/book.ts`, `functions/api/calendar/free-busy.ts`, `wrangler.toml`, and `schema.sql`. The substitutions that make it concrete are: in `public/index.html`, set `<meta name="days-ahead">` content to `daysAhead` and set `<meta name="allow-multi-slot">` content to `allowMultiSlot` as the literal `true` or `false`; and fill `wrangler.toml`'s `__PROJECT_NAME__`, `__D1_DATABASE_NAME__`, and `__D1_DATABASE_ID__` from the project name and the database created below. Leave `<meta name="api-base">` empty as it ships; the page reads availability same-origin from the site's own `free-busy` edge Function (see the snapshot section below), never the device tunnel. Leave no `__...__` placeholder in the assembled tree.
 
 ## Provision the D1 bookings table
 
-This is a `bookings` table, not the `leads` table of a contact form, so the booking-specific schema ships with the template. Load the stable `<brand>-pages-d1` token from the account secrets file, minting it once only if absent and persisting it, exactly as `references/api.md` and `references/d1-data-capture.md` prescribe; the token needs both Pages Edit and D1 Edit. Create the database, record its id into `wrangler.toml`, and apply `schema.sql` to the remote database. The token is never written into the tree, never committed, never echoed.
+The booking-specific schema ships with the template: `schema.sql` creates both the `bookings` table (written by the booking page) and the `availability_snapshot` table (the single-row free/busy cache the publish job upserts and the `free-busy` edge Function reads). Applying `schema.sql` provisions both. Load the stable `<brand>-pages-d1` token from the account secrets file, minting it once only if absent and persisting it, exactly as `references/api.md` and `references/d1-data-capture.md` prescribe; the token needs both Pages Edit and D1 Edit. Create the database, record its id into `wrangler.toml`, and apply `schema.sql` to the remote database. The token is never written into the tree, never committed, never echoed.
 
 ## Deploy through site-deploy
 
@@ -59,7 +63,13 @@ Hand the assembled tree to `cloudflare:site-deploy`: it builds nothing for a sta
 Done is a live behavioural signal on the booking domain, surfaced verbatim:
 
 - The booking domain returns `HTTP/2 200` on a cache-busted request.
-- The page's free/busy call succeeds: `curl` the brand tunnel free/busy endpoint and confirm it returns a `slots` array and carries no meeting title, description, or location field. A `404` here means availability was not written; a blocked or unauthenticated response means the free/busy path is not reachable on the brand host.
+- The page's free/busy call succeeds same-origin: `curl` the booking domain's own `free-busy` edge Function and confirm it returns a `slots` array (with `updatedAt`) and carries no meeting title, description, or location field. Immediately after deploy it may return `{"slots":[],"updatedAt":null,"stale":true}` until the platform server's publish job runs once (within ~5 minutes); re-check until `updatedAt` is fresh and `slots` is populated. A response missing the `slots` field means the edge Function did not deploy; empty-with-`stale` after several minutes means the publish job is not reaching D1 (check the brand journal for `[calendar-availability]`).
+
+```bash
+curl -s "https://<booking-domain>/api/calendar/free-busy?from=$(date -u +%Y-%m-%dT00:00:00Z)&to=$(date -u -v+14d +%Y-%m-%dT00:00:00Z)" | head -c 400
+```
+
+The device's own free/busy (the publish job's source) should also return a `slots` array; a `404` there means the availability window was not written:
 
 ```bash
 curl -s "https://<brand-tunnel-domain>/api/calendar/free-busy?from=$(date -u +%Y-%m-%dT00:00:00Z)&to=$(date -u -v+14d +%Y-%m-%dT00:00:00Z)" | head -c 400

package/payload/platform/plugins/cloudflare/skills/calendar-site/template/functions/api/calendar/free-busy.ts

@@ -0,0 +1,152 @@
+// Edge free/busy Function (calendar-site skill) — offline-resilient availability.
+//
+// Served at GET /api/calendar/free-busy on the booking domain, same-origin with
+// the page. It serves open times from a snapshot the device publishes into D1
+// on a short timer (platform/ui server → publish-availability), MINUS any slot
+// already booked in the D1 `bookings` table:
+//   - Serving the snapshot means the public page keeps showing availability
+//     while the install device is offline (the device's own tunnel free/busy is
+//     then unreachable, but the snapshot survives on the edge).
+//   - Subtracting accepted bookings here — at the edge — means a booked slot
+//     disappears the instant it is taken, with no wait for the device to
+//     reconcile and republish, so two visitors are never shown the same slot.
+//   - Past slots are always filtered out, so a stale snapshot never offers a
+//     time that has already passed.
+//
+// Split like book.ts so the logic is verifiable without the Pages runtime:
+// computeFreeBusy takes an injected DB + logger and returns the HTTP shape.
+
+interface D1PreparedStatement {
+  bind: (...values: unknown[]) => D1PreparedStatement
+  first: <T = Record<string, unknown>>() => Promise<T | null>
+  all: <T = Record<string, unknown>>() => Promise<{ results?: T[] }>
+}
+interface D1Database {
+  prepare: (query: string) => D1PreparedStatement
+}
+interface FreeBusyEnv {
+  DB: D1Database
+}
+
+interface Slot {
+  start: string
+  end: string
+}
+interface Snapshot {
+  durationMins?: number
+  timezone?: string
+  slots?: Slot[]
+}
+
+type Logger = (line: string) => void
+
+interface FreeBusyQuery {
+  from?: string | null
+  to?: string | null
+  nowMs: number
+}
+
+// Default horizon when `to` is absent — a generous ceiling so a snapshot always
+// covers the page's own (operator-set) horizon.
+const DEFAULT_HORIZON_MS = 31 * 24 * 3600 * 1000
+
+export interface FreeBusyResult {
+  durationMins: number | null
+  timezone: string | null
+  slots: Slot[]
+  updatedAt: string | null
+  stale?: boolean
+}
+
+export async function computeFreeBusy(
+  env: FreeBusyEnv,
+  query: FreeBusyQuery,
+  log: Logger,
+): Promise<FreeBusyResult> {
+  const { nowMs } = query
+  const from = query.from ? Date.parse(query.from) : nowMs
+  const to = query.to ? Date.parse(query.to) : nowMs + DEFAULT_HORIZON_MS
+
+  let row: { payload?: string; updatedAt?: string } | null = null
+  try {
+    row = await env.DB
+      .prepare('SELECT payload, updatedAt FROM availability_snapshot WHERE id = 1')
+      .first<{ payload?: string; updatedAt?: string }>()
+  } catch {
+    row = null
+  }
+
+  // No snapshot published yet (first deploy) is distinct from a corrupt payload
+  // below — both otherwise collapse to empty slots, so name them apart in the log.
+  if (!row || !row.payload) {
+    log('[calendar-availability] op=serve result=no-snapshot slots=0')
+    return { durationMins: null, timezone: null, slots: [], updatedAt: null, stale: true }
+  }
+
+  let snap: Snapshot
+  try {
+    snap = JSON.parse(row.payload) as Snapshot
+  } catch {
+    log('[calendar-availability] op=serve result=corrupt slots=0')
+    return { durationMins: null, timezone: null, slots: [], updatedAt: row.updatedAt ?? null, stale: true }
+  }
+
+  const lower = Math.max(Number.isNaN(from) ? nowMs : from, nowMs)
+  const upper = Number.isNaN(to) ? nowMs + DEFAULT_HORIZON_MS : to
+
+  // Slots already taken (optimistic subtraction). Bound the scan to bookings at
+  // or after `lower`: reconcile only marks rows swept, never de-accepts them, so
+  // without this the accepted set grows without bound over the calendar's life —
+  // and a past booking can never match a snapshot slot that survives the
+  // start >= lower filter below, so the bound drops nothing. A failed read
+  // serves the snapshot as-is rather than 500 — the booking page still works.
+  const booked = new Set<string>()
+  try {
+    const res = await env.DB
+      .prepare("SELECT slotStart FROM bookings WHERE status = 'accepted' AND slotStart >= ?1")
+      .bind(new Date(lower).toISOString())
+      .all<{ slotStart?: string }>()
+    for (const b of res.results || []) {
+      if (b && typeof b.slotStart === 'string') booked.add(b.slotStart)
+    }
+  } catch {
+    /* keep the snapshot as-is */
+  }
+  const slots = (snap.slots || []).filter((s) => {
+    const t = Date.parse(s.start)
+    return !Number.isNaN(t) && t >= lower && t < upper && !booked.has(s.start)
+  })
+
+  const ageMs = row.updatedAt ? nowMs - Date.parse(row.updatedAt) : null
+  log(`[calendar-availability] op=serve result=ok slots=${slots.length} ageMs=${ageMs ?? 'na'}`)
+
+  return {
+    durationMins: snap.durationMins ?? null,
+    timezone: snap.timezone ?? null,
+    slots,
+    updatedAt: row.updatedAt ?? null,
+  }
+}
+
+interface PagesContext {
+  request: Request
+  env: FreeBusyEnv
+}
+
+export async function onRequestGet(context: PagesContext): Promise<Response> {
+  const url = new URL(context.request.url)
+  const result = await computeFreeBusy(
+    context.env,
+    {
+      from: url.searchParams.get('from'),
+      to: url.searchParams.get('to'),
+      nowMs: Date.now(),
+    },
+    (line) => console.log(line),
+  )
+  // Free/busy carries no credentials; a wildcard origin keeps it readable if a
+  // page ever fetches it cross-origin, matching the device endpoint's CORS.
+  return Response.json(result, {
+    headers: { 'Access-Control-Allow-Origin': '*' },
+  })
+}

package/payload/platform/plugins/cloudflare/skills/calendar-site/template/public/index.html

@@ -3,9 +3,12 @@
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <!-- The calendar-site skill rewrites the content of this tag to the brand
-       tunnel origin that serves /api/calendar/free-busy. -->
-  <meta name="api-base" content="__API_BASE__" />
+  <!-- Availability is read same-origin from this site's own edge Function
+       (functions/api/calendar/free-busy.ts), which serves the snapshot the
+       device publishes to D1. Empty = same-origin, so the page keeps working
+       when the install device is offline. Left blank deliberately; do not point
+       it at the device tunnel. -->
+  <meta name="api-base" content="" />
   <!-- Operator-set booking horizon (positive integer days). The skill rewrites
        the content; booking.js falls back to 14 when it is left unsubstituted. -->
   <meta name="days-ahead" content="__DAYS_AHEAD__" />

package/payload/platform/plugins/cloudflare/skills/calendar-site/template/schema.sql

@@ -16,3 +16,14 @@ CREATE TABLE IF NOT EXISTS bookings (
 );
 
 CREATE INDEX IF NOT EXISTS bookings_unswept ON bookings (status, swept);
+
+-- Single-row cache of the account's computed free/busy, published by the device
+-- on a short timer (platform/ui server → publish-availability). The booking
+-- page's edge free/busy Function serves open times from this snapshot minus any
+-- accepted booking, so the public page keeps showing availability while the
+-- device is offline. id is pinned to 1: one account per booking site, one row.
+CREATE TABLE IF NOT EXISTS availability_snapshot (
+  id        INTEGER PRIMARY KEY CHECK (id = 1),
+  payload   TEXT,
+  updatedAt TEXT
+);

package/payload/platform/plugins/docs/references/calendar-booking.md

@@ -55,4 +55,4 @@ A `pendingUnreconciled` number that stays above zero across several runs means t
 
 ## What this does not do
 
-One meeting type only (one length, one weekly window, one buffer). No syncing to Google or iCloud calendars: your meetings in Maxy are the source of truth. No rescheduling or cancellation links, reminders, or visitor time-zone selection. The booking page shows availability live from your device, so while your device is offline the page can still take a booking but may not show fresh open times until it is back.
+One meeting type only (one length, one weekly window, one buffer). No syncing to Google or iCloud calendars: your meetings in Maxy are the source of truth. No rescheduling or cancellation links, reminders, or visitor time-zone selection. The booking page shows open times from a snapshot your device publishes to the edge on a short timer, so the page keeps showing availability and taking bookings even while your device is offline — a slot that gets booked drops off at once, and times that have passed are never shown. If your device stays offline a long time the open times can go stale, but they never vanish; they refresh the moment it is back online.

package/payload/platform/plugins/docs/references/graph.md

@@ -1,8 +1,10 @@
 # Graph View
 
 The **Graph** admin page (`/graph`) renders a force-directed view of your
-account's Neo4j subgraph. Labels on the canvas follow the zoom level, so you
-see the most useful identity at every scale.
+account's Neo4j subgraph. Node captions are hidden on first load so the
+whole-graph overview stays uncluttered, and appear the moment you interact.
+Once shown, captions follow the zoom level so you see the most useful identity
+at every scale.
 
 ## Default view
 
@@ -58,11 +60,25 @@ This is an in-page overlay, so the browser tab and address bar stay put. It is
 not the operating system's full-screen mode. The maximize button shows only on
 the `/graph` page, not where the graph is embedded in another pane.
 
+## Captions hidden on first load
+
+When you open `/graph` (or refresh the page) the whole graph auto-fits into the
+viewport, which on a busy graph would render every caption at once and overlap
+them into unreadable clutter. So captions start hidden. They appear on your
+first interaction of any kind — zoom, drag, a filter chip, a search, clicking a
+node — and stay visible for the rest of that visit. To get the clean
+caption-free overview back, reload the page.
+
+This is a one-off marker tied to page load, not a zoom threshold: after the
+first interaction, captions follow the zoom tiers below and do not hide again
+until the next reload.
+
 ## Conversation label tiers
 
 Conversation nodes carry the most operator-meaningful identity in the
 subgraph (the conversation name or summary, the date it started, the message
-count). They render in one of three tiers, switched by canvas scale:
+count). Once captions are showing they render in one of three tiers, switched
+by canvas scale:
 
 | Zoom | Label shape | Example |
 |------|-------------|---------|

package/payload/platform/plugins/docs/references/outlook-guide.md

@@ -8,6 +8,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 2. **Per account: register the Outlook account** — in admin chat, ask the agent to "register my Outlook account". The agent runs `outlook-account-register`, which returns a short user code and the URL `microsoft.com/devicelogin` and relays both to you.
 3. **Consent on any device** — open `microsoft.com/devicelogin` on your phone or laptop, enter the code, sign in to your Microsoft account, and consent to the requested scopes (`offline_access`, `User.Read`, `Mail.ReadWrite`, `Mail.Send`, `Calendars.ReadWrite`, `Contacts.Read`). `Mail.Send` enables sending and `Calendars.ReadWrite` enables calendar control; a mailbox last consented on an older read-only scope set must re-register before send or any calendar write succeeds. The agent finishes by calling `outlook-account-register-poll`.
 4. **Done.** Subsequent tool calls (mail, calendar, contacts) use the persisted refresh token transparently.
+5. **Several mailboxes on one account.** Register again to add a second mailbox; it is stored alongside the first, not in place of it. Every operational tool then takes an optional `mailbox` argument — an email address or graphUserId. With one mailbox, omit it. With two or more, name it; omitting it returns a refusal listing the connected mailboxes. `outlook-mailbox-list` shows every connected mailbox. Only one registration runs at a time per account; starting another while one is live returns an in-progress signal.
 
 ## Tools
 
@@ -25,7 +26,8 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-calendar-respond` | Accept, decline, or tentatively accept an invite. |
 | `outlook-calendar-freebusy` | Availability for one or more addresses over a window. |
 | `outlook-contacts-list` | Top contacts. Default top=50. |
-| `outlook-mailbox-info` | Health probe — auth state, refresh-window, folder count. |
+| `outlook-mailbox-info` | Health probe for one mailbox — auth state, refresh-window, folder count. Name the mailbox with `mailbox` when several are attached. |
+| `outlook-mailbox-list` | Every connected mailbox with its email, scopes, and token health. Local only — no network — so it also flags a mailbox whose stored credentials cannot be read. |
 | `outlook-mail-send` | Send a message (`POST /me/sendMail`). to/cc/bcc arrays, subject, body, isHtml. Success asserted on Graph 202. Needs `Mail.Send`. |
 | `outlook-draft` | Create a draft in Drafts (`POST /me/messages`). Same body model. Returns the draft id. Needs `Mail.ReadWrite`. |
 | `outlook-draft-send` | Send an existing draft by id (`POST /me/messages/{id}/send`). Graph consumes the draft, returns 202. Needs `Mail.Send`. |
@@ -43,7 +45,9 @@ All log lines start with `[outlook-mcp]` and write to `server.log`. They are key
 | Pending-store census | `pending-store-census account=<id> live=<N>` |
 | Pending cleared | `pending-cleared account=<id> verified=<bool>` |
 | /me failed post-token | `me-failed account=<id> status=<N>` |
-| Auth ok | `auth-ok account=<id> graphUserId=<id> scopes=<csv> tokenExpSec=<N>` |
+| Auth ok | `auth-ok account=<id> graphUserId=<id> mail=<addr> scopes=<csv> tokenExpSec=<N>` |
+| Registration already in flight | `register-in-progress account=<id>` (start refused; one device-code flow at a time) |
+| Credential resolve | `cred-resolve account=<id> mailbox=<id-or-empty> source=arg|sole|none|refused` — names the resolved mailbox and how it was chosen; `source=refused` is the ambiguity/not-found refusal |
 | Token refreshed | `token-refreshed account=<id> oldExpSec=<N> newExpSec=<N>` |
 | Refresh failed | `token-refresh-failed account=<id> reason=<err>` (terminal) |
 | Mail list | `mail-list op=resolve account=<id> folderIn=<name> folderResolved=<token> asRawId=<bool> count=<N> elapsedMs=<N>` (on error, `error=<msg>` replaces `count`) |
@@ -58,6 +62,7 @@ All log lines start with `[outlook-mcp]` and write to `server.log`. They are key
 | Scope insufficient | `scope-insufficient tool=<t> account=<id> missing=Calendars.ReadWrite` (stale read-only consent) |
 | Contacts list | `contacts-list account=<id> count=<N> elapsedMs=<N>` |
 | Mailbox info | `mailbox-info account=<id> tokenWithinRefreshWindow=<bool> folderCount=<N>` |
+| Mailbox list | `mailbox-list account=<id> count=<N> unreadable=<N>` (unreadable>0 flags an orphaned or corrupt mailbox store) |
 | Graph error | `graph-error account=<id> status=<N> code=<graphErrorCode> retryAfterMs=<N-or-null>` — writes flow through the same `callGraph` loop, so a failed write logs `graph-error` too |
 | On-prem rejected | `on-prem-rejected account=<id> mailServer=<host>` (terminal) |
 | Scope insufficient | `scope-insufficient account=<id> tool=<t> missing=Mail.Send` (terminal — re-register to grant send) |

package/payload/platform/plugins/outlook/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "outlook",
-  "description": "Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read + draft + send; contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox; outlook-mail-send / outlook-draft / outlook-draft-send: compose and send; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count.",
+  "description": "Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read + draft + send; contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox; outlook-mail-send / outlook-draft / outlook-draft-send: compose and send; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/outlook/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: outlook
-description: Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read + draft + send; contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox; outlook-mail-send / outlook-draft / outlook-draft-send: compose and send; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count.
+description: Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read + draft + send; contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox; outlook-mail-send / outlook-draft / outlook-draft-send: compose and send; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.
 tools:
   - name: outlook-account-register
     publicAllowlist: false
@@ -50,6 +50,9 @@ tools:
   - name: outlook-mailbox-info
     publicAllowlist: false
     adminAllowlist: false
+  - name: outlook-mailbox-list
+    publicAllowlist: false
+    adminAllowlist: false
 always: false
 embed: ["admin"]
 metadata: {"platform":{"optional":true}}
@@ -75,12 +78,13 @@ Microsoft Graph access for Outlook.com / Microsoft 365 mailboxes. Mail is read,
 
 ## Capabilities
 
-- **Register:** `outlook-account-register` — starts the OAuth device-code flow against the brand's Entra app and returns a user code + verification URL immediately. The operator opens `microsoft.com/devicelogin` on any device, enters the code, and consents. `outlook-account-register-poll` completes registration — one check per call. Tokens persist per-account, encrypted on disk (AES-256-CBC).
+- **Register:** `outlook-account-register` — starts the OAuth device-code flow against the brand's Entra app and returns a user code + verification URL immediately. The operator opens `microsoft.com/devicelogin` on any device, enters the code, and consents. `outlook-account-register-poll` completes registration — one check per call. Registering a second mailbox on the same account adds it alongside the first rather than replacing it; each mailbox holds its own encrypted tokens (AES-256-CBC) under a shared account key. One device-code flow runs at a time per account; starting another while one is live returns an `in-progress` signal.
+- **Multiple mailboxes:** one account can hold several mailboxes. Every operational tool takes an optional `mailbox` argument (email or graphUserId). With one mailbox, omit it. With two or more, name it — omitting it returns a refusal listing the connected mailboxes. `outlook-mailbox-list` shows them all.
 - **Mail (read):** `outlook-mail-list` returns recent messages; `outlook-mail-search` runs a Graph `$search` query.
 - **Mail (send / draft):** `outlook-mail-send` sends via `POST /me/sendMail` (success asserted on Graph 202); `outlook-draft` creates a draft and returns its id; `outlook-draft-send` sends an existing draft by id. Recipients are to/cc/bcc arrays; body is HTML or plain text via `isHtml`. Requires `Mail.Send` + `Mail.ReadWrite`; a mailbox on the old read-only consent returns an actionable "re-register to grant send" signal.
 - **Calendar (read + control):** `outlook-calendar-list` and `outlook-calendar-event` read events; `outlook-calendar-create` books an event; `outlook-calendar-update` reschedules or edits one; `outlook-calendar-cancel` cancels a meeting (notifying attendees when the account organises it) or deletes a personal appointment; `outlook-calendar-respond` accepts, declines, or tentatively accepts an invite; `outlook-calendar-freebusy` reports availability for one or more addresses over a window. Writes require the `Calendars.ReadWrite` consent; a mailbox on stale read-only consent returns a distinct signal naming the scope and `outlook-account-register`.
 - **Contacts (read-only):** `outlook-contacts-list` returns contacts.
-- **Health:** `outlook-mailbox-info` reports auth state, refresh-window status, and top-level folder count. Use this to answer "did account X auth?" without grepping logs.
+- **Health:** `outlook-mailbox-info` reports auth state, refresh-window status, and top-level folder count for one mailbox (name it with `mailbox` when several are attached). `outlook-mailbox-list` lists every connected mailbox with its email, scopes, and token health, reading local stores only — no network — so it also flags a mailbox whose stored credentials cannot be read. Use these to answer "did mailbox X auth?" without grepping logs.
 
 ## Out of scope