@rubytech/create-maxy-code 0.1.459 → 0.1.460

package/payload/platform/plugins/cloudflare/skills/data-portal/template/public/portal.css

@@ -0,0 +1,113 @@
+/* Data portal styles. Plain CSS, dp- prefixed, themed off variables so a brand
+   can restyle without touching markup — the same shape as booking.css. */
+:root {
+  --dp-ink: #14181f;
+  --dp-muted: #667085;
+  --dp-paper: #ffffff;
+  --dp-rule: #e4e7ec;
+  --dp-accent: #1f6feb;
+  --dp-accent-ink: #ffffff;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  padding: 2rem 1rem;
+  background: var(--dp-paper);
+  color: var(--dp-ink);
+  font: 16px/1.5 system-ui, -apple-system, 'Segoe UI', sans-serif;
+}
+
+.dp-card {
+  max-width: 34rem;
+  margin: 0 auto;
+}
+
+.dp-title {
+  margin: 0 0 1rem;
+  font-size: 1.5rem;
+}
+
+.dp-status {
+  min-height: 1.5rem;
+  margin: 0 0 1rem;
+  color: var(--dp-muted);
+}
+
+.dp-login,
+.dp-upload {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.dp-label {
+  font-size: 0.875rem;
+  color: var(--dp-muted);
+}
+
+.dp-input,
+.dp-file {
+  padding: 0.625rem 0.75rem;
+  border: 1px solid var(--dp-rule);
+  border-radius: 0.375rem;
+  font: inherit;
+}
+
+.dp-btn {
+  margin-top: 0.5rem;
+  padding: 0.625rem 1rem;
+  border: 0;
+  border-radius: 0.375rem;
+  background: var(--dp-accent);
+  color: var(--dp-accent-ink);
+  font: inherit;
+  cursor: pointer;
+}
+
+.dp-upload {
+  margin-bottom: 1.5rem;
+}
+
+.dp-files {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+.dp-file-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  padding: 0.75rem 0;
+  border-bottom: 1px solid var(--dp-rule);
+}
+
+.dp-file-name {
+  color: var(--dp-accent);
+  text-decoration: none;
+  word-break: break-all;
+}
+
+.dp-file-name:hover {
+  text-decoration: underline;
+}
+
+.dp-del {
+  border: 1px solid var(--dp-rule);
+  border-radius: 0.375rem;
+  background: transparent;
+  color: var(--dp-muted);
+  padding: 0.375rem 0.625rem;
+  font: inherit;
+  cursor: pointer;
+}
+
+.dp-empty {
+  color: var(--dp-muted);
+  padding: 0.75rem 0;
+}

package/payload/platform/plugins/cloudflare/skills/data-portal/template/public/portal.js

@@ -0,0 +1,155 @@
+/* Data portal client. Dependency-free, no bundler, no framework — the same
+   shape as the booking page's booking.js.
+
+   Three steps: sign in with a passcode, list your own files, upload/delete.
+   The session cookie is HttpOnly, so this script never sees or stores it. */
+(function () {
+  'use strict';
+
+  function meta(name) {
+    var el = document.querySelector('meta[name="' + name + '"]');
+    return el ? el.getAttribute('content') || '' : '';
+  }
+
+  var API = meta('api-base');
+  var statusEl = document.getElementById('dp-status');
+  var loginEl = document.getElementById('dp-login');
+  var panelEl = document.getElementById('dp-panel');
+  var filesEl = document.getElementById('dp-files');
+
+  function say(msg) {
+    statusEl.textContent = msg;
+  }
+
+  function api(path, opts) {
+    return fetch(API + path, Object.assign({ credentials: 'same-origin' }, opts || {}));
+  }
+
+  function item(text) {
+    var li = document.createElement('li');
+    li.className = 'dp-empty';
+    li.textContent = text;
+    return li;
+  }
+
+  function render(files) {
+    // replaceChildren, not innerHTML: every filename below is set with
+    // textContent so a name like '<img onerror=…>' renders as text, and
+    // clearing the list should not go anywhere near HTML parsing either.
+    filesEl.replaceChildren();
+    if (!files.length) {
+      filesEl.appendChild(item('No files yet.'));
+      return;
+    }
+    files.forEach(function (f) {
+      var li = document.createElement('li');
+      li.className = 'dp-file-row';
+
+      var a = document.createElement('a');
+      a.className = 'dp-file-name';
+      a.href = API + '/api/download?key=' + encodeURIComponent(f.objectKey);
+      a.textContent = f.filename;
+      li.appendChild(a);
+
+      var del = document.createElement('button');
+      del.className = 'dp-del';
+      del.type = 'button';
+      del.textContent = 'Delete';
+      del.addEventListener('click', function () {
+        remove(f.objectKey);
+      });
+      li.appendChild(del);
+
+      filesEl.appendChild(li);
+    });
+  }
+
+  function refresh() {
+    return api('/api/files')
+      .then(function (r) {
+        return r.json();
+      })
+      .then(function (d) {
+        if (d.ok) render(d.files || []);
+      })
+      .catch(function () {
+        say('Could not load your files.');
+      });
+  }
+
+  function remove(key) {
+    say('Deleting…');
+    api('/api/delete', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ key: key }),
+    })
+      .then(function (r) {
+        return r.json();
+      })
+      .then(function (d) {
+        say(d.ok ? 'Deleted.' : 'Could not delete that.');
+        return refresh();
+      })
+      .catch(function () {
+        say('Could not delete that.');
+      });
+  }
+
+  loginEl.addEventListener('submit', function (e) {
+    e.preventDefault();
+    say('Signing in…');
+    api('/api/auth', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        ownerId: document.getElementById('dp-owner').value.trim(),
+        passcode: document.getElementById('dp-passcode').value,
+      }),
+    })
+      .then(function (r) {
+        return r.json().then(function (d) {
+          return { s: r.status, d: d };
+        });
+      })
+      .then(function (res) {
+        if (res.s === 429) {
+          say('Too many attempts. Try again later.');
+          return;
+        }
+        if (!res.d.ok) {
+          say('That did not work.');
+          return;
+        }
+        document.getElementById('dp-passcode').value = '';
+        loginEl.hidden = true;
+        panelEl.hidden = false;
+        say('');
+        return refresh();
+      })
+      .catch(function () {
+        say('That did not work.');
+      });
+  });
+
+  document.getElementById('dp-upload').addEventListener('submit', function (e) {
+    e.preventDefault();
+    var input = document.getElementById('dp-file');
+    if (!input.files || !input.files[0]) return;
+    var fd = new FormData();
+    fd.append('file', input.files[0]);
+    say('Uploading…');
+    api('/api/upload', { method: 'POST', body: fd })
+      .then(function (r) {
+        return r.json();
+      })
+      .then(function (d) {
+        say(d.ok ? 'Uploaded.' : 'Upload failed.');
+        input.value = '';
+        return refresh();
+      })
+      .catch(function () {
+        say('Upload failed.');
+      });
+  });
+})();

package/payload/platform/plugins/cloudflare/skills/data-portal/template/schema.sql

@@ -0,0 +1,64 @@
+-- D1 schema for the data portal (data-portal skill).
+--
+-- Four tables: who may authenticate (people), who currently is (sessions),
+-- what they have dropped (manifest), and how hard they have been trying
+-- (auth_attempts). Everything is IF NOT EXISTS so re-applying is safe.
+
+-- One row per enrolled person. No plaintext passcode is ever stored: the skill
+-- generates the passcode, shows it to the operator once, and persists only the
+-- PBKDF2 salt and hash. `iterations` is stored per row so the cost can be
+-- raised later without invalidating existing rows.
+CREATE TABLE IF NOT EXISTS people (
+  ownerId    TEXT PRIMARY KEY,
+  name       TEXT NOT NULL,
+  salt       TEXT NOT NULL,
+  hash       TEXT NOT NULL,
+  iterations INTEGER NOT NULL,
+  createdAt  TEXT NOT NULL
+);
+
+-- `pcCheck` is a short digest of the person's passcode hash at mint time, and
+-- resolveSession requires it to still match `people.hash`. It is what makes
+-- revocation structural: rotating a passcode necessarily changes the hash, so
+-- every session minted against the old one stops resolving immediately, with
+-- no cleanup step for an operator to remember and no 12-hour window to wait
+-- out. A leaked passcode is exactly the case where a procedural remedy fails.
+CREATE TABLE IF NOT EXISTS sessions (
+  sessionId TEXT PRIMARY KEY,
+  ownerId   TEXT NOT NULL,
+  pcCheck   TEXT NOT NULL,
+  expiresAt INTEGER NOT NULL,
+  createdAt TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS sessions_owner ON sessions (ownerId);
+
+-- One row per stored object. `ingested` is the claim flag the device-side
+-- sweep (a separate task) reads and sets; a row stays 0 until its file has
+-- been pulled into the graph, so the backlog survives the device being offline.
+CREATE TABLE IF NOT EXISTS manifest (
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  fileId     TEXT UNIQUE NOT NULL,
+  ownerId    TEXT NOT NULL,
+  filename   TEXT NOT NULL,
+  objectKey  TEXT UNIQUE NOT NULL,
+  size       INTEGER NOT NULL,
+  uploadedAt TEXT NOT NULL,
+  ingested   INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE INDEX IF NOT EXISTS manifest_uningested ON manifest (ingested);
+CREATE INDEX IF NOT EXISTS manifest_owner ON manifest (ownerId);
+
+-- Fixed-window auth attempt counter. Pages Functions are stateless, so the
+-- counter cannot live in process memory the way every other rate limiter in
+-- this platform does. The unique index is what makes the upsert in
+-- _lib/ratelimit.ts collapse onto one row per window.
+CREATE TABLE IF NOT EXISTS auth_attempts (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  scope       TEXT NOT NULL,
+  windowStart INTEGER NOT NULL,
+  count       INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS auth_attempts_scope_window ON auth_attempts (scope, windowStart);

package/payload/platform/plugins/cloudflare/skills/data-portal/template/wrangler.toml

@@ -0,0 +1,21 @@
+# Cloudflare Pages config for the data portal (data-portal skill).
+# The skill fills the placeholders at assemble time:
+#   __PROJECT_NAME__     the Pages project name
+#   __D1_DATABASE_NAME__ the D1 database name  (<accountId>-<purpose>)
+#   __D1_DATABASE_ID__   the id printed by `wrangler d1 create`
+#   __R2_BUCKET_NAME__   the R2 bucket name    (<accountId>-<purpose>)
+name = "__PROJECT_NAME__"
+pages_build_output_dir = "public"
+compatibility_date = "2024-01-01"
+compatibility_flags = ["nodejs_compat"]
+
+[[d1_databases]]
+binding = "DB"
+database_name = "__D1_DATABASE_NAME__"
+database_id = "__D1_DATABASE_ID__"
+
+# R2 binds by NAME and has no database_id analogue — the one asymmetry with the
+# D1 block above. `binding` is the name the Pages Function reads off env.
+[[r2_buckets]]
+binding = "BUCKET"
+bucket_name = "__R2_BUCKET_NAME__"

package/payload/platform/plugins/cloudflare/skills/site-deploy/SKILL.md

@@ -61,6 +61,14 @@ When the canonical tree carries a contact or waitlist form, the deploy is not co
 
 Name the database with the canonical `<accountId>-<purpose>` scheme from `bin/cf-store-name.sh`, and keep one store per capture purpose: a new capture kind is a discriminator column, not a second database. A document-acceptance form (works agreement, quote signing) uses the canonical `acceptances` shape declared in `references/d1-data-capture.md`, not a per-build table, so the watcher reads one known store.
 
+## Bind the bucket when the tree binds one
+
+When the canonical tree carries an `[[r2_buckets]]` block, the deploy is not complete until a Function can reach the bucket off `env`. Follow `references/r2-object-storage.md`: the bucket is created once by its owning account through the storage broker — not here, and not by this skill's token — the binding is added to `wrangler.toml`, and the Function reads `env.<binding>`.
+
+The binding is declarative config carried in the deploy payload, so the Pages token from the auth step already covers it and no R2 scope is needed at deploy time. Only bucket *creation* needs `Workers R2 Storage Write`, which is the `storage` scope, and it happens outside this skill. An R2-bound Function that fails every store call with `result=failed` is the signature of a binding that did not deploy — check the block reached the tree with `bucket_name` filled, rather than reaching for a token the deploy never needed.
+
+Name the bucket with the canonical `<accountId>-<purpose>` scheme from `bin/cf-store-name.sh`, and keep one bucket per purpose, exactly as the D1 section above requires for databases. A tree with no `[[r2_buckets]]` block skips this section.
+
 ## Open Graph correctness
 
 The live page must carry brand-correct Open Graph metadata: `<meta property="og:title">`, `og:description`, `og:image`, and `og:url` reflecting this site and this brand, not a leftover from whatever the tree was cloned from. Stale OG (a live card still naming a previous brand) is a recorded failure mode of hand deployment. Confirm the `og:*` tags in the deployed HTML are correct before claiming done; if they are stale, fix them in the source tree, redeploy, and re-check.

package/payload/platform/plugins/docs/references/outlook-guide.md

@@ -19,7 +19,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-mail-list` | Mail newest-first. Default top=25, folder=Inbox. `folder` takes a well-known name or alias (case/space-insensitive): Inbox, Sent Items/sent, Drafts, Deleted Items/trash, Junk Email/junk/spam, Archive, Outbox — or a raw folder id. Custom folder names are not resolved. `since`/`before` (ISO date-times) narrow by receipt date. The 250-per-page figure is not a ceiling: the reply carries `nextCursor` when older mail remains — pass it back as `cursor` to page further back. Filter by sender/subject via `outlook-mail-search`. |
 | `outlook-mail-search` | Microsoft Graph `$search` (KQL) over the mailbox. Preview-only, like `outlook-mail-list`, and pages the same way via `nextCursor`/`cursor`. Put sender/subject/recipient/date filters in the query: `from:`, `to:`, `subject:`, `received>=`. Graph forbids `$search`+`$filter`, so a strict date window is on `outlook-mail-list`. |
 | `outlook-mail-fetch-body` | Complete body of one message by id (`GET /me/messages/{id}?$select=body`). HTML decoded to text, no preview cap. The full-read path — list/search return Microsoft's ~255-char preview only. Returns the envelope plus the whole body. |
-| `outlook-mail-attachment` | List or download a message's inbound attachments. With `messageId` alone, LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of file/item/reference) via `GET /me/messages/{id}/attachments` and `$select` (no bytes). With `messageId`+`attachmentId`, DOWNLOADS one file attachment: its bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — item/reference kinds, empty payloads, and anything over 25 MB are refused with nothing written. `outlook-mail-list` / `outlook-mail-search` / `outlook-mail-fetch-body` report `hasAttachments` so the agent knows when to call this. Needs `Mail.Read`. |
+| `outlook-mail-attachment` | List or download any message's attachments — received or draft. With `messageId` alone, LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of file/item/reference) via `GET /me/messages/{id}/attachments` and `$select` (no bytes). A draft is a message in the same collection, so passing a draftId lists what that draft carries; the returned `name`/`id` is what `outlook-draft-edit`'s `removeAttachments` takes. With `messageId`+`attachmentId`, DOWNLOADS one file attachment: its bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — item/reference kinds, empty payloads, and anything over 25 MB are refused with nothing written. `outlook-mail-list` / `outlook-mail-search` / `outlook-mail-fetch-body` report `hasAttachments` so the agent knows when to call this. Needs `Mail.Read`. |
 | `outlook-mail-reply` | Reply in-thread (`createReply` / `createReplyAll` + send). Threads natively via conversationId. `replyAll`, added cc/bcc, and account-scoped file attachments (up to 25 MB per file; files over Graph's ~3 MB inline limit use a chunked upload session). Body is plain text, prepended above the quote. Needs `Mail.ReadWrite` + `Mail.Send`. |
 | `outlook-mail-delete` | Move messages to Deleted Items (`POST /me/messages/{id}/move`). Recoverable — never hard-deletes. An id already gone is counted not-moved. Needs `Mail.ReadWrite`. |
 | `outlook-mail-otp-extract` | Poll the inbox for a one-time code from a sender (domain). Reads full bodies to extract it; optional subject regex and timeout (default 60 s). |
@@ -35,7 +35,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-mailbox-list` | Every connected mailbox with its email, scopes, and token health. Local only — no network — so it also flags a mailbox whose stored credentials cannot be read. |
 | `outlook-mail-send` | Send a message. No attachments → `POST /me/sendMail`; with attachments → draft, attach, send (`/me/sendMail` carries attachments inline and cannot fit a large file). to/cc/bcc arrays, subject, body, isHtml, attachments (account-dir paths, 25 MB/file). Success asserted on Graph 202; no message id on either route. Needs `Mail.Send` (+ `Mail.ReadWrite` to attach). |
 | `outlook-draft` | Create a draft in Drafts (`POST /me/messages`). Same body model, including attachments — files are attached before the id is returned, so the draft is ready to send. Returns the draft id. Needs `Mail.ReadWrite`. |
-| `outlook-draft-edit` | Update an existing draft in place (`PATCH /me/messages/{draftId}`) and/or add attachments. Graph drafts are mutable — pass draftId plus the fields to change (to/cc/bcc/subject/body/isHtml/attachments). Attachments are additive; removal is not supported. Sent messages cannot be edited. Needs `Mail.ReadWrite`. |
+| `outlook-draft-edit` | Update an existing draft in place (`PATCH /me/messages/{draftId}`) and/or add and remove attachments. Graph drafts are mutable — pass draftId plus the fields to change (to/cc/bcc/subject/body/isHtml/attachments/removeAttachments). `attachments` adds; `removeAttachments` takes files off by name or attachment id; both together replace a file in one call. Sent messages cannot be edited. Needs `Mail.ReadWrite`. |
 | `outlook-draft-send` | Send an existing draft by id (`POST /me/messages/{id}/send`). Graph consumes the draft, returns 202. Needs `Mail.Send`. |
 
 ## Observability
@@ -110,4 +110,4 @@ Latency triage: `mail-list count=0 elapsedMs<200` consistent → permissions iss
 
 ## Out of scope
 
-Mail move to arbitrary folders / flag, hard (permanent) delete, removing or replacing an attachment already on a draft, ingesting reviewed mail into the business graph (the `email-ingest` analogue), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.
+Mail move to arbitrary folders / flag, hard (permanent) delete, removing an attachment from a **sent** message (Graph forbids it), ingesting reviewed mail into the business graph (the `email-ingest` analogue), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments, with a draft's attachments editable in place (add, remove, replace) — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.

package/payload/platform/plugins/docs/references/voice-mirror-guide.md

@@ -66,6 +66,7 @@ Voice mirror is on by default for every drafting skill. To opt out for one, set
 - **Copy public figures** — voice mirror only learns from your own writing.
 - **Clone audio** — text only, no speech synthesis.
 - **Guess** — historical content stays `unknown` until you mark it. {{productName}} never auto-classifies your writing. (Automatic ingestion applies only to your live PTY sessions where authorship is certain.)
+- **Invent an identity** — a voice belongs to a real admin user on the account. Attribution is refused outright if it names anyone else, and nothing is written. A person's name is not an identity, so tagging someone's writing on a shared account needs their actual admin id, not their name.
 
 ## Status
 

package/payload/platform/plugins/filesystem/PLUGIN.md

@@ -31,7 +31,6 @@ mcp:
     LOG_DIR: ${LOG_DIR}
     PLATFORM_ROOT: ${PLATFORM_ROOT}
     ACCOUNT_ID: ${ACCOUNT_ID}
-    HOUSE_ADMIN_SCOPE: ${HOUSE_ADMIN_SCOPE}
     SESSION_ID: ${SESSION_ID}
     AGENT_SLUG: ${AGENT_SLUG}
 mcp-manifest: auto

package/payload/platform/plugins/filesystem/mcp/dist/lib/scope.d.ts

@@ -1,16 +1,20 @@
 /**
  * Read HOUSE_ADMIN_SCOPE for the plugin, fail-closed. HOUSE_ADMIN_SCOPE is the
  * whole boundary: it is present in the spawn env ONLY for a house role:admin
- * session (Task 1440). This plugin's PLUGIN.md also declares the key with a
- * `${HOUSE_ADMIN_SCOPE}` placeholder so the value flows on loaders that pass
- * only declared env keys — but an UNSET placeholder is substituted
- * differently across spawn loaders: some yield empty, some leave the literal
- * `${HOUSE_ADMIN_SCOPE}` string (which is truthy). Treating a literal
- * placeholder or an empty value as "no scope" makes a non-house session
- * deterministically fail-closed regardless of loader behaviour — the read
- * never trusts a value it did not receive as a real scope. (This is why the
- * plugin does not call the shared `readHouseAdminScope`, whose truthy test
- * would accept the literal placeholder.)
+ * session (Task 1440), and it reaches this server by INHERITANCE from that
+ * env — never from a declared env block. Task 1700 deleted this plugin's
+ * `HOUSE_ADMIN_SCOPE: ${HOUSE_ADMIN_SCOPE}` declaration: the key is not in the
+ * platform placeholder map, so declaring it could only ever yield the literal
+ * `${HOUSE_ADMIN_SCOPE}` string (which is truthy), and the `mcp-manifest: auto`
+ * generator discards the block anyway. Do not restore the declaration.
+ *
+ * The literal-placeholder guard below stays as defence in depth. Since Task
+ * 1700 the platform drops an unresolvable key rather than emitting its literal,
+ * so no loader should now deliver one — but treating a literal placeholder or
+ * an empty value as "no scope" keeps a non-house session deterministically
+ * fail-closed regardless of loader behaviour: the read never trusts a value it
+ * did not receive as a real scope. (This is why the plugin does not call the
+ * shared `readHouseAdminScope`, whose truthy test would accept the literal.)
  */
 export declare function readPluginHouseScope(env: NodeJS.ProcessEnv): string | null;
 export interface Ctx {

package/payload/platform/plugins/filesystem/mcp/dist/lib/scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/lib/scope.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,IAAI,CAK1E;AAED,MAAM,WAAW,GAAG;IAClB,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClC;IACE,MAAM,EACF,sBAAsB,GACtB,8BAA8B,GAC9B,sCAAsC,CAAC;CAC5C,CAAC;AAEN;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,GAAG,EACR,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,IAAI,EAAE,MAAM,GACX,iBAAiB,CA2BnB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAenE"}
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/lib/scope.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,IAAI,CAK1E;AAED,MAAM,WAAW,GAAG;IAClB,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClC;IACE,MAAM,EACF,sBAAsB,GACtB,8BAA8B,GAC9B,sCAAsC,CAAC;CAC5C,CAAC;AAEN;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,GAAG,EACR,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,IAAI,EAAE,MAAM,GACX,iBAAiB,CA2BnB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAenE"}

package/payload/platform/plugins/filesystem/mcp/dist/lib/scope.js

@@ -20,16 +20,20 @@ const short = (id) => id.slice(0, 8);
 /**
  * Read HOUSE_ADMIN_SCOPE for the plugin, fail-closed. HOUSE_ADMIN_SCOPE is the
  * whole boundary: it is present in the spawn env ONLY for a house role:admin
- * session (Task 1440). This plugin's PLUGIN.md also declares the key with a
- * `${HOUSE_ADMIN_SCOPE}` placeholder so the value flows on loaders that pass
- * only declared env keys — but an UNSET placeholder is substituted
- * differently across spawn loaders: some yield empty, some leave the literal
- * `${HOUSE_ADMIN_SCOPE}` string (which is truthy). Treating a literal
- * placeholder or an empty value as "no scope" makes a non-house session
- * deterministically fail-closed regardless of loader behaviour — the read
- * never trusts a value it did not receive as a real scope. (This is why the
- * plugin does not call the shared `readHouseAdminScope`, whose truthy test
- * would accept the literal placeholder.)
+ * session (Task 1440), and it reaches this server by INHERITANCE from that
+ * env — never from a declared env block. Task 1700 deleted this plugin's
+ * `HOUSE_ADMIN_SCOPE: ${HOUSE_ADMIN_SCOPE}` declaration: the key is not in the
+ * platform placeholder map, so declaring it could only ever yield the literal
+ * `${HOUSE_ADMIN_SCOPE}` string (which is truthy), and the `mcp-manifest: auto`
+ * generator discards the block anyway. Do not restore the declaration.
+ *
+ * The literal-placeholder guard below stays as defence in depth. Since Task
+ * 1700 the platform drops an unresolvable key rather than emitting its literal,
+ * so no loader should now deliver one — but treating a literal placeholder or
+ * an empty value as "no scope" keeps a non-house session deterministically
+ * fail-closed regardless of loader behaviour: the read never trusts a value it
+ * did not receive as a real scope. (This is why the plugin does not call the
+ * shared `readHouseAdminScope`, whose truthy test would accept the literal.)
  */
 export function readPluginHouseScope(env) {
     const raw = env.HOUSE_ADMIN_SCOPE;

package/payload/platform/plugins/filesystem/mcp/dist/lib/scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/lib/scope.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,mDAAmD;AACnD,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,8EAA8E;AAC9E,2CAA2C;AAC3C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAE5F,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAoBD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,GAAQ,EACR,eAAmC,EACnC,IAAY;IAEZ,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAE,EAAE,CACtC,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,2BAA2B,CACrC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,EAC/E,gBAAgB,EAChB,sCAAsC,CACvC,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACrD,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,IAAI,WAAW,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,WAAW,eAAe,UAAU,yBAAyB,GAAG,CAAC,MAAM,IAAI,CACrJ,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,IAAI,WAAW,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,WAAW,eAAe,UAAU,+BAA+B,CAC7I,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAU,EAAE;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,OAAO,aAAa,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,CACrG,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;QAAE,MAAM,EAAE,CAAC;IAClE,IAAI,QAAQ,GAAG,GAAG,CAAC;IACnB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;QAAE,MAAM,EAAE,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/lib/scope.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,mDAAmD;AACnD,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,8EAA8E;AAC9E,2CAA2C;AAC3C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAE5F,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAoBD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,GAAQ,EACR,eAAmC,EACnC,IAAY;IAEZ,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAE,EAAE,CACtC,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,2BAA2B,CACrC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,EAC/E,gBAAgB,EAChB,sCAAsC,CACvC,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtE,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACrD,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,IAAI,WAAW,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,WAAW,eAAe,UAAU,yBAAyB,GAAG,CAAC,MAAM,IAAI,CACrJ,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,IAAI,WAAW,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,WAAW,eAAe,UAAU,+BAA+B,CAC7I,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAU,EAAE;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,OAAO,aAAa,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,IAAI,CACrG,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;QAAE,MAAM,EAAE,CAAC;IAClE,IAAI,QAAQ,GAAG,GAAG,CAAC;IACnB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;QAAE,MAAM,EAAE,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/payload/platform/plugins/outlook/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "outlook",
-  "description": "Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview) with a date window (list) or KQL from:/subject: filters (search) and a nextCursor for paging beyond the newest page; outlook-mail-fetch-body: full body of one message by id; outlook-mail-attachment: list a message's inbound attachments, or download one file attachment's bytes to the account uploads folder; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send, all with attachments; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.",
+  "description": "Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview) with a date window (list) or KQL from:/subject: filters (search) and a nextCursor for paging beyond the newest page; outlook-mail-fetch-body: full body of one message by id; outlook-mail-attachment: list any message's attachments (received or draft), or download one file attachment's bytes to the account uploads folder; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send, all with attachments; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/outlook/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: outlook
-description: Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview) with a date window (list) or KQL from:/subject: filters (search) and a nextCursor for paging beyond the newest page; outlook-mail-fetch-body: full body of one message by id; outlook-mail-attachment: list a message's inbound attachments, or download one file attachment's bytes to the account uploads folder; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send, all with attachments; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.
+description: Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview) with a date window (list) or KQL from:/subject: filters (search) and a nextCursor for paging beyond the newest page; outlook-mail-fetch-body: full body of one message by id; outlook-mail-attachment: list any message's attachments (received or draft), or download one file attachment's bytes to the account uploads folder; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send, all with attachments; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.
 tools:
   - name: outlook-account-register
     publicAllowlist: false
@@ -85,8 +85,6 @@ mcp:
     PLATFORM_ROOT: ${PLATFORM_ROOT}
     ACCOUNT_ID: ${ACCOUNT_ID}
     SESSION_ID: ${SESSION_ID}
-    OUTLOOK_CLIENT_ID: ${OUTLOOK_CLIENT_ID}
-    OUTLOOK_TENANT_ID: ${OUTLOOK_TENANT_ID}
 mcp-manifest: auto
 ---
 
@@ -99,10 +97,10 @@ Microsoft Graph access for Outlook.com / Microsoft 365 mailboxes. Mail is read (
 - **Register:** `outlook-account-register` — starts the OAuth device-code flow against the brand's Entra app and returns a user code + verification URL immediately. The operator opens `microsoft.com/devicelogin` on any device, enters the code, and consents. The always-running server then completes registration on its own: a self-contained dispatcher (`dist/scripts/complete-registration.js`), armed on a 30 s interval, polls every live pending code to a terminal outcome, so a mailbox connects once the operator consents with no agent action. `outlook-account-register-poll` remains the manual path and the fallback, one check per call. Registering a second mailbox on the same account adds it alongside the first rather than replacing it; each mailbox holds its own encrypted tokens (AES-256-CBC) under a shared account key. One device-code flow runs at a time per account; starting another while one is live returns an `in-progress` signal. Observability: `devicecode-autopoll` per poll cycle and an independent `devicecode-stranded` audit for any pending code left un-harvested past its lifetime.
 - **Multiple mailboxes:** one account can hold several mailboxes. Every operational tool takes an optional `mailbox` argument (email or graphUserId). With one mailbox, omit it. With two or more, name it — omitting it returns a refusal listing the connected mailboxes. `outlook-mailbox-list` shows them all.
 - **Mail (read):** `outlook-mail-list` returns messages newest-first with an optional `since`/`before` date window, and `outlook-mail-search` runs a Graph `$search` (KQL) query where `from:`/`to:`/`subject:`/`received>=` filters live — both return Microsoft's short `bodyPreview` (~255 chars) for cheap triage and a `nextCursor` for paging beyond the 250-per-page window (the cursor is an opaque `@odata.nextLink`; pass it back as `cursor`). Graph forbids `$search`+`$filter`, so the strict date window is on the list tool and sender/subject filtering is on the search tool. `outlook-mail-fetch-body` reads the COMPLETE body of one message by id (HTML decoded to text, no preview cap) — the full-read path. All three read tools report `hasAttachments` per message, so the agent knows to reach for the attachment tool.
-- **Mail (attachments):** `outlook-mail-attachment` lists or downloads a message's inbound attachments. Called with `messageId` alone it LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of `file`/`item`/`reference`) via `GET /me/messages/{id}/attachments` with `$select` (no bytes). Called with `messageId`+`attachmentId` it DOWNLOADS one file attachment: the bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved absolute path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — `item` (embedded message/event) and `reference` (cloud-drive link) kinds are refused, as are empty payloads and anything over the 25 MB cap; in each case nothing is written. Requires `Mail.Read`.
+- **Mail (attachments):** `outlook-mail-attachment` lists or downloads any message's attachments — received or draft. Called with `messageId` alone it LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of `file`/`item`/`reference`) via `GET /me/messages/{id}/attachments` with `$select` (no bytes); a draft is a message in the same collection, so passing a draftId lists what that draft carries, and the returned `name`/`id` is the handle `outlook-draft-edit`'s `removeAttachments` takes. Called with `messageId`+`attachmentId` it DOWNLOADS one file attachment: the bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved absolute path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — `item` (embedded message/event) and `reference` (cloud-drive link) kinds are refused, as are empty payloads and anything over the 25 MB cap; in each case nothing is written. Requires `Mail.Read`.
 - **Mail (reply / delete):** `outlook-mail-reply` replies in-thread (native `conversationId` threading) with `replyAll`, added cc/bcc, and account-scoped file attachments (up to 25 MB per file — files over Graph's ~3 MB inline limit stream through a chunked upload session); the body is prepended above the quoted original. `outlook-mail-delete` moves messages to Deleted Items (recoverable — never hard-deletes). Both require `Mail.ReadWrite` (reply also needs `Mail.Send`).
 - **Mail (OTP):** `outlook-mail-otp-extract` polls the inbox for a one-time verification code from a named sender, reading full bodies to extract it — used during service authentication.
-- **Mail (send / draft):** `outlook-mail-send` sends a new message — via `POST /me/sendMail` with no attachments, or composed as a draft, attached, and sent when `attachments` is present (`/me/sendMail` carries attachments inline and cannot fit a large file); `outlook-draft` creates a draft, attaches any files, and returns its id; `outlook-draft-edit` updates an existing draft in place (Graph drafts are mutable) and can add attachments (additive — it cannot remove one); `outlook-draft-send` sends an existing draft by id. Recipients are to/cc/bcc arrays; body is HTML or plain text via `isHtml`; `attachments` are file paths inside the account directory, capped at 25 MB per file and validated before any Graph write. Success asserted on Graph 202. Requires `Mail.Send` + `Mail.ReadWrite`; a mailbox on the old read-only consent returns an actionable "re-register to grant send" signal.
+- **Mail (send / draft):** `outlook-mail-send` sends a new message — via `POST /me/sendMail` with no attachments, or composed as a draft, attached, and sent when `attachments` is present (`/me/sendMail` carries attachments inline and cannot fit a large file); `outlook-draft` creates a draft, attaches any files, and returns its id; `outlook-draft-edit` updates an existing draft in place (Graph drafts are mutable) and edits its attachments — `attachments` adds files, `removeAttachments` takes them off by name or attachment id, and both together replace a file in one call; `outlook-draft-send` sends an existing draft by id. Recipients are to/cc/bcc arrays; body is HTML or plain text via `isHtml`; `attachments` are file paths inside the account directory, capped at 25 MB per file and validated before any Graph write. Success asserted on Graph 202. Requires `Mail.Send` + `Mail.ReadWrite`; a mailbox on the old read-only consent returns an actionable "re-register to grant send" signal.
 - **Calendar (read + control):** `outlook-calendar-list` and `outlook-calendar-event` read events; `outlook-calendar-create` books an event; `outlook-calendar-update` reschedules or edits one; `outlook-calendar-cancel` cancels a meeting (notifying attendees when the account organises it) or deletes a personal appointment; `outlook-calendar-respond` accepts, declines, or tentatively accepts an invite; `outlook-calendar-freebusy` reports availability for one or more addresses over a window. Writes require the `Calendars.ReadWrite` consent; a mailbox on stale read-only consent returns a distinct signal naming the scope and `outlook-account-register`.
 - **Contacts (read-only):** `outlook-contacts-list` returns contacts.
 - **Health:** `outlook-mailbox-info` reports auth state, refresh-window status, and top-level folder count for one mailbox (name it with `mailbox` when several are attached). `outlook-mailbox-list` lists every attached mailbox with its email, scopes, and token health, reading local stores only, never the network. It reports an `addressable` count and a per-mailbox `status` (`ok` / `blank-email` / `refresh-expired` / `unreadable`) so an authenticated, addressable mailbox is distinguishable from one that is merely present: a bare `count` of 1 is not "connected" unless that mailbox is `status:ok`. Use these to answer "did mailbox X auth?" without grepping logs.

package/payload/platform/plugins/outlook/mcp/dist/__tests__/detach.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=detach.test.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/detach.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detach.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/detach.test.ts"],"names":[],"mappings":""}