@rubytech/create-maxy-code 0.1.505 → 0.1.507

package/payload/platform/plugins/admin/PLUGIN.md

@@ -6,111 +6,147 @@ tools:
   - name: system-status
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: public-hostname
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: admin-hostname
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: publish-site
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: brand-settings
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: account-manage
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: capabilities-here
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: account-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: account_list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: account_roster
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: account_create
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: account_reassign_admin
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: account_set_owner_name
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: account_delete
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: account_purge
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: account_channel_routing
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: account_channel_routing_set
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: admin-add
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: admin-remove
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: admin-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: admin-update-pin
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: agent-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: agent-config-read
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: logs-read
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: cpu-triage-start
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: exec
   - name: cpu-triage-read
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: plugin-read
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: skill-load
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: skill-search
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: store-skill
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: session-reset
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: session-resume
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: action-pending
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: action-approve
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: action-reject
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: action-edit
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
 hidden:
   - remote-auth-status
   - remote-auth-set-password

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:1c3857d846036719bbed45a9411a5027e90fc1d28d0a6230e2ef6a7f20b645ec
+content-hash: sha256:a1e6cd6d7cccbf1c314340dd556761adf9aac772939fcd6a870265d0f7c00e1b
 brand: maxy-code
 product-name: Maxy
 ---
@@ -474,6 +474,32 @@ Skill content, plugin manifests, agent templates, and reference files reference
 
 The runtime substitution happens at every read site that flows content into a system prompt or operator-visible UI: the admin agent's `plugin-read` tool (references + `PLUGIN.md`), the `skill-load` tool (SKILL.md by skill name — one-call resolver+reader, the canonical primitive for SKILL.md), the public agent's recursive plugin assembly, and `IDENTITY` / `SOUL` / `AGENTS` / `KNOWLEDGE` markdown reads. Missing or empty `productName` hard-fails — there is no fallback to a default brand string. See [.docs/agents.md](../../.docs/agents.md) § "Brand templating" for the full contract.
 
+## Tool risk classes (for plugin authors)
+
+Every tool a plugin declares in its `PLUGIN.md` `tools:` block carries three mandatory
+fields. `publicAllowlist` and `adminAllowlist` say who may call the tool. `riskClass`
+says what happens when they do, and takes one of four values:
+
+- `read` changes no state anywhere. A remote lookup counts as `read`; reaching the
+  network is not by itself consequential.
+- `write_local` mutates account files or the graph on this device and transmits nothing.
+- `exec` runs an operating-system command, or code supplied by the caller or the operator.
+- `external` transmits to, or changes state on, a system outside this device, or delivers
+  a message to a person.
+
+Leaving the field out is a refusal-to-boot condition, not a silent default. The platform
+refuses to start rather than treat an undeclared consequence as harmless, because a tool
+that quietly reads as `read` escapes every check downstream of it.
+
+Declaring the class does not yet gate anything. It gives any consumer one honest answer
+to the question "is this tool consequential?" without maintaining a list of tool names,
+which is what the checks in `platform/plugins/admin/hooks/` have had to do until now.
+
+A publish-time gate flags declarations that contradict what the tool's own name says it
+does, and a boot line reports the census across all four classes. The classification
+rule, the exception mechanism, and the diagnostic commands are in
+`.docs/tool-risk-classes.md`.
+
 ## MCP Plugin Observability (for plugin authors)
 
 Every `console.error` line from a plugin's MCP server is captured to a per-server raw log. Capture is automatic and needs no import or call: the `mcp-spawn-tee` shim spawns every MCP server and mirrors its stderr to `mcp-<name>-<sessionId>.log` (or `mcp-<name>-nosession.log` for a spawn with no session). That file is keyed by session, which is the conversation, and that is where you grep. Prefix your diagnostics `[your-tool]` so a grep isolates one tool.
@@ -3101,25 +3127,49 @@ kinds, each card tagged `Public` or `Specialist`:
   link.
 
 The former "Public" flyout toggle in the account menu was removed; this page is
-the sole agent surface. The route (`server/routes/admin/agents.ts`) resolves the
-current account via `resolveAccount`; `:slug` params reject `/`, `..`, `\` (the
-traversal guard). A slug containing `--` routes to the specialist branch.
+the sole agent surface.
+
+**Account scope.** The route (`server/routes/admin/agents.ts`) never infers an
+account from device state. The two reads resolve from the caller's admin session
+(`requireAdminSession` + the shared `accountDirForSession` in
+`server/routes/admin/_account-scope.ts`), returning 401 when the session maps to
+no valid account. The two writes carry no admin session (the
+`public-agent-manager` skill calls them), so they take an explicit `accountId`
+query parameter validated against the account list and refuse a missing or
+unknown one with 400 — never defaulting to a resolved account. `:slug` params
+reject `/`, `..`, `\` (the traversal guard); specialist detail is selected by an
+explicit `?plugin=` parameter, not inferred from `--` in the slug.
 
 | Route | Behaviour |
 |-------|-----------|
-| `GET /api/admin/agents` | Lists public `agents/*/` dirs (never the `admin` agent) plus user-created specialists from `plugins/*/agents/*.md`, each row tagged `kind`. Returns `{agents, skipped, specialistsSkipped}` — `skipped` counts public dirs whose `config.json` failed to parse; `specialistsSkipped` counts specialist `.md` files with no parseable `name`. |
-| `GET /api/admin/agents/:slug` | A `--`-free slug returns a public agent's config fields + four owned docs + a `present` map (a missing doc is `''`/`present.<role>=false`, never a 500). A `--` slug returns a specialist's `{kind, model, tools, systemPrompt, skills}`. Unknown 404s. |
-| `DELETE /api/admin/agents/:slug` | Public agents only: removes the dir after `deleteAgentProjection`; refuses the `admin` slug. Loud-fail: a graph-cleanup throw aborts the file removal. |
-
-Observability rides `[admin/agents]`: `op=list agents=<n> specialists=<m>
-skipped=<x> specialistsSkipped=<y>` (the heartbeat — `skipped>0`/`specialistsSkipped>0`
-is a malformed-source signal the page renders as a banner; `specialists=0` with
-user plugins present is the broken-walk signature), `op=detail slug=<…>
-kind=<public|specialist>` (with `present=<comma-list|none>` on the public branch —
-a role absent for an agent expected complete is the missing-doc signature;
-`op=list-specialist-skip plugin=<p> file=<f>` per unreadable specialist), and the
-existing delete lines (`deleted agent "<slug>"` / `graph cleanup failed …
-aborting file removal`).
+| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent) plus its user-created specialists from `plugins/*/agents/*.md`, each row tagged `kind`. Returns `{agents, accountId, skipped, specialistsSkipped}` — `accountId` names the account resolved (the client sends it back on a delete); `skipped` counts public dirs whose `config.json` failed to parse; `specialistsSkipped` counts specialist `.md` files with no parseable `name`. 401 when the session maps to no account. |
+| `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, returns that plugin's specialist `{kind, model, tools, systemPrompt, skills}`. Unknown 404s, 401 as above. |
+| `DELETE /api/admin/agents/:slug?accountId=` | Public agents only, on the named validated account. Removes the dir after `deleteAgentProjection`; refuses the `admin` slug (403) and a missing/unknown `accountId` (400) with no write. Loud-fail: a graph-cleanup throw aborts the file removal. |
+| `POST /api/admin/agents/:slug/project?accountId=` | Re-projects the named account's on-disk agent into the graph. Same `accountId` contract as delete. |
+
+Observability rides `[admin/agents]`, and **every line names the account it acted
+on** (`accountId=<id8>`) — a well-formed answer about the wrong account is
+otherwise indistinguishable from a correct one, which is exactly how an empty
+Agents page survived undiagnosed on a multi-account install.
+
+- `op=list accountId=<id8> agents=<n> specialists=<m> skipped=<x> specialistsSkipped=<y>`
+  — the heartbeat. Compare `accountId` against the account the operator is
+  viewing; `skipped>0`/`specialistsSkipped>0` is a malformed-source signal the
+  page renders as a banner, and `specialists=0` with user plugins present is the
+  broken-walk signature.
+- `op=detail accountId=<id8> slug=<…> kind=<public|specialist>` — with
+  `present=<comma-list|none>` on the public branch, where a role absent for an
+  agent expected complete is the missing-doc signature. One
+  `op=list-specialist-skip plugin=<p> file=<f>` per unreadable specialist.
+- `op=<list|detail> auth-rejected reason=no-account-for-session` — the session
+  maps to no valid account. No `op=list` line at all for a page load means the
+  request never reached the handler, a distinct signature from a zero count.
+- `op=<delete|project> rejected reason=<missing-accountId|unknown-accountId>` —
+  a caller that did not name its account. A skill that was not updated produces
+  this on its first call instead of writing to the wrong account.
+- `op=delete accountId=<id8> slug=<…> outcome=<ok|failed>` with
+  `reason=<graph-cleanup-failed|rm-error>` on failure (files preserved on a
+  graph-cleanup throw).
 
 ### Graph
 
@@ -3253,6 +3303,44 @@ the Web Share API and is disabled where unavailable. Signals:
 `[data-ui] op=mount header=operator home=absent`, `op=select-enter`,
 `op=select-exit reason=<cancel|action>`, `op=share supported=<bool> count=<n>`.
 
+**The dashboard has a surface ramp and a display type tier.** Every page sits on
+a page plane, cards rise onto a raised plane, and inputs and scroll regions
+recede onto an inset plane. Each brand chooses how the card separates: SiteDesk's
+card is a shade lighter than its page and casts no shadow, Real Agent's card and
+page are both white and a shadow does the work. The page header is an inverted
+band carrying the page title at the display size. Colours, radii, shadows and
+type weights all come from the brand's own tokens; nothing is hardcoded, and a
+token that resolves to nothing fails the build rather than painting invisibly.
+
+**Folders open beside a rail on a wide screen.** At 1280px and above the folder
+view splits in two: a list of the account's folders on the left, the files on
+the right, with the folder you are in highlighted. Below that width the rail is
+hidden and the breadcrumb does the same job.
+
+**Status colours are shared.** Success, warning, error and info each carry a
+solid fill, a pale tint and a text colour for that tint. Every pairing meets the
+WCAG AA contrast minimum, on every brand.
+
+**`/data` opens on the account's own folders, as cards.** With no `#path=` in
+the URL the browser lands on **home**: the account's business folders (the
+entity folders of its trade, plus documents, projects, contacts, the work it
+has produced for you, anything a client has sent in, and any websites it
+has published) shown
+one per card, each listing the first 20 things inside it and a `+N more` row
+past that. Tapping a card opens that folder in the ordinary list or grid. There
+are never loose files at this level. Everything the platform and its plugins
+keep for themselves — caches, logs, published sites, plugin workspaces, hidden
+folders — sits behind a single **system** card at the end, and opens as the
+ordinary list too. The split comes from the account's own `SCHEMA.md`, so it
+follows the graph ontology rather than a hardcoded list, and nothing moves on
+disk. Upload and New folder are disabled on the cards view because it names no
+single folder to write into; open a folder first. The flat account root is still
+reachable from the account name in the breadcrumb, which is the way back if a
+folder is ever grouped wrongly. Signals: `[data-schema] op=classify` on every
+account-root listing (`home=`, `system=`, `unknown=`, `status=ok|parse-failed`),
+`op=home-files` when a name that should be a folder is a file, and
+`op=card-children … status=error` when one card's folder could not be read.
+
 **`/data` list ↔ grid view + image thumbnails.** A toolbar toggle switches the
 file browser between the two-line list and a **grid**. In grid view, image
 files render an inline thumbnail; folders render a folder tile (still navigate

package/payload/platform/plugins/admin/skills/public-agent-manager/SKILL.md

@@ -176,7 +176,7 @@ After creation, no template metadata persists in the agent's files. The resultin
 8. **KNOWLEDGE.md generation** — populate from the now-tagged set plus keyword matches using the `update-knowledge` skill workflow. KNOWLEDGE.md is required and must be non-empty; an empty or missing KNOWLEDGE is refused at spawn.
 9. Write `config.json` with selected model, status "active", and `knowledgeKeywords`. This is the last gated write — placed after IDENTITY.md, SOUL.md, and KNOWLEDGE.md to prevent cascade failure if one gate stalls.
 10. Check context budget — auto-summarise if over threshold
-11. **Project the agent into the graph** — delegate to the `specialists:database-operator` specialist with the instruction: "Project public agent `{slug}` into the graph by POSTing to `/api/admin/agents/{slug}/project`." The route reads the on-disk files and idempotently MERGEs the `:Agent` node, the four owned `:KnowledgeDocument` projections (IDENTITY/SOUL/KNOWLEDGE/KNOWLEDGE-SUMMARY when present, namespaced `attachmentId="agent:<slug>:<role>"`), the `HAS_*` edges, and the `USES_KNOWLEDGE` edges to every operator-tagged doc. Loud-fail: if the route returns non-2xx, surface the error to the user verbatim — the agent's files exist on disk but its graph projection is incomplete, which means the operator's /graph view will not show this agent. Re-running the projection is safe; it is the same idempotent MERGE.
+11. **Project the agent into the graph** — delegate to the `specialists:database-operator` specialist with the instruction: "Project public agent `{slug}` into the graph by POSTing to `/api/admin/agents/{slug}/project?accountId=<the literal ACCOUNT_ID value you read>`." The route reads the on-disk files and idempotently MERGEs the `:Agent` node, the four owned `:KnowledgeDocument` projections (IDENTITY/SOUL/KNOWLEDGE/KNOWLEDGE-SUMMARY when present, namespaced `attachmentId="agent:<slug>:<role>"`), the `HAS_*` edges, and the `USES_KNOWLEDGE` edges to every operator-tagged doc. Loud-fail: if the route returns non-2xx, surface the error to the user verbatim — the agent's files exist on disk but its graph projection is incomplete, which means the operator's /graph view will not show this agent. Re-running the projection is safe; it is the same idempotent MERGE. The `accountId` query parameter is required on every write to this route (project and delete). The route no longer infers an account from device state, so it returns 400 without one and 403 when the caller is not entitled to the account it named. Source the value from the `ACCOUNT_ID` environment variable of this session (`echo $ACCOUNT_ID`), and substitute the literal id into the URL before delegating, since the specialist you delegate to does not share your shell.
 12. **Set the default if none exists.** Read `defaultAgent` from `account-manage`. If it is empty, set it to this new slug via `account-update` (`field: "defaultAgent"`, `value: "{slug}"`) — otherwise the agent answers at `/{slug}` but the bare root serves nothing. If a default already exists, do not change it silently: tell the operator the current default and ask whether to switch the root to this new agent; call `account-update` only if they say yes.
 13. Confirm creation: "Agent created and reachable at `/{slug}`." If you set or changed the default in step 12, add: "The site root also serves this agent." If a different default remains, add: "The site root still serves `{currentDefault}`."
 
@@ -213,7 +213,7 @@ For knowledge scope changes:
 - Allow adding/removing keyword subscriptions (update `knowledgeKeywords` in `config.json`).
 - After changes, offer to refresh KNOWLEDGE.md using the `update-knowledge` skill.
 
-**After every Edit operation that touches IDENTITY/SOUL/KNOWLEDGE/KNOWLEDGE-SUMMARY/`config.json` (including `knowledgeKeywords` or direct-tag mutations), delegate to `specialists:database-operator` to re-project: POST `/api/admin/agents/{slug}/project`.** Without re-projection the on-disk files diverge from the graph state — the operator sees stale `:Agent` properties and stale `USES_KNOWLEDGE` edges in /graph. Loud-fail: surface non-2xx errors verbatim.
+**After every Edit operation that touches IDENTITY/SOUL/KNOWLEDGE/KNOWLEDGE-SUMMARY/`config.json` (including `knowledgeKeywords` or direct-tag mutations), delegate to `specialists:database-operator` to re-project: POST `/api/admin/agents/{slug}/project?accountId={accountId}`.** Without re-projection the on-disk files diverge from the graph state — the operator sees stale `:Agent` properties and stale `USES_KNOWLEDGE` edges in /graph. Loud-fail: surface non-2xx errors verbatim.
 
 ### Delete
 
@@ -226,7 +226,7 @@ Deletion removes the entire agent directory (`agents/{slug}/`) — not individua
 - If no other agents remain (or the user declines to set a new default), clear the `defaultAgent` field by calling `account-update` with `field: "defaultAgent"`, `value: ""`. Tell the user that visitors to the root URL will see a "no agents" message until a new agent is created.
 
 **Cleanup sequence:**
-- Issue `DELETE /api/admin/agents/{slug}` — the route removes the `:Agent` node and its four owned `:KnowledgeDocument` projections FIRST, then deletes the directory. Loud-fail: if graph cleanup throws, files are preserved and a 500 is returned with the error text. Re-issuing the DELETE is safe (idempotent on both layers). Operator-tagged docs survive the projection delete — only the `USES_KNOWLEDGE` edges from this Agent are removed.
+- Issue `DELETE /api/admin/agents/{slug}?accountId={accountId}` — the route removes the `:Agent` node and its four owned `:KnowledgeDocument` projections FIRST, then deletes the directory. Loud-fail: if graph cleanup throws, files are preserved and a 500 is returned with the error text. Re-issuing the DELETE is safe (idempotent on both layers). Operator-tagged docs survive the projection delete — only the `USES_KNOWLEDGE` edges from this Agent are removed.
 - Verify the directory no longer exists
 - Report what was removed (list the files that were in the directory)
 

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,19 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-25 (0.1.507)
+
+- Chat now updates the moment a message or permission prompt arrives, instead of checking every couple of seconds.
+- The dashboard has a visual refresh: cards now fill in properly instead of looking transparent.
+- The Data page has a new two-pane view with a folder rail on wider screens, and uploads/sites are now correctly grouped under Home.
+- Every assistant tool now carries a declared risk level, checked automatically so it cannot silently drift.
+
+## 2026-07-25 (0.1.506)
+
+- Fixed a bug where the Agents page and a few other admin screens could resolve the wrong account.
+- The dashboard and sidebar now update instantly when something changes, instead of waiting for the next refresh.
+- The Data page now groups your files into Home and System, with a clearer card layout.
+
 ## 2026-07-25 (0.1.505)
 
 - Upgraded to Claude Opus 5, the assistant's most capable model.

package/payload/platform/plugins/aeo/PLUGIN.md

@@ -5,12 +5,15 @@ tools:
   - name: aeo-emit-jsonld
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: aeo-write-llms-txt
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: aeo-audit-page
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
 skills:
   - skills/structured-answer/SKILL.md
 always: false

package/payload/platform/plugins/browser/PLUGIN.md

@@ -5,57 +5,75 @@ tools:
   - name: browser-render
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-navigate
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-snapshot
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-click
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-fill
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-fill-form
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-type
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-press-key
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-hover
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-select-option
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-wait-for
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-handle-dialog
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-evaluate
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: exec
   - name: browser-console-messages
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-tabs
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-pdf-save
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: browser-screenshot
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: browser-resize
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 always: true
 embed: false
 metadata: {"platform":{}}

package/payload/platform/plugins/connector/PLUGIN.md

@@ -5,15 +5,19 @@ tools:
   - name: connector-register
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: connector-call
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: connector-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: connector-deregister
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
 metadata: {"platform":{"optional":true,"pluginKey":"connector"}}
 mcp:
   command: node

package/payload/platform/plugins/contacts/PLUGIN.md

@@ -5,30 +5,39 @@ tools:
   - name: contact-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: contact-lookup
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: contact-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: contact-delete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: contact-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: contact-export
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: contact-erase
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: group-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: group-manage
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
 always: false
 embed: false
 metadata: {"platform":{}}

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -174,25 +174,49 @@ kinds, each card tagged `Public` or `Specialist`:
   link.
 
 The former "Public" flyout toggle in the account menu was removed; this page is
-the sole agent surface. The route (`server/routes/admin/agents.ts`) resolves the
-current account via `resolveAccount`; `:slug` params reject `/`, `..`, `\` (the
-traversal guard). A slug containing `--` routes to the specialist branch.
+the sole agent surface.
+
+**Account scope.** The route (`server/routes/admin/agents.ts`) never infers an
+account from device state. The two reads resolve from the caller's admin session
+(`requireAdminSession` + the shared `accountDirForSession` in
+`server/routes/admin/_account-scope.ts`), returning 401 when the session maps to
+no valid account. The two writes carry no admin session (the
+`public-agent-manager` skill calls them), so they take an explicit `accountId`
+query parameter validated against the account list and refuse a missing or
+unknown one with 400 — never defaulting to a resolved account. `:slug` params
+reject `/`, `..`, `\` (the traversal guard); specialist detail is selected by an
+explicit `?plugin=` parameter, not inferred from `--` in the slug.
 
 | Route | Behaviour |
 |-------|-----------|
-| `GET /api/admin/agents` | Lists public `agents/*/` dirs (never the `admin` agent) plus user-created specialists from `plugins/*/agents/*.md`, each row tagged `kind`. Returns `{agents, skipped, specialistsSkipped}` — `skipped` counts public dirs whose `config.json` failed to parse; `specialistsSkipped` counts specialist `.md` files with no parseable `name`. |
-| `GET /api/admin/agents/:slug` | A `--`-free slug returns a public agent's config fields + four owned docs + a `present` map (a missing doc is `''`/`present.<role>=false`, never a 500). A `--` slug returns a specialist's `{kind, model, tools, systemPrompt, skills}`. Unknown 404s. |
-| `DELETE /api/admin/agents/:slug` | Public agents only: removes the dir after `deleteAgentProjection`; refuses the `admin` slug. Loud-fail: a graph-cleanup throw aborts the file removal. |
-
-Observability rides `[admin/agents]`: `op=list agents=<n> specialists=<m>
-skipped=<x> specialistsSkipped=<y>` (the heartbeat — `skipped>0`/`specialistsSkipped>0`
-is a malformed-source signal the page renders as a banner; `specialists=0` with
-user plugins present is the broken-walk signature), `op=detail slug=<…>
-kind=<public|specialist>` (with `present=<comma-list|none>` on the public branch —
-a role absent for an agent expected complete is the missing-doc signature;
-`op=list-specialist-skip plugin=<p> file=<f>` per unreadable specialist), and the
-existing delete lines (`deleted agent "<slug>"` / `graph cleanup failed …
-aborting file removal`).
+| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent) plus its user-created specialists from `plugins/*/agents/*.md`, each row tagged `kind`. Returns `{agents, accountId, skipped, specialistsSkipped}` — `accountId` names the account resolved (the client sends it back on a delete); `skipped` counts public dirs whose `config.json` failed to parse; `specialistsSkipped` counts specialist `.md` files with no parseable `name`. 401 when the session maps to no account. |
+| `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, returns that plugin's specialist `{kind, model, tools, systemPrompt, skills}`. Unknown 404s, 401 as above. |
+| `DELETE /api/admin/agents/:slug?accountId=` | Public agents only, on the named validated account. Removes the dir after `deleteAgentProjection`; refuses the `admin` slug (403) and a missing/unknown `accountId` (400) with no write. Loud-fail: a graph-cleanup throw aborts the file removal. |
+| `POST /api/admin/agents/:slug/project?accountId=` | Re-projects the named account's on-disk agent into the graph. Same `accountId` contract as delete. |
+
+Observability rides `[admin/agents]`, and **every line names the account it acted
+on** (`accountId=<id8>`) — a well-formed answer about the wrong account is
+otherwise indistinguishable from a correct one, which is exactly how an empty
+Agents page survived undiagnosed on a multi-account install.
+
+- `op=list accountId=<id8> agents=<n> specialists=<m> skipped=<x> specialistsSkipped=<y>`
+  — the heartbeat. Compare `accountId` against the account the operator is
+  viewing; `skipped>0`/`specialistsSkipped>0` is a malformed-source signal the
+  page renders as a banner, and `specialists=0` with user plugins present is the
+  broken-walk signature.
+- `op=detail accountId=<id8> slug=<…> kind=<public|specialist>` — with
+  `present=<comma-list|none>` on the public branch, where a role absent for an
+  agent expected complete is the missing-doc signature. One
+  `op=list-specialist-skip plugin=<p> file=<f>` per unreadable specialist.
+- `op=<list|detail> auth-rejected reason=no-account-for-session` — the session
+  maps to no valid account. No `op=list` line at all for a page load means the
+  request never reached the handler, a distinct signature from a zero count.
+- `op=<delete|project> rejected reason=<missing-accountId|unknown-accountId>` —
+  a caller that did not name its account. A skill that was not updated produces
+  this on its first call instead of writing to the wrong account.
+- `op=delete accountId=<id8> slug=<…> outcome=<ok|failed>` with
+  `reason=<graph-cleanup-failed|rm-error>` on failure (files preserved on a
+  graph-cleanup throw).
 
 ### Graph
 
@@ -326,6 +350,44 @@ the Web Share API and is disabled where unavailable. Signals:
 `[data-ui] op=mount header=operator home=absent`, `op=select-enter`,
 `op=select-exit reason=<cancel|action>`, `op=share supported=<bool> count=<n>`.
 
+**The dashboard has a surface ramp and a display type tier.** Every page sits on
+a page plane, cards rise onto a raised plane, and inputs and scroll regions
+recede onto an inset plane. Each brand chooses how the card separates: SiteDesk's
+card is a shade lighter than its page and casts no shadow, Real Agent's card and
+page are both white and a shadow does the work. The page header is an inverted
+band carrying the page title at the display size. Colours, radii, shadows and
+type weights all come from the brand's own tokens; nothing is hardcoded, and a
+token that resolves to nothing fails the build rather than painting invisibly.
+
+**Folders open beside a rail on a wide screen.** At 1280px and above the folder
+view splits in two: a list of the account's folders on the left, the files on
+the right, with the folder you are in highlighted. Below that width the rail is
+hidden and the breadcrumb does the same job.
+
+**Status colours are shared.** Success, warning, error and info each carry a
+solid fill, a pale tint and a text colour for that tint. Every pairing meets the
+WCAG AA contrast minimum, on every brand.
+
+**`/data` opens on the account's own folders, as cards.** With no `#path=` in
+the URL the browser lands on **home**: the account's business folders (the
+entity folders of its trade, plus documents, projects, contacts, the work it
+has produced for you, anything a client has sent in, and any websites it
+has published) shown
+one per card, each listing the first 20 things inside it and a `+N more` row
+past that. Tapping a card opens that folder in the ordinary list or grid. There
+are never loose files at this level. Everything the platform and its plugins
+keep for themselves — caches, logs, published sites, plugin workspaces, hidden
+folders — sits behind a single **system** card at the end, and opens as the
+ordinary list too. The split comes from the account's own `SCHEMA.md`, so it
+follows the graph ontology rather than a hardcoded list, and nothing moves on
+disk. Upload and New folder are disabled on the cards view because it names no
+single folder to write into; open a folder first. The flat account root is still
+reachable from the account name in the breadcrumb, which is the way back if a
+folder is ever grouped wrongly. Signals: `[data-schema] op=classify` on every
+account-root listing (`home=`, `system=`, `unknown=`, `status=ok|parse-failed`),
+`op=home-files` when a name that should be a folder is a file, and
+`op=card-children … status=error` when one card's folder could not be read.
+
 **`/data` list ↔ grid view + image thumbnails.** A toolbar toggle switches the
 file browser between the two-line list and a **grid**. In grid view, image
 files render an inline thumbnail; folders render a folder tile (still navigate