@rubytech/create-maxy-code 0.1.505 → 0.1.507

package/payload/platform/plugins/docs/references/plugins-guide.md

@@ -150,6 +150,32 @@ Skill content, plugin manifests, agent templates, and reference files reference
 
 The runtime substitution happens at every read site that flows content into a system prompt or operator-visible UI: the admin agent's `plugin-read` tool (references + `PLUGIN.md`), the `skill-load` tool (SKILL.md by skill name — one-call resolver+reader, the canonical primitive for SKILL.md), the public agent's recursive plugin assembly, and `IDENTITY` / `SOUL` / `AGENTS` / `KNOWLEDGE` markdown reads. Missing or empty `productName` hard-fails — there is no fallback to a default brand string. See [.docs/agents.md](../../.docs/agents.md) § "Brand templating" for the full contract.
 
+## Tool risk classes (for plugin authors)
+
+Every tool a plugin declares in its `PLUGIN.md` `tools:` block carries three mandatory
+fields. `publicAllowlist` and `adminAllowlist` say who may call the tool. `riskClass`
+says what happens when they do, and takes one of four values:
+
+- `read` changes no state anywhere. A remote lookup counts as `read`; reaching the
+  network is not by itself consequential.
+- `write_local` mutates account files or the graph on this device and transmits nothing.
+- `exec` runs an operating-system command, or code supplied by the caller or the operator.
+- `external` transmits to, or changes state on, a system outside this device, or delivers
+  a message to a person.
+
+Leaving the field out is a refusal-to-boot condition, not a silent default. The platform
+refuses to start rather than treat an undeclared consequence as harmless, because a tool
+that quietly reads as `read` escapes every check downstream of it.
+
+Declaring the class does not yet gate anything. It gives any consumer one honest answer
+to the question "is this tool consequential?" without maintaining a list of tool names,
+which is what the checks in `platform/plugins/admin/hooks/` have had to do until now.
+
+A publish-time gate flags declarations that contradict what the tool's own name says it
+does, and a boot line reports the census across all four classes. The classification
+rule, the exception mechanism, and the diagnostic commands are in
+`.docs/tool-risk-classes.md`.
+
 ## MCP Plugin Observability (for plugin authors)
 
 Every `console.error` line from a plugin's MCP server is captured to a per-server raw log. Capture is automatic and needs no import or call: the `mcp-spawn-tee` shim spawns every MCP server and mirrors its stderr to `mcp-<name>-<sessionId>.log` (or `mcp-<name>-nosession.log` for a spawn with no session). That file is keyed by session, which is the conversation, and that is where you grep. Prefix your diagnostics `[your-tool]` so a grep isolates one tool.

package/payload/platform/plugins/email/PLUGIN.md

@@ -5,54 +5,71 @@ tools:
   - name: email-provider-info
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-setup
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: email-read
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-fetch-body
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-fetch-attachment
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-send
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-reply
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-draft
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-draft-edit
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-draft-send
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-search
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-delete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-graph-query
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-fetch
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-ingest
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: email-otp-extract
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-status
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
 always: false
 embed: ["admin"]
 metadata: {"platform":{}}

package/payload/platform/plugins/filesystem/PLUGIN.md

@@ -5,21 +5,27 @@ tools:
   - name: file-read
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: file-write
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: file-edit
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: file-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: file-glob
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: file-grep
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 metadata: {"platform":{"always":false,"embed":[],"pluginKey":"filesystem"}}
 mcp:
   command: node

package/payload/platform/plugins/google/PLUGIN.md

@@ -5,39 +5,51 @@ tools:
   - name: google-account-register
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: google-account-register-poll
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: google-account-register-submit
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: google-calendar-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: google-calendar-event
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: google-calendar-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: google-calendar-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: google-calendar-cancel
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: google-calendar-respond
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: google-calendar-freebusy
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: google-account-info
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: google-account-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
 mcp:
   command: node
   args:

package/payload/platform/plugins/graph/PLUGIN.md

@@ -4,12 +4,15 @@ tools:
   - name: maxy-graph-read_neo4j_cypher
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: maxy-graph-get_neo4j_schema
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: maxy-graph-write_neo4j_cypher
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
 mcp-manifest: shared-lib
 mcp:
   command: node

package/payload/platform/plugins/graph-viewer/PLUGIN.md

@@ -17,6 +17,7 @@ tools:
   - name: graph-render
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 ---
 
 # graph-viewer

package/payload/platform/plugins/ledger/PLUGIN.md

@@ -5,24 +5,31 @@ tools:
   - name: ledger-invoice-record
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: ledger-payment-record
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: ledger-credit-record
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: ledger-cash-record
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: ledger-balance
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: ledger-statement
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: ledger-reconcile
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 always: false
 embed: false
 metadata: {"platform":{}}

package/payload/platform/plugins/memory/PLUGIN.md

@@ -6,126 +6,167 @@ tools:
   - name: memory-search
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-write
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-update
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-edge
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-update-by-name
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-reindex
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: memory-ingest
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: kd-classify
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: memory-ingest-extract
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: memory-ingest-web
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: memory-find-candidates
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-node-exists
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-lookup-by-name
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-delete
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-restore
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-empty-trash
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-list-attachments
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-read-attachment
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-edit-attachment
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-rename-attachment
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-archive-write
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: obsidian-vault-import
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: conversation-archive-list-chunks
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: conversation-archive-derive-insights
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: conversation-archive-enrich-rejection
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: memory-report-write
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-report-read-latest
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-report-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-compiled-truth-history
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: conversation-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: conversation-search
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: profile-read
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: profile-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: profile-delete
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-brain-capture-recent
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: graph-prune-denylist-add
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: graph-prune-denylist-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: graph-prune-denylist-remove
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: conversation-memory-expunge
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-dream-run
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-review-queue
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 hidden:
   - session-compact
   - session-compact-status

package/payload/platform/plugins/outlook/PLUGIN.md

@@ -5,75 +5,99 @@ tools:
   - name: outlook-account-register
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: outlook-account-register-poll
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: outlook-mail-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mail-search
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mail-fetch-body
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mail-attachment
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mail-reply
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-mail-delete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-mail-ingest
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: outlook-mail-otp-extract
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mail-send
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-draft
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-draft-send
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-draft-edit
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-calendar-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-calendar-event
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-calendar-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-calendar-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-calendar-cancel
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-calendar-respond
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-calendar-freebusy
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-contacts-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mailbox-info
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mailbox-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
 always: false
 embed: ["admin"]
 metadata: {"platform":{"optional":true}}

package/payload/platform/plugins/quickbooks/PLUGIN.md

@@ -5,48 +5,63 @@ tools:
   - name: quickbooks-credentials-set
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: quickbooks-authorize-url
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: quickbooks-connections
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: quickbooks-token-audit
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: quickbooks-disconnect
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: quickbooks-query
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: quickbooks-report
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: quickbooks-invoice-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-invoice-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-customer-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-customer-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-bill-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-payment-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-entity-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-entity-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
 skills:
   - skills/quickbooks/SKILL.md
 metadata: {"platform":{"optional":true,"pluginKey":"quickbooks"}}

package/payload/platform/plugins/replicate/PLUGIN.md

@@ -5,12 +5,15 @@ tools:
   - name: image-generate
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: replicate-key-store
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: replicate-key-verify
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 metadata: {"platform":{"optional":true,"recommended":true,"pluginKey":"replicate"}}
 mcp:
   command: node

package/payload/platform/plugins/scheduling/PLUGIN.md

@@ -5,33 +5,43 @@ tools:
   - name: schedule-event
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: schedule-get
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: schedule-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-cancel
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-export-ics
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-import-ics
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-archive-ics
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: schedule-connector-busy-sync
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: time-resolve
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 skills:
   - skills/daily-prep/SKILL.md
   - skills/briefing/SKILL.md

package/payload/platform/plugins/storage-broker/PLUGIN.md

@@ -6,39 +6,51 @@ tools:
   - name: storage-d1-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: storage-d1-create
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-d1-query
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-r2-bucket-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: storage-r2-bucket-create
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-r2-object-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: storage-r2-object-get
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: storage-r2-object-put
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-r2-object-delete
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-pages-create
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-pages-deploy
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: storage-pages-adopt
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
 metadata: {"platform":{"embed":["admin"]}}
 mcp:
   command: node