@rubytech/create-maxy-code 0.1.506 → 0.1.507

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.506",
+  "version": "0.1.507",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"
@@ -13,7 +13,7 @@
     "build": "tsc",
     "bundle": "node scripts/bundle.js",
     "test": "npm run build && node --test 'dist/__tests__/*.test.js'",
-    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-plugin-tools-mcp-consistency.mjs && node ../../platform/scripts/check-specialist-tool-surface.mjs && node ../../platform/scripts/check-agent-contract.mjs && node ../../platform/scripts/check-routing-prose-bash.mjs && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-no-esm-require.mjs && node ../../platform/scripts/check-no-raw-mcp-registrations.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/scripts/check-architecture-skill-no-drift.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && bash ../../platform/scripts/smoke-boot-services.sh && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
+    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-plugin-tools-mcp-consistency.mjs && node ../../platform/scripts/check-risk-class.mjs && node ../../platform/scripts/check-specialist-tool-surface.mjs && node ../../platform/scripts/check-agent-contract.mjs && node ../../platform/scripts/check-routing-prose-bash.mjs && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-no-esm-require.mjs && node ../../platform/scripts/check-no-raw-mcp-registrations.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/scripts/check-architecture-skill-no-drift.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && bash ../../platform/scripts/smoke-boot-services.sh && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
   },
   "files": [
     "dist",

package/payload/platform/config/brand.json

@@ -19,9 +19,16 @@
   "googleClientSecret": "",
   "commercialMode": false,
   "vertical": "schema-knowledge-work",
-  "shipsPremiumBundles": ["venture-studio", "writer-craft", "teaching", "management-consulting"],
-  "primaryContainer": { "label": "Project", "term": "Projects" },
-
+  "shipsPremiumBundles": [
+    "venture-studio",
+    "writer-craft",
+    "teaching",
+    "management-consulting"
+  ],
+  "primaryContainer": {
+    "label": "Project",
+    "term": "Projects"
+  },
   "defaultColors": {
     "primary": "#7C8C72",
     "primaryHover": "#6A7A62",
@@ -31,14 +38,11 @@
     "background": "#F6F5F2",
     "agentBubble": "#F5F2ED"
   },
-
   "defaultFonts": {
     "display": "'Newsreader', Georgia, serif",
     "body": "'Inter', -apple-system, BlinkMacSystemFont, sans-serif"
   },
-
   "logoContainsName": true,
-
   "assets": {
     "logo": "maxy-square.png",
     "icon": "maxy-monochrome.png",
@@ -48,27 +52,69 @@
     "appIcon192": "maxy-app-icon-192.png",
     "maskableIcon": "maxy-app-icon-maskable-512.png"
   },
-
   "npm": {
     "packageName": "@rubytech/create-maxy-code",
     "binName": "create-maxy-code",
     "author": "Rubytech LLC"
   },
-
   "plugins": {
-    "core": ["admin", "memory", "docs", "cloudflare", "anthropic", "workflows", "work", "ledger", "scheduling", "email", "contacts", "projects", "prompt-optimiser", "browser"],
-    "defaultEnabled": ["business-assistant", "sales", "web-designer"],
-    "available": ["connector", "telegram", "deep-research", "whatsapp", "replicate", "linkedin-import", "notion-import", "obsidian-import", "x-import", "slides"],
-    "excluded": ["joblogic"]
+    "core": [
+      "admin",
+      "memory",
+      "docs",
+      "cloudflare",
+      "anthropic",
+      "workflows",
+      "work",
+      "ledger",
+      "scheduling",
+      "email",
+      "contacts",
+      "projects",
+      "prompt-optimiser",
+      "browser"
+    ],
+    "defaultEnabled": [
+      "business-assistant",
+      "sales",
+      "web-designer"
+    ],
+    "available": [
+      "connector",
+      "telegram",
+      "deep-research",
+      "whatsapp",
+      "replicate",
+      "linkedin-import",
+      "notion-import",
+      "obsidian-import",
+      "x-import",
+      "slides"
+    ],
+    "excluded": [
+      "joblogic"
+    ]
   },
-
   "externalPlugins": [
-    { "name": "discord",  "marketplace": "claude-plugins-official", "channelPlugin": true },
-    { "name": "imessage", "marketplace": "claude-plugins-official", "channelPlugin": true },
-    { "name": "superpowers", "marketplace": "claude-plugins-official" },
-    { "name": "code-review", "marketplace": "claude-plugins-official" }
+    {
+      "name": "discord",
+      "marketplace": "claude-plugins-official",
+      "channelPlugin": true
+    },
+    {
+      "name": "imessage",
+      "marketplace": "claude-plugins-official",
+      "channelPlugin": true
+    },
+    {
+      "name": "superpowers",
+      "marketplace": "claude-plugins-official"
+    },
+    {
+      "name": "code-review",
+      "marketplace": "claude-plugins-official"
+    }
   ],
-
   "consent": {
     "copy": {
       "title": "Before you browse this listing",
@@ -86,5 +132,20 @@
       "accentFg": "#FFFFFF",
       "border": "#E8ECF0"
     }
+  },
+  "fonts": {
+    "body": {
+      "family": "Inter",
+      "faces": [
+        {
+          "weight": 400,
+          "file": "inter-400.woff2"
+        },
+        {
+          "weight": 500,
+          "file": "inter-500.woff2"
+        }
+      ]
+    }
   }
 }

package/payload/platform/lib/account-schema-regions/dist/index.d.ts

@@ -22,11 +22,23 @@
  * behaviour so a future edit cannot reintroduce separator sensitivity.
  */
 /**
- * Operator-data buckets from the shipped template
- * (platform/templates/account-schema/SCHEMA.md). They carry no ontology row
- * because they are not entity buckets, but they hold the operator's own data,
- * so they are home on every brand. On a vertical with no `## Top-level node
- * types` table (schema-knowledge-work) they are the whole of home.
+ * Non-ontology buckets that are still the operator's own work, so they are home
+ * on every brand. They carry no ontology row because they are not entity
+ * buckets. On a vertical with no `## Top-level node types` table
+ * (schema-knowledge-work) they are the whole of home.
+ *
+ * The membership test is "would the operator go looking for this?", not "who
+ * writes it". `output`, `generated` and `extracted` hold delivered work product;
+ * `sites` holds published websites; `uploads` holds what a client sent in. The
+ * shipped template groups those five under "tool-owned", but that is a rule
+ * about not reorganising their internals — a write constraint, not a reason to
+ * file them behind the platform's own plumbing. What stays out is genuinely
+ * internal: caches, state, logs, secrets, temp, the git and Claude control
+ * dirs, and plugin workspaces.
+ *
+ * Every name here is created at provision (provision-account-dir.sh `_seed_dirs`),
+ * so the standing home-parity audit finds them on disk rather than reporting
+ * them missing.
  *
  * Lives here rather than in either consumer because both the /data page and the
  * standing reconcile audit must agree on the same set; a hand-synced copy in

package/payload/platform/lib/account-schema-regions/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAAyD,CAAA;AAiBjG,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,iEAAiE;IACjE,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,gEAAgE;IAChE,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB;;;;;;;OAOG;IACH,MAAM,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,MAAM,EAAE,IAAI,GAAG,eAAe,GAAG,cAAc,CAAA;CAChD;AAiCD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,CAazE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAEtC,CAAA;AAiBF,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,iEAAiE;IACjE,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,gEAAgE;IAChE,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB;;;;;;;OAOG;IACH,MAAM,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,MAAM,EAAE,IAAI,GAAG,eAAe,GAAG,cAAc,CAAA;CAChD;AAiCD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,CAazE"}

package/payload/platform/lib/account-schema-regions/dist/index.js

@@ -26,17 +26,31 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.HOME_FIXED = void 0;
 exports.parseSchemaRegions = parseSchemaRegions;
 /**
- * Operator-data buckets from the shipped template
- * (platform/templates/account-schema/SCHEMA.md). They carry no ontology row
- * because they are not entity buckets, but they hold the operator's own data,
- * so they are home on every brand. On a vertical with no `## Top-level node
- * types` table (schema-knowledge-work) they are the whole of home.
+ * Non-ontology buckets that are still the operator's own work, so they are home
+ * on every brand. They carry no ontology row because they are not entity
+ * buckets. On a vertical with no `## Top-level node types` table
+ * (schema-knowledge-work) they are the whole of home.
+ *
+ * The membership test is "would the operator go looking for this?", not "who
+ * writes it". `output`, `generated` and `extracted` hold delivered work product;
+ * `sites` holds published websites; `uploads` holds what a client sent in. The
+ * shipped template groups those five under "tool-owned", but that is a rule
+ * about not reorganising their internals — a write constraint, not a reason to
+ * file them behind the platform's own plumbing. What stays out is genuinely
+ * internal: caches, state, logs, secrets, temp, the git and Claude control
+ * dirs, and plugin workspaces.
+ *
+ * Every name here is created at provision (provision-account-dir.sh `_seed_dirs`),
+ * so the standing home-parity audit finds them on disk rather than reporting
+ * them missing.
  *
  * Lives here rather than in either consumer because both the /data page and the
  * standing reconcile audit must agree on the same set; a hand-synced copy in
  * each build is precisely the drift this shared module exists to prevent.
  */
-exports.HOME_FIXED = Object.freeze(['projects', 'contacts', 'documents']);
+exports.HOME_FIXED = Object.freeze([
+    'projects', 'contacts', 'documents', 'output', 'generated', 'extracted', 'sites', 'uploads',
+]);
 const ONT_START = '<!-- ontology-buckets:start -->';
 const ONT_END = '<!-- ontology-buckets:end -->';
 const PLUGIN_START = '<!-- plugin-owned-dirs:start -->';

package/payload/platform/lib/account-schema-regions/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AAqFH,gDAaC;AAhGD;;;;;;;;;;GAUG;AACU,QAAA,UAAU,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;AAEjG,MAAM,SAAS,GAAG,iCAAiC,CAAA;AACnD,MAAM,OAAO,GAAG,+BAA+B,CAAA;AAC/C,MAAM,YAAY,GAAG,kCAAkC,CAAA;AACvD,MAAM,UAAU,GAAG,gCAAgC,CAAA;AACnD,MAAM,aAAa,GAAG,sBAAsB,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,QAAQ,GAAG,mBAAmB,CAAA;AA0BpC,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,MAAM,CAAC,KAAe;IAC7B,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1C,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACzC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IACxB,OAAO,IAAI;SACR,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,EAAE,CAAC;SACxB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,SAAgB,kBAAkB,CAAC,QAAuB;IACxD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC5G,CAAC;IACD,MAAM,eAAe,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAA;IACzC,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACpE,eAAe;QACf,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc;KACvC,CAAA;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AAmGH,gDAaC;AA9GD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACU,QAAA,UAAU,GAAsB,MAAM,CAAC,MAAM,CAAC;IACzD,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS;CAC5F,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,iCAAiC,CAAA;AACnD,MAAM,OAAO,GAAG,+BAA+B,CAAA;AAC/C,MAAM,YAAY,GAAG,kCAAkC,CAAA;AACvD,MAAM,UAAU,GAAG,gCAAgC,CAAA;AACnD,MAAM,aAAa,GAAG,sBAAsB,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,QAAQ,GAAG,mBAAmB,CAAA;AA0BpC,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,MAAM,CAAC,KAAe;IAC7B,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1C,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACzC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IACxB,OAAO,IAAI;SACR,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,EAAE,CAAC;SACxB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,SAAgB,kBAAkB,CAAC,QAAuB;IACxD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC5G,CAAC;IACD,MAAM,eAAe,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAA;IACzC,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACpE,eAAe;QACf,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc;KACvC,CAAA;AACH,CAAC"}

package/payload/platform/lib/account-schema-regions/src/index.ts

@@ -23,17 +23,31 @@
  */
 
 /**
- * Operator-data buckets from the shipped template
- * (platform/templates/account-schema/SCHEMA.md). They carry no ontology row
- * because they are not entity buckets, but they hold the operator's own data,
- * so they are home on every brand. On a vertical with no `## Top-level node
- * types` table (schema-knowledge-work) they are the whole of home.
+ * Non-ontology buckets that are still the operator's own work, so they are home
+ * on every brand. They carry no ontology row because they are not entity
+ * buckets. On a vertical with no `## Top-level node types` table
+ * (schema-knowledge-work) they are the whole of home.
+ *
+ * The membership test is "would the operator go looking for this?", not "who
+ * writes it". `output`, `generated` and `extracted` hold delivered work product;
+ * `sites` holds published websites; `uploads` holds what a client sent in. The
+ * shipped template groups those five under "tool-owned", but that is a rule
+ * about not reorganising their internals — a write constraint, not a reason to
+ * file them behind the platform's own plumbing. What stays out is genuinely
+ * internal: caches, state, logs, secrets, temp, the git and Claude control
+ * dirs, and plugin workspaces.
+ *
+ * Every name here is created at provision (provision-account-dir.sh `_seed_dirs`),
+ * so the standing home-parity audit finds them on disk rather than reporting
+ * them missing.
  *
  * Lives here rather than in either consumer because both the /data page and the
  * standing reconcile audit must agree on the same set; a hand-synced copy in
  * each build is precisely the drift this shared module exists to prevent.
  */
-export const HOME_FIXED: readonly string[] = Object.freeze(['projects', 'contacts', 'documents'])
+export const HOME_FIXED: readonly string[] = Object.freeze([
+  'projects', 'contacts', 'documents', 'output', 'generated', 'extracted', 'sites', 'uploads',
+])
 
 const ONT_START = '<!-- ontology-buckets:start -->'
 const ONT_END = '<!-- ontology-buckets:end -->'

package/payload/platform/plugins/admin/PLUGIN.md

@@ -6,111 +6,147 @@ tools:
   - name: system-status
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: public-hostname
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: admin-hostname
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: publish-site
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: brand-settings
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: account-manage
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: capabilities-here
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: account-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: account_list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: account_roster
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: account_create
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: account_reassign_admin
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: account_set_owner_name
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: account_delete
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: account_purge
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: account_channel_routing
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: account_channel_routing_set
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: admin-add
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: admin-remove
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: admin-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: admin-update-pin
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: agent-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: agent-config-read
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: logs-read
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: cpu-triage-start
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: exec
   - name: cpu-triage-read
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: plugin-read
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: skill-load
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: skill-search
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: store-skill
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: session-reset
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: session-resume
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: action-pending
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: action-approve
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: action-reject
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: action-edit
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
 hidden:
   - remote-auth-status
   - remote-auth-set-password

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:7e164ac0a4a7c3a6ab0fead2f2f109cb9a4f9e9c89b4761ecdee9c7166dca4ed
+content-hash: sha256:a1e6cd6d7cccbf1c314340dd556761adf9aac772939fcd6a870265d0f7c00e1b
 brand: maxy-code
 product-name: Maxy
 ---
@@ -474,6 +474,32 @@ Skill content, plugin manifests, agent templates, and reference files reference
 
 The runtime substitution happens at every read site that flows content into a system prompt or operator-visible UI: the admin agent's `plugin-read` tool (references + `PLUGIN.md`), the `skill-load` tool (SKILL.md by skill name — one-call resolver+reader, the canonical primitive for SKILL.md), the public agent's recursive plugin assembly, and `IDENTITY` / `SOUL` / `AGENTS` / `KNOWLEDGE` markdown reads. Missing or empty `productName` hard-fails — there is no fallback to a default brand string. See [.docs/agents.md](../../.docs/agents.md) § "Brand templating" for the full contract.
 
+## Tool risk classes (for plugin authors)
+
+Every tool a plugin declares in its `PLUGIN.md` `tools:` block carries three mandatory
+fields. `publicAllowlist` and `adminAllowlist` say who may call the tool. `riskClass`
+says what happens when they do, and takes one of four values:
+
+- `read` changes no state anywhere. A remote lookup counts as `read`; reaching the
+  network is not by itself consequential.
+- `write_local` mutates account files or the graph on this device and transmits nothing.
+- `exec` runs an operating-system command, or code supplied by the caller or the operator.
+- `external` transmits to, or changes state on, a system outside this device, or delivers
+  a message to a person.
+
+Leaving the field out is a refusal-to-boot condition, not a silent default. The platform
+refuses to start rather than treat an undeclared consequence as harmless, because a tool
+that quietly reads as `read` escapes every check downstream of it.
+
+Declaring the class does not yet gate anything. It gives any consumer one honest answer
+to the question "is this tool consequential?" without maintaining a list of tool names,
+which is what the checks in `platform/plugins/admin/hooks/` have had to do until now.
+
+A publish-time gate flags declarations that contradict what the tool's own name says it
+does, and a boot line reports the census across all four classes. The classification
+rule, the exception mechanism, and the diagnostic commands are in
+`.docs/tool-risk-classes.md`.
+
 ## MCP Plugin Observability (for plugin authors)
 
 Every `console.error` line from a plugin's MCP server is captured to a per-server raw log. Capture is automatic and needs no import or call: the `mcp-spawn-tee` shim spawns every MCP server and mirrors its stderr to `mcp-<name>-<sessionId>.log` (or `mcp-<name>-nosession.log` for a spawn with no session). That file is keyed by session, which is the conversation, and that is where you grep. Prefix your diagnostics `[your-tool]` so a grep isolates one tool.
@@ -3277,9 +3303,29 @@ the Web Share API and is disabled where unavailable. Signals:
 `[data-ui] op=mount header=operator home=absent`, `op=select-enter`,
 `op=select-exit reason=<cancel|action>`, `op=share supported=<bool> count=<n>`.
 
+**The dashboard has a surface ramp and a display type tier.** Every page sits on
+a page plane, cards rise onto a raised plane, and inputs and scroll regions
+recede onto an inset plane. Each brand chooses how the card separates: SiteDesk's
+card is a shade lighter than its page and casts no shadow, Real Agent's card and
+page are both white and a shadow does the work. The page header is an inverted
+band carrying the page title at the display size. Colours, radii, shadows and
+type weights all come from the brand's own tokens; nothing is hardcoded, and a
+token that resolves to nothing fails the build rather than painting invisibly.
+
+**Folders open beside a rail on a wide screen.** At 1280px and above the folder
+view splits in two: a list of the account's folders on the left, the files on
+the right, with the folder you are in highlighted. Below that width the rail is
+hidden and the breadcrumb does the same job.
+
+**Status colours are shared.** Success, warning, error and info each carry a
+solid fill, a pale tint and a text colour for that tint. Every pairing meets the
+WCAG AA contrast minimum, on every brand.
+
 **`/data` opens on the account's own folders, as cards.** With no `#path=` in
 the URL the browser lands on **home**: the account's business folders (the
-entity folders of its trade, plus `projects`, `contacts` and `documents`) shown
+entity folders of its trade, plus documents, projects, contacts, the work it
+has produced for you, anything a client has sent in, and any websites it
+has published) shown
 one per card, each listing the first 20 things inside it and a `+N more` row
 past that. Tapping a card opens that folder in the ordinary list or grid. There
 are never loose files at this level. Everything the platform and its plugins

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,13 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-25 (0.1.507)
+
+- Chat now updates the moment a message or permission prompt arrives, instead of checking every couple of seconds.
+- The dashboard has a visual refresh: cards now fill in properly instead of looking transparent.
+- The Data page has a new two-pane view with a folder rail on wider screens, and uploads/sites are now correctly grouped under Home.
+- Every assistant tool now carries a declared risk level, checked automatically so it cannot silently drift.
+
 ## 2026-07-25 (0.1.506)
 
 - Fixed a bug where the Agents page and a few other admin screens could resolve the wrong account.

package/payload/platform/plugins/aeo/PLUGIN.md

@@ -5,12 +5,15 @@ tools:
   - name: aeo-emit-jsonld
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: aeo-write-llms-txt
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: aeo-audit-page
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
 skills:
   - skills/structured-answer/SKILL.md
 always: false

package/payload/platform/plugins/browser/PLUGIN.md

@@ -5,57 +5,75 @@ tools:
   - name: browser-render
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-navigate
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-snapshot
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-click
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-fill
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-fill-form
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-type
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-press-key
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-hover
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-select-option
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-wait-for
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-handle-dialog
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: browser-evaluate
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: exec
   - name: browser-console-messages
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-tabs
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: browser-pdf-save
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: browser-screenshot
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: browser-resize
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 always: true
 embed: false
 metadata: {"platform":{}}

package/payload/platform/plugins/connector/PLUGIN.md

@@ -5,15 +5,19 @@ tools:
   - name: connector-register
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: connector-call
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: connector-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: connector-deregister
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
 metadata: {"platform":{"optional":true,"pluginKey":"connector"}}
 mcp:
   command: node