@rubytech/create-maxy-code 0.1.506 → 0.1.507

package/payload/platform/plugins/contacts/PLUGIN.md

@@ -5,30 +5,39 @@ tools:
   - name: contact-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: contact-lookup
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: contact-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: contact-delete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: contact-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: contact-export
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: contact-erase
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: group-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: group-manage
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
 always: false
 embed: false
 metadata: {"platform":{}}

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -350,9 +350,29 @@ the Web Share API and is disabled where unavailable. Signals:
 `[data-ui] op=mount header=operator home=absent`, `op=select-enter`,
 `op=select-exit reason=<cancel|action>`, `op=share supported=<bool> count=<n>`.
 
+**The dashboard has a surface ramp and a display type tier.** Every page sits on
+a page plane, cards rise onto a raised plane, and inputs and scroll regions
+recede onto an inset plane. Each brand chooses how the card separates: SiteDesk's
+card is a shade lighter than its page and casts no shadow, Real Agent's card and
+page are both white and a shadow does the work. The page header is an inverted
+band carrying the page title at the display size. Colours, radii, shadows and
+type weights all come from the brand's own tokens; nothing is hardcoded, and a
+token that resolves to nothing fails the build rather than painting invisibly.
+
+**Folders open beside a rail on a wide screen.** At 1280px and above the folder
+view splits in two: a list of the account's folders on the left, the files on
+the right, with the folder you are in highlighted. Below that width the rail is
+hidden and the breadcrumb does the same job.
+
+**Status colours are shared.** Success, warning, error and info each carry a
+solid fill, a pale tint and a text colour for that tint. Every pairing meets the
+WCAG AA contrast minimum, on every brand.
+
 **`/data` opens on the account's own folders, as cards.** With no `#path=` in
 the URL the browser lands on **home**: the account's business folders (the
-entity folders of its trade, plus `projects`, `contacts` and `documents`) shown
+entity folders of its trade, plus documents, projects, contacts, the work it
+has produced for you, anything a client has sent in, and any websites it
+has published) shown
 one per card, each listing the first 20 things inside it and a `+N more` row
 past that. Tapping a card opens that folder in the ordinary list or grid. There
 are never loose files at this level. Everything the platform and its plugins

package/payload/platform/plugins/docs/references/plugins-guide.md

@@ -150,6 +150,32 @@ Skill content, plugin manifests, agent templates, and reference files reference
 
 The runtime substitution happens at every read site that flows content into a system prompt or operator-visible UI: the admin agent's `plugin-read` tool (references + `PLUGIN.md`), the `skill-load` tool (SKILL.md by skill name — one-call resolver+reader, the canonical primitive for SKILL.md), the public agent's recursive plugin assembly, and `IDENTITY` / `SOUL` / `AGENTS` / `KNOWLEDGE` markdown reads. Missing or empty `productName` hard-fails — there is no fallback to a default brand string. See [.docs/agents.md](../../.docs/agents.md) § "Brand templating" for the full contract.
 
+## Tool risk classes (for plugin authors)
+
+Every tool a plugin declares in its `PLUGIN.md` `tools:` block carries three mandatory
+fields. `publicAllowlist` and `adminAllowlist` say who may call the tool. `riskClass`
+says what happens when they do, and takes one of four values:
+
+- `read` changes no state anywhere. A remote lookup counts as `read`; reaching the
+  network is not by itself consequential.
+- `write_local` mutates account files or the graph on this device and transmits nothing.
+- `exec` runs an operating-system command, or code supplied by the caller or the operator.
+- `external` transmits to, or changes state on, a system outside this device, or delivers
+  a message to a person.
+
+Leaving the field out is a refusal-to-boot condition, not a silent default. The platform
+refuses to start rather than treat an undeclared consequence as harmless, because a tool
+that quietly reads as `read` escapes every check downstream of it.
+
+Declaring the class does not yet gate anything. It gives any consumer one honest answer
+to the question "is this tool consequential?" without maintaining a list of tool names,
+which is what the checks in `platform/plugins/admin/hooks/` have had to do until now.
+
+A publish-time gate flags declarations that contradict what the tool's own name says it
+does, and a boot line reports the census across all four classes. The classification
+rule, the exception mechanism, and the diagnostic commands are in
+`.docs/tool-risk-classes.md`.
+
 ## MCP Plugin Observability (for plugin authors)
 
 Every `console.error` line from a plugin's MCP server is captured to a per-server raw log. Capture is automatic and needs no import or call: the `mcp-spawn-tee` shim spawns every MCP server and mirrors its stderr to `mcp-<name>-<sessionId>.log` (or `mcp-<name>-nosession.log` for a spawn with no session). That file is keyed by session, which is the conversation, and that is where you grep. Prefix your diagnostics `[your-tool]` so a grep isolates one tool.

package/payload/platform/plugins/email/PLUGIN.md

@@ -5,54 +5,71 @@ tools:
   - name: email-provider-info
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-setup
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: email-read
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-fetch-body
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-fetch-attachment
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-send
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-reply
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-draft
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-draft-edit
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-draft-send
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-search
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-delete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: email-graph-query
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-fetch
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-ingest
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: email-otp-extract
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: email-status
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
 always: false
 embed: ["admin"]
 metadata: {"platform":{}}

package/payload/platform/plugins/filesystem/PLUGIN.md

@@ -5,21 +5,27 @@ tools:
   - name: file-read
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: file-write
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: file-edit
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: file-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: file-glob
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: file-grep
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 metadata: {"platform":{"always":false,"embed":[],"pluginKey":"filesystem"}}
 mcp:
   command: node

package/payload/platform/plugins/google/PLUGIN.md

@@ -5,39 +5,51 @@ tools:
   - name: google-account-register
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: google-account-register-poll
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: google-account-register-submit
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: google-calendar-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: google-calendar-event
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: google-calendar-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: google-calendar-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: google-calendar-cancel
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: google-calendar-respond
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: google-calendar-freebusy
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: google-account-info
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: google-account-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
 mcp:
   command: node
   args:

package/payload/platform/plugins/graph/PLUGIN.md

@@ -4,12 +4,15 @@ tools:
   - name: maxy-graph-read_neo4j_cypher
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: maxy-graph-get_neo4j_schema
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: maxy-graph-write_neo4j_cypher
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
 mcp-manifest: shared-lib
 mcp:
   command: node

package/payload/platform/plugins/graph-viewer/PLUGIN.md

@@ -17,6 +17,7 @@ tools:
   - name: graph-render
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 ---
 
 # graph-viewer

package/payload/platform/plugins/ledger/PLUGIN.md

@@ -5,24 +5,31 @@ tools:
   - name: ledger-invoice-record
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: ledger-payment-record
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: ledger-credit-record
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: ledger-cash-record
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: ledger-balance
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: ledger-statement
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: ledger-reconcile
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 always: false
 embed: false
 metadata: {"platform":{}}

package/payload/platform/plugins/memory/PLUGIN.md

@@ -6,126 +6,167 @@ tools:
   - name: memory-search
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-write
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-update
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-edge
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-update-by-name
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-reindex
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: memory-ingest
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: kd-classify
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: memory-ingest-extract
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: memory-ingest-web
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: memory-find-candidates
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-node-exists
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-lookup-by-name
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-delete
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-restore
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-empty-trash
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-list-attachments
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-read-attachment
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-edit-attachment
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-rename-attachment
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-archive-write
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: obsidian-vault-import
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: conversation-archive-list-chunks
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: conversation-archive-derive-insights
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: conversation-archive-enrich-rejection
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: memory-report-write
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-report-read-latest
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-report-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: memory-compiled-truth-history
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: conversation-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: conversation-search
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: profile-read
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: profile-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: profile-delete
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-brain-capture-recent
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: graph-prune-denylist-add
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: graph-prune-denylist-list
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: graph-prune-denylist-remove
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: conversation-memory-expunge
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-dream-run
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: memory-review-queue
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 hidden:
   - session-compact
   - session-compact-status

package/payload/platform/plugins/outlook/PLUGIN.md

@@ -5,75 +5,99 @@ tools:
   - name: outlook-account-register
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: outlook-account-register-poll
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: outlook-mail-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mail-search
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mail-fetch-body
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mail-attachment
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mail-reply
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-mail-delete
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-mail-ingest
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: write_local
   - name: outlook-mail-otp-extract
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mail-send
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-draft
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-draft-send
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-draft-edit
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-calendar-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-calendar-event
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-calendar-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-calendar-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-calendar-cancel
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-calendar-respond
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: outlook-calendar-freebusy
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-contacts-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mailbox-info
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: outlook-mailbox-list
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
 always: false
 embed: ["admin"]
 metadata: {"platform":{"optional":true}}

package/payload/platform/plugins/quickbooks/PLUGIN.md

@@ -5,48 +5,63 @@ tools:
   - name: quickbooks-credentials-set
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: quickbooks-authorize-url
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: quickbooks-connections
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: quickbooks-token-audit
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
   - name: quickbooks-disconnect
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: external
   - name: quickbooks-query
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: quickbooks-report
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: read
   - name: quickbooks-invoice-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-invoice-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-customer-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-customer-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-bill-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-payment-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-entity-create
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: quickbooks-entity-update
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
 skills:
   - skills/quickbooks/SKILL.md
 metadata: {"platform":{"optional":true,"pluginKey":"quickbooks"}}

package/payload/platform/plugins/replicate/PLUGIN.md

@@ -5,12 +5,15 @@ tools:
   - name: image-generate
     publicAllowlist: false
     adminAllowlist: false
+    riskClass: external
   - name: replicate-key-store
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: write_local
   - name: replicate-key-verify
     publicAllowlist: false
     adminAllowlist: true
+    riskClass: read
 metadata: {"platform":{"optional":true,"recommended":true,"pluginKey":"replicate"}}
 mcp:
   command: node