@rubytech/create-siteoffice-code 0.1.256

package/payload/platform/plugins/email/skills/email-composition/SKILL.md

@@ -0,0 +1,184 @@
+---
+name: email-composition
+description: "Conversational wrapper around the email plugin tools. Activate when the operator asks to reply to an email, draft a new email, follow up on a thread, or triage outstanding inbox items (e.g. 'reply to Sarah about X', 'email Joel about Y', 'what's outstanding in my inbox'). Orchestrates `email-graph-query`, `email-search`, `email-read`, `email-send`, `email-reply`. Every send is operator-approved — never auto-sends."
+---
+
+# Email composition
+
+Conversational wrapper around the existing `email-*` tools. Drafting, threading, triage. **Human-in-the-loop only — every send is explicitly approved by the operator.** No drip sequences, no scheduled sends, no automatic categorisation.
+
+## When to activate
+
+Activate when the operator asks for any of:
+
+- **Reply to a known thread.** "Reply to Sarah's email about the lease." "Draft a reply to that thread from Joel."
+- **New outbound email.** "Email Joel about the viewing." "Send a note to the team about Friday."
+- **Follow-up on a topic.** "Follow up with everyone from yesterday's viewings."
+- **Inbox triage.** "What's outstanding in my inbox?" "Anything I need to deal with?"
+
+Do **not** activate for:
+
+- Listing or searching emails as the end-goal (no draft intent) — let `email-search` / `email-graph-query` answer directly.
+- Setup, status checks, OTP extraction — those are direct tool calls.
+- Any automated send loop. If the operator asks for drip / scheduled / broadcast sends, decline and explain that this skill is human-in-the-loop only.
+
+## Flow — reply to an existing thread
+
+### 1. Identify the thread
+
+Pick the right retrieval path:
+
+- **Graph history first** (`email-graph-query`) — for "reply to Sarah's email about the lease": the operator is naming a known correspondent and topic. Fast, semantic, covers the operator's full email history.
+- **Live IMAP** (`email-search` or `email-read`) — for "that email that just came in" or "today's reply from Joel": the operator is naming a recent message that may not yet be in the graph.
+
+If the search returns **multiple plausible threads**, do not guess. Surface 3-5 candidates with sender, subject, date, and a one-line summary, and ask which one. Emit narration `[email-composition] ambiguous-thread candidates=<n>`.
+
+If the search returns **zero matches**, ask the operator to refine (different correspondent? different subject phrasing? wider date range?). Do not invent a thread.
+
+Once the thread is locked, emit narration `[email-composition] thread-identified messageId=<id> subject="<subject>"`.
+
+### 2. Load thread context
+
+Pull the full thread — the current message plus parent messages — via `email-read` or `email-graph-query`. Reply to the actual position of the conversation, not a stripped-down summary. Quote-stripped one-line summaries miss the question the operator is actually being asked.
+
+If the thread has **attachments** that the draft will reference, list the attachment names in the draft presentation and ask whether to forward them. The five existing tools do not currently forward attachments inline — surface this so the operator can manually re-attach if needed.
+
+### 3. Detect skip conditions
+
+Before drafting, check the inbound for:
+
+- **Out-of-office / vacation autoreply.** Skip. Flag to the operator: "this looks like an OOO autoreply — no draft." Do not propose a reply.
+- **Unsubscribe / list-management mail** (List-Unsubscribe header, "to unsubscribe click here" body). Skip. Flag to the operator.
+- **Hostile or grief tone.** Draft cautiously and flag the tone in the presentation: "this reads as hostile / grief-related — please review carefully before sending." Never auto-soften without surfacing the tone judgement.
+
+### 4. Retrieve voice exemplars (conditional)
+
+Call `voice-retrieve-conditioning` with `format: "email"`, `length: "short"`, and `topic` set to the inbound thread's subject (or, for a new outbound, the topic the operator named). The tool returns `{styleCard, exemplars[]}` — when `styleCard` is non-null, inject both the style card and the exemplar bodies into the drafting prompt before composing.
+
+If the tool returns `{styleCard: null, exemplars: []}` (the operator has no `:VoiceProfile` yet, or the `writer-craft` plugin isn't enabled on the account), draft in a **neutral British business register** — polite, concise, no slang, no transatlantic spellings — and state explicitly in the presentation: "drafted in neutral British business voice (no voice profile on file)."
+
+Emit narration `[email-composition] voice-mirror styleCardBytes=<n> exemplars=<k>` when conditioning was applied. Absence of the line confirms the fallback path was taken.
+
+### 5. Draft
+
+Compose the reply. Anchor to:
+
+- The specific question or position in the parent message.
+- The operator's voice (from voice-mirror) or the neutral British business register.
+- Any decisions the operator has already stated in this conversation (e.g. "say yes to the price, no to the timeline").
+
+Keep drafts tight. Email is not a wall-of-text medium.
+
+### 6. Present
+
+Show the draft inline with:
+
+- **To** — recipient address (the original sender, unless the operator asked for `replyAll`).
+- **Cc / Bcc** — empty unless the operator explicitly named one. Never copy people forward from the original thread without being asked.
+- **Subject** — the threaded subject (the original with `Re:` if not already prefixed; `email-reply` handles this).
+- **Body** — the draft.
+- **Notes** — any flags from step 3 (tone, attachments, OOO skip-already-applied).
+
+Emit narration `[email-composition] draft-presented recipient=<addr> subjectPrefix="<first-60-chars>"`.
+
+**Do not call `email-reply` at this step.** The send is not yet approved.
+
+### 7. Edit loop
+
+The operator may:
+
+- **Approve** ("send it", "looks good", "yes"). Proceed to step 8.
+- **Edit verbally** ("make it shorter", "drop the second paragraph", "say yes to the price but not the timeline"). Apply the edit and re-present. Stay in the loop until approval or abandonment.
+- **Abandon** ("never mind", "I'll do it myself"). Emit `[email-composition] send-aborted reason=operator-abandoned`. Do not send.
+
+Every operator edit on the draft (before final approval) is downstream feedback for `voice-mirror`. After the operator approves the final send, call `voice-record-feedback` with the original agent draft and the final edited version (`skill: "email-composition"`, `brief` set to the topic/subject). The call is fire-and-forget — failure is logged but does not block the send. If the `writer-craft` plugin isn't enabled on the account the tool call is omitted; no feedback is recorded.
+
+### 8. Send
+
+On **explicit** approval, call `email-reply` with:
+
+- `messageId` — the parent message ID from step 1. This is the threading anchor; `email-reply` populates `In-Reply-To` and `References` from it so the reply lands inside the existing thread, not as a new conversation.
+- `replyAll` — only if the operator asked for it. Default is false (reply to sender only).
+- Subject and body from the approved draft.
+
+Emit narration `[email-composition] send-confirmed`.
+
+Confirm to the operator that the send happened by quoting the `email-reply` tool's success line (it includes the sent `messageId` and the resolved `In-Reply-To`).
+
+If `email-reply` errors, surface the error verbatim; do not silently retry. The operator decides whether to fix and retry or abandon.
+
+## Flow — new outbound email
+
+Same as the reply flow with two differences:
+
+1. **No thread context load** (step 2 skipped). Instead, ask the operator for the recipient (if not already named), the topic, and any constraints (formal vs casual, length, things to include or exclude).
+2. **Send via `email-send`**, not `email-reply`. There is no parent `messageId` because this is a new conversation.
+
+Multi-recipient drafting: if the operator names a single person, use that address. If the operator names a group ("email the team", "everyone from yesterday's viewings"), ask which addresses to include — list candidates if you can resolve them from the graph, otherwise ask the operator to enumerate. Do not invent recipients.
+
+## Flow — triage variant
+
+When the operator asks "what's outstanding in my inbox" / "anything I need to deal with" / "what's unread":
+
+1. Call `email-read` for the last N unread messages (default N = 10; operator can specify "last 25", "today's", etc.).
+2. For each message, return a one-line summary with a recommended action:
+   - **Reply** — needs a response.
+   - **File** — informational, can be archived.
+   - **Ignore** — autoreply, newsletter, list mail, OOO.
+3. Emit narration `[email-composition] triage-returned n=<count>`.
+4. Wait for the operator to pick one. When they do ("reply to #3", "draft a response to the Joel one"), drop into the reply flow at step 1 (thread already identified — use the `messageId` from the triage list).
+
+The triage variant **never auto-drafts**. It returns the list and waits.
+
+## Edge cases
+
+| Situation | Behaviour |
+|-----------|-----------|
+| Multiple threads match the operator's description | Surface 3-5 candidates and ask. Never guess. |
+| CC / BCC in the original thread | Reply to sender only by default. Ask explicitly before copying others. |
+| `replyAll` requested | Pass `replyAll: true` to `email-reply`. Otherwise omit (defaults false). |
+| Original thread has attachments referenced in the draft | List attachment names; ask whether to forward. |
+| Inbound is an out-of-office autoreply | Skip. Flag to operator. Do not draft. |
+| Inbound is a list / unsubscribe mail | Skip. Flag to operator. Do not draft. |
+| Inbound is hostile or grief-related | Draft cautiously; flag tone in the presentation. Operator must review explicitly. |
+| `voice-mirror` plugin absent | Draft in neutral British business register; state the absence in the presentation. |
+| `email-reply` returns an error after approval | Surface the error verbatim. Operator decides whether to fix and retry or abandon. Do not silent-retry. |
+
+## Out of scope
+
+Hard boundaries — never offer these in this skill, even if asked:
+
+- **Drip sequences** — multi-step automated send chains. Decline; refer to a future task.
+- **Scheduled / delayed sends** — there is no "send at 9am tomorrow" path. The operator triggers the send when they approve.
+- **List broadcasts** — bulk sends to managed subscriber lists. Not this skill.
+- **Inbox auto-categorisation / labelling** — triage is on demand only.
+- **Calendar follow-up auto-writes** — if a reply confirms a meeting, mention it and let the operator decide whether to write a calendar entry separately.
+- **New MCP tools** — this skill orchestrates the existing five (`email-graph-query`, `email-search`, `email-read`, `email-send`, `email-reply`). Nothing else.
+
+## Observability
+
+The skill emits narration at each major step so a session log makes the full draft → approval → send chain greppable:
+
+| Step | Narration |
+|------|-----------|
+| Thread locked | `[email-composition] thread-identified messageId=<id> subject="<subject>"` |
+| Multiple matches | `[email-composition] ambiguous-thread candidates=<n>` |
+| Draft shown | `[email-composition] draft-presented recipient=<addr> subjectPrefix="<first-60-chars>"` |
+| Send approved | `[email-composition] send-confirmed` |
+| Send abandoned | `[email-composition] send-aborted reason=<why>` |
+| Triage list returned | `[email-composition] triage-returned n=<count>` |
+
+The underlying `[email-send]` / `[email-reply]` / `[email-search]` / `[email-graph-query]` / `[email-read]` tool logs confirm the actual tool calls. Absence of an expected tool tag after `draft-presented` + operator approval is the failure signal — the skill said it sent but didn't.
+
+Diagnostic on Pi:
+
+```
+grep -E '\[email-(composition|reply|send|search|graph-query|read)\]' <session-log>
+```
+
+returns the full chain for any thread.
+
+## Dependencies
+
+- **Required:** `email` plugin (`email-graph-query`, `email-search`, `email-read`, `email-send`, `email-reply`).
+- **Optional:** `voice-mirror` plugin. If installed, drafts use the operator's style-card and edits are captured as feedback. If absent, drafts fall back to a neutral British business register.

package/payload/platform/plugins/email/skills/email-ingest/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: email-ingest
+description: "Operator-initiated email ingestion. Activate when the operator asks to check, triage, or pull in new email ('check my emails', 'any new mail?', 'pull in the latest emails', 'what came in overnight'). Drives a list → summarise → ask → ingest loop using the email-fetch and email-ingest tools. Human-in-the-loop: nothing enters the graph without an explicit operator decision per message."
+---
+
+# Email ingestion
+
+Operator-initiated, human-in-the-loop ingestion of the agent's IMAP inbox into the graph. New messages enter the knowledge graph **only** when the operator says so, and only the ones they pick. There is no background poll, no automatic classifier, no silent writes.
+
+## When to activate
+
+Activate when the operator wants to bring new email into the agent's memory. Typical phrasings:
+
+- "Check my emails."
+- "Any new mail?"
+- "Pull in the latest emails."
+- "What came in overnight?"
+
+Do **not** activate for:
+
+- Searching, reading, or recalling email already in the inbox or the graph — those are `email-search`, `email-read`, `email-graph-query`.
+- Drafting or sending — that's `email-composition`.
+- Setup, status, or OTP extraction — those are direct tool calls.
+
+## Flow
+
+### 1. List
+
+Call `email-fetch`. It pulls new messages since the stored high-water mark (or a `since_uid` if the operator asked for a wider window) and stages them in-memory for the follow-up ingest. **It writes nothing to the graph.**
+
+If `email-fetch` returns "No new messages", say that and stop. There is nothing to ingest.
+
+### 2. Summarise
+
+Present the listed messages to the operator as a numbered or per-`Message-ID` summary. For each, surface:
+
+- Sender (name + address).
+- Subject.
+- A one-line gist drawn from the body preview (not the full preview — keep it tight).
+- A suggested disposition where the message is obviously one or the other (e.g., "newsletter — looks like discard", "thread reply from a known correspondent — looks like ingest"). The suggestion is a hint, never an action; the operator decides.
+
+Do not classify suspicious vs clean — there is no screener. If a message looks like phishing, surface that observation in plain English so the operator can discard it by eye.
+
+### 3. Ask
+
+Ask the operator to confirm a disposition for **every** message in the list. Either:
+
+- A blanket call ("ingest all", "discard everything"), which you turn into the per-message map.
+- An explicit per-message choice ("ingest 1, 2, 4; discard 3").
+
+If the operator answers ambiguously ("the work ones"), restate the messages you think they mean and confirm before proceeding. Never guess.
+
+### 4. Ingest
+
+Call `email-ingest` with a `decisions` array containing one entry per Message-ID returned by `email-fetch`. The tool refuses if any pending Message-ID is missing a decision — that's the safeguard against silent drops, not an error to retry around. If it refuses, go back to the operator and ask about the missing ones.
+
+On success the tool returns a one-line summary (ingested / discarded / thread counts) and advances the inbox high-water mark.
+
+### 5. Confirm
+
+Echo the tool's summary back to the operator in one sentence. If they want to draft a reply to anything that was just ingested, hand off to `email-composition`.
+
+## Edge cases
+
+| Situation | Behaviour |
+|-----------|-----------|
+| `email-fetch` returns zero new messages | Tell the operator and stop. Do not call `email-ingest`. |
+| A listed message has no `Message-ID` header | Surface it by UID and ask the operator how to handle it. `email-ingest` cannot apply a per-message decision to it, so either widen the search or skip it explicitly. |
+| Operator wants to ingest some now and review the rest later | Refuse cleanly. The high-water mark advances on every successful ingest, so a partial decision would silently drop the rest. Ask them to commit one way or the other on every message, or to wait. |
+| Operator abandons mid-flow | Do not call `email-ingest`. The staged batch stays in memory until the next `email-fetch` overwrites it; the high-water mark does not move. |
+| `email-fetch` errors (IMAP down, auth failure) | Surface the error verbatim. Do not retry silently. |
+
+## Out of scope
+
+- **Automatic re-screening or LLM classification.** The screener was removed; the operator is the screener now.
+- **Scheduled or recurring ingestion.** There is no cron, no interval, no background trigger. The operator initiates every cycle.
+- **Per-thread or per-sender allowlists.** Each message gets a fresh decision.
+- **Other channels.** WhatsApp and the public web have their own ingestion paths.
+
+## Observability
+
+Each tool emits a single tagged log line:
+
+- `[email-fetch] tag=email-fetch listed=<n> sinceUid=<uid>` — one per list call.
+- `[email-ingest] tag=email-ingest ingested=<n> discarded=<m>` — one per ingest call.
+
+A complete cycle is greppable as the pair `email-fetch` → `email-ingest` for the same session.

package/payload/platform/plugins/graph/.claude-plugin/plugin.json

@@ -0,0 +1,8 @@
+{
+  "name": "graph",
+  "description": "Raw Neo4j Cypher proxy. Wraps the upstream `mcp-neo4j-cypher` server (spawned under uvx by `platform/lib/graph-mcp`) under the stable `maxy-graph` namespace, so its tools register as `maxy-graph-read_neo4j_cypher`, `maxy-graph-get_neo4j_schema`, and `maxy-graph-write_neo4j_cypher`. The read and schema tools are admin-allowlisted for schema checks and read-only queries; the write tool is specialist-only (database-operator / librarian execute operator-confirmed `mergeCypher` templates through it, never hand-authored Cypher). The shim validates write Cypher against the live schema, stamps provenance, and rejects unknown labels/edges. Account isolation is per-brand Neo4j; the shim adds no query-layer tenant filter.",
+  "version": "0.1.0",
+  "author": {
+    "name": "Rubytech LLC"
+  }
+}

package/payload/platform/plugins/graph/PLUGIN.md

@@ -0,0 +1,37 @@
+---
+name: graph
+tools:
+  - name: maxy-graph-read_neo4j_cypher
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: maxy-graph-get_neo4j_schema
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: maxy-graph-write_neo4j_cypher
+    publicAllowlist: false
+    adminAllowlist: false
+mcp:
+  command: node
+  args:
+    - ${PLATFORM_ROOT}/lib/graph-mcp/dist/index.js
+  env:
+    LOG_DIR: ${LOG_DIR}
+    PLATFORM_ROOT: ${PLATFORM_ROOT}
+    ACCOUNT_ID: ${ACCOUNT_ID}
+    SESSION_ID: ${SESSION_ID}
+    NEO4J_URI: ${NEO4J_URI}
+    NEO4J_PASSWORD: ${NEO4J_PASSWORD}
+description: "Raw Neo4j Cypher proxy. Wraps the upstream `mcp-neo4j-cypher` server (spawned under uvx by `platform/lib/graph-mcp`) under the stable `maxy-graph` namespace, so its tools register as `maxy-graph-read_neo4j_cypher`, `maxy-graph-get_neo4j_schema`, and `maxy-graph-write_neo4j_cypher`. The read and schema tools are admin-allowlisted for schema checks and read-only queries; the write tool is specialist-only (database-operator / librarian execute operator-confirmed `mergeCypher` templates through it, never hand-authored Cypher). The shim validates write Cypher against the live schema, stamps provenance, and rejects unknown labels/edges. Account isolation is per-brand Neo4j; the shim adds no query-layer tenant filter."
+---
+
+# graph
+
+Cypher proxy plugin. The server is `platform/lib/graph-mcp`, which adopts the upstream
+Python `mcp-neo4j-cypher` server per brand and proxies its JSON-RPC stdio under the
+`maxy-graph` namespace. It is registered through the installed-plugin channel like every
+other platform MCP, so its tools surface as `mcp__plugin_graph_graph__maxy-graph-*`.
+
+Write Cypher is intercepted (not forwarded) so the shim can validate tokens against the
+live schema cache, stamp `createdBy` provenance, and roll back orphan-producing writes.
+Read Cypher and schema introspection forward to upstream with an envelope-warning probe
+that stitches Neo4j `gql_status` codes back into the response.

package/payload/platform/plugins/graph-viewer/.claude-plugin/plugin.json

@@ -0,0 +1,8 @@
+{
+  "name": "graph-viewer",
+  "description": "Inline Neo4j subgraph renderer. Provides graph-render — a Node-side PNG renderer that walks N hops from a starting node, applies the same palette and display strings the live /graph page uses, and returns the image as an MCP image content block. Removes the device-switch otherwise required for the agent to show the operator what a subgraph looks like. Account-scoped: the tool refuses to render nodes outside the caller's accountId. Layout is d3-force with a deterministic seed; drawing is @napi-rs/canvas with a system-font fallback for labels. The fidelity contract is palette and display-string parity — node positions will differ from the live page's vis-network layout. Ships one skill: render-graph.",
+  "version": "0.1.0",
+  "author": {
+    "name": "Rubytech LLC"
+  }
+}

package/payload/platform/plugins/graph-viewer/PLUGIN.md

@@ -0,0 +1,56 @@
+---
+name: graph-viewer
+mcp:
+  command: node
+  args:
+    - ${PLATFORM_ROOT}/lib/mcp-spawn-tee/dist/index.js
+    - ${PLATFORM_ROOT}/plugins/graph-viewer/mcp/dist/index.js
+  env:
+    MCP_SPAWN_TEE_NAME: graph-viewer
+    LOG_DIR: ${LOG_DIR}
+    PLATFORM_ROOT: ${PLATFORM_ROOT}
+    ACCOUNT_ID: ${ACCOUNT_ID}
+    SESSION_ID: ${SESSION_ID}
+mcp-manifest: skip
+description: "Inline Neo4j subgraph renderer. Provides graph-render — a Node-side PNG renderer that walks N hops from a starting node, applies the same palette and display strings the live /graph page uses, and returns the image as an MCP image content block. Removes the device-switch otherwise required for the agent to show the operator what a subgraph looks like. Account-scoped: the tool refuses to render nodes outside the caller's accountId. Layout is d3-force with a deterministic seed; drawing is @napi-rs/canvas with a system-font fallback for labels. The fidelity contract is palette and display-string parity — node positions will differ from the live page's vis-network layout. Ships one skill: render-graph."
+tools:
+  - name: graph-render
+    publicAllowlist: false
+    adminAllowlist: true
+---
+
+# graph-viewer
+
+## What it does
+
+A single MCP tool, `graph-render`, takes a Neo4j node ID and a hop depth and
+returns an inline PNG of the subgraph rooted at that node. The agent
+attaches the PNG to its reply so the operator can see the graph without
+opening the admin UI on a different device.
+
+## Why it exists
+
+Before this plugin, the agent had no way to ship the operator a picture
+of a subgraph from inside chat. Mermaid and ASCII substitutes were
+illegible and bore no resemblance to the live `/graph` page. Operators
+otherwise had to leave the chat surface, open the admin UI on whatever
+device hosts it, and re-find the same subgraph by hand.
+
+## Surface boundaries
+
+- `graph-render` only accepts a `nodeId + hopDepth` query shape. Arbitrary
+  Cypher is not supported and is filed as a follow-up task.
+- Pixel-equivalence with `/graph` is not a goal. The layout engine is
+  d3-force, not the live page's vis-network port; node positions will
+  differ. The colour palette, label precedence, and short-label strings
+  are shared with `/graph` via `platform/lib/graph-style/`.
+- Subgraphs above 200 nodes return a truncation envelope alongside the
+  capped render.
+- `:Trashed` nodes are filtered out, matching `memory-search`'s contract.
+
+## Enabling
+
+The plugin is auto-discovered from `platform/plugins/`. Each operator
+account must list `graph-viewer` in its `enabledPlugins` (use the admin
+`plugin-toggle-enabled` MCP tool) before `graph-render` appears in the
+agent's tool surface.

package/payload/platform/plugins/graph-viewer/mcp/dist/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * MCP server entrypoint for the graph-viewer plugin. Registers one tool,
+ * `graph-render`, on the standard stdio transport. Account-scoping is
+ * enforced inside the tool handler against the caller-supplied accountId.
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/plugins/graph-viewer/mcp/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/payload/platform/plugins/graph-viewer/mcp/dist/index.js

@@ -0,0 +1,70 @@
+/**
+ * MCP server entrypoint for the graph-viewer plugin. Registers one tool,
+ * `graph-render`, on the standard stdio transport. Account-scoping is
+ * enforced inside the tool handler against the caller-supplied accountId.
+ */
+import { initStderrTee } from "../../../../lib/mcp-stderr-tee/dist/index.js";
+initStderrTee("graph-viewer");
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { eagerTool } from "../../../../lib/mcp-eager/dist/index.js";
+import { z } from "zod";
+import { graphRender } from "./tools/graph-render.js";
+import { closeDriver } from "./lib/neo4j.js";
+const server = new McpServer({
+    name: "maxy-graph-viewer",
+    version: "0.1.0",
+});
+eagerTool(server, "graph-render", "Render a PNG of an account-scoped Neo4j subgraph rooted at a given nodeId, walking up to hopDepth hops (0-3). Writes the PNG to data/accounts/<accountId>/output/graph-render/ and returns {ok:true, path, nodeCount, edgeCount, width, height, truncated?}. The PNG lands under output/, so it appears in the operator's Artefacts panel (downloadable) and on their file share; callers tell the operator that exact path — MCP image content blocks are not surfaced in the maxy-code chat UI and there is no send-to-chat tool. The image uses the same colour palette and short-label strings as the live /graph page; node positions differ (d3-force, not vis-network) and are auto-fit to the canvas. Subgraphs above 200 nodes are capped and the envelope carries truncated={rendered,total}. Trashed nodes are excluded. Use when the operator asks to see what a subgraph looks like and you want to avoid making them switch to the admin UI on a different device.", {
+    accountId: z.string().min(1).describe("Operator account id. The root nodeId must belong to this account or the tool refuses with reason=scope."),
+    nodeId: z.string().min(1).describe("elementId of the root node, as returned by memory-search or other graph tools."),
+    hopDepth: z.number().int().min(0).max(3).describe("Number of hops to walk from the root (0 = just the root). Max 3."),
+}, async (args) => {
+    const result = await graphRender(args);
+    if (!result.ok) {
+        return {
+            isError: true,
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({ ok: false, reason: result.reason, message: result.message }, null, 2),
+                },
+            ],
+        };
+    }
+    const envelope = {
+        ok: true,
+        path: result.path,
+        width: result.width,
+        height: result.height,
+        nodeCount: result.nodeCount,
+        edgeCount: result.edgeCount,
+    };
+    if (result.truncated)
+        envelope.truncated = result.truncated;
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify(envelope, null, 2),
+            },
+        ],
+    };
+});
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((err) => {
+    console.error("[graph-viewer] fatal:", err);
+    process.exit(1);
+});
+process.on("SIGINT", async () => {
+    await closeDriver();
+    process.exit(0);
+});
+process.on("SIGTERM", async () => {
+    await closeDriver();
+    process.exit(0);
+});
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/graph-viewer/mcp/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,aAAa,CAAC,cAAc,CAAC,CAAC;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;IAC3B,IAAI,EAAE,mBAAmB;IACzB,OAAO,EAAE,OAAO;CACjB,CAAC,CAAC;AAEH,SAAS,CACP,MAAM,EACN,cAAc,EACd,k7BAAk7B,EACl7B;IACE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yGAAyG,CAAC;IAChJ,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gFAAgF,CAAC;IACpH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kEAAkE,CAAC;CACtH,EACD,KAAK,EAAE,IAA6D,EAAE,EAAE;IACtE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAC7D,IAAI,EACJ,CAAC,CACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAA4B;QACxC,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IACF,IAAI,MAAM,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;aACxC;SACF;KACF,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;IAC9B,MAAM,WAAW,EAAE,CAAC;IACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;IAC/B,MAAM,WAAW,EAAE,CAAC;IACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/graph-viewer/mcp/dist/lib/neo4j.d.ts

@@ -0,0 +1,5 @@
+import { type Driver, type Session } from "neo4j-driver";
+export declare function getDriver(): Driver;
+export declare function getSession(): Session;
+export declare function closeDriver(): Promise<void>;
+//# sourceMappingURL=neo4j.d.ts.map

package/payload/platform/plugins/graph-viewer/mcp/dist/lib/neo4j.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"neo4j.d.ts","sourceRoot":"","sources":["../../src/lib/neo4j.ts"],"names":[],"mappings":"AAAA,OAAc,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAwBhE,wBAAgB,SAAS,IAAI,MAAM,CAgBlC;AAED,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAKjD"}

package/payload/platform/plugins/graph-viewer/mcp/dist/lib/neo4j.js

@@ -0,0 +1,43 @@
+import neo4j from "neo4j-driver";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+let driver = null;
+function readPassword() {
+    if (process.env.NEO4J_PASSWORD)
+        return process.env.NEO4J_PASSWORD;
+    // Five segments up from the compiled file
+    // (`platform/plugins/graph-viewer/mcp/dist/lib/neo4j.js`) reaches
+    // `platform/`, where the installer writes `config/.neo4j-password`.
+    const passwordFile = resolve(process.env.PLATFORM_ROOT ?? resolve(import.meta.dirname, "../../../../.."), "config/.neo4j-password");
+    try {
+        return readFileSync(passwordFile, "utf-8").trim();
+    }
+    catch {
+        throw new Error(`Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`);
+    }
+}
+export function getDriver() {
+    if (!driver) {
+        // Refuse to default the URI — silent localhost:7687 has historically
+        // crossed brand boundaries on shared devices.
+        const uri = process.env.NEO4J_URI;
+        if (!uri) {
+            throw new Error("[graph-viewer] NEO4J_URI unset — refusing to default to bolt://localhost:7687");
+        }
+        const user = process.env.NEO4J_USER ?? "neo4j";
+        const password = readPassword();
+        console.error(`[graph-viewer] resolved neo4j_uri=${uri}`);
+        driver = neo4j.driver(uri, neo4j.auth.basic(user, password));
+    }
+    return driver;
+}
+export function getSession() {
+    return getDriver().session();
+}
+export async function closeDriver() {
+    if (driver) {
+        await driver.close();
+        driver = null;
+    }
+}
+//# sourceMappingURL=neo4j.js.map

package/payload/platform/plugins/graph-viewer/mcp/dist/lib/neo4j.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"neo4j.js","sourceRoot":"","sources":["../../src/lib/neo4j.ts"],"names":[],"mappings":"AAAA,OAAO,KAAoC,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,SAAS,YAAY;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAClE,0CAA0C;IAC1C,kEAAkE;IAClE,oEAAoE;IACpE,MAAM,YAAY,GAAG,OAAO,CAC1B,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAC3E,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yCAAyC,YAAY,gCAAgC,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC;QAC/C,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/payload/platform/plugins/graph-viewer/mcp/dist/render/draw.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Canvas drawing for the graph-render tool. Takes a laid-out graph and
+ * produces a PNG buffer.
+ *
+ * Visual contract:
+ *   - Background matches the /graph page's surface colour (#FAFAF8).
+ *   - Node fill comes from platform/lib/graph-style's resolveNodeColour —
+ *     identical hue to the live page for the same labels.
+ *   - Node label is pickShortLabel from the same shared lib, rendered
+ *     below the node circle in a sans-serif fallback. Exact webfont match
+ *     is filed as a follow-up.
+ *   - Edges are thin grey lines with a small arrowhead. Edge type labels
+ *     are intentionally omitted — they crowd the canvas at high node
+ *     counts and the operator can drill into the live page if they need
+ *     them.
+ */
+import type { LayoutResult, LayoutNodeOut } from "./layout.js";
+export interface DrawNode extends LayoutNodeOut {
+    properties: Record<string, unknown>;
+}
+export interface DrawInput {
+    layout: LayoutResult;
+    nodeProperties: Record<string, Record<string, unknown>>;
+    width: number;
+    height: number;
+}
+export declare function drawGraph(input: DrawInput): Buffer;
+//# sourceMappingURL=draw.d.ts.map

package/payload/platform/plugins/graph-viewer/mcp/dist/render/draw.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"draw.d.ts","sourceRoot":"","sources":["../../src/render/draw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAW/D,MAAM,WAAW,QAAS,SAAQ,aAAa;IAC7C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,CAAC;IAGrB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAiDlD"}

package/payload/platform/plugins/graph-viewer/mcp/dist/render/draw.js

@@ -0,0 +1,73 @@
+/**
+ * Canvas drawing for the graph-render tool. Takes a laid-out graph and
+ * produces a PNG buffer.
+ *
+ * Visual contract:
+ *   - Background matches the /graph page's surface colour (#FAFAF8).
+ *   - Node fill comes from platform/lib/graph-style's resolveNodeColour —
+ *     identical hue to the live page for the same labels.
+ *   - Node label is pickShortLabel from the same shared lib, rendered
+ *     below the node circle in a sans-serif fallback. Exact webfont match
+ *     is filed as a follow-up.
+ *   - Edges are thin grey lines with a small arrowhead. Edge type labels
+ *     are intentionally omitted — they crowd the canvas at high node
+ *     counts and the operator can drill into the live page if they need
+ *     them.
+ */
+import { createCanvas } from "@napi-rs/canvas";
+import { resolveNodeColour, pickShortLabel, } from "../../../../../lib/graph-style/dist/index.js";
+const BACKGROUND = "#FAFAF8";
+const EDGE_COLOUR = "#C9C7C2";
+const NODE_RADIUS = 12;
+const NODE_STROKE = "#FFFFFF";
+const NODE_STROKE_WIDTH = 2;
+const LABEL_COLOUR = "#1A1A1A";
+const LABEL_FONT = "12px sans-serif";
+const LABEL_PADDING_Y = 4;
+export function drawGraph(input) {
+    const { layout, nodeProperties, width, height } = input;
+    const canvas = createCanvas(width, height);
+    const ctx = canvas.getContext("2d");
+    ctx.fillStyle = BACKGROUND;
+    ctx.fillRect(0, 0, width, height);
+    const nodeIndex = new Map();
+    for (const n of layout.nodes)
+        nodeIndex.set(n.id, n);
+    // Edges first, so node circles cover the endpoints.
+    ctx.strokeStyle = EDGE_COLOUR;
+    ctx.lineWidth = 1;
+    for (const e of layout.edges) {
+        const from = nodeIndex.get(e.from);
+        const to = nodeIndex.get(e.to);
+        if (!from || !to)
+            continue;
+        ctx.beginPath();
+        ctx.moveTo(from.x, from.y);
+        ctx.lineTo(to.x, to.y);
+        ctx.stroke();
+    }
+    // Nodes: filled circle, white stroke, label below.
+    ctx.font = LABEL_FONT;
+    ctx.textAlign = "center";
+    ctx.textBaseline = "top";
+    for (const n of layout.nodes) {
+        const { colour } = resolveNodeColour(n.labels);
+        ctx.fillStyle = colour;
+        ctx.beginPath();
+        ctx.arc(n.x, n.y, NODE_RADIUS, 0, Math.PI * 2);
+        ctx.fill();
+        ctx.lineWidth = NODE_STROKE_WIDTH;
+        ctx.strokeStyle = NODE_STROKE;
+        ctx.stroke();
+        const props = nodeProperties[n.id] ?? {};
+        const labelNode = {
+            id: n.id,
+            labels: n.labels,
+            properties: props,
+        };
+        ctx.fillStyle = LABEL_COLOUR;
+        ctx.fillText(pickShortLabel(labelNode), n.x, n.y + NODE_RADIUS + LABEL_PADDING_Y);
+    }
+    return canvas.toBuffer("image/png");
+}
+//# sourceMappingURL=draw.js.map