feat: initial public release (MAESTRO v0.1.0)

Open-source release of MAESTRO, an agent orchestration platform that runs
LLM-driven tasks through sandboxed tools, with a web UI. Apache-2.0.
See README.md and docs/ (getting-started, configuration, architecture).

docs/tools/listuserassets.md

@@ -0,0 +1,53 @@
+# ListUserAssets
+
+Lists user-authored scripts, templates, and recordings stored in the caller's user folder (`data/users/{userId}/`).
+
+## Input
+
+```ts
+{
+  kind?: 'scripts' | 'templates' | 'recordings' | 'all'  // default: 'all'
+}
+```
+
+## Output
+
+Human-readable text listing each asset category.
+
+**Scripts** (`.js` files in `scripts/`): each entry shows the filename, description, and declared params.  
+**Templates** and **Recordings**: filename, byte size, and last-modified timestamp.
+
+Example output:
+
+```
+User folder for user-abc:
+Scripts (2):
+  - foo.js: "Log into example.com" — params: [date:string]
+  - bar.js: "Check dashboard" — params: []
+Templates (0):
+  (none)
+Recordings (1):
+  - rec-2026-05-09T12-34-56.json (1234 bytes, 2026-05-09T12:34:56.000Z)
+```
+
+## Owner gate
+
+The tool always reads the folder of the **authenticated caller** (`ctx.userId`). There is no way to list another user's assets.
+
+If the caller is unauthenticated (`ctx.userId` missing), the tool returns `isError: true` with a message about authentication.
+
+## Workflow example
+
+```
+ListUserAssets({ kind: 'scripts' })
+→ see which scripts are available and what params they need
+
+RunUserScript({ name: 'foo', params: { date: '2026-05-01' } })
+→ execute the script
+```
+
+## Notes
+
+- Scripts without a frontmatter block are listed with an empty description and no params.
+- A parse error in one script is reported inline for that entry; other scripts are still listed.
+- The tool is a META_TOOL — no need to add it to `allowed_tools` in piece YAML.