@ccoalm/ccl-skills 0.18.1 → 0.18.2

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_merge_authorization_prompt.sh

@@ -7,7 +7,7 @@
 set -u
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-HOOK="$SCRIPT_DIR/merge-authorization-prompt.sh"
+HOOK="${HOOK:-$SCRIPT_DIR/merge-authorization-prompt.sh}"
 [ -f "$HOOK" ] || { echo "FAIL: hook not found: $HOOK" >&2; exit 1; }
 command -v jq >/dev/null 2>&1 || { echo "FAIL: jq required for this suite" >&2; exit 1; }
 
@@ -18,11 +18,14 @@ SID="sess-prompt-test"
 AUTH_DIR="$tmp/ccl-skills-merge-auth-$(id -u)"
 SENT="$AUTH_DIR/$SID"
 
+git -C "$tmp" init -q repo
+git -C "$tmp/repo" remote add origin https://example.invalid/team/project.git
+
 pass=0; fail=0
 
 send() { # send <prompt> [sid]
   local p="$1" s="${2-$SID}"
-  jq -nc --arg p "$p" --arg s "$s" '{prompt:$p,session_id:$s}' | TMPDIR="$tmp" bash "$HOOK"
+  jq -nc --arg p "$p" --arg s "$s" --arg w "$tmp/repo" '{prompt:$p,session_id:$s,cwd:$w}' | TMPDIR="$tmp" bash "$HOOK"
 }
 
 expect_armed() { # expect_armed <prompt> [expected sentinel content]
@@ -160,8 +163,9 @@ fi
 rm -f "$SENT"
 
 # --- degrade / hostile inputs: no session_id, path-traversal session_id ---
+before_missing_sid=$(ls -A "$AUTH_DIR" 2>/dev/null)
 jq -nc '{prompt:"合并"}' | TMPDIR="$tmp" bash "$HOOK"
-if [ ! -d "$AUTH_DIR" ] || [ -z "$(ls -A "$AUTH_DIR" 2>/dev/null)" ]; then pass=$((pass+1)); else
+if [ "$(ls -A "$AUTH_DIR" 2>/dev/null)" = "$before_missing_sid" ]; then pass=$((pass+1)); else
   fail=$((fail+1)); echo 'FAIL  missing session_id must be a no-op' >&2
 fi
 send '合并' '../evil'
@@ -171,6 +175,55 @@ fi
 out=$(printf 'not-json' | TMPDIR="$tmp" bash "$HOOK")
 if [ -z "$out" ]; then pass=$((pass+1)); else fail=$((fail+1)); echo "FAIL  bad json -> $out" >&2; fi
 
+# Target goals have a closed grammar and retain their original deadline.
+expect_goal() {
+  send "$1"
+  if sed -n '1p' "$SENT" 2>/dev/null | jq -e '.kind == "target-goal" and .state == "active" and .id == "123" and .repo == "example.invalid/team/project"' >/dev/null 2>&1; then
+    pass=$((pass+1))
+  else fail=$((fail+1)); echo "FAIL target goal not armed: $1" >&2; fi
+}
+expect_goal '完成并合并 PR #123'
+expect_goal 'finish and merge PR #123'
+for bad in '完成并合并 PR #123？' '不要完成并合并 PR #123' '如果通过，完成并合并 PR #123' '“完成并合并 PR #123”' '完成并合并 PR #123 然后发布' '完成并合并 PR #0123' '发布下个 npm 补丁'; do
+  expect_not_armed "$bad"
+done
+for neutral in '继续' '继续吧' '进度' '状态' 'continue' 'status' 'progress'; do
+  rm -f "$SENT"
+  send "$neutral"
+  if [ ! -f "$SENT" ]; then pass=$((pass+1)); else fail=$((fail+1)); echo "FAIL neutral created authority: $neutral" >&2; fi
+  expect_goal '完成并合并 PR #123'
+  old_ts=$(date -v-30M +%Y%m%d%H%M 2>/dev/null || date -d '-30 minutes' +%Y%m%d%H%M)
+  touch -t "$old_ts" "$SENT"
+  cp -p "$SENT" "$tmp/before-neutral"
+  send "$neutral"
+  if cmp -s "$SENT" "$tmp/before-neutral" && [ ! "$SENT" -nt "$tmp/before-neutral" ]; then
+    pass=$((pass+1))
+  else fail=$((fail+1)); echo "FAIL neutral must preserve scope and original expiry: $neutral" >&2; fi
+done
+expect_goal '完成并合并 PR #123'
+send '先改 README'
+if sed -n '1p' "$SENT" 2>/dev/null | jq -e '.state == "suspended"' >/dev/null 2>&1; then pass=$((pass+1)); else fail=$((fail+1)); echo 'FAIL unresolved message must suspend goal' >&2; fi
+send '继续'
+if sed -n '1p' "$SENT" 2>/dev/null | jq -e '.state == "suspended"' >/dev/null 2>&1; then pass=$((pass+1)); else fail=$((fail+1)); echo 'FAIL neutral must not reactivate suspended goal' >&2; fi
+for revoke in '停止' '停一下' '不要合并' '撤销合并授权' 'stop' 'pause' 'cancel merge'; do
+  expect_goal '完成并合并 PR #123'
+  send "$revoke"
+  if [ ! -f "$SENT" ]; then pass=$((pass+1)); else fail=$((fail+1)); echo "FAIL explicit revocation: $revoke" >&2; fi
+done
+send '批量合并 3'
+send '继续'
+if [ ! -f "$SENT" ]; then pass=$((pass+1)); else fail=$((fail+1)); echo 'FAIL legacy batch still clears on neutral prompt' >&2; fi
+git -C "$tmp/repo" remote set-url origin 'https://user:password@example.invalid/team/project.git'
+expect_not_armed '完成并合并 PR #123'
+git -C "$tmp/repo" remote set-url origin 'git@example.invalid:team/project.git'
+expect_goal '完成并合并 PR #123'
+git -C "$tmp/repo" remote set-url origin 'ssh://git@example.invalid/team/project.git'
+expect_goal '完成并合并 PR #123'
+git -C "$tmp/repo" remote set-url origin $'https://example.invalid/team/project.git\nhttps://user:password@example.org/team/other'
+expect_not_armed '完成并合并 PR #123'
+git -C "$tmp/repo" remote remove origin
+expect_not_armed '完成并合并 PR #123'
+
 if [ "$fail" -ne 0 ]; then
   echo "test_merge_authorization_prompt: FAIL pass=$pass fail=$fail" >&2
   exit 1

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_proposed_next.py

@@ -0,0 +1,260 @@
+#!/usr/bin/env python3
+"""Synthetic native Stop payloads; no real host state or conversations."""
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class ProposedNextTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.hooks = self.root / 'hooks'
+        self.hooks.mkdir()
+        for name in ('host-input.py', 'proposed-next-stop.sh'):
+            source = ROOT / 'hooks' / name
+            if source.exists():
+                shutil.copyfile(source, self.hooks / name)
+        self.skill = self.root / 'skills/product-rd-workflow/SKILL.md'
+        self.skill.parent.mkdir(parents=True)
+        source = (ROOT / 'skills/product-rd-workflow/SKILL.md').read_text()
+        self.contract = next(p for p in source.split('\n\n') if p.startswith(
+            '**Continuation-proposal output contract (session-wide for product delivery).**'))
+        self.skill.write_text('---\nname: product-rd-workflow\n---\n\n' + self.contract + '\n')
+        self.path = self.root / 'synthetic.jsonl'
+        self.path.write_text('')
+        self.payload = {'session_id': 'synthetic', 'cwd': str(self.root),
+                        'transcript_path': str(self.path), 'hook_event_name': 'Stop',
+                        'stop_hook_active': False, 'last_assistant_message': 'Checks passed.'}
+
+    def events(self, events):
+        self.path.write_text(''.join(json.dumps(e) + '\n' for e in events))
+
+    def run_hook(self, payload=None):
+        value = self.payload if payload is None else payload
+        raw = value if isinstance(value, str) else json.dumps(value)
+        result = subprocess.run(['bash', str(self.hooks / 'proposed-next-stop.sh')],
+                                input=raw, text=True, capture_output=True, cwd=self.root)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stderr, '')
+        return json.loads(result.stdout) if result.stdout else {}
+
+    def claude_load(self, name='product-rd-workflow', error=False):
+        return [
+            {'type': 'assistant', 'message': {'content': [{'type': 'tool_use', 'id': 'load',
+             'name': 'Skill', 'input': {'skill': 'ccl-skills:' + name}}]}},
+            {'type': 'user', 'message': {'content': [{'type': 'tool_result',
+             'tool_use_id': 'load', 'is_error': error, 'content': 'Skill loaded'}]}}]
+
+    def codex_read(self, command=None, body=None, code=0, call_id='load', output_id='load'):
+        return [
+            {'type': 'response_item', 'payload': {'type': 'function_call', 'name': 'exec_command',
+             'call_id': call_id, 'arguments': json.dumps({'cmd': command or f'cat {self.skill}'})}},
+            {'type': 'response_item', 'payload': {'type': 'function_call_output', 'call_id': output_id,
+             'output': f'Process exited with code {code}\nOutput:\n' + (
+                 self.skill.read_text() if body is None else body)}}]
+
+    def assistant(self, text, host='codex', phase='final_answer'):
+        if host == 'claude':
+            return {'type': 'assistant', 'message': {'content': [{'type': 'text', 'text': text}]}}
+        return {'type': 'response_item', 'payload': {'type': 'message', 'role': 'assistant',
+                'phase': phase, 'content': [{'type': 'output_text', 'text': text}]}}
+
+    def assert_block(self, value):
+        self.assertEqual(value.get('decision'), 'block', value)
+        self.assertEqual(set(value), {'decision', 'reason'})
+        self.assertIn('proposed-next:', value['reason'])
+
+    def test_native_claude_and_codex_completed_owner(self):
+        for host, events in [('claude', self.claude_load()), ('codex', self.codex_read())]:
+            with self.subTest(host=host):
+                self.events(events)
+                payload = dict(self.payload)
+                if host == 'codex':
+                    payload.update(turn_id='synthetic-turn', model='synthetic-model',
+                                   permission_mode='default')
+                self.assert_block(self.run_hook(payload))
+
+    def test_direct_final_overrides_stale_transcript_answer(self):
+        self.events(self.claude_load() + [self.assistant('proposed-next: verify the local patch')])
+        self.assert_block(self.run_hook())
+        self.payload['last_assistant_message'] = 'Done.\nproposed-next: none — status only'
+        self.assertEqual(self.run_hook(), {})
+
+    def test_loop_and_malformed_fields_are_quiet(self):
+        self.events(self.claude_load())
+        for updates in ({'stop_hook_active': True}, {'stop_hook_active': 'false'},
+                        {'stop_hook_active': 0}, {'last_assistant_message': None},
+                        {'last_assistant_message': ''}, {'last_assistant_message': []},
+                        {'hook_event_name': 'SubagentStop'}, {'hook_event_name': 'StopFailure'}):
+            with self.subTest(updates=updates):
+                self.assertEqual(self.run_hook(dict(self.payload, **updates)), {})
+        for field in ('last_assistant_message', 'stop_hook_active', 'hook_event_name'):
+            payload = dict(self.payload)
+            del payload[field]
+            self.assertEqual(self.run_hook(payload), {})
+        for payload in ('[]', 'null', '{}'):
+            self.assertEqual(self.run_hook(payload), {})
+
+    def test_plain_answers_and_unrelated_owner_do_not_trigger(self):
+        for events in ([], self.claude_load('testing-strategy'), self.claude_load(error=True),
+                       self.claude_load()[:1]):
+            self.events(events)
+            self.assertEqual(self.run_hook(), {})
+
+    def test_prior_assistant_handoff_is_eligibility_for_both_hosts(self):
+        for host in ('claude', 'codex'):
+            self.events([self.assistant('proposed-next: verify the local patch', host)])
+            self.assert_block(self.run_hook())
+
+    def test_quoted_examples_and_commentary_do_not_establish_eligibility(self):
+        for text in ('> proposed-next: run checks', '```text\nproposed-next: run checks\n```',
+                     'Example: proposed-next: run checks', 'proposed-next: <action and scope>',
+                     '`proposed-next: run checks`', '    proposed-next: code example',
+                     '```text\n```not a closing fence\nproposed-next: code example\n```'):
+            self.events([self.assistant(text)])
+            self.assertEqual(self.run_hook(), {})
+        self.events([self.assistant('proposed-next: run checks', phase='commentary')])
+        self.assertEqual(self.run_hook(), {})
+        self.events([{'type': 'response_item', 'payload': {'type': 'message', 'role': 'user',
+                     'content': [{'type': 'input_text', 'text': 'proposed-next: run checks'}]}}])
+        self.assertEqual(self.run_hook(), {})
+
+    def test_marker_in_quote_does_not_satisfy_current_handoff(self):
+        self.events(self.claude_load())
+        for text in ('Done.\n> proposed-next: run checks',
+                     'Done.\n```text\nproposed-next: run checks\n```',
+                     'Done.\nproposed-next: <action and scope>', 'Done.\nproposed-next:  '):
+            self.payload['last_assistant_message'] = text
+            self.assert_block(self.run_hook())
+
+    def test_status_question_and_user_stop_keep_truthful_formatting(self):
+        self.events(self.claude_load())
+        for text in ('Which option should I use?', 'Stopped as requested.', 'Status: checks passed.'):
+            self.payload['last_assistant_message'] = text
+            self.assert_block(self.run_hook())
+        for text in ('proposed-next: none — status only', '**proposed-next:** none — status only',
+                     'proposed-next: run the existing local verification suite'):
+            self.payload['last_assistant_message'] = text
+            self.assertEqual(self.run_hook(), {})
+
+    def test_complete_machine_artifacts_are_preserved(self):
+        self.events(self.claude_load())
+        for text in ('{"status":"done"}', '[1,2]', 'true', '"done"', '42',
+                     '```json\n{"status":"done"}\n```', '~~~text\nexact output\n~~~'):
+            self.payload['last_assistant_message'] = text
+            self.assertEqual(self.run_hook(), {})
+        self.payload['last_assistant_message'] = '```json\n{}\n```\nChecks passed.\n```text\nexample\n```'
+        self.assert_block(self.run_hook())
+
+    def test_missing_optional_canonical_rule_does_not_disable_other_evidence(self):
+        self.skill.unlink()
+        for events in (self.claude_load(), [self.assistant('proposed-next: run local checks')]):
+            self.events(events)
+            self.assert_block(self.run_hook())
+        self.events([])
+        self.assertEqual(self.run_hook(), {})
+
+    def test_successful_fragment_read_is_visibility_not_completed_owner(self):
+        for command, body in [(f'sed -n \'10,12p\' {self.skill}', self.contract),
+                              (f'printf before; sed -n \'1,20p\' {self.skill}', self.skill.read_text())]:
+            with self.subTest(command=command):
+                self.events(self.codex_read(command, body))
+                self.assert_block(self.run_hook())
+                result = subprocess.run(['python3', str(self.hooks / 'host-input.py'),
+                                         'transcript', str(self.path), str(self.root)],
+                                        capture_output=True, text=True, check=True)
+                summary = json.loads(result.stdout)
+                self.assertEqual(summary['completed_skills'], [])
+                self.assertTrue(summary['continuation_contract_visible'])
+
+    def test_visibility_requires_whole_current_rule_and_terminal_matching_output(self):
+        command = f'sed -n \'10,12p\' {self.skill}'
+        for label, events in [
+            ('pending', self.codex_read(command)[:1]),
+            ('error', self.codex_read(command, self.contract, code=1)),
+            ('mismatch', self.codex_read(command, self.contract, output_id='unpaired')),
+            ('truncated', self.codex_read(command, 'Warning: truncated output\n' + self.contract)),
+            ('partial-rule', self.codex_read(command, self.contract[:120])),
+            ('strings-only', self.codex_read(command, 'proposed-next: <action and scope>')),
+        ]:
+            with self.subTest(label=label):
+                self.events(events)
+                self.assertEqual(self.run_hook(), {})
+        events = self.codex_read(command)
+        events[1]['payload']['output'] = 'Process running with session ID 1\nOutput:\n' + self.contract
+        self.events(events)
+        self.assertEqual(self.run_hook(), {})
+
+    def test_claude_successful_read_visibility_is_not_a_skill_load(self):
+        request = {'type': 'assistant', 'message': {'content': [{'type': 'tool_use', 'name': 'Read',
+                   'id': 'read', 'input': {'file_path': str(self.skill)}}]}}
+        for error, expected in ((False, 'block'), (True, None)):
+            self.events([request, {'type': 'user', 'message': {'content': [{'type': 'tool_result',
+                         'tool_use_id': 'read', 'is_error': error,
+                         'content': [{'type': 'text', 'text': self.contract}]}]}}])
+            self.assertEqual(self.run_hook().get('decision'), expected)
+
+    def test_visibility_tracks_canonical_rule_without_copied_matching_prose(self):
+        self.contract += ' Synthetic changed obligation.'
+        self.skill.write_text('---\nname: product-rd-workflow\n---\n\n' + self.contract + '\n')
+        self.events(self.codex_read('sed -n \'1,20p\' skills/product-rd-workflow/SKILL.md', self.contract))
+        self.assert_block(self.run_hook())
+
+    def test_internal_errors_warn_without_leaking_inputs(self):
+        self.events(self.claude_load())
+        self.payload['last_assistant_message'] = 'Private synthetic payload, never echo this.'
+        first = self.run_hook()
+        self.payload['last_assistant_message'] = 'Another synthetic payload.'
+        self.assertEqual(self.run_hook(), first)
+        self.assertNotIn('synthetic', json.dumps(first))
+        result = self.run_hook('{invalid secret fixture')
+        self.assertIn('unavailable', result.get('systemMessage', ''))
+        self.assertNotIn('secret', json.dumps(result))
+        (self.hooks / 'host-input.py').unlink()
+        self.assertIn('unavailable', self.run_hook().get('systemMessage', ''))
+
+    def test_scan_is_bounded_and_no_filesystem_markers_are_written(self):
+        self.events([{'type': 'ignored'}] * 20000 + self.claude_load())
+        before = set(self.root.rglob('*'))
+        self.assertIn('unverified', self.run_hook().get('systemMessage', '').lower())
+        self.assertEqual(set(self.root.rglob('*')), before)
+        self.events([{'type': 'ignored'}] * 20000)
+        self.assertEqual(self.run_hook(), {})
+        self.events(self.claude_load())
+        self.assert_block(self.run_hook())
+        self.assert_block(self.run_hook())  # A new host turn must not be suppressed by session id.
+        self.assertEqual(set(self.root.rglob('*')), before)
+
+    def test_oversized_or_malformed_input_fails_soft_without_transcript_echo(self):
+        self.path.write_text(json.dumps({'type': 'ignored', 'text': 'x' * (1024 * 1024)}) + '\n')
+        self.assertIn('unverified', self.run_hook().get('systemMessage', '').lower())
+        oversized = dict(self.payload, last_assistant_message='x' * (2 * 1024 * 1024))
+        self.assertIn('unavailable', self.run_hook(oversized).get('systemMessage', ''))
+        malformed = self.claude_load()
+        malformed[0]['message']['content'][0]['id'] = ['synthetic-private']
+        malformed[1]['message']['content'][0]['tool_use_id'] = ['synthetic-private']
+        self.events(malformed)
+        result = self.run_hook()
+        self.assertIn('unavailable', result.get('systemMessage', ''))
+        self.assertNotIn('synthetic-private', json.dumps(result))
+
+    def test_nonregular_transcript_does_not_block_on_a_pipe(self):
+        pipe = self.root / 'synthetic-pipe'
+        os.mkfifo(pipe)
+        payload = dict(self.payload, transcript_path=str(pipe))
+        result = subprocess.run(['python3', str(self.hooks / 'host-input.py'), 'proposed-next'],
+                                input=json.dumps(payload), text=True, capture_output=True, timeout=2)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn('unavailable', json.loads(result.stdout).get('systemMessage', ''))
+
+
+if __name__ == '__main__':
+    unittest.main()

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_session_start.sh

@@ -48,8 +48,9 @@ printf '%s' "$ctx" | grep -q 'app.txt' \
 printf '%s' "$ctx" | grep -q 'read the smallest relevant local session/memory slice' \
   && printf '%s' "$ctx" | grep -q 'Do not ask the user to reconstruct discoverable history' \
   && ok "capsule makes history recovery controller-owned" || bad "missing autonomous recovery contract"
-printf '%s' "$ctx" | grep -q 'local_history: repo-attributed-available' \
-  && ! printf '%s' "$ctx" | grep -Eq 'codex_sessions|claude_project_sessions|cursor_sessions|opencode_sessions|\.codex|\.claude|\.cursor' \
+recovery=$(printf '%s' "$ctx" | sed -n '/^<agent-context-recovery /,$p')
+printf '%s' "$recovery" | grep -q 'local_history: repo-attributed-available' \
+  && ! printf '%s' "$recovery" | grep -Eq 'codex_sessions|claude_project_sessions|cursor_sessions|opencode_sessions|\.codex|\.claude|\.cursor' \
   && ok "capsule aggregates local history without host/tool fingerprint" || bad "capsule leaks per-tool history identity"
 
 UNRELATED_HOME="$WORK/unrelated-history-home"
@@ -89,7 +90,8 @@ printf '%s' "$unknown_ctx" | grep -q 'repo_root: unknown' \
 for i in $(seq 1 25); do printf 'dirty\n' > "$REPO/dirty-$i.txt"; done
 many_out=$(printf '{"cwd":"%s"}' "$REPO" | HOME="$HISTORY_HOME" bash "$HOOK")
 many_ctx=$(printf '%s' "$many_out" | jq -r '.hookSpecificOutput.additionalContext // empty')
-printf '%s' "$many_ctx" | grep -Eq '\.\.\. \(\+[0-9]+ more; refresh with git status\)' \
+many_recovery=$(printf '{"cwd":"%s"}' "$REPO" | HOME="$HISTORY_HOME" bash "$(dirname "$HOOK")/session-context.sh")
+printf '%s' "$many_recovery" | grep -Eq '\.\.\. \(\+[0-9]+ more; refresh with git status\)' \
   && ok "dirty-scope truncation is explicit" || bad "dirty-scope truncation is silent"
 
 # --- the optional context must never corrupt the mandatory bootstrap ----------
@@ -166,5 +168,85 @@ printf '{}' | bash "$d/hooks/session-start.sh" >/dev/null 2>"$d/err"
 grep -q 'routing layer NOT injected' "$d/err" \
   && ok "missing bootstrap is diagnosable on stderr" || bad "missing bootstrap failed silently"
 
+# Keep the real merged payload inside both hosts' direct-context budgets.
+# Codex estimates tokens from UTF-8 bytes; a byte cap also bounds Claude characters.
+printf '%s' "$many_ctx" | grep -Fq 'proposed-next:' \
+  && printf '%s' "$many_ctx" | grep -Fq 'none — status only' \
+  && ok "delivery handoff cue remains directly visible" \
+  || bad "startup omits the delivery handoff cue"
+ctx_bytes=$(printf '%s' "$many_ctx" | LC_ALL=C wc -c | tr -d ' ')
+[ "$ctx_bytes" -le 9600 ] \
+  && ok "startup with bounded dirty scope fits direct-context budget" \
+  || bad "startup context exceeds 9600 bytes: $ctx_bytes"
+for source in startup clear compact resume fork; do
+  matcher=$(jq -r '.hooks.SessionStart[0].matcher' "$(dirname "$HOOK")/hooks.json")
+  printf '%s' "$source" | grep -Eq "^($matcher)$" \
+    && ok "SessionStart matches $source" || bad "SessionStart omits $source"
+done
+
+policy="$(cd "$(dirname "$HOOK")/.." && pwd)/agent-context/session-policy.md"
+printf '%s' "$ctx" | grep -Fq "](<$policy>)" \
+  && [ -r "$policy" ] \
+  && ok "deferred policy has a readable absolute plugin path" || bad "deferred policy pointer cannot resolve from a product cwd"
+
+r=$(fake_root '#!/usr/bin/env bash
+printf "<agent-context-recovery priority=\"high\">\n"
+printf "%020000d\n" 0
+printf "</agent-context-recovery>\n"')
+c=$(ctx_of "$r")
+[ "$(printf '%s' "$c" | LC_ALL=C wc -c | tr -d ' ')" -le 9600 ] \
+  && printf '%s' "$c" | grep -q '</ccl-skills-routing>' \
+  && printf '%s' "$c" | grep -q 'refresh live Git' \
+  && [ "$(tag_balance "$r")" = "1 1" ] \
+  && ok "oversized recovery is replaced whole while mandatory rules stay intact" \
+  || bad "oversized recovery spills or truncates the startup rules"
+
+# Mandatory content cannot be truncated to satisfy a host budget. Diagnose that
+# distinct limit without making it worse by adding an optional replacement frame.
+r=$(fake_root '#!/usr/bin/env bash
+exit 0')
+printf '%010000d' 0 > "$r/agent-context/session-start.md"
+c=$(ctx_of "$r")
+[ "$c" = "$(cat "$r/agent-context/session-start.md")" ] \
+  && grep -q 'mandatory bootstrap exceeds direct-context budget' "$r/err" \
+  && ! grep -q 'recovery context exceeds' "$r/err" \
+  && ok "oversized mandatory bootstrap stays whole with an accurate degradation diagnostic" \
+  || bad "oversized mandatory bootstrap is altered or misdiagnosed as recovery overflow"
+
+# A source file can fit while its installed policy link pushes the rendered
+# bootstrap over budget. Use a synthetic long plugin root, not a host path.
+long_root="$r/$(printf '%0180d' 0)"
+mkdir -p "$long_root"
+mv "$r/hooks" "$r/agent-context" "$long_root/"
+r="$long_root"
+printf '%09450d\n[Policy](session-policy.md)' 0 > "$r/agent-context/session-start.md"
+c=$(ctx_of "$r")
+expected=$(printf '%09450d\n[Policy](<%s/agent-context/session-policy.md>)' 0 "$r")
+[ "$(LC_ALL=C wc -c < "$r/agent-context/session-start.md" | tr -d ' ')" -le 9600 ] \
+  && [ "$(printf '%s' "$c" | LC_ALL=C wc -c | tr -d ' ')" -gt 9600 ] \
+  && [ "$c" = "$expected" ] \
+  && grep -q 'mandatory bootstrap exceeds direct-context budget' "$r/err" \
+  && ok "policy path expansion is included in mandatory bootstrap overflow detection" \
+  || bad "expanded mandatory policy path overflow is silent or truncated"
+
+r=$(fake_root '#!/usr/bin/env bash
+printf "<agent-context-recovery priority=\"high\">\n"
+printf "%020000d\n" 0
+printf "</agent-context-recovery>\n"')
+printf '%09500d' 0 > "$r/agent-context/session-start.md"
+c=$(ctx_of "$r")
+[ "$c" = "$(cat "$r/agent-context/session-start.md")" ] \
+  && grep -q 'recovery context omitted entirely' "$r/err" \
+  && ok "near-limit bootstrap omits a replacement capsule that would still exceed budget" \
+  || bad "replacement recovery capsule pushes a near-limit bootstrap over budget"
+
+r=$(fake_root '#!/usr/bin/env bash
+exit 0')
+printf '%09600d' 0 > "$r/agent-context/session-start.md"
+c=$(ctx_of "$r")
+[ "$c" = "$(cat "$r/agent-context/session-start.md")" ] && [ ! -s "$r/err" ] \
+  && ok "exact-budget bootstrap with no recovery does not add a phantom separator or frame" \
+  || bad "exact-budget bootstrap is incorrectly treated as overflow"
+
 printf '%s\n' "---" "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]