@cohortapp/agent-sdk 2.3.0

package/scripts/healthcheck.sh

@@ -0,0 +1,116 @@
+#!/bin/bash
+# Health Check — Verifies all Maestro agent subsystems are operational
+# Usage: ./scripts/healthcheck.sh
+# Exit codes: 0 = healthy, 1 = degraded, 2 = critical
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SOPHIE_AI_DIR="$(dirname "$SCRIPT_DIR")"
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+HEALTHY=0
+WARNINGS=0
+ERRORS=0
+
+echo "Maestro Health Check — $TIMESTAMP"
+echo "======================================="
+
+# Check 1: Emergency stop flag
+if [ -f "$SOPHIE_AI_DIR/.emergency-stop" ]; then
+    echo "[STOP] Emergency stop flag is active"
+    ERRORS=$((ERRORS + 1))
+else
+    echo "[OK]   No emergency stop flag"
+fi
+
+# Check 2: Anthropic auth — either ANTHROPIC_API_KEY set OR subscription
+# auth enabled. Daemons launched under launchd don't inherit the agent's
+# shell env, so a "missing" ANTHROPIC_API_KEY is normal when the operator
+# opted into Claude Code subscription auth (MAESTRO_PREFER_SUBSCRIPTION_AUTH=1
+# in .env strips the var and falls back to Keychain OAuth).
+if [ -n "${ANTHROPIC_API_KEY:-}" ]; then
+    echo "[OK]   Environment variable: ANTHROPIC_API_KEY"
+elif [ -f "$SOPHIE_AI_DIR/.env" ] && grep -qE "^MAESTRO_PREFER_SUBSCRIPTION_AUTH=(1|true|yes)$" "$SOPHIE_AI_DIR/.env"; then
+    echo "[OK]   Anthropic auth: subscription mode (.env: MAESTRO_PREFER_SUBSCRIPTION_AUTH=1)"
+elif [ -f "$SOPHIE_AI_DIR/.env" ] && grep -qE "^ANTHROPIC_API_KEY=." "$SOPHIE_AI_DIR/.env"; then
+    echo "[OK]   Anthropic auth: ANTHROPIC_API_KEY in .env"
+else
+    echo "[FAIL] Anthropic auth not configured (.env needs either ANTHROPIC_API_KEY or MAESTRO_PREFER_SUBSCRIPTION_AUTH=1)"
+    ERRORS=$((ERRORS + 1))
+fi
+
+# Check 3: Key directories exist and are writable
+for dir in logs outputs knowledge/memory config; do
+    if [ -d "$SOPHIE_AI_DIR/$dir" ] && [ -w "$SOPHIE_AI_DIR/$dir" ]; then
+        echo "[OK]   Directory writable: $dir"
+    else
+        echo "[FAIL] Directory missing or not writable: $dir"
+        ERRORS=$((ERRORS + 1))
+    fi
+done
+
+# Check 4: Source repositories accessible
+for repo in company-web innovation-lab partner-framework company-legal regulatory-submission strategic-initiative; do
+    if [ -d "$HOME/$repo" ]; then
+        echo "[OK]   Source repo accessible: ~/$repo"
+    else
+        echo "[WARN] Source repo not found: ~/$repo"
+        WARNINGS=$((WARNINGS + 1))
+    fi
+done
+
+# Check 5: Key applications available
+for app in Slack WhatsApp Safari; do
+    if [ -d "/Applications/$app.app" ] || [ -d "$HOME/Applications/$app.app" ]; then
+        echo "[OK]   Application installed: $app"
+    else
+        echo "[WARN] Application not found: $app"
+        WARNINGS=$((WARNINGS + 1))
+    fi
+done
+
+# Check 6: Network connectivity
+if curl -s --max-time 5 https://api.anthropic.com > /dev/null 2>&1; then
+    echo "[OK]   Network: Anthropic API reachable"
+else
+    echo "[FAIL] Network: Cannot reach Anthropic API"
+    ERRORS=$((ERRORS + 1))
+fi
+
+# Check 7: Disk space
+DISK_FREE=$(df -h "$SOPHIE_AI_DIR" | awk 'NR==2{print $5}' | tr -d '%')
+if [ "$DISK_FREE" -gt 90 ]; then
+    echo "[WARN] Disk usage: ${DISK_FREE}% — consider cleanup"
+    WARNINGS=$((WARNINGS + 1))
+elif [ "$DISK_FREE" -gt 95 ]; then
+    echo "[FAIL] Disk usage: ${DISK_FREE}% — critically low"
+    ERRORS=$((ERRORS + 1))
+else
+    echo "[OK]   Disk usage: ${DISK_FREE}%"
+fi
+
+# Check 8: Config files present
+for config in priorities.yaml environment.yaml contacts.yaml; do
+    if [ -f "$SOPHIE_AI_DIR/config/$config" ]; then
+        echo "[OK]   Config present: $config"
+    else
+        echo "[FAIL] Config missing: $config"
+        ERRORS=$((ERRORS + 1))
+    fi
+done
+
+# Summary
+echo ""
+echo "======================================="
+echo "Results: $ERRORS errors, $WARNINGS warnings"
+
+if [ "$ERRORS" -gt 0 ]; then
+    echo "Status: CRITICAL — fix errors before operating"
+    exit 2
+elif [ "$WARNINGS" -gt 0 ]; then
+    echo "Status: DEGRADED — operational with limitations"
+    exit 1
+else
+    echo "Status: HEALTHY — all systems operational"
+    exit 0
+fi

package/scripts/hooks/block-mcp-cohort-send.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+# Block org-MCP outbound writes in agent-repo sessions.
+#
+# The cohort MCP server (scaffold/.mcp.json) exposes the org tool surface to
+# interactive Claude sessions. READS are welcome; the outbound WRITES
+# (messaging_send, email_send, email_draft_send) and the org_rpc escape hatch
+# must go through the
+# sanctioned CLI lane instead — scripts/slack-send.sh / scripts/org/send-orgmail.mjs
+# — which carries the full dedup + reply-storm + governance perimeter that the
+# MCP tool's content screen alone does not. Same pattern as
+# block-mcp-slack-send.sh (CEO directive si-010).
+#
+# Exit 2 = blocked (message shown to Claude as rejection)
+echo "BLOCKED: org-MCP outbound writes are session-blocked. Reply via the sanctioned CLI lane instead: org messaging → the daemon's messaging path / scripts/slack-send.sh for Slack; workspace email → node scripts/org/send-orgmail.mjs --thread \"<thread_id>\" --body-file <path>. Read/board/decision org tools remain available." >&2
+exit 2

package/scripts/hooks/block-mcp-slack-send.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+# Block MCP Slack sends — per CEO directive si-010
+# All Slack sending must go through User OAuth Token (xoxp-) via slack-send.sh
+# MCP Slack adds "Sent using @Claude" label — unacceptable for the agent's identity
+# Exit 2 = blocked (message shown to Claude as rejection)
+echo "BLOCKED: Per CEO directive si-010 — do NOT use MCP Slack for sending. Use scripts/slack-send.sh with SLACK_USER_TOKEN instead." >&2
+exit 2

package/scripts/hooks/post-action-log.sh

@@ -0,0 +1,126 @@
+#!/bin/bash
+# Post-action log hook — logs every tool completion to the audit trail.
+# Called by Claude Code's PostToolUse hook after every tool execution.
+#
+# Stdin: Claude Code PostToolUse JSON payload (same contract the sibling
+#   pre-send-audit.sh relies on):
+#     { "tool_name": "...", "tool_input": { ... }, "tool_response": ...,
+#       "session_id": "..." }
+#
+# We parse that payload (jq when available, grep/sed fallback otherwise) and
+# append one row:
+#   {"timestamp":ISO8601Z,"tool":<tool_name>,"status":<"error"|"completed">,
+#    "target":<best-effort recipient/path/url/command>,"session_id":<id|null>}
+#
+# Design note: PostToolUse runs AFTER the tool has executed, so this hook can
+# never block or undo anything. Every path therefore fails OPEN and the script
+# always exits 0 — a parse error must still produce a row (with whatever is
+# parseable and status "unknown-parse"), never crash the session.
+
+AGENT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ACTION_LOG="$AGENT_DIR/logs/audit/$(date +%Y-%m-%d)-actions.jsonl"
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+# Read the full hook payload from stdin (do NOT discard it — it carries the
+# real tool name, inputs and response that the old hook threw away).
+PAYLOAD=$(cat 2>/dev/null)
+
+mkdir -p "$(dirname "$ACTION_LOG")" 2>/dev/null
+
+# Emit a row and exit. Args: tool status target session_id (each already a
+# bare string; jq -n quotes/escapes them safely; nulls passed as empty string
+# become JSON null).
+emit_row() {
+    local tool="$1" status="$2" target="$3" sid="$4"
+    if command -v jq >/dev/null 2>&1; then
+        jq -cn \
+            --arg ts "$TIMESTAMP" \
+            --arg tool "$tool" \
+            --arg status "$status" \
+            --arg target "$target" \
+            --arg sid "$sid" \
+            '{timestamp:$ts, tool:$tool, status:$status,
+              target:(if $target=="" then null else $target end),
+              session_id:(if $sid=="" then null else $sid end)}' \
+            >> "$ACTION_LOG" 2>/dev/null
+    else
+        # jq missing: hand-escape the few fields we control (backslash first,
+        # then double-quote, then strip control chars/newlines) so the row is
+        # still valid JSONL.
+        local esc_tool esc_status esc_target target_json sid_json
+        esc_tool=$(printf '%s' "$tool" | sed 's/\\/\\\\/g; s/"/\\"/g' | tr -d '\000-\037')
+        esc_status=$(printf '%s' "$status" | sed 's/\\/\\\\/g; s/"/\\"/g' | tr -d '\000-\037')
+        if [ -n "$target" ]; then
+            esc_target=$(printf '%s' "$target" | sed 's/\\/\\\\/g; s/"/\\"/g' | tr -d '\000-\037')
+            target_json="\"$esc_target\""
+        else
+            target_json="null"
+        fi
+        if [ -n "$sid" ]; then
+            sid_json="\"$(printf '%s' "$sid" | sed 's/\\/\\\\/g; s/"/\\"/g' | tr -d '\000-\037')\""
+        else
+            sid_json="null"
+        fi
+        printf '{"timestamp":"%s","tool":"%s","status":"%s","target":%s,"session_id":%s}\n' \
+            "$TIMESTAMP" "$esc_tool" "$esc_status" "$target_json" "$sid_json" \
+            >> "$ACTION_LOG" 2>/dev/null
+    fi
+    exit 0
+}
+
+# --- jq path (preferred) ----------------------------------------------------
+if command -v jq >/dev/null 2>&1 && printf '%s' "$PAYLOAD" | jq -e . >/dev/null 2>&1; then
+    TOOL_NAME=$(printf '%s' "$PAYLOAD" | jq -r '.tool_name // "unknown"' 2>/dev/null)
+    SESSION_ID=$(printf '%s' "$PAYLOAD" | jq -r '.session_id // empty' 2>/dev/null)
+
+    # Status: "error" when the tool response signals failure in any of the
+    # shapes Claude Code uses (string "error", {error:...}, {is_error:true},
+    # {success:false}, or a non-zero numeric exit/code); else "completed".
+    STATUS=$(printf '%s' "$PAYLOAD" | jq -r '
+        .tool_response as $r
+        | if ($r == null) then "completed"
+          elif ($r | type) == "string" then
+            (if ($r | ascii_downcase | test("error")) then "error" else "completed" end)
+          elif ($r | type) == "object" then
+            (if ($r.is_error == true)
+                or ($r.error != null and $r.error != false)
+                or ($r.success == false)
+                or (($r.exit_code // $r.exitCode // $r.code // 0) | tonumber? // 0) != 0
+             then "error" else "completed" end)
+          else "completed" end
+    ' 2>/dev/null)
+    [ -n "$STATUS" ] || STATUS="completed"
+
+    # Target: best-effort, first present of file_path / command / url / to /
+    # channel / recipient from tool_input. Command is truncated to 200 chars.
+    TARGET=$(printf '%s' "$PAYLOAD" | jq -r '
+        (.tool_input // {}) as $ti
+        | ( $ti.file_path?
+            // ( $ti.command? | if . == null then null else (.[0:200]) end )
+            // $ti.url?
+            // $ti.to?
+            // $ti.channel?
+            // $ti.recipient?
+            // empty )
+        | if . == null then "" else (. | tostring) end
+    ' 2>/dev/null)
+
+    emit_row "$TOOL_NAME" "$STATUS" "$TARGET" "$SESSION_ID"
+fi
+
+# --- fallback path: jq missing or payload not valid JSON --------------------
+# Pull the tool name out of the raw payload with a minimal grep/sed extraction
+# rather than writing "unknown". If we get a name we still record a useful row;
+# status is "unknown-parse" because we cannot reliably inspect the response.
+TOOL_NAME=$(printf '%s' "$PAYLOAD" \
+    | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' \
+    | head -1 \
+    | sed 's/.*"tool_name"[[:space:]]*:[[:space:]]*"//; s/"$//')
+[ -n "$TOOL_NAME" ] || TOOL_NAME="unknown"
+
+SESSION_ID=$(printf '%s' "$PAYLOAD" \
+    | grep -o '"session_id"[[:space:]]*:[[:space:]]*"[^"]*"' \
+    | head -1 \
+    | sed 's/.*"session_id"[[:space:]]*:[[:space:]]*"//; s/"$//')
+
+emit_row "$TOOL_NAME" "unknown-parse" "" "$SESSION_ID"

package/scripts/hooks/pre-send-audit.sh

@@ -0,0 +1,174 @@
+#!/bin/bash
+# Pre-send audit hook — gates outbound communications
+# Called by Claude Code PreToolUse hook before Slack/Gmail/WhatsApp sends.
+# Reads the PreToolUse payload from stdin, screens the outbound CONTENT
+# against the banned-phrase list (policies/communication-style.md), runs a
+# recipient allowlist sanity check, and enforces hourly + daily rate caps.
+#
+# Usage: pre-send-audit.sh <channel_type>
+#   channel_type: slack | slack-draft | gmail | whatsapp
+#
+# Stdin: Claude Code PreToolUse JSON payload:
+#   { "tool_name": "...", "tool_input": { "text"|"message"|"body": "...",
+#     "to"|"recipient"|"channel": "..." }, ... }
+#
+# Exit codes:
+#   0 = allowed (stdout message shown to Claude)
+#   2 = blocked / any parse|IO error (stderr reason shown as rejection).
+#       Claude Code blocks the tool call on any non-zero exit, so EVERY
+#       failure path below intentionally fails CLOSED with exit 2.
+#
+# Design note: this script does NOT use `set -e`. A non-zero from a grep
+# (no match) or an arithmetic expansion must not silently abort the script
+# into an implicit success/fail-open state. Instead every gate is checked
+# explicitly and the script ends with `exit 0` only after all checks pass.
+
+set -uo pipefail
+
+# --- fail-closed helper -----------------------------------------------------
+deny() {
+    # $1 = human-readable reason
+    echo "BLOCKED: ${1:-pre-send audit failed}" >&2
+    exit 2
+}
+
+CHANNEL_TYPE="${1:-}"
+[ -n "$CHANNEL_TYPE" ] || deny "Channel type required (slack|slack-draft|gmail|whatsapp)"
+
+# jq is mandatory — without it we cannot inspect content, so refuse to send.
+command -v jq >/dev/null 2>&1 || deny "jq not available — cannot screen outbound content (fail closed)"
+
+# --- read stdin payload -----------------------------------------------------
+TOOL_INPUT=$(cat)
+[ -n "$TOOL_INPUT" ] || deny "Empty hook payload — nothing to audit (fail closed)"
+
+# Validate that the payload is well-formed JSON before doing anything else.
+if ! printf '%s' "$TOOL_INPUT" | jq -e . >/dev/null 2>&1; then
+    deny "Malformed hook payload (not valid JSON) — fail closed"
+fi
+
+# Extract the outbound text. Claude Code wraps the tool args under
+# tool_input; for robustness we also look at the top level. We concatenate
+# every plausible content field so a banned phrase anywhere is caught.
+CONTENT=$(printf '%s' "$TOOL_INPUT" | jq -r '
+    [ .tool_input // {} , . ]
+    | map(
+        ( .text? // empty ),
+        ( .message? // empty ),
+        ( .body? // empty ),
+        ( .content? // empty ),
+        ( .blocks? | if type=="array" or type=="object" then tojson else empty end )
+      )
+    | flatten
+    | map(select(. != null and . != ""))
+    | join("\n")
+' 2>/dev/null) || deny "Failed to parse outbound content (fail closed)"
+
+# Extract the recipient for the allowlist sanity check (optional field).
+RECIPIENT=$(printf '%s' "$TOOL_INPUT" | jq -r '
+    ( .tool_input // {} ) as $ti
+    | ( $ti.to? // $ti.recipient? // $ti.channel? // $ti.email? // $ti.thread_ts? // .to? // .recipient? // empty )
+    | if . == null then "" else (. | tostring) end
+' 2>/dev/null) || deny "Failed to parse recipient (fail closed)"
+
+# --- (a) banned-phrase screen ----------------------------------------------
+# Source of truth: policies/communication-style.md (kept in sync manually).
+# Matching is case-insensitive and substring-based. Opener phrases
+# ("Certainly!" / "Absolutely!") are common in legitimate prose mid-sentence,
+# so we anchor those to the start of the content / a line.
+BANNED_SUBSTRINGS=(
+    "I'm here to help"
+    "I am here to help"
+    "Let me know if you need anything else"
+    "I hope this helps"
+    "Feel free to ask if you have any questions"
+    "As an AI"
+    "As a language model"
+    "I should clarify that I am"
+    "Great question!"
+    "Here's a comprehensive overview of"
+    "Here is a comprehensive overview of"
+    "I'd be happy to"
+    "I would be happy to"
+)
+
+# Lowercased copy for case-insensitive substring matching.
+CONTENT_LC=$(printf '%s' "$CONTENT" | tr '[:upper:]' '[:lower:]')
+
+for phrase in "${BANNED_SUBSTRINGS[@]}"; do
+    phrase_lc=$(printf '%s' "$phrase" | tr '[:upper:]' '[:lower:]')
+    case "$CONTENT_LC" in
+        *"$phrase_lc"*)
+            deny "Banned AI-tell phrase in outbound message: \"$phrase\" (see policies/communication-style.md)"
+            ;;
+    esac
+done
+
+# Opener-only phrases: block when they begin the message or any line.
+# (Mid-sentence "absolutely" is fine; "Absolutely!" as a line opener is not.)
+if printf '%s' "$CONTENT" | grep -Eiq '(^|[[:cntrl:]])[[:space:]]*(Certainly!|Absolutely!|Great question!)'; then
+    deny "Banned filler opener (Certainly!/Absolutely!/Great question!) — see policies/communication-style.md"
+fi
+
+# --- (b) recipient allowlist sanity check ----------------------------------
+# Only enforced when a recipient is present AND an allowlist file exists.
+# Allowlist file: one entry (channel id, email, handle) per line, '#' comments.
+ALLOWLIST_FILE="${MAESTRO_SEND_ALLOWLIST:-}"
+if [ -n "$RECIPIENT" ] && [ -n "$ALLOWLIST_FILE" ] && [ -f "$ALLOWLIST_FILE" ]; then
+    if ! grep -Eq -- "^[[:space:]]*$(printf '%s' "$RECIPIENT" | sed 's/[.[\*^$()+?{|]/\\&/g')[[:space:]]*(#.*)?$" "$ALLOWLIST_FILE" 2>/dev/null; then
+        deny "Recipient \"$RECIPIENT\" not on send allowlist ($ALLOWLIST_FILE)"
+    fi
+fi
+
+# --- (c) rate caps (hourly + daily) ----------------------------------------
+RUNTIME_DIR="${MAESTRO_RUNTIME_DIR:-$HOME/.maestro/runtime}/audit"
+if ! mkdir -p "$RUNTIME_DIR" 2>/dev/null; then
+    deny "Cannot create audit runtime dir $RUNTIME_DIR (fail closed)"
+fi
+
+COUNTER_FILE="$RUNTIME_DIR/send-counter.tsv"
+TODAY=$(date +%Y-%m-%d)
+HOUR=$(date +%H)
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+SEND_LOG="$RUNTIME_DIR/$TODAY-sends.jsonl"
+
+PER_HOUR_CAP="${MAESTRO_SEND_PER_HOUR:-3000}"
+PER_DAY_CAP="${MAESTRO_SEND_PER_DAY:-20000}"
+
+# Counter format (TSV): date<TAB>hour<TAB>hour_count<TAB>day_count
+# Reset whenever the date rolls over; reset the hour bucket when hour rolls.
+PREV_DATE=""; PREV_HOUR=""; HOUR_COUNT=0; DAY_COUNT=0
+if [ -f "$COUNTER_FILE" ]; then
+    IFS=$'\t' read -r PREV_DATE PREV_HOUR HOUR_COUNT DAY_COUNT < "$COUNTER_FILE" 2>/dev/null || true
+fi
+# Sanitise to integers (fail closed to 0 rather than aborting).
+case "$HOUR_COUNT" in (''|*[!0-9]*) HOUR_COUNT=0 ;; esac
+case "$DAY_COUNT"  in (''|*[!0-9]*) DAY_COUNT=0  ;; esac
+
+if [ "$PREV_DATE" != "$TODAY" ]; then
+    DAY_COUNT=0
+    HOUR_COUNT=0
+elif [ "$PREV_HOUR" != "$HOUR" ]; then
+    HOUR_COUNT=0
+fi
+
+if [ "$DAY_COUNT" -ge "$PER_DAY_CAP" ]; then
+    deny "Daily send limit ($PER_DAY_CAP) reached. Sends resume tomorrow."
+fi
+if [ "$HOUR_COUNT" -ge "$PER_HOUR_CAP" ]; then
+    deny "Hourly send limit ($PER_HOUR_CAP) reached. Sends resume next hour."
+fi
+
+# --- commit: increment counters + log allowed send -------------------------
+HOUR_COUNT=$((HOUR_COUNT + 1))
+DAY_COUNT=$((DAY_COUNT + 1))
+if ! printf '%s\t%s\t%s\t%s\n' "$TODAY" "$HOUR" "$HOUR_COUNT" "$DAY_COUNT" > "$COUNTER_FILE" 2>/dev/null; then
+    deny "Cannot write send counter (fail closed)"
+fi
+
+RECIPIENT_JSON=$(printf '%s' "$RECIPIENT" | jq -Rs . 2>/dev/null || printf '""')
+printf '{"timestamp":"%s","channel":"%s","recipient":%s,"status":"allowed"}\n' \
+    "$TIMESTAMP" "$CHANNEL_TYPE" "$RECIPIENT_JSON" >> "$SEND_LOG" 2>/dev/null || true
+
+echo "Audit: $CHANNEL_TYPE send screened and logged at $TIMESTAMP (hour: $HOUR_COUNT/$PER_HOUR_CAP, day: $DAY_COUNT/$PER_DAY_CAP)"
+exit 0

package/scripts/hooks/pre-send-audit.test.mjs

@@ -0,0 +1,215 @@
+// node:test for scripts/hooks/pre-send-audit.sh (audit M1)
+//
+// The hook is a Claude Code PreToolUse gate that must SCREEN outbound
+// content and FAIL CLOSED (exit 2) on any banned phrase, allowlist miss,
+// rate-cap breach, or parse/IO error. These tests execFile the real shell
+// script with crafted stdin JSON and assert the exit code.
+//
+// jq is required by the hook; if it is not on PATH we skip rather than
+// report a false failure (but jq is available in CI/dev here).
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { execFile, execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const HOOK = join(__dirname, "pre-send-audit.sh");
+
+function jqAvailable() {
+  try {
+    execFileSync("jq", ["--version"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+const JQ = jqAvailable();
+
+// Run the hook with the given stdin, returning { code, stdout, stderr }.
+// Each call gets its own runtime dir so the rate counters never leak
+// between cases. The shell env is reset to a known baseline so a stray
+// MAESTRO_SEND_* in the test runner's environment cannot skew caps.
+function runHook(stdin, { channel = "slack", env = {} } = {}) {
+  const runtimeDir = mkdtempSync(join(tmpdir(), "presend-"));
+  return new Promise((resolve) => {
+    const child = execFile(
+      "bash",
+      [HOOK, channel],
+      {
+        env: {
+          PATH: process.env.PATH,
+          HOME: runtimeDir,
+          MAESTRO_RUNTIME_DIR: runtimeDir,
+          ...env,
+        },
+      },
+      (err, stdout, stderr) => {
+        const code = err && typeof err.code === "number" ? err.code : 0;
+        rmSync(runtimeDir, { recursive: true, force: true });
+        resolve({ code, stdout, stderr });
+      },
+    );
+    child.stdin.end(stdin);
+  });
+}
+
+test("clean message passes (exit 0)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const payload = JSON.stringify({
+    tool_name: "send",
+    tool_input: { text: "In progress — only blocker is DBA approval, expected EOD.", to: "C123" },
+  });
+  const { code, stdout } = await runHook(payload);
+  assert.equal(code, 0, `expected exit 0, got ${code}`);
+  assert.match(stdout, /screened and logged/);
+});
+
+test("banned phrase 'Let me know if you need anything else' blocks (exit 2)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const payload = JSON.stringify({ tool_input: { text: "Done. Let me know if you need anything else!" } });
+  const { code, stderr } = await runHook(payload);
+  assert.equal(code, 2, `expected exit 2, got ${code}`);
+  assert.match(stderr, /BLOCKED/);
+});
+
+test("banned phrase 'As an AI' blocks (exit 2)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const payload = JSON.stringify({ tool_input: { body: "As an AI, I cannot make that commitment." } });
+  const { code } = await runHook(payload, { channel: "gmail" });
+  assert.equal(code, 2, `expected exit 2, got ${code}`);
+});
+
+test("banned phrase \"I'd be happy to\" blocks (exit 2)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const payload = JSON.stringify({ tool_input: { message: "I'd be happy to set that up for you." } });
+  const { code } = await runHook(payload);
+  assert.equal(code, 2, `expected exit 2, got ${code}`);
+});
+
+test("filler opener 'Absolutely!' blocks (exit 2)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const payload = JSON.stringify({ tool_input: { text: "Absolutely! I can pull that together." } });
+  const { code } = await runHook(payload);
+  assert.equal(code, 2, `expected exit 2, got ${code}`);
+});
+
+test("mid-sentence 'absolutely' (no opener) passes (exit 0)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const payload = JSON.stringify({ tool_input: { text: "I am absolutely certain the deploy is fine." } });
+  const { code } = await runHook(payload);
+  assert.equal(code, 0, `expected exit 0, got ${code}`);
+});
+
+test("banned phrase inside Slack blocks array blocks (exit 2)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const payload = JSON.stringify({
+    tool_input: { blocks: [{ type: "section", text: { type: "mrkdwn", text: "As an AI I will help with that." } }] },
+  });
+  const { code } = await runHook(payload);
+  assert.equal(code, 2, `expected exit 2, got ${code}`);
+});
+
+test("malformed JSON fails closed (exit 2)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const { code, stderr } = await runHook("not json {{{");
+  assert.equal(code, 2, `expected exit 2, got ${code}`);
+  assert.match(stderr, /Malformed|fail closed/i);
+});
+
+test("empty stdin fails closed (exit 2)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const { code } = await runHook("");
+  assert.equal(code, 2, `expected exit 2, got ${code}`);
+});
+
+test("missing channel arg fails closed (exit 2)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  // Invoke with no channel argument.
+  const runtimeDir = mkdtempSync(join(tmpdir(), "presend-"));
+  const code = await new Promise((resolve) => {
+    const child = execFile(
+      "bash",
+      [HOOK],
+      { env: { PATH: process.env.PATH, HOME: runtimeDir, MAESTRO_RUNTIME_DIR: runtimeDir } },
+      (err) => {
+        rmSync(runtimeDir, { recursive: true, force: true });
+        resolve(err && typeof err.code === "number" ? err.code : 0);
+      },
+    );
+    child.stdin.end(JSON.stringify({ tool_input: { text: "hi" } }));
+  });
+  assert.equal(code, 2, `expected exit 2, got ${code}`);
+});
+
+test("recipient on allowlist passes (exit 0)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const dir = mkdtempSync(join(tmpdir(), "presend-allow-"));
+  const allow = join(dir, "allow.txt");
+  writeFileSync(allow, "C123\ngood@example.com\n# a comment\n");
+  const payload = JSON.stringify({ tool_input: { text: "hello", to: "C123" } });
+  const { code } = await runHook(payload, { env: { MAESTRO_SEND_ALLOWLIST: allow } });
+  rmSync(dir, { recursive: true, force: true });
+  assert.equal(code, 0, `expected exit 0, got ${code}`);
+});
+
+test("recipient NOT on allowlist fails closed (exit 2)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const dir = mkdtempSync(join(tmpdir(), "presend-allow-"));
+  const allow = join(dir, "allow.txt");
+  writeFileSync(allow, "C123\ngood@example.com\n");
+  const payload = JSON.stringify({ tool_input: { text: "hello", to: "C999" } });
+  const { code, stderr } = await runHook(payload, { env: { MAESTRO_SEND_ALLOWLIST: allow } });
+  rmSync(dir, { recursive: true, force: true });
+  assert.equal(code, 2, `expected exit 2, got ${code}`);
+  assert.match(stderr, /allowlist/i);
+});
+
+test("hourly cap blocks once exceeded (exit 2)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  // Share one runtime dir across three sends with PER_HOUR=2.
+  const runtimeDir = mkdtempSync(join(tmpdir(), "presend-hour-"));
+  const payload = JSON.stringify({ tool_input: { text: "hi" } });
+  const send = () =>
+    new Promise((resolve) => {
+      const child = execFile(
+        "bash",
+        [HOOK, "slack"],
+        {
+          env: {
+            PATH: process.env.PATH,
+            HOME: runtimeDir,
+            MAESTRO_RUNTIME_DIR: runtimeDir,
+            MAESTRO_SEND_PER_HOUR: "2",
+          },
+        },
+        (err) => resolve(err && typeof err.code === "number" ? err.code : 0),
+      );
+      child.stdin.end(payload);
+    });
+  const c1 = await send();
+  const c2 = await send();
+  const c3 = await send();
+  rmSync(runtimeDir, { recursive: true, force: true });
+  assert.equal(c1, 0, `send 1 expected 0, got ${c1}`);
+  assert.equal(c2, 0, `send 2 expected 0, got ${c2}`);
+  assert.equal(c3, 2, `send 3 expected 2 (hourly cap), got ${c3}`);
+});
+
+test("daily cap blocks once exceeded (exit 2)", { skip: JQ ? false : "jq not on PATH" }, async () => {
+  const runtimeDir = mkdtempSync(join(tmpdir(), "presend-day-"));
+  const payload = JSON.stringify({ tool_input: { text: "hi" } });
+  const send = () =>
+    new Promise((resolve) => {
+      const child = execFile(
+        "bash",
+        [HOOK, "slack"],
+        {
+          env: {
+            PATH: process.env.PATH,
+            HOME: runtimeDir,
+            MAESTRO_RUNTIME_DIR: runtimeDir,
+            MAESTRO_SEND_PER_DAY: "1",
+          },
+        },
+        (err, stdout, stderr) => resolve({ code: err && typeof err.code === "number" ? err.code : 0, stderr }),
+      );
+      child.stdin.end(payload);
+    });
+  const r1 = await send();
+  const r2 = await send();
+  rmSync(runtimeDir, { recursive: true, force: true });
+  assert.equal(r1.code, 0, `send 1 expected 0, got ${r1.code}`);
+  assert.equal(r2.code, 2, `send 2 expected 2 (daily cap), got ${r2.code}`);
+  assert.match(r2.stderr, /Daily send limit/);
+});