@cohortapp/agent-sdk 2.3.0

package/scripts/test-rag-phase2.sh

@@ -0,0 +1,442 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# test-rag-phase2.sh — Tests for RAG Phase 2 (SQLite FTS5 backend)
+#
+# Tests:
+#   1-3.  Indexer: full index, stats, incremental re-index
+#   4-5.  SQLite search: CEO gets results, correct backend label
+#   6-7.  Ring-fencing: leadership cannot see CEO private DMs
+#   8-9.  Ring-fencing: unknown user sees only public scope
+#   10.   Ring-fencing: partner sees public + own data only
+#   11.   Fallback: sqlite backend falls back to grep when DB missing
+#   12.   User resolution works with sqlite backend
+#   13.   Text format works with sqlite backend
+#   14.   FTS5 search quality: multi-word queries return relevant results
+#   15.   Incremental indexing skips unchanged files
+#   16.   Phase 1 backward compatibility: grep backend still works
+#   17.   Ring-fencing DB-level: direct SQL confirms no scope leakage
+#   18.   Indexer --stats runs without error
+#   19.   Custom --db path works
+#   20.   Empty query handling
+#
+# Usage: ./scripts/test-rag-phase2.sh
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+BASE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+SEARCH_SCRIPT="${SCRIPT_DIR}/user-context-search.py"
+INDEXER_SCRIPT="${SCRIPT_DIR}/rag-indexer.py"
+DB_PATH="${BASE_DIR}/state/rag/search.db"
+TEST_DB="/tmp/test-rag-phase2.db"
+PASS=0
+FAIL=0
+TOTAL=0
+
+# ── Helpers ────────────────────────────────────────────────────────────────────
+
+pass_test() {
+    PASS=$((PASS + 1))
+    TOTAL=$((TOTAL + 1))
+    echo "  PASS: $1"
+}
+
+fail_test() {
+    FAIL=$((FAIL + 1))
+    TOTAL=$((TOTAL + 1))
+    echo "  FAIL: $1"
+    if [ -n "${2:-}" ]; then
+        echo "        Detail: $2"
+    fi
+}
+
+run_search() {
+    python3 "$SEARCH_SCRIPT" "$@" 2>/dev/null
+}
+
+run_indexer() {
+    python3 "$INDEXER_SCRIPT" "$@" 2>/dev/null
+}
+
+# ── Setup ──────────────────────────────────────────────────────────────────────
+
+echo "================================================================"
+echo "RAG Phase 2 — SQLite FTS5 backend test suite"
+echo "================================================================"
+echo ""
+
+# Clean up test DB if it exists
+rm -f "$TEST_DB"
+
+# ── Test 1: Full index builds database ────────────────────────────────────────
+
+echo "Test 1: Full index builds database"
+OUTPUT=$(run_indexer --full --db "$TEST_DB" 2>&1 || true)
+
+if [ -f "$TEST_DB" ]; then
+    pass_test "Database file created at $TEST_DB"
+else
+    fail_test "Database file not created" "$OUTPUT"
+fi
+
+if echo "$OUTPUT" | grep -q "Indexed.*files"; then
+    pass_test "Indexer reported indexed files"
+else
+    fail_test "Indexer should report indexed file count" "$OUTPUT"
+fi
+
+echo ""
+
+# ── Test 2: Database has documents ────────────────────────────────────────────
+
+echo "Test 2: Database contains documents"
+DOC_COUNT=$(python3 -c "
+import sqlite3
+conn = sqlite3.connect('$TEST_DB')
+count = conn.execute('SELECT COUNT(*) FROM documents').fetchone()[0]
+print(count)
+conn.close()
+" 2>/dev/null || echo "0")
+
+if [ "$DOC_COUNT" -gt 0 ] 2>/dev/null; then
+    pass_test "Database contains $DOC_COUNT documents"
+else
+    fail_test "Database should contain documents (got $DOC_COUNT)"
+fi
+
+echo ""
+
+# ── Test 3: FTS5 virtual table exists ─────────────────────────────────────────
+
+echo "Test 3: FTS5 virtual table exists and is searchable"
+FTS_RESULT=$(python3 -c "
+import sqlite3
+conn = sqlite3.connect('$TEST_DB')
+try:
+    rows = conn.execute(\"SELECT COUNT(*) FROM documents_fts WHERE documents_fts MATCH '\\\"northwind\\\"'\").fetchone()[0]
+    print(rows)
+except Exception as e:
+    print(f'ERROR: {e}')
+conn.close()
+" 2>/dev/null || echo "ERROR")
+
+if echo "$FTS_RESULT" | grep -qv "ERROR"; then
+    if [ "$FTS_RESULT" -gt 0 ] 2>/dev/null; then
+        pass_test "FTS5 table is searchable, found $FTS_RESULT matches for 'northwind'"
+    else
+        fail_test "FTS5 search returned 0 results for 'northwind'"
+    fi
+else
+    fail_test "FTS5 table query failed: $FTS_RESULT"
+fi
+
+echo ""
+
+# ── Test 4: SQLite backend — CEO search returns results ──────────────────────
+
+echo "Test 4: SQLite backend — CEO search returns results"
+RESULT=$(run_search --user alex --query "the regulator" --backend sqlite --db "$TEST_DB" --format json 2>&1 || true)
+
+MATCH_COUNT=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['result_count'])" 2>/dev/null || echo "0")
+if [ "$MATCH_COUNT" -gt 0 ] 2>/dev/null; then
+    pass_test "CEO sqlite search returned $MATCH_COUNT results for 'the regulator'"
+else
+    fail_test "CEO sqlite search should return results for 'the regulator'"
+fi
+
+echo ""
+
+# ── Test 5: SQLite backend label in output ────────────────────────────────────
+
+echo "Test 5: Backend label is 'sqlite' in JSON output"
+BACKEND=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('backend',''))" 2>/dev/null || echo "")
+if [ "$BACKEND" = "sqlite" ]; then
+    pass_test "Backend reported as 'sqlite'"
+else
+    fail_test "Backend should be 'sqlite', got '$BACKEND'"
+fi
+
+echo ""
+
+# ── Test 6: Ring-fencing — leadership cannot see CEO private DMs ──────────────
+
+echo "Test 6: Ring-fencing — leadership cannot see CEO private DMs"
+RESULT=$(run_search --user jordan --query "alex" --backend sqlite --db "$TEST_DB" --format json --max-results 50 2>&1 || true)
+
+LEAKED=$(echo "$RESULT" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+# Check if any result has user_scope of a private user (alex-chen)
+leaked = [m for m in d['matches'] if m.get('user_scope') == 'alex-chen']
+print(len(leaked))
+" 2>/dev/null || echo "-1")
+
+if [ "$LEAKED" = "0" ]; then
+    pass_test "Leadership user sees 0 of Alex's private documents"
+else
+    fail_test "Leadership user should not see Alex's private docs (saw $LEAKED)"
+fi
+
+echo ""
+
+# ── Test 7: Ring-fencing — CEO can see private DMs ────────────────────────────
+
+echo "Test 7: Ring-fencing — CEO can see private DMs"
+RESULT=$(run_search --user alex --query "voice" --backend sqlite --db "$TEST_DB" --format json --max-results 50 2>&1 || true)
+
+PRIVATE_COUNT=$(echo "$RESULT" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+private = [m for m in d['matches'] if m.get('user_scope') == 'alex-chen']
+print(len(private))
+" 2>/dev/null || echo "0")
+
+if [ "$PRIVATE_COUNT" -gt 0 ] 2>/dev/null; then
+    pass_test "CEO can see $PRIVATE_COUNT private documents"
+else
+    fail_test "CEO should be able to see private DM documents"
+fi
+
+echo ""
+
+# ── Test 8: Ring-fencing — unknown user sees only public ─────────────────────
+
+echo "Test 8: Ring-fencing — unknown user sees only public scope"
+RESULT=$(run_search --user nobody --query "northwind" --backend sqlite --db "$TEST_DB" --format json --max-results 50 2>&1 || true)
+
+NON_PUBLIC=$(echo "$RESULT" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+non_pub = [m for m in d['matches'] if m.get('user_scope') != 'public']
+print(len(non_pub))
+" 2>/dev/null || echo "-1")
+
+if [ "$NON_PUBLIC" = "0" ]; then
+    pass_test "Unknown user sees only public-scoped documents"
+else
+    fail_test "Unknown user should only see public docs (saw $NON_PUBLIC non-public)"
+fi
+
+echo ""
+
+# ── Test 9: Ring-fencing — unknown user access level is default ──────────────
+
+echo "Test 9: Unknown user has 'default' access level"
+ACCESS=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['access_level'])" 2>/dev/null || echo "")
+if [ "$ACCESS" = "default" ]; then
+    pass_test "Unknown user access_level is 'default'"
+else
+    fail_test "Unknown user access_level should be 'default', got '$ACCESS'"
+fi
+
+echo ""
+
+# ── Test 10: Ring-fencing — partner sees public + own only ───────────────────
+
+echo "Test 10: Ring-fencing — partner sees public + own data only"
+RESULT=$(run_search --user shayan --query "northwind" --backend sqlite --db "$TEST_DB" --format json --max-results 50 2>&1 || true)
+
+BAD_SCOPE=$(echo "$RESULT" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+allowed = {'public', 'casey-morgan'}
+bad = [m for m in d['matches'] if m.get('user_scope') not in allowed]
+print(len(bad))
+" 2>/dev/null || echo "-1")
+
+if [ "$BAD_SCOPE" = "0" ]; then
+    pass_test "Partner sees only public + own-scope documents"
+else
+    fail_test "Partner should only see public + own scope (saw $BAD_SCOPE violations)"
+fi
+
+echo ""
+
+# ── Test 11: Fallback — sqlite falls back to grep when DB missing ────────────
+
+echo "Test 11: Fallback to grep when SQLite DB missing"
+RESULT=$(python3 "$SEARCH_SCRIPT" --user alex --query "the regulator" --backend sqlite --db /tmp/nonexistent-db-test.db --format json 2>/dev/null || true)
+
+BACKEND=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('backend',''))" 2>/dev/null || echo "")
+if [ "$BACKEND" = "grep" ]; then
+    pass_test "Fell back to 'grep' backend when DB missing"
+else
+    fail_test "Should fall back to 'grep' when DB missing, got '$BACKEND'"
+fi
+
+echo ""
+
+# ── Test 12: User resolution works with sqlite backend ───────────────────────
+
+echo "Test 12: Slack ID resolution works with sqlite backend"
+RESULT=$(run_search --user U099N1JGKRQ --query "test" --backend sqlite --db "$TEST_DB" --format json 2>&1 || true)
+
+USER=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['user'])" 2>/dev/null || echo "")
+if [ "$USER" = "alex" ]; then
+    pass_test "Slack ID U099N1JGKRQ resolved to 'alex' with sqlite backend"
+else
+    fail_test "Slack ID should resolve to 'alex', got '$USER'"
+fi
+
+echo ""
+
+# ── Test 13: Text format works with sqlite backend ───────────────────────────
+
+echo "Test 13: Text format output with sqlite backend"
+RESULT=$(run_search --user alex --query "the regulator" --backend sqlite --db "$TEST_DB" --format text 2>&1 || true)
+
+if echo "$RESULT" | grep -q "Access: ceo"; then
+    pass_test "Text format includes 'Access: ceo'"
+else
+    fail_test "Text format should include 'Access: ceo'"
+fi
+
+if echo "$RESULT" | grep -q 'Search: "the regulator"'; then
+    pass_test "Text format includes search query"
+else
+    fail_test "Text format should include search query"
+fi
+
+echo ""
+
+# ── Test 14: FTS5 multi-word query ────────────────────────────────────────────
+
+echo "Test 14: FTS5 multi-word query"
+RESULT=$(run_search --user alex --query "the regulator compliance" --backend sqlite --db "$TEST_DB" --format json 2>&1 || true)
+
+MATCH_COUNT=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['result_count'])" 2>/dev/null || echo "0")
+if [ "$MATCH_COUNT" -gt 0 ] 2>/dev/null; then
+    pass_test "Multi-word query 'the regulator compliance' returned $MATCH_COUNT results"
+else
+    fail_test "Multi-word query should return results"
+fi
+
+echo ""
+
+# ── Test 15: Incremental indexing skips unchanged files ──────────────────────
+
+echo "Test 15: Incremental re-index skips unchanged files"
+OUTPUT=$(run_indexer --db "$TEST_DB" 2>&1 || true)
+
+if echo "$OUTPUT" | grep -q "Skipped.*unchanged"; then
+    pass_test "Incremental index skipped unchanged files"
+else
+    fail_test "Incremental index should report skipped files" "$OUTPUT"
+fi
+
+echo ""
+
+# ── Test 16: Backward compatibility — grep backend works ────────────────────
+
+echo "Test 16: Backward compatibility — grep backend still works"
+RESULT=$(run_search --user alex --query "the regulator" --backend grep --format json 2>&1 || true)
+
+BACKEND=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('backend',''))" 2>/dev/null || echo "")
+if [ "$BACKEND" = "grep" ]; then
+    pass_test "Grep backend returns backend='grep'"
+else
+    fail_test "Grep backend should return backend='grep', got '$BACKEND'"
+fi
+
+MATCH_COUNT=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['result_count'])" 2>/dev/null || echo "0")
+if [ "$MATCH_COUNT" -gt 0 ] 2>/dev/null; then
+    pass_test "Grep backend returned $MATCH_COUNT results"
+else
+    fail_test "Grep backend should return results"
+fi
+
+echo ""
+
+# ── Test 17: Direct SQL scope verification ───────────────────────────────────
+
+echo "Test 17: Direct SQL — no scope leakage possible for leadership query"
+LEAKED_SQL=$(python3 -c "
+import sqlite3
+conn = sqlite3.connect('$TEST_DB')
+# Simulate what the search does for leadership: query with scope filter
+allowed = ('public', 'leadership', 'sam-rivera')
+placeholders = ','.join(['?'] * len(allowed))
+sql = f'''SELECT COUNT(*) FROM documents WHERE user_scope NOT IN ({placeholders})'''
+total_private = conn.execute(sql, allowed).fetchone()[0]
+# There should be private docs in the DB that leadership can't see
+total_all = conn.execute('SELECT COUNT(*) FROM documents').fetchone()[0]
+print(f'{total_private},{total_all}')
+conn.close()
+" 2>/dev/null || echo "0,0")
+
+PRIVATE=$(echo "$LEAKED_SQL" | cut -d',' -f1)
+TOTAL_DOCS=$(echo "$LEAKED_SQL" | cut -d',' -f2)
+if [ "$PRIVATE" -gt 0 ] 2>/dev/null && [ "$TOTAL_DOCS" -gt "$PRIVATE" ] 2>/dev/null; then
+    pass_test "DB has $PRIVATE private docs out of $TOTAL_DOCS total — scope filter would block them"
+else
+    fail_test "Expected some private docs that leadership can't see (private=$PRIVATE, total=$TOTAL_DOCS)"
+fi
+
+echo ""
+
+# ── Test 18: Indexer --stats runs without error ──────────────────────────────
+
+echo "Test 18: Indexer --stats runs without error"
+STATS_OUTPUT=$(run_indexer --stats --db "$TEST_DB" 2>&1 || true)
+
+if echo "$STATS_OUTPUT" | grep -q "Total documents:"; then
+    pass_test "Stats output includes 'Total documents:'"
+else
+    fail_test "Stats should include 'Total documents:'" "$STATS_OUTPUT"
+fi
+
+echo ""
+
+# ── Test 19: Custom --db path works ──────────────────────────────────────────
+
+echo "Test 19: Custom --db path works for search"
+CUSTOM_DB="/tmp/test-rag-custom.db"
+rm -f "$CUSTOM_DB"
+run_indexer --full --db "$CUSTOM_DB" >/dev/null 2>&1 || true
+
+if [ -f "$CUSTOM_DB" ]; then
+    RESULT=$(run_search --user alex --query "test" --backend sqlite --db "$CUSTOM_DB" --format json 2>&1 || true)
+    BACKEND=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('backend',''))" 2>/dev/null || echo "")
+    if [ "$BACKEND" = "sqlite" ]; then
+        pass_test "Custom DB path works for both indexer and search"
+    else
+        fail_test "Custom DB path search should use sqlite backend"
+    fi
+    rm -f "$CUSTOM_DB"
+else
+    fail_test "Custom DB was not created"
+fi
+
+echo ""
+
+# ── Test 20: Empty/unusual query handling ────────────────────────────────────
+
+echo "Test 20: Unusual query handling"
+# Single character query
+RESULT=$(run_search --user alex --query "x" --backend sqlite --db "$TEST_DB" --format json 2>&1 || true)
+ACCESS=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['access_level'])" 2>/dev/null || echo "")
+if [ "$ACCESS" = "ceo" ]; then
+    pass_test "Single-character query doesn't crash, returns valid JSON"
+else
+    fail_test "Single-character query should return valid JSON with access_level"
+fi
+
+echo ""
+
+# ── Cleanup ───────────────────────────────────────────────────────────────────
+
+rm -f "$TEST_DB"
+rm -f /tmp/test-rag-custom.db
+
+# ── Summary ───────────────────────────────────────────────────────────────────
+
+echo "================================================================"
+echo "Results: $PASS passed, $FAIL failed, $TOTAL total"
+echo "================================================================"
+
+if [ "$FAIL" -gt 0 ]; then
+    exit 1
+fi
+
+echo ""
+echo "All tests passed."
+exit 0

package/scripts/test-rag-search.sh

@@ -0,0 +1,251 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# test-rag-search.sh — Quick smoke tests for user-context-search.py (Phase 1 RAG)
+#
+# Tests:
+#   1. CEO (alex) can search and gets broad results
+#   2. Leadership (jordan) gets scoped results (no private CEO data)
+#   3. Unknown user gets minimal access (knowledge/sources only)
+#   4. Slack ID resolution works
+#   5. Email resolution works
+#
+# Usage: ./scripts/test-rag-search.sh
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+SEARCH_SCRIPT="${SCRIPT_DIR}/user-context-search.py"
+PASS=0
+FAIL=0
+TOTAL=0
+
+# ── Helpers ────────────────────────────────────────────────────────────────────
+
+pass_test() {
+    PASS=$((PASS + 1))
+    TOTAL=$((TOTAL + 1))
+    echo "  PASS: $1"
+}
+
+fail_test() {
+    FAIL=$((FAIL + 1))
+    TOTAL=$((TOTAL + 1))
+    echo "  FAIL: $1"
+    if [ -n "${2:-}" ]; then
+        echo "        Detail: $2"
+    fi
+}
+
+run_search() {
+    python3 "$SEARCH_SCRIPT" "$@" 2>/dev/null
+}
+
+# ── Tests ──────────────────────────────────────────────────────────────────────
+
+echo "================================================================"
+echo "RAG Phase 1 — user-context-search.py test suite"
+echo "================================================================"
+echo ""
+
+# --- Test 1: CEO (alex) search ---
+echo "Test 1: CEO search (alex, query='the regulator')"
+RESULT=$(run_search --user alex --query "the regulator" --format json 2>&1 || true)
+
+if echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['access_level']=='ceo'" 2>/dev/null; then
+    pass_test "access_level is 'ceo'"
+else
+    fail_test "access_level should be 'ceo'" "$RESULT"
+fi
+
+if echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['user']=='alex'" 2>/dev/null; then
+    pass_test "user resolved to 'alex'"
+else
+    fail_test "user should resolve to 'alex'"
+fi
+
+MATCH_COUNT=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['result_count'])" 2>/dev/null || echo "0")
+if [ "$MATCH_COUNT" -gt 0 ] 2>/dev/null; then
+    pass_test "CEO search returned $MATCH_COUNT results (>0)"
+else
+    fail_test "CEO search returned 0 results — expected matches for 'the regulator'"
+fi
+
+# Check CEO can search in memory/ and state/ (broad access)
+PATHS_SEARCHED=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(' '.join(d['paths_searched']))" 2>/dev/null || echo "")
+if echo "$PATHS_SEARCHED" | grep -q "memory/"; then
+    pass_test "CEO search includes memory/ path"
+else
+    fail_test "CEO search should include memory/ path"
+fi
+
+if echo "$PATHS_SEARCHED" | grep -q "state/"; then
+    pass_test "CEO search includes state/ path"
+else
+    fail_test "CEO search should include state/ path"
+fi
+
+echo ""
+
+# --- Test 2: Leadership (jordan) scoped search ---
+echo "Test 2: Leadership search (jordan, query='northwind')"
+RESULT=$(run_search --user jordan --query "northwind" --format json 2>&1 || true)
+
+if echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['access_level']=='leadership'" 2>/dev/null; then
+    pass_test "access_level is 'leadership'"
+else
+    fail_test "access_level should be 'leadership'"
+fi
+
+# Leadership should NOT search all of memory/ or state/ or logs/
+if echo "$RESULT" | python3 -c "
+import sys,json
+d=json.load(sys.stdin)
+paths = d['paths_searched']
+# Leadership should not have unrestricted memory/ or state/ or logs/
+bad = [p for p in paths if p in ('memory/', 'state/', 'logs/')]
+assert len(bad) == 0, f'Should not have: {bad}'
+" 2>/dev/null; then
+    pass_test "Leadership search does NOT include unrestricted memory/state/logs"
+else
+    fail_test "Leadership should not have unrestricted memory/state/logs access"
+fi
+
+# Leadership should have knowledge/
+if echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); assert 'knowledge/' in d['paths_searched']" 2>/dev/null; then
+    pass_test "Leadership search includes knowledge/"
+else
+    fail_test "Leadership should include knowledge/"
+fi
+
+echo ""
+
+# --- Test 3: Unknown user (minimal access) ---
+echo "Test 3: Unknown user search (user='nobody', query='northwind')"
+RESULT=$(run_search --user nobody --query "northwind" --format json 2>&1 || true)
+
+if echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['access_level']=='default'" 2>/dev/null; then
+    pass_test "Unknown user gets 'default' access"
+else
+    fail_test "Unknown user should get 'default' access"
+fi
+
+PATHS_SEARCHED=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(' '.join(d['paths_searched']))" 2>/dev/null || echo "")
+# Default should ONLY search knowledge/sources/
+if echo "$PATHS_SEARCHED" | grep -q "knowledge/sources/"; then
+    pass_test "Default access includes knowledge/sources/"
+else
+    fail_test "Default access should include knowledge/sources/"
+fi
+
+# Should NOT have memory/ or outputs/ or docs/
+if echo "$PATHS_SEARCHED" | grep -qv "memory\|outputs\|docs\|state\|logs"; then
+    pass_test "Default access does NOT include private paths"
+else
+    fail_test "Default access should not include memory/outputs/docs/state/logs"
+fi
+
+echo ""
+
+# --- Test 4: Slack ID resolution ---
+echo "Test 4: Slack ID resolution (U099N1JGKRQ -> alex)"
+RESULT=$(run_search --user U099N1JGKRQ --query "test" --format json 2>&1 || true)
+
+if echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['user']=='alex'" 2>/dev/null; then
+    pass_test "Slack ID U099N1JGKRQ resolved to 'alex'"
+else
+    fail_test "Slack ID U099N1JGKRQ should resolve to 'alex'"
+fi
+
+if echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['access_level']=='ceo'" 2>/dev/null; then
+    pass_test "Resolved user has 'ceo' access"
+else
+    fail_test "Resolved user should have 'ceo' access"
+fi
+
+echo ""
+
+# --- Test 5: Email resolution ---
+echo "Test 5: Email resolution (nima@example.com -> nima)"
+RESULT=$(run_search --user "nima@example.com" --query "legal" --format json 2>&1 || true)
+
+if echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['user']=='nima'" 2>/dev/null; then
+    pass_test "Email nima@example.com resolved to 'nima'"
+else
+    fail_test "Email nima@example.com should resolve to 'nima'"
+fi
+
+if echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['access_level']=='leadership'" 2>/dev/null; then
+    pass_test "Resolved user has 'leadership' access"
+else
+    fail_test "Resolved user should have 'leadership' access"
+fi
+
+echo ""
+
+# --- Test 6: Text format output ---
+echo "Test 6: Text format output"
+RESULT=$(run_search --user alex --query "the regulator" --format text 2>&1 || true)
+
+if echo "$RESULT" | grep -q "Access: ceo"; then
+    pass_test "Text format includes access level"
+else
+    fail_test "Text format should include 'Access: ceo'"
+fi
+
+if echo "$RESULT" | grep -q 'Search: "the regulator"'; then
+    pass_test "Text format includes query"
+else
+    fail_test "Text format should include query"
+fi
+
+echo ""
+
+# --- Test 7: Partner access (shayan) ---
+echo "Test 7: Partner access (shayan)"
+RESULT=$(run_search --user shayan --query "northwind" --format json 2>&1 || true)
+
+if echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['access_level']=='partner'" 2>/dev/null; then
+    pass_test "Casey gets 'partner' access"
+else
+    fail_test "Casey should get 'partner' access"
+fi
+
+# Partner should NOT have full knowledge/ or state/
+if echo "$RESULT" | python3 -c "
+import sys,json
+d=json.load(sys.stdin)
+paths = d['paths_searched']
+bad = [p for p in paths if p in ('knowledge/', 'state/', 'memory/', 'logs/')]
+assert len(bad) == 0, f'Should not have: {bad}'
+" 2>/dev/null; then
+    pass_test "Partner does NOT have unrestricted knowledge/state/memory/logs"
+else
+    fail_test "Partner should not have unrestricted access"
+fi
+
+echo ""
+
+# --- Test 8: Phone number resolution ---
+echo "Test 8: Phone number resolution (+971585291799 -> alex)"
+RESULT=$(run_search --user "+971585291799" --query "test" --format json 2>&1 || true)
+
+if echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); assert d['user']=='alex'" 2>/dev/null; then
+    pass_test "Phone +971585291799 resolved to 'alex'"
+else
+    fail_test "Phone +971585291799 should resolve to 'alex'"
+fi
+
+echo ""
+
+# ── Summary ────────────────────────────────────────────────────────────────────
+
+echo "================================================================"
+echo "Results: $PASS passed, $FAIL failed, $TOTAL total"
+echo "================================================================"
+
+if [ "$FAIL" -gt 0 ]; then
+    exit 1
+fi
+
+echo ""
+echo "All tests passed."
+exit 0