@inetafrica/open-claudia 3.4.24 → 3.5.1

package/core/tool-guard.js

@@ -15,12 +15,16 @@
 // it) slips through — accepted as best-effort; the dream's KPI pass reads the
 // guard log to spot chronic bypassing.
 //
-// Fail-open doctrine: any error in the gate itself must NEVER brick the
-// agent's shell — parse failures, fs errors, unknown payloads all allow.
+// Fail direction: on owner and no-context turns any error in the gate itself
+// must NEVER brick the agent's tools — parse failures, fs errors, unknown
+// payloads all allow. On GUARDED (non-owner) turns the same failures deny:
+// a check that could not run must not widen a staff member's reach.
 
 const fs = require("fs");
+const os = require("os");
 const path = require("path");
 const CONFIG_DIR = require("../config-dir");
+const { resolveConfigDir } = require("./config-dir");
 
 const GUARD_LOG = process.env.TOOL_GUARD_LOG || path.join(CONFIG_DIR, "tool-guard.jsonl");
 const SETTINGS_FILE = process.env.DENY_GATE_SETTINGS || path.join(CONFIG_DIR, "deny-gate.settings.json");
@@ -309,34 +313,408 @@ function externalControlPlaneDenial(command) {
   );
 }
 
+// ── guarded-speaker read gate ──────────────────────────────────────────────
+// Claude Code's own file-reading tools never pass through a shell, so on a
+// guarded turn they could open the bot's keyring, every session transcript,
+// or ~/.ssh. On a guarded turn a read whose target resolves inside a
+// protected root is denied, and a search (Grep/Glob/LS) is denied when its
+// root is a protected root, inside one, or ABOVE one — searching $HOME or /
+// walks straight through them. Owner and no-context turns never get here.
+const READ_FILE_TOOLS = new Set(["Read", "NotebookRead"]);
+const READ_SEARCH_TOOLS = new Set(["Grep", "Glob", "LS"]); // LS/NotebookRead: older Claude Code builds
+const READ_TOOLS = new Set([...READ_FILE_TOOLS, ...READ_SEARCH_TOOLS]);
+
+// Credential stores under the user's home. One list feeds both the read gate
+// and the guarded shell check below, so the two cannot drift apart.
+const HOME_SECRET_PATHS = [
+  ".claude",          // Claude Code credentials and every session transcript (the owner's private chats)
+  ".claude.json",     // Claude Code account state and MCP server config (can carry API keys)
+  ".codex",           // Codex auth.json and session rollouts
+  ".ssh",             // SSH private keys
+  ".aws",             // AWS access keys
+  ".kube",            // Kubernetes cluster credentials
+  ".docker",          // container registry auth (config.json)
+  ".config/gcloud",   // Google Cloud credentials
+  ".netrc",           // plaintext host passwords (curl, git, ftp)
+  ".git-credentials", // git credential-store tokens
+  ".npmrc",           // npm registry tokens
+];
+
+function homeDirs() {
+  const out = [];
+  for (const get of [() => os.homedir(), () => os.userInfo().homedir]) {
+    try {
+      const home = get();
+      if (home && !out.includes(path.resolve(home))) out.push(path.resolve(home));
+    } catch (e) { /* no resolvable home */ }
+  }
+  return out;
+}
+
+// Every root a guarded turn may not read. Absolute paths; symlinks are
+// resolved at match time, on both sides.
+function protectedReadRoots() {
+  const roots = [];
+  const add = (value) => {
+    const raw = String(value || "").trim();
+    if (!raw) return;
+    const abs = path.resolve(raw);
+    if (!roots.includes(abs)) roots.push(abs);
+  };
+  // Open Claudia's own state: keyring, vault, approvals, grants, transcripts,
+  // people, identities, audit logs, crons/jobs, tool state — and the packs
+  // (procedure notes), which Phase 1 serves through the bot instead.
+  add(resolveConfigDir());
+  add(CONFIG_DIR);
+  for (const home of homeDirs()) {
+    // The default config dir: another bot on this host, or this bot's state
+    // from before OPEN_CLAUDIA_CONFIG_DIR moved it.
+    add(path.join(home, ".open-claudia"));
+    for (const rel of HOME_SECRET_PATHS) add(path.join(home, rel));
+  }
+  // The same Claude Code / Codex stores when relocated for this process.
+  add(process.env.CLAUDE_CONFIG_DIR);
+  add(process.env.CODEX_HOME);
+  // Linux: /proc/<pid>/environ exposes other processes' environment, which
+  // for the bot process means its channel and provider tokens.
+  add("/proc");
+  // The bot env file named in the system prompt. The rest of the installed
+  // package is public source and stays readable; any other .env file inside
+  // it is matched by name (isPackageEnvFile).
+  add(path.join(PACKAGE_ROOT, ".env"));
+  return roots;
+}
+
+// Inbound chat attachments are saved under the config dir (files/, media/)
+// and every photo/document turn tells the agent to Read them there, so a
+// guarded turn keeps reading single files there exactly as today. Never a
+// search root: a Grep/Glob over these folders would sweep every attachment
+// from every room.
+function attachmentDirs() {
+  const out = [];
+  for (const dir of [resolveConfigDir(), CONFIG_DIR]) {
+    for (const sub of ["files", "media"]) {
+      const p = path.join(path.resolve(dir), sub);
+      if (!out.includes(p)) out.push(p);
+    }
+  }
+  return out;
+}
+
+const CASE_INSENSITIVE_PATHS = process.platform === "darwin" || process.platform === "win32";
+
+function comparablePath(value) {
+  const s = String(value).normalize("NFC");
+  return CASE_INSENSITIVE_PATHS ? s.toLowerCase() : s;
+}
+
+// Prefix match on whole path segments: /a/b contains /a/b/c, not /a/bc.
+function isSameOrInside(child, parent) {
+  const c = comparablePath(child);
+  const p = comparablePath(parent);
+  if (c === p) return true;
+  return c.startsWith(p.endsWith(path.sep) ? p : p + path.sep);
+}
+
+// Where the OS actually lands for an absolute path: symlinks followed and a
+// `..` applied AFTER them, as open(2) does. fs.realpathSync.native, because
+// the JS realpath folds `..` lexically first (so `link/../x` would escape).
+// A path that does not exist yet resolves through its deepest existing
+// ancestor.
+function physicalPath(rawAbs) {
+  const parts = String(rawAbs).split(path.sep);
+  for (let keep = parts.length; keep > 0; keep -= 1) {
+    const head = parts.slice(0, keep).join(path.sep) || path.sep;
+    try {
+      const real = fs.realpathSync.native(head);
+      const rest = parts.slice(keep).filter(Boolean);
+      return rest.length ? path.join(real, ...rest) : real;
+    } catch (e) { /* missing or unreadable — try the parent */ }
+  }
+  return path.resolve(rawAbs);
+}
+
+function expandHome(raw) {
+  const value = String(raw);
+  const home = os.homedir();
+  if (value === "~" || value === "$HOME" || value === "${HOME}") return home;
+  for (const prefix of ["~/", "$HOME/", "${HOME}/"]) {
+    if (value.startsWith(prefix)) return home + path.sep + value.slice(prefix.length);
+  }
+  return value;
+}
+
+// Both views of a tool path: lexical (what a caller that normalises first
+// opens) and physical (what open(2) reaches). A check must pass on both.
+function pathForms(raw, cwd) {
+  const expanded = expandHome(raw);
+  const rawAbs = path.isAbsolute(expanded) ? expanded : cwd + path.sep + expanded;
+  const forms = [path.resolve(cwd, expanded), physicalPath(rawAbs)];
+  return forms.filter((form, index) => forms.indexOf(form) === index);
+}
+
+function protectedRootForms() {
+  const forms = [];
+  for (const root of protectedReadRoots()) {
+    for (const form of [root, physicalPath(root)]) if (!forms.includes(form)) forms.push(form);
+  }
+  return forms;
+}
+
+const PACKAGE_ENV_FILE_RE = /^\.env(?:\..+)?$/i;
+
+function isPackageEnvFile(form) {
+  if (!PACKAGE_ENV_FILE_RE.test(path.basename(form))) return false;
+  return [PACKAGE_ROOT, physicalPath(PACKAGE_ROOT)].some((root) => isSameOrInside(form, root));
+}
+
+// True when reading the file at `raw` (relative to `cwd`) would reach
+// protected state. Attachment folders are exempt unless the path escapes
+// them, or they themselves resolve onto protected state.
+function isProtectedReadPath(raw, cwd = process.cwd()) {
+  const base = path.resolve(String(cwd || process.cwd()));
+  const roots = protectedRootForms();
+  const exempt = attachmentDirs()
+    .flatMap((dir) => [dir, physicalPath(dir)])
+    .filter((dir) => !roots.some((root) => isSameOrInside(root, dir)));
+  return pathForms(raw, base).some((form) => isPackageEnvFile(form)
+    || (roots.some((root) => isSameOrInside(form, root))
+      && !exempt.some((dir) => isSameOrInside(form, dir))));
+}
+
+// True when a search rooted at `raw` would enter protected state: the root is
+// a protected root, inside one, or an ancestor of one.
+function isProtectedSearchRoot(raw, cwd = process.cwd()) {
+  const base = path.resolve(String(cwd || process.cwd()));
+  return searchFormsProtected(pathForms(raw, base));
+}
+
+function searchFormsProtected(forms) {
+  const roots = protectedRootForms();
+  return forms.some((form) => isPackageEnvFile(form)
+    || roots.some((root) => isSameOrInside(form, root) || isSameOrInside(root, form)));
+}
+
+// Glob: where the walk actually starts. The literal (wildcard-free) leading
+// segments of the pattern, taken from the pattern itself when it is absolute
+// (or ~-anchored), else from the search root; every `..` after the first
+// wildcard may climb one level higher, so the base climbs with it.
+const GLOB_MAGIC_RE = /[*?[\]{}()!+@\\]/;
+
+function globSearchBases(pattern, searchRoot) {
+  const expanded = expandHome(pattern);
+  const literal = [];
+  let climb = 0;
+  let wild = false;
+  for (const segment of expanded.split("/")) {
+    if (!wild && !GLOB_MAGIC_RE.test(segment)) { literal.push(segment); continue; }
+    wild = true;
+    if (segment === "..") climb += 1;
+  }
+  const prefix = literal.join("/");
+  const start = path.isAbsolute(expanded)
+    ? (prefix || path.sep)
+    : (prefix ? searchRoot + path.sep + prefix : searchRoot);
+  return pathForms(start, searchRoot).map((form) => {
+    let out = form;
+    for (let i = 0; i < climb; i += 1) out = path.dirname(out);
+    return out;
+  });
+}
+
+function isRegularFile(raw, cwd) {
+  try { return fs.statSync(path.resolve(cwd, expandHome(raw))).isFile(); }
+  catch (e) { return false; }
+}
+
+// Guarded-turn verdict for one read-tool call:
+// { malformed } | { deny, target, search }.
+function evaluateGuardedRead(toolName, input, cwd) {
+  if (!input || typeof input !== "object") return { malformed: true };
+  const base = path.resolve(typeof cwd === "string" && cwd ? cwd : process.cwd());
+  if (READ_FILE_TOOLS.has(toolName)) {
+    const target = toolName === "NotebookRead" ? input.notebook_path : input.file_path;
+    if (typeof target !== "string" || !target) return { malformed: true };
+    return { deny: isProtectedReadPath(target, base), target, search: false };
+  }
+  if (input.path != null && typeof input.path !== "string") return { malformed: true };
+  if (toolName === "LS" && !input.path) return { malformed: true };
+  if (toolName === "Glob" && (typeof input.pattern !== "string" || !input.pattern)) return { malformed: true };
+  const root = input.path || base;
+  // A Grep over one file is a read of that file.
+  if (toolName === "Grep" && isRegularFile(root, base)) {
+    return { deny: isProtectedReadPath(root, base), target: root, search: false };
+  }
+  if (isProtectedSearchRoot(root, base)) return { deny: true, target: root, search: true };
+  if (toolName === "Glob"
+    && searchFormsProtected(globSearchBases(input.pattern, path.resolve(base, expandHome(root))))) {
+    return { deny: true, target: input.pattern, search: true };
+  }
+  return { deny: false, target: root, search: true };
+}
+
+function protectedReadDenial(toolName, verdict, speaker) {
+  const who = speaker && speaker.name ? ` (${speaker.name})` : "";
+  const target = String(verdict.target).slice(0, 200);
+  return verdict.search
+    ? `⛔ External-speaker guard: ${toolName} over ${target} is blocked on this turn — it would reach the bot's private state or credentials, and the speaker${who} is not the owner.\nSearch a narrower folder inside the project instead.`
+    : `⛔ External-speaker guard: ${toolName} of ${target} is blocked on this turn — it is part of the bot's private state or credentials, and the speaker${who} is not the owner.\nAnswer without it.`;
+}
+
+// ── guarded-speaker secret reads from the shell ────────────────────────────
+// A deliberately small list of obvious ways a shell reads another process's
+// environment (the bot's carries its tokens) or a credential store. Their own
+// environment (`env`, `printenv`) is left alone. Phase 2 replaces shell text
+// matching with tool-only staff turns; until then this closes the literal
+// forms of what the read gate above denies to Read/Grep/Glob.
+const KEYCHAIN_RE = /\bsecurity\s+(?:find-generic-password|find-internet-password|dump-keychain|export)\b/;
+const PS_RE = /(?:^|[|;&(`'"\n])\s*(?:sudo\s+)?(?:[^\s|;&()`'"]*\/)?ps(?=\s|$)([^|;&\n)`]*)/g;
+
+// ps prints other processes' environment with BSD `e` (ps eww, ps auxe) or
+// macOS -E. Linux `-e` only selects all processes and stays free.
+function psShowsEnvironment(cmd) {
+  for (const match of cmd.matchAll(PS_RE)) {
+    const args = match[1].split(/\s+/).map((arg) => arg.replace(/^['"]+|['"]+$/g, "")).filter(Boolean);
+    let valueNext = false;
+    for (const arg of args) {
+      if (valueNext) { valueNext = false; continue; }
+      if (/^-[A-Za-z]*E/.test(arg)) return true;
+      if (/^-[A-Za-z]*[oOpUuGgtCq]$/.test(arg)) { valueNext = true; continue; }
+      if (/^[A-Za-z]+$/.test(arg) && arg.includes("e")) return true;
+    }
+  }
+  return false;
+}
+
+function credentialPathAnchors() {
+  const anchors = [];
+  const prefixes = ["~/", "$HOME/", "${HOME}/", ...homeDirs().map((home) => home + path.sep)];
+  for (const prefix of prefixes) for (const rel of HOME_SECRET_PATHS) anchors.push(prefix + rel);
+  for (const moved of [process.env.CLAUDE_CONFIG_DIR, process.env.CODEX_HOME]) {
+    if (moved && String(moved).trim()) anchors.push(path.resolve(String(moved).trim()));
+  }
+  return anchors;
+}
+
+function mentionsCredentialPath(cmd) {
+  return credentialPathAnchors().some((anchor) => {
+    for (let at = cmd.indexOf(anchor); at !== -1; at = cmd.indexOf(anchor, at + 1)) {
+      const next = cmd[at + anchor.length];
+      if (next === undefined || !/[A-Za-z0-9_-]/.test(next)) return true;
+    }
+    return false;
+  });
+}
+
+// Words a guarded turn's command may not contain at all (Phase 0 review,
+// HIGH): the path-anchored rules above only see one spelling of a read, so the
+// names themselves are refused — process environments and argument blocks, the
+// keyring, the bot's own config dir, and the credential stores above as path
+// components — and so is any per-process /proc path, as the read gate already
+// refuses /proc to Read/Grep/Glob. This narrows the shell; it is not a
+// boundary. Phase 2 takes the shell away from staff turns.
+const SECRET_WORD_RE = /\b(?:environ|procargs\d*|keyring)\b/i;
+const PROC_PROCESS_RE = /\/proc\/(?:\d|self\b|thread-self\b|[$*?[{])/;
+const SECRET_COMPONENT_RE = new RegExp(
+  `(?:^|[\\s/'"=:(\`])(?:\\.open|${HOME_SECRET_PATHS.map((rel) => rel.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})(?![A-Za-z0-9_-])`,
+);
+
+// Pure: null, or the id of the secret-read pattern the command matches.
+function secretReadRule(command) {
+  const cmd = String(command || "");
+  if (!cmd.trim() || isAuthorizedChannelCommand(cmd)) return null;
+  if (cmd.includes("/proc/") && cmd.includes("environ")) return "proc-environ";
+  if (psShowsEnvironment(cmd)) return "ps-environment";
+  if (KEYCHAIN_RE.test(cmd)) return "os-keychain";
+  if (mentionsCredentialPath(cmd)) return "credential-store";
+  if (PROC_PROCESS_RE.test(cmd)) return "proc-process";
+  if (SECRET_WORD_RE.test(cmd) || SECRET_COMPONENT_RE.test(cmd)) return "secret-word";
+  return null;
+}
+
+function externalSecretReadDenial(command) {
+  const rule = secretReadRule(command);
+  if (!rule) return null;
+  const speaker = guardedSpeakerFromEnv();
+  if (!speaker) return null;
+  return {
+    rule,
+    message:
+      `⛔ External-speaker guard: this command reads another process's environment or a credential store, and the speaker${speaker.name ? ` (${speaker.name})` : ""} is not the owner.\n` +
+      `Answer without it.`,
+  };
+}
+
+// A hook call that could not be checked. Owner and no-context turns fail
+// OPEN as they always have; a guarded turn fails CLOSED.
+function hookFailure(toolName, reason) {
+  let speaker = null;
+  try { speaker = guardedSpeakerFromEnv(); }
+  catch (e) { speaker = process.env.OC_CHANNEL_ADAPTER && process.env.OC_CHANNEL_ID ? { name: "" } : null; }
+  if (!speaker) return { exit: 0, stderr: "" };
+  logGuardEvent({ kind: "deny", rule: "external-guard-failure", tool: String(toolName || "").slice(0, 60), reason });
+  return {
+    exit: 2,
+    stderr: `⛔ External-speaker guard: this ${toolName || "tool"} call could not be checked, so it is blocked on this turn (the speaker is not the owner).`,
+  };
+}
+
+// Claude sends the shell command as a string; accept an argv array too.
+function shellCommandOf(input) {
+  if (!input || typeof input !== "object") return null;
+  if (typeof input.command === "string") return input.command;
+  if (Array.isArray(input.command) && input.command.every((part) => typeof part === "string")) {
+    return input.command.join(" ");
+  }
+  return null;
+}
+
 // Hook entry, pure enough to test: takes the PreToolUse stdin payload (object
 // or JSON string), returns { exit, stderr }. exit 2 = deny (stderr is fed back
-// to the model); exit 0 = allow. Anything unexpected → allow (fail-open).
+// to the model); exit 0 = allow. Anything unexpected → allow on owner and
+// no-context turns (fail-open), deny on guarded turns (fail-closed).
 function runHook(payload) {
   let data = payload;
   try {
     if (typeof payload === "string") data = JSON.parse(payload);
   } catch (e) {
-    return { exit: 0, stderr: "" };
+    return hookFailure("", "unparseable payload");
   }
+  let toolName = "";
   try {
+    if (!data || typeof data !== "object" || typeof data.tool_name !== "string" || !data.tool_name) {
+      return hookFailure("", "malformed payload");
+    }
+    toolName = data.tool_name;
     // File-mutation tools are gated by SPEAKER, not by command content — and
     // deliberately outside the relaxed tooling-mode bypass below: tooling mode
     // is an owner workflow preference, this is a security control.
-    if (data && FILE_MUTATION_TOOLS.has(data.tool_name)) {
-      const denial = externalFileMutationDenial(data.tool_name);
+    if (FILE_MUTATION_TOOLS.has(toolName)) {
+      const denial = externalFileMutationDenial(toolName);
       if (!denial) return { exit: 0, stderr: "" };
       const input = data.tool_input || {};
       logGuardEvent({
         kind: "deny",
         rule: "external-file-write",
-        tool: data.tool_name,
+        tool: toolName,
         file: String(input.file_path || input.notebook_path || input.command || "").slice(0, 300),
       });
       return { exit: 2, stderr: denial };
     }
-    if (!data || data.tool_name !== "Bash") return { exit: 0, stderr: "" };
-    const command = data.tool_input && data.tool_input.command;
+    // Read tools: speaker first, so owner and no-context turns pass through
+    // untouched (no path work, no log line).
+    if (READ_TOOLS.has(toolName)) {
+      const speaker = guardedSpeakerFromEnv();
+      if (!speaker) return { exit: 0, stderr: "" };
+      const verdict = evaluateGuardedRead(toolName, data.tool_input, data.cwd);
+      if (verdict.malformed) return hookFailure(toolName, "malformed payload");
+      if (!verdict.deny) return { exit: 0, stderr: "" };
+      logGuardEvent({ kind: "deny", rule: "external-protected-read", tool: toolName, target: String(verdict.target).slice(0, 300) });
+      return { exit: 2, stderr: protectedReadDenial(toolName, verdict, speaker) };
+    }
+    if (toolName !== "Bash") return { exit: 0, stderr: "" };
+    const command = shellCommandOf(data.tool_input);
+    if (command === null) return hookFailure(toolName, "malformed payload");
     // Control-plane references are speaker-gated ahead of the tooling-mode
     // switch — a security control, not a workflow preference.
     const cpDenial = externalControlPlaneDenial(command);
@@ -344,6 +722,11 @@ function runHook(payload) {
       logGuardEvent({ kind: "deny", rule: "external-control-plane", command: String(command).slice(0, 300) });
       return { exit: 2, stderr: cpDenial };
     }
+    const secretDenial = externalSecretReadDenial(command);
+    if (secretDenial) {
+      logGuardEvent({ kind: "deny", rule: "external-secret-read", pattern: secretDenial.rule, command: String(command).slice(0, 300) });
+      return { exit: 2, stderr: secretDenial.message };
+    }
     // Relaxed tooling mode: the gate observes but never blocks. The event is
     // still logged (as relaxed-pass, not deny) so the dream KPI can report
     // what WOULD have been denied — visibility survives the mode switch.
@@ -357,7 +740,7 @@ function runHook(payload) {
       ? { exit: 2, stderr: policy.message }
       : { exit: 0, stderr: "" };
   } catch (e) {
-    return { exit: 0, stderr: "" };
+    return hookFailure(toolName, "guard error");
   }
 }
 
@@ -373,8 +756,9 @@ function ensureHookSettings() {
 }
 
 module.exports = {
-  RULES, RAW_OP_PATTERNS, GUARD_LOG, SETTINGS_FILE, FILE_MUTATION_TOOLS,
+  RULES, RAW_OP_PATTERNS, GUARD_LOG, SETTINGS_FILE, FILE_MUTATION_TOOLS, READ_TOOLS, HOME_SECRET_PATHS,
   isAuthorizedChannelCommand, matchRule, denyMessage, evaluateCommandPolicy, logGuardEvent, runHook, hookSettings, ensureHookSettings,
   externalFileMutationDenial, externalControlPlaneDenial, guardedSpeakerFromEnv,
+  protectedReadRoots, isProtectedReadPath, isProtectedSearchRoot, secretReadRule,
   matchRawOp, noteRawOp, readGuardEvents,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.4.24",
+  "version": "3.5.1",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {
@@ -11,7 +11,7 @@
     "setup": "node setup.js",
     "start": "node bot.js",
     "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-turn-observer.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-refusal-recovery.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-credential-capture.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-upgrade-path.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js && node test-kazee-channel-health.js && node test-kazee-media-caption.js && node test-kazee-context-media.js && node test-kazee-typing-join.js && node test-kazee-inbound-dedup.js && node test-typing-phase-push.js && node test-socket-reconnect.js && node test-speech-loopback.js && node test-prompt-budget.js && node test-agency-ledger.js && node test-agency-deliberate.js && node test-guardrail.js && node test-spaces-comment-content.js && node test-boot-health.js && node test-lexical-floor.js && node test-safe-mode.js && node test-logout.js && node test-kazee-call-audio.js && node test-kazee-call-janus.js && node test-kazee-call-webrtc.js && node test-kazee-call-speech.js && node test-kazee-call-manager.js && node test-call-speech.js && node test-kazee-call-session.js",
-    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-usage-accounting.js && node test-codex-rollout.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-query.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-walker-score.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-score-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-cokept-warming.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-search.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-extractive-injection.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-relationship-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-relationship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-enforcer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-mandate-hygiene.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-external-rule-scopes.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-cards.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-identity-prune.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-message-id.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-group-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-group-context.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-people-owner-seed.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-delivery-contract.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-run-lock.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-typing-heartbeat.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-web-sessions.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-poll-recovery.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-409-grace.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-conflict-heal-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-single-instance.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-streaming-split.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-stream-preview-purpose.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-spaces-autoenable.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-say-loopback.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-journal-union.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-subst-score.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-section-budgets.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-dedup-adjudicator.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-prospective.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-regressions.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-cost-report.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-context.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-mining.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-certification.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-apprenticeship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-attest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-verify-contact.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-loopback-owner-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-intro-adoption.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-grants.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-room-provider-settings.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-store-durability.js"
+    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-usage-accounting.js && node test-codex-rollout.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-query.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-walker-score.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-score-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-cokept-warming.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-transcript-room-scope.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-search.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-extractive-injection.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-read-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-relationship-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-relationship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-enforcer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-mandate-hygiene.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-external-rule-scopes.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-cards.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-identity-prune.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-message-id.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-group-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-group-context.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-people-owner-seed.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-delivery-contract.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-run-lock.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-typing-heartbeat.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-web-sessions.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-poll-recovery.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-409-grace.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-conflict-heal-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-single-instance.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-streaming-split.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-stream-preview-purpose.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-spaces-autoenable.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-say-loopback.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-journal-union.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-subst-score.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-section-budgets.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-dedup-adjudicator.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-prospective.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-regressions.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-cost-report.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-context.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-mining.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-certification.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-apprenticeship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-attest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-run-attest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-bot-endpoint.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-cli-owner-gates.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-verify-contact.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-loopback-owner-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-watch-check-env.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-intro-adoption.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-grants.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-room-provider-settings.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-store-durability.js"
   },
   "files": [
     "bot.js",

package/project-transcripts.js

@@ -136,9 +136,34 @@ class ProjectTranscripts {
   }
 }
 
+// Who a transcript file belongs to, for the room-scoping guard in the search
+// CLIs. Every project transcript is keyed by (canonicalUserId, projectPath) and
+// records the owning canonicalUserId in its sidecar `.json` (and on each JSONL
+// entry). Reading it back lets a non-owner CLI confirm a transcript it was
+// pointed at is actually the caller's own — an env-forged OC_TRANSCRIPT_PATH
+// aimed at someone else's file resolves to a different canonicalUserId and is
+// refused. Returns null when ownership cannot be established (fail closed).
+function transcriptOwnerOf(transcriptPath) {
+  const file = String(transcriptPath || "");
+  if (!file) return null;
+  const sidecar = file.endsWith(".jsonl") ? `${file.slice(0, -6)}.json` : `${file}.json`;
+  try {
+    const meta = JSON.parse(fs.readFileSync(sidecar, "utf8"));
+    if (meta && meta.canonicalUserId) return String(meta.canonicalUserId);
+  } catch (e) { /* fall through to the JSONL header */ }
+  try {
+    const raw = fs.readFileSync(file, "utf8");
+    const newline = raw.indexOf("\n");
+    const first = JSON.parse(newline === -1 ? raw : raw.slice(0, newline));
+    if (first && first.canonicalUserId) return String(first.canonicalUserId);
+  } catch (e) { /* unreadable → unknown owner */ }
+  return null;
+}
+
 module.exports = {
   ProjectTranscripts,
   normalizeProjectPath,
   projectHash,
   truthy,
+  transcriptOwnerOf,
 };

package/test-approval-async.js

@@ -124,6 +124,28 @@ const approvals = require("./core/approvals");
     "legacy approvals with an undisplayed suffix require a fresh decision",
   );
 
+  // ── an approval carries EXACTLY the tier on the owner's card ──
+  // A write approval never redeems for a run that now resolves destructive
+  // (and the refusal leaves the token intact); the tier a redemption exports
+  // is the record's own, and a record without one falls back to the run's
+  // tier — never to "destructive" by default.
+  const writeRec = approvals.create({ tool: "fleet", verb: "restart", tier: "write", command: CMD, channelId: "c1", adapter: "tg" });
+  approvals.decide(writeRec.id, "approved", "c1");
+  const stretched = approvals.consume(writeRec.id, CMD, { tier: "destructive" });
+  assert.strictEqual(stretched.ok, false, "a write approval cannot redeem a destructive run");
+  assert.ok(/covers a write run, but this run is destructive/.test(stretched.reason));
+  assert.strictEqual(approvals.read(writeRec.id).consumedAt, undefined, "the tier refusal does not burn the token");
+  const fits = approvals.consume(writeRec.id, CMD, { tier: "write" });
+  assert.strictEqual(fits.ok, true, "the approved tier redeems");
+  assert.strictEqual(approvals.approvedTier(fits.record, "destructive"), "write", "the record's tier is what the run carries");
+  const untiered = approvals.create({ tool: "fleet", command: CMD, channelId: "c1", adapter: "tg" });
+  assert.strictEqual(untiered.tier, "", "no tier given → none recorded (not destructive)");
+  approvals.decide(untiered.id, "approved", "c1");
+  const legacyRun = approvals.consume(untiered.id, CMD, { tier: "destructive" });
+  assert.strictEqual(legacyRun.ok, true, "a tierless record binds nothing extra");
+  assert.strictEqual(approvals.approvedTier(legacyRun.record, "write"), "write", "a tierless record exports the run's own tier");
+  assert.strictEqual(approvals.approvedTier({ tier: "reply" }, "read-only"), "read-only", "non-tool tiers never widen a run");
+
   const quotedCommand = approvals.formatApprovedCommand(["open-claudia", "tool", "run", "fleet", "purge", "node one", "it's-safe"]);
   assert.strictEqual(quotedCommand, "open-claudia tool run fleet purge 'node one' 'it'\"'\"'s-safe'");