@kontourai/flow-agents 3.12.1 → 4.1.0

package/dist/kiro/evals/integration/test_session_resume_roundtrip.sh

@@ -449,6 +449,234 @@ else
   _fail "T2: forged actor text was not collapsed onto the same line as the real actor prefix: $(cat "$TMPDIR_EVAL/hostile-actor.out")"
 fi
 
+# Active canonical Flow state must supersede stale handoff routing and fresh-task kit triggers.
+REPO5="$TMPDIR_EVAL/repo5"
+SLUG5="canonical-guidance-616"
+TASK_DIR5="$REPO5/.kontourai/flow-agents/$SLUG5"
+FLOW_DIR5="$REPO5/.kontourai/flow/runs/$SLUG5"
+mkdir -p "$TASK_DIR5" "$FLOW_DIR5" "$REPO5/kits/builder" "$REPO5/docs"
+printf '# Canonical Guidance Fixture\n' > "$REPO5/AGENTS.md"
+printf '# Context Map\n' > "$REPO5/docs/context-map.md"
+cp "$ROOT/kits/builder/kit.json" "$REPO5/kits/builder/kit.json"
+cat > "$REPO5/kits/catalog.json" <<'JSON'
+{"schema_version":"1.0","kits":[{"id":"builder","name":"Builder Kit","path":"kits/builder","description":"Builder fixture"}]}
+JSON
+cat > "$TASK_DIR5/state.json" <<'JSON'
+{
+  "schema_version": "1.0",
+  "task_slug": "canonical-guidance-616",
+  "status": "in_progress",
+  "phase": "pickup",
+  "next_action": {
+    "status": "continue",
+    "summary": "Complete design-probe with pickup-probe evidence.",
+    "skills": ["pickup-probe"]
+  },
+  "flow_run": {
+    "run_id": "canonical-guidance-616",
+    "definition_id": "builder.build",
+    "definition_version": "1.0",
+    "status": "active",
+    "current_step": "design-probe"
+  },
+  "artifact_paths": []
+}
+JSON
+cat > "$FLOW_DIR5/state.json" <<'JSON'
+{
+  "run_id": "canonical-guidance-616",
+  "definition_id": "builder.build",
+  "definition_version": "1.0",
+  "status": "active",
+  "current_step": "design-probe"
+}
+JSON
+cat > "$FLOW_DIR5/definition.json" <<'JSON'
+{
+  "id": "builder.build",
+  "version": "1.0",
+  "steps": [
+    {"id":"pull-work"},
+    {"id":"design-probe"},
+    {"id":"plan"},
+    {"id":"execute"},
+    {"id":"verify"},
+    {"id":"merge-ready"},
+    {"id":"pr-open"},
+    {"id":"merge-ready-ci"},
+    {"id":"learn"},
+    {"id":"done"}
+  ]
+}
+JSON
+cat > "$TASK_DIR5/handoff.json" <<'JSON'
+{
+  "schema_version": "1.0",
+  "next_steps": ["Start the canonical Flow run; activate pull-work."],
+  "blockers": []
+}
+JSON
+seed_current_pointer "$REPO5/.kontourai/flow-agents" "$SLUG5" "canonical-actor"
+
+echo "{\"hook_event_name\":\"SessionStart\",\"cwd\":\"$REPO5\"}" | \
+  FLOW_AGENTS_ACTOR="canonical-actor" node "$ROOT/scripts/hooks/workflow-steering.js" > "$TMPDIR_EVAL/canonical-start.out" 2>&1
+
+if grep -qF 'Canonical Flow: builder.build@1.0/canonical-guidance-616 status:active current_step:design-probe.' "$TMPDIR_EVAL/canonical-start.out" \
+  && grep -qF 'Gate skills: pickup-probe.' "$TMPDIR_EVAL/canonical-start.out" \
+  && grep -qF 'Implementation allowed: no.' "$TMPDIR_EVAL/canonical-start.out" \
+  && [[ "$(grep -c 'Canonical guidance identity: sha256:' "$TMPDIR_EVAL/canonical-start.out" || true)" -eq 1 ]]; then
+  _pass "active Flow SessionStart guidance binds canonical state to installed gate action"
+else
+  _fail "active Flow SessionStart guidance missed canonical state/action identity: $(cat "$TMPDIR_EVAL/canonical-start.out")"
+fi
+
+if ! grep -qF 'Start the canonical Flow run' "$TMPDIR_EVAL/canonical-start.out" \
+  && ! grep -qF 'run pull-work' "$TMPDIR_EVAL/canonical-start.out" \
+  && ! grep -qF 'activate `deliver`' "$TMPDIR_EVAL/canonical-start.out"; then
+  _pass "active Flow SessionStart guidance suppresses stale handoff and generic route hints"
+else
+  _fail "active Flow SessionStart guidance leaked contradictory routing: $(cat "$TMPDIR_EVAL/canonical-start.out")"
+fi
+
+echo "{\"hook_event_name\":\"UserPromptSubmit\",\"cwd\":\"$REPO5\",\"prompt\":\"Please implement the settings API.\"}" | \
+  FLOW_AGENTS_ACTOR="canonical-actor" node "$ROOT/scripts/hooks/workflow-steering.js" > "$TMPDIR_EVAL/canonical-prompt.out" 2>&1
+
+if grep -qF 'Canonical Flow: builder.build@1.0/canonical-guidance-616 status:active current_step:design-probe.' "$TMPDIR_EVAL/canonical-prompt.out" \
+  && grep -qF 'Gate skills: pickup-probe.' "$TMPDIR_EVAL/canonical-prompt.out" \
+  && ! grep -qF 'KIT WORKFLOW ROUTE' "$TMPDIR_EVAL/canonical-prompt.out" \
+  && ! grep -qF 'activate `deliver`' "$TMPDIR_EVAL/canonical-prompt.out"; then
+  _pass "active Flow prompt guidance suppresses fresh-task kit routing"
+else
+  _fail "active Flow prompt guidance competed with generic kit routing: $(cat "$TMPDIR_EVAL/canonical-prompt.out")"
+fi
+
+echo "{\"hook_event_name\":\"PostToolUse\",\"cwd\":\"$REPO5\",\"tool_input\":{\"command\":\"InvokeSubagents\",\"content\":{\"subagents\":[{\"agent_name\":\"tool-planner\"}]}}}" | \
+  FLOW_AGENTS_ACTOR="canonical-actor" node "$ROOT/scripts/hooks/workflow-steering.js" > "$TMPDIR_EVAL/canonical-subagent.out" 2>&1
+if grep -qF 'current_step:design-probe.' "$TMPDIR_EVAL/canonical-subagent.out" \
+  && grep -qF 'Gate skills: pickup-probe.' "$TMPDIR_EVAL/canonical-subagent.out" \
+  && ! grep -qF 'PLAN COMPLETE' "$TMPDIR_EVAL/canonical-subagent.out" \
+  && ! grep -qF 'Next: execute-plan' "$TMPDIR_EVAL/canonical-subagent.out"; then
+  _pass "active Flow subagent completion re-grounds to the canonical gate"
+else
+  _fail "subagent completion competed with canonical gate guidance: $(cat "$TMPDIR_EVAL/canonical-subagent.out")"
+fi
+
+# A stale Flow Agents projection must fail closed instead of falling back to either handoff
+# advice or fresh-task kit routing.
+node - "$TASK_DIR5/state.json" <<'NODE'
+const fs = require('fs');
+const file = process.argv[2];
+const state = JSON.parse(fs.readFileSync(file, 'utf8'));
+state.flow_run.current_step = 'plan';
+fs.writeFileSync(file, `${JSON.stringify(state, null, 2)}\n`);
+NODE
+echo "{\"hook_event_name\":\"UserPromptSubmit\",\"cwd\":\"$REPO5\",\"prompt\":\"Please implement the settings API.\"}" | \
+  FLOW_AGENTS_ACTOR="canonical-actor" node "$ROOT/scripts/hooks/workflow-steering.js" > "$TMPDIR_EVAL/canonical-conflict.out" 2>&1
+if grep -qF 'GUIDANCE_CONFLICT:' "$TMPDIR_EVAL/canonical-conflict.out" \
+  && grep -qF 'No executable workflow recommendation is available' "$TMPDIR_EVAL/canonical-conflict.out" \
+  && ! grep -qF 'KIT WORKFLOW ROUTE' "$TMPDIR_EVAL/canonical-conflict.out" \
+  && ! grep -qF 'resume the next step' "$TMPDIR_EVAL/canonical-conflict.out" \
+  && ! grep -qF 'Start the canonical Flow run' "$TMPDIR_EVAL/canonical-conflict.out"; then
+  _pass "canonical disagreement emits a typed conflict and no executable fallback"
+else
+  _fail "canonical disagreement did not fail closed: $(cat "$TMPDIR_EVAL/canonical-conflict.out")"
+fi
+
+# Every nonterminal canonical status remains canonical and never degrades to legacy routing.
+for status in blocked needs_decision paused; do
+  node - "$TASK_DIR5/state.json" "$FLOW_DIR5/state.json" "$status" <<'NODE'
+const fs = require('fs');
+const [sidecarFile, flowFile, status] = process.argv.slice(2);
+const sidecar = JSON.parse(fs.readFileSync(sidecarFile, 'utf8'));
+const flow = JSON.parse(fs.readFileSync(flowFile, 'utf8'));
+sidecar.flow_run.current_step = 'design-probe';
+sidecar.flow_run.status = status;
+flow.status = status;
+fs.writeFileSync(sidecarFile, `${JSON.stringify(sidecar, null, 2)}\n`);
+fs.writeFileSync(flowFile, `${JSON.stringify(flow, null, 2)}\n`);
+NODE
+  echo "{\"hook_event_name\":\"UserPromptSubmit\",\"cwd\":\"$REPO5\",\"prompt\":\"Please implement the settings API.\"}" | \
+    FLOW_AGENTS_ACTOR="canonical-actor" node "$ROOT/scripts/hooks/workflow-steering.js" > "$TMPDIR_EVAL/canonical-$status.out" 2>&1
+  if grep -qF "status:$status" "$TMPDIR_EVAL/canonical-$status.out" \
+    && ! grep -qF 'NON-CANONICAL FALLBACK' "$TMPDIR_EVAL/canonical-$status.out" \
+    && ! grep -qF 'KIT WORKFLOW ROUTE' "$TMPDIR_EVAL/canonical-$status.out"; then
+    _pass "$status Flow state remains under canonical guidance"
+  else
+    _fail "$status Flow state degraded to noncanonical guidance: $(cat "$TMPDIR_EVAL/canonical-$status.out")"
+  fi
+done
+
+if ROOT_FOR_NODE="$ROOT" node <<'NODE'
+const { flowStepAction } = require(`${process.env.ROOT_FOR_NODE}/scripts/hooks/workflow-steering.js`);
+const expected = {
+  'pull-work': ['pull-work', false],
+  'design-probe': ['pickup-probe', false],
+  plan: ['plan-work', false],
+  execute: ['execute-plan', true],
+  verify: ['review-work,verify-work', false],
+  'merge-ready': ['evidence-gate', false],
+  'pr-open': ['publish-change', false],
+  'merge-ready-ci': ['release-readiness', false],
+  learn: ['learning-review', false],
+  done: ['', false],
+};
+for (const [step, [names, implementationAllowed]] of Object.entries(expected)) {
+  const result = flowStepAction('builder.build', step);
+  if (result.error || !result.action) process.exit(1);
+  const actualNames = [...result.action.skills, ...result.action.operations].join(',');
+  if (actualNames !== names || result.action.implementation_allowed !== implementationAllowed) process.exit(2);
+}
+NODE
+then
+  _pass "installed Builder action projection covers every build gate and permission"
+else
+  _fail "installed Builder action projection is incomplete or inaccurate"
+fi
+
+# A production-shaped canceled projection remains canonical and cannot expose its parked step action.
+node - "$TASK_DIR5/state.json" "$FLOW_DIR5/state.json" <<'NODE'
+const fs = require('fs');
+for (const file of process.argv.slice(2)) {
+  const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+  if (value.flow_run) {
+    value.status = 'canceled';
+    value.flow_run.status = 'canceled';
+    value.flow_run.current_step = 'execute';
+    value.next_action = {status: 'done', summary: 'Legacy projection says done.'};
+  }
+  else {
+    value.status = 'canceled';
+    value.current_step = 'execute';
+  }
+  fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+NODE
+echo "{\"hook_event_name\":\"SessionStart\",\"cwd\":\"$REPO5\"}" | \
+  FLOW_AGENTS_ACTOR="canonical-actor" node "$ROOT/scripts/hooks/workflow-steering.js" > "$TMPDIR_EVAL/canonical-terminal.out" 2>&1
+if grep -qF 'status:canceled' "$TMPDIR_EVAL/canonical-terminal.out" \
+  && grep -qF 'no gate action or implementation is authorized' "$TMPDIR_EVAL/canonical-terminal.out" \
+  && ! grep -qF 'Gate skills:' "$TMPDIR_EVAL/canonical-terminal.out" \
+  && ! grep -qF 'Gate operations:' "$TMPDIR_EVAL/canonical-terminal.out" \
+  && ! grep -qF 'Implementation allowed:' "$TMPDIR_EVAL/canonical-terminal.out" \
+  && ! grep -qF 'KIT WORKFLOW ROUTE' "$TMPDIR_EVAL/canonical-terminal.out"; then
+  _pass "canceled Flow SessionStart suppresses parked gate actions and legacy done routing"
+else
+  _fail "canceled Flow SessionStart was dropped or exposed executable guidance: $(cat "$TMPDIR_EVAL/canonical-terminal.out")"
+fi
+
+# A projected run with missing canonical artifacts is a conflict, never a legacy session.
+rm "$FLOW_DIR5/state.json"
+echo "{\"hook_event_name\":\"SessionStart\",\"cwd\":\"$REPO5\"}" | \
+  FLOW_AGENTS_ACTOR="canonical-actor" node "$ROOT/scripts/hooks/workflow-steering.js" > "$TMPDIR_EVAL/canonical-missing.out" 2>&1
+if grep -qF 'GUIDANCE_CONFLICT:' "$TMPDIR_EVAL/canonical-missing.out" \
+  && ! grep -qF 'NON-CANONICAL FALLBACK' "$TMPDIR_EVAL/canonical-missing.out" \
+  && ! grep -qF 'RESUME:' "$TMPDIR_EVAL/canonical-missing.out" \
+  && ! grep -qF 'KIT WORKFLOW ROUTE' "$TMPDIR_EVAL/canonical-missing.out"; then
+  _pass "missing canonical artifacts fail closed without legacy routing"
+else
+  _fail "missing canonical artifacts degraded to fallback guidance: $(cat "$TMPDIR_EVAL/canonical-missing.out")"
+fi
+
 
 # ─── Summary ──────────────────────────────────────────────────────────────────
 if [[ "$errors" -eq 0 ]]; then

package/dist/kiro/evals/integration/test_telemetry_action_class.sh

@@ -0,0 +1,265 @@
+#!/usr/bin/env bash
+# test_telemetry_action_class.sh — normalized action-class ontology enrichment
+# (kontourai/flow-agents#582, final child of #568)
+#
+# Proves every tool event carries a normalized cross-runtime activity class
+# .tool.action ∈ {edit, search, test, git, build, web, read}, mapped from each
+# runtime's native tool vocabulary (Claude Code / Codex / Kiro), and present
+# ONLY when classifiable — ABSENT (never a fabricated class) otherwise.
+#
+# Highest-value teeth:
+#   - classification correctness + no-guess: every mapped tool -> its exact
+#     class; every unmapped/ambiguous tool -> NO .tool.action.
+#   - test-vs-build disambiguation table (npm test->test, npm run build->build,
+#     bare npm->none).
+#   - verb false-positives: gitfoo / /path/git-helper / echo git / X=1 make
+#     do not misclassify (whole leading-token match, env-prefix stripped).
+#   - cross-runtime: Claude (Edit/Grep/...) AND Codex (apply_patch/fs_read/shell)
+#     both classify.
+#   - privacy: the raw command string is NOT added by this change (only the enum).
+#   - presence honesty: unclassifiable -> no .tool.action key.
+#
+# Uses the same TELEMETRY_DIR resolution + FLOW_AGENTS_TELEMETRY_FOREGROUND
+# convention as test_telemetry_delegation.sh so assertions never race a
+# backgrounded subshell.
+set -uo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+if [[ -d "$ROOT_DIR/context/scripts/telemetry" ]]; then
+  TELEMETRY_DIR="$ROOT_DIR/context/scripts/telemetry"
+else
+  TELEMETRY_DIR="__KIRO_PACKAGE_ROOT__/context/scripts/telemetry"
+fi
+TELEMETRY_SH="${TELEMETRY_DIR}/telemetry.sh"
+
+TMPDIR_EVAL=$(mktemp -d /tmp/eval-telemetry-action-class.XXXXXX)
+TMPLOG="${TMPDIR_EVAL}/test-output.jsonl"
+
+pass=0; fail=0
+_pass() { echo "  ✓ $1"; pass=$((pass + 1)); }
+_fail() { echo "  ✗ $1"; fail=$((fail + 1)); }
+
+echo "=== Telemetry Action-Class Ontology (#582: .tool.action) ==="
+echo ""
+
+if [[ ! -f "$TELEMETRY_SH" ]]; then
+  _fail "telemetry.sh not found at $TELEMETRY_SH"
+  rm -rf "$TMPDIR_EVAL"; exit 1
+fi
+
+# Run one hook event against telemetry.sh (foreground) and echo the LAST
+# full-channel log line (the primary tool event).
+_run_tool_event() {
+  local hook_type="$1" input="$2"; shift 2
+  local extra_env=("$@")
+  local common_env=(
+    HOME="${TMPDIR_EVAL}/home"
+    TELEMETRY_ENABLED=true
+    TELEMETRY_CHANNELS=full
+    TELEMETRY_CHANNEL_FULL_LOG_FILE="$TMPLOG"
+    FLOW_AGENTS_TELEMETRY_FOREGROUND=true
+    TELEMETRY_CONFIG_FILE="$TMPDIR_EVAL/telemetry.conf"
+    TELEMETRY_DATA_DIR="$TMPDIR_EVAL"
+    TELEMETRY_SESSION_DIR="$TMPDIR_EVAL/sessions"
+    TELEMETRY_USAGE_TRACKING=true
+  )
+  mkdir -p "${TMPDIR_EVAL}/home" "${TMPDIR_EVAL}/sessions"
+
+  local before_lines
+  touch "$TMPLOG"
+  before_lines=$(wc -l < "$TMPLOG" | tr -d ' ')
+
+  echo "$input" | env "${common_env[@]}" ${extra_env[@]+"${extra_env[@]}"} bash "$TELEMETRY_SH" "$hook_type" dev 2>/dev/null
+
+  tail -n +"$((before_lines + 1))" "$TMPLOG" 2>/dev/null | tail -1
+}
+
+# Assert a Bash-family command classifies to $want (or none when $want empty).
+_assert_bash() {
+  local runtime="$1" tool="$2" cmd="$3" want="$4" label="$5"
+  local inv out got
+  inv=$(jq -nc --arg t "$tool" --arg c "$cmd" '{session_id:"ac",hook_event_name:"PreToolUse",tool_name:$t,tool_input:{command:$c}}')
+  out=$(FLOW_AGENTS_TELEMETRY_RUNTIME="$runtime" _run_tool_event "preToolUse" "$inv" FLOW_AGENTS_TELEMETRY_RUNTIME="$runtime")
+  if [[ -z "$want" ]]; then
+    got=$(echo "$out" | jq -r 'if (.tool | has("action")) then .tool.action else "ABSENT" end')
+    [[ "$got" == "ABSENT" ]] && _pass "$label -> no .tool.action (honest absence)" || _fail "$label expected NO action, got '$got'"
+  else
+    got=$(echo "$out" | jq -r '.tool.action // "ABSENT"')
+    [[ "$got" == "$want" ]] && _pass "$label -> action=='$want'" || _fail "$label expected '$want', got '$got'"
+  fi
+}
+
+# Assert a non-shell tool (input irrelevant) classifies to $want (or none).
+_assert_tool() {
+  local tool="$1" want="$2" input="$3" label="$4"
+  local inv out got
+  inv=$(jq -nc --arg t "$tool" --argjson ti "$input" '{session_id:"ac",hook_event_name:"PreToolUse",tool_name:$t,tool_input:$ti}')
+  out=$(_run_tool_event "preToolUse" "$inv")
+  if [[ -z "$want" ]]; then
+    got=$(echo "$out" | jq -r 'if (.tool | has("action")) then .tool.action else "ABSENT" end')
+    [[ "$got" == "ABSENT" ]] && _pass "$label -> no .tool.action (honest absence)" || _fail "$label expected NO action, got '$got'"
+  else
+    got=$(echo "$out" | jq -r '.tool.action // "ABSENT"')
+    [[ "$got" == "$want" ]] && _pass "$label -> action=='$want'" || _fail "$label expected '$want', got '$got'"
+  fi
+}
+
+# --- (a) Claude Code vocabulary: one representative per class -----------------
+echo "--- (a) Claude Code tool vocabulary -> each class ---"
+_assert_tool "Edit"     "edit"   '{"file_path":"a.ts"}'         "Edit"
+_assert_tool "Write"    "edit"   '{"file_path":"a.ts"}'         "Write"
+_assert_tool "MultiEdit" "edit"  '{"file_path":"a.ts"}'         "MultiEdit"
+_assert_tool "Grep"     "search" '{"pattern":"foo"}'            "Grep"
+_assert_tool "Glob"     "search" '{"pattern":"**/*.ts"}'        "Glob"
+_assert_tool "Read"     "read"   '{"file_path":"a.ts"}'         "Read"
+_assert_tool "WebFetch" "web"    '{"url":"https://x"}'          "WebFetch"
+_assert_tool "WebSearch" "web"   '{"query":"x"}'                "WebSearch"
+
+# --- (b) Bash verb sub-classification ----------------------------------------
+echo ""
+echo "--- (b) Bash verb sub-classification (leading token) ---"
+_assert_bash "claude-code" "Bash" "git status"        "git"   "git status"
+_assert_bash "claude-code" "Bash" "git commit -m x"   "git"   "git commit"
+_assert_bash "claude-code" "Bash" "npm test"          "test"  "npm test"
+_assert_bash "claude-code" "Bash" "pytest -q"         "test"  "pytest -q"
+_assert_bash "claude-code" "Bash" "jest"              "test"  "jest"
+_assert_bash "claude-code" "Bash" "go test ./..."     "test"  "go test"
+_assert_bash "claude-code" "Bash" "cargo test"        "test"  "cargo test"
+_assert_bash "claude-code" "Bash" "make test"         "test"  "make test"
+_assert_bash "claude-code" "Bash" "npm run test:unit" "test"  "npm run test:unit"
+_assert_bash "claude-code" "Bash" "npm run build"     "build" "npm run build"
+_assert_bash "claude-code" "Bash" "npm run build:prod" "build" "npm run build:prod"
+_assert_bash "claude-code" "Bash" "make"              "build" "make (bare)"
+_assert_bash "claude-code" "Bash" "make build"        "build" "make build"
+_assert_bash "claude-code" "Bash" "tsc -p ."          "build" "tsc"
+_assert_bash "claude-code" "Bash" "go build ./..."    "build" "go build"
+_assert_bash "claude-code" "Bash" "vite build"        "build" "vite build"
+
+# --- (c) test-vs-build disambiguation table (the HIGHEST-value teeth) --------
+echo ""
+echo "--- (c) test-vs-build disambiguation (npm test|npm run build|bare npm) ---"
+_assert_bash "claude-code" "Bash" "npm test"       "test"  "npm test"
+_assert_bash "claude-code" "Bash" "npm run build"  "build" "npm run build"
+_assert_bash "claude-code" "Bash" "npm"            ""      "bare npm (unknown intent)"
+_assert_bash "claude-code" "Bash" "npm run lint"   ""      "npm run lint (unknown script)"
+_assert_bash "claude-code" "Bash" "pnpm test"      "test"  "pnpm test"
+_assert_bash "claude-code" "Bash" "yarn run build" "build" "yarn run build"
+# word-boundary script-name matching (review fix #2): a script name that merely
+# STARTS WITH "test"/"build" as a substring must NOT match -- only test/build
+# as a whole segment (optionally followed by :, _, - ) should.
+_assert_bash "claude-code" "Bash" "npm run testimonials"       ""      "npm run testimonials (substring, NOT test)"
+_assert_bash "claude-code" "Bash" "npm run buildpacks-verify"  ""      "npm run buildpacks-verify (substring, NOT build)"
+_assert_bash "claude-code" "Bash" "npm run test:unit"          "test"  "npm run test:unit (word-boundary test)"
+_assert_bash "claude-code" "Bash" "npm run build:prod"         "build" "npm run build:prod (word-boundary build)"
+# make (review fix #1): only bare `make` or an explicit test/build target
+# classify; any OTHER explicit target is an honest no-guess absence.
+_assert_bash "claude-code" "Bash" "make"           "build" "make (bare, no target -> conventional default build)"
+_assert_bash "claude-code" "Bash" "make test"      "test"  "make test"
+_assert_bash "claude-code" "Bash" "make build"     "build" "make build"
+_assert_bash "claude-code" "Bash" "make deploy"    ""      "make deploy (explicit non-test/build target -> NO action, no guess)"
+_assert_bash "claude-code" "Bash" "make clean"     ""      "make clean (explicit non-test/build target -> NO action, no guess)"
+_assert_bash "claude-code" "Bash" "make lint"      ""      "make lint (explicit non-test/build target -> NO action, no guess)"
+_assert_bash "claude-code" "Bash" "make install"   ""      "make install (explicit non-test/build target -> NO action, no guess)"
+
+# --- (d) cross-runtime: Codex native vocabulary ------------------------------
+echo ""
+echo "--- (d) cross-runtime: Codex vocabulary (apply_patch/fs_read/shell) ---"
+_assert_tool "apply_patch" "edit" '{"patch":"..."}'  "Codex apply_patch"
+_assert_tool "fs_read"     "read" '{"path":"a.ts"}'  "Codex fs_read"
+_assert_bash "codex" "shell"        "git diff"       "git" "Codex shell 'git diff'"
+_assert_bash "codex" "execute_bash" "npm test"       "test" "Codex execute_bash 'npm test'"
+
+# --- (e) NEGATIVES: unclassifiable -> honest absence -------------------------
+echo ""
+echo "--- (e) negatives: unclassifiable shells + delegation tools -> NO action ---"
+_assert_bash "claude-code" "Bash" "ls -la"    "" "ls -la"
+_assert_bash "claude-code" "Bash" "cat foo"   "" "cat foo"
+_assert_bash "claude-code" "Bash" "echo hi"   "" "echo hi"
+_assert_bash "claude-code" "Bash" "npm"       "" "bare npm"
+_assert_tool "Task"        "" '{"subagent_type":"code-reviewer"}' "Task delegation"
+_assert_tool "use_subagent" "" '{"agent_name":"planner"}'         "use_subagent delegation"
+_assert_tool "spawn_agent"  "" '{"agent_type":"worker"}'          "spawn_agent delegation"
+_assert_tool "SomeUnknownTool" "" '{"x":1}'                       "unknown tool"
+
+# --- (f) verb FALSE-POSITIVE guard -------------------------------------------
+echo ""
+echo "--- (f) verb false-positive guard (whole-token match, env-prefix strip) ---"
+_assert_bash "claude-code" "Bash" "gitfoo status"        "" "gitfoo status (substring, not git)"
+_assert_bash "claude-code" "Bash" "/usr/bin/git-helper x" "" "/usr/bin/git-helper (path, not git)"
+_assert_bash "claude-code" "Bash" "echo git"            "" "echo git (git is an arg, not the verb)"
+_assert_bash "claude-code" "Bash" "makefoo"             "" "makefoo (substring, not make)"
+# env-prefix stripped: X=1 make -> the leading real token is make -> build.
+_assert_bash "claude-code" "Bash" "X=1 make"            "build" "X=1 make (env-prefix stripped -> make -> build)"
+# bash -lc wrapper peeled: the inner leading token classifies.
+_assert_bash "claude-code" "Bash" "bash -lc 'git status'" "git" "bash -lc 'git status' (wrapper peeled)"
+
+# --- (g) all three event branches carry .tool.action -------------------------
+echo ""
+echo "--- (g) .tool.action stamped on invoke / permission_request / result ---"
+inv_g=$(jq -nc '{session_id:"ac-g",hook_event_name:"PreToolUse",tool_name:"Edit",tool_input:{file_path:"a.ts"}}')
+out_g=$(_run_tool_event "preToolUse" "$inv_g")
+[[ "$(echo "$out_g" | jq -r '.event_type')" == "tool.invoke" && "$(echo "$out_g" | jq -r '.tool.action')" == "edit" ]] \
+  && _pass "tool.invoke carries .tool.action==edit" || _fail "invoke branch missing action ($(echo "$out_g" | jq -c '.tool'))"
+perm_g=$(jq -nc '{session_id:"ac-g2",hook_event_name:"PermissionRequest",tool_name:"Bash",tool_input:{command:"git status",description:"run git"}}')
+out_g2=$(_run_tool_event "permissionRequest" "$perm_g")
+[[ "$(echo "$out_g2" | jq -r '.event_type')" == "tool.permission_request" && "$(echo "$out_g2" | jq -r '.tool.action')" == "git" ]] \
+  && _pass "tool.permission_request carries .tool.action==git" || _fail "permission_request branch missing action ($(echo "$out_g2" | jq -c '.tool'))"
+res_g=$(jq -nc '{session_id:"ac-g3",hook_event_name:"PostToolUse",tool_name:"Bash",tool_input:{command:"npm run build"},tool_response:{output:"ok"}}')
+out_g3=$(_run_tool_event "postToolUse" "$res_g")
+[[ "$(echo "$out_g3" | jq -r '.event_type')" == "tool.result" && "$(echo "$out_g3" | jq -r '.tool.action')" == "build" ]] \
+  && _pass "tool.result carries .tool.action==build" || _fail "result branch missing action ($(echo "$out_g3" | jq -c '.tool'))"
+
+# --- (h) PRESENCE HONESTY: unclassifiable never emits the key (all 3 branches) --
+echo ""
+echo "--- (h) presence honesty: unclassifiable -> .tool has NO action key ---"
+inv_h=$(jq -nc '{session_id:"ac-h",hook_event_name:"PreToolUse",tool_name:"Bash",tool_input:{command:"ls -la"}}')
+out_h=$(_run_tool_event "preToolUse" "$inv_h")
+has_h=$(echo "$out_h" | jq -r '.tool | has("action")')
+[[ "$has_h" == "false" ]] && _pass "preToolUse: 'ls -la' -> .tool has no 'action' key (not action:null, not action:\"\")" || _fail "unclassifiable produced an action key ($(echo "$out_h" | jq -c '.tool'))"
+# The rest of the tool object is still intact when action is absent.
+[[ "$(echo "$out_h" | jq -r '.tool.name')" == "Bash" ]] && _pass "tool.name still present when action absent" || _fail "tool object degraded when action absent"
+# Same negative for the postToolUse/result branch (shares the same stamping jq).
+res_h=$(jq -nc '{session_id:"ac-h2",hook_event_name:"PostToolUse",tool_name:"Bash",tool_input:{command:"ls -la"},tool_response:{output:"ok"}}')
+out_h2=$(_run_tool_event "postToolUse" "$res_h")
+has_h2=$(echo "$out_h2" | jq -r '.tool | has("action")')
+[[ "$has_h2" == "false" ]] && _pass "postToolUse/result: 'ls -la' -> .tool has no 'action' key" || _fail "result branch produced an action key for unclassifiable ($(echo "$out_h2" | jq -c '.tool'))"
+[[ "$(echo "$out_h2" | jq -r '.event_type')" == "tool.result" ]] && _pass "result branch event_type is tool.result" || _fail "unexpected event_type ($(echo "$out_h2" | jq -r '.event_type'))"
+# Same negative for the permissionRequest branch (shares the same stamping jq).
+perm_h=$(jq -nc '{session_id:"ac-h3",hook_event_name:"PermissionRequest",tool_name:"Bash",tool_input:{command:"ls -la",description:"list files"}}')
+out_h3=$(_run_tool_event "permissionRequest" "$perm_h")
+has_h3=$(echo "$out_h3" | jq -r '.tool | has("action")')
+[[ "$has_h3" == "false" ]] && _pass "permissionRequest: 'ls -la' -> .tool has no 'action' key" || _fail "permission_request branch produced an action key for unclassifiable ($(echo "$out_h3" | jq -c '.tool'))"
+[[ "$(echo "$out_h3" | jq -r '.event_type')" == "tool.permission_request" ]] && _pass "permission_request branch event_type is tool.permission_request" || _fail "unexpected event_type ($(echo "$out_h3" | jq -r '.event_type'))"
+
+# --- (i) no-block: malformed/absent tool_input still emits cleanly -----------
+echo ""
+echo "--- (i) no-block: absent/malformed tool_input emits the event, no action ---"
+inv_i=$(jq -nc '{session_id:"ac-i",hook_event_name:"PreToolUse",tool_name:"Bash"}')
+out_i=$(_run_tool_event "preToolUse" "$inv_i")
+[[ "$(echo "$out_i" | jq -r '.event_type // empty')" == "tool.invoke" ]] && _pass "absent tool_input still emits tool.invoke (never blackholed)" || _fail "event dropped on absent tool_input"
+[[ "$(echo "$out_i" | jq -r '.tool | has("action")')" == "false" ]] && _pass "absent tool_input -> no .tool.action" || _fail "absent tool_input produced an action"
+
+# --- (j) PRIVACY: the raw command string is NOT added by this change ---------
+echo ""
+echo "--- (j) privacy: .tool.action is a bounded enum; no new raw-command field ---"
+SECRET="SENSITIVE_TOKEN_sk_ant_9f3a"
+inv_j=$(jq -nc --arg s "$SECRET" '{session_id:"ac-j",hook_event_name:"PreToolUse",tool_name:"Bash",tool_input:{command:("git commit -m \"deploy "+$s+"\"")}}')
+out_j=$(_run_tool_event "preToolUse" "$inv_j")
+action_j=$(echo "$out_j" | jq -r '.tool.action')
+[[ "$action_j" == "git" ]] && _pass "sensitive git command still classifies (action==git)" || _fail "expected git, got '$action_j'"
+# .tool.action is exactly the enum — never the raw command.
+if echo "$action_j" | grep -q "$SECRET"; then
+  _fail "PRIVACY LEAK: .tool.action contains the raw command args"
+else
+  _pass ".tool.action carries only the enum 'git', not the raw command args"
+fi
+# The ONLY place the command text appears is the pre-existing .tool.input (this
+# change added no new raw-command field). Assert the secret appears solely there.
+occurrences=$(echo "$out_j" | jq -c '.tool | del(.input)' | grep -c "$SECRET" || true)
+[[ "$occurrences" == "0" ]] && _pass "no NEW field outside the pre-existing .tool.input carries the raw command (this change added only the enum)" || _fail "this change leaked the raw command into a new field"
+
+rm -rf "$TMPDIR_EVAL"
+
+echo ""
+echo "Telemetry action-class ontology: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]