@rubytech/create-maxy-code 0.1.102 → 0.1.104

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.102",
+  "version": "0.1.104",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, file-attach, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, file-attach, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: admin
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, file-attach, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, file-attach, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective) for managing the Maxy platform."
 tools:
   - name: system-status
     publicAllowlist: false
@@ -68,6 +68,9 @@ tools:
   - name: action-edit
     publicAllowlist: false
     adminAllowlist: true
+  - name: session-retrospective-mark-complete
+    publicAllowlist: false
+    adminAllowlist: true
 hidden:
   - remote-auth-status
   - remote-auth-set-password
@@ -131,6 +134,7 @@ Tools are available via the `admin` MCP server.
 - `hooks/playwright-file-guard.sh` — rewrites file:// URLs to a backgrounded loopback http.server before Playwright sees them
 - `hooks/webfetch-preflight.mjs` — short-circuits WebFetch on JS-SPA shells with a structured `WEBFETCH_CANNOT_READ_JS_SPA` error so the agent surfaces a loud failure to the owner instead of paying the 60s extraction timeout. Fail-open on any internal error.
 - `hooks/askuserquestion-investigate-gate.sh` — PreToolUse matcher=`AskUserQuestion`. Blocks the question (exit 2) when no read-only investigation tool has fired since the latest real user turn in the session JSONL. The structural fix for the failure class where the agent fabricates a menu before evidence-gathering (session `c085ec2c-46fb-4b73-8865-68cf85866ea8` 2026-05-22 — "change remote access password" → invented options "Admin PIN / Cloudflare tunnel / WiFi password" with zero prior tool_use; post-correction the agent immediately fired `remote-auth-status` → `ToolSearch` → `remote-auth-set-password`, proving it knew the moves). **Allowlist** (exact, with trailing `__<tool>` suffix-match for namespaced `mcp__plugin_<plugin>_<server>__<tool>` aliases): `ToolSearch`, `Grep`, `Glob`, `Read`, `LS`, `NotebookRead`, `Bash`, `WebFetch`, `WebSearch`, plus the read-only admin / memory MCP tools (`*-status`, `*-list`, `*-read`, `skill-find`, `memory-find-candidates`, `profile-read`, `conversation-list`, `memory-list-attachments`, `memory-read-attachment`). **Block message:** `Blocked: AskUserQuestion requires at least one investigation tool (ToolSearch, Grep, Read, *-list, *-status, *-read, skill-find, ...) earlier in this turn. Search the operator's literal phrase first.` **Log line** (stderr, one per call): `[ask-gate] decision=<allow|block> sessionId=<id8> seen=<csv|-> reason=<allowlist-hit|no-investigation|fail-open-no-transcript|fail-open-parse-error>`. **Fail-open** on missing transcript or parse error — nudges, never bricks the UI.
+- `hooks/session-end-retrospective.sh` — **Stop hook.** Fires on every assistant end_turn but exits 0 with `trigger-skipped reason=<role-not-admin|is-specialist|empty-stdin|missing-transcript|no-intent-match>` on every path EXCEPT when the operator's latest real-user message carries an end-intent token (`/end`, `/archive`, `end session`, `archive this session`, case-insensitive, must match the whole message or a standalone line — not embedded in prose). On that path the hook blocks (exit 2 + structured retrospective instruction on stderr per Stop-hook contract) and emits `[session-retrospective] gate-blocked sessionId=<id> reason=sentinel-absent` until the admin agent calls the `session-retrospective-mark-complete` MCP sentinel tool. Completion is recognised by greping the operator's own JSONL (`transcript_path` on the Stop envelope) for a `tool_use` block whose `name` equals that exact string — never by parsing prose ([[feedback_no_stdout_parsing_for_control_flow]], [[feedback_doctrine_paragraph_is_not_a_gate]]). The sentinel-grep doubles as the re-entry guard: every Stop after the sentinel call sees it and exits 0 with `gate-released sessionId=<id>`. Recursion guard: any session whose `MAXY_SPECIALIST` env is set (specialist subagent dispatched via Task tool) skips the gate. The Sidebar archive button POSTs `/:sessionId/archive` directly to the manager which kills the PTY — no Stop fires after that, so clicking archive is the operator's current escape hatch (opt-out remains deferred per the task spec). All emits go through `POST /api/admin/log-ingest`; the only stderr writer is the gate-blocked path (the instruction block the agent reads). The retrospective itself runs as one or more additional turns inside the operator's existing admin session — Task-tool delegation to `database-operator` is the existing IDENTITY.md "Recording" route, not a parallel admin session ([[feedback_deterministic_means_remove_llm]]).
 - `hooks/turn-completed-graph-write.sh` — **Dormant since Task 214** — the Stop-hook registration is no longer written to account settings.json; admin delegates graph writes to `database-operator` via the Task tool. The script, envelope walker, loopback `/api/admin/claude-sessions` 127.0.0.1 bypass, `[turn-recorder]` emitters, recorder-auto-archive subscriber, and `initialMessage` envelope spec are preserved as reusable infrastructure for any future autonomous post-turn flow. Historical contract (still describes the dormant path): Stop hook fired once per completed admin-agent turn. Gates on `MAXY_SESSION_ROLE=admin` + `MAXY_SPECIALIST!=database-operator` so it never recurses into the recorder PTY or fires on public sessions. **Task 147** — the recorder is spawned via the same route Sidebar uses. ONE POST to `POST /api/admin/claude-sessions`, body carries `{specialist:'database-operator', model:'haiku', initialMessage:<json-envelope>, adminSessionId:<op>}` — no synthetic `senderId: 'turn-recorder'` marker. The Hono wrapper bypasses cookie auth on this exact method+path when the request originates from `127.0.0.1` (same trust boundary the claude-session-manager itself relies on), looks up the operator's senderId from the manager's `/<adminSessionId>/meta`, and forwards a Sidebar-shape spawn body. The `/recorder-spawn` sibling route is gone. The hook reads its UI port from `MAXY_UI_INTERNAL_PORT` (stamped on the manager systemd unit) — no fallback; absence emits `[turn-recorder] spawn-failed reason=missing-env env=MAXY_UI_INTERNAL_PORT` to stderr instead of silently 19199-ing. **Task 177** — `initialMessage` is a JSON-stringified envelope; the schema lives in [`platform/plugins/docs/references/admin-session.md`](../docs/references/admin-session.md) under "`initialMessage` JSON envelope (Task 177)". Top-level keys exactly: `turns`, `conversationId`, `accountId`, `occurredAt`. `turns` is the full conversation transcript, oldest first, newest last, with each entry `{ role: "user"|"assistant", text, ts, toolCalls? }`. No windowing, no truncation. Multi-record assistant messages collapse on `message.id`. `tool_use` and matching `tool_result` blocks attach as a single `toolCalls` entry on the owning assistant turn; the user record carrying only the `tool_result` does not create a separate user turn. No leading instruction prose. `toolCalls[].input` and `toolCalls[].output` are native JSON values, never re-stringified. (Replaces Task 175's `(operatorMessage, assistantReply)` pair, which asserted a temporal Q→A relationship the walker never enforced.) One observability line `[turn-recorder] envelope sessionId=<op> turnsCount=<n> userTurns=<n> assistantTurns=<n> toolCallTurns=<n>` precedes `spawn-request`. The envelope rides on the `/spawn` body as a trailing positional argv to `claude`, so the database-operator session's JSONL first `role=user` line is the JSON object verbatim. No separate `POST /:id/input` call, no bracketed-paste, no keystroke injection. The recorder-auto-archive subscriber stops the recorder PTY as soon as its JSONL contains an assistant message with `stop_reason === "end_turn"`. **Task 129** — every emit goes through `POST /api/admin/log-ingest` so the lines land in `server.log` keyed by the operator session id. The chain is `trigger` → `spawn-request` → `spawn-success` → `input-delivered` → `tool-call` × N → `tool-result` × N → `write-complete` → `auto-archive`; each gated-off path emits one `trigger-skipped reason=<role-not-admin|is-recorder|empty-stdin|missing-transcript|conversation-empty>` line. Failure modes — `spawn-failed`, `tool-surface-missing`, `input-failed`, `write-empty`, `auto-archive reason=stale-recorder` — each emit one named line; absence is itself a defect.
 
 ## Session identifiers (Task 135)

package/payload/platform/plugins/admin/hooks/__tests__/session-end-retrospective.test.sh

@@ -0,0 +1,396 @@
+#!/usr/bin/env bash
+# Task 282 — session-end retrospective Stop hook test suite.
+#
+# Listener-mock pattern from turn-completed-graph-write.test.sh: a local
+# Python HTTP server stands in for /api/admin/log-ingest and records every
+# POST so the assertions can read every log line the hook emitted.
+#
+# Contract under test:
+#   - All log emissions go through POST /api/admin/log-ingest. Hook stderr
+#     stays silent on every path EXCEPT the gate-blocked path, which writes
+#     the three-pass retrospective instruction block to stderr (Stop-hook
+#     contract — that is how the agent receives the instruction).
+#   - Every gated-off path emits one `trigger-skipped reason=<r>` line and
+#     exits 0:
+#       role-not-admin | is-specialist | empty-stdin | missing-transcript |
+#       no-intent-match
+#   - End-intent triggers: `/end`, `/archive`, `end session`,
+#     `archive this session`, applied case-insensitively to the latest
+#     real-user message. `tool_result`-only user records are NOT the
+#     latest user message. Embedded prose ("I'll end session by 5pm")
+#     does NOT trigger.
+#   - When the intent matches and the sentinel `tool_use` of
+#     `session-retrospective-mark-complete` is absent from the JSONL:
+#     exit 2, stderr carries the instruction block,
+#     `gate-blocked sessionId=<id> reason=sentinel-absent` emitted.
+#   - When the intent matches and the sentinel `tool_use` is present:
+#     exit 0, `gate-released sessionId=<id>` emitted.
+#   - Re-entry: a second Stop fired after the sentinel call still releases
+#     (the sentinel-grep is the re-entry guard).
+#   - Per-session scoping: a sentinel in a DIFFERENT session's JSONL does
+#     NOT release the active gate.
+
+set -u
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/session-end-retrospective.sh"
+if [[ ! -x "$HOOK" ]]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+
+OP_ID='aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb'
+OTHER_ID='99999999-7777-6666-5555-444444444444'
+
+TMPFILES=()
+LISTENER_PIDS=()
+cleanup_test_state() {
+  for pid in "${LISTENER_PIDS[@]:-}"; do
+    if [[ -n "$pid" ]]; then
+      kill "$pid" 2>/dev/null || true
+      wait "$pid" 2>/dev/null || true
+    fi
+  done
+  for f in "${TMPFILES[@]:-}"; do
+    [[ -n "$f" ]] && rm -f "$f" 2>/dev/null || true
+  done
+}
+trap cleanup_test_state EXIT
+
+PASS=0
+FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
+
+start_listener() {
+  REQ_LOG=$(mktemp); TMPFILES+=("$REQ_LOG")
+  LISTENER_PORT=$((39500 + RANDOM % 100))
+  python3 - "$LISTENER_PORT" "$REQ_LOG" <<'PY' &
+import sys, http.server, json
+port = int(sys.argv[1])
+log_path = sys.argv[2]
+class H(http.server.BaseHTTPRequestHandler):
+  def log_message(self, *a, **k): pass
+  def do_POST(self):
+    n = int(self.headers.get('Content-Length','0') or 0)
+    body = self.rfile.read(n).decode('utf-8','replace')
+    with open(log_path, 'a', encoding='utf-8') as f:
+      f.write(self.path + '\t' + body + '\n')
+    self.send_response(200)
+    self.send_header('Content-Type','application/json')
+    self.end_headers()
+    self.wfile.write(json.dumps({"ok": True}).encode('utf-8'))
+http.server.HTTPServer(('127.0.0.1', port), H).serve_forever()
+PY
+  LISTENER_PIDS+=("$!")
+  for _ in $(seq 1 20); do
+    if curl -sS --max-time 1 -X POST "http://127.0.0.1:${LISTENER_PORT}/ping" -d '{}' >/dev/null 2>&1; then
+      break
+    fi
+    sleep 0.1
+  done
+  : > "$REQ_LOG"
+}
+
+run_hook() {
+  local role="$1"; local specialist="$2"; local stdin_json="$3"
+  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
+  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
+  printf '%s' "$stdin_json" | \
+    MAXY_SESSION_ROLE="$role" \
+    MAXY_SPECIALIST="$specialist" \
+    MAXY_UI_INTERNAL_PORT="$LISTENER_PORT" \
+    bash "$HOOK" >"$stdout_file" 2>"$stderr_file"
+  HOOK_RC=$?
+  HOOK_STDERR=$(cat "$stderr_file")
+  HOOK_STDOUT=$(cat "$stdout_file")
+  sleep 0.1
+}
+
+ingest_lines() {
+  grep -E '^/api/admin/log-ingest	' "$REQ_LOG" 2>/dev/null | python3 -c '
+import sys, json
+for raw in sys.stdin:
+  try:
+    _, body = raw.rstrip("\n").split("\t", 1)
+    d = json.loads(body)
+    if isinstance(d, dict) and isinstance(d.get("line"), str):
+      print(d["line"])
+  except Exception:
+    pass
+' || true
+}
+
+# Build a JSONL transcript from positional jq-style triples. Each triple is
+# role|text|extra where extra is one of:
+#   ""                                  → plain user/assistant text record
+#   "tool_use:<NAME>"                   → assistant record carrying a
+#                                          tool_use block of that name
+#   "tool_result"                       → user record carrying only a
+#                                          tool_result block (not a real
+#                                          user turn)
+write_transcript() {
+  local out="$1"; shift
+  : > "$out"
+  python3 - "$out" "$@" <<'PY'
+import sys, json
+out = sys.argv[1]
+spec = sys.argv[2:]
+with open(out, "w", encoding="utf-8") as f:
+    for entry in spec:
+        role, text, extra = entry.split("|", 2)
+        rec = {"type": role, "timestamp": "2026-05-24T10:00:00.000Z"}
+        if role == "user":
+            if extra == "tool_result":
+                rec["message"] = {
+                    "role": "user",
+                    "content": [
+                        {"type": "tool_result",
+                         "tool_use_id": "tu_x",
+                         "content": text or "ok"},
+                    ],
+                }
+            else:
+                rec["message"] = {"role": "user", "content": text}
+        else:
+            content_blocks = []
+            if text:
+                content_blocks.append({"type": "text", "text": text})
+            if extra.startswith("tool_use:"):
+                tool_name = extra.split(":", 1)[1]
+                content_blocks.append({
+                    "type": "tool_use",
+                    "id": f"toolu_{tool_name}",
+                    "name": tool_name,
+                    "input": {},
+                })
+            rec["message"] = {
+                "id": f"msg_{role}_{hash(text) & 0xffff:04x}",
+                "role": "assistant",
+                "content": content_blocks,
+            }
+        f.write(json.dumps(rec) + "\n")
+PY
+}
+
+envelope_for() {
+  python3 -c '
+import json, sys
+print(json.dumps({"session_id": sys.argv[1], "transcript_path": sys.argv[2]}))
+' "$1" "$2"
+}
+
+# ---------------------------------------------------------------------------
+# Case 1: role != admin → trigger-skipped reason=role-not-admin
+# ---------------------------------------------------------------------------
+start_listener
+TRANSCRIPT_PUBLIC=$(mktemp); TMPFILES+=("$TRANSCRIPT_PUBLIC")
+write_transcript "$TRANSCRIPT_PUBLIC" "user|/end|"
+ENV_PUBLIC=$(envelope_for "$OP_ID" "$TRANSCRIPT_PUBLIC")
+: > "$REQ_LOG"
+run_hook "public" "" "$ENV_PUBLIC"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-1 rc=$HOOK_RC"
+[[ -z "$HOOK_STDERR" ]] || fail "case-1 stderr must be empty, got: $HOOK_STDERR"
+if ingest_lines | grep -qE '^trigger-skipped sessionId=.* reason=role-not-admin$'; then
+  pass "case-1 role=public → trigger-skipped reason=role-not-admin"
+else
+  fail "case-1 expected role-not-admin, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 2: MAXY_SPECIALIST set → trigger-skipped is-specialist
+# ---------------------------------------------------------------------------
+: > "$REQ_LOG"
+run_hook "admin" "database-operator" "$ENV_PUBLIC"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-2 rc=$HOOK_RC"
+[[ -z "$HOOK_STDERR" ]] || fail "case-2 stderr must be empty, got: $HOOK_STDERR"
+if ingest_lines | grep -qE '^trigger-skipped sessionId=.* reason=is-specialist specialist=database-operator$'; then
+  pass "case-2 specialist=database-operator → trigger-skipped is-specialist"
+else
+  fail "case-2 expected is-specialist, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 3: empty stdin → trigger-skipped reason=empty-stdin
+# ---------------------------------------------------------------------------
+: > "$REQ_LOG"
+run_hook "admin" "" ""
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-3 rc=$HOOK_RC"
+if ingest_lines | grep -qE '^trigger-skipped sessionId=.* reason=empty-stdin$'; then
+  pass "case-3 empty stdin → trigger-skipped reason=empty-stdin"
+else
+  fail "case-3 expected empty-stdin, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 4: missing transcript_path → trigger-skipped missing-transcript
+# ---------------------------------------------------------------------------
+: > "$REQ_LOG"
+BAD_ENV=$(python3 -c 'import json,sys; print(json.dumps({"session_id": sys.argv[1]}))' "$OP_ID")
+run_hook "admin" "" "$BAD_ENV"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-4 rc=$HOOK_RC"
+if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=missing-transcript$"; then
+  pass "case-4 missing transcript → trigger-skipped reason=missing-transcript"
+else
+  fail "case-4 expected missing-transcript, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 5: no end-intent token → trigger-skipped reason=no-intent-match
+# ---------------------------------------------------------------------------
+TRANSCRIPT_BORING=$(mktemp); TMPFILES+=("$TRANSCRIPT_BORING")
+write_transcript "$TRANSCRIPT_BORING" \
+  "user|hello|" \
+  "assistant|hi|" \
+  "user|what's the weather|"
+ENV_BORING=$(envelope_for "$OP_ID" "$TRANSCRIPT_BORING")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_BORING"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-5 rc=$HOOK_RC"
+[[ -z "$HOOK_STDERR" ]] || fail "case-5 stderr must be empty"
+if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=no-intent-match$"; then
+  pass "case-5 no intent token → trigger-skipped reason=no-intent-match"
+else
+  fail "case-5 expected no-intent-match, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 6: each intent token triggers gate-blocked (sentinel absent)
+# ---------------------------------------------------------------------------
+for TOKEN in "/end" "/archive" "end session" "archive this session"; do
+  T_FILE=$(mktemp); TMPFILES+=("$T_FILE")
+  write_transcript "$T_FILE" "user|hi|" "assistant|hello|" "user|${TOKEN}|"
+  ENV_BLOCK=$(envelope_for "$OP_ID" "$T_FILE")
+  : > "$REQ_LOG"
+  run_hook "admin" "" "$ENV_BLOCK"
+  if [[ "$HOOK_RC" -ne 2 ]]; then
+    fail "case-6:${TOKEN} expected rc=2, got $HOOK_RC"
+    continue
+  fi
+  if ! ingest_lines | grep -qE "^trigger sessionId=${OP_ID} token=${TOKEN}$"; then
+    fail "case-6:${TOKEN} missing trigger line, got: $(ingest_lines)"
+    continue
+  fi
+  if ! ingest_lines | grep -qE "^gate-blocked sessionId=${OP_ID} reason=sentinel-absent$"; then
+    fail "case-6:${TOKEN} missing gate-blocked line, got: $(ingest_lines)"
+    continue
+  fi
+  if ! printf '%s' "$HOOK_STDERR" | grep -q "session-retrospective-mark-complete"; then
+    fail "case-6:${TOKEN} instruction block missing sentinel tool name on stderr"
+    continue
+  fi
+  if ! printf '%s' "$HOOK_STDERR" | grep -q "database-operator"; then
+    fail "case-6:${TOKEN} instruction block missing database-operator reference"
+    continue
+  fi
+  pass "case-6:${TOKEN} triggers gate-blocked exit 2 + instruction stderr"
+done
+
+# ---------------------------------------------------------------------------
+# Case 7: intent token + sentinel present → gate-released exit 0
+# ---------------------------------------------------------------------------
+T_RELEASE=$(mktemp); TMPFILES+=("$T_RELEASE")
+write_transcript "$T_RELEASE" \
+  "user|hi|" \
+  "assistant|hello|" \
+  "user|/end|" \
+  "assistant|running retrospective|" \
+  "assistant||tool_use:session-retrospective-mark-complete"
+ENV_REL=$(envelope_for "$OP_ID" "$T_RELEASE")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_REL"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-7 expected rc=0, got $HOOK_RC"
+[[ -z "$HOOK_STDERR" ]] || fail "case-7 stderr must be empty, got: $HOOK_STDERR"
+if ingest_lines | grep -qE "^gate-released sessionId=${OP_ID}$"; then
+  pass "case-7 sentinel present → gate-released exit 0"
+else
+  fail "case-7 expected gate-released, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 8: re-entry — Stop fires twice after sentinel call, both release
+# ---------------------------------------------------------------------------
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_REL"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-8 second-stop rc=$HOOK_RC"
+if ingest_lines | grep -qE "^gate-released sessionId=${OP_ID}$"; then
+  pass "case-8 re-entry: second Stop after sentinel still releases"
+else
+  fail "case-8 second Stop did not emit gate-released, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 9: per-session scoping — sentinel lives in a different session's
+#          JSONL; active gate must NOT release
+# ---------------------------------------------------------------------------
+T_OTHER=$(mktemp); TMPFILES+=("$T_OTHER")
+write_transcript "$T_OTHER" \
+  "user|/end|" \
+  "assistant||tool_use:session-retrospective-mark-complete"
+# Active gate inspects only T_ACTIVE (no sentinel inside).
+T_ACTIVE=$(mktemp); TMPFILES+=("$T_ACTIVE")
+write_transcript "$T_ACTIVE" "user|/end|"
+ENV_ACTIVE=$(envelope_for "$OP_ID" "$T_ACTIVE")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_ACTIVE"
+[[ "$HOOK_RC" -eq 2 ]] || fail "case-9 expected rc=2 (other session's sentinel must not release), got $HOOK_RC"
+if ingest_lines | grep -qE "^gate-blocked sessionId=${OP_ID} reason=sentinel-absent$"; then
+  pass "case-9 per-session scoping: sentinel in another transcript does not release"
+else
+  fail "case-9 expected gate-blocked, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 10: `tool_result`-only user record is NOT the latest user message;
+#           the prior real user message wins.
+# ---------------------------------------------------------------------------
+T_TR_ONLY=$(mktemp); TMPFILES+=("$T_TR_ONLY")
+write_transcript "$T_TR_ONLY" \
+  "user|/end|" \
+  "assistant||tool_use:Read" \
+  "user|noise|tool_result"
+ENV_TR=$(envelope_for "$OP_ID" "$T_TR_ONLY")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_TR"
+[[ "$HOOK_RC" -eq 2 ]] || fail "case-10 expected rc=2 (tool_result must not mask /end), got $HOOK_RC"
+if ingest_lines | grep -qE "^gate-blocked sessionId=${OP_ID} reason=sentinel-absent$"; then
+  pass "case-10 tool_result-only user record does not mask latest real user /end"
+else
+  fail "case-10 expected gate-blocked, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 11: embedded prose does NOT trigger ("I'll end session by 5pm")
+# ---------------------------------------------------------------------------
+T_PROSE=$(mktemp); TMPFILES+=("$T_PROSE")
+write_transcript "$T_PROSE" "user|I'll end session by 5pm|"
+ENV_PROSE=$(envelope_for "$OP_ID" "$T_PROSE")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_PROSE"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-11 expected rc=0 (prose must not trigger), got $HOOK_RC"
+if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=no-intent-match$"; then
+  pass "case-11 embedded prose 'end session' does not trigger gate"
+else
+  fail "case-11 expected no-intent-match, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 12: case-insensitive match — `/END` triggers like `/end`
+# ---------------------------------------------------------------------------
+T_CASE=$(mktemp); TMPFILES+=("$T_CASE")
+write_transcript "$T_CASE" "user|/END|"
+ENV_CASE=$(envelope_for "$OP_ID" "$T_CASE")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_CASE"
+[[ "$HOOK_RC" -eq 2 ]] || fail "case-12 expected rc=2 for /END, got $HOOK_RC"
+if ingest_lines | grep -qE "^trigger sessionId=${OP_ID} token=/end$"; then
+  pass "case-12 case-insensitive: /END normalises to /end"
+else
+  fail "case-12 expected token=/end, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+echo
+echo "session-end-retrospective tests: $PASS passed, $FAIL failed"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/pre-tool-use.sh

@@ -182,7 +182,7 @@ except Exception:
       BYTES="${GUARD_VERDICT##*:}"
       echo "[pre-tool-use] guard=base64-tool-result bytes=${BYTES} tool=Bash reason=${REASON} action=reject" >&2
       echo "Blocked: Bash command would emit binary as inline base64/hex to stdout, which lands in the assistant turn and overloads the model context (the 2026-05-09 Rubytech-invoice path hit 66% context after a single ~33 KB tool_result)." >&2
-      echo "Instead: save the bytes directly to \$ACCOUNT_DIR/tmp/<sha1>.<ext> and operate on the file via path — Read for inspection, <img src=\"./<file>\"> for HTML embedding, file-attach for delivery. Decoding base64 (e.g. 'base64 -d in.b64 > out.bin') is allowed." >&2
+      echo "Instead: save the bytes directly to \$ACCOUNT_DIR/tmp/<sha1>.<ext> and operate on the file via path — Read for inspection, <img src=\"./<file>\"> for HTML embedding, the \`file-presentation\` skill for delivery. Decoding base64 (e.g. 'base64 -d in.b64 > out.bin') is allowed." >&2
       exit 2
       ;;
     *)