@rubytech/create-maxy-code 0.1.163 → 0.1.165

package/payload/platform/plugins/admin/hooks/__tests__/per-turn-graph-pass-gate.test.sh

@@ -1,387 +0,0 @@
-#!/usr/bin/env bash
-# Task 440 — per-turn-graph-pass-gate Stop hook test suite.
-#
-# Mirrors session-end-retrospective.test.sh's listener-mock pattern. Local
-# Python HTTP server stands in for /api/admin/log-ingest and records every
-# POST so the assertions read every log line the hook emitted.
-#
-# Contract under test:
-#   - Role/specialist gates: exit 0, single trigger-skipped log line, no
-#     stderr.
-#       role-not-admin | is-specialist | empty-stdin | missing-transcript
-#   - No real-user record in transcript (e.g. SessionStart bootstrap, or
-#     only tool_result-shaped user records): exit 0, single
-#     `trigger-skipped reason=no-real-user` line, no stderr.
-#   - Block path — admin's turn since the latest real-user message contains
-#     no `Task(database-operator)` dispatch and no `pre-turn-graph-pass-skip`
-#     tool_use: exit 2, stderr carries the instruction block,
-#     `gate-blocked sessionId=<id> reason=sentinel-absent` emitted.
-#   - Release via dispatch — a `Task` tool_use with
-#     `input.subagent_type=database-operator` appears AFTER the latest
-#     real-user message: exit 0, `gate-released sessionId=<id> via=dispatch`.
-#   - Release via skip-sentinel — a `tool_use` named
-#     `mcp__admin__pre-turn-graph-pass-skip` appears AFTER the latest
-#     real-user message: exit 0,
-#     `gate-released sessionId=<id> via=skip-sentinel`.
-#   - Per-prompt scoping — a dispatch BEFORE the latest real-user message
-#     does NOT release the gate.
-#   - Re-entry — a second Stop fired after the release tool_use still
-#     releases (the JSONL grep is the re-entry guard, no loop).
-
-set -u
-
-HOOK="$(cd "$(dirname "$0")/.." && pwd)/per-turn-graph-pass-gate.sh"
-if [[ ! -x "$HOOK" ]]; then
-  echo "FAIL: $HOOK not executable" >&2
-  exit 1
-fi
-
-OP_ID='aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb'
-
-TMPFILES=()
-LISTENER_PIDS=()
-cleanup_test_state() {
-  for pid in "${LISTENER_PIDS[@]:-}"; do
-    if [[ -n "$pid" ]]; then
-      kill "$pid" 2>/dev/null || true
-      wait "$pid" 2>/dev/null || true
-    fi
-  done
-  for f in "${TMPFILES[@]:-}"; do
-    [[ -n "$f" ]] && rm -f "$f" 2>/dev/null || true
-  done
-}
-trap cleanup_test_state EXIT
-
-PASS=0
-FAIL=0
-pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
-fail() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
-
-start_listener() {
-  REQ_LOG=$(mktemp); TMPFILES+=("$REQ_LOG")
-  LISTENER_PORT=$((39800 + RANDOM % 100))
-  python3 - "$LISTENER_PORT" "$REQ_LOG" <<'PY' &
-import sys, http.server, json
-port = int(sys.argv[1])
-log_path = sys.argv[2]
-class H(http.server.BaseHTTPRequestHandler):
-  def log_message(self, *a, **k): pass
-  def do_POST(self):
-    n = int(self.headers.get('Content-Length','0') or 0)
-    body = self.rfile.read(n).decode('utf-8','replace')
-    with open(log_path, 'a', encoding='utf-8') as f:
-      f.write(self.path + '\t' + body + '\n')
-    self.send_response(200)
-    self.send_header('Content-Type','application/json')
-    self.end_headers()
-    self.wfile.write(json.dumps({"ok": True}).encode('utf-8'))
-http.server.HTTPServer(('127.0.0.1', port), H).serve_forever()
-PY
-  LISTENER_PIDS+=("$!")
-  for _ in $(seq 1 20); do
-    if curl -sS --max-time 1 -X POST "http://127.0.0.1:${LISTENER_PORT}/ping" -d '{}' >/dev/null 2>&1; then
-      break
-    fi
-    sleep 0.1
-  done
-  : > "$REQ_LOG"
-}
-
-run_hook() {
-  local role="$1"; local specialist="$2"; local stdin_json="$3"
-  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-  printf '%s' "$stdin_json" | \
-    MAXY_SESSION_ROLE="$role" \
-    MAXY_SPECIALIST="$specialist" \
-    MAXY_UI_INTERNAL_PORT="$LISTENER_PORT" \
-    bash "$HOOK" >"$stdout_file" 2>"$stderr_file"
-  HOOK_RC=$?
-  HOOK_STDERR=$(cat "$stderr_file")
-  HOOK_STDOUT=$(cat "$stdout_file")
-  sleep 0.1
-}
-
-ingest_lines() {
-  grep -E '^/api/admin/log-ingest	' "$REQ_LOG" 2>/dev/null | python3 -c '
-import sys, json
-for raw in sys.stdin:
-  try:
-    _, body = raw.rstrip("\n").split("\t", 1)
-    d = json.loads(body)
-    if isinstance(d, dict) and isinstance(d.get("line"), str):
-      print(d["line"])
-  except Exception:
-    pass
-' || true
-}
-
-# write_transcript: builds JSONL from positional specs.
-# Spec format: <role>|<text>|<extra>
-#   extra "" — plain text record
-#   extra "tool_result" — user record carrying only a tool_result block
-#   extra "tool_use:<NAME>" — assistant record with a tool_use block (no input)
-#   extra "task:<subagent_type>" — assistant record with a Task tool_use whose
-#                                  input.subagent_type equals <subagent_type>
-write_transcript() {
-  local out="$1"; shift
-  python3 - "$out" "$@" <<'PY'
-import sys, json
-out = sys.argv[1]
-spec = sys.argv[2:]
-with open(out, "w", encoding="utf-8") as f:
-    for entry in spec:
-        role, text, extra = entry.split("|", 2)
-        rec = {"type": role, "timestamp": "2026-05-26T10:00:00.000Z"}
-        if role == "user":
-            if extra == "tool_result":
-                rec["message"] = {
-                    "role": "user",
-                    "content": [
-                        {"type": "tool_result", "tool_use_id": "tu_x", "content": text or "ok"},
-                    ],
-                }
-            else:
-                rec["message"] = {"role": "user", "content": text}
-        else:
-            content_blocks = []
-            if text:
-                content_blocks.append({"type": "text", "text": text})
-            if extra.startswith("tool_use:"):
-                tool_name = extra.split(":", 1)[1]
-                content_blocks.append({
-                    "type": "tool_use",
-                    "id": f"toolu_{tool_name}",
-                    "name": tool_name,
-                    "input": {},
-                })
-            elif extra.startswith("task:"):
-                subagent = extra.split(":", 1)[1]
-                content_blocks.append({
-                    "type": "tool_use",
-                    "id": f"toolu_task_{subagent}",
-                    "name": "Task",
-                    "input": {"subagent_type": subagent, "description": "test", "prompt": "test"},
-                })
-            rec["message"] = {
-                "id": f"msg_{role}_{hash(text) & 0xffff:04x}",
-                "role": "assistant",
-                "content": content_blocks,
-            }
-        f.write(json.dumps(rec) + "\n")
-PY
-}
-
-envelope_for() {
-  python3 -c '
-import json, sys
-print(json.dumps({"session_id": sys.argv[1], "transcript_path": sys.argv[2]}))
-' "$1" "$2"
-}
-
-INSTRUCTION_TOKEN='Before this turn closes, do the per-turn graph pass'
-
-# ---------------------------------------------------------------------------
-# Case 1: role != admin → trigger-skipped reason=role-not-admin
-# ---------------------------------------------------------------------------
-start_listener
-TR_BASIC=$(mktemp); TMPFILES+=("$TR_BASIC")
-write_transcript "$TR_BASIC" "user|hello|" "assistant|hi|"
-ENV_BASIC=$(envelope_for "$OP_ID" "$TR_BASIC")
-: > "$REQ_LOG"
-run_hook "public" "" "$ENV_BASIC"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-1 rc=$HOOK_RC"
-[[ -z "$HOOK_STDERR" ]] || fail "case-1 stderr must be empty"
-if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=role-not-admin$"; then
-  pass "case-1 role=public → trigger-skipped reason=role-not-admin"
-else
-  fail "case-1 expected role-not-admin, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 2: MAXY_SPECIALIST set → trigger-skipped reason=is-specialist
-# ---------------------------------------------------------------------------
-: > "$REQ_LOG"
-run_hook "admin" "database-operator" "$ENV_BASIC"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-2 rc=$HOOK_RC"
-[[ -z "$HOOK_STDERR" ]] || fail "case-2 stderr must be empty"
-if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=is-specialist specialist=database-operator$"; then
-  pass "case-2 specialist=database-operator → trigger-skipped is-specialist"
-else
-  fail "case-2 expected is-specialist, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 3: empty stdin → trigger-skipped reason=empty-stdin
-# ---------------------------------------------------------------------------
-: > "$REQ_LOG"
-run_hook "admin" "" ""
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-3 rc=$HOOK_RC"
-if ingest_lines | grep -qE "^trigger-skipped sessionId=.* reason=empty-stdin$"; then
-  pass "case-3 empty stdin → trigger-skipped reason=empty-stdin"
-else
-  fail "case-3 expected empty-stdin, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 4: missing transcript_path → trigger-skipped reason=missing-transcript
-# ---------------------------------------------------------------------------
-BAD_ENV=$(python3 -c 'import json,sys; print(json.dumps({"session_id": sys.argv[1]}))' "$OP_ID")
-: > "$REQ_LOG"
-run_hook "admin" "" "$BAD_ENV"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-4 rc=$HOOK_RC"
-if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=missing-transcript$"; then
-  pass "case-4 missing transcript → trigger-skipped reason=missing-transcript"
-else
-  fail "case-4 expected missing-transcript, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 5: no real-user record in transcript → trigger-skipped no-real-user
-# ---------------------------------------------------------------------------
-TR_NO_USER=$(mktemp); TMPFILES+=("$TR_NO_USER")
-# Only a tool_result-shaped user record + an assistant record. The hook should
-# treat this as "no real user yet" and trigger-skip.
-write_transcript "$TR_NO_USER" "user|ok|tool_result" "assistant|booting|"
-ENV_NO_USER=$(envelope_for "$OP_ID" "$TR_NO_USER")
-: > "$REQ_LOG"
-run_hook "admin" "" "$ENV_NO_USER"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-5 rc=$HOOK_RC"
-[[ -z "$HOOK_STDERR" ]] || fail "case-5 stderr must be empty"
-if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=no-real-user$"; then
-  pass "case-5 only tool_result-user records → trigger-skipped no-real-user"
-else
-  fail "case-5 expected no-real-user, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 6: gate-blocked — admin replied to operator without dispatching or
-# calling the skip sentinel.
-# ---------------------------------------------------------------------------
-TR_BLOCKED=$(mktemp); TMPFILES+=("$TR_BLOCKED")
-write_transcript "$TR_BLOCKED" "user|hello|" "assistant|hi there|"
-ENV_BLOCKED=$(envelope_for "$OP_ID" "$TR_BLOCKED")
-: > "$REQ_LOG"
-run_hook "admin" "" "$ENV_BLOCKED"
-[[ "$HOOK_RC" -eq 2 ]] || fail "case-6 expected rc=2, got $HOOK_RC"
-if ! printf '%s' "$HOOK_STDERR" | grep -qF "$INSTRUCTION_TOKEN"; then
-  fail "case-6 stderr must contain instruction token; got: $HOOK_STDERR"
-fi
-if ingest_lines | grep -qE "^gate-blocked sessionId=${OP_ID} reason=sentinel-absent$"; then
-  pass "case-6 admin replied without dispatch/skip → gate-blocked + stderr instruction + rc=2"
-else
-  fail "case-6 expected gate-blocked, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 7: release via dispatch — admin issued Task(database-operator) AFTER
-# the latest real-user message.
-# ---------------------------------------------------------------------------
-TR_DISPATCH=$(mktemp); TMPFILES+=("$TR_DISPATCH")
-write_transcript "$TR_DISPATCH" \
-  "user|tell me about Alice|" \
-  "assistant|dispatching|task:database-operator" \
-  "assistant|done|"
-ENV_DISPATCH=$(envelope_for "$OP_ID" "$TR_DISPATCH")
-: > "$REQ_LOG"
-run_hook "admin" "" "$ENV_DISPATCH"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-7 expected rc=0, got $HOOK_RC"
-[[ -z "$HOOK_STDERR" ]] || fail "case-7 stderr must be empty on release"
-if ingest_lines | grep -qE "^gate-released sessionId=${OP_ID} via=dispatch( |$)"; then
-  pass "case-7 Task(database-operator) after latest user → gate-released via=dispatch"
-else
-  fail "case-7 expected gate-released via=dispatch, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 8: release via skip-sentinel — admin called the skip MCP tool AFTER
-# the latest real-user message.
-# ---------------------------------------------------------------------------
-TR_SKIP=$(mktemp); TMPFILES+=("$TR_SKIP")
-write_transcript "$TR_SKIP" \
-  "user|thanks|" \
-  "assistant|noted|tool_use:mcp__admin__pre-turn-graph-pass-skip" \
-  "assistant|you're welcome|"
-ENV_SKIP=$(envelope_for "$OP_ID" "$TR_SKIP")
-: > "$REQ_LOG"
-run_hook "admin" "" "$ENV_SKIP"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-8 expected rc=0, got $HOOK_RC"
-[[ -z "$HOOK_STDERR" ]] || fail "case-8 stderr must be empty on release"
-if ingest_lines | grep -qE "^gate-released sessionId=${OP_ID} via=skip-sentinel tool=mcp__admin__pre-turn-graph-pass-skip$"; then
-  pass "case-8 skip-sentinel after latest user → gate-released via=skip-sentinel"
-else
-  fail "case-8 expected gate-released via=skip-sentinel, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 9: per-prompt scoping — a dispatch BEFORE the latest real-user
-# message does NOT release the current turn's gate.
-# ---------------------------------------------------------------------------
-TR_PRIOR=$(mktemp); TMPFILES+=("$TR_PRIOR")
-write_transcript "$TR_PRIOR" \
-  "user|first turn|" \
-  "assistant|dispatching|task:database-operator" \
-  "assistant|done|" \
-  "user|second turn|" \
-  "assistant|hello again|"
-ENV_PRIOR=$(envelope_for "$OP_ID" "$TR_PRIOR")
-: > "$REQ_LOG"
-run_hook "admin" "" "$ENV_PRIOR"
-[[ "$HOOK_RC" -eq 2 ]] || fail "case-9 expected rc=2, got $HOOK_RC"
-if ingest_lines | grep -qE "^gate-blocked sessionId=${OP_ID} reason=sentinel-absent$"; then
-  pass "case-9 dispatch before latest user does NOT release current turn → gate-blocked"
-else
-  fail "case-9 expected gate-blocked, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 10: re-entry — a release tool_use earlier in the same prompt window
-# stays released on a second Stop fire (no loop).
-# ---------------------------------------------------------------------------
-TR_REENTRY=$(mktemp); TMPFILES+=("$TR_REENTRY")
-write_transcript "$TR_REENTRY" \
-  "user|hi|" \
-  "assistant|dispatching|task:database-operator" \
-  "assistant|done|" \
-  "assistant|wrap-up reply|"
-ENV_REENTRY=$(envelope_for "$OP_ID" "$TR_REENTRY")
-: > "$REQ_LOG"
-run_hook "admin" "" "$ENV_REENTRY"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-10 expected rc=0, got $HOOK_RC"
-if ingest_lines | grep -qE "^gate-released sessionId=${OP_ID} via=dispatch( |$)"; then
-  pass "case-10 second Stop after dispatch still releases (no loop)"
-else
-  fail "case-10 expected gate-released via=dispatch, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-# Case 11: namespace alias — admin called the skip MCP tool via the Claude
-# Code plugin-system namespace (`mcp__plugin_admin_admin__…`) instead of the
-# bare `mcp__admin__…`. Both forms must release the gate. Regression guard
-# for the Task 440 namespace-match bug observed in session
-# 2cfe467c-743d-4386-ac04-3eec8c89d8c9, where the agent looped on Stop
-# because the gate's literal `mcp__admin__pre-turn-graph-pass-skip` pattern
-# did not fullmatch the plugin-prefixed `tool_use.name` actually written
-# to JSONL.
-# ---------------------------------------------------------------------------
-TR_NS=$(mktemp); TMPFILES+=("$TR_NS")
-write_transcript "$TR_NS" \
-  "user|thanks|" \
-  "assistant|noted|tool_use:mcp__plugin_admin_admin__pre-turn-graph-pass-skip" \
-  "assistant|you're welcome|"
-ENV_NS=$(envelope_for "$OP_ID" "$TR_NS")
-: > "$REQ_LOG"
-run_hook "admin" "" "$ENV_NS"
-[[ "$HOOK_RC" -eq 0 ]] || fail "case-11 expected rc=0, got $HOOK_RC"
-[[ -z "$HOOK_STDERR" ]] || fail "case-11 stderr must be empty on release"
-if ingest_lines | grep -qE "^gate-released sessionId=${OP_ID} via=skip-sentinel tool=mcp__plugin_admin_admin__pre-turn-graph-pass-skip$"; then
-  pass "case-11 plugin-namespaced skip-sentinel → gate-released via=skip-sentinel"
-else
-  fail "case-11 expected gate-released via=skip-sentinel under plugin namespace, got: $(ingest_lines)"
-fi
-
-# ---------------------------------------------------------------------------
-echo
-echo "per-turn-graph-pass-gate tests: $PASS passed, $FAIL failed"
-[[ "$FAIL" -eq 0 ]]