@rubytech/create-maxy-code 0.1.214 → 0.1.219

package/payload/platform/plugins/admin/hooks/__tests__/pre-tool-use-admin-tool-gate.test.sh

@@ -1,14 +1,17 @@
 #!/usr/bin/env bash
-# Task 529 — admin-tool-gate enforces orchestration-only at the PreToolUse
-# hook. Admin-direct invocations of Write/Edit/MultiEdit/Bash/WebFetch/
-# WebSearch are refused with the dispatch hint; in-window Task subagents
-# pass through.
+# Task 571 — the orchestration-only block has been removed. Admin's standard
+# tool surface (Write/Edit/MultiEdit/Bash/WebFetch/WebSearch) is callable
+# directly from the admin seat; delegation is a doctrine bias enforced in
+# IDENTITY.md, not a platform refusal. This test pins the post-571 contract:
 #
-# Task 559 — the discriminator is `parent_tool_use_id` from the Claude
-# Code hook input. Non-empty → subagent (allow). Absent/empty → admin
-# direct (block). The earlier `transcript_path` glob was broken in
-# Claude Code 2.1.x because subagent hooks receive the parent session's
-# transcript_path, never one under `*/subagents/agent-*.jsonl`.
+#   - Admin-direct Bash/Edit/Write/WebFetch all return exit 0 with no
+#     `reason=orchestration-only` or `reason=specialist-owned` line.
+#   - The resource-specific hook blocks (code-dir, entitlement, account.json,
+#     pending-actions, base64-guard, approval-queue) are unaffected and live
+#     in their own dedicated tests.
+#
+# Reintroducing the orchestration-only block requires a doctrine flip — this
+# test fails first and surfaces the change loudly.
 
 set -u
 
@@ -30,97 +33,75 @@ PASS=0; FAIL=0
 pass() { PASS=$((PASS+1)); echo "PASS: $1"; }
 fail() { FAIL=$((FAIL+1)); echo "FAIL: $1" >&2; }
 
-# The hook receives the parent session's transcript_path even on subagent
-# calls in Claude Code 2.1.x. The fixture mirrors production.
 SESSION_TRANSCRIPT="/tmp/sess/44283ae1-2b82-4bd7-b8af-99a11141ed4b.jsonl"
-SUBAGENT_PARENT_ID="toolu_01QFC4W32wFUyHy6WJMNjHf6"
 
-run() {
-  local tool="$1" parent_id="$2" expected_rc="$3" expected_pattern="$4" label="$5"
+# run_admin_direct <tool> <expected_rc> <label>
+#   Pipes a minimal PreToolUse payload to the hook with MAXY_SESSION_ROLE=admin
+#   (the realistic admin spawn shape) and asserts the rc and that no
+#   orchestration-only / specialist-owned refusal line appears on stderr.
+run_admin_direct() {
+  local tool="$1" expected_rc="$2" label="$3"
   local input_json
   input_json=$(python3 -c '
 import json, sys
-payload = {
+print(json.dumps({
     "hook_event_name": "PreToolUse",
     "tool_name": sys.argv[1],
-    "tool_input": {"file_path": "/tmp/x", "content": "x", "command": "echo hi"},
+    "tool_input": {"file_path": "/tmp/x", "content": "x", "command": "echo hi", "url": "https://example.com"},
     "transcript_path": sys.argv[2],
-}
-parent = sys.argv[3]
-if parent:
-    payload["parent_tool_use_id"] = parent
-print(json.dumps(payload, separators=(",", ":")))
-' "$tool" "$SESSION_TRANSCRIPT" "$parent_id")
+}, separators=(",", ":")))
+' "$tool" "$SESSION_TRANSCRIPT")
   local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
   local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  printf '%s' "$input_json" | bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
+  printf '%s' "$input_json" | \
+    env -u MAXY_SPECIALIST MAXY_SESSION_ROLE=admin \
+      bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
   local rc=$?
   if [[ "$rc" -ne "$expected_rc" ]]; then
     fail "$label: expected exit $expected_rc, got $rc. Stderr: $(cat "$stderr_file")"
     return
   fi
-  if [[ -n "$expected_pattern" ]] && ! grep -qE "$expected_pattern" "$stderr_file"; then
-    fail "$label: stderr missing pattern '$expected_pattern'. Got: $(cat "$stderr_file")"
+  if grep -qE 'reason=orchestration-only|reason=specialist-owned|reason=missing-marker' "$stderr_file"; then
+    fail "$label: stderr carries a removed-gate reason line. Got: $(cat "$stderr_file")"
     return
   fi
   pass "$label"
 }
 
-# ── Admin-direct refusals (no parent_tool_use_id) ───────────────────────
-run Write     "" 2 '\[admin-tool-gate\] role=admin parent_tool_use_id=- specialist=- tool=Write decision=block.*owner=content-producer' \
-  "Test 1: admin-direct Write rejected with content-producer dispatch hint"
-run Edit      "" 2 '\[admin-tool-gate\] role=admin .*tool=Edit decision=block.*owner=content-producer' \
-  "Test 2: admin-direct Edit rejected"
-run MultiEdit "" 2 '\[admin-tool-gate\] role=admin .*tool=MultiEdit decision=block.*owner=content-producer' \
-  "Test 3: admin-direct MultiEdit rejected"
-run Bash      "" 2 '\[admin-tool-gate\] role=admin .*tool=Bash decision=block' \
-  "Test 4: admin-direct Bash rejected"
-run WebFetch  "" 2 '\[admin-tool-gate\] role=admin .*tool=WebFetch decision=block.*owner=research-assistant' \
-  "Test 5: admin-direct WebFetch rejected"
-run WebSearch "" 2 '\[admin-tool-gate\] role=admin .*tool=WebSearch decision=block.*owner=research-assistant' \
-  "Test 6: admin-direct WebSearch rejected"
-
-# ── In-window subagent passthrough (parent_tool_use_id non-empty) ───────
-run Write     "$SUBAGENT_PARENT_ID" 0 "\[admin-tool-gate\] role=subagent parent_tool_use_id=${SUBAGENT_PARENT_ID} .*tool=Write decision=allow" \
-  "Test 7: subagent Write passes through"
-run Edit      "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=Edit decision=allow' \
-  "Test 8: subagent Edit passes through"
-run Bash      "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=Bash decision=allow' \
-  "Test 9: subagent Bash passes through (Task 559 regression — coding-assistant git pull)"
-run WebFetch  "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=WebFetch decision=allow' \
-  "Test 10: subagent WebFetch passes through"
-run MultiEdit "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=MultiEdit decision=allow' \
-  "Test 11: subagent MultiEdit passes through"
+# ── Admin-direct passthrough (the Task 571 regression boundary) ──────────
+run_admin_direct Bash      0 "Test 1: admin-direct Bash passes through"
+run_admin_direct Edit      0 "Test 2: admin-direct Edit passes through (path /tmp/x is outside protected dirs)"
+run_admin_direct Write     0 "Test 3: admin-direct Write passes through"
+run_admin_direct MultiEdit 0 "Test 4: admin-direct MultiEdit passes through"
+run_admin_direct WebFetch  0 "Test 5: admin-direct WebFetch passes through"
+run_admin_direct WebSearch 0 "Test 6: admin-direct WebSearch passes through"
+run_admin_direct Read      0 "Test 7: admin-direct Read passes through"
 
-# ── Unrelated tools untouched ───────────────────────────────────────────
-run Read      "" 0 '' \
-  "Test 12: admin-direct Read passes (Read is admin-keep-list)"
-
-# ── Task 560: admin-direct block emits propagation record ──────────────
-# Uses the Task 559 classifier (no parent_tool_use_id → admin-direct).
-PROP_TMPDIR=$(mktemp -d); TMPFILES+=("$PROP_TMPDIR")
-export MAXY_HOOK_BUFFER_DIR="$PROP_TMPDIR/buffers"
-export MAXY_HOOK_SERVER_LOG="$PROP_TMPDIR/server.log"
-SESSION="task560-test-sess"
-PROP_INPUT=$(python3 -c '
+# ── Resource-specific blocks unaffected: protected code-dir Write still refuses ──
+# Verifies the deletion was surgical — code-dir-protection-ui still fires.
+PROTECTED_INPUT=$(python3 -c '
 import json, sys
-print(json.dumps({"hook_event_name":"PreToolUse","tool_name":"Bash",
-  "tool_input":{"command":"ls"},"transcript_path":sys.argv[1],
-  "session_id":sys.argv[2]}, separators=(",",":")))
-' "$SESSION_TRANSCRIPT" "$SESSION")
-printf '%s' "$PROP_INPUT" | bash "$HOOK" admin >/dev/null 2>/dev/null
-BUF="$MAXY_HOOK_BUFFER_DIR/$SESSION.jsonl"
-if [[ -f "$BUF" ]] && grep -q '"hookName":"admin-tool-gate"' "$BUF" \
-   && grep -q '"decision":"block"' "$BUF" \
-   && grep -q '"reason":"orchestration-only"' "$BUF"; then
-  pass "Test 13b: admin-direct Bash block emits Task 560 propagation record"
+print(json.dumps({
+    "hook_event_name": "PreToolUse",
+    "tool_name": "Write",
+    "tool_input": {"file_path": "/srv/maxy/platform/ui/app/page.tsx", "content": "x"},
+    "transcript_path": sys.argv[1],
+}, separators=(",", ":")))
+' "$SESSION_TRANSCRIPT")
+PROT_STDOUT=$(mktemp); TMPFILES+=("$PROT_STDOUT")
+PROT_STDERR=$(mktemp); TMPFILES+=("$PROT_STDERR")
+printf '%s' "$PROTECTED_INPUT" | \
+  env -u MAXY_SPECIALIST MAXY_SESSION_ROLE=admin \
+    bash "$HOOK" admin >"$PROT_STDOUT" 2>"$PROT_STDERR"
+PROT_RC=$?
+if [[ "$PROT_RC" -eq 2 ]] && grep -q 'cannot modify platform UI source' "$PROT_STDERR"; then
+  pass "Test 8: admin-direct Write to platform/ui/ still blocked (resource-specific block intact)"
 else
-  fail "Test 13b: propagation record missing/malformed — $(cat "$BUF" 2>/dev/null || echo '<no buffer>')"
+  fail "Test 8: expected platform/ui code-dir block, got rc=$PROT_RC stdout=$(cat "$PROT_STDOUT") stderr=$(cat "$PROT_STDERR")"
 fi
-unset MAXY_HOOK_BUFFER_DIR MAXY_HOOK_SERVER_LOG
 
 echo
-echo "──────── pre-tool-use admin-tool-gate test summary ────────"
+echo "──────── pre-tool-use admin-tool-gate test summary (post-Task 571) ────────"
 echo "PASS: $PASS"
 echo "FAIL: $FAIL"
 

package/payload/platform/plugins/admin/hooks/lib/hook-emit.sh

@@ -9,6 +9,55 @@
 : "${MAXY_HOOK_BUFFER_DIR:=$HOME/.maxy-code/logs/hook-decisions}"
 : "${MAXY_HOOK_SERVER_LOG:=$HOME/.maxy-code/logs/server.log}"
 : "${MAXY_HOOK_STDERR_CAP:=4096}"
+# Task 563 — mkdir-based mutex serialises emitter append vs drainer rename.
+# 100 attempts × 10ms = ~1s ceiling. Portable across Linux (Pi) and macOS
+# (tests) without flock(1).
+: "${MAXY_HOOK_LOCK_ATTEMPTS:=100}"
+: "${MAXY_HOOK_LOCK_SLEEP:=0.01}"
+# Task 569 — TTL for orphaned lockdirs left behind when a holder dies
+# between `mkdir lock` and `rmdir lock` (SIGKILL, OOM, systemd restart).
+# Default 5s is far longer than the legitimate hold (microseconds for a
+# rename or append) and shorter than operator-noticeable propagation lag.
+: "${MAXY_HOOK_LOCK_TTL_SECONDS:=5}"
+
+# _hook_lockdir_age_seconds <lockdir> — prints integer age in seconds, or
+# -1 if the lockdir cannot be stat'd. Portable across Linux (`stat -c`)
+# and macOS (`stat -f`).
+_hook_lockdir_age_seconds() {
+  local lockdir="$1" mtime now
+  mtime=$(stat -c %Y "$lockdir" 2>/dev/null || stat -f %m "$lockdir" 2>/dev/null)
+  [[ -z "$mtime" ]] && { echo -1; return; }
+  now=$(date +%s)
+  echo $((now - mtime))
+}
+
+# _hook_acquire_lock <lockdir> — returns 0 on success, 1 on timeout.
+# On each mkdir failure, if the lockdir is older than
+# MAXY_HOOK_LOCK_TTL_SECONDS, the orphaned holder is presumed dead: the
+# lockdir is force-removed, a stale-lock-reclaimed observability line is
+# emitted, and one mkdir retry is attempted before resuming the spin.
+_hook_acquire_lock() {
+  local lockdir="$1" i=0 age
+  while ! mkdir "$lockdir" 2>/dev/null; do
+    age=$(_hook_lockdir_age_seconds "$lockdir")
+    if [[ "$age" -ge "$MAXY_HOOK_LOCK_TTL_SECONDS" ]]; then
+      rmdir "$lockdir" 2>/dev/null || rm -rf "$lockdir" 2>/dev/null
+      mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
+      printf '[hook-propagate-error] reason=stale-lock-reclaimed lockdir=%s ageSeconds=%s\n' \
+        "$lockdir" "$age" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
+      mkdir "$lockdir" 2>/dev/null && return 0
+    fi
+    i=$((i+1))
+    [[ "$i" -ge "$MAXY_HOOK_LOCK_ATTEMPTS" ]] && return 1
+    sleep "$MAXY_HOOK_LOCK_SLEEP" 2>/dev/null || true
+  done
+  return 0
+}
+
+# _hook_release_lock <lockdir>
+_hook_release_lock() {
+  rmdir "$1" 2>/dev/null || true
+}
 
 # hook_emit_decision <agentId> <hookName> <toolName> <decision> <reason>
 #                    <stderrPayload> <exitCode> <durationMs>
@@ -52,12 +101,21 @@ PY
 
   mkdir -p "$MAXY_HOOK_BUFFER_DIR" 2>/dev/null
   local buf="$MAXY_HOOK_BUFFER_DIR/$agentId.jsonl"
+  local lock="${buf}.lock"
+  if ! _hook_acquire_lock "$lock"; then
+    mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
+    printf '[hook-propagate-error] reason=lock-timeout agentId=%s hook=%s\n' \
+      "$agentId" "$hookName" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null
+    return 0
+  fi
   if ! printf '%s\n' "$rec" >>"$buf" 2>/dev/null; then
+    _hook_release_lock "$lock"
     mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
     printf '[hook-propagate-error] reason=buffer-write agentId=%s hook=%s\n' \
       "$agentId" "$hookName" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null
     return 0
   fi
+  _hook_release_lock "$lock"
 
   local bytesIn="${#stderrPayload}"
   local bytesOut="${#rec}"

package/payload/platform/plugins/admin/hooks/post-tool-use-agent.sh

@@ -1,15 +1,35 @@
 #!/usr/bin/env bash
 # Task 560 — PostToolUse hook scoped to tool_name=Agent in the admin role.
-# Drains any subagent hook-decision buffers modified since this parent's
-# previous fire, prints each record as a [hook-propagate] line to stdout
-# (Claude Code attaches the stdout to the parent JSONL as a hook_success
-# attachment), and emits one [hook-propagate-census] line. N != M in the
-# census is the propagation regression signal.
+# Drains every subagent hook-decision buffer in the dir, prints each record
+# as a [hook-propagate] line to stdout (Claude Code attaches the stdout to
+# the parent JSONL as a hook_success attachment), and emits one
+# [hook-propagate-census] line. N != M in the census is the propagation
+# regression signal.
+#
+# Task 563 — concurrency hardening:
+#   - Atomic claim before read. Each buffer is renamed under a mkdir mutex
+#     to a per-fire `claimed/<basename>-<epoch>-<pid>.jsonl` path. The lock
+#     is held only for the rename syscall; reading happens against the
+#     renamed inode, which no emitter can address. The race window between
+#     the drainer's read and the buffer rotation is closed.
+#   - No cursor. The cursor file was load-bearing only because consumed
+#     buffers could be re-seen; with atomic claim the file's presence in
+#     the directory is the unambiguous signal. Dropping the cursor closes
+#     two further races (concurrent-drainer cursor write, shared
+#     `.unknown.cursor` across broken-stdin fires).
+#   - Unknown-parent observability. When stdin's `session_id` is missing
+#     or unparseable, an explicit `[hook-propagate] parentSession=unknown
+#     reason=session-id-missing` line is emitted to both stdout and
+#     server.log so the broken-stdin path is no longer silent.
 
 set -uo pipefail
 
 : "${MAXY_HOOK_BUFFER_DIR:=$HOME/.maxy-code/logs/hook-decisions}"
 : "${MAXY_HOOK_SERVER_LOG:=$HOME/.maxy-code/logs/server.log}"
+: "${MAXY_HOOK_LOCK_ATTEMPTS:=100}"
+: "${MAXY_HOOK_LOCK_SLEEP:=0.01}"
+# Task 569 — TTL for orphaned lockdirs (see hook-emit.sh for rationale).
+: "${MAXY_HOOK_LOCK_TTL_SECONDS:=5}"
 
 if [ -t 0 ]; then
   # No stdin — no correlation possible. Fail-open.
@@ -19,61 +39,112 @@ INPUT=$(cat)
 PARENT_SESSION=$(printf '%s' "$INPUT" | python3 -c '
 import sys, json
 try:
-    print(json.load(sys.stdin).get("session_id", "") or "unknown")
+    sid = json.load(sys.stdin).get("session_id") or ""
+    print(sid if sid else "unknown")
 except Exception:
     print("unknown")
 ' 2>/dev/null || echo "unknown")
 
-CURSOR_FILE="$MAXY_HOOK_BUFFER_DIR/.${PARENT_SESSION}.cursor"
-mkdir -p "$MAXY_HOOK_BUFFER_DIR/consumed" 2>/dev/null
-
-PREV_CURSOR=0
-if [[ -f "$CURSOR_FILE" ]]; then
-  PREV_CURSOR=$(cat "$CURSOR_FILE" 2>/dev/null || echo 0)
-  [[ "$PREV_CURSOR" =~ ^[0-9]+$ ]] || PREV_CURSOR=0
+if [[ "$PARENT_SESSION" == "unknown" ]]; then
+  # Conservative play (Task 563 brief option C): emit observability and
+  # exit without draining. A broken-stdin fire has no business processing
+  # buffers — the next valid parent fire will pick them up.
+  mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
+  printf '[hook-propagate] parentSession=unknown reason=session-id-missing\n'
+  printf '[hook-propagate] parentSession=unknown reason=session-id-missing\n' \
+    >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
+  exit 0
 fi
-NOW_EPOCH=$(date +%s)
 
+mkdir -p "$MAXY_HOOK_BUFFER_DIR/claimed" "$MAXY_HOOK_BUFFER_DIR/consumed" 2>/dev/null
+
+# Sweep orphaned `.<session>.cursor` files left behind by an older
+# version of this script. The cursor mechanism is gone; without this
+# they would persist forever as dir noise.
+rm -f "$MAXY_HOOK_BUFFER_DIR"/.*.cursor 2>/dev/null || true
+
+NOW_EPOCH=$(date +%s)
 N_OBSERVED=0
 N_EMITTED=0
+
+# Task 569 — same stale-lockdir TTL reclamation as hook-emit.sh.
+_drain_lockdir_age_seconds() {
+  local lockdir="$1" mtime now
+  mtime=$(stat -c %Y "$lockdir" 2>/dev/null || stat -f %m "$lockdir" 2>/dev/null)
+  [[ -z "$mtime" ]] && { echo -1; return; }
+  now=$(date +%s)
+  echo $((now - mtime))
+}
+
+_drain_acquire_lock() {
+  local lockdir="$1" i=0 age
+  while ! mkdir "$lockdir" 2>/dev/null; do
+    age=$(_drain_lockdir_age_seconds "$lockdir")
+    if [[ "$age" -ge "$MAXY_HOOK_LOCK_TTL_SECONDS" ]]; then
+      rmdir "$lockdir" 2>/dev/null || rm -rf "$lockdir" 2>/dev/null
+      mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
+      printf '[hook-propagate-error] reason=stale-lock-reclaimed lockdir=%s ageSeconds=%s\n' \
+        "$lockdir" "$age" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
+      mkdir "$lockdir" 2>/dev/null && return 0
+    fi
+    i=$((i+1))
+    [[ "$i" -ge "$MAXY_HOOK_LOCK_ATTEMPTS" ]] && return 1
+    sleep "$MAXY_HOOK_LOCK_SLEEP" 2>/dev/null || true
+  done
+  return 0
+}
+
 shopt -s nullglob
 for buf in "$MAXY_HOOK_BUFFER_DIR"/*.jsonl; do
   [[ -f "$buf" ]] || continue
   case "$(basename "$buf")" in
     .*) continue;;
   esac
-  MTIME=$(stat -f %m "$buf" 2>/dev/null || stat -c %Y "$buf" 2>/dev/null || echo 0)
-  if [[ "$MTIME" -le "$PREV_CURSOR" ]]; then
+  lock="${buf}.lock"
+  if ! _drain_acquire_lock "$lock"; then
+    mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
+    printf '[hook-propagate-error] reason=lock-timeout parentSession=%s buffer=%s\n' \
+      "$PARENT_SESSION" "$(basename "$buf")" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
+    continue
+  fi
+  # Re-check existence under lock — a peer drainer may have claimed it
+  # between our `for` iteration and our lock acquisition.
+  if [[ ! -f "$buf" ]]; then
+    rmdir "$lock" 2>/dev/null || true
+    continue
+  fi
+  CLAIMED="$MAXY_HOOK_BUFFER_DIR/claimed/$(basename "$buf" .jsonl)-${NOW_EPOCH}-$$.jsonl"
+  if ! mv "$buf" "$CLAIMED" 2>/dev/null; then
+    rmdir "$lock" 2>/dev/null || true
+    mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
+    printf '[hook-propagate-error] reason=claim-mv parentSession=%s buffer=%s\n' \
+      "$PARENT_SESSION" "$(basename "$buf")" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
     continue
   fi
-  # Ground-truth observed count: non-empty lines in the buffer file. The
-  # printf-success M_EMITTED is incremented independently below, so a
+  rmdir "$lock" 2>/dev/null || true
+
+  # Ground-truth observed count: non-empty lines in the claimed file. The
+  # printf-success N_EMITTED is incremented independently below, so a
   # printf failure (SIGPIPE on a closed downstream pipe, EIO on stdout)
   # produces N_OBSERVED > N_EMITTED — the propagation regression signal
   # the census promises. The two counters must not be bumped together.
-  BUF_LINES=$(grep -c . "$buf" 2>/dev/null || echo 0)
+  BUF_LINES=$(grep -c . "$CLAIMED" 2>/dev/null || echo 0)
   N_OBSERVED=$((N_OBSERVED + BUF_LINES))
   while IFS= read -r line || [[ -n "$line" ]]; do
     [[ -z "$line" ]] && continue
     if printf '[hook-propagate] %s\n' "$line" 2>/dev/null; then
       N_EMITTED=$((N_EMITTED+1))
     fi
-  done <"$buf"
-  TARGET="$MAXY_HOOK_BUFFER_DIR/consumed/$(basename "$buf" .jsonl)-${NOW_EPOCH}.jsonl"
-  if ! mv "$buf" "$TARGET" 2>/dev/null; then
+  done <"$CLAIMED"
+  TARGET="$MAXY_HOOK_BUFFER_DIR/consumed/$(basename "$CLAIMED")"
+  if ! mv "$CLAIMED" "$TARGET" 2>/dev/null; then
     mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
     printf '[hook-propagate-error] reason=consumed-mv parentSession=%s buffer=%s\n' \
-      "$PARENT_SESSION" "$(basename "$buf")" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
+      "$PARENT_SESSION" "$(basename "$CLAIMED")" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
   fi
 done
 shopt -u nullglob
 
-if ! printf '%s' "$NOW_EPOCH" >"$CURSOR_FILE" 2>/dev/null; then
-  mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
-  printf '[hook-propagate-error] reason=cursor-write parentSession=%s cursor=%s\n' \
-    "$PARENT_SESSION" "$CURSOR_FILE" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
-fi
-
 printf '[hook-propagate-census] parentSession=%s subagentHooksObserved=%d attachmentsEmitted=%d\n' \
   "$PARENT_SESSION" "$N_OBSERVED" "$N_EMITTED"
 

package/payload/platform/plugins/admin/hooks/pre-tool-use.sh

@@ -43,61 +43,6 @@ except Exception:
 # ---------------------------------------------------------------------------
 if [ "$AGENT_TYPE" = "admin" ]; then
 
-  # ── Orchestration-only authoring + research block (Task 529, 559) ────────
-  # The admin seat is orchestration + clarification + delivery only.
-  # Write/Edit/MultiEdit/Bash/WebFetch/WebSearch are specialist-owned —
-  # content-producer for authoring, research-assistant for research, the
-  # shell tools for whichever specialist owns the workflow that needs them.
-  # In-window Task subagents must keep these tools (Task 222 regression
-  # class).
-  #
-  # Discriminator (Task 559): Claude Code passes `parent_tool_use_id` in
-  # the hook input JSON when the call originates from a subagent (the id
-  # of the parent's Task tool_use). Admin-direct calls have it absent or
-  # empty. Earlier versions used the `transcript_path` glob, but Claude
-  # Code 2.1.x passes the parent session's transcript_path to subagent
-  # hooks, so the glob never matched and every specialist subagent Bash
-  # was blocked with the admin orchestration-only wording.
-  #
-  # Admin direct (no parent_tool_use_id) → exit 2 with dispatch hint.
-  # Subagent (parent_tool_use_id non-empty) → exit 0 (passthrough).
-  case "$TOOL_NAME" in
-    Write|Edit|MultiEdit|Bash|WebFetch|WebSearch)
-      PARENT_TOOL_USE_ID=$(echo "$INPUT" | python3 -c '
-import sys, json
-try:
-    v = json.load(sys.stdin).get("parent_tool_use_id", "")
-    print(v if isinstance(v, str) else "")
-except Exception:
-    print("")
-' 2>/dev/null)
-      SPECIALIST="${MAXY_SPECIALIST:-}"
-      if [ -n "$PARENT_TOOL_USE_ID" ]; then
-        # In-window subagent — passthrough. Tool name resolves on the
-        # subagent's own frontmatter `tools:` allowlist downstream.
-        echo "[admin-tool-gate] role=subagent parent_tool_use_id=${PARENT_TOOL_USE_ID} specialist=${SPECIALIST:--} tool=${TOOL_NAME} decision=allow source=hook-passthrough" >&2
-      else
-        # Admin direct invocation — refuse with dispatch hint.
-        case "$TOOL_NAME" in
-          Write|Edit|MultiEdit)
-            OWNER="content-producer"
-            ;;
-          Bash)
-            OWNER="the specialist that owns the workflow needing shell access"
-            ;;
-          WebFetch|WebSearch)
-            OWNER="research-assistant"
-            ;;
-        esac
-        echo "[admin-tool-gate] role=admin parent_tool_use_id=- specialist=${SPECIALIST:--} tool=${TOOL_NAME} decision=block reason=orchestration-only owner=${OWNER}" >&2
-        hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-          "orchestration-only" \
-          "Blocked: \`${TOOL_NAME}\` is not callable from the admin seat. The admin seat is orchestration + clarification + delivery only — authoring, shell work, and web research are owned by specialists.
-Dispatch the work to ${OWNER} via the Agent tool."
-      fi
-      ;;
-  esac
-
   # ── Code directory protection ────────────────────────────────────────────
   case "$TOOL_NAME" in
     Write|Edit)

package/payload/platform/plugins/admin/mcp/dist/__tests__/capabilities-here.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=capabilities-here.test.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/capabilities-here.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities-here.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/capabilities-here.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/admin/mcp/dist/__tests__/capabilities-here.test.js

@@ -0,0 +1,130 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { resolveCapabilitiesHere } from "../tools/capabilities-here.js";
+function writeFile(path, body) {
+    mkdirSync(join(path, ".."), { recursive: true });
+    writeFileSync(path, body);
+}
+function seedTree(root, spec) {
+    const accountConfigPath = join(root, "accounts", spec.accountId, "account.json");
+    const brandConfigPath = join(root, "platform", "config", "brand.json");
+    const platformRoot = join(root, "platform");
+    const premiumPluginsRoot = join(root, "premium-plugins");
+    const claudeConfigDir = join(root, "claude-config");
+    writeFile(accountConfigPath, JSON.stringify({
+        accountId: spec.accountId,
+        enabledPlugins: spec.enabledPlugins ?? [],
+        tier: spec.tier,
+        adminModel: spec.adminModel,
+        publicModel: spec.publicModel,
+    }));
+    writeFile(brandConfigPath, JSON.stringify({
+        productName: spec.productName,
+        shipsPremiumBundles: spec.shipsPremiumBundles ?? [],
+    }));
+    const specialistsDir = join(platformRoot, "templates", "specialists", "agents");
+    mkdirSync(specialistsDir, { recursive: true });
+    for (const name of spec.platformSpecialists) {
+        writeFileSync(join(specialistsDir, `${name}.md`), `---\nname: ${name}\n---\n`);
+    }
+    for (const [bundle, names] of Object.entries(spec.premiumSpecialists ?? {})) {
+        const dir = join(premiumPluginsRoot, bundle, "agents");
+        mkdirSync(dir, { recursive: true });
+        for (const name of names) {
+            writeFileSync(join(dir, `${name}.md`), `---\nname: ${name}\n---\n`);
+        }
+    }
+    const agentsDir = join(claudeConfigDir, "agents");
+    mkdirSync(agentsDir, { recursive: true });
+    for (const name of spec.registeredAgents ?? []) {
+        writeFileSync(join(agentsDir, `${name}.md`), `---\nname: ${name}\n---\n`);
+    }
+    return {
+        input: {
+            accountId: spec.accountId,
+            accountConfigPath,
+            brandConfigPath,
+            platformRoot,
+            premiumPluginsRoot,
+            claudeConfigDir,
+        },
+    };
+}
+describe("resolveCapabilitiesHere", () => {
+    let root;
+    beforeEach(() => { root = mkdtempSync(join(tmpdir(), "cap-here-")); });
+    afterEach(() => { rmSync(root, { recursive: true, force: true }); });
+    it("returns Maxy install set with no premium bundles", async () => {
+        const { input } = seedTree(root, {
+            accountId: "acct-maxy",
+            enabledPlugins: ["business-assistant", "sales", "teaching"],
+            tier: "pro",
+            adminModel: "claude-opus-4-7",
+            publicModel: "claude-haiku-4-5",
+            productName: "Maxy",
+            shipsPremiumBundles: [],
+            platformSpecialists: ["personal-assistant", "project-manager", "librarian"],
+            registeredAgents: ["plugin:admin:librarian", "plugin:admin:project-manager"],
+        });
+        const result = await resolveCapabilitiesHere(input, "2026-05-31T07:00:00Z");
+        expect(result.accountId).toBe("acct-maxy");
+        expect(result.tier).toBe("pro");
+        expect(result.enabledPlugins).toEqual(["business-assistant", "sales", "teaching"]);
+        expect(result.installedPlatformSpecialists).toEqual(["librarian", "personal-assistant", "project-manager"]);
+        expect(result.installedPremiumSpecialists).toEqual([]);
+        expect(result.registeredAgentTypes).toEqual(["plugin:admin:librarian", "plugin:admin:project-manager"]);
+        expect(result.brand.productName).toBe("Maxy");
+        expect(result.brand.shipsPremiumBundles).toEqual([]);
+        expect(result.capturedAt).toBe("2026-05-31T07:00:00Z");
+    });
+    it("returns Real Agent install set including premium specialists from each shipped bundle", async () => {
+        const { input } = seedTree(root, {
+            accountId: "acct-ra",
+            enabledPlugins: ["loop", "property-data", "estate-sales"],
+            tier: "agency",
+            productName: "Real Agent",
+            shipsPremiumBundles: ["real-agent"],
+            platformSpecialists: ["coding-assistant", "database-operator"],
+            premiumSpecialists: {
+                "real-agent": ["negotiator", "valuer", "compliance", "listing-curator"],
+            },
+            registeredAgents: ["plugin:real-agent:negotiator"],
+        });
+        const result = await resolveCapabilitiesHere(input, "2026-05-31T07:00:00Z");
+        expect(result.brand.productName).toBe("Real Agent");
+        expect(result.brand.shipsPremiumBundles).toEqual(["real-agent"]);
+        expect(result.installedPlatformSpecialists).toEqual(["coding-assistant", "database-operator"]);
+        expect(result.installedPremiumSpecialists).toEqual([
+            { bundle: "real-agent", name: "compliance" },
+            { bundle: "real-agent", name: "listing-curator" },
+            { bundle: "real-agent", name: "negotiator" },
+            { bundle: "real-agent", name: "valuer" },
+        ]);
+        expect(result.registeredAgentTypes).toEqual(["plugin:real-agent:negotiator"]);
+    });
+    it("handles missing fields and missing directories gracefully", async () => {
+        const accountConfigPath = join(root, "account.json");
+        const brandConfigPath = join(root, "brand.json");
+        writeFileSync(accountConfigPath, JSON.stringify({ accountId: "x" }));
+        writeFileSync(brandConfigPath, JSON.stringify({}));
+        const result = await resolveCapabilitiesHere({
+            accountId: "x",
+            accountConfigPath,
+            brandConfigPath,
+            platformRoot: join(root, "absent-platform"),
+            premiumPluginsRoot: join(root, "absent-premium"),
+            claudeConfigDir: join(root, "absent-claude"),
+        }, "2026-05-31T07:00:00Z");
+        expect(result.tier).toBeNull();
+        expect(result.adminModel).toBeNull();
+        expect(result.publicModel).toBeNull();
+        expect(result.enabledPlugins).toEqual([]);
+        expect(result.installedPlatformSpecialists).toEqual([]);
+        expect(result.installedPremiumSpecialists).toEqual([]);
+        expect(result.registeredAgentTypes).toEqual([]);
+        expect(result.brand.productName).toBeNull();
+    });
+});
+//# sourceMappingURL=capabilities-here.test.js.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/capabilities-here.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities-here.test.js","sourceRoot":"","sources":["../../src/__tests__/capabilities-here.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAW/B;IACC,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACjF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC5C,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAEpD,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC;QAC1C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;QACzC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC,CAAC;IACJ,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC;QACxC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,EAAE;KACpD,CAAC,CAAC,CAAC;IACJ,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IAChF,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,KAAK,CAAC,EAAE,cAAc,IAAI,SAAS,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,EAAE,cAAc,IAAI,SAAS,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAClD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAC/C,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,KAAK,CAAC,EAAE,cAAc,IAAI,SAAS,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB;YACjB,eAAe;YACf,YAAY;YACZ,kBAAkB;YAClB,eAAe;SAChB;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAI,IAAY,CAAC;IACjB,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,SAAS,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErE,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE;YAC/B,SAAS,EAAE,WAAW;YACtB,cAAc,EAAE,CAAC,oBAAoB,EAAE,OAAO,EAAE,UAAU,CAAC;YAC3D,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,iBAAiB;YAC7B,WAAW,EAAE,kBAAkB;YAC/B,WAAW,EAAE,MAAM;YACnB,mBAAmB,EAAE,EAAE;YACvB,mBAAmB,EAAE,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,WAAW,CAAC;YAC3E,gBAAgB,EAAE,CAAC,wBAAwB,EAAE,8BAA8B,CAAC;SAC7E,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QACnF,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC5G,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,wBAAwB,EAAE,8BAA8B,CAAC,CAAC,CAAC;QACxG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE;YAC/B,SAAS,EAAE,SAAS;YACpB,cAAc,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,cAAc,CAAC;YACzD,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,YAAY;YACzB,mBAAmB,EAAE,CAAC,YAAY,CAAC;YACnC,mBAAmB,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;YAC9D,kBAAkB,EAAE;gBAClB,YAAY,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,iBAAiB,CAAC;aACxE;YACD,gBAAgB,EAAE,CAAC,8BAA8B,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,OAAO,CAAC;YACjD,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE;YAC5C,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE;YACjD,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE;YAC5C,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACrD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACjD,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACrE,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C;YACE,SAAS,EAAE,GAAG;YACd,iBAAiB;YACjB,eAAe;YACf,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAC3C,kBAAkB,EAAE,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAChD,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;SAC7C,EACD,sBAAsB,CACvB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}