@rubytech/create-maxy-code 0.1.216 → 0.1.219

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.216",
+  "version": "0.1.219",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/mcp-eager/dist/index.d.ts

@@ -20,41 +20,6 @@
  */
 /** Wire-format metadata key the Claude Code SDK reads. */
 export declare const ALWAYS_LOAD_META_KEY: "anthropic/alwaysLoad";
-/**
- * Admin-seat detection. The rc-daemon exports `MAXY_SESSION_ROLE=admin` and
- * `MAXY_SPECIALIST=""` for the orchestrator process and its MCP plugin
- * children; specialist spawns set `MAXY_SPECIALIST=<name>`. A plugin process
- * inheriting the env can therefore decide at registration AND invocation
- * time whether it is loaded inside the admin seat.
- *
- * Mirrors `isAdminSeat` in platform/plugins/admin/mcp/src/skill-resolution.ts
- * — this is a duplicate at the library layer so plugins that cannot import
- * from the admin plugin (a sibling, not a dependency) share the same rule.
- */
-export declare function isAdminSeat(env?: NodeJS.ProcessEnv): boolean;
-/**
- * MCP refusal envelope returned when the admin seat invokes a specialist-
- * owned tool. The text names the dispatch route so the model's next action
- * is the `Agent` dispatch rather than a dead end.
- */
-export declare function adminBlockedResponse(toolName: string, owner: string): {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: true;
-};
-/**
- * Wrap a tool handler so any admin-seat invocation short-circuits with the
- * refusal envelope above and emits one `[admin-tool-gate]` line to stderr.
- *
- * Specialist seats pass through unchanged: this is the primitive Task 529
- * defines for closing the in-message authoring path that Task 516 could
- * not reach. The handler signature is preserved so existing call sites
- * substitute `eagerTool(... handler)` for `eagerTool(... withAdminGate(name,
- * owner, handler))` mechanically.
- */
-export declare function withAdminGate<H extends (...args: any[]) => any>(toolName: string, owner: string, handler: H): H;
 /**
  * Loose structural type for any object exposing a `registerTool` method. The
  * MCP SDK ships dual ESM/CJS packages with conditional exports, so importing
@@ -92,25 +57,5 @@ type LocalZodRawShape = Record<string, unknown>;
  * the consumer's own zod version) infers the handler args.
  */
 export declare function eagerTool<Args extends LocalZodRawShape>(server: EagerCapableServer, name: string, description: string, inputSchema: Args, handler: (...args: any[]) => any): void;
-/**
- * Loose structural type for the legacy four-arg `server.tool(name, desc,
- * schema, handler)` call shape — used when the admin seat must register a
- * specialist-owned tool as deferred (not eager) so it does not appear in
- * the admin's eager tool list.
- */
-type DeferredCapableServer = {
-    tool: (name: string, description: string, inputSchema: any, handler: (...args: any[]) => any) => any;
-};
-/**
- * Register a tool that is eager for specialists but deferred + admin-gated
- * for the admin seat. The owning specialist name is named here so the
- * refusal envelope (and the `[admin-tool-gate]` log line) carries it.
- *
- * Use for every tool whose owner is a specialist (database-operator, writer-
- * craft, research-assistant, personal-assistant, content-producer). The
- * admin seat sees the tool only via ToolSearch — and any invocation from the
- * admin seat refuses with the dispatch hint.
- */
-export declare function eagerToolGated<Args extends LocalZodRawShape>(server: EagerCapableServer & DeferredCapableServer, name: string, owner: string, description: string, inputSchema: Args, handler: (...args: any[]) => any): void;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/mcp-eager/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,EAAG,sBAA+B,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IACrE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1C,OAAO,EAAE,IAAI,CAAC;CACf,CAYA;AAED;;;;;;;;;GASG;AAEH,wBAAgB,aAAa,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAC7D,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,CAAC,GACT,CAAC,CAYH;AAED;;;;;;;GAOG;AAEH,KAAK,kBAAkB,GAAG;IAAE,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,SAAS,gBAAgB,EACrD,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,IAAI,EAEjB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAC/B,IAAI,CAUN;AAED;;;;;GAKG;AAEH,KAAK,qBAAqB,GAAG;IAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,KAAK,GAAG,CAAA;CAAE,CAAC;AAEtI;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,SAAS,gBAAgB,EAC1D,MAAM,EAAE,kBAAkB,GAAG,qBAAqB,EAClD,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,IAAI,EAEjB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAC/B,IAAI,CAMN"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,EAAG,sBAA+B,CAAC;AAEpE;;;;;;;GAOG;AAEH,KAAK,kBAAkB,GAAG;IAAE,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,SAAS,gBAAgB,EACrD,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,IAAI,EAEjB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAC/B,IAAI,CAUN"}

package/payload/platform/lib/mcp-eager/dist/index.js

@@ -1,11 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ALWAYS_LOAD_META_KEY = void 0;
-exports.isAdminSeat = isAdminSeat;
-exports.adminBlockedResponse = adminBlockedResponse;
-exports.withAdminGate = withAdminGate;
 exports.eagerTool = eagerTool;
-exports.eagerToolGated = eagerToolGated;
 /**
  * MCP eager-load helper.
  *
@@ -28,59 +24,6 @@ exports.eagerToolGated = eagerToolGated;
  */
 /** Wire-format metadata key the Claude Code SDK reads. */
 exports.ALWAYS_LOAD_META_KEY = "anthropic/alwaysLoad";
-/**
- * Admin-seat detection. The rc-daemon exports `MAXY_SESSION_ROLE=admin` and
- * `MAXY_SPECIALIST=""` for the orchestrator process and its MCP plugin
- * children; specialist spawns set `MAXY_SPECIALIST=<name>`. A plugin process
- * inheriting the env can therefore decide at registration AND invocation
- * time whether it is loaded inside the admin seat.
- *
- * Mirrors `isAdminSeat` in platform/plugins/admin/mcp/src/skill-resolution.ts
- * — this is a duplicate at the library layer so plugins that cannot import
- * from the admin plugin (a sibling, not a dependency) share the same rule.
- */
-function isAdminSeat(env = process.env) {
-    return env.MAXY_SESSION_ROLE === "admin" && !(env.MAXY_SPECIALIST && env.MAXY_SPECIALIST.length > 0);
-}
-/**
- * MCP refusal envelope returned when the admin seat invokes a specialist-
- * owned tool. The text names the dispatch route so the model's next action
- * is the `Agent` dispatch rather than a dead end.
- */
-function adminBlockedResponse(toolName, owner) {
-    return {
-        content: [
-            {
-                type: "text",
-                text: `Tool \`${toolName}\` is owned by the \`${owner}\` specialist and is not callable from the admin seat. ` +
-                    `Dispatch \`${owner}\` with the Agent tool and pass the work as the brief.`,
-            },
-        ],
-        isError: true,
-    };
-}
-/**
- * Wrap a tool handler so any admin-seat invocation short-circuits with the
- * refusal envelope above and emits one `[admin-tool-gate]` line to stderr.
- *
- * Specialist seats pass through unchanged: this is the primitive Task 529
- * defines for closing the in-message authoring path that Task 516 could
- * not reach. The handler signature is preserved so existing call sites
- * substitute `eagerTool(... handler)` for `eagerTool(... withAdminGate(name,
- * owner, handler))` mechanically.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function withAdminGate(toolName, owner, handler) {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const wrapped = ((...args) => {
-        if (isAdminSeat(process.env)) {
-            process.stderr.write(`[admin-tool-gate] role=admin tool=${toolName} decision=block reason=specialist-owned owner=${owner}\n`);
-            return adminBlockedResponse(toolName, owner);
-        }
-        return handler(...args);
-    });
-    return wrapped;
-}
 /**
  * Register an MCP tool that the Claude Code SDK eager-loads into the
  * model's prompt at session boot, bypassing the ToolSearch round-trip.
@@ -103,23 +46,4 @@ handler) {
         _meta: { [exports.ALWAYS_LOAD_META_KEY]: true },
     }, handler);
 }
-/**
- * Register a tool that is eager for specialists but deferred + admin-gated
- * for the admin seat. The owning specialist name is named here so the
- * refusal envelope (and the `[admin-tool-gate]` log line) carries it.
- *
- * Use for every tool whose owner is a specialist (database-operator, writer-
- * craft, research-assistant, personal-assistant, content-producer). The
- * admin seat sees the tool only via ToolSearch — and any invocation from the
- * admin seat refuses with the dispatch hint.
- */
-function eagerToolGated(server, name, owner, description, inputSchema, 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-handler) {
-    if (isAdminSeat(process.env)) {
-        server.tool(name, description, inputSchema, withAdminGate(name, owner, handler));
-        return;
-    }
-    eagerTool(server, name, description, inputSchema, handler);
-}
 //# sourceMappingURL=index.js.map

package/payload/platform/lib/mcp-eager/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAkCA,kCAEC;AAOD,oDAeC;AAaD,sCAgBC;AAuCD,8BAiBC;AAqBD,wCAcC;AAlLD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,0DAA0D;AAC7C,QAAA,oBAAoB,GAAG,sBAA+B,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,SAAgB,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,OAAO,GAAG,CAAC,iBAAiB,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,QAAgB,EAAE,KAAa;IAIlE,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EACF,UAAU,QAAQ,wBAAwB,KAAK,yDAAyD;oBACxG,cAAc,KAAK,wDAAwD;aAC9E;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,8DAA8D;AAC9D,SAAgB,aAAa,CAC3B,QAAgB,EAChB,KAAa,EACb,OAAU;IAEV,8DAA8D;IAC9D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,IAAW,EAAE,EAAE;QAClC,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC,QAAQ,iDAAiD,KAAK,IAAI,CACxG,CAAC;YACF,OAAO,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAiB,CAAC;IACnB,OAAO,OAAO,CAAC;AACjB,CAAC;AA0BD;;;;;;;;;;;;GAYG;AACH,SAAgB,SAAS,CACvB,MAA0B,EAC1B,IAAY,EACZ,WAAmB,EACnB,WAAiB;AACjB,8DAA8D;AAC9D,OAAgC;IAEhC,MAAM,CAAC,YAAY,CACjB,IAAI,EACJ;QACE,WAAW;QACX,WAAW;QACX,KAAK,EAAE,EAAE,CAAC,4BAAoB,CAAC,EAAE,IAAI,EAAE;KACxC,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAWD;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAC5B,MAAkD,EAClD,IAAY,EACZ,KAAa,EACb,WAAmB,EACnB,WAAiB;AACjB,8DAA8D;AAC9D,OAAgC;IAEhC,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AA4DA,8BAiBC;AA7ED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,0DAA0D;AAC7C,QAAA,oBAAoB,GAAG,sBAA+B,CAAC;AA0BpE;;;;;;;;;;;;GAYG;AACH,SAAgB,SAAS,CACvB,MAA0B,EAC1B,IAAY,EACZ,WAAmB,EACnB,WAAiB;AACjB,8DAA8D;AAC9D,OAAgC;IAEhC,MAAM,CAAC,YAAY,CACjB,IAAI,EACJ;QACE,WAAW;QACX,WAAW;QACX,KAAK,EAAE,EAAE,CAAC,4BAAoB,CAAC,EAAE,IAAI,EAAE;KACxC,EACD,OAAO,CACR,CAAC;AACJ,CAAC"}

package/payload/platform/lib/mcp-eager/src/index.ts

@@ -21,72 +21,6 @@
 /** Wire-format metadata key the Claude Code SDK reads. */
 export const ALWAYS_LOAD_META_KEY = "anthropic/alwaysLoad" as const;
 
-/**
- * Admin-seat detection. The rc-daemon exports `MAXY_SESSION_ROLE=admin` and
- * `MAXY_SPECIALIST=""` for the orchestrator process and its MCP plugin
- * children; specialist spawns set `MAXY_SPECIALIST=<name>`. A plugin process
- * inheriting the env can therefore decide at registration AND invocation
- * time whether it is loaded inside the admin seat.
- *
- * Mirrors `isAdminSeat` in platform/plugins/admin/mcp/src/skill-resolution.ts
- * — this is a duplicate at the library layer so plugins that cannot import
- * from the admin plugin (a sibling, not a dependency) share the same rule.
- */
-export function isAdminSeat(env: NodeJS.ProcessEnv = process.env): boolean {
-  return env.MAXY_SESSION_ROLE === "admin" && !(env.MAXY_SPECIALIST && env.MAXY_SPECIALIST.length > 0);
-}
-
-/**
- * MCP refusal envelope returned when the admin seat invokes a specialist-
- * owned tool. The text names the dispatch route so the model's next action
- * is the `Agent` dispatch rather than a dead end.
- */
-export function adminBlockedResponse(toolName: string, owner: string): {
-  content: { type: "text"; text: string }[];
-  isError: true;
-} {
-  return {
-    content: [
-      {
-        type: "text",
-        text:
-          `Tool \`${toolName}\` is owned by the \`${owner}\` specialist and is not callable from the admin seat. ` +
-          `Dispatch \`${owner}\` with the Agent tool and pass the work as the brief.`,
-      },
-    ],
-    isError: true,
-  };
-}
-
-/**
- * Wrap a tool handler so any admin-seat invocation short-circuits with the
- * refusal envelope above and emits one `[admin-tool-gate]` line to stderr.
- *
- * Specialist seats pass through unchanged: this is the primitive Task 529
- * defines for closing the in-message authoring path that Task 516 could
- * not reach. The handler signature is preserved so existing call sites
- * substitute `eagerTool(... handler)` for `eagerTool(... withAdminGate(name,
- * owner, handler))` mechanically.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export function withAdminGate<H extends (...args: any[]) => any>(
-  toolName: string,
-  owner: string,
-  handler: H,
-): H {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const wrapped = ((...args: any[]) => {
-    if (isAdminSeat(process.env)) {
-      process.stderr.write(
-        `[admin-tool-gate] role=admin tool=${toolName} decision=block reason=specialist-owned owner=${owner}\n`,
-      );
-      return adminBlockedResponse(toolName, owner);
-    }
-    return handler(...args);
-  }) as unknown as H;
-  return wrapped;
-}
-
 /**
  * Loose structural type for any object exposing a `registerTool` method. The
  * MCP SDK ships dual ESM/CJS packages with conditional exports, so importing
@@ -142,38 +76,3 @@ export function eagerTool<Args extends LocalZodRawShape>(
     handler,
   );
 }
-
-/**
- * Loose structural type for the legacy four-arg `server.tool(name, desc,
- * schema, handler)` call shape — used when the admin seat must register a
- * specialist-owned tool as deferred (not eager) so it does not appear in
- * the admin's eager tool list.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-type DeferredCapableServer = { tool: (name: string, description: string, inputSchema: any, handler: (...args: any[]) => any) => any };
-
-/**
- * Register a tool that is eager for specialists but deferred + admin-gated
- * for the admin seat. The owning specialist name is named here so the
- * refusal envelope (and the `[admin-tool-gate]` log line) carries it.
- *
- * Use for every tool whose owner is a specialist (database-operator, writer-
- * craft, research-assistant, personal-assistant, content-producer). The
- * admin seat sees the tool only via ToolSearch — and any invocation from the
- * admin seat refuses with the dispatch hint.
- */
-export function eagerToolGated<Args extends LocalZodRawShape>(
-  server: EagerCapableServer & DeferredCapableServer,
-  name: string,
-  owner: string,
-  description: string,
-  inputSchema: Args,
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  handler: (...args: any[]) => any,
-): void {
-  if (isAdminSeat(process.env)) {
-    server.tool(name, description, inputSchema, withAdminGate(name, owner, handler));
-    return;
-  }
-  eagerTool(server, name, description, inputSchema, handler);
-}

package/payload/platform/plugins/admin/hooks/__tests__/hook-emit-stale-lock-ttl.test.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# Task 569 — stale-lockdir TTL reclamation in _hook_acquire_lock and
+# _drain_acquire_lock. A backdated lockdir is force-removed on acquire;
+# a freshly held lockdir is not.
+set -u
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+LIB="$ROOT/lib/hook-emit.sh"
+DRAIN="$ROOT/post-tool-use-agent.sh"
+[[ -f "$LIB" ]] || { echo "FAIL: $LIB missing"; exit 1; }
+[[ -f "$DRAIN" ]] || { echo "FAIL: $DRAIN missing"; exit 1; }
+
+TMP=$(mktemp -d)
+export MAXY_HOOK_BUFFER_DIR="$TMP/buffers"
+export MAXY_HOOK_SERVER_LOG="$TMP/server.log"
+# Tight test budget — 20 × 10ms = 200ms ceiling so the negative case
+# returns quickly.
+export MAXY_HOOK_LOCK_ATTEMPTS=20
+export MAXY_HOOK_LOCK_SLEEP=0.01
+export MAXY_HOOK_LOCK_TTL_SECONDS=2
+mkdir -p "$MAXY_HOOK_BUFFER_DIR"
+
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "PASS: $1"; }
+fail() { FAIL=$((FAIL+1)); echo "FAIL: $1" >&2; }
+
+# shellcheck disable=SC1090
+source "$LIB" || { fail "source library"; exit 1; }
+pass "source library"
+
+# Test 1: a stale lockdir (mtime backdated 10s; TTL=2s) is reclaimed and
+# acquire succeeds.
+LOCK1="$TMP/lock-stale"
+mkdir "$LOCK1"
+# Backdate mtime by 10s. -t needs YYYYMMDDhhmm.SS form; portable form
+# uses -d on GNU and -A/-r on BSD, so we use python to set it.
+python3 -c "import os,time; os.utime('$LOCK1', (time.time()-10, time.time()-10))"
+if _hook_acquire_lock "$LOCK1"; then
+  pass "stale lockdir reclaimed (emit-path)"
+else
+  fail "stale lockdir not reclaimed within budget (emit-path)"
+fi
+# Verify observability line.
+if grep -q "\[hook-propagate-error\] reason=stale-lock-reclaimed lockdir=$LOCK1" "$MAXY_HOOK_SERVER_LOG"; then
+  pass "stale-lock-reclaimed observability line emitted"
+else
+  fail "stale-lock-reclaimed line missing from server.log"
+fi
+rmdir "$LOCK1" 2>/dev/null || true
+
+# Test 2: a fresh lockdir (mtime = now) is NOT reclaimed and acquire
+# returns 1 within the attempt budget.
+LOCK2="$TMP/lock-fresh"
+mkdir "$LOCK2"
+START=$(date +%s)
+if _hook_acquire_lock "$LOCK2"; then
+  fail "fresh lockdir wrongly reclaimed (emit-path)"
+else
+  END=$(date +%s)
+  pass "fresh lockdir not reclaimed; acquire timed out (emit-path, ${END}-${START}s)"
+fi
+# Verify no stale-lock-reclaimed line was written for LOCK2.
+if grep -q "lockdir=$LOCK2 ageSeconds=" "$MAXY_HOOK_SERVER_LOG"; then
+  fail "fresh lockdir wrongly logged as stale (emit-path)"
+else
+  pass "no stale-lock log for fresh lockdir (emit-path)"
+fi
+rmdir "$LOCK2" 2>/dev/null || true
+
+# Test 3: same property for the drainer-side function. Extract
+# _drain_acquire_lock + its age helper from post-tool-use-agent.sh and
+# source them in isolation.
+DRAIN_LIB="$TMP/drain-lock.sh"
+awk '
+  /^_drain_lockdir_age_seconds\(\)/,/^}/ { print; next }
+  /^_drain_acquire_lock\(\)/,/^}/ { print; next }
+' "$DRAIN" > "$DRAIN_LIB"
+[[ -s "$DRAIN_LIB" ]] || { fail "drain lock extract empty"; }
+# shellcheck disable=SC1090
+source "$DRAIN_LIB" || fail "source drain lib"
+
+LOCK3="$TMP/lock-drain-stale"
+mkdir "$LOCK3"
+python3 -c "import os,time; os.utime('$LOCK3', (time.time()-10, time.time()-10))"
+if _drain_acquire_lock "$LOCK3"; then
+  pass "stale lockdir reclaimed (drain-path)"
+else
+  fail "stale lockdir not reclaimed (drain-path)"
+fi
+
+LOCK4="$TMP/lock-drain-fresh"
+mkdir "$LOCK4"
+if _drain_acquire_lock "$LOCK4"; then
+  fail "fresh lockdir wrongly reclaimed (drain-path)"
+else
+  pass "fresh lockdir not reclaimed; acquire timed out (drain-path)"
+fi
+
+rm -rf "$TMP"
+echo "----"
+echo "$PASS pass, $FAIL fail"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/__tests__/pre-tool-use-admin-tool-gate.test.sh

@@ -1,17 +1,17 @@
 #!/usr/bin/env bash
-# Task 529 — admin-tool-gate enforces orchestration-only at the PreToolUse
-# hook. Admin-direct invocations of Write/Edit/MultiEdit/Bash/WebFetch/
-# WebSearch are refused with the dispatch hint; subagents pass through.
+# Task 571 — the orchestration-only block has been removed. Admin's standard
+# tool surface (Write/Edit/MultiEdit/Bash/WebFetch/WebSearch) is callable
+# directly from the admin seat; delegation is a doctrine bias enforced in
+# IDENTITY.md, not a platform refusal. This test pins the post-571 contract:
 #
-# Task 559 — discriminator is `parent_tool_use_id` from the Claude Code
-# hook input. Non-empty → in-window Task subagent (allow).
+#   - Admin-direct Bash/Edit/Write/WebFetch all return exit 0 with no
+#     `reason=orchestration-only` or `reason=specialist-owned` line.
+#   - The resource-specific hook blocks (code-dir, entitlement, account.json,
+#     pending-actions, base64-guard, approval-queue) are unaffected and live
+#     in their own dedicated tests.
 #
-# Task 566 — discriminator extended to `$MAXY_SPECIALIST` for maxy MCP
-# `Agent`-spawned specialists (separate top-level `claude rc` processes
-# with no `parent_tool_use_id` but `MAXY_SPECIALIST=<name>` on env, set
-# by pty-spawner.ts:1601). Calls with neither marker AND no
-# `MAXY_SESSION_ROLE=admin` fail closed with `reason=missing-marker` so a
-# future spawn shape cannot silently regress.
+# Reintroducing the orchestration-only block requires a doctrine flip — this
+# test fails first and surfaces the change loudly.
 
 set -u
 
@@ -33,135 +33,75 @@ PASS=0; FAIL=0
 pass() { PASS=$((PASS+1)); echo "PASS: $1"; }
 fail() { FAIL=$((FAIL+1)); echo "FAIL: $1" >&2; }
 
-# The hook receives the parent session's transcript_path even on subagent
-# calls in Claude Code 2.1.x. The fixture mirrors production.
 SESSION_TRANSCRIPT="/tmp/sess/44283ae1-2b82-4bd7-b8af-99a11141ed4b.jsonl"
-SUBAGENT_PARENT_ID="toolu_01QFC4W32wFUyHy6WJMNjHf6"
 
-# run <tool> <parent_id> <expected_rc> <expected_pattern> <label>
-# Env knobs (default mirror production admin spawn):
-#   MAXY_SESSION_ROLE_OVERRIDE — defaults to "admin"; set empty to drop the role
-#   MAXY_SPECIALIST_OVERRIDE   — defaults to empty; set to a name to simulate
-#                                an MCP-Agent-spawned specialist
-run() {
-  local tool="$1" parent_id="$2" expected_rc="$3" expected_pattern="$4" label="$5"
-  local role="${MAXY_SESSION_ROLE_OVERRIDE-admin}"
-  local specialist="${MAXY_SPECIALIST_OVERRIDE-}"
+# run_admin_direct <tool> <expected_rc> <label>
+#   Pipes a minimal PreToolUse payload to the hook with MAXY_SESSION_ROLE=admin
+#   (the realistic admin spawn shape) and asserts the rc and that no
+#   orchestration-only / specialist-owned refusal line appears on stderr.
+run_admin_direct() {
+  local tool="$1" expected_rc="$2" label="$3"
   local input_json
   input_json=$(python3 -c '
 import json, sys
-payload = {
+print(json.dumps({
     "hook_event_name": "PreToolUse",
     "tool_name": sys.argv[1],
-    "tool_input": {"file_path": "/tmp/x", "content": "x", "command": "echo hi"},
+    "tool_input": {"file_path": "/tmp/x", "content": "x", "command": "echo hi", "url": "https://example.com"},
     "transcript_path": sys.argv[2],
-}
-parent = sys.argv[3]
-if parent:
-    payload["parent_tool_use_id"] = parent
-print(json.dumps(payload, separators=(",", ":")))
-' "$tool" "$SESSION_TRANSCRIPT" "$parent_id")
+}, separators=(",", ":")))
+' "$tool" "$SESSION_TRANSCRIPT")
   local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
   local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
   printf '%s' "$input_json" | \
-    env -u MAXY_SESSION_ROLE -u MAXY_SPECIALIST \
-      MAXY_SESSION_ROLE="$role" MAXY_SPECIALIST="$specialist" \
+    env -u MAXY_SPECIALIST MAXY_SESSION_ROLE=admin \
       bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
   local rc=$?
   if [[ "$rc" -ne "$expected_rc" ]]; then
     fail "$label: expected exit $expected_rc, got $rc. Stderr: $(cat "$stderr_file")"
     return
   fi
-  if [[ -n "$expected_pattern" ]] && ! grep -qE "$expected_pattern" "$stderr_file"; then
-    fail "$label: stderr missing pattern '$expected_pattern'. Got: $(cat "$stderr_file")"
+  if grep -qE 'reason=orchestration-only|reason=specialist-owned|reason=missing-marker' "$stderr_file"; then
+    fail "$label: stderr carries a removed-gate reason line. Got: $(cat "$stderr_file")"
     return
   fi
   pass "$label"
 }
 
-# ── Admin-direct refusals (no parent_tool_use_id, no MAXY_SPECIALIST, role=admin) ───
-run Write     "" 2 '\[admin-tool-gate\] role=admin parent_tool_use_id=- specialist=- session_role=admin tool=Write decision=block.*owner=content-producer' \
-  "Test 1: admin-direct Write rejected with content-producer dispatch hint"
-run Edit      "" 2 '\[admin-tool-gate\] role=admin .*tool=Edit decision=block.*owner=content-producer' \
-  "Test 2: admin-direct Edit rejected"
-run MultiEdit "" 2 '\[admin-tool-gate\] role=admin .*tool=MultiEdit decision=block.*owner=content-producer' \
-  "Test 3: admin-direct MultiEdit rejected"
-run Bash      "" 2 '\[admin-tool-gate\] role=admin .*tool=Bash decision=block' \
-  "Test 4: admin-direct Bash rejected"
-run WebFetch  "" 2 '\[admin-tool-gate\] role=admin .*tool=WebFetch decision=block.*owner=research-assistant' \
-  "Test 5: admin-direct WebFetch rejected"
-run WebSearch "" 2 '\[admin-tool-gate\] role=admin .*tool=WebSearch decision=block.*owner=research-assistant' \
-  "Test 6: admin-direct WebSearch rejected"
-
-# ── In-window subagent passthrough (parent_tool_use_id non-empty) ───────
-run Write     "$SUBAGENT_PARENT_ID" 0 "\[admin-tool-gate\] role=subagent parent_tool_use_id=${SUBAGENT_PARENT_ID} .*tool=Write decision=allow" \
-  "Test 7: subagent Write passes through"
-run Edit      "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=Edit decision=allow' \
-  "Test 8: subagent Edit passes through"
-run Bash      "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=Bash decision=allow' \
-  "Test 9: subagent Bash passes through (Task 559 regression — coding-assistant git pull)"
-run WebFetch  "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=WebFetch decision=allow' \
-  "Test 10: subagent WebFetch passes through"
-run MultiEdit "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=MultiEdit decision=allow' \
-  "Test 11: subagent MultiEdit passes through"
-
-# ── Unrelated tools untouched ───────────────────────────────────────────
-run Read      "" 0 '' \
-  "Test 12: admin-direct Read passes (Read is admin-keep-list)"
-
-# ── Task 560: admin-direct block emits propagation record ──────────────
-# Admin-direct path: MAXY_SESSION_ROLE=admin, no MAXY_SPECIALIST, no parent.
-PROP_TMPDIR=$(mktemp -d); TMPFILES+=("$PROP_TMPDIR")
-export MAXY_HOOK_BUFFER_DIR="$PROP_TMPDIR/buffers"
-export MAXY_HOOK_SERVER_LOG="$PROP_TMPDIR/server.log"
-SESSION="task560-test-sess"
-PROP_INPUT=$(python3 -c '
+# ── Admin-direct passthrough (the Task 571 regression boundary) ──────────
+run_admin_direct Bash      0 "Test 1: admin-direct Bash passes through"
+run_admin_direct Edit      0 "Test 2: admin-direct Edit passes through (path /tmp/x is outside protected dirs)"
+run_admin_direct Write     0 "Test 3: admin-direct Write passes through"
+run_admin_direct MultiEdit 0 "Test 4: admin-direct MultiEdit passes through"
+run_admin_direct WebFetch  0 "Test 5: admin-direct WebFetch passes through"
+run_admin_direct WebSearch 0 "Test 6: admin-direct WebSearch passes through"
+run_admin_direct Read      0 "Test 7: admin-direct Read passes through"
+
+# ── Resource-specific blocks unaffected: protected code-dir Write still refuses ──
+# Verifies the deletion was surgical — code-dir-protection-ui still fires.
+PROTECTED_INPUT=$(python3 -c '
 import json, sys
-print(json.dumps({"hook_event_name":"PreToolUse","tool_name":"Bash",
-  "tool_input":{"command":"ls"},"transcript_path":sys.argv[1],
-  "session_id":sys.argv[2]}, separators=(",",":")))
-' "$SESSION_TRANSCRIPT" "$SESSION")
-printf '%s' "$PROP_INPUT" | \
+print(json.dumps({
+    "hook_event_name": "PreToolUse",
+    "tool_name": "Write",
+    "tool_input": {"file_path": "/srv/maxy/platform/ui/app/page.tsx", "content": "x"},
+    "transcript_path": sys.argv[1],
+}, separators=(",", ":")))
+' "$SESSION_TRANSCRIPT")
+PROT_STDOUT=$(mktemp); TMPFILES+=("$PROT_STDOUT")
+PROT_STDERR=$(mktemp); TMPFILES+=("$PROT_STDERR")
+printf '%s' "$PROTECTED_INPUT" | \
   env -u MAXY_SPECIALIST MAXY_SESSION_ROLE=admin \
-    bash "$HOOK" admin >/dev/null 2>/dev/null
-BUF="$MAXY_HOOK_BUFFER_DIR/$SESSION.jsonl"
-if [[ -f "$BUF" ]] && grep -q '"hookName":"admin-tool-gate"' "$BUF" \
-   && grep -q '"decision":"block"' "$BUF" \
-   && grep -q '"reason":"orchestration-only"' "$BUF"; then
-  pass "Test 13b: admin-direct Bash block emits Task 560 propagation record"
+    bash "$HOOK" admin >"$PROT_STDOUT" 2>"$PROT_STDERR"
+PROT_RC=$?
+if [[ "$PROT_RC" -eq 2 ]] && grep -q 'cannot modify platform UI source' "$PROT_STDERR"; then
+  pass "Test 8: admin-direct Write to platform/ui/ still blocked (resource-specific block intact)"
 else
-  fail "Test 13b: propagation record missing/malformed — $(cat "$BUF" 2>/dev/null || echo '<no buffer>')"
+  fail "Test 8: expected platform/ui code-dir block, got rc=$PROT_RC stdout=$(cat "$PROT_STDOUT") stderr=$(cat "$PROT_STDERR")"
 fi
-unset MAXY_HOOK_BUFFER_DIR MAXY_HOOK_SERVER_LOG
-
-# ── Task 566: maxy-MCP-Agent-spawned specialist passthrough ────────────
-# MCP-Agent specialists are separate top-level claude rc processes with no
-# parent_tool_use_id; pty-spawner stamps MAXY_SPECIALIST=<name> on the env.
-MAXY_SPECIALIST_OVERRIDE=content-producer \
-run Edit "" 0 '\[admin-tool-gate\] role=subagent .*specialist=content-producer .*tool=Edit decision=allow source=mcp-specialist' \
-  "Test 14: mcp-specialist Edit passes through (Task 566)"
-
-MAXY_SPECIALIST_OVERRIDE=coding-assistant \
-run Bash "" 0 '\[admin-tool-gate\] role=subagent .*specialist=coding-assistant .*tool=Bash decision=allow source=mcp-specialist' \
-  "Test 15: mcp-specialist Bash passes through (Task 559 regression class)"
-
-MAXY_SPECIALIST_OVERRIDE=research-assistant \
-run WebFetch "" 0 '\[admin-tool-gate\] role=subagent .*specialist=research-assistant .*tool=WebFetch decision=allow source=mcp-specialist' \
-  "Test 16: mcp-specialist WebFetch passes through"
-
-# ── Task 566: missing-marker fail-closed ───────────────────────────────
-# No parent_tool_use_id, no MAXY_SPECIALIST, MAXY_SESSION_ROLE not 'admin'.
-MAXY_SESSION_ROLE_OVERRIDE="" MAXY_SPECIALIST_OVERRIDE="" \
-run Edit "" 2 '\[admin-tool-gate\] role=unknown .*tool=Edit decision=block reason=missing-marker' \
-  "Test 17: missing-marker fail-closed (no positive role marker)"
-
-# ── Task 566: combined parent_tool_use_id + MAXY_SPECIALIST is also subagent ──
-MAXY_SPECIALIST_OVERRIDE=database-operator \
-run Bash "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*specialist=database-operator .*tool=Bash decision=allow source=task-subagent\+mcp-specialist' \
-  "Test 18: combined parent + specialist resolves as task-subagent+mcp-specialist"
 
 echo
-echo "──────── pre-tool-use admin-tool-gate test summary ────────"
+echo "──────── pre-tool-use admin-tool-gate test summary (post-Task 571) ────────"
 echo "PASS: $PASS"
 echo "FAIL: $FAIL"
 

package/payload/platform/plugins/admin/hooks/lib/hook-emit.sh

@@ -14,11 +14,39 @@
 # (tests) without flock(1).
 : "${MAXY_HOOK_LOCK_ATTEMPTS:=100}"
 : "${MAXY_HOOK_LOCK_SLEEP:=0.01}"
+# Task 569 — TTL for orphaned lockdirs left behind when a holder dies
+# between `mkdir lock` and `rmdir lock` (SIGKILL, OOM, systemd restart).
+# Default 5s is far longer than the legitimate hold (microseconds for a
+# rename or append) and shorter than operator-noticeable propagation lag.
+: "${MAXY_HOOK_LOCK_TTL_SECONDS:=5}"
+
+# _hook_lockdir_age_seconds <lockdir> — prints integer age in seconds, or
+# -1 if the lockdir cannot be stat'd. Portable across Linux (`stat -c`)
+# and macOS (`stat -f`).
+_hook_lockdir_age_seconds() {
+  local lockdir="$1" mtime now
+  mtime=$(stat -c %Y "$lockdir" 2>/dev/null || stat -f %m "$lockdir" 2>/dev/null)
+  [[ -z "$mtime" ]] && { echo -1; return; }
+  now=$(date +%s)
+  echo $((now - mtime))
+}
 
 # _hook_acquire_lock <lockdir> — returns 0 on success, 1 on timeout.
+# On each mkdir failure, if the lockdir is older than
+# MAXY_HOOK_LOCK_TTL_SECONDS, the orphaned holder is presumed dead: the
+# lockdir is force-removed, a stale-lock-reclaimed observability line is
+# emitted, and one mkdir retry is attempted before resuming the spin.
 _hook_acquire_lock() {
-  local lockdir="$1" i=0
+  local lockdir="$1" i=0 age
   while ! mkdir "$lockdir" 2>/dev/null; do
+    age=$(_hook_lockdir_age_seconds "$lockdir")
+    if [[ "$age" -ge "$MAXY_HOOK_LOCK_TTL_SECONDS" ]]; then
+      rmdir "$lockdir" 2>/dev/null || rm -rf "$lockdir" 2>/dev/null
+      mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
+      printf '[hook-propagate-error] reason=stale-lock-reclaimed lockdir=%s ageSeconds=%s\n' \
+        "$lockdir" "$age" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
+      mkdir "$lockdir" 2>/dev/null && return 0
+    fi
     i=$((i+1))
     [[ "$i" -ge "$MAXY_HOOK_LOCK_ATTEMPTS" ]] && return 1
     sleep "$MAXY_HOOK_LOCK_SLEEP" 2>/dev/null || true