@rubytech/create-maxy-code 0.1.216 → 0.1.221

package/payload/server/server.js

@@ -824,13 +824,10 @@ import { monitorEventLoopDelay } from "perf_hooks";
 // app/lib/agent-slug-pattern.ts
 var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
 
-// server/routes/health.ts
-import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
-import { createConnection as createConnection2 } from "net";
-
 // app/lib/claude-auth.ts
 import { readFileSync, writeFileSync } from "fs";
 import { sep } from "path";
+import { lock } from "proper-lockfile";
 if (!CLAUDE_CREDENTIALS_FILE.startsWith(MAXY_DIR + sep)) {
   console.error(
     `[claude-auth] WARN cross-brand-path-detected resolved=${CLAUDE_CREDENTIALS_FILE} brand=${BRAND_NAME} maxyDir=${MAXY_DIR}`
@@ -929,11 +926,39 @@ function logRefreshOutcome(outcome) {
   );
 }
 async function doRefresh() {
+  const pre = readCredentials();
+  if (!pre) return { status: "missing" };
+  if (!pre.refreshToken) return { status: "dead", expiresAt: pre.expiresAt };
+  let release = null;
+  try {
+    release = await lock(CLAUDE_CREDENTIALS_FILE, {
+      retries: { retries: 8, minTimeout: 100, maxTimeout: 1e3, factor: 1.5 },
+      stale: 3e4
+    });
+  } catch (err) {
+    console.error(
+      `[auth-refresh] op=lock-acquire-failed err=${err instanceof Error ? err.message : String(err)}`
+    );
+    logRefreshOutcome("fail-network");
+    return { status: "expired", expiresAt: pre.expiresAt };
+  }
+  console.log(`[auth-refresh] op=lock-acquired pid=${process.pid} path=${CLAUDE_CREDENTIALS_FILE}`);
+  try {
+    return await doRefreshLocked();
+  } finally {
+    await release().catch(() => {
+    });
+  }
+}
+async function doRefreshLocked() {
   const creds = readCredentials();
   if (!creds) return { status: "missing" };
   if (!creds.refreshToken) return { status: "dead", expiresAt: creds.expiresAt };
   const now = Date.now();
   if (creds.expiresAt - now > EXPIRING_THRESHOLD_MS) {
+    console.log(
+      `[auth-refresh] op=skipped-fresh expiresAt=${new Date(creds.expiresAt).toISOString()}`
+    );
     return { status: "ok", expiresAt: creds.expiresAt };
   }
   let res;
@@ -989,13 +1014,26 @@ async function doRefresh() {
     expiresIn: typeof expiresIn === "number" && expiresIn > 0 ? expiresIn : void 0
   });
   if (newExpiresAt) {
-    console.log(`[auth-refresh] success, expires ${new Date(newExpiresAt).toISOString()}`);
+    console.log(`[auth-refresh] op=renewed expiresAt=${new Date(newExpiresAt).toISOString()}`);
   } else {
-    console.warn("[auth-refresh] write-back failed");
+    console.warn("[auth-refresh] op=renewed-write-back-failed");
   }
   logRefreshOutcome("ok");
   return { status: "ok", expiresAt: newExpiresAt ?? Date.now() + 3600 * 1e3 };
 }
+function startAuthHealthHeartbeat(intervalMs = 5 * 60 * 1e3) {
+  const tick = () => {
+    const h = computeAuthHealth();
+    const expiresIn = h.expiresAt != null ? Math.round((h.expiresAt - Date.now()) / 1e3) : null;
+    console.log(
+      `[auth-health] brand=${BRAND_NAME} status=${h.status} expiresIn=${expiresIn != null ? expiresIn + "s" : "n/a"}`
+    );
+  };
+  tick();
+  const handle = setInterval(tick, intervalMs);
+  if (typeof handle.unref === "function") handle.unref();
+  return () => clearInterval(handle);
+}
 async function ensureAuth() {
   const health = assessAuthHealth();
   if (health.status === "ok" || health.status === "missing" || health.status === "dead") {
@@ -1004,6 +1042,10 @@ async function ensureAuth() {
   return refreshAccessToken();
 }
 
+// server/routes/health.ts
+import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
+import { createConnection as createConnection2 } from "net";
+
 // app/lib/network.ts
 import { networkInterfaces } from "os";
 function getLanIp() {
@@ -12157,12 +12199,6 @@ app25.post("/", requireAdminSession, async (c) => {
   const payload = {};
   if (typeof body.sessionId === "string" && body.sessionId.length > 0) payload.sessionId = body.sessionId;
   if (typeof body.name === "string" && body.name.length > 0) payload.name = body.name;
-  if (body.spawnPath !== void 0) {
-    if (body.spawnPath !== "node-pty" && body.spawnPath !== "script-scope") {
-      return c.json({ error: `spawnPath must be 'node-pty' or 'script-scope'` }, 400);
-    }
-    payload.spawnPath = body.spawnPath;
-  }
   let res;
   try {
     res = await fetch(`${managerBase4()}/rc-spawn`, {
@@ -15167,6 +15203,7 @@ var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app41.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
+startAuthHealthHeartbeat();
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
   loopHist.enable();

package/payload/platform/plugins/admin/hooks/__tests__/pre-tool-use-admin-tool-gate.test.sh

@@ -1,169 +0,0 @@
-#!/usr/bin/env bash
-# Task 529 — admin-tool-gate enforces orchestration-only at the PreToolUse
-# hook. Admin-direct invocations of Write/Edit/MultiEdit/Bash/WebFetch/
-# WebSearch are refused with the dispatch hint; subagents pass through.
-#
-# Task 559 — discriminator is `parent_tool_use_id` from the Claude Code
-# hook input. Non-empty → in-window Task subagent (allow).
-#
-# Task 566 — discriminator extended to `$MAXY_SPECIALIST` for maxy MCP
-# `Agent`-spawned specialists (separate top-level `claude rc` processes
-# with no `parent_tool_use_id` but `MAXY_SPECIALIST=<name>` on env, set
-# by pty-spawner.ts:1601). Calls with neither marker AND no
-# `MAXY_SESSION_ROLE=admin` fail closed with `reason=missing-marker` so a
-# future spawn shape cannot silently regress.
-
-set -u
-
-HOOK="$(cd "$(dirname "$0")/.." && pwd)/pre-tool-use.sh"
-if [[ ! -x "$HOOK" ]]; then
-  echo "FAIL: $HOOK not executable" >&2
-  exit 1
-fi
-
-TMPFILES=()
-cleanup() {
-  for f in "${TMPFILES[@]:-}"; do
-    [[ -n "$f" ]] && rm -f "$f" 2>/dev/null || true
-  done
-}
-trap cleanup EXIT
-
-PASS=0; FAIL=0
-pass() { PASS=$((PASS+1)); echo "PASS: $1"; }
-fail() { FAIL=$((FAIL+1)); echo "FAIL: $1" >&2; }
-
-# The hook receives the parent session's transcript_path even on subagent
-# calls in Claude Code 2.1.x. The fixture mirrors production.
-SESSION_TRANSCRIPT="/tmp/sess/44283ae1-2b82-4bd7-b8af-99a11141ed4b.jsonl"
-SUBAGENT_PARENT_ID="toolu_01QFC4W32wFUyHy6WJMNjHf6"
-
-# run <tool> <parent_id> <expected_rc> <expected_pattern> <label>
-# Env knobs (default mirror production admin spawn):
-#   MAXY_SESSION_ROLE_OVERRIDE — defaults to "admin"; set empty to drop the role
-#   MAXY_SPECIALIST_OVERRIDE   — defaults to empty; set to a name to simulate
-#                                an MCP-Agent-spawned specialist
-run() {
-  local tool="$1" parent_id="$2" expected_rc="$3" expected_pattern="$4" label="$5"
-  local role="${MAXY_SESSION_ROLE_OVERRIDE-admin}"
-  local specialist="${MAXY_SPECIALIST_OVERRIDE-}"
-  local input_json
-  input_json=$(python3 -c '
-import json, sys
-payload = {
-    "hook_event_name": "PreToolUse",
-    "tool_name": sys.argv[1],
-    "tool_input": {"file_path": "/tmp/x", "content": "x", "command": "echo hi"},
-    "transcript_path": sys.argv[2],
-}
-parent = sys.argv[3]
-if parent:
-    payload["parent_tool_use_id"] = parent
-print(json.dumps(payload, separators=(",", ":")))
-' "$tool" "$SESSION_TRANSCRIPT" "$parent_id")
-  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  printf '%s' "$input_json" | \
-    env -u MAXY_SESSION_ROLE -u MAXY_SPECIALIST \
-      MAXY_SESSION_ROLE="$role" MAXY_SPECIALIST="$specialist" \
-      bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
-  local rc=$?
-  if [[ "$rc" -ne "$expected_rc" ]]; then
-    fail "$label: expected exit $expected_rc, got $rc. Stderr: $(cat "$stderr_file")"
-    return
-  fi
-  if [[ -n "$expected_pattern" ]] && ! grep -qE "$expected_pattern" "$stderr_file"; then
-    fail "$label: stderr missing pattern '$expected_pattern'. Got: $(cat "$stderr_file")"
-    return
-  fi
-  pass "$label"
-}
-
-# ── Admin-direct refusals (no parent_tool_use_id, no MAXY_SPECIALIST, role=admin) ───
-run Write     "" 2 '\[admin-tool-gate\] role=admin parent_tool_use_id=- specialist=- session_role=admin tool=Write decision=block.*owner=content-producer' \
-  "Test 1: admin-direct Write rejected with content-producer dispatch hint"
-run Edit      "" 2 '\[admin-tool-gate\] role=admin .*tool=Edit decision=block.*owner=content-producer' \
-  "Test 2: admin-direct Edit rejected"
-run MultiEdit "" 2 '\[admin-tool-gate\] role=admin .*tool=MultiEdit decision=block.*owner=content-producer' \
-  "Test 3: admin-direct MultiEdit rejected"
-run Bash      "" 2 '\[admin-tool-gate\] role=admin .*tool=Bash decision=block' \
-  "Test 4: admin-direct Bash rejected"
-run WebFetch  "" 2 '\[admin-tool-gate\] role=admin .*tool=WebFetch decision=block.*owner=research-assistant' \
-  "Test 5: admin-direct WebFetch rejected"
-run WebSearch "" 2 '\[admin-tool-gate\] role=admin .*tool=WebSearch decision=block.*owner=research-assistant' \
-  "Test 6: admin-direct WebSearch rejected"
-
-# ── In-window subagent passthrough (parent_tool_use_id non-empty) ───────
-run Write     "$SUBAGENT_PARENT_ID" 0 "\[admin-tool-gate\] role=subagent parent_tool_use_id=${SUBAGENT_PARENT_ID} .*tool=Write decision=allow" \
-  "Test 7: subagent Write passes through"
-run Edit      "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=Edit decision=allow' \
-  "Test 8: subagent Edit passes through"
-run Bash      "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=Bash decision=allow' \
-  "Test 9: subagent Bash passes through (Task 559 regression — coding-assistant git pull)"
-run WebFetch  "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=WebFetch decision=allow' \
-  "Test 10: subagent WebFetch passes through"
-run MultiEdit "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*tool=MultiEdit decision=allow' \
-  "Test 11: subagent MultiEdit passes through"
-
-# ── Unrelated tools untouched ───────────────────────────────────────────
-run Read      "" 0 '' \
-  "Test 12: admin-direct Read passes (Read is admin-keep-list)"
-
-# ── Task 560: admin-direct block emits propagation record ──────────────
-# Admin-direct path: MAXY_SESSION_ROLE=admin, no MAXY_SPECIALIST, no parent.
-PROP_TMPDIR=$(mktemp -d); TMPFILES+=("$PROP_TMPDIR")
-export MAXY_HOOK_BUFFER_DIR="$PROP_TMPDIR/buffers"
-export MAXY_HOOK_SERVER_LOG="$PROP_TMPDIR/server.log"
-SESSION="task560-test-sess"
-PROP_INPUT=$(python3 -c '
-import json, sys
-print(json.dumps({"hook_event_name":"PreToolUse","tool_name":"Bash",
-  "tool_input":{"command":"ls"},"transcript_path":sys.argv[1],
-  "session_id":sys.argv[2]}, separators=(",",":")))
-' "$SESSION_TRANSCRIPT" "$SESSION")
-printf '%s' "$PROP_INPUT" | \
-  env -u MAXY_SPECIALIST MAXY_SESSION_ROLE=admin \
-    bash "$HOOK" admin >/dev/null 2>/dev/null
-BUF="$MAXY_HOOK_BUFFER_DIR/$SESSION.jsonl"
-if [[ -f "$BUF" ]] && grep -q '"hookName":"admin-tool-gate"' "$BUF" \
-   && grep -q '"decision":"block"' "$BUF" \
-   && grep -q '"reason":"orchestration-only"' "$BUF"; then
-  pass "Test 13b: admin-direct Bash block emits Task 560 propagation record"
-else
-  fail "Test 13b: propagation record missing/malformed — $(cat "$BUF" 2>/dev/null || echo '<no buffer>')"
-fi
-unset MAXY_HOOK_BUFFER_DIR MAXY_HOOK_SERVER_LOG
-
-# ── Task 566: maxy-MCP-Agent-spawned specialist passthrough ────────────
-# MCP-Agent specialists are separate top-level claude rc processes with no
-# parent_tool_use_id; pty-spawner stamps MAXY_SPECIALIST=<name> on the env.
-MAXY_SPECIALIST_OVERRIDE=content-producer \
-run Edit "" 0 '\[admin-tool-gate\] role=subagent .*specialist=content-producer .*tool=Edit decision=allow source=mcp-specialist' \
-  "Test 14: mcp-specialist Edit passes through (Task 566)"
-
-MAXY_SPECIALIST_OVERRIDE=coding-assistant \
-run Bash "" 0 '\[admin-tool-gate\] role=subagent .*specialist=coding-assistant .*tool=Bash decision=allow source=mcp-specialist' \
-  "Test 15: mcp-specialist Bash passes through (Task 559 regression class)"
-
-MAXY_SPECIALIST_OVERRIDE=research-assistant \
-run WebFetch "" 0 '\[admin-tool-gate\] role=subagent .*specialist=research-assistant .*tool=WebFetch decision=allow source=mcp-specialist' \
-  "Test 16: mcp-specialist WebFetch passes through"
-
-# ── Task 566: missing-marker fail-closed ───────────────────────────────
-# No parent_tool_use_id, no MAXY_SPECIALIST, MAXY_SESSION_ROLE not 'admin'.
-MAXY_SESSION_ROLE_OVERRIDE="" MAXY_SPECIALIST_OVERRIDE="" \
-run Edit "" 2 '\[admin-tool-gate\] role=unknown .*tool=Edit decision=block reason=missing-marker' \
-  "Test 17: missing-marker fail-closed (no positive role marker)"
-
-# ── Task 566: combined parent_tool_use_id + MAXY_SPECIALIST is also subagent ──
-MAXY_SPECIALIST_OVERRIDE=database-operator \
-run Bash "$SUBAGENT_PARENT_ID" 0 '\[admin-tool-gate\] role=subagent .*specialist=database-operator .*tool=Bash decision=allow source=task-subagent\+mcp-specialist' \
-  "Test 18: combined parent + specialist resolves as task-subagent+mcp-specialist"
-
-echo
-echo "──────── pre-tool-use admin-tool-gate test summary ────────"
-echo "PASS: $PASS"
-echo "FAIL: $FAIL"
-
-[[ "$FAIL" -gt 0 ]] && exit 1
-exit 0

package/payload/platform/plugins/admin/hooks/__tests__/pre-tool-use-base64-guard.test.sh

@@ -1,204 +0,0 @@
-#!/usr/bin/env bash
-# Regression test for the base64 context-overflow guard.
-#
-# Covers two PreToolUse rejection paths in pre-tool-use.sh:
-#
-#   1. Bash producer guard — `tool_input.command` invoking `base64` (encode
-#      direction) or `xxd -p` is rejected; `base64 -d|-D|--decode` is allowed.
-#   2. Write/Edit consumer guard — `tool_input.content` (Write) or
-#      `tool_input.new_string` (Edit) carrying `data:<mime>;base64,<≥4096 chars>`
-#      is rejected; small inline data URIs and plain content are allowed.
-#
-# Plus a fail-open case (malformed stdin → exit 0 silent) to pin the contract
-# established by the playwright-file-guard test (terminal-stdin guard + parse-
-# error fail-open).
-
-set -u
-
-HOOK="$(cd "$(dirname "$0")/.." && pwd)/pre-tool-use.sh"
-if [[ ! -x "$HOOK" ]]; then
-  echo "FAIL: $HOOK not executable" >&2
-  exit 1
-fi
-
-TMPFILES=()
-cleanup_test_state() {
-  for f in "${TMPFILES[@]:-}"; do
-    [[ -n "$f" ]] && rm -f "$f" 2>/dev/null || true
-  done
-}
-trap cleanup_test_state EXIT
-
-PASS=0
-FAIL=0
-pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
-fail() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
-
-# Helper: run hook with Bash tool_input.command and assert exit code + stderr.
-run_bash() {
-  local command_text="$1"; local expected_rc="$2"; local stderr_pattern="$3"; local label="$4"
-  local input_json
-  # Build the input JSON via python3 so command_text with quotes / specials is safe.
-  input_json=$(python3 -c '
-import json, sys
-print(json.dumps({"hook_event_name": "PreToolUse", "tool_name": "Bash", "tool_input": {"command": sys.argv[1]}, "transcript_path": "/tmp/sess/parent.jsonl", "parent_tool_use_id": "toolu_test_subagent"}, separators=(",", ":")))
-' "$command_text")
-  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  printf '%s' "$input_json" | bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
-  local rc=$?
-  if [[ "$rc" -ne "$expected_rc" ]]; then
-    fail "$label: expected exit $expected_rc, got $rc. Stderr: $(cat "$stderr_file")"
-    return
-  fi
-  if [[ -n "$stderr_pattern" ]] && ! grep -qE "$stderr_pattern" "$stderr_file"; then
-    fail "$label: stderr missing pattern '$stderr_pattern'. Got: $(cat "$stderr_file")"
-    return
-  fi
-  pass "$label"
-}
-
-# Helper: run hook with Write tool_input.content and assert exit code + stderr.
-run_write() {
-  local content="$1"; local expected_rc="$2"; local stderr_pattern="$3"; local label="$4"
-  local input_json
-  input_json=$(python3 -c '
-import json, sys
-print(json.dumps({"hook_event_name": "PreToolUse", "tool_name": "Write", "tool_input": {"file_path": "/tmp/test.html", "content": sys.argv[1]}, "transcript_path": "/tmp/sess/parent.jsonl", "parent_tool_use_id": "toolu_test_subagent"}, separators=(",", ":")))
-' "$content")
-  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  printf '%s' "$input_json" | bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
-  local rc=$?
-  if [[ "$rc" -ne "$expected_rc" ]]; then
-    fail "$label: expected exit $expected_rc, got $rc. Stderr: $(cat "$stderr_file")"
-    return
-  fi
-  if [[ -n "$stderr_pattern" ]] && ! grep -qE "$stderr_pattern" "$stderr_file"; then
-    fail "$label: stderr missing pattern '$stderr_pattern'. Got: $(cat "$stderr_file")"
-    return
-  fi
-  pass "$label"
-}
-
-# Helper: run hook with Edit tool_input.new_string and assert exit code.
-run_edit() {
-  local new_string="$1"; local expected_rc="$2"; local stderr_pattern="$3"; local label="$4"
-  local input_json
-  input_json=$(python3 -c '
-import json, sys
-print(json.dumps({"hook_event_name": "PreToolUse", "tool_name": "Edit", "tool_input": {"file_path": "/tmp/test.html", "old_string": "OLD", "new_string": sys.argv[1]}, "transcript_path": "/tmp/sess/parent.jsonl", "parent_tool_use_id": "toolu_test_subagent"}, separators=(",", ":")))
-' "$new_string")
-  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  printf '%s' "$input_json" | bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
-  local rc=$?
-  if [[ "$rc" -ne "$expected_rc" ]]; then
-    fail "$label: expected exit $expected_rc, got $rc. Stderr: $(cat "$stderr_file")"
-    return
-  fi
-  if [[ -n "$stderr_pattern" ]] && ! grep -qE "$stderr_pattern" "$stderr_file"; then
-    fail "$label: stderr missing pattern '$stderr_pattern'. Got: $(cat "$stderr_file")"
-    return
-  fi
-  pass "$label"
-}
-
-# Generate a base64-character blob >= 4096 chars (data-URI body trigger).
-LARGE_B64=$(python3 -c "print('A' * 5000)")
-
-# ───────── Bash producer guard ──────────────────────────────────────────────
-run_bash "echo hello world" 0 "" \
-  "Test 1: bare Bash command (no base64) allowed"
-
-run_bash "ls -la" 0 "" \
-  "Test 2: ls -la (no base64 token) allowed"
-
-run_bash "base64 /tmp/foo.png" 2 '\[pre-tool-use\] guard=base64-tool-result.*tool=Bash.*reason=base64-encoder.*action=reject' \
-  "Test 3: 'base64 file' (encode) rejected"
-
-run_bash "cat foo.png | base64" 2 '\[pre-tool-use\] guard=base64-tool-result.*action=reject' \
-  "Test 4: 'cat | base64' (encode pipeline) rejected"
-
-run_bash "cat foo.png|base64 -w0" 2 '\[pre-tool-use\] guard=base64-tool-result.*action=reject' \
-  "Test 5: 'base64 -w0' (encode with line-wrap flag) rejected"
-
-run_bash "xxd -p file.bin" 2 '\[pre-tool-use\] guard=base64-tool-result.*reason=xxd-plain-hex.*action=reject' \
-  "Test 6: 'xxd -p' (plain hex encode) rejected"
-
-run_bash "base64 -d input.b64 > output.bin" 0 "" \
-  "Test 7: 'base64 -d' (decode direction) allowed"
-
-run_bash "base64 --decode < x.b64 > y.bin" 0 "" \
-  "Test 8: 'base64 --decode' (decode long-form) allowed"
-
-run_bash "echo Zm9v | base64 -d" 0 "" \
-  "Test 9: 'base64 -d' decode pipeline allowed"
-
-run_bash "echo '--debug-base64-foo'" 0 "" \
-  "Test 10: 'base64' substring inside flag name does NOT false-match"
-
-run_bash "ls mybase64tool" 0 "" \
-  "Test 11: 'base64' substring inside identifier does NOT false-match"
-
-run_bash "cat in.b64 | base64 -d > /tmp/foo.bin; cat /tmp/bar.png | base64" 2 '\[pre-tool-use\] guard=base64-tool-result.*reason=base64-encoder.*action=reject' \
-  "Test 11b: compound (decode ; encode) rejects encoder segment (per-segment scan)"
-
-run_bash "echo data | base64 -d > x.bin && cat y.png | base64 > y.b64" 2 '\[pre-tool-use\] guard=base64-tool-result.*action=reject' \
-  "Test 11c: compound (decode && encode) rejects encoder segment"
-
-run_bash "base64 -d in.b64 > out.bin; base64 -d in2.b64 > out2.bin" 0 "" \
-  "Test 11d: compound (decode ; decode) allowed"
-
-# ───────── Write/Edit consumer guard ────────────────────────────────────────
-run_write "<html><body>hello world</body></html>" 0 "" \
-  "Test 12: Write small HTML content (no data URI) allowed"
-
-run_write "<img src='data:image/png;base64,AAAA'>" 0 "" \
-  "Test 13: Write content with small inline data URI (<4096 chars) allowed"
-
-run_write "<img src='data:image/png;base64,${LARGE_B64}'>" 2 '\[pre-tool-use\] guard=base64-write-content.*action=reject' \
-  "Test 14: Write content with large inline data URI (>4096 chars) rejected"
-
-run_edit "<img src='data:image/png;base64,${LARGE_B64}'>" 2 '\[pre-tool-use\] guard=base64-write-content.*action=reject' \
-  "Test 15: Edit new_string with large inline data URI rejected"
-
-run_edit "<p>just text replacement</p>" 0 "" \
-  "Test 16: Edit new_string with plain text allowed"
-
-# ───────── Fail-open / structural ───────────────────────────────────────────
-STDOUT_FILE=$(mktemp); STDERR_FILE=$(mktemp); TMPFILES+=("$STDOUT_FILE" "$STDERR_FILE")
-printf '%s' 'not json at all { ' | bash "$HOOK" admin >"$STDOUT_FILE" 2>"$STDERR_FILE"
-RC=$?
-if [[ "$RC" -ne 0 ]]; then
-  fail "Test 17: malformed stdin should fail open (exit 0), got $RC. Stderr: $(cat "$STDERR_FILE")"
-else
-  pass "Test 17: malformed stdin → silent passthrough (fail-open)"
-fi
-
-# Terminal-stdin guard preserved (no -t 0 test runs in test harness; assert
-# the guard line exists in source).
-if ! grep -q '\[ -t 0 \]' "$HOOK"; then
-  fail "Test 18: terminal stdin guard missing from hook source"
-else
-  pass "Test 18: terminal stdin guard present in source"
-fi
-
-# Pre-existing guards still active — entitlement file edit still rejected.
-ENT_JSON=$(python3 -c 'import json; print(json.dumps({"hook_event_name":"PreToolUse","tool_name":"Write","tool_input":{"file_path":"/srv/entitlement.json","content":"{\"tier\":\"max\"}"},"transcript_path":"/tmp/sess/parent.jsonl","parent_tool_use_id":"toolu_test_subagent"}, separators=(",", ":")))')
-STDOUT_FILE=$(mktemp); STDERR_FILE=$(mktemp); TMPFILES+=("$STDOUT_FILE" "$STDERR_FILE")
-printf '%s' "$ENT_JSON" | bash "$HOOK" admin >"$STDOUT_FILE" 2>"$STDERR_FILE"
-RC=$?
-if [[ "$RC" -ne 2 ]]; then
-  fail "Test 19: pre-existing entitlement guard regressed (expected exit 2, got $RC)"
-else
-  pass "Test 19: pre-existing entitlement guard still rejects entitlement.json"
-fi
-
-echo
-echo "──────── pre-tool-use base64 guard test summary ────────"
-echo "PASS: $PASS"
-echo "FAIL: $FAIL"
-
-[[ "$FAIL" -gt 0 ]] && exit 1
-exit 0

package/payload/platform/plugins/admin/hooks/__tests__/pre-tool-use-memory-write-passthrough.test.sh

@@ -1,118 +0,0 @@
-#!/usr/bin/env bash
-# Task 225 — passthrough regression test for memory-write / memory-update
-# under the admin agent's pre-tool-use.sh.
-#
-# The Task 213→222 chain previously gated both writers at the top of the
-# admin branch with an exit-2 block (admin direct) and an exit-0 allow
-# (Task-subagent). Task 225 reversed the doctrine: admin holds the
-# writers in its own surface and the case-block was deleted. This test
-# pins the new behaviour so a future re-introduction of the block
-# cannot land silently.
-#
-# Five cases:
-#   1. mcp__plugin_memory_memory__memory-write     admin-direct → exit 0, no rejection stderr
-#   2. mcp__plugin_memory_memory__memory-update    admin-direct → exit 0, no rejection stderr
-#   3. mcp__plugin_memory_memory__memory-search    admin-direct → exit 0, no rejection stderr (read tool control)
-#   4. mcp__memory__memory-write                   admin-direct → exit 0 (pre-209 namespace, falls through harmlessly)
-#   5. malformed JSON stdin                                   → exit 0 (no crash; case-block removal does not break fall-through)
-
-set -u
-
-HOOK="$(cd "$(dirname "$0")/.." && pwd)/pre-tool-use.sh"
-if [[ ! -x "$HOOK" ]]; then
-  echo "FAIL: $HOOK not executable" >&2
-  exit 1
-fi
-
-TMPFILES=()
-cleanup() {
-  for f in "${TMPFILES[@]:-}"; do
-    [[ -n "$f" ]] && rm -f "$f" 2>/dev/null || true
-  done
-}
-trap cleanup EXIT
-
-PASS=0
-FAIL=0
-pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
-fail() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
-
-# Admin-direct calls land with a non-subagent transcript path. A synthetic
-# empty file in a temp dir is enough — the hook no longer reads the path
-# for the deleted writers' case-block, but other gates may still touch it.
-ADMIN_TRANSCRIPT=$(mktemp); TMPFILES+=("$ADMIN_TRANSCRIPT")
-: > "$ADMIN_TRANSCRIPT"
-
-run_with_tool() {
-  local tool="$1"
-  local sid="$2"
-  local transcript_path="${3:-}"
-  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-  python3 -c '
-import json, sys
-payload = {
-  "hook_event_name": "PreToolUse",
-  "session_id": sys.argv[1],
-  "tool_name": sys.argv[2],
-  "tool_input": {"name":"Smalleys","accountId":"acct-x","scope":"shared"},
-}
-if sys.argv[3]:
-  payload["transcript_path"] = sys.argv[3]
-print(json.dumps(payload, separators=(",", ":")))
-' "$sid" "$tool" "$transcript_path" | bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
-  HOOK_RC=$?
-  HOOK_STDERR=$(cat "$stderr_file")
-}
-
-assert_passthrough() {
-  local label="$1"
-  if [[ "$HOOK_RC" -ne 0 ]]; then
-    fail "${label}: expected exit 0, got $HOOK_RC stderr: $HOOK_STDERR"
-    return
-  fi
-  if echo "$HOOK_STDERR" | grep -qF "does not write to the graph directly"; then
-    fail "${label}: stderr carries deleted-block rejection message: $HOOK_STDERR"
-    return
-  fi
-  pass "${label}: exit 0, no rejection stderr"
-}
-
-# --- 1. memory-write admin-direct passthrough ---------------------------
-run_with_tool "mcp__plugin_memory_memory__memory-write" "sess-write-1" "$ADMIN_TRANSCRIPT"
-assert_passthrough "admin-direct memory-write"
-
-# --- 2. memory-update admin-direct passthrough --------------------------
-run_with_tool "mcp__plugin_memory_memory__memory-update" "sess-update-1" "$ADMIN_TRANSCRIPT"
-assert_passthrough "admin-direct memory-update"
-
-# --- 3. memory-search admin-direct passthrough (read tool control) -----
-run_with_tool "mcp__plugin_memory_memory__memory-search" "sess-search-1" "$ADMIN_TRANSCRIPT"
-assert_passthrough "admin-direct memory-search (read tool control)"
-
-# --- 4. pre-209 namespace mcp__memory__memory-write ---------------------
-# The bare mcp__memory__ namespace was never in the admin runtime surface
-# after Task 203's plugin_ prefix rename; this case pins that it still
-# falls through harmlessly after the case-block removal.
-run_with_tool "mcp__memory__memory-write" "sess-old-ns-1" "$ADMIN_TRANSCRIPT"
-assert_passthrough "pre-209 namespace mcp__memory__memory-write"
-
-# --- 5. malformed JSON stdin — hook must not crash ----------------------
-stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
-stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
-echo "not-valid-json{{{" | bash "$HOOK" admin >"$stdout_file" 2>"$stderr_file"
-HOOK_RC=$?
-HOOK_STDERR=$(cat "$stderr_file")
-if [[ "$HOOK_RC" -ne 0 ]]; then
-  fail "malformed payload: expected exit 0, got $HOOK_RC stderr: $HOOK_STDERR"
-elif echo "$HOOK_STDERR" | grep -qF "does not write to the graph directly"; then
-  fail "malformed payload: stderr carries deleted-block rejection message: $HOOK_STDERR"
-else
-  pass "malformed payload: exit 0, hook does not crash"
-fi
-
-# --- Summary -----------------------------------------------------------
-echo "---"
-echo "PASSED: $PASS  FAILED: $FAIL"
-[[ "$FAIL" -eq 0 ]] || exit 1
-exit 0