@rubytech/create-maxy-code 0.1.219 → 0.1.222

package/payload/platform/plugins/admin/hooks/pre-tool-use.sh

@@ -1,337 +0,0 @@
-#!/usr/bin/env bash
-# PreToolUse hook — enforces agent tool boundaries and approval gating.
-# Usage: pre-tool-use.sh <agent-type>
-# Receives tool call JSON on stdin (from Claude Code hook protocol).
-# Exit 0 = allow, exit 2 = block.
-
-set -uo pipefail
-
-AGENT_TYPE="${1:-public}"
-
-# Source the propagation emitter (Task 560). The library is fail-open;
-# any error path inside it logs to server.log and returns 0, so sourcing
-# never blocks the hook's primary allow/block contract.
-HOOKS_LIB_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)/lib"
-# shellcheck disable=SC1091
-[ -f "$HOOKS_LIB_DIR/hook-emit.sh" ] && source "$HOOKS_LIB_DIR/hook-emit.sh"
-
-# Read stdin — fail closed if unavailable
-if [ -t 0 ]; then
-  # No INPUT yet; propagate with agentId=unknown so the regression is visible.
-  if declare -F hook_emit_decision >/dev/null 2>&1; then
-    hook_emit_decision "unknown" "admin-tool-gate" "?" "block" \
-      "stdin-missing" "Blocked: Cannot determine tool call (no stdin). Failing closed." 2 0
-  fi
-  echo "Blocked: Cannot determine tool call (no stdin). Failing closed." >&2
-  exit 2
-fi
-INPUT=$(cat)
-TOOL_NAME=$(echo "$INPUT" | grep -o '"tool_name":"[^"]*"' | head -1 | cut -d'"' -f4)
-
-# Session id for propagation. Empty / parse-failure routes to "unknown" —
-# the propagator emits the record under agentId=unknown rather than dropping.
-SESSION_ID=$(printf '%s' "$INPUT" | python3 -c '
-import sys, json
-try:
-    print(json.load(sys.stdin).get("session_id", "") or "unknown")
-except Exception:
-    print("unknown")
-' 2>/dev/null || echo "unknown")
-
-# ---------------------------------------------------------------------------
-# Admin agent — code directory protection + approval gating
-# ---------------------------------------------------------------------------
-if [ "$AGENT_TYPE" = "admin" ]; then
-
-  # ── Code directory protection ────────────────────────────────────────────
-  case "$TOOL_NAME" in
-    Write|Edit)
-      FILE_PATH=$(echo "$INPUT" | grep -o '"file_path":"[^"]*"' | head -1 | cut -d'"' -f4)
-      case "$FILE_PATH" in
-        # Platform UI source (platform/ui/) — source lives here, not on device
-        */platform/ui/app/*|*/platform/ui/lib/*|*/platform/ui/*.ts|*/platform/ui/*.tsx|*/platform/ui/*.mjs)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "code-dir-protection-ui" \
-            "Blocked: Admin agent cannot modify platform UI source at $FILE_PATH"
-          ;;
-        # Compiled MCP servers, hooks, and scripts — what actually ships to device
-        */platform/plugins/*/mcp/dist/*|*/platform/plugins/*/hooks/*|*/platform/scripts/*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "code-dir-protection-platform" \
-            "Blocked: Admin agent cannot modify platform code at $FILE_PATH"
-          ;;
-        # Entitlement library — verifier source, compiled output, vendored
-        # pubkey, hash file, and any signed entitlement.json. Tampering here is the
-        # agent path to revenue bypass; the legitimate write path is the Rubytech
-        # issuance endpoint, never the agent's filesystem.
-        # Patterns intentionally cover both absolute (*/...) and relative
-        # (no leading slash) paths so an agent can't bypass via cwd-relative writes.
-        */platform/lib/entitlement/*|platform/lib/entitlement/*|*/entitlement.json|entitlement.json)
-          echo "[entitlement] tool-deny: tool=${TOOL_NAME} path=${FILE_PATH} field=entitlement-file" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "entitlement-file" \
-            "Blocked: Admin agent cannot modify entitlement files at $FILE_PATH. Effective tier and purchasedPlugins derive from a Rubytech-signed payload."
-          ;;
-        # account.json — agent must use the account-update
-        # MCP tool (or plugin-toggle-enabled for enabledPlugins changes), which
-        # whitelists editable fields server-side. Direct Edit/Write bypasses
-        # that whitelist; deny unconditionally including cwd-relative paths.
-        # adds */account.json and *account.json as a backstop so any
-        # layout the named patterns miss is still caught — the Adam Mackay
-        # incident showed a tier upgrade via raw Edit on account.json reach
-        # the disk, exactly the failure mode this hook exists to prevent.
-        */data/accounts/*/account.json|*/config/accounts/*/account.json|data/accounts/*/account.json|config/accounts/*/account.json|*/account.json|*account.json|account.json)
-          echo "[entitlement] tool-deny: tool=${TOOL_NAME} path=${FILE_PATH} field=account-json" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "account-json" \
-            "Blocked: Admin agent cannot edit account.json directly. Use the account-update or plugin-toggle-enabled MCP tools — they whitelist editable fields server-side and exclude tier and purchasedPlugins by design."
-          ;;
-        # Pending action queue — only the hook and MCP tools may write here
-        */pending-actions/*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "${TOOL_NAME}" \
-            "pending-actions" \
-            "Blocked: Admin agent cannot modify pending action files directly"
-          ;;
-      esac
-      ;;
-    Bash)
-      # Block shell commands referencing protected code directories or pending actions
-      case "$INPUT" in
-        *"platform/ui/app/"*|*"platform/ui/lib/"*|*"platform/plugins/"*"hooks/"*|*"platform/scripts/"*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "code-dir-protection-bash" \
-            "Blocked: Admin agent cannot run shell commands against code directories"
-          ;;
-        # Entitlement files via shell — same surface, blocked symmetrically
-        *"platform/lib/entitlement/"*|*"entitlement.json"*)
-          echo "[entitlement] tool-deny: tool=Bash path=entitlement-file field=entitlement-file" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "entitlement-shell" \
-            "Blocked: Admin agent cannot reference entitlement files via shell."
-          ;;
-        # account.json via shell — same rationale as Edit/Write block
-        *"data/accounts/"*"account.json"*|*"config/accounts/"*"account.json"*)
-          echo "[entitlement] tool-deny: tool=Bash path=account-json field=account-json" >&2
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "account-json-shell" \
-            "Blocked: Admin agent cannot edit account.json via shell. Use the account-update MCP tool."
-          ;;
-        *"pending-actions/"*)
-          hook_block_with_emit "$SESSION_ID" "admin-tool-gate" "Bash" \
-            "pending-actions-shell" \
-            "Blocked: Admin agent cannot modify pending action files via shell"
-          ;;
-      esac
-      ;;
-  esac
-
-  # ── Base64 context-overflow guard ─────────────────────────────
-  # Block inline base64 payloads from reaching the model context. Two paths:
-  #
-  #   1. Bash command that ENCODES a binary file to base64/hex (the producer).
-  #   2. Write/Edit content carrying an inline `data:<mime>;base64,…` blob
-  #      (the consumer — agent quoting bytes from a prior tool_result into a
-  #      HTML/markdown Write).
-  #
-  # Either path landed ~33 KB of base64 in the SDK request and the next turn
-  # tripped `main_stream_stalled` at 180 s. The
-  # remediation is symmetric: the agent saves bytes to `$ACCOUNT_DIR/tmp/<sha1>.<ext>`
-  # and references the path (`<img src="./file">` or Read-by-path) instead of
-  # carrying bytes through the assistant turn.
-  #
-  # Parsing uses python3 (already a hook dependency at the action-id site
-  # below); grep on JSON is unsafe for content with escaped quotes or
-  # embedded newlines. Parse failure is fail-open (empty extracted string,
-  # no match, allow) — matches the playwright-file-guard fail-open contract.
-  # Single python3 invocation parses the JSON, runs the tool-specific
-  # regex match (avoiding BSD-vs-GNU grep interval-count incompatibilities —
-  # `grep -E '{4096,}'` errors with "invalid repetition count(s)" on macOS
-  # BSD grep under some pattern combinations), and prints the rejection
-  # outcome to stdout as `REJECT:<reason>:<bytes>` or `ALLOW`. The wrapping
-  # bash logic reads the verdict and emits the rejection log/stderr/exit-2.
-  # Parse failure prints `ALLOW` (fail-open, matching the playwright-file-
-  # guard contract for malformed stdin).
-  GUARD_VERDICT=$(echo "$INPUT" | python3 -c '
-import sys, json, re
-try:
-    d = json.load(sys.stdin)
-    tool = d.get("tool_name", "")
-    ti = d.get("tool_input", {}) or {}
-    if tool in ("Write", "Edit"):
-        # Write.content OR Edit.new_string can carry inline base64.
-        content = ti.get("content") or ti.get("new_string") or ""
-        if not isinstance(content, str):
-            print("ALLOW"); sys.exit(0)
-        # data:<mime>;base64,<≥4096 base64 chars> — threshold matches the
-        # doctrine paragraph in .docs/agents.md. The 4096-char body is
-        # ~3 KB binary, far above any legitimate inline icon.
-        m = re.search(r"data:[^;]+;base64,[A-Za-z0-9+/]{4096,}={0,2}", content)
-        if m:
-            print(f"REJECT:base64-write-content:{len(content)}")
-        else:
-            print("ALLOW")
-    elif tool == "Bash":
-        command = ti.get("command", "")
-        if not isinstance(command, str):
-            print("ALLOW"); sys.exit(0)
-        # Per-segment scan. A compound command like
-        #   cat in.b64 | base64 -d > out.bin; cat photo.png | base64
-        # contains both a legitimate decode AND a malicious encoder. A whole-
-        # command decode-flag check is fooled into allowing the encoder. Split
-        # on shell separators (;, &&, ||, &) and scan each segment as its own
-        # command — the encoder rejection fires when ANY segment is a bare
-        # base64 invocation without a paired decode flag in the SAME segment.
-        # Pipelines (|) keep the segment together because the encoder direction
-        # of `cat file | base64` lives across the pipe.
-        segments = re.split(r";|&&|\|\||(?<![|&])&(?![|&])", command)
-        rejected = None
-        for seg in segments:
-            if re.search(r"(?:^|[\s|;&])xxd[\t ]+-p(?![A-Za-z0-9_-])", seg):
-                rejected = "xxd-plain-hex"; break
-            if re.search(r"(?:^|[\s|;&])base64(?![A-Za-z0-9_-])", seg):
-                if not re.search(r"base64[\t ]+[^|]*(?:-d|-D|--decode)(?![A-Za-z0-9_])", seg):
-                    rejected = "base64-encoder"; break
-        if rejected:
-            print(f"REJECT:{rejected}:{len(command)}")
-        else:
-            print("ALLOW")
-    else:
-        print("ALLOW")
-except Exception:
-    print("ALLOW")
-' 2>/dev/null || echo "ALLOW")
-  case "$GUARD_VERDICT" in
-    REJECT:base64-write-content:*)
-      BYTES="${GUARD_VERDICT##*:}"
-      echo "[pre-tool-use] guard=base64-write-content bytes=${BYTES} action=reject" >&2
-      hook_block_with_emit "$SESSION_ID" "base64-guard" "${TOOL_NAME}" \
-        "base64-write-content" \
-        "Blocked: ${TOOL_NAME} content carries an inline base64 payload (>4 KB encoded). Inline binary in Write.content overloads the model context — the same path produced a main_stream_stalled at ~33 KB on 2026-05-09.
-Save the bytes to \$ACCOUNT_DIR/tmp/<sha1>.<ext> via Bash (e.g. 'base64 -d > out.png'), then reference the file from the document: <img src=\"./<file>\"> or Read-by-path. Do not carry binary bytes through the assistant turn."
-      ;;
-    REJECT:base64-encoder:*|REJECT:xxd-plain-hex:*)
-      REASON="${GUARD_VERDICT#REJECT:}"; REASON="${REASON%:*}"
-      BYTES="${GUARD_VERDICT##*:}"
-      echo "[pre-tool-use] guard=base64-tool-result bytes=${BYTES} tool=Bash reason=${REASON} action=reject" >&2
-      hook_block_with_emit "$SESSION_ID" "base64-guard" "Bash" \
-        "$REASON" \
-        "Blocked: Bash command would emit binary as inline base64/hex to stdout, which lands in the assistant turn and overloads the model context (the 2026-05-09 Rubytech-invoice path hit 66% context after a single ~33 KB tool_result).
-Instead: save the bytes directly to \$ACCOUNT_DIR/tmp/<sha1>.<ext> and operate on the file via path — Read for inspection, <img src=\"./<file>\"> for HTML embedding, the \`file-presentation\` skill for delivery. Decoding base64 (e.g. 'base64 -d in.b64 > out.bin') is allowed."
-      ;;
-    *)
-      : # ALLOW — fall through to approval gating below
-      ;;
-  esac
-
-  # ── Approval gating (EU AI Act Article 14 — human oversight) ─────────────
-  # Strip the mcp__<plugin>__ prefix to get the short tool name.
-  # Built-in tools (no prefix) pass through unchanged.
-  SHORT_NAME=$(echo "$TOOL_NAME" | sed 's/^mcp__[^_]*__//')
-
-  # Derive platform root from this hook's location:
-  #   platform/plugins/admin/hooks/pre-tool-use.sh → platform/
-  HOOK_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
-  PLATFORM_ROOT="${HOOK_DIR}/../../.."
-
-  # Resolve the single account directory (Phase 0).
-  ACCOUNTS_DIR="${PLATFORM_ROOT}/../data/accounts"
-  ACCOUNT_DIR=""
-  if [ -d "$ACCOUNTS_DIR" ]; then
-    ACCOUNT_DIR=$(find "$ACCOUNTS_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | head -1)
-  fi
-
-  # Default require-review tools — matches DEFAULT_REQUIRE_REVIEW in claude-agent.ts
-  DEFAULT_REQUIRE_REVIEW="email-send email-reply whatsapp-send whatsapp-send-document message contact-erase"
-
-  # Check if this tool requires approval review.
-  # 1. Read per-account override from account.json approvalPolicy (if it exists)
-  # 2. Fall back to the default require-review list
-  POLICY=""
-  if [ -n "$ACCOUNT_DIR" ] && [ -f "${ACCOUNT_DIR}/account.json" ]; then
-    # Check per-account override first (grep for the tool name in the approvalPolicy block)
-    OVERRIDE=$(grep -o "\"${SHORT_NAME}\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" "${ACCOUNT_DIR}/account.json" 2>/dev/null | head -1 | grep -o '"[^"]*"$' | tr -d '"')
-    if [ -n "$OVERRIDE" ]; then
-      POLICY="$OVERRIDE"
-    fi
-  fi
-
-  # If no per-account override, check the default list
-  if [ -z "$POLICY" ]; then
-    for TOOL in $DEFAULT_REQUIRE_REVIEW; do
-      if [ "$SHORT_NAME" = "$TOOL" ]; then
-        POLICY="require-review"
-        break
-      fi
-    done
-  fi
-
-  # If not in any policy, auto-execute (allow)
-  if [ "$POLICY" != "require-review" ]; then
-    exit 0
-  fi
-
-  # ── Special case: contact-erase preview calls pass through ───────────────
-  # The contact-erase tool has a two-step flow: first call with confirm:false
-  # returns a preview (data counts), second call with confirm:true executes.
-  # Only gate the destructive confirm:true call.
-  if [ "$SHORT_NAME" = "contact-erase" ]; then
-    if ! echo "$INPUT" | grep -q '"confirm"[[:space:]]*:[[:space:]]*true'; then
-      exit 0
-    fi
-  fi
-
-  # ── Queue the action for approval ───────────────────────────────────────
-  PENDING_DIR="${ACCOUNT_DIR}/pending-actions"
-  mkdir -p "$PENDING_DIR" 2>/dev/null
-
-  ACTION_ID="$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())' 2>/dev/null || date +%s%N)"
-  CREATED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-
-  # Write atomically: temp file + mv
-  TEMP=$(mktemp "${PENDING_DIR}/.tmp.XXXXXX" 2>/dev/null)
-  if [ -z "$TEMP" ]; then
-    hook_block_with_emit "$SESSION_ID" "approval-gate" "${TOOL_NAME}" \
-      "approval-queue-mktemp" \
-      "Blocked: Action requires approval but failed to create queue file (disk error). Failing closed."
-  fi
-
-  # The pending action file contains the full hook JSON (tool_name + tool_input)
-  # plus metadata. The MCP approval tools parse it with Node.js JSON.parse.
-  cat > "$TEMP" <<ENDJSON
-{
-  "actionId": "${ACTION_ID}",
-  "toolName": "${SHORT_NAME}",
-  "pluginName": "$(echo "$TOOL_NAME" | sed -n 's/^mcp__\([^_]*\)__.*/\1/p')",
-  "hookPayload": ${INPUT},
-  "state": "pending",
-  "createdAt": "${CREATED_AT}"
-}
-ENDJSON
-
-  if ! mv "$TEMP" "${PENDING_DIR}/${ACTION_ID}.json" 2>/dev/null; then
-    rm -f "$TEMP" 2>/dev/null
-    hook_block_with_emit "$SESSION_ID" "approval-gate" "${TOOL_NAME}" \
-      "approval-queue-mv" \
-      "Blocked: Action requires approval but failed to queue (filesystem error). Failing closed."
-  fi
-
-  # Record the queued-for-approval block in the propagation buffer; the
-  # readable summary still goes to stdout (CC attaches it as the agent's
-  # tool_result). hook_emit_decision is the no-exit variant — the
-  # subsequent echoes + exit 2 below remain the operator-facing surface.
-  hook_emit_decision "$SESSION_ID" "approval-gate" "${TOOL_NAME}" \
-    "block" "approval-queued" \
-    "Action ${ACTION_ID} queued for review" 2 0
-
-  # Extract a readable summary of the action for the agent to present
-  # tool_input is the second JSON value in the hook payload
-  echo "Action requires approval before execution."
-  echo ""
-  echo "Action ID: ${ACTION_ID}"
-  echo "Tool: ${SHORT_NAME}"
-  echo "Status: Queued for review"
-  echo ""
-  echo "The admin must approve this action before it can execute."
-  echo "Use action-approve to send, action-reject to cancel, or action-edit to modify."
-  exit 2
-fi

package/payload/server/public/assets/channel-CzcSNxDm.js

@@ -1 +0,0 @@
-import{it as e,rt as t}from"./chunk-ICPOFSXX-DxtrRClx.js";var n=(n,r)=>e.lang.round(t.parse(n)[r]);export{n as t};

package/payload/server/public/assets/classDiagram-6PBFFD2Q-DFOM3vCn.js

@@ -1 +0,0 @@
-import{h as e}from"./src-CWiyyVfn.js";import"./chunk-ICPOFSXX-DxtrRClx.js";import"./dist-BzAsli7o.js";import"./chunk-5PVQY5BW-YXZKnPCz.js";import"./chunk-U2HBQHQK-BPTv3Oj1.js";import"./chunk-FMBD7UC4-C_E43NFJ.js";import"./chunk-BSJP7CBP-L79XKVcb.js";import"./chunk-ZZ45TVLE-Dqr161Q1.js";import"./chunk-YZCP3GAM-BZ4N75oy.js";import"./chunk-55IACEB6-BwZyF7vR.js";import"./chunk-EDXVE4YY-DAMCJHKQ.js";import"./chunk-X2U36JSP-DxBry33v.js";import"./chunk-5FUZZQ4R-BZZwZX5Q.js";import"./chunk-ENJZ2VHE-DsD95Bqn.js";import"./chunk-336JU56O-DS3ksXBG.js";import{i as t,n,r,t as i}from"./chunk-4TB4RGXK-BrhOvJ01.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/payload/server/public/assets/classDiagram-v2-HSJHXN6E-HplDfaL1.js

@@ -1 +0,0 @@
-import{h as e}from"./src-CWiyyVfn.js";import"./chunk-ICPOFSXX-DxtrRClx.js";import"./dist-BzAsli7o.js";import"./chunk-5PVQY5BW-YXZKnPCz.js";import"./chunk-U2HBQHQK-BPTv3Oj1.js";import"./chunk-FMBD7UC4-C_E43NFJ.js";import"./chunk-BSJP7CBP-L79XKVcb.js";import"./chunk-ZZ45TVLE-Dqr161Q1.js";import"./chunk-YZCP3GAM-BZ4N75oy.js";import"./chunk-55IACEB6-BwZyF7vR.js";import"./chunk-EDXVE4YY-DAMCJHKQ.js";import"./chunk-X2U36JSP-DxBry33v.js";import"./chunk-5FUZZQ4R-BZZwZX5Q.js";import"./chunk-ENJZ2VHE-DsD95Bqn.js";import"./chunk-336JU56O-DS3ksXBG.js";import{i as t,n,r,t as i}from"./chunk-4TB4RGXK-BrhOvJ01.js";var a={parser:n,get db(){return new i},renderer:r,styles:t,init:e(e=>{e.class||={},e.class.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};

package/payload/server/public/assets/clone-G-2rqnSR.js

@@ -1 +0,0 @@
-import{i as e}from"./graphlib-DjnyHqGy.js";var t=4;function n(n){return e(n,t)}export{n as t};

package/payload/server/public/assets/stateDiagram-v2-QKLJ7IA2-NXz27DaV.js

@@ -1 +0,0 @@
-import{h as e}from"./src-CWiyyVfn.js";import"./chunk-ICPOFSXX-DxtrRClx.js";import"./dist-BzAsli7o.js";import"./chunk-5PVQY5BW-YXZKnPCz.js";import"./chunk-U2HBQHQK-BPTv3Oj1.js";import"./chunk-BSJP7CBP-L79XKVcb.js";import"./chunk-ZZ45TVLE-Dqr161Q1.js";import"./chunk-55IACEB6-BwZyF7vR.js";import"./chunk-EDXVE4YY-DAMCJHKQ.js";import"./chunk-X2U36JSP-DxBry33v.js";import"./chunk-5FUZZQ4R-BZZwZX5Q.js";import"./chunk-ENJZ2VHE-DsD95Bqn.js";import"./chunk-336JU56O-DS3ksXBG.js";import{i as t,n,r,t as i}from"./chunk-OYMX7WX6-CN4kLK-H.js";var a={parser:n,get db(){return new i(2)},renderer:r,styles:t,init:e(e=>{e.state||={},e.state.arrowMarkerAbsolute=e.arrowMarkerAbsolute},`init`)};export{a as diagram};