@rubytech/create-maxy-code 0.1.569 → 0.1.570

package/payload/platform/scripts/lib/__tests__/account-settings-askgate.test.sh

@@ -1,144 +0,0 @@
-#!/usr/bin/env bash
-# Regression test for account-settings-askgate.sh (Task 1683).
-#
-# The lib retrofits the AskUserQuestion carrier gate onto existing accounts'
-# .claude/settings.json on every install/upgrade. Task 1552 added the gate to
-# provision-account-dir.sh, but that writer only runs at account-provision time
-# and the upgrade path never re-provisions existing client sub-accounts — so an
-# account provisioned before 1552 keeps a stale AskUserQuestion matcher with no
-# carrier gate and re-wedges on a channel AskUserQuestion (live SiteDesk
-# incident, session d39a22b0, account 2078cb54).
-#
-# Covers:
-#   1. Stale matcher (investigate only)      -> updated, carrier appended, idempotent on re-run
-#   2. Correct matcher (both gates)          -> already-set, file byte-identical
-#   3. AskUserQuestion matcher absent        -> updated, matcher added with both gates
-#   4. No .hooks.PreToolUse                   -> no-hooks, file untouched
-#   5. File absent                            -> absent
-#   6. Malformed JSON                         -> rewrite-failed, file untouched
-#   7. reconcile_all_accounts_askgate         -> patches every account.json dir, skips non-account dirs
-#
-# All cases assert the [backfill-1683] status token and the post-state of the file.
-
-set -u
-
-LIB="$(cd "$(dirname "$0")/.." && pwd)/account-settings-askgate.sh"
-if [ ! -f "$LIB" ]; then
-  echo "FAIL: $LIB not found" >&2
-  exit 1
-fi
-# shellcheck source=/dev/null
-. "$LIB"
-
-CARRIER='bash $PLATFORM_ROOT/plugins/admin/hooks/askuserquestion-channel-carrier-gate.sh'
-INVEST='bash $PLATFORM_ROOT/plugins/admin/hooks/askuserquestion-investigate-gate.sh'
-
-PASS=0
-FAIL=0
-TMP="$(mktemp -d)"
-trap 'rm -rf "$TMP"' EXIT
-
-ok()   { PASS=$((PASS+1)); }
-bad()  { FAIL=$((FAIL+1)); echo "FAIL: $1" >&2; }
-
-# settings.json with an AskUserQuestion matcher carrying the given command list.
-# Args after $1 are command strings for the AskUserQuestion matcher.
-write_settings() {
-  local file="$1"; shift
-  local cmds="" c
-  for c in "$@"; do
-    [ -n "$cmds" ] && cmds="$cmds,"
-    cmds="$cmds{\"type\":\"command\",\"command\":\"$c\"}"
-  done
-  mkdir -p "$(dirname "$file")"
-  cat > "$file" <<EOF
-{
-  "permissions": { "defaultMode": "bypassPermissions", "allow": [], "deny": [] },
-  "hooks": {
-    "PreToolUse": [
-      { "matcher": "Write", "hooks": [ { "type": "command", "command": "bash \$P/w.sh" } ] },
-      { "matcher": "AskUserQuestion", "hooks": [ $cmds ] }
-    ]
-  }
-}
-EOF
-}
-
-carrier_count() { grep -cF 'askuserquestion-channel-carrier-gate.sh' "$1" 2>/dev/null || true; }
-askmatcher_present() {
-  jq -e '.hooks.PreToolUse | any(.[]; .matcher == "AskUserQuestion")' "$1" >/dev/null 2>&1
-}
-
-# --- 1. stale matcher -> updated, then idempotent ---------------------------
-F="$TMP/stale/.claude/settings.json"
-write_settings "$F" "$INVEST"
-OUT="$(ensure_askgate_carrier "$F")"
-case "$OUT" in *status=updated*) ok;; *) bad "1a stale should be updated, got: $OUT";; esac
-[ "$(carrier_count "$F")" -eq 1 ] && ok || bad "1b carrier not appended (count=$(carrier_count "$F"))"
-# investigate still present and first
-if jq -e '.hooks.PreToolUse[] | select(.matcher=="AskUserQuestion") | .hooks[0].command | test("investigate-gate")' "$F" >/dev/null 2>&1; then ok; else bad "1c investigate no longer first"; fi
-OUT2="$(ensure_askgate_carrier "$F")"
-case "$OUT2" in *status=already-set*) ok;; *) bad "1d re-run should be already-set, got: $OUT2";; esac
-[ "$(carrier_count "$F")" -eq 1 ] && ok || bad "1e carrier duplicated on re-run (count=$(carrier_count "$F"))"
-
-# --- 2. correct matcher -> already-set, byte-identical ----------------------
-F="$TMP/good/.claude/settings.json"
-write_settings "$F" "$INVEST" "$CARRIER"
-BEFORE="$(cat "$F")"
-OUT="$(ensure_askgate_carrier "$F")"
-case "$OUT" in *status=already-set*) ok;; *) bad "2a good should be already-set, got: $OUT";; esac
-[ "$BEFORE" = "$(cat "$F")" ] && ok || bad "2b already-set file was rewritten"
-
-# --- 3. AskUserQuestion matcher absent -> updated, matcher added -------------
-F="$TMP/nomatcher/.claude/settings.json"
-mkdir -p "$(dirname "$F")"
-cat > "$F" <<'EOF'
-{ "permissions": {}, "hooks": { "PreToolUse": [ { "matcher": "Write", "hooks": [] } ] } }
-EOF
-OUT="$(ensure_askgate_carrier "$F")"
-case "$OUT" in *status=updated*) ok;; *) bad "3a nomatcher should be updated, got: $OUT";; esac
-askmatcher_present "$F" && ok || bad "3b AskUserQuestion matcher not added"
-[ "$(carrier_count "$F")" -eq 1 ] && ok || bad "3c carrier missing after add"
-if jq -e '.hooks.PreToolUse[] | select(.matcher=="AskUserQuestion") | .hooks | length == 2' "$F" >/dev/null 2>&1; then ok; else bad "3d added matcher should carry both gates"; fi
-
-# --- 4. no PreToolUse -> no-hooks, untouched --------------------------------
-F="$TMP/nohooks/.claude/settings.json"
-mkdir -p "$(dirname "$F")"
-echo '{ "permissions": {}, "hooks": {} }' > "$F"
-BEFORE="$(cat "$F")"
-OUT="$(ensure_askgate_carrier "$F")"
-case "$OUT" in *status=no-hooks*) ok;; *) bad "4a should be no-hooks, got: $OUT";; esac
-[ "$BEFORE" = "$(cat "$F")" ] && ok || bad "4b no-hooks file was rewritten"
-
-# --- 5. file absent -> absent ------------------------------------------------
-OUT="$(ensure_askgate_carrier "$TMP/does-not-exist/.claude/settings.json")"
-case "$OUT" in *status=absent*) ok;; *) bad "5 should be absent, got: $OUT";; esac
-
-# --- 6. malformed JSON -> rewrite-failed, untouched -------------------------
-F="$TMP/bad/.claude/settings.json"
-mkdir -p "$(dirname "$F")"
-printf '{ this is not json ' > "$F"
-BEFORE="$(cat "$F")"
-OUT="$(ensure_askgate_carrier "$F")"
-case "$OUT" in *status=rewrite-failed*) ok;; *) bad "6a malformed should be rewrite-failed, got: $OUT";; esac
-[ "$BEFORE" = "$(cat "$F")" ] && ok || bad "6b malformed file was mutated"
-[ ! -e "$F.1683.tmp" ] && ok || bad "6c temp file left behind"
-
-# --- 7. reconcile_all_accounts_askgate --------------------------------------
-ROOT="$TMP/accts"
-mkdir -p "$ROOT/acctA/.claude" "$ROOT/acctB/.claude" "$ROOT/notanaccount/.claude"
-echo '{"role":"house"}'  > "$ROOT/acctA/account.json"
-echo '{"role":"client"}' > "$ROOT/acctB/account.json"
-# notanaccount has no account.json -> must be skipped
-write_settings "$ROOT/acctA/.claude/settings.json" "$INVEST"
-write_settings "$ROOT/acctB/.claude/settings.json" "$INVEST" "$CARRIER"
-write_settings "$ROOT/notanaccount/.claude/settings.json" "$INVEST"
-RECOUT="$(reconcile_all_accounts_askgate "$ROOT")"
-[ "$(carrier_count "$ROOT/acctA/.claude/settings.json")" -eq 1 ] && ok || bad "7a acctA not patched"
-[ "$(carrier_count "$ROOT/acctB/.claude/settings.json")" -eq 1 ] && ok || bad "7b acctB disturbed"
-[ "$(carrier_count "$ROOT/notanaccount/.claude/settings.json")" -eq 0 ] && ok || bad "7c non-account dir was patched"
-case "$RECOUT" in *acctA*status=updated*) ok;; *) bad "7d reconcile did not log acctA updated";; esac
-
-echo "----------------------------------------"
-echo "PASS=$PASS FAIL=$FAIL"
-[ "$FAIL" -eq 0 ]

package/payload/platform/scripts/lib/__tests__/account-settings-mailbox-inject.test.sh

@@ -1,166 +0,0 @@
-#!/usr/bin/env bash
-# Regression test for account-settings-mailbox-inject.sh (Task 2157).
-#
-# The lib retrofits the per-turn <mailboxes> injection hook onto existing
-# accounts' .claude/settings.json on every install. provision-account-dir.sh
-# writes the UserPromptSubmit array at provision time only, and setup-account.sh
-# re-provisions the HOUSE account only, so a client sub-account created by the
-# admin-core account-lifecycle tool never gets the hook without this reconcile.
-#
-# Covers:
-#   1. Array with a sibling hook   -> updated, command appended, sibling preserved
-#   2. Re-run on the same file     -> already-set, file byte-identical
-#   3. Empty UserPromptSubmit array-> updated, whole entry created
-#   4. Command already present     -> already-set, no duplicate
-#   5. No .hooks.UserPromptSubmit  -> no-hooks, file untouched
-#   6. File absent                 -> absent
-#   7. Malformed JSON              -> rewrite-failed, file untouched
-#   8. settings.json is an array   -> rewrite-failed or no-hooks, file untouched
-#   9. reconcile_all_accounts_*    -> patches every account.json dir, skips others
-#  10. No temp file is ever left behind, on any path
-#
-# All cases assert the [backfill-2157] status token and the post-state of the file.
-
-set -u
-
-LIB="$(cd "$(dirname "$0")/.." && pwd)/account-settings-mailbox-inject.sh"
-if [ ! -f "$LIB" ]; then
-  echo "FAIL: $LIB not found" >&2
-  exit 1
-fi
-# shellcheck source=/dev/null
-. "$LIB"
-
-CMD='bash $PLATFORM_ROOT/plugins/admin/hooks/mailbox-inject.sh'
-SIB='bash $PLATFORM_ROOT/plugins/admin/hooks/datetime-inject.sh'
-
-PASS=0
-FAIL=0
-TMP="$(mktemp -d)"
-trap 'rm -rf "$TMP"' EXIT
-
-ok()  { echo "PASS: $1"; PASS=$((PASS+1)); }
-bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL+1)); }
-
-# cmds <file> -> every command string in the UserPromptSubmit array, one per line
-cmds() { jq -r '[.hooks.UserPromptSubmit[]?.hooks[]?.command] | .[]' "$1" 2>/dev/null; }
-status_of() { printf '%s' "$1" | /usr/bin/sed 's/.*status=//'; }
-
-# --- 1. array with a sibling hook -> updated, sibling preserved -------------
-F="$TMP/a.json"
-printf '%s' "{\"hooks\":{\"UserPromptSubmit\":[{\"hooks\":[{\"type\":\"command\",\"command\":\"$SIB\"}]}]}}" > "$F"
-OUT=$(ensure_mailbox_inject_hook "$F")
-if [ "$(status_of "$OUT")" = "updated" ] \
-   && [ "$(cmds "$F" | /usr/bin/grep -cF "$CMD")" -eq 1 ] \
-   && [ "$(cmds "$F" | /usr/bin/grep -cF "$SIB")" -eq 1 ]; then
-  ok "existing array -> updated, sibling hook preserved"
-else
-  bad "case 1 (out=$OUT cmds=$(cmds "$F" | tr '\n' ' '))"
-fi
-
-# --- 2. re-run -> already-set, byte-identical -------------------------------
-B=$(shasum "$F" | /usr/bin/cut -d' ' -f1)
-OUT=$(ensure_mailbox_inject_hook "$F")
-A=$(shasum "$F" | /usr/bin/cut -d' ' -f1)
-if [ "$(status_of "$OUT")" = "already-set" ] && [ "$B" = "$A" ] \
-   && [ "$(cmds "$F" | /usr/bin/grep -cF "$CMD")" -eq 1 ]; then
-  ok "re-run -> already-set, file byte-identical, no duplicate"
-else
-  bad "case 2 (out=$OUT before=$B after=$A)"
-fi
-
-# --- 3. empty array -> updated, whole entry created -------------------------
-F="$TMP/b.json"; printf '%s' '{"hooks":{"UserPromptSubmit":[]}}' > "$F"
-OUT=$(ensure_mailbox_inject_hook "$F")
-if [ "$(status_of "$OUT")" = "updated" ] && [ "$(cmds "$F" | /usr/bin/grep -cF "$CMD")" -eq 1 ]; then
-  ok "empty array -> updated, entry created"
-else
-  bad "case 3 (out=$OUT cmds=$(cmds "$F" | tr '\n' ' '))"
-fi
-
-# --- 4. command already present in a later entry -> already-set, no dupe ----
-F="$TMP/c.json"
-printf '%s' "{\"hooks\":{\"UserPromptSubmit\":[{\"hooks\":[{\"type\":\"command\",\"command\":\"$SIB\"}]},{\"hooks\":[{\"type\":\"command\",\"command\":\"$CMD\"}]}]}}" > "$F"
-OUT=$(ensure_mailbox_inject_hook "$F")
-if [ "$(status_of "$OUT")" = "already-set" ] && [ "$(cmds "$F" | /usr/bin/grep -cF "$CMD")" -eq 1 ]; then
-  ok "command present in a later entry -> already-set, not duplicated"
-else
-  bad "case 4 (out=$OUT cmds=$(cmds "$F" | tr '\n' ' '))"
-fi
-
-# --- 5. no UserPromptSubmit -> no-hooks, untouched --------------------------
-F="$TMP/d.json"; printf '%s' '{"permissions":{}}' > "$F"
-B=$(shasum "$F" | /usr/bin/cut -d' ' -f1); OUT=$(ensure_mailbox_inject_hook "$F"); A=$(shasum "$F" | /usr/bin/cut -d' ' -f1)
-if [ "$(status_of "$OUT")" = "no-hooks" ] && [ "$B" = "$A" ]; then
-  ok "no UserPromptSubmit array -> no-hooks, file untouched"
-else
-  bad "case 5 (out=$OUT)"
-fi
-
-# --- 6. file absent -> absent ----------------------------------------------
-OUT=$(ensure_mailbox_inject_hook "$TMP/does-not-exist.json")
-if [ "$(status_of "$OUT")" = "absent" ]; then
-  ok "file absent -> absent"
-else
-  bad "case 6 (out=$OUT)"
-fi
-
-# --- 7. malformed JSON -> rewrite-failed, untouched -------------------------
-F="$TMP/e.json"; printf 'not json at all' > "$F"
-B=$(shasum "$F" | /usr/bin/cut -d' ' -f1); OUT=$(ensure_mailbox_inject_hook "$F"); A=$(shasum "$F" | /usr/bin/cut -d' ' -f1)
-if [ "$(status_of "$OUT")" = "rewrite-failed" ] && [ "$B" = "$A" ]; then
-  ok "malformed JSON -> rewrite-failed, file untouched"
-else
-  bad "case 7 (out=$OUT)"
-fi
-
-# --- 8. settings.json is a JSON array -> not patched, untouched -------------
-F="$TMP/f.json"; printf '%s' '[]' > "$F"
-B=$(shasum "$F" | /usr/bin/cut -d' ' -f1); OUT=$(ensure_mailbox_inject_hook "$F"); A=$(shasum "$F" | /usr/bin/cut -d' ' -f1)
-S=$(status_of "$OUT")
-if { [ "$S" = "no-hooks" ] || [ "$S" = "rewrite-failed" ]; } && [ "$B" = "$A" ]; then
-  ok "settings.json that is an array -> not patched, file untouched"
-else
-  bad "case 8 (out=$OUT before=$B after=$A)"
-fi
-
-# --- 9. reconcile walks account dirs only ----------------------------------
-R="$TMP/accts"; mkdir -p "$R/one/.claude" "$R/two/.claude" "$R/notanaccount/.claude"
-printf '%s' '{}' > "$R/one/account.json"; printf '%s' '{}' > "$R/two/account.json"
-for d in one two notanaccount; do
-  printf '%s' "{\"hooks\":{\"UserPromptSubmit\":[{\"hooks\":[{\"type\":\"command\",\"command\":\"$SIB\"}]}]}}" > "$R/$d/.claude/settings.json"
-done
-OUT=$(reconcile_all_accounts_mailbox_inject "$R")
-if [ "$(printf '%s' "$OUT" | /usr/bin/grep -c 'status=updated')" -eq 2 ] \
-   && [ "$(cmds "$R/one/.claude/settings.json" | /usr/bin/grep -cF "$CMD")" -eq 1 ] \
-   && [ "$(cmds "$R/two/.claude/settings.json" | /usr/bin/grep -cF "$CMD")" -eq 1 ] \
-   && [ "$(cmds "$R/notanaccount/.claude/settings.json" | /usr/bin/grep -cF "$CMD")" -eq 0 ]; then
-  ok "reconcile patches account.json dirs only"
-else
-  bad "case 9 (out=$OUT)"
-fi
-
-# --- 10. no temp file left behind on any path ------------------------------
-if [ "$(find "$TMP" -name '*.2157.tmp' | /usr/bin/wc -l | tr -d ' ')" -eq 0 ]; then
-  ok "no .2157.tmp file left behind on any path"
-else
-  bad "case 10 (strays: $(find "$TMP" -name '*.2157.tmp'))"
-fi
-
-# --- 11. never returns non-zero, even on the failure paths -----------------
-ensure_mailbox_inject_hook "$TMP/e.json" >/dev/null; r1=$?
-ensure_mailbox_inject_hook "$TMP/nope.json" >/dev/null; r2=$?
-reconcile_all_accounts_mailbox_inject "$TMP/no-such-dir" >/dev/null; r3=$?
-if [ "$r1" -eq 0 ] && [ "$r2" -eq 0 ] && [ "$r3" -eq 0 ]; then
-  ok "every path returns 0, so a caller running set -e is never aborted"
-else
-  bad "case 11 (malformed=$r1 absent=$r2 nodir=$r3)"
-fi
-
-echo "----"
-echo "PASS=$PASS FAIL=$FAIL"
-if [ $((PASS+FAIL)) -ne 11 ]; then
-  echo "FAIL: expected 11 cases, ran $((PASS+FAIL))" >&2
-  exit 1
-fi
-[ "$FAIL" -eq 0 ]

package/payload/platform/scripts/lib/__tests__/account-settings-pdf-conformance.test.sh

@@ -1,151 +0,0 @@
-#!/usr/bin/env bash
-# Regression test for account-settings-pdf-conformance.sh (Task 1929).
-#
-# The lib retrofits the quote-render PDF-conformance PostToolUse matcher onto
-# existing accounts' .claude/settings.json on every install/upgrade. Task 1922
-# added the matcher to provision-account-dir.sh, but that writer only runs at
-# account-provision time and the upgrade path re-provisions only the house
-# account -- so an account provisioned before 1922 keeps a settings.json without
-# the browser-pdf-save PostToolUse matcher and never runs the PDF gate (live
-# glsmith is such an account).
-#
-# Covers:
-#   1. Stale matcher (browser-pdf-save present, conformance cmd absent) -> updated, appended, idempotent
-#   2. Correct matcher (conformance cmd present)                        -> already-set, byte-identical
-#   3. browser-pdf-save matcher absent (broad mcp__.* present)          -> updated, matcher added, wildcard untouched
-#   4. No .hooks.PostToolUse                                            -> no-hooks, untouched
-#   5. File absent                                                      -> absent
-#   6. Malformed JSON                                                   -> rewrite-failed, untouched, no temp
-#   7. reconcile_all_accounts_pdf_conformance                          -> patches every account.json dir, skips others
-#
-# All cases assert the [backfill-1929] status token and the post-state of the file.
-
-set -u
-
-LIB="$(cd "$(dirname "$0")/.." && pwd)/account-settings-pdf-conformance.sh"
-if [ ! -f "$LIB" ]; then
-  echo "FAIL: $LIB not found" >&2
-  exit 1
-fi
-# shellcheck source=/dev/null
-. "$LIB"
-
-MATCHER='mcp__plugin_browser_browser__browser-pdf-save'
-CONFORMANCE='bash $PLATFORM_ROOT/plugins/admin/hooks/quote-render-pdf-conformance.sh'
-
-PASS=0
-FAIL=0
-TMP="$(mktemp -d)"
-trap 'rm -rf "$TMP"' EXIT
-
-ok()   { PASS=$((PASS+1)); }
-bad()  { FAIL=$((FAIL+1)); echo "FAIL: $1" >&2; }
-
-# settings.json with a PostToolUse browser-pdf-save matcher carrying the given
-# command list. Args after $1 are command strings for that matcher.
-write_settings() {
-  local file="$1"; shift
-  local cmds="" c
-  for c in "$@"; do
-    [ -n "$cmds" ] && cmds="$cmds,"
-    cmds="$cmds{\"type\":\"command\",\"command\":\"$c\"}"
-  done
-  mkdir -p "$(dirname "$file")"
-  cat > "$file" <<EOF
-{
-  "permissions": { "defaultMode": "bypassPermissions", "allow": [], "deny": [] },
-  "hooks": {
-    "PostToolUse": [
-      { "matcher": "Bash", "hooks": [ { "type": "command", "command": "bash \$P/b.sh" } ] },
-      { "matcher": "$MATCHER", "hooks": [ $cmds ] },
-      { "matcher": "mcp__.*", "hooks": [ { "type": "command", "command": "bash \$P/missing.sh" } ] }
-    ]
-  }
-}
-EOF
-}
-
-conformance_count() { grep -cF 'quote-render-pdf-conformance.sh' "$1" 2>/dev/null || true; }
-pdfmatcher_present() {
-  jq -e --arg m "$MATCHER" '.hooks.PostToolUse | any(.[]; .matcher == $m)' "$1" >/dev/null 2>&1
-}
-wildcard_present() {
-  jq -e '.hooks.PostToolUse | any(.[]; .matcher == "mcp__.*")' "$1" >/dev/null 2>&1
-}
-
-# --- 1. stale matcher -> updated, then idempotent ---------------------------
-F="$TMP/stale/.claude/settings.json"
-write_settings "$F"
-OUT="$(ensure_pdf_conformance_matcher "$F")"
-case "$OUT" in *status=updated*) ok;; *) bad "1a stale should be updated, got: $OUT";; esac
-[ "$(conformance_count "$F")" -eq 1 ] && ok || bad "1b conformance not appended (count=$(conformance_count "$F"))"
-OUT2="$(ensure_pdf_conformance_matcher "$F")"
-case "$OUT2" in *status=already-set*) ok;; *) bad "1c re-run should be already-set, got: $OUT2";; esac
-[ "$(conformance_count "$F")" -eq 1 ] && ok || bad "1d conformance duplicated on re-run (count=$(conformance_count "$F"))"
-
-# --- 2. correct matcher -> already-set, byte-identical ----------------------
-F="$TMP/good/.claude/settings.json"
-write_settings "$F" "$CONFORMANCE"
-BEFORE="$(cat "$F")"
-OUT="$(ensure_pdf_conformance_matcher "$F")"
-case "$OUT" in *status=already-set*) ok;; *) bad "2a good should be already-set, got: $OUT";; esac
-[ "$BEFORE" = "$(cat "$F")" ] && ok || bad "2b already-set file was rewritten"
-
-# --- 3. browser-pdf-save matcher absent (wildcard present) -> updated, added --
-F="$TMP/nomatcher/.claude/settings.json"
-mkdir -p "$(dirname "$F")"
-cat > "$F" <<'EOF'
-{ "permissions": {}, "hooks": { "PostToolUse": [
-  { "matcher": "Bash", "hooks": [] },
-  { "matcher": "mcp__.*", "hooks": [ { "type": "command", "command": "bash $P/missing.sh" } ] }
-] } }
-EOF
-OUT="$(ensure_pdf_conformance_matcher "$F")"
-case "$OUT" in *status=updated*) ok;; *) bad "3a nomatcher should be updated, got: $OUT";; esac
-pdfmatcher_present "$F" && ok || bad "3b browser-pdf-save matcher not added"
-[ "$(conformance_count "$F")" -eq 1 ] && ok || bad "3c conformance missing after add"
-wildcard_present "$F" && ok || bad "3d wildcard matcher was disturbed"
-# added matcher carries exactly the one conformance command
-if jq -e --arg m "$MATCHER" '.hooks.PostToolUse[] | select(.matcher==$m) | .hooks | length == 1' "$F" >/dev/null 2>&1; then ok; else bad "3e added matcher should carry exactly one command"; fi
-
-# --- 4. no PostToolUse -> no-hooks, untouched -------------------------------
-F="$TMP/nohooks/.claude/settings.json"
-mkdir -p "$(dirname "$F")"
-echo '{ "permissions": {}, "hooks": {} }' > "$F"
-BEFORE="$(cat "$F")"
-OUT="$(ensure_pdf_conformance_matcher "$F")"
-case "$OUT" in *status=no-hooks*) ok;; *) bad "4a should be no-hooks, got: $OUT";; esac
-[ "$BEFORE" = "$(cat "$F")" ] && ok || bad "4b no-hooks file was rewritten"
-
-# --- 5. file absent -> absent ------------------------------------------------
-OUT="$(ensure_pdf_conformance_matcher "$TMP/does-not-exist/.claude/settings.json")"
-case "$OUT" in *status=absent*) ok;; *) bad "5 should be absent, got: $OUT";; esac
-
-# --- 6. malformed JSON -> rewrite-failed, untouched -------------------------
-F="$TMP/bad/.claude/settings.json"
-mkdir -p "$(dirname "$F")"
-printf '{ this is not json ' > "$F"
-BEFORE="$(cat "$F")"
-OUT="$(ensure_pdf_conformance_matcher "$F")"
-case "$OUT" in *status=rewrite-failed*) ok;; *) bad "6a malformed should be rewrite-failed, got: $OUT";; esac
-[ "$BEFORE" = "$(cat "$F")" ] && ok || bad "6b malformed file was mutated"
-[ ! -e "$F.1929.tmp" ] && ok || bad "6c temp file left behind"
-
-# --- 7. reconcile_all_accounts_pdf_conformance ------------------------------
-ROOT="$TMP/accts"
-mkdir -p "$ROOT/acctA/.claude" "$ROOT/acctB/.claude" "$ROOT/notanaccount/.claude"
-echo '{"role":"house"}'  > "$ROOT/acctA/account.json"
-echo '{"role":"client"}' > "$ROOT/acctB/account.json"
-# notanaccount has no account.json -> must be skipped
-write_settings "$ROOT/acctA/.claude/settings.json"
-write_settings "$ROOT/acctB/.claude/settings.json" "$CONFORMANCE"
-write_settings "$ROOT/notanaccount/.claude/settings.json"
-RECOUT="$(reconcile_all_accounts_pdf_conformance "$ROOT")"
-[ "$(conformance_count "$ROOT/acctA/.claude/settings.json")" -eq 1 ] && ok || bad "7a acctA not patched"
-[ "$(conformance_count "$ROOT/acctB/.claude/settings.json")" -eq 1 ] && ok || bad "7b acctB disturbed"
-[ "$(conformance_count "$ROOT/notanaccount/.claude/settings.json")" -eq 0 ] && ok || bad "7c non-account dir was patched"
-case "$RECOUT" in *acctA*status=updated*) ok;; *) bad "7d reconcile did not log acctA updated";; esac
-
-echo "----------------------------------------"
-echo "PASS=$PASS FAIL=$FAIL"
-[ "$FAIL" -eq 0 ]

package/payload/platform/scripts/lib/__tests__/account-settings-public-surface.test.sh

@@ -1,109 +0,0 @@
-#!/usr/bin/env bash
-# Task 2339 — the backfill must reach an account provisioned before the hook
-# existed, must be a byte-identical no-op on a second run, and must never damage
-# a file it cannot patch.
-set -uo pipefail
-DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../account-settings-public-surface.sh
-. "$DIR/../account-settings-public-surface.sh"
-PASS=0; FAIL=0
-ok()  { echo "PASS: $1"; PASS=$((PASS+1)); }
-bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL+1)); }
-CMD='bash $PLATFORM_ROOT/plugins/admin/hooks/public-tool-surface.sh'
-
-# A pre-2339 settings file: all three arrays present, none carrying the command.
-mkpre() {
-  local f="$1"
-  cat > "$f" <<'JSON'
-{
-  "permissions": { "defaultMode": "bypassPermissions", "allow": [], "deny": [] },
-  "hooks": {
-    "PreToolUse": [
-      { "matcher": "Bash", "hooks": [ { "type": "command", "command": "bash $PLATFORM_ROOT/plugins/admin/hooks/quote-engine-gate.sh" } ] },
-      { "hooks": [ { "type": "command", "command": "bash $PLATFORM_ROOT/plugins/admin/hooks/archive-ingest-surface-gate.sh" } ] }
-    ],
-    "UserPromptSubmit": [
-      { "hooks": [ { "type": "command", "command": "bash $PLATFORM_ROOT/plugins/admin/hooks/datetime-inject.sh" } ] }
-    ],
-    "Stop": [
-      { "hooks": [ { "type": "command", "command": "bash $PLATFORM_ROOT/plugins/admin/hooks/prompt-optimiser-compliance.sh" } ] }
-    ]
-  }
-}
-JSON
-}
-
-D=$(mktemp -d)
-F="$D/settings.json"
-mkpre "$F"
-OUT=$(ensure_public_surface_hook "$F")
-if [[ "$OUT" == *"status=updated"* ]]; then ok "a pre-2339 file is updated"; else bad "expected updated, got: $OUT"; fi
-if [ "$(jq -r --arg c "$CMD" '[.hooks.PreToolUse[] | select(has("matcher") | not) | .hooks[] | select(.command == $c)] | length' "$F")" = "1" ]; then
-  ok "the command lands on the matcher-less PreToolUse entry"
-else
-  bad "command not on the matcher-less PreToolUse entry"
-fi
-if [ "$(jq -r --arg c "$CMD" '[.hooks.PreToolUse[] | select(has("matcher")) | .hooks[] | select(.command == $c)] | length' "$F")" = "0" ]; then
-  ok "no matcher-scoped entry gained the command"
-else
-  bad "a matcher-scoped entry gained the command"
-fi
-if [ "$(jq -r --arg c "$CMD" '[.hooks.Stop[].hooks[] | select(.command == $c)] | length' "$F")" = "1" ]; then
-  ok "the command lands on the Stop entry"
-else
-  bad "command absent from Stop"
-fi
-if [ "$(jq -r --arg c "$CMD" '[.hooks.UserPromptSubmit[].hooks[] | select(.command == $c)] | length' "$F")" = "1" ]; then
-  ok "the command lands on the UserPromptSubmit entry"
-else
-  bad "command absent from UserPromptSubmit"
-fi
-
-BEFORE=$(cat "$F")
-OUT=$(ensure_public_surface_hook "$F")
-if [[ "$OUT" == *"status=already-set"* ]]; then ok "a second run reports already-set"; else bad "expected already-set, got: $OUT"; fi
-if [ "$BEFORE" = "$(cat "$F")" ]; then ok "a second run leaves the file byte-identical"; else bad "second run rewrote the file"; fi
-
-# Missing file.
-OUT=$(ensure_public_surface_hook "$D/nope.json")
-if [[ "$OUT" == *"status=absent"* ]]; then ok "a missing file reports absent"; else bad "expected absent, got: $OUT"; fi
-
-# Valid JSON with no hooks block.
-echo '{"permissions":{}}' > "$D/nohooks.json"
-OUT=$(ensure_public_surface_hook "$D/nohooks.json")
-if [[ "$OUT" == *"status=no-hooks"* ]]; then ok "a hookless file reports no-hooks"; else bad "expected no-hooks, got: $OUT"; fi
-
-# Malformed JSON is reported and left untouched.
-printf '{ not json' > "$D/bad.json"
-BAD_BEFORE=$(cat "$D/bad.json")
-OUT=$(ensure_public_surface_hook "$D/bad.json")
-if [[ "$OUT" == *"status=rewrite-failed"* ]]; then ok "a malformed file reports rewrite-failed"; else bad "expected rewrite-failed, got: $OUT"; fi
-if [ "$BAD_BEFORE" = "$(cat "$D/bad.json")" ]; then ok "a malformed file is left untouched"; else bad "malformed file was modified"; fi
-
-# An empty Stop array gains a whole entry.
-mkpre "$D/emptystop.json"
-jq '.hooks.Stop = []' "$D/emptystop.json" > "$D/es.tmp" && mv "$D/es.tmp" "$D/emptystop.json"
-ensure_public_surface_hook "$D/emptystop.json" >/dev/null
-if [ "$(jq -r --arg c "$CMD" '[.hooks.Stop[].hooks[] | select(.command == $c)] | length' "$D/emptystop.json")" = "1" ]; then
-  ok "an empty Stop array gains a whole entry"
-else
-  bad "empty Stop array not handled"
-fi
-
-# A PreToolUse array with no matcher-less entry gains one.
-mkpre "$D/nocatchall.json"
-jq 'del(.hooks.PreToolUse[] | select(has("matcher") | not))' "$D/nocatchall.json" > "$D/nc.tmp" && mv "$D/nc.tmp" "$D/nocatchall.json"
-ensure_public_surface_hook "$D/nocatchall.json" >/dev/null
-if [ "$(jq -r --arg c "$CMD" '[.hooks.PreToolUse[] | select(has("matcher") | not) | .hooks[] | select(.command == $c)] | length' "$D/nocatchall.json")" = "1" ]; then
-  ok "a PreToolUse array with no matcher-less entry gains one"
-else
-  bad "missing catch-all entry not handled"
-fi
-
-echo "----"
-echo "PASS=$PASS FAIL=$FAIL"
-if [ $((PASS+FAIL)) -ne 13 ]; then
-  echo "FAIL: expected 13 checks, ran $((PASS+FAIL))" >&2
-  exit 1
-fi
-[ "$FAIL" -eq 0 ]