@rubytech/create-maxy-code 0.1.569 → 0.1.570

package/payload/platform/scripts/lib/account-settings-askgate.sh

@@ -1,98 +0,0 @@
-# account-settings-askgate.sh — retrofit the AskUserQuestion carrier gate onto
-# existing accounts' .claude/settings.json. Task 1683.
-#
-# Task 1552 added askuserquestion-channel-carrier-gate.sh as a second command on
-# the AskUserQuestion PreToolUse matcher in provision-account-dir.sh. That writer
-# only runs at account-provision time; the upgrade path re-provisions the house
-# account but NOT existing client sub-accounts, so any account provisioned before
-# 1552 keeps a stale matcher with no carrier gate and re-wedges on a channel
-# AskUserQuestion (live SiteDesk incident: session d39a22b0, account 2078cb54,
-# 2026-07-15). This lib is the standing backfill: setup-account.sh reconciles
-# every account on every install so the gate reaches pre-1552 accounts.
-#
-# Requires jq. Idempotent. Never echoes file contents. Fail-open (nudge, not
-# brick): any unusable file logs a status and is left untouched.
-#
-# Sourced by setup-account.sh; also runnable standalone for a manual repair.
-
-# The exact command strings provision-account-dir.sh writes. $PLATFORM_ROOT is a
-# literal in the settings file, resolved by Claude Code at hook-run time.
-_ASKGATE_CARRIER='bash $PLATFORM_ROOT/plugins/admin/hooks/askuserquestion-channel-carrier-gate.sh'
-_ASKGATE_INVESTIGATE='bash $PLATFORM_ROOT/plugins/admin/hooks/askuserquestion-investigate-gate.sh'
-
-# ensure_askgate_carrier <settings_file>
-# Guarantees the AskUserQuestion PreToolUse matcher carries the carrier-gate
-# command: appends it if the matcher exists without it, or adds the whole matcher
-# (both gates, investigate first) if the matcher is absent. Logs exactly one
-# `[backfill-1683] file=<f> status=<absent|no-hooks|already-set|updated|rewrite-failed>`
-# to stdout. Always returns 0.
-ensure_askgate_carrier() {
-  local f="$1"
-  if [ ! -f "$f" ]; then
-    echo "[backfill-1683] file=$f status=absent"
-    return 0
-  fi
-  # Patchable only when the file is valid JSON with a PreToolUse array.
-  if ! jq -e '.hooks.PreToolUse | type == "array"' "$f" >/dev/null 2>&1; then
-    if jq -e . "$f" >/dev/null 2>&1; then
-      echo "[backfill-1683] file=$f status=no-hooks"
-    else
-      echo "[backfill-1683] file=$f status=rewrite-failed"
-    fi
-    return 0
-  fi
-  local tmp="$f.1683.tmp"
-  if ! jq \
-      --arg carrier "$_ASKGATE_CARRIER" \
-      --arg invest "$_ASKGATE_INVESTIGATE" '
-      .hooks.PreToolUse |= (
-        if any(.[]; .matcher == "AskUserQuestion")
-        then map(
-          if .matcher == "AskUserQuestion"
-          then .hooks = (
-                 if any(.hooks[]; .command == $carrier)
-                 then .hooks
-                 else .hooks + [{type: "command", command: $carrier}]
-                 end)
-          else . end)
-        else . + [{matcher: "AskUserQuestion", hooks: [{type: "command", command: $invest}, {type: "command", command: $carrier}]}]
-        end)
-    ' "$f" > "$tmp" 2>/dev/null; then
-    rm -f "$tmp"
-    echo "[backfill-1683] file=$f status=rewrite-failed"
-    return 0
-  fi
-  # Semantic no-op? Compare canonical forms; leave the file byte-identical if so.
-  # `|| true` keeps a jq failure here (e.g. $f truncated by a concurrent writer
-  # between the type-check above and this read) from tripping a caller's `set -e`
-  # and aborting the whole install — this lib is fail-open by contract.
-  local before after
-  before="$(jq -S . "$f" 2>/dev/null || true)"
-  after="$(jq -S . "$tmp" 2>/dev/null || true)"
-  if [ "$before" = "$after" ]; then
-    rm -f "$tmp"
-    echo "[backfill-1683] file=$f status=already-set"
-    return 0
-  fi
-  if mv "$tmp" "$f"; then
-    echo "[backfill-1683] file=$f status=updated"
-  else
-    rm -f "$tmp"
-    echo "[backfill-1683] file=$f status=rewrite-failed"
-  fi
-  return 0
-}
-
-# reconcile_all_accounts_askgate <accounts_dir>
-# Standing check + backfill: every account dir with an account.json gets its
-# AskUserQuestion matcher's carrier gate ensured. Mirrors
-# reconcile_all_accounts_owned_dirs.
-reconcile_all_accounts_askgate() {
-  local accts="$1"
-  [ -d "$accts" ] || return 0
-  local acct
-  for acct in "$accts"/*/; do
-    [ -f "$acct/account.json" ] || continue
-    ensure_askgate_carrier "$acct/.claude/settings.json"
-  done
-}

package/payload/platform/scripts/lib/account-settings-mailbox-inject.sh

@@ -1,91 +0,0 @@
-# account-settings-mailbox-inject.sh — retrofit the per-turn <mailboxes>
-# injection hook onto existing accounts' .claude/settings.json. Task 2157.
-#
-# provision-account-dir.sh writes the UserPromptSubmit array only at provision
-# time, and setup-account.sh re-provisions the HOUSE account only: a client
-# sub-account's settings.json is written once, at creation, by the admin-core
-# account-lifecycle tool, and no install ever rewrites it. Without this lib the
-# hook reaches house accounts only, and no device gate would notice, because the
-# verification account on a single-account install IS that install's house
-# account. Same shape as account-settings-askgate.sh (Task 1683) and
-# account-settings-pdf-conformance.sh (Task 1929).
-#
-# Requires jq. Idempotent. Never echoes file contents. Fail-open (nudge, not
-# brick): any unusable file logs a status and is left untouched.
-#
-# Sourced by setup-account.sh; also runnable standalone for a manual repair.
-
-# The exact command string provision-account-dir.sh writes. $PLATFORM_ROOT is a
-# literal in the settings file, resolved by Claude Code at hook-run time.
-_MBXINJECT_CMD='bash $PLATFORM_ROOT/plugins/admin/hooks/mailbox-inject.sh'
-
-# ensure_mailbox_inject_hook <settings_file>
-# Guarantees the UserPromptSubmit array carries the mailbox-inject command:
-# appends it to the first entry when the array exists without it, or adds a whole
-# entry when the array is empty. Logs exactly one
-# `[backfill-2157] file=<f> status=<absent|no-hooks|already-set|updated|rewrite-failed>`
-# to stdout. Always returns 0.
-ensure_mailbox_inject_hook() {
-  local f="$1"
-  if [ ! -f "$f" ]; then
-    echo "[backfill-2157] file=$f status=absent"
-    return 0
-  fi
-  # Patchable only when the file is valid JSON with a UserPromptSubmit array.
-  if ! jq -e '.hooks.UserPromptSubmit | type == "array"' "$f" >/dev/null 2>&1; then
-    if jq -e . "$f" >/dev/null 2>&1; then
-      echo "[backfill-2157] file=$f status=no-hooks"
-    else
-      echo "[backfill-2157] file=$f status=rewrite-failed"
-    fi
-    return 0
-  fi
-  local tmp="$f.2157.tmp"
-  if ! jq --arg cmd "$_MBXINJECT_CMD" '
-      .hooks.UserPromptSubmit |= (
-        if length == 0
-        then [{hooks: [{type: "command", command: $cmd}]}]
-        else
-          if any(.[]; (.hooks // []) | any(.[]; .command == $cmd))
-          then .
-          else (.[0].hooks = ((.[0].hooks // []) + [{type: "command", command: $cmd}]))
-          end
-        end)
-    ' "$f" > "$tmp" 2>/dev/null; then
-    rm -f "$tmp"
-    echo "[backfill-2157] file=$f status=rewrite-failed"
-    return 0
-  fi
-  # Semantic no-op? Compare canonical forms; leave the file byte-identical if so.
-  # `|| true` keeps a jq failure here (e.g. $f truncated by a concurrent writer
-  # between the type-check above and this read) from tripping a caller's `set -e`
-  # and aborting the whole install — this lib is fail-open by contract.
-  local before after
-  before="$(jq -S . "$f" 2>/dev/null || true)"
-  after="$(jq -S . "$tmp" 2>/dev/null || true)"
-  if [ "$before" = "$after" ]; then
-    rm -f "$tmp"
-    echo "[backfill-2157] file=$f status=already-set"
-    return 0
-  fi
-  if mv "$tmp" "$f"; then
-    echo "[backfill-2157] file=$f status=updated"
-  else
-    rm -f "$tmp"
-    echo "[backfill-2157] file=$f status=rewrite-failed"
-  fi
-  return 0
-}
-
-# reconcile_all_accounts_mailbox_inject <accounts_dir>
-# Standing check + backfill: every account dir with an account.json gets the
-# mailbox-inject hook ensured. Mirrors reconcile_all_accounts_askgate.
-reconcile_all_accounts_mailbox_inject() {
-  local accts="$1"
-  [ -d "$accts" ] || return 0
-  local acct
-  for acct in "$accts"/*/; do
-    [ -f "$acct/account.json" ] || continue
-    ensure_mailbox_inject_hook "$acct/.claude/settings.json"
-  done
-}

package/payload/platform/scripts/lib/account-settings-pdf-conformance.sh

@@ -1,98 +0,0 @@
-# account-settings-pdf-conformance.sh — retrofit the quote-render PDF-conformance
-# PostToolUse matcher onto existing accounts' .claude/settings.json. Task 1929.
-#
-# Task 1922 added a PostToolUse matcher on the browser-pdf-save tool running
-# quote-render-pdf-conformance.sh to provision-account-dir.sh. That writer only
-# runs at account-provision time; the upgrade path re-provisions the house
-# account but NOT existing client sub-accounts, so any account provisioned before
-# 1922 keeps a settings.json without the matcher and never runs the PDF gate
-# (live glsmith is such an account). This lib is the standing backfill:
-# setup-account.sh reconciles every account on every install so the gate reaches
-# pre-1922 accounts. Mirrors account-settings-askgate.sh (Task 1683).
-#
-# Requires jq. Idempotent. Never echoes file contents. Fail-open (nudge, not
-# brick): any unusable file logs a status and is left untouched.
-#
-# Sourced by setup-account.sh; also runnable standalone for a manual repair.
-
-# The exact command string provision-account-dir.sh writes. $PLATFORM_ROOT is a
-# literal in the settings file, resolved by Claude Code at hook-run time.
-_PDF_CONFORMANCE_MATCHER='mcp__plugin_browser_browser__browser-pdf-save'
-_PDF_CONFORMANCE_CMD='bash $PLATFORM_ROOT/plugins/admin/hooks/quote-render-pdf-conformance.sh'
-
-# ensure_pdf_conformance_matcher <settings_file>
-# Guarantees the PostToolUse browser-pdf-save matcher carries the conformance
-# command: appends it if the matcher exists without it, or adds the whole matcher
-# (single conformance command) if the matcher is absent. Logs exactly one
-# `[backfill-1929] file=<f> status=<absent|no-hooks|already-set|updated|rewrite-failed>`
-# to stdout. Always returns 0.
-ensure_pdf_conformance_matcher() {
-  local f="$1"
-  if [ ! -f "$f" ]; then
-    echo "[backfill-1929] file=$f status=absent"
-    return 0
-  fi
-  # Patchable only when the file is valid JSON with a PostToolUse array.
-  if ! jq -e '.hooks.PostToolUse | type == "array"' "$f" >/dev/null 2>&1; then
-    if jq -e . "$f" >/dev/null 2>&1; then
-      echo "[backfill-1929] file=$f status=no-hooks"
-    else
-      echo "[backfill-1929] file=$f status=rewrite-failed"
-    fi
-    return 0
-  fi
-  local tmp="$f.1929.tmp"
-  if ! jq \
-      --arg matcher "$_PDF_CONFORMANCE_MATCHER" \
-      --arg cmd "$_PDF_CONFORMANCE_CMD" '
-      .hooks.PostToolUse |= (
-        if any(.[]; .matcher == $matcher)
-        then map(
-          if .matcher == $matcher
-          then .hooks = (
-                 if any(.hooks[]; .command == $cmd)
-                 then .hooks
-                 else .hooks + [{type: "command", command: $cmd}]
-                 end)
-          else . end)
-        else . + [{matcher: $matcher, hooks: [{type: "command", command: $cmd}]}]
-        end)
-    ' "$f" > "$tmp" 2>/dev/null; then
-    rm -f "$tmp"
-    echo "[backfill-1929] file=$f status=rewrite-failed"
-    return 0
-  fi
-  # Semantic no-op? Compare canonical forms; leave the file byte-identical if so.
-  # `|| true` keeps a jq failure here (e.g. $f truncated by a concurrent writer
-  # between the type-check above and this read) from tripping a caller's `set -e`
-  # and aborting the whole install. This lib is fail-open by contract.
-  local before after
-  before="$(jq -S . "$f" 2>/dev/null || true)"
-  after="$(jq -S . "$tmp" 2>/dev/null || true)"
-  if [ "$before" = "$after" ]; then
-    rm -f "$tmp"
-    echo "[backfill-1929] file=$f status=already-set"
-    return 0
-  fi
-  if mv "$tmp" "$f"; then
-    echo "[backfill-1929] file=$f status=updated"
-  else
-    rm -f "$tmp"
-    echo "[backfill-1929] file=$f status=rewrite-failed"
-  fi
-  return 0
-}
-
-# reconcile_all_accounts_pdf_conformance <accounts_dir>
-# Standing check + backfill: every account dir with an account.json gets its
-# PostToolUse browser-pdf-save matcher's conformance command ensured. Mirrors
-# reconcile_all_accounts_askgate.
-reconcile_all_accounts_pdf_conformance() {
-  local accts="$1"
-  [ -d "$accts" ] || return 0
-  local acct
-  for acct in "$accts"/*/; do
-    [ -f "$acct/account.json" ] || continue
-    ensure_pdf_conformance_matcher "$acct/.claude/settings.json"
-  done
-}

package/payload/platform/scripts/lib/account-settings-public-surface.sh

@@ -1,109 +0,0 @@
-# account-settings-public-surface.sh — retrofit the realised-public-tool-surface
-# hook onto existing accounts' .claude/settings.json. Task 2339.
-#
-# provision-account-dir.sh writes the hooks block only at provision time, and
-# setup-account.sh re-provisions the HOUSE account only: a client sub-account's
-# settings.json is written once, at creation, by the admin-core account-lifecycle
-# tool, and no install ever rewrites it. Without this lib the hook reaches house
-# accounts only, and the account the 2026-08-01 breach was observed on would keep
-# a settings file with no such command — so the instrumentation could not be
-# verified where the defect was seen. Same shape as
-# account-settings-mailbox-inject.sh (Task 2157).
-#
-# Requires jq. Idempotent. Never echoes file contents. Fail-open (nudge, not
-# brick): any unusable file logs a status and is left untouched.
-#
-# Sourced by setup-account.sh; also runnable standalone for a manual repair.
-
-# The exact command string provision-account-dir.sh writes. $PLATFORM_ROOT is a
-# literal in the settings file, resolved by Claude Code at hook-run time.
-_PUBSURFACE_CMD='bash $PLATFORM_ROOT/plugins/admin/hooks/public-tool-surface.sh'
-
-# ensure_public_surface_hook <settings_file>
-# Guarantees the matcher-less PreToolUse entry, the UserPromptSubmit entry and
-# the Stop entry all carry the command. The PreToolUse target is the
-# matcher-less entry specifically: a matcher-scoped entry would narrow the hook
-# to one tool, and the whole point is every tool. UserPromptSubmit is the
-# turn-start reset without which a killed turn's tally inflates the next turn's
-# census. Logs exactly one
-# `[backfill-2339] file=<f> status=<absent|no-hooks|already-set|updated|rewrite-failed>`
-# to stdout. Always returns 0.
-ensure_public_surface_hook() {
-  local f="$1"
-  if [ ! -f "$f" ]; then
-    echo "[backfill-2339] file=$f status=absent"
-    return 0
-  fi
-  # Patchable only when the file is valid JSON with both arrays.
-  if ! jq -e '(.hooks.PreToolUse | type == "array") and (.hooks.UserPromptSubmit | type == "array") and (.hooks.Stop | type == "array")' "$f" >/dev/null 2>&1; then
-    if jq -e . "$f" >/dev/null 2>&1; then
-      echo "[backfill-2339] file=$f status=no-hooks"
-    else
-      echo "[backfill-2339] file=$f status=rewrite-failed"
-    fi
-    return 0
-  fi
-  local tmp="$f.2339.tmp"
-  if ! jq --arg cmd "$_PUBSURFACE_CMD" '
-      .hooks.PreToolUse |= (
-        if any(.[]; (.hooks // []) | any(.[]; .command == $cmd))
-        then .
-        elif any(.[]; has("matcher") | not)
-        then map(if (has("matcher") | not)
-                 then .hooks = ((.hooks // []) + [{type: "command", command: $cmd}])
-                 else . end)
-        else . + [{hooks: [{type: "command", command: $cmd}]}]
-        end)
-      | .hooks.UserPromptSubmit |= (
-        if any(.[]; (.hooks // []) | any(.[]; .command == $cmd))
-        then .
-        elif length == 0
-        then [{hooks: [{type: "command", command: $cmd}]}]
-        else (.[0].hooks = ((.[0].hooks // []) + [{type: "command", command: $cmd}]))
-        end)
-      | .hooks.Stop |= (
-        if any(.[]; (.hooks // []) | any(.[]; .command == $cmd))
-        then .
-        elif length == 0
-        then [{hooks: [{type: "command", command: $cmd}]}]
-        else (.[0].hooks = ((.[0].hooks // []) + [{type: "command", command: $cmd}]))
-        end)
-    ' "$f" > "$tmp" 2>/dev/null; then
-    rm -f "$tmp"
-    echo "[backfill-2339] file=$f status=rewrite-failed"
-    return 0
-  fi
-  # Semantic no-op? Compare canonical forms; leave the file byte-identical if so.
-  # `|| true` keeps a jq failure here (e.g. $f truncated by a concurrent writer
-  # between the type-check above and this read) from tripping a caller's `set -e`
-  # and aborting the whole install — this lib is fail-open by contract.
-  local before after
-  before="$(jq -S . "$f" 2>/dev/null || true)"
-  after="$(jq -S . "$tmp" 2>/dev/null || true)"
-  if [ "$before" = "$after" ]; then
-    rm -f "$tmp"
-    echo "[backfill-2339] file=$f status=already-set"
-    return 0
-  fi
-  if mv "$tmp" "$f"; then
-    echo "[backfill-2339] file=$f status=updated"
-  else
-    rm -f "$tmp"
-    echo "[backfill-2339] file=$f status=rewrite-failed"
-  fi
-  return 0
-}
-
-# reconcile_all_accounts_public_surface <accounts_dir>
-# Standing check + backfill: every account dir with an account.json gets the
-# realised-surface hook ensured on both events. Mirrors
-# reconcile_all_accounts_mailbox_inject.
-reconcile_all_accounts_public_surface() {
-  local accts="$1"
-  [ -d "$accts" ] || return 0
-  local acct
-  for acct in "$accts"/*/; do
-    [ -f "$acct/account.json" ] || continue
-    ensure_public_surface_hook "$acct/.claude/settings.json"
-  done
-}