@rubytech/create-maxy 1.0.881 → 1.0.884

package/payload/platform/scripts/__tests__/logs-read-prefix.sh

@@ -0,0 +1,341 @@
+#!/usr/bin/env bash
+# Task 998 — bash harness for logs-read.sh prefix-match resolution.
+#
+# Covers the contract from the task brief:
+#   1. 8-char prefix → resolves full-UUID file (the original bug)
+#   2. Multiple matches → reason=ambiguous-prefix, exit 1, never picks
+#   3. More-specific prefix disambiguates
+#   4. Zero matches → reason=file-not-found-in-either-shape with glob patterns
+#   5. Full 36-char UUID still resolves (regression boundary)
+#   6. Preflush prefix match
+#   7. Preflush ambiguity (Pass 1 zero, Pass 2 multiple)
+#   8. Every per-conversation type (agent-stream, session, error, public)
+#      resolves under prefix-match
+#
+# Companion to platform/scripts/logs-read.test.sh (Task 671's two-shape
+# resolution harness).
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LOGS_READ="$SCRIPT_DIR/../logs-read.sh"
+if [[ ! -x "$LOGS_READ" ]]; then
+  echo "FATAL: $LOGS_READ not executable" >&2
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+
+# logs-read.sh resolves PLATFORM_ROOT from its own location; mirror the
+# logs-read.test.sh convention by symlinking the script into an ephemeral
+# install tree per case.
+setup_install_tree() {
+  local root="$1"
+  mkdir -p "$root/platform/scripts"
+  mkdir -p "$root/data/accounts/acct-test/logs"
+  mkdir -p "$HOME/.$(basename "$root")/logs"
+  ln -sf "$LOGS_READ" "$root/platform/scripts/logs-read.sh"
+  echo "$root/platform/scripts/logs-read.sh"
+}
+
+cleanup_install_tree() {
+  local root="$1"
+  rm -rf "$root"
+  rm -rf "$HOME/.$(basename "$root")"
+}
+
+run_case() {
+  local name="$1"
+  shift
+  echo ""
+  echo "=== CASE: $name ==="
+  if "$@"; then
+    PASS=$((PASS + 1))
+    echo "PASS: $name"
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: $name"
+  fi
+}
+
+# --- Case 1: 8-char prefix resolves a full-UUID file (original bug) ---
+case_prefix_resolves_full() {
+  local root="/tmp/maxy-logs-read-prefix-1-$$"
+  local script
+  script=$(setup_install_tree "$root")
+  local logdir="$root/data/accounts/acct-test/logs"
+  local full_uuid="3483269d-c793-4a07-98cc-556d936f2f4d"
+  local filename="claude-agent-stream-${full_uuid}.log"
+  echo "prefix-match-sentinel" > "$logdir/$filename"
+
+  local stdout stderr rc=0
+  stdout=$("$script" "3483269d" system 2>/tmp/logs-read-prefix-stderr-1-$$) || rc=$?
+  stderr=$(cat /tmp/logs-read-prefix-stderr-1-$$)
+  rm -f /tmp/logs-read-prefix-stderr-1-$$
+
+  cleanup_install_tree "$root"
+
+  if [[ $rc -ne 0 ]]; then echo "  expected exit 0, got $rc"; return 1; fi
+  if [[ "$stdout" != *"prefix-match-sentinel"* ]]; then
+    echo "  stdout missing sentinel: $stdout"; return 1
+  fi
+  if [[ "$stderr" != *"matched_shape=full"* ]]; then
+    echo "  stderr missing matched_shape=full: $stderr"; return 1
+  fi
+  if [[ "$stdout" != *"$filename"* ]]; then
+    echo "  header missing matched filename: $stdout"; return 1
+  fi
+  return 0
+}
+
+# --- Case 2: Multiple matches on Pass 1 → ambiguous-prefix, exit 1 ---
+case_ambiguous_prefix() {
+  local root="/tmp/maxy-logs-read-prefix-2-$$"
+  local script
+  script=$(setup_install_tree "$root")
+  local logdir="$root/data/accounts/acct-test/logs"
+  echo "A" > "$logdir/claude-agent-stream-aaaaaaaa-1111-A.log"
+  echo "B" > "$logdir/claude-agent-stream-aaaaaaaa-2222-B.log"
+
+  local stdout stderr rc=0
+  stdout=$("$script" "aaaaaaaa" system 2>/tmp/logs-read-prefix-stderr-2-$$) || rc=$?
+  stderr=$(cat /tmp/logs-read-prefix-stderr-2-$$)
+  rm -f /tmp/logs-read-prefix-stderr-2-$$
+
+  cleanup_install_tree "$root"
+
+  if [[ $rc -ne 1 ]]; then echo "  expected exit 1, got $rc"; return 1; fi
+  if [[ "$stderr" != *"reason=ambiguous-prefix"* ]]; then
+    echo "  stderr missing reason=ambiguous-prefix: $stderr"; return 1
+  fi
+  if [[ "$stderr" != *"matches=2"* ]]; then
+    echo "  stderr missing matches=2: $stderr"; return 1
+  fi
+  if [[ "$stderr" != *"claude-agent-stream-aaaaaaaa-1111-A.log"* ]]; then
+    echo "  stderr missing candidate A: $stderr"; return 1
+  fi
+  if [[ "$stderr" != *"claude-agent-stream-aaaaaaaa-2222-B.log"* ]]; then
+    echo "  stderr missing candidate B: $stderr"; return 1
+  fi
+  # Body must NOT contain either sentinel — refusal means no body emitted.
+  if [[ -n "$stdout" ]]; then
+    echo "  stdout non-empty on ambiguous refusal: $stdout"; return 1
+  fi
+  return 0
+}
+
+# --- Case 3: more-specific prefix disambiguates ---
+case_more_specific_disambiguates() {
+  local root="/tmp/maxy-logs-read-prefix-3-$$"
+  local script
+  script=$(setup_install_tree "$root")
+  local logdir="$root/data/accounts/acct-test/logs"
+  echo "ONE" > "$logdir/claude-agent-stream-aaaaaaaa-1111-A.log"
+  echo "TWO" > "$logdir/claude-agent-stream-aaaaaaaa-2222-B.log"
+
+  local stdout stderr rc=0
+  stdout=$("$script" "aaaaaaaa-1111" system 2>/tmp/logs-read-prefix-stderr-3-$$) || rc=$?
+  stderr=$(cat /tmp/logs-read-prefix-stderr-3-$$)
+  rm -f /tmp/logs-read-prefix-stderr-3-$$
+
+  cleanup_install_tree "$root"
+
+  if [[ $rc -ne 0 ]]; then echo "  expected exit 0, got $rc"; return 1; fi
+  if [[ "$stdout" != *"ONE"* ]]; then echo "  stdout missing ONE: $stdout"; return 1; fi
+  if [[ "$stdout" == *"TWO"* ]]; then echo "  stdout contained TWO: $stdout"; return 1; fi
+  if [[ "$stderr" != *"matched_shape=full"* ]]; then
+    echo "  stderr missing matched_shape=full: $stderr"; return 1
+  fi
+  return 0
+}
+
+# --- Case 4: zero matches → tried=[<glob>, <glob>] file-not-found ---
+case_zero_matches() {
+  local root="/tmp/maxy-logs-read-prefix-4-$$"
+  local script
+  script=$(setup_install_tree "$root")
+
+  local stdout stderr rc=0
+  stdout=$("$script" "xxxxxxxx" system 2>/tmp/logs-read-prefix-stderr-4-$$) || rc=$?
+  stderr=$(cat /tmp/logs-read-prefix-stderr-4-$$)
+  rm -f /tmp/logs-read-prefix-stderr-4-$$
+
+  cleanup_install_tree "$root"
+
+  if [[ $rc -ne 1 ]]; then echo "  expected exit 1, got $rc"; return 1; fi
+  if [[ "$stderr" != *"reason=file-not-found-in-either-shape"* ]]; then
+    echo "  stderr missing reason=file-not-found-in-either-shape: $stderr"; return 1
+  fi
+  if [[ "$stderr" != *"tried=[claude-agent-stream-xxxxxxxx*.log, claude-agent-stream-preflush-xxxxxxxx*.log]"* ]]; then
+    echo "  stderr missing tried=[<glob>, <glob>]: $stderr"; return 1
+  fi
+  return 0
+}
+
+# --- Case 5: full 36-char UUID still resolves (regression boundary) ---
+case_full_uuid_regression() {
+  local root="/tmp/maxy-logs-read-prefix-5-$$"
+  local script
+  script=$(setup_install_tree "$root")
+  local logdir="$root/data/accounts/acct-test/logs"
+  local full_uuid="3483269d-c793-4a07-98cc-556d936f2f4d"
+  local filename="claude-agent-stream-${full_uuid}.log"
+  echo "regression-sentinel" > "$logdir/$filename"
+
+  local stdout stderr rc=0
+  stdout=$("$script" "$full_uuid" system 2>/tmp/logs-read-prefix-stderr-5-$$) || rc=$?
+  stderr=$(cat /tmp/logs-read-prefix-stderr-5-$$)
+  rm -f /tmp/logs-read-prefix-stderr-5-$$
+
+  cleanup_install_tree "$root"
+
+  if [[ $rc -ne 0 ]]; then echo "  expected exit 0, got $rc"; return 1; fi
+  if [[ "$stdout" != *"regression-sentinel"* ]]; then
+    echo "  stdout missing sentinel: $stdout"; return 1
+  fi
+  if [[ "$stderr" != *"matched_shape=full"* ]]; then
+    echo "  stderr missing matched_shape=full: $stderr"; return 1
+  fi
+  return 0
+}
+
+# --- Case 6: preflush-only file, prefix-match (Pass 2) ---
+case_preflush_prefix_match() {
+  local root="/tmp/maxy-logs-read-prefix-6-$$"
+  local script
+  script=$(setup_install_tree "$root")
+  local logdir="$root/data/accounts/acct-test/logs"
+  # Preflush filename uses sessionKey:0:12; mimic with a 12-char slice.
+  echo "preflush-prefix-sentinel" > "$logdir/claude-agent-stream-preflush-bbbbbbbb-ccc.log"
+
+  local stdout stderr rc=0
+  stdout=$("$script" "bbbbbbbb" system 2>/tmp/logs-read-prefix-stderr-6-$$) || rc=$?
+  stderr=$(cat /tmp/logs-read-prefix-stderr-6-$$)
+  rm -f /tmp/logs-read-prefix-stderr-6-$$
+
+  cleanup_install_tree "$root"
+
+  if [[ $rc -ne 0 ]]; then echo "  expected exit 0, got $rc"; return 1; fi
+  if [[ "$stdout" != *"preflush-prefix-sentinel"* ]]; then
+    echo "  stdout missing sentinel: $stdout"; return 1
+  fi
+  if [[ "$stderr" != *"matched_shape=preflush"* ]]; then
+    echo "  stderr missing matched_shape=preflush: $stderr"; return 1
+  fi
+  return 0
+}
+
+# --- Case 7: preflush ambiguity (Pass 1 zero, Pass 2 multiple) ---
+case_preflush_ambiguity() {
+  local root="/tmp/maxy-logs-read-prefix-7-$$"
+  local script
+  script=$(setup_install_tree "$root")
+  local logdir="$root/data/accounts/acct-test/logs"
+  echo "P1" > "$logdir/claude-agent-stream-preflush-cccccccc-111.log"
+  echo "P2" > "$logdir/claude-agent-stream-preflush-cccccccc-222.log"
+
+  local stdout stderr rc=0
+  stdout=$("$script" "cccccccc" system 2>/tmp/logs-read-prefix-stderr-7-$$) || rc=$?
+  stderr=$(cat /tmp/logs-read-prefix-stderr-7-$$)
+  rm -f /tmp/logs-read-prefix-stderr-7-$$
+
+  cleanup_install_tree "$root"
+
+  if [[ $rc -ne 1 ]]; then echo "  expected exit 1, got $rc"; return 1; fi
+  if [[ "$stderr" != *"reason=ambiguous-prefix"* ]]; then
+    echo "  stderr missing reason=ambiguous-prefix: $stderr"; return 1
+  fi
+  if [[ "$stderr" != *"matches=2"* ]]; then
+    echo "  stderr missing matches=2: $stderr"; return 1
+  fi
+  if [[ "$stderr" != *"claude-agent-stream-preflush-cccccccc-111.log"* ]]; then
+    echo "  stderr missing preflush candidate 1: $stderr"; return 1
+  fi
+  if [[ "$stderr" != *"claude-agent-stream-preflush-cccccccc-222.log"* ]]; then
+    echo "  stderr missing preflush candidate 2: $stderr"; return 1
+  fi
+  return 0
+}
+
+# --- Case 8: every per-conversation type resolves under prefix-match ---
+# Parameterised over the four prefix_for_type values:
+#   agent-stream → claude-agent-stream-
+#   session      → sse-events-
+#   error        → claude-agent-stderr-
+#   public       → public-agent-stream-
+case_all_types_prefix_match() {
+  local root="/tmp/maxy-logs-read-prefix-8-$$"
+  local script
+  script=$(setup_install_tree "$root")
+  local logdir="$root/data/accounts/acct-test/logs"
+  local full_uuid="7d49ef21-1234-4567-89ab-cdef01234567"
+
+  echo "sentinel-agent-stream" > "$logdir/claude-agent-stream-${full_uuid}.log"
+  echo "sentinel-session"      > "$logdir/sse-events-${full_uuid}.log"
+  echo "sentinel-error"        > "$logdir/claude-agent-stderr-${full_uuid}.log"
+  echo "sentinel-public"       > "$logdir/public-agent-stream-${full_uuid}.log"
+
+  local pairs=(
+    "agent-stream|sentinel-agent-stream"
+    "session|sentinel-session"
+    "error|sentinel-error"
+    "public|sentinel-public"
+  )
+  local fail=0
+  local pair t expected_sentinel
+  for pair in "${pairs[@]}"; do
+    t="${pair%%|*}"
+    expected_sentinel="${pair##*|}"
+    local stdout stderr rc=0
+    stdout=$("$script" "7d49ef21" "$t" 2>/tmp/logs-read-prefix-stderr-8-$$) || rc=$?
+    stderr=$(cat /tmp/logs-read-prefix-stderr-8-$$)
+    rm -f /tmp/logs-read-prefix-stderr-8-$$
+    if [[ $rc -ne 0 ]]; then echo "  [$t] expected exit 0, got $rc — stderr: $stderr"; fail=1; continue; fi
+    if [[ "$stdout" != *"$expected_sentinel"* ]]; then
+      echo "  [$t] missing sentinel '$expected_sentinel': $stdout"; fail=1
+    fi
+    if [[ "$stderr" != *"matched_shape=full"* ]]; then
+      echo "  [$t] stderr missing matched_shape=full: $stderr"; fail=1
+    fi
+  done
+
+  cleanup_install_tree "$root"
+  [[ $fail -eq 0 ]]
+}
+
+# --- Case 9: conv_id with shell metacharacters is rejected ---
+case_metacharacter_rejected() {
+  local root="/tmp/maxy-logs-read-prefix-9-$$"
+  local script
+  script=$(setup_install_tree "$root")
+
+  local stdout stderr rc=0
+  # Use a backslash-escaped wildcard to feed it as a literal argument.
+  stdout=$("$script" "ab*cd" system 2>/tmp/logs-read-prefix-stderr-9-$$) || rc=$?
+  stderr=$(cat /tmp/logs-read-prefix-stderr-9-$$)
+  rm -f /tmp/logs-read-prefix-stderr-9-$$
+
+  cleanup_install_tree "$root"
+
+  if [[ $rc -ne 2 ]]; then echo "  expected exit 2 (usage), got $rc"; return 1; fi
+  if [[ "$stderr" != *"invalid characters"* ]]; then
+    echo "  stderr missing invalid-characters guard: $stderr"; return 1
+  fi
+  return 0
+}
+
+run_case "8-char prefix resolves full-UUID file"        case_prefix_resolves_full
+run_case "ambiguous prefix → refused, candidates listed" case_ambiguous_prefix
+run_case "more-specific prefix disambiguates"            case_more_specific_disambiguates
+run_case "zero matches → file-not-found-in-either-shape" case_zero_matches
+run_case "full 36-char UUID still resolves"              case_full_uuid_regression
+run_case "preflush file resolves by prefix"              case_preflush_prefix_match
+run_case "preflush ambiguity refused"                    case_preflush_ambiguity
+run_case "every per-conversation type prefix-matches"    case_all_types_prefix_match
+run_case "shell metacharacters rejected"                 case_metacharacter_rejected
+
+echo ""
+echo "================================================"
+echo " Passed: $PASS / Failed: $FAIL"
+echo "================================================"
+[[ $FAIL -eq 0 ]]

package/payload/platform/scripts/logs-read.sh

@@ -144,25 +144,42 @@ validate_type() {
   esac
 }
 
-# --- Per-conversation mode: read {prefix}{convId}.log, with preflush fallback ---
+# --- Per-conversation mode: prefix-match {prefix}{convId-prefix}*.log ---
 #
-# Task 671: writer (Task 650) emits logs under two filename shapes —
+# Task 671 — two filename shapes the writer emits:
 #   FULL:     {prefix}{conversationId}.log      (post 1→2-user-turn flush)
 #   PREFLUSH: {prefix}preflush-{id:0:12}.log    (pre-flush, first turn; the
 #                                                 slice is of the sessionKey)
-# This mode tries FULL across every account dir first; if zero FULL hits,
-# falls back to PREFLUSH across every dir. If BOTH exist in the same dir,
-# FULL wins and the preflush sibling is logged to server.log as stale
-# (promotion-race housekeeping signal).
 #
-# Identity note: for the abrupt-exit case this fallback exists to solve,
+# Task 998 — operator surface accepts any unambiguous prefix of the id.
+# The writer's filename is canonical (full 36-char UUID) but every agent
+# line surfaces the 8-char id (`conversationId=3483269d…`). Pass 1 and
+# Pass 2 each glob `${prefix}${conv_id}*.log` so an 8-char operator input
+# resolves a full-UUID file. Three trailer outcomes:
+#   single hit  → exit 0 + matched_shape=full|preflush  (existing success)
+#   zero hits   → exit 1 + reason=file-not-found-in-either-shape (existing miss)
+#   2+ hits     → exit 1 + reason=ambiguous-prefix candidates=[...]; never picks
+#
+# Stale-preflush housekeeping (Task 671): on a single FULL hit, glob the
+# preflush pattern in the same dir and emit `[logs-read] stale-preflush-detected`
+# to server.log for each sibling. Best-effort — retrieval doesn't fail if
+# server.log is unwritable.
+#
+# Identity note: the preflush fallback exists for the abrupt-exit case where
 # the operator passes the sessionKey (no conversationId was ever assigned).
-# For post-flush retrievals the operator passes the conversationId and the
-# FULL file is expected to exist.
+# For post-flush retrievals the operator passes the conversationId (or any
+# unambiguous prefix of it) and the FULL file is expected to exist.
 #
-# MIRROR: keep the two-shape contract in sync with:
-#   - platform/ui/app/lib/logs-read-resolve.ts (canonical TS helper + tests)
-#   - platform/plugins/admin/mcp/src/index.ts (conversationId branch)
+# MIRROR — intentional divergence (Task 998):
+#   - platform/ui/app/lib/logs-read-resolve.ts (canonical TS helper) —
+#     EXACT-MATCH on `${prefix}${conversationId}.log`.
+#   - platform/plugins/admin/mcp/src/index.ts (conversationId branch) —
+#     EXACT-MATCH, same shape.
+# Both serve agents that always hold the full conversationId. This shell
+# counterpart is the operator surface; operators read 8-char ids from agent
+# lines and type them at the SSH prompt. Do not "fix" the divergence by
+# adding prefix-match to TS/MCP — it would mask agent bugs that pass
+# partial ids.
 per_conversation_mode() {
   local conv_id="$1"
   local filter_type="${2:-agent-stream}"
@@ -172,6 +189,14 @@ per_conversation_mode() {
     exit 2
   fi
 
+  # Reject shell metacharacters in conv_id — the prefix-match glob below
+  # would otherwise turn user input into a shell pattern. UUIDs and
+  # sessionKeys only contain [a-zA-Z0-9-].
+  if [[ ! "$conv_id" =~ ^[a-zA-Z0-9-]+$ ]]; then
+    echo "Error: conversationId contains invalid characters (allowed: a-z, A-Z, 0-9, -)" >&2
+    exit 2
+  fi
+
   validate_type "$filter_type"
 
   # Platform-scoped types shortcut to their fixed files regardless of convId.
@@ -190,56 +215,98 @@ per_conversation_mode() {
     exit 2
   fi
 
-  # Build the two filenames the two-shape contract expects.
-  local full_name="${prefix}${conv_id}.log"
-  local preflush_name="${prefix}preflush-${conv_id:0:12}.log"
+  # Glob patterns the two-shape contract expects (Task 998: prefix match).
+  local full_glob="${prefix}${conv_id}*.log"
+  local preflush_glob="${prefix}preflush-${conv_id:0:12}*.log"
 
-  local found=0
   local searched=0
   local matched_shape=""
 
-  # Pass 1: FULL across every log dir. Records stale preflush siblings.
+  # Pass 1: FULL prefix glob across every log dir; aggregate hits.
+  local -a full_hits=()
+  local -a full_dirs=()
+  shopt -s nullglob
   for log_dir in "${ACCOUNT_LOG_DIRS[@]}"; do
-    local full_path="$log_dir/$full_name"
     searched=$((searched + 1))
-    if [[ ! -f "$full_path" ]]; then
-      continue
-    fi
-    [[ $found -gt 0 ]] && echo ""
-    echo "## $(basename "$full_path") ($filter_type)$(account_suffix "$log_dir")"
+    for f in "$log_dir"/${prefix}${conv_id}*.log; do
+      full_hits+=("$f")
+      full_dirs+=("$log_dir")
+    done
+  done
+  shopt -u nullglob
+
+  # Pass 1 ambiguous → refuse, never silently pick.
+  if [[ ${#full_hits[@]} -gt 1 ]]; then
+    local -a candidate_names=()
+    local cf
+    for cf in "${full_hits[@]}"; do
+      candidate_names+=("$(basename "$cf")")
+    done
+    local joined
+    joined=$(IFS=','; printf '%s' "${candidate_names[*]}")
+    echo "-- trailer: conversationId=$conv_id type=$filter_type searched=$searched matches=${#full_hits[@]} reason=ambiguous-prefix candidates=[${joined}]" >&2
+    exit 1
+  fi
+
+  local found=0
+
+  # Pass 1 single hit → emit body, run stale-preflush detection in matched dir.
+  if [[ ${#full_hits[@]} -eq 1 ]]; then
+    local full_path="${full_hits[0]}"
+    local match_dir="${full_dirs[0]}"
+    echo "## $(basename "$full_path") ($filter_type)$(account_suffix "$match_dir")"
     cat "$full_path"
-    found=$((found + 1))
+    found=1
     matched_shape="full"
-    # Stale-preflush detection: if the post-flush rename left the preflush
-    # sibling on disk, emit a housekeeping signal to server.log. Best-effort
-    # — retrieval must not fail if server.log is unwritable.
-    local stale_path="$log_dir/$preflush_name"
-    if [[ -f "$stale_path" ]]; then
+
+    shopt -s nullglob
+    local stale_path
+    for stale_path in "$match_dir"/${prefix}preflush-${conv_id:0:12}*.log; do
       local stale_ts
       stale_ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
       echo "${stale_ts} [logs-read] stale-preflush-detected path=${stale_path}" >> "$SERVER_LOG" 2>/dev/null || true
-    fi
-  done
+    done
+    shopt -u nullglob
+  fi
 
-  # Pass 2: PREFLUSH across every dir. Only runs if zero FULL hits.
+  # Pass 2: PREFLUSH prefix glob, only if Pass 1 had zero hits.
   if [[ $found -eq 0 ]]; then
+    local -a preflush_hits=()
+    local -a preflush_dirs=()
+    shopt -s nullglob
     for log_dir in "${ACCOUNT_LOG_DIRS[@]}"; do
-      local preflush_path="$log_dir/$preflush_name"
       searched=$((searched + 1))
-      if [[ ! -f "$preflush_path" ]]; then
-        continue
-      fi
-      [[ $found -gt 0 ]] && echo ""
-      echo "## $(basename "$preflush_path") ($filter_type)$(account_suffix "$log_dir")"
+      for f in "$log_dir"/${prefix}preflush-${conv_id:0:12}*.log; do
+        preflush_hits+=("$f")
+        preflush_dirs+=("$log_dir")
+      done
+    done
+    shopt -u nullglob
+
+    if [[ ${#preflush_hits[@]} -gt 1 ]]; then
+      local -a candidate_names=()
+      local pf
+      for pf in "${preflush_hits[@]}"; do
+        candidate_names+=("$(basename "$pf")")
+      done
+      local joined
+      joined=$(IFS=','; printf '%s' "${candidate_names[*]}")
+      echo "-- trailer: conversationId=$conv_id type=$filter_type searched=$searched matches=${#preflush_hits[@]} reason=ambiguous-prefix candidates=[${joined}]" >&2
+      exit 1
+    fi
+
+    if [[ ${#preflush_hits[@]} -eq 1 ]]; then
+      local preflush_path="${preflush_hits[0]}"
+      echo "## $(basename "$preflush_path") ($filter_type)$(account_suffix "${preflush_dirs[0]}")"
       cat "$preflush_path"
-      found=$((found + 1))
+      found=1
       matched_shape="preflush"
-    done
+    fi
   fi
 
   # Trailer: empty output never leaves the reader guessing why.
   if [[ $found -eq 0 ]]; then
-    echo "-- trailer: conversationId=$conv_id type=$filter_type searched=$searched found=0 tried=[${full_name}, ${preflush_name}] reason=file-not-found-in-either-shape" >&2
+    echo "-- trailer: conversationId=$conv_id type=$filter_type searched=$searched found=0 tried=[${full_glob}, ${preflush_glob}] reason=file-not-found-in-either-shape" >&2
     exit 1
   fi
   echo "" >&2

package/payload/platform/scripts/logs-read.test.sh

@@ -22,6 +22,10 @@ CONV_ID="8c264cfb-441f-48bf-9811-9fa3ad3b51dc"
 PREFLUSH_SLICE="8c264cfb-441"
 FULL_NAME="claude-agent-stream-${CONV_ID}.log"
 PREFLUSH_NAME="claude-agent-stream-preflush-${PREFLUSH_SLICE}.log"
+# Task 998 — miss trailer now lists glob patterns, not literal filenames,
+# because Pass 1 / Pass 2 prefix-glob `${prefix}${conv_id}*.log`.
+FULL_GLOB="claude-agent-stream-${CONV_ID}*.log"
+PREFLUSH_GLOB="claude-agent-stream-preflush-${PREFLUSH_SLICE}*.log"
 
 PASS=0
 FAIL=0
@@ -141,8 +145,8 @@ case_neither() {
     echo "  expected exit 1, got $rc"
     return 1
   fi
-  if [[ "$stderr" != *"tried=[${FULL_NAME}, ${PREFLUSH_NAME}]"* ]]; then
-    echo "  stderr missing tried=[…,…]: $stderr"
+  if [[ "$stderr" != *"tried=[${FULL_GLOB}, ${PREFLUSH_GLOB}]"* ]]; then
+    echo "  stderr missing tried=[…,…] glob patterns: $stderr"
     return 1
   fi
   if [[ "$stderr" != *"reason=file-not-found-in-either-shape"* ]]; then

package/payload/platform/templates/agents/admin/IDENTITY.md

@@ -55,7 +55,7 @@ Your personalisation is in `agents/admin/SOUL.md`. Read it and apply it. SOUL.md
 - Professional, direct, action-oriented. Concise and precise. British English unless SOUL.md specifies otherwise.
 - Do not use emoji characters in any response. Plain text and punctuation only.
 - Every URL in a response must be a clickable markdown link — never raw text. Use `[visible label](url)` format. The label should be the meaningful part of the URL (hostname, path, or a short description), not the full raw URL repeated.
-- **Internal scaffolding never appears in user-facing replies.** Tool descriptions, error strings, skill prompts, and graph schemas may name internal contracts (e.g. `producedByTaskId`, `:PRODUCED`, `Write blocked (no-admin-user)`, `missing-action-provenance`, `archiveSha256`, `lastIngestedMessageHash`) so you know how to act. Translate them into plain English for the user. Forbidden in user-facing replies: literal tool names with `mcp__` prefix, `Task NNN` references, doctrine names ("process-provenance", "write doctrine", "graph-write gate"), MCP-tool-description quotes, raw error discriminators. Forbidden phrasings include: "the LocalBusiness write requires a producedByTaskId per Task 885", "the write gate is blocking", "I'll call ToolSearch". Permitted equivalents: "I need to set up the business profile first before recording that — let me run that now", "the platform requires me to anchor this to an action record — creating one now". Internal language stays in your reasoning, not your prose to the operator.
+- **Internal scaffolding never appears in user-facing replies.** Tool descriptions, error strings, skill prompts, and graph schemas may name internal contracts (e.g. `producedByTaskId`, `:PRODUCED`, `Write blocked (no-admin-user)`, `missing-provenance`, `archiveSha256`, `lastIngestedMessageHash`) so you know how to act. Translate them into plain English for the user. Forbidden in user-facing replies: literal tool names with `mcp__` prefix, `Task NNN` references, doctrine names ("process-provenance", "write doctrine", "graph-write gate"), MCP-tool-description quotes, raw error discriminators. Forbidden phrasings include: "the LocalBusiness write requires a producedByTaskId per Task 885", "the write gate is blocking", "I'll call ToolSearch". Permitted equivalents: "I need to set up the business profile first before recording that — let me run that now", "the platform requires me to anchor this to an action record — creating one now". Internal language stays in your reasoning, not your prose to the operator.
 
 ## Information Sourcing
 

package/payload/premium-plugins/real-agency/BUNDLE.md

@@ -17,7 +17,7 @@ plugins:
 
 # Real Agency
 
-Premium plugin bundle for UK estate agency professionals. Purchasing this bundle grants access to all 11 sub-plugins, each independently activatable via `enabledPlugins`. The bundle also delivers three specialist roles — negotiator, valuer, and compliance — that embed domain knowledge from the sub-plugins and operate autonomously with Loop CRM tools.
+Premium plugin bundle for UK estate agency professionals. Purchasing this bundle grants access to all 11 sub-plugins, each independently activatable via `enabledPlugins`. When the bundle is auto-delivered at admin session startup (or explicitly via `premium-deliver`), every sub-plugin in the `plugins:` list above is stamped into `account.json` `enabledPlugins` in one idempotent set-union — delivery implies enablement, so `mcp__loop__*` tools and the other sub-plugin surfaces are visible to the agent from the first turn after install. Disable individual sub-plugins with `plugin-toggle-enabled`. The bundle also delivers three specialist roles — negotiator, valuer, and compliance — that embed domain knowledge from the sub-plugins and operate autonomously with Loop CRM tools.
 
 ## Specialist Roles