@rubytech/create-realagent-code 0.1.572 → 0.1.574

package/payload/platform/plugins/admin/hooks/__tests__/quote-render-pdf-conformance.test.sh

@@ -29,6 +29,14 @@
 #   P. a block names the headerless page numbers
 #   Q. a running footer repeating the ref does NOT count as a header
 #   R. @page :first declared before @page still yields the marker
+#
+# Running-image geometry (only a document declaring an image margin box):
+#   S. running image within a third of the page width      → ALLOWED
+#   T. running image wider than a third                    → BLOCKED
+#   U. an oversized image on ONE page only (content photo) → ALLOWED
+#   W. source declares no image margin box                 → ALLOWED (never gated)
+#   V. pdfimages unusable → ALLOWED, and the skip says reason=no-poppler
+#   X. the link stage's non-gated return names its reason rather than going quiet
 
 set -u
 
@@ -59,39 +67,66 @@ mk_job() { # jobId, html_body, pdf_uri_repeat
     > "$DOCS/quote-$job.pdf"
 }
 
-# A minimal, uncompressed, multi-page PDF. Each page argument is
-# "<top line>|<bottom line>"; the bottom line is optional and stands in for a
-# running footer. The /URI stubs above are not readable by pdftotext, and the
-# header check needs real per-page text at real positions, so the header
-# fixtures need a genuine PDF. Pure stdlib — no third-party generator, no
-# network, deterministic byte-for-byte.
-mk_pdf() { # out_path, then one "top|bottom" argument per page
+# A minimal, multi-page PDF. Each page argument is "<top>|<bottom>|<images>";
+# the bottom line is optional and stands in for a running footer, and images is
+# an optional ";"-separated list of "<pixel width>,<pixel height>,<rendered pt>".
+# The /URI stubs above are not readable by pdftotext, and the header check needs
+# real per-page text at real positions, so the header fixtures need a genuine
+# PDF. Pure stdlib — no third-party generator, no network, deterministic
+# byte-for-byte.
+#
+# An image is drawn through a transform matrix, so its rendered size on the page
+# is independent of its pixel size: that is what makes `pdfimages -list` report a
+# controlled x-ppi, and rendered width = pixel width / x-ppi * 72 is exactly what
+# the geometry check asserts. The image object is created once per (width,height)
+# and referenced from every page carrying it, which is what a running header is
+# in a real print and what makes "present on every checked page" testable.
+mk_pdf() { # out_path, then one "top|bottom|W,H,pt;W,H,pt" argument per page
   local out="$1"; shift
   python3 - "$out" "$@" <<'PY'
-import sys
-out, texts = sys.argv[1], sys.argv[2:]
+import sys, zlib
+out, specs = sys.argv[1], sys.argv[2:]
 objs = []
-kids = " ".join("%d 0 R" % (4 + 2 * i) for i in range(len(texts)))
-objs.append("<< /Type /Catalog /Pages 2 0 R >>")
-objs.append("<< /Type /Pages /Kids [%s] /Count %d >>" % (kids, len(texts)))
-objs.append("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>")
-for i, t in enumerate(texts):
-    top, _, bottom = t.partition("|")
+def add(b):
+    objs.append(b if isinstance(b, bytes) else b.encode("latin-1"))
+    return len(objs)
+add("<< /Type /Catalog /Pages 2 0 R >>")
+add("PLACEHOLDER")  # 2: /Pages, patched once the kid object numbers are known
+add("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>")
+kids, shared = [], {}
+for spec in specs:
+    top, bottom, imgs = (spec.split("|") + ["", ""])[:3]
     body = "BT /F1 11 Tf 72 760 Td (%s) Tj ET" % top
     if bottom:
         body += " BT /F1 8 Tf 72 40 Td (%s) Tj ET" % bottom
-    objs.append("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 595 842] "
-                "/Resources << /Font << /F1 3 0 R >> >> /Contents %d 0 R >>" % (5 + 2 * i))
-    objs.append("<< /Length %d >>\nstream\n%s\nendstream" % (len(body), body))
-pdf, offsets = "%PDF-1.4\n", []
+    res, xo = "/Font << /F1 3 0 R >>", []
+    for k, one in enumerate(x for x in imgs.split(";") if x):
+        ws, hs, pts = one.split(",")
+        w, h, pt = int(ws), int(hs), float(pts)
+        if (w, h) not in shared:
+            comp = zlib.compress(bytes([200, 30, 30]) * (w * h))
+            shared[(w, h)] = add(
+                b"<< /Type /XObject /Subtype /Image /Width %d /Height %d /ColorSpace /DeviceRGB "
+                b"/BitsPerComponent 8 /Filter /FlateDecode /Length %d >>\nstream\n"
+                % (w, h, len(comp)) + comp + b"\nendstream")
+        xo.append("/Im%d %d 0 R" % (k, shared[(w, h)]))
+        body += " q %.3f 0 0 %.3f 40 %d cm /Im%d Do Q" % (pt, pt * h / w, 700 - k * 120, k)
+    if xo:
+        res += " /XObject << %s >>" % " ".join(xo)
+    c = add("<< /Length %d >>\nstream\n%s\nendstream" % (len(body), body))
+    kids.append(add("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 595 842] "
+                    "/Resources << %s >> /Contents %d 0 R >>" % (res, c)))
+objs[1] = ("<< /Type /Pages /Kids [%s] /Count %d >>"
+           % (" ".join("%d 0 R" % k for k in kids), len(kids))).encode("latin-1")
+pdf, offsets = b"%PDF-1.4\n", []
 for i, o in enumerate(objs, start=1):
     offsets.append(len(pdf))
-    pdf += "%d 0 obj\n%s\nendobj\n" % (i, o)
+    pdf += b"%d 0 obj\n" % i + o + b"\nendobj\n"
 start = len(pdf)
-pdf += "xref\n0 %d\n0000000000 65535 f \n" % (len(objs) + 1)
-pdf += "".join("%010d 00000 n \n" % off for off in offsets)
-pdf += "trailer\n<< /Size %d /Root 1 0 R >>\nstartxref\n%d\n%%%%EOF\n" % (len(objs) + 1, start)
-open(out, "wb").write(pdf.encode("latin-1"))
+pdf += b"xref\n0 %d\n0000000000 65535 f \n" % (len(objs) + 1)
+pdf += b"".join(b"%010d 00000 n \n" % off for off in offsets)
+pdf += b"trailer\n<< /Size %d /Root 1 0 R >>\nstartxref\n%d\n%%%%EOF\n" % (len(objs) + 1, start)
+open(out, "wb").write(pdf)
 PY
 }
 
@@ -192,6 +227,69 @@ run_case "Q: footer repeats the ref, page 3 headerless → BLOCKED" \
 run_case "R: @page :first declared first, page 3 headerless → BLOCKED" \
   "$(envelope "$BROWSER" "$DOCS/hdr-first-declared-first.pdf")" 2
 
+# ---- running-image geometry ----
+# Chromium paints a page-margin box's content:url() at intrinsic pixel size and
+# does not scale it to the declared box, so a full-resolution logo covers most of
+# the page on every page the box paints. The assertion is scoped to the RUNNING
+# image — the object present on every checked page — because a content photo
+# legitimately runs wider: measured on real quotes, running headers 9.0-18.9% of
+# page width against content photos at 38.7-77.2% and the defect at 88.2%.
+mk_doc_img() { # basename, css, then one "top|bottom|W,H,pt;…" per page
+  local base="$1" css="$2"; shift 2
+  printf '<html><head>%s</head><body>doc</body></html>' "$css" > "$DOCS/$base.html"
+  mk_pdf "$DOCS/$base.pdf" "$@"
+}
+
+# S: 125px at 96ppi = 93.8pt = 15.8% of the 595pt page. The corrected print.
+mk_doc_img "geo-ok" "$HDR_CSS" \
+  "cover masthead" "Quote 2468/1 two||125,45,93.8" "Quote 2468/1 three||125,45,93.8"
+# T: 700px at 96ppi = 525.0pt = 88.2%. The measured defect.
+mk_doc_img "geo-wide" "$HDR_CSS" \
+  "cover masthead" "Quote 2468/1 two||700,252,525" "Quote 2468/1 three||700,252,525"
+# U: compliant running header plus a one-page 1300px photo at 230pt = 38.7%.
+# A whole-page third-of-width rule blocks this document, and it is legitimate.
+mk_doc_img "geo-photo" "$HDR_CSS" \
+  "cover masthead" "Quote 2468/1 two||125,45,93.8;1300,1300,230" "Quote 2468/1 three||125,45,93.8"
+# W: no image margin box declared, so geometry never applies however wide.
+mk_doc_img "geo-nobox" "$NOHDR_CSS" \
+  "page one" "page two||700,252,525" "page three||700,252,525"
+
+run_case "S: running image within a third of page width → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/geo-ok.pdf")" 0
+run_case "T: running image over a third of page width → BLOCKED" \
+  "$(envelope "$BROWSER" "$DOCS/geo-wide.pdf")" 2
+run_case "U: an oversized photo on one page only → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/geo-photo.pdf")" 0
+run_case "W: no image margin box declared → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/geo-nobox.pdf")" 0
+
+# V: `pdfimages` alone is unusable. Shadowing pdfinfo too would make the header
+# stage take its own pre-existing no-poppler exit and the geometry stage would
+# never run, so the case would pass without testing anything new. The stub is
+# EXECUTABLE and prints nothing: a non-executable file is skipped by the PATH
+# search rather than failing, so the real binary would still be found. An absent
+# binary and an unusable one converge on the same empty listing.
+STUB="$ACCT/nopdfimages"
+mkdir -p "$STUB"
+printf '#!/bin/sh\nexit 127\n' > "$STUB/pdfimages"
+chmod +x "$STUB/pdfimages"
+V_OUT=$( cd "$ACCT" && PATH="$STUB:$PATH" bash -c 'printf "%s" "$1" | bash "$2" 2>&1 >/dev/null' \
+  _ "$(envelope "$BROWSER" "$DOCS/geo-ok.pdf")" "$HOOK" )
+if printf '%s' "$V_OUT" | grep -q 'op=pdf-image-geometry .*reason=no-poppler'; then
+  echo "PASS: V: absent pdfimages emits reason=no-poppler"; PASS=$((PASS + 1))
+else
+  echo "FAIL: V: geometry no-poppler skip absent (got: $V_OUT)" >&2; FAIL=$((FAIL + 1))
+fi
+
+# X: the link stage returns without inspecting anything on a non-quote path. It
+# did so silently, which is indistinguishable from a gate that never ran at all.
+X_OUT=$( cd "$ACCT" && printf '%s' "$(envelope "$BROWSER" "$DOCS/brochure.pdf")" | bash "$HOOK" 2>&1 >/dev/null )
+if printf '%s' "$X_OUT" | grep -q 'op=skip reason=not-gated'; then
+  echo "PASS: X: link stage skip names its reason"; PASS=$((PASS + 1))
+else
+  echo "FAIL: X: link skip reason absent (got: $X_OUT)" >&2; FAIL=$((FAIL + 1))
+fi
+
 # O: a clean run is distinguishable from a check that never ran.
 STDERR=$( cd "$ACCT" && printf '%s' "$(envelope "$BROWSER" "$DOCS/hdr-ok.pdf")" | bash "$HOOK" 2>&1 >/dev/null )
 if printf '%s' "$STDERR" | grep -q 'op=pdf-header-conformance .*pagesChecked=2 pagesHeaderless=0'; then

package/payload/platform/plugins/admin/hooks/__tests__/specialist-dispatch-gate.test.sh

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# Regression test for specialist-dispatch-gate.sh.
+#
+# An account's own specialists own their tools: the admin does not do their work
+# by hand. The gate refuses a main-conversation call to a tool one of the
+# account's authored cards declares, and names the specialist to dispatch.
+#
+# Two narrowings are load-bearing and both are asserted here. Only cards the
+# ACCOUNT authored count — provisioning copies every shipped template in, and one
+# of them declares roughly 130 tools including the whole email surface, so
+# reading every card would refuse the admin nearly its entire seat. And native
+# tools are never gated, because every card declares some of them.
+#
+# Caller identity is `agent_type`, which Claude Code sets when a hook fires
+# inside a subagent and leaves empty in the main conversation.
+#
+# Covers:
+#   A. main conversation, authored tool           → BLOCKED, names the specialist
+#   B. same call inside a subagent                → ALLOWED (never filters a subagent)
+#   C. a native tool the card also declares       → ALLOWED
+#   D. a tool only a shipped template declares    → ALLOWED
+#   E. a tool only a premium bundle declares      → ALLOWED
+#   F. an account with no authored cards          → ALLOWED
+#   G. empty stdin                                → ALLOWED
+#   H. unparseable envelope                       → ALLOWED
+#   I. an unreadable specialists dir              → ALLOWED, op=degraded on stderr
+#   J. a card under the ACCOUNT's own plugin root → BLOCKED (still the account's own)
+#   K. the refuse line carries the account and the tool
+#   L. the native set matches CC_NATIVE_TOOLS in the session manager
+
+set -uo pipefail
+HOOKS_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+GATE="$HOOKS_DIR/specialist-dispatch-gate.sh"
+DRIFT_SOURCE="$(cd "$HOOKS_DIR/../../../services/claude-session-manager/src" && pwd)/specialist-drift.ts"
+
+PASS=0
+FAIL=0
+ok()  { PASS=$((PASS + 1)); echo "  ok   $1"; }
+bad() { FAIL=$((FAIL + 1)); echo "  FAIL $1"; }
+
+ROOT="$(mktemp -d)"
+trap 'chmod -R u+rwX "$ROOT" 2>/dev/null; rm -rf "$ROOT"' EXIT
+
+ACCT="$ROOT/2078cb54aaaa"
+PLATFORM="$ROOT/platform"
+PREMIUM="$ROOT/premium-plugins"
+mkdir -p "$ACCT/specialists/agents" \
+         "$PLATFORM/templates/specialists/agents" \
+         "$PLATFORM/plugins" \
+         "$PREMIUM/sitedesk/agents"
+
+card() { # dir file name tools
+  mkdir -p "$1"
+  printf -- '---\nname: %s\ndescription: "d"\ntools: %s\n---\nbody\n' "$3" "$4" > "$1/$2"
+}
+
+# The account's own clerk: no copy in any shipped root.
+card "$ACCT/specialists/agents" "glsmith--email-clerk.md" "email-clerk" \
+     "Read, Bash, mcp__plugin_email_email__email-draft"
+# A shipped template, copied into the account by provisioning.
+card "$ACCT/specialists/agents" "personal-assistant.md" "personal-assistant" \
+     "mcp__plugin_whatsapp_whatsapp__whatsapp-send-admin"
+card "$PLATFORM/templates/specialists/agents" "personal-assistant.md" "personal-assistant" \
+     "mcp__plugin_whatsapp_whatsapp__whatsapp-send-admin"
+# A premium bundle card, also copied in.
+card "$ACCT/specialists/agents" "sitedesk--quoter.md" "quoter" \
+     "mcp__plugin_sitedesk-job_sitedesk-job__quote-render"
+card "$PREMIUM/sitedesk/agents" "sitedesk--quoter.md" "quoter" \
+     "mcp__plugin_sitedesk-job_sitedesk-job__quote-render"
+# An authored card whose durable copy lives under the ACCOUNT's own plugin root.
+card "$ACCT/specialists/agents" "glsmith--order-clerk.md" "order-clerk" \
+     "mcp__plugin_work_work__work-create"
+card "$ACCT/plugins/glsmith/agents" "glsmith--order-clerk.md" "order-clerk" \
+     "mcp__plugin_work_work__work-create"
+
+envelope() { printf '{"tool_name":"%s","agent_type":%s,"tool_input":{}}' "$1" "$2"; }
+
+# fire <cwd> <json> — sets RC and ERR
+fire() {
+  ERR="$(cd "$1" && printf '%s' "$2" | PLATFORM_ROOT="$PLATFORM" bash "$GATE" 2>&1 >/dev/null)"
+  RC=$?
+}
+
+# A
+fire "$ACCT" "$(envelope mcp__plugin_email_email__email-draft '""')"
+if [ "$RC" = 2 ] && printf '%s' "$ERR" | grep -q 'email-clerk'; then
+  ok "A blocks the main conversation and names the specialist"
+else bad "A rc=$RC err=$ERR"; fi
+
+# B
+fire "$ACCT" "$(envelope mcp__plugin_email_email__email-draft '"specialists:email-clerk"')"
+if [ "$RC" = 0 ]; then ok "B allows the same call inside a subagent"; else bad "B rc=$RC err=$ERR"; fi
+
+# C
+fire "$ACCT" "$(envelope Bash '""')"
+if [ "$RC" = 0 ]; then ok "C allows a native tool the card declares"; else bad "C rc=$RC err=$ERR"; fi
+
+# D
+fire "$ACCT" "$(envelope mcp__plugin_whatsapp_whatsapp__whatsapp-send-admin '""')"
+if [ "$RC" = 0 ]; then ok "D allows a tool only a shipped template declares"; else bad "D rc=$RC err=$ERR"; fi
+
+# E
+fire "$ACCT" "$(envelope mcp__plugin_sitedesk-job_sitedesk-job__quote-render '""')"
+if [ "$RC" = 0 ]; then ok "E allows a tool only a premium bundle declares"; else bad "E rc=$RC err=$ERR"; fi
+
+# F
+EMPTY="$ROOT/empty"
+mkdir -p "$EMPTY/specialists/agents"
+fire "$EMPTY" "$(envelope mcp__plugin_email_email__email-draft '""')"
+if [ "$RC" = 0 ]; then ok "F allows on an account with no authored cards"; else bad "F rc=$RC err=$ERR"; fi
+
+# G
+fire "$ACCT" ""
+if [ "$RC" = 0 ]; then ok "G allows on empty stdin"; else bad "G rc=$RC err=$ERR"; fi
+
+# H
+fire "$ACCT" '{not json'
+if [ "$RC" = 0 ]; then ok "H allows on an unparseable envelope"; else bad "H rc=$RC err=$ERR"; fi
+
+# I — failing open is fine; failing open SILENTLY is the fault.
+BROKEN="$ROOT/brokenacct"
+mkdir -p "$BROKEN/specialists/agents"
+chmod 000 "$BROKEN/specialists/agents"
+fire "$BROKEN" "$(envelope mcp__plugin_email_email__email-draft '""')"
+chmod 755 "$BROKEN/specialists/agents"
+if [ "$RC" = 0 ] && printf '%s' "$ERR" | grep -q 'op=degraded'; then
+  ok "I fails open and says so"
+else bad "I rc=$RC err=$ERR"; fi
+
+# J
+fire "$ACCT" "$(envelope mcp__plugin_work_work__work-create '""')"
+if [ "$RC" = 2 ] && printf '%s' "$ERR" | grep -q 'order-clerk'; then
+  ok "J blocks a card whose durable copy is under the account plugin root"
+else bad "J rc=$RC err=$ERR"; fi
+
+# K
+fire "$ACCT" "$(envelope mcp__plugin_email_email__email-draft '""')"
+if printf '%s' "$ERR" | grep -q 'op=refuse account=2078cb54 tool=mcp__plugin_email_email__email-draft specialist=email-clerk'; then
+  ok "K the refuse line carries the account, the tool and the specialist"
+else bad "K err=$ERR"; fi
+
+# L — the hook cannot import the manager's TypeScript, so it mirrors
+# CC_NATIVE_TOOLS as a python literal. A mirror that drifts silently un-gates or
+# over-gates, so the two sets are compared rather than trusted.
+TS_SET="$(sed -n '/export const CC_NATIVE_TOOLS/,/^\])/p' "$DRIFT_SOURCE" \
+  | grep -oE "'[A-Za-z]+'" | tr -d "'" | sort -u)"
+SH_SET="$(sed -n '/^NATIVE = {/,/^}/p' "$GATE" \
+  | grep -oE '"[A-Za-z]+"' | tr -d '"' | sort -u)"
+if [ "$TS_SET" = "$SH_SET" ]; then
+  ok "L the native set matches CC_NATIVE_TOOLS"
+else
+  bad "L native sets differ:"
+  diff <(printf '%s\n' "$TS_SET") <(printf '%s\n' "$SH_SET") | sed 's/^/       /'
+fi
+
+echo "──────── specialist-dispatch-gate summary ────────"
+echo "pass=$PASS fail=$FAIL"
+[ "$FAIL" -eq 0 ]

package/payload/platform/plugins/admin/hooks/html-structure-gate.sh

@@ -0,0 +1,165 @@
+#!/usr/bin/env bash
+# html-structure-gate — PreToolUse gate on Write / Edit / MultiEdit.
+#
+# Refuses a write that would produce an HTML document with a <style> element
+# opened inside another one, or with more openers than closers.
+#
+# The fault is not cosmetic. HTML parses style content as raw text, so the FIRST
+# </style> closes the outer element: everything after it becomes body content and
+# renders as visible text, and the rule immediately after the stray opener is
+# eaten as part of an invalid selector. One fault, two symptoms — a leaked
+# stylesheet above the header and an unstyled box further down the same page.
+#
+# The detector has three rules, and the same three are implemented in the
+# session-manager census that walks what is already on disk:
+#   1. HTML comments are stripped first, each replaced by its own newlines, so a
+#      <style> inside <!-- … --> is not scanned and line numbers do not shift.
+#      That comment case is real: two account templates carry one and are clean,
+#      and a comment-blind detector reports both.
+#   2. <style…> and </style…> are walked case-insensitively, tracking depth. An
+#      opener seen at depth > 0 is the fault.
+#   3. At end of input, openers must equal closers; an unmatched opener is
+#      reported at its own line.
+#
+# It walks the document the call would PRODUCE, not the fragment it carries. For
+# Write that is `content`; for Edit and MultiEdit the on-disk file is read and
+# the replacements applied in memory first. Walking a fragment cannot work: rule
+# 3 would refuse every partial edit, and a nested opener whose outer <style> is
+# already on disk would pass.
+#
+# Scope is the whole account with an exclusion list, never a bucket list: every
+# .html/.htm resolving inside the account dir except under node_modules/,
+# .wrangler/, .tool/ and .trash/. A bucket list is what let the live document
+# through — it sat under sites/<project>/public/, which no quote bucket covers.
+# The account dir is this hook's cwd, as in fs-schema-guard.sh.
+#
+# Exit codes: 0 = allow, 2 = block (stderr shown to the agent). Fail OPEN on an
+# uninspectable envelope — tty, empty stdin, unreadable target, unparseable edit.
+# A gate that bricks writes on a parse failure is worse than the fault it catches.
+#
+# The observability line is a direct append to the resolved server.log, not an
+# echo: a hook's stderr reaches no sink on an allow, so a stderr-only line would
+# be an audit nothing reads. No task numbers or internal refs in operator text.
+
+set -uo pipefail
+
+# No envelope (tty or empty stdin) → allow: cannot inspect, must not brick writes.
+if [ -t 0 ]; then exit 0; fi
+INPUT=$(cat)
+[ -z "$INPUT" ] && exit 0
+
+VERDICT=$(INPUT="$INPUT" ACCT="$PWD" python3 - <<'PY' 2>/dev/null || true
+import os, re, json, sys
+
+COMMENT = re.compile(r"<!--.*?-->", re.S)
+CSS_COMMENT = re.compile(r"/\*.*?\*/", re.S)
+TAG = re.compile(r"<\s*(/)?\s*style\b[^>]*>", re.I)
+EXCLUDED = ("node_modules", ".wrangler", ".tool", ".trash")
+
+
+def fault_line(s):
+    """Line of the first nested or unmatched <style> opener, else None."""
+    t = COMMENT.sub(lambda m: "\n" * m.group(0).count("\n"), s)
+    spans = [(m.start(), m.end()) for m in CSS_COMMENT.finditer(t)]
+    depth = 0
+    open_line = 0
+    for m in TAG.finditer(t):
+        line = t.count("\n", 0, m.start()) + 1
+        if m.group(1):
+            if depth > 0:
+                depth -= 1
+        elif depth > 0:
+            # A CSS comment protects an opener but never a closer. Style content
+            # is raw text to the HTML parser, so </style> terminates the element
+            # wherever it appears; an opener is never a parse event there, only
+            # text the CSS parser reads as an invalid selector — and inside a
+            # comment it is discarded, so nothing is eaten.
+            if any(a <= m.start() < b for a, b in spans):
+                continue
+            return line
+        else:
+            depth = 1
+            open_line = line
+    return open_line if depth > 0 else None
+
+
+try:
+    d = json.loads(os.environ["INPUT"])
+except Exception:
+    sys.exit(0)
+if (d.get("tool_name", "") or "") not in ("Write", "Edit", "MultiEdit"):
+    sys.exit(0)
+tool = d["tool_name"]
+ti = d.get("tool_input", {}) or {}
+target = ti.get("file_path") or ""
+if not target:
+    sys.exit(0)
+
+acct = os.path.realpath(os.environ["ACCT"])
+ab = os.path.realpath(target if os.path.isabs(target) else os.path.join(acct, target))
+if not ab.startswith(acct + os.sep):
+    sys.exit(0)
+rel = os.path.relpath(ab, acct)
+if os.path.splitext(rel)[1].lower() not in (".html", ".htm"):
+    sys.exit(0)
+if any(p in EXCLUDED for p in rel.split(os.sep)):
+    sys.exit(0)
+
+if tool == "Write":
+    produced = ti.get("content")
+    if not isinstance(produced, str):
+        sys.exit(0)
+else:
+    try:
+        with open(ab, encoding="utf-8", errors="replace") as fh:
+            produced = fh.read()
+    except Exception:
+        sys.exit(0)
+    edits = ti.get("edits") if tool == "MultiEdit" else [ti]
+    if not isinstance(edits, list):
+        sys.exit(0)
+    for e in edits:
+        if not isinstance(e, dict):
+            sys.exit(0)
+        old, new = e.get("old_string"), e.get("new_string")
+        if not isinstance(old, str) or not isinstance(new, str):
+            sys.exit(0)
+        produced = produced.replace(old, new) if e.get("replace_all") else produced.replace(old, new, 1)
+
+line = fault_line(produced)
+if line is None:
+    sys.exit(0)
+print(line)
+print(json.dumps(rel))
+PY
+)
+
+[ -z "$VERDICT" ] && exit 0
+LINE=$(printf '%s' "$VERDICT" | sed -n 1p)
+QREL=$(printf '%s' "$VERDICT" | sed -n 2p)
+[ -z "$LINE" ] && exit 0
+
+# Sink ladder, as quote-render-pdf-conformance.sh: LOG_DIR is stamped on the
+# rc-spawn path, CLAUDE_SESSION_MANAGER_PERSIST_DIR is on the systemd unit and
+# resolves to the same directory, the account's own logs dir is the last resort.
+#
+# There is deliberately no hard-coded brand fallback. Four brands are co-resident
+# on one box, each with its own ~/.<brand>/logs, so a literal would file this
+# account's path in a SIBLING brand's server.log. When no rung resolves, the line
+# is dropped: the refusal still blocks and still reaches the agent on stderr.
+LOGD=""
+if [ -n "${LOG_DIR:-}" ] && [ -d "${LOG_DIR}" ]; then
+  LOGD="$LOG_DIR"
+elif [ -n "${CLAUDE_SESSION_MANAGER_PERSIST_DIR:-}" ] && [ -d "${CLAUDE_SESSION_MANAGER_PERSIST_DIR}/logs" ]; then
+  LOGD="$CLAUDE_SESSION_MANAGER_PERSIST_DIR/logs"
+elif [ -d "$PWD/logs" ]; then
+  LOGD="$PWD/logs"
+fi
+if [ -n "$LOGD" ]; then
+  ID8=$(basename "$PWD" | cut -c1-8)
+  printf '[html-structure-gate] op=refuse account=%s file=%s line=%s\n' \
+    "$ID8" "$QREL" "$LINE" >>"$LOGD/server.log" 2>/dev/null || true
+fi
+
+echo "Blocked: this document opens a <style> element inside another one (line $LINE). The browser closes the outer element at the first </style>, so the rest of the stylesheet renders as visible text on the page and the rule after the stray opener is discarded. Put the block in the body as its own <style> element, or merge its rules into the one already open." >&2
+exit 2