npm - @rubytech/create-realagent-code - Versions diffs - 0.1.573 → 0.1.575 - Mend

@rubytech/create-realagent-code 0.1.573 → 0.1.575

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1001) hide show

package/payload/platform/plugins/admin/hooks/__tests__/html-structure-gate.test.sh ADDED Viewed

@@ -0,0 +1,264 @@
+#!/usr/bin/env bash
+# Regression test for html-structure-gate.sh.
+#
+# A second <style> opener nested inside an open <style> element is not a
+# cosmetic fault. HTML parses style content as raw text, so the FIRST </style>
+# closes the outer element: everything after it becomes body content and renders
+# as visible text on the page, and the rule immediately after the stray opener is
+# eaten as part of an invalid selector. One fault, two symptoms, and a client
+# quotation went out carrying both.
+#
+# The gate walks the document the call would PRODUCE, not the fragment it
+# carries. For Write that is `content`; for Edit and MultiEdit the on-disk file
+# is read and the replacements applied in memory first. Walking a fragment cannot
+# work: the unbalanced-at-EOF rule would refuse every partial edit, and a nested
+# opener whose outer <style> is already on disk would pass.
+#
+# Scope is the whole account with an exclusion list, never a bucket list. A
+# bucket list is what let the live file through: it sat under sites/<project>/
+# public/, which no quote bucket covers.
+#
+# Covers:
+#   A. Write producing a nested opener            → BLOCKED, names the line
+#   B. the same document with the opener removed  → ALLOWED
+#   C. <style> inside an HTML comment             → ALLOWED
+#   D. three openers, two closers                 → BLOCKED, names the unmatched one
+#   E. a write under sites/<project>/public/      → BLOCKED (not a quote bucket)
+#   F. a write under node_modules/                → ALLOWED (excluded)
+#   G. a .txt target                              → ALLOWED
+#   H. Edit introducing the opener into a clean file → BLOCKED
+#   I. Edit elsewhere in an already-malformed file   → BLOCKED
+#   J. MultiEdit whose second edit introduces it     → BLOCKED
+#   K. empty stdin                                → ALLOWED (fail-open)
+#   L. a Read of a malformed path                 → ALLOWED
+#   M. a path outside the account dir             → ALLOWED
+#   N. a block appends the op=refuse line, path JSON-quoted
+set -u
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/html-structure-gate.sh"
+if [[ ! -x "$HOOK" ]]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+FAKE=$(mktemp -d)
+cleanup() { rm -rf "$FAKE"; }
+trap cleanup EXIT
+ACCT="$FAKE/accounts/2078cb54abcd"
+mkdir -p "$ACCT/sites/gls-sign/public" "$ACCT/node_modules/pkg" "$ACCT/logs" \
+         "$ACCT/documents/Quotations/1867" "$FAKE/outside"
+# A document whose stray opener sits at line 4.
+NESTED='<html>
+<style>
+:root{--orange:#F89828;}
+<style>
+  .esign-box{border:1px solid var(--orange);}
+</style>
+<body>ok</body>
+</html>'
+CLEAN='<html>
+<style>
+:root{--orange:#F89828;}
+  .esign-box{border:1px solid var(--orange);}
+</style>
+<body>ok</body>
+</html>'
+# The false positive a comment-blind detector produces: the templates on the
+# live install carry a <style> inside an HTML comment and are clean.
+COMMENTED='<html>
+<style>
+a{}
+<!--
+<style>
+-->
+</style>
+</html>'
+# Three openers, two closers. The unmatched opener is on line 5.
+UNBALANCED='<style>
+</style>
+<style>
+</style>
+<style>
+a{}'
+# Already malformed on disk: an edit anywhere in it still produces a malformed
+# document, so it is refused.
+printf '%s\n' "$NESTED" > "$ACCT/documents/Quotations/1867/broken.html"
+printf '%s\n' "$CLEAN" > "$ACCT/documents/Quotations/1867/clean.html"
+printf '%s\n' "$NESTED" > "$FAKE/outside/broken.html"
+PASS=0
+FAIL=0
+write_envelope() { # file_path, content
+  python3 -c '
+import json, sys
+print(json.dumps({"hook_event_name": "PreToolUse", "tool_name": "Write",
+                  "tool_input": {"file_path": sys.argv[1], "content": sys.argv[2]}}))' "$1" "$2"
+}
+edit_envelope() { # file_path, old_string, new_string
+  python3 -c '
+import json, sys
+print(json.dumps({"hook_event_name": "PreToolUse", "tool_name": "Edit",
+                  "tool_input": {"file_path": sys.argv[1], "old_string": sys.argv[2],
+                                 "new_string": sys.argv[3]}}))' "$1" "$2" "$3"
+}
+multiedit_envelope() { # file_path, old1, new1, old2, new2
+  python3 -c '
+import json, sys
+print(json.dumps({"hook_event_name": "PreToolUse", "tool_name": "MultiEdit",
+                  "tool_input": {"file_path": sys.argv[1], "edits": [
+                      {"old_string": sys.argv[2], "new_string": sys.argv[3]},
+                      {"old_string": sys.argv[4], "new_string": sys.argv[5]}]}}))' "$1" "$2" "$3" "$4" "$5"
+}
+other_envelope() { # tool_name, file_path
+  python3 -c '
+import json, sys
+print(json.dumps({"hook_event_name": "PreToolUse", "tool_name": sys.argv[1],
+                  "tool_input": {"file_path": sys.argv[2]}}))' "$1" "$2"
+}
+run_case() { # name, stdin, expected_exit
+  local name="$1" stdin="$2" expected_exit="$3" actual_exit
+  ( cd "$ACCT" && export LOG_DIR="$ACCT/logs" && printf '%s' "$stdin" | bash "$HOOK" >/dev/null 2>/dev/null )
+  actual_exit=$?
+  if [[ "$actual_exit" -eq "$expected_exit" ]]; then
+    echo "PASS: $name (exit=$actual_exit)"
+    PASS=$((PASS + 1))
+  else
+    echo "FAIL: $name (expected exit=$expected_exit, got=$actual_exit)" >&2
+    FAIL=$((FAIL + 1))
+  fi
+}
+run_line_case() { # name, stdin, expected_line
+  local name="$1" stdin="$2" want="$3" out
+  out=$( cd "$ACCT" && export LOG_DIR="$ACCT/logs" && printf '%s' "$stdin" | bash "$HOOK" 2>&1 >/dev/null )
+  if printf '%s' "$out" | grep -q "line $want"; then
+    echo "PASS: $name (names line $want)"
+    PASS=$((PASS + 1))
+  else
+    echo "FAIL: $name (expected line $want, got: $out)" >&2
+    FAIL=$((FAIL + 1))
+  fi
+}
+run_case "A: Write producing a nested opener → BLOCKED" \
+  "$(write_envelope 'documents/Quotations/1867/new.html' "$NESTED")" 2
+run_line_case "A2: the block names the stray opener's line" \
+  "$(write_envelope 'documents/Quotations/1867/new.html' "$NESTED")" 4
+run_case "B: the same document with the opener removed → ALLOWED" \
+  "$(write_envelope 'documents/Quotations/1867/new.html' "$CLEAN")" 0
+run_case "C: <style> inside an HTML comment → ALLOWED" \
+  "$(write_envelope 'documents/Quotations/1867/front-matter.html' "$COMMENTED")" 0
+run_case "D: three openers, two closers → BLOCKED" \
+  "$(write_envelope 'documents/Quotations/1867/new.html' "$UNBALANCED")" 2
+run_line_case "D2: the unbalanced block names the unmatched opener" \
+  "$(write_envelope 'documents/Quotations/1867/new.html' "$UNBALANCED")" 5
+run_case "E: a write under sites/<project>/public/ → BLOCKED" \
+  "$(write_envelope 'sites/gls-sign/public/quote-gresswell.html' "$NESTED")" 2
+run_case "F: a write under node_modules/ → ALLOWED (excluded)" \
+  "$(write_envelope 'node_modules/pkg/broken.html' "$NESTED")" 0
+run_case "G: a .txt target → ALLOWED" \
+  "$(write_envelope 'documents/Quotations/1867/notes.txt' "$NESTED")" 0
+run_case "H: Edit introducing the opener into a clean file → BLOCKED" \
+  "$(edit_envelope 'documents/Quotations/1867/clean.html' '  .esign-box' '<style>
+  .esign-box')" 2
+run_case "I: Edit elsewhere in an already-malformed file → BLOCKED" \
+  "$(edit_envelope 'documents/Quotations/1867/broken.html' '<body>ok</body>' '<body>changed</body>')" 2
+run_case "J: MultiEdit whose second edit introduces the opener → BLOCKED" \
+  "$(multiedit_envelope 'documents/Quotations/1867/clean.html' '<body>ok</body>' '<body>two</body>' '  .esign-box' '<style>
+  .esign-box')" 2
+# The shipped property-brochure template documents its override slot with a CSS
+# comment naming the tag it wants emitted. The CSS parser discards a comment, so
+# the mention is inert. A closer is NOT protected the same way: style content is
+# raw text to the HTML parser, so </style> terminates the element wherever it
+# appears.
+CSS_COMMENT='<html>
+<style>
+a{}
+/* branded register MUST emit a <style id="brand-tokens"> block here */
+b{}
+</style>
+</html>'
+CLOSER_IN_COMMENT='<html>
+<style>
+a{}
+/* </style> */
+<style>
+<style>
+</style>
+</html>'
+run_case "K: empty stdin → ALLOWED (fail-open)" "" 0
+run_case "K2: an opener named inside a CSS comment → ALLOWED" \
+  "$(write_envelope 'documents/Quotations/1867/brochure.html' "$CSS_COMMENT")" 0
+run_case "K3: a closer inside a CSS comment still closes, so the next nesting is caught" \
+  "$(write_envelope 'documents/Quotations/1867/brochure.html' "$CLOSER_IN_COMMENT")" 2
+run_case "L: a Read of a malformed path → ALLOWED" \
+  "$(other_envelope Read 'documents/Quotations/1867/broken.html')" 0
+run_case "M: a path outside the account dir → ALLOWED" \
+  "$(write_envelope "$FAKE/outside/broken.html" "$NESTED")" 0
+# N. The observability line: one append per refusal, path JSON-quoted so a
+# filename carrying spaces survives a key=value reader.
+SPACED='documents/Quotations/1867/Q1867 - 22 Barley Ponds Road (Themistocli).html'
+( cd "$ACCT" && export LOG_DIR="$ACCT/logs" && printf '%s' "$(write_envelope "$SPACED" "$NESTED")" | bash "$HOOK" >/dev/null 2>&1 )
+if grep -qF '[html-structure-gate] op=refuse account=2078cb54 file="documents/Quotations/1867/Q1867 - 22 Barley Ponds Road (Themistocli).html" line=4' "$ACCT/logs/server.log" 2>/dev/null; then
+  echo "PASS: N: the refusal is logged with a JSON-quoted path and the account id8"
+  PASS=$((PASS + 1))
+else
+  echo "FAIL: N: no op=refuse line (got: $(cat "$ACCT/logs/server.log" 2>/dev/null))" >&2
+  FAIL=$((FAIL + 1))
+fi
+# O. Brand isolation: when no brand-correct sink resolves, the refusal still
+# blocks but writes nothing. Four brands are co-resident on the laptop and each
+# has its own ~/.<brand>/logs, so a hard-coded fallback would file one brand's
+# account path in another brand's server.log.
+BARE="$FAKE/accounts/bare0000acct"
+mkdir -p "$BARE"
+printf '%s\n' "$NESTED" > "$BARE/doc.html"
+FAKEHOME="$FAKE/fakehome"
+mkdir -p "$FAKEHOME/.maxy-code/logs"
+O_ENVELOPE=$(write_envelope 'doc.html' "$NESTED")
+( cd "$BARE" && printf '%s' "$O_ENVELOPE" | env -u LOG_DIR -u CLAUDE_SESSION_MANAGER_PERSIST_DIR \
+    HOME="$FAKEHOME" bash "$HOOK" >/dev/null 2>&1 )
+O_EXIT=$?
+if [[ "$O_EXIT" -eq 2 ]] && [[ ! -s "$FAKEHOME/.maxy-code/logs/server.log" ]]; then
+  echo "PASS: O: with no brand-correct sink the write is still refused and no other brand's log is written"
+  PASS=$((PASS + 1))
+else
+  echo "FAIL: O: exit=$O_EXIT, foreign log=$(cat "$FAKEHOME/.maxy-code/logs/server.log" 2>/dev/null)" >&2
+  FAIL=$((FAIL + 1))
+fi
+echo "──────── html-structure-gate test summary ────────"
+echo "PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/__tests__/quote-render-pdf-conformance.test.sh CHANGED Viewed

@@ -29,6 +29,14 @@
 #   P. a block names the headerless page numbers
 #   Q. a running footer repeating the ref does NOT count as a header
 #   R. @page :first declared before @page still yields the marker
+#
+# Running-image geometry (only a document declaring an image margin box):
+#   S. running image within a third of the page width      → ALLOWED
+#   T. running image wider than a third                    → BLOCKED
+#   U. an oversized image on ONE page only (content photo) → ALLOWED
+#   W. source declares no image margin box                 → ALLOWED (never gated)
+#   V. pdfimages unusable → ALLOWED, and the skip says reason=no-poppler
+#   X. the link stage's non-gated return names its reason rather than going quiet
 set -u
@@ -59,39 +67,66 @@ mk_job() { # jobId, html_body, pdf_uri_repeat
     > "$DOCS/quote-$job.pdf"
 }
-# A minimal, uncompressed, multi-page PDF. Each page argument is
-# "<top line>|<bottom line>"; the bottom line is optional and stands in for a
-# running footer. The /URI stubs above are not readable by pdftotext, and the
-# header check needs real per-page text at real positions, so the header
-# fixtures need a genuine PDF. Pure stdlib — no third-party generator, no
-# network, deterministic byte-for-byte.
-mk_pdf() { # out_path, then one "top|bottom" argument per page
+# A minimal, multi-page PDF. Each page argument is "<top>|<bottom>|<images>";
+# the bottom line is optional and stands in for a running footer, and images is
+# an optional ";"-separated list of "<pixel width>,<pixel height>,<rendered pt>".
+# The /URI stubs above are not readable by pdftotext, and the header check needs
+# real per-page text at real positions, so the header fixtures need a genuine
+# PDF. Pure stdlib — no third-party generator, no network, deterministic
+# byte-for-byte.
+#
+# An image is drawn through a transform matrix, so its rendered size on the page
+# is independent of its pixel size: that is what makes `pdfimages -list` report a
+# controlled x-ppi, and rendered width = pixel width / x-ppi * 72 is exactly what
+# the geometry check asserts. The image object is created once per (width,height)
+# and referenced from every page carrying it, which is what a running header is
+# in a real print and what makes "present on every checked page" testable.
+mk_pdf() { # out_path, then one "top|bottom|W,H,pt;W,H,pt" argument per page
   local out="$1"; shift
   python3 - "$out" "$@" <<'PY'
-import sys
-out, texts = sys.argv[1], sys.argv[2:]
+import sys, zlib
+out, specs = sys.argv[1], sys.argv[2:]
 objs = []
-kids = " ".join("%d 0 R" % (4 + 2 * i) for i in range(len(texts)))
-objs.append("<< /Type /Catalog /Pages 2 0 R >>")
-objs.append("<< /Type /Pages /Kids [%s] /Count %d >>" % (kids, len(texts)))
-objs.append("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>")
-for i, t in enumerate(texts):
-    top, _, bottom = t.partition("|")
+def add(b):
+    objs.append(b if isinstance(b, bytes) else b.encode("latin-1"))
+    return len(objs)
+add("<< /Type /Catalog /Pages 2 0 R >>")
+add("PLACEHOLDER")  # 2: /Pages, patched once the kid object numbers are known
+add("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>")
+kids, shared = [], {}
+for spec in specs:
+    top, bottom, imgs = (spec.split("|") + ["", ""])[:3]
     body = "BT /F1 11 Tf 72 760 Td (%s) Tj ET" % top
     if bottom:
         body += " BT /F1 8 Tf 72 40 Td (%s) Tj ET" % bottom
-    objs.append("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 595 842] "
-                "/Resources << /Font << /F1 3 0 R >> >> /Contents %d 0 R >>" % (5 + 2 * i))
-    objs.append("<< /Length %d >>\nstream\n%s\nendstream" % (len(body), body))
-pdf, offsets = "%PDF-1.4\n", []
+    res, xo = "/Font << /F1 3 0 R >>", []
+    for k, one in enumerate(x for x in imgs.split(";") if x):
+        ws, hs, pts = one.split(",")
+        w, h, pt = int(ws), int(hs), float(pts)
+        if (w, h) not in shared:
+            comp = zlib.compress(bytes([200, 30, 30]) * (w * h))
+            shared[(w, h)] = add(
+                b"<< /Type /XObject /Subtype /Image /Width %d /Height %d /ColorSpace /DeviceRGB "
+                b"/BitsPerComponent 8 /Filter /FlateDecode /Length %d >>\nstream\n"
+                % (w, h, len(comp)) + comp + b"\nendstream")
+        xo.append("/Im%d %d 0 R" % (k, shared[(w, h)]))
+        body += " q %.3f 0 0 %.3f 40 %d cm /Im%d Do Q" % (pt, pt * h / w, 700 - k * 120, k)
+    if xo:
+        res += " /XObject << %s >>" % " ".join(xo)
+    c = add("<< /Length %d >>\nstream\n%s\nendstream" % (len(body), body))
+    kids.append(add("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 595 842] "
+                    "/Resources << %s >> /Contents %d 0 R >>" % (res, c)))
+objs[1] = ("<< /Type /Pages /Kids [%s] /Count %d >>"
+           % (" ".join("%d 0 R" % k for k in kids), len(kids))).encode("latin-1")
+pdf, offsets = b"%PDF-1.4\n", []
 for i, o in enumerate(objs, start=1):
     offsets.append(len(pdf))
-    pdf += "%d 0 obj\n%s\nendobj\n" % (i, o)
+    pdf += b"%d 0 obj\n" % i + o + b"\nendobj\n"
 start = len(pdf)
-pdf += "xref\n0 %d\n0000000000 65535 f \n" % (len(objs) + 1)
-pdf += "".join("%010d 00000 n \n" % off for off in offsets)
-pdf += "trailer\n<< /Size %d /Root 1 0 R >>\nstartxref\n%d\n%%%%EOF\n" % (len(objs) + 1, start)
-open(out, "wb").write(pdf.encode("latin-1"))
+pdf += b"xref\n0 %d\n0000000000 65535 f \n" % (len(objs) + 1)
+pdf += b"".join(b"%010d 00000 n \n" % off for off in offsets)
+pdf += b"trailer\n<< /Size %d /Root 1 0 R >>\nstartxref\n%d\n%%%%EOF\n" % (len(objs) + 1, start)
+open(out, "wb").write(pdf)
 PY
 }
@@ -192,6 +227,69 @@ run_case "Q: footer repeats the ref, page 3 headerless → BLOCKED" \
 run_case "R: @page :first declared first, page 3 headerless → BLOCKED" \
   "$(envelope "$BROWSER" "$DOCS/hdr-first-declared-first.pdf")" 2
+# ---- running-image geometry ----
+# Chromium paints a page-margin box's content:url() at intrinsic pixel size and
+# does not scale it to the declared box, so a full-resolution logo covers most of
+# the page on every page the box paints. The assertion is scoped to the RUNNING
+# image — the object present on every checked page — because a content photo
+# legitimately runs wider: measured on real quotes, running headers 9.0-18.9% of
+# page width against content photos at 38.7-77.2% and the defect at 88.2%.
+mk_doc_img() { # basename, css, then one "top|bottom|W,H,pt;…" per page
+  local base="$1" css="$2"; shift 2
+  printf '<html><head>%s</head><body>doc</body></html>' "$css" > "$DOCS/$base.html"
+  mk_pdf "$DOCS/$base.pdf" "$@"
+}
+# S: 125px at 96ppi = 93.8pt = 15.8% of the 595pt page. The corrected print.
+mk_doc_img "geo-ok" "$HDR_CSS" \
+  "cover masthead" "Quote 2468/1 two||125,45,93.8" "Quote 2468/1 three||125,45,93.8"
+# T: 700px at 96ppi = 525.0pt = 88.2%. The measured defect.
+mk_doc_img "geo-wide" "$HDR_CSS" \
+  "cover masthead" "Quote 2468/1 two||700,252,525" "Quote 2468/1 three||700,252,525"
+# U: compliant running header plus a one-page 1300px photo at 230pt = 38.7%.
+# A whole-page third-of-width rule blocks this document, and it is legitimate.
+mk_doc_img "geo-photo" "$HDR_CSS" \
+  "cover masthead" "Quote 2468/1 two||125,45,93.8;1300,1300,230" "Quote 2468/1 three||125,45,93.8"
+# W: no image margin box declared, so geometry never applies however wide.
+mk_doc_img "geo-nobox" "$NOHDR_CSS" \
+  "page one" "page two||700,252,525" "page three||700,252,525"
+run_case "S: running image within a third of page width → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/geo-ok.pdf")" 0
+run_case "T: running image over a third of page width → BLOCKED" \
+  "$(envelope "$BROWSER" "$DOCS/geo-wide.pdf")" 2
+run_case "U: an oversized photo on one page only → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/geo-photo.pdf")" 0
+run_case "W: no image margin box declared → ALLOWED" \
+  "$(envelope "$BROWSER" "$DOCS/geo-nobox.pdf")" 0
+# V: `pdfimages` alone is unusable. Shadowing pdfinfo too would make the header
+# stage take its own pre-existing no-poppler exit and the geometry stage would
+# never run, so the case would pass without testing anything new. The stub is
+# EXECUTABLE and prints nothing: a non-executable file is skipped by the PATH
+# search rather than failing, so the real binary would still be found. An absent
+# binary and an unusable one converge on the same empty listing.
+STUB="$ACCT/nopdfimages"
+mkdir -p "$STUB"
+printf '#!/bin/sh\nexit 127\n' > "$STUB/pdfimages"
+chmod +x "$STUB/pdfimages"
+V_OUT=$( cd "$ACCT" && PATH="$STUB:$PATH" bash -c 'printf "%s" "$1" | bash "$2" 2>&1 >/dev/null' \
+  _ "$(envelope "$BROWSER" "$DOCS/geo-ok.pdf")" "$HOOK" )
+if printf '%s' "$V_OUT" | grep -q 'op=pdf-image-geometry .*reason=no-poppler'; then
+  echo "PASS: V: absent pdfimages emits reason=no-poppler"; PASS=$((PASS + 1))
+else
+  echo "FAIL: V: geometry no-poppler skip absent (got: $V_OUT)" >&2; FAIL=$((FAIL + 1))
+fi
+# X: the link stage returns without inspecting anything on a non-quote path. It
+# did so silently, which is indistinguishable from a gate that never ran at all.
+X_OUT=$( cd "$ACCT" && printf '%s' "$(envelope "$BROWSER" "$DOCS/brochure.pdf")" | bash "$HOOK" 2>&1 >/dev/null )
+if printf '%s' "$X_OUT" | grep -q 'op=skip reason=not-gated'; then
+  echo "PASS: X: link stage skip names its reason"; PASS=$((PASS + 1))
+else
+  echo "FAIL: X: link skip reason absent (got: $X_OUT)" >&2; FAIL=$((FAIL + 1))
+fi
 # O: a clean run is distinguishable from a check that never ran.
 STDERR=$( cd "$ACCT" && printf '%s' "$(envelope "$BROWSER" "$DOCS/hdr-ok.pdf")" | bash "$HOOK" 2>&1 >/dev/null )
 if printf '%s' "$STDERR" | grep -q 'op=pdf-header-conformance .*pagesChecked=2 pagesHeaderless=0'; then

package/payload/platform/plugins/admin/hooks/__tests__/specialist-dispatch-gate.test.sh ADDED Viewed

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# Regression test for specialist-dispatch-gate.sh.
+#
+# An account's own specialists own their tools: the admin does not do their work
+# by hand. The gate refuses a main-conversation call to a tool one of the
+# account's authored cards declares, and names the specialist to dispatch.
+#
+# Two narrowings are load-bearing and both are asserted here. Only cards the
+# ACCOUNT authored count — provisioning copies every shipped template in, and one
+# of them declares roughly 130 tools including the whole email surface, so
+# reading every card would refuse the admin nearly its entire seat. And native
+# tools are never gated, because every card declares some of them.
+#
+# Caller identity is `agent_type`, which Claude Code sets when a hook fires
+# inside a subagent and leaves empty in the main conversation.
+#
+# Covers:
+#   A. main conversation, authored tool           → BLOCKED, names the specialist
+#   B. same call inside a subagent                → ALLOWED (never filters a subagent)
+#   C. a native tool the card also declares       → ALLOWED
+#   D. a tool only a shipped template declares    → ALLOWED
+#   E. a tool only a premium bundle declares      → ALLOWED
+#   F. an account with no authored cards          → ALLOWED
+#   G. empty stdin                                → ALLOWED
+#   H. unparseable envelope                       → ALLOWED
+#   I. an unreadable specialists dir              → ALLOWED, op=degraded on stderr
+#   J. a card under the ACCOUNT's own plugin root → BLOCKED (still the account's own)
+#   K. the refuse line carries the account and the tool
+#   L. the native set matches CC_NATIVE_TOOLS in the session manager
+set -uo pipefail
+HOOKS_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+GATE="$HOOKS_DIR/specialist-dispatch-gate.sh"
+DRIFT_SOURCE="$(cd "$HOOKS_DIR/../../../services/claude-session-manager/src" && pwd)/specialist-drift.ts"
+PASS=0
+FAIL=0
+ok()  { PASS=$((PASS + 1)); echo "  ok   $1"; }
+bad() { FAIL=$((FAIL + 1)); echo "  FAIL $1"; }
+ROOT="$(mktemp -d)"
+trap 'chmod -R u+rwX "$ROOT" 2>/dev/null; rm -rf "$ROOT"' EXIT
+ACCT="$ROOT/2078cb54aaaa"
+PLATFORM="$ROOT/platform"
+PREMIUM="$ROOT/premium-plugins"
+mkdir -p "$ACCT/specialists/agents" \
+         "$PLATFORM/templates/specialists/agents" \
+         "$PLATFORM/plugins" \
+         "$PREMIUM/sitedesk/agents"
+card() { # dir file name tools
+  mkdir -p "$1"
+  printf -- '---\nname: %s\ndescription: "d"\ntools: %s\n---\nbody\n' "$3" "$4" > "$1/$2"
+}
+# The account's own clerk: no copy in any shipped root.
+card "$ACCT/specialists/agents" "glsmith--email-clerk.md" "email-clerk" \
+     "Read, Bash, mcp__plugin_email_email__email-draft"
+# A shipped template, copied into the account by provisioning.
+card "$ACCT/specialists/agents" "personal-assistant.md" "personal-assistant" \
+     "mcp__plugin_whatsapp_whatsapp__whatsapp-send-admin"
+card "$PLATFORM/templates/specialists/agents" "personal-assistant.md" "personal-assistant" \
+     "mcp__plugin_whatsapp_whatsapp__whatsapp-send-admin"
+# A premium bundle card, also copied in.
+card "$ACCT/specialists/agents" "sitedesk--quoter.md" "quoter" \
+     "mcp__plugin_sitedesk-job_sitedesk-job__quote-render"
+card "$PREMIUM/sitedesk/agents" "sitedesk--quoter.md" "quoter" \
+     "mcp__plugin_sitedesk-job_sitedesk-job__quote-render"
+# An authored card whose durable copy lives under the ACCOUNT's own plugin root.
+card "$ACCT/specialists/agents" "glsmith--order-clerk.md" "order-clerk" \
+     "mcp__plugin_work_work__work-create"
+card "$ACCT/plugins/glsmith/agents" "glsmith--order-clerk.md" "order-clerk" \
+     "mcp__plugin_work_work__work-create"
+envelope() { printf '{"tool_name":"%s","agent_type":%s,"tool_input":{}}' "$1" "$2"; }
+# fire <cwd> <json> — sets RC and ERR
+fire() {
+  ERR="$(cd "$1" && printf '%s' "$2" | PLATFORM_ROOT="$PLATFORM" bash "$GATE" 2>&1 >/dev/null)"
+  RC=$?
+}
+# A
+fire "$ACCT" "$(envelope mcp__plugin_email_email__email-draft '""')"
+if [ "$RC" = 2 ] && printf '%s' "$ERR" | grep -q 'email-clerk'; then
+  ok "A blocks the main conversation and names the specialist"
+else bad "A rc=$RC err=$ERR"; fi
+# B
+fire "$ACCT" "$(envelope mcp__plugin_email_email__email-draft '"specialists:email-clerk"')"
+if [ "$RC" = 0 ]; then ok "B allows the same call inside a subagent"; else bad "B rc=$RC err=$ERR"; fi
+# C
+fire "$ACCT" "$(envelope Bash '""')"
+if [ "$RC" = 0 ]; then ok "C allows a native tool the card declares"; else bad "C rc=$RC err=$ERR"; fi
+# D
+fire "$ACCT" "$(envelope mcp__plugin_whatsapp_whatsapp__whatsapp-send-admin '""')"
+if [ "$RC" = 0 ]; then ok "D allows a tool only a shipped template declares"; else bad "D rc=$RC err=$ERR"; fi
+# E
+fire "$ACCT" "$(envelope mcp__plugin_sitedesk-job_sitedesk-job__quote-render '""')"
+if [ "$RC" = 0 ]; then ok "E allows a tool only a premium bundle declares"; else bad "E rc=$RC err=$ERR"; fi
+# F
+EMPTY="$ROOT/empty"
+mkdir -p "$EMPTY/specialists/agents"
+fire "$EMPTY" "$(envelope mcp__plugin_email_email__email-draft '""')"
+if [ "$RC" = 0 ]; then ok "F allows on an account with no authored cards"; else bad "F rc=$RC err=$ERR"; fi
+# G
+fire "$ACCT" ""
+if [ "$RC" = 0 ]; then ok "G allows on empty stdin"; else bad "G rc=$RC err=$ERR"; fi
+# H
+fire "$ACCT" '{not json'
+if [ "$RC" = 0 ]; then ok "H allows on an unparseable envelope"; else bad "H rc=$RC err=$ERR"; fi
+# I — failing open is fine; failing open SILENTLY is the fault.
+BROKEN="$ROOT/brokenacct"
+mkdir -p "$BROKEN/specialists/agents"
+chmod 000 "$BROKEN/specialists/agents"
+fire "$BROKEN" "$(envelope mcp__plugin_email_email__email-draft '""')"
+chmod 755 "$BROKEN/specialists/agents"
+if [ "$RC" = 0 ] && printf '%s' "$ERR" | grep -q 'op=degraded'; then
+  ok "I fails open and says so"
+else bad "I rc=$RC err=$ERR"; fi
+# J
+fire "$ACCT" "$(envelope mcp__plugin_work_work__work-create '""')"
+if [ "$RC" = 2 ] && printf '%s' "$ERR" | grep -q 'order-clerk'; then
+  ok "J blocks a card whose durable copy is under the account plugin root"
+else bad "J rc=$RC err=$ERR"; fi
+# K
+fire "$ACCT" "$(envelope mcp__plugin_email_email__email-draft '""')"
+if printf '%s' "$ERR" | grep -q 'op=refuse account=2078cb54 tool=mcp__plugin_email_email__email-draft specialist=email-clerk'; then
+  ok "K the refuse line carries the account, the tool and the specialist"
+else bad "K err=$ERR"; fi
+# L — the hook cannot import the manager's TypeScript, so it mirrors
+# CC_NATIVE_TOOLS as a python literal. A mirror that drifts silently un-gates or
+# over-gates, so the two sets are compared rather than trusted.
+TS_SET="$(sed -n '/export const CC_NATIVE_TOOLS/,/^\])/p' "$DRIFT_SOURCE" \
+  | grep -oE "'[A-Za-z]+'" | tr -d "'" | sort -u)"
+SH_SET="$(sed -n '/^NATIVE = {/,/^}/p' "$GATE" \
+  | grep -oE '"[A-Za-z]+"' | tr -d '"' | sort -u)"
+if [ "$TS_SET" = "$SH_SET" ]; then
+  ok "L the native set matches CC_NATIVE_TOOLS"
+else
+  bad "L native sets differ:"
+  diff <(printf '%s\n' "$TS_SET") <(printf '%s\n' "$SH_SET") | sed 's/^/       /'
+fi
+echo "──────── specialist-dispatch-gate summary ────────"
+echo "pass=$PASS fail=$FAIL"
+[ "$FAIL" -eq 0 ]