@rubytech/create-siteoffice-code 0.1.256

package/payload/platform/plugins/admin/hooks/__tests__/askuserquestion-investigate-gate.test.sh

@@ -0,0 +1,176 @@
+#!/usr/bin/env bash
+# Regression test for askuserquestion-investigate-gate.sh.
+#
+# Covers (per .tasks/241):
+#   1. Non-AskUserQuestion tool                                  → ALLOW (early exit)
+#   2. AskUserQuestion + earlier ToolSearch this turn            → ALLOW (allowlist-hit)
+#   3. AskUserQuestion + earlier write-only tool                 → BLOCK
+#   4. Turn-1 fixture (zero tool_use this turn)                  → BLOCK
+#   5. Allowlisted tool in EARLIER turn only                     → BLOCK
+#   6. Namespaced alias mcp__plugin_admin_admin__skill-find      → ALLOW
+#   7. Missing CLAUDE_SESSION_ID / JSONL not found               → ALLOW (fail-open-no-transcript)
+#   8. Malformed JSONL line                                      → ALLOW (fail-open-parse-error)
+#
+# All cases assert exit code AND the decision-log signature on stderr.
+
+set -u
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/askuserquestion-investigate-gate.sh"
+if [ ! -x "$HOOK" ]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+PASS=0
+FAIL=0
+
+# Run one case. Args:
+#   $1 = name
+#   $2 = stdin payload
+#   $3 = transcript path (set env so hook reads it) or "" for none
+#   $4 = expected exit code
+#   $5 = expected log signature regex (matched against stderr)
+run_case() {
+  local name="$1" stdin="$2" transcript="$3" expected_exit="$4" expected_log_re="$5"
+  local stderr_file actual_exit
+  stderr_file="$(mktemp)"
+  if [ -n "$transcript" ]; then
+    printf '%s' "$stdin" | ASK_GATE_TRANSCRIPT_PATH="$transcript" bash "$HOOK" >/dev/null 2>"$stderr_file"
+  else
+    printf '%s' "$stdin" | bash "$HOOK" >/dev/null 2>"$stderr_file"
+  fi
+  actual_exit=$?
+  local stderr_content
+  stderr_content=$(cat "$stderr_file")
+  rm -f "$stderr_file"
+
+  local exit_ok=0 log_ok=0
+  if [ "$actual_exit" -eq "$expected_exit" ]; then exit_ok=1; fi
+  if [ -z "$expected_log_re" ] || printf '%s' "$stderr_content" | grep -Eq "$expected_log_re"; then log_ok=1; fi
+
+  if [ $exit_ok -eq 1 ] && [ $log_ok -eq 1 ]; then
+    echo "PASS: $name (exit=$actual_exit)"
+    PASS=$((PASS + 1))
+  else
+    echo "FAIL: $name" >&2
+    [ $exit_ok -eq 0 ] && echo "  expected exit=$expected_exit, got=$actual_exit" >&2
+    [ $log_ok -eq 0 ]  && echo "  expected log regex: $expected_log_re" >&2 && \
+                          echo "  actual stderr: $stderr_content" >&2
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# ---------- Fixtures ----------
+
+# c085ec2c turn-1 fixture: header lines + user prompt only.
+TURN1="$TMP_DIR/turn1.jsonl"
+cat > "$TURN1" <<'JSONL'
+{"type":"summary","summary":"session start","leafUuid":"00000000-0000-0000-0000-000000000000"}
+{"type":"user","message":{"role":"user","content":"change remote access password"},"uuid":"aaaaaaaa-1111-1111-1111-111111111111","timestamp":"2026-05-22T09:07:18.247Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+JSONL
+
+# c085ec2c turn-2 fixture: turn-1 + AskUserQuestion + user correction + status + ToolSearch
+TURN2="$TMP_DIR/turn2.jsonl"
+cat > "$TURN2" <<'JSONL'
+{"type":"summary","summary":"session start","leafUuid":"00000000-0000-0000-0000-000000000000"}
+{"type":"user","message":{"role":"user","content":"change remote access password"},"uuid":"aaaaaaaa-1111-1111-1111-111111111111","timestamp":"2026-05-22T09:07:18.247Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","id":"toolu_ask_01","name":"AskUserQuestion","input":{"questions":[]}}]},"uuid":"bbbbbbbb-2222-2222-2222-222222222222","timestamp":"2026-05-22T09:07:32.387Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+{"type":"user","message":{"role":"user","content":[{"type":"tool_result","tool_use_id":"toolu_ask_01","content":"...the remote admin route. Obviously."}]},"uuid":"cccccccc-3333-3333-3333-333333333333","timestamp":"2026-05-22T09:08:45.400Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+{"type":"user","message":{"role":"user","content":"...the remote admin route. Obviously."},"uuid":"dddddddd-4444-4444-4444-444444444444","timestamp":"2026-05-22T09:08:45.500Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","id":"toolu_status_02","name":"mcp__admin__remote-auth-status","input":{}}]},"uuid":"eeeeeeee-5555-5555-5555-555555555555","timestamp":"2026-05-22T09:08:50.826Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+{"type":"user","message":{"role":"user","content":[{"type":"tool_result","tool_use_id":"toolu_status_02","content":"Remote access password is configured."}]},"uuid":"ffffffff-6666-6666-6666-666666666666","timestamp":"2026-05-22T09:08:51.000Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","id":"toolu_search_03","name":"ToolSearch","input":{"query":"select:mcp__admin__remote-auth-set-password"}}]},"uuid":"99999999-7777-7777-7777-777777777777","timestamp":"2026-05-22T09:08:54.306Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+JSONL
+
+# Single user turn with a non-investigation prior tool (write-only).
+WRITE_ONLY="$TMP_DIR/write_only.jsonl"
+cat > "$WRITE_ONLY" <<'JSONL'
+{"type":"user","message":{"role":"user","content":"new password"},"uuid":"aaaaaaaa-1111-1111-1111-111111111111","timestamp":"2026-05-22T09:00:00.000Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","id":"toolu_set_01","name":"mcp__admin__remote-auth-set-password","input":{"password":"x"}}]},"uuid":"bbbbbbbb-2222-2222-2222-222222222222","timestamp":"2026-05-22T09:00:01.000Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+JSONL
+
+# Investigation tool in EARLIER turn only — current turn has no tool_use yet.
+EARLIER_ONLY="$TMP_DIR/earlier_only.jsonl"
+cat > "$EARLIER_ONLY" <<'JSONL'
+{"type":"user","message":{"role":"user","content":"what is the status?"},"uuid":"aaaaaaaa-1111-1111-1111-111111111111","timestamp":"2026-05-22T09:00:00.000Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","id":"toolu_status_01","name":"mcp__admin__remote-auth-status","input":{}}]},"uuid":"bbbbbbbb-2222-2222-2222-222222222222","timestamp":"2026-05-22T09:00:01.000Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+{"type":"user","message":{"role":"user","content":[{"type":"tool_result","tool_use_id":"toolu_status_01","content":"ok"}]},"uuid":"cccccccc-3333-3333-3333-333333333333","timestamp":"2026-05-22T09:00:02.000Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+{"type":"user","message":{"role":"user","content":"change it"},"uuid":"dddddddd-4444-4444-4444-444444444444","timestamp":"2026-05-22T09:01:00.000Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+JSONL
+
+# Namespaced alias `mcp__plugin_admin_admin__skill-find`.
+ALIAS_FIXTURE="$TMP_DIR/alias.jsonl"
+cat > "$ALIAS_FIXTURE" <<'JSONL'
+{"type":"user","message":{"role":"user","content":"how do I X"},"uuid":"aaaaaaaa-1111-1111-1111-111111111111","timestamp":"2026-05-22T09:00:00.000Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","id":"toolu_find_01","name":"mcp__plugin_admin_admin__skill-find","input":{"query":"X"}}]},"uuid":"bbbbbbbb-2222-2222-2222-222222222222","timestamp":"2026-05-22T09:00:01.000Z","sessionId":"c085ec2c-46fb-4b73-8865-68cf85866ea8"}
+JSONL
+
+# Malformed JSONL line.
+BAD="$TMP_DIR/bad.jsonl"
+cat > "$BAD" <<'JSONL'
+{"type":"user","message":{"role":"user","content":"hi"},"uuid":"a","timestamp":"t","sessionId":"s"}
+{ this is not valid json
+JSONL
+
+# Stdin payloads.
+PRE_ASK='{"hook_event_name":"PreToolUse","tool_name":"AskUserQuestion","session_id":"c085ec2c-46fb-4b73-8865-68cf85866ea8","tool_input":{"questions":[]}}'
+PRE_OTHER='{"hook_event_name":"PreToolUse","tool_name":"Read","session_id":"c085ec2c-46fb-4b73-8865-68cf85866ea8","tool_input":{"file_path":"/tmp/x"}}'
+
+# ---------- Cases ----------
+
+# 1. Non-AskUserQuestion early exit.
+run_case "Non-AskUserQuestion tool → ALLOW (silent)" \
+  "$PRE_OTHER" "$TURN1" 0 ""
+
+# 2. AskUserQuestion + earlier ToolSearch this turn → ALLOW.
+run_case "Earlier ToolSearch in same turn → ALLOW allowlist-hit" \
+  "$PRE_ASK" "$TURN2" 0 \
+  '\[ask-gate\] decision=allow sessionId=c085ec2c seen=mcp__admin__remote-auth-status,ToolSearch reason=allowlist-hit'
+
+# 3. Earlier write-only tool only → BLOCK.
+run_case "Earlier write-only tool only → BLOCK no-investigation" \
+  "$PRE_ASK" "$WRITE_ONLY" 2 \
+  '\[ask-gate\] decision=block sessionId=c085ec2c seen=mcp__admin__remote-auth-set-password reason=no-investigation'
+
+# 4. Turn-1 fixture (zero tool_use this turn) → BLOCK.
+run_case "Turn 1 fixture (no tool_use this turn) → BLOCK no-investigation seen=-" \
+  "$PRE_ASK" "$TURN1" 2 \
+  '\[ask-gate\] decision=block sessionId=c085ec2c seen=- reason=no-investigation'
+
+# 5. Allowlisted tool in EARLIER turn only → BLOCK.
+run_case "Allowlisted tool in earlier turn only → BLOCK no-investigation seen=-" \
+  "$PRE_ASK" "$EARLIER_ONLY" 2 \
+  '\[ask-gate\] decision=block sessionId=c085ec2c seen=- reason=no-investigation'
+
+# 6. Namespaced alias → ALLOW.
+run_case "Namespaced alias mcp__plugin_admin_admin__skill-find → ALLOW" \
+  "$PRE_ASK" "$ALIAS_FIXTURE" 0 \
+  '\[ask-gate\] decision=allow sessionId=c085ec2c seen=mcp__plugin_admin_admin__skill-find reason=allowlist-hit'
+
+# 7. Missing transcript path → ALLOW fail-open-no-transcript.
+MISSING_PATH="$TMP_DIR/does-not-exist.jsonl"
+run_case "Missing transcript file → ALLOW fail-open-no-transcript" \
+  "$PRE_ASK" "$MISSING_PATH" 0 \
+  '\[ask-gate\] decision=allow sessionId=c085ec2c seen=- reason=fail-open-no-transcript'
+
+# 7b. Empty transcript path (no env override AND no transcript_path in stdin).
+PRE_ASK_NO_PATH='{"hook_event_name":"PreToolUse","tool_name":"AskUserQuestion","session_id":"c085ec2c-46fb-4b73-8865-68cf85866ea8","tool_input":{"questions":[]}}'
+run_case "No transcript_path in stdin → ALLOW fail-open-no-transcript" \
+  "$PRE_ASK_NO_PATH" "" 0 \
+  '\[ask-gate\] decision=allow sessionId=c085ec2c seen=- reason=fail-open-no-transcript'
+
+# 8. Malformed JSONL → ALLOW fail-open-parse-error.
+run_case "Malformed JSONL line → ALLOW fail-open-parse-error" \
+  "$PRE_ASK" "$BAD" 0 \
+  '\[ask-gate\] decision=allow sessionId=c085ec2c seen=- reason=fail-open-parse-error'
+
+echo
+echo "──────── askuserquestion-investigate-gate test summary ────────"
+echo "PASS: $PASS"
+echo "FAIL: $FAIL"
+
+[ "$FAIL" -gt 0 ] && exit 1
+exit 0

package/payload/platform/plugins/admin/hooks/__tests__/hook-emit-stale-lock-ttl.test.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# Task 569 — stale-lockdir TTL reclamation in _hook_acquire_lock and
+# _drain_acquire_lock. A backdated lockdir is force-removed on acquire;
+# a freshly held lockdir is not.
+set -u
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+LIB="$ROOT/lib/hook-emit.sh"
+DRAIN="$ROOT/post-tool-use-agent.sh"
+[[ -f "$LIB" ]] || { echo "FAIL: $LIB missing"; exit 1; }
+[[ -f "$DRAIN" ]] || { echo "FAIL: $DRAIN missing"; exit 1; }
+
+TMP=$(mktemp -d)
+export MAXY_HOOK_BUFFER_DIR="$TMP/buffers"
+export MAXY_HOOK_SERVER_LOG="$TMP/server.log"
+# Tight test budget — 20 × 10ms = 200ms ceiling so the negative case
+# returns quickly.
+export MAXY_HOOK_LOCK_ATTEMPTS=20
+export MAXY_HOOK_LOCK_SLEEP=0.01
+export MAXY_HOOK_LOCK_TTL_SECONDS=2
+mkdir -p "$MAXY_HOOK_BUFFER_DIR"
+
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "PASS: $1"; }
+fail() { FAIL=$((FAIL+1)); echo "FAIL: $1" >&2; }
+
+# shellcheck disable=SC1090
+source "$LIB" || { fail "source library"; exit 1; }
+pass "source library"
+
+# Test 1: a stale lockdir (mtime backdated 10s; TTL=2s) is reclaimed and
+# acquire succeeds.
+LOCK1="$TMP/lock-stale"
+mkdir "$LOCK1"
+# Backdate mtime by 10s. -t needs YYYYMMDDhhmm.SS form; portable form
+# uses -d on GNU and -A/-r on BSD, so we use python to set it.
+python3 -c "import os,time; os.utime('$LOCK1', (time.time()-10, time.time()-10))"
+if _hook_acquire_lock "$LOCK1"; then
+  pass "stale lockdir reclaimed (emit-path)"
+else
+  fail "stale lockdir not reclaimed within budget (emit-path)"
+fi
+# Verify observability line.
+if grep -q "\[hook-propagate-error\] reason=stale-lock-reclaimed lockdir=$LOCK1" "$MAXY_HOOK_SERVER_LOG"; then
+  pass "stale-lock-reclaimed observability line emitted"
+else
+  fail "stale-lock-reclaimed line missing from server.log"
+fi
+rmdir "$LOCK1" 2>/dev/null || true
+
+# Test 2: a fresh lockdir (mtime = now) is NOT reclaimed and acquire
+# returns 1 within the attempt budget.
+LOCK2="$TMP/lock-fresh"
+mkdir "$LOCK2"
+START=$(date +%s)
+if _hook_acquire_lock "$LOCK2"; then
+  fail "fresh lockdir wrongly reclaimed (emit-path)"
+else
+  END=$(date +%s)
+  pass "fresh lockdir not reclaimed; acquire timed out (emit-path, ${END}-${START}s)"
+fi
+# Verify no stale-lock-reclaimed line was written for LOCK2.
+if grep -q "lockdir=$LOCK2 ageSeconds=" "$MAXY_HOOK_SERVER_LOG"; then
+  fail "fresh lockdir wrongly logged as stale (emit-path)"
+else
+  pass "no stale-lock log for fresh lockdir (emit-path)"
+fi
+rmdir "$LOCK2" 2>/dev/null || true
+
+# Test 3: same property for the drainer-side function. Extract
+# _drain_acquire_lock + its age helper from post-tool-use-agent.sh and
+# source them in isolation.
+DRAIN_LIB="$TMP/drain-lock.sh"
+awk '
+  /^_drain_lockdir_age_seconds\(\)/,/^}/ { print; next }
+  /^_drain_acquire_lock\(\)/,/^}/ { print; next }
+' "$DRAIN" > "$DRAIN_LIB"
+[[ -s "$DRAIN_LIB" ]] || { fail "drain lock extract empty"; }
+# shellcheck disable=SC1090
+source "$DRAIN_LIB" || fail "source drain lib"
+
+LOCK3="$TMP/lock-drain-stale"
+mkdir "$LOCK3"
+python3 -c "import os,time; os.utime('$LOCK3', (time.time()-10, time.time()-10))"
+if _drain_acquire_lock "$LOCK3"; then
+  pass "stale lockdir reclaimed (drain-path)"
+else
+  fail "stale lockdir not reclaimed (drain-path)"
+fi
+
+LOCK4="$TMP/lock-drain-fresh"
+mkdir "$LOCK4"
+if _drain_acquire_lock "$LOCK4"; then
+  fail "fresh lockdir wrongly reclaimed (drain-path)"
+else
+  pass "fresh lockdir not reclaimed; acquire timed out (drain-path)"
+fi
+
+rm -rf "$TMP"
+echo "----"
+echo "$PASS pass, $FAIL fail"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/__tests__/hook-emit.test.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Task 560 — emitter library writes one well-formed JSON record per call,
+# truncates oversize stderr, and emits an observability line to server.log.
+set -u
+
+LIB="$(cd "$(dirname "$0")/.." && pwd)/lib/hook-emit.sh"
+[[ -f "$LIB" ]] || { echo "FAIL: $LIB missing"; exit 1; }
+
+TMPDIR_OVERRIDE=$(mktemp -d)
+export MAXY_HOOK_BUFFER_DIR="$TMPDIR_OVERRIDE/buffers"
+export MAXY_HOOK_SERVER_LOG="$TMPDIR_OVERRIDE/server.log"
+mkdir -p "$MAXY_HOOK_BUFFER_DIR"
+
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "PASS: $1"; }
+fail() { FAIL=$((FAIL+1)); echo "FAIL: $1" >&2; }
+
+# shellcheck disable=SC1090
+source "$LIB" || { fail "source library"; exit 1; }
+pass "source library"
+
+# Test 1: one call writes one well-formed JSON record keyed by session id.
+SESSION_ID="abc-123-def"
+hook_emit_decision \
+  "$SESSION_ID" \
+  "admin-tool-gate" \
+  "Bash" \
+  "block" \
+  "orchestration-only" \
+  "Blocked: Bash is not callable from admin." \
+  2 \
+  10
+BUFFER="$MAXY_HOOK_BUFFER_DIR/$SESSION_ID.jsonl"
+if [[ ! -f "$BUFFER" ]]; then
+  fail "buffer file not created at $BUFFER"
+else
+  LINES=$(wc -l <"$BUFFER" | tr -d ' ')
+  [[ "$LINES" -eq 1 ]] && pass "one record per call" || fail "expected 1 line, got $LINES"
+  for key in agentId hookName toolName decision reason stderr exitCode durationMs truncated ts; do
+    if python3 -c "import json,sys; d=json.loads(open(sys.argv[1]).read().strip()); sys.exit(0 if '$key' in d else 1)" "$BUFFER"; then
+      pass "record carries $key"
+    else
+      fail "record missing $key"
+    fi
+  done
+fi
+
+# Test 2: oversize stderr is truncated to ~4 KB with truncated=true.
+BIG=$(python3 -c 'print("X"*40000)')
+hook_emit_decision \
+  "$SESSION_ID" \
+  "noisy-hook" \
+  "Bash" \
+  "block" \
+  "synthetic" \
+  "$BIG" \
+  2 \
+  5
+TAIL_REC=$(tail -1 "$BUFFER")
+TRUNC=$(echo "$TAIL_REC" | python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["truncated"])')
+[[ "$TRUNC" == "True" ]] && pass "oversize record marked truncated" || fail "oversize record not marked truncated (got $TRUNC)"
+LEN=$(echo "$TAIL_REC" | python3 -c 'import json,sys; print(len(json.loads(sys.stdin.read())["stderr"]))')
+[[ "$LEN" -le 4200 ]] && pass "stderr clipped to bound (len=$LEN)" || fail "stderr not clipped (len=$LEN)"
+
+# Test 3: server.log observability line emitted.
+if grep -q '\[hook-propagate\] ' "$MAXY_HOOK_SERVER_LOG"; then
+  pass "server.log got [hook-propagate] line"
+else
+  fail "server.log missing [hook-propagate] line"
+fi
+
+rm -rf "$TMPDIR_OVERRIDE"
+echo "----"
+echo "$PASS pass, $FAIL fail"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/__tests__/pin-identity-gate.test.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# Regression test for pin-identity-gate.sh (Task 619).
+#
+# Covers:
+#   1. Non-admin role                                  → ALLOW (no-op)
+#   2. admin, unauthenticated, ordinary tool           → BLOCK (op=pin-prompted)
+#   3. admin, already authenticated (state file)       → ALLOW
+#   4. admin, auth tool, endpoint match                → ALLOW + state written (op=pin-bound)
+#   5. admin, auth tool, endpoint miss                 → BLOCK (op=session-terminated)
+#   6. admin, auth tool, endpoint unavailable          → BLOCK (op=pin-unavailable)
+#   7. admin, auth tool, endpoint unreachable          → BLOCK (op=pin-error)
+#
+# The validate endpoint is stubbed via a `curl` shim on PATH whose response is
+# driven by $FAKE_VALIDATE_KIND.
+
+set -u
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/pin-identity-gate.sh"
+[ -x "$HOOK" ] || { echo "FAIL: $HOOK not executable" >&2; exit 1; }
+
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+mkdir -p "$TMP_DIR/bin" "$TMP_DIR/state"
+
+# curl shim: emit a canned validate response based on $FAKE_VALIDATE_KIND.
+cat > "$TMP_DIR/bin/curl" <<'SHIM'
+#!/usr/bin/env bash
+case "${FAKE_VALIDATE_KIND:-}" in
+  match)       echo '{"kind":"match","userId":"user-0001"}' ;;
+  miss)        echo '{"kind":"miss"}' ;;
+  unavailable) echo '{"kind":"unavailable"}' ;;
+  corrupt)     echo '{"kind":"corrupt"}' ;;
+  unreachable) echo '' ;;
+  *)           echo '' ;;
+esac
+SHIM
+chmod +x "$TMP_DIR/bin/curl"
+
+AUTH_TOOL='mcp__plugin_admin_admin__admin-identity-authenticate'
+PASS=0; FAIL=0
+
+# run <role> <kind> <stdin-json> [specialist] ; sets EXIT and ERR
+run() {
+  ERR=$(printf '%s' "$3" | \
+    PATH="$TMP_DIR/bin:$PATH" \
+    MAXY_SESSION_ROLE="$1" \
+    MAXY_SPECIALIST="${4:-}" \
+    FAKE_VALIDATE_KIND="$2" \
+    MAXY_IDENTITY_GATE_STATE_DIR="$TMP_DIR/state" \
+    MAXY_IDENTITY_VALIDATE_URL="http://stub/validate" \
+    bash "$HOOK" 2>&1 >/dev/null)
+  EXIT=$?
+}
+
+check() { # <label> <want-exit> <grep-or-->
+  if [ "$EXIT" != "$2" ]; then echo "FAIL[$1]: exit=$EXIT want=$2 err=$ERR"; FAIL=$((FAIL+1)); return; fi
+  if [ "$3" != "-" ] && ! printf '%s' "$ERR" | grep -q "$3"; then echo "FAIL[$1]: missing '$3' in: $ERR"; FAIL=$((FAIL+1)); return; fi
+  echo "PASS[$1]"; PASS=$((PASS+1))
+}
+
+# 1. non-admin → allow
+run public '' '{"session_id":"s1","tool_name":"Bash","tool_input":{}}'
+check non-admin 0 -
+
+# 1b. admin but specialist subagent (MAXY_SPECIALIST set) → allow (no-op)
+run admin '' '{"session_id":"s1b","tool_name":"Bash","tool_input":{}}' database-operator
+check specialist-exempt 0 -
+
+# 2. admin unauth, ordinary tool → block
+run admin '' '{"session_id":"s2","tool_name":"Bash","tool_input":{}}'
+check unauth-block 2 "op=pin-prompted"
+
+# 3. admin, authenticated (state file present) → allow
+echo '{"userId":"user-0001"}' > "$TMP_DIR/state/s3.json"
+run admin '' '{"session_id":"s3","tool_name":"Bash","tool_input":{}}'
+check authed-allow 0 -
+
+# 4. admin, auth tool, match → allow + state written + pin-bound
+run admin match "{\"session_id\":\"s4\",\"tool_name\":\"$AUTH_TOOL\",\"tool_input\":{\"pin\":\"1234\"}}"
+check match-allow 0 "op=pin-bound"
+[ -f "$TMP_DIR/state/s4.json" ] && { echo "PASS[match-state-written]"; PASS=$((PASS+1)); } || { echo "FAIL[match-state-written]"; FAIL=$((FAIL+1)); }
+
+# 5. admin, auth tool, miss → block + terminate
+run admin miss "{\"session_id\":\"s5\",\"tool_name\":\"$AUTH_TOOL\",\"tool_input\":{\"pin\":\"9999\"}}"
+check miss-block 2 "op=session-terminated"
+
+# 6. admin, auth tool, unavailable → block
+run admin unavailable "{\"session_id\":\"s6\",\"tool_name\":\"$AUTH_TOOL\",\"tool_input\":{\"pin\":\"1\"}}"
+check unavailable-block 2 "op=pin-unavailable"
+
+# 7. admin, auth tool, unreachable endpoint → block (fail-closed)
+run admin unreachable "{\"session_id\":\"s7\",\"tool_name\":\"$AUTH_TOOL\",\"tool_input\":{\"pin\":\"1\"}}"
+check unreachable-block 2 "op=pin-error"
+
+echo "---"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" = 0 ] || exit 1

package/payload/platform/plugins/admin/hooks/__tests__/post-tool-use-agent.test.sh

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+# Task 560 — propagator reads subagent buffers, prints structured records
+# to stdout, advances a parent-keyed cursor, rotates consumed buffers,
+# and emits a census line on every fire.
+set -u
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/post-tool-use-agent.sh"
+[[ -x "$HOOK" ]] || { echo "FAIL: $HOOK not executable"; exit 1; }
+
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "PASS: $1"; }
+fail() { FAIL=$((FAIL+1)); echo "FAIL: $1" >&2; }
+
+TMP=$(mktemp -d)
+export MAXY_HOOK_BUFFER_DIR="$TMP/buffers"
+export MAXY_HOOK_SERVER_LOG="$TMP/server.log"
+mkdir -p "$MAXY_HOOK_BUFFER_DIR"
+PARENT="parent-XYZ"
+SUB="sub-ABC"
+# Seed one subagent record.
+cat >"$MAXY_HOOK_BUFFER_DIR/$SUB.jsonl" <<JSON
+{"ts":"2026-05-31T00:00:00Z","agentId":"$SUB","hookName":"admin-tool-gate","toolName":"Bash","decision":"block","reason":"orchestration-only","stderr":"x","exitCode":2,"durationMs":1,"truncated":false}
+JSON
+
+INPUT=$(python3 -c '
+import json, sys
+print(json.dumps({"hook_event_name":"PostToolUse","tool_name":"Agent",
+  "session_id":sys.argv[1]}, separators=(",",":")))
+' "$PARENT")
+OUT=$(printf '%s' "$INPUT" | bash "$HOOK" 2>"$TMP/err")
+RC=$?
+[[ "$RC" -eq 0 ]] && pass "exit 0" || fail "exit $RC; stderr=$(cat "$TMP/err")"
+echo "$OUT" | grep -q '\[hook-propagate\] ' && pass "stdout carries [hook-propagate] line" \
+  || fail "stdout missing [hook-propagate] (got: $OUT)"
+echo "$OUT" | grep -q "\"agentId\":\"$SUB\"" && pass "record carries subagent id" \
+  || fail "record missing subagent id"
+echo "$OUT" | grep -q '\[hook-propagate-census\] ' && pass "census line on stdout" \
+  || fail "census line absent"
+CONSUMED=$(ls "$MAXY_HOOK_BUFFER_DIR/consumed/" 2>/dev/null | head -1)
+[[ -n "$CONSUMED" ]] && pass "consumed buffer rotated" || fail "buffer not rotated"
+
+# Second invocation finds nothing new — census reports N=0.
+OUT2=$(printf '%s' "$INPUT" | bash "$HOOK" 2>/dev/null)
+echo "$OUT2" | grep -qE '\[hook-propagate-census\] .*subagentHooksObserved=0 attachmentsEmitted=0' \
+  && pass "cursor prevents double-attach" || fail "double-attach: $OUT2"
+
+# Census N is independent of M: seed two records, force stdout pipe closure
+# after the first printf, and assert N=2 M=1 (the regression signal fires).
+SUB2="sub-DEF"
+cat >"$MAXY_HOOK_BUFFER_DIR/$SUB2.jsonl" <<JSON
+{"agentId":"$SUB2","hookName":"h1","toolName":"Bash","decision":"block","reason":"r1","stderr":"x","exitCode":2,"durationMs":1,"truncated":false}
+{"agentId":"$SUB2","hookName":"h2","toolName":"Bash","decision":"block","reason":"r2","stderr":"x","exitCode":2,"durationMs":1,"truncated":false}
+JSON
+INPUT3=$(python3 -c '
+import json, sys
+print(json.dumps({"hook_event_name":"PostToolUse","tool_name":"Agent",
+  "session_id":sys.argv[1]}, separators=(",",":")))
+' "parent-pipe-test")
+CENSUS=$(printf '%s' "$INPUT3" | bash "$HOOK" 2>/dev/null | { read -r first; cat >/dev/null; echo "$first"; } && true)
+# The drainer's full stdout is dropped after the first line; the census
+# line is among the lost output. Direct way to verify N≠M: read the
+# census the propagator wrote to server.log (which is independent of stdout).
+CENSUS_LOG=$(grep '\[hook-propagate-census\] parentSession=parent-pipe-test' "$MAXY_HOOK_SERVER_LOG" | tail -1)
+echo "$CENSUS_LOG" | grep -qE 'subagentHooksObserved=2' \
+  && pass "census N counts records on disk" \
+  || fail "census N wrong: $CENSUS_LOG"
+# M is incremented only on successful printf. With normal stdout (no
+# pipe break) M should equal N. We tested a healthy fire; SIGPIPE
+# detection happens at runtime when CC attachment closes early —
+# unit-testing that path is brittle. The crucial property is that
+# the two counters are now independent: BUF_LINES vs printf-success.
+echo "$CENSUS_LOG" | grep -qE 'attachmentsEmitted=2' \
+  && pass "census M equals N when stdout open" \
+  || fail "census M wrong: $CENSUS_LOG"
+
+# Task 563 — concurrency hardening.
+
+# Concurrent emitter + drainer on the same buffer must not drop records.
+# Spawn an emitter that writes 50 records in a tight loop while two
+# drainer fires race against it. Union of attachments must equal 50.
+LIB="$(cd "$(dirname "$0")/.." && pwd)/lib/hook-emit.sh"
+[[ -f "$LIB" ]] || { fail "lib missing"; }
+CONCUR_TMP=$(mktemp -d)
+export MAXY_HOOK_BUFFER_DIR="$CONCUR_TMP/buffers"
+export MAXY_HOOK_SERVER_LOG="$CONCUR_TMP/server.log"
+mkdir -p "$MAXY_HOOK_BUFFER_DIR"
+PARENT_C="parent-CONC"
+SUB_C="sub-CONC"
+INPUT_C=$(python3 -c '
+import json, sys
+print(json.dumps({"hook_event_name":"PostToolUse","tool_name":"Agent",
+  "session_id":sys.argv[1]}, separators=(",",":")))
+' "$PARENT_C")
+
+# Emitter: 50 records as fast as possible.
+EMIT_OUT="$CONCUR_TMP/emit.log"
+(
+  # shellcheck disable=SC1090
+  source "$LIB"
+  for i in $(seq 1 50); do
+    hook_emit_decision "$SUB_C" "h" "Bash" "block" "r$i" "x" 2 1
+  done
+  echo "done" >"$EMIT_OUT"
+) &
+EMIT_PID=$!
+
+# Two drainer fires racing the emitter.
+DRAIN1="$CONCUR_TMP/drain1.out"
+DRAIN2="$CONCUR_TMP/drain2.out"
+(printf '%s' "$INPUT_C" | bash "$HOOK" >"$DRAIN1" 2>/dev/null) &
+D1=$!
+(printf '%s' "$INPUT_C" | bash "$HOOK" >"$DRAIN2" 2>/dev/null) &
+D2=$!
+wait "$EMIT_PID" "$D1" "$D2"
+
+# Drain any leftovers after emitter+drainers settled.
+DRAIN3="$CONCUR_TMP/drain3.out"
+printf '%s' "$INPUT_C" | bash "$HOOK" >"$DRAIN3" 2>/dev/null
+# A second sweep catches buffer files created after drainer 3 started.
+DRAIN4="$CONCUR_TMP/drain4.out"
+printf '%s' "$INPUT_C" | bash "$HOOK" >"$DRAIN4" 2>/dev/null
+
+TOTAL_ATTACHED=$(cat "$DRAIN1" "$DRAIN2" "$DRAIN3" "$DRAIN4" | grep -c '^\[hook-propagate\] {' || true)
+UNIQUE_R=$(cat "$DRAIN1" "$DRAIN2" "$DRAIN3" "$DRAIN4" | grep '^\[hook-propagate\] {' | \
+  python3 -c 'import json,sys
+seen=set()
+for line in sys.stdin:
+    rec=line.split(" ",1)[1]
+    d=json.loads(rec)
+    seen.add(d["reason"])
+print(len(seen))')
+[[ "$TOTAL_ATTACHED" -eq 50 ]] && pass "concurrent: 50 records attached, no duplicates" \
+  || fail "concurrent: expected 50 attached, got $TOTAL_ATTACHED"
+[[ "$UNIQUE_R" -eq 50 ]] && pass "concurrent: 50 unique records, no drops" \
+  || fail "concurrent: expected 50 unique reasons, got $UNIQUE_R"
+
+# No cursor file should exist (cursor mechanism removed).
+[[ -z "$(ls "$MAXY_HOOK_BUFFER_DIR"/.*.cursor 2>/dev/null)" ]] \
+  && pass "cursor mechanism removed (no .cursor files)" \
+  || fail "cursor file unexpectedly present: $(ls "$MAXY_HOOK_BUFFER_DIR"/.*.cursor 2>/dev/null)"
+
+rm -rf "$CONCUR_TMP"
+
+# Unknown-parent fallback emits observability line and does not corrupt
+# state across concurrent fires.
+UNK_TMP=$(mktemp -d)
+export MAXY_HOOK_BUFFER_DIR="$UNK_TMP/buffers"
+export MAXY_HOOK_SERVER_LOG="$UNK_TMP/server.log"
+mkdir -p "$MAXY_HOOK_BUFFER_DIR"
+# Stdin with no session_id at all.
+BAD_INPUT='{"hook_event_name":"PostToolUse","tool_name":"Agent"}'
+UNK1="$UNK_TMP/unk1.out"
+UNK2="$UNK_TMP/unk2.out"
+(printf '%s' "$BAD_INPUT" | bash "$HOOK" >"$UNK1" 2>/dev/null) &
+U1=$!
+(printf '%s' "$BAD_INPUT" | bash "$HOOK" >"$UNK2" 2>/dev/null) &
+U2=$!
+wait "$U1" "$U2"
+
+grep -q 'parentSession=unknown reason=session-id-missing' "$UNK1" "$UNK2" \
+  && pass "unknown parent emits observability line" \
+  || fail "unknown parent missing observability line: $(cat "$UNK1" "$UNK2")"
+grep -q 'parentSession=unknown reason=session-id-missing' "$MAXY_HOOK_SERVER_LOG" \
+  && pass "unknown parent line logged to server.log" \
+  || fail "server.log missing unknown-parent line"
+# No .unknown.cursor file — cursor mechanism is gone.
+[[ ! -e "$MAXY_HOOK_BUFFER_DIR/.unknown.cursor" ]] \
+  && pass "no shared .unknown.cursor file" \
+  || fail ".unknown.cursor unexpectedly present"
+
+rm -rf "$UNK_TMP"
+
+echo "----"; echo "$PASS pass, $FAIL fail"
+[[ "$FAIL" -eq 0 ]]