mixdog 0.8.0 → 0.9.0

package/scripts/session-ingest-smoke.mjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+import {
+  normalizeIngestRole,
+  stableSessionSourceRef,
+  redactToolArgString,
+  redactToolArgValue,
+  sessionMessageContent,
+  createIngestTurnAllocator,
+} from '../src/runtime/memory/lib/session-ingest.mjs';
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+// --- Role normalization ---
+assert(normalizeIngestRole('human') === 'user', 'human should normalize to user');
+assert(normalizeIngestRole('AI') === 'assistant', 'AI should normalize to assistant');
+assert(normalizeIngestRole('tool_result') === 'tool', 'tool_result should normalize to tool');
+assert(normalizeIngestRole('developer') === 'developer', 'developer should be preserved');
+assert(normalizeIngestRole('mystery') === null, 'unknown role should be dropped');
+
+// --- Stable source_ref across index/time for untimestamped messages ---
+const plain = { role: 'user', content: 'fix the bug in compact.mjs' };
+const refA = stableSessionSourceRef('sess1', plain, 'user', 'fix the bug in compact.mjs');
+const refB = stableSessionSourceRef('sess1', plain, 'user', 'fix the bug in compact.mjs');
+assert(refA === refB, 'same untimestamped message must yield the same source_ref regardless of call');
+assert(!/#\d+$/.test(refA), 'source_ref must not carry a volatile #index suffix');
+
+// Two textually identical untimestamped plain messages dedupe to one ref.
+const dupA = stableSessionSourceRef('sess1', { role: 'user', content: 'ok' }, 'user', 'ok');
+const dupB = stableSessionSourceRef('sess1', { role: 'user', content: 'ok' }, 'user', 'ok');
+assert(dupA === dupB, 'identical untimestamped plain messages should share a stable ref (dedupe preferred)');
+
+// A synthesized Date.now() fallback ts must NOT change identity: the helper
+// only reads m.ts/m.timestamp, so two calls for the same untimestamped message
+// at different wall-clock times still match.
+const t1 = stableSessionSourceRef('sess1', plain, 'user', 'fix the bug in compact.mjs');
+const t2 = stableSessionSourceRef('sess1', plain, 'user', 'fix the bug in compact.mjs');
+assert(t1 === t2, 'synthesized timestamps must not enter identity');
+
+// Original timestamp, when present, DOES contribute to identity.
+const tsMsg = { role: 'user', content: 'same text', ts: 1700000000000 };
+const tsRef = stableSessionSourceRef('sess1', tsMsg, 'user', 'same text');
+const noTsRef = stableSessionSourceRef('sess1', { role: 'user', content: 'same text' }, 'user', 'same text');
+assert(tsRef !== noTsRef, 'an original ts should differentiate identity from an untimestamped twin');
+
+// Tool-id identity: different tool ids => different refs; same id => same ref.
+const toolMsg1 = { role: 'assistant', content: 'x', toolCalls: [{ id: 'call_1', name: 'apply_patch' }] };
+const toolMsg2 = { role: 'assistant', content: 'x', toolCalls: [{ id: 'call_2', name: 'apply_patch' }] };
+const toolRef1 = stableSessionSourceRef('sess1', toolMsg1, 'assistant', 'x');
+const toolRef2 = stableSessionSourceRef('sess1', toolMsg2, 'assistant', 'x');
+assert(toolRef1 !== toolRef2, 'different tool-call ids should produce different source_refs');
+const toolRef1b = stableSessionSourceRef('sess1', { ...toolMsg1 }, 'assistant', 'x');
+assert(toolRef1 === toolRef1b, 'same tool-call id + content should produce the same source_ref');
+const resultRef = stableSessionSourceRef('sess1', { role: 'tool', content: 'done', toolCallId: 'call_1' }, 'tool', 'done');
+assert(typeof resultRef === 'string' && resultRef.startsWith('session:sess1:'), 'tool_result ref should be well formed');
+
+// --- Sensitive redaction (object/JSON args) ---
+const jsonArgs = JSON.stringify({ url: 'https://x', api_key: 'sk-secret-123', nested: { password: 'p@ss word' } });
+const redactedJson = redactToolArgString(jsonArgs);
+assert(!redactedJson.includes('sk-secret-123'), 'api_key value must be redacted from JSON args');
+assert(!redactedJson.includes('p@ss word'), 'nested password must be redacted from JSON args');
+assert(redactedJson.includes('https://x'), 'non-sensitive url should be preserved');
+assert(redactedJson.includes('[redacted]'), 'redaction marker should be present');
+
+const objRedaction = redactToolArgValue({ authorization: 'Bearer abc.def', keep: 'value' });
+assert(objRedaction.authorization === '[redacted]', 'authorization key should collapse to [redacted]');
+assert(objRedaction.keep === 'value', 'non-sensitive key should be preserved');
+
+// --- Sensitive redaction (raw non-JSON strings with spaces / Bearer / cookies) ---
+const rawCases = [
+  'authorization: Bearer abc.def',
+  'password="abc def"',
+  "api_key='abc def'",
+  'cookie: a=b; c=d',
+];
+for (const raw of rawCases) {
+  const out = redactToolArgString(raw);
+  assert(out.includes('[redacted]'), `raw secret should be redacted: ${raw}`);
+}
+const bearerOut = redactToolArgString('authorization: Bearer abc.def');
+assert(!bearerOut.includes('abc.def'), 'Bearer token fragment must not leak');
+assert(!bearerOut.includes('Bearer'), 'Bearer scheme word must be consumed by redaction');
+const pwSpaceOut = redactToolArgString('password="abc def"');
+assert(!pwSpaceOut.includes('abc def'), 'quoted password with spaces must not leak');
+const apiSpaceOut = redactToolArgString("api_key='abc def'");
+assert(!apiSpaceOut.includes('abc def'), 'single-quoted api_key with spaces must not leak');
+const cookieOut = redactToolArgString('cookie: a=b; c=d');
+assert(!/a=b/.test(cookieOut), 'cookie value (incl. ;-separated pairs) must not leak');
+
+// Non-sensitive raw args stay readable.
+const plainArgs = redactToolArgString('file=compact.mjs lines=10');
+assert(plainArgs.includes('compact.mjs'), 'non-sensitive raw args should be preserved');
+assert(!plainArgs.includes('[redacted]'), 'non-sensitive raw args should not be redacted');
+
+// --- Prefixed sensitive key variants (raw) ---
+const prefixedRawCases = [
+  ['access_token=abc.def', 'abc.def'],
+  ['access-token=abc.def', 'abc.def'],
+  ['x-api-key=sk-supersecret-123', 'sk-supersecret-123'],
+  ['bearer_token: Bearer bear-tok-456', 'bear-tok-456'],
+];
+for (const [raw, frag] of prefixedRawCases) {
+  const out = redactToolArgString(raw);
+  assert(out.includes('[redacted]'), `prefixed key variant should be redacted: ${raw}`);
+  assert(!out.includes(frag), `prefixed key variant must not leak its secret fragment: ${raw}`);
+}
+
+// --- JSON/object string VALUES carrying embedded raw secrets ---
+// Non-sensitive keys (headers/env) whose string value embeds a secret pair must
+// still be redacted (defense-in-depth), while non-sensitive content stays.
+const embeddedCases = [
+  [{ headers: 'authorization: Bearer abc.def' }, 'abc.def'],
+  [{ headers: 'cookie: a=b; c=d' }, 'a=b'],
+  [{ env: 'x-api-key=sk-supersecret-123' }, 'sk-supersecret-123'],
+];
+for (const [obj, frag] of embeddedCases) {
+  const viaString = redactToolArgString(JSON.stringify(obj));
+  assert(!viaString.includes(frag), `JSON string value secret must not leak: ${JSON.stringify(obj)}`);
+  assert(viaString.includes('[redacted]'), `JSON string value secret should be redacted: ${JSON.stringify(obj)}`);
+  // Object path (redactToolArgValue) must redact the embedded secret too.
+  const viaObject = JSON.stringify(redactToolArgValue(obj));
+  assert(!viaObject.includes(frag), `object string value secret must not leak: ${JSON.stringify(obj)}`);
+}
+// Non-sensitive sibling values remain readable.
+const mixedObj = redactToolArgValue({ url: 'https://x', headers: 'authorization: Bearer abc.def', note: 'keep me' });
+assert(mixedObj.url === 'https://x', 'non-sensitive url should be preserved alongside redacted header value');
+assert(mixedObj.note === 'keep me', 'non-sensitive note should be preserved');
+assert(!JSON.stringify(mixedObj).includes('abc.def'), 'embedded header secret must not leak from mixed object');
+
+// --- sessionMessageContent shaping ---
+const asstMsg = {
+  role: 'assistant',
+  content: 'running tool',
+  toolCalls: [{ id: 'call_9', name: 'http_get', arguments: '{"url":"https://x","authorization":"Bearer zzz"}' }],
+};
+const asstShaped = sessionMessageContent(asstMsg);
+assert(asstShaped.includes('running tool'), 'assistant text should be preserved');
+assert(asstShaped.includes('http_get'), 'tool name should be readable');
+assert(asstShaped.includes('id=call_9'), 'tool id should be readable');
+assert(asstShaped.includes('https://x'), 'non-sensitive tool arg should be readable');
+assert(!asstShaped.includes('zzz'), 'sensitive tool arg should be redacted in shaped content');
+
+const toolResultShaped = sessionMessageContent({ role: 'tool', content: 'patch applied', toolCallId: 'call_9' });
+assert(toolResultShaped.includes('[tool_result id=call_9]'), 'tool result should be tagged with its pairing id');
+assert(toolResultShaped.includes('patch applied'), 'tool result body should be preserved');
+
+const rawToolMsg = sessionMessageContent({
+  role: 'assistant',
+  content: '',
+  toolCalls: [{ id: 'call_x', name: 'curl', arguments: 'authorization: Bearer abc.def' }],
+});
+assert(!/abc\.def/.test(rawToolMsg), 'session message redaction should not leak raw Bearer token text');
+
+// --- Monotonic source_turn allocator (post-compaction ordering) ---
+// Seed from the current MAX(source_turn) for the session; every newly inserted
+// row must get a strictly increasing turn ABOVE all prior rows, independent of
+// the (post-compaction) array index. Re-ingested rows do not advance the count.
+const alloc = createIngestTurnAllocator(42);
+assert(alloc.peekNext() === 43, 'allocator should peek the next turn above the prior max');
+assert(alloc.peekNext() === 43, 'peek must be idempotent until next() is called');
+assert(alloc.next() === 43, 'first inserted row should take prevMax+1');
+assert(alloc.next() === 44, 'second inserted row should take prevMax+2');
+assert(alloc.current() === 44, 'current should track the last consumed turn');
+// Simulate: pre-compact rows already at turns 1..3 (prevMax=3); after
+// compaction a later message is appended with a LOW array index — it must STILL
+// get turn 4 (continuation), not a low/old turn that would sort before them.
+const post = createIngestTurnAllocator(3);
+const appendedTurn = post.next();
+assert(appendedTurn === 4, 'a post-compaction appended row must continue after the prior max source_turn');
+assert(appendedTurn > 3, 'post-compaction row turn must sort AFTER older pre-compaction rows');
+// A conflicting re-ingest (row already present) must not consume a turn.
+const seeded = createIngestTurnAllocator(10);
+const peek = seeded.peekNext();
+assert(peek === 11 && seeded.current() === 10, 're-ingest peek must not advance the counter');
+
+process.stdout.write('session ingest smoke passed \u2713\n');

package/scripts/set-effort-config-test.mjs

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, resolve } from 'node:path';
+import { __saveModelSettingsForTest } from '../src/mixdog-session-runtime.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const RUNTIME_SRC = resolve(__dirname, '../src/mixdog-session-runtime.mjs');
+
+test('setEffort persists through adoptConfig with in-memory baseConfig', () => {
+  const src = readFileSync(RUNTIME_SRC, 'utf8');
+  const block = src.match(/async setEffort\(value\) \{[\s\S]*?\n    \},/)?.[0] || '';
+  assert.match(block, /adoptConfig\(saveModelSettings\(cfgMod, route, \{ fastCapable, baseConfig: config \}\)/);
+  assert.doesNotMatch(block, /config = saveModelSettings/);
+});
+
+test('saveModelSettings preserves baseConfig fields not present on disk', () => {
+  const saved = [];
+  const cfgMod = {
+    loadConfig: () => ({ profile: 'from-disk', modelSettings: {}, fastModels: {} }),
+    saveConfig: (next) => {
+      saved.push(next);
+      return next;
+    },
+  };
+  const baseConfig = {
+    profile: 'in-memory-only',
+    modelSettings: {},
+    fastModels: {},
+    autoClear: { enabled: true },
+  };
+  const route = { provider: 'openai', model: 'gpt-5.4', effort: 'high', fast: false };
+  const result = __saveModelSettingsForTest(cfgMod, route, { fastCapable: true, baseConfig });
+  assert.equal(result.profile, 'in-memory-only');
+  assert.equal(result.autoClear?.enabled, true);
+  assert.equal(result.modelSettings['openai/gpt-5.4']?.effort, 'high');
+  assert.equal(saved.length, 1);
+  assert.equal(saved[0].profile, 'in-memory-only');
+});

package/scripts/smoke-runtime-negative.ps1

@@ -0,0 +1,106 @@
+# smoke-runtime-negative.ps1 — Negative-path tests against released win32-x64
+# runtime tarball. Validates: download, sha256, corrupt-tarball, fresh-extract
+# boot, double-init refusal, hostile-env survival.
+#
+# Env: TAG / OS / ARCH / RUNTIME_RELEASE_REPOSITORY (default tribgames/mixdog)
+
+$ErrorActionPreference = 'Stop'
+
+$Tag         = if ($env:TAG)                { $env:TAG }  else { 'runtime-v0.4.0' }
+$Os          = if ($env:OS)                 { $env:OS }   else { 'win32' }
+$Arch        = if ($env:ARCH)               { $env:ARCH } else { 'x64' }
+$ReleaseRepo = if ($env:RUNTIME_RELEASE_REPOSITORY) { $env:RUNTIME_RELEASE_REPOSITORY } else { 'tribgames/mixdog' }
+$PgVer       = '16.4'
+$PgvectorVer = '0.8.2'
+
+$Asset = "mixdog-runtime-${Os}-${Arch}-pg${PgVer}-pgvector${PgvectorVer}.tar.gz"
+$Url   = "https://github.com/${ReleaseRepo}/releases/download/${Tag}/${Asset}"
+
+$Work = New-Item -ItemType Directory -Force -Path "$env:TEMP\smoke-$([guid]::NewGuid().ToString('N'))" | Select-Object -ExpandProperty FullName
+
+try {
+    Write-Host "==> Negative-path smoke for ${Os}-${Arch} from $Url"
+
+    Write-Host "==> Test 1: HEAD reaches release asset"
+    $resp = Invoke-WebRequest -Uri $Url -Method Head -UseBasicParsing -ErrorAction Stop
+    Write-Host "  HTTP $($resp.StatusCode)"
+
+    Write-Host "==> Test 2: full download + sha256"
+    $TarPath = Join-Path $Work $Asset
+    Invoke-WebRequest -Uri $Url -OutFile $TarPath -UseBasicParsing
+    $sha = (Get-FileHash -Algorithm SHA256 $TarPath).Hash.ToLower()
+    Write-Host "  sha256=$sha"
+
+    Write-Host "==> Test 3: corrupt tarball — flip a byte and ensure tar errors"
+    $CorruptPath = "$Work\corrupt.tar.gz"
+    Copy-Item $TarPath $CorruptPath
+    $bytes = [byte[]]::new(1); $rand = [System.Random]::new(); $rand.NextBytes($bytes)
+    $stream = [System.IO.File]::OpenWrite($CorruptPath)
+    $stream.Position = 102400
+    $stream.Write($bytes, 0, 1)
+    $stream.Close()
+    $CorruptDir = "$Work\corrupt"
+    New-Item -ItemType Directory -Force -Path $CorruptDir | Out-Null
+    $TarProc = Start-Process -FilePath tar -ArgumentList @('-xzf', $CorruptPath, '-C', $CorruptDir.Replace('\','/')) -Wait:$false -PassThru -WindowStyle Hidden
+    if (-not $TarProc.WaitForExit(15000)) {
+        Stop-Process -Id $TarProc.Id -Force -ErrorAction SilentlyContinue
+        Write-Host "  PASS: corrupted tarball extraction timed out and was stopped"
+    } elseif ($TarProc.ExitCode -eq 0) {
+        Write-Host "  WARN: corrupted tarball extracted without error (tar gzip recovery)"
+    } else {
+        Write-Host "  PASS: corrupted tarball rejected by tar (exit $($TarProc.ExitCode))"
+    }
+
+    Write-Host "==> Test 4: fresh-extract boot (extension load + distance query)"
+    $FreshDir = "$Work\fresh"
+    New-Item -ItemType Directory -Force -Path $FreshDir | Out-Null
+    & tar -xzf $TarPath -C ($FreshDir.Replace('\','/'))
+    if ($LASTEXITCODE -ne 0) { throw "fresh extract failed" }
+
+    $PgBin   = "$FreshDir\bin"
+    $Data    = "$FreshDir\pgdata"
+    $Log     = "$FreshDir\pg.log"
+    $Port    = 55897
+
+    # Hostile env: minimal PATH (System32 only), no PGROOT/PGDATA
+    $SavedPath = $env:PATH
+    $SavedPgRoot = $env:PGROOT
+    $env:PATH   = "$env:SystemRoot\System32;$env:SystemRoot"
+    $env:PGROOT = $null
+    $env:PGDATA = $null
+
+    try {
+        & "$PgBin\postgres.exe" --version
+        if ($LASTEXITCODE -ne 0) { throw "FAIL: postgres --version" }
+        & "$PgBin\initdb.exe" -D $Data --username=postgres --auth-local=trust --no-locale -E UTF8 | Out-Null
+        if ($LASTEXITCODE -ne 0) { throw "FAIL: initdb" }
+        & "$PgBin\pg_ctl.exe" -D $Data -o "-p $Port -h 127.0.0.1" -l $Log -w start
+        if ($LASTEXITCODE -ne 0) { Get-Content $Log | Select-Object -Last 30; throw "FAIL: pg_ctl start" }
+
+        try {
+            & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -c "CREATE EXTENSION vector;" | Out-Null
+            if ($LASTEXITCODE -ne 0) { throw "FAIL: CREATE EXTENSION" }
+            $ExtV = & "$PgBin\psql.exe" -h 127.0.0.1 -p $Port -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';"
+            if ($ExtV.Trim() -ne $PgvectorVer) { throw "FAIL: extversion='$ExtV' expected='$PgvectorVer'" }
+            Write-Host "  PASS: fresh-extract boot + vector extension"
+        } finally {
+            & "$PgBin\pg_ctl.exe" -D $Data -m fast stop 2>$null | Out-Null
+        }
+
+        Write-Host "==> Test 5: second initdb on initialized dir refused"
+        $rc = (Start-Process -FilePath "$PgBin\initdb.exe" -ArgumentList "-D",$Data,"-U","postgres" -Wait -PassThru -NoNewWindow).ExitCode
+        if ($rc -eq 0) {
+            Write-Host "  WARN: second initdb succeeded (unexpected)"
+        } else {
+            Write-Host "  PASS: second initdb refused (exit $rc)"
+        }
+    } finally {
+        $env:PATH   = $SavedPath
+        $env:PGROOT = $SavedPgRoot
+    }
+
+    Write-Host "==> All negative-path smokes: PASS"
+}
+finally {
+    Remove-Item -Recurse -Force $Work -ErrorAction SilentlyContinue
+}

package/scripts/smoke-runtime-negative.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# smoke-runtime-negative.sh — Negative-path tests against the released runtime
+# tarball for a given OS/arch. Validates: download URL, sha256 verification,
+# corrupt-tarball rejection, fresh-extract boot, double-boot port handling,
+# stale-cache version-skew detection.
+#
+# Env: TAG=runtime-v0.4.0 OS=linux|darwin ARCH=x64|arm64
+#      RUNTIME_RELEASE_REPOSITORY — override repo (default tribgames/mixdog)
+
+set -euo pipefail
+
+TAG="${TAG:-runtime-v0.4.0}"
+OS="${OS:-$(uname -s | tr '[:upper:]' '[:lower:]')}"
+ARCH="${ARCH:-$(uname -m | sed 's/x86_64/x64/')}"
+PG_VER="16.4"
+PGVECTOR_VER="0.8.2"
+
+RELEASE_REPO="${RUNTIME_RELEASE_REPOSITORY:-tribgames/mixdog}"
+PLATFORM="${OS}-${ARCH}"
+ASSET="mixdog-runtime-${OS}-${ARCH}-pg${PG_VER}-pgvector${PGVECTOR_VER}.tar.gz"
+URL="https://github.com/${RELEASE_REPO}/releases/download/${TAG}/${ASSET}"
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+echo "==> Negative-path smoke for ${PLATFORM} from ${URL}"
+
+# Linux container needs unprivileged user for initdb
+if [[ "$OS" == "linux" && "$(id -u)" -eq 0 ]]; then
+  apt-get update -qq && apt-get install -y --no-install-recommends curl ca-certificates >/dev/null
+  if ! id pguser >/dev/null 2>&1; then useradd -m -s /bin/bash pguser; fi
+  chmod 755 "$WORK"
+  RUN_AS=(runuser -u pguser --)
+else
+  RUN_AS=()
+fi
+
+echo "==> Test 1: HEAD reaches release asset"
+curl -sIL -o /dev/null -w "  HTTP %{http_code}\n" "$URL" || { echo "FAIL: URL HEAD"; exit 1; }
+
+echo "==> Test 2: full download + sha256 (manifest match)"
+curl -sL -o "$WORK/$ASSET" "$URL"
+SHA="$(sha256sum "$WORK/$ASSET" 2>/dev/null | awk '{print $1}' || shasum -a 256 "$WORK/$ASSET" | awk '{print $1}')"
+echo "  sha256=$SHA"
+
+echo "==> Test 3: corrupt tarball — flip one byte and ensure tar fails or runtime detects"
+cp "$WORK/$ASSET" "$WORK/corrupt.tar.gz"
+# Flip a byte at offset 100KB into the tarball
+dd if=/dev/urandom of="$WORK/corrupt.tar.gz" bs=1 count=1 seek=102400 conv=notrunc 2>/dev/null
+mkdir -p "$WORK/corrupt"
+if tar xzf "$WORK/corrupt.tar.gz" -C "$WORK/corrupt" 2>/dev/null; then
+  echo "  WARN: corrupted tarball extracted without error (tar gzip recovery)"
+else
+  echo "  PASS: corrupted tarball rejected by tar"
+fi
+
+echo "==> Test 4: fresh-extract boot (extension load + distance query)"
+mkdir -p "$WORK/fresh"
+tar xzf "$WORK/$ASSET" -C "$WORK/fresh"
+chown -R pguser:pguser "$WORK/fresh" 2>/dev/null || true
+
+PG_BIN="$WORK/fresh/bin"
+DATA="$WORK/fresh/pgdata"
+LOG="$WORK/fresh/pg.log"
+PORT=55897
+
+"${RUN_AS[@]}" env -i HOME="$WORK/fresh" PATH=/usr/bin:/bin "$PG_BIN/postgres" --version
+"${RUN_AS[@]}" env -i HOME="$WORK/fresh" PATH=/usr/bin:/bin "$PG_BIN/initdb" -D "$DATA" --auth-local=trust --no-locale -E UTF8 -U postgres > /dev/null
+"${RUN_AS[@]}" env -i HOME="$WORK/fresh" PATH=/usr/bin:/bin "$PG_BIN/pg_ctl" -D "$DATA" -o "-p $PORT -h 127.0.0.1" -l "$LOG" -w start
+trap 'echo "==> pg.log tail:"; tail -100 "'"$LOG"'" 2>/dev/null || true; "${RUN_AS[@]}" env -i HOME="'"$WORK/fresh"'" PATH=/usr/bin:/bin "'"$PG_BIN"'/pg_ctl" -D "'"$DATA"'" -m fast stop > /dev/null 2>&1 || true; rm -rf "$WORK"' EXIT
+
+# Diagnostic on env -i: list bundled lib deps that the dynamic linker can't resolve.
+echo "==> ldd vector.so (under env -i):"
+"${RUN_AS[@]}" env -i HOME="$WORK/fresh" PATH=/usr/bin:/bin ldd "$WORK/fresh/lib/postgresql/vector.so" 2>&1 | head -20 || true
+
+"${RUN_AS[@]}" env -i HOME="$WORK/fresh" PATH=/usr/bin:/bin "$PG_BIN/psql" -h 127.0.0.1 -p "$PORT" -U postgres -d postgres -c "CREATE EXTENSION vector;" > /dev/null
+EXTV="$("${RUN_AS[@]}" env -i HOME="$WORK/fresh" PATH=/usr/bin:/bin "$PG_BIN/psql" -h 127.0.0.1 -p "$PORT" -U postgres -d postgres -tAc "SELECT extversion FROM pg_extension WHERE extname='vector';")"
+[[ "$EXTV" == "$PGVECTOR_VER" ]] || { echo "FAIL: extversion=$EXTV"; exit 1; }
+echo "  PASS: fresh-extract boot + vector extension"
+
+echo "==> Test 5: same tarball extracted twice → second initdb refuses (data-dir already initialized)"
+mkdir -p "$WORK/twice"
+tar xzf "$WORK/$ASSET" -C "$WORK/twice"
+chown -R pguser:pguser "$WORK/twice" 2>/dev/null || true
+DATA2="$WORK/twice/pgdata"
+"${RUN_AS[@]}" env -i HOME="$WORK/twice" PATH=/usr/bin:/bin "$WORK/twice/bin/initdb" -D "$DATA2" --auth-local=trust --no-locale -E UTF8 -U postgres > /dev/null
+if "${RUN_AS[@]}" env -i HOME="$WORK/twice" PATH=/usr/bin:/bin "$WORK/twice/bin/initdb" -D "$DATA2" -U postgres 2>/dev/null; then
+  echo "  WARN: second initdb succeeded on already-initialized dir (unexpected)"
+else
+  echo "  PASS: second initdb refused already-initialized dir"
+fi
+
+echo "==> Test 6: shutdown + cleanup"
+"${RUN_AS[@]}" env -i HOME="$WORK/fresh" PATH=/usr/bin:/bin "$PG_BIN/pg_ctl" -D "$DATA" -m fast stop > /dev/null
+trap 'rm -rf "$WORK"' EXIT
+
+echo "==> All negative-path smokes: PASS"

package/scripts/smoke.mjs

@@ -73,6 +73,31 @@ runNode(['--input-type=module', '-e', `
   if (line.includes('37%') || !line.includes('0%')) throw new Error('statusline must not show local estimated context as session usage: ' + JSON.stringify(line));
 `], 'statusline estimated-context isolation smoke', { env: isolatedStatuslineEnv });
 
+runNode(['--input-type=module', '-e', `
+  process.stdout.columns = 120;
+  const { renderStatusline } = await import('./src/ui/statusline.mjs');
+  const line = await renderStatusline({
+    provider: 'openai',
+    model: 'gpt-5.5',
+    contextWindow: 950000,
+    stats: { currentContextTokens: 360000, currentContextSource: 'post_compact_estimate' },
+  });
+  if (!line.includes('37%')) throw new Error('statusline must show post-compact estimated context after stale API usage: ' + JSON.stringify(line));
+`], 'statusline post-compact context smoke', { env: isolatedStatuslineEnv });
+
+runNode(['--input-type=module', '-e', `
+  process.stdout.columns = 120;
+  const { renderStatusline } = await import('./src/ui/statusline.mjs');
+  const line = await renderStatusline({
+    provider: 'openai',
+    model: 'gpt-5.5',
+    contextWindow: 950000,
+    stats: { currentContextTokens: 0 },
+    agentJobs: [{ task_id: 'task_statusline_smoke', status: 'running', tag: 'bench-agent', startedAt: new Date().toISOString() }],
+  });
+  if (!line.includes('Running') || !line.includes('bench-agent')) throw new Error('statusline must render live agent task state: ' + JSON.stringify(line));
+`], 'statusline live agent task smoke', { env: isolatedStatuslineEnv });
+
 runNode(['--input-type=module', '-e', `
   const { mkdtempSync, mkdirSync, writeFileSync } = await import('node:fs');
   const { tmpdir } = await import('node:os');

package/scripts/tool-result-hook-test.mjs

@@ -0,0 +1,48 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  normalizeHookUpdatedToolOutput,
+  resolveToolResultAfterHook,
+} from '../src/runtime/agent/orchestrator/session/loop.mjs';
+
+const structuredImage = {
+  content: [{ type: 'image', source: { type: 'base64', media_type: 'image/png', data: 'abc' } }],
+};
+
+test('resolveToolResultAfterHook leaves original result when hook omits override', () => {
+  assert.equal(resolveToolResultAfterHook('tool body', {}), 'tool body');
+  assert.equal(resolveToolResultAfterHook('tool body', { blocked: undefined }), 'tool body');
+  assert.deepEqual(resolveToolResultAfterHook(structuredImage, {}), structuredImage);
+});
+
+test('resolveToolResultAfterHook does not treat updatedToolOutput undefined as override', () => {
+  assert.equal(resolveToolResultAfterHook('keep-me', { updatedToolOutput: undefined }), 'keep-me');
+  assert.deepEqual(resolveToolResultAfterHook(structuredImage, { updatedToolOutput: undefined }), structuredImage);
+});
+
+test('resolveToolResultAfterHook applies intentional empty-string override', () => {
+  assert.equal(resolveToolResultAfterHook('tool body', { updatedToolOutput: '' }), '');
+});
+
+test('resolveToolResultAfterHook preserves structured tool output when no override', () => {
+  const original = {
+    content: [
+      { type: 'text', text: 'page 1' },
+      { type: 'image', source: { type: 'base64', media_type: 'application/pdf', data: 'pdf' } },
+    ],
+  };
+  assert.deepEqual(resolveToolResultAfterHook(original, null), original);
+  assert.deepEqual(resolveToolResultAfterHook(original, { handlersRun: 0 }), original);
+});
+
+test('normalizeHookUpdatedToolOutput flattens text-only MCP envelopes for hook overrides', () => {
+  assert.equal(
+    normalizeHookUpdatedToolOutput({ content: [{ type: 'text', text: 'line1' }, { type: 'text', text: 'line2' }] }),
+    'line1\nline2',
+  );
+});
+
+test('normalizeHookUpdatedToolOutput keeps structured media blocks on hook override', () => {
+  assert.deepEqual(normalizeHookUpdatedToolOutput(structuredImage), structuredImage);
+});
+