mixdog 0.9.2 → 0.9.4

package/scripts/tool-smoke.mjs

@@ -11,7 +11,7 @@ import { buildHeadlessSpawnArgs } from '../src/headless-role.mjs';
 import { createStandaloneChannelWorker } from '../src/standalone/channel-worker.mjs';
 import { OpenAIOAuthProvider, buildRequestBody, sendViaHttpSse } from '../src/runtime/agent/orchestrator/providers/openai-oauth.mjs';
 import { _test as _anthropicOAuthTest } from '../src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs';
-import { _logicalResponseItemMatch, _resolveOpenAiPromptCacheRatePolicy } from '../src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs';
+import { _logicalResponseItemMatch } from '../src/runtime/agent/orchestrator/providers/openai-oauth-ws.mjs';
 import { _mergePendingMessageEntries, applyAskTerminalUsageTotals, closeSession, createSession, drainPendingMessages, enqueuePendingMessage, resumeSession } from '../src/runtime/agent/orchestrator/session/manager.mjs';
 import {
   contentHasImage,
@@ -137,46 +137,6 @@ function assertOk(name, result, pattern = null) {
 }
 
 {
-  const fullPolicy = _resolveOpenAiPromptCacheRatePolicy({}, {
-    mode: 'full',
-    frameInputItems: 40,
-    deltaTokens: 9000,
-    hasPreviousResponseId: false,
-  });
-  assert(fullPolicy.policy === 'full_guard' && fullPolicy.limitPerMin === 12, `full cache lane should keep 12rpm guard: ${JSON.stringify(fullPolicy)}`);
-
-  const deltaPolicy = _resolveOpenAiPromptCacheRatePolicy({}, {
-    mode: 'delta',
-    frameInputItems: 1,
-    deltaTokens: 9000,
-    hasPreviousResponseId: true,
-  });
-  assert(deltaPolicy.policy === 'delta_relaxed' && deltaPolicy.limitPerMin === 60, `small delta should use relaxed cache lane rpm: ${JSON.stringify(deltaPolicy)}`);
-
-  const largeDeltaPolicy = _resolveOpenAiPromptCacheRatePolicy({}, {
-    mode: 'delta',
-    frameInputItems: 20,
-    deltaTokens: 9000,
-    hasPreviousResponseId: true,
-  });
-  assert(largeDeltaPolicy.policy === 'delta_guarded' && largeDeltaPolicy.limitPerMin === 12, `large delta should fall back to full guard: ${JSON.stringify(largeDeltaPolicy)}`);
-
-  const customDeltaPolicy = _resolveOpenAiPromptCacheRatePolicy({ openaiCacheLaneDeltaRateLimitPerMin: 90 }, {
-    mode: 'delta',
-    frameInputItems: 1,
-    deltaTokens: 9000,
-    hasPreviousResponseId: true,
-  });
-  assert(customDeltaPolicy.limitPerMin === 90, `custom delta rpm should be honored: ${JSON.stringify(customDeltaPolicy)}`);
-
-  const unlimitedDeltaPolicy = _resolveOpenAiPromptCacheRatePolicy({ openaiCacheLaneDeltaRateLimitPerMin: 0 }, {
-    mode: 'delta',
-    frameInputItems: 1,
-    deltaTokens: 9000,
-    hasPreviousResponseId: true,
-  });
-  assert(unlimitedDeltaPolicy.policy === 'delta_unlimited' && unlimitedDeltaPolicy.limitPerMin === 0, `delta rpm=0 should disable delta rate wait: ${JSON.stringify(unlimitedDeltaPolicy)}`);
-
   const originalFunctionCall = {
     type: 'function_call',
     call_id: 'call_tool_1',
@@ -589,20 +549,28 @@ if (grepContextPolicyArgs['-C'] !== GREP_CONTEXT_MAX || Object.prototype.hasOwnP
   throw new Error(`grep context policy must canonicalize and clamp explicit context: ${JSON.stringify(grepContextPolicyArgs)}`);
 }
 
-const invalidGrepPath = validateBuiltinArgs('grep', {
+// Multiple absolute paths in one string are now auto-split into a path array
+// (arg-guard splitMultipleAbsoluteWindowsPaths) instead of rejected.
+const multiGrepPathArgs = {
   pattern: 'providerStatus',
   path: 'C:\\Project\\mixdog\\src\\tui C:\\Project\\mixdog\\src\\mixdog-session-runtime.mjs',
-});
-if (!/multiple absolute paths/i.test(invalidGrepPath || '')) {
-  throw new Error(`grep multi-path guard failed: ${invalidGrepPath}`);
+};
+const multiGrepPathErr = validateBuiltinArgs('grep', multiGrepPathArgs);
+if (multiGrepPathErr) {
+  throw new Error(`grep multi-path auto-split should pass validation: ${multiGrepPathErr}`);
+}
+if (!Array.isArray(multiGrepPathArgs.path) || multiGrepPathArgs.path.length !== 2) {
+  throw new Error(`grep multi-path auto-split should coerce to 2-element array: ${JSON.stringify(multiGrepPathArgs.path)}`);
 }
 
-const invalidGrepLookaround = validateBuiltinArgs('grep', {
+// Lookaround/backrefs are no longer rejected at validation time: search-tool
+// routes them to rg --pcre2 at runtime (arg-guard.mjs comment near globKeys).
+const lookaroundGrepErr = validateBuiltinArgs('grep', {
   pattern: 'C:\\\\Project(?!\\\\mixdog)',
   path: root,
 });
-if (!/lookaround\/backrefs/i.test(invalidGrepLookaround || '')) {
-  throw new Error(`grep unsupported-regex guard failed: ${invalidGrepLookaround}`);
+if (lookaroundGrepErr) {
+  throw new Error(`grep lookaround pattern should pass validation (PCRE2 runtime routing): ${lookaroundGrepErr}`);
 }
 
 // Windows drive path + no explicit shell used to be rejected with a retry hint;
@@ -747,7 +715,7 @@ if (agentProps.mode || agentProps.wait) throw new Error('agent schema should not
     agentRules: '# Tool Use',
     skillManifest: '',
   });
-  if (!heavyPrompt.stableSystemContext.includes('## heavy-worker') || !heavyPrompt.stableSystemContext.includes('Handoff fragments only')) {
+  if (!heavyPrompt.stableSystemContext.includes('## heavy-worker')) {
     throw new Error(`heavy-worker AGENT.md must be included in scoped role instructions: ${heavyPrompt.stableSystemContext}`);
   }
   const workerPrompt = composeSystemPrompt({
@@ -756,7 +724,7 @@ if (agentProps.mode || agentProps.wait) throw new Error('agent schema should not
     agentRules: '# Tool Use',
     skillManifest: '',
   });
-  if (!workerPrompt.stableSystemContext.includes('## worker') || !workerPrompt.stableSystemContext.includes('Handoff fragments only')) {
+  if (!workerPrompt.stableSystemContext.includes('## worker')) {
     throw new Error(`worker AGENT.md must be included in scoped role instructions: ${workerPrompt.stableSystemContext}`);
   }
 }
@@ -991,10 +959,7 @@ setInternalToolsProvider({
     { name: 'recall', description: 'Memory recall surface.', inputSchema: { type: 'object', properties: {} }, annotations: { readOnlyHint: true } },
     { name: 'search', description: 'Web search surface.', inputSchema: { type: 'object', properties: {} }, annotations: { readOnlyHint: true, openWorldHint: true } },
     { name: 'reply', description: 'Channel reply surface.', inputSchema: { type: 'object', properties: {} }, annotations: { destructiveHint: true } },
-    { name: 'edit_message', description: 'Channel edit surface.', inputSchema: { type: 'object', properties: {} }, annotations: { destructiveHint: true } },
     { name: 'web_fetch', description: 'Web fetch surface.', inputSchema: { type: 'object', properties: {} }, annotations: { readOnlyHint: true, openWorldHint: true } },
-    { name: 'reload_config', description: 'Config reload surface.', inputSchema: { type: 'object', properties: {} }, annotations: { destructiveHint: true } },
-    { name: 'inject_command', description: 'Command injection surface.', inputSchema: { type: 'object', properties: {} }, annotations: { destructiveHint: true } },
   ],
 });
 {
@@ -1091,7 +1056,7 @@ setInternalToolsProvider({
     if (!/Read-only retrieval role/i.test(visible) || /# environment/i.test(visible) || /git operations deferred to Lead/i.test(visible)) {
       throw new Error(`explorer hidden retrieval context should stay slim: ${visible.slice(0, 1200)}`);
     }
-    if (!/# Role: explorer/i.test(systemVisible) || /# Role: explorer/i.test(userReminderVisible) || !/Locator only/i.test(systemVisible)) {
+    if (!/# Role: explorer/i.test(systemVisible) || /# Role: explorer/i.test(userReminderVisible) || !/one-shot locator/i.test(systemVisible)) {
       throw new Error(`explorer role md must ride BP2 system, not BP3 user reminder: system=${systemVisible.slice(0, 600)} user=${userReminderVisible.slice(0, 600)}`);
     }
     const visibleBytes = Buffer.byteLength(visible, 'utf8');
@@ -1197,12 +1162,12 @@ setInternalToolsProvider({
     if (readTools.includes('shell') || writeTools.includes('shell')) {
       throw new Error(`read/read-write agent schemas must omit shell: read=${readTools.join(', ')} write=${writeTools.join(', ')}`);
     }
-    for (const name of ['shell', 'apply_patch', 'task', 'diagnostics', 'open_config']) {
+    for (const name of ['shell', 'apply_patch', 'task']) {
       if (readTools.includes(name)) {
         throw new Error(`read agent schema must omit non-read tool ${name}: read=${readTools.join(', ')}`);
       }
     }
-    for (const name of ['apply_patch', 'task', 'diagnostics']) {
+    for (const name of ['apply_patch', 'task']) {
       if (name === 'apply_patch' && !writeTools.includes(name)) {
         throw new Error(`read-write agent schema must preserve apply_patch: write=${writeTools.join(', ')}`);
       }
@@ -1210,12 +1175,7 @@ setInternalToolsProvider({
         throw new Error(`read-write agent schema must omit non-edit tool ${name}: write=${writeTools.join(', ')}`);
       }
     }
-    for (const name of ['open_config']) {
-      if (writeTools.includes(name)) {
-        throw new Error(`read-write agent schema must omit config/skill tool ${name}: write=${writeTools.join(', ')}`);
-      }
-    }
-    for (const name of ['memory', 'recall', 'reply', 'edit_message', 'reload_config', 'inject_command']) {
+    for (const name of ['memory', 'recall', 'reply']) {
       if (readTools.includes(name) || writeTools.includes(name)) {
         throw new Error(`read/read-write agent schema must not expose full-runtime internal tool ${name}: read=${readTools.join(', ')} write=${writeTools.join(', ')}`);
       }
@@ -1293,7 +1253,7 @@ setInternalToolsProvider({
   const hiddenAgents = JSON.parse(readFileSync(join(root, 'src', 'defaults', 'agents.json'), 'utf8')).agents || [];
   const hiddenPreset = { id: 'hidden-smoke', name: 'hidden-smoke', type: 'agent', provider: 'openai-oauth', model: 'tool-smoke-model', tools: 'full' };
   const hiddenRuntimeSpec = { scopeKey: 'hidden-role-smoke', lane: 'agent' };
-  const hiddenBadTools = new Set(['shell', 'task', 'diagnostics', 'open_config', 'Skill', 'memory', 'reply', 'edit_message', 'recall', 'reload_config', 'inject_command']);
+  const hiddenBadTools = new Set(['shell', 'task', 'Skill', 'memory', 'reply', 'recall']);
   const expectedForHiddenAgent = (permission, schemaAllowedTools) => {
     if (Array.isArray(schemaAllowedTools)) return schemaAllowedTools.slice();
     if (permission === 'none') return [];
@@ -1434,9 +1394,12 @@ for (const requiredGrammarLine of [
 }
 const readPathSchema = BUILTIN_TOOLS.find((tool) => tool.name === 'read')?.inputSchema?.properties?.path || {};
 const readPathDescription = readPathSchema.description || '';
-if (!/File path/i.test(readPathDescription) || !/\{path,offset,limit\}\[\]/i.test(readPathDescription) || !/Pass arrays directly/i.test(readPathDescription) || !/legacy recovery only/i.test(readPathDescription) || !/Dirs use list/i.test(readPathDescription)) {
+if (!/File path/i.test(readPathDescription) || !/\{path,offset,limit\}\[\]/i.test(readPathDescription) || !/Pass arrays directly/i.test(readPathDescription) || !/legacy recovery only/i.test(readPathDescription)) {
   throw new Error('read schema must keep directory-vs-file guidance');
 }
+if (!/Dirs use list/i.test((BUILTIN_TOOLS.find((tool) => tool.name === 'read')?.description) || '')) {
+  throw new Error('read description must keep directory-vs-file guidance');
+}
 const readTool = BUILTIN_TOOLS.find((tool) => tool.name === 'read');
 const readDescription = readTool?.description || '';
 const readProps = readTool?.inputSchema?.properties || {};
@@ -1514,7 +1477,7 @@ if (!/before text grep/i.test(codeGraphDescription)) {
 if (!/repo-local/i.test(codeGraphDescription) || !/NOT web search|not web/i.test(codeGraphDescription)) {
   throw new Error('code_graph description must mark itself repo-local (not web search)');
 }
-if (!/repo-local|not web/i.test(codeGraphProps.mode?.description || '') || !/source file/i.test(codeGraphProps.file?.description || '')) {
+if (!/repo-local|not web/i.test(codeGraphProps.mode?.description || '') || !/source file/i.test(codeGraphProps.files?.description || '')) {
   throw new Error('code_graph schema must keep compact, repo-local field descriptions');
 }
 const recallTool = MEMORY_TOOL_DEFS.find((tool) => tool.name === 'recall');
@@ -1585,7 +1548,7 @@ if (!recallProps.sessionOnly || !/session only/i.test(recallProps.sessionOnly?.d
 }
 const memoryTool = MEMORY_TOOL_DEFS.find((tool) => tool.name === 'memory');
 const memoryProps = memoryTool?.inputSchema?.properties || {};
-if (!/explicit mutation/i.test(memoryTool?.description || '') || !/Destructive jobs require exact confirm/i.test(memoryTool?.description || '') || !/Exact confirmation phrase/i.test(memoryProps.confirm?.description || '')) {
+if (!/mutation/i.test(memoryTool?.description || '') || !/Exact confirmation phrase/i.test(memoryProps.confirm?.description || '')) {
   throw new Error('memory schema must preserve mutation/destructive confirmation guidance');
 }
 const searchTool = SEARCH_TOOL_DEFS.find((tool) => tool.name === 'search');
@@ -1780,7 +1743,7 @@ if (grepTool?.inputSchema?.properties?.head_limit?.minimum !== 0 || !/keep small
 if (grepTool?.inputSchema?.properties?.type) {
   throw new Error('grep type schema must stay hidden; prefer glob for extension narrowing');
 }
-if (!/code flow before text search/i.test(codeGraphProps.mode?.description || '') || !/one anchor is enough/i.test(codeGraphProps.symbol?.description || '') || !/one call/i.test(codeGraphProps.symbols?.description || '')) {
+if (!/code flow before text search/i.test(codeGraphProps.mode?.description || '') || !/one anchor is enough/i.test(codeGraphProps.symbols?.description || '') || !/one call/i.test(codeGraphProps.symbols?.description || '')) {
   throw new Error('code_graph schema fields must steer away from repeated lookup loops');
 }
 

package/scripts/tui-render-smoke.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+/**
+ * scripts/tui-render-smoke.mjs — undeclared-identifier gate for the TUI bundle.
+ *
+ * Why: esbuild does not flag free (undeclared) identifiers in JSX modules —
+ * they may legitimately be runtime globals — and no smoke actually renders
+ * App. That gap shipped two ReferenceErrors (promptContentRows,
+ * TRANSCRIPT_WINDOW_OVERSCAN_ROWS) during the App.jsx split.
+ *
+ * How: parse src/tui/dist/index.mjs with acorn, run eslint-scope, and fail on
+ * any reference that resolves to no binding and is not a known JS/Node/DOM
+ * global. Static, deterministic, no terminal or engine session needed.
+ *
+ * Run:  node scripts/tui-render-smoke.mjs   (or `npm run smoke:tui`)
+ * Exit: 0 = clean, 1 = undeclared identifiers found or bundle missing.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parse } from 'acorn';
+import { analyze } from 'eslint-scope';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const BUNDLE = join(ROOT, 'src', 'tui', 'dist', 'index.mjs');
+
+// Globals that are legal free identifiers in the bundle. Anything outside
+// this set that resolves to no binding is a guaranteed ReferenceError at
+// runtime (module scope is strict; there is no window fallback in node ESM).
+const KNOWN_GLOBALS = new Set([
+  // ECMAScript builtins
+  'Array', 'ArrayBuffer', 'Atomics', 'BigInt', 'BigInt64Array', 'BigUint64Array', 'Boolean',
+  'DataView', 'Date', 'Error', 'EvalError', 'FinalizationRegistry', 'Float32Array',
+  'Float64Array', 'Function', 'Infinity', 'Int8Array', 'Int16Array', 'Int32Array',
+  'Intl', 'JSON', 'Map', 'Math', 'NaN', 'Number', 'Object', 'Promise', 'Proxy',
+  'RangeError', 'ReferenceError', 'Reflect', 'RegExp', 'Set', 'SharedArrayBuffer',
+  'String', 'Symbol', 'SyntaxError', 'TypeError', 'URIError', 'Uint8Array',
+  'Uint8ClampedArray', 'Uint16Array', 'Uint32Array', 'WeakMap', 'WeakRef', 'WeakSet',
+  'decodeURI', 'decodeURIComponent', 'encodeURI', 'encodeURIComponent', 'eval',
+  'globalThis', 'isFinite', 'isNaN', 'parseFloat', 'parseInt', 'undefined',
+  // Node.js globals
+  'AbortController', 'AbortSignal', 'Blob', 'Buffer', 'ByteLengthQueuingStrategy',
+  'CompressionStream', 'CountQueuingStrategy', 'Crypto', 'CryptoKey', 'CustomEvent',
+  'DecompressionStream', 'Event', 'EventTarget', 'File', 'FormData', 'Headers',
+  'MessageChannel', 'MessageEvent', 'MessagePort', 'Navigator', 'PerformanceEntry',
+  'PerformanceObserver', 'ReadableStream', 'ReadableStreamDefaultReader', 'Request',
+  'Response', 'SubtleCrypto', 'TextDecoder', 'TextDecoderStream', 'TextEncoder',
+  'TextEncoderStream', 'TransformStream', 'URL', 'URLSearchParams', 'WebAssembly',
+  'WebSocket', 'WritableStream', 'atob', 'btoa', 'clearImmediate', 'clearInterval',
+  'clearTimeout', 'console', 'crypto', 'fetch', 'navigator', 'performance',
+  'process', 'queueMicrotask', 'require', 'setImmediate', 'setInterval',
+  'setTimeout', 'structuredClone',
+  // Bundler/runtime artifacts occasionally referenced defensively
+  'window', 'document', 'reportError',
+]);
+
+if (!existsSync(BUNDLE)) {
+  console.error(`tui-render-smoke: FAIL — bundle not found at ${BUNDLE}; run \`npm run build:tui\` first`);
+  process.exit(1);
+}
+
+const source = readFileSync(BUNDLE, 'utf8');
+
+let ast;
+try {
+  ast = parse(source, { ecmaVersion: 'latest', sourceType: 'module', locations: true, ranges: true });
+} catch (err) {
+  console.error(`tui-render-smoke: FAIL — bundle does not parse: ${err.message}`);
+  process.exit(1);
+}
+
+const scopeManager = analyze(ast, { ecmaVersion: 2022, sourceType: 'module' });
+const unresolved = scopeManager.globalScope.through.filter(
+  (ref) => !KNOWN_GLOBALS.has(ref.identifier.name),
+);
+
+if (unresolved.length > 0) {
+  const seen = new Map();
+  for (const ref of unresolved) {
+    const { name } = ref.identifier;
+    if (!seen.has(name)) seen.set(name, ref.identifier.loc?.start);
+  }
+  console.error(`tui-render-smoke: FAIL — ${seen.size} undeclared identifier(s) in src/tui/dist/index.mjs:`);
+  for (const [name, loc] of seen) {
+    console.error(`  ${name} (dist/index.mjs:${loc ? `${loc.line}:${loc.column}` : '?'})`);
+  }
+  console.error('These throw ReferenceError when the TUI renders. Fix missing imports in src/tui/ and rebuild.');
+  process.exit(1);
+}
+
+console.log('tui-render-smoke: ok — no undeclared identifiers in TUI bundle');

package/scripts/webhook-smoke.mjs

@@ -0,0 +1,208 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as crypto from 'node:crypto';
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { readMarkdownDocument } from '../src/runtime/shared/markdown-frontmatter.mjs';
+
+// DATA_DIR resolves from MIXDOG_DATA_DIR at module import time (via
+// ./config.mjs -> resolvePluginData), so the env var MUST be set before
+// the first dynamic import of webhook.mjs.
+const dataDir = mkdtempSync(join(tmpdir(), 'mixdog-webhook-test-'));
+process.env.MIXDOG_DATA_DIR = dataDir;
+
+const {
+  extractSignature,
+  verifySignature,
+  loadEndpointConfig,
+  STRIPE_TOLERANCE_MS,
+} = await import('../src/runtime/channels/lib/webhook.mjs');
+
+function hmacHex(secret, payload) {
+  return crypto.createHmac('sha256', secret).update(payload).digest('hex');
+}
+
+// ── verifySignature: github/generic hex HMAC ──────────────────────────
+
+test('verifySignature: github parser accepts a valid sha256 hex signature', () => {
+  const secret = 'shh';
+  const body = '{"hello":"world"}';
+  const sig = hmacHex(secret, body);
+  assert.equal(verifySignature(secret, body, sig, 'github'), true);
+});
+
+test('verifySignature: generic parser accepts a valid sha256 hex signature', () => {
+  const secret = 'shh';
+  const body = '{"hello":"world"}';
+  const sig = hmacHex(secret, body);
+  assert.equal(verifySignature(secret, body, sig, 'generic'), true);
+});
+
+test('verifySignature: github/generic reject a wrong signature', () => {
+  const secret = 'shh';
+  const body = '{"hello":"world"}';
+  const wrong = hmacHex('other-secret', body);
+  assert.equal(verifySignature(secret, body, wrong, 'github'), false);
+});
+
+test('verifySignature: length-mismatch hex signature returns false without throwing', () => {
+  const secret = 'shh';
+  const body = 'payload';
+  // Valid hex, wrong byte length vs the 32-byte sha256 digest.
+  assert.doesNotThrow(() => {
+    assert.equal(verifySignature(secret, body, 'ab', 'github'), false);
+  });
+});
+
+test('verifySignature: malformed (non-hex) signature returns false without throwing', () => {
+  const secret = 'shh';
+  const body = 'payload';
+  assert.doesNotThrow(() => {
+    assert.equal(verifySignature(secret, body, 'not-hex-zzzz', 'github'), false);
+  });
+});
+
+// ── verifySignature: stripe t= / v1= scheme ───────────────────────────
+
+test('verifySignature: stripe accepts a valid t+v1 pair', () => {
+  const secret = 'stripe-secret';
+  const body = '{"id":"evt_1"}';
+  const t = Math.floor(Date.now() / 1000);
+  const v1 = hmacHex(secret, `${t}.${body}`);
+  assert.equal(verifySignature(secret, body, `t=${t},v1=${v1}`, 'stripe'), true);
+});
+
+test('verifySignature: stripe rejects a header missing t=', () => {
+  const secret = 'stripe-secret';
+  const body = '{"id":"evt_1"}';
+  const t = Math.floor(Date.now() / 1000);
+  const v1 = hmacHex(secret, `${t}.${body}`);
+  assert.equal(verifySignature(secret, body, `v1=${v1}`, 'stripe'), false);
+});
+
+test('verifySignature: stripe rejects a header missing v1=', () => {
+  const secret = 'stripe-secret';
+  const body = '{"id":"evt_1"}';
+  const t = Math.floor(Date.now() / 1000);
+  assert.equal(verifySignature(secret, body, `t=${t}`, 'stripe'), false);
+});
+
+test('verifySignature: stripe rejects a stale timestamp beyond the tolerance window (replay)', () => {
+  const secret = 'stripe-secret';
+  const body = '{"id":"evt_1"}';
+  const staleT = Math.floor((Date.now() - STRIPE_TOLERANCE_MS - 60_000) / 1000);
+  const v1 = hmacHex(secret, `${staleT}.${body}`);
+  assert.equal(verifySignature(secret, body, `t=${staleT},v1=${v1}`, 'stripe'), false);
+});
+
+test('verifySignature: stripe rejects a tampered v1 (HMAC mismatch) with a fresh t', () => {
+  const secret = 'stripe-secret';
+  const body = '{"id":"evt_1"}';
+  const t = Math.floor(Date.now() / 1000);
+  const tamperedV1 = hmacHex('wrong-secret', `${t}.${body}`);
+  assert.equal(verifySignature(secret, body, `t=${t},v1=${tamperedV1}`, 'stripe'), false);
+});
+
+// ── extractSignature: parser mapping + fallback scan ──────────────────
+
+test('extractSignature: github parser strips the sha256= prefix from x-hub-signature-256', () => {
+  const headers = { 'x-hub-signature-256': 'sha256=deadbeef' };
+  assert.equal(extractSignature(headers, 'github'), 'deadbeef');
+});
+
+test('extractSignature: generic parser strips the sha256= prefix from x-signature-256', () => {
+  const headers = { 'x-signature-256': 'sha256=cafebabe' };
+  assert.equal(extractSignature(headers, 'generic'), 'cafebabe');
+});
+
+test('extractSignature: stripe parser returns the raw stripe-signature value (no prefix)', () => {
+  const headers = { 'stripe-signature': 't=1,v1=abc123' };
+  assert.equal(extractSignature(headers, 'stripe'), 't=1,v1=abc123');
+});
+
+test('extractSignature: sentry parser returns the raw sentry-hook-signature value', () => {
+  const headers = { 'sentry-hook-signature': 'raw-sig-value' };
+  assert.equal(extractSignature(headers, 'sentry'), 'raw-sig-value');
+});
+
+test('extractSignature: unknown parser name falls back to scanning all known headers', () => {
+  const headers = { 'x-signature-256': 'sha256=fallback-hit' };
+  assert.equal(extractSignature(headers, 'no-such-parser'), 'fallback-hit');
+});
+
+test('extractSignature: no parser given scans known headers in declaration order', () => {
+  const headers = { 'x-hub-signature-256': 'sha256=github-hit' };
+  assert.equal(extractSignature(headers, undefined), 'github-hit');
+});
+
+test('extractSignature: returns null when no known signature header is present', () => {
+  const headers = { 'x-some-other-header': 'value' };
+  assert.equal(extractSignature(headers, 'github'), null);
+});
+
+// ── endpoint config loader: WEBHOOK.md frontmatter + secret side file ─
+
+test('loadEndpointConfig: loads frontmatter + reads secret from side file', () => {
+  const name = 'my-endpoint';
+  const dir = join(dataDir, 'webhooks', name);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    join(dir, 'WEBHOOK.md'),
+    [
+      '---',
+      'channel: main',
+      'parser: github',
+      'enabled: true',
+      '---',
+      '',
+      'Handle this webhook by summarizing the payload.',
+      '',
+    ].join('\n'),
+    'utf8',
+  );
+  writeFileSync(join(dir, 'secret'), 'my-webhook-secret\n', 'utf8');
+
+  const cfg = loadEndpointConfig(name);
+  assert.equal(cfg.channel, 'main');
+  assert.equal(cfg.parser, 'github');
+  assert.equal(cfg.enabled, true);
+});
+
+test('loadEndpointConfig: enabled: false frontmatter casts to boolean false', () => {
+  const name = 'disabled-endpoint';
+  const dir = join(dataDir, 'webhooks', name);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    join(dir, 'WEBHOOK.md'),
+    ['---', 'channel: main', 'enabled: false', '---', '', 'body text', ''].join('\n'),
+    'utf8',
+  );
+  const cfg = loadEndpointConfig(name);
+  assert.equal(cfg.enabled, false);
+});
+
+test('loadEndpointConfig: returns null for a name with no WEBHOOK.md', () => {
+  assert.equal(loadEndpointConfig('never-registered'), null);
+});
+
+// loadEndpointConfig only surfaces the frontmatter (by design — see
+// webhook.mjs comment above loadEndpointConfig); confirm the underlying
+// shared parser it delegates to also recovers the markdown body, since
+// the loader's frontmatter/body split is not independently exercised
+// through the exported loadEndpointConfig surface.
+test('readMarkdownDocument: WEBHOOK.md-shaped input yields frontmatter + body', () => {
+  const raw = [
+    '---',
+    'channel: main',
+    'parser: github',
+    '---',
+    '',
+    'Handle this webhook by summarizing the payload.',
+    '',
+  ].join('\n');
+  const { frontmatter, body } = readMarkdownDocument(raw);
+  assert.equal(frontmatter.channel, 'main');
+  assert.equal(frontmatter.parser, 'github');
+  assert.equal(body, 'Handle this webhook by summarizing the payload.');
+});

package/src/agents/debugger/AGENT.md

@@ -7,5 +7,8 @@ permission: read
 Root-cause analysis agent.
 
 Smallest confirmed cause chain before fixes. Return likely cause, evidence
-(`file:line`), smallest next check/fix. Fragments only, no narration. Mark
-confirmed facts vs inferences; avoid broad speculation.
+(`file:line`), smallest next check/fix. Mark confirmed facts vs inferences;
+avoid broad speculation. Fragments only; no narration, no report bloat.
+
+Converge, don't sweep: when new reads stop adding evidence, report the best
+cause chain so far — a partial/blocked report is a valid completion.

package/src/agents/heavy-worker/AGENT.md

@@ -1,11 +1,21 @@
----
-permission: read-write
----
-
-# Heavy Worker
-Broad implementation agent.
-
-Bounded slices; smallest coherent change, not rewrite. Stop: unclear scope,
-growing blast radius, or Lead-only verification. Minimal checks + how-to-verify.
-Handoff fragments only, no report bloat: changed `file:line`, verification, risks.
-
+---
+permission: read-write
+---
+
+# Heavy Worker
+Broad implementation agent.
+
+Bounded slices; smallest coherent change, not rewrite. Stop: unclear scope,
+growing blast radius, or Lead-only verification.
+
+EDIT-FIRST DISCIPLINE. Survey the slice with ONE batched read/grep round,
+then start patching the first bounded piece — broad scope means edit
+incrementally, not read exhaustively. NEVER "one more confirming read": if
+an anchor is plausible, the next call is `apply_patch`. Repeated read-only
+turns without an edit = stalling; any runtime reminder is your cue to patch
+the piece you understand or report blocked — a blocked report is a valid
+completion. Self-check comes AFTER edits; deep verification is Lead's.
+
+Minimal checks + how-to-verify. Hand off outcome as fragments anchored to
+`file:line`; no narration, no report bloat.
+

package/src/agents/maintainer/AGENT.md

@@ -5,3 +5,7 @@ permission: read-write
 # Maintainer
 
 Maintenance and cleanup agent.
+
+Smallest coherent change; no scope growth. Repeated read-only turns without
+an edit = stalling; patch or return blocked — a blocked report is a valid
+completion. Hand off as fragments (`file:line`); no narration.

package/src/agents/reviewer/AGENT.md

@@ -7,5 +7,6 @@ permission: read
 Regression/risk review agent.
 
 Find actionable correctness/regression/security/verification risks. Findings
-first, severity-ordered, one line with `file:line`; skip non-risky nits. No
-preamble/prose padding. If clean, one line + only material residual risk.
+first, severity-ordered, one line with `file:line`; skip non-risky nits. If
+clean, one line + only material residual risk. Fragments only; no narration,
+no report bloat.

package/src/agents/worker/AGENT.md

@@ -1,11 +1,21 @@
----
-permission: read-write
----
-
-# Worker
-Scoped implementation agent.
-
-Smallest scoped change; no drive-by cleanup. Stop when done/blocked.
-Self-check scope+obvious errors; Lead/Reviewer verify. Handoff fragments only,
-no report bloat: changed `file:line`, verification, risks.
-
+---
+permission: read-write
+---
+
+# Worker
+Scoped implementation agent.
+
+Smallest scoped change; no drive-by cleanup. Stop when done/blocked.
+
+EDIT-FIRST DISCIPLINE. Brief anchors (`file:line`) are pre-verified — trust
+them and patch. No anchor: locate with AT MOST 1-2 reads, then edit. NEVER
+"one more confirming read": if you know the file and the change, the next
+call is `apply_patch`. Repeated read-only turns without an edit = stalling;
+any runtime reminder is your cue to patch now or return blocked with what's
+missing — a blocked report is a valid completion. Confidence threshold is
+"plausible", not "proven"; self-check comes AFTER the edit, and Lead/Reviewer
+own final verification.
+
+Hand off outcome as fragments anchored to `file:line`; no narration, no
+report bloat.
+

package/src/lib/rules-builder.cjs

@@ -21,6 +21,7 @@
  * Source files (rules/):
  *   - shared/01-tool.md              — universal tool policy (Lead + agent BP1, identical full set)
  *   - lead/lead-tool.md             — Lead-specific control-tower / delegation / ToolSearch guidance
+ *   - lead/lead-brief.md            — Lead brief contract (agent handoff briefs)
  *   - lead/01-02                     — Lead general / channels
  *   - output-styles/<name>.md        — Lead output style, selected by config outputStyle
  *   - agent/00-common.md             — agent common behavior + universal worker contract (BP2)
@@ -275,6 +276,9 @@ function buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR }) {
   const toolLead = readOptional(path.join(LEAD_DIR, 'lead-tool.md'));
   if (toolLead) parts.push(toolLead);
 
+  const briefLead = readOptional(path.join(LEAD_DIR, 'lead-brief.md'));
+  if (briefLead) parts.push(briefLead);
+
   if (generalSplit.role) parts.push(generalSplit.role);
 
   const channels = readOptional(path.join(LEAD_DIR, '02-channels.md'));