jekyll-theme-zer0 1.28.0 → 1.29.0

data/scripts/ci/test_agent_review_result.py

@@ -0,0 +1,172 @@
+#!/usr/bin/env python3
+"""Unit tests for scripts/ci/agent_review_result.py (issue #418).
+
+The bug these guard against: the Claude tier of ai-content-review.yml posted
+
+    Failed to authenticate. API Error: 401 OAuth access token has been revoked.
+
+into PR #414 as its review, and the job still reported success. The credential
+has since been rotated, but the SWALLOW is the durable defect — it would hide
+the next revoked token exactly as well as it hid this one.
+
+The first fixture below is that output verbatim, copied from the comment the
+workflow actually posted (2026-08-23T04:51:47Z, run 32618860829). If the guard
+ever stops failing on it, the regression is back.
+
+Both directions are covered. A real review must NOT be flagged — including one
+whose prose legitimately quotes an auth error, which is the false positive a
+bare `grep 'Failed to authenticate'` would produce (and which would fire on this
+repo's own troubleshooting docs).
+
+Dependency-light on purpose: standard library only, so it runs anywhere the
+workflow does.
+
+    python3 scripts/ci/test_agent_review_result.py
+"""
+
+from __future__ import annotations
+
+import re
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import agent_review_result as arr  # noqa: E402
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+WORKFLOW = REPO_ROOT / ".github" / "workflows" / "ai-content-review.yml"
+
+CHECKS: list[tuple[str, bool]] = []
+
+
+def check(label: str, ok: bool) -> None:
+    CHECKS.append((label, bool(ok)))
+
+
+# The 401 exactly as the CLI printed it and the workflow posted it.
+AUTH_401 = "Failed to authenticate. API Error: 401 OAuth access token has been revoked.\n"
+
+REAL_REVIEW = """**Verdict:** approve with minor suggestions
+
+### pages/_docs/getting-started.md
+
+- The `description` front matter reads as a keyword list rather than a sentence.
+  Rewrite it as prose so search snippets are readable.
+- The second H2 duplicates the page title; demote it to an H3 or cut it.
+- Two code fences are missing a language tag, so they render unhighlighted.
+- Alt text on the architecture diagram describes the file, not the picture.
+
+### pages/_docs/configuration.md
+
+- Consistent terminology: this page says "config file" where the rest of the
+  docs say `_config.yml`. Pick one.
+- The table of collection defaults is missing the `books` collection added in
+  v1.19, so the page is incomplete rather than merely terse.
+- Sentence length in "Advanced overrides" averages 38 words; split the longest.
+
+### Summary
+
+Both files are accurate and well-organised. The findings above are polish, not
+correctness — nothing here blocks the merge.
+"""
+
+# A real review that TALKS about auth failures. Must not be mistaken for one.
+REVIEW_ABOUT_AUTH = """**Verdict:** approve
+
+### docs/troubleshooting/credentials.md
+
+- The page explains what to do when the CLI prints "Failed to authenticate. API
+  Error: 401 OAuth access token has been revoked." — good, that is the exact
+  string users will search for, so keep it verbatim rather than paraphrasing.
+- Add a cross-link to the rotation runbook; the reader is told to "rotate the
+  token" with no pointer to how.
+- The `authentication_error` example block is missing a language tag.
+- Consider noting that the deterministic review tier keeps working while the
+  credential is broken, since that surprised at least one reader.
+- Front matter `lastmod` is stale by two releases.
+
+### Summary
+
+Accurate and genuinely useful. Only polish items above; the troubleshooting
+steps themselves check out against the current workflow definition.
+"""
+
+
+def run_guard(status: int, stdout: str, stderr: str = "") -> tuple[int, str]:
+    """Invoke the guard end-to-end; return (exit code, comment body)."""
+    with tempfile.TemporaryDirectory() as tmp:
+        d = Path(tmp)
+        (d / "out.txt").write_text(stdout, encoding="utf-8")
+        (d / "err.txt").write_text(stderr, encoding="utf-8")
+        rc = arr.main([
+            "--status", str(status),
+            "--stdout", str(d / "out.txt"),
+            "--stderr", str(d / "err.txt"),
+            "--out", str(d / "body.md"),
+        ])
+        return rc, (d / "body.md").read_text(encoding="utf-8")
+
+
+def main() -> int:
+    # --- the observed failure, verbatim ------------------------------------ #
+    rc, body = run_guard(0, AUTH_401)
+    check("the verbatim PR #414 401 fails the step (exit 1) even on claude exit 0", rc == 1)
+    check("the 401 comment body says the review did not run", "did not run" in body)
+    check("the raw 401 line is no longer posted as if it were the review",
+          not body.startswith(f"{arr.TITLE}\n\nFailed to authenticate"))
+    check("the failure notice is visibly a caution, not a review", "[!CAUTION]" in body)
+
+    rc, _ = run_guard(1, AUTH_401)
+    check("a non-zero claude exit fails the step", rc == 1)
+
+    # --- nothing came back -------------------------------------------------- #
+    rc, body = run_guard(0, "")
+    check("empty agent output fails the step", rc == 1)
+    check("the empty-output notice names the reason", "no output" in body)
+
+    rc, _ = run_guard(0, "\n   \n\t\n")
+    check("whitespace-only agent output fails the step", rc == 1)
+
+    # --- other credential failures ------------------------------------------ #
+    rc, _ = run_guard(0, "API Error: 400 Credit balance is too low to access the API.\n")
+    check("a credit-balance failure fails the step", rc == 1)
+    rc, _ = run_guard(0, "Invalid API key · Please run `claude login`\n")
+    check("an invalid-key failure fails the step", rc == 1)
+    rc, _ = run_guard(0, "API Error: 429 rate limit exceeded\n")
+    check("a rate-limit failure fails the step", rc == 1)
+
+    # --- real reviews pass --------------------------------------------------- #
+    rc, body = run_guard(0, REAL_REVIEW)
+    check("a genuine multi-section review passes", rc == 0)
+    check("the real review is posted under the review heading", "**Verdict:**" in body)
+
+    rc, _ = run_guard(0, REVIEW_ABOUT_AUTH)
+    check("a long review that QUOTES an auth error is not mistaken for a failure", rc == 0)
+
+    # --- the workflow actually uses the guard -------------------------------- #
+    # Without this the fix is one deleted line away from returning, and nothing
+    # in the fixture tests above would notice.
+    wf = WORKFLOW.read_text(encoding="utf-8")
+    check("ai-content-review.yml invokes the guard",
+          "scripts/ci/agent_review_result.py" in wf)
+    check("the agent step no longer ends by piping stdout into the comment body",
+          not re.search(r"cat /tmp/agent-review\.md\s*\n\s*\}\s*>\s*/tmp/agent-review-final\.md", wf))
+    check("the AI gate no longer implies a present credential is a working one",
+          "not validity" in wf)
+
+    failed = [label for label, ok in CHECKS if not ok]
+    print()
+    for label, ok in CHECKS:
+        print(f"  {'PASS' if ok else 'FAIL'}  {label}")
+    print()
+    if failed:
+        print(f"FAILED ({len(failed)}/{len(CHECKS)})")
+        return 1
+    print(f"OK ({len(CHECKS)} checks)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

data/scripts/design-system-check.rb

@@ -0,0 +1,170 @@
+#!/usr/bin/env ruby
+# Feature: ZER0-081
+# frozen_string_literal: true
+
+# ---------------------------------------------------------------------------
+# design-system-check — token parity between the theme and its Claude Design
+# mirror.
+#
+# The `--zer0-*` design tokens live twice on purpose:
+#   - `_sass/tokens/*.scss`         — the source of truth the theme compiles
+#   - `_design-system/tokens/*.css` — the mirror pushed to the Claude Design
+#                                     project (see _design-system/SYNC.md)
+#
+# This check keeps the two in lockstep so the design system can be built from
+# either side without silent drift:
+#
+#   1. Per file pair: the sets of `--zer0-*` names must match, and every value
+#      must resolve to the same string. `var(--x, fallback)` wrappers are
+#      resolved against the mirror's concrete `--bs-*`/`--bd-*` primitives, so
+#      the theme's alias form and the mirror's self-contained form compare
+#      equal.
+#   2. Skins: `_sass/theme/_skins.scss` and `tokens/skins.css` must declare the
+#      same skin names, and each mirror skin's brand hex must appear in the
+#      matching SCSS block.
+#   3. Dangling-token audit: any fallback-less `var(--zer0-…)` reference in
+#      `_sass/` must be declared somewhere (tokens, includes, or JS).
+#
+#   ruby scripts/design-system-check.rb        # exit 1 + report on drift
+#
+# Runs in the `core` test suite (test/test_core.sh). Plain Ruby, no gems.
+# ---------------------------------------------------------------------------
+
+ROOT = File.expand_path('..', __dir__)
+
+PAIRS = {
+  '_sass/tokens/_color.scss'       => '_design-system/tokens/colors.css',
+  '_sass/tokens/_spacing.scss'     => '_design-system/tokens/spacing.css',
+  '_sass/tokens/_radius.scss'      => '_design-system/tokens/radius.css',
+  '_sass/tokens/_typography.scss'  => '_design-system/tokens/typography.css',
+  '_sass/tokens/_shadow.scss'      => '_design-system/tokens/shadows.css',
+  '_sass/tokens/_motion.scss'      => '_design-system/tokens/motion.css',
+  '_sass/tokens/_breakpoints.scss' => '_design-system/tokens/breakpoints.css',
+  '_sass/tokens/_layers.scss'      => '_design-system/tokens/layers.css'
+}.freeze
+
+SKIN_SCSS = '_sass/theme/_skins.scss'
+SKIN_CSS  = '_design-system/tokens/skins.css'
+
+def read(rel)
+  path = File.join(ROOT, rel)
+  abort "design-system-check: missing file #{rel}" unless File.file?(path)
+  File.read(path)
+end
+
+# Strip /* */ blocks, // line comments, and everything from the first @media on
+# (motion files re-declare durations under prefers-reduced-motion).
+def strip(text, scss:)
+  t = text.split('@media', 2).first
+  t = t.gsub(%r{/\*.*?\*/}m, '')
+  t = t.gsub(%r{(?:^|\s)//.*$}, '') if scss
+  t
+end
+
+# { '--zer0-foo' => 'raw value', ... } from declaration-position matches.
+def declarations(text)
+  text.scan(/(--zer0-[\w-]+)\s*:\s*([^;]+);/).each_with_object({}) do |(k, v), h|
+    h[k] ||= v.strip.gsub(/\s+/, ' ')
+  end
+end
+
+# All custom properties (any prefix) declared in the mirror's colors.css light
+# scope — the concrete primitives var() chains resolve against.
+def primitives
+  light = read(SKIN_CSS.sub('skins', 'colors')).split('[data-bs-theme="dark"]', 2).first
+  strip(light, scss: false).scan(/(--[\w-]+)\s*:\s*([^;]+);/)
+                           .each_with_object({}) { |(k, v), h| h[k] ||= v.strip.gsub(/\s+/, ' ') }
+end
+
+# Resolve a value that is entirely a var() wrapper: prefer the primitive's
+# concrete value, else the wrapper's own fallback. Inner var() references in
+# composite values (color-mix, rgba) are left as-is and compared literally.
+def resolve(value, prims, depth = 0)
+  v = value.strip.gsub(/\s+/, ' ')
+  return v if depth > 6
+
+  m = v.match(/\Avar\((--[\w-]+)(?:\s*,\s*(.+))?\)\z/)
+  return v unless m
+
+  name, fallback = m[1], m[2]
+  if prims.key?(name)
+    resolve(prims[name], prims, depth + 1)
+  elsif fallback
+    resolve(fallback, prims, depth + 1)
+  else
+    v
+  end
+end
+
+failures = []
+prims = primitives
+
+# --- 1. token parity per file pair -----------------------------------------
+PAIRS.each do |scss_rel, css_rel|
+  scss = declarations(strip(read(scss_rel), scss: true))
+  css  = declarations(strip(read(css_rel),  scss: false))
+
+  (scss.keys - css.keys).each { |k| failures << "#{css_rel}: missing #{k} (declared in #{scss_rel})" }
+  (css.keys - scss.keys).each { |k| failures << "#{scss_rel}: missing #{k} (declared in #{css_rel})" }
+
+  (scss.keys & css.keys).each do |k|
+    a = resolve(scss[k], prims)
+    b = resolve(css[k], prims)
+    failures << "#{k}: theme resolves to `#{a}` but mirror to `#{b}`" unless a == b
+  end
+end
+
+# Both motion files must keep the reduced-motion guard.
+[PAIRS.key('_design-system/tokens/motion.css'), '_design-system/tokens/motion.css'].each do |rel|
+  failures << "#{rel}: lost its prefers-reduced-motion guard" unless read(rel).include?('prefers-reduced-motion')
+end
+
+# --- 2. skins: same names, same brand hex ----------------------------------
+scss_skins_src = read(SKIN_SCSS)
+css_skins_src  = read(SKIN_CSS)
+scss_skins = scss_skins_src.scan(/\[data-theme-skin="(\w+)"\]/).flatten.uniq.sort
+css_skins  = css_skins_src.scan(/\[data-theme-skin="(\w+)"\]/).flatten.uniq.sort
+unless scss_skins == css_skins
+  failures << "skins differ: theme has #{scss_skins.join(', ')} but mirror has #{css_skins.join(', ')}"
+end
+
+(scss_skins & css_skins).each do |skin|
+  block = css_skins_src[/\[data-theme-skin="#{skin}"\]\s*\{.*?\}/m].to_s
+  hex = block[/--zer0-color-primary:\s*(#\h+)/, 1]
+  next unless hex
+
+  scss_block = scss_skins_src[/\[data-theme-skin="#{skin}"\]\s*\{.*?\}/m].to_s
+  unless scss_block.downcase.include?(hex.downcase)
+    failures << "skin #{skin}: mirror brand #{hex} not found in #{SKIN_SCSS}"
+  end
+end
+
+# --- 3. dangling-token audit ------------------------------------------------
+declared = Dir.glob(File.join(ROOT, '_sass/**/*.scss'))
+              .flat_map { |f| File.read(f).scan(/(--zer0-[\w-]+)\s*:/) }.flatten
+declared += Dir.glob(File.join(ROOT, '{_includes,_layouts}/**/*.html'))
+               .flat_map { |f| File.read(f).scan(/(--zer0-[\w-]+)\s*:/) }.flatten
+declared += Dir.glob(File.join(ROOT, 'assets/js/**/*.js')).flat_map do |f|
+  src = File.read(f)
+  src.scan(/setProperty\(\s*['"](--zer0-[\w-]+)/).flatten +
+    src.scan(/['"`](--zer0-[\w-]+)['"`:]/).flatten
+end
+declared = declared.uniq
+
+Dir.glob(File.join(ROOT, '_sass/**/*.scss')).sort.each do |f|
+  File.read(f).scan(/var\(\s*(--zer0-[\w-]+)\s*\)/).flatten.uniq.each do |token|
+    next if declared.include?(token)
+
+    failures << "#{f.sub("#{ROOT}/", '')}: references #{token} with no fallback, but it is never declared"
+  end
+end
+
+# --- report -----------------------------------------------------------------
+if failures.empty?
+  puts "design-system-check: OK — #{PAIRS.size} token file pairs, #{css_skins.size} skins, no dangling tokens"
+else
+  warn "design-system-check: #{failures.size} problem(s) — theme (_sass/tokens) and mirror (_design-system/tokens) have drifted:"
+  failures.each { |f| warn "  - #{f}" }
+  warn 'Fix the drift (see _design-system/SYNC.md), then re-run: ruby scripts/design-system-check.rb'
+  exit 1
+end

data/scripts/lib/audit.sh

@@ -205,13 +205,45 @@ detect_consumer_mode() {
         return
     fi
 
-    if grep -qE '^remote_theme:' "$config"; then
+    # Match a top-level `remote_theme` key. The whitespace class before the
+    # colon is load-bearing: most fleet consumers write column-aligned YAML
+    # (`remote_theme             : "bamr87/zer0-mistakes"`), which a bare
+    # `^remote_theme:` never matches — every one of them was silently
+    # misreported as gem mode, skipping the plugin checks entirely.
+    # `|| true` keeps a no-match grep from tripping the caller's `set -o pipefail`.
+    local line value
+    line=$(grep -m1 -E '^remote_theme[[:space:]]*:' "$config" 2>/dev/null || true)
+    value=$(printf '%s' "$line" \
+            | sed -E 's/^remote_theme[[:space:]]*:[[:space:]]*//; s/[[:space:]]*(#.*)?$//; s/^"(.*)"$/\1/; s/^'\''(.*)'\''$/\1/')
+
+    # `remote_theme: false` (or an empty value) is how a consumer turns the
+    # remote theme OFF and resolves the theme as a gem instead.
+    if [[ -n "$value" && "$value" != "false" ]]; then
         echo "remote_theme"
     else
         echo "gem"
     fi
 }
 
+# detect_consumer_source <consumer_root>
+# Echoes the Jekyll `source:` value from _config.yml (relative path), or empty.
+#
+# Jekyll's `source:` relocates the whole site tree — zer0-pages keeps every
+# theme-shadowing file under `pages/`. Auditing the repo root there reports a
+# falsely clean "0 overrides, 0 unique files"; the real surface only appears
+# when the scan follows `source:`.
+detect_consumer_source() {
+    local consumer_root="$1"
+    local config="$consumer_root/_config.yml"
+
+    [[ -f "$config" ]] || return 0
+
+    local line
+    line=$(grep -m1 -E '^source[[:space:]]*:' "$config" 2>/dev/null || true)
+    printf '%s' "$line" \
+        | sed -E 's/^source[[:space:]]*:[[:space:]]*//; s/[[:space:]]*(#.*)?$//; s/^"(.*)"$/\1/; s/^'\''(.*)'\''$/\1/; s#^\./##; s#/$##'
+}
+
 # ---------------------------------------------------------------------------
 # Output helpers
 # ---------------------------------------------------------------------------
@@ -277,7 +309,15 @@ print_classification() {
                 echo "::notice file=$relpath::OPTIONAL_PLUGIN (not required)" ;;
         esac
     elif [[ "$format" == "json" ]]; then
-        echo "  {\"path\":\"$relpath\",\"status\":\"$classification\"},"
+        # Separator goes BEFORE each entry but the first, so the array never
+        # ends on a dangling comma. Emitting a trailing comma per entry (the
+        # previous behaviour) produced `...},\n]}` — which no JSON parser
+        # accepts, making --format json unusable for any CI consumer.
+        if [[ "${JSON_ENTRY_EMITTED:-0}" == "1" ]]; then
+            printf ',\n'
+        fi
+        JSON_ENTRY_EMITTED=1
+        printf '  {"path":"%s","status":"%s"}' "$relpath" "$classification"
     else
         echo -e "${color}[$classification]${NC} $relpath"
     fi

data/scripts/lint-liquid-raw.rb

@@ -0,0 +1,137 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# ---------------------------------------------------------------------------
+# lint-liquid-raw — guard the Markdown the Pages build renders through Liquid
+#
+# `github-pages` ships jekyll-optional-front-matter, so EVERY non-excluded
+# Markdown file in the repo becomes a page — CHANGELOG.md and the
+# _design-system/ mirror included — and every one of them is run through Liquid
+# before Markdown. Two failure modes follow, and neither is loud:
+#
+#   1. An unbalanced `{% raw %}`. Liquid's raw block swallows everything up to
+#      the FIRST `{% endraw %}`, so a stray opener silently eats the rest of the
+#      document. CHANGELOG.md carried one that consumed 945 lines while the
+#      build stayed green.
+#
+#   2. A literal `{% raw %}` / `{% endraw %}` written as documentation prose.
+#      It reads like text but parses as a tag, which is how (1) happens. To show
+#      the tag, escape it: `{% raw %}{% raw %}{% endraw %}`.
+#
+# A Liquid *syntax* error (e.g. `{{…}}`) is caught by the Pages workflow, which
+# fails on "Liquid Warning" in the build output. This script catches the class
+# the build cannot report, because swallowed text is not an error to Liquid.
+#
+# Usage:
+#   scripts/lint-liquid-raw.rb            # scan the rendered Markdown surface
+#   scripts/lint-liquid-raw.rb PATH...    # scan specific files
+#   scripts/lint-liquid-raw.rb --verbose  # list every file scanned
+# ---------------------------------------------------------------------------
+
+ROOT = File.expand_path('..', __dir__)
+TAG = /\{%-?\s*(raw|endraw)\s*-?%\}/.freeze
+
+# The escape form: a raw block whose entire body is one raw/endraw tag, which
+# is how you render the tag as text. Blanked before scanning so the literal it
+# carries is not mistaken for a real tag.
+ESCAPED = /\{%-?\s*raw\s*-?%\}\{%-?\s*(?:raw|endraw)\s*-?%\}\{%-?\s*endraw\s*-?%\}/.freeze
+
+# Directories Jekyll never reads, plus the ones _config.yml excludes. Kept in
+# sync with the `exclude:` list; a path missing here only costs a false
+# positive, never a missed one.
+SKIP_DIRS = %w[
+  .git .github .claude .cursor .devcontainer .frontmatter .vscode .obsidian
+  .jekyll-cache .sass-cache _site node_modules vendor pkg logs
+  docs scripts templates test tests examples submodules gemfiles docker lib
+].freeze
+
+# True when `pos` sits inside a single-backtick code span: an odd number of
+# backtick runs precede it on its own line.
+def in_code_span?(text, pos)
+  bol = text.rindex("\n", pos - 1)
+  line = text[(bol ? bol + 1 : 0)...pos]
+  line.scan(/`+/).size.odd?
+end
+
+def scan(path)
+  # Blank the escape form (keeping byte offsets and newlines) so the literal
+  # tag it renders is not read as a tag itself.
+  text = File.read(path, encoding: 'UTF-8')
+             .gsub(ESCAPED) { |m| ' ' * m.length }
+  problems = []
+  in_raw = false
+  opened_at = nil
+  opened_in_span = false
+
+  text.to_enum(:scan, TAG).each do
+    match = Regexp.last_match
+    line = text[0, match.begin(0)].count("\n") + 1
+    if in_raw
+      # Inside a raw block every tag is literal text — nothing to check.
+      if match[1] == 'endraw'
+        if opened_in_span && line != opened_at
+          problems << "#{path}:#{opened_at}: `{% raw %}` inside a code span " \
+                      "opens a block that only closes at line #{line} — " \
+                      'escape it to show the tag as text'
+        end
+        in_raw = false
+        opened_at = nil
+        opened_in_span = false
+      end
+      next
+    end
+
+    if match[1] == 'raw'
+      in_raw = true
+      opened_at = line
+      # `{% raw %}` inside an inline code span is the documentation-mention
+      # trap: it reads as text but opens a real block. Legitimate inline use
+      # (`{% raw %}{{ x }}{% endraw %}`) closes on the same line; a mention
+      # does not, and swallows everything up to the next `{% endraw %}`.
+      opened_in_span = in_code_span?(text, match.begin(0))
+    else
+      problems << "#{path}:#{line}: `{% endraw %}` with no matching `{% raw %}`"
+    end
+  end
+
+  if in_raw
+    problems << "#{path}:#{opened_at}: `{% raw %}` is never closed — " \
+                'Liquid will swallow the rest of the file'
+  end
+  problems
+rescue ArgumentError, Encoding::InvalidByteSequenceError => e
+  ["#{path}: could not read as UTF-8 (#{e.class})"]
+end
+
+def markdown_files
+  Dir.chdir(ROOT) do
+    Dir.glob('**/*.{md,markdown}', File::FNM_DOTMATCH).reject do |p|
+      p.split(File::SEPARATOR).any? { |seg| SKIP_DIRS.include?(seg) }
+    end.sort
+  end
+end
+
+verbose = ARGV.delete('--verbose')
+targets = ARGV.empty? ? markdown_files : ARGV
+
+problems = []
+Dir.chdir(ROOT) do
+  targets.each do |path|
+    next unless File.file?(path)
+
+    warn "  scanning #{path}" if verbose
+    problems.concat(scan(path))
+  end
+end
+
+if problems.empty?
+  puts "✓ lint-liquid-raw: #{targets.size} Markdown files, all " \
+       '`{% raw %}` blocks balanced'
+  exit 0
+end
+
+warn '✗ lint-liquid-raw: unbalanced Liquid raw blocks'
+problems.each { |p| warn "  #{p}" }
+warn ''
+warn 'To display a literal tag, escape it: `{% raw %}{% raw %}{% endraw %}`'
+exit 1

data/scripts/test/lib/run_tests.sh

@@ -131,7 +131,8 @@ main() {
     source "$TEST_DIR/test_migrate.sh"
     source "$TEST_DIR/test_pixelate_images.sh"
     source "$TEST_DIR/test_content_review.sh"
-    
+    source "$TEST_DIR/test_agent_review_result.sh"
+
     # Summary
     echo -e "\n${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
     echo -e "${BLUE}Test Summary${NC}"

data/scripts/test/lib/test_agent_review_result.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# Bridge for scripts/ci/test_agent_review_result.py (issue #418).
+#
+# The guard that decides whether the Claude content review actually ran lives in
+# scripts/ci/agent_review_result.py, next to the other CI helper
+# (classify_changes.py), and its tests are written in Python beside it. This
+# wrapper is what puts them on the CI path: run_tests.sh sources this file, and
+# ./scripts/bin/test runs run_tests.sh on every PR.
+#
+# scripts/issues/test_verify_close.py is the cautionary example — a real test
+# suite that no runner ever invoked. Do not let this one drift the same way: if
+# the Python tests move, move this line with them.
+
+ARR_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+
+print_suite_header "Claude review guard (scripts/ci/agent_review_result.py)"
+
+if command -v python3 >/dev/null 2>&1; then
+    arr_output="$(python3 "$ARR_ROOT/scripts/ci/test_agent_review_result.py" 2>&1)"
+    arr_status=$?
+    echo "$arr_output"
+    assert_equals "0" "$arr_status" \
+        "scripts/ci/test_agent_review_result.py passes (the #418 401-swallow guard)"
+else
+    echo "python3 not available — skipping the Claude review guard tests"
+fi