@alexcodeplace/slopgate 0.3.1 → 0.3.4

package/README.md

@@ -41,10 +41,10 @@ A global code-quality / anti-slop gate for Claude Code and git. Engine is shared
 ## Install
 
 ```bash
-npm install -g slopgate
+npm install -g @alexcodeplace/slopgate@0.3.4
 ```
 
-The matching prebuilt native engine for your platform (linux / macOS / Windows × x64 / arm64) is pulled in automatically as an optional dependency — no toolchain or build step required.
+The matching prebuilt native engine for your platform is included in the package, and the pinned `ast-grep` runtime needed for structural rules is installed as a package dependency. No Rust toolchain or separate scanner install is required.
 
 Then onboard a project:
 
@@ -90,9 +90,31 @@ slopgate baseline --prune --config .slopgate/config.toml
 
 ### Run self-test (validate the engine against bundled fixtures):
 ```bash
-slopgate --self-test --config "$(npm root -g)/slopgate/rules/baseline/selftest.config.toml"
+slopgate --self-test --config "$(npm root -g)/@alexcodeplace/slopgate/rules/baseline/selftest.config.toml"
 ```
 
+### Run immutable full-repository CI gate:
+```bash
+slopgate scan --scope repo --tier commit --format github --config .slopgate/config.toml
+```
+
+### Record reviewer defects and enforce rule harvesting:
+```bash
+slopgate defect record --class missing-button-type --file src/app.tsx --line 42 --source code-review --config .slopgate/config.toml
+slopgate harvest --check --config .slopgate/config.toml
+```
+
+Second distinct occurrence requires `.slopgate/rules/ast/<class>.yml` plus `.slopgate/fixtures/<class>.invalid.ts[x]` and `<class>.valid.ts[x]`. `--self-test` proves rule fires on configured fixtures.
+
+### Reusable GitHub gate:
+```yaml
+jobs:
+  slopgate:
+    uses: alexcodeplace/slopgate/.github/workflows/slopgate.yml@v1
+```
+
+The reusable workflow defaults to GitHub-hosted `ubuntu-latest`, so fork pull requests run in an isolated disposable runner. If you override `runner-json` to use a persistent self-hosted runner, do not execute untrusted fork code there.
+
 ### Install or reinstall hooks:
 ```bash
 slopgate install-hooks --config .slopgate/config.toml
@@ -343,7 +365,7 @@ skipDirs = ["node_modules", "dist"]      # dirs to skip
 
 # Rule packs
 baseline = ["no-stubs", "ts-suppress", "as-any"]  # built-in baseline packs to enable (opt-in)
-rules = []                               # project regex rule packs — must be [] (PHASE-2, not yet supported)
+rules = ["./rules/project.json"]          # optional project-owned regex packs
 astRules = "./rules/ast"                 # dir of .yml AST rules (optional)
 astDisable = []                          # rule ids to disable (escape hatch)
 
@@ -387,7 +409,7 @@ All are opt-in via the `baseline` array in config. Severity drives the gate thre
 |------|----------|----------|---------|
 | `no-stubs` | critical | convention | Stub / placeholder / "not implemented" / deferred-work markers |
 | `ts-suppress` | high | convention | `@ts-ignore` / `@ts-expect-error` — suppressing tsc instead of fixing the cause |
-| `as-any` | high | convention | `as any` casts that disable type safety |
+| `as-any` | high | convention | `as any`, `: any`, `Array<any>`, `Promise<any>`, `Record<string, any>` escape hatches that disable type safety |
 | `no-narration-comments` | high | convention | Comments that narrate a diff/history/removal (`changed from`, `used to`, `no longer needed`, `track later`) instead of explaining a non-obvious constraint |
 | `raw-hex` | high | convention | Hardcoded hex / `rgb()` colors + raw multi-digit `px` — use design tokens |
 | `sql-safety` | critical | convention | `SELECT … FOR UPDATE` with an aggregate (Postgres rejects this at runtime) |
@@ -405,6 +427,7 @@ Loaded automatically alongside the regex packs (the resolver always adds `rules/
 |---------|---------|
 | `empty-catch` (ts + tsx) | Empty `catch` block silently swallowing an error |
 | `inner-html` | Unsafe `innerHTML` / `dangerouslySetInnerHTML` assignment |
+| `focused-test` | Focused tests committed via `test.only` / `it.only` / `describe.only` / `fit` / `fdescribe` |
 | `target-blank-norel` | `target="_blank"` anchor missing `rel="noopener"` |
 | `window-in-render` | `window`/`document` access during render (SSR hazard) |
 
@@ -418,7 +441,7 @@ Opt-in via `stack = ["cloudflare"]`:
 
 **Planned (v2+):**
 - Depth rules — pass-through-fn, delegating-wrapper (Ousterhout symptoms)
-- Test-slop rules — test-no-assertion, test-skip-only
+- Test-slop rules — test-no-assertion, test-skip
 - Custom project **regex** rule packs (the `rules = [...]` field — see [Project-Owned Rules](#project-owned-rules))
 
 ### Project-Owned Rules
@@ -441,7 +464,7 @@ Point `astRules` at the directory holding them:
 astRules = "./rules/ast"  # auto-loads all .yml files in this dir
 ```
 
-> **Note:** Custom **project regex rule packs** (the `rules = [...]` field) are **not yet supported** by the native engine. `rules` must currently be `[]`; a non-empty value errors with `slopgate: project rule pack "<path>" cannot be loaded by the native TOML resolver (PHASE-2: project rule packs)`. Project regex packs are planned (PHASE-2). For now, use ast-grep YAML for custom rules, or one of the built-in baseline/stack packs.
+Project-owned regex rule packs are supported as JSON files listed in `rules = ["./rules/my-pack.json"]`. Use regex rules for precise line/token patterns and ast-grep YAML for structural code shapes.
 
 ---
 
@@ -449,7 +472,7 @@ astRules = "./rules/ast"  # auto-loads all .yml files in this dir
 
 ### Regex Rules
 
-> **Note:** Authoring *custom project* regex rule packs is **not yet supported** by the native engine (PHASE-2 — see [Project-Owned Rules](#project-owned-rules)). The shape below describes how the **built-in** regex packs are defined (compiled into the engine); it is reference, not a workflow you can wire in via `rules` today. Use ast-grep YAML for custom rules.
+Custom project regex packs use the same keyed JSON shape as the built-in packs and are loaded from paths listed in `rules = [...]` in `.slopgate/config.toml`.
 
 Patterns are regex strings with flags (i, m, s, etc.). A pattern matches any line containing the regex.
 
@@ -701,12 +724,10 @@ Tool crash / timeout → `⚠ skipped: <id> (<reason>)` warning, gate continues
 
 - **Git-only** — no other VCS support
 - **No auto-fix** — violations are reported, not automatically corrected
-- **No CI integration yet** — hooks are local and Claude Code only; CI layer is future work
-- **`slopgate audit` command** — planned for v2 (non-gating architecture-health report: hotspots, module shape, co-change coupling, ratchet progress tracking)
+- **`slopgate audit` is advisory** — it reports architecture/ratchet health but does not gate commits
 - **Embeddings-based semantic duplicate detection** — planned, not in v1
 - **API-surface diff gate** — track breaking changes to public exports (future)
 - **LLM-judge skill** — on-demand deep review of architectural debt (separate sub-project)
-- **Rule harvesting** — auto-generate rules from repeated violations (separate sub-project)
 
 ---
 

package/bin/slopgate

@@ -11,21 +11,67 @@
 //   2. <pkg>/vendor/<platform>-<arch>/slopgate-rs     (bundled prebuilt; npm-install path)
 //   3. <pkg>/target/release/slopgate-rs               (cargo build --release; dev)
 import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, realpathSync, readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
+import os from 'node:os';
+
+// Re-entry guard: if a resolution bug ever routes the engine back to this shim,
+// fail closed instead of forking forever (a self-pointing $SLOPGATE_BIN froze a
+// workstation with an unbounded nice -10 spawn chain).
+if (process.env.SLOPGATE_SHIM_ACTIVE === '1') {
+  process.stderr.write(
+    'slopgate: recursive shim invocation detected (SLOPGATE_BIN points back at the slopgate launcher?) — aborting.\n',
+  );
+  process.exit(1);
+}
+process.env.SLOPGATE_SHIM_ACTIVE = '1';
+
+// Git hooks inherit the caller's nice; never let the gate outrank the desktop.
+try {
+  if (os.getPriority() < 0) os.setPriority(0);
+} catch {}
+
+const selfPath = fileURLToPath(import.meta.url);
+const pkgRoot = join(dirname(selfPath), '..');
+
+// Report the public package version, not the Rust engine's internal crate version.
+if (process.argv.length === 3 && ['--version', '-V'].includes(process.argv[2])) {
+  try {
+    const { version } = JSON.parse(readFileSync(join(pkgRoot, 'package.json'), 'utf8'));
+    process.stdout.write(`slopgate ${version}\n`);
+    process.exit(0);
+  } catch (error) {
+    process.stderr.write(`slopgate: failed to read package version: ${error.message}\n`);
+    process.exit(1);
+  }
+}
+
+// Runtime dependencies such as ast-grep live inside this npm package. Make
+// their bins visible to the native engine even when slopgate is installed
+// globally and the target project has no node_modules of its own.
+const depBin = join(pkgRoot, 'node_modules', '.bin');
+const pathKey = Object.keys(process.env).find((key) => key.toLowerCase() === 'path') || 'PATH';
+process.env[pathKey] = process.env[pathKey] ? `${depBin}${process.platform === 'win32' ? ';' : ':'}${process.env[pathKey]}` : depBin;
 
-const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
 const binName = process.platform === 'win32' ? 'slopgate-rs.exe' : 'slopgate-rs';
 const host = `${process.platform}-${process.arch}`;
 
+const isSelf = (p) => {
+  try {
+    return realpathSync(p) === realpathSync(selfPath);
+  } catch {
+    return false;
+  }
+};
+
 const candidates = [
   process.env.SLOPGATE_BIN,
   join(pkgRoot, 'vendor', host, binName),
   join(pkgRoot, 'target', 'release', binName),
 ].filter(Boolean);
 
-const bin = candidates.find((p) => existsSync(p));
+const bin = candidates.find((p) => existsSync(p) && !isSelf(p));
 if (!bin) {
   process.stderr.write(
     `slopgate: native engine binary not found for ${host}.\n` +

package/hooks/baseline-guard.mjs

@@ -0,0 +1,88 @@
+// Slopgate baseline-guard — PreToolUse hook blocking agent bypass of the gate.
+// Covers: Edit/Write to baseline.json/suppressions.json, Bash rm/mv on baseline*,
+// Bash `slopgate baseline` in any form.
+// Exit 2 = block the tool use (PreToolUse protocol). Exit 0 = allow. Always fail-open on errors.
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+
+const BASELINE_FILE = /\.slopgate\/(baseline|suppressions)\.json$/;
+const BASELINE_CMD =
+  /(^|[;&|\s])(npx\s+|pnpm\s+exec\s+|yarn\s+)?(node\s+[^ ]+\/bin\/slopgate|slopgate)\s+baseline(\s|$)/;
+const BASELINE_RM = /(rm|mv)\s+.*\.slopgate\/baseline/;
+
+function payload() {
+  try {
+    return JSON.parse(fs.readFileSync(0, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+function verdict(input) {
+  const toolInput = input.tool_input || {};
+  switch (input.tool_name) {
+    case "Edit":
+    case "Write": {
+      const filePath = String(toolInput.file_path || "");
+      if (BASELINE_FILE.test(filePath)) {
+        return `direct write to ${filePath} blocked — edit baseline/suppressions via slopgate CLI only`;
+      }
+      return null;
+    }
+    case "Bash": {
+      const command = String(toolInput.command || "");
+      if (BASELINE_RM.test(command)) {
+        return "rm/mv of .slopgate/baseline blocked — baseline integrity guard";
+      }
+      if (BASELINE_CMD.test(command)) {
+        return "slopgate baseline blocked — agent cannot update/create baseline; run in your own terminal";
+      }
+      return null;
+    }
+    default:
+      return null;
+  }
+}
+
+function recordBypassAttempt(reason) {
+  let root;
+  try {
+    root = execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    root = process.cwd();
+  }
+  try {
+    const key = crypto.createHash("sha256").update(root).digest("hex").slice(0, 16);
+    const sess = JSON.parse(fs.readFileSync(path.join(os.homedir(), ".slopgate", "sessions", `${key}.json`), "utf8"));
+    const row = JSON.stringify({
+      ts: new Date().toISOString(),
+      project: path.basename(root),
+      projectPath: root,
+      model: sess.model || "unknown",
+      sessionId: sess.sessionId || null,
+      mode: "bypass-attempt",
+      ruleId: "baseline-tamper",
+      severity: "critical",
+      category: "security",
+      engine: "bypass-attempt",
+      file: null,
+      line: null,
+      reason
+    });
+    fs.appendFileSync(path.join(os.homedir(), ".slopgate", "stats.jsonl"), `${row}\n`);
+  } catch {
+    // fail-open: the deny still stands even when stats cannot be written
+  }
+}
+
+const reason = verdict(payload());
+if (reason) {
+  fs.writeSync(2, `⛔ SLOPGATE GUARD: ${reason}\n`);
+  recordBypassAttempt(reason);
+  process.exit(2);
+}
+process.exit(0);

package/hooks/baseline-guard.sh

@@ -1,60 +1,15 @@
 #!/usr/bin/env bash
-# Slopgate baseline-guard — PreToolUse hook blocking agent bypass of the gate.
-# Covers: Edit/Write to baseline.json/suppressions.json, Bash rm/mv on baseline*,
-# Bash `slopgate baseline` in any form.
-# Exit 2 = block the tool use (PreToolUse protocol). Exit 0 = allow. Always fail-open on errors.
-
-set -euo pipefail
-INPUT=$(cat)
-
-tool_name=$(node -e "try{const j=JSON.parse(process.argv[1]);process.stdout.write(j.tool_name||'')}catch{}" "$INPUT" 2>/dev/null || echo '')
-tool_input=$(node -e "try{const j=JSON.parse(process.argv[1]);process.stdout.write(JSON.stringify(j.tool_input||{}))}catch{}" "$INPUT" 2>/dev/null || echo '{}')
-
-blocked=0
-reason=''
-
-case "$tool_name" in
-  Edit|Write)
-    file_path=$(node -e "try{const j=JSON.parse(process.argv[1]);process.stdout.write(j.file_path||'')}catch{}" "$tool_input" 2>/dev/null || echo '')
-    if echo "$file_path" | grep -qE '\.slopgate/(baseline|suppressions)\.json$'; then
-      blocked=1
-      reason="direct write to $file_path blocked — edit baseline/suppressions via slopgate CLI only"
-    fi
-    ;;
-  Bash)
-    cmd=$(node -e "try{const j=JSON.parse(process.argv[1]);process.stdout.write(j.command||'')}catch{}" "$tool_input" 2>/dev/null || echo '')
-    # Block: slopgate baseline (create or --update)
-    if echo "$cmd" | grep -qE '(^|[;&|[:space:]])(npx[[:space:]]+|pnpm[[:space:]]+exec[[:space:]]+|yarn[[:space:]]+)?(node[[:space:]]+[^ ]+/bin/slopgate|slopgate)[[:space:]]+baseline([[:space:]]|$)'; then
-      blocked=1
-      reason="slopgate baseline blocked — agent cannot update/create baseline; run in your own terminal"
-    fi
-    # Block: rm/mv targeting .slopgate/baseline*
-    if echo "$cmd" | grep -qE '(rm|mv)\s+.*\.slopgate/baseline'; then
-      blocked=1
-      reason="rm/mv of .slopgate/baseline blocked — baseline integrity guard"
-    fi
-    ;;
+# Fast-path launcher: every trigger pattern in baseline-guard.mjs requires the literal
+# "slopgate" somewhere in the payload (.slopgate/ paths, `slopgate baseline` commands).
+# The common call carries no such substring, so a pure-bash check answers it without a
+# runtime start (measured: ~67ms runtime boot -> ~5ms). Payload with the literal falls
+# through to the real guard, verdict semantics unchanged.
+payload=""; IFS= read -rd '' payload || true
+case "$payload" in
+  *slopgate*) ;;
+  *) exit 0 ;;
 esac
-
-if [ "$blocked" -eq 1 ]; then
-  echo "⛔ SLOPGATE GUARD: $reason" >&2
-  # Write bypass-attempt stats row (fail-open)
-  ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-  node -e "
-const crypto=require('crypto'),fs=require('fs'),path=require('path'),os=require('os');
-const root=process.argv[1], reason=process.argv[2];
-try {
-  const key=crypto.createHash('sha256').update(root).digest('hex').slice(0,16);
-  const sess=JSON.parse(fs.readFileSync(path.join(os.homedir(),'.slopgate','sessions',key+'.json'),'utf8'));
-  const row=JSON.stringify({ts:new Date().toISOString(),project:path.basename(root),projectPath:root,
-    model:sess.model||'unknown',sessionId:sess.sessionId||null,mode:'bypass-attempt',
-    ruleId:'baseline-tamper',severity:'critical',category:'security',engine:'bypass-attempt',
-    file:null,line:null,reason});
-  const gp=path.join(os.homedir(),'.slopgate','stats.jsonl');
-  fs.appendFileSync(gp,row+'\n');
-} catch { /* fail-open */ }
-" "$ROOT" "$reason" 2>/dev/null || true
-  exit 2
-fi
-
-exit 0
+HERE="${BASH_SOURCE[0]%/*}"
+. "$HERE/runtime.sh"
+RUNTIME="$(slopgate_runtime_or_warn baseline-guard)" || exit 0
+printf '%s' "$payload" | "$RUNTIME" "$HERE/baseline-guard.mjs"

package/hooks/commit-hook.sh

@@ -1,12 +1,17 @@
 #!/usr/bin/env bash
 # Slopgate PreToolUse hook — runs --staged before a git commit. Exit 1 → commit blocked.
 TOOL_JSON=$(cat)
-CMD=$(node -e "
+# Cheap raw prefilter: a git commit always carries the substring "commit" in the payload,
+# so skip the interpreter spawn on every non-commit Bash call.
+printf '%s' "$TOOL_JSON" | grep -q 'commit' || exit 0
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+. "$HERE/runtime.sh"
+RUNTIME="$(slopgate_runtime_or_warn commit-hook)" || exit 0
+CMD=$("$RUNTIME" -e "
 let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{process.stdout.write(JSON.parse(d).tool_input?.command||'')}catch{process.stdout.write('')}});" <<< "$TOOL_JSON" 2>/dev/null)
 echo "$CMD" | grep -qE 'git[[:space:]]+commit' || exit 0
 
 ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
 CONFIG="$ROOT/.slopgate/config.toml"
 [ -f "$CONFIG" ] || exit 0
-HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-exec node "$HERE/../bin/slopgate" --staged --config "$CONFIG"
+exec "$RUNTIME" "$HERE/../bin/slopgate" --staged --config "$CONFIG"

package/hooks/edit-hook.sh

@@ -1,8 +1,11 @@
 #!/usr/bin/env bash
 # Slopgate PostToolUse hook — single-file scan after Edit/Write.
 # Exit 2 → stderr feeds back into the agent turn. FAIL-OPEN: any error/timeout → exit 0.
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+. "$HERE/runtime.sh"
+RUNTIME="$(slopgate_runtime_or_warn edit-hook)" || exit 0
 TOOL_JSON=$(cat)
-FILE=$(node -e "
+FILE=$("$RUNTIME" -e "
 let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{process.stdout.write(JSON.parse(d).tool_input?.file_path||'')}catch{process.stdout.write('')}});" <<< "$TOOL_JSON" 2>/dev/null) || exit 0
 [ -n "$FILE" ] || exit 0
 case "$FILE" in *.test.ts|*.test.tsx) exit 0 ;; *.ts|*.tsx|*.astro) ;; *) exit 0 ;; esac
@@ -13,7 +16,6 @@ ROOT=$(git -C "$(dirname "$FILE")" rev-parse --show-toplevel 2>/dev/null) || exi
 CONFIG="$ROOT/.slopgate/config.toml"
 [ -f "$CONFIG" ] || exit 0
 
-HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-OUT=$(timeout 5 node "$HERE/../bin/slopgate" --file "$FILE" --config "$CONFIG" 2>&1)
+OUT=$(timeout 5 "$RUNTIME" "$HERE/../bin/slopgate" --file "$FILE" --config "$CONFIG" 2>&1)
 [ "$?" -eq 1 ] && { echo "$OUT" >&2; exit 2; }
 exit 0

package/hooks/runtime.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Resolves the JS runtime the hooks exec. /usr/bin/bun is the workstation's real binary and
+# is tried first so the hot hooks skip the PATH bun wrapper; a host without it (buildboxes)
+# reaches bun or node through PATH, and every hook payload runs on either. A candidate must
+# be named bun or node: a runtime pointed back at a hook would re-enter it on every exec.
+# SLOPGATE_RUNTIME pins one explicitly; SLOPGATE_SYSTEM_RUNTIME overrides the absolute
+# fast-path candidate (set empty to force PATH resolution).
+slopgate_runtime() { # -> path to bun or node on stdout, 1 when neither resolves
+  local c
+  for c in "${SLOPGATE_RUNTIME:-}" "${SLOPGATE_SYSTEM_RUNTIME-/usr/bin/bun}"; do
+    case "${c##*/}" in bun | node) ;; *) continue ;; esac
+    [ -x "$c" ] || continue
+    printf '%s\n' "$c"
+    return 0
+  done
+  c="$(command -v bun || command -v node)" || return 1
+  [ -n "$c" ] || return 1
+  printf '%s\n' "$c"
+}
+
+slopgate_runtime_or_warn() { # hook-name -> runtime on stdout; warns once, never blocks
+  local rt
+  rt="$(slopgate_runtime)" || {
+    echo "slopgate $1: no bun or node on this host — hook did nothing" >&2
+    return 1
+  }
+  printf '%s\n' "$rt"
+}

package/hooks/session-start.sh

@@ -2,8 +2,10 @@
 # Slopgate SessionStart hook — capture the session-start model for stats attribution.
 # Only SessionStart receives a `model` field; mid-session /model switches are invisible.
 # Fail-open: any error leaves no file -> stats resolves model to 'unknown'.
+. "${BASH_SOURCE[0]%/*}/runtime.sh"
+RUNTIME="$(slopgate_runtime_or_warn session-start)" || exit 0
 ROOT=$(realpath "$(git rev-parse --show-toplevel 2>/dev/null || pwd)" 2>/dev/null || git rev-parse --show-toplevel 2>/dev/null || pwd)
-exec node -e '
+exec "$RUNTIME" -e '
 const crypto = require("crypto"), fs = require("fs"), path = require("path"), os = require("os");
 const root = process.argv[1];
 let d = "";

package/hooks/test-hooks-decisions.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# Decision regression tests for the agent-facing hooks (baseline-guard, commit-hook,
+# session-start). Guards the block/allow contract across interpreter changes.
+# HOME is sandboxed so stats/session writes never touch the real ~/.slopgate.
+# Run: bash hooks/test-hooks-decisions.sh   (exit 0 = all pass)
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SANDBOX="$(mktemp -d)"
+trap 'rm -rf "$SANDBOX"' EXIT
+export HOME="$SANDBOX"
+
+pass=0; fail=0
+chk(){ # script  expected_rc  label  payload
+  printf '%s' "$4" | bash "$HERE/$1" >/dev/null 2>&1
+  local rc=$?
+  if [ "$rc" -eq "$2" ]; then echo "PASS ($rc) $3"; pass=$((pass+1))
+  else echo "FAIL (got $rc want $2) $3"; fail=$((fail+1)); fi
+}
+
+echo "== baseline-guard (2=block, 0=allow) =="
+chk baseline-guard.sh 2 "Edit baseline.json blocked"     '{"tool_name":"Edit","tool_input":{"file_path":"/x/.slopgate/baseline.json"}}'
+chk baseline-guard.sh 2 "Edit suppressions.json blocked" '{"tool_name":"Edit","tool_input":{"file_path":"/x/.slopgate/suppressions.json"}}'
+chk baseline-guard.sh 0 "Edit normal file allowed"       '{"tool_name":"Edit","tool_input":{"file_path":"/x/src/app.ts"}}'
+chk baseline-guard.sh 2 "Bash slopgate baseline blocked" '{"tool_name":"Bash","tool_input":{"command":"slopgate baseline --update"}}'
+BJSON=".slopgate/baseline.json"
+chk baseline-guard.sh 2 "Bash rm baseline blocked"       "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"rm $BJSON\"}}"
+chk baseline-guard.sh 0 "Bash benign allowed"            '{"tool_name":"Bash","tool_input":{"command":"ls -la"}}'
+BCMD="slopgate ""baseline"
+chk baseline-guard.sh 2 "Write baseline.json blocked"    '{"tool_name":"Write","tool_input":{"file_path":"/x/.slopgate/baseline.json"}}'
+chk baseline-guard.sh 2 "Bash npx wrapper blocked"       "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"npx $BCMD\"}}"
+chk baseline-guard.sh 2 "Bash node bin wrapper blocked"  "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"node ./dist/bin/$BCMD --update\"}}"
+chk baseline-guard.sh 2 "Bash mv baseline blocked"       "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"mv $BJSON /tmp/x\"}}"
+chk baseline-guard.sh 0 "Read is not gated"              '{"tool_name":"Read","tool_input":{"file_path":"/x/.slopgate/baseline.json"}}'
+chk baseline-guard.sh 0 "empty payload allowed"          ''
+
+# A block must still emit the operator-facing reason and the bypass-attempt stats row.
+mkdir -p "$SANDBOX/.slopgate/sessions"
+skey=$(printf '%s' "$PWD" | sha256sum | cut -c1-16)
+printf '{"model":"opus","sessionId":"s1"}' > "$SANDBOX/.slopgate/sessions/$skey.json"
+blk_err=$(printf '%s' '{"tool_name":"Edit","tool_input":{"file_path":"/x/.slopgate/baseline.json"}}' | bash "$HERE/baseline-guard.sh" 2>&1 >/dev/null)
+if [[ "$blk_err" == *"SLOPGATE GUARD"* ]]; then echo "PASS (0) block prints the guard reason"; pass=$((pass+1));
+else echo "FAIL block prints the guard reason: $blk_err"; fail=$((fail+1)); fi
+if grep -q '"ruleId":"baseline-tamper"' "$SANDBOX/.slopgate/stats.jsonl" 2>/dev/null; then
+  echo "PASS (0) block records a bypass-attempt stats row"; pass=$((pass+1));
+else echo "FAIL block records a bypass-attempt stats row"; fail=$((fail+1)); fi
+
+echo "== commit-hook (0=allow/skip; no .slopgate config in sandbox HOME) =="
+chk commit-hook.sh 0 "non-commit Bash fast-skips"        '{"tool_name":"Bash","tool_input":{"command":"ls -la"}}'
+
+echo "== session-start (0, records model, no crash) =="
+chk session-start.sh 0 "session-start records model"     '{"model":"opus","session_id":"s1","cwd":"'"$PWD"'"}'
+
+echo "== runtime resolution (a host without /usr/bin/bun still runs every hook) =="
+node_bin="$(command -v node)"
+if [ -n "$node_bin" ]; then
+  export SLOPGATE_RUNTIME="$node_bin"
+  chk baseline-guard.sh 2 "node runtime blocks baseline edit" \
+    '{"tool_name":"Edit","tool_input":{"file_path":"/x/.slopgate/baseline.json"}}'
+  chk session-start.sh 0 "node runtime records model" \
+    '{"model":"opus","session_id":"s1","cwd":"'"$PWD"'"}'
+  unset SLOPGATE_RUNTIME
+else
+  echo "FAIL no node on PATH to prove runtime independence"; fail=$((fail+1))
+fi
+
+# The hooks name no interpreter by absolute path: one that a box does not have makes every
+# gate exit 0 without a word, which is indistinguishable from a clean scan.
+hardcoded=$(grep -l '/usr/bin/\(bun\|node\)' "$HERE"/baseline-guard.sh "$HERE"/commit-hook.sh \
+  "$HERE"/edit-hook.sh "$HERE"/session-start.sh 2>/dev/null)
+if [ -z "$hardcoded" ]; then echo "PASS (0) no hook hardcodes an interpreter path"; pass=$((pass+1));
+else echo "FAIL hooks hardcode an interpreter path: $hardcoded"; fail=$((fail+1)); fi
+
+warn=$(printf '%s' '{"tool_name":"Edit","tool_input":{"file_path":"/x/.slopgate/baseline.json"}}' \
+  | env -i HOME="$SANDBOX" PATH=/nonexistent SLOPGATE_SYSTEM_RUNTIME= \
+    /bin/bash "$HERE/baseline-guard.sh" 2>&1 >/dev/null)
+rc=$?
+if [ "$rc" -eq 0 ] && [[ "$warn" == *"no bun or node on this host"* ]]; then
+  echo "PASS (0) missing runtime says so on stderr"; pass=$((pass+1));
+else echo "FAIL missing runtime is silent (rc=$rc): $warn"; fail=$((fail+1)); fi
+
+if (. "$HERE/runtime.sh"; SLOPGATE_RUNTIME="$HERE/baseline-guard.sh" \
+    SLOPGATE_SYSTEM_RUNTIME= PATH=/nonexistent slopgate_runtime >/dev/null 2>&1); then
+  echo "FAIL a hook path is accepted as the runtime"; fail=$((fail+1));
+else echo "PASS (0) a hook path is rejected as the runtime"; pass=$((pass+1)); fi
+
+# Claude Code hands hooks a SOCKET stdin; open("/dev/stdin") on a socket fails ENXIO,
+# so the payload read must consume fd 0 directly (read builtin), never reopen the path.
+sock_err=$(python3 - "$HERE/baseline-guard.sh" <<'PYEOF' 2>&1
+import socket, subprocess, sys
+a, b = socket.socketpair()
+b.send(b'{"tool_name":"Edit","tool_input":{"file_path":"/x/.slopgate/baseline.json"}}')
+b.shutdown(socket.SHUT_WR)
+r = subprocess.run(["bash", sys.argv[1]], stdin=a.fileno(), capture_output=True, text=True, timeout=30)
+sys.stderr.write(r.stderr)
+sys.exit(0 if (r.returncode == 2 and "/dev/stdin" not in r.stderr) else 1)
+PYEOF
+)
+if [ $? -eq 0 ]; then echo "PASS (0) socket stdin still blocks baseline edit"; pass=$((pass+1));
+else echo "FAIL socket stdin: $sock_err"; fail=$((fail+1)); fi
+
+echo "---- pass=$pass fail=$fail ----"
+[ "$fail" -eq 0 ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alexcodeplace/slopgate",
-  "version": "0.3.1",
+  "version": "0.3.4",
   "type": "module",
   "description": "Global code-quality / anti-slop gate — engine shared, rules per-project.",
   "license": "MIT",
@@ -30,5 +30,8 @@
   "scripts": {
     "self-test": "node bin/slopgate --self-test --config rules/baseline/selftest.config.toml",
     "test": "cargo test --workspace"
+  },
+  "dependencies": {
+    "@ast-grep/cli": "0.45.3"
   }
 }

package/rules/baseline/ast/focused-test-only-ts.yml

@@ -0,0 +1,10 @@
+id: focused-test-only-ts
+language: typescript
+severity: error
+message: Focused test committed
+note: '{"severity":"critical","category":"test","resolution":"Remove .only before committing so the full test suite runs."}'
+rule:
+  any:
+    - pattern: test.only($$$)
+    - pattern: it.only($$$)
+    - pattern: describe.only($$$)

package/rules/baseline/ast/focused-test-only-tsx.yml

@@ -0,0 +1,10 @@
+id: focused-test-only-tsx
+language: tsx
+severity: error
+message: Focused test committed
+note: '{"severity":"critical","category":"test","resolution":"Remove .only before committing so the full test suite runs."}'
+rule:
+  any:
+    - pattern: test.only($$$)
+    - pattern: it.only($$$)
+    - pattern: describe.only($$$)

package/rules/baseline/ast/focused-test-shorthand-ts.yml

@@ -0,0 +1,15 @@
+id: focused-test-shorthand-ts
+language: typescript
+severity: error
+message: Focused test helper committed
+note: '{"severity":"critical","category":"test","resolution":"Replace fit/fdescribe with test/it/describe before committing so the full test suite runs."}'
+files:
+  - '**/*.test.ts'
+  - '**/*.spec.ts'
+  - '**/__tests__/**/*.ts'
+  - '**/tests/**/*.ts'
+  - '**/fixtures/**/*.ts'
+rule:
+  any:
+    - pattern: fit($$$)
+    - pattern: fdescribe($$$)

package/rules/baseline/ast/focused-test-shorthand-tsx.yml

@@ -0,0 +1,15 @@
+id: focused-test-shorthand-tsx
+language: tsx
+severity: error
+message: Focused test helper committed
+note: '{"severity":"critical","category":"test","resolution":"Replace fit/fdescribe with test/it/describe before committing so the full test suite runs."}'
+files:
+  - '**/*.test.tsx'
+  - '**/*.spec.tsx'
+  - '**/__tests__/**/*.tsx'
+  - '**/tests/**/*.tsx'
+  - '**/fixtures/**/*.tsx'
+rule:
+  any:
+    - pattern: fit($$$)
+    - pattern: fdescribe($$$)

package/rules/baseline/ast/inner-html.yml

@@ -1,12 +1,15 @@
 id: inner-html-assignment
 language: tsx
 severity: error
-message: innerHTML / insertAdjacentHTML assignment — XSS surface
+message: innerHTML / insertAdjacentHTML / dangerouslySetInnerHTML — XSS surface
 note: '{"severity":"high","category":"security","resolution":"Build DOM via safe APIs or sanitize with isomorphic-dompurify."}'
 rule:
   any:
     - pattern: $X.innerHTML = $$$
     - pattern: $X.insertAdjacentHTML($$$)
+    - all:
+        - kind: jsx_attribute
+        - regex: '^dangerouslySetInnerHTML='
 ignores:
   - '**/*.test.ts'
   - '**/*.test.tsx'

package/rules/baseline/fixtures/checker-outputs/actionlint.expected.json

@@ -0,0 +1,9 @@
+[
+  {
+    "file": ".github/workflows/ci.yml",
+    "line": 21,
+    "column": 20,
+    "kind": "expression",
+    "message": "property \"platform\" is not defined in object type {os: string}"
+  }
+]

package/rules/baseline/fixtures/checker-outputs/actionlint.json

@@ -0,0 +1,11 @@
+[
+  {
+    "message": "property \"platform\" is not defined in object type {os: string}",
+    "snippet": "          key: ${{ matrix.platform }}",
+    "kind": "expression",
+    "filepath": ".github/workflows/ci.yml",
+    "line": 21,
+    "column": 20,
+    "end_column": 35
+  }
+]

package/rules/baseline/fixtures/checker-outputs/shellcheck.expected.json

@@ -0,0 +1,16 @@
+[
+  {
+    "file": "scripts/deploy.sh",
+    "line": 7,
+    "code": "SC2086",
+    "level": "warning",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "hooks/commit-hook.sh",
+    "line": 2,
+    "code": "SC2148",
+    "level": "style",
+    "message": "Tips depend on target shell and yours is unknown."
+  }
+]

package/rules/baseline/fixtures/checker-outputs/shellcheck.json

@@ -0,0 +1,18 @@
+[
+  {
+    "file": "scripts/deploy.sh",
+    "line": 7,
+    "column": 9,
+    "level": "warning",
+    "code": 2086,
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "hooks/commit-hook.sh",
+    "line": 2,
+    "column": 1,
+    "level": "style",
+    "code": "SC2148",
+    "message": "Tips depend on target shell and yours is unknown."
+  }
+]

package/rules/baseline/fixtures/checker-outputs/typos.expected.json

@@ -0,0 +1,14 @@
+[
+  {
+    "file": "./src/lib.rs",
+    "line": 3,
+    "typo": "retrive",
+    "corrections": ["retrieve"]
+  },
+  {
+    "file": "docs/guide.md",
+    "line": 9,
+    "typo": "succesfully",
+    "corrections": ["successfully"]
+  }
+]

package/rules/baseline/fixtures/checker-outputs/typos.jsonl

@@ -0,0 +1,3 @@
+{"type":"typo","path":"./src/lib.rs","line_num":3,"byte_offset":8,"typo":"retrive","corrections":["retrieve"]}
+{"type":"binary-file","path":"assets/logo.png"}
+{"type":"typo","path":"docs/guide.md","line_num":9,"byte_offset":4,"typo":"succesfully","corrections":["successfully"]}

package/rules/baseline/fixtures/src/canary.tsx

@@ -13,6 +13,12 @@ const namePlaceholder = 1;
 /* eslint-disable zync/no-raw-html-in-pages */
 // changed from foo to bar
 function bad(el: HTMLElement) { el.innerHTML = '<b>hi</b>'; }
+const _dangerous = <div dangerouslySetInnerHTML={{ __html: html }} />;
+const _safeAttrName = { dangerouslySetInnerHTML: html };
+describe.only('focused suite canary', () => {});
+fdescribe('focused suite shorthand canary', () => {});
+describe('regular suite negative canary', () => {});
+// describe.only('commented focused suite negative canary', () => {});
 // live-secrets canary:
 const _sk = "sk_live_aaaaaaaaaaaa";
 // eval-ban canary:

package/rules/baseline/fixtures/src/focused-test.ts

@@ -0,0 +1,11 @@
+// Focused-test AST canaries.
+test.only('focused test canary', () => {});
+it.only('focused spec canary', () => {});
+fit('focused shorthand canary', () => {});
+
+// Negative canaries: regular tests and comments should not match.
+test('regular test', () => {});
+it('regular spec', () => {});
+describe('regular suite', () => {});
+// test.only('commented focused test', () => {});
+// fit('commented focused shorthand', () => {});