@cyanautomation/kaseki-agent 1.4.1

package/tests/doctor-template-parity.test.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+template_dir="$TMP_DIR/source-checkout"
+fake_bin="$TMP_DIR/bin"
+mkdir -p "$template_dir/scripts" "$fake_bin"
+cp "$ROOT_DIR/run-kaseki.sh" "$template_dir/run-kaseki.sh"
+cp "$ROOT_DIR/kaseki-agent.sh" "$template_dir/kaseki-agent.sh"
+cp "$ROOT_DIR/scripts/kaseki-preflight.sh" "$template_dir/scripts/kaseki-preflight.sh"
+chmod +x "$template_dir/run-kaseki.sh" "$template_dir/kaseki-agent.sh" "$template_dir/scripts/kaseki-preflight.sh"
+
+cat > "$fake_bin/docker" <<'DOCKER'
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "${1:-}" = "--version" ]; then
+  printf 'Docker version test\n'
+  exit 0
+fi
+
+if [ "${1:-}" = "image" ] && [ "${2:-}" = "inspect" ]; then
+  exit 0
+fi
+
+if [ "${1:-}" = "run" ]; then
+  shift
+  if [ "${1:-}" = "--rm" ]; then shift; fi
+  if [ "${1:-}" = "--entrypoint" ]; then
+    entrypoint="${2:-}"
+    shift 2
+  else
+    entrypoint=""
+  fi
+  image="${1:-}"
+  shift || true
+  case "$entrypoint" in
+    test)
+      [ "${1:-}" = "-f" ] && [ "${2:-}" = "/app/run-kaseki.sh" ]
+      ;;
+    sha256sum)
+      case "${1:-}" in
+        /usr/local/bin/kaseki-agent)
+          sha256sum "$TEST_TEMPLATE_DIR/kaseki-agent.sh"
+          ;;
+        *)
+          printf '0000000000000000000000000000000000000000000000000000000000000000  %s\n' "${1:-}"
+          ;;
+      esac
+      ;;
+    *)
+      printf 'unexpected docker run entrypoint for %s: %s\n' "$image" "$entrypoint" >&2
+      exit 2
+      ;;
+  esac
+  exit 0
+fi
+
+printf 'unexpected docker invocation: %s\n' "$*" >&2
+exit 2
+DOCKER
+chmod +x "$fake_bin/docker"
+
+set +e
+output="$(
+  cd "$template_dir" && env \
+    PATH="$fake_bin:/usr/bin:/bin" \
+    TEST_TEMPLATE_DIR="$template_dir" \
+    KASEKI_ROOT="$TMP_DIR/root" \
+    KASEKI_LOG_DIR="$TMP_DIR/logs" \
+    OPENROUTER_API_KEY="test-key" \
+    ./run-kaseki.sh --doctor 2>&1
+)"
+status=$?
+set -e
+
+if [ "$status" -eq 0 ]; then
+  printf 'Expected doctor to fail for missing deployed template files\nOutput:\n%s\n' "$output" >&2
+  exit 1
+fi
+
+for expected in \
+  'Image/template parity: missing host file lib/pi-event-filter.js' \
+  'Image/template parity: missing deployed template files; this looks like a source checkout or incomplete template.' \
+  'sudo KASEKI_IMAGE_PULL_POLICY=missing ./scripts/deploy-pi-template.sh' \
+  '/agents/kaseki-template/run-kaseki.sh --doctor'
+do
+  if ! printf '%s\n' "$output" | grep -Fq "$expected"; then
+    printf 'Expected doctor output to contain: %s\nOutput:\n%s\n' "$expected" "$output" >&2
+    exit 1
+  fi
+done

package/tests/github-operations.test.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# Integration tests for github operations printf safety
+# Tests that github operations skip logging doesn't break with variable substitution
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+pass() { printf '✓ %s\n' "$1"; }
+fail() { printf '✗ %s\n' "$1" >&2; exit 1; }
+info() { printf '[info] %s\n' "$1"; }
+
+# Test setup
+mkdir -p "$TMP_DIR/results"
+RESULTS_DIR="$TMP_DIR/results"
+
+# Test 1: printf with dash-containing variable doesn't fail
+info "Test 1: printf with dash-containing skip reasons"
+{
+  GITHUB_SKIP_REASONS=("agent_failed" "-validation_failed" "empty_diff")
+  printf -- 'GitHub operations: skipped (reasons: %s)\n' "$(IFS=,; printf '%s' "${GITHUB_SKIP_REASONS[*]}")" > "$RESULTS_DIR/test1.log"
+} && pass "printf with dash-containing reasons succeeded" || fail "printf with dash-containing reasons failed"
+
+# Verify output contains all reasons
+if grep -q "agent_failed,-validation_failed,empty_diff" "$RESULTS_DIR/test1.log"; then
+  pass "All skip reasons captured in output"
+else
+  fail "Skip reasons not properly captured: $(cat "$RESULTS_DIR/test1.log")"
+fi
+
+# Test 2: printf with multi-argument substitution (github skip diagnostics)
+info "Test 2: Multi-argument printf with exit code variables"
+{
+  PI_EXIT=0
+  VALIDATION_EXIT=1
+  QUALITY_EXIT=0
+  SECRET_SCAN_EXIT=0
+  GITHUB_SKIP_REASONS=("validation_failed")
+  DIFF_NONEMPTY="true"
+  GITHUB_APP_ENABLED="0"
+  
+  printf -- 'GitHub operations: skipped (reasons: %s; agent %s, validation %s, quality %s, secret_scan %s, diff %s, github_enabled %s)\n' \
+    "$(IFS=,; printf '%s' "${GITHUB_SKIP_REASONS[*]}")" \
+    "$([ "$PI_EXIT" -eq 0 ] && printf 'passed' || printf 'failed')" \
+    "$([ "$VALIDATION_EXIT" -eq 0 ] && printf 'passed' || printf 'failed')" \
+    "$([ "$QUALITY_EXIT" -eq 0 ] && printf 'passed' || printf 'failed')" \
+    "$([ "$SECRET_SCAN_EXIT" -eq 0 ] && printf 'passed' || printf 'failed')" \
+    "$DIFF_NONEMPTY" \
+    "$GITHUB_APP_ENABLED" > "$RESULTS_DIR/test2.log"
+} && pass "Multi-argument printf succeeded" || fail "Multi-argument printf failed"
+
+# Verify output contains all placeholders properly filled
+if grep -q "validation_failed; agent passed, validation failed, quality passed, secret_scan passed, diff true, github_enabled 0" "$RESULTS_DIR/test2.log"; then
+  pass "All arguments properly substituted in output"
+else
+  fail "Arguments not properly substituted: $(cat "$RESULTS_DIR/test2.log")"
+fi
+
+# Test 3: printf with edge case: empty array expansion
+info "Test 3: printf with empty skip reasons"
+{
+  GITHUB_SKIP_REASONS=()
+  printf -- 'GitHub operations: skipped (reasons: %s)\n' "$(IFS=,; printf '%s' "${GITHUB_SKIP_REASONS[*]:-none}")" > "$RESULTS_DIR/test3.log"
+} && pass "printf with empty array succeeded" || fail "printf with empty array failed"
+
+if grep -q "reasons: none" "$RESULTS_DIR/test3.log"; then
+  pass "Empty array handled correctly"
+else
+  fail "Empty array not handled correctly: $(cat "$RESULTS_DIR/test3.log")"
+fi
+
+# Test 4: printf with special characters in variable values
+info "Test 4: printf with special characters in REPO_URL"
+{
+  REPO_URL="https://github.com/owner-name/repo-name.git"
+  printf -- 'Cannot parse GitHub repo URL: %s\n' "$REPO_URL" > "$RESULTS_DIR/test4.log"
+} && pass "printf with special chars in URL succeeded" || fail "printf with special chars in URL failed"
+
+if grep -q "owner-name/repo-name" "$RESULTS_DIR/test4.log"; then
+  pass "Special characters preserved in output"
+else
+  fail "Special characters not preserved: $(cat "$RESULTS_DIR/test4.log")"
+fi
+
+# Test 5: printf with feature branch containing instance name
+info "Test 5: printf with feature branch name containing dashes"
+{
+  INSTANCE_NAME="kaseki-9142"
+  feature_branch="kaseki/$INSTANCE_NAME"
+  printf -- 'Creating feature branch: %s\n' "$feature_branch" > "$RESULTS_DIR/test5.log"
+} && pass "printf with dash-containing branch name succeeded" || fail "printf with dash-containing branch name failed"
+
+if grep -q "kaseki/kaseki-9142" "$RESULTS_DIR/test5.log"; then
+  pass "Feature branch name correctly output"
+else
+  fail "Feature branch name not correct: $(cat "$RESULTS_DIR/test5.log")"
+fi
+
+# Test 6: Verify all printf calls have -- separator (source code check)
+info "Test 6: Verify -- separator present in critical printf calls"
+if grep -n "printf -- 'GitHub operations: skipped (reasons:" "$ROOT_DIR/kaseki-agent.sh" > /dev/null; then
+  pass "Primary github operations printf has -- separator"
+else
+  fail "Primary github operations printf missing -- separator"
+fi
+
+if grep -n "printf -- 'GitHub operations: skipped (reasons:.*agent %s" "$ROOT_DIR/kaseki-agent.sh" > /dev/null; then
+  pass "Multi-argument github operations printf has -- separator"
+else
+  fail "Multi-argument github operations printf missing -- separator"
+fi
+
+# Test 7: Integration test - simulate actual function behavior
+info "Test 7: Simulate actual build_github_skip_reasons behavior"
+{
+  # Simulate the skip reasons array logic
+  GITHUB_SKIP_REASONS=()
+  PI_EXIT=1
+  [ "$PI_EXIT" -eq 0 ] || GITHUB_SKIP_REASONS+=("agent_failed")
+  
+  VALIDATION_EXIT=5
+  [ "$VALIDATION_EXIT" -eq 0 ] || GITHUB_SKIP_REASONS+=("validation_failed")
+  
+  # Log the skip reasons safely
+  printf -- 'GitHub operations: skipped (reasons: %s)\n' \
+    "$(IFS=,; printf '%s' "${GITHUB_SKIP_REASONS[*]}")" > "$RESULTS_DIR/test7.log"
+} && pass "Simulated skip reasons logic succeeded" || fail "Simulated skip reasons logic failed"
+
+if grep -q "agent_failed,validation_failed" "$RESULTS_DIR/test7.log"; then
+  pass "Skip reasons correctly accumulated and logged"
+else
+  fail "Skip reasons not correctly accumulated: $(cat "$RESULTS_DIR/test7.log")"
+fi
+
+# Summary
+info "All tests passed!"
+printf '\n==> Summary\n'
+printf 'Tests run: 7\n'
+printf 'Passed: 7\n'
+printf 'Failed: 0\n'

package/tests/npm-install-flags.test.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+# Load only the npm install flag helpers from kaseki-agent.sh.
+eval "$(awk '
+  /^append_npm_install_flags\(\)/ { emit=1 }
+  /^dependency_cache_key\(\)/ { emit=0 }
+  emit { print }
+' "$ROOT_DIR/kaseki-agent.sh")"
+
+fail() { printf '✗ %s\n' "$1" >&2; exit 1; }
+pass() { printf '✓ %s\n' "$1"; }
+
+assert_flags() {
+  local label="$1"
+  local omit_dev="$2"
+  local ignore_scripts="$3"
+  local expected_display="$4"
+  shift 4
+  local -a expected_flags=("$@")
+  local -a install_flags=("stale")
+
+  KASEKI_NPM_OMIT_DEV="$omit_dev"
+  KASEKI_INSTALL_IGNORE_SCRIPTS="$ignore_scripts"
+  append_npm_install_flags install_flags
+
+  if [ "${#install_flags[@]}" -ne "${#expected_flags[@]}" ]; then
+    fail "$label: expected ${#expected_flags[@]} flags, got ${#install_flags[@]}"
+  fi
+
+  local i
+  for i in "${!expected_flags[@]}"; do
+    if [ "${install_flags[$i]}" != "${expected_flags[$i]}" ]; then
+      fail "$label: expected flag $i to be ${expected_flags[$i]}, got ${install_flags[$i]}"
+    fi
+  done
+
+  local display
+  display="$(render_npm_install_flags "${install_flags[@]}")"
+  if [ "$display" != "$expected_display" ]; then
+    fail "$label: expected display '$expected_display', got '$display'"
+  fi
+
+  local -a npm_args=(ci --prefer-offline "${install_flags[@]}")
+  local expected_count=$((2 + ${#expected_flags[@]}))
+  if [ "${#npm_args[@]}" -ne "$expected_count" ]; then
+    fail "$label: npm argument count changed during expansion"
+  fi
+
+  pass "$label"
+}
+
+assert_flags "no optional install flags" 0 0 "none"
+assert_flags "one optional install flag (omit dev)" 1 0 "--omit=dev" "--omit=dev"
+assert_flags "one optional install flag (ignore scripts)" 0 1 "--ignore-scripts" "--ignore-scripts"
+assert_flags "both optional install flags" 1 1 "--omit=dev --ignore-scripts" "--omit=dev" "--ignore-scripts"

package/tests/quality-gates.test.sh

@@ -0,0 +1,178 @@
+#!/usr/bin/env bash
+# Integration tests for quality gate enforcement
+# Tests diff size limits, allowlist validation, and secret scanning
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+# Load quality gate logic from kaseki-agent.sh
+eval "$(awk '
+  /^allowlist_pattern_to_regex\(\)/ { emit=1 }
+  /^compute_repo_memory_key\(\)/ { emit=0 }
+  emit { print }
+' "$ROOT_DIR/scripts/allowlist-helper.sh")"
+
+pass() { printf '✓ %s\n' "$1"; }
+fail() { printf '✗ %s\n' "$1" >&2; exit 1; }
+
+# Create a test results directory structure
+mkdir -p "$TMP_DIR/results"
+mkdir -p "$TMP_DIR/repo"
+
+# Test 1: Diff size exceeds max bytes
+echo "==> Test: Diff size check"
+{
+  cd "$TMP_DIR/repo"
+  git init --initial-branch=main -q
+  git config user.email "test@kaseki.local"
+  git config user.name "Test User"
+  
+  # Create initial commit
+  echo "initial" > file.txt
+  git add file.txt
+  git commit -q -m "initial"
+  
+  # Generate a large diff (exceeds default 200KB)
+  # Create a file with 300KB of data
+  python3 -c "print('x' * 310000)" > large_file.txt
+  git add large_file.txt
+  git diff --cached > "$TMP_DIR/results/git.diff"
+  
+  diff_size="$(wc -c < "$TMP_DIR/results/git.diff" | tr -d ' ')"
+  KASEKI_MAX_DIFF_BYTES=200000
+  
+  if [ "$diff_size" -gt "$KASEKI_MAX_DIFF_BYTES" ]; then
+    pass "Diff size check: detects oversized diff ($diff_size > $KASEKI_MAX_DIFF_BYTES)"
+  else
+    fail "Diff size check: expected diff to exceed $KASEKI_MAX_DIFF_BYTES bytes, got $diff_size"
+  fi
+}
+
+# Test 2: Allowlist validation
+echo "==> Test: Allowlist validation"
+{
+  cd "$TMP_DIR/repo"
+  git diff --name-only > "$TMP_DIR/results/changed-files.txt"
+  
+  # Test matching allowed files
+  KASEKI_CHANGED_FILES_ALLOWLIST="src/**/*.ts tests/**/*.test.ts"
+  allowlist_regex="$(build_allowlist_regex)"
+  
+  # Should match
+  if printf 'src/index.ts\n' | grep -Eq "^(${allowlist_regex})$"; then
+    pass "Allowlist: allows src/index.ts pattern"
+  else
+    fail "Allowlist: should allow src/index.ts"
+  fi
+  
+  # Should not match
+  if printf 'README.md\n' | grep -Eq "^(${allowlist_regex})$"; then
+    fail "Allowlist: should reject README.md"
+  else
+    pass "Allowlist: rejects README.md"
+  fi
+  
+  # Test wildcard patterns
+  if printf 'src/lib/parser.ts\n' | grep -Eq "^(${allowlist_regex})$"; then
+    pass "Allowlist: allows nested src/lib/parser.ts"
+  else
+    fail "Allowlist: should allow src/lib/parser.ts"
+  fi
+}
+
+# Test 3: Secret scanning (pattern detection)
+echo "==> Test: Secret scanning"
+{
+  # Create a file with a fake API key
+  cat > "$TMP_DIR/results/secret-test.txt" <<'EOF'
+This file has an OpenRouter API key: sk-or-aBcDeFgHiJkLmNoPqRsT
+And some normal content
+EOF
+  
+  if grep -E 'sk-or-[A-Za-z0-9_-]{20,}' "$TMP_DIR/results/secret-test.txt" > /dev/null; then
+    pass "Secret scanning: detects sk-or-* pattern"
+  else
+    fail "Secret scanning: should detect sk-or-* pattern"
+  fi
+  
+  # Create a clean file
+  cat > "$TMP_DIR/results/clean-test.txt" <<'EOF'
+This file has no secrets
+Just normal content here
+EOF
+  
+  if ! grep -E 'sk-or-[A-Za-z0-9_-]{20,}' "$TMP_DIR/results/clean-test.txt"; then
+    pass "Secret scanning: clean file passes"
+  else
+    fail "Secret scanning: clean file should pass"
+  fi
+}
+
+# Test 4: Overly broad allowlist patterns
+echo "==> Test: Overly broad allowlist detection"
+{
+  # Test that '*' pattern is too broad
+  KASEKI_CHANGED_FILES_ALLOWLIST="*"
+  allowlist_regex="$(build_allowlist_regex)"
+  
+  # This would match everything, which is bad
+  test_cases=("package.json" "src/index.ts" "tests/foo.test.ts" "README.md" "Dockerfile")
+  all_match=true
+  
+  for file in "${test_cases[@]}"; do
+    if ! printf '%s\n' "$file" | grep -Eq "^(${allowlist_regex})$"; then
+      all_match=false
+      break
+    fi
+  done
+  
+  if [ "$all_match" = true ]; then
+    fail "Overly broad allowlist: '*' pattern matches everything (too permissive)"
+  else
+    pass "Allowlist prevents overly broad '*' patterns"
+  fi
+}
+
+# Test 5: Multiple file allowlist
+echo "==> Test: Multiple file allowlist patterns"
+{
+  KASEKI_CHANGED_FILES_ALLOWLIST="src/lib/parser.ts tests/parser.validation.ts docs/README.md"
+  allowlist_regex="$(build_allowlist_regex)"
+  
+  allowed_files=("src/lib/parser.ts" "tests/parser.validation.ts" "docs/README.md")
+  rejected_files=("src/index.ts" "tests/other.test.ts" "CHANGELOG.md")
+  
+  for file in "${allowed_files[@]}"; do
+    if printf '%s\n' "$file" | grep -Eq "^(${allowlist_regex})$"; then
+      pass "Allowlist: allows $file"
+    else
+      fail "Allowlist: should allow $file"
+    fi
+  done
+  
+  for file in "${rejected_files[@]}"; do
+    if printf '%s\n' "$file" | grep -Eq "^(${allowlist_regex})$"; then
+      fail "Allowlist: should reject $file"
+    else
+      pass "Allowlist: rejects $file"
+    fi
+  done
+}
+
+# Test 6: Empty diff detection
+echo "==> Test: Empty diff handling"
+{
+  : > "$TMP_DIR/results/empty.diff"
+  empty_size="$(wc -c < "$TMP_DIR/results/empty.diff" | tr -d ' ')"
+  
+  if [ "$empty_size" -eq 0 ]; then
+    pass "Empty diff detection: correctly identifies 0-byte diff"
+  else
+    fail "Empty diff detection: expected 0 bytes, got $empty_size"
+  fi
+}
+
+printf '\n✅ All quality gate tests passed\n'

package/tests/repo-memory.test.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+# Load only repository-memory and prompt helpers from kaseki-agent.sh.
+eval "$(awk '
+  /^compute_repo_memory_key\(\)/ { emit=1 }
+  /^run_github_operations\(\)/ { emit=0 }
+  emit { print }
+' "$ROOT_DIR/kaseki-agent.sh")"
+
+emit_event() { :; }
+emit_error_event() { :; }
+
+REPO_URL="https://example.com/acme/widgets.git"
+GIT_REF="main"
+TASK_PROMPT="Fix the widget parser."
+KASEKI_AGENT_GUARDRAILS=1
+KASEKI_REPO_MEMORY_MODE=summary
+KASEKI_REPO_MEMORY_TTL_DAYS=30
+KASEKI_REPO_MEMORY_MAX_BYTES=4096
+KASEKI_DRY_RUN=0
+REPO_MEMORY_KEY=""
+REPO_MEMORY_DIR=""
+REPO_MEMORY_FILE=""
+REPO_MEMORY_STATUS="disabled"
+
+init_repo_memory_paths
+trap 'rm -rf "$TMP_DIR" "$REPO_MEMORY_DIR"' EXIT
+rm -rf "$REPO_MEMORY_DIR"
+mkdir -p "$REPO_MEMORY_DIR"
+cat > "$REPO_MEMORY_FILE" <<'MEMORY'
+# Repository Memory Summary
+
+- Repo URL: https://example.com/acme/widgets.git
+- Default ref: main
+- Commit SHA: abc123
+- Updated at: 2026-05-06T00:00:00Z
+
+## Changed files
+- src/widget.ts
+MEMORY
+
+prompt="$(build_agent_prompt)"
+if ! grep -q 'Prior repository context (opt-in cache' <<< "$prompt"; then
+  printf 'Expected build_agent_prompt to append labeled repository memory.\n' >&2
+  exit 1
+fi
+if ! grep -q 'Commit SHA: abc123' <<< "$prompt"; then
+  printf 'Expected appended memory to include cached metadata.\n' >&2
+  exit 1
+fi
+
+touch -d '45 days ago' "$REPO_MEMORY_FILE"
+expired_prompt="$(build_agent_prompt)"
+if grep -q 'Commit SHA: abc123' <<< "$expired_prompt"; then
+  printf 'Expected expired repository memory to be omitted.\n' >&2
+  exit 1
+fi
+
+mkdir -p /results
+cat > /results/result-summary.md <<'SUMMARY'
+# Kaseki Result: test
+- Status: passed
+- Secret scan: 0
+- Task Prompt: do not persist this
+SUMMARY
+cat > /results/analysis.md <<'ANALYSIS'
+Useful architecture note.
+OPENROUTER_API_KEY=sk-or-should-not-persist
+ANALYSIS
+cat > /results/changed-files.txt <<'FILES'
+src/widget.ts
+tests/widget.test.ts
+FILES
+cat > /results/validation-timings.tsv <<'TIMINGS'
+npm test	0	3
+TIMINGS
+
+STATUS=0
+PI_EXIT=0
+SECRET_SCAN_EXIT=0
+KASEKI_TASK_MODE=patch
+START_ISO="2026-05-06T12:00:00Z"
+VALIDATION_EXIT=0
+QUALITY_EXIT=0
+write_repo_memory_summary
+
+if grep -Eiq 'OPENROUTER|sk-or|Task Prompt|do not persist' "$REPO_MEMORY_FILE"; then
+  printf 'Expected repository memory writer to filter prompts and secrets.\n' >&2
+  exit 1
+fi
+if ! grep -q 'Useful architecture note' "$REPO_MEMORY_FILE"; then
+  printf 'Expected sanitized analysis note to be retained.\n' >&2
+  exit 1
+fi
+if ! grep -q 'npm test: exit 0, 3s' "$REPO_MEMORY_FILE"; then
+  printf 'Expected validation outcome to be summarized.\n' >&2
+  exit 1
+fi

package/tests/restore-disallowed-changes.test.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Tests for allowlist restoration behavior in kaseki-agent.sh.
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+# Load allowlist helper functions used by restore_disallowed_changes().
+# shellcheck source=../scripts/allowlist-helper.sh
+. "$ROOT_DIR/scripts/allowlist-helper.sh"
+
+pass() { printf '✓ %s\n' "$1"; }
+fail() { printf '✗ %s\n' "$1" >&2; exit 1; }
+
+emit_event() {
+  printf '%s' "$1" >> "$TMP_DIR/results/events.log"
+  shift
+  while [ "$#" -gt 0 ]; do
+    printf ' %s' "$1" >> "$TMP_DIR/results/events.log"
+    shift
+  done
+  printf '\n' >> "$TMP_DIR/results/events.log"
+}
+
+collect_git_artifacts() {
+  printf 'collect_git_artifacts should not be called when restored_count=0\n' >&2
+  return 1
+}
+
+# Load restore_disallowed_changes() while redirecting its container-only absolute
+# paths into this test's temporary workspace.
+eval "$(awk '
+  /^restore_disallowed_changes\(\)/ { emit=1 }
+  /^generate_restoration_report\(\)/ { emit=0 }
+  emit { print }
+' "$ROOT_DIR/kaseki-agent.sh" | sed "s#/workspace/repo#$TMP_DIR/repo#g; s#/results#$TMP_DIR/results#g")"
+
+mkdir -p "$TMP_DIR/results" "$TMP_DIR/repo"
+{
+  cd "$TMP_DIR/repo"
+  git init --initial-branch=main -q
+  git config user.email "test@kaseki.local"
+  git config user.name "Test User"
+  printf 'original\n' > allowed.txt
+  git add allowed.txt
+  git commit -q -m "initial"
+  printf 'modified\n' > allowed.txt
+}
+
+printf 'allowed.txt\n' > "$TMP_DIR/results/changed-files.txt"
+: > "$TMP_DIR/results/quality.log"
+: > "$TMP_DIR/results/events.log"
+
+KASEKI_RESTORE_DISALLOWED_CHANGES=1
+KASEKI_CHANGED_FILES_ALLOWLIST='allowed.txt'
+
+restore_disallowed_changes
+
+if grep -Fq '[allowlist summary] Restored: 0 files; Kept: 1 files (coverage: 100%)' "$TMP_DIR/results/quality.log"; then
+  pass 'restore_disallowed_changes summarizes 0 restored / 1 kept with coverage under set -u'
+else
+  fail 'restore_disallowed_changes did not write the expected 0 restored / 1 kept summary'
+fi
+
+if grep -Fq 'allowlist_restoration_complete restored=0 kept=1 coverage=100' "$TMP_DIR/results/events.log"; then
+  pass 'restore_disallowed_changes emits completion event with computed coverage'
+else
+  fail 'restore_disallowed_changes did not emit expected coverage event'
+fi
+
+
+if grep -Fxq 'COPY kaseki-agent.sh /usr/local/bin/kaseki-agent' "$ROOT_DIR/Dockerfile"; then
+  pass 'Docker image installs /usr/local/bin/kaseki-agent directly from repository kaseki-agent.sh'
+else
+  fail 'Dockerfile must copy repository kaseki-agent.sh to /usr/local/bin/kaseki-agent'
+fi
+
+printf '\n✅ restore_disallowed_changes tests passed\n'