@devrik-tools/claude-gates 0.1.2 → 0.2.0

package/plugins/gates/hooks/gates/intent-flow/test.mjs

@@ -1,136 +1,165 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'intent-flow-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function delegate(prompt, extra = {}) {
-  return { tool_name: 'Agent', tool_input: { prompt, ...extra } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLED = {
-  config: { gates: { requireScopeListBeforeDelegating: true } },
-};
-
-test('denies implementing a payment change with real intent and no scope list', () => {
-  const result = runGate(
-    delegate(
-      'Implementa el cobro del pago con la nueva pasarela de dinero para el checkout.',
-    ),
-    ENABLED,
-  );
-  assert.ok(isDeny(result));
-});
-
-test('allows the same request once IN SCOPE / OUT OF SCOPE / EDGE CASES are declared', () => {
-  const prompt = [
-    'Implementa el cobro del pago con la nueva pasarela de dinero para el checkout.',
-    '',
-    'QUE SI (alcance): integrar el nuevo proveedor de pago en el checkout.',
-    'QUE NO (fuera de alcance): no tocar el flujo de reembolsos.',
-    'EDGE CASES: no aplican casos borde adicionales.',
-  ].join('\n');
-  assert.equal(runGate(delegate(prompt), ENABLED), null);
-});
-
-test('denies hard when a high-impact request declares an unresolved unknown', () => {
-  const prompt = [
-    'Implementa el cobro del pago con la nueva pasarela; todavia no esta claro que hacer con reembolsos parciales, unknown.',
-    'QUE SI: cobro basico. QUE NO: reembolsos. EDGE CASES: ninguno.',
-  ].join('\n');
-  assert.ok(isDeny(runGate(delegate(prompt), ENABLED)));
-});
-
-test('allows a request mentioning payment only as documentation topic', () => {
-  assert.equal(
-    runGate(
-      delegate(
-        'Crea un documento README.md que explique como funciona el pago y la autenticacion del sistema para el equipo nuevo.',
-      ),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('allows a normal implementation request with no high-impact signal', () => {
-  assert.equal(
-    runGate(
-      delegate(
-        'Arregla el boton que no cambia de color al pasar el mouse en la pagina de inicio.',
-      ),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('allows a read-only subagent', () => {
-  assert.equal(
-    runGate(
-      delegate(
-        'Implementa el cobro del pago con la nueva pasarela de dinero.',
-        {
-          subagent_type: 'plan',
-        },
-      ),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('disabled by config: the gate does not run', () => {
-  assert.equal(
-    runGate(
-      delegate('Implementa el cobro del pago con la nueva pasarela de dinero.'),
-      {
-        config: { gates: { requireScopeListBeforeDelegating: false } },
-      },
-    ),
-    null,
-  );
-});
-
-test('project highImpactPatterns override narrows what counts as high-impact', () => {
-  const config = {
-    gates: {
-      requireScopeListBeforeDelegating: {
-        enabled: true,
-        highImpactPatterns: ['pagin[ao]ci[oó]n'],
-      },
-    },
-  };
-  const prompt =
-    'Implementa el cobro del pago con la nueva pasarela de dinero.';
-  // With the default patterns (money/payment), this same prompt is denied.
-  assert.ok(isDeny(runGate(delegate(prompt), ENABLED)));
-  // No longer matches "dinero/pago" as high-impact once overridden, so no scope list
-  // is required and the gate allows.
-  assert.equal(runGate(delegate(prompt), { config }), null);
-});
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function runGate(payload, { config } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'intent-flow-'));
+  mkdirSync(join(project, '.git'));
+  if (config) {
+    mkdirSync(join(project, '.ai'));
+    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
+  }
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    // Isolate from the user's real global config: point homedir() at the temp
+    // project so the global-config fallback finds nothing (registry default).
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function delegate(prompt, extra = {}) {
+  return { tool_name: 'Agent', tool_input: { prompt, ...extra } };
+}
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+const ENABLED = {
+  config: { gates: { requireScopeListBeforeDelegating: true } },
+};
+
+test('denies implementing a payment change with real intent and no scope list', () => {
+  const result = runGate(
+    delegate(
+      'Implementa el cobro del pago con la nueva pasarela de dinero para el checkout.',
+    ),
+    ENABLED,
+  );
+  assert.ok(isDeny(result));
+});
+
+test('bilingual control: an EN payment brief with no scope list denies exactly like its ES equivalent', () => {
+  const es = delegate(
+    'Implementa el cobro del pago con la nueva pasarela de dinero para el checkout.',
+  );
+  const en = delegate(
+    'Implement the payment charge with the new money gateway for checkout.',
+  );
+  assert.ok(isDeny(runGate(es, ENABLED)));
+  assert.ok(isDeny(runGate(en, ENABLED)));
+});
+
+test('allows the same request once IN SCOPE / OUT OF SCOPE / EDGE CASES are declared', () => {
+  const prompt = [
+    'Implementa el cobro del pago con la nueva pasarela de dinero para el checkout.',
+    '',
+    'QUE SI (alcance): integrar el nuevo proveedor de pago en el checkout.',
+    'QUE NO (fuera de alcance): no tocar el flujo de reembolsos.',
+    'EDGE CASES: no aplican casos borde adicionales.',
+  ].join('\n');
+  assert.equal(runGate(delegate(prompt), ENABLED), null);
+});
+
+test('denies hard when a high-impact request declares an unresolved unknown', () => {
+  const prompt = [
+    'Implementa el cobro del pago con la nueva pasarela; todavia no esta claro que hacer con reembolsos parciales, unknown.',
+    'QUE SI: cobro basico. QUE NO: reembolsos. EDGE CASES: ninguno.',
+  ].join('\n');
+  assert.ok(isDeny(runGate(delegate(prompt), ENABLED)));
+});
+
+test('allows a request mentioning payment only as documentation topic', () => {
+  assert.equal(
+    runGate(
+      delegate(
+        'Crea un documento README.md que explique como funciona el pago y la autenticacion del sistema para el equipo nuevo.',
+      ),
+      ENABLED,
+    ),
+    null,
+  );
+});
+
+test('allows a normal implementation request with no high-impact signal', () => {
+  assert.equal(
+    runGate(
+      delegate(
+        'Arregla el boton que no cambia de color al pasar el mouse en la pagina de inicio.',
+      ),
+      ENABLED,
+    ),
+    null,
+  );
+});
+
+// A whitelisted read-only subagent name is now void whenever the prompt itself carries
+// a mutation-risk signal (money/auth/data/write/deploy): the label is self-declared,
+// never a verified capability, and a real risk signal in the text must win over it
+// (bug fixed in this gate; see intent-flow.edge.test.mjs). So a prompt naming "plan" is
+// only exempt when it carries no such signal.
+test('allows a read-only subagent when the prompt carries no mutation-risk signal', () => {
+  assert.equal(
+    runGate(
+      delegate('Explica como funciona el flujo de checkout actual.', {
+        subagent_type: 'plan',
+      }),
+      ENABLED,
+    ),
+    null,
+  );
+});
+
+test('a read-only subagent name no longer exempts a real money-mutation prompt', () => {
+  assert.ok(
+    isDeny(
+      runGate(
+        delegate(
+          'Implementa el cobro del pago con la nueva pasarela de dinero.',
+          {
+            subagent_type: 'plan',
+          },
+        ),
+        ENABLED,
+      ),
+    ),
+  );
+});
+
+test('disabled by config: the gate does not run', () => {
+  assert.equal(
+    runGate(
+      delegate('Implementa el cobro del pago con la nueva pasarela de dinero.'),
+      {
+        config: { gates: { requireScopeListBeforeDelegating: false } },
+      },
+    ),
+    null,
+  );
+});
+
+test('project highImpactPatterns override narrows what counts as high-impact', () => {
+  const config = {
+    gates: {
+      requireScopeListBeforeDelegating: {
+        enabled: true,
+        highImpactPatterns: ['pagin[ao]ci[oó]n'],
+      },
+    },
+  };
+  const prompt =
+    'Implementa el cobro del pago con la nueva pasarela de dinero.';
+  // With the default patterns (money/payment), this same prompt is denied.
+  assert.ok(isDeny(runGate(delegate(prompt), ENABLED)));
+  // No longer matches "dinero/pago" as high-impact once overridden, so no scope list
+  // is required and the gate allows.
+  assert.equal(runGate(delegate(prompt), { config }), null);
+});

package/plugins/gates/hooks/gates/lint-commit/index.mjs

@@ -0,0 +1,149 @@
+// lint-commit — denies `git commit` while the project's lint script fails. The gate never
+// invents a lint step: it only runs a `lint` script the project itself declared in
+// package.json (or an explicit override), so a project with no linter configured is left
+// alone (allow, silent).
+//
+// justification: no existing tool covers this. bash-commands (the other shell gate) only
+// pattern-matches the command text; it never SPAWNS a check. This is the first gate that
+// runs an external process as its verdict.
+//
+// ── What a project can configure (params) ───────────────────────────────────────────
+//   lintCommand     explicit command to run instead of autodetecting `npm run lint`.
+//                   null (default) means: read package.json's `scripts.lint`, and if
+//                   absent, allow — this gate does not invent a lint step.
+//   lintTimeoutMs   how long the lint run may take before it is treated as a failure.
+// The defaults live here, in the source, so a project reads them and knows exactly what
+// its override replaces.
+//
+// ── How it detects a commit ──────────────────────────────────────────────────────────
+// Reuses bash-commands' git-global-option normalization idea: `git -C <path> commit` or
+// `git -c user.name=x commit` must be caught the same as a bare `git commit`. Only a real
+// commit (not `git commit --help`, not a mention inside a delegation prompt describing one)
+// is gated — this runs on the shell tool only, not on delegation text, because spawning a
+// lint run for a prompt that merely MENTIONS a commit would be wasted work and a false
+// blocker on unrelated delegations.
+//
+// ── Why spawnSync + shell:true on Windows ────────────────────────────────────────────
+// `npm` is `npm.cmd` on Windows; resolving the concrete binary name per platform is more
+// fragile than letting the shell resolve it, so this always spawns through the shell.
+//
+// ── Fail-safe shape ───────────────────────────────────────────────────────────────────
+// No package.json, or package.json with no `scripts.lint` and no `lintCommand` override:
+// allow (nothing to enforce, never invented). Lint run exits non-zero: deny with the last
+// ~15 lines of its combined output. Lint run exits zero: allow.
+
+import { existsSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+import { runGate, deny, toolInGroups } from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'lint-commit';
+const CONFIG_KEY = 'blockCommitWithFailingLint';
+
+const SHELL_GROUPS = ['shell'];
+const DEFAULT_LINT_TIMEOUT_MS = 60000;
+const OUTPUT_TAIL_LINES = 15;
+
+// One global git option at a time, stripped repeatedly — same normalization bash-commands
+// uses so `git -C /repo -c x=y commit` reduces to `git commit` before the pattern runs.
+const GIT_OPTION_WITH_VALUE = String.raw`(?:-[Cc]|--git-dir|--work-tree|--namespace|--exec-path|--config-env)(?:\s+|=)\S+`;
+const GIT_FLAG_OPTION = String.raw`--(?:paginate|no-pager|bare|no-optional-locks)|-p`;
+const GIT_GLOBAL_OPTION_PATTERN = new RegExp(
+  String.raw`\bgit\s+(?:${GIT_OPTION_WITH_VALUE}|${GIT_FLAG_OPTION})\s+`,
+  'i',
+);
+const GIT_COMMIT_PATTERN = /\bgit\s+commit\b/i;
+
+function normalizeGitOptions(command) {
+  let previous;
+  let normalized = command;
+  do {
+    previous = normalized;
+    normalized = normalized.replace(GIT_GLOBAL_OPTION_PATTERN, 'git ');
+  } while (normalized !== previous);
+  return normalized;
+}
+
+function isGitCommit(command) {
+  return GIT_COMMIT_PATTERN.test(normalizeGitOptions(command));
+}
+
+function commandTextFrom(toolInput) {
+  return String(toolInput.CommandLine ?? toolInput.command ?? '');
+}
+
+/** The project's declared lint command, or null when none is declared (never invented). */
+function resolveLintCommand(cwd, lintCommandOverride) {
+  if (lintCommandOverride) return lintCommandOverride;
+
+  const packageJsonPath = join(cwd, 'package.json');
+  if (!existsSync(packageJsonPath)) return null;
+
+  try {
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
+    if (packageJson?.scripts?.lint) return 'npm run lint';
+    return null;
+  } catch {
+    // Corrupt package.json is not this gate's problem to diagnose; do not invent a lint step.
+    return null;
+  }
+}
+
+function tailLines(text, count) {
+  const lines = String(text).split(/\r?\n/).filter((line) => line.length > 0);
+  return lines.slice(-count).join('\n');
+}
+
+function runLint(lintCommand, cwd, timeoutMs) {
+  return spawnSync(lintCommand, {
+    cwd,
+    shell: true,
+    encoding: 'utf8',
+    timeout: timeoutMs,
+  });
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: false,
+    defaultParams: {
+      lintCommand: null,
+      lintTimeoutMs: DEFAULT_LINT_TIMEOUT_MS,
+    },
+  },
+  ({ toolName, toolInput, parameters }) => {
+    if (!toolInGroups(toolName, SHELL_GROUPS)) return;
+
+    const command = commandTextFrom(toolInput);
+    if (!isGitCommit(command)) return;
+
+    const cwd = process.cwd();
+    const lintCommand = resolveLintCommand(cwd, parameters.lintCommand);
+    if (!lintCommand) return; // no lint script declared anywhere: nothing to enforce
+
+    const timeoutMs = parameters.lintTimeoutMs ?? DEFAULT_LINT_TIMEOUT_MS;
+    const result = runLint(lintCommand, cwd, timeoutMs);
+
+    if (result.error) {
+      // The lint process itself could not be spawned (bad shell, missing interpreter, or a
+      // timeout kill). A commit gate that cannot evaluate must not silently permit — deny
+      // with the spawn error so the user can fix the environment, not guess.
+      deny(
+        GATE_ID,
+        `Could not run the lint command ("${lintCommand}"): ${result.error.message}. Fix ` +
+          'the lint setup or set lintCommand/blockCommitWithFailingLint in .ai/config.json.',
+      );
+    }
+
+    if (result.status !== 0) {
+      const combinedOutput = `${result.stdout ?? ''}\n${result.stderr ?? ''}`.trim();
+      deny(
+        GATE_ID,
+        `Lint failed (exit ${result.status}) — commit blocked until it passes:\n` +
+          `${tailLines(combinedOutput, OUTPUT_TAIL_LINES)}`,
+      );
+    }
+  },
+);

package/plugins/gates/hooks/gates/lint-commit/test.mjs

@@ -0,0 +1,85 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function bashPayload(command) {
+  return { tool_name: 'Bash', tool_input: { command } };
+}
+
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+/** Runs the gate in a temp project. HOME isolated so the real global config is not read. */
+function runGate(project, payload, { enabled = true } = {}) {
+  mkdirSync(join(project, '.git'), { recursive: true });
+  mkdirSync(join(project, '.ai'), { recursive: true });
+  writeFileSync(
+    join(project, '.ai', 'config.json'),
+    JSON.stringify({ gates: { blockCommitWithFailingLint: { enabled } } }),
+  );
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function projectWithLintScript(exitCode) {
+  const project = mkdtempSync(join(tmpdir(), 'lint-commit-'));
+  writeFileSync(
+    join(project, 'package.json'),
+    JSON.stringify({
+      name: 'fixture',
+      scripts: {
+        lint: `node -e "process.exit(${exitCode})"`,
+      },
+    }),
+  );
+  return project;
+}
+
+test('lint exits non-zero: git commit is denied with tail of output', () => {
+  const project = projectWithLintScript(1);
+  const result = runGate(project, bashPayload('git commit -m "x"'));
+  assert.ok(isDeny(result), 'expected a deny result');
+  assert.match(result.hookSpecificOutput.permissionDecisionReason, /Lint failed/);
+});
+
+test('lint exits zero: git commit is allowed', () => {
+  const project = projectWithLintScript(0);
+  const result = runGate(project, bashPayload('git commit -m "x"'));
+  assert.equal(result, null);
+});
+
+test('no package.json / no lint script: commit is allowed (never invented)', () => {
+  const project = mkdtempSync(join(tmpdir(), 'lint-commit-nolint-'));
+  const result = runGate(project, bashPayload('git commit -m "x"'));
+  assert.equal(result, null);
+});
+
+test('a non-commit shell command is never blocked, even with failing lint', () => {
+  const project = projectWithLintScript(1);
+  const result = runGate(project, bashPayload('git status'));
+  assert.equal(result, null);
+});
+
+test('git -C <path> commit is still recognized as a commit (global-option bypass closed)', () => {
+  const project = projectWithLintScript(1);
+  const result = runGate(project, bashPayload(`git -C ${project} commit -m "x"`));
+  assert.ok(isDeny(result));
+});
+
+test('gate disabled: commit is allowed even with failing lint', () => {
+  const project = projectWithLintScript(1);
+  const result = runGate(project, bashPayload('git commit -m "x"'), { enabled: false });
+  assert.equal(result, null);
+});

package/plugins/gates/hooks/gates/mandatory-flow/edge.edge.test.mjs

@@ -0,0 +1,100 @@
+// Edge-case probes for mandatory-flow. Previously: (1) the prompt was read only from
+// prompt/Prompt/task, so a Task delegation carrying its brief in `description`
+// bypassed the check (shared root cause with implementation-pipeline, test-matrix,
+// sdd-specs delegation check); (2) the ACTIVA pointer's slug was used unsanitized in
+// join(cwd, '.ai', 'pipeline', slug), so a slug with '..' segments let
+// hasTaskContract() resolve outside .ai/pipeline/ and accept an unrelated file
+// anywhere on disk as the active task's contract. Both are now fixed:
+// delegationPromptOf() reads description too, and readSlug() rejects any slug
+// containing a path separator or a '.'/'..' segment, treating it as empty (which
+// denies the same way a missing slug does).
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function makeProject() {
+  const project = mkdtempSync(join(tmpdir(), 'mandatory-flow-edge-'));
+  mkdirSync(join(project, '.git'));
+  return project;
+}
+
+function writeProjectConfig(project, config) {
+  mkdirSync(join(project, '.ai'), { recursive: true });
+  writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
+}
+
+function runGate(project, payload) {
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+function enableGate(project) {
+  writeProjectConfig(project, { gates: { requireLiveTaskWhenImplementing: true } });
+}
+
+test('FIXED: a Task delegation carrying its brief in `description` is now checked', () => {
+  const project = makeProject();
+  enableGate(project);
+  // No ACTIVA pointer at all -- with delegationPromptOf reading `description`, this
+  // now reaches checkLiveTask and denies for the missing pointer.
+  const payload = {
+    tool_name: 'Task',
+    tool_input: {
+      description: 'Nivel: STANDARD\nImplementá el checkout.',
+      subagent_type: 'backend',
+    },
+  };
+  assert.ok(
+    isDeny(runGate(project, payload)),
+    'delegationPromptOf reads description and the no-live-task deny fires',
+  );
+});
+
+test('OK: the equivalent payload using `prompt` with no ACTIVA pointer IS denied (control)', () => {
+  const project = makeProject();
+  enableGate(project);
+  const payload = {
+    tool_name: 'Task',
+    tool_input: {
+      prompt: 'Nivel: STANDARD\nImplementá el checkout.',
+      subagent_type: 'backend',
+    },
+  };
+  assert.ok(isDeny(runGate(project, payload)), 'control failed');
+});
+
+test('FIXED: a path-traversal slug in ACTIVA no longer lets an unrelated file satisfy hasTaskContract', () => {
+  const project = makeProject();
+  enableGate(project);
+  mkdirSync(join(project, '.ai', 'pipeline'), { recursive: true });
+  mkdirSync(join(project, 'evil'), { recursive: true });
+  writeFileSync(join(project, 'evil', 'asserts.md'), 'unrelated content');
+  writeFileSync(join(project, '.ai', 'pipeline', 'ACTIVA'), '../../evil');
+  const payload = {
+    tool_name: 'Agent',
+    tool_input: {
+      prompt: 'Nivel: STANDARD\nImplementá el checkout.',
+      subagent_type: 'backend',
+    },
+  };
+  assert.ok(
+    isDeny(runGate(project, payload)),
+    'readSlug must reject the traversal slug (treated as empty), denying instead of ' +
+      'accepting the unrelated file outside .ai/pipeline/',
+  );
+});