@devrik-tools/claude-gates 0.1.2 → 0.2.0

package/plugins/gates/hooks/gates/risk-level/test.mjs

@@ -1,125 +1,153 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'risk-level-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function delegate(prompt, extra = {}) {
-  return { tool_name: 'Agent', tool_input: { prompt, ...extra } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLED = { config: { gates: { requireDeclaredRiskLevel: true } } };
-
-test('denies an implementation delegation with no declared level', () => {
-  assert.ok(
-    isDeny(
-      runGate(
-        delegate('Arregla el boton que no cambia de color en la pagina.'),
-        ENABLED,
-      ),
-    ),
-  );
-});
-
-test('allows a declared level consistent with a low-risk request', () => {
-  assert.equal(
-    runGate(
-      delegate(
-        'NIVEL: STANDARD\n\nArregla el boton que no cambia de color en la pagina.',
-      ),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('denies a declared level that contradicts a real high-impact signal', () => {
-  assert.ok(
-    isDeny(
-      runGate(
-        delegate(
-          'NIVEL: MICRO\n\nImplementa el cobro del pago con la nueva pasarela de dinero.',
-        ),
-        ENABLED,
-      ),
-    ),
-  );
-});
-
-test('allows HIGH-RISK declared for a high-impact request', () => {
-  assert.equal(
-    runGate(
-      delegate(
-        'NIVEL: HIGH-RISK\n\nImplementa el cobro del pago con la nueva pasarela de dinero.',
-      ),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('allows a read-only subagent without a declared level', () => {
-  assert.equal(
-    runGate(
-      delegate(
-        'Implementa el cobro del pago con la nueva pasarela de dinero.',
-        {
-          subagent_type: 'explore',
-        },
-      ),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('disabled by config: the gate does not run', () => {
-  assert.equal(
-    runGate(delegate('Arregla el boton que no cambia de color en la pagina.'), {
-      config: { gates: { requireDeclaredRiskLevel: false } },
-    }),
-    null,
-  );
-});
-
-test('project highImpactPatterns override narrows what forces HIGH-RISK', () => {
-  const config = {
-    gates: {
-      requireDeclaredRiskLevel: {
-        enabled: true,
-        highImpactPatterns: ['pagin[ao]ci[oó]n'],
-      },
-    },
-  };
-  const prompt =
-    'NIVEL: MICRO\n\nImplementa el cobro del pago con la nueva pasarela de dinero.';
-  // With the default patterns (money/payment), MICRO contradicts the signal and is denied.
-  assert.ok(isDeny(runGate(delegate(prompt), ENABLED)));
-  // Once overridden, "dinero/pago" no longer counts as high-impact, so MICRO is allowed.
-  assert.equal(runGate(delegate(prompt), { config }), null);
-});
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function runGate(payload, { config } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'risk-level-'));
+  mkdirSync(join(project, '.git'));
+  if (config) {
+    mkdirSync(join(project, '.ai'));
+    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
+  }
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    // Isolate from the user's real global config: point homedir() at the temp
+    // project so the global-config fallback finds nothing (registry default).
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function delegate(prompt, extra = {}) {
+  return { tool_name: 'Agent', tool_input: { prompt, ...extra } };
+}
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+const ENABLED = { config: { gates: { requireDeclaredRiskLevel: true } } };
+
+test('denies an implementation delegation with no declared level', () => {
+  assert.ok(
+    isDeny(
+      runGate(
+        delegate('Arregla el boton que no cambia de color en la pagina.'),
+        ENABLED,
+      ),
+    ),
+  );
+});
+
+test('allows a declared level consistent with a low-risk request', () => {
+  assert.equal(
+    runGate(
+      delegate(
+        'NIVEL: STANDARD\n\nArregla el boton que no cambia de color en la pagina.',
+      ),
+      ENABLED,
+    ),
+    null,
+  );
+});
+
+test('denies a declared level that contradicts a real high-impact signal', () => {
+  assert.ok(
+    isDeny(
+      runGate(
+        delegate(
+          'NIVEL: MICRO\n\nImplementa el cobro del pago con la nueva pasarela de dinero.',
+        ),
+        ENABLED,
+      ),
+    ),
+  );
+});
+
+test('allows HIGH-RISK declared for a high-impact request', () => {
+  assert.equal(
+    runGate(
+      delegate(
+        'NIVEL: HIGH-RISK\n\nImplementa el cobro del pago con la nueva pasarela de dinero.',
+      ),
+      ENABLED,
+    ),
+    null,
+  );
+});
+
+test('bilingual control: an EN money-mutation brief contradicts a low level exactly like its ES equivalent', () => {
+  const es = delegate(
+    'NIVEL: MICRO\n\nImplementa el cobro del pago con la nueva pasarela de dinero.',
+  );
+  const en = delegate(
+    'LEVEL: MICRO\n\nImplement the payment charge with the new money gateway.',
+  );
+  assert.ok(isDeny(runGate(es, ENABLED)));
+  assert.ok(isDeny(runGate(en, ENABLED)));
+});
+
+// A whitelisted read-only subagent name is now void whenever the prompt itself carries
+// a mutation-risk signal (money/auth/data/write/deploy): the label is self-declared,
+// never a verified capability, and a real risk signal in the text must win over it
+// (bug fixed in this gate; see risk-level.edge.test.mjs).
+test('allows a read-only subagent without a declared level when the prompt carries no mutation-risk signal', () => {
+  assert.equal(
+    runGate(
+      delegate('Explica como funciona el flujo de checkout actual.', {
+        subagent_type: 'explore',
+      }),
+      ENABLED,
+    ),
+    null,
+  );
+});
+
+test('a read-only subagent name no longer exempts a real money-mutation prompt from declaring a level', () => {
+  assert.ok(
+    isDeny(
+      runGate(
+        delegate(
+          'Implementa el cobro del pago con la nueva pasarela de dinero.',
+          {
+            subagent_type: 'explore',
+          },
+        ),
+        ENABLED,
+      ),
+    ),
+  );
+});
+
+test('disabled by config: the gate does not run', () => {
+  assert.equal(
+    runGate(delegate('Arregla el boton que no cambia de color en la pagina.'), {
+      config: { gates: { requireDeclaredRiskLevel: false } },
+    }),
+    null,
+  );
+});
+
+test('project highImpactPatterns override narrows what forces HIGH-RISK', () => {
+  const config = {
+    gates: {
+      requireDeclaredRiskLevel: {
+        enabled: true,
+        highImpactPatterns: ['pagin[ao]ci[oó]n'],
+      },
+    },
+  };
+  const prompt =
+    'NIVEL: MICRO\n\nImplementa el cobro del pago con la nueva pasarela de dinero.';
+  // With the default patterns (money/payment), MICRO contradicts the signal and is denied.
+  assert.ok(isDeny(runGate(delegate(prompt), ENABLED)));
+  // Once overridden, "dinero/pago" no longer counts as high-impact, so MICRO is allowed.
+  assert.equal(runGate(delegate(prompt), { config }), null);
+});

package/plugins/gates/hooks/gates/root-cause-first/index.mjs

@@ -1,50 +1,56 @@
-import { runGate, deny, TOOL_GROUPS } from '../../lib/hook-io.mjs';
-
-const GATE_ID = 'root-cause-first';
-const CONFIG_KEY = 'requireRootCauseBeforePatch';
-
-const DEFAULT_PATCH_MARKER_PATTERNS = ['//\\s*todo:?\\s*fix\\s+later\\s+patch'];
-
-function extractContent(toolName, toolInput) {
-  if (TOOL_GROUPS.delegation.includes(toolName)) {
-    return toolInput?.prompt;
-  }
-  return toolInput?.content ?? toolInput?.new_string;
-}
-
-runGate(
-  {
-    id: GATE_ID,
-    configKey: CONFIG_KEY,
-    enabledByDefault: false,
-    defaultParams: {
-      patchMarkerPatterns: DEFAULT_PATCH_MARKER_PATTERNS,
-    },
-  },
-  ({ toolName, toolInput, parameters }) => {
-    const isWrite = TOOL_GROUPS.write.includes(toolName);
-    const isDelegation = TOOL_GROUPS.delegation.includes(toolName);
-    if (!isWrite && !isDelegation) return;
-
-    const content = extractContent(toolName, toolInput);
-    if (typeof content !== 'string') return;
-
-    const patterns = parameters.patchMarkerPatterns.map(
-      (source) => new RegExp(source, 'i'),
-    );
-    const matched = patterns.find((pattern) => pattern.test(content));
-    if (!matched) return;
-
-    deny(
-      GATE_ID,
-      `Content matches a patch-without-diagnosis marker (${matched.source}). Identify and fix the root cause before patching; do not defer with a "fix later" marker.`,
-    );
-  },
-);
-
-// Simplified vs. the source guard (guard-root-cause-first.mjs): the original
-// used an auxiliary lib/embedded-content-detection.mjs module to tell real
-// file content apart from a quoted example inside markdown. That module does
-// not exist in this repo, so this gate matches directly against the new
-// content/prompt. Distinguishing markdown quotes from real code is future
-// work if false positives on quoted examples become a problem.
+import {
+  runGate,
+  deny,
+  toolInGroups,
+  writtenContentOf,
+  delegationPromptOf,
+} from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'root-cause-first';
+const CONFIG_KEY = 'requireRootCauseBeforePatch';
+
+const DEFAULT_PATCH_MARKER_PATTERNS = ['//\\s*todo:?\\s*fix\\s+later\\s+patch'];
+
+// The text to scan: a delegation's brief, or the content a write puts on disk. writtenContentOf
+// covers every native and MCP write shape (Write's content, Edit's new_string, NotebookEdit's
+// new_source, replace_file_content's new_content) — the old reader missed new_source, so a
+// deferral marker written via NotebookEdit was never caught by this DENY gate.
+function textToScan(toolName, toolInput) {
+  if (toolInGroups(toolName, ['delegation'])) return delegationPromptOf(toolInput);
+  return writtenContentOf(toolInput);
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: false,
+    defaultParams: {
+      patchMarkerPatterns: DEFAULT_PATCH_MARKER_PATTERNS,
+    },
+  },
+  ({ toolName, toolInput, parameters }) => {
+    if (!toolInGroups(toolName, ['write', 'delegation'])) return;
+
+    const content = textToScan(toolName, toolInput);
+    if (!content) return;
+
+    const patterns = parameters.patchMarkerPatterns.map(
+      (source) => new RegExp(source, 'i'),
+    );
+    const matched = patterns.find((pattern) => pattern.test(content));
+    if (!matched) return;
+
+    deny(
+      GATE_ID,
+      `Content matches a patch-without-diagnosis marker (${matched.source}). Identify and fix the root cause before patching; do not defer with a "fix later" marker.`,
+    );
+  },
+);
+
+// Simplified vs. the source guard (guard-root-cause-first.mjs): the original
+// used an auxiliary lib/embedded-content-detection.mjs module to tell real
+// file content apart from a quoted example inside markdown. That module does
+// not exist in this repo, so this gate matches directly against the new
+// content/prompt. Distinguishing markdown quotes from real code is future
+// work if false positives on quoted examples become a problem.

package/plugins/gates/hooks/gates/root-cause-first/root-cause-first.edge.test.mjs

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function runGate(payload, { config } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'root-cause-first-edge-'));
+  mkdirSync(join(project, '.git'));
+  if (config) {
+    mkdirSync(join(project, '.ai'));
+    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
+  }
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+const ENABLE = { config: { gates: { requireRootCauseBeforePatch: true } } };
+
+// FIXED: writtenContentOf reads NotebookEdit's new_source, so a deferral marker written via
+// NotebookEdit is now caught by this DENY gate.
+test('FIXED: patch-marker comment via NotebookEdit is now denied', () => {
+  const payload = {
+    tool_name: 'NotebookEdit',
+    tool_input: {
+      notebook_path: '/repo/nb.ipynb',
+      cell_id: 'x',
+      new_source: '// TODO fix later patch',
+      cell_type: 'code',
+    },
+  };
+  assert.ok(isDeny(runGate(payload, ENABLE)), 'a patch marker via NotebookEdit must now be denied');
+});
+
+// FIXED: writtenContentOf reads replace_file_content's new_content field too.
+test('FIXED: patch-marker via replace_file_content (new_content field) is now denied', () => {
+  const payload = {
+    tool_name: 'replace_file_content',
+    tool_input: {
+      file_path: '/repo/x.js',
+      new_content: '// TODO fix later patch',
+    },
+  };
+  assert.ok(isDeny(runGate(payload, ENABLE)), 'the field-name variant must now be denied');
+});