@devrik-tools/claude-gates 0.1.2 → 0.2.0

package/plugins/gates/hooks/gates/test-matrix/index.mjs

@@ -1,181 +1,187 @@
-// test-matrix — denies an implementation delegation whose brief touches a domain that
-// makes a test type mandatory (money/auth/persistence → E2E; UI → visual/QA; always →
-// unit/mutation) without that type declared in the prompt. Migrated from
-// ~/.claude/hooks/guard-matriz-de-tests.mjs.
-//
-// ── What a project can configure (params) ───────────────────────────────────────────
-//   e2eSignals       regex sources (matched case-insensitively) that make an E2E row
-//                     mandatory when found in the brief (money, auth, persistence...).
-//                     Replaces the built-in list wholesale.
-//   visualSignals    regex sources that make a visual/QA row mandatory (UI signals).
-//                     Replaces the built-in list wholesale.
-// The defaults live here, in the source, so a project reads them and knows exactly what
-// its override replaces.
-//
-// ── Off by default, and quiet outside its narrow trigger ───────────────────────────
-// Only STANDARD/HIGH-RISK implementation delegations on builder subagents, not about
-// the harness itself, reach the check. A brief that only describes work never triggers.
-
-import { runGate, deny, TOOL_GROUPS } from '../../lib/hook-io.mjs';
-
-const GATE_ID = 'test-matrix';
-const CONFIG_KEY = 'requireTestMatrixWhenImplementing';
-
-const DELEGATION_TOOLS = new Set(TOOL_GROUPS.delegation);
-
-const DEFAULT_EXEMPT_SUBAGENTS = [
-  'scout',
-  'explore',
-  'plan',
-  'revision',
-  'contraste',
-  'test-planner',
-  'qa',
-  'ui',
-  'ux',
-];
-
-const DEFAULT_E2E_SIGNALS = [
-  'money|amount|payment|charge|invoice|balance',
-  'auth|authentication|login|session|token|permission|role',
-  'persist|database|migration|transaction',
-];
-
-const DEFAULT_VISUAL_SIGNALS = [
-  'ui|interface|component|screen|view',
-  'form|button|modal|layout|style',
-  'responsive|mobile|visual|\\.vue|\\.tsx?|\\.jsx?',
-];
-
-function withWordBoundary(alternation) {
-  return new RegExp(
-    `(?:^|[^\\p{L}\\p{N}_])(?:${alternation})(?:[^\\p{L}\\p{N}_]|$)`,
-    'iu',
-  );
-}
-
-const IMPLEMENTATION_VERBS = withWordBoundary(
-  'implementa|implementar|implement(á|é)|agreg(a|á)|agregar|añad(e|í)|añadir|cre(a|á)|crear|' +
-    'arregl(a|á)|arreglar|cambi(a|á)|cambiar|migr(a|á)|migrar|' +
-    'corrige|corregir|correg(í|ir)|constru(ye|í)|construir|modific(a|á)|modificar|' +
-    'refactoriz(a|á)|refactorizar|elimin(a|á)|eliminar|reescrib(e|í)|reescribir|desplieg(a|á)|desplegar|' +
-    'escrib(í|e)|escribir|implement\\w*|writ(?:e|ing)|creat\\w*|fix\\w*|build\\w*|refactor\\w*|migrat\\w*|' +
-    'add\\w*|remov\\w*|delet\\w*|modify|modifies|modifying|rewrit\\w*',
-);
-
-/** Declared LEVEL near the word "level"/"classification" in Spanish or English, matching
- * the plugin-wide convention (see risk-level.mjs). */
-const DEMANDING_LEVEL_PATTERN =
-  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(STANDARD|HIGH-RISK)\b/iu;
-const EXEMPT_LEVEL_PATTERN =
-  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(QUESTION|MICRO)\b/iu;
-
-const HARNESS_PATTERN =
-  /(\.claude[\\/]|hooks[\\/]|plugins[\\/]gates|settings\.json|[\\/]agents[\\/]\w|[\\/]rules[\\/]\w|[\\/]skills[\\/]\w)/i;
-
-const DETECTS_E2E = /\b(e2e|end[- ]to[- ]end|playwright)\b/i;
-const DETECTS_VISUAL = /\b(visual|qa\b|screenshot|snapshot)\b/i;
-const DETECTS_UNIT_OR_MUTATION =
-  /\b(unit\b|units\b|vitest|jest|mutation|mutant|stryker)\b/i;
-const DETECTS_NEGATIVE_CASES = withWordBoundary(
-  'negative|edge|empty|error|no data|zero|count 0|failure|invalid|limit',
-);
-
-function joinSignals(signals) {
-  return withWordBoundary(signals.join('|'));
-}
-
-function isExempt(toolInput, prompt, exemptSubagents) {
-  const subagentType = String(
-    toolInput.subagent_type ?? toolInput.subagentType ?? '',
-  ).toLowerCase();
-  if (exemptSubagents.includes(subagentType)) return true;
-  if (EXEMPT_LEVEL_PATTERN.test(prompt)) return true;
-  if (!DEMANDING_LEVEL_PATTERN.test(prompt)) return true;
-  if (!IMPLEMENTATION_VERBS.test(prompt)) return true;
-  if (HARNESS_PATTERN.test(prompt)) return true;
-  return false;
-}
-
-/** Which mandatory test types are missing from the prompt, given the brief text. */
-function missingTypes(prompt, e2ePattern, visualPattern) {
-  const missing = [];
-
-  if (!DETECTS_UNIT_OR_MUTATION.test(prompt)) {
-    missing.push({
-      type: 'unit/mutation',
-      line: '- unit/mutation: yes — <what it covers>  (or: not applicable — <reason>)',
-    });
-  }
-
-  if (e2ePattern.test(prompt) && !DETECTS_E2E.test(prompt)) {
-    missing.push({
-      type: 'E2E',
-      line: '- E2E: yes — <end-to-end flow verified>  (mandatory: the requirement touches money/auth/persistence)',
-    });
-  }
-
-  if (visualPattern.test(prompt) && !DETECTS_VISUAL.test(prompt)) {
-    missing.push({
-      type: 'visual/QA',
-      line: '- visual/QA: yes — <screen/state reviewed in the browser>  (mandatory: the requirement touches UI)',
-    });
-  }
-
-  const declaresAnyType =
-    DETECTS_UNIT_OR_MUTATION.test(prompt) ||
-    DETECTS_E2E.test(prompt) ||
-    DETECTS_VISUAL.test(prompt);
-  if (declaresAnyType && !DETECTS_NEGATIVE_CASES.test(prompt)) {
-    missing.push({
-      type: 'negative/edge cases',
-      line: '- negative/edge cases: <no data / empty / error / zero value / invalid input tested>  (the happy path is not enough)',
-    });
-  }
-
-  return missing;
-}
-
-runGate(
-  {
-    id: GATE_ID,
-    configKey: CONFIG_KEY,
-    enabledByDefault: false,
-    defaultParams: {
-      exemptSubagents: DEFAULT_EXEMPT_SUBAGENTS,
-      e2eSignals: DEFAULT_E2E_SIGNALS,
-      visualSignals: DEFAULT_VISUAL_SIGNALS,
-    },
-  },
-  ({ toolName, toolInput, parameters }) => {
-    if (!DELEGATION_TOOLS.has(toolName)) return;
-
-    const prompt = String(
-      toolInput.prompt ?? toolInput.Prompt ?? toolInput.task ?? '',
-    );
-    if (!prompt.trim()) return;
-
-    const exemptSubagents =
-      parameters.exemptSubagents ?? DEFAULT_EXEMPT_SUBAGENTS;
-    if (isExempt(toolInput, prompt, exemptSubagents)) return;
-
-    const e2eSignals = parameters.e2eSignals ?? DEFAULT_E2E_SIGNALS;
-    const visualSignals = parameters.visualSignals ?? DEFAULT_VISUAL_SIGNALS;
-    const e2ePattern = joinSignals(e2eSignals);
-    const visualPattern = joinSignals(visualSignals);
-
-    const missing = missingTypes(prompt, e2ePattern, visualPattern);
-    if (missing.length === 0) return;
-
-    const lines = missing.map((entry) => `  ${entry.line}`).join('\n');
-    deny(
-      GATE_ID,
-      `Missing ${missing.length} test type(s) the requirement makes mandatory. Test types ` +
-        'are chosen ACCORDING TO THE REQUIREMENT: E2E if it touches money/auth/persistence, ' +
-        'visual/QA if it touches UI, and always unit or mutation. ' +
-        `PASTE THIS SECTION INTO THE PROMPT (adjust yes/no with judgment) AND RELAUNCH:\n` +
-        `TEST MATRIX (by type, according to the requirement):\n${lines}\n` +
-        'A type that truly does not apply is declared "no — <reason>", never silently omitted.',
-    );
-  },
-);
+// test-matrix — denies an implementation delegation whose brief touches a domain that
+// makes a test type mandatory (money/auth/persistence → E2E; UI → visual/QA; always →
+// unit/mutation) without that type declared in the prompt. Migrated from
+// ~/.claude/hooks/guard-matriz-de-tests.mjs.
+//
+// ── What a project can configure (params) ───────────────────────────────────────────
+//   e2eSignals       regex sources (matched case-insensitively) that make an E2E row
+//                     mandatory when found in the brief (money, auth, persistence...).
+//                     Replaces the built-in list wholesale.
+//   visualSignals    regex sources that make a visual/QA row mandatory (UI signals).
+//                     Replaces the built-in list wholesale.
+// The defaults live here, in the source, so a project reads them and knows exactly what
+// its override replaces.
+//
+// ── Off by default, and quiet outside its narrow trigger ───────────────────────────
+// Only STANDARD/HIGH-RISK implementation delegations on builder subagents, not about
+// the harness itself, reach the check. A brief that only describes work never triggers.
+
+import {
+  runGate,
+  deny,
+  toolInGroups,
+  delegationPromptOf,
+} from '../../lib/hook-io.mjs';
+import { RISK_SIGNAL_SOURCES } from '../../lib/signals.mjs';
+
+const GATE_ID = 'test-matrix';
+const CONFIG_KEY = 'requireTestMatrixWhenImplementing';
+
+const DEFAULT_EXEMPT_SUBAGENTS = [
+  'scout',
+  'explore',
+  'plan',
+  'revision',
+  'contraste',
+  'test-planner',
+  'qa',
+  'ui',
+  'ux',
+];
+
+// Money/auth signals shared with RISK_SIGNAL (lib/signals.mjs, ES+EN), plus this gate's
+// own persistence-domain terms (also bilingual) — a project override still replaces the
+// whole list wholesale, same as before.
+const DEFAULT_E2E_SIGNALS = [
+  ...RISK_SIGNAL_SOURCES.slice(0, 2), // money terms, auth terms
+  'login|session|token|permission|role|sesi[oó]n|permiso|rol',
+  'persist|database|migration|transaction|persistencia|base de datos|migraci[oó]n|transacci[oó]n',
+];
+
+const DEFAULT_VISUAL_SIGNALS = [
+  'ui|interface|interfaz|component|componente|screen|pantalla|view|vista',
+  'form|formulario|button|bot[oó]n|modal|layout|style|estilo',
+  'responsive|mobile|m[oó]vil|visual|\\.vue|\\.tsx?|\\.jsx?',
+];
+
+function withWordBoundary(alternation) {
+  return new RegExp(
+    `(?:^|[^\\p{L}\\p{N}_])(?:${alternation})(?:[^\\p{L}\\p{N}_]|$)`,
+    'iu',
+  );
+}
+
+const IMPLEMENTATION_VERBS = withWordBoundary(
+  'implementa|implementar|implement(á|é)|agreg(a|á)|agregar|añad(e|í)|añadir|cre(a|á)|crear|' +
+    'arregl(a|á)|arreglar|cambi(a|á)|cambiar|migr(a|á)|migrar|' +
+    'corrige|corregir|correg(í|ir)|constru(ye|í)|construir|modific(a|á)|modificar|' +
+    'refactoriz(a|á)|refactorizar|elimin(a|á)|eliminar|reescrib(e|í)|reescribir|desplieg(a|á)|desplegar|' +
+    'escrib(í|e)|escribir|implement\\w*|writ(?:e|ing)|creat\\w*|fix\\w*|build\\w*|refactor\\w*|migrat\\w*|' +
+    'add\\w*|remov\\w*|delet\\w*|modify|modifies|modifying|rewrit\\w*',
+);
+
+/** Declared LEVEL near the word "level"/"classification" in Spanish or English, matching
+ * the plugin-wide convention (see risk-level.mjs). */
+const DEMANDING_LEVEL_PATTERN =
+  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(STANDARD|HIGH-RISK)\b/iu;
+const EXEMPT_LEVEL_PATTERN =
+  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(QUESTION|MICRO)\b/iu;
+
+const HARNESS_PATTERN =
+  /(\.claude[\\/]|hooks[\\/]|plugins[\\/]gates|settings\.json|[\\/]agents[\\/]\w|[\\/]rules[\\/]\w|[\\/]skills[\\/]\w)/i;
+
+const DETECTS_E2E = /\b(e2e|end[- ]to[- ]end|playwright)\b/i;
+const DETECTS_VISUAL = /\b(visual|qa\b|screenshot|snapshot)\b/i;
+const DETECTS_UNIT_OR_MUTATION =
+  /\b(unit\b|units\b|unitari[ao]s?|vitest|jest|mutation|mutaci[oó]n|mutant|stryker)\b/i;
+const DETECTS_NEGATIVE_CASES = withWordBoundary(
+  'negative|edge|empty|error|no data|zero|count 0|failure|invalid|limit|' +
+    'negativ[ao]s?|borde|vac[ií]o|sin datos|cero|falla|inv[aá]lid[ao]|l[ií]mite',
+);
+
+function joinSignals(signals) {
+  return withWordBoundary(signals.join('|'));
+}
+
+function isExempt(toolInput, prompt, exemptSubagents) {
+  const subagentType = String(
+    toolInput.subagent_type ?? toolInput.subagentType ?? '',
+  ).toLowerCase();
+  if (exemptSubagents.includes(subagentType)) return true;
+  if (EXEMPT_LEVEL_PATTERN.test(prompt)) return true;
+  if (!DEMANDING_LEVEL_PATTERN.test(prompt)) return true;
+  if (!IMPLEMENTATION_VERBS.test(prompt)) return true;
+  if (HARNESS_PATTERN.test(prompt)) return true;
+  return false;
+}
+
+/** Which mandatory test types are missing from the prompt, given the brief text. */
+function missingTypes(prompt, e2ePattern, visualPattern) {
+  const missing = [];
+
+  if (!DETECTS_UNIT_OR_MUTATION.test(prompt)) {
+    missing.push({
+      type: 'unit/mutation',
+      line: '- unit/mutation: yes — <what it covers>  (or: not applicable — <reason>)',
+    });
+  }
+
+  if (e2ePattern.test(prompt) && !DETECTS_E2E.test(prompt)) {
+    missing.push({
+      type: 'E2E',
+      line: '- E2E: yes — <end-to-end flow verified>  (mandatory: the requirement touches money/auth/persistence)',
+    });
+  }
+
+  if (visualPattern.test(prompt) && !DETECTS_VISUAL.test(prompt)) {
+    missing.push({
+      type: 'visual/QA',
+      line: '- visual/QA: yes — <screen/state reviewed in the browser>  (mandatory: the requirement touches UI)',
+    });
+  }
+
+  const declaresAnyType =
+    DETECTS_UNIT_OR_MUTATION.test(prompt) ||
+    DETECTS_E2E.test(prompt) ||
+    DETECTS_VISUAL.test(prompt);
+  if (declaresAnyType && !DETECTS_NEGATIVE_CASES.test(prompt)) {
+    missing.push({
+      type: 'negative/edge cases',
+      line: '- negative/edge cases: <no data / empty / error / zero value / invalid input tested>  (the happy path is not enough)',
+    });
+  }
+
+  return missing;
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: false,
+    defaultParams: {
+      exemptSubagents: DEFAULT_EXEMPT_SUBAGENTS,
+      e2eSignals: DEFAULT_E2E_SIGNALS,
+      visualSignals: DEFAULT_VISUAL_SIGNALS,
+    },
+  },
+  ({ toolName, toolInput, parameters }) => {
+    if (!toolInGroups(toolName, ['delegation'])) return;
+
+    const prompt = delegationPromptOf(toolInput);
+    if (!prompt.trim()) return;
+
+    const exemptSubagents =
+      parameters.exemptSubagents ?? DEFAULT_EXEMPT_SUBAGENTS;
+    if (isExempt(toolInput, prompt, exemptSubagents)) return;
+
+    const e2eSignals = parameters.e2eSignals ?? DEFAULT_E2E_SIGNALS;
+    const visualSignals = parameters.visualSignals ?? DEFAULT_VISUAL_SIGNALS;
+    const e2ePattern = joinSignals(e2eSignals);
+    const visualPattern = joinSignals(visualSignals);
+
+    const missing = missingTypes(prompt, e2ePattern, visualPattern);
+    if (missing.length === 0) return;
+
+    const lines = missing.map((entry) => `  ${entry.line}`).join('\n');
+    deny(
+      GATE_ID,
+      `Missing ${missing.length} test type(s) the requirement makes mandatory. Test types ` +
+        'are chosen ACCORDING TO THE REQUIREMENT: E2E if it touches money/auth/persistence, ' +
+        'visual/QA if it touches UI, and always unit or mutation. ' +
+        `PASTE THIS SECTION INTO THE PROMPT (adjust yes/no with judgment) AND RELAUNCH:\n` +
+        `TEST MATRIX (by type, according to the requirement):\n${lines}\n` +
+        'A type that truly does not apply is declared "no — <reason>", never silently omitted.',
+    );
+  },
+);

package/plugins/gates/hooks/gates/test-matrix/test.mjs

@@ -1,87 +1,114 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'test-matrix-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function delegate(prompt, subagentType = 'backend') {
-  return {
-    tool_name: 'Agent',
-    tool_input: { prompt, subagent_type: subagentType },
-  };
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-function enabledConfig(extraParameters) {
-  return {
-    gates: {
-      requireTestMatrixWhenImplementing: extraParameters
-        ? { enabled: true, ...extraParameters }
-        : true,
-    },
-  };
-}
-
-test('disabled by default: a money-touching brief with no test matrix is allowed', () => {
-  const prompt = 'Nivel: STANDARD\nImplementá el cobro de la cuota.';
-  assert.equal(runGate(delegate(prompt)), null);
-});
-
-test('denies missing unit/mutation on a plain brief with no test type declared', () => {
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  assert.ok(isDeny(runGate(delegate(prompt), { config: enabledConfig() })));
-});
-
-test('denies missing E2E when the brief touches money and only declares unit tests', () => {
-  const prompt =
-    'Nivel: STANDARD\nImplementá el cobro de la cuota. Verificación: vitest cubre el cálculo.';
-  assert.ok(isDeny(runGate(delegate(prompt), { config: enabledConfig() })));
-});
-
-test('allows a brief that declares unit, E2E and negative cases for a money domain', () => {
-  const prompt =
-    'Nivel: STANDARD\nImplementá el cobro de la cuota. ' +
-    'Verificación: vitest cubre el cálculo. E2E: flujo completo de cobro. ' +
-    'Casos negativos: monto cero, sin saldo, error de red.';
-  assert.equal(runGate(delegate(prompt), { config: enabledConfig() }), null);
-});
-
-test('exempt subagent type (qa) is never held to the matrix requirement', () => {
-  const prompt = 'Nivel: STANDARD\nImplementá el cobro de la cuota.';
-  assert.equal(
-    runGate(delegate(prompt, 'qa'), { config: enabledConfig() }),
-    null,
-  );
-});
-
-test('e2eSignals param override makes a domain word mandatory that the default list omits', () => {
-  const prompt =
-    'Nivel: STANDARD\nImplementá el módulo de inventario. Verificación: vitest cubre el cálculo.';
-  const config = enabledConfig({ e2eSignals: ['inventario|inventory'] });
-  assert.ok(isDeny(runGate(delegate(prompt), { config })));
-});
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function runGate(payload, { config } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'test-matrix-'));
+  mkdirSync(join(project, '.git'));
+  if (config) {
+    mkdirSync(join(project, '.ai'));
+    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
+  }
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    // Isolate from the user's real global config: point homedir() at the temp
+    // project so the global-config fallback finds nothing (registry default).
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function delegate(prompt, subagentType = 'backend') {
+  return {
+    tool_name: 'Agent',
+    tool_input: { prompt, subagent_type: subagentType },
+  };
+}
+
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+function enabledConfig(extraParameters) {
+  return {
+    gates: {
+      requireTestMatrixWhenImplementing: extraParameters
+        ? { enabled: true, ...extraParameters }
+        : true,
+    },
+  };
+}
+
+test('disabled by default: a money-touching brief with no test matrix is allowed', () => {
+  const prompt = 'Nivel: STANDARD\nImplementá el cobro de la cuota.';
+  assert.equal(runGate(delegate(prompt)), null);
+});
+
+test('denies missing unit/mutation on a plain brief with no test type declared', () => {
+  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
+  assert.ok(isDeny(runGate(delegate(prompt), { config: enabledConfig() })));
+});
+
+test('denies missing E2E when the brief touches money and only declares unit tests', () => {
+  const prompt =
+    'Nivel: STANDARD\nImplementá el cobro de la cuota. Verificación: vitest cubre el cálculo.';
+  assert.ok(isDeny(runGate(delegate(prompt), { config: enabledConfig() })));
+});
+
+test('allows a brief that declares unit, E2E and negative cases for a money domain', () => {
+  const prompt =
+    'Nivel: STANDARD\nImplementá el cobro de la cuota. ' +
+    'Verificación: vitest cubre el cálculo. E2E: flujo completo de cobro. ' +
+    'Casos negativos: monto cero, sin saldo, error de red.';
+  assert.equal(runGate(delegate(prompt), { config: enabledConfig() }), null);
+});
+
+test('exempt subagent type (qa) is never held to the matrix requirement', () => {
+  const prompt = 'Nivel: STANDARD\nImplementá el cobro de la cuota.';
+  assert.equal(
+    runGate(delegate(prompt, 'qa'), { config: enabledConfig() }),
+    null,
+  );
+});
+
+test('denies missing E2E for a Spanish money brief (cobro/saldo/cuota), not just its English equivalent', () => {
+  const prompt =
+    'Nivel: STANDARD\nImplementá el cobro de la cuota. Verificación: vitest cubre el cálculo.';
+  const result = runGate(delegate(prompt), { config: enabledConfig() });
+  assert.ok(isDeny(result));
+  assert.ok(result.hookSpecificOutput.permissionDecisionReason.includes('E2E'));
+});
+
+test('bilingual control: an EN money brief with only unit coverage denies for the same reason as its ES equivalent', () => {
+  const es = 'Nivel: STANDARD\nImplementá el cobro de la cuota. Verificación: vitest cubre el cálculo.';
+  const en = 'Level: STANDARD\nImplement the fee charge. Verification: vitest covers the calculation.';
+  const resultEs = runGate(delegate(es), { config: enabledConfig() });
+  const resultEn = runGate(delegate(en), { config: enabledConfig() });
+  assert.ok(isDeny(resultEs));
+  assert.ok(isDeny(resultEn));
+  assert.ok(resultEs.hookSpecificOutput.permissionDecisionReason.includes('E2E'));
+  assert.ok(resultEn.hookSpecificOutput.permissionDecisionReason.includes('E2E'));
+});
+
+test('allows a Spanish brief that declares unit, E2E and negative cases with Spanish wording', () => {
+  const prompt =
+    'Nivel: STANDARD\nImplementá el cobro de la cuota. ' +
+    'Verificación: pruebas unitarias cubren el calculo. E2E: flujo completo de cobro. ' +
+    'Casos negativos: monto cero, sin saldo, entrada invalida.';
+  assert.equal(runGate(delegate(prompt), { config: enabledConfig() }), null);
+});
+
+test('e2eSignals param override makes a domain word mandatory that the default list omits', () => {
+  const prompt =
+    'Nivel: STANDARD\nImplementá el módulo de inventario. Verificación: vitest cubre el cálculo.';
+  const config = enabledConfig({ e2eSignals: ['inventario|inventory'] });
+  assert.ok(isDeny(runGate(delegate(prompt), { config })));
+});

package/plugins/gates/hooks/gates/tool-map/edge.edge.test.mjs

@@ -0,0 +1,62 @@
+// Edge-case probe for tool-map. Previously the same Edit/new_string content-field gap
+// as feature-catalog/sdd-specs meant a legitimately-audited tool created/edited via
+// Edit's `new_string` was never recorded in .ai/tool-map.json, so reuse-before-build
+// kept re-blocking a tool that was already cleared once. Migrated to
+// writtenContentOf()/writtenPathOf() (hook-io.mjs), which read new_string, so this is
+// now recorded the same as a Write.
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, existsSync, readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function runGate(payload) {
+  const project = mkdtempSync(join(tmpdir(), 'tool-map-edge-'));
+  mkdirSync(join(project, '.git'));
+  mkdirSync(join(project, '.ai'));
+  writeFileSync(
+    join(project, '.ai', 'config.json'),
+    JSON.stringify({ gates: { maintainToolMap: true } }),
+  );
+  execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return { mapPath: join(project, '.ai', 'tool-map.json') };
+}
+
+test('FIXED: an audited tool written via Edit (new_string) is now recorded', () => {
+  const payload = {
+    tool_name: 'Edit',
+    tool_input: {
+      file_path: 'scripts/new-tool.mjs',
+      old_string: '',
+      new_string: '// audited: nothing does this\nexport function parse(){}',
+    },
+  };
+  const { mapPath } = runGate(payload);
+  assert.ok(
+    existsSync(mapPath),
+    'writtenContentOf must read new_string so an Edit-created tool is persisted',
+  );
+  const map = JSON.parse(readFileSync(mapPath, 'utf8'));
+  assert.equal(map.tools[0].path, 'scripts/new-tool.mjs');
+});
+
+test('OK: the equivalent Write-tool payload IS recorded (control)', () => {
+  const payload = {
+    tool_name: 'Write',
+    tool_input: {
+      file_path: 'scripts/new-tool.mjs',
+      content: '// audited: nothing does this\nexport function parse(){}',
+    },
+  };
+  const { mapPath } = runGate(payload);
+  assert.ok(existsSync(mapPath), 'control failed');
+});