@devrik-tools/claude-gates 0.1.2 → 0.2.0

package/plugins/gates/hooks/lib/__tests__/hook-io.test.mjs

@@ -1,154 +1,210 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { test } from 'node:test';
-import { pathToFileURL } from 'node:url';
-import {
-  toolNamesFor,
-  matcherFor,
-  toolNameOf,
-  sessionIdOf,
-  toolInputOf,
-} from '../hook-io.mjs';
-
-// deny/warn/allow/runGate call process.exit and cannot be invoked in-process without
-// killing the test runner. They are exercised here as a child process instead; each
-// gate's own tests additionally cover runGate's wiring through its real check function.
-
-test('toolNamesFor expands a single group', () => {
-  assert.deepEqual(toolNamesFor(['question']), ['AskUserQuestion']);
-});
-
-test('toolNamesFor expands multiple groups and de-duplicates overlapping names', () => {
-  const names = toolNamesFor(['write', 'execution']);
-  // 'execution' repeats every 'write' tool plus Bash/run_command/mcp__ide__executeCode.
-  assert.equal(names.filter((name) => name === 'Write').length, 1);
-  assert.ok(names.includes('Write'));
-  assert.ok(names.includes('Bash'));
-  assert.ok(names.includes('mcp__ide__executeCode'));
-});
-
-test('toolNamesFor returns an empty list for an empty group set', () => {
-  assert.deepEqual(toolNamesFor([]), []);
-});
-
-test('toolNamesFor ignores an unknown group name', () => {
-  assert.deepEqual(toolNamesFor(['not-a-real-group']), []);
-});
-
-test('matcherFor joins tool names with a pipe', () => {
-  assert.equal(matcherFor(['question']), 'AskUserQuestion');
-  assert.equal(matcherFor(['shell']), 'Bash|run_command');
-});
-
-test('matcherFor returns an empty string for an empty group set', () => {
-  assert.equal(matcherFor([]), '');
-});
-
-test('toolNameOf reads tool_name, falls back to name, defaults to empty string', () => {
-  assert.equal(toolNameOf(JSON.stringify({ tool_name: 'Bash' })), 'Bash');
-  assert.equal(toolNameOf(JSON.stringify({ name: 'Edit' })), 'Edit');
-  assert.equal(
-    toolNameOf(JSON.stringify({ tool_name: 'Bash', name: 'Edit' })),
-    'Bash',
-  );
-  assert.equal(toolNameOf(JSON.stringify({})), '');
-});
-
-test('toolNameOf returns null for unparseable payloads', () => {
-  assert.equal(toolNameOf('{not json'), null);
-  assert.equal(toolNameOf(undefined), null);
-});
-
-test('sessionIdOf reads session_id or returns null when absent/unparseable', () => {
-  assert.equal(sessionIdOf(JSON.stringify({ session_id: 'abc123' })), 'abc123');
-  assert.equal(sessionIdOf(JSON.stringify({})), null);
-  assert.equal(sessionIdOf('{not json'), null);
-});
-
-test('toolInputOf reads tool_input, falls back to input, defaults to {}', () => {
-  assert.deepEqual(
-    toolInputOf(JSON.stringify({ tool_input: { command: 'ls' } })),
-    { command: 'ls' },
-  );
-  assert.deepEqual(toolInputOf(JSON.stringify({ input: { file: 'a' } })), {
-    file: 'a',
-  });
-  assert.deepEqual(
-    toolInputOf(JSON.stringify({ tool_input: { a: 1 }, input: { b: 2 } })),
-    { a: 1 },
-  );
-  assert.deepEqual(toolInputOf(JSON.stringify({})), {});
-});
-
-test('toolInputOf returns {} for unparseable payloads', () => {
-  assert.deepEqual(toolInputOf('{not json'), {});
-  assert.deepEqual(toolInputOf(undefined), {});
-});
-
-const hookIoModuleUrl = pathToFileURL(
-  new URL('../hook-io.mjs', import.meta.url).pathname.replace(
-    /^\/([A-Za-z]:)/,
-    '$1',
-  ),
-).href;
-
-/** Runs `body` (a callback expression referencing `mod`) in a child process after
- *  dynamically importing hook-io.mjs there, so process.exit-calling exports can be
- *  exercised without killing the test runner. */
-function runInChildProcess(body, execOptions) {
-  const script = `import('${hookIoModuleUrl}').then((mod) => { ${body} });`;
-  return execFileSync(process.execPath, ['--input-type=module', '-e', script], {
-    encoding: 'utf8',
-    ...execOptions,
-  });
-}
-
-test('readHookPayload reads whatever is piped on stdin, including empty input', () => {
-  const output = runInChildProcess(
-    'process.stdout.write(JSON.stringify(mod.readHookPayload()))',
-    { input: '{"tool_name":"Bash"}' },
-  );
-  assert.equal(output, JSON.stringify('{"tool_name":"Bash"}'));
-
-  const emptyOutput = runInChildProcess(
-    'process.stdout.write(JSON.stringify(mod.readHookPayload()))',
-    { stdio: ['ignore', 'pipe', 'pipe'] },
-  );
-  // With no stdin available, readFileSync(0) resolves to an empty string rather than
-  // throwing on this platform, so readHookPayload returns '' — not null. The null
-  // path (an unreadable fd 0) is exercised indirectly by every gate's own tests via
-  // runGate, since forcing an EBADF/EAGAIN on fd 0 portably from node:test is not
-  // reliable across platforms.
-  assert.equal(emptyOutput, JSON.stringify(''));
-});
-
-test('deny writes a permissionDecision:deny hookSpecificOutput and exits 0', () => {
-  const output = runInChildProcess("mod.deny('my-gate', 'because reasons')", {
-    input: '',
-  });
-  const parsed = JSON.parse(output);
-  assert.equal(parsed.hookSpecificOutput.hookEventName, 'PreToolUse');
-  assert.equal(parsed.hookSpecificOutput.permissionDecision, 'deny');
-  assert.equal(
-    parsed.hookSpecificOutput.permissionDecisionReason,
-    '[my-gate] because reasons',
-  );
-});
-
-test('warn writes additionalContext and exits 0', () => {
-  const output = runInChildProcess("mod.warn('my-gate', 'consider this')", {
-    input: '',
-  });
-  const parsed = JSON.parse(output);
-  assert.equal(parsed.hookSpecificOutput.hookEventName, 'PreToolUse');
-  assert.equal(
-    parsed.hookSpecificOutput.additionalContext,
-    '[my-gate] consider this',
-  );
-  assert.equal(parsed.hookSpecificOutput.permissionDecision, undefined);
-});
-
-test('allow exits 0 with no stdout', () => {
-  const output = runInChildProcess('mod.allow()', { input: '' });
-  assert.equal(output, '');
-});
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { test } from 'node:test';
+import { pathToFileURL } from 'node:url';
+import {
+  toolNamesFor,
+  matcherFor,
+  toolNameOf,
+  sessionIdOf,
+  toolInputOf,
+  toolInGroups,
+  writtenContentOf,
+  writtenPathOf,
+  delegationPromptOf,
+} from '../hook-io.mjs';
+
+// deny/warn/allow/runGate call process.exit and cannot be invoked in-process without
+// killing the test runner. They are exercised here as a child process instead; each
+// gate's own tests additionally cover runGate's wiring through its real check function.
+
+test('toolNamesFor expands a single group', () => {
+  assert.deepEqual(toolNamesFor(['question']), ['AskUserQuestion']);
+});
+
+test('toolNamesFor expands multiple groups and de-duplicates overlapping names', () => {
+  const names = toolNamesFor(['write', 'execution']);
+  // 'execution' repeats every 'write' tool plus Bash/run_command/mcp__ide__executeCode.
+  assert.equal(names.filter((name) => name === 'Write').length, 1);
+  assert.ok(names.includes('Write'));
+  assert.ok(names.includes('Bash'));
+  assert.ok(names.includes('mcp__ide__executeCode'));
+});
+
+test('toolNamesFor returns an empty list for an empty group set', () => {
+  assert.deepEqual(toolNamesFor([]), []);
+});
+
+test('toolNamesFor ignores an unknown group name', () => {
+  assert.deepEqual(toolNamesFor(['not-a-real-group']), []);
+});
+
+test('matcherFor joins native tool names with a pipe and always appends the mcp__.* clause', () => {
+  // The trailing `mcp__.*` makes Claude Code route EVERY MCP tool call to the hook, so the
+  // gate can classify it at runtime with toolInGroups. Without it, the hook is never even
+  // invoked for an MCP tool — the deepest layer of the MCP blind spot.
+  assert.equal(matcherFor(['question']), 'AskUserQuestion|mcp__.*');
+  assert.equal(matcherFor(['shell']), 'Bash|run_command|mcp__.*');
+});
+
+test('matcherFor still matches MCP tools even for an empty native group set', () => {
+  // An empty group means "no native names", but MCP tools must still reach the hook.
+  assert.equal(matcherFor([]), 'mcp__.*');
+});
+
+test('toolInGroups matches native names exactly and case-insensitively', () => {
+  assert.equal(toolInGroups('Write', ['write']), true);
+  assert.equal(toolInGroups('write', ['write']), true); // case-insensitive
+  assert.equal(toolInGroups('AskUserQuestion', ['question']), true);
+  assert.equal(toolInGroups('Bash', ['write']), false); // wrong group
+  assert.equal(toolInGroups('', ['write']), false); // empty tool name
+});
+
+test('toolInGroups classifies MCP tools by their action segment', () => {
+  assert.equal(toolInGroups('mcp__filesystem__write_file', ['write']), true);
+  assert.equal(toolInGroups('mcp__fs__edit_file', ['write']), true);
+  assert.equal(toolInGroups('mcp__shell__exec', ['shell']), true);
+  assert.equal(toolInGroups('mcp__x__ask_user_confirmation', ['question']), true);
+  assert.equal(toolInGroups('mcp__orchestrator__spawn_agent', ['delegation']), true);
+  // A read-only MCP tool must NOT match a write/shell group.
+  assert.equal(toolInGroups('mcp__fs__read_file', ['write', 'shell']), false);
+  // Malformed mcp name (no action segment) does not match.
+  assert.equal(toolInGroups('mcp__server', ['write']), false);
+});
+
+test('writtenContentOf reads content across native and MCP field shapes', () => {
+  assert.equal(writtenContentOf({ content: 'a' }), 'a'); // Write
+  assert.equal(writtenContentOf({ new_string: 'b' }), 'b'); // Edit
+  assert.equal(writtenContentOf({ new_source: 'c' }), 'c'); // NotebookEdit
+  assert.equal(writtenContentOf({ new_content: 'd' }), 'd'); // replace_file_content
+  assert.equal(writtenContentOf({ text: 'e' }), 'e'); // an MCP shape
+  assert.equal(
+    writtenContentOf({ edits: [{ new_string: 'x' }, { new_string: 'y' }] }),
+    'x\ny',
+  ); // MultiEdit
+  assert.equal(writtenContentOf({}), '');
+  assert.equal(writtenContentOf(null), '');
+});
+
+test('writtenPathOf reads the target path across field shapes', () => {
+  assert.equal(writtenPathOf({ file_path: 'a.js' }), 'a.js');
+  assert.equal(writtenPathOf({ path: 'b.js' }), 'b.js');
+  assert.equal(writtenPathOf({ notebook_path: 'n.ipynb' }), 'n.ipynb');
+  assert.equal(writtenPathOf({}), '');
+});
+
+test('delegationPromptOf reads the brief across field shapes', () => {
+  assert.equal(delegationPromptOf({ prompt: 'a' }), 'a');
+  assert.equal(delegationPromptOf({ description: 'b' }), 'b'); // Task
+  assert.equal(delegationPromptOf({ instructions: 'c' }), 'c'); // an MCP shape
+  assert.equal(delegationPromptOf({}), '');
+});
+
+test('toolNameOf reads tool_name, falls back to name, defaults to empty string', () => {
+  assert.equal(toolNameOf(JSON.stringify({ tool_name: 'Bash' })), 'Bash');
+  assert.equal(toolNameOf(JSON.stringify({ name: 'Edit' })), 'Edit');
+  assert.equal(
+    toolNameOf(JSON.stringify({ tool_name: 'Bash', name: 'Edit' })),
+    'Bash',
+  );
+  assert.equal(toolNameOf(JSON.stringify({})), '');
+});
+
+test('toolNameOf returns null for unparseable payloads', () => {
+  assert.equal(toolNameOf('{not json'), null);
+  assert.equal(toolNameOf(undefined), null);
+});
+
+test('sessionIdOf reads session_id or returns null when absent/unparseable', () => {
+  assert.equal(sessionIdOf(JSON.stringify({ session_id: 'abc123' })), 'abc123');
+  assert.equal(sessionIdOf(JSON.stringify({})), null);
+  assert.equal(sessionIdOf('{not json'), null);
+});
+
+test('toolInputOf reads tool_input, falls back to input, defaults to {}', () => {
+  assert.deepEqual(
+    toolInputOf(JSON.stringify({ tool_input: { command: 'ls' } })),
+    { command: 'ls' },
+  );
+  assert.deepEqual(toolInputOf(JSON.stringify({ input: { file: 'a' } })), {
+    file: 'a',
+  });
+  assert.deepEqual(
+    toolInputOf(JSON.stringify({ tool_input: { a: 1 }, input: { b: 2 } })),
+    { a: 1 },
+  );
+  assert.deepEqual(toolInputOf(JSON.stringify({})), {});
+});
+
+test('toolInputOf returns {} for unparseable payloads', () => {
+  assert.deepEqual(toolInputOf('{not json'), {});
+  assert.deepEqual(toolInputOf(undefined), {});
+});
+
+const hookIoModuleUrl = pathToFileURL(
+  new URL('../hook-io.mjs', import.meta.url).pathname.replace(
+    /^\/([A-Za-z]:)/,
+    '$1',
+  ),
+).href;
+
+/** Runs `body` (a callback expression referencing `mod`) in a child process after
+ *  dynamically importing hook-io.mjs there, so process.exit-calling exports can be
+ *  exercised without killing the test runner. */
+function runInChildProcess(body, execOptions) {
+  const script = `import('${hookIoModuleUrl}').then((mod) => { ${body} });`;
+  return execFileSync(process.execPath, ['--input-type=module', '-e', script], {
+    encoding: 'utf8',
+    ...execOptions,
+  });
+}
+
+test('readHookPayload reads whatever is piped on stdin, including empty input', () => {
+  const output = runInChildProcess(
+    'process.stdout.write(JSON.stringify(mod.readHookPayload()))',
+    { input: '{"tool_name":"Bash"}' },
+  );
+  assert.equal(output, JSON.stringify('{"tool_name":"Bash"}'));
+
+  const emptyOutput = runInChildProcess(
+    'process.stdout.write(JSON.stringify(mod.readHookPayload()))',
+    { stdio: ['ignore', 'pipe', 'pipe'] },
+  );
+  // With no stdin available, readFileSync(0) resolves to an empty string rather than
+  // throwing on this platform, so readHookPayload returns '' — not null. The null
+  // path (an unreadable fd 0) is exercised indirectly by every gate's own tests via
+  // runGate, since forcing an EBADF/EAGAIN on fd 0 portably from node:test is not
+  // reliable across platforms.
+  assert.equal(emptyOutput, JSON.stringify(''));
+});
+
+test('deny writes a permissionDecision:deny hookSpecificOutput and exits 0', () => {
+  const output = runInChildProcess("mod.deny('my-gate', 'because reasons')", {
+    input: '',
+  });
+  const parsed = JSON.parse(output);
+  assert.equal(parsed.hookSpecificOutput.hookEventName, 'PreToolUse');
+  assert.equal(parsed.hookSpecificOutput.permissionDecision, 'deny');
+  assert.equal(
+    parsed.hookSpecificOutput.permissionDecisionReason,
+    '[my-gate] because reasons',
+  );
+});
+
+test('warn writes additionalContext and exits 0', () => {
+  const output = runInChildProcess("mod.warn('my-gate', 'consider this')", {
+    input: '',
+  });
+  const parsed = JSON.parse(output);
+  assert.equal(parsed.hookSpecificOutput.hookEventName, 'PreToolUse');
+  assert.equal(
+    parsed.hookSpecificOutput.additionalContext,
+    '[my-gate] consider this',
+  );
+  assert.equal(parsed.hookSpecificOutput.permissionDecision, undefined);
+});
+
+test('allow exits 0 with no stdout', () => {
+  const output = runInChildProcess('mod.allow()', { input: '' });
+  assert.equal(output, '');
+});

package/plugins/gates/hooks/lib/__tests__/signals.test.mjs

@@ -0,0 +1,114 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import {
+  RISK_SIGNAL,
+  MONEY_SIGNAL,
+  AUTH_SIGNAL,
+  DESTRUCTIVE_DEPLOY_SIGNAL,
+  CONJECTURE,
+  PERSISTENCE_VERB,
+  withUnicodeWordBoundary,
+} from '../signals.mjs';
+
+// ── RISK_SIGNAL ──────────────────────────────────────────────────────────────────────
+
+test('RISK_SIGNAL matches money terms in EN and ES', () => {
+  assert.ok(RISK_SIGNAL.test('update the payment flow'));
+  assert.ok(RISK_SIGNAL.test('actualizar el flujo de pago'));
+  assert.ok(RISK_SIGNAL.test('mover el saldo de una cuenta'));
+  assert.ok(RISK_SIGNAL.test('move the account balance'));
+});
+
+test('RISK_SIGNAL matches auth terms in EN and ES', () => {
+  assert.ok(RISK_SIGNAL.test('reset the user password'));
+  assert.ok(RISK_SIGNAL.test('resetear la contrasena del usuario'));
+  assert.ok(RISK_SIGNAL.test('resetear la contraseña del usuario'));
+  assert.ok(RISK_SIGNAL.test('cambiar la sesion activa'));
+  assert.ok(RISK_SIGNAL.test('cambiar la sesión activa'));
+});
+
+test('RISK_SIGNAL matches destructive/deploy terms in EN and ES', () => {
+  assert.ok(RISK_SIGNAL.test('deploy to production'));
+  assert.ok(RISK_SIGNAL.test('desplegar a produccion'));
+  assert.ok(RISK_SIGNAL.test('truncate the orders table'));
+  assert.ok(RISK_SIGNAL.test('eliminar la tabla de pedidos'));
+  assert.ok(RISK_SIGNAL.test('run the migration'));
+  assert.ok(RISK_SIGNAL.test('correr la migracion'));
+});
+
+test('bilingual control: an ES risk brief matches exactly like its EN equivalent', () => {
+  const es = 'implementa el endpoint para mover el saldo de una cuenta bancaria';
+  const en = 'implement the endpoint to move the balance of a bank account';
+  assert.equal(RISK_SIGNAL.test(es), RISK_SIGNAL.test(en));
+  assert.ok(RISK_SIGNAL.test(es));
+});
+
+test('RISK_SIGNAL does not fire on neutral text', () => {
+  assert.equal(RISK_SIGNAL.test('add a tooltip to the button'), false);
+  assert.equal(RISK_SIGNAL.test('agregar un tooltip al boton'), false);
+});
+
+test('RISK_SIGNAL false-positive guard: short terms require a full word', () => {
+  // "auth" inside "autor", "prod" inside "producto", "token" inside "tokenizer".
+  assert.equal(RISK_SIGNAL.test('the autor of this book'), false);
+  assert.equal(RISK_SIGNAL.test('el autor de este libro'), false);
+  assert.equal(RISK_SIGNAL.test('compra este producto'), false);
+  assert.equal(RISK_SIGNAL.test('buy this product'), false);
+  assert.equal(RISK_SIGNAL.test('the tokenizer splits words'), false);
+});
+
+test('MONEY_SIGNAL / AUTH_SIGNAL / DESTRUCTIVE_DEPLOY_SIGNAL are independently usable', () => {
+  assert.ok(MONEY_SIGNAL.test('pago'));
+  assert.equal(MONEY_SIGNAL.test('auth'), false);
+  assert.ok(AUTH_SIGNAL.test('token'));
+  assert.equal(AUTH_SIGNAL.test('pago'), false);
+  assert.ok(DESTRUCTIVE_DEPLOY_SIGNAL.test('produccion'));
+  assert.equal(DESTRUCTIVE_DEPLOY_SIGNAL.test('pago'), false);
+});
+
+// ── CONJECTURE ───────────────────────────────────────────────────────────────────────
+
+test('CONJECTURE matches EN and ES conjecture phrasing', () => {
+  assert.ok(CONJECTURE.test('i assume the timezone is UTC'));
+  assert.ok(CONJECTURE.test('probably fine to skip this'));
+  assert.ok(CONJECTURE.test('supongo que esto funciona'));
+  assert.ok(CONJECTURE.test('asumo que el usuario ya esta logueado'));
+  assert.ok(CONJECTURE.test('deberia ser suficiente con esto'));
+  assert.ok(CONJECTURE.test('debería ser suficiente con esto'));
+  assert.ok(CONJECTURE.test('creo que esto anda bien'));
+});
+
+test('bilingual control: ES and EN conjecture brief both trigger', () => {
+  const es = 'creo que el usuario ya esta autenticado, no lo verifique';
+  const en = 'i assume the user is already authenticated, did not verify it';
+  assert.equal(CONJECTURE.test(es), CONJECTURE.test(en));
+  assert.ok(CONJECTURE.test(es));
+});
+
+test('CONJECTURE does not fire on neutral confirmed statements', () => {
+  assert.equal(CONJECTURE.test('verified: the timezone is UTC per config.json'), false);
+  assert.equal(CONJECTURE.test('confirmado: el usuario esta autenticado'), false);
+});
+
+// ── PERSISTENCE_VERB ─────────────────────────────────────────────────────────────────
+
+test('PERSISTENCE_VERB matches EN and ES persistence instructions', () => {
+  assert.ok(PERSISTENCE_VERB.test('save this to state.json'));
+  assert.ok(PERSISTENCE_VERB.test('guarda esto en decision.md'));
+  assert.ok(PERSISTENCE_VERB.test('persist the result in the database'));
+  assert.ok(PERSISTENCE_VERB.test('escribi esto en el archivo'));
+  assert.ok(PERSISTENCE_VERB.test('anota el resultado en el log'));
+});
+
+test('PERSISTENCE_VERB does not fire on unrelated prose', () => {
+  assert.equal(PERSISTENCE_VERB.test('the button looks nice'), false);
+  assert.equal(PERSISTENCE_VERB.test('el boton se ve bien'), false);
+});
+
+// ── withUnicodeWordBoundary ──────────────────────────────────────────────────────────
+
+test('withUnicodeWordBoundary rejects a substring match', () => {
+  const pattern = withUnicodeWordBoundary('auth');
+  assert.ok(pattern.test('auth required'));
+  assert.equal(pattern.test('autor'), false);
+});