@devrik-tools/claude-gates 0.2.0 → 0.3.0

package/plugins/gates/hooks/gates/forge-flow/test.mjs

@@ -1,135 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { DatabaseSync } from 'node:sqlite';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-// Builds a forge SQLite DB with the runs table and optional active run for a given cwd.
-function makeForgeDatabase(directory, activeCwd) {
-  const databasePath = join(directory, 'forge.db');
-  const database = new DatabaseSync(databasePath);
-  database.exec(
-    'CREATE TABLE runs (id TEXT, cwd TEXT, current_phase TEXT, status TEXT)',
-  );
-  if (activeCwd) {
-    database
-      .prepare(
-        'INSERT INTO runs (id, cwd, current_phase, status) VALUES (?,?,?,?)',
-      )
-      .run('r1', activeCwd, 'build', 'active');
-  }
-  database.close();
-  return databasePath;
-}
-
-// Runs the gate in a temp project. `adopted` writes the forge marker; `forgeDatabasePath` is
-// passed as the gate's param via config. HOME is isolated so the real global config is
-// never read. Returns the parsed deny output, or null when the gate allowed.
-function runGate(payload, { adopted, forgeDatabasePath, enabled = true } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'forge-flow-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'));
-  if (adopted) writeFileSync(join(project, '.ai', 'forge.json'), '{}');
-  const gateEntry = { enabled };
-  if (forgeDatabasePath) gateEntry.forgeDatabasePath = forgeDatabasePath;
-  writeFileSync(
-    join(project, '.ai', 'config.json'),
-    JSON.stringify({ gates: { requireForgeRunToEdit: gateEntry } }),
-  );
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return { output: out.trim() ? JSON.parse(out.trim()) : null, project };
-}
-
-function write(filePath) {
-  return {
-    tool_name: 'Write',
-    tool_input: { file_path: filePath, content: 'x' },
-  };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-test('a project that did NOT adopt forge is never blocked', () => {
-  const { output } = runGate(write('src/x.js'), { adopted: false });
-  assert.equal(output, null);
-});
-
-test('adopted forge, no active run: a write is denied', () => {
-  const home = mkdtempSync(join(tmpdir(), 'forge-db-'));
-  const databasePath = makeForgeDatabase(home); // no active run
-  const { output } = runGate(write('src/x.js'), {
-    adopted: true,
-    forgeDatabasePath: databasePath,
-  });
-  assert.ok(isDeny(output));
-});
-
-test('adopted forge, active run for this project: the write is allowed', () => {
-  // The run's cwd must equal the project root the gate resolves. Run once to learn the
-  // project path, then rebuild the DB with that cwd — the helper makes a fresh project each
-  // call, so we seed the DB against the project it actually created.
-  const project = mkdtempSync(join(tmpdir(), 'forge-flow-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'));
-  writeFileSync(join(project, '.ai', 'forge.json'), '{}');
-  const home = mkdtempSync(join(tmpdir(), 'forge-db-'));
-  const databasePath = makeForgeDatabase(home, project); // active run whose cwd = this project
-  writeFileSync(
-    join(project, '.ai', 'config.json'),
-    JSON.stringify({
-      gates: {
-        requireForgeRunToEdit: {
-          enabled: true,
-          forgeDatabasePath: databasePath,
-        },
-      },
-    }),
-  );
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(write('src/x.js')),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  assert.equal(out.trim(), '', 'allowed: no output');
-});
-
-test('adopted forge but DB missing: denied (no runs at all)', () => {
-  const { output } = runGate(write('src/x.js'), {
-    adopted: true,
-    forgeDatabasePath: join(tmpdir(), 'does-not-exist', 'forge.db'),
-  });
-  assert.ok(isDeny(output));
-});
-
-test('disabled by config: not blocked even in an adopted project', () => {
-  const home = mkdtempSync(join(tmpdir(), 'forge-db-'));
-  const databasePath = makeForgeDatabase(home);
-  const { output } = runGate(write('src/x.js'), {
-    adopted: true,
-    forgeDatabasePath: databasePath,
-    enabled: false,
-  });
-  assert.equal(output, null);
-});
-
-test('a read-only tool (no write/shell) is never blocked', () => {
-  const home = mkdtempSync(join(tmpdir(), 'forge-db-'));
-  const databasePath = makeForgeDatabase(home);
-  const { output } = runGate(
-    { tool_name: 'Read', tool_input: { file_path: 'src/x.js' } },
-    { adopted: true, forgeDatabasePath: databasePath },
-  );
-  assert.equal(output, null);
-});

package/plugins/gates/hooks/gates/implementation-pipeline/edge.edge.test.mjs

@@ -1,66 +0,0 @@
-// Edge-case probe for implementation-pipeline. Previously the prompt was read only
-// from toolInput.prompt/Prompt/task, so a Task delegation carrying its brief in
-// `description` bypassed the pipeline check entirely. Migrated to
-// delegationPromptOf() (hook-io.mjs), which also reads description/instructions/
-// message/input, so this is now caught.
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'implementation-pipeline-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-function enabledConfig() {
-  return { gates: { requireImplementationPipeline: true } };
-}
-
-test('FIXED: a Task delegation carrying its brief in `description` is now checked', () => {
-  const payload = {
-    tool_name: 'Task',
-    tool_input: {
-      description: 'Nivel: STANDARD\nImplementá el checkout.',
-      subagent_type: 'backend',
-    },
-  };
-  assert.ok(
-    isDeny(runGate(payload, { config: enabledConfig() })),
-    'delegationPromptOf reads description and the missing-pipeline-stages deny fires',
-  );
-});
-
-test('OK: the equivalent payload using `prompt` IS caught (control)', () => {
-  const payload = {
-    tool_name: 'Task',
-    tool_input: {
-      prompt: 'Nivel: STANDARD\nImplementá el checkout.',
-      subagent_type: 'backend',
-    },
-  };
-  assert.ok(
-    isDeny(runGate(payload, { config: enabledConfig() })),
-    'control failed',
-  );
-});

package/plugins/gates/hooks/gates/implementation-pipeline/test.mjs

@@ -1,86 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'implementation-pipeline-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function delegate(prompt, subagentType = 'backend') {
-  return {
-    tool_name: 'Agent',
-    tool_input: { prompt, subagent_type: subagentType },
-  };
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-function enabledConfig(extraParameters) {
-  return {
-    gates: {
-      requireImplementationPipeline: extraParameters
-        ? { enabled: true, ...extraParameters }
-        : true,
-    },
-  };
-}
-
-test('disabled by default: a builder delegation with no pipeline stages is allowed', () => {
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  assert.equal(runGate(delegate(prompt)), null);
-});
-
-test('denies a builder delegation missing all three pipeline stages', () => {
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  assert.ok(isDeny(runGate(delegate(prompt), { config: enabledConfig() })));
-});
-
-test('allows a builder delegation that declares all three stages', () => {
-  const prompt =
-    'Nivel: STANDARD\nImplementá el checkout. Contexto verificado: .ai/features/checkout/brief.md. ' +
-    'Verificación: npm test debe pasar. Revisión: el principal revisa el diff antes de cerrar.';
-  assert.equal(runGate(delegate(prompt), { config: enabledConfig() }), null);
-});
-
-test('exempt subagent type (scout) is never held to the pipeline', () => {
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  assert.equal(
-    runGate(delegate(prompt, 'scout'), { config: enabledConfig() }),
-    null,
-  );
-});
-
-test('a prompt that only describes, does not order, is exempt via QUESTION level', () => {
-  const prompt = 'Nivel: QUESTION\nExplicá cómo funciona el checkout hoy.';
-  assert.equal(runGate(delegate(prompt), { config: enabledConfig() }), null);
-});
-
-test('builderSubagents param override holds a custom type to the pipeline', () => {
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  const config = enabledConfig({ builderSubagents: ['custom-builder'] });
-  assert.ok(isDeny(runGate(delegate(prompt, 'custom-builder'), { config })));
-  // a type NOT in the overridden list is not assumed to be a builder
-  assert.equal(runGate(delegate(prompt, 'backend'), { config }), null);
-});

package/plugins/gates/hooks/gates/intent-flow/intent-flow.edge.test.mjs

@@ -1,96 +0,0 @@
-// Edge-case audit for intent-flow. Each test demonstrates a confirmed BUG or an OK.
-// Run: node --test intent-flow.edge.test.mjs
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'intent-flow-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLED = { config: { gates: { requireScopeListBeforeDelegating: true } } };
-
-const SENSITIVE_NO_SCOPE =
-  'Implementa el cobro del pago con la nueva pasarela de dinero para el checkout.';
-
-test('FIXED: a delegation tool name outside the native list is now caught via toolInGroups (MCP delegation signal)', () => {
-  const result = runGate(
-    { tool_name: 'mcp__orchestrator__spawn_agent', tool_input: { prompt: SENSITIVE_NO_SCOPE } },
-    ENABLED,
-  );
-  assert.ok(isDeny(result), 'gate now denies the sensitive-no-scope prompt under the MCP tool name too');
-});
-
-test('FIXED: prompt carried in a field other than prompt/description/task is now read via delegationPromptOf', () => {
-  const result = runGate(
-    { tool_name: 'Agent', tool_input: { instructions: SENSITIVE_NO_SCOPE } },
-    ENABLED,
-  );
-  assert.ok(isDeny(result), 'gate now sees the prompt under "instructions" and denies it for missing scope list');
-});
-
-test('FIXED: a mutation-risk signal in the prompt overrides a whitelisted read-only subagent name', () => {
-  // isReadOnlySubagent now voids the name-based exemption whenever the prompt itself
-  // carries a mutation-risk signal (money/auth/data/write/deploy): a subagent named
-  // "explore" cannot exempt a real money-mutation delegation just by using that label.
-  const result = runGate(
-    { tool_name: 'Agent', tool_input: { prompt: SENSITIVE_NO_SCOPE, subagent_type: 'explore' } },
-    ENABLED,
-  );
-  assert.ok(
-    isDeny(result),
-    'gate no longer exempts a real money-mutation delegation solely because subagent_type says "explore"',
-  );
-});
-
-test('OK: a whitelisted read-only subagent name with no mutation-risk signal is still exempt', () => {
-  assert.equal(
-    runGate(
-      {
-        tool_name: 'Agent',
-        tool_input: {
-          prompt: 'Arregla el boton que no cambia de color al pasar el mouse.',
-          subagent_type: 'explore',
-        },
-      },
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('OK: same sensitive prompt without a read-only subagent name is denied', () => {
-  const result = runGate({ tool_name: 'Agent', tool_input: { prompt: SENSITIVE_NO_SCOPE } }, ENABLED);
-  assert.ok(isDeny(result));
-});
-
-test('OK: Task and invoke_subagent tool names are both covered', () => {
-  assert.ok(isDeny(runGate({ tool_name: 'Task', tool_input: { prompt: SENSITIVE_NO_SCOPE } }, ENABLED)));
-  assert.ok(
-    isDeny(
-      runGate({ tool_name: 'invoke_subagent', tool_input: { prompt: SENSITIVE_NO_SCOPE } }, ENABLED),
-    ),
-  );
-});

package/plugins/gates/hooks/gates/intent-flow/test.mjs

@@ -1,165 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'intent-flow-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function delegate(prompt, extra = {}) {
-  return { tool_name: 'Agent', tool_input: { prompt, ...extra } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLED = {
-  config: { gates: { requireScopeListBeforeDelegating: true } },
-};
-
-test('denies implementing a payment change with real intent and no scope list', () => {
-  const result = runGate(
-    delegate(
-      'Implementa el cobro del pago con la nueva pasarela de dinero para el checkout.',
-    ),
-    ENABLED,
-  );
-  assert.ok(isDeny(result));
-});
-
-test('bilingual control: an EN payment brief with no scope list denies exactly like its ES equivalent', () => {
-  const es = delegate(
-    'Implementa el cobro del pago con la nueva pasarela de dinero para el checkout.',
-  );
-  const en = delegate(
-    'Implement the payment charge with the new money gateway for checkout.',
-  );
-  assert.ok(isDeny(runGate(es, ENABLED)));
-  assert.ok(isDeny(runGate(en, ENABLED)));
-});
-
-test('allows the same request once IN SCOPE / OUT OF SCOPE / EDGE CASES are declared', () => {
-  const prompt = [
-    'Implementa el cobro del pago con la nueva pasarela de dinero para el checkout.',
-    '',
-    'QUE SI (alcance): integrar el nuevo proveedor de pago en el checkout.',
-    'QUE NO (fuera de alcance): no tocar el flujo de reembolsos.',
-    'EDGE CASES: no aplican casos borde adicionales.',
-  ].join('\n');
-  assert.equal(runGate(delegate(prompt), ENABLED), null);
-});
-
-test('denies hard when a high-impact request declares an unresolved unknown', () => {
-  const prompt = [
-    'Implementa el cobro del pago con la nueva pasarela; todavia no esta claro que hacer con reembolsos parciales, unknown.',
-    'QUE SI: cobro basico. QUE NO: reembolsos. EDGE CASES: ninguno.',
-  ].join('\n');
-  assert.ok(isDeny(runGate(delegate(prompt), ENABLED)));
-});
-
-test('allows a request mentioning payment only as documentation topic', () => {
-  assert.equal(
-    runGate(
-      delegate(
-        'Crea un documento README.md que explique como funciona el pago y la autenticacion del sistema para el equipo nuevo.',
-      ),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('allows a normal implementation request with no high-impact signal', () => {
-  assert.equal(
-    runGate(
-      delegate(
-        'Arregla el boton que no cambia de color al pasar el mouse en la pagina de inicio.',
-      ),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-// A whitelisted read-only subagent name is now void whenever the prompt itself carries
-// a mutation-risk signal (money/auth/data/write/deploy): the label is self-declared,
-// never a verified capability, and a real risk signal in the text must win over it
-// (bug fixed in this gate; see intent-flow.edge.test.mjs). So a prompt naming "plan" is
-// only exempt when it carries no such signal.
-test('allows a read-only subagent when the prompt carries no mutation-risk signal', () => {
-  assert.equal(
-    runGate(
-      delegate('Explica como funciona el flujo de checkout actual.', {
-        subagent_type: 'plan',
-      }),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('a read-only subagent name no longer exempts a real money-mutation prompt', () => {
-  assert.ok(
-    isDeny(
-      runGate(
-        delegate(
-          'Implementa el cobro del pago con la nueva pasarela de dinero.',
-          {
-            subagent_type: 'plan',
-          },
-        ),
-        ENABLED,
-      ),
-    ),
-  );
-});
-
-test('disabled by config: the gate does not run', () => {
-  assert.equal(
-    runGate(
-      delegate('Implementa el cobro del pago con la nueva pasarela de dinero.'),
-      {
-        config: { gates: { requireScopeListBeforeDelegating: false } },
-      },
-    ),
-    null,
-  );
-});
-
-test('project highImpactPatterns override narrows what counts as high-impact', () => {
-  const config = {
-    gates: {
-      requireScopeListBeforeDelegating: {
-        enabled: true,
-        highImpactPatterns: ['pagin[ao]ci[oó]n'],
-      },
-    },
-  };
-  const prompt =
-    'Implementa el cobro del pago con la nueva pasarela de dinero.';
-  // With the default patterns (money/payment), this same prompt is denied.
-  assert.ok(isDeny(runGate(delegate(prompt), ENABLED)));
-  // No longer matches "dinero/pago" as high-impact once overridden, so no scope list
-  // is required and the gate allows.
-  assert.equal(runGate(delegate(prompt), { config }), null);
-});

package/plugins/gates/hooks/gates/lint-commit/test.mjs

@@ -1,85 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function bashPayload(command) {
-  return { tool_name: 'Bash', tool_input: { command } };
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-/** Runs the gate in a temp project. HOME isolated so the real global config is not read. */
-function runGate(project, payload, { enabled = true } = {}) {
-  mkdirSync(join(project, '.git'), { recursive: true });
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(
-    join(project, '.ai', 'config.json'),
-    JSON.stringify({ gates: { blockCommitWithFailingLint: { enabled } } }),
-  );
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function projectWithLintScript(exitCode) {
-  const project = mkdtempSync(join(tmpdir(), 'lint-commit-'));
-  writeFileSync(
-    join(project, 'package.json'),
-    JSON.stringify({
-      name: 'fixture',
-      scripts: {
-        lint: `node -e "process.exit(${exitCode})"`,
-      },
-    }),
-  );
-  return project;
-}
-
-test('lint exits non-zero: git commit is denied with tail of output', () => {
-  const project = projectWithLintScript(1);
-  const result = runGate(project, bashPayload('git commit -m "x"'));
-  assert.ok(isDeny(result), 'expected a deny result');
-  assert.match(result.hookSpecificOutput.permissionDecisionReason, /Lint failed/);
-});
-
-test('lint exits zero: git commit is allowed', () => {
-  const project = projectWithLintScript(0);
-  const result = runGate(project, bashPayload('git commit -m "x"'));
-  assert.equal(result, null);
-});
-
-test('no package.json / no lint script: commit is allowed (never invented)', () => {
-  const project = mkdtempSync(join(tmpdir(), 'lint-commit-nolint-'));
-  const result = runGate(project, bashPayload('git commit -m "x"'));
-  assert.equal(result, null);
-});
-
-test('a non-commit shell command is never blocked, even with failing lint', () => {
-  const project = projectWithLintScript(1);
-  const result = runGate(project, bashPayload('git status'));
-  assert.equal(result, null);
-});
-
-test('git -C <path> commit is still recognized as a commit (global-option bypass closed)', () => {
-  const project = projectWithLintScript(1);
-  const result = runGate(project, bashPayload(`git -C ${project} commit -m "x"`));
-  assert.ok(isDeny(result));
-});
-
-test('gate disabled: commit is allowed even with failing lint', () => {
-  const project = projectWithLintScript(1);
-  const result = runGate(project, bashPayload('git commit -m "x"'), { enabled: false });
-  assert.equal(result, null);
-});