@devrik-tools/claude-gates 0.2.0 → 0.3.0

package/plugins/gates/hooks/gates/mandatory-flow/edge.edge.test.mjs

@@ -1,100 +0,0 @@
-// Edge-case probes for mandatory-flow. Previously: (1) the prompt was read only from
-// prompt/Prompt/task, so a Task delegation carrying its brief in `description`
-// bypassed the check (shared root cause with implementation-pipeline, test-matrix,
-// sdd-specs delegation check); (2) the ACTIVA pointer's slug was used unsanitized in
-// join(cwd, '.ai', 'pipeline', slug), so a slug with '..' segments let
-// hasTaskContract() resolve outside .ai/pipeline/ and accept an unrelated file
-// anywhere on disk as the active task's contract. Both are now fixed:
-// delegationPromptOf() reads description too, and readSlug() rejects any slug
-// containing a path separator or a '.'/'..' segment, treating it as empty (which
-// denies the same way a missing slug does).
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function makeProject() {
-  const project = mkdtempSync(join(tmpdir(), 'mandatory-flow-edge-'));
-  mkdirSync(join(project, '.git'));
-  return project;
-}
-
-function writeProjectConfig(project, config) {
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-}
-
-function runGate(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-function enableGate(project) {
-  writeProjectConfig(project, { gates: { requireLiveTaskWhenImplementing: true } });
-}
-
-test('FIXED: a Task delegation carrying its brief in `description` is now checked', () => {
-  const project = makeProject();
-  enableGate(project);
-  // No ACTIVA pointer at all -- with delegationPromptOf reading `description`, this
-  // now reaches checkLiveTask and denies for the missing pointer.
-  const payload = {
-    tool_name: 'Task',
-    tool_input: {
-      description: 'Nivel: STANDARD\nImplementá el checkout.',
-      subagent_type: 'backend',
-    },
-  };
-  assert.ok(
-    isDeny(runGate(project, payload)),
-    'delegationPromptOf reads description and the no-live-task deny fires',
-  );
-});
-
-test('OK: the equivalent payload using `prompt` with no ACTIVA pointer IS denied (control)', () => {
-  const project = makeProject();
-  enableGate(project);
-  const payload = {
-    tool_name: 'Task',
-    tool_input: {
-      prompt: 'Nivel: STANDARD\nImplementá el checkout.',
-      subagent_type: 'backend',
-    },
-  };
-  assert.ok(isDeny(runGate(project, payload)), 'control failed');
-});
-
-test('FIXED: a path-traversal slug in ACTIVA no longer lets an unrelated file satisfy hasTaskContract', () => {
-  const project = makeProject();
-  enableGate(project);
-  mkdirSync(join(project, '.ai', 'pipeline'), { recursive: true });
-  mkdirSync(join(project, 'evil'), { recursive: true });
-  writeFileSync(join(project, 'evil', 'asserts.md'), 'unrelated content');
-  writeFileSync(join(project, '.ai', 'pipeline', 'ACTIVA'), '../../evil');
-  const payload = {
-    tool_name: 'Agent',
-    tool_input: {
-      prompt: 'Nivel: STANDARD\nImplementá el checkout.',
-      subagent_type: 'backend',
-    },
-  };
-  assert.ok(
-    isDeny(runGate(project, payload)),
-    'readSlug must reject the traversal slug (treated as empty), denying instead of ' +
-      'accepting the unrelated file outside .ai/pipeline/',
-  );
-});

package/plugins/gates/hooks/gates/mandatory-flow/test.mjs

@@ -1,119 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function makeProject() {
-  const project = mkdtempSync(join(tmpdir(), 'mandatory-flow-'));
-  mkdirSync(join(project, '.git'));
-  return project;
-}
-
-function writeProjectConfig(project, config) {
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-}
-
-function runGate(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function delegate(prompt, subagentType = 'backend') {
-  return {
-    tool_name: 'Agent',
-    tool_input: { prompt, subagent_type: subagentType },
-  };
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-function enableGate(project) {
-  writeProjectConfig(project, {
-    gates: { requireLiveTaskWhenImplementing: true },
-  });
-}
-
-test('disabled by default: no pointer file needed', () => {
-  const project = makeProject();
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  assert.equal(runGate(project, delegate(prompt)), null);
-});
-
-test('denies implementing when no active-task pointer exists on disk', () => {
-  const project = makeProject();
-  enableGate(project);
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  assert.ok(isDeny(runGate(project, delegate(prompt))));
-});
-
-test('allows implementing when the active task has a contract on disk', () => {
-  const project = makeProject();
-  enableGate(project);
-  mkdirSync(join(project, '.ai', 'pipeline', 'checkout-flow'), {
-    recursive: true,
-  });
-  writeFileSync(join(project, '.ai', 'pipeline', 'ACTIVA'), 'checkout-flow');
-  writeFileSync(
-    join(project, '.ai', 'pipeline', 'checkout-flow', 'asserts.md'),
-    '# Asserts\n\nCriterio: cobrar bien.',
-  );
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  assert.equal(runGate(project, delegate(prompt)), null);
-});
-
-test('denies when the pointer names a task with no contract file', () => {
-  const project = makeProject();
-  enableGate(project);
-  mkdirSync(join(project, '.ai', 'pipeline', 'checkout-flow'), {
-    recursive: true,
-  });
-  writeFileSync(join(project, '.ai', 'pipeline', 'ACTIVA'), 'checkout-flow');
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  assert.ok(isDeny(runGate(project, delegate(prompt))));
-});
-
-test('exempt subagent type (qa) is never held to the live-task requirement', () => {
-  const project = makeProject();
-  enableGate(project);
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  assert.equal(runGate(project, delegate(prompt, 'qa')), null);
-});
-
-test('activePointerPath param override points the gate at a custom location', () => {
-  const project = makeProject();
-  writeProjectConfig(project, {
-    gates: {
-      requireLiveTaskWhenImplementing: {
-        enabled: true,
-        activePointerPath: join('.custom', 'ACTIVE'),
-      },
-    },
-  });
-  mkdirSync(join(project, '.ai', 'pipeline', 'checkout-flow'), {
-    recursive: true,
-  });
-  writeFileSync(join(project, '.ai', 'pipeline', 'ACTIVA'), 'checkout-flow');
-  writeFileSync(
-    join(project, '.ai', 'pipeline', 'checkout-flow', 'asserts.md'),
-    'Criterio: cobrar bien.',
-  );
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  // the default pointer exists and is well-formed, but the override points elsewhere,
-  // which does not exist: the gate must deny, proving the param actually took effect.
-  assert.ok(isDeny(runGate(project, delegate(prompt))));
-});

package/plugins/gates/hooks/gates/neutral-spanish/neutral-spanish.edge.test.mjs

@@ -1,80 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'neutral-spanish-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isWarn(result) {
-  return result?.hookSpecificOutput?.additionalContext !== undefined;
-}
-
-// FIXED: extractText() now gates on toolInGroups(toolName, ['write']) and reads through
-// writtenContentOf() (lib/hook-io.mjs), which covers NotebookEdit's new_source field.
-test('FIXED: NotebookEdit carrying regional Spanish is detected', () => {
-  const payload = {
-    tool_name: 'NotebookEdit',
-    tool_input: {
-      notebook_path: '/repo/notebook.ipynb',
-      cell_id: 'abc',
-      new_source: 'vos tenés que revisar esto, dale',
-      cell_type: 'markdown',
-    },
-  };
-  assert.ok(isWarn(runGate(payload)), 'gate now detects regional Spanish written via NotebookEdit');
-});
-
-// FIXED: write_to_file is recognized by toolInGroups(toolName, ['write']) (native name in
-// TOOL_GROUPS.write) and its `content` field is read through writtenContentOf().
-test('FIXED: write_to_file with regional Spanish content is detected', () => {
-  const payload = {
-    tool_name: 'write_to_file',
-    tool_input: {
-      file_path: '/repo/notes.md',
-      content: 'che, mirá el laburo que hicimos acá',
-    },
-  };
-  assert.ok(isWarn(runGate(payload)), 'gate now detects regional Spanish written via write_to_file');
-});
-
-// EDGE CASE 3: false-positive check on legitimate neutral words that are substrings-adjacent
-// to markers. "sos" (voseo for "you are") is in the marker list; verify a word that merely
-// CONTAINS "sos" as a substring (e.g. "sospecha", "hermosos") is NOT flagged, since the
-// pattern uses \p{L} boundaries.
-test('OK: word boundary prevents false positive on words containing a marker as substring', () => {
-  const result = runGate({
-    tool_name: 'Write',
-    tool_input: { file_path: '/repo/notes.md', content: 'Tengo una sospecha sobre estos hermosos resultados.' },
-  });
-  assert.equal(result, null, 'false positive: "sos" matched inside sospecha/hermosos');
-});
-
-// EDGE CASE 4: "dale" is in the marker list as Rioplatense slang, but is this over-broad?
-// "dale" only appears as that exact word — check it correctly fires only for that token,
-// not, e.g., as part of "dalear" or similar. This confirms no over-matching regression.
-test('OK: marker "dale" does not fire on a word merely containing it', () => {
-  const result = runGate({
-    tool_name: 'Write',
-    tool_input: { file_path: '/repo/notes.md', content: 'Actualiza el dataleer o el dalext.' },
-  });
-  assert.equal(result, null, 'false positive: "dale" matched inside a longer word');
-});

package/plugins/gates/hooks/gates/neutral-spanish/test.mjs

@@ -1,65 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'neutral-spanish-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function write(content) {
-  return {
-    tool_name: 'Write',
-    tool_input: { file_path: '/repo/notes.md', content },
-  };
-}
-function isWarn(result) {
-  return result?.hookSpecificOutput?.additionalContext !== undefined;
-}
-
-test('warns on Rioplatense voseo and lexicon', () => {
-  assert.ok(isWarn(runGate(write('vos tenés que revisar esto, dale'))));
-  assert.ok(isWarn(runGate(write('che, mirá el laburo que hicimos acá'))));
-});
-
-test('allows neutral Spanish', () => {
-  assert.equal(runGate(write('tienes que revisar esto, de acuerdo')), null);
-});
-
-test('disabled by config: the gate does not run', () => {
-  assert.equal(
-    runGate(write('vos tenés que revisar esto'), {
-      config: { gates: { warnNonNeutralSpanish: false } },
-    }),
-    null,
-  );
-});
-
-test('project regionalMarkers override replaces the built-in list', () => {
-  const config = {
-    gates: {
-      warnNonNeutralSpanish: { enabled: true, regionalMarkers: ['bacano'] },
-    },
-  };
-  assert.equal(runGate(write('vos tenés que revisar esto'), { config }), null);
-  assert.ok(isWarn(runGate(write('que bacano quedo esto'), { config })));
-});

package/plugins/gates/hooks/gates/never-assume/never-assume.edge.test.mjs

@@ -1,71 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'never-assume-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isWarn(result) {
-  return result?.hookSpecificOutput?.additionalContext !== undefined;
-}
-
-const ENABLE = { config: { gates: { requireVerificationBeforeAssuming: true } } };
-
-// FIXED: extractContent() now reads through writtenContentOf() (lib/hook-io.mjs), which
-// covers NotebookEdit's new_source field, closing the tool-coverage gap this test used to
-// document as a bug.
-test('FIXED: conjecture phrasing written via NotebookEdit is detected', () => {
-  const payload = {
-    tool_name: 'NotebookEdit',
-    tool_input: {
-      notebook_path: '/repo/nb.ipynb',
-      cell_id: 'x',
-      new_source: '# i assume the timezone is UTC',
-      cell_type: 'code',
-    },
-  };
-  assert.ok(isWarn(runGate(payload, ENABLE)), 'gate now detects conjecture phrasing via NotebookEdit');
-});
-
-// EDGE CASE (BUG): 'invoke_subagent' is a declared delegation tool name (TOOL_GROUPS.delegation
-// in lib/hook-io.mjs) and is matched in hooks.json, but extractContent() branches on
-// TOOL_GROUPS.delegation.includes(toolName) which DOES include invoke_subagent — so this one
-// should actually work. Verify it does (a real behavioral check, not a bug) to make sure the
-// delegation branch itself is sound before concluding the write-side gap is the only issue.
-test('OK: conjecture phrasing in an invoke_subagent prompt is detected (delegation branch is sound)', () => {
-  const payload = {
-    tool_name: 'invoke_subagent',
-    tool_input: { prompt: 'i assume the config is already loaded, proceed' },
-  };
-  assert.ok(isWarn(runGate(payload, ENABLE)));
-});
-
-// EDGE CASE: false-positive check — "should be" is a very broad conjecture pattern that can
-// match ordinary correct engineering prose describing an invariant, not an unverified guess,
-// e.g. "the response should be a 200 for valid input" (spec language, not conjecture).
-test('OK/expected-noise: "should be" fires even on spec-style invariant language (broad pattern, not a bug but a known false-positive source)', () => {
-  const result = runGate(
-    { tool_name: 'Write', tool_input: { file_path: '/repo/x.js', content: '// per the spec, the response should be a 200 for valid input' } },
-    ENABLE,
-  );
-  assert.ok(isWarn(result), 'documents that "should be" over-fires on legitimate spec prose, not just conjecture');
-});

package/plugins/gates/hooks/gates/never-assume/test.mjs

@@ -1,95 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'never-assume-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function write(content) {
-  return {
-    tool_name: 'Write',
-    tool_input: { file_path: '/repo/src/x.js', content },
-  };
-}
-function isWarn(result) {
-  return result?.hookSpecificOutput?.additionalContext !== undefined;
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLE = {
-  config: { gates: { requireVerificationBeforeAssuming: true } },
-};
-
-test('warns on conjecture phrasing', () => {
-  assert.ok(isWarn(runGate(write('// i assume the timezone is UTC'), ENABLE)));
-  assert.ok(isWarn(runGate(write('// probably fine to skip this'), ENABLE)));
-});
-
-test('never denies, only warns', () => {
-  const result = runGate(write('// i assume this works'), ENABLE);
-  assert.ok(isWarn(result));
-  assert.ok(!isDeny(result));
-});
-
-test('allows content without conjecture phrasing', () => {
-  assert.equal(runGate(write('const x = 1;'), ENABLE), null);
-});
-
-test('disabled by default (registry default is false)', () => {
-  assert.equal(runGate(write('// i assume this works')), null);
-});
-
-test('warns on conjecture phrasing in Spanish', () => {
-  assert.ok(isWarn(runGate(write('// supongo que la zona horaria es UTC'), ENABLE)));
-  assert.ok(isWarn(runGate(write('// probablemente sea correcto omitir esto'), ENABLE)));
-  assert.ok(isWarn(runGate(write('// deberia ser suficiente con este chequeo'), ENABLE)));
-});
-
-test('bilingual control: ES and EN equivalent conjecture briefs both warn', () => {
-  const es = write('// creo que el usuario ya esta autenticado, no lo verifique');
-  const en = write('// i assume the user is already authenticated, did not verify it');
-  assert.ok(isWarn(runGate(es, ENABLE)));
-  assert.ok(isWarn(runGate(en, ENABLE)));
-});
-
-test('allows neutral Spanish content without conjecture phrasing', () => {
-  assert.equal(runGate(write('const contrasena = "verificada";'), ENABLE), null);
-});
-
-test('project conjecturePatterns override replaces the built-in list', () => {
-  const config = {
-    gates: {
-      requireVerificationBeforeAssuming: {
-        enabled: true,
-        conjecturePatterns: ['totally made up'],
-      },
-    },
-  };
-  assert.equal(runGate(write('// i assume this works'), { config }), null);
-  assert.ok(
-    isWarn(runGate(write('// totally made up value here'), { config })),
-  );
-});

package/plugins/gates/hooks/gates/no-blocking/no-blocking.edge.test.mjs

@@ -1,109 +0,0 @@
-// Edge-case audit for no-blocking: bypasses and false positives.
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'no-blocking-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-const ENABLED = { gates: { blockWaitingCommands: true } };
-
-function bash(command, extra = {}) {
-  return { tool_name: 'Bash', tool_input: { command, ...extra } };
-}
-function mcpTool(name, input) {
-  return { tool_name: name, tool_input: input };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-// ── BUG: MCP shell-equivalent tools are not in TOOL_GROUPS.shell/delegation.
-test('FIXED: an mcp shell-equivalent tool running "sleep 30" is now recognized', () => {
-  const result = runGate(mcpTool('mcp__shell__run', { command: 'sleep 30' }), {
-    config: ENABLED,
-  });
-  assert.ok(isDeny(result)); // toolInGroups classifies mcp__shell__run into the shell group
-});
-
-// ── BUG (false positive / evasion pairing): the WAIT-JUSTIFIED marker escape requires
-// NO reason validation beyond "two more tokens exist after the marker" — the reason text
-// itself is never checked for plausibility, so trivially defeats the intent of a
-// "declared, justified wait": any two words work as an unchecked excuse.
-test('BUG (weak justification check): any two-word text after the marker escapes the block regardless of content', () => {
-  const result = runGate(
-    bash('sleep 9999 # WAIT-JUSTIFIED: because yes'),
-    { config: ENABLED },
-  );
-  assert.equal(result, null); // allowed: marker escape has no semantic validation, only shape
-});
-
-// ── BUG candidate: `timeout 30 someserver` is matched by the sleep|timeout pattern
-// requiring the command to START the line or follow |;&/then/do. A background-launched
-// dev server that is piped through `| cat` first, e.g. `npm run dev | cat`, should still
-// match \b(npm|pnpm|yarn|bun)\s+(run\s+)?(dev|start|serve|watch)\b since that's a
-// substring test with no anchoring requirement (unlike sleep/timeout). Confirm no bypass.
-test('OK: piping a dev server through another command does not bypass the dev-server pattern', () => {
-  assert.ok(
-    isDeny(runGate(bash('npm run dev | cat'), { config: ENABLED })),
-  );
-});
-
-// ── BUG: `NOT_TAKING_THE_TURN` includes `-d\b` as a generic "detached" flag marker. This
-// is dangerously broad: ANY command containing a standalone `-d` token — including one
-// completely unrelated to backgrounding — escapes every blocking pattern. E.g. `sleep 30
-// -d` (nonsensical flag for sleep, but matches) or more realistically a docker/curl
-// command with an unrelated `-d` (data) flag combined with a blocking pattern.
-test('FIXED: an unrelated "-d" flag (curl -d) no longer escapes the blocking check', () => {
-  // curl -d is "data", not detach. The bare -d escape was removed, so a genuinely foreground
-  // sleep on the same command line is now denied despite the unrelated -d flag.
-  const result = runGate(bash('sleep 30; curl -d "payload" http://x'), {
-    config: ENABLED,
-  });
-  assert.ok(isDeny(result));
-});
-
-// ── BUG candidate: `npm run dev &` (trailing background operator with a space before
-// EOL, e.g. training whitespace) — NOT_TAKING_THE_TURN requires `&\s*$`. A trailing
-// newline in the JSON string (unlikely from a real shell, but a delegation prompt or a
-// tool that appends '\n') would still satisfy `\s*$` since \s includes \n. Not pursued
-// further as a distinct bug; documenting as checked.
-test('OK: trailing background operator followed by trailing whitespace still escapes correctly (not a bug)', () => {
-  assert.equal(
-    runGate(bash('npm run dev &  '), { config: ENABLED }),
-    null,
-  );
-});
-
-// ── BUG candidate: PowerShell `Start-Job` / `Start-Process ... -NoNewWindow` background
-// forms are not recognized by NOT_TAKING_THE_TURN, but that only matters if the command
-// is ALSO caught by a blocking pattern in the first place. `Start-Sleep` alone, run as
-// `Start-Job { Start-Sleep 30 }` (already backgrounded via Start-Job) is still matched by
-// \bStart-Sleep\b and NOT recognized as non-blocking, causing a FALSE POSITIVE: a
-// genuinely backgrounded PowerShell job gets denied because its "backgrounded" wrapper
-// (Start-Job) is not in NOT_TAKING_THE_TURN.
-test('FIXED: Start-Sleep inside a Start-Job background wrapper is now allowed', () => {
-  const result = runGate(bash('Start-Job { Start-Sleep 30 }'), {
-    config: ENABLED,
-  });
-  assert.equal(result, null); // Start-Job is now recognized as a backgrounding mechanism
-});