@devrik-tools/claude-gates 0.2.0 → 0.3.0

package/plugins/gates/hooks/gates/no-blocking/test.mjs

@@ -1,108 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-// Runs the gate as its own process (it calls process.exit), feeding a payload on stdin
-// from inside a temp project so the gate's config lookup is isolated. Returns the parsed
-// stdout, or null when the gate allowed (no output).
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'no-blocking-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-const ENABLED = { gates: { blockWaitingCommands: true } };
-
-function bash(command, extra = {}) {
-  return { tool_name: 'Bash', tool_input: { command, ...extra } };
-}
-function delegate(prompt) {
-  return { tool_name: 'Agent', tool_input: { prompt } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-test('denies sleep in foreground, a dev server, and a polling loop', () => {
-  assert.ok(isDeny(runGate(bash('sleep 30'), { config: ENABLED })));
-  assert.ok(isDeny(runGate(bash('npm run dev'), { config: ENABLED })));
-  assert.ok(
-    isDeny(
-      runGate(bash('until curl -sf localhost:3000; do sleep 2; done'), {
-        config: ENABLED,
-      }),
-    ),
-  );
-});
-
-test('allows an innocuous command and a backgrounded long-runner', () => {
-  assert.equal(runGate(bash('git status'), { config: ENABLED }), null);
-  assert.equal(
-    runGate(bash('npm run dev', { run_in_background: true }), {
-      config: ENABLED,
-    }),
-    null,
-  );
-  assert.equal(runGate(bash('sleep 30 &'), { config: ENABLED }), null);
-});
-
-test('disabled by default: the gate does not run without opting in', () => {
-  assert.equal(runGate(bash('sleep 30')), null);
-});
-
-test('a delegation prompt telling the subagent to sleep-wait is denied', () => {
-  assert.ok(
-    isDeny(
-      runGate(
-        delegate('Please then sleep 60 seconds until the server is ready.'),
-        {
-          config: ENABLED,
-        },
-      ),
-    ),
-  );
-});
-
-test('the wait-justified marker with a reason escapes the block', () => {
-  assert.equal(
-    runGate(
-      bash('sleep 30 # WAIT-JUSTIFIED: waiting for migration lock release'),
-      {
-        config: ENABLED,
-      },
-    ),
-    null,
-  );
-});
-
-test('project blockingPatterns replaces the built-in list', () => {
-  const config = {
-    gates: {
-      blockWaitingCommands: {
-        enabled: true,
-        blockingPatterns: [String.raw`\bcustom-block\b`],
-      },
-    },
-  };
-  // sleep no longer denied under the override
-  assert.equal(runGate(bash('sleep 30'), { config }), null);
-  assert.ok(isDeny(runGate(bash('custom-block now'), { config })));
-});

package/plugins/gates/hooks/gates/no-memory-dependency/no-memory-dependency.edge.test.mjs

@@ -1,83 +0,0 @@
-// Edge-case audit for no-memory-dependency. This gate only warns, never denies, so a
-// "bypass" here means the warning silently fails to fire for a prompt that really does
-// depend on the model's memory, not that anything unsafe was blocked.
-// Run: node --test no-memory-dependency.edge.test.mjs
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'no-memory-dependency-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isWarn(result) {
-  return typeof result?.hookSpecificOutput?.additionalContext === 'string';
-}
-
-const ENABLED = { config: { gates: { warnMemoryDependencyInBrief: true } } };
-const MEMORY_PROMPT = 'Acordate de lo que hablamos antes y aplica el mismo criterio.';
-
-test('FIXED: a delegation tool name outside the native list is now caught via toolInGroups (MCP delegation signal)', () => {
-  const result = runGate(
-    { tool_name: 'mcp__orchestrator__spawn_agent', tool_input: { prompt: MEMORY_PROMPT } },
-    ENABLED,
-  );
-  assert.ok(isWarn(result), 'gate now warns for the memory-dependency prompt under the MCP tool name too');
-});
-
-test('FIXED: prompt carried in a field other than prompt/description/task is now read via delegationPromptOf', () => {
-  const result = runGate(
-    { tool_name: 'Agent', tool_input: { instructions: MEMORY_PROMPT } },
-    ENABLED,
-  );
-  assert.ok(isWarn(result), 'gate now sees the prompt under "instructions" and warns');
-});
-
-test('FIXED: a persistence noun with no verb no longer suppresses the warning', () => {
-  // hasPersistenceInstructionNearby now requires an imperative persistence VERB nearby,
-  // not merely a noun. A prompt that mentions an unrelated file's name within the window
-  // (with no verb instructing anything be saved) no longer suppresses the warning.
-  const prompt =
-    'Acordate de lo que dijimos del login (el reporte esta en incident.md) y aplica el ' +
-    'mismo criterio de siempre.';
-  const result = runGate({ tool_name: 'Agent', tool_input: { prompt } }, ENABLED);
-  assert.ok(
-    isWarn(result),
-    'gate now warns: "incident.md" nearby with no persistence verb is not a real persistence instruction',
-  );
-});
-
-test('OK: a genuine memory-dependency phrase via Agent is warned', () => {
-  assert.ok(isWarn(runGate({ tool_name: 'Agent', tool_input: { prompt: MEMORY_PROMPT } }, ENABLED)));
-});
-
-test('OK: a memory phrase paired with a real persistence verb still suppresses the warning', () => {
-  const result = runGate(
-    {
-      tool_name: 'Agent',
-      tool_input: {
-        prompt: 'No te olvides de guardar la decision en .ai/decision.md antes de continuar.',
-      },
-    },
-    ENABLED,
-  );
-  assert.equal(result, null);
-});

package/plugins/gates/hooks/gates/no-memory-dependency/test.mjs

@@ -1,106 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'no-memory-dependency-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function delegate(prompt) {
-  return { tool_name: 'Agent', tool_input: { prompt } };
-}
-function isWarn(result) {
-  return typeof result?.hookSpecificOutput?.additionalContext === 'string';
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLED = { config: { gates: { warnMemoryDependencyInBrief: true } } };
-
-test('warns (never denies) when the brief leans on remembered context', () => {
-  const result = runGate(
-    delegate('Acordate de lo que hablamos antes y aplica el mismo criterio.'),
-    ENABLED,
-  );
-  assert.ok(isWarn(result));
-  assert.ok(!isDeny(result));
-});
-
-test('allows a brief with no memory-dependency phrase', () => {
-  assert.equal(
-    runGate(
-      delegate('Implementa el endpoint de login segun el contrato adjunto.'),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('allows a memory phrase paired with a deterministic persistence instruction', () => {
-  assert.equal(
-    runGate(
-      delegate(
-        'No te olvides de guardar la decision en .ai/decision.md antes de continuar.',
-      ),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('disabled by config: the gate does not run', () => {
-  assert.equal(
-    runGate(
-      delegate('Acordate de lo que hablamos antes y aplica el mismo criterio.'),
-      {
-        config: { gates: { warnMemoryDependencyInBrief: false } },
-      },
-    ),
-    null,
-  );
-});
-
-test('project memoryDependencyPatterns override replaces the built-in list', () => {
-  const config = {
-    gates: {
-      warnMemoryDependencyInBrief: {
-        enabled: true,
-        memoryDependencyPatterns: ['como quedamos'],
-      },
-    },
-  };
-  // No longer matches the built-in "acordate de" phrase.
-  assert.equal(
-    runGate(
-      delegate('Acordate de lo que hablamos antes y aplica el mismo criterio.'),
-      { config },
-    ),
-    null,
-  );
-  assert.ok(
-    isWarn(
-      runGate(delegate('Hacelo como quedamos la ultima vez.'), { config }),
-    ),
-  );
-});

package/plugins/gates/hooks/gates/no-reconfirm/no-reconfirm.edge.test.mjs

@@ -1,91 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function newProject({ config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'no-reconfirm-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  return project;
-}
-
-function writeTranscript(project, events) {
-  const transcriptPath = join(project, 'transcript.jsonl');
-  writeFileSync(transcriptPath, events.map((e) => JSON.stringify(e)).join('\n'));
-  return transcriptPath;
-}
-
-function humanTurn(text) {
-  return { type: 'user', userType: 'external', message: { content: text } };
-}
-
-function askQuestion(transcriptPath, question) {
-  return {
-    tool_name: 'AskUserQuestion',
-    transcript_path: transcriptPath,
-    tool_input: { questions: [question] },
-  };
-}
-
-function runGateIn(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isWarn(result) {
-  return result?.hookSpecificOutput?.additionalContext !== undefined;
-}
-
-// EDGE CASE (BUG, confirmed via manual calculation before writing this test): the overlap
-// check has no notion of WHICH entity the action targets — it only counts shared
-// significant (>=5 char) words between the approving turn and the new question's topic
-// text (header+question+option labels). Approving "migrate the STAGING database schema"
-// shares 3 of 4 topic words (migrate/database/schema) with an unrelated question about
-// migrating the BILLING database schema — a materially different target — and clears both
-// MIN_SHARED_WORDS (2) and the default overlapThreshold (0.34): shared=3, fraction=0.75.
-test('BUG: approving one migration is treated as approval for an unrelated migration of a different entity (staging vs billing)', () => {
-  const project = newProject();
-  const transcriptPath = writeTranscript(project, [
-    humanTurn('go ahead, migrate the staging database schema now'),
-  ]);
-  const question = {
-    header: '',
-    question: 'Should I migrate the billing database schema?',
-    options: [],
-  };
-  const result = runGateIn(project, askQuestion(transcriptPath, question));
-  // Documents the false positive: the gate claims this was "already approved" even though
-  // the user approved a migration of a DIFFERENT database (staging, not billing).
-  assert.ok(isWarn(result), 'expected the (buggy) false-positive warn to fire: no entity/target check, only generic word overlap');
-});
-
-// EDGE CASE (BUG candidate): false negative via negation. The APPROVAL_PATTERN matches
-// literal phrases like "go ahead" / "do it" without checking for a preceding negation.
-// "don't go ahead" or "no, don't do it yet" still matches the raw pattern.
-test('BUG: a NEGATED approval phrase ("do not go ahead") is still treated as approval', () => {
-  const project = newProject();
-  const transcriptPath = writeTranscript(project, [
-    humanTurn('do not go ahead with migrating the authentication database schema'),
-  ]);
-  const question = {
-    header: 'Migration',
-    question: 'Should I migrate the authentication database schema?',
-    options: [],
-  };
-  const result = runGateIn(project, askQuestion(transcriptPath, question));
-  assert.ok(isWarn(result), 'expected the (buggy) warn to fire even though the user said NOT to go ahead — APPROVAL_PATTERN has no negation check');
-});

package/plugins/gates/hooks/gates/no-reconfirm/test.mjs

@@ -1,131 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function newProject({ config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'no-reconfirm-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  return project;
-}
-
-function writeTranscript(project, events) {
-  const transcriptPath = join(project, 'transcript.jsonl');
-  writeFileSync(
-    transcriptPath,
-    events.map((event) => JSON.stringify(event)).join('\n'),
-  );
-  return transcriptPath;
-}
-
-function humanTurn(text) {
-  return { type: 'user', userType: 'external', message: { content: text } };
-}
-
-function askQuestion(transcriptPath, question) {
-  return {
-    tool_name: 'AskUserQuestion',
-    transcript_path: transcriptPath,
-    tool_input: { questions: [question] },
-  };
-}
-
-function runGateIn(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isWarn(result) {
-  return result?.hookSpecificOutput?.additionalContext !== undefined;
-}
-
-test('warns when re-asking a topic the user already approved', () => {
-  const project = newProject();
-  const transcriptPath = writeTranscript(project, [
-    humanTurn('go ahead, migrate the authentication database schema now'),
-  ]);
-  const question = {
-    header: 'Migration',
-    question: 'Should I migrate the authentication database schema?',
-    options: [],
-  };
-  assert.ok(isWarn(runGateIn(project, askQuestion(transcriptPath, question))));
-});
-
-test('allows a genuinely new question with no prior approval overlap', () => {
-  const project = newProject();
-  const transcriptPath = writeTranscript(project, [humanTurn('hello there')]);
-  const question = {
-    header: 'Deploy',
-    question: 'Should I deploy to production now?',
-    options: [],
-  };
-  assert.equal(runGateIn(project, askQuestion(transcriptPath, question)), null);
-});
-
-test('disabled by config: the gate does not run', () => {
-  const project = newProject({
-    config: { gates: { requireNoReconfirmOfApproved: false } },
-  });
-  const transcriptPath = writeTranscript(project, [
-    humanTurn('go ahead, migrate the authentication database schema now'),
-  ]);
-  const question = {
-    header: 'Migration',
-    question: 'Should I migrate the authentication database schema?',
-    options: [],
-  };
-  assert.equal(runGateIn(project, askQuestion(transcriptPath, question)), null);
-});
-
-test('degrades to allow when transcript_path is missing or unreadable', () => {
-  const project = newProject();
-  const question = {
-    header: 'Migration',
-    question: 'Should I migrate now?',
-    options: [],
-  };
-  assert.equal(
-    runGateIn(project, {
-      tool_name: 'AskUserQuestion',
-      tool_input: { questions: [question] },
-    }),
-    null,
-  );
-});
-
-test('overlapThreshold override changes sensitivity', () => {
-  const project = newProject({
-    config: {
-      gates: {
-        requireNoReconfirmOfApproved: { enabled: true, overlapThreshold: 0.99 },
-      },
-    },
-  });
-  const transcriptPath = writeTranscript(project, [
-    humanTurn('go ahead, migrate the authentication schema'),
-  ]);
-  const question = {
-    header: 'Migration',
-    question:
-      'Should I migrate the authentication database schema now with backups?',
-    options: [],
-  };
-  assert.equal(runGateIn(project, askQuestion(transcriptPath, question)), null);
-});

package/plugins/gates/hooks/gates/protected-paths/protected-paths.edge.test.mjs

@@ -1,126 +0,0 @@
-// Edge-case audit for protected-paths: bypasses and false positives.
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'protected-paths-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function write(filePath) {
-  return { tool_name: 'Write', tool_input: { file_path: filePath } };
-}
-function edit(filePath) {
-  return { tool_name: 'Edit', tool_input: { file_path: filePath } };
-}
-function bash(command) {
-  return { tool_name: 'Bash', tool_input: { command } };
-}
-function mcpTool(name, input) {
-  return { tool_name: name, tool_input: input };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-// ── FIXED: toolInGroups classifies an MCP tool by its action segment, so an MCP write
-// tool is now recognized regardless of its exact name.
-test('FIXED: mcp filesystem write_file targeting .env is now recognized as a write tool', () => {
-  const result = runGate(
-    mcpTool('mcp__filesystem__write_file', { path: '/repo/.env', content: 'X=1' }),
-  );
-  assert.ok(isDeny(result));
-});
-
-test('FIXED: mcp filesystem edit_file targeting package-lock.json is now recognized', () => {
-  const result = runGate(
-    mcpTool('mcp__filesystem__edit_file', {
-      file_path: '/repo/package-lock.json',
-      diff: '...',
-    }),
-  );
-  assert.ok(isDeny(result));
-});
-
-// ── FIXED: an mcp shell-equivalent tool with a mutating command against .env is now
-// recognized too, via toolInGroups' shell signal.
-test('FIXED: mcp shell-equivalent tool removing .env is now recognized as a shell tool', () => {
-  const result = runGate(mcpTool('mcp__shell__run', { command: 'rm .env' }));
-  assert.ok(isDeny(result));
-});
-
-// ── BUG candidate: chained command where the mutating verb and the protected path are
-// split across a chain, e.g. `echo hi && rm .env` — mutatingCommand.test and
-// protectedTarget.test both run against the FULL command string independently (not
-// requiring adjacency), so this should still be caught. Confirm.
-test('OK: mutating command chained after a harmless one is still caught', () => {
-  assert.ok(isDeny(runGate(bash('echo hi && rm .env'))));
-});
-
-// ── BUG candidate: redirect-to-protected pattern `>>?\s*\S*(protected)` requires the
-// protected fragment to appear immediately after the redirect target token (no space
-// before it beyond \s*, and \S* is greedy so it consumes up to whitespace). A redirect
-// with a relative path prefix like `echo x > ./.env` should still match since '.env' is
-// a substring inside './.env'. Confirm.
-test('OK: redirect to a protected path via a relative ./ prefix is still caught', () => {
-  assert.ok(isDeny(runGate(bash('echo "X=1" > ./.env'))));
-});
-
-// ── BUG: the redirect pattern anchors on `>>?\s*\S*(protected)` — but it does not
-// require a mutating command AT ALL; a bare redirect from an allowed "reading" command
-// like `cat foo > .env` is denied correctly. But what about protected-path matches
-// inside an UNQUOTED argument to a non-mutating, non-redirecting command that merely
-// happens to reference the filename without any real risk, e.g. `node --check .env`?
-// mutatingCommand list doesn't include 'node', and there's no redirect, so
-// targetsProtected is false — correctly allowed. Confirm to make sure the "read/lint a
-// protected path" case is not a false positive.
-test('OK: a non-mutating command that only references a protected filename is allowed', () => {
-  assert.equal(runGate(bash('node --check .env')), null);
-});
-
-// ── BUG: case sensitivity / path separator on Windows. protectedTarget building lower-
-// cases the path fragment comparison for isProtectedPath (writes) via .toLowerCase(), but
-// for the SHELL branch, buildCommandPatterns compiles patterns with the 'i' flag, so case
-// should be handled there too. Confirm mixed-case doesn't bypass either branch.
-test('OK: mixed-case protected path does not bypass either the write or shell branch', () => {
-  assert.ok(isDeny(runGate(write('/repo/.ENV'))));
-  assert.ok(isDeny(runGate(bash('rm .ENV'))));
-});
-
-// ── FIXED: the write and shell branches normalize backslashes to forward slashes before
-// comparing, so a Windows-style absolute path under hooks\ now matches the 'hooks/'
-// protected fragment.
-test('FIXED: windows backslash path under hooks\\ now matches the "hooks/" protected fragment', () => {
-  const result = runGate(write('C:\\repo\\hooks\\gates\\evil.mjs'));
-  assert.ok(isDeny(result));
-});
-
-// ── BUG: sed -i is in mutatingCommands as the two-token regex source `sed\\s+-i` joined
-// into one big alternation with \b...\b around the WHOLE alternation, not each term. This
-// means the outer \b applies to the first alternative's boundary only for single-word
-// terms; for the multi-word 'sed\\s+-i' term, \b anchors immediately before 's' and after
-// the LAST alternative in the group, not after 'sed\s+-i' locally — but since it's inside
-// one non-capturing pattern (`\b(a|b|sed\s+-i|c)\b`), the trailing \b applies right after
-// whatever alternative matched, i.e. after "-i", which IS a word boundary. Confirm sed -i
-// against a protected path is still caught (not a bug) before moving on.
-test('OK: sed -i against a protected path is still caught', () => {
-  assert.ok(isDeny(runGate(bash('sed -i "s/a/b/" .env'))));
-});