@devrik-tools/claude-gates 0.2.0 → 0.3.0

package/plugins/gates/hooks/gates/risk-level/test.mjs

@@ -1,153 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'risk-level-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function delegate(prompt, extra = {}) {
-  return { tool_name: 'Agent', tool_input: { prompt, ...extra } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLED = { config: { gates: { requireDeclaredRiskLevel: true } } };
-
-test('denies an implementation delegation with no declared level', () => {
-  assert.ok(
-    isDeny(
-      runGate(
-        delegate('Arregla el boton que no cambia de color en la pagina.'),
-        ENABLED,
-      ),
-    ),
-  );
-});
-
-test('allows a declared level consistent with a low-risk request', () => {
-  assert.equal(
-    runGate(
-      delegate(
-        'NIVEL: STANDARD\n\nArregla el boton que no cambia de color en la pagina.',
-      ),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('denies a declared level that contradicts a real high-impact signal', () => {
-  assert.ok(
-    isDeny(
-      runGate(
-        delegate(
-          'NIVEL: MICRO\n\nImplementa el cobro del pago con la nueva pasarela de dinero.',
-        ),
-        ENABLED,
-      ),
-    ),
-  );
-});
-
-test('allows HIGH-RISK declared for a high-impact request', () => {
-  assert.equal(
-    runGate(
-      delegate(
-        'NIVEL: HIGH-RISK\n\nImplementa el cobro del pago con la nueva pasarela de dinero.',
-      ),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('bilingual control: an EN money-mutation brief contradicts a low level exactly like its ES equivalent', () => {
-  const es = delegate(
-    'NIVEL: MICRO\n\nImplementa el cobro del pago con la nueva pasarela de dinero.',
-  );
-  const en = delegate(
-    'LEVEL: MICRO\n\nImplement the payment charge with the new money gateway.',
-  );
-  assert.ok(isDeny(runGate(es, ENABLED)));
-  assert.ok(isDeny(runGate(en, ENABLED)));
-});
-
-// A whitelisted read-only subagent name is now void whenever the prompt itself carries
-// a mutation-risk signal (money/auth/data/write/deploy): the label is self-declared,
-// never a verified capability, and a real risk signal in the text must win over it
-// (bug fixed in this gate; see risk-level.edge.test.mjs).
-test('allows a read-only subagent without a declared level when the prompt carries no mutation-risk signal', () => {
-  assert.equal(
-    runGate(
-      delegate('Explica como funciona el flujo de checkout actual.', {
-        subagent_type: 'explore',
-      }),
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('a read-only subagent name no longer exempts a real money-mutation prompt from declaring a level', () => {
-  assert.ok(
-    isDeny(
-      runGate(
-        delegate(
-          'Implementa el cobro del pago con la nueva pasarela de dinero.',
-          {
-            subagent_type: 'explore',
-          },
-        ),
-        ENABLED,
-      ),
-    ),
-  );
-});
-
-test('disabled by config: the gate does not run', () => {
-  assert.equal(
-    runGate(delegate('Arregla el boton que no cambia de color en la pagina.'), {
-      config: { gates: { requireDeclaredRiskLevel: false } },
-    }),
-    null,
-  );
-});
-
-test('project highImpactPatterns override narrows what forces HIGH-RISK', () => {
-  const config = {
-    gates: {
-      requireDeclaredRiskLevel: {
-        enabled: true,
-        highImpactPatterns: ['pagin[ao]ci[oó]n'],
-      },
-    },
-  };
-  const prompt =
-    'NIVEL: MICRO\n\nImplementa el cobro del pago con la nueva pasarela de dinero.';
-  // With the default patterns (money/payment), MICRO contradicts the signal and is denied.
-  assert.ok(isDeny(runGate(delegate(prompt), ENABLED)));
-  // Once overridden, "dinero/pago" no longer counts as high-impact, so MICRO is allowed.
-  assert.equal(runGate(delegate(prompt), { config }), null);
-});

package/plugins/gates/hooks/gates/root-cause-first/root-cause-first.edge.test.mjs

@@ -1,58 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'root-cause-first-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLE = { config: { gates: { requireRootCauseBeforePatch: true } } };
-
-// FIXED: writtenContentOf reads NotebookEdit's new_source, so a deferral marker written via
-// NotebookEdit is now caught by this DENY gate.
-test('FIXED: patch-marker comment via NotebookEdit is now denied', () => {
-  const payload = {
-    tool_name: 'NotebookEdit',
-    tool_input: {
-      notebook_path: '/repo/nb.ipynb',
-      cell_id: 'x',
-      new_source: '// TODO fix later patch',
-      cell_type: 'code',
-    },
-  };
-  assert.ok(isDeny(runGate(payload, ENABLE)), 'a patch marker via NotebookEdit must now be denied');
-});
-
-// FIXED: writtenContentOf reads replace_file_content's new_content field too.
-test('FIXED: patch-marker via replace_file_content (new_content field) is now denied', () => {
-  const payload = {
-    tool_name: 'replace_file_content',
-    tool_input: {
-      file_path: '/repo/x.js',
-      new_content: '// TODO fix later patch',
-    },
-  };
-  assert.ok(isDeny(runGate(payload, ENABLE)), 'the field-name variant must now be denied');
-});

package/plugins/gates/hooks/gates/root-cause-first/test.mjs

@@ -1,73 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'root-cause-first-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function write(content) {
-  return {
-    tool_name: 'Write',
-    tool_input: { file_path: '/repo/src/x.js', content },
-  };
-}
-function delegate(prompt) {
-  return { tool_name: 'Agent', tool_input: { prompt } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLE = { config: { gates: { requireRootCauseBeforePatch: true } } };
-
-test('denies a patch-marker comment in a write', () => {
-  assert.ok(isDeny(runGate(write('// TODO fix later patch'), ENABLE)));
-});
-
-test('denies the same marker inside a delegation prompt', () => {
-  assert.ok(
-    isDeny(runGate(delegate('add a // TODO fix later patch comment'), ENABLE)),
-  );
-});
-
-test('allows innocuous content', () => {
-  assert.equal(runGate(write('const x = 1;'), ENABLE), null);
-});
-
-test('disabled by default (registry default is false)', () => {
-  assert.equal(runGate(write('// TODO fix later patch')), null);
-});
-
-test('project patchMarkerPatterns override replaces the built-in list', () => {
-  const config = {
-    gates: {
-      requireRootCauseBeforePatch: {
-        enabled: true,
-        patchMarkerPatterns: ['hack-me-later'],
-      },
-    },
-  };
-  assert.equal(runGate(write('// TODO fix later patch'), { config }), null);
-  assert.ok(isDeny(runGate(write('// hack-me-later'), { config })));
-});

package/plugins/gates/hooks/gates/root-whitelist/root-whitelist.edge.test.mjs

@@ -1,97 +0,0 @@
-// Edge-case audit for root-whitelist: bypasses and false positives.
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join, sep } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function project({ config } = {}) {
-  const root = mkdtempSync(join(tmpdir(), 'root-whitelist-edge-'));
-  mkdirSync(join(root, '.git'));
-  if (config) {
-    mkdirSync(join(root, '.ai'));
-    writeFileSync(join(root, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  return {
-    root,
-    run(payload) {
-      const out = execFileSync(process.execPath, [GATE], {
-        input: JSON.stringify(payload),
-        encoding: 'utf8',
-        cwd: root,
-        env: { ...process.env, HOME: root, USERPROFILE: root },
-      });
-      return out.trim() ? JSON.parse(out.trim()) : null;
-    },
-  };
-}
-
-function write(filePath) {
-  return { tool_name: 'Write', tool_input: { file_path: filePath } };
-}
-function mcpTool(name, input) {
-  return { tool_name: name, tool_input: input };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-// ── FIXED: toolInGroups classifies an MCP tool by its action segment, so an MCP write
-// tool creating an orphan root file is now recognized.
-test('FIXED: mcp filesystem write_file creating an orphan root file is now recognized', () => {
-  const { root, run } = project();
-  const result = run(
-    mcpTool('mcp__filesystem__write_file', {
-      path: join(root, 'orphan-mcp.txt'),
-      content: 'x',
-    }),
-  );
-  assert.ok(isDeny(result));
-});
-
-// ── FIXED: a relative (non-absolute) file_path is now resolved against process.cwd()
-// (the test runs the gate with cwd = root) before the root-prefix check, so it is judged
-// by where it actually lands instead of skipping the check entirely.
-test('FIXED: a relative file_path targeting the root is now caught by resolving it against cwd', () => {
-  const { run } = project();
-  const result = run(write('orphan-relative.txt'));
-  assert.ok(isDeny(result));
-});
-
-// ── BUG candidate: path traversal via ../ that resolves back into the root from a
-// nested absolute path, e.g. '<root>/src/../orphan.txt'. normalize() collapses '..'
-// segments, so this SHOULD reduce to '<root>/orphan.txt' and be caught. Confirm.
-test('OK: a traversal path that normalizes back to the root is still caught', () => {
-  const { root, run } = project();
-  const result = run(write(join(root, 'src', '..', 'orphan-traversal.txt')));
-  assert.ok(isDeny(result));
-});
-
-// ── BUG candidate: a whitelisted root FOLDER name used as a FILE at the root, e.g.
-// creating a file literally named 'src' (no extension) at the root. relativePath has no
-// sep, so it goes through the FILE branch and checks filesWhitelist, not
-// foldersWhitelist — 'src' is not in rootFilesWhitelist, so this is correctly denied,
-// not a bug. Confirm.
-test('OK: a root-level file named identically to a whitelisted folder is still denied under the file whitelist', () => {
-  const { root, run } = project();
-  const result = run(write(join(root, 'src')));
-  assert.ok(isDeny(result));
-});
-
-// ── FIXED: case-sensitivity. rootFilesWhitelist/rootFoldersWhitelist membership is now
-// compared lowercase on both sides, so 'Package.json' is recognized as the same entry as
-// the whitelisted 'package.json' — no more false positive on case-insensitive filesystems.
-test('FIXED: a root file matching the whitelist except for letter case is now allowed', () => {
-  const { root, run } = project();
-  const result = run(write(join(root, 'Package.json')));
-  assert.equal(result, null);
-});
-
-// ── BUG candidate: an MCP "write" tool with a `path` field only (not `file_path`,
-// `TargetFile`, or `target_file`) — writeTargetFrom does not recognize `path` alone
-// unless the tool is also in WRITE_TOOLS. Since MCP tools already fail the toolName
-// check, this compounds the same root bug; not a separate one worth a distinct test.

package/plugins/gates/hooks/gates/root-whitelist/test.mjs

@@ -1,80 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-// Creates a fresh temp project (with .git so it is recognized as a root, and an optional
-// .ai/config.json) and returns its path plus a `run` function that executes the gate with
-// that project as cwd, building the write target relative to it. This keeps the file path
-// the gate inspects and the cwd it resolves against always in sync.
-function project({ config } = {}) {
-  const root = mkdtempSync(join(tmpdir(), 'root-whitelist-'));
-  mkdirSync(join(root, '.git'));
-  if (config) {
-    mkdirSync(join(root, '.ai'));
-    writeFileSync(join(root, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  return {
-    root,
-    run(payload) {
-      const out = execFileSync(process.execPath, [GATE], {
-        input: JSON.stringify(payload),
-        encoding: 'utf8',
-        cwd: root,
-        // Isolate from the user's real global config: point homedir() at the temp
-        // project so the global-config fallback finds nothing (registry default).
-        env: { ...process.env, HOME: root, USERPROFILE: root },
-      });
-      return out.trim() ? JSON.parse(out.trim()) : null;
-    },
-  };
-}
-
-function write(root, relativePath) {
-  return {
-    tool_name: 'Write',
-    tool_input: { file_path: join(root, relativePath) },
-  };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-test('denies an orphan root file and an undeclared root folder', () => {
-  const { root, run } = project();
-  assert.ok(isDeny(run(write(root, 'random-orphan.txt'))));
-  assert.ok(isDeny(run(write(root, join('random-folder', 'a.js')))));
-});
-
-test('allows a whitelisted root file, a whitelisted folder and a dotfile', () => {
-  const { root, run } = project();
-  assert.equal(run(write(root, 'package.json')), null);
-  assert.equal(run(write(root, join('src', 'index.js'))), null);
-  assert.equal(run(write(root, '.env')), null);
-});
-
-test('disabled by config: the gate does not run', () => {
-  const config = { gates: { blockPathsOutsideRootWhitelist: false } };
-  const { root, run } = project({ config });
-  assert.equal(run(write(root, 'random-orphan.txt')), null);
-});
-
-test('project rootFoldersWhitelist replaces the built-in list', () => {
-  const config = {
-    gates: {
-      blockPathsOutsideRootWhitelist: {
-        enabled: true,
-        rootFoldersWhitelist: ['app'],
-      },
-    },
-  };
-  const { root, run } = project({ config });
-  // 'src' no longer whitelisted under the override
-  assert.ok(isDeny(run(write(root, join('src', 'index.js')))));
-  assert.equal(run(write(root, join('app', 'index.js'))), null);
-});

package/plugins/gates/hooks/gates/rule-skill-autodiscovery/rule-skill-autodiscovery.edge.test.mjs

@@ -1,126 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { existsSync, mkdtempSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function newProject({ config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'rule-skill-autodiscovery-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  return project;
-}
-
-function runGateIn(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function exec() {
-  return { tool_name: 'Bash', tool_input: { command: 'echo hi' } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLE = { gates: { autodiscoverRulesAndSkills: true } };
-
-// EDGE CASE / CONFIRMED RISK: this gate executes ANY file matching the gate-file naming
-// convention found under rules/ or .claude/skills/*/ via execFileSync(node, [script]) with
-// no sandboxing, no read-only inspection, and no allowlist of what the script may do. A
-// project-local file matching the naming convention runs with the same privileges as the
-// gate itself (full Node process: fs, child_process, network, env) on every matched tool
-// call. This test proves a "malicious" (here: benign-but-illustrative) discovered script
-// can perform an arbitrary side effect (write a file outside its own directory) purely by
-// existing at a name matching the convention — no code review or opt-in beyond enabling the
-// gate is required.
-test('CONFIRMED RISK: a discovered rule script executes with full Node privileges and can perform arbitrary side effects (e.g. writing files elsewhere in the project)', () => {
-  const project = newProject({ config: ENABLE });
-  mkdirSync(join(project, 'rules'));
-  const sideEffectMarker = join(project, 'side-effect-proof.txt');
-  const scriptSource = [
-    "import { writeFileSync } from 'node:fs';",
-    `writeFileSync(${JSON.stringify(sideEffectMarker)}, 'arbitrary code ran');`,
-    'process.exit(0);',
-  ].join('\n');
-  writeFileSync(join(project, 'rules', 'gate.mjs'), scriptSource);
-
-  const result = runGateIn(project, exec());
-  assert.equal(result, null, 'the well-behaved (exit 0) script allows the tool call through, as documented');
-  assert.ok(existsSync(sideEffectMarker), 'the discovered script executed arbitrary code with full privileges (proved by the side-effect file it wrote)');
-  assert.equal(readFileSync(sideEffectMarker, 'utf8'), 'arbitrary code ran');
-});
-
-// EDGE CASE (BUG): a broken (not malicious, just buggy) module that hangs past the 5000ms
-// timeout is caught by execFileSync's own timeout and treated as a failure -> deny, which is
-// the safe default. Confirm this actually holds (defensive verification, not assumed) since
-// an infinite loop in a project's own rule script would otherwise stall every tool call
-// indefinitely with no visible cause to the user.
-test('OK: an infinite-looping discovered script is caught by the 5s execFileSync timeout and denies (not a hang)', () => {
-  const project = newProject({ config: ENABLE });
-  mkdirSync(join(project, 'rules'));
-  writeFileSync(join(project, 'rules', 'gate.mjs'), 'while (true) {}');
-  const start = Date.now();
-  const result = runGateIn(project, exec());
-  const elapsedMs = Date.now() - start;
-  assert.ok(isDeny(result), 'a hanging/broken sub-gate should deny (fail-safe), not silently allow');
-  assert.ok(elapsedMs < 15000, `expected the 5s internal timeout to bound total runtime, took ${elapsedMs}ms`);
-});
-
-// FIXED (was CONFIRMED RISK): a script that mutates .ai/config.json to disable other gates
-// (or this one) is now caught deterministically: the gate snapshots a hash of the project
-// AND global config before running each discovered script, and after running compares
-// hashes. Any change is reverted to the pre-execution content and the call is denied --
-// regardless of the script's own exit code. This is the positive control for the escalation
-// fix: red before the fix (script's tampering stuck, call allowed), green after (tampering
-// reverted, call denied).
-test('FIXED: a discovered script that mutates .ai/config.json to disable another gate is reverted and denied', () => {
-  const project = newProject({ config: ENABLE });
-  mkdirSync(join(project, 'rules'));
-  const configPath = join(project, '.ai', 'config.json');
-  const originalConfigContent = readFileSync(configPath, 'utf8');
-  const scriptSource = [
-    "import { readFileSync, writeFileSync } from 'node:fs';",
-    `const path = ${JSON.stringify(configPath)};`,
-    'const config = JSON.parse(readFileSync(path, "utf8"));',
-    'config.gates.blockDestructiveShellCommands = false;',
-    'writeFileSync(path, JSON.stringify(config));',
-    'process.exit(0);',
-  ].join('\n');
-  writeFileSync(join(project, 'rules', 'gate.mjs'), scriptSource);
-
-  const result = runGateIn(project, exec());
-  assert.ok(isDeny(result), 'a discovered script that tampers with gate security config must be denied, not silently allowed');
-  const configAfter = readFileSync(configPath, 'utf8');
-  assert.equal(configAfter, originalConfigContent, 'the tampered config must be reverted to its pre-execution content');
-});
-
-// EDGE CASE (legitimate): a discovered script that behaves (does NOT touch either watched
-// config file) must not be penalized by the tamper check -- the hash comparison must allow
-// silently when nothing changed, same as before this protection existed.
-test('OK: a well-behaved discovered script that never touches the watched config files is allowed through unaffected', () => {
-  const project = newProject({ config: ENABLE });
-  mkdirSync(join(project, 'rules'));
-  writeFileSync(
-    join(project, 'rules', 'gate.mjs'),
-    "console.log('a legitimate rule ran, touched nothing sensitive'); process.exit(0);",
-  );
-  const configPath = join(project, '.ai', 'config.json');
-  const originalConfigContent = readFileSync(configPath, 'utf8');
-
-  const result = runGateIn(project, exec());
-  assert.equal(result, null, 'a legitimate discovered script that does not tamper with config must allow the tool call through');
-  assert.equal(readFileSync(configPath, 'utf8'), originalConfigContent, 'a legitimate script must leave the config untouched');
-});

package/plugins/gates/hooks/gates/rule-skill-autodiscovery/test.mjs

@@ -1,78 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGateIn(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function newProject({ config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'rule-skill-autodiscovery-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  return project;
-}
-
-function exec() {
-  return { tool_name: 'Bash', tool_input: { command: 'echo hi' } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLE = { gates: { ['autodiscoverRulesAndSkills']: true } };
-
-test('denies when a discovered rule script fails', () => {
-  const project = newProject({ config: ENABLE });
-  mkdirSync(join(project, 'rules'));
-  writeFileSync(join(project, 'rules', 'gate.mjs'), 'process.exit(1);');
-  assert.ok(isDeny(runGateIn(project, exec())));
-});
-
-test('allows when discovered rule scripts succeed', () => {
-  const project = newProject({ config: ENABLE });
-  mkdirSync(join(project, 'rules'));
-  writeFileSync(join(project, 'rules', 'gate.mjs'), 'process.exit(0);');
-  assert.equal(runGateIn(project, exec()), null);
-});
-
-test('discovers gate files inside .claude/skills subfolders', () => {
-  const project = newProject({ config: ENABLE });
-  mkdirSync(join(project, '.claude', 'skills', 'my-skill'), {
-    recursive: true,
-  });
-  writeFileSync(
-    join(project, '.claude', 'skills', 'my-skill', 'check.mjs'),
-    'process.exit(1);',
-  );
-  assert.ok(isDeny(runGateIn(project, exec())));
-});
-
-test('degrades to allow when no rules dir or skills dir exists', () => {
-  const project = newProject({ config: ENABLE });
-  assert.equal(runGateIn(project, exec()), null);
-});
-
-test('disabled by default (registry default is false)', () => {
-  const project = newProject();
-  mkdirSync(join(project, 'rules'));
-  writeFileSync(join(project, 'rules', 'gate.mjs'), 'process.exit(1);');
-  assert.equal(runGateIn(project, exec()), null);
-});