@devrik-tools/claude-gates 0.2.1 → 0.3.0

package/plugins/gates/hooks/gates/protected-paths/test.mjs

@@ -1,75 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-// Runs the gate as its own process (it calls process.exit), feeding a payload on stdin
-// from inside a temp project so the gate's config lookup is isolated. Returns the parsed
-// stdout, or null when the gate allowed (no output).
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'protected-paths-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function write(filePath) {
-  return { tool_name: 'Write', tool_input: { file_path: filePath } };
-}
-function bash(command) {
-  return { tool_name: 'Bash', tool_input: { command } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-test('denies writing to .env and a mutating shell command targeting it', () => {
-  assert.ok(isDeny(runGate(write('/repo/.env'))));
-  assert.ok(isDeny(runGate(bash('rm .env'))));
-  assert.ok(isDeny(runGate(bash('touch package-lock.json'))));
-});
-
-test('allows an innocuous write and a read-only command mentioning a protected path', () => {
-  assert.equal(runGate(write('/repo/src/index.js')), null);
-  assert.equal(runGate(bash('echo "reading .env for debugging"')), null);
-  assert.equal(runGate(bash('cat .env')), null);
-});
-
-test('disabled by config: the gate does not run', () => {
-  assert.equal(
-    runGate(write('/repo/.env'), {
-      config: { gates: { blockWritesToProtectedPaths: false } },
-    }),
-    null,
-  );
-});
-
-test('project protectedPaths replaces the built-in list', () => {
-  const config = {
-    gates: {
-      blockWritesToProtectedPaths: {
-        enabled: true,
-        protectedPaths: ['secrets.yaml'],
-      },
-    },
-  };
-  // .env no longer protected under the override
-  assert.equal(runGate(write('/repo/.env'), { config }), null);
-  assert.ok(isDeny(runGate(write('/repo/secrets.yaml'), { config })));
-});

package/plugins/gates/hooks/gates/recurrence-lock/recurrence-lock.edge.test.mjs

@@ -1,102 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function newProject({ config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'recurrence-lock-edge-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  if (config) {
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  return project;
-}
-
-function runGateIn(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function exec() {
-  return { tool_name: 'Bash', tool_input: { command: 'echo hi' } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-// EDGE CASE (BUG): mcp__ide__executeCode is part of TOOL_GROUPS.execution (lib/hook-io.mjs
-// line 37-46) and this gate checks TOOL_GROUPS.execution.includes(toolName), so this should
-// actually be covered. Verify it is (defensive check — not assumed).
-test('OK: mcp__ide__executeCode is covered because it is in TOOL_GROUPS.execution', () => {
-  const project = newProject();
-  writeFileSync(
-    join(project, '.ai', 'reincidencias.json'),
-    JSON.stringify({ classes: [{ class: 'x', occurrences: [1, 2], status: 'open' }] }),
-  );
-  assert.ok(isDeny(runGateIn(project, { tool_name: 'mcp__ide__executeCode', tool_input: {} })));
-});
-
-// FIXED (was BUG): status is now trimmed before lowercasing, so a padded/capitalized status
-// like "Closed " (trailing space) is correctly recognized as closed and no longer sticks the
-// lock on a legitimately-resolved recurrence. A genuine typo like "closd" must still NOT be
-// recognized (no typo-tolerance) and stays open-blocking, as expected.
-test('FIXED: a status of "Closed " (capitalized, trailing space) is trimmed and recognized as closed, unblocking the recurrence', () => {
-  const project = newProject();
-  writeFileSync(
-    join(project, '.ai', 'reincidencias.json'),
-    JSON.stringify({ classes: [{ class: 'x', occurrences: [1, 2], status: 'Closed ' }] }),
-  );
-  assert.equal(runGateIn(project, exec()), null, 'a padded/capitalized "Closed " status must be trimmed and recognized as closed, allowing the tool call through');
-});
-
-test('OK: a genuine typo status like "closd" is NOT recognized as closed and stays open-blocking (no typo-tolerance)', () => {
-  const project = newProject();
-  writeFileSync(
-    join(project, '.ai', 'reincidencias.json'),
-    JSON.stringify({ classes: [{ class: 'x', occurrences: [1, 2], status: 'closd' }] }),
-  );
-  assert.ok(isDeny(runGateIn(project, exec())), 'a typo status must not be silently treated as closed');
-});
-
-// FIXED (was BUG): occurrences are now deduplicated (by id/hash, or by value for bare
-// scalars) before counting against the threshold. `occurrences: [1, 1]` is the same
-// occurrence logged twice (e.g. by a race or a bug in the writer) and must no longer count
-// as two distinct occurrences.
-test('FIXED: duplicate identical entries in occurrences[] are deduplicated before counting, so [1, 1] does not reach a threshold of 2', () => {
-  const project = newProject();
-  writeFileSync(
-    join(project, '.ai', 'reincidencias.json'),
-    JSON.stringify({ classes: [{ class: 'dup', occurrences: [1, 1], status: 'open' }] }),
-  );
-  assert.equal(runGateIn(project, exec()), null, 'duplicate occurrence entries must be deduplicated before comparing against thresholdAppearances');
-});
-
-// OK: genuinely distinct occurrences (even with the same shape) must still count normally —
-// dedup must not under-count real, distinct recurrences.
-test('OK: distinct occurrence entries (identified by id) still count toward the threshold normally', () => {
-  const project = newProject();
-  writeFileSync(
-    join(project, '.ai', 'reincidencias.json'),
-    JSON.stringify({
-      classes: [
-        {
-          class: 'distinct',
-          occurrences: [{ id: 'a' }, { id: 'b' }],
-          status: 'open',
-        },
-      ],
-    }),
-  );
-  assert.ok(isDeny(runGateIn(project, exec())), 'two genuinely distinct occurrences (different ids) must still trip the threshold');
-});

package/plugins/gates/hooks/gates/recurrence-lock/test.mjs

@@ -1,99 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function newProject({ config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'recurrence-lock-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  if (config) {
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  return project;
-}
-
-function runGateIn(project, payload) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function exec() {
-  return { tool_name: 'Bash', tool_input: { command: 'echo hi' } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-test('denies when an open recurrence class is at/above threshold', () => {
-  const project = newProject();
-  writeFileSync(
-    join(project, '.ai', 'reincidencias.json'),
-    JSON.stringify({
-      classes: [
-        { class: 'duplicate-catch', occurrences: [1, 2], status: 'open' },
-      ],
-    }),
-  );
-  assert.ok(isDeny(runGateIn(project, exec())));
-});
-
-test('allows when the recurrence class is closed', () => {
-  const project = newProject();
-  writeFileSync(
-    join(project, '.ai', 'reincidencias.json'),
-    JSON.stringify({
-      classes: [
-        { class: 'duplicate-catch', occurrences: [1, 2], status: 'closed' },
-      ],
-    }),
-  );
-  assert.equal(runGateIn(project, exec()), null);
-});
-
-test('degrades to allow when the recurrence file does not exist', () => {
-  const project = newProject();
-  assert.equal(runGateIn(project, exec()), null);
-});
-
-test('disabled by config: the gate does not run', () => {
-  const project = newProject({
-    config: { gates: { blockRegisteredRecurrences: false } },
-  });
-  writeFileSync(
-    join(project, '.ai', 'reincidencias.json'),
-    JSON.stringify({
-      classes: [{ class: 'x', occurrences: [1, 2], status: 'open' }],
-    }),
-  );
-  assert.equal(runGateIn(project, exec()), null);
-});
-
-test('thresholdAppearances override changes the trigger point', () => {
-  const project = newProject({
-    config: {
-      gates: {
-        blockRegisteredRecurrences: { enabled: true, thresholdAppearances: 3 },
-      },
-    },
-  });
-  writeFileSync(
-    join(project, '.ai', 'reincidencias.json'),
-    JSON.stringify({
-      classes: [{ class: 'x', occurrences: [1, 2], status: 'open' }],
-    }),
-  );
-  assert.equal(runGateIn(project, exec()), null);
-});

package/plugins/gates/hooks/gates/reuse-before-build/edge.edge.test.mjs

@@ -1,94 +0,0 @@
-// Edge-case probes for reuse-before-build. Previously: (1) TOOL_FOLDERS matching was a
-// bare substring test on the normalized path, so a legitimate folder like
-// "src/mytools/thing.mjs" was misclassified as a tool build (false positive) because
-// it contains the substring "tools/"; (2) checkDelegation read the prompt only from
-// toolInput.prompt/description, so a delegation using another field name (e.g. `task`)
-// was invisible; (3) an MCP-style write tool name (not in the old TOOL_GROUPS.write
-// Set) bypassed the gate entirely. All three are now fixed: isExecutableToolPath
-// compares whole path SEGMENTS (not substrings), delegationPromptOf() reads
-// task/instructions/message/input too, and toolInGroups() classifies any mcp__* tool
-// by its action segment so an unrecognized MCP write name is still caught.
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'reuse-before-build-edge-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'));
-  const effectiveConfig = config ?? {
-    gates: { requireReuseCheckBeforeBuilding: true },
-  };
-  writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(effectiveConfig));
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-test('FIXED: a legitimate "mytools/" folder is no longer misclassified as a tool build', () => {
-  const payload = {
-    tool_name: 'Write',
-    tool_input: { file_path: 'src/mytools/thing.mjs', content: 'export function thing(){}' },
-  };
-  assert.equal(
-    isDeny(runGate(payload)),
-    false,
-    'isExecutableToolPath must compare whole path segments, not substrings: "mytools" ' +
-      'is not the segment "tools"',
-  );
-});
-
-test('FIXED: a real "tools/" folder is still caught (control for the segment fix)', () => {
-  const payload = {
-    tool_name: 'Write',
-    tool_input: { file_path: 'tools/thing.mjs', content: 'export function thing(){}' },
-  };
-  assert.ok(
-    isDeny(runGate(payload)),
-    'a genuine tools/ segment must still trigger the gate',
-  );
-});
-
-test('FIXED: an MCP-style write tool name is no longer invisible to the gate', () => {
-  const payload = {
-    tool_name: 'mcp__filesystem__write_file',
-    tool_input: { file_path: 'scripts/new-tool.mjs', content: 'export function parse(){}' },
-  };
-  assert.ok(
-    isDeny(runGate(payload)),
-    'toolInGroups must classify an MCP write tool by its action segment (write_file)',
-  );
-});
-
-test('FIXED: a delegation prompt carried in `task` (not prompt/description) is now checked', () => {
-  const payload = {
-    tool_name: 'Agent',
-    tool_input: { task: 'Please write a new script that parses CSV files.' },
-  };
-  assert.ok(
-    isDeny(runGate(payload)),
-    'delegationPromptOf must read the `task` field',
-  );
-});
-
-test('OK: the equivalent Write-tool payload IS caught (control)', () => {
-  const payload = {
-    tool_name: 'Write',
-    tool_input: { file_path: 'scripts/new-tool.mjs', content: 'export function parse(){}' },
-  };
-  assert.ok(isDeny(runGate(payload)), 'control failed');
-});

package/plugins/gates/hooks/gates/reuse-before-build/test.mjs

@@ -1,101 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-// Runs the gate as a child process inside a temp project (with .git so config/root resolve).
-// The gate is off by default, so config enables it unless a test overrides that. An optional
-// tool map is seeded. Returns parsed stdout or null when it allowed.
-function runGate(payload, { config, toolMap } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'reuse-before-build-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'));
-  const effectiveConfig = config ?? {
-    gates: { requireReuseCheckBeforeBuilding: true },
-  };
-  writeFileSync(
-    join(project, '.ai', 'config.json'),
-    JSON.stringify(effectiveConfig),
-  );
-  if (toolMap) {
-    writeFileSync(
-      join(project, '.ai', 'tool-map.json'),
-      JSON.stringify(toolMap),
-    );
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function writeTool(content) {
-  return {
-    tool_name: 'Write',
-    tool_input: { file_path: 'scripts/csv-parser.mjs', content },
-  };
-}
-function delegate(prompt) {
-  return { tool_name: 'Agent', tool_input: { prompt } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-test('denies building a new tool without an audit', () => {
-  assert.ok(isDeny(runGate(writeTool('export function parse() {}'))));
-  assert.ok(
-    isDeny(
-      runGate(delegate('Please write a new script that parses CSV files.')),
-    ),
-  );
-});
-
-test('allows when the text declares an audit was done', () => {
-  assert.equal(
-    runGate(
-      writeTool('// Justification: no existing tool covers this.\nexport {}'),
-    ),
-    null,
-  );
-  assert.equal(
-    runGate(
-      delegate('Write a new script for CSV — I audited and nothing does this.'),
-    ),
-    null,
-  );
-});
-
-test('allows when the need is already recorded in the tool map', () => {
-  const toolMap = { tools: [{ path: 'scripts/csv-parser.mjs', audit: 'x' }] };
-  assert.equal(runGate(writeTool('export {}'), { toolMap }), null);
-});
-
-test('ignores non-tool writes (a plain markdown file)', () => {
-  assert.equal(
-    runGate({
-      tool_name: 'Write',
-      tool_input: { file_path: 'docs/readme.md', content: 'hello' },
-    }),
-    null,
-  );
-});
-
-test('disabled by config: the gate does not run', () => {
-  assert.equal(
-    runGate(writeTool('export {}'), {
-      config: { gates: { requireReuseCheckBeforeBuilding: false } },
-    }),
-    null,
-  );
-});

package/plugins/gates/hooks/gates/risk-level/risk-level.edge.test.mjs

@@ -1,116 +0,0 @@
-// Edge-case audit for risk-level. Each test demonstrates a confirmed BUG or an OK.
-// Run: node --test risk-level.edge.test.mjs
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'risk-level-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLED = { config: { gates: { requireDeclaredRiskLevel: true } } };
-
-const SENSITIVE_NO_LEVEL =
-  'Implementa el cobro del pago con la nueva pasarela de dinero para el checkout.';
-
-test('FIXED: a delegation tool name outside the native list is now caught via toolInGroups (MCP delegation signal)', () => {
-  const result = runGate(
-    { tool_name: 'mcp__orchestrator__spawn_agent', tool_input: { prompt: SENSITIVE_NO_LEVEL } },
-    ENABLED,
-  );
-  assert.ok(isDeny(result), 'gate now denies the no-level prompt under the MCP tool name too');
-});
-
-test('FIXED: prompt carried in a field other than prompt/description/task is now read via delegationPromptOf', () => {
-  const result = runGate(
-    { tool_name: 'Agent', tool_input: { instructions: SENSITIVE_NO_LEVEL } },
-    ENABLED,
-  );
-  assert.ok(isDeny(result), 'gate now sees the prompt under "instructions" and denies it for missing LEVEL');
-});
-
-test('FIXED: a mutation-risk signal in the prompt overrides a whitelisted read-only subagent name', () => {
-  const result = runGate(
-    { tool_name: 'Agent', tool_input: { prompt: SENSITIVE_NO_LEVEL, subagent_type: 'plan' } },
-    ENABLED,
-  );
-  assert.ok(
-    isDeny(result),
-    'gate no longer exempts a real money-mutation delegation solely because subagent_type says "plan"',
-  );
-});
-
-test('FIXED: the LAST level declaration governs, not the first (a decoy early mention no longer wins)', () => {
-  // Previously DECLARED_LEVEL_PATTERN.exec(prompt) (no /g) took only the first match, so
-  // a decoy HIGH-RISK mention near the top let a real MICRO-declared money mutation
-  // through. operativeLevel() now takes the LAST declaration as operative: MICRO governs
-  // here and the real money-mutation signal contradicts it, so the gate denies.
-  const prompt =
-    'NIVEL: HIGH-RISK (nota: eso era para la tarea anterior, ignorar). Para esta tarea: NIVEL: MICRO. ' +
-    'Implementa el cobro del pago con la nueva pasarela de dinero para el checkout.';
-  const result = runGate({ tool_name: 'Agent', tool_input: { prompt } }, ENABLED);
-  assert.ok(
-    isDeny(result),
-    'gate now denies: the operative (last) declaration is MICRO, which contradicts the real money-mutation signal',
-  );
-});
-
-test('FIXED: two DIFFERENT levels that both look operative are denied as ambiguous, not silently resolved', () => {
-  const prompt =
-    'NIVEL: MICRO. Mas adelante, NIVEL: HIGH-RISK. Arregla el boton que no cambia de color en la pagina.';
-  const result = runGate({ tool_name: 'Agent', tool_input: { prompt } }, ENABLED);
-  assert.ok(
-    isDeny(result),
-    'gate denies and asks for a single unambiguous LEVEL when multiple different levels are declared',
-  );
-});
-
-test('OK: repeating the SAME level twice is not treated as ambiguous', () => {
-  const result = runGate(
-    {
-      tool_name: 'Agent',
-      tool_input: {
-        prompt:
-          'NIVEL: STANDARD. Como se declaro, NIVEL: STANDARD. Arregla el boton que no cambia de color.',
-      },
-    },
-    ENABLED,
-  );
-  assert.equal(result, null);
-});
-
-test('OK: same sensitive prompt without a read-only subagent name and no level is denied', () => {
-  const result = runGate({ tool_name: 'Agent', tool_input: { prompt: SENSITIVE_NO_LEVEL } }, ENABLED);
-  assert.ok(isDeny(result));
-});
-
-test('OK: Task and invoke_subagent tool names are both covered', () => {
-  assert.ok(isDeny(runGate({ tool_name: 'Task', tool_input: { prompt: SENSITIVE_NO_LEVEL } }, ENABLED)));
-  assert.ok(
-    isDeny(
-      runGate({ tool_name: 'invoke_subagent', tool_input: { prompt: SENSITIVE_NO_LEVEL } }, ENABLED),
-    ),
-  );
-});