@devrik-tools/claude-gates 0.2.1 → 0.3.0

package/plugins/gates/hooks/gates/test-matrix/edge.edge.test.mjs

@@ -1,63 +0,0 @@
-// Edge-case probe for test-matrix. Previously the prompt was read only from
-// toolInput.prompt/Prompt/task, the same root cause shared by implementation-pipeline,
-// mandatory-flow and the sdd-specs delegation check: a Task delegation carrying its
-// brief in `description` was invisible. Migrated to delegationPromptOf()
-// (hook-io.mjs), so this is now caught.
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'test-matrix-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-function enabledConfig() {
-  return { gates: { requireTestMatrixWhenImplementing: true } };
-}
-
-test('FIXED: a Task delegation carrying its brief in `description` is now checked', () => {
-  const payload = {
-    tool_name: 'Task',
-    tool_input: {
-      description: 'Nivel: STANDARD\nImplementá el cobro de la cuota.',
-      subagent_type: 'backend',
-    },
-  };
-  assert.ok(
-    isDeny(runGate(payload, { config: enabledConfig() })),
-    'delegationPromptOf reads description and the missing-test-matrix deny fires',
-  );
-});
-
-test('OK: the equivalent payload using `prompt` IS caught (control)', () => {
-  const payload = {
-    tool_name: 'Task',
-    tool_input: {
-      prompt: 'Nivel: STANDARD\nImplementá el cobro de la cuota.',
-      subagent_type: 'backend',
-    },
-  };
-  assert.ok(isDeny(runGate(payload, { config: enabledConfig() })), 'control failed');
-});

package/plugins/gates/hooks/gates/test-matrix/test.mjs

@@ -1,114 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'test-matrix-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function delegate(prompt, subagentType = 'backend') {
-  return {
-    tool_name: 'Agent',
-    tool_input: { prompt, subagent_type: subagentType },
-  };
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-function enabledConfig(extraParameters) {
-  return {
-    gates: {
-      requireTestMatrixWhenImplementing: extraParameters
-        ? { enabled: true, ...extraParameters }
-        : true,
-    },
-  };
-}
-
-test('disabled by default: a money-touching brief with no test matrix is allowed', () => {
-  const prompt = 'Nivel: STANDARD\nImplementá el cobro de la cuota.';
-  assert.equal(runGate(delegate(prompt)), null);
-});
-
-test('denies missing unit/mutation on a plain brief with no test type declared', () => {
-  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
-  assert.ok(isDeny(runGate(delegate(prompt), { config: enabledConfig() })));
-});
-
-test('denies missing E2E when the brief touches money and only declares unit tests', () => {
-  const prompt =
-    'Nivel: STANDARD\nImplementá el cobro de la cuota. Verificación: vitest cubre el cálculo.';
-  assert.ok(isDeny(runGate(delegate(prompt), { config: enabledConfig() })));
-});
-
-test('allows a brief that declares unit, E2E and negative cases for a money domain', () => {
-  const prompt =
-    'Nivel: STANDARD\nImplementá el cobro de la cuota. ' +
-    'Verificación: vitest cubre el cálculo. E2E: flujo completo de cobro. ' +
-    'Casos negativos: monto cero, sin saldo, error de red.';
-  assert.equal(runGate(delegate(prompt), { config: enabledConfig() }), null);
-});
-
-test('exempt subagent type (qa) is never held to the matrix requirement', () => {
-  const prompt = 'Nivel: STANDARD\nImplementá el cobro de la cuota.';
-  assert.equal(
-    runGate(delegate(prompt, 'qa'), { config: enabledConfig() }),
-    null,
-  );
-});
-
-test('denies missing E2E for a Spanish money brief (cobro/saldo/cuota), not just its English equivalent', () => {
-  const prompt =
-    'Nivel: STANDARD\nImplementá el cobro de la cuota. Verificación: vitest cubre el cálculo.';
-  const result = runGate(delegate(prompt), { config: enabledConfig() });
-  assert.ok(isDeny(result));
-  assert.ok(result.hookSpecificOutput.permissionDecisionReason.includes('E2E'));
-});
-
-test('bilingual control: an EN money brief with only unit coverage denies for the same reason as its ES equivalent', () => {
-  const es = 'Nivel: STANDARD\nImplementá el cobro de la cuota. Verificación: vitest cubre el cálculo.';
-  const en = 'Level: STANDARD\nImplement the fee charge. Verification: vitest covers the calculation.';
-  const resultEs = runGate(delegate(es), { config: enabledConfig() });
-  const resultEn = runGate(delegate(en), { config: enabledConfig() });
-  assert.ok(isDeny(resultEs));
-  assert.ok(isDeny(resultEn));
-  assert.ok(resultEs.hookSpecificOutput.permissionDecisionReason.includes('E2E'));
-  assert.ok(resultEn.hookSpecificOutput.permissionDecisionReason.includes('E2E'));
-});
-
-test('allows a Spanish brief that declares unit, E2E and negative cases with Spanish wording', () => {
-  const prompt =
-    'Nivel: STANDARD\nImplementá el cobro de la cuota. ' +
-    'Verificación: pruebas unitarias cubren el calculo. E2E: flujo completo de cobro. ' +
-    'Casos negativos: monto cero, sin saldo, entrada invalida.';
-  assert.equal(runGate(delegate(prompt), { config: enabledConfig() }), null);
-});
-
-test('e2eSignals param override makes a domain word mandatory that the default list omits', () => {
-  const prompt =
-    'Nivel: STANDARD\nImplementá el módulo de inventario. Verificación: vitest cubre el cálculo.';
-  const config = enabledConfig({ e2eSignals: ['inventario|inventory'] });
-  assert.ok(isDeny(runGate(delegate(prompt), { config })));
-});

package/plugins/gates/hooks/gates/tool-map/edge.edge.test.mjs

@@ -1,62 +0,0 @@
-// Edge-case probe for tool-map. Previously the same Edit/new_string content-field gap
-// as feature-catalog/sdd-specs meant a legitimately-audited tool created/edited via
-// Edit's `new_string` was never recorded in .ai/tool-map.json, so reuse-before-build
-// kept re-blocking a tool that was already cleared once. Migrated to
-// writtenContentOf()/writtenPathOf() (hook-io.mjs), which read new_string, so this is
-// now recorded the same as a Write.
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync, existsSync, readFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload) {
-  const project = mkdtempSync(join(tmpdir(), 'tool-map-edge-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'));
-  writeFileSync(
-    join(project, '.ai', 'config.json'),
-    JSON.stringify({ gates: { maintainToolMap: true } }),
-  );
-  execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return { mapPath: join(project, '.ai', 'tool-map.json') };
-}
-
-test('FIXED: an audited tool written via Edit (new_string) is now recorded', () => {
-  const payload = {
-    tool_name: 'Edit',
-    tool_input: {
-      file_path: 'scripts/new-tool.mjs',
-      old_string: '',
-      new_string: '// audited: nothing does this\nexport function parse(){}',
-    },
-  };
-  const { mapPath } = runGate(payload);
-  assert.ok(
-    existsSync(mapPath),
-    'writtenContentOf must read new_string so an Edit-created tool is persisted',
-  );
-  const map = JSON.parse(readFileSync(mapPath, 'utf8'));
-  assert.equal(map.tools[0].path, 'scripts/new-tool.mjs');
-});
-
-test('OK: the equivalent Write-tool payload IS recorded (control)', () => {
-  const payload = {
-    tool_name: 'Write',
-    tool_input: {
-      file_path: 'scripts/new-tool.mjs',
-      content: '// audited: nothing does this\nexport function parse(){}',
-    },
-  };
-  const { mapPath } = runGate(payload);
-  assert.ok(existsSync(mapPath), 'control failed');
-});

package/plugins/gates/hooks/gates/tool-map/test.mjs

@@ -1,87 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import {
-  mkdtempSync,
-  mkdirSync,
-  writeFileSync,
-  existsSync,
-  readFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-// Runs the gate in a temp project (with .git). The gate is off by default, so config
-// enables it. Returns { output, mapPath, project } so a test can inspect the written map.
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'tool-map-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'));
-  const effectiveConfig = config ?? { gates: { maintainToolMap: true } };
-  writeFileSync(
-    join(project, '.ai', 'config.json'),
-    JSON.stringify(effectiveConfig),
-  );
-  const output = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return {
-    output: output.trim(),
-    mapPath: join(project, '.ai', 'tool-map.json'),
-  };
-}
-
-function writeTool(filePath, content) {
-  return { tool_name: 'Write', tool_input: { file_path: filePath, content } };
-}
-
-test('records a new tool that declares its audit', () => {
-  const { mapPath } = runGate(
-    writeTool(
-      'scripts/csv-parser.mjs',
-      '// Justification: no existing tool covers this.\nexport {}',
-    ),
-  );
-  assert.ok(existsSync(mapPath));
-  const map = JSON.parse(readFileSync(mapPath, 'utf8'));
-  assert.equal(map.tools.length, 1);
-  assert.equal(map.tools[0].path, 'scripts/csv-parser.mjs');
-  assert.match(map.tools[0].audit, /no existing tool/i);
-});
-
-test('does not record a tool without an audit line', () => {
-  const { mapPath } = runGate(
-    writeTool('scripts/thing.mjs', 'export function thing() {}'),
-  );
-  assert.ok(!existsSync(mapPath));
-});
-
-test('ignores a non-tool write', () => {
-  const { mapPath } = runGate(writeTool('docs/readme.md', 'audited: hi'));
-  assert.ok(!existsSync(mapPath));
-});
-
-test('does not duplicate an already-recorded tool', () => {
-  // Two writes of the same tool path record it once.
-  const first = runGate(
-    writeTool('scripts/x.mjs', '// audited: nothing does this\nexport {}'),
-  );
-  const map = JSON.parse(readFileSync(first.mapPath, 'utf8'));
-  assert.equal(map.tools.length, 1);
-});
-
-test('disabled by config: does not record', () => {
-  const { mapPath } = runGate(
-    writeTool('scripts/y.mjs', '// audited: none\nexport {}'),
-    { config: { gates: { maintainToolMap: false } } },
-  );
-  assert.ok(!existsSync(mapPath));
-});

package/plugins/gates/hooks/lib/__tests__/config.test.mjs

@@ -1,173 +0,0 @@
-import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { test } from 'node:test';
-import { isGateEnabled, gateParameters } from '../config.mjs';
-
-const GATE_KEY = 'blockDestructiveShellCommands';
-
-function temporaryDirectory() {
-  return mkdtempSync(join(tmpdir(), 'claude-gates-config-'));
-}
-
-/** A project directory with a .git marker so config.mjs finds a project root. */
-function projectDirectory() {
-  const root = temporaryDirectory();
-  mkdirSync(join(root, '.git'));
-  return root;
-}
-
-function writeProjectConfig(root, config) {
-  mkdirSync(join(root, '.ai'), { recursive: true });
-  writeFileSync(join(root, '.ai', 'config.json'), JSON.stringify(config));
-}
-
-function writeGlobalConfig(home, config) {
-  const directory = join(home, '.claude', 'claude-gates');
-  mkdirSync(directory, { recursive: true });
-  writeFileSync(join(directory, 'config.json'), JSON.stringify(config));
-}
-
-test('isGateEnabled falls back to the registry default when no config exists anywhere', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  assert.equal(isGateEnabled(GATE_KEY, true, project, { home }), true);
-  assert.equal(isGateEnabled(GATE_KEY, false, project, { home }), false);
-});
-
-test('isGateEnabled reads a bool shorthand entry from the project config', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  writeProjectConfig(project, { gates: { [GATE_KEY]: false } });
-  assert.equal(isGateEnabled(GATE_KEY, true, project, { home }), false);
-
-  const projectTrue = projectDirectory();
-  writeProjectConfig(projectTrue, { gates: { [GATE_KEY]: true } });
-  assert.equal(isGateEnabled(GATE_KEY, false, projectTrue, { home }), true);
-});
-
-test('isGateEnabled reads an object entry with an explicit enabled flag', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  writeProjectConfig(project, {
-    gates: { [GATE_KEY]: { enabled: false, someParam: 'x' } },
-  });
-  assert.equal(isGateEnabled(GATE_KEY, true, project, { home }), false);
-});
-
-test('isGateEnabled treats an object entry with no enabled field as silent (uses registry default)', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  writeProjectConfig(project, {
-    gates: { [GATE_KEY]: { someParam: 'x' } },
-  });
-  assert.equal(isGateEnabled(GATE_KEY, true, project, { home }), true);
-  assert.equal(isGateEnabled(GATE_KEY, false, project, { home }), false);
-});
-
-test('isGateEnabled falls back to the global config when the project declares nothing', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  writeGlobalConfig(home, { gates: { [GATE_KEY]: false } });
-  assert.equal(isGateEnabled(GATE_KEY, true, project, { home }), false);
-});
-
-test('isGateEnabled: an existing project config wins over the global config even if silent about this gate', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  writeGlobalConfig(home, { gates: { [GATE_KEY]: false } });
-  writeProjectConfig(project, { gates: {} });
-  // Project config exists (even without this gate declared): registry default wins,
-  // global's false must NOT leak through.
-  assert.equal(isGateEnabled(GATE_KEY, true, project, { home }), true);
-});
-
-test('isGateEnabled: corrupt project config is treated as absent and falls through to global', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(join(project, '.ai', 'config.json'), '{not valid json');
-  writeGlobalConfig(home, { gates: { [GATE_KEY]: false } });
-  assert.equal(isGateEnabled(GATE_KEY, true, project, { home }), false);
-});
-
-test('isGateEnabled: a malformed entry (string/number) is ignored, falls back to registry default', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  writeProjectConfig(project, { gates: { [GATE_KEY]: 'yes' } });
-  assert.equal(isGateEnabled(GATE_KEY, true, project, { home }), true);
-  assert.equal(isGateEnabled(GATE_KEY, false, project, { home }), false);
-
-  const projectNumber = projectDirectory();
-  writeProjectConfig(projectNumber, { gates: { [GATE_KEY]: 1 } });
-  assert.equal(isGateEnabled(GATE_KEY, false, projectNumber, { home }), false);
-});
-
-test('gateParameters returns {} when nothing is declared for the gate', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  writeProjectConfig(project, { gates: {} });
-  assert.deepEqual(gateParameters(GATE_KEY, project, { home }), {});
-});
-
-test('gateParameters returns {} for a bool shorthand entry (no params, just enabled)', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  writeProjectConfig(project, { gates: { [GATE_KEY]: true } });
-  assert.deepEqual(gateParameters(GATE_KEY, project, { home }), {});
-});
-
-test('gateParameters strips enabled and returns the remaining params from the project config', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  writeProjectConfig(project, {
-    gates: {
-      [GATE_KEY]: { enabled: true, protectedPaths: ['a', 'b'] },
-    },
-  });
-  assert.deepEqual(gateParameters(GATE_KEY, project, { home }), {
-    protectedPaths: ['a', 'b'],
-  });
-});
-
-test('gateParameters: project params replace (do not merge with) global params', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  writeGlobalConfig(home, {
-    gates: {
-      [GATE_KEY]: { protectedPaths: ['global-a'], extra: 'g' },
-    },
-  });
-  writeProjectConfig(project, {
-    gates: { [GATE_KEY]: { protectedPaths: ['project-a'] } },
-  });
-  assert.deepEqual(gateParameters(GATE_KEY, project, { home }), {
-    protectedPaths: ['project-a'],
-  });
-});
-
-test('gateParameters returns {} when no config exists anywhere', () => {
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  assert.deepEqual(gateParameters(GATE_KEY, project, { home }), {});
-});
-
-test('a project config saved WITH a UTF-8 BOM is still read (not silently dropped)', () => {
-  // A BOM is what a Windows editor or PowerShell 5.1 `Set-Content -Encoding utf8` prepends.
-  // Before the fix, JSON.parse threw on the leading BOM, the project config was treated as
-  // absent, and its gate disables were silently ignored (falling through to global/registry).
-  // Here the project disables the gate; the BOM must not resurrect it.
-  const project = projectDirectory();
-  const home = temporaryDirectory();
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(
-    join(project, '.ai', 'config.json'),
-    '' + JSON.stringify({ gates: { [GATE_KEY]: { enabled: false } } }),
-  );
-  assert.equal(
-    isGateEnabled(GATE_KEY, true, project, { home }),
-    false,
-    'the BOM-prefixed project disable must take effect',
-  );
-});