@devrik-tools/claude-gates 0.2.1 → 0.3.0

package/plugins/gates/hooks/lib/__tests__/hook-io.test.mjs

@@ -1,223 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { test } from 'node:test';
-import { pathToFileURL } from 'node:url';
-import {
-  toolNamesFor,
-  matcherFor,
-  toolNameOf,
-  sessionIdOf,
-  toolInputOf,
-  toolInGroups,
-  writtenContentOf,
-  writtenPathOf,
-  delegationPromptOf,
-  shellWrittenPaths,
-} from '../hook-io.mjs';
-
-// deny/warn/allow/runGate call process.exit and cannot be invoked in-process without
-// killing the test runner. They are exercised here as a child process instead; each
-// gate's own tests additionally cover runGate's wiring through its real check function.
-
-test('toolNamesFor expands a single group', () => {
-  assert.deepEqual(toolNamesFor(['question']), ['AskUserQuestion']);
-});
-
-test('toolNamesFor expands multiple groups and de-duplicates overlapping names', () => {
-  const names = toolNamesFor(['write', 'execution']);
-  // 'execution' repeats every 'write' tool plus Bash/run_command/mcp__ide__executeCode.
-  assert.equal(names.filter((name) => name === 'Write').length, 1);
-  assert.ok(names.includes('Write'));
-  assert.ok(names.includes('Bash'));
-  assert.ok(names.includes('mcp__ide__executeCode'));
-});
-
-test('toolNamesFor returns an empty list for an empty group set', () => {
-  assert.deepEqual(toolNamesFor([]), []);
-});
-
-test('toolNamesFor ignores an unknown group name', () => {
-  assert.deepEqual(toolNamesFor(['not-a-real-group']), []);
-});
-
-test('matcherFor joins native tool names with a pipe and always appends the mcp__.* clause', () => {
-  // The trailing `mcp__.*` makes Claude Code route EVERY MCP tool call to the hook, so the
-  // gate can classify it at runtime with toolInGroups. Without it, the hook is never even
-  // invoked for an MCP tool — the deepest layer of the MCP blind spot.
-  assert.equal(matcherFor(['question']), 'AskUserQuestion|mcp__.*');
-  assert.equal(matcherFor(['shell']), 'Bash|run_command|mcp__.*');
-});
-
-test('matcherFor still matches MCP tools even for an empty native group set', () => {
-  // An empty group means "no native names", but MCP tools must still reach the hook.
-  assert.equal(matcherFor([]), 'mcp__.*');
-});
-
-test('toolInGroups matches native names exactly and case-insensitively', () => {
-  assert.equal(toolInGroups('Write', ['write']), true);
-  assert.equal(toolInGroups('write', ['write']), true); // case-insensitive
-  assert.equal(toolInGroups('AskUserQuestion', ['question']), true);
-  assert.equal(toolInGroups('Bash', ['write']), false); // wrong group
-  assert.equal(toolInGroups('', ['write']), false); // empty tool name
-});
-
-test('toolInGroups classifies MCP tools by their action segment', () => {
-  assert.equal(toolInGroups('mcp__filesystem__write_file', ['write']), true);
-  assert.equal(toolInGroups('mcp__fs__edit_file', ['write']), true);
-  assert.equal(toolInGroups('mcp__shell__exec', ['shell']), true);
-  assert.equal(toolInGroups('mcp__x__ask_user_confirmation', ['question']), true);
-  assert.equal(toolInGroups('mcp__orchestrator__spawn_agent', ['delegation']), true);
-  // A read-only MCP tool must NOT match a write/shell group.
-  assert.equal(toolInGroups('mcp__fs__read_file', ['write', 'shell']), false);
-  // Malformed mcp name (no action segment) does not match.
-  assert.equal(toolInGroups('mcp__server', ['write']), false);
-});
-
-test('writtenContentOf reads content across native and MCP field shapes', () => {
-  assert.equal(writtenContentOf({ content: 'a' }), 'a'); // Write
-  assert.equal(writtenContentOf({ new_string: 'b' }), 'b'); // Edit
-  assert.equal(writtenContentOf({ new_source: 'c' }), 'c'); // NotebookEdit
-  assert.equal(writtenContentOf({ new_content: 'd' }), 'd'); // replace_file_content
-  assert.equal(writtenContentOf({ text: 'e' }), 'e'); // an MCP shape
-  assert.equal(
-    writtenContentOf({ edits: [{ new_string: 'x' }, { new_string: 'y' }] }),
-    'x\ny',
-  ); // MultiEdit
-  assert.equal(writtenContentOf({}), '');
-  assert.equal(writtenContentOf(null), '');
-});
-
-test('writtenPathOf reads the target path across field shapes', () => {
-  assert.equal(writtenPathOf({ file_path: 'a.js' }), 'a.js');
-  assert.equal(writtenPathOf({ path: 'b.js' }), 'b.js');
-  assert.equal(writtenPathOf({ notebook_path: 'n.ipynb' }), 'n.ipynb');
-  assert.equal(writtenPathOf({}), '');
-});
-
-test('delegationPromptOf reads the brief across field shapes', () => {
-  assert.equal(delegationPromptOf({ prompt: 'a' }), 'a');
-  assert.equal(delegationPromptOf({ description: 'b' }), 'b'); // Task
-  assert.equal(delegationPromptOf({ instructions: 'c' }), 'c'); // an MCP shape
-  assert.equal(delegationPromptOf({}), '');
-});
-
-test('toolNameOf reads tool_name, falls back to name, defaults to empty string', () => {
-  assert.equal(toolNameOf(JSON.stringify({ tool_name: 'Bash' })), 'Bash');
-  assert.equal(toolNameOf(JSON.stringify({ name: 'Edit' })), 'Edit');
-  assert.equal(
-    toolNameOf(JSON.stringify({ tool_name: 'Bash', name: 'Edit' })),
-    'Bash',
-  );
-  assert.equal(toolNameOf(JSON.stringify({})), '');
-});
-
-test('toolNameOf returns null for unparseable payloads', () => {
-  assert.equal(toolNameOf('{not json'), null);
-  assert.equal(toolNameOf(undefined), null);
-});
-
-test('sessionIdOf reads session_id or returns null when absent/unparseable', () => {
-  assert.equal(sessionIdOf(JSON.stringify({ session_id: 'abc123' })), 'abc123');
-  assert.equal(sessionIdOf(JSON.stringify({})), null);
-  assert.equal(sessionIdOf('{not json'), null);
-});
-
-test('toolInputOf reads tool_input, falls back to input, defaults to {}', () => {
-  assert.deepEqual(
-    toolInputOf(JSON.stringify({ tool_input: { command: 'ls' } })),
-    { command: 'ls' },
-  );
-  assert.deepEqual(toolInputOf(JSON.stringify({ input: { file: 'a' } })), {
-    file: 'a',
-  });
-  assert.deepEqual(
-    toolInputOf(JSON.stringify({ tool_input: { a: 1 }, input: { b: 2 } })),
-    { a: 1 },
-  );
-  assert.deepEqual(toolInputOf(JSON.stringify({})), {});
-});
-
-test('toolInputOf returns {} for unparseable payloads', () => {
-  assert.deepEqual(toolInputOf('{not json'), {});
-  assert.deepEqual(toolInputOf(undefined), {});
-});
-
-const hookIoModuleUrl = pathToFileURL(
-  new URL('../hook-io.mjs', import.meta.url).pathname.replace(
-    /^\/([A-Za-z]:)/,
-    '$1',
-  ),
-).href;
-
-/** Runs `body` (a callback expression referencing `mod`) in a child process after
- *  dynamically importing hook-io.mjs there, so process.exit-calling exports can be
- *  exercised without killing the test runner. */
-function runInChildProcess(body, execOptions) {
-  const script = `import('${hookIoModuleUrl}').then((mod) => { ${body} });`;
-  return execFileSync(process.execPath, ['--input-type=module', '-e', script], {
-    encoding: 'utf8',
-    ...execOptions,
-  });
-}
-
-test('readHookPayload reads whatever is piped on stdin, including empty input', () => {
-  const output = runInChildProcess(
-    'process.stdout.write(JSON.stringify(mod.readHookPayload()))',
-    { input: '{"tool_name":"Bash"}' },
-  );
-  assert.equal(output, JSON.stringify('{"tool_name":"Bash"}'));
-
-  const emptyOutput = runInChildProcess(
-    'process.stdout.write(JSON.stringify(mod.readHookPayload()))',
-    { stdio: ['ignore', 'pipe', 'pipe'] },
-  );
-  // With no stdin available, readFileSync(0) resolves to an empty string rather than
-  // throwing on this platform, so readHookPayload returns '' — not null. The null
-  // path (an unreadable fd 0) is exercised indirectly by every gate's own tests via
-  // runGate, since forcing an EBADF/EAGAIN on fd 0 portably from node:test is not
-  // reliable across platforms.
-  assert.equal(emptyOutput, JSON.stringify(''));
-});
-
-test('deny writes a permissionDecision:deny hookSpecificOutput and exits 0', () => {
-  const output = runInChildProcess("mod.deny('my-gate', 'because reasons')", {
-    input: '',
-  });
-  const parsed = JSON.parse(output);
-  assert.equal(parsed.hookSpecificOutput.hookEventName, 'PreToolUse');
-  assert.equal(parsed.hookSpecificOutput.permissionDecision, 'deny');
-  assert.equal(
-    parsed.hookSpecificOutput.permissionDecisionReason,
-    '[my-gate] because reasons',
-  );
-});
-
-test('warn writes additionalContext and exits 0', () => {
-  const output = runInChildProcess("mod.warn('my-gate', 'consider this')", {
-    input: '',
-  });
-  const parsed = JSON.parse(output);
-  assert.equal(parsed.hookSpecificOutput.hookEventName, 'PreToolUse');
-  assert.equal(
-    parsed.hookSpecificOutput.additionalContext,
-    '[my-gate] consider this',
-  );
-  assert.equal(parsed.hookSpecificOutput.permissionDecision, undefined);
-});
-
-test('allow exits 0 with no stdout', () => {
-  const output = runInChildProcess('mod.allow()', { input: '' });
-  assert.equal(output, '');
-});
-
-test('shellWrittenPaths extracts paths a shell command creates', () => {
-  assert.deepEqual(shellWrittenPaths('printf x > basura.txt'), ['basura.txt']);
-  assert.deepEqual(shellWrittenPaths('echo hi >> log.txt'), ['log.txt']);
-  assert.deepEqual(shellWrittenPaths('touch nuevo.js'), ['nuevo.js']);
-  assert.deepEqual(shellWrittenPaths('tee out.txt'), ['out.txt']);
-  // creates nothing -> empty
-  assert.deepEqual(shellWrittenPaths('git status'), []);
-  assert.deepEqual(shellWrittenPaths('cat archivo.txt'), []);
-  // a dynamically built path is NOT extracted (documented limitation)
-  assert.deepEqual(shellWrittenPaths('printf x > "$f"'), []);
-});

package/plugins/gates/hooks/lib/__tests__/signals.test.mjs

@@ -1,114 +0,0 @@
-import assert from 'node:assert/strict';
-import { test } from 'node:test';
-import {
-  RISK_SIGNAL,
-  MONEY_SIGNAL,
-  AUTH_SIGNAL,
-  DESTRUCTIVE_DEPLOY_SIGNAL,
-  CONJECTURE,
-  PERSISTENCE_VERB,
-  withUnicodeWordBoundary,
-} from '../signals.mjs';
-
-// ── RISK_SIGNAL ──────────────────────────────────────────────────────────────────────
-
-test('RISK_SIGNAL matches money terms in EN and ES', () => {
-  assert.ok(RISK_SIGNAL.test('update the payment flow'));
-  assert.ok(RISK_SIGNAL.test('actualizar el flujo de pago'));
-  assert.ok(RISK_SIGNAL.test('mover el saldo de una cuenta'));
-  assert.ok(RISK_SIGNAL.test('move the account balance'));
-});
-
-test('RISK_SIGNAL matches auth terms in EN and ES', () => {
-  assert.ok(RISK_SIGNAL.test('reset the user password'));
-  assert.ok(RISK_SIGNAL.test('resetear la contrasena del usuario'));
-  assert.ok(RISK_SIGNAL.test('resetear la contraseña del usuario'));
-  assert.ok(RISK_SIGNAL.test('cambiar la sesion activa'));
-  assert.ok(RISK_SIGNAL.test('cambiar la sesión activa'));
-});
-
-test('RISK_SIGNAL matches destructive/deploy terms in EN and ES', () => {
-  assert.ok(RISK_SIGNAL.test('deploy to production'));
-  assert.ok(RISK_SIGNAL.test('desplegar a produccion'));
-  assert.ok(RISK_SIGNAL.test('truncate the orders table'));
-  assert.ok(RISK_SIGNAL.test('eliminar la tabla de pedidos'));
-  assert.ok(RISK_SIGNAL.test('run the migration'));
-  assert.ok(RISK_SIGNAL.test('correr la migracion'));
-});
-
-test('bilingual control: an ES risk brief matches exactly like its EN equivalent', () => {
-  const es = 'implementa el endpoint para mover el saldo de una cuenta bancaria';
-  const en = 'implement the endpoint to move the balance of a bank account';
-  assert.equal(RISK_SIGNAL.test(es), RISK_SIGNAL.test(en));
-  assert.ok(RISK_SIGNAL.test(es));
-});
-
-test('RISK_SIGNAL does not fire on neutral text', () => {
-  assert.equal(RISK_SIGNAL.test('add a tooltip to the button'), false);
-  assert.equal(RISK_SIGNAL.test('agregar un tooltip al boton'), false);
-});
-
-test('RISK_SIGNAL false-positive guard: short terms require a full word', () => {
-  // "auth" inside "autor", "prod" inside "producto", "token" inside "tokenizer".
-  assert.equal(RISK_SIGNAL.test('the autor of this book'), false);
-  assert.equal(RISK_SIGNAL.test('el autor de este libro'), false);
-  assert.equal(RISK_SIGNAL.test('compra este producto'), false);
-  assert.equal(RISK_SIGNAL.test('buy this product'), false);
-  assert.equal(RISK_SIGNAL.test('the tokenizer splits words'), false);
-});
-
-test('MONEY_SIGNAL / AUTH_SIGNAL / DESTRUCTIVE_DEPLOY_SIGNAL are independently usable', () => {
-  assert.ok(MONEY_SIGNAL.test('pago'));
-  assert.equal(MONEY_SIGNAL.test('auth'), false);
-  assert.ok(AUTH_SIGNAL.test('token'));
-  assert.equal(AUTH_SIGNAL.test('pago'), false);
-  assert.ok(DESTRUCTIVE_DEPLOY_SIGNAL.test('produccion'));
-  assert.equal(DESTRUCTIVE_DEPLOY_SIGNAL.test('pago'), false);
-});
-
-// ── CONJECTURE ───────────────────────────────────────────────────────────────────────
-
-test('CONJECTURE matches EN and ES conjecture phrasing', () => {
-  assert.ok(CONJECTURE.test('i assume the timezone is UTC'));
-  assert.ok(CONJECTURE.test('probably fine to skip this'));
-  assert.ok(CONJECTURE.test('supongo que esto funciona'));
-  assert.ok(CONJECTURE.test('asumo que el usuario ya esta logueado'));
-  assert.ok(CONJECTURE.test('deberia ser suficiente con esto'));
-  assert.ok(CONJECTURE.test('debería ser suficiente con esto'));
-  assert.ok(CONJECTURE.test('creo que esto anda bien'));
-});
-
-test('bilingual control: ES and EN conjecture brief both trigger', () => {
-  const es = 'creo que el usuario ya esta autenticado, no lo verifique';
-  const en = 'i assume the user is already authenticated, did not verify it';
-  assert.equal(CONJECTURE.test(es), CONJECTURE.test(en));
-  assert.ok(CONJECTURE.test(es));
-});
-
-test('CONJECTURE does not fire on neutral confirmed statements', () => {
-  assert.equal(CONJECTURE.test('verified: the timezone is UTC per config.json'), false);
-  assert.equal(CONJECTURE.test('confirmado: el usuario esta autenticado'), false);
-});
-
-// ── PERSISTENCE_VERB ─────────────────────────────────────────────────────────────────
-
-test('PERSISTENCE_VERB matches EN and ES persistence instructions', () => {
-  assert.ok(PERSISTENCE_VERB.test('save this to state.json'));
-  assert.ok(PERSISTENCE_VERB.test('guarda esto en decision.md'));
-  assert.ok(PERSISTENCE_VERB.test('persist the result in the database'));
-  assert.ok(PERSISTENCE_VERB.test('escribi esto en el archivo'));
-  assert.ok(PERSISTENCE_VERB.test('anota el resultado en el log'));
-});
-
-test('PERSISTENCE_VERB does not fire on unrelated prose', () => {
-  assert.equal(PERSISTENCE_VERB.test('the button looks nice'), false);
-  assert.equal(PERSISTENCE_VERB.test('el boton se ve bien'), false);
-});
-
-// ── withUnicodeWordBoundary ──────────────────────────────────────────────────────────
-
-test('withUnicodeWordBoundary rejects a substring match', () => {
-  const pattern = withUnicodeWordBoundary('auth');
-  assert.ok(pattern.test('auth required'));
-  assert.equal(pattern.test('autor'), false);
-});

package/plugins/gates/hooks/lib/hook-io-config.edge.test.mjs

@@ -1,189 +0,0 @@
-// Edge audit for the common scaffolding (hook-io.mjs, config.mjs) that every gate shares.
-// Uses a minimal real gate built on runGate() so behavior is exercised end to end rather
-// than by reading source and guessing.
-//
-// Findings:
-//   1. Config precedence: a project config that EXISTS but omits a given gate key falls
-//      through to the REGISTRY DEFAULT passed by the gate (not to the global config) --
-//      confirmed by gatesLayerFor's early return the moment projectData is truthy
-//      (config.mjs line 80-81: `if (projectData) return projectData.gates ?? {};`). A
-//      global config with the key enabled is never consulted once a project config file
-//      exists at all, even if it says nothing about this particular gate.
-//   2. A corrupted project config.json does NOT silently disable protection: readJsonOrNull
-//      returns null on parse failure, gatesLayerFor then falls through to the global config
-//      layer, and if that too is corrupt/absent, isGateEnabled falls back to the gate's own
-//      registryDefault. Verified with a gate whose registryDefault is `true` (deny-by-default)
-//      to prove corruption doesn't fail open when the default is protective.
-//   3. toolNameOf/runGate coalescing (payload.tool_name ?? payload.name ?? '' -> '' on
-//      unparseable JSON) is exercised directly here against the shared helpers, independent
-//      of any specific gate's matcher set.
-
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-
-// A minimal probe gate: denies unconditionally whenever it runs and is enabled, with a
-// registryDefault of true (protective/deny-by-default), so we can distinguish "ran and
-// allowed via toolName mismatch" from "did not run because disabled".
-const PROBE_GATE_SOURCE = `
-import { runGate, deny } from ${JSON.stringify(pathToFileURL(join(HERE, 'hook-io.mjs')).href)};
-runGate(
-  { id: 'probe-gate', configKey: 'probeGate', enabledByDefault: true },
-  ({ toolName }) => {
-    deny('probe-gate', 'toolName=' + JSON.stringify(toolName));
-  },
-);
-`;
-
-function writeProbeGate(directory) {
-  const gatePath = join(directory, 'probe-gate.mjs');
-  writeFileSync(gatePath, PROBE_GATE_SOURCE);
-  return gatePath;
-}
-
-function runProbe(gatePath, rawInput, project) {
-  const out = execFileSync(process.execPath, [gatePath], {
-    input: rawInput,
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-test('toolNameOf/runGate: unparseable JSON payload coalesces toolName to empty string, not null', () => {
-  const scratch = mkdtempSync(join(tmpdir(), 'hookio-edge-'));
-  const project = mkdtempSync(join(tmpdir(), 'hookio-proj-'));
-  mkdirSync(join(project, '.git'));
-  const gatePath = writeProbeGate(scratch);
-  // registryDefault=true means the probe gate is ON with no config at all; it always denies
-  // when it runs, and the deny message embeds the resolved toolName so we can inspect it.
-  const result = runProbe(gatePath, 'not json at all {{{', project);
-  assert.ok(isDeny(result));
-  assert.match(
-    result.hookSpecificOutput.permissionDecisionReason,
-    /toolName=""/,
-    'confirms toolNameOf(...) ?? \'\' resolves corrupt payloads to the empty string, ' +
-      'the exact value that fails to match any TOOL_GROUPS Set',
-  );
-});
-
-test('config precedence: project config exists but omits the gate key -> registryDefault wins, NOT global config', () => {
-  const project = mkdtempSync(join(tmpdir(), 'hookio-proj-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'));
-  // Project config exists, and declares gates, but never mentions 'probeGate'.
-  writeFileSync(
-    join(project, '.ai', 'config.json'),
-    JSON.stringify({ gates: { someOtherGate: true } }),
-  );
-  // Global config (same HOME as project, since HOME=project below) explicitly disables it.
-  // If precedence were "most specific explicit setting wins", global's false should apply.
-  // If precedence is "project file existing short-circuits global entirely", the probe's
-  // own registryDefault (true) should apply instead, ignoring global.
-  const home = project; // isolate HOME to a dir we control, distinct from project root marker use
-  mkdirSync(join(home, '.claude', 'claude-gates'), { recursive: true });
-  writeFileSync(
-    join(home, '.claude', 'claude-gates', 'config.json'),
-    JSON.stringify({ gates: { probeGate: false } }),
-  );
-  const scratch = mkdtempSync(join(tmpdir(), 'hookio-edge-'));
-  const gatePath = writeProbeGate(scratch);
-  const out = execFileSync(process.execPath, [gatePath], {
-    input: JSON.stringify({ tool_name: 'Write', tool_input: {} }),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: home, USERPROFILE: home },
-  });
-  const result = out.trim() ? JSON.parse(out.trim()) : null;
-  assert.ok(
-    isDeny(result),
-    'PASA(confirmed): project config existing makes gatesLayerFor return early with {} ' +
-      'for gates it does not mention, so registryDefault (true/deny) wins over the global ' +
-      'config saying false -- global is never consulted once ANY project config.json exists',
-  );
-});
-
-test('config precedence: NO project config at all -> global config value is honored', () => {
-  const project = mkdtempSync(join(tmpdir(), 'hookio-proj-'));
-  mkdirSync(join(project, '.git'));
-  // No .ai/config.json in the project at all.
-  const home = mkdtempSync(join(tmpdir(), 'hookio-home-'));
-  mkdirSync(join(home, '.claude', 'claude-gates'), { recursive: true });
-  writeFileSync(
-    join(home, '.claude', 'claude-gates', 'config.json'),
-    JSON.stringify({ gates: { probeGate: false } }),
-  );
-  const scratch = mkdtempSync(join(tmpdir(), 'hookio-edge-'));
-  const gatePath = writeProbeGate(scratch);
-  const out = execFileSync(process.execPath, [gatePath], {
-    input: JSON.stringify({ tool_name: 'Write', tool_input: {} }),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: home, USERPROFILE: home },
-  });
-  const result = out.trim() ? JSON.parse(out.trim()) : null;
-  assert.equal(
-    result,
-    null,
-    'control: with no project config file present at all, global config IS consulted and ' +
-      'its false correctly disables the gate -- confirms the precedence bug above is ' +
-      'specifically "project file exists" short-circuiting, not "global never works"',
-  );
-});
-
-test('corrupted project config.json does not silently disable a protective (default-on) gate', () => {
-  const project = mkdtempSync(join(tmpdir(), 'hookio-proj-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'));
-  writeFileSync(join(project, '.ai', 'config.json'), '{ this is not valid json ][');
-  const home = mkdtempSync(join(tmpdir(), 'hookio-home-'));
-  const scratch = mkdtempSync(join(tmpdir(), 'hookio-edge-'));
-  const gatePath = writeProbeGate(scratch);
-  const out = execFileSync(process.execPath, [gatePath], {
-    input: JSON.stringify({ tool_name: 'Write', tool_input: {} }),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: home, USERPROFILE: home },
-  });
-  const result = out.trim() ? JSON.parse(out.trim()) : null;
-  assert.ok(
-    isDeny(result),
-    'FALLA(ok): corrupt project config treated as absent -> falls through to global (none) ' +
-      '-> registryDefault (true) -> still protected, matching config.mjs\'s documented intent',
-  );
-});
-
-test('corrupted GLOBAL config.json (no project config) does not silently disable a protective gate', () => {
-  const project = mkdtempSync(join(tmpdir(), 'hookio-proj-'));
-  mkdirSync(join(project, '.git'));
-  const home = mkdtempSync(join(tmpdir(), 'hookio-home-'));
-  mkdirSync(join(home, '.claude', 'claude-gates'), { recursive: true });
-  writeFileSync(
-    join(home, '.claude', 'claude-gates', 'config.json'),
-    '{ not valid json at all',
-  );
-  const scratch = mkdtempSync(join(tmpdir(), 'hookio-edge-'));
-  const gatePath = writeProbeGate(scratch);
-  const out = execFileSync(process.execPath, [gatePath], {
-    input: JSON.stringify({ tool_name: 'Write', tool_input: {} }),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: home, USERPROFILE: home },
-  });
-  const result = out.trim() ? JSON.parse(out.trim()) : null;
-  assert.ok(
-    isDeny(result),
-    'FALLA(ok): corrupt global config also treated as absent -> registryDefault wins',
-  );
-});

package/plugins/tasks/hooks/__tests__/register-requests.test.mjs

@@ -1,100 +0,0 @@
-// register-requests — UserPromptSubmit hook. Spawned as a real child process, matching how
-// Claude Code invokes it, against a temp project.
-
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-import { openTaskStore } from '../lib/task-store.mjs';
-
-const HOOK_PATH = join(
-  dirname(fileURLToPath(import.meta.url)),
-  '..',
-  'register-requests.mjs',
-);
-
-function makeProject() {
-  const project = mkdtempSync(join(tmpdir(), 'register-requests-'));
-  mkdirSync(join(project, '.git'));
-  return project;
-}
-
-function runHook(cwd) {
-  return execFileSync(process.execPath, [HOOK_PATH], {
-    input: JSON.stringify({ cwd }),
-    encoding: 'utf8',
-  });
-}
-
-function writeConfig(project, gates) {
-  mkdirSync(join(project, '.ai'), { recursive: true });
-  writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify({ gates }));
-}
-
-function sampleTask(id) {
-  return {
-    id,
-    title: `task ${id}`,
-    description: '',
-    status: 'open',
-    size: 'trivial',
-    createdAt: new Date().toISOString(),
-    messages: [],
-  };
-}
-
-test('always asks the model to classify+register, even with no active tasks yet', () => {
-  const project = makeProject();
-  const stdout = runHook(project);
-  assert.match(stdout, /claude-gates task add/);
-});
-
-test('does NOT recite active tasks before remindEveryMessages is reached', () => {
-  const project = makeProject();
-  const store = openTaskStore(project);
-  store.add(sampleTask('t1'));
-  writeConfig(project, { remindOpenTasks: { enabled: true, remindEveryMessages: 3 } });
-
-  const first = runHook(project);
-  assert.doesNotMatch(first, /OPEN TASKS/);
-  const second = runHook(project);
-  assert.doesNotMatch(second, /OPEN TASKS/);
-});
-
-test('recites active tasks once remindEveryMessages is reached, then resets the counter', () => {
-  const project = makeProject();
-  const store = openTaskStore(project);
-  store.add(sampleTask('t1'));
-  writeConfig(project, { remindOpenTasks: { enabled: true, remindEveryMessages: 2 } });
-
-  runHook(project); // 1st call: counter -> 1, no reminder
-  const forced = runHook(project); // 2nd call: counter hits threshold -> reminder + reset
-  assert.match(forced, /OPEN TASKS/);
-  assert.match(forced, /t1/);
-
-  const afterReset = runHook(project); // 3rd call: counter just reset -> no reminder yet
-  assert.doesNotMatch(afterReset, /OPEN TASKS/);
-});
-
-test('remindOpenTasks:false silences the hook entirely (no classify prompt, no reminder)', () => {
-  const project = makeProject();
-  const store = openTaskStore(project);
-  store.add(sampleTask('t1'));
-  writeConfig(project, { remindOpenTasks: false });
-
-  const stdout = runHook(project);
-  assert.equal(stdout, '');
-});
-
-test('defaults-dump mode reports remindEveryMessages default without touching stdin', () => {
-  const out = execFileSync(process.execPath, [HOOK_PATH], {
-    encoding: 'utf8',
-    env: { ...process.env, CLAUDE_GATES_DUMP_DEFAULTS: '1' },
-  });
-  const parsed = JSON.parse(out);
-  assert.equal(parsed.configKey, 'remindOpenTasks');
-  assert.equal(parsed.defaultParams.remindEveryMessages, 5);
-});