@jjchill/probity-rules 0.1.0 → 0.2.1

package/dist/rules/kotlin.js

@@ -27,11 +27,18 @@ export const KOTLIN_INFRASTRUCTURE_IMPORTS = /import\s+(?:com\.amazonaws|aws\.sd
  */
 export const MOCKING_LIBRARY_IMPORTS = /import\s+(?:io\.mockk|org\.mockito|org\.powermock)\./;
 /**
- * Matches Gradle test invocations (`./gradlew test`,
- * `./gradlew :mysudo:testDevDebugUnitTest`, flavored Android unit-test
- * tasks) for the commit-on-green `requireCommand` gate.
+ * Matches a Gradle invocation of a verification task — `test`,
+ * flavored/module-qualified `test...Test` tasks (`./gradlew
+ * :mysudo:testDevDebugUnitTest`), `allTests`, `jvmTest`, `build`, or
+ * `check` (Gradle's `build` and `check` both run the test tasks they
+ * depend on, without the literal word "test") — for the commit-on-green
+ * `requireGreenTestRun` gate. Matches `gradlew`/`gradle` anywhere in a
+ * piped (`./gradlew build | grep ...`) or compound
+ * (`foo; ./gradlew build`) command string, not only at its start.
+ * Deliberately excludes unrelated tasks such as `assemble`, which
+ * builds outputs without running verification.
  */
-export const GRADLE_TEST_COMMAND = /gradlew?\s+(?:[\w:./-]+\s+)*:?[\w:.-]*[tT]est\w*/;
+export const GRADLE_TEST_COMMAND = /\bgradlew?\b[^\n;&|]*(?:\b(?:build|check|test|allTests|jvmTest)\b|\btest[A-Za-z0-9]*Test\b)/;
 const STATIC_MOCK_PATTERNS = [
     { label: 'Mockito.mockStatic()', pattern: /\bmockStatic\s*[(<]/g },
     { label: 'mockkStatic()', pattern: /\bmockkStatic\s*\(/g },
@@ -125,10 +132,17 @@ const KOTLIN_TEST_PATTERNS = [
     {
         rule: {
             kind: 'function_declaration',
-            regex: '@(Test|ParameterizedTest|RepeatedTest|TestFactory)\\b',
+            has: {
+                kind: 'modifiers',
+                has: {
+                    kind: 'annotation',
+                    regex: '^@(Test|ParameterizedTest|RepeatedTest|TestFactory)(?:\\b|\\s*\\()',
+                },
+            },
         },
     },
 ];
+const KOTLIN_TEST_FILE_PATTERN = /(?:^|\/)src\/(?:test|[A-Za-z0-9]+Test)\/(?:java|kotlin)\//;
 let astGrep;
 function loadKotlinAstGrep() {
     if (astGrep !== undefined)
@@ -141,32 +155,272 @@ function loadKotlinAstGrep() {
         astGrep = napi;
     }
     catch {
-        // Optional peer deps not installed — the wrapper falls through.
+        // Optional dependencies unavailable on this install or platform.
         astGrep = null;
     }
     return astGrep;
 }
-function countKotlinTests(napi, code, patterns) {
+function findKotlinTestNodes(napi, code, patterns) {
     const root = napi.parse('kotlin', code).root();
-    let count = 0;
-    for (const pattern of patterns)
-        count += root.findAll(pattern).length;
-    return count;
+    return patterns.flatMap((pattern) => root.findAll(pattern));
+}
+function kotlinTestNodes(napi, code, patterns) {
+    return findKotlinTestNodes(napi, code, patterns).map((node) => node.text());
+}
+function nodeIsInside(node, insertion) {
+    const range = node.range();
+    return (range.start.index >= insertion.startByte &&
+        range.end.index <= insertion.endByte);
+}
+function addedTestNode(beforeTests, afterTests, insertion) {
+    const unmatched = [...afterTests];
+    for (const beforeTest of beforeTests) {
+        const index = unmatched.findIndex((node) => node.text() === beforeTest);
+        if (index === -1)
+            return null;
+        unmatched.splice(index, 1);
+    }
+    if (unmatched.length !== 1)
+        return null;
+    const added = unmatched[0];
+    if (beforeTests.includes(added.text()))
+        return null;
+    return nodeIsInside(added, insertion) ? added : null;
+}
+function singleInsertion(before, after) {
+    if (after.length <= before.length)
+        return null;
+    let prefix = 0;
+    while (prefix < before.length && before[prefix] === after[prefix]) {
+        prefix += 1;
+    }
+    let beforeSuffix = before.length;
+    let afterSuffix = after.length;
+    while (beforeSuffix > prefix &&
+        before[beforeSuffix - 1] === after[afterSuffix - 1]) {
+        beforeSuffix -= 1;
+        afterSuffix -= 1;
+    }
+    if (beforeSuffix !== prefix)
+        return null;
+    const text = after.slice(prefix, afterSuffix);
+    const startByte = Buffer.byteLength(after.slice(0, prefix), 'utf8');
+    return {
+        text,
+        startByte,
+        endByte: startByte + Buffer.byteLength(text, 'utf8'),
+    };
+}
+function isRunnableTestNode(node) {
+    const ancestors = node.ancestors();
+    const owner = ancestors[1];
+    if (ancestors[0]?.kind() !== 'class_body' ||
+        owner?.kind() !== 'class_declaration' ||
+        ancestors[2]?.kind() !== 'source_file' ||
+        !owner.children().some((child) => child.kind() === 'class')) {
+        return false;
+    }
+    const bodyStart = owner.text().indexOf('{');
+    const header = bodyStart === -1 ? owner.text() : owner.text().slice(0, bodyStart);
+    return countMatches(header, DISABLING_TEST_CONTROL) === 0;
+}
+function onlyCommentsAndWhitespace(code) {
+    return /^\s*$/.test(code.replace(/\/\/[^\r\n]*\r?\n|\/\*[\s\S]*?\*\//g, ''));
+}
+function identifiersIn(tests) {
+    return new Set(tests.flatMap((test) => [...test.matchAll(/`([^`]+)`|\b([A-Za-z_]\w*)\b/g)].map((match) => match[1] ?? match[2])));
+}
+function safeExistingFileInsertion(napi, before, after, addedTest, beforeTests, patterns) {
+    const insertion = singleInsertion(before, after);
+    if (!insertion || !nodeIsInside(addedTest, insertion))
+        return false;
+    const addedText = addedTest.text();
+    const addedAt = insertion.text.indexOf(addedText);
+    if (addedAt !== -1) {
+        const remainder = insertion.text.slice(0, addedAt) +
+            insertion.text.slice(addedAt + addedText.length);
+        if (onlyCommentsAndWhitespace(remainder))
+            return true;
+    }
+    const trimmed = insertion.text.trim();
+    const priorIdentifiers = identifiersIn(beforeTests);
+    const root = napi.parse('kotlin', after).root();
+    return root.findAll({ rule: { kind: 'class_declaration' } }).some((node) => {
+        if (node.text().trim() !== trimmed)
+            return false;
+        const name = nodeName(node);
+        if (name && priorIdentifiers.has(name))
+            return false;
+        const tests = patterns.flatMap((pattern) => node.findAll(pattern));
+        const functions = node.findAll({ rule: { kind: 'function_declaration' } });
+        return (tests.length === 1 &&
+            tests[0].range().start.index === addedTest.range().start.index &&
+            tests[0].range().end.index === addedTest.range().end.index &&
+            isRunnableTestNode(addedTest) &&
+            functions.length === 1);
+    });
+}
+function safeNewTestFile(napi, code, addedTest) {
+    if (!isRunnableTestNode(addedTest))
+        return false;
+    const root = napi.parse('kotlin', code).root();
+    return (root.findAll({ rule: { kind: 'class_declaration' } }).length === 1 &&
+        root.findAll({ rule: { kind: 'function_declaration' } }).length === 1);
+}
+const DISABLING_TEST_CONTROL = /@(?:[A-Za-z_]\w*\.)*(?:Ignore|Disabled)\b|\benabled\s*=\s*false\b/g;
+function countMatches(code, pattern) {
+    pattern.lastIndex = 0;
+    return [...code.matchAll(pattern)].length;
+}
+function introducesDisablingControl(before, after) {
+    return (countMatches(after, DISABLING_TEST_CONTROL) >
+        countMatches(before, DISABLING_TEST_CONTROL));
+}
+function nodeName(node) {
+    const names = node
+        .children()
+        .filter((child) => child.kind() === 'simple_identifier' || child.kind() === 'type_identifier');
+    const direct = names.at(-1)?.text();
+    if (direct)
+        return direct.replace(/^`|`$/g, '');
+    const nested = node.findAll({ rule: { kind: 'simple_identifier' } })[0];
+    return nested ? nested.text().replace(/^`|`$/g, '') : null;
+}
+function enclosingScope(node) {
+    const container = node
+        .ancestors()
+        .find((ancestor) => ancestor.kind() === 'class_declaration' ||
+        ancestor.kind() === 'object_declaration');
+    return container ? (nodeName(container) ?? '<anonymous>') : '<top-level>';
+}
+function testScopes(napi, code, patterns) {
+    const root = napi.parse('kotlin', code).root();
+    const scopes = new Set();
+    for (const pattern of patterns) {
+        for (const node of root.findAll(pattern))
+            scopes.add(enclosingScope(node));
+    }
+    return scopes;
+}
+function containerHeaders(napi, code) {
+    const root = napi.parse('kotlin', code).root();
+    const headers = new Map();
+    for (const kind of ['class_declaration', 'object_declaration']) {
+        for (const node of root.findAll({ rule: { kind } })) {
+            const name = nodeName(node);
+            if (!name)
+                continue;
+            const bodyStart = node.text().indexOf('{');
+            headers.set(name, (bodyStart === -1 ? node.text() : node.text().slice(0, bodyStart)).trim());
+        }
+    }
+    return headers;
+}
+function changesExistingTestContainer(napi, before, after, patterns) {
+    const scopes = testScopes(napi, before, patterns);
+    const beforeHeaders = containerHeaders(napi, before);
+    const afterHeaders = containerHeaders(napi, after);
+    for (const scope of scopes) {
+        if (scope === '<top-level>')
+            continue;
+        if (beforeHeaders.get(scope) !== afterHeaders.get(scope))
+            return true;
+    }
+    return false;
+}
+function declarations(napi, code) {
+    const root = napi.parse('kotlin', code).root();
+    const found = [];
+    for (const kind of [
+        'function_declaration',
+        'property_declaration',
+        'class_declaration',
+        'object_declaration',
+    ]) {
+        for (const node of root.findAll({ rule: { kind } })) {
+            const name = nodeName(node);
+            if (name)
+                found.push({ name, scope: enclosingScope(node) });
+        }
+    }
+    for (const node of root.findAll({ rule: { kind: 'import_header' } })) {
+        const alias = node.findAll({ rule: { kind: 'type_identifier' } }).at(-1);
+        const leaf = node.findAll({ rule: { kind: 'simple_identifier' } }).at(-1);
+        const name = (alias ?? leaf)?.text().replace(/^`|`$/g, '');
+        if (name)
+            found.push({ name, scope: '<top-level>' });
+    }
+    return found;
+}
+function introducedDeclarations(before, after) {
+    const existing = new Map();
+    for (const declaration of before) {
+        const key = `${declaration.scope}\u0000${declaration.name}`;
+        existing.set(key, (existing.get(key) ?? 0) + 1);
+    }
+    return after.filter((declaration) => {
+        const key = `${declaration.scope}\u0000${declaration.name}`;
+        const remaining = existing.get(key) ?? 0;
+        if (remaining === 0)
+            return true;
+        existing.set(key, remaining - 1);
+        return false;
+    });
+}
+function shadowsExistingTestIdentifier(napi, before, after, beforeTests, patterns) {
+    const identifiers = new Set(beforeTests.flatMap((test) => [...test.matchAll(/`([^`]+)`|\b([A-Za-z_]\w*)\b/g)].map((match) => match[1] ?? match[2])));
+    const scopes = testScopes(napi, before, patterns);
+    return introducedDeclarations(declarations(napi, before), declarations(napi, after)).some(({ name, scope }) => identifiers.has(name) &&
+        (scope === '<top-level>' || scopes.has(scope)));
+}
+function matchesTestPath(pattern, path) {
+    pattern.lastIndex = 0;
+    if (pattern !== KOTLIN_TEST_FILE_PATTERN)
+        return pattern.test(path);
+    const match = pattern.exec(path);
+    if (!match)
+        return false;
+    const prefix = path.slice(0, match.index);
+    return !/(?:^|\/)src\/(?:main|[A-Za-z0-9]+Main)\/(?:java|kotlin)\//.test(prefix);
+}
+async function delegateWithFastPathUnavailable(rule, action, ctx, detail) {
+    const result = await rule(action, ctx);
+    const diagnostic = `Kotlin fast path unavailable (${detail}); delegated to the wrapped rule.`;
+    if (result.kind === 'violation') {
+        return { kind: 'violation', reason: `${result.reason} ${diagnostic}` };
+    }
+    return {
+        ...result,
+        reason: result.reason ?? diagnostic,
+        notes: [
+            ...(result.notes ?? []),
+            { kind: 'kotlin-fast-path-unavailable' },
+        ],
+    };
 }
 /**
  * Kotlin equivalent of `enforceTdd({ fastPath: true })`, which Probity
  * only implements for TS/JS/Python/C#/Ruby/PHP: wraps a rule so that a
  * `.kt`/`.kts` write adding exactly one new test function passes
  * deterministically — no AI call for the most common write in a TDD
- * loop, adding the next red test. Everything else (production writes,
- * multi-test writes, non-Kotlin files) delegates to the wrapped rule
- * unchanged.
+ * loop, adding the next red test. The write must target a Kotlin test
+ * source set and add exactly one runnable test function. Existing files
+ * must preserve every byte and test function and make one contiguous
+ * insertion: the test (plus comments/whitespace), or a separate test
+ * class with no additional functions. Brand-new files may include
+ * imports and property fixtures but only the one test function.
+ * Edits that target production paths, introduce disabling controls,
+ * alter an existing test container's header, shadow an identifier used
+ * by an existing test, or delete, disable, or weaken tests delegate to
+ * the wrapped rule. Everything else (multi-test writes and non-Kotlin
+ * files) delegates unchanged.
  *
- * Requires the optional packages `@ast-grep/napi` and
- * `@ast-grep/lang-kotlin` (`npm install -D` both). When they're
- * missing, or the current file content is unavailable, or parsing
- * fails, the wrapper transparently falls through to the wrapped rule
- * — it can only ever skip work, never block.
+ * The parser packages `@ast-grep/napi` and `@ast-grep/lang-kotlin`
+ * ship as optional dependencies, so supported npm installs receive
+ * them automatically. If a platform cannot install them, or the
+ * current file is unavailable, or parsing fails, the wrapper falls
+ * through to the wrapped rule — it can only ever skip work, never
+ * block.
  *
  * Same trade-off as Probity's own fast-path: a deterministic pass on
  * every single-test addition skips the green→red refactor-readiness
@@ -175,36 +429,62 @@ function countKotlinTests(napi, code, patterns) {
  * @param rule — the rule to wrap, normally `enforceTdd()`.
  * @param options.patterns — replaces the default ast-grep test-node
  *   patterns (e.g. to add a Kotest spec pattern).
+ * @param options.testFilePattern — limits deterministic passes to test
+ *   source paths; defaults to classic and KMP `src/*Test/{java,kotlin}`.
  *
  * @example
  * { files: ['**\/src\/main\/**', '**\/src\/test\/**'], rules: [withKotlinFastPath(enforceTdd())] }
  */
 export function withKotlinFastPath(rule, options = {}) {
     const patterns = options.patterns ?? KOTLIN_TEST_PATTERNS;
+    const testFilePattern = options.testFilePattern ?? KOTLIN_TEST_FILE_PATTERN;
     const wrapped = async function kotlinFastPath(action, ctx) {
-        if (action.kind !== 'write' || !/\.kts?$/.test(action.path)) {
+        if (action.kind !== 'write' ||
+            !/\.kts?$/.test(action.path) ||
+            !matchesTestPath(testFilePattern, action.path)) {
             return rule(action, ctx);
         }
         const napi = loadKotlinAstGrep();
-        if (!napi)
-            return rule(action, ctx);
+        if (!napi) {
+            return delegateWithFastPathUnavailable(rule, action, ctx, 'parser packages could not be loaded');
+        }
         const before = await ctx?.readFile?.(action.path);
-        // An unknowable before-count makes any delta unverifiable; fall
-        // through to the wrapped rule rather than risk a false pass.
-        if (!before || before.kind === 'unknown')
-            return rule(action, ctx);
+        if (!before || before.kind === 'unknown') {
+            return delegateWithFastPathUnavailable(rule, action, ctx, 'current file content unavailable');
+        }
         const beforeText = before.kind === 'present' ? before.content : '';
-        let delta;
+        const insertion = beforeText.length === 0
+            ? {
+                text: action.content,
+                startByte: 0,
+                endByte: Buffer.byteLength(action.content, 'utf8'),
+            }
+            : singleInsertion(beforeText, action.content);
+        if (!insertion)
+            return rule(action, ctx);
+        let fastPath = false;
         try {
-            delta =
-                countKotlinTests(napi, action.content, patterns) -
-                    countKotlinTests(napi, beforeText, patterns);
+            const beforeTests = kotlinTestNodes(napi, beforeText, patterns);
+            const afterTestNodes = findKotlinTestNodes(napi, action.content, patterns);
+            const addedTest = addedTestNode(beforeTests, afterTestNodes, insertion);
+            if (addedTest) {
+                const unsafeInsertion = introducesDisablingControl(beforeText, action.content) ||
+                    changesExistingTestContainer(napi, beforeText, action.content, patterns) ||
+                    shadowsExistingTestIdentifier(napi, beforeText, action.content, beforeTests, patterns);
+                fastPath =
+                    !unsafeInsertion &&
+                        isRunnableTestNode(addedTest) &&
+                        (beforeText.length === 0
+                            ? safeNewTestFile(napi, action.content, addedTest)
+                            : safeExistingFileInsertion(napi, beforeText, action.content, addedTest, beforeTests, patterns));
+            }
         }
         catch {
-            return rule(action, ctx);
+            return delegateWithFastPathUnavailable(rule, action, ctx, 'parsing failed');
         }
-        if (delta === 1)
+        if (fastPath) {
             return { kind: 'pass', notes: [{ kind: 'fast-path' }] };
+        }
         return rule(action, ctx);
     };
     // Surface the wrapped rule in engine traces and block reports:
@@ -214,39 +494,222 @@ export function withKotlinFastPath(rule, options = {}) {
     });
     return wrapped;
 }
+// Kiro's tool-result envelope reports a command's outcome as JSON
+// (`{"exit_status": "exit status: 0", ...}`) instead of the runner's
+// own text, so a quiet/`-q` Gradle run with no "BUILD SUCCESSFUL" text
+// can still be trusted via exit_status — but only when the Gradle
+// invocation is provably the LAST simple command run (a pipe,
+// `|| true`, or trailing command reports THAT command's status, not
+// Gradle's). Kiro-specific: native Claude, or a caller supplying its
+// own successPattern/failurePattern, gets no such allowance.
+const KIRO_ZERO_EXIT_STATUS = 'exit status: 0';
+/** Parses a Kiro envelope's `exit_status` via `JSON.parse` + a shape
+ *  check, never a text regex — malformed/differently-shaped output is
+ *  no evidence, never a parsed zero. */
+function parseKiroExitStatus(output) {
+    const trimmed = output.trim();
+    if (!trimmed.startsWith('{') || !trimmed.endsWith('}'))
+        return null;
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            return null;
+        }
+        const record = parsed;
+        const exitStatus = record['exit_status'];
+        return typeof exitStatus === 'string' &&
+            typeof record['stdout'] === 'string' &&
+            typeof record['stderr'] === 'string'
+            ? exitStatus
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** True when `output` mentions an `exit_status` field but fails
+ *  {@link parseKiroExitStatus}'s canonical-shape check. Distinguishes
+ *  "no Kiro evidence" from a broken/non-canonical envelope, which is
+ *  red even if it contains banner-like text. */
+function isMalformedKiroEnvelope(output) {
+    const trimmed = output.trim();
+    return ((trimmed.startsWith('{') || trimmed.startsWith('[')) &&
+        trimmed.includes('"exit_status"') &&
+        parseKiroExitStatus(output) === null);
+}
+/** Splits on top-level `;`, `&&`, `||`, `|`, background `&`, and
+ *  newlines, quote-aware, without splitting a redirect's `&` (`2>&1`).
+ *  Used only to find the LAST simple command for the Kiro check. */
+function splitTopLevelCommands(command) {
+    const segments = [];
+    let current = '';
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (quote) {
+            current += ch;
+            if (ch === quote && command[i - 1] !== '\\')
+                quote = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            current += ch;
+            continue;
+        }
+        const isRedirectAmpersand = ch === '&' &&
+            (command[i - 1] === '>' ||
+                command[i - 1] === '<' ||
+                command[i + 1] === '>');
+        if ('\n|;&'.includes(ch) && !isRedirectAmpersand) {
+            if ('|&'.includes(ch) && command[i + 1] === ch)
+                i++;
+            segments.push(current);
+            current = '';
+            continue;
+        }
+        current += ch;
+    }
+    segments.push(current);
+    return segments;
+}
+/** True when the LAST top-level simple command is itself a genuine
+ *  Gradle verification invocation — not followed by a pipe/`;`/`&&`/
+ *  `||`/other command, and not merely mentioning "gradlew" as an
+ *  argument (`echo gradlew`). Piped/chained runs still pass via
+ *  BUILD SUCCESSFUL; this only gates the exit-status shortcut. */
+function gradleInvocationIsFinalCommand(command) {
+    const segments = splitTopLevelCommands(command);
+    let last = '';
+    for (let i = segments.length - 1; i >= 0; i--) {
+        if (segments[i].trim().length > 0) {
+            last = segments[i];
+            break;
+        }
+    }
+    return isGradleVerificationInvocation(last);
+}
+// Flags consuming the FOLLOWING word as a value (`--flag value`);
+// boolean flags like `--no-daemon` take none.
+const VALUE_TAKING_FLAGS = new Set([
+    '-P', '--project-prop', '-D', '--system-prop', '-I', '--init-script',
+    '-c', '--settings-file', '-b', '--build-file', '-p', '--project-dir',
+    '-g', '--gradle-user-home', '-x', '--exclude-task', '--args', '--task',
+    '--configuration-cache-problems', '--priority', '--max-workers',
+    '--console', '--warning-mode',
+]);
+const EXCLUDE_TASK_FLAG = /^(?:-x(?:=?.+)?|--exclude-task(?:=.+)?)$/;
+const REDIRECT = /^(?:\d*|&)(?:>>?|<<?)/;
+const REDIRECT_WITH_SEPARATE_TARGET = /^(?:\d*|&)(?:>>?|<<?)$/;
+function isVerificationTask(word) {
+    const task = word.replace(/^:+/, '').split(':').pop() ?? '';
+    return (task === 'build' ||
+        task === 'check' ||
+        task === 'test' ||
+        task === 'allTests' ||
+        task === 'jvmTest' ||
+        /^test[A-Za-z0-9]*Test$/.test(task));
+}
+/** Accepts one simple shell command as a genuine Gradle verification
+ *  invocation: first word `gradlew`/`./gradlew`/`gradle`; no
+ *  `--dry-run` or `-x`/`--exclude-task`; and at least one positional
+ *  task (not a flag, flag value, or redirect target) on the allowlist. */
+function isGradleVerificationInvocation(simpleCommand) {
+    const words = simpleCommand.trim().split(/\s+/).filter(Boolean);
+    if (!/^(?:\.\/|[\w./-]*\/)?gradlew?$/.test(words[0] ?? ''))
+        return false;
+    if (words.some((word) => word === '--dry-run' || EXCLUDE_TASK_FLAG.test(word))) {
+        return false;
+    }
+    let skipNext = false;
+    for (let i = 1; i < words.length; i++) {
+        const word = words[i];
+        if (skipNext) {
+            skipNext = false;
+            continue;
+        }
+        if (REDIRECT.test(word)) {
+            skipNext = REDIRECT_WITH_SEPARATE_TARGET.test(word);
+            continue;
+        }
+        if (word.startsWith('-')) {
+            skipNext = !word.includes('=') && VALUE_TAKING_FLAGS.has(word);
+            continue;
+        }
+        if (isVerificationTask(word))
+            return true;
+    }
+    return false;
+}
+/** Kotlin-default command predicate: true if ANY top-level simple
+ *  command is a genuine Gradle verification invocation. */
+function isKotlinDefaultGradleCommand(command) {
+    return splitTopLevelCommands(command).some(isGradleVerificationInvocation);
+}
+/** Kotlin-default extra-success predicate: trusts a parsed zero exit
+ *  status only when the Gradle invocation is the last command run. */
+function kotlinDefaultExtraSuccess(command, output) {
+    return (gradleInvocationIsFinalCommand(command) &&
+        parseKiroExitStatus(output) === KIRO_ZERO_EXIT_STATUS);
+}
+const DEFAULT_SUCCESS_PATTERN = /BUILD SUCCESSFUL/;
+// A script/dependency-resolution failure can print `FAILURE:` without
+// `BUILD FAILED`; a task failure names the task in `Execution failed
+// for task ':...'`.
+const DEFAULT_FAILURE_PATTERN = /FAILED|BUILD FAILED|^FAILURE: |Execution failed for task/m;
+/** Kotlin-default extra-failure predicate: a parsed non-zero exit
+ *  status, or output that looks like an ATTEMPTED but malformed/
+ *  non-canonical Kiro envelope, is always red — even alongside a
+ *  BUILD SUCCESSFUL banner (which may be echoed/stale text, or a
+ *  substring inside broken JSON, not this run's own verdict). */
+function kotlinDefaultExtraFailure(output) {
+    if (isMalformedKiroEnvelope(output))
+        return true;
+    const exitStatus = parseKiroExitStatus(output);
+    return exitStatus !== null && exitStatus !== KIRO_ZERO_EXIT_STATUS;
+}
+const DEFAULT_GRADLE_GREEN_REASON = 'Accepted Gradle verification tasks: test/test...Test, build, or check ' +
+    '(including module-qualified tasks and allTests/jvmTest; not --dry-run ' +
+    'or -x/--exclude-task). Under Kiro, a quiet run with no BUILD ' +
+    'SUCCESSFUL text is accepted only when the tool result is the canonical ' +
+    '{"exit_status": "exit status: 0", ...} envelope (a zero exit_status) ' +
+    'AND the Gradle invocation is the LAST command run (no trailing pipe, ' +
+    '`; next-command`, or `|| fallback`) — those still need the BUILD ' +
+    'SUCCESSFUL banner itself.';
 /**
- * Commit-on-GREEN gate — the stricter sibling of Probity's built-in
- * `requireCommand`, which only checks that a matching test command was
- * *recorded* after the last write and would happily pass a transcript
- * whose latest run FAILED. This rule additionally judges the recorded
- * run's output: the last matching test command after the last write
- * must look green (`successPattern` present, `failurePattern` absent).
- *
- * Inherent limit (unchanged from requireCommand): the gate sees only
- * the session transcript. A green run in another terminal, CI, or a
- * wrapper script is invisible — rerun the suite in-session, and keep
- * the CI mirror for human commits.
- *
- * Applies to: command actions matching `git commit`. Deterministic —
- * no AI call.
- *
- * @param options.command — regex matching a test invocation (e.g.
- *   {@link GRADLE_TEST_COMMAND}).
- * @param options.successPattern — output must match to count as green
- *   (default `/BUILD SUCCESSFUL/`).
- * @param options.failurePattern — output matching this is red even if
- *   the success pattern also appears (default `/FAILED|BUILD FAILED/`).
+ * Gradle/Kiro-defaulted wrapper over `requireGreenTestRun` in
+ * `gates.ts` (see that export for the full option contract). The
+ * Kotlin defaults (command predicate, Kiro extra success/failure
+ * signal, default reason) apply ONLY when `options.command` is
+ * referentially the exported {@link GRADLE_TEST_COMMAND}; any other
+ * RegExp (a custom pattern, or a preset's own constant such as
+ * Swift's `XCODEBUILD_TEST_COMMAND`) falls through to the
+ * language-neutral behavior with the caller's own patterns/reason and
+ * no default appended. The Kiro exit-status extra-success/failure
+ * predicates apply only when the caller omits BOTH `successPattern`
+ * and `failurePattern` — supplying either fully suppresses the Kiro
+ * allowance, so a caller replacing the evidence contract gets exactly
+ * what they specified, nothing more.
  */
 export function requireGreenTestRun(options) {
-    // Gradle-defaulted wrapper over the language-neutral rule in
-    // gates.ts (JS/TS configs use it directly with their own patterns).
+    const isDefaultGradleCommand = options.command === GRADLE_TEST_COMMAND;
+    const allowKiroExtras = isDefaultGradleCommand && !options.successPattern && !options.failurePattern;
     return requireGreenTestRunGeneric({
         command: options.command,
-        successPattern: options.successPattern ?? /BUILD SUCCESSFUL/,
-        failurePattern: options.failurePattern ?? /FAILED|BUILD FAILED/,
+        commandPredicate: isDefaultGradleCommand
+            ? isKotlinDefaultGradleCommand
+            : undefined,
+        successPattern: options.successPattern ?? DEFAULT_SUCCESS_PATTERN,
+        extraSuccessPredicate: allowKiroExtras ? kotlinDefaultExtraSuccess : undefined,
+        failurePattern: options.failurePattern ?? DEFAULT_FAILURE_PATTERN,
+        extraFailurePredicate: allowKiroExtras
+            ? (_command, output) => kotlinDefaultExtraFailure(output)
+            : undefined,
         enforceForPaths: options.enforceForPaths,
         listCommitFiles: options.listCommitFiles,
-        reason: options.reason,
+        reason: isDefaultGradleCommand
+            ? options.reason ?? DEFAULT_GRADLE_GREEN_REASON
+            : options.reason,
     });
 }
 /** Complete single-line telemetry calls — the only additions the