@lifeaitools/rdc-skills 0.24.41 → 0.25.0

package/tests/rdc-brochure.test.mjs

@@ -1,125 +1,125 @@
-#!/usr/bin/env node
-
-import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const REPO_ROOT = resolve(__dirname, '..');
-const SCRIPT = join(REPO_ROOT, 'scripts', 'rdc-brochure.mjs');
-
-let failures = 0;
-function assert(cond, msg) {
-  if (cond) console.log(`  ✓ ${msg}`);
-  else {
-    failures += 1;
-    console.error(`  ✗ ${msg}`);
-  }
-}
-
-function runBrochure(args, env = {}) {
-  return spawnSync(process.execPath, [SCRIPT, ...args], {
-    cwd: REPO_ROOT,
-    encoding: 'utf8',
-    env: {
-      ...process.env,
-      RDC_BROCHURE_COMPOSE_ONLY: '1',
-      ...env,
-    },
-  });
-}
-
-function composedHtmlPath(stdout) {
-  const m = String(stdout || '').match(/^HTML:\s+(.+)$/m);
-  return m ? m[1].trim() : null;
-}
-
-function crc32(buf) {
-  let crc = 0xffffffff;
-  for (const byte of buf) {
-    crc ^= byte;
-    for (let i = 0; i < 8; i++) crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
-  }
-  return (crc ^ 0xffffffff) >>> 0;
-}
-
-function u16(n) {
-  const b = Buffer.alloc(2);
-  b.writeUInt16LE(n);
-  return b;
-}
-
-function u32(n) {
-  const b = Buffer.alloc(4);
-  b.writeUInt32LE(n >>> 0);
-  return b;
-}
-
-function writeStoredZip(zipPath, entryName, content) {
-  const name = Buffer.from(entryName);
-  const body = Buffer.from(content);
-  const crc = crc32(body);
-  const local = Buffer.concat([
-    u32(0x04034b50), u16(20), u16(0), u16(0), u16(0), u16(0),
-    u32(crc), u32(body.length), u32(body.length), u16(name.length), u16(0),
-    name, body,
-  ]);
-  const centralOffset = local.length;
-  const central = Buffer.concat([
-    u32(0x02014b50), u16(20), u16(20), u16(0), u16(0), u16(0), u16(0),
-    u32(crc), u32(body.length), u32(body.length), u16(name.length), u16(0),
-    u16(0), u16(0), u16(0), u32(0), u32(0), name,
-  ]);
-  const end = Buffer.concat([
-    u32(0x06054b50), u16(0), u16(0), u16(1), u16(1),
-    u32(central.length), u32(centralOffset), u16(0),
-  ]);
-  writeFileSync(zipPath, Buffer.concat([local, central, end]));
-}
-
-const root = mkdtempSync(join(tmpdir(), 'rdc-brochure-test-'));
-
-try {
-  console.log('Test 1: folder compose suppresses synthetic headings after YAML front matter');
-  const folder = join(root, 'frontmatter-folder');
-  mkdirSync(folder, { recursive: true });
-  writeFileSync(join(folder, '01-overview.md'), '---\ntitle: Overview\n---\n\n# Real Title\n\nBody.\n', 'utf8');
-  writeFileSync(join(folder, '02-h6.md'), '###### Small Heading\n\nTiny body.\n', 'utf8');
-  const composed = runBrochure([folder]);
-  assert(composed.status === 0, `compose-only folder exits 0 (got ${composed.status})`);
-  const htmlPath = composedHtmlPath(composed.stdout);
-  assert(htmlPath && existsSync(htmlPath), 'compose-only prints a readable HTML path');
-  const html = htmlPath ? readFileSync(htmlPath, 'utf8') : '';
-  assert(!html.includes('<h2>01-overview</h2>'), 'front-matter-led # heading has no duplicate filename h2');
-  assert(!html.includes('<h2>02-h6</h2>'), 'ATX h6 heading has no duplicate filename h2');
-  assert(html.includes('<h1>Real Title</h1>'), 'front-matter body still renders the real h1');
-
-  console.log('Test 2: invalid templates fail for folder and markdown compose paths');
-  const folderBad = runBrochure([folder, '--template', 'missing-template']);
-  assert(folderBad.status !== 0, 'folder compose with invalid template exits non-zero');
-  assert(/unknown template "missing-template"/.test(folderBad.stderr), 'folder compose reports unknown template');
-  assert(/Available template\(s\): studio-default/.test(folderBad.stderr), 'folder compose lists available templates');
-  const mdFile = join(root, 'single.md');
-  writeFileSync(mdFile, '# Single\n\nBody.\n', 'utf8');
-  const mdBad = runBrochure([mdFile, '--template', 'missing-template']);
-  assert(mdBad.status !== 0, 'single markdown compose with invalid template exits non-zero');
-  assert(/unknown template "missing-template"/.test(mdBad.stderr), 'single markdown compose reports unknown template');
-
-  console.log('Test 3: native unzip fallback rejects zip-slip entries before extraction');
-  const zipPath = join(root, 'zip-slip.zip');
-  writeStoredZip(zipPath, '../evil.md', '# Evil\n');
-  const badZip = runBrochure([zipPath], { RDC_BROCHURE_DISABLE_ADM_ZIP: '1' });
-  assert(badZip.status !== 0, 'zip-slip archive exits non-zero');
-  assert(/zip-slip: entry/.test(badZip.stderr), 'zip-slip error is reported');
-  assert(!existsSync(join(root, 'evil.md')), 'zip-slip member was not extracted outside the destination');
-} finally {
-  rmSync(root, { recursive: true, force: true });
-}
-
-if (failures > 0) {
-  console.error(`\nFAILED: ${failures} assertion(s)`);
-  process.exit(1);
-}
-console.log('\nALL PASS');
+#!/usr/bin/env node
+
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(__dirname, '..');
+const SCRIPT = join(REPO_ROOT, 'scripts', 'rdc-brochure.mjs');
+
+let failures = 0;
+function assert(cond, msg) {
+  if (cond) console.log(`  ✓ ${msg}`);
+  else {
+    failures += 1;
+    console.error(`  ✗ ${msg}`);
+  }
+}
+
+function runBrochure(args, env = {}) {
+  return spawnSync(process.execPath, [SCRIPT, ...args], {
+    cwd: REPO_ROOT,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      RDC_BROCHURE_COMPOSE_ONLY: '1',
+      ...env,
+    },
+  });
+}
+
+function composedHtmlPath(stdout) {
+  const m = String(stdout || '').match(/^HTML:\s+(.+)$/m);
+  return m ? m[1].trim() : null;
+}
+
+function crc32(buf) {
+  let crc = 0xffffffff;
+  for (const byte of buf) {
+    crc ^= byte;
+    for (let i = 0; i < 8; i++) crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function u16(n) {
+  const b = Buffer.alloc(2);
+  b.writeUInt16LE(n);
+  return b;
+}
+
+function u32(n) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32LE(n >>> 0);
+  return b;
+}
+
+function writeStoredZip(zipPath, entryName, content) {
+  const name = Buffer.from(entryName);
+  const body = Buffer.from(content);
+  const crc = crc32(body);
+  const local = Buffer.concat([
+    u32(0x04034b50), u16(20), u16(0), u16(0), u16(0), u16(0),
+    u32(crc), u32(body.length), u32(body.length), u16(name.length), u16(0),
+    name, body,
+  ]);
+  const centralOffset = local.length;
+  const central = Buffer.concat([
+    u32(0x02014b50), u16(20), u16(20), u16(0), u16(0), u16(0), u16(0),
+    u32(crc), u32(body.length), u32(body.length), u16(name.length), u16(0),
+    u16(0), u16(0), u16(0), u32(0), u32(0), name,
+  ]);
+  const end = Buffer.concat([
+    u32(0x06054b50), u16(0), u16(0), u16(1), u16(1),
+    u32(central.length), u32(centralOffset), u16(0),
+  ]);
+  writeFileSync(zipPath, Buffer.concat([local, central, end]));
+}
+
+const root = mkdtempSync(join(tmpdir(), 'rdc-brochure-test-'));
+
+try {
+  console.log('Test 1: folder compose suppresses synthetic headings after YAML front matter');
+  const folder = join(root, 'frontmatter-folder');
+  mkdirSync(folder, { recursive: true });
+  writeFileSync(join(folder, '01-overview.md'), '---\ntitle: Overview\n---\n\n# Real Title\n\nBody.\n', 'utf8');
+  writeFileSync(join(folder, '02-h6.md'), '###### Small Heading\n\nTiny body.\n', 'utf8');
+  const composed = runBrochure([folder]);
+  assert(composed.status === 0, `compose-only folder exits 0 (got ${composed.status})`);
+  const htmlPath = composedHtmlPath(composed.stdout);
+  assert(htmlPath && existsSync(htmlPath), 'compose-only prints a readable HTML path');
+  const html = htmlPath ? readFileSync(htmlPath, 'utf8') : '';
+  assert(!html.includes('<h2>01-overview</h2>'), 'front-matter-led # heading has no duplicate filename h2');
+  assert(!html.includes('<h2>02-h6</h2>'), 'ATX h6 heading has no duplicate filename h2');
+  assert(html.includes('<h1>Real Title</h1>'), 'front-matter body still renders the real h1');
+
+  console.log('Test 2: invalid templates fail for folder and markdown compose paths');
+  const folderBad = runBrochure([folder, '--template', 'missing-template']);
+  assert(folderBad.status !== 0, 'folder compose with invalid template exits non-zero');
+  assert(/unknown template "missing-template"/.test(folderBad.stderr), 'folder compose reports unknown template');
+  assert(/Available template\(s\): studio-default/.test(folderBad.stderr), 'folder compose lists available templates');
+  const mdFile = join(root, 'single.md');
+  writeFileSync(mdFile, '# Single\n\nBody.\n', 'utf8');
+  const mdBad = runBrochure([mdFile, '--template', 'missing-template']);
+  assert(mdBad.status !== 0, 'single markdown compose with invalid template exits non-zero');
+  assert(/unknown template "missing-template"/.test(mdBad.stderr), 'single markdown compose reports unknown template');
+
+  console.log('Test 3: native unzip fallback rejects zip-slip entries before extraction');
+  const zipPath = join(root, 'zip-slip.zip');
+  writeStoredZip(zipPath, '../evil.md', '# Evil\n');
+  const badZip = runBrochure([zipPath], { RDC_BROCHURE_DISABLE_ADM_ZIP: '1' });
+  assert(badZip.status !== 0, 'zip-slip archive exits non-zero');
+  assert(/zip-slip: entry/.test(badZip.stderr), 'zip-slip error is reported');
+  assert(!existsSync(join(root, 'evil.md')), 'zip-slip member was not extracted outside the destination');
+} finally {
+  rmSync(root, { recursive: true, force: true });
+}
+
+if (failures > 0) {
+  console.error(`\nFAILED: ${failures} assertion(s)`);
+  process.exit(1);
+}
+console.log('\nALL PASS');

package/tests/require-work-item-on-commit.test.mjs

@@ -1,162 +1,162 @@
-#!/usr/bin/env node
-/**
- * Truth Gate L1 — commit-capture hook tests.
- *
- * Proves:
- *   1. parse: the work-item UUID is extracted from a commit message; absent UUID -> null.
- *   2. capture: on a PostToolUse(git commit), the captured `sha` EQUALS the real
- *      `git rev-parse HEAD` of the repo (verified against a throwaway git repo,
- *      via the RDC_COMMIT_CAPTURE_SINK file — no live DB required).
- *   3. no-item: capture NO-OPs (writes nothing) when the commit message carries
- *      no work-item UUID. No orphan row.
- *
- * Run: node tests/require-work-item-on-commit.test.mjs   (or `node --test tests/`)
- */
-import { mkdtempSync, rmSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, resolve, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { spawnSync, execFileSync } from 'node:child_process';
-import { createRequire } from 'node:module';
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const REPO_ROOT = resolve(__dirname, '..');
-const HOOK = join(REPO_ROOT, 'hooks', 'require-work-item-on-commit.js');
-
-const require = createRequire(import.meta.url);
-const failures = [];
-function assert(name, condition, detail = '') {
-  if (!condition) failures.push(`${name}${detail ? `: ${detail}` : ''}`);
-}
-
-// ---------------------------------------------------------------------------
-// 1. Pure parse assertions
-// ---------------------------------------------------------------------------
-const hook = require(HOOK);
-const WI = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';
-
-assert('parse: extracts UUID from message',
-  hook.parseCommitMessageWorkItem(`feat(x): do thing for ${WI}`) === WI);
-assert('parse: null when no UUID',
-  hook.parseCommitMessageWorkItem('feat(x): no work item here') === null);
-assert('isGitCommit: true for real commit',
-  hook.isGitCommit('git commit -m "feat: x"') === true);
-assert('isGitCommit: false for --help',
-  hook.isGitCommit('git commit --help') === false);
-assert('isGitCommit: false for unrelated',
-  hook.isGitCommit('git status') === false);
-assert('commitSucceeded: false on nothing-to-commit',
-  hook.commitSucceeded({ stdout: 'nothing to commit, working tree clean' }) === false);
-assert('commitSucceeded: true on exit 0',
-  hook.commitSucceeded({ exit_code: 0 }) === true);
-
-// ---------------------------------------------------------------------------
-// helper: build a throwaway git repo with one commit
-// ---------------------------------------------------------------------------
-function makeRepo() {
-  const dir = mkdtempSync(join(tmpdir(), 'wic-repo-'));
-  const g = (...args) => execFileSync('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
-  g('init', '-q');
-  g('config', 'user.email', 'test@example.com');
-  g('config', 'user.name', 'Test');
-  writeFileSync(join(dir, 'f.txt'), 'hello\n');
-  g('add', 'f.txt');
-  g('commit', '-q', '-m', `feat: seed for ${WI}`);
-  const head = g('rev-parse', 'HEAD').trim();
-  return { dir, head };
-}
-
-function runHook(payload, extraEnv = {}) {
-  return spawnSync(process.execPath, [HOOK], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    env: { ...process.env, ...extraEnv },
-  });
-}
-
-// ---------------------------------------------------------------------------
-// 2. Capture: sha == git rev-parse HEAD
-// ---------------------------------------------------------------------------
-{
-  const { dir, head } = makeRepo();
-  const sink = join(dir, 'sink.jsonl');
-  // Point Supabase at an unreachable host so the test never touches a real DB;
-  // capture still writes the sink, which is what we assert on.
-  const res = runHook({
-    hook_event_name: 'PostToolUse',
-    tool_name: 'Bash',
-    session_id: 'sess-capture-1',
-    cwd: dir,
-    tool_input: { command: `git commit -m "feat: thing for ${WI}"` },
-    tool_response: { exit_code: 0, stdout: '1 file changed' },
-  }, {
-    RDC_COMMIT_CAPTURE_SINK: sink,
-    SUPABASE_URL: 'http://127.0.0.1:9',     // unreachable -> DB insert fails fast, capture still records sink
-    SUPABASE_SERVICE_ROLE_KEY: 'test-key-not-real',
-  });
-  assert('capture: hook exits zero', res.status === 0, res.stderr);
-  assert('capture: sink written', existsSync(sink), 'no sink file');
-  if (existsSync(sink)) {
-    const row = JSON.parse(readFileSync(sink, 'utf8').trim().split('\n')[0]);
-    assert('capture: sha equals real HEAD', row.sha === head, `${row.sha} !== ${head}`);
-    assert('capture: work_item_id parsed', row.work_item_id === WI, row.work_item_id);
-    assert('capture: session_id recorded', row.session_id === 'sess-capture-1', row.session_id);
-  }
-  rmSync(dir, { recursive: true, force: true });
-}
-
-// ---------------------------------------------------------------------------
-// 3. No active work item -> NO-OP (no sink row)
-// ---------------------------------------------------------------------------
-{
-  const { dir } = makeRepo();
-  const sink = join(dir, 'sink.jsonl');
-  const res = runHook({
-    hook_event_name: 'PostToolUse',
-    tool_name: 'Bash',
-    session_id: 'sess-no-item',
-    cwd: dir,
-    tool_input: { command: 'git commit -m "feat: no work item ref"' },
-    tool_response: { exit_code: 0 },
-  }, { RDC_COMMIT_CAPTURE_SINK: sink });
-  assert('no-item: hook exits zero', res.status === 0, res.stderr);
-  assert('no-item: no sink row written', !existsSync(sink), 'orphan capture written for no-item commit');
-  rmSync(dir, { recursive: true, force: true });
-}
-
-// ---------------------------------------------------------------------------
-// 4. PreToolUse legacy behavior preserved (warn-only, never blocks)
-//    Uses a fresh temp dir as HOME/USERPROFILE so no fixit.marker is visible
-//    regardless of real machine state — makes the warn-path assertion deterministic.
-// ---------------------------------------------------------------------------
-{
-  const fakeHome = mkdtempSync(join(tmpdir(), 'wic-home-'));
-  try {
-    const preEnv = { HOME: fakeHome, USERPROFILE: fakeHome };
-
-    const res = runHook({
-      hook_event_name: 'PreToolUse',
-      tool_name: 'Bash',
-      tool_input: { command: 'git commit -m "no convention and no uuid"' },
-    }, preEnv);
-    assert('pre: warn exits zero (never blocks)', res.status === 0, res.stderr);
-    assert('pre: emits warn systemMessage', /no work item reference/.test(res.stdout), res.stdout);
-
-    const ok = runHook({
-      hook_event_name: 'PreToolUse',
-      tool_name: 'Bash',
-      tool_input: { command: 'git commit -m "feat(x): conventional"' },
-    }, preEnv);
-    assert('pre: conventional passes silently', ok.status === 0 && ok.stdout.trim() === '', ok.stdout);
-  } finally {
-    rmSync(fakeHome, { recursive: true, force: true });
-  }
-}
-
-// ---------------------------------------------------------------------------
-if (failures.length > 0) {
-  console.error('\ncommit-capture hook tests — FAIL\n');
-  for (const f of failures) console.error(`  - ${f}`);
-  process.exit(1);
-}
-console.log('commit-capture hook tests — PASS');
+#!/usr/bin/env node
+/**
+ * Truth Gate L1 — commit-capture hook tests.
+ *
+ * Proves:
+ *   1. parse: the work-item UUID is extracted from a commit message; absent UUID -> null.
+ *   2. capture: on a PostToolUse(git commit), the captured `sha` EQUALS the real
+ *      `git rev-parse HEAD` of the repo (verified against a throwaway git repo,
+ *      via the RDC_COMMIT_CAPTURE_SINK file — no live DB required).
+ *   3. no-item: capture NO-OPs (writes nothing) when the commit message carries
+ *      no work-item UUID. No orphan row.
+ *
+ * Run: node tests/require-work-item-on-commit.test.mjs   (or `node --test tests/`)
+ */
+import { mkdtempSync, rmSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync, execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(__dirname, '..');
+const HOOK = join(REPO_ROOT, 'hooks', 'require-work-item-on-commit.js');
+
+const require = createRequire(import.meta.url);
+const failures = [];
+function assert(name, condition, detail = '') {
+  if (!condition) failures.push(`${name}${detail ? `: ${detail}` : ''}`);
+}
+
+// ---------------------------------------------------------------------------
+// 1. Pure parse assertions
+// ---------------------------------------------------------------------------
+const hook = require(HOOK);
+const WI = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';
+
+assert('parse: extracts UUID from message',
+  hook.parseCommitMessageWorkItem(`feat(x): do thing for ${WI}`) === WI);
+assert('parse: null when no UUID',
+  hook.parseCommitMessageWorkItem('feat(x): no work item here') === null);
+assert('isGitCommit: true for real commit',
+  hook.isGitCommit('git commit -m "feat: x"') === true);
+assert('isGitCommit: false for --help',
+  hook.isGitCommit('git commit --help') === false);
+assert('isGitCommit: false for unrelated',
+  hook.isGitCommit('git status') === false);
+assert('commitSucceeded: false on nothing-to-commit',
+  hook.commitSucceeded({ stdout: 'nothing to commit, working tree clean' }) === false);
+assert('commitSucceeded: true on exit 0',
+  hook.commitSucceeded({ exit_code: 0 }) === true);
+
+// ---------------------------------------------------------------------------
+// helper: build a throwaway git repo with one commit
+// ---------------------------------------------------------------------------
+function makeRepo() {
+  const dir = mkdtempSync(join(tmpdir(), 'wic-repo-'));
+  const g = (...args) => execFileSync('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  g('init', '-q');
+  g('config', 'user.email', 'test@example.com');
+  g('config', 'user.name', 'Test');
+  writeFileSync(join(dir, 'f.txt'), 'hello\n');
+  g('add', 'f.txt');
+  g('commit', '-q', '-m', `feat: seed for ${WI}`);
+  const head = g('rev-parse', 'HEAD').trim();
+  return { dir, head };
+}
+
+function runHook(payload, extraEnv = {}) {
+  return spawnSync(process.execPath, [HOOK], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    env: { ...process.env, ...extraEnv },
+  });
+}
+
+// ---------------------------------------------------------------------------
+// 2. Capture: sha == git rev-parse HEAD
+// ---------------------------------------------------------------------------
+{
+  const { dir, head } = makeRepo();
+  const sink = join(dir, 'sink.jsonl');
+  // Point Supabase at an unreachable host so the test never touches a real DB;
+  // capture still writes the sink, which is what we assert on.
+  const res = runHook({
+    hook_event_name: 'PostToolUse',
+    tool_name: 'Bash',
+    session_id: 'sess-capture-1',
+    cwd: dir,
+    tool_input: { command: `git commit -m "feat: thing for ${WI}"` },
+    tool_response: { exit_code: 0, stdout: '1 file changed' },
+  }, {
+    RDC_COMMIT_CAPTURE_SINK: sink,
+    SUPABASE_URL: 'http://127.0.0.1:9',     // unreachable -> DB insert fails fast, capture still records sink
+    SUPABASE_SERVICE_ROLE_KEY: 'test-key-not-real',
+  });
+  assert('capture: hook exits zero', res.status === 0, res.stderr);
+  assert('capture: sink written', existsSync(sink), 'no sink file');
+  if (existsSync(sink)) {
+    const row = JSON.parse(readFileSync(sink, 'utf8').trim().split('\n')[0]);
+    assert('capture: sha equals real HEAD', row.sha === head, `${row.sha} !== ${head}`);
+    assert('capture: work_item_id parsed', row.work_item_id === WI, row.work_item_id);
+    assert('capture: session_id recorded', row.session_id === 'sess-capture-1', row.session_id);
+  }
+  rmSync(dir, { recursive: true, force: true });
+}
+
+// ---------------------------------------------------------------------------
+// 3. No active work item -> NO-OP (no sink row)
+// ---------------------------------------------------------------------------
+{
+  const { dir } = makeRepo();
+  const sink = join(dir, 'sink.jsonl');
+  const res = runHook({
+    hook_event_name: 'PostToolUse',
+    tool_name: 'Bash',
+    session_id: 'sess-no-item',
+    cwd: dir,
+    tool_input: { command: 'git commit -m "feat: no work item ref"' },
+    tool_response: { exit_code: 0 },
+  }, { RDC_COMMIT_CAPTURE_SINK: sink });
+  assert('no-item: hook exits zero', res.status === 0, res.stderr);
+  assert('no-item: no sink row written', !existsSync(sink), 'orphan capture written for no-item commit');
+  rmSync(dir, { recursive: true, force: true });
+}
+
+// ---------------------------------------------------------------------------
+// 4. PreToolUse legacy behavior preserved (warn-only, never blocks)
+//    Uses a fresh temp dir as HOME/USERPROFILE so no fixit.marker is visible
+//    regardless of real machine state — makes the warn-path assertion deterministic.
+// ---------------------------------------------------------------------------
+{
+  const fakeHome = mkdtempSync(join(tmpdir(), 'wic-home-'));
+  try {
+    const preEnv = { HOME: fakeHome, USERPROFILE: fakeHome };
+
+    const res = runHook({
+      hook_event_name: 'PreToolUse',
+      tool_name: 'Bash',
+      tool_input: { command: 'git commit -m "no convention and no uuid"' },
+    }, preEnv);
+    assert('pre: warn exits zero (never blocks)', res.status === 0, res.stderr);
+    assert('pre: emits warn systemMessage', /no work item reference/.test(res.stdout), res.stdout);
+
+    const ok = runHook({
+      hook_event_name: 'PreToolUse',
+      tool_name: 'Bash',
+      tool_input: { command: 'git commit -m "feat(x): conventional"' },
+    }, preEnv);
+    assert('pre: conventional passes silently', ok.status === 0 && ok.stdout.trim() === '', ok.stdout);
+  } finally {
+    rmSync(fakeHome, { recursive: true, force: true });
+  }
+}
+
+// ---------------------------------------------------------------------------
+if (failures.length > 0) {
+  console.error('\ncommit-capture hook tests — FAIL\n');
+  for (const f of failures) console.error(`  - ${f}`);
+  process.exit(1);
+}
+console.log('commit-capture hook tests — PASS');