@mmnto/cli 1.102.0 → 1.104.0

package/dist/commands/init.test.js

@@ -3,7 +3,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { LedgerEventSchema, resolveSelfAgents } from '@mmnto/totem';
+import { AUTO_CLOSE_REGEX_SOURCE, LedgerEventSchema, resolveSelfAgents } from '@mmnto/totem';
 import { UNIVERSAL_BASELINE_LESSONS, UNIVERSAL_BASELINE_MARKDOWN, UNIVERSAL_BASELINE_MARKER, } from '../assets/universal-baseline.js';
 import { cleanTmpDir } from '../test-utils.js';
 import { buildNpxCommand, detectEmbeddingTier, detectReflexStatus, generateConfig, initCommand, installBaselineLessons, OLLAMA_FLOOR_DEFAULT_BASE_URL, probeOllamaFloor, REFLEX_VERSION, scaffoldClaudeHooks, scaffoldClaudeSessionStart, scaffoldClaudeSkill, scaffoldClaudeWriteShield, scaffoldFile, scaffoldMcpConfig, upgradeReflexes, } from './init.js';
@@ -313,7 +313,7 @@ describe('Gemini hook scaffolding', () => {
         const hooksDir = path.join(tmpDir, '.gemini', 'hooks');
         const skillsDir = path.join(tmpDir, '.gemini', 'skills');
         const sessionStart = scaffoldFile(path.join(hooksDir, 'SessionStart.js'), '// [totem] auto-generated\ntest\n');
-        const beforeTool = scaffoldFile(path.join(hooksDir, 'BeforeTool.js'), '// [totem] auto-generated\ntest\n');
+        const beforeTool = scaffoldFile(path.join(hooksDir, 'BeforeTool.cjs'), '// [totem] auto-generated\ntest\n');
         const skill = scaffoldFile(path.join(skillsDir, 'totem.md'), '<!-- [totem] auto-generated — Totem Architect skill -->\ntest\n', '<!-- [totem] auto-generated — Totem Architect skill -->');
         expect(sessionStart).toEqual({ action: 'created' });
         expect(beforeTool).toEqual({ action: 'created' });
@@ -1179,6 +1179,12 @@ describe('CLAUDE_PREWRITESHIELD template', () => {
     it('cites the seal at mmnto-ai/totem-strategy#145', () => {
         expect(CLAUDE_PREWRITESHIELD).toContain('mmnto-ai/totem-strategy#145');
     });
+    it('inlines the shared AUTO_CLOSE_REGEX_SOURCE (mmnto-ai/totem#1762, JSON-encoded)', () => {
+        expect(CLAUDE_PREWRITESHIELD).toContain(JSON.stringify(AUTO_CLOSE_REGEX_SOURCE));
+    });
+    it('cites the auto-close issue mmnto-ai/totem#1762', () => {
+        expect(CLAUDE_PREWRITESHIELD).toContain('mmnto-ai/totem#1762');
+    });
 });
 describe('PreWriteShield runtime behavior', () => {
     let tmpDir;
@@ -1291,6 +1297,269 @@ describe('PreWriteShield runtime behavior', () => {
         });
         expect(result.exitCode).toBe(0);
     });
+    // ─── Auto-close keyword guard (mmnto-ai/totem#1762) ───────────────────────
+    it('exits 2 on a close keyword adjacent to an issue ref in a **/*.md write', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: { file_path: 'docs/x.md', content: 'Closes #131' },
+        });
+        expect(result.exitCode).toBe(2);
+        expect(result.stderr).toMatch(/auto-close/i);
+        expect(result.stderr).toContain('#131');
+    });
+    it('exits 2 even under NEGATION (presence invariant — the #2471 shape)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: { file_path: '.journal/t.md', content: 'Does not close #2466' },
+        });
+        expect(result.exitCode).toBe(2);
+        expect(result.stderr).toMatch(/auto-close/i);
+        expect(result.stderr).toContain('#2466');
+    });
+    it('exits 2 on a QUALIFIED close ref (owner/repo#N still auto-closes)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: { file_path: 'docs/x.md', content: 'Closes mmnto-ai/totem#131' },
+        });
+        expect(result.exitCode).toBe(2);
+        expect(result.stderr).toMatch(/auto-close/i);
+    });
+    it('exits 2 on the issue-URL close form (kimi BLOCKING-1)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: 'docs/x.md',
+                content: 'Fixes https://github.com/mmnto-ai/totem/issues/2466',
+            },
+        });
+        expect(result.exitCode).toBe(2);
+        expect(result.stderr).toMatch(/auto-close/i);
+        expect(result.stderr).toContain('mmnto-ai/totem#2466');
+    });
+    it('EXEMPTS .github/** from the auto-close guard (AC-4 — keywords intentional there)', () => {
+        // Qualified ref so the sealed bare-ref arm (unchanged) also stays quiet; this
+        // isolates the auto-close .github exemption.
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: '.github/PULL_REQUEST_TEMPLATE.md',
+                content: 'Closes mmnto-ai/totem#131',
+            },
+        });
+        expect(result.exitCode).toBe(0);
+    });
+    it('EXEMPTS .totem/** from the auto-close guard (gemini #2 — tool/agent-authored content)', () => {
+        // Qualified ref isolates the auto-close .totem exemption from the sealed
+        // bare-ref rule (which still applies to .totem/*.md — out of this slice's scope).
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: { file_path: '.totem/lessons/x.md', content: 'Closes mmnto-ai/totem#131' },
+        });
+        expect(result.exitCode).toBe(0);
+    });
+    it('does NOT exempt .changeset/** (its prose is composed into the VP-PR description)', () => {
+        // gemini #2 DECLINED half: changeset prose lands in the Version-Packages PR
+        // description (an auto-close surface — verified on PR mmnto-ai/totem#2474).
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: { file_path: '.changeset/happy-lions.md', content: 'Fixes mmnto-ai/totem#131' },
+        });
+        expect(result.exitCode).toBe(2);
+        expect(result.stderr).toMatch(/auto-close/i);
+    });
+    it('respects the suppression-directive bypass for a verbatim-quoted close keyword', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: 'docs/x.md',
+                content: '<!-- totem-context: verbatim quotation of a historical commit -->\nThe commit said closes #131.',
+            },
+        });
+        expect(result.exitCode).toBe(0);
+    });
+    it('exits 0 on a non-keyword issue reference in markdown (references/see form)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: 'docs/x.md',
+                content: 'references mmnto-ai/totem#131 and see mmnto-ai/totem#5',
+            },
+        });
+        expect(result.exitCode).toBe(0);
+    });
+    // ─── Dispatch frontmatter-quoting guard (mmnto-ai/totem-status#123) ────────
+    const OUTBOX_MD = '.totem/orchestration/totem-claude/outbox/2026-07-22T1200Z-reply.md';
+    it('exits 2 on an unquoted ": " in an outbox subject: value (strict-YAML breaker)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: OUTBOX_MD,
+                content: '---\nschema: adr-098-v0.4\nsubject: Re: parity round -- positions\n---\nBody.',
+            },
+        });
+        expect(result.exitCode).toBe(2);
+        expect(result.stderr).toContain('subject');
+        expect(result.stderr).toMatch(/quote/i);
+        expect(result.stderr).toContain('mmnto-ai/totem-status#123');
+    });
+    it('exits 2 on an unquoted ": " in expected-action: (and names the offending key)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: OUTBOX_MD,
+                content: '---\nsubject: "safe"\nexpected-action: reply by Friday: with positions\n---\n',
+            },
+        });
+        expect(result.exitCode).toBe(2);
+        expect(result.stderr).toContain('expected-action');
+    });
+    it('exits 2 on a TRAILING colon in an unquoted subject: value', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: { file_path: OUTBOX_MD, content: '---\nsubject: Re:\n---\n' },
+        });
+        expect(result.exitCode).toBe(2);
+    });
+    it('exits 2 at a Windows-backslash outbox path too', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: '.totem\\orchestration\\totem-claude\\outbox\\reply.md',
+                content: '---\nsubject: Re: broken -- title\n---\n',
+            },
+        });
+        expect(result.exitCode).toBe(2);
+    });
+    it('exits 0 on a double-quoted subject carrying colons', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: OUTBOX_MD,
+                content: '---\nsubject: "Re: parity round -- positions"\n---\nBody.',
+            },
+        });
+        expect(result.exitCode).toBe(0);
+    });
+    it('exits 2 on a fake block-scalar header with trailing text (">note: x" is not valid YAML)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: OUTBOX_MD,
+                content: '---\nsubject: >note: this is not a block scalar\n---\n',
+            },
+        });
+        expect(result.exitCode).toBe(2);
+    });
+    it('exits 0 on a single-quoted value and on a block scalar (>-)', () => {
+        const single = runHook({
+            tool_name: 'Write',
+            tool_input: { file_path: OUTBOX_MD, content: "---\nsubject: 'Re: quoted'\n---\n" },
+        });
+        expect(single.exitCode).toBe(0);
+        const folded = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: OUTBOX_MD,
+                content: '---\nsubject: >-\n  Re: folded -- safe\n---\n',
+            },
+        });
+        expect(folded.exitCode).toBe(0);
+    });
+    it('exits 0 on a colon-free unquoted subject (plain scalars stay legal)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: { file_path: OUTBOX_MD, content: '---\nsubject: parity round positions\n---\n' },
+        });
+        expect(result.exitCode).toBe(0);
+    });
+    it('scans the leading frontmatter block ONLY on full-file writes (body prose stays writable)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: OUTBOX_MD,
+                content: '---\nsubject: "safe"\n---\nsubject: unquoted: colon in body prose about the schema',
+            },
+        });
+        expect(result.exitCode).toBe(0);
+    });
+    it('exits 0 on a frontmatter-LESS full Write (mode is tool-determined, body is never scanned)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: OUTBOX_MD,
+                content: 'Draft notes, no frontmatter yet.\nsubject: Re: unsafe-looking body line\n',
+            },
+        });
+        expect(result.exitCode).toBe(0);
+    });
+    it('exits 2 on an UNTERMINATED quoted subject (a leading quote alone is not safety)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: { file_path: OUTBOX_MD, content: '---\nsubject: "Re: round\n---\n' },
+        });
+        expect(result.exitCode).toBe(2);
+    });
+    it('exits 2 on trailing junk after a closed quote (also invalid YAML)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: { file_path: OUTBOX_MD, content: '---\nsubject: "Re: round" oops\n---\n' },
+        });
+        expect(result.exitCode).toBe(2);
+    });
+    it('exits 2 on an invalid double-quote escape ("Re: D:\\q" is not YAML)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: { file_path: OUTBOX_MD, content: '---\nsubject: "Re: D:\\q"\n---\n' },
+        });
+        expect(result.exitCode).toBe(2);
+    });
+    it('exits 0 on YAML-legal escapes inside a quoted subject', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: OUTBOX_MD,
+                content: '---\nsubject: "tab \\t quote \\" backslash \\\\ ok"\n---\n',
+            },
+        });
+        expect(result.exitCode).toBe(0);
+    });
+    it('exits 2 on a multi-line quoted subject (single-physical-line policy for the line-oriented lenient consumer)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: OUTBOX_MD,
+                content: '---\nsubject: "Re: spans\n  two lines"\n---\n',
+            },
+        });
+        expect(result.exitCode).toBe(2);
+    });
+    it('does NOT fire outside the outbox surface (same content at a .journal path)', () => {
+        const result = runHook({
+            tool_name: 'Write',
+            tool_input: {
+                file_path: '.journal/test.md',
+                content: '---\nsubject: Re: not a dispatch -- out of scope\n---\n',
+            },
+        });
+        expect(result.exitCode).toBe(0);
+    });
+    it('exits 2 on an Edit fragment reintroducing an unquoted subject (fragment mode)', () => {
+        const result = runHook({
+            tool_name: 'Edit',
+            tool_input: { file_path: OUTBOX_MD, new_string: 'subject: Re: sharpened -- title' },
+        });
+        expect(result.exitCode).toBe(2);
+    });
+    it('honors the totem-context escape in fragment mode (schema discussion in a body edit)', () => {
+        const result = runHook({
+            tool_name: 'Edit',
+            tool_input: {
+                file_path: OUTBOX_MD,
+                new_string: '<!-- totem-context: verbatim quotation of the malformed specimen -->\nsubject: Re: the specimen that broke strict YAML',
+            },
+        });
+        expect(result.exitCode).toBe(0);
+    });
 });
 describe('CLAUDE_SESSION_START runtime behavior (A.3.a ledger write)', () => {
     // Fail-fast guard for the spawned hook process, matching the 30s timeout
@@ -1369,10 +1638,16 @@ describe('CLAUDE_SESSION_START runtime behavior (A.3.a ledger write)', () => {
         }
     });
 });
-describe('GEMINI_BEFORE_TOOL write_file/edit_file extension', () => {
-    it('extends BeforeTool with write_file/edit_file branch', () => {
-        expect(GEMINI_BEFORE_TOOL).toContain("'write_file'");
-        expect(GEMINI_BEFORE_TOOL).toContain("'edit_file'");
+describe('GEMINI_BEFORE_TOOL write_file/replace extension', () => {
+    it('gates BOTH check functions on write_file + replace (+ legacy edit_file)', () => {
+        // Gemini CLI's real write tools are `write_file` + `replace` — there is NO
+        // `edit_file` (docs.gemini file-system tools; gemini-cli#20321). Every check
+        // function must list `replace`, else surgical edits bypass the hook
+        // (gemini #1). `edit_file` is kept for backward-safety.
+        const gates = [...GEMINI_BEFORE_TOOL.matchAll(/toolName !== '([a-z_]+)'/g)].map((m) => m[1]);
+        for (const wanted of ['write_file', 'replace']) {
+            expect(gates.filter((g) => g === wanted).length).toBeGreaterThanOrEqual(2);
+        }
     });
     it('inlines BARE_REF_REGEX_SOURCE in write-tool branch (JSON-encoded for safe JS string-literal embedding)', () => {
         expect(GEMINI_BEFORE_TOOL).toContain(JSON.stringify(BARE_REF_REGEX_SOURCE));
@@ -1384,6 +1659,175 @@ describe('GEMINI_BEFORE_TOOL write_file/edit_file extension', () => {
     it('cites the seal at mmnto-ai/totem-strategy#145 in BeforeTool extension', () => {
         expect(GEMINI_BEFORE_TOOL).toContain('mmnto-ai/totem-strategy#145');
     });
+    it('inlines the shared AUTO_CLOSE_REGEX_SOURCE (mmnto-ai/totem#1762, parity with PreWriteShield)', () => {
+        expect(GEMINI_BEFORE_TOOL).toContain(JSON.stringify(AUTO_CLOSE_REGEX_SOURCE));
+    });
+    it('wires the auto-close check into beforeTool and cites mmnto-ai/totem#1762', () => {
+        expect(GEMINI_BEFORE_TOOL).toContain('checkAutoCloseKeywords(toolName, toolInput)');
+        expect(GEMINI_BEFORE_TOOL).toContain('mmnto-ai/totem#1762');
+    });
+});
+describe('GEMINI_BEFORE_TOOL auto-close runtime behavior (mmnto-ai/totem#1762)', () => {
+    let tmpDir;
+    let hookPath;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'totem-gemini-beforetool-'));
+        hookPath = path.join(tmpDir, 'BeforeTool.js');
+        fs.writeFileSync(hookPath, GEMINI_BEFORE_TOOL, 'utf-8');
+    });
+    afterEach(() => {
+        cleanTmpDir(tmpDir);
+    });
+    /** Require the rendered hook fresh and report whether it threw. */
+    function runBeforeTool(tool, input) {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const beforeTool = require(hookPath);
+        try {
+            beforeTool(tool, input);
+            return { threw: false, message: '' };
+        }
+        catch (err) {
+            return { threw: true, message: err instanceof Error ? err.message : String(err) };
+        }
+    }
+    it('throws (blocks) on a close keyword adjacent to an issue ref in a **/*.md write, even negated', () => {
+        const r = runBeforeTool('write_file', {
+            file_path: 'docs/x.md',
+            content: 'Does not close #2466',
+        });
+        expect(r.threw).toBe(true);
+        expect(r.message).toMatch(/auto-close/i);
+        expect(r.message).toContain('#2466');
+    });
+    it('blocks the auto-close rule via the real `replace` edit tool (gemini #1)', () => {
+        const r = runBeforeTool('replace', {
+            file_path: 'docs/x.md',
+            new_string: 'Fixes https://github.com/mmnto-ai/totem/issues/2466',
+        });
+        expect(r.threw).toBe(true);
+        expect(r.message).toContain('mmnto-ai/totem#2466');
+    });
+    it('blocks the xrepo bare-ref rule via `replace` too (fixes the same pre-existing gap)', () => {
+        const r = runBeforeTool('replace', { file_path: '.journal/x.md', new_string: 'see #9 above' });
+        expect(r.threw).toBe(true);
+        expect(r.message).toMatch(/Bare PR\/issue/i);
+    });
+    it('uses the [totem BeforeTool] prefix, not [totem PreWriteShield] (gemini #3)', () => {
+        const r = runBeforeTool('write_file', { file_path: 'docs/x.md', content: 'Closes #5' });
+        expect(r.message).toContain('[totem BeforeTool]');
+        expect(r.message).not.toContain('PreWriteShield');
+    });
+    it('exempts .github/** (qualified ref keeps the bare-ref arm quiet too)', () => {
+        const r = runBeforeTool('write_file', {
+            file_path: '.github/x.md',
+            content: 'Closes mmnto-ai/totem#5',
+        });
+        expect(r.threw).toBe(false);
+    });
+    it('exempts .totem/** from the auto-close rule (gemini #2)', () => {
+        const r = runBeforeTool('write_file', {
+            file_path: '.totem/lessons/x.md',
+            content: 'Closes mmnto-ai/totem#5',
+        });
+        expect(r.threw).toBe(false);
+    });
+    it('does not throw on a non-keyword reference form', () => {
+        const r = runBeforeTool('edit_file', {
+            file_path: 'docs/x.md',
+            new_string: 'see mmnto-ai/totem#5',
+        });
+        expect(r.threw).toBe(false);
+    });
+    // ─── Dispatch frontmatter-quoting guard (mmnto-ai/totem-status#123) ────────
+    it('throws on an unquoted ": " in an outbox subject: value (parity with PreWriteShield)', () => {
+        const r = runBeforeTool('write_file', {
+            file_path: '.totem/orchestration/totem-gemini/outbox/reply.md',
+            content: '---\nsubject: Re: parity round -- positions\n---\nBody.',
+        });
+        expect(r.threw).toBe(true);
+        expect(r.message).toContain('[totem BeforeTool]');
+        expect(r.message).toContain('mmnto-ai/totem-status#123');
+    });
+    it('does not throw on a quoted outbox subject', () => {
+        const r = runBeforeTool('write_file', {
+            file_path: '.totem/orchestration/totem-gemini/outbox/reply.md',
+            content: '---\nsubject: "Re: parity round -- positions"\n---\nBody.',
+        });
+        expect(r.threw).toBe(false);
+    });
+    it('blocks the quoting guard via the real `replace` edit tool too', () => {
+        const r = runBeforeTool('replace', {
+            file_path: '.totem/orchestration/totem-gemini/outbox/reply.md',
+            new_string: 'subject: Re: reintroduced -- unquoted',
+        });
+        expect(r.threw).toBe(true);
+        expect(r.message).toMatch(/quote/i);
+    });
+    it('blocks the quoting guard via the legacy `edit_file` gate (backward-safety branch)', () => {
+        const r = runBeforeTool('edit_file', {
+            file_path: '.totem/orchestration/totem-gemini/outbox/reply.md',
+            new_string: 'subject: Re: legacy tool -- unquoted',
+        });
+        expect(r.threw).toBe(true);
+    });
+    it('does not throw on a frontmatter-less full write_file (tool-determined mode)', () => {
+        const r = runBeforeTool('write_file', {
+            file_path: '.totem/orchestration/totem-gemini/outbox/reply.md',
+            content: 'Draft notes, no frontmatter yet.\nsubject: Re: unsafe-looking body line\n',
+        });
+        expect(r.threw).toBe(false);
+    });
+    it('throws on an unterminated quoted subject (leading quote alone is not safety)', () => {
+        const r = runBeforeTool('write_file', {
+            file_path: '.totem/orchestration/totem-gemini/outbox/reply.md',
+            content: '---\nsubject: "Re: round\n---\n',
+        });
+        expect(r.threw).toBe(true);
+    });
+    it('throws on an invalid double-quote escape at the Gemini call site too', () => {
+        const r = runBeforeTool('write_file', {
+            file_path: '.totem/orchestration/totem-gemini/outbox/reply.md',
+            content: '---\nsubject: "Re: D:\\q"\n---\n',
+        });
+        expect(r.threw).toBe(true);
+    });
+});
+describe('GEMINI_BEFORE_TOOL ships as CJS for "type": "module" consumers (mmnto-ai/totem#2481)', () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'totem-2481-typemodule-'));
+        // A consumer repo whose package.json declares ESM — the environment that makes a
+        // bare `.js` hook resolve as ESM and fail-open.
+        fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({ type: 'module' }, null, 2) + '\n', 'utf-8');
+    });
+    afterEach(() => {
+        cleanTmpDir(tmpDir);
+    });
+    it('executes the distributed .cjs hook and the guard evaluates (no `require is not defined`)', () => {
+        const cjsPath = path.join(tmpDir, 'BeforeTool.cjs');
+        fs.writeFileSync(cjsPath, GEMINI_BEFORE_TOOL, 'utf-8');
+        // Require the shipped `.cjs` from a real node subprocess INSIDE the ESM consumer
+        // and drive the guard with a close-keyword write. A `.cjs` is CommonJS regardless
+        // of the enclosing package `type`, so `require` resolves and the guard BODY runs —
+        // proven by the guard throwing its own `[totem BeforeTool]` error rather than a
+        // `require is not defined` ReferenceError.
+        const driver = `require(${JSON.stringify(cjsPath)})('write_file', { file_path: 'docs/x.md', content: 'Closes #5' })`;
+        const res = spawnSync(process.execPath, ['-e', driver], { cwd: tmpDir, encoding: 'utf-8' });
+        expect(res.stderr).not.toMatch(/require is not defined/);
+        expect(res.stderr).toContain('[totem BeforeTool]');
+        expect(res.status).not.toBe(0); // the guard blocked the write
+    });
+    it('proves the defect the .cjs fixes: the identical body as `.js` fail-opens as ESM', () => {
+        // Contrast fixture documenting WHY the extension is load-bearing. The identical
+        // hook body under a `.js` extension resolves as ESM in this consumer and throws
+        // `require is not defined` at the top-level `require('child_process')`, before it
+        // can read the tool call — the silent fail-open reported on mmnto-ai/totem#2481.
+        const jsPath = path.join(tmpDir, 'BeforeTool.js');
+        fs.writeFileSync(jsPath, GEMINI_BEFORE_TOOL, 'utf-8');
+        const res = spawnSync(process.execPath, [jsPath], { cwd: tmpDir, encoding: 'utf-8' });
+        expect(res.status).not.toBe(0);
+        expect(res.stderr).toMatch(/require is not defined/);
+    });
 });
 describe('scaffoldClaudeSkill (mmnto-ai/totem#1890 Phase C slice 3)', () => {
     let tmpDir;