@next-friday/create-app 9.1.1 → 9.2.1

package/templates/base/scripts/check-agent-gates.ts

@@ -1,89 +1,85 @@
-import {spawnSync} from "node:child_process";
+import {execFileSync, spawnSync} from "node:child_process";
+import {mkdtempSync, rmSync, writeFileSync} from "node:fs";
+import path from "node:path";
+import {tmpdir} from "node:os";
 
 type GateCase = {
   expectedExit: 0 | 2;
-  expectedPermission?: "allow" | "ask";
+  expectedPermission?: "allow";
   gate: string;
   input: Record<string, unknown>;
   name: string;
+  projectDirectory?: string;
   releaseApproval?: string;
 };
 
+const repositoryVariables = execFileSync("git", ["rev-parse", "--local-env-vars"], {
+  encoding: "utf8",
+}).split("\n");
+
+const childEnvironment = {
+  ...process.env,
+};
+
+for (const name of repositoryVariables) {
+  delete childEnvironment[name];
+}
+
 const shellGate = ".agents/hooks/agent-shell-gate.sh";
-const suppressionGate = ".agents/hooks/agent-suppression-gate.sh";
 const constitutionGate = ".cursor/hooks/agent-constitution-gate.sh";
 const mcpGate = ".agents/hooks/agent-mcp-gate.sh";
 const productionGate = ".agents/hooks/agent-production-gate.sh";
+const testEditGate = ".agents/hooks/agent-test-edit-gate.sh";
 const sourceFile = "src/example.ts";
 
 const blockedCommands = [
-  "git commit -n -m x",
-  "git commit -nm x",
-  "git commit -a -n -m x",
-  "git commit -an",
-  "git commit -m x -n",
-  "git commit --amend -n",
-  "git -C . commit -n",
-  "git commit --no-verify -m x",
-  "git push --no-verify",
-  "HUSKY=0 git commit -m x",
-  "export HUSKY=0; git commit -m x",
-  "git config core.hooksPath /dev/null",
-  "gh repo delete next-friday/example",
-  "gh issue delete 1",
-  "gh release delete v1",
-  "git commit --no-verif -m x",
-  "git commit --no-v -m x",
-  'git commit "--no-verify" -m x',
-  "git commit '-n' -m x",
-  'env "HUSKY=0" git commit -m x',
-  "git config core.hookspath /dev/null",
-  "git -c core.HooksPath=/dev/null commit -m x",
-  "git -c alias.c='commit --no-verify' c",
-  "git config alias.c commit",
-  "git commit-tree HEAD^{tree} -m x",
-  "git update-ref refs/heads/main HEAD",
   "printf 'exit 0' > .husky/pre-commit",
   "rm -rf .husky/_",
   "sed -i '' s/gitleaks/true/ .husky/pre-commit",
   "tee .gitleaks.toml < /dev/null",
   "cp /dev/null .agents/hooks/agent-shell-gate.sh",
-  "git -c core.hooks\\Path=/dev/null commit -m x",
-  "git commit --no-ver\\ify -m x",
-  "HU\\SKY=0 git commit -m x",
-  "git commit -m x --no-$(echo verify)",
-  "/usr/bin/git commit -n -m x",
-  "git --git-dir .git commit -n -m x",
-  "git commit -n; git status",
-  "git commit -m x -n&&git push",
   "rm -rf .husky",
   "mv .husky /tmp/h",
   "sed -e s/a/b/ -i .husky/pre-commit",
   "python3 -c \"open('.husky/pre-commit','w')\"",
   "dd of=.husky/pre-commit",
-  "git config core.hooks$X x",
   "cd .husky && python3 -c \"open('pre-commit','w')\"",
-  "GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/x git commit -m x",
-  'bash -c "git commit -n -m x"',
-  "eval git commit -n -m x",
   "git checkout -- .husky/pre-commit",
   "echo x >> .claude/settings.local.json",
-  "git merge --no-verify feature",
-  "$(git commit --no-verify -m x)",
-  "echo `git commit -n -m x`",
   'echo "$(rm -rf .husky)"',
-  "x=$(echo $(git commit -n -m x))",
-  "echo \"$(echo ')'; git commit --no-verify -m x)\"",
-  "$(echo \\); git commit -n -m x)",
-  "$(echo x # )\ngit commit -n -m x)",
-  'echo "$(true&# )\ngit commit -n -m x)"',
-  'echo "$(true|# )\ngit commit -n -m x)"',
-  'echo "$( (true)# )\ngit commit -n -m x)"',
-  "{ git commit --no-verify -m x; }",
-  "if true; then git commit -n -m x; fi",
-  "while true; do git commit -n -m x; done",
-  "if git commit -n -m x; then true; fi",
   "printf x > .git/config.worktree",
+  "git restore .husky/pre-commit",
+  "git rm .husky/pre-commit",
+  "git mv .husky/pre-commit /tmp/h",
+  "git apply .husky/change.patch",
+  "pushd .husky && echo x > pre-commit",
+  "ln -s /dev/null .husky/pre-commit",
+  "chmod 000 .husky/pre-commit",
+  "install -m 644 x .husky/pre-commit",
+  "truncate -s 0 .husky/pre-commit",
+  "rsync x .husky/pre-commit",
+  "patch .husky/pre-commit change.patch",
+  "sponge .husky/pre-commit",
+  "perl -pi -e s/a/b/ .husky/pre-commit",
+  "node -e \"require('fs').writeFileSync('.husky/pre-commit','')\"",
+  'ruby -e \'File.write(".husky/pre-commit", "")\'',
+  "bun -e \"Bun.write('.husky/pre-commit','')\"",
+  "/usr/bin/gh pr merge 1",
+  "gh pr merge 1; git status",
+  "git status&&gh pr merge 1",
+  'bash -c "gh pr merge 1"',
+  "eval gh pr merge 1",
+  "$(gh pr merge 1)",
+  "echo `gh pr merge 1`",
+  "x=$(echo $(gh pr merge 1))",
+  "echo \"$(echo ')'; gh pr merge 1)\"",
+  "$(echo \\); gh pr merge 1)",
+  "$(echo x # )\ngh pr merge 1)",
+  'echo "$(true&# )\ngh pr merge 1)"',
+  "{ gh pr merge 1; }",
+  "if true; then gh pr merge 1; fi",
+  "while true; do gh pr merge 1; done",
+  "if gh pr merge 1; then true; fi",
   "gh pr merge 1 --squash",
   "gh pr merge 1 --auto",
   "gh -R next-friday/example pr merge 1",
@@ -95,18 +91,11 @@ const blockedCommands = [
   "gh pr review 1 --approve=true",
   "gh pr review 1 -a",
   "gh -R next-friday/example pr review 1 -a",
-  "gh alias set m 'pr merge'",
   "gh api repos/next-friday/example/pulls/1/merge -X PUT",
   "gh api graphql -f query='mutation { mergePullRequest(input: {}) { clientMutationId } }'",
-  "gh api graphql -f query=@query.graphql",
   "gh api repos/next-friday/example/pulls/1/reviews -f event=APPROVE",
   "gh api -X POST repos/next-friday/example/actions/runs/1/pending_deployments -f state=approved",
   "gh pr review 1 -ca",
-  "gh alias import aliases.yml",
-  "gh api graphql -Fquery=@query.graphql",
-  "gh api graphql --input query.json",
-  "gh api -X POST repos/next-friday/example/pulls/1/reviews --input review.json",
-  "gh api repos/next-friday/example/actions/runs/1/pending_deployments -F state=@state.txt",
   "gh api graphql -f query='mutation { enablePullRequestAutoMerge(input: {}) { clientMutationId } }'",
   "gh api graphql -f query='mutation { enqueuePullRequest(input: {}) { clientMutationId } }'",
   "gh api graphql -f query='mutation($e: PullRequestReviewEvent!) { addPullRequestReview(input: {event: $e}) { clientMutationId } }' -f e=APPROVE",
@@ -118,79 +107,34 @@ const blockedCommands = [
   "bash -c -- 'gh pr merge 1'",
 ];
 
-const irreversibleCommands = [
-  "git push --force",
-  "git push -f origin x",
-  "git push origin x -f",
-  "git push -uf origin x",
-  "git push origin +x",
-  "git push origin :x",
-  "git push -d origin x",
-  "git push --delete origin x",
-  "git push --mirror",
-  "git reset --hard HEAD~1",
-  "git -C . reset --hard",
-  "git clean -fd",
-  "git clean -xdf",
-  "git branch -D x",
-  "git branch -df x",
-  "git branch --delete --force x",
-  "git checkout .",
-  "git checkout -- .",
-  "git checkout -f main",
-  "git restore .",
-  "git restore --worktree .",
-  "git switch --discard-changes main",
-  "git stash drop",
-  "git worktree remove --force x",
-  "git restore :/",
-  "timeout 5 git push --force",
-  "xargs git reset --hard",
-];
-
 const allowedCommands = [
   'git commit -m "add login"',
-  "git commit --signoff -m x",
-  "git commit --amend --no-edit",
   "git status",
   "pnpm check",
-  "git commit --verbose -m x",
   "cat .husky/pre-commit",
   "git diff .husky/pre-commit",
-  'git commit -m "feat(x): y" && git log -n 3',
-  "git commit -m x; ls -n",
-  "git commit -m \"$(printf 'feat(x): y')\"",
-  "echo '$(git commit -n -m x)'",
-  'git commit -m "run with -n"',
-  'git commit -am "fix: -n flag handling"',
   "git diff .husky/pre-commit > /tmp/x",
   "ls .husky/ ; cp a b",
   'git commit -m "chore: rm .husky/pre-commit file"',
-  'gh pr create --title "docs(x): explain core.hooksPath"',
-  'gh pr create --title "ci(x): remove HUSKY=0 usage"',
-  "git push -n",
+  "echo '$(gh pr merge 1)'",
+  'gh pr create --title "docs(x): explain gh pr merge"',
   "node scripts/check-agent-gates.ts",
   "git push -u origin x",
-  "git push --dry-run --force",
-  "git push --force-with-lease origin x",
   'gh pr create --title "fix(x): y" --body z',
   "gh pr comment 1 --body x",
   'gh pr review 1 -c -b "fix -a flag"',
   'gh api repos/next-friday/example/issues/1/comments -f body="Please APPROVE"',
   "gh api repos/next-friday/example/pulls/1",
   "gh pr checks 1 --watch",
-  "git branch -d x",
   "git checkout feature",
   "git checkout .changeset/x.md",
-  "git restore --staged .",
-  "git clean -n",
-  "git reset --soft HEAD~1",
-  "git stash pop",
   "timeout 60 pnpm test",
   'gh api graphql -f query="query { viewer { login } }"',
   'gh api repos/next-friday/example/issues/1/comments -f body="APPROVED by QA"',
 ];
 
+const railwayProductionCommand = "railway up -e prod";
+
 const productionCommands = [
   "gh workflow run deploy.yml -f environment=prod -f commit_sha=abc",
   "gh workflow run Deploy --field 'environment=prod'",
@@ -211,7 +155,7 @@ const productionCommands = [
   "gh api repos/o/r/actions/workflows/1/dispatches -f inputs[environment]=$E",
   "bash -c 'gh workflow run deploy.yml -f environment=prod'",
   "railway up --ci --environment prod",
-  "railway up -e prod",
+  railwayProductionCommand,
   "railway up -e=prod",
   "railway up -eprod",
   "railway up -ce prod",
@@ -261,6 +205,9 @@ const productionCommands = [
   "cd a\\\\\ngit push origin v1.0.0",
 ];
 
+const approvalLiftsGate = ["CHG-123", "1", "CHG-1", "off", "00", " "];
+const approvalKeepsGate = ["", "0", "false", "no", "FALSE", "No", "nO"];
+
 const nonProductionCommands = [
   "gh workflow run deploy.yml -f environment=uat -f commit_sha=abc",
   "gh api repos/o/r/actions/workflows/deploy.yml/dispatches -f 'inputs[environment]=uat'",
@@ -291,11 +238,78 @@ const mcpTools = {
     "mcp__github__merge_pull_request",
     "github__merge_pull_request",
     "github__enable_pr_auto_merge",
-    "github__pull_request_review_write",
   ],
   allowed: ["github__create_pull_request", "github__add_issue_comment"],
 };
 
+const reviewWriteCases = [
+  {
+    name: "APPROVE",
+    expectedExit: 2,
+    toolInput: {
+      method: "create",
+      event: "APPROVE",
+    },
+  },
+  {
+    name: "approve in lower case",
+    expectedExit: 2,
+    toolInput: {
+      method: "create",
+      event: "approve",
+    },
+  },
+  {
+    name: "Approve in mixed case",
+    expectedExit: 2,
+    toolInput: {
+      method: "create",
+      event: "Approve",
+    },
+  },
+  {
+    name: "submit_pending with APPROVE",
+    expectedExit: 2,
+    toolInput: {
+      method: "submit_pending",
+      event: "APPROVE",
+    },
+  },
+  {
+    name: "APPROVE in a JSON string, as Cursor sends it",
+    toolInput: '{"method":"create","event":"APPROVE"}',
+    expectedExit: 2,
+  },
+  {
+    name: "COMMENT",
+    expectedExit: 0,
+    toolInput: {
+      method: "create",
+      event: "COMMENT",
+    },
+  },
+  {
+    name: "REQUEST_CHANGES",
+    expectedExit: 0,
+    toolInput: {
+      method: "submit_pending",
+      event: "REQUEST_CHANGES",
+    },
+  },
+  {
+    name: "no event",
+    expectedExit: 0,
+    toolInput: {
+      method: "create",
+    },
+  },
+  {
+    name: "an empty JSON string",
+    toolInput: "{}",
+    expectedExit: 0,
+  },
+];
+
 const protectedPaths = [
   ".agents/rules/code-comments.md",
   ".agents/rules.json",
@@ -317,6 +331,62 @@ const protectedPaths = [
   "src/../.husky/pre-commit",
 ];
 
+/**
+ * Create a repository on a branch, with one commit per file after an empty commit on `main`.
+ * @param branch - The branch to check out.
+ * @param committedFiles - Files to commit on the branch, one commit each.
+ * @returns The repository directory.
+ */
+function createRepository(branch: string, committedFiles: string[]): string {
+  const directory = mkdtempSync(path.join(tmpdir(), "agent-gates-"));
+
+  const runGit = (...gitArguments: string[]): void => {
+    execFileSync(
+      "git",
+      [
+        "-C",
+        directory,
+        "-c",
+        "user.name=Gate Check",
+        "-c",
+        "user.email=gate-check@example.com",
+        "-c",
+        "commit.gpgsign=false",
+        ...gitArguments,
+      ],
+      {
+        env: childEnvironment,
+        stdio: "ignore",
+      },
+    );
+  };
+
+  runGit("init", "--initial-branch=main");
+  runGit("commit", "--allow-empty", "--message", "initial");
+  runGit("checkout", "-b", branch);
+
+  for (const file of committedFiles) {
+    writeFileSync(path.join(directory, path.basename(file)), "");
+    runGit("add", "--all");
+    runGit("commit", "--message", `add ${file}`);
+  }
+
+  return directory;
+}
+
+const fixBranch = "fix/login-error";
+const featureBranch = "feat/login";
+const testFileName = "login.test.ts";
+const fixBranchWithTest = createRepository(fixBranch, [testFileName]);
+const fixBranchWithoutTest = createRepository(fixBranch, ["login.ts"]);
+const featureBranchWithTest = createRepository(featureBranch, [testFileName]);
+const markerRepository = createRepository(featureBranch, []);
+
+writeFileSync(path.join(markerRepository, ".git", "bug-fix-in-progress"), "");
+
+const testFile = `src/${testFileName}`;
+const outsideRepository = mkdtempSync(path.join(tmpdir(), "agent-gates-outside-"));
+
 const cases: GateCase[] = [
   ...blockedCommands.flatMap(command => [
     {
@@ -338,29 +408,6 @@ const cases: GateCase[] = [
       name: `Claude Bash: ${command}`,
     },
   ]),
-  ...irreversibleCommands.flatMap(command => [
-    {
-      gate: shellGate,
-      input: {
-        command,
-      },
-      expectedExit: 0 as const,
-      expectedPermission: "ask" as const,
-      name: `Cursor shell asks first: ${command}`,
-    },
-    {
-      gate: shellGate,
-      input: {
-        hook_event_name: "PreToolUse",
-        tool_input: {
-          command,
-        },
-      },
-      expectedExit: 0 as const,
-      expectedPermission: "ask" as const,
-      name: `Claude Bash asks first: ${command}`,
-    },
-  ]),
   ...allowedCommands.map(command => ({
     gate: shellGate,
     input: {
@@ -390,18 +437,29 @@ const cases: GateCase[] = [
       name: `Claude production: ${command}`,
     },
   ]),
-  {
+  ...approvalLiftsGate.map(releaseApproval => ({
     gate: productionGate,
-    releaseApproval: "CHG-1",
-    expectedPermission: "allow",
-    name: "production with RELEASE_APPROVAL: railway up -e prod",
-    expectedExit: 0,
+    releaseApproval,
     input: {
       tool_input: {
-        command: "railway up -e prod",
+        command: railwayProductionCommand,
       },
     },
-  },
+    expectedPermission: "allow" as const,
+    name: `production with RELEASE_APPROVAL="${releaseApproval}": ${railwayProductionCommand}`,
+    expectedExit: 0 as const,
+  })),
+  ...approvalKeepsGate.map(releaseApproval => ({
+    gate: productionGate,
+    releaseApproval,
+    input: {
+      tool_input: {
+        command: railwayProductionCommand,
+      },
+    },
+    name: `production with RELEASE_APPROVAL="${releaseApproval}": ${railwayProductionCommand}`,
+    expectedExit: 2 as const,
+  })),
   ...nonProductionCommands.map(command => ({
     gate: productionGate,
     input: {
@@ -430,63 +488,6 @@ const cases: GateCase[] = [
     expectedPermission: "allow" as const,
     name: `MCP: ${tool}`,
   })),
-  {
-    gate: suppressionGate,
-    name: "suppression: eslint-disable",
-    expectedExit: 2,
-    input: {
-      tool_input: {
-        file_path: sourceFile,
-        content: "// eslint-disable-next-line\n",
-      },
-    },
-  },
-  ...["// NOSONAR", "# noqa: E501", "# hadolint ignore=DL3008", "# trivy:ignore:AVD-DS-0002"].map(
-    content => ({
-      gate: suppressionGate,
-      input: {
-        tool_input: {
-          file_path: sourceFile,
-          content,
-        },
-      },
-      expectedExit: 2 as const,
-      name: `suppression: ${content}`,
-    }),
-  ),
-  {
-    gate: suppressionGate,
-    name: "suppression: noqa inside a word",
-    expectedExit: 0,
-    input: {
-      tool_input: {
-        file_path: sourceFile,
-        content: "const canoqaValue = 1;\n",
-      },
-    },
-  },
-  {
-    gate: suppressionGate,
-    name: "suppression: exempt directory reached through ..",
-    expectedExit: 2,
-    input: {
-      tool_input: {
-        file_path: ".agents/rules/../../src/example.ts",
-        content: "// eslint-disable-next-line\n",
-      },
-    },
-  },
-  {
-    gate: suppressionGate,
-    name: "suppression: clean edit",
-    expectedExit: 0,
-    input: {
-      tool_input: {
-        file_path: sourceFile,
-        content: "export const value = 1;\n",
-      },
-    },
-  },
   ...protectedPaths.map(file => ({
     gate: constitutionGate,
     input: {
@@ -497,6 +498,15 @@ const cases: GateCase[] = [
     expectedExit: 2 as const,
     name: `constitution: ${file}`,
   })),
+  ...reviewWriteCases.map(({expectedExit, name, toolInput}) => ({
+    gate: mcpGate,
+    input: {
+      tool_input: toolInput,
+      tool_name: "mcp__github__pull_request_review_write",
+    },
+    expectedExit: expectedExit as 0 | 2,
+    name: `MCP: pull_request_review_write with ${name}`,
+  })),
   {
     gate: constitutionGate,
     name: "constitution: src file",
@@ -507,36 +517,51 @@ const cases: GateCase[] = [
       },
     },
   },
+  ...[
+    {
+      projectDirectory: fixBranchWithTest,
+      name: "fix branch with a committed test",
+      expectedExit: 2,
+    },
+    {
+      projectDirectory: fixBranchWithoutTest,
+      name: "fix branch without a committed test",
+      expectedExit: 0,
+    },
+    {
+      projectDirectory: featureBranchWithTest,
+      name: "other branch with a committed test",
+      expectedExit: 0,
+    },
+    {
+      projectDirectory: markerRepository,
+      name: "bug-fix-in-progress marker",
+      expectedExit: 2,
+    },
+    {
+      projectDirectory: outsideRepository,
+      name: "directory outside a Git repository",
+      expectedExit: 0,
+    },
+  ].map(({expectedExit, name, projectDirectory}) => ({
+    gate: testEditGate,
+    projectDirectory,
+    input: {
+      tool_input: {
+        file_path: testFile,
+      },
+    },
+    expectedExit: expectedExit as 0 | 2,
+    name: `test edit: ${name}`,
+  })),
 ];
 
-/**
- * Reads the permission a gate printed in the format its tool reads: Claude Code's
- * `hookSpecificOutput` for a `PreToolUse` input, and Cursor's `permission` otherwise.
- * @param gateCase - The case whose input decides the format.
- * @param stdout - The gate's standard output.
- * @returns The permission, or undefined when the output is not JSON.
- */
-function permissionOf(gateCase: GateCase, stdout: string): string | undefined {
-  try {
-    const output = JSON.parse(stdout) as {
-      hookSpecificOutput?: {permissionDecision?: string};
-      permission?: string;
-    };
-
-    return gateCase.input.hook_event_name === "PreToolUse" && gateCase.expectedPermission === "ask"
-      ? output.hookSpecificOutput?.permissionDecision
-      : output.permission;
-  } catch {
-    return undefined;
-  }
-}
-
 const failures = cases.filter(gateCase => {
   const result = spawnSync(gateCase.gate, {
     env: {
-      ...process.env,
-      CLAUDE_PROJECT_DIR: process.cwd(),
-      CURSOR_PROJECT_DIR: process.cwd(),
+      ...childEnvironment,
+      CLAUDE_PROJECT_DIR: gateCase.projectDirectory ?? process.cwd(),
+      CURSOR_PROJECT_DIR: gateCase.projectDirectory ?? process.cwd(),
       RELEASE_APPROVAL: gateCase.releaseApproval,
     },
     input: JSON.stringify(gateCase.input),
@@ -544,11 +569,25 @@ const failures = cases.filter(gateCase => {
 
   const isPermissionWrong =
     gateCase.expectedPermission !== undefined &&
-    permissionOf(gateCase, result.stdout.toString()) !== gateCase.expectedPermission;
+    (JSON.parse(result.stdout.toString()) as {permission?: string}).permission !==
+      gateCase.expectedPermission;
 
   return result.status !== gateCase.expectedExit || isPermissionWrong;
 });
 
+for (const directory of [
+  fixBranchWithTest,
+  fixBranchWithoutTest,
+  featureBranchWithTest,
+  markerRepository,
+  outsideRepository,
+]) {
+  rmSync(directory, {
+    recursive: true,
+    force: true,
+  });
+}
+
 if (failures.length > 0) {
   const failureLines = failures.map(gateCase => {
     const permission =