@onlooker-community/ecosystem 0.43.4 → 0.43.6

package/test/bats/inspector-post-write-hook.bats

@@ -155,3 +155,95 @@ EOF
 	# The last argv slot should now hold the resolved touched file path.
 	[[ "$(echo "$argv" | jq -r '.[-1]')" == *"src/sample.ts" ]]
 }
+
+# ── path canonicalization (ecosystem-foi) ────────────────────────────────────
+#
+# The hook decides "is this file inside the repo?" by prefix-matching the
+# canonicalized file path against the repo root. Those two paths used to be
+# canonicalized by INDEPENDENT mechanisms — realpath for the file, `git
+# rev-parse --show-toplevel` for the root — each with its own fallback. On
+# macOS /var is a symlink to /private/var, so whenever either mechanism fell
+# back, the two sides landed in different namespaces, the prefix match failed,
+# and the hook reported not_in_repo for a file plainly inside the repo: exit 0,
+# no agent output, one misleading .skipped event.
+#
+# That is the exact signature of the intermittent failure in ecosystem-foi,
+# where the hook exited 0 but emitted no file header. These tests force each
+# fallback deterministically instead of waiting for the flake.
+
+_stub_dir() {
+	local d="${BATS_TEST_TMPDIR}/stub-$1"
+	mkdir -p "$d"
+	printf '%s' "$d"
+}
+
+_failing_check_settings() {
+	cat <<'EOF' | _settings
+{"inspector":{"checks":{".ts":[
+	{"name":"broken","kind":"lint","argv":["sh","-c","echo 'src/sample.ts:1:1 - Bad'; exit 2"]}
+]}}}
+EOF
+}
+
+@test "the repo-root fallback still finds a file inside the repo when git fails" {
+	# git rev-parse failing sends inspector_project_repo_root to its $cwd
+	# fallback, which is the caller-supplied (unresolved) path.
+	_failing_check_settings
+	local stub
+	stub=$(_stub_dir git)
+	printf '#!/bin/sh\nexit 1\n' >"${stub}/git"
+	chmod +x "${stub}/git"
+
+	run bash -c "printf '%s' '$(_input)' | PATH='${stub}:$PATH' ONLOOKER_DIR='$ONLOOKER_DIR' CLAUDE_PLUGIN_ROOT='$PLUGIN_ROOT' bash '$HOOK'"
+	[ "$status" -eq 0 ] || return 1
+	[[ "$output" == *"inspector: src/sample.ts"* ]] || return 1
+	[ "$(_event_count inspector.check.failed)" = "1" ]
+}
+
+@test "the file is still found inside the repo when realpath is unavailable" {
+	# realpath failing leaves the file path unresolved while the repo root,
+	# coming from git, is resolved — the same mismatch from the other side.
+	_failing_check_settings
+	local stub
+	stub=$(_stub_dir realpath)
+	printf '#!/bin/sh\nexit 1\n' >"${stub}/realpath"
+	chmod +x "${stub}/realpath"
+
+	run bash -c "printf '%s' '$(_input)' | PATH='${stub}:$PATH' ONLOOKER_DIR='$ONLOOKER_DIR' CLAUDE_PLUGIN_ROOT='$PLUGIN_ROOT' bash '$HOOK'"
+	[ "$status" -eq 0 ] || return 1
+	[[ "$output" == *"inspector: src/sample.ts"* ]] || return 1
+	[ "$(_event_count inspector.check.failed)" = "1" ]
+}
+
+@test "a file genuinely outside the repo still reports not_in_repo" {
+	# The containment check must still say no when the answer really is no —
+	# canonicalizing both sides must not turn it into a rubber stamp.
+	_failing_check_settings
+	local outside="${BATS_TEST_TMPDIR}/outside.ts"
+	printf 'x\n' >"$outside"
+
+	run _run_hook "$(_input "$REPO" "Edit" "$outside")"
+	[ "$status" -eq 0 ] || return 1
+	[ -z "$output" ] || return 1
+	[ "$(jq -r 'select(.event_type=="inspector.check.skipped").payload.reason' "$ONLOOKER_EVENTS_LOG")" = "not_in_repo" ]
+}
+
+@test "canonicalization survives with neither realpath nor readlink -f" {
+	# The last resort is `cd` + `pwd -P`, a builtin. Without it, a box with no
+	# GNU coreutils would hit the same namespace mismatch through a third door,
+	# and no other test forces this branch.
+	_failing_check_settings
+	local stub
+	stub=$(_stub_dir noresolvers)
+	printf '#!/bin/sh\nexit 1\n' >"${stub}/realpath"
+	printf '#!/bin/sh\nexit 1\n' >"${stub}/readlink"
+	chmod +x "${stub}/realpath" "${stub}/readlink"
+
+	run bash -c "printf '%s' '$(_input)' | PATH='${stub}:$PATH' ONLOOKER_DIR='$ONLOOKER_DIR' CLAUDE_PLUGIN_ROOT='$PLUGIN_ROOT' bash '$HOOK'"
+	[ "$status" -eq 0 ] || return 1
+	[[ "$output" == *"inspector: src/sample.ts"* ]] || return 1
+	# file_path_relative must still be repo-relative, not an absolute path —
+	# that is what proves the prefix strip found the root, rather than the
+	# header printing off a coincidentally-passing comparison.
+	[ "$(jq -r 'select(.event_type=="inspector.check.failed").payload.file_path_relative' "$ONLOOKER_EVENTS_LOG")" = "src/sample.ts" ]
+}

package/test/bats/librarian-lesson-promote.bats

@@ -47,14 +47,20 @@ STUB
 _dir() { printf '%s' "$(librarian_lessons_dir "$PROJECT_KEY")"; }
 
 # A judged proposal. $1 = id, $2 = visibility, $3 = status,
-# $4 = verdict judges JSON array.
+# $4 = verdict judges JSON array, $5 = artifact_id (defaults to "art-<id>").
+#
+# $5 exists so a test can seed two DISTINCT proposals that share one
+# artifact_id. The default derives the artifact from the id, which makes that
+# collision unreachable — and the collision is the whole subject of the
+# declined-ledger guard tests below (ecosystem-bkj).
 _seed_judged() {
 	local id="$1" visibility="$2" status="$3" judges="$4"
+	local artifact_id="${5:-art-$1}"
 	local now
 	now=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 	jq -n --arg id "$id" --arg v "$visibility" --arg s "$status" \
-		--arg t "$now" --argjson j "$judges" \
-		'{ id: $id, artifact_id: "art-\($id)", status: $s, visibility: $v,
+		--arg t "$now" --argjson j "$judges" --arg aid "$artifact_id" \
+		'{ id: $id, artifact_id: $aid, status: $s, visibility: $v,
 		   confirmed_at: $t, judged_at: $t,
 		   candidate: { claim: "Prefer jq -c for compact output",
 		                rationale: "Readable diffs",
@@ -550,3 +556,83 @@ _promote_refuses_shape() {
 	[ "$status" -eq 0 ]
 	[ -f "$(_dir)/approved/skill01.json" ]
 }
+
+# ── declined-ledger guard: per-proposal, not per-artifact (ecosystem-bkj) ─────
+#
+# The guard that stops a double-write into declined.jsonl used to key on
+# artifact_id. That cannot tell "this artifact was already declined" apart from
+# "a DIFFERENT proposal for the same artifact was already declined", so the
+# second of two colliding proposals found a matching row, skipped its append,
+# and returned 0 — both proposals stamped, one verdict on disk. The inverse of
+# the double-write the guard exists to prevent, and still data loss in the
+# per-judge detail declined.jsonl carries for rubric tuning.
+#
+# The approved branch never had this: its guard is approved/<lesson_id>.json,
+# which is per-proposal by construction. These tests hold the declined branch
+# to the same standard.
+
+@test "two rejected proposals sharing an artifact_id both reach the ledger" {
+	_seed_judged "dupa" "public" "rejected" "$(_split)" "art-shared"
+	_seed_judged "dupb" "public" "rejected" "$(_split)" "art-shared"
+
+	run librarian_lesson_promote "$PROJECT_KEY" "dupa"
+	[ "$status" -eq 0 ] || return 1
+	run librarian_lesson_promote "$PROJECT_KEY" "dupb"
+	[ "$status" -eq 0 ] || return 1
+
+	# Two distinct proposals were judged and rejected, so two verdicts are
+	# owed. Under the artifact_id-keyed guard this was 1.
+	[ "$(grep -c 'art-shared' "$(_dir)/declined.jsonl")" -eq 2 ] || return 1
+
+	# And they are distinguishable — a row per proposal, not two identical
+	# rows, which is what makes the ledger usable for rubric tuning.
+	local ids
+	ids=$(jq -r '.lesson_id' "$(_dir)/declined.jsonl" | sort | tr '\n' ' ')
+	[ "$ids" = "dupa dupb " ]
+}
+
+@test "the declined guard still blocks a true double-write for one proposal" {
+	# The behavior the guard was added for, which the re-key must not lose:
+	# a stamp that fails AFTER the declined row lands, then a standalone
+	# re-run. Same chmod shape as the artifact_id-keyed test above.
+	_seed_judged "rekey01" "public" "rejected" "$(_split)"
+
+	chmod 0500 "$(_dir)/proposals"
+	run --separate-stderr librarian_lesson_promote "$PROJECT_KEY" "rekey01"
+	chmod 0700 "$(_dir)/proposals"
+	[ "$status" -ne 0 ] || return 1
+	[ "$(grep -c 'art-rekey01' "$(_dir)/declined.jsonl")" -eq 1 ] || return 1
+
+	run librarian_lesson_promote "$PROJECT_KEY" "rekey01"
+	[ "$status" -eq 0 ] || return 1
+	[ "$(grep -c 'art-rekey01' "$(_dir)/declined.jsonl")" -eq 1 ]
+}
+
+@test "a legacy declined row without lesson_id still dedups by artifact_id" {
+	# Rows written before this change carry no lesson_id. Keying purely on
+	# lesson_id would make them match nothing, so an unstamped proposal left
+	# over from a historical stamp failure would double-write on re-run —
+	# trading this bug for the one the guard was built to stop. The fallback
+	# keeps the old artifact_id behavior for exactly those rows.
+	_seed_judged "legacy01" "public" "rejected" "$(_split)"
+	printf '%s\n' '{"artifact_id":"art-legacy01","reason":"rejected","detail":null,"declined_at":"2020-01-01T00:00:00Z"}' \
+		>> "$(_dir)/declined.jsonl"
+
+	run librarian_lesson_promote "$PROJECT_KEY" "legacy01"
+	[ "$status" -eq 0 ] || return 1
+	[ "$(grep -c 'art-legacy01' "$(_dir)/declined.jsonl")" -eq 1 ]
+}
+
+@test "librarian_lesson_seen still matches on artifact_id, not lesson_id" {
+	# seen() answers "was this ARTIFACT already handled?", which is correctly
+	# artifact-scoped — it is what stops transform from re-proposing. Adding
+	# lesson_id to the row must not perturb it.
+	_seed_judged "seen01" "public" "rejected" "$(_split)" "art-seen-shared"
+	run librarian_lesson_promote "$PROJECT_KEY" "seen01"
+	[ "$status" -eq 0 ] || return 1
+
+	run librarian_lesson_seen "$PROJECT_KEY" "art-seen-shared"
+	[ "$status" -eq 0 ] || return 1
+	run librarian_lesson_seen "$PROJECT_KEY" "art-never-declined"
+	[ "$status" -ne 0 ]
+}

package/test/bats/validate-path.bats

@@ -108,6 +108,52 @@ setup() {
     >/dev/null
 }
 
+@test "safe_emit's line validates as a canonical envelope, not just a lookalike" {
+  # The assertion above spot-checks four fields. A hand-built envelope can pass
+  # that while still being rejected by the schema, which is exactly how the
+  # fallback below stayed broken. Validate the whole line instead.
+  export _HOOK_SESSION_ID="emit-session"
+  safe_emit "tool.file.read" '{"path":"/tmp/example.txt","read_mode":"full"}'
+  tail -n 1 "$ONLOOKER_EVENTS_LOG" \
+    | ONLOOKER_DIR="$ONLOOKER_DIR" node "${REPO_ROOT}/scripts/lib/onlooker-event.mjs" validate >/dev/null
+}
+
+@test "safe_emit writes nothing when the emit script is missing" {
+  # The degraded path. It used to hand-build an envelope with jq that omitted
+  # every required id/schema_version/runtime/machine_id/sequence field and added
+  # four the schema forbids (hook_type, tool_name, turn, tool_call_seq), on an
+  # envelope that is additionalProperties:false. An unparseable line on the bus
+  # is worse than a missing one, so this path now writes nothing at all.
+  # See ecosystem-0tm.
+  export _HOOK_SESSION_ID="emit-session"
+  export ONLOOKER_HOOK_TYPE="PreToolUse"
+  export ONLOOKER_TOOL_NAME="Read"
+  export ONLOOKER_TURN_NUMBER=4
+  export ONLOOKER_TURN_TOOL_SEQ=2
+  export ONLOOKER_EMIT="${BATS_TEST_TMPDIR}/no-such-emit.sh"
+
+  : >"$ONLOOKER_EVENTS_LOG"
+  run safe_emit "tool.file.read" '{"path":"/tmp/example.txt","read_mode":"full"}'
+  [ "$status" -ne 0 ] || return 1
+  [ ! -s "$ONLOOKER_EVENTS_LOG" ]
+}
+
+@test "safe_emit's failure to emit never aborts the calling hook" {
+  # safe_emit is substrate: returning non-zero must be absorbable by a caller
+  # running under `set -e`, the shape every hook uses. Assert the caller
+  # survives and reaches its next statement.
+  export ONLOOKER_EMIT="${BATS_TEST_TMPDIR}/no-such-emit.sh"
+  run bash -c "
+    set -euo pipefail
+    source '${REPO_ROOT}/scripts/lib/validate-path.sh'
+    export ONLOOKER_EMIT='${BATS_TEST_TMPDIR}/no-such-emit.sh'
+    safe_emit 'tool.file.read' '{\"path\":\"/x\",\"read_mode\":\"full\"}' || true
+    echo REACHED
+  "
+  [ "$status" -eq 0 ] || return 1
+  [[ "$output" == *"REACHED"* ]]
+}
+
 # ----------------------------------------------------------------------------
 # Hook health instrumentation: hook_register / hook_success / hook_failure
 # ----------------------------------------------------------------------------