@qijenchen/design-system 0.1.0-beta.13 → 0.1.0-beta.130

package/ds-canonical/hooks/tests/test_check_main_branch_workbench.sh

@@ -1,147 +1,82 @@
 #!/bin/bash
-# Tests for check_main_branch_workbench.sh(M28 main-as-workbench BLOCKER)
-#
-# Hook 規則:PreToolUse Edit/Write/MultiEdit + 目標 file 為 production code
-# (`packages/design-system/src/**/*.{tsx,ts,css}` OR `src/app/**` OR `src/explorations/**`)
-# + current git branch == main/master + transcript 近 5 user msg 無 branch trigger keyword
-# → exit 2 BLOCKER。
-# Allow:`CLAUDE_BYPASS_MAIN_WORKBENCH=1` / branch != main / out-of-scope path /
-#        trigger keyword(開 branch / 開 分支 / 新 branch / working branch / 在 branch 上做 / on branch)。
-#
-# 測試手法:`CLAUDE_PROJECT_DIR` 指向 fixture git repo(可控 current branch)。
+# Tests for the protected-main editing feedback gate(M28).
 
 set -u
-
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 HOOK="$SCRIPT_DIR/../check_main_branch_workbench.sh"
-
-if [ ! -x "$HOOK" ]; then
-  echo "FATAL: hook not executable: $HOOK"
-  exit 1
-fi
+[ -x "$HOOK" ] || { echo "FATAL: hook not executable: $HOOK"; exit 1; }
 
 TMP_ROOT=$(mktemp -d)
 trap 'rm -rf "$TMP_ROOT"' EXIT
-
-# Build fake git repos:one on main, one on feature branch
 REPO_MAIN="$TMP_ROOT/repo-main"
-REPO_FEAT="$TMP_ROOT/repo-feat"
+REPO_FEAT="$TMP_ROOT/repo-feature"
 
 setup_repo() {
-  local dir="$1"; local branch="$2"
+  local dir="$1" branch="$2"
   mkdir -p "$dir"
-  (
-    cd "$dir"
-    git init -q -b main 2>/dev/null || { git init -q && git checkout -q -b main; }
-    git config user.email test@example.com
-    git config user.name test
-    echo seed > seed.txt
-    git add seed.txt
-    git commit -q -m "seed"
-    if [ "$branch" != "main" ]; then
-      git checkout -q -b "$branch"
-    fi
-  )
+  git -C "$dir" init -q -b main 2>/dev/null || { git -C "$dir" init -q; git -C "$dir" checkout -q -b main; }
+  git -C "$dir" config user.email test@example.invalid
+  git -C "$dir" config user.name test
+  printf 'seed\n' > "$dir/seed.txt"
+  git -C "$dir" add seed.txt
+  git -C "$dir" commit -qm seed
+  [ "$branch" = main ] || git -C "$dir" checkout -q -b "$branch"
 }
-
-setup_repo "$REPO_MAIN" "main"
-setup_repo "$REPO_FEAT" "feature-x"
+setup_repo "$REPO_MAIN" main
+setup_repo "$REPO_FEAT" codex/feature
 
 PASS=0
 FAIL=0
-FAILED_TESTS=""
 
 run_hook() {
-  local file_path="$1"; local project_dir="$2"; local transcript="${3:-}"
-  local payload
-  payload=$(jq -n --arg fp "$file_path" \
-    '{tool_name: "Edit", tool_input: {file_path: $fp, new_string: "x"}}')
-  STDOUT=$(mktemp); STDERR=$(mktemp)
+  local file_path="$1" project_dir="$2" tool="${3:-Edit}"
+  local payload stdout_file stderr_file
+  payload=$(jq -n --arg fp "$file_path" --arg tool "$tool" '{tool_name:$tool,tool_input:{file_path:$fp}}')
+  stdout_file=$(mktemp); stderr_file=$(mktemp)
   set +e
-  CLAUDE_PROJECT_DIR="$project_dir" CLAUDE_TRANSCRIPT_PATH="$transcript" \
-    printf '%s' "$payload" | CLAUDE_PROJECT_DIR="$project_dir" CLAUDE_TRANSCRIPT_PATH="$transcript" \
-    bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  printf '%s' "$payload" | GOVERNANCE_PROJECT_DIR="$project_dir" bash "$HOOK" >"$stdout_file" 2>"$stderr_file"
   EXIT=$?
   set -e
-  STDERR_TEXT=$(cat "$STDERR")
-  rm -f "$STDOUT" "$STDERR"
+  STDERR_TEXT=$(cat "$stderr_file")
+  rm -f "$stdout_file" "$stderr_file"
 }
 
-expect_pass_silent() {
+expect_pass() {
   local name="$1"
-  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ]; then
-    echo "  PASS  $name"; PASS=$((PASS+1))
-  else
-    echo "  FAIL  $name (expected silent, exit=$EXIT)"
-    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
-    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
-  fi
+  if [ "$EXIT" = 0 ] && [ -z "$STDERR_TEXT" ]; then echo "  PASS  $name"; PASS=$((PASS+1));
+  else echo "  FAIL  $name(exit=$EXIT)"; FAIL=$((FAIL+1)); fi
 }
-
-expect_blocker() {
-  local name="$1"; local needle="$2"
-  if [ "$EXIT" = "2" ] && echo "$STDERR_TEXT" | grep -qF "$needle"; then
-    echo "  PASS  $name"; PASS=$((PASS+1))
-  else
-    echo "  FAIL  $name (expected exit 2 + '$needle', got exit $EXIT)"
-    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
-    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
-  fi
+expect_block() {
+  local name="$1"
+  if [ "$EXIT" = 2 ] && echo "$STDERR_TEXT" | grep -qF 'PROTECTED-MAIN WORKBENCH BLOCKER'; then echo "  PASS  $name"; PASS=$((PASS+1));
+  else echo "  FAIL  $name(exit=$EXIT)"; echo "$STDERR_TEXT"; FAIL=$((FAIL+1)); fi
 }
 
-echo "=== check_main_branch_workbench tests ==="
+echo "=== check_main_branch_workbench protected-main tests ==="
+run_hook "$REPO_MAIN/README.md" "$REPO_MAIN" Read
+expect_pass "1. read tool skips"
 
-# 1. Non Edit/Write tool → skip (use payload with different tool)
-payload=$(jq -n '{tool_name: "Read", tool_input: {file_path: "/repo/packages/design-system/src/foo.tsx"}}')
-STDOUT=$(mktemp); STDERR=$(mktemp)
-set +e
-CLAUDE_PROJECT_DIR="$REPO_MAIN" printf '%s' "$payload" | CLAUDE_PROJECT_DIR="$REPO_MAIN" bash "$HOOK" >"$STDOUT" 2>"$STDERR"
-EXIT=$?
-set -e
-STDERR_TEXT=$(cat "$STDERR")
-rm -f "$STDOUT" "$STDERR"
-expect_pass_silent "1. non Edit/Write tool → skip"
+run_hook "$REPO_FEAT/README.md" "$REPO_FEAT"
+expect_pass "2. edits on the task branch pass"
 
-# 2. Out-of-scope path (random file) → skip
-run_hook "/repo/.claude/foo.md" "$REPO_MAIN"
-expect_pass_silent "2. out-of-scope path (.claude/) → skip"
+run_hook "$REPO_MAIN/packages/design-system/src/Foo.tsx" "$REPO_MAIN"
+expect_block "3. production edit on main blocks"
 
-# 3. Production code path + branch=feature-x → skip
-run_hook "/repo/packages/design-system/src/components/Foo/foo.tsx" "$REPO_FEAT"
-expect_pass_silent "3. on feature branch → skip"
+run_hook "$REPO_MAIN/.claude/rules/meta-patterns.md" "$REPO_MAIN"
+expect_block "4. governance/doc edit on main also blocks"
 
-# 4. Production code path + branch=main + no trigger transcript → BLOCKER
-run_hook "/repo/packages/design-system/src/components/Foo/foo.tsx" "$REPO_MAIN"
-expect_blocker "4. main + production code + no trigger → BLOCKER" "MAIN-AS-WORKBENCH BLOCKER"
+run_hook "$TMP_ROOT/outside.txt" "$REPO_MAIN"
+expect_pass "5. file outside checkout skips"
 
-# 5. CLAUDE_BYPASS_MAIN_WORKBENCH=1 escape → skip
-payload=$(jq -n '{tool_name: "Edit", tool_input: {file_path: "/repo/packages/design-system/src/components/Foo/foo.tsx", new_string: "x"}}')
-STDOUT=$(mktemp); STDERR=$(mktemp)
+payload=$(jq -n --arg fp "$REPO_MAIN/README.md" '{tool_name:"Edit",tool_input:{file_path:$fp}}')
+stdout_file=$(mktemp); stderr_file=$(mktemp)
 set +e
-printf '%s' "$payload" | CLAUDE_PROJECT_DIR="$REPO_MAIN" CLAUDE_BYPASS_MAIN_WORKBENCH=1 bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+printf '%s' "$payload" | GOVERNANCE_PROJECT_DIR="$REPO_MAIN" GOVERNANCE_BYPASS_MAIN_WORKBENCH=1 bash "$HOOK" >"$stdout_file" 2>"$stderr_file"
 EXIT=$?
 set -e
-STDERR_TEXT=$(cat "$STDERR")
-rm -f "$STDOUT" "$STDERR"
-expect_pass_silent "5. CLAUDE_BYPASS_MAIN_WORKBENCH=1 → skip"
-
-# 6. Transcript with branch trigger keyword → skip
-TRANSCRIPT="$TMP_ROOT/transcript.jsonl"
-cat >"$TRANSCRIPT" <<'EOF'
-{"role":"user","content":"我們開 working branch 來做這個 batch"}
-{"role":"assistant","content":"OK"}
-EOF
-run_hook "/repo/packages/design-system/src/components/Foo/foo.tsx" "$REPO_MAIN" "$TRANSCRIPT"
-expect_pass_silent "6. transcript has 'working branch' trigger → skip"
-
-# 7. src/app/** also intercepted on main → BLOCKER
-run_hook "/repo/src/app/page.tsx" "$REPO_MAIN"
-expect_blocker "7. src/app/ on main → BLOCKER" "MAIN-AS-WORKBENCH BLOCKER"
+STDERR_TEXT=$(cat "$stderr_file")
+rm -f "$stdout_file" "$stderr_file"
+expect_pass "6. local recovery override passes"
 
-echo ""
-echo "=== Summary ==="
 echo "Passed: $PASS / $((PASS + FAIL))"
-if [ "$FAIL" -gt 0 ]; then
-  echo "Failed:$FAILED_TESTS"
-  exit 1
-fi
+[ "$FAIL" -eq 0 ]

package/ds-canonical/hooks/tests/test_check_naming_and_abstraction.sh

@@ -18,9 +18,26 @@ run_hook() {
     | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
   EXIT=$?
   set -e
+  STDOUT_TEXT=$(cat "$STDOUT")
   STDERR_TEXT=$(cat "$STDERR"); rm -f "$STDOUT" "$STDERR"
 }
 
+expect_context() {
+  local name="$1" needle="$2"
+  local context
+  context=$(printf '%s' "$STDOUT_TEXT" | jq -er \
+    'select(keys == ["governanceContext"]) | .governanceContext
+     | select(.hookEventName == "PreToolUse") | .message' 2>/dev/null || true)
+  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ] && printf '%s' "$context" | grep -qF "$needle"; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected exact governance context containing '$needle', got exit $EXIT)"
+    echo "  --- stdout ---"; echo "$STDOUT_TEXT" | sed 's/^/    /'
+    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+
 expect_exit() {
   local name="$1" expect="$2" needle="${3:-}"
   if [ "$EXIT" = "$expect" ] && { [ -z "$needle" ] || echo "$STDERR_TEXT" | grep -qF "$needle"; }; then
@@ -100,11 +117,11 @@ expect_exit "D.2.3 no DS title → silent" 0 ""
 echo ""
 echo "=== D.3 primitive color var in tsx ==="
 
-# 8. tsx with var(--color-neutral-5) → WARN stderr
+# 8. tsx with var(--color-neutral-5) → neutral governance context
 run_hook "/r/packages/design-system/src/components/Foo/foo.tsx" '
 const cls = "border-[var(--color-neutral-5)]"
 ' Write
-expect_exit "D.3.1 primitive var color → WARN stderr" 0 "primitive color var"
+expect_context "D.3.1 primitive var color → governance context" "primitive color var"
 
 # 9. tsx with semantic alias → silent
 run_hook "/r/packages/design-system/src/components/Foo/foo.tsx" '

package/ds-canonical/hooks/tests/test_check_opacity_token_usage.sh

@@ -9,6 +9,8 @@ set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 HOOK="$SCRIPT_DIR/../check_opacity_token_usage.sh"
+PROJECT_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel)
+REGISTRY="$PROJECT_ROOT/packages/design-system/src/tokens/utility-registry.json"
 
 if [ ! -x "$HOOK" ]; then
   echo "FATAL: hook not executable: $HOOK"
@@ -24,22 +26,53 @@ run_hook() {
   local content="$2"
   local payload
   payload=$(jq -n --arg fp "$file_path" --arg c "$content" \
-    '{tool_name: "Write", tool_input: {file_path: $fp, content: $c}}')
+    '{hook_event_name:"PreToolUse", tool_name: "Write", tool_input: {file_path: $fp, content: $c}}')
   STDOUT=$(mktemp); STDERR=$(mktemp)
   set +e
-  printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  printf '%s' "$payload" | GOVERNANCE_PROJECT_DIR="$PROJECT_ROOT" \
+    bash "$HOOK" >"$STDOUT" 2>"$STDERR"
   EXIT=$?
   set -e
+  STDOUT_TEXT=$(cat "$STDOUT")
   STDERR_TEXT=$(cat "$STDERR")
   rm -f "$STDOUT" "$STDERR"
 }
 
+run_raw() {
+  local payload="$1"
+  STDOUT=$(mktemp); STDERR=$(mktemp)
+  set +e
+  printf '%s' "$payload" | GOVERNANCE_PROJECT_DIR="$PROJECT_ROOT" \
+    bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  EXIT=$?
+  set -e
+  STDOUT_TEXT=$(cat "$STDOUT")
+  STDERR_TEXT=$(cat "$STDERR")
+  rm -f "$STDOUT" "$STDERR"
+}
+
+is_exact_context() {
+  local needle="$1" compact
+  compact=$(printf '%s' "$STDOUT_TEXT" | jq -c . 2>/dev/null) || return 1
+  [ "$STDOUT_TEXT" = "$compact" ] || return 1
+  printf '%s' "$STDOUT_TEXT" | jq -se --arg needle "$needle" '
+    length == 1
+    and (.[0] | type == "object" and (keys | sort) == ["governanceContext"])
+    and (.[0].governanceContext |
+      type == "object"
+      and (keys | sort) == ["hookEventName", "message"]
+      and .hookEventName == "PreToolUse"
+      and (.message | type == "string" and length > 0 and contains($needle)))
+  ' >/dev/null
+}
+
 expect_pass_silent() {
   local name="$1"
-  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ]; then
+  if [ "$EXIT" = "0" ] && [ -z "$STDOUT_TEXT" ] && [ -z "$STDERR_TEXT" ]; then
     echo "  PASS  $name"; PASS=$((PASS+1))
   else
-    echo "  FAIL  $name (expected silent, exit=$EXIT, stderr non-empty=$([ -n "$STDERR_TEXT" ] && echo yes))"
+    echo "  FAIL  $name (expected both channels silent, exit=$EXIT)"
+    echo "  --- stdout ---"; echo "$STDOUT_TEXT" | sed 's/^/    /'; echo "  --- end ---"
     echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
     FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
   fi
@@ -47,10 +80,23 @@ expect_pass_silent() {
 
 expect_warn() {
   local name="$1"; local needle="$2"
-  if [ "$EXIT" = "0" ] && echo "$STDERR_TEXT" | grep -qF "$needle"; then
+  if [ "$EXIT" = "2" ] && [ -z "$STDOUT_TEXT" ] && echo "$STDERR_TEXT" | grep -qF "$needle"; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected exit=2 + needle '$needle', got exit $EXIT)"
+    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+
+# #71 soft WARN tier(micro_gap / fraction):exit 0 + exact governance context
+expect_soft_flag() {
+  local name="$1"
+  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ] && is_exact_context "soft flag"; then
     echo "  PASS  $name"; PASS=$((PASS+1))
   else
-    echo "  FAIL  $name (expected warn '$needle', got exit $EXIT)"
+    echo "  FAIL  $name (expected exact PreToolUse governance context containing 'soft flag', got exit=$EXIT)"
+    echo "  --- stdout ---"; echo "$STDOUT_TEXT" | sed 's/^/    /'; echo "  --- end ---"
     echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
     FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
   fi
@@ -101,6 +147,105 @@ const b = "opacity-75"
 '
 expect_warn "7. multi opacity-N values → warn" "opacity-25"
 
+# ── #71 micro_gap / fraction soft WARN tier(2026-07-11 接線)──────────────────
+FP71="/repo/packages/design-system/src/components/Calendar/calendar.tsx"
+
+# 8. gap-0.5(micro gap)→ soft flag(exit 0,非 block)
+run_hook "$FP71" 'const a = <div className="gap-0.5" />'
+expect_soft_flag "8. gap-0.5 micro gap → soft WARN(非 block)"
+
+# 9. w-1/3(registry fraction)→ soft flag(exit 0)
+run_hook "$FP71" 'const a = <div className="w-1/3" />'
+expect_soft_flag "9. w-1/3 registry fraction → soft WARN"
+
+# 10. w-1/2(合法,不在 registry 14 條)→ silent(不誤殺)
+run_hook "$FP71" 'const a = <div className="w-1/2" />'
+expect_pass_silent "10. w-1/2(合法留白)→ silent 不誤殺"
+
+# 11. gap-2(合法)→ silent
+run_hook "$FP71" 'const a = <div className="gap-2" />'
+expect_pass_silent "11. gap-2(合法)→ silent"
+
+# 12. 硬 violation + gap-0.5 → exit 2(hard block 不被 soft tier 弱化)
+run_hook "$FP71" 'const a = <div className="text-muted-foreground gap-0.5" />'
+expect_warn "12. 硬 violation + gap-0.5 → exit 2 block" "shadcn alias"
+
+# 13. gap-0.5 + @token-registry-ok escape → silent
+run_hook "$FP71" 'const a = <div className="gap-0.5" /> // @token-registry-ok: skeleton bone'
+expect_pass_silent "13. gap-0.5 + escape → silent"
+
+# Multiple soft flags remain one compact envelope and retain both messages.
+run_hook "$FP71" 'const a = <div className="gap-0.5 w-1/3" />'
+if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ] \
+  && is_exact_context "micro gap <4px" \
+  && printf '%s' "$STDOUT_TEXT" | jq -e \
+    '.governanceContext.message | contains("fraction width")' >/dev/null; then
+  echo "  PASS  14. two soft flags → one exact PreToolUse context"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL  14. soft-flag aggregation contract"
+  FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - 14. soft aggregation"
+fi
+
+# Every explicit registry token must be behaviorally consumed. This is deliberately data-driven:
+# adding a value to any authenticated block/warn list extends the regression without editing a
+# second token inventory in this test.
+while IFS=$'\t' read -r RULE_ID TOKEN; do
+  run_hook "$FP71" "const a = <div className=\"$TOKEN\" />"
+  expect_warn "registry block closure: $RULE_ID → $TOKEN" "$TOKEN"
+done < <(jq -r '
+  . as $registry
+  | .enforcement.block[]
+  | select(.tokenListPointer)
+  | .id as $id
+  | .tokenListPointer
+  | split("/")[1:] as $path
+  | $registry | getpath($path)[]
+  | [$id, .] | @tsv
+' "$REGISTRY")
+
+while IFS=$'\t' read -r RULE_ID TOKEN; do
+  run_hook "$FP71" "const a = <div className=\"$TOKEN\" />"
+  expect_soft_flag "registry warn closure: $RULE_ID → $TOKEN"
+done < <(jq -r '
+  . as $registry
+  | .enforcement.warn[]
+  | select(.tokenListPointer)
+  | .id as $id
+  | .tokenListPointer
+  | split("/")[1:] as $path
+  | $registry | getpath($path)[]
+  | [$id, .] | @tsv
+' "$REGISTRY")
+
+while IFS=$'\t' read -r RULE_ID LABEL FIXTURE; do
+  run_hook "$FP71" "$FIXTURE"
+  expect_warn "registry pattern closure: $RULE_ID" "[$LABEL]"
+done <<'EOF_PATTERN_FIXTURES'
+typography-leading-numeric	leading numeric	const a = <div className="leading-7" />
+typography-inline-style	typography inline style	const a = <div style={{ fontSize: 12 }} />
+radius-arbitrary	radius arbitrary	const a = <div className="rounded-[7px]" />
+radius-inline-style	radius inline style	const a = <div style={{ borderRadius: 7 }} />
+opacity-numeric	opacity	const a = <div className="opacity-15" />
+opacity-arbitrary	opacity arbitrary	const a = <div className="opacity-[0.42]" />
+primitive-color-family	primitive color as utility	const a = <div className="bg-green-8" />
+phantom-state-suffix	phantom state suffix(silent no-op)	const a = <div className="hover:bg-neutral-hovered" />
+EOF_PATTERN_FIXTURES
+
+run_hook "$FP71" 'const a = <div className="rounded-[inherit]" />'
+expect_pass_silent "registry pattern exclusion: rounded-[inherit] remains allowed"
+
+run_raw '{'
+if [ "$EXIT" = "70" ] && [ -z "$STDOUT_TEXT" ] \
+  && echo "$STDERR_TEXT" | grep -qF "GOVERNANCE_INTEGRITY:" \
+  && echo "$STDERR_TEXT" | grep -qF "invalid input envelope"; then
+  echo "  PASS  15. malformed input → stderr-only integrity failure"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL  15. malformed input output contract"
+  FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - 15. malformed input"
+fi
+
 echo ""
 echo "=== Summary ==="
 echo "Passed: $PASS / $((PASS + FAIL))"

package/ds-canonical/hooks/tests/test_check_orphan_ds_css.sh

@@ -0,0 +1,228 @@
+#!/bin/bash
+# Tests for check_orphan_ds_css.sh(P0 BLOCKER,2026-05-27 codify)
+#
+# Hook 規則(Stop / SubagentStop event):
+#   Scan $GOVERNANCE_PROJECT_DIR/packages/design-system/src/**/*.css。
+#   Orphan condition(provider-neutral Stop block decision):
+#     file NOT in styles/tokens.css aggregator(grep -qF rel path)
+#     AND basename NOT imported by any tsx/ts/css in DS(grep -rln 'import.*base|@import.*base')
+#   任一 orphan → exit 0 + stdout governanceDecision JSON，供 provider runner 轉譯。
+#   非 Stop/SubagentStop event → exit 0 silent。
+#   active canonical root 缺 DS_SRC / tokens.css aggregator → integrity exit 70。
+#   styles/tokens.css aggregator 自身永遠 skip(不算 orphan)。
+#
+# 全部 fixture 走 TMP_DIR + GOVERNANCE_PROJECT_DIR override,deterministic,無 network。
+
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK="$SCRIPT_DIR/../check_orphan_ds_css.sh"
+
+if [ ! -x "$HOOK" ]; then
+  echo "FATAL: hook not executable: $HOOK"
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+FAILED_TESTS=""
+
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+# GOVERNANCE_PROJECT_DIR override → hook 完全在 TMP_DIR sandbox 內掃,不碰 repo 真 DS。
+export GOVERNANCE_PROJECT_DIR="$TMP_DIR"
+DS_SRC="$TMP_DIR/packages/design-system/src"
+
+# ── Fixture helpers ────────────────────────────────────────────────────────
+
+# 重建乾淨 DS_SRC:tokens.css aggregator + styles dir。
+reset_ds() {
+  rm -rf "$TMP_DIR/packages"
+  mkdir -p "$DS_SRC/styles" "$DS_SRC/tokens" "$DS_SRC/components" "$DS_SRC/patterns"
+  cat > "$DS_SRC/styles/tokens.css" <<'EOF'
+/* AUTO-GENERATED aggregator */
+@import "../tokens/primitives.css";
+@import "../tokens/semantic.css";
+EOF
+}
+
+run_hook() {
+  local event="${1:-Stop}"
+  local payload
+  payload=$(jq -n --arg e "$event" '{hook_event_name:$e}')
+  STDOUT=$(mktemp); STDERR=$(mktemp)
+  set +e
+  printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  EXIT=$?
+  set -e
+  STDOUT_TEXT=$(cat "$STDOUT" 2>/dev/null)
+  STDERR_TEXT=$(cat "$STDERR" 2>/dev/null)
+  rm -f "$STDOUT" "$STDERR"
+}
+
+expect_block() {
+  local name="$1"; local needle="${2:-ORPHAN-DS-CSS BLOCKER}"
+  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ] \
+     && echo "$STDOUT_TEXT" | jq -e --arg needle "$needle" '.governanceDecision == "block" and (.reason | contains($needle))' >/dev/null 2>&1; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected neutral BLOCK decision + '$needle', got exit=$EXIT)"
+    echo "  --- stdout ---"; echo "$STDOUT_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+
+# neutral reason 必含此 file 的 rel path(guard against 漏報具體檔)
+expect_block_lists() {
+  local name="$1"; local rel="$2"
+  if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ] \
+     && echo "$STDOUT_TEXT" | jq -e --arg rel "$rel" '.governanceDecision == "block" and (.reason | contains("ORPHAN-DS-CSS BLOCKER")) and (.reason | contains($rel))' >/dev/null 2>&1; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected BLOCK listing '$rel', exit=$EXIT)"
+    echo "  --- stdout ---"; echo "$STDOUT_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+
+expect_pass_silent() {
+  local name="$1"
+  if [ "$EXIT" = "0" ] && [ -z "$STDOUT_TEXT" ] && [ -z "$STDERR_TEXT" ]; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected silent exit=0, got exit=$EXIT, stderr=$([ -n "$STDERR_TEXT" ] && echo non-empty || echo empty))"
+    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+
+expect_integrity() {
+  local name="$1"; local needle="$2"
+  if [ "$EXIT" = "70" ] && [ -z "$STDOUT_TEXT" ] \
+    && echo "$STDERR_TEXT" | grep -qF "GOVERNANCE_INTEGRITY:" \
+    && echo "$STDERR_TEXT" | grep -qF "$needle"; then
+    echo "  PASS  $name"; PASS=$((PASS+1))
+  else
+    echo "  FAIL  $name (expected integrity exit 70 + '$needle', got exit=$EXIT)"
+    echo "  --- stdout ---"; echo "$STDOUT_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+  fi
+}
+
+echo "=== check_orphan_ds_css tests ==="
+
+# ── NEGATIVE: event gating + missing infra ─────────────────────────────────
+
+# 1. Non-Stop event(PreToolUse)→ silent，即使有 orphan 也不掃
+reset_ds
+cat > "$DS_SRC/components/orphan.css" <<'EOF'
+:root { --foo: 1px; }
+EOF
+run_hook "PreToolUse"
+expect_pass_silent "1. event=PreToolUse → skip(不掃,即使有 orphan)"
+
+# 2. 無 DS_SRC dir → active hook configuration integrity fault
+rm -rf "$TMP_DIR/packages"
+run_hook "Stop"
+expect_integrity "2. 無 packages/design-system/src dir → integrity 70" "canonical DS root or aggregator"
+
+# 3. 有 DS_SRC 但無 tokens.css aggregator → integrity fault
+mkdir -p "$DS_SRC/components"
+cat > "$DS_SRC/components/x.css" <<'EOF'
+:root { --x: 1px; }
+EOF
+run_hook "Stop"
+expect_integrity "3. 無 tokens.css aggregator → integrity 70" "canonical DS root or aggregator"
+
+# ── POSITIVE: real orphan(guards against over-narrow regex)────────────────
+
+# 4. CSS 既不在 aggregator 也沒被 import → BLOCK，列出該檔
+#    (這是 2026-05-26 header-canonical.css / data-table.css 真 root case)
+reset_ds
+cat > "$DS_SRC/patterns/data-table.css" <<'EOF'
+.ds-data-table { display: grid; }
+EOF
+run_hook "Stop"
+expect_block_lists "4. orphan CSS(不在 aggregator 不被 import)→ BLOCK 列出檔" "patterns/data-table.css"
+
+# 5. 多個 orphan → BLOCK，兩個 rel path 都列出(M10 exhaustive,不只報第一個)
+reset_ds
+cat > "$DS_SRC/patterns/data-table.css" <<'EOF'
+.ds-data-table { display: grid; }
+EOF
+cat > "$DS_SRC/components/header-canonical.css" <<'EOF'
+.ds-chrome-header { height: var(--chrome-header-h); }
+EOF
+run_hook "Stop"
+if [ "$EXIT" = "0" ] && [ -z "$STDERR_TEXT" ] \
+   && echo "$STDOUT_TEXT" | jq -e '.governanceDecision == "block" and (.reason | contains("patterns/data-table.css")) and (.reason | contains("components/header-canonical.css"))' >/dev/null 2>&1; then
+  echo "  PASS  5. 多 orphan → 兩檔都列出"; PASS=$((PASS+1))
+else
+  echo "  FAIL  5. 多 orphan(expected 兩檔都列出, exit=$EXIT)"
+  echo "  --- stdout ---"; echo "$STDOUT_TEXT" | sed 's/^/    /'; echo "  --- end ---"
+  FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - 5. 多 orphan"
+fi
+
+# ── NEGATIVE: legit CSS not orphan(guards against over-broad regex)─────────
+
+# 6. CSS 在 aggregator(rel path @import)→ silent
+reset_ds
+cat > "$DS_SRC/tokens/primitives.css" <<'EOF'
+:root { --primitive-blue: #06f; }
+EOF
+# tokens.css 已 @import "../tokens/primitives.css" → rel "tokens/primitives.css" 命中 grep -F
+run_hook "Stop"
+expect_pass_silent "6. CSS 在 tokens.css aggregator(rel path 命中)→ silent"
+
+# 7. CSS 被 tsx import(component-internal scoped)→ silent
+reset_ds
+cat > "$DS_SRC/components/Tooltip.css" <<'EOF'
+.ds-tooltip { z-index: 50; }
+EOF
+cat > "$DS_SRC/components/Tooltip.tsx" <<'EOF'
+import "./Tooltip.css";
+export const Tooltip = () => null;
+EOF
+run_hook "Stop"
+expect_pass_silent "7. CSS 被 tsx import → silent(component-internal scoped)"
+
+# 8. CSS 被另一個 .css @import(chain via css)→ silent
+reset_ds
+cat > "$DS_SRC/patterns/sub.css" <<'EOF'
+.ds-sub { color: red; }
+EOF
+cat > "$DS_SRC/patterns/index.css" <<'EOF'
+@import "./sub.css";
+EOF
+# index.css 自己也得被消費,否則它變 orphan → 讓 tokens.css 收 index.css
+sed -i.bak '$a\
+@import "../patterns/index.css";' "$DS_SRC/styles/tokens.css"
+rm -f "$DS_SRC/styles/tokens.css.bak"
+run_hook "Stop"
+expect_pass_silent "8. CSS 被另一 .css @import + chain head 在 aggregator → silent"
+
+# 9. styles/tokens.css aggregator 自身永遠 skip(空 DS,只有 aggregator)→ silent
+#    (near-miss:aggregator rel path 不在自己內容裡，但 hook 顯式 skip)
+reset_ds
+run_hook "Stop"
+expect_pass_silent "9. 只有 tokens.css aggregator 自身 → silent(顯式 skip)"
+
+# 10. SubagentStop event 同樣觸發掃描(orphan → BLOCK)
+reset_ds
+cat > "$DS_SRC/components/lone.css" <<'EOF'
+.ds-lone { display: none; }
+EOF
+run_hook "SubagentStop"
+expect_block "10. event=SubagentStop + orphan → BLOCK" "ORPHAN-DS-CSS BLOCKER"
+
+echo ""
+echo "=== Summary ==="
+echo "Passed: $PASS / $((PASS + FAIL))"
+if [ "$FAIL" -gt 0 ]; then
+  printf "Failed:%b\n" "$FAILED_TESTS"
+  exit 1
+fi
+exit 0