@qijenchen/design-system 0.1.0-beta.92 → 0.1.0-beta.95

package/ds-canonical/hooks/tests/test_post_edit_dispatcher.sh

@@ -1,108 +1,265 @@
 #!/bin/bash
-# Tests for post_edit_dispatcher.sh (orchestrator)
-#
-# orchestrator smoke test only — lib hook detailed tests are separate.
-# Dispatcher fans out stdin to 9 lib/_*.sh helpers (PostToolUse Write|Edit|MultiEdit),
-# aggregates their JSON additionalContext, prints ONE JSON output, exit 0 (non-blocking).
-#
-# Smoke checks:
-#   (a) bash -n syntax OK
-#   (b) JSON input → exit 0(non-blocking,no matter helper outcome)
-#   (c) Empty / malformed stdin → still exit 0
-#   (d) Helper aggregation:if any helper emits additionalContext, dispatcher includes it
-#       in stdout JSON;若全 helper silent → dispatcher 也 silent(no stdout)。
-
-set -u
+# Enforcement-integrity tests for post_edit_dispatcher.sh.
+
+set -uo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-HOOK="$SCRIPT_DIR/../post_edit_dispatcher.sh"
+SOURCE="$SCRIPT_DIR/../post_edit_dispatcher.sh"
+FIXTURE=$(mktemp -d)
+trap 'rm -rf -- "$FIXTURE"' EXIT
+mkdir -p "$FIXTURE/lib"
+cp "$SOURCE" "$FIXTURE/post_edit_dispatcher.sh"
 
-if [ ! -f "$HOOK" ]; then echo "FATAL: hook not found: $HOOK"; exit 1; fi
+HELPERS=(
+  _token_hygiene.sh
+  _hardcoded_strings.sh
+  _code_quality.sh
+  _layout_space_canonical.sh
+  _person_data_richness.sh
+  _overlay_handcraft.sh
+  _cva_default_sync.sh
+  _story_compile_drift.sh
+  _governance_coverage_check.sh
+)
 
 PASS=0
 FAIL=0
-FAILED_TESTS=""
+VALID_PAYLOAD='{"hook_event_name":"PostToolUse","tool_name":"Write","tool_input":{"file_path":"apps/demo/src/App.tsx","content":"const x = 1"}}'
+
+write_helper() {
+  local helper="$1"
+  local mode="${2:-clean}"
+  rm -f "$FIXTURE/lib/$helper"
+  case "$mode" in
+    clean)
+      printf '#!/bin/bash\ncat >/dev/null\nexit 0\n' >"$FIXTURE/lib/$helper"
+      ;;
+    context-one)
+      printf '%s\n' \
+        '#!/bin/bash' \
+        'cat >/dev/null' \
+        'printf '\''{"governanceContext":{"hookEventName":"PostToolUse","message":"context one"}}\n'\''' \
+        'exit 0' >"$FIXTURE/lib/$helper"
+      ;;
+    context-two)
+      printf '%s\n' \
+        '#!/bin/bash' \
+        'cat >/dev/null' \
+        'printf '\''{"governanceContext":{"hookEventName":"PostToolUse","message":"context two"}}\n'\''' \
+        'exit 0' >"$FIXTURE/lib/$helper"
+      ;;
+    rc1)
+      printf '#!/bin/bash\ncat >/dev/null\nexit 1\n' >"$FIXTURE/lib/$helper"
+      ;;
+    rc2)
+      printf '#!/bin/bash\ncat >/dev/null\nexit 2\n' >"$FIXTURE/lib/$helper"
+      ;;
+    malformed)
+      printf '%s\n' \
+        '#!/bin/bash' \
+        'cat >/dev/null' \
+        'printf '\''not-json\n'\''' \
+        'exit 0' >"$FIXTURE/lib/$helper"
+      ;;
+    wrong-event)
+      printf '%s\n' \
+        '#!/bin/bash' \
+        'cat >/dev/null' \
+        'printf '\''{"governanceContext":{"hookEventName":"PreToolUse","message":"wrong event"}}\n'\''' \
+        'exit 0' >"$FIXTURE/lib/$helper"
+      ;;
+    raw-stderr)
+      printf '%s\n' \
+        '#!/bin/bash' \
+        'cat >/dev/null' \
+        'printf '\''raw diagnostic\n'\'' >&2' \
+        'exit 0' >"$FIXTURE/lib/$helper"
+      ;;
+    *)
+      printf 'unknown helper mode: %s\n' "$mode" >&2
+      exit 1
+      ;;
+  esac
+}
+
+reset_helpers() {
+  local helper
+  for helper in "${HELPERS[@]}"; do
+    write_helper "$helper" clean
+  done
+}
 
-run_hook_stdin() {
+run_hook() {
   local payload="$1"
-  STDOUT=$(mktemp); STDERR=$(mktemp)
   set +e
-  printf '%s' "$payload" | bash "$HOOK" >"$STDOUT" 2>"$STDERR"
+  printf '%s' "$payload" \
+    | bash "$FIXTURE/post_edit_dispatcher.sh" >"$FIXTURE/stdout" 2>"$FIXTURE/stderr"
   EXIT=$?
   set -e
-  STDOUT_TEXT=$(cat "$STDOUT")
-  STDERR_TEXT=$(cat "$STDERR")
-  rm -f "$STDOUT" "$STDERR"
 }
 
-expect_exit0() {
+run_real_hook() {
+  local payload="$1"
+  set +e
+  printf '%s' "$payload" \
+    | GOVERNANCE_TELEMETRY_OPT_IN=0 bash "$SOURCE" >"$FIXTURE/stdout" 2>"$FIXTURE/stderr"
+  EXIT=$?
+  set -e
+}
+
+pass() {
+  PASS=$((PASS + 1))
+  printf '  PASS  %s\n' "$1"
+}
+
+fail() {
+  FAIL=$((FAIL + 1))
+  printf '  FAIL  %s\n' "$1"
+  sed 's/^/    stdout: /' "$FIXTURE/stdout"
+  sed 's/^/    stderr: /' "$FIXTURE/stderr"
+}
+
+expect_clean() {
   local name="$1"
-  if [ "$EXIT" = "0" ]; then
-    echo "  PASS  $name"; PASS=$((PASS+1))
+  if [ "$EXIT" -eq 0 ] && [ ! -s "$FIXTURE/stdout" ] && [ ! -s "$FIXTURE/stderr" ]; then
+    pass "$name"
   else
-    echo "  FAIL  $name (expected exit 0, got $EXIT)"
-    echo "  --- stdout ---"; echo "$STDOUT_TEXT" | sed 's/^/    /'; echo "  --- end ---"
-    echo "  --- stderr ---"; echo "$STDERR_TEXT" | sed 's/^/    /'; echo "  --- end ---"
-    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - $name"
+    fail "$name (expected clean exit 0, got $EXIT)"
   fi
 }
 
-echo "=== post_edit_dispatcher tests (orchestrator smoke) ==="
+expect_integrity_failure() {
+  local name="$1"
+  local needle="$2"
+  if [ "$EXIT" -eq 70 ] \
+    && [ ! -s "$FIXTURE/stdout" ] \
+    && grep -qF 'GOVERNANCE_INTEGRITY:' "$FIXTURE/stderr" \
+    && grep -qF "$needle" "$FIXTURE/stderr"; then
+    pass "$name"
+  else
+    fail "$name (expected stderr-only integrity exit 70 containing '$needle', got $EXIT)"
+  fi
+}
 
-# 1. bash -n syntax check
-set +e
-bash -n "$HOOK" 2>/dev/null
-SYNTAX=$?
 set -e
-if [ "$SYNTAX" = "0" ]; then
-  echo "  PASS  1. bash -n syntax OK"; PASS=$((PASS+1))
+printf '%s\n' '=== post_edit_dispatcher enforcement-integrity tests ==='
+
+reset_helpers
+run_hook "$VALID_PAYLOAD"
+expect_clean 'all required helpers clean'
+
+write_helper "_token_hygiene.sh" context-one
+write_helper "_code_quality.sh" context-two
+run_hook "$VALID_PAYLOAD"
+if [ "$EXIT" -eq 0 ] \
+  && [ ! -s "$FIXTURE/stderr" ] \
+  && jq -e '
+    keys == ["governanceContext"]
+    and .governanceContext.hookEventName == "PostToolUse"
+    and (.governanceContext.message | contains("context one") and contains("context two"))
+  ' "$FIXTURE/stdout" >/dev/null 2>&1; then
+  pass 'valid helper contexts aggregate into one exact PostToolUse envelope'
 else
-  echo "  FAIL  1. bash -n syntax check"
-  FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - 1. syntax"
+  fail "valid helper context aggregation (got exit $EXIT)"
 fi
 
-# 2. Valid JSON input (out-of-scope file) → exit 0
-PAYLOAD=$(jq -n '{tool_name: "Write", tool_input: {file_path: "/tmp/out-of-scope.txt", content: "noop"}}')
-run_hook_stdin "$PAYLOAD"
-expect_exit0 "2. valid JSON input → exit 0"
+reset_helpers
+rm -f "$FIXTURE/lib/_story_compile_drift.sh"
+run_hook "$VALID_PAYLOAD"
+expect_integrity_failure 'missing required helper fails closed' 'required helper'
 
-# 3. Empty stdin → exit 0 (dispatcher reads `cat 2>/dev/null || echo "{}"`)
-run_hook_stdin ""
-expect_exit0 "3. empty stdin → exit 0"
+reset_helpers
+printf '#!/bin/bash\ncat >/dev/null\nexit 0\n' >"$FIXTURE/clean-target.sh"
+rm -f "$FIXTURE/lib/_story_compile_drift.sh"
+ln -s "$FIXTURE/clean-target.sh" "$FIXTURE/lib/_story_compile_drift.sh"
+run_hook "$VALID_PAYLOAD"
+expect_integrity_failure 'symlink helper replacement fails closed' 'symlink'
 
-# 4. Malformed JSON → still exit 0 (helpers handle their own jq errors silently)
-run_hook_stdin "not-valid-json{{{"
-expect_exit0 "4. malformed JSON stdin → exit 0"
+reset_helpers
+write_helper "_hardcoded_strings.sh" rc1
+run_hook "$VALID_PAYLOAD"
+expect_integrity_failure 'helper exit 1 fails closed' 'exit code 1'
 
-# 5. tsx file path (in-scope for some helpers) → exit 0, may emit JSON to stdout
-PAYLOAD_TSX=$(jq -n '{tool_name: "Edit", tool_input: {file_path: "/tmp/foo.tsx", new_string: "const x = 1;"}}')
-run_hook_stdin "$PAYLOAD_TSX"
-expect_exit0 "5. tsx Edit payload → exit 0 (non-blocking)"
+reset_helpers
+write_helper "_hardcoded_strings.sh" rc2
+run_hook "$VALID_PAYLOAD"
+expect_integrity_failure 'advisory helper exit 2 is integrity failure' 'exit code 2'
 
-# 6. If stdout non-empty, must be valid JSON with hookSpecificOutput
-# (only assert when stdout is non-empty — many tsx inputs may yield no warnings)
-if [ -n "$STDOUT_TEXT" ]; then
-  set +e
-  echo "$STDOUT_TEXT" | jq -e '.hookSpecificOutput.additionalContext' >/dev/null 2>&1
-  JSON_OK=$?
-  set -e
-  if [ "$JSON_OK" = "0" ]; then
-    echo "  PASS  6. when stdout non-empty, valid JSON with hookSpecificOutput"
-    PASS=$((PASS+1))
-  else
-    echo "  FAIL  6. stdout was non-empty but not valid hookSpecificOutput JSON"
-    echo "  --- stdout ---"; echo "$STDOUT_TEXT" | sed 's/^/    /'; echo "  --- end ---"
-    FAIL=$((FAIL+1)); FAILED_TESTS="${FAILED_TESTS}\n  - 6. stdout JSON shape"
-  fi
+reset_helpers
+write_helper "_layout_space_canonical.sh" malformed
+run_hook "$VALID_PAYLOAD"
+expect_integrity_failure 'malformed helper stdout fails closed' 'malformed or wrong-event envelope'
+
+reset_helpers
+write_helper "_layout_space_canonical.sh" wrong-event
+run_hook "$VALID_PAYLOAD"
+expect_integrity_failure 'wrong-event helper context fails closed' 'malformed or wrong-event envelope'
+
+reset_helpers
+write_helper "_person_data_richness.sh" raw-stderr
+run_hook "$VALID_PAYLOAD"
+expect_integrity_failure 'raw helper stderr fails closed' 'raw stderr'
+
+reset_helpers
+run_hook 'not-json'
+expect_integrity_failure 'malformed canonical input fails closed' 'malformed or wrong-event canonical envelope'
+
+run_hook '{"hook_event_name":"PreToolUse","tool_name":"Write","tool_input":{"file_path":"apps/demo/src/App.tsx"}}'
+expect_integrity_failure 'misrouted event input fails closed' 'malformed or wrong-event canonical envelope'
+
+# Exercise the real dispatcher and all nine real helpers with both a >256 KiB
+# canonical event and a file containing far more matches than every diagnostic
+# cap. This guards against producer -> early-closing grep/head pipelines
+# surfacing EPIPE as a false helper-integrity failure.
+REAL_COMPONENT_DIR="$FIXTURE/workspace/packages/design-system/src/components/SigpipeFixture"
+REAL_COMPONENT="$REAL_COMPONENT_DIR/sigpipe-fixture.tsx"
+mkdir -p "$REAL_COMPONENT_DIR"
+{
+  printf '%s\n' \
+    'import { cva } from "class-variance-authority";' \
+    'const variants = cva("", { variants: { size: { md: "" } }, defaultVariants: { size: "md" } });'
+  fixture_index=0
+  while [ "$fixture_index" -lt 1200 ]; do
+    printf 'const unsafeAny%s: any = null;\n' "$fixture_index"
+    printf 'const hardcodedLabel%s = "這是使用者介面文字";\n' "$fixture_index"
+    printf '<div className="bg-popover shadow-lg bg-neutral-3 overflow-auto w-[--fixture-width]">row</div>;\n'
+    printf '<div className="px-[var(--layout-space-loose)] border-b border-divider">overlay</div>;\n'
+    printf 'const sparsePerson%s = { name: "Person", avatarUrl: "/avatar.png" };\n' "$fixture_index"
+    fixture_index=$((fixture_index + 1))
+  done
+} >"$REAL_COMPONENT"
+
+REAL_PAYLOAD=$(
+  jq -Rs --arg path "$REAL_COMPONENT" '{
+    hook_event_name: "PostToolUse",
+    tool_name: "Write",
+    tool_input: {
+      file_path: $path,
+      content: .
+    }
+  }' <"$REAL_COMPONENT"
+)
+
+run_real_hook "$REAL_PAYLOAD"
+if [ "$(wc -c <"$REAL_COMPONENT" | tr -d ' ')" -gt 262144 ] \
+  && [ "$EXIT" -eq 0 ] \
+  && [ ! -s "$FIXTURE/stderr" ] \
+  && jq -e '
+    keys == ["governanceContext"]
+    and .governanceContext.hookEventName == "PostToolUse"
+    and (
+      .governanceContext.message
+      | contains("Token hygiene")
+        and contains("i18n hygiene")
+        and contains("Code quality lite")
+        and contains("Primitive consumption")
+        and contains("cva/defaultVariants touched")
+    )
+  ' "$FIXTURE/stdout" >/dev/null 2>&1; then
+  pass 'real dispatcher handles >256 KiB event and high-match helper scans without EPIPE/integrity noise'
 else
-  echo "  PASS  6. stdout silent (all helpers in-scope returned empty) — JSON shape n/a"
-  PASS=$((PASS+1))
+  fail "real dispatcher large-input/high-match regression (got exit $EXIT)"
 fi
 
-echo ""
-echo "=== Summary ==="
-echo "Passed: $PASS / $((PASS + FAIL))"
-if [ "$FAIL" -gt 0 ]; then
-  echo "Failed:$FAILED_TESTS"
-  exit 1
-fi
+printf 'Passed: %s / %s\n' "$PASS" "$((PASS + FAIL))"
+[ "$FAIL" -eq 0 ]

package/ds-canonical/hooks/tests/test_provider_peer_symmetry.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+# Provider-neutral behavioral matrix for the legacy-named peer hooks.
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+BRIEF_HOOK="$SCRIPT_DIR/../check_codex_brief_invariants.sh"
+COLLAB_HOOK="$SCRIPT_DIR/../check_codex_collab_5step.sh"
+STOP_HOOK="$SCRIPT_DIR/../stop_self_audit.sh"
+TMP_ROOT=$(mktemp -d)
+trap 'rm -rf "$TMP_ROOT"' EXIT
+mkdir -p "$TMP_ROOT/project/state"
+
+PASS=0
+FAIL=0
+
+set_pair() {
+  export GOVERNANCE_PROJECT_DIR="$TMP_ROOT/project"
+  export GOVERNANCE_STATE_DIR="$TMP_ROOT/project/state"
+  export GOVERNANCE_READ_ONLY=1
+  export GOVERNANCE_SELF_PROVIDER="$1"
+  export GOVERNANCE_SELF_DISPLAY_NAME="$1"
+  export GOVERNANCE_PEER_PROVIDER="$2"
+  export GOVERNANCE_PEER_DISPLAY_NAME="$2"
+  export GOVERNANCE_PEER_CLI="$2"
+  export GOVERNANCE_PEER_LOCAL_EXECUTABLE="node_modules/.bin/$2"
+  export GOVERNANCE_PEER_BRIEF_MARKERS_JSON='["review"]'
+  export GOVERNANCE_PEER_DISCOVERY_MARKERS_JSON="[\"node_modules/.bin/$2\",\"command -v $2\"]"
+  export GOVERNANCE_PEER_REPLY_ARTIFACT_PREFIX="$2-reply"
+  export GOVERNANCE_INSTRUCTION_ENTRY=AGENTS.md
+  export GOVERNANCE_SHARED_INSTRUCTION_ENTRY=AGENTS.md
+}
+
+record() {
+  if [ "$1" = "1" ]; then
+    echo "  PASS  $2"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL  $2"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+for pair in "alpha beta" "beta alpha"; do
+  set -- $pair
+  self="$1"; peer="$2"
+  set_pair "$self" "$peer"
+
+  payload=$(jq -nc --arg cmd "$peer review trivial" '{hook_event_name:"PreToolUse",tool_name:"Bash",tool_input:{command:$cmd}}')
+  printf '%s' "$payload" | bash "$BRIEF_HOOK" >/dev/null 2>"$TMP_ROOT/brief.err"
+  rc=$?
+  record "$([ "$rc" = "2" ] && grep -q 'PEER BRIEF MISSING' "$TMP_ROOT/brief.err" && echo 1 || echo 0)" "${self}→${peer} peer brief is governed"
+
+  payload=$(jq -nc --arg cmd "$self review trivial" '{hook_event_name:"PreToolUse",tool_name:"Bash",tool_input:{command:$cmd}}')
+  printf '%s' "$payload" | bash "$BRIEF_HOOK" >/dev/null 2>"$TMP_ROOT/self.err"
+  rc=$?
+  record "$([ "$rc" = "0" ] && [ ! -s "$TMP_ROOT/self.err" ] && echo 1 || echo 0)" "${self}→${peer} self CLI is not inverted into peer gate"
+
+  payload=$(jq -nc --arg cmd "git commit -m '$peer collab'" '{hook_event_name:"PreToolUse",tool_name:"Bash",tool_input:{command:$cmd}}')
+  printf '%s' "$payload" | bash "$COLLAB_HOOK" >/dev/null 2>"$TMP_ROOT/collab.err"
+  rc=$?
+  record "$([ "$rc" = "0" ] && grep -q "self=$self,peer=$peer" "$TMP_ROOT/collab.err" && echo 1 || echo 0)" "${self}→${peer} collaboration marker is dynamic"
+
+  transcript="$TMP_ROOT/$self-$peer.jsonl"
+  printf '%s\n' \
+    '{"type":"user","message":{"role":"user","content":"review this"}}' \
+    "{\"type\":\"assistant\",\"message\":{\"role\":\"assistant\",\"content\":[{\"type\":\"tool_use\",\"name\":\"Read\",\"input\":{\"file_path\":\"$peer-reply-review.md\"}}]}}" \
+    '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"review received"}]}}' \
+    > "$transcript"
+  payload=$(jq -nc --arg transcript "$transcript" '{hook_event_name:"Stop",transcript_path:$transcript,session_id:"symmetry"}')
+  output=$(printf '%s' "$payload" | bash "$STOP_HOOK" 2>/dev/null)
+  rc=$?
+  record "$([ "$rc" = "0" ] && printf '%s' "$output" | grep -q '"governanceDecision":"block"' && echo 1 || echo 0)" "${self}→${peer} peer reply audit emits neutral Stop decision"
+done
+
+echo "Results: $PASS PASS, $FAIL FAIL"
+[ "$FAIL" = "0" ]

package/ds-canonical/hooks/tests/test_registration_output_contracts.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+# Registration-derived static output-contract audit.
+#
+# This test deliberately reads registrations.json and its schema instead of maintaining a second
+# descriptor inventory. Targeted runtime branches live in each hook's focused behavior test.
+
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK_ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+REGISTRY="$HOOK_ROOT/registrations.json"
+SCHEMA="$HOOK_ROOT/registrations.schema.json"
+
+command -v node >/dev/null 2>&1 || {
+  echo "FATAL: node is required for registration output-contract tests"
+  exit 1
+}
+
+node -- "$SCRIPT_DIR/registration-output-contracts.mjs" \
+  "$REGISTRY" "$SCHEMA" "$HOOK_ROOT"