@reddb-io/red-skills-dev 2.75.2

package/skills/misc/branch-lock/scripts/tests/codex-hook.test.sh

@@ -0,0 +1,229 @@
+#!/usr/bin/env bash
+# Unit test for the Codex plugin PreToolUse branch-lock hook.
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+PLUGIN_ROOT="$(cd "$HERE/../../../../.." && pwd)"
+HOOK="$PLUGIN_ROOT/hooks/branch-lock-codex.sh"
+MANIFEST="$PLUGIN_ROOT/hooks/codex.hooks.json"
+
+pass=0
+fail=0
+
+ok()  { echo "PASS  $1"; pass=$((pass + 1)); }
+bad() { echo "FAIL  $1"; fail=$((fail + 1)); }
+
+expect_eq() {
+  local label="$1" expected="$2" actual="$3"
+  if [[ "$expected" == "$actual" ]]; then
+    ok "$label"
+  else
+    bad "$label"
+    printf '  expected: %q\n  actual:   %q\n' "$expected" "$actual"
+  fi
+}
+
+expect_contains() {
+  local label="$1" needle="$2" haystack="$3"
+  if [[ "$haystack" == *"$needle"* ]]; then
+    ok "$label"
+  else
+    bad "$label"
+    printf '  missing: %q\n  in:      %q\n' "$needle" "$haystack"
+  fi
+}
+
+tmp="$(mktemp -d -t branch-lock-codex.XXXXXX)"
+trap 'rm -rf "$tmp"' EXIT
+
+primary="$tmp/red-skills"
+mkdir -p "$primary/.red/tmp"
+cat > "$primary/.red/config.yaml" <<'EOF'
+plugins:
+  dev:
+    enabled: true
+EOF
+printf 'main\n' > "$primary/.red/tmp/branch-lock.yaml"
+
+run_hook() {
+  local root="$1" payload="$2" out err rc
+  out="$tmp/out"
+  err="$tmp/err"
+  CODEX_PLUGIN_ROOT="$PLUGIN_ROOT" "$HOOK" >"$out" 2>"$err" <<<"$payload"
+  rc=$?
+  printf '%s\n---stdout---\n%s\n---stderr---\n%s\n' "$rc" "$(<"$out")" "$(<"$err")"
+}
+
+payload() {
+  local root="$1" cmd="$2"
+  jq -nc --arg cwd "$root" --arg cmd "$cmd" \
+    '{hook_event_name:"PreToolUse", cwd:$cwd, tool_input:{cmd:$cmd}}'
+}
+
+manifest_hook="$(jq -r '.hooks.PreToolUse[0].hooks[] | select(.command | contains("branch-lock-codex.sh")) | .command' "$MANIFEST")"
+expect_contains "manifest: wires branch-lock-codex.sh" "branch-lock-codex.sh" "$manifest_hook"
+expect_contains "manifest: wrapper drains stdin before hook" 'cat >"$tmp"' "$manifest_hook"
+
+out="$tmp/manifest-out"
+err="$tmp/manifest-err"
+CODEX_PLUGIN_ROOT="$PLUGIN_ROOT" bash -lc "$manifest_hook" >"$out" 2>"$err" \
+  <<<"$(payload "$primary" "git status")"
+rc=$?
+expect_eq "manifest: command executes through shell" "0" "$rc"
+expect_eq "manifest: command prints empty JSON" "{}" "$(<"$out")"
+
+missing_root="$tmp/missing-plugin-root"
+mkdir -p "$missing_root"
+CODEX_PLUGIN_ROOT="$missing_root" bash -lc "$manifest_hook" >"$out" 2>"$err" \
+  <<<"$(payload "$primary" "git switch main")"
+rc=$?
+expect_eq "manifest: missing hook fails open" "0" "$rc"
+expect_eq "manifest: missing hook prints empty JSON" "{}" "$(<"$out")"
+
+early_root="$tmp/early-plugin-root"
+mkdir -p "$early_root/hooks"
+cat > "$early_root/hooks/branch-lock-codex.sh" <<'EOF'
+#!/usr/bin/env sh
+printf '{}'
+exit 0
+EOF
+chmod +x "$early_root/hooks/branch-lock-codex.sh"
+set -o pipefail
+(head -c 1048576 /dev/zero | tr '\0' x) \
+  | CODEX_PLUGIN_ROOT="$early_root" bash -lc "$manifest_hook" >"$out" 2>"$err"
+rc=$?
+set +o pipefail
+expect_eq "manifest: early hook still drains Codex stdin" "0" "$rc"
+expect_eq "manifest: early hook prints empty JSON" "{}" "$(<"$out")"
+
+CODEX_PLUGIN_ROOT="$missing_root" "$HOOK" >"$out" 2>"$err" \
+  <<<"$(payload "$primary" "git switch main")"
+rc=$?
+expect_eq "hook: incomplete plugin root fails open" "0" "$rc"
+expect_eq "hook: incomplete plugin root prints empty JSON" "{}" "$(<"$out")"
+
+# Branch movement in the primary is now blocked unconditionally by the
+# untouchable-primary rule (ADR 0083) — it fires before the branch-lock path, so
+# switching away, and even switching *back* to the locked branch, is refused.
+result="$(run_hook "$primary" "$(payload "$primary" "git switch feature")")"
+rc="$(sed -n '1p' <<<"$result")"
+stderr="$(sed -n '/---stderr---/,$p' <<<"$result")"
+expect_eq "locked: switch away is blocked" "0" "$rc"
+expect_contains "locked: error names ADR 0083" "ADR 0083" "$stderr"
+
+result="$(run_hook "$primary" "$(payload "$primary" "git switch main")")"
+rc="$(sed -n '1p' <<<"$result")"
+stderr="$(sed -n '/---stderr---/,$p' <<<"$result")"
+expect_eq "locked: switch back is also blocked (untouchable primary)" "0" "$rc"
+expect_contains "locked: switch-back error names ADR 0083" "ADR 0083" "$stderr"
+
+# Work-loss commands are caught by the unconditional untouchable-primary guard
+# (#1024 reset/stash family + #1025 unconditional structure) even while a lock
+# is active — the guard runs before the lock read, so the refusal names
+# ADR 0083, not the branch lock.
+result="$(run_hook "$primary" "$(payload "$primary" "git reset --hard HEAD~1")")"
+rc="$(sed -n '1p' <<<"$result")"
+stderr="$(sed -n '/---stderr---/,$p' <<<"$result")"
+expect_eq "locked: work-loss reset --hard is blocked" "0" "$rc"
+expect_contains "locked: work-loss error names untouchable primary" "ADR 0083" "$stderr"
+
+rm -f "$primary/.red/tmp/branch-lock.yaml"
+result="$(run_hook "$primary" "$(payload "$primary" "git switch feature")")"
+rc="$(sed -n '1p' <<<"$result")"
+stderr="$(sed -n '/---stderr---/,$p' <<<"$result")"
+expect_eq "unlocked: switch is still blocked (untouchable primary)" "0" "$rc"
+expect_contains "unlocked: error names ADR 0083" "ADR 0083" "$stderr"
+
+# With no lock file the untouchable-primary guard still blocks every branch
+# move, regardless of the legacy `dev.lock.primary-branch` toggle value.
+mkdir -p "$primary/.red"
+cat > "$primary/.red/config.yaml" <<'EOF'
+plugins:
+  dev:
+    enabled: true
+EOF
+
+result="$(run_hook "$primary" "$(payload "$primary" "git switch feature")")"
+rc="$(sed -n '1p' <<<"$result")"
+stderr="$(sed -n '/---stderr---/,$p' <<<"$result")"
+expect_eq "primary guard: switch blocked with no lock and no config" "0" "$rc"
+expect_contains "primary guard: error names ADR 0083" "ADR 0083" "$stderr"
+
+result="$(run_hook "$primary" "$(payload "$primary" "git checkout feature")")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "primary guard: checkout branch is blocked" "0" "$rc"
+
+# issue #1024 — git reset (any form) and git stash (all subcommands) blocked,
+# and the refusal explains the reason + the sanctioned worktree alternative.
+result="$(run_hook "$primary" "$(payload "$primary" "git reset --hard")")"
+rc="$(sed -n '1p' <<<"$result")"
+stderr="$(sed -n '/---stderr---/,$p' <<<"$result")"
+expect_eq "primary guard: reset --hard is blocked when flag is on" "0" "$rc"
+expect_contains "primary guard: reset refusal points to worktree" ".red/tmp/work-" "$stderr"
+
+result="$(run_hook "$primary" "$(payload "$primary" "git reset --soft HEAD~1")")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "primary guard: reset --soft is blocked when flag is on" "0" "$rc"
+
+result="$(run_hook "$primary" "$(payload "$primary" "git stash")")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "primary guard: stash is blocked when flag is on" "0" "$rc"
+
+result="$(run_hook "$primary" "$(payload "$primary" "git rebase --autostash main")")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "primary guard: rebase --autostash is blocked when flag is on" "0" "$rc"
+
+result="$(run_hook "$primary" "$(payload "$primary" "git switch -b new")")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "primary guard: switch -b is blocked" "0" "$rc"
+
+result="$(run_hook "$primary" "$(payload "$primary" "git commit -m wip")")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "primary guard: commit is allowed" "0" "$rc"
+
+result="$(run_hook "$primary" "$(payload "$primary" "git worktree add ../wt feature")")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "primary guard: worktree add is allowed" "0" "$rc"
+
+result="$(run_hook "$primary" "$(payload "$primary" "git status")")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "primary guard: read-only git is allowed" "0" "$rc"
+
+# The legacy toggle is still readable but can no longer *enable* switching:
+# explicitly false must not re-open primary branch movement (ADR 0083 §2).
+cat > "$primary/.red/config.yaml" <<'EOF'
+plugins:
+  dev:
+    enabled: true
+    lock:
+      primary-branch: false
+EOF
+result="$(run_hook "$primary" "$(payload "$primary" "git switch feature")")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "primary guard: legacy toggle off still blocks switch" "0" "$rc"
+
+worktree="$primary/.red/tmp/work-wAAAA-i1/worktree"
+mkdir -p "$worktree" "$primary/.red/tmp"
+printf 'main\n' > "$primary/.red/tmp/branch-lock.yaml"
+result="$(run_hook "$worktree" "$(payload "$worktree" "git switch feature")")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "worktree: branch lock is exempt" "0" "$rc"
+
+mkdir -p "$worktree/.red"
+cat > "$worktree/.red/config.yaml" <<'EOF'
+dev:
+  lock:
+    primary-branch: true
+EOF
+result="$(run_hook "$worktree" "$(payload "$worktree" "git switch feature")")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "worktree: primary guard is exempt" "0" "$rc"
+
+result="$(run_hook "$primary" "$(jq -nc --arg cwd "$primary" '{hook_event_name:"PreToolUse", cwd:$cwd, tool_input:{file:"x"}}')")"
+rc="$(sed -n '1p' <<<"$result")"
+expect_eq "non-shell payload: no-op allowed" "0" "$rc"
+
+echo
+echo "summary: $pass passed, $fail failed"
+[[ "$fail" -eq 0 ]]

package/skills/misc/branch-lock/scripts/tests/dev-config.test.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# Unit test for lib/dev-config.sh — runtime reader for dev.lock.primary-branch.
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LIB="$(dirname "$HERE")/lib/dev-config.sh"
+
+# shellcheck source=../lib/dev-config.sh
+source "$LIB"
+
+pass=0
+fail=0
+
+expect_rc() {
+  local label="$1" expected="$2" file="$3"
+  dev_config_lock_primary_branch_enabled "$file"
+  local actual=$?
+  if [[ "$actual" == "$expected" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      expected rc: %q\n      actual rc:   %q\n' "$label" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+
+missing="$tmp/missing.yaml"
+expect_rc "missing file: disabled" 1 "$missing"
+
+cfg="$tmp/config.yaml"
+
+cat > "$cfg" <<'EOF'
+dev:
+  lock:
+    primary-branch: true
+EOF
+expect_rc "nested dev flag true: enabled" 0 "$cfg"
+
+cat > "$cfg" <<'EOF'
+dev:
+  lock:
+    primary-branch: false
+EOF
+expect_rc "nested dev flag false: disabled" 1 "$cfg"
+
+cat > "$cfg" <<'EOF'
+dev:
+  lock:
+    primary-branch: "true"
+EOF
+expect_rc "quoted true: enabled" 0 "$cfg"
+
+cat > "$cfg" <<'EOF'
+afk:
+  default_runner: codex
+EOF
+expect_rc "absent key: disabled" 1 "$cfg"
+
+cat > "$cfg" <<'EOF'
+dev:
+   lock:
+     primary-branch: true
+EOF
+expect_rc "malformed indentation: disabled" 1 "$cfg"
+
+cat > "$cfg" <<'EOF'
+dev:
+  lock:
+    primary-branch: "true" # branch protection on
+EOF
+expect_rc "inline comment after quoted true: enabled" 0 "$cfg"
+
+cat > "$cfg" <<'EOF'
+dev:
+  lock:
+    primary-branch: true
+afk:
+  backpressure:
+    - npm run test
+    - npm run lint
+EOF
+expect_rc "block-sequence sibling does not disable guard: enabled" 0 "$cfg"
+
+cat > "$cfg" <<'EOF'
+afk:
+  backpressure:
+    - npm run test
+dev:
+  lock:
+    primary-branch: true
+EOF
+expect_rc "block-sequence before dev key: enabled" 0 "$cfg"
+
+echo
+echo "summary: $pass passed, $fail failed"
+[[ "$fail" -eq 0 ]]

package/skills/misc/branch-lock/scripts/tests/git-command-classifier.test.sh

@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+# Unit test for lib/git-command-classifier.sh (issue #60).
+#
+# Locked to "main", verifies the minimal classifier:
+#   block  — checkout/switch to a branch other than the lock target
+#   allow  — switching back to the lock target, file-level `checkout -- <path>`,
+#            bare checkout, `git worktree add`, and non-git/non-checkout commands
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LIB="$(dirname "$HERE")/lib/git-command-classifier.sh"
+
+# shellcheck source=../lib/git-command-classifier.sh
+source "$LIB"
+
+pass=0
+fail=0
+
+expect_verdict() {
+  local label="$1" lock="$2" cmd="$3" expected="$4"
+  local actual; actual="$(classify_git_command "$lock" "$cmd")"
+  if [[ "$actual" == "$expected" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      cmd:      %q\n      expected: %q\n      actual:   %q\n' \
+      "$label" "$cmd" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+LOCK="main"
+
+# ===========================================================================
+# BLOCK — leaving the locked branch
+# ===========================================================================
+expect_verdict "block/checkout other"        "$LOCK" "git checkout feature"          "block"
+expect_verdict "block/switch other"          "$LOCK" "git switch feature"            "block"
+expect_verdict "block/checkout slash branch" "$LOCK" "git checkout feature/x"        "block"
+expect_verdict "block/checkout -b new"       "$LOCK" "git checkout -b shiny"         "block"
+expect_verdict "block/switch -c new"         "$LOCK" "git switch -c shiny"           "block"
+expect_verdict "block/switch dash previous"  "$LOCK" "git switch -"                  "block"
+expect_verdict "block/compound command"      "$LOCK" "cd repo && git checkout other" "block"
+expect_verdict "block/checkout --track"      "$LOCK" "git checkout --track origin/x" "block"
+
+# global options before the subcommand must not bypass the lock
+expect_verdict "block/-C path checkout"      "$LOCK" "git -C /repo checkout other"   "block"
+expect_verdict "block/-C path switch"        "$LOCK" "git -C /repo switch other"      "block"
+expect_verdict "block/-C path checkout -b"   "$LOCK" "git -C /repo checkout -b shiny" "block"
+expect_verdict "block/-c config checkout"    "$LOCK" "git -c core.x=1 checkout other" "block"
+expect_verdict "block/--git-dir eq switch"   "$LOCK" "git --git-dir=/r/.git switch o" "block"
+expect_verdict "block/--git-dir arg switch"  "$LOCK" "git --git-dir /r/.git switch o" "block"
+expect_verdict "block/--no-pager checkout"   "$LOCK" "git --no-pager checkout other"  "block"
+expect_verdict "block/-C compound"           "$LOCK" "cd x && git -C /r checkout other" "block"
+expect_verdict "block/-C reset --hard"       "$LOCK" "git -C /repo reset --hard"      "block"
+expect_verdict "block/-C stash"              "$LOCK" "git -C /repo stash"             "block"
+
+# ===========================================================================
+# ALLOW — same-branch / legitimate operations
+# ===========================================================================
+expect_verdict "allow/checkout lock target"  "$LOCK" "git checkout main"             "allow"
+expect_verdict "allow/switch lock target"    "$LOCK" "git switch main"               "allow"
+expect_verdict "allow/file restore --"       "$LOCK" "git checkout -- src/app.ts"    "allow"
+expect_verdict "allow/file restore -- multi" "$LOCK" "git checkout -- a.txt b.txt"   "allow"
+expect_verdict "allow/bare checkout"         "$LOCK" "git checkout"                   "allow"
+expect_verdict "allow/worktree add"          "$LOCK" "git worktree add ../wt branch" "allow"
+expect_verdict "allow/non-checkout git"      "$LOCK" "git status"                     "allow"
+expect_verdict "allow/non-git command"       "$LOCK" "ls -la"                         "allow"
+expect_verdict "allow/commit"                "$LOCK" "git commit -m wip"              "allow"
+
+# global options before the subcommand: legitimate operations still allowed
+expect_verdict "allow/-C checkout lock"      "$LOCK" "git -C /repo checkout main"     "allow"
+expect_verdict "allow/-C status"             "$LOCK" "git -C /repo status"            "allow"
+expect_verdict "allow/-C file restore"       "$LOCK" "git -C /repo checkout -- a.ts"  "allow"
+expect_verdict "allow/-C worktree add"       "$LOCK" "git -C /repo worktree add ../w" "allow"
+
+# slash lock target: switching back to it is allowed, elsewhere blocked
+expect_verdict "allow/slash lock back"  "feature/x" "git switch feature/x"  "allow"
+expect_verdict "block/slash other"      "feature/x" "git switch feature/y"  "block"
+
+# ===========================================================================
+# BLOCK — the work-loss family (issue #61)
+# ===========================================================================
+expect_verdict "block/stash bare"            "$LOCK" "git stash"                   "block"
+expect_verdict "block/stash push"            "$LOCK" "git stash push"              "block"
+expect_verdict "block/stash push paths"      "$LOCK" "git stash push -m x src/"    "block"
+expect_verdict "block/stash save"            "$LOCK" "git stash save wip"          "block"
+expect_verdict "block/clean -f"              "$LOCK" "git clean -f"                "block"
+expect_verdict "block/clean -fd"             "$LOCK" "git clean -fd"               "block"
+expect_verdict "block/clean -xfd"            "$LOCK" "git clean -xfd"              "block"
+expect_verdict "block/clean --force"         "$LOCK" "git clean --force"           "block"
+expect_verdict "block/reset --hard"          "$LOCK" "git reset --hard"            "block"
+expect_verdict "block/reset --hard HEAD~1"   "$LOCK" "git reset --hard HEAD~1"     "block"
+expect_verdict "block/checkout dot"          "$LOCK" "git checkout ."              "block"
+expect_verdict "block/restore dot"           "$LOCK" "git restore ."              "block"
+expect_verdict "block/checkout dashdash dot"  "$LOCK" "git checkout -- ."          "block"
+expect_verdict "block/family compound"       "$LOCK" "cd repo && git reset --hard" "block"
+
+# ===========================================================================
+# ALLOW — non-destructive members of the same command families
+# ===========================================================================
+expect_verdict "allow/stash list"            "$LOCK" "git stash list"              "allow"
+expect_verdict "allow/stash show"            "$LOCK" "git stash show"              "allow"
+expect_verdict "allow/clean dry-run"         "$LOCK" "git clean -n"                "allow"
+expect_verdict "allow/clean --dry-run"       "$LOCK" "git clean --dry-run"         "allow"
+expect_verdict "allow/reset soft"            "$LOCK" "git reset --soft HEAD~1"     "allow"
+expect_verdict "allow/reset mixed default"   "$LOCK" "git reset HEAD file.txt"     "allow"
+expect_verdict "allow/restore staged"        "$LOCK" "git restore --staged f.txt"  "allow"
+expect_verdict "allow/restore single file"   "$LOCK" "git restore src/app.ts"       "allow"
+
+# ===========================================================================
+# PRIMARY BRANCH GUARD — dev.lock.primary-branch (issue #396 / ADR 0043)
+# Table: command, cwd-is-primary, flag-state => allow/block.
+# ===========================================================================
+expect_primary_guard() {
+  local label="$1" cmd="$2" primary="$3" flag="$4" expected="$5"
+  local actual="allow"
+  if [[ "$primary" == "primary" && "$flag" == "on" ]]; then
+    actual="$(classify_primary_branch_switch_guard "$cmd")"
+  fi
+  if [[ "$actual" == "$expected" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      cmd:      %q\n      primary:  %q\n      flag:     %q\n      expected: %q\n      actual:   %q\n' \
+      "$label" "$cmd" "$primary" "$flag" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+expect_primary_guard "primary/on/switch other blocked"       "git switch other"              primary  on  block
+expect_primary_guard "primary/on/checkout other blocked"     "git checkout other"            primary  on  block
+expect_primary_guard "primary/on/switch -b new blocked"      "git switch -b new"             primary  on  block
+expect_primary_guard "primary/on/checkout -b new blocked"    "git checkout -b new"           primary  on  block
+expect_primary_guard "primary/on/compound switch blocked"    "cd repo && git switch other"   primary  on  block
+expect_primary_guard "primary/on/-C switch blocked"          "git -C /repo switch other"     primary  on  block
+expect_primary_guard "primary/on/-C checkout -b blocked"     "git -C /repo checkout -b new"  primary  on  block
+expect_primary_guard "primary/on/switch dash blocked"        "git switch -"                  primary  on  block
+expect_primary_guard "primary/on/commit allowed"             "git commit -m wip"             primary  on  allow
+expect_primary_guard "primary/on/worktree add allowed"       "git worktree add ../wt other"  primary  on  allow
+expect_primary_guard "primary/on/status allowed"             "git status"                    primary  on  allow
+expect_primary_guard "primary/on/checkout path allowed"      "git checkout -- src/app.ts"    primary  on  allow
+expect_primary_guard "primary/on/checkout dot allowed"       "git checkout ."                primary  on  allow
+expect_primary_guard "primary/off/switch allowed"            "git switch other"              primary  off allow
+expect_primary_guard "worktree/on/switch allowed"            "git switch other"              worktree on  allow
+expect_primary_guard "worktree/off/switch allowed"           "git switch other"              worktree off allow
+
+# ---------------------------------------------------------------------------
+# issue #1024: block git reset (any form) and git stash (all subcommands),
+# plus git rebase --autostash, in the primary checkout. Parallel human WIP
+# lives there; these commands have destroyed in-progress work before.
+# ---------------------------------------------------------------------------
+expect_primary_guard "primary/on/reset bare blocked"         "git reset"                          primary  on  block
+expect_primary_guard "primary/on/reset --hard blocked"       "git reset --hard"                   primary  on  block
+expect_primary_guard "primary/on/reset --hard HEAD~1 blocked" "git reset --hard HEAD~1"           primary  on  block
+expect_primary_guard "primary/on/reset --soft blocked"       "git reset --soft HEAD~1"            primary  on  block
+expect_primary_guard "primary/on/reset --mixed blocked"      "git reset --mixed"                  primary  on  block
+expect_primary_guard "primary/on/reset pathspec blocked"     "git reset HEAD file.txt"            primary  on  block
+expect_primary_guard "primary/on/-C reset blocked"           "git -C /repo reset --hard"          primary  on  block
+expect_primary_guard "primary/on/compound reset blocked"     "cd repo && git reset --hard"        primary  on  block
+
+expect_primary_guard "primary/on/stash bare blocked"         "git stash"                          primary  on  block
+expect_primary_guard "primary/on/stash push blocked"         "git stash push"                     primary  on  block
+expect_primary_guard "primary/on/stash push paths blocked"   "git stash push -m x src/"           primary  on  block
+expect_primary_guard "primary/on/stash save blocked"         "git stash save wip"                 primary  on  block
+expect_primary_guard "primary/on/stash pop blocked"          "git stash pop"                      primary  on  block
+expect_primary_guard "primary/on/stash apply blocked"        "git stash apply"                    primary  on  block
+expect_primary_guard "primary/on/stash list blocked"         "git stash list"                     primary  on  block
+expect_primary_guard "primary/on/stash show blocked"         "git stash show"                     primary  on  block
+expect_primary_guard "primary/on/-C stash blocked"           "git -C /repo stash"                 primary  on  block
+
+expect_primary_guard "primary/on/rebase autostash blocked"   "git rebase --autostash"             primary  on  block
+expect_primary_guard "primary/on/rebase autostash arg blocked" "git rebase --autostash origin/main" primary on block
+expect_primary_guard "primary/on/rebase main autostash blocked" "git rebase main --autostash"     primary  on  block
+
+# rebase without --autostash is not the work-loss vector this rule targets
+expect_primary_guard "primary/on/rebase plain allowed"       "git rebase main"                    primary  on  allow
+expect_primary_guard "primary/on/rebase --no-autostash allowed" "git rebase --no-autostash main"  primary  on  allow
+
+# worktrees stay exempt (scope), flag-off stays inert — for reset/stash too
+expect_primary_guard "worktree/on/reset allowed"             "git reset --hard"                   worktree on  allow
+expect_primary_guard "worktree/on/stash allowed"             "git stash"                          worktree on  allow
+expect_primary_guard "primary/off/reset allowed"             "git reset --hard"                   primary  off allow
+expect_primary_guard "primary/off/stash allowed"             "git stash"                          primary  off allow
+
+echo
+echo "summary: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/skills/misc/branch-lock/scripts/tests/lock-store.test.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# Unit test for lib/lock-store.sh (issue #60).
+#
+# Sources the module directly (no globals) and exercises all four entry points
+# against temp lock files:
+#   - write/read round-trip, including a branch name with a slash
+#   - absent file => unlocked (read rc 1, no output; is_locked rc 1)
+#   - clear removes the file and is idempotent
+#   - write is atomic and overwrites (relock to a new target)
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LIB="$(dirname "$HERE")/lib/lock-store.sh"
+
+# shellcheck source=../lib/lock-store.sh
+source "$LIB"
+
+pass=0
+fail=0
+
+expect_eq() {
+  local label="$1" expected="$2" actual="$3"
+  if [[ "$expected" == "$actual" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      expected: %q\n      actual:   %q\n' "$label" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+# ===========================================================================
+# absent file => unlocked
+# ===========================================================================
+tmpdir="$(mktemp -d)"
+lock="$tmpdir/.red/tmp/branch-lock.yaml"
+
+out="$(lock_store_read "$lock")"; rc=$?
+expect_eq "absent/read rc 1"        "1"  "$rc"
+expect_eq "absent/read silent"      ""   "$out"
+lock_store_is_locked "$lock"; rc=$?
+expect_eq "absent/is_locked rc 1"   "1"  "$rc"
+
+# ===========================================================================
+# write / read round-trip (parent dir created, slash branch preserved)
+# ===========================================================================
+lock_store_write "$lock" "feature/branch-lock"; rc=$?
+expect_eq "write/rc 0"              "0"  "$rc"
+expect_eq "write/file exists"       "1"  "$([[ -f "$lock" ]] && echo 1 || echo 0)"
+expect_eq "write/read back"         "feature/branch-lock"  "$(lock_store_read "$lock")"
+lock_store_is_locked "$lock"; rc=$?
+expect_eq "write/is_locked rc 0"    "0"  "$rc"
+# stored content is a single line (no trailing whitespace in the value)
+expect_eq "write/single line"       "1"  "$(wc -l < "$lock" | tr -d ' ')"
+
+# ===========================================================================
+# write overwrites (relock to a new target)
+# ===========================================================================
+lock_store_write "$lock" "main"
+expect_eq "relock/read new target"  "main"  "$(lock_store_read "$lock")"
+
+# missing arg => rc 2, file untouched
+lock_store_write "$lock" "" 2>/dev/null; rc=$?
+expect_eq "write/missing branch rc 2" "2"  "$rc"
+expect_eq "write/untouched after bad" "main" "$(lock_store_read "$lock")"
+
+# ===========================================================================
+# clear removes the file and is idempotent
+# ===========================================================================
+lock_store_clear "$lock"; rc=$?
+expect_eq "clear/rc 0"              "0"  "$rc"
+expect_eq "clear/file gone"         "0"  "$([[ -f "$lock" ]] && echo 1 || echo 0)"
+lock_store_clear "$lock"; rc=$?
+expect_eq "clear/idempotent rc 0"   "0"  "$rc"
+lock_store_is_locked "$lock"; rc=$?
+expect_eq "clear/is_locked rc 1"    "1"  "$rc"
+
+# ===========================================================================
+# an empty lock file reads as unlocked (defensive: half-written / truncated)
+# ===========================================================================
+mkdir -p "$(dirname "$lock")"; : > "$lock"
+out="$(lock_store_read "$lock")"; rc=$?
+expect_eq "empty/read rc 1"         "1"  "$rc"
+expect_eq "empty/read silent"       ""   "$out"
+
+rm -rf "$tmpdir"
+
+echo
+echo "summary: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]