@reddb-io/red-skills 4.4.1 → 4.6.0

package/runtime/plugins/dev/skills/misc/branch-lock/scripts/tests/git-command-classifier.test.sh

@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+# Unit test for lib/git-command-classifier.sh (issue #60).
+#
+# Locked to "main", verifies the minimal classifier:
+#   block  — checkout/switch to a branch other than the lock target
+#   allow  — switching back to the lock target, file-level `checkout -- <path>`,
+#            bare checkout, `git worktree add`, and non-git/non-checkout commands
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LIB="$(dirname "$HERE")/lib/git-command-classifier.sh"
+
+# shellcheck source=../lib/git-command-classifier.sh
+source "$LIB"
+
+pass=0
+fail=0
+
+expect_verdict() {
+  local label="$1" lock="$2" cmd="$3" expected="$4"
+  local actual; actual="$(classify_git_command "$lock" "$cmd")"
+  if [[ "$actual" == "$expected" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      cmd:      %q\n      expected: %q\n      actual:   %q\n' \
+      "$label" "$cmd" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+LOCK="main"
+
+# ===========================================================================
+# BLOCK — leaving the locked branch
+# ===========================================================================
+expect_verdict "block/checkout other"        "$LOCK" "git checkout feature"          "block"
+expect_verdict "block/switch other"          "$LOCK" "git switch feature"            "block"
+expect_verdict "block/checkout slash branch" "$LOCK" "git checkout feature/x"        "block"
+expect_verdict "block/checkout -b new"       "$LOCK" "git checkout -b shiny"         "block"
+expect_verdict "block/switch -c new"         "$LOCK" "git switch -c shiny"           "block"
+expect_verdict "block/switch dash previous"  "$LOCK" "git switch -"                  "block"
+expect_verdict "block/compound command"      "$LOCK" "cd repo && git checkout other" "block"
+expect_verdict "block/checkout --track"      "$LOCK" "git checkout --track origin/x" "block"
+
+# global options before the subcommand must not bypass the lock
+expect_verdict "block/-C path checkout"      "$LOCK" "git -C /repo checkout other"   "block"
+expect_verdict "block/-C path switch"        "$LOCK" "git -C /repo switch other"      "block"
+expect_verdict "block/-C path checkout -b"   "$LOCK" "git -C /repo checkout -b shiny" "block"
+expect_verdict "block/-c config checkout"    "$LOCK" "git -c core.x=1 checkout other" "block"
+expect_verdict "block/--git-dir eq switch"   "$LOCK" "git --git-dir=/r/.git switch o" "block"
+expect_verdict "block/--git-dir arg switch"  "$LOCK" "git --git-dir /r/.git switch o" "block"
+expect_verdict "block/--no-pager checkout"   "$LOCK" "git --no-pager checkout other"  "block"
+expect_verdict "block/-C compound"           "$LOCK" "cd x && git -C /r checkout other" "block"
+expect_verdict "block/-C reset --hard"       "$LOCK" "git -C /repo reset --hard"      "block"
+expect_verdict "block/-C stash"              "$LOCK" "git -C /repo stash"             "block"
+
+# ===========================================================================
+# ALLOW — same-branch / legitimate operations
+# ===========================================================================
+expect_verdict "allow/checkout lock target"  "$LOCK" "git checkout main"             "allow"
+expect_verdict "allow/switch lock target"    "$LOCK" "git switch main"               "allow"
+expect_verdict "allow/file restore --"       "$LOCK" "git checkout -- src/app.ts"    "allow"
+expect_verdict "allow/file restore -- multi" "$LOCK" "git checkout -- a.txt b.txt"   "allow"
+expect_verdict "allow/bare checkout"         "$LOCK" "git checkout"                   "allow"
+expect_verdict "allow/worktree add"          "$LOCK" "git worktree add ../wt branch" "allow"
+expect_verdict "allow/non-checkout git"      "$LOCK" "git status"                     "allow"
+expect_verdict "allow/non-git command"       "$LOCK" "ls -la"                         "allow"
+expect_verdict "allow/commit"                "$LOCK" "git commit -m wip"              "allow"
+
+# global options before the subcommand: legitimate operations still allowed
+expect_verdict "allow/-C checkout lock"      "$LOCK" "git -C /repo checkout main"     "allow"
+expect_verdict "allow/-C status"             "$LOCK" "git -C /repo status"            "allow"
+expect_verdict "allow/-C file restore"       "$LOCK" "git -C /repo checkout -- a.ts"  "allow"
+expect_verdict "allow/-C worktree add"       "$LOCK" "git -C /repo worktree add ../w" "allow"
+
+# slash lock target: switching back to it is allowed, elsewhere blocked
+expect_verdict "allow/slash lock back"  "feature/x" "git switch feature/x"  "allow"
+expect_verdict "block/slash other"      "feature/x" "git switch feature/y"  "block"
+
+# ===========================================================================
+# BLOCK — the work-loss family (issue #61)
+# ===========================================================================
+expect_verdict "block/stash bare"            "$LOCK" "git stash"                   "block"
+expect_verdict "block/stash push"            "$LOCK" "git stash push"              "block"
+expect_verdict "block/stash push paths"      "$LOCK" "git stash push -m x src/"    "block"
+expect_verdict "block/stash save"            "$LOCK" "git stash save wip"          "block"
+expect_verdict "block/clean -f"              "$LOCK" "git clean -f"                "block"
+expect_verdict "block/clean -fd"             "$LOCK" "git clean -fd"               "block"
+expect_verdict "block/clean -xfd"            "$LOCK" "git clean -xfd"              "block"
+expect_verdict "block/clean --force"         "$LOCK" "git clean --force"           "block"
+expect_verdict "block/reset --hard"          "$LOCK" "git reset --hard"            "block"
+expect_verdict "block/reset --hard HEAD~1"   "$LOCK" "git reset --hard HEAD~1"     "block"
+expect_verdict "block/checkout dot"          "$LOCK" "git checkout ."              "block"
+expect_verdict "block/restore dot"           "$LOCK" "git restore ."              "block"
+expect_verdict "block/checkout dashdash dot"  "$LOCK" "git checkout -- ."          "block"
+expect_verdict "block/family compound"       "$LOCK" "cd repo && git reset --hard" "block"
+
+# ===========================================================================
+# ALLOW — non-destructive members of the same command families
+# ===========================================================================
+expect_verdict "allow/stash list"            "$LOCK" "git stash list"              "allow"
+expect_verdict "allow/stash show"            "$LOCK" "git stash show"              "allow"
+expect_verdict "allow/clean dry-run"         "$LOCK" "git clean -n"                "allow"
+expect_verdict "allow/clean --dry-run"       "$LOCK" "git clean --dry-run"         "allow"
+expect_verdict "allow/reset soft"            "$LOCK" "git reset --soft HEAD~1"     "allow"
+expect_verdict "allow/reset mixed default"   "$LOCK" "git reset HEAD file.txt"     "allow"
+expect_verdict "allow/restore staged"        "$LOCK" "git restore --staged f.txt"  "allow"
+expect_verdict "allow/restore single file"   "$LOCK" "git restore src/app.ts"       "allow"
+
+# ===========================================================================
+# PRIMARY BRANCH GUARD — dev.lock.primary-branch (issue #396 / ADR 0043)
+# Table: command, cwd-is-primary, flag-state => allow/block.
+# ===========================================================================
+expect_primary_guard() {
+  local label="$1" cmd="$2" primary="$3" flag="$4" expected="$5"
+  local actual="allow"
+  if [[ "$primary" == "primary" && "$flag" == "on" ]]; then
+    actual="$(classify_primary_branch_switch_guard "$cmd")"
+  fi
+  if [[ "$actual" == "$expected" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      cmd:      %q\n      primary:  %q\n      flag:     %q\n      expected: %q\n      actual:   %q\n' \
+      "$label" "$cmd" "$primary" "$flag" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+expect_primary_guard "primary/on/switch other blocked"       "git switch other"              primary  on  block
+expect_primary_guard "primary/on/checkout other blocked"     "git checkout other"            primary  on  block
+expect_primary_guard "primary/on/switch -b new blocked"      "git switch -b new"             primary  on  block
+expect_primary_guard "primary/on/checkout -b new blocked"    "git checkout -b new"           primary  on  block
+expect_primary_guard "primary/on/compound switch blocked"    "cd repo && git switch other"   primary  on  block
+expect_primary_guard "primary/on/-C switch blocked"          "git -C /repo switch other"     primary  on  block
+expect_primary_guard "primary/on/-C checkout -b blocked"     "git -C /repo checkout -b new"  primary  on  block
+expect_primary_guard "primary/on/switch dash blocked"        "git switch -"                  primary  on  block
+expect_primary_guard "primary/on/commit allowed"             "git commit -m wip"             primary  on  allow
+expect_primary_guard "primary/on/worktree add allowed"       "git worktree add ../wt other"  primary  on  allow
+expect_primary_guard "primary/on/status allowed"             "git status"                    primary  on  allow
+expect_primary_guard "primary/on/checkout path allowed"      "git checkout -- src/app.ts"    primary  on  allow
+expect_primary_guard "primary/on/checkout dot allowed"       "git checkout ."                primary  on  allow
+expect_primary_guard "primary/off/switch allowed"            "git switch other"              primary  off allow
+expect_primary_guard "worktree/on/switch allowed"            "git switch other"              worktree on  allow
+expect_primary_guard "worktree/off/switch allowed"           "git switch other"              worktree off allow
+
+# ---------------------------------------------------------------------------
+# issue #1024: block git reset (any form) and git stash (all subcommands),
+# plus git rebase --autostash, in the primary checkout. Parallel human WIP
+# lives there; these commands have destroyed in-progress work before.
+# ---------------------------------------------------------------------------
+expect_primary_guard "primary/on/reset bare blocked"         "git reset"                          primary  on  block
+expect_primary_guard "primary/on/reset --hard blocked"       "git reset --hard"                   primary  on  block
+expect_primary_guard "primary/on/reset --hard HEAD~1 blocked" "git reset --hard HEAD~1"           primary  on  block
+expect_primary_guard "primary/on/reset --soft blocked"       "git reset --soft HEAD~1"            primary  on  block
+expect_primary_guard "primary/on/reset --mixed blocked"      "git reset --mixed"                  primary  on  block
+expect_primary_guard "primary/on/reset pathspec blocked"     "git reset HEAD file.txt"            primary  on  block
+expect_primary_guard "primary/on/-C reset blocked"           "git -C /repo reset --hard"          primary  on  block
+expect_primary_guard "primary/on/compound reset blocked"     "cd repo && git reset --hard"        primary  on  block
+
+expect_primary_guard "primary/on/stash bare blocked"         "git stash"                          primary  on  block
+expect_primary_guard "primary/on/stash push blocked"         "git stash push"                     primary  on  block
+expect_primary_guard "primary/on/stash push paths blocked"   "git stash push -m x src/"           primary  on  block
+expect_primary_guard "primary/on/stash save blocked"         "git stash save wip"                 primary  on  block
+expect_primary_guard "primary/on/stash pop blocked"          "git stash pop"                      primary  on  block
+expect_primary_guard "primary/on/stash apply blocked"        "git stash apply"                    primary  on  block
+expect_primary_guard "primary/on/stash list blocked"         "git stash list"                     primary  on  block
+expect_primary_guard "primary/on/stash show blocked"         "git stash show"                     primary  on  block
+expect_primary_guard "primary/on/-C stash blocked"           "git -C /repo stash"                 primary  on  block
+
+expect_primary_guard "primary/on/rebase autostash blocked"   "git rebase --autostash"             primary  on  block
+expect_primary_guard "primary/on/rebase autostash arg blocked" "git rebase --autostash origin/main" primary on block
+expect_primary_guard "primary/on/rebase main autostash blocked" "git rebase main --autostash"     primary  on  block
+
+# rebase without --autostash is not the work-loss vector this rule targets
+expect_primary_guard "primary/on/rebase plain allowed"       "git rebase main"                    primary  on  allow
+expect_primary_guard "primary/on/rebase --no-autostash allowed" "git rebase --no-autostash main"  primary  on  allow
+
+# worktrees stay exempt (scope), flag-off stays inert — for reset/stash too
+expect_primary_guard "worktree/on/reset allowed"             "git reset --hard"                   worktree on  allow
+expect_primary_guard "worktree/on/stash allowed"             "git stash"                          worktree on  allow
+expect_primary_guard "primary/off/reset allowed"             "git reset --hard"                   primary  off allow
+expect_primary_guard "primary/off/stash allowed"             "git stash"                          primary  off allow
+
+echo
+echo "summary: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/runtime/plugins/dev/skills/misc/branch-lock/scripts/tests/lock-store.test.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# Unit test for lib/lock-store.sh (issue #60).
+#
+# Sources the module directly (no globals) and exercises all four entry points
+# against temp lock files:
+#   - write/read round-trip, including a branch name with a slash
+#   - absent file => unlocked (read rc 1, no output; is_locked rc 1)
+#   - clear removes the file and is idempotent
+#   - write is atomic and overwrites (relock to a new target)
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LIB="$(dirname "$HERE")/lib/lock-store.sh"
+
+# shellcheck source=../lib/lock-store.sh
+source "$LIB"
+
+pass=0
+fail=0
+
+expect_eq() {
+  local label="$1" expected="$2" actual="$3"
+  if [[ "$expected" == "$actual" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      expected: %q\n      actual:   %q\n' "$label" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+# ===========================================================================
+# absent file => unlocked
+# ===========================================================================
+tmpdir="$(mktemp -d)"
+lock="$tmpdir/.red/tmp/branch-lock.yaml"
+
+out="$(lock_store_read "$lock")"; rc=$?
+expect_eq "absent/read rc 1"        "1"  "$rc"
+expect_eq "absent/read silent"      ""   "$out"
+lock_store_is_locked "$lock"; rc=$?
+expect_eq "absent/is_locked rc 1"   "1"  "$rc"
+
+# ===========================================================================
+# write / read round-trip (parent dir created, slash branch preserved)
+# ===========================================================================
+lock_store_write "$lock" "feature/branch-lock"; rc=$?
+expect_eq "write/rc 0"              "0"  "$rc"
+expect_eq "write/file exists"       "1"  "$([[ -f "$lock" ]] && echo 1 || echo 0)"
+expect_eq "write/read back"         "feature/branch-lock"  "$(lock_store_read "$lock")"
+lock_store_is_locked "$lock"; rc=$?
+expect_eq "write/is_locked rc 0"    "0"  "$rc"
+# stored content is a single line (no trailing whitespace in the value)
+expect_eq "write/single line"       "1"  "$(wc -l < "$lock" | tr -d ' ')"
+
+# ===========================================================================
+# write overwrites (relock to a new target)
+# ===========================================================================
+lock_store_write "$lock" "main"
+expect_eq "relock/read new target"  "main"  "$(lock_store_read "$lock")"
+
+# missing arg => rc 2, file untouched
+lock_store_write "$lock" "" 2>/dev/null; rc=$?
+expect_eq "write/missing branch rc 2" "2"  "$rc"
+expect_eq "write/untouched after bad" "main" "$(lock_store_read "$lock")"
+
+# ===========================================================================
+# clear removes the file and is idempotent
+# ===========================================================================
+lock_store_clear "$lock"; rc=$?
+expect_eq "clear/rc 0"              "0"  "$rc"
+expect_eq "clear/file gone"         "0"  "$([[ -f "$lock" ]] && echo 1 || echo 0)"
+lock_store_clear "$lock"; rc=$?
+expect_eq "clear/idempotent rc 0"   "0"  "$rc"
+lock_store_is_locked "$lock"; rc=$?
+expect_eq "clear/is_locked rc 1"    "1"  "$rc"
+
+# ===========================================================================
+# an empty lock file reads as unlocked (defensive: half-written / truncated)
+# ===========================================================================
+mkdir -p "$(dirname "$lock")"; : > "$lock"
+out="$(lock_store_read "$lock")"; rc=$?
+expect_eq "empty/read rc 1"         "1"  "$rc"
+expect_eq "empty/read silent"       ""   "$out"
+
+rm -rf "$tmpdir"
+
+echo
+echo "summary: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/runtime/plugins/dev/skills/misc/branch-lock/scripts/tests/scope-resolver.test.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Unit test for lib/scope-resolver.sh (issue #60).
+#
+# The lock enforces in the primary checkout and is exempt in registered
+# .red/tmp worktree lanes plus legacy .red/tmp/work-* worktrees. Verifies both
+# scope_is_worktree and its inverse scope_should_enforce across primary roots,
+# worktree roots, and paths nested inside a worktree.
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LIB="$(dirname "$HERE")/lib/scope-resolver.sh"
+
+# shellcheck source=../lib/scope-resolver.sh
+source "$LIB"
+
+pass=0
+fail=0
+
+expect_eq() {
+  local label="$1" expected="$2" actual="$3"
+  if [[ "$expected" == "$actual" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      expected: %q\n      actual:   %q\n' "$label" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+rc_of() { "$@"; echo $?; }
+
+# ===========================================================================
+# primary checkout => enforce (not a worktree)
+# ===========================================================================
+PRIMARY="/home/dev/Work/reddb.io/red-skills"
+expect_eq "primary/is_worktree rc 1"     "1"  "$(rc_of scope_is_worktree "$PRIMARY")"
+expect_eq "primary/should_enforce rc 0"  "0"  "$(rc_of scope_should_enforce "$PRIMARY")"
+
+# a path that merely contains '.red/tmp' but is not a work-* worktree still enforces
+NEAR="/home/dev/Work/reddb.io/red-skills/.red/tmp"
+expect_eq "near/is_worktree rc 1"        "1"  "$(rc_of scope_is_worktree "$NEAR")"
+
+# ===========================================================================
+# registered worktree lane root => exempt
+# ===========================================================================
+WT="/home/dev/Work/reddb.io/red-skills/.red/tmp/worktrees/manual/fix-docs"
+expect_eq "worktree/is_worktree rc 0"    "0"  "$(rc_of scope_is_worktree "$WT")"
+expect_eq "worktree/should_enforce rc 1" "1"  "$(rc_of scope_should_enforce "$WT")"
+
+# legacy .red/tmp/work-* remains exempt during migration
+WTROOT="/home/dev/Work/reddb.io/red-skills/.red/tmp/work-abc-i1"
+expect_eq "worktree-root/is_worktree rc 0" "0" "$(rc_of scope_is_worktree "$WTROOT")"
+
+# ===========================================================================
+# nested path inside a worktree => still exempt
+# ===========================================================================
+NESTED="/home/dev/Work/reddb.io/red-skills/.red/tmp/worktrees/manual/fix-docs/plugins/dev"
+expect_eq "nested/is_worktree rc 0"      "0"  "$(rc_of scope_is_worktree "$NESTED")"
+expect_eq "nested/should_enforce rc 1"   "1"  "$(rc_of scope_should_enforce "$NESTED")"
+
+echo
+echo "summary: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]

package/runtime/plugins/dev/skills/misc/branch-lock/scripts/tests/session-start.test.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Unit test for branch-lock-session-start.sh (issue #62).
+#
+# The SessionStart hook offers — once, at session start — to lock the agent to
+# the current branch. It must:
+#   - emit an instruction (exit 0, JSON on stdout) in the primary checkout when
+#     the branch is unlocked, naming the current branch;
+#   - stay silent (no stdout) inside an /afk worktree (scope exemption);
+#   - stay silent when a lock is already present (nothing to offer);
+#   - stay silent on a detached HEAD (no branch to lock).
+#
+# Exercises the pure decision/text helpers sourced from the hook script, plus an
+# end-to-end run of the hook against throwaway git repos.
+
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+HOOK="$(dirname "$HERE")/branch-lock-session-start.sh"
+
+# Source the script for its pure helpers (the script guards main on direct run).
+# shellcheck source=../branch-lock-session-start.sh
+source "$HOOK"
+
+pass=0
+fail=0
+
+expect_eq() {
+  local label="$1" expected="$2" actual="$3"
+  if [[ "$expected" == "$actual" ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      expected: %q\n      actual:   %q\n' "$label" "$expected" "$actual"
+    fail=$((fail + 1))
+  fi
+}
+
+expect_contains() {
+  local label="$1" needle="$2" haystack="$3"
+  if [[ "$haystack" == *"$needle"* ]]; then
+    echo "PASS  $label"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %s\n      missing: %q\n      in:      %q\n' "$label" "$needle" "$haystack"
+    fail=$((fail + 1))
+  fi
+}
+
+rc_of() { "$@"; echo $?; }
+
+# ===========================================================================
+# session_start_should_prompt <root> <lockfile> <branch>
+#   prompt only when: primary checkout AND unlocked AND a real branch.
+# ===========================================================================
+PRIMARY="/home/dev/Work/reddb.io/red-skills"
+WT="/home/dev/Work/reddb.io/red-skills/.red/tmp/work-abc-i1/worktree"
+ABSENT_LOCK="$(mktemp -u)"   # path that does not exist => unlocked
+
+expect_eq "primary+unlocked+branch => prompt (rc 0)" \
+  "0" "$(rc_of session_start_should_prompt "$PRIMARY" "$ABSENT_LOCK" "main")"
+
+expect_eq "worktree => no prompt (rc 1)" \
+  "1" "$(rc_of session_start_should_prompt "$WT" "$ABSENT_LOCK" "main")"
+
+expect_eq "detached HEAD => no prompt (rc 1)" \
+  "1" "$(rc_of session_start_should_prompt "$PRIMARY" "$ABSENT_LOCK" "HEAD")"
+
+expect_eq "empty branch => no prompt (rc 1)" \
+  "1" "$(rc_of session_start_should_prompt "$PRIMARY" "$ABSENT_LOCK" "")"
+
+PRESENT_LOCK="$(mktemp)"; printf 'main\n' > "$PRESENT_LOCK"
+expect_eq "already locked => no prompt (rc 1)" \
+  "1" "$(rc_of session_start_should_prompt "$PRIMARY" "$PRESENT_LOCK" "feature/x")"
+rm -f "$PRESENT_LOCK"
+
+# ===========================================================================
+# session_start_prompt_text <branch> — names the branch, instructs to ask.
+# ===========================================================================
+TEXT="$(session_start_prompt_text "feature/login")"
+expect_contains "prompt text names the branch" "feature/login" "$TEXT"
+expect_contains "prompt text says to ask the user" "ask" "$TEXT"
+expect_contains "prompt text points at /branch-lock" "/branch-lock" "$TEXT"
+
+# ===========================================================================
+# End-to-end: run the hook against throwaway repos.
+# ===========================================================================
+mk_repo() {
+  local dir="$1"
+  git init -q "$dir"
+  git -C "$dir" config user.email t@t.t
+  git -C "$dir" config user.name t
+  git -C "$dir" commit -q --allow-empty -m init
+}
+
+run_hook() { CLAUDE_PROJECT_DIR="$1" bash "$HOOK" <<<'{"hook_event_name":"SessionStart"}'; }
+
+# primary checkout, unlocked => emits JSON with additionalContext naming branch
+TMP_PRIMARY="$(mktemp -d)/red-skills"
+mk_repo "$TMP_PRIMARY"
+git -C "$TMP_PRIMARY" branch -m work-branch
+OUT="$(run_hook "$TMP_PRIMARY")"
+expect_contains "e2e primary: emits SessionStart event" "SessionStart" "$OUT"
+expect_contains "e2e primary: names the branch" "work-branch" "$OUT"
+expect_contains "e2e primary: valid additionalContext" "additionalContext" "$OUT"
+if command -v jq >/dev/null 2>&1; then
+  CTX="$(jq -r '.hookSpecificOutput.additionalContext' <<<"$OUT" 2>/dev/null)"
+  expect_contains "e2e primary: JSON parses, branch in context" "work-branch" "$CTX"
+fi
+
+# already locked => silent (empty stdout)
+mkdir -p "$TMP_PRIMARY/.red/tmp"
+printf 'work-branch\n' > "$TMP_PRIMARY/.red/tmp/branch-lock.yaml"
+OUT_LOCKED="$(run_hook "$TMP_PRIMARY")"
+expect_eq "e2e locked: silent" "" "$OUT_LOCKED"
+
+# worktree => silent even when unlocked
+TMP_WT="$(mktemp -d)/red-skills/.red/tmp/work-zzz-i1/worktree"
+mkdir -p "$(dirname "$TMP_WT")"
+mk_repo "$TMP_WT"
+OUT_WT="$(run_hook "$TMP_WT")"
+expect_eq "e2e worktree: silent" "" "$OUT_WT"
+
+echo
+echo "summary: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]