@sdsrs/code-graph 0.94.0 → 0.95.1

package/claude-plugin/scripts/find-binary.test.js

@@ -1,246 +0,0 @@
-'use strict';
-const test = require('node:test');
-const assert = require('node:assert/strict');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-
-const { globalNodeModulesCandidates, findPlatformBinary, BINARY_NAME,
-        compareVersions, getPackageVersion, isCachedBinaryFresh,
-        unsupportedPlatformHint } = require('./find-binary');
-
-function mkDir(t, prefix) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
-  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
-  return dir;
-}
-
-test('globalNodeModulesCandidates includes derivation from process.execPath', () => {
-  const candidates = globalNodeModulesCandidates();
-  assert.ok(candidates.length > 0, 'at least one candidate path');
-
-  const nodeBinDir = path.dirname(process.execPath);
-  const expected = process.platform === 'win32'
-    ? path.join(nodeBinDir, 'node_modules')
-    : path.resolve(nodeBinDir, '..', 'lib', 'node_modules');
-  assert.ok(candidates.includes(expected), `expected ${expected} in ${JSON.stringify(candidates)}`);
-});
-
-test('globalNodeModulesCandidates honors NPM_CONFIG_PREFIX', (t) => {
-  const original = process.env.NPM_CONFIG_PREFIX;
-  process.env.NPM_CONFIG_PREFIX = '/tmp/fake-npm-prefix';
-  t.after(() => {
-    if (original === undefined) delete process.env.NPM_CONFIG_PREFIX;
-    else process.env.NPM_CONFIG_PREFIX = original;
-  });
-
-  const candidates = globalNodeModulesCandidates();
-  const expected = process.platform === 'win32'
-    ? path.join('/tmp/fake-npm-prefix', 'node_modules')
-    : path.join('/tmp/fake-npm-prefix', 'lib', 'node_modules');
-  assert.ok(candidates.includes(expected),
-    `expected NPM_CONFIG_PREFIX-derived path in candidates: ${JSON.stringify(candidates)}`);
-});
-
-test('globalNodeModulesCandidates dedupes overlapping paths', (t) => {
-  const original = process.env.NPM_CONFIG_PREFIX;
-  // Force NPM_CONFIG_PREFIX to match the execPath-derived prefix
-  const nodeBinDir = path.dirname(process.execPath);
-  const matchedPrefix = process.platform === 'win32'
-    ? nodeBinDir
-    : path.resolve(nodeBinDir, '..');
-  process.env.NPM_CONFIG_PREFIX = matchedPrefix;
-  t.after(() => {
-    if (original === undefined) delete process.env.NPM_CONFIG_PREFIX;
-    else process.env.NPM_CONFIG_PREFIX = original;
-  });
-
-  const candidates = globalNodeModulesCandidates();
-  const seen = new Set();
-  for (const c of candidates) {
-    assert.ok(!seen.has(c), `duplicate candidate: ${c}`);
-    seen.add(c);
-  }
-});
-
-test('findPlatformBinary locates platform pkg in NPM_CONFIG_PREFIX-derived global node_modules', (t) => {
-  // Mirror what `npm install -g` produces for @sdsrs/code-graph-{platform}-{arch}.
-  const fakePrefix = mkDir(t, 'find-binary-test-');
-  const platDir = process.platform === 'win32'
-    ? path.join(fakePrefix, 'node_modules', '@sdsrs', `code-graph-${process.platform}-${process.arch}`)
-    : path.join(fakePrefix, 'lib', 'node_modules', '@sdsrs', `code-graph-${process.platform}-${process.arch}`);
-  fs.mkdirSync(platDir, { recursive: true });
-
-  // Copy node executable so realpathSync(candidate)'s basename === BINARY_NAME
-  // (isNativeBinary check). Plain copy, not symlink, so basename matches.
-  const fakeBinary = path.join(platDir, BINARY_NAME);
-  fs.copyFileSync(process.execPath, fakeBinary);
-  if (process.platform !== 'win32') fs.chmodSync(fakeBinary, 0o755);
-
-  const original = process.env.NPM_CONFIG_PREFIX;
-  process.env.NPM_CONFIG_PREFIX = fakePrefix;
-  t.after(() => {
-    if (original === undefined) delete process.env.NPM_CONFIG_PREFIX;
-    else process.env.NPM_CONFIG_PREFIX = original;
-  });
-
-  const found = findPlatformBinary();
-  assert.equal(found, fakeBinary, `expected ${fakeBinary}, got ${found}`);
-});
-
-test('findPlatformBinary returns null when no platform pkg installed anywhere reachable', (t) => {
-  // Point NPM_CONFIG_PREFIX at an empty dir so global probe cannot match.
-  const fakePrefix = mkDir(t, 'find-binary-empty-');
-  const original = process.env.NPM_CONFIG_PREFIX;
-  process.env.NPM_CONFIG_PREFIX = fakePrefix;
-  t.after(() => {
-    if (original === undefined) delete process.env.NPM_CONFIG_PREFIX;
-    else process.env.NPM_CONFIG_PREFIX = original;
-  });
-
-  // Note: this test only proves the negative if no real install of the platform
-  // package is reachable via require.resolve OR any other candidate path. On a
-  // dev machine that has `@sdsrs/code-graph-linux-x64` installed globally, this
-  // assertion will fail — that's not a defect of the helper but of test setup.
-  // Skip if a real install is detected.
-  const real = findPlatformBinary();
-  if (real && !real.startsWith(fakePrefix)) {
-    t.skip(`real platform pkg installed at ${real}, cannot test the null path here`);
-    return;
-  }
-  assert.equal(real, null);
-});
-
-// ─── compareVersions (B fix: cache version invalidation helper) ───────────
-
-test('compareVersions: equal', () => {
-  assert.equal(compareVersions('1.2.3', '1.2.3'), 0);
-});
-
-test('compareVersions: cache older than pkg', () => {
-  // After `npm update` to 0.16.8, an auto-update cache from 0.16.7 must NOT
-  // shadow the freshly-installed platform-pkg binary. Returns -1 here so
-  // findBinaryUncached falls through to platform-pkg.
-  assert.equal(compareVersions('0.16.7', '0.16.8'), -1);
-});
-
-test('compareVersions: cache newer than pkg', () => {
-  // Auto-update may legitimately be ahead of npm pkg (cache fetched 0.17.0
-  // before npm shipped it). Returns 1 → cache wins.
-  assert.equal(compareVersions('0.17.0', '0.16.8'), 1);
-});
-
-test('compareVersions: minor and patch boundaries', () => {
-  assert.equal(compareVersions('1.0.0', '0.999.999'), 1);
-  assert.equal(compareVersions('1.10.0', '1.9.99'), 1);  // numeric, not lexical
-  assert.equal(compareVersions('1.0.10', '1.0.9'), 1);
-});
-
-test('compareVersions: tolerates non-numeric / short input', () => {
-  // Non-numeric → treated as 0; shorter strings padded with 0.
-  assert.equal(compareVersions('1.2', '1.2.0'), 0);
-  assert.equal(compareVersions('foo', '0.0.0'), 0);
-});
-
-test('getPackageVersion reads root package.json', () => {
-  const v = getPackageVersion();
-  assert.match(v, /^\d+\.\d+\.\d+$/, `expected semver-ish, got: ${v}`);
-});
-
-// ─── isCachedBinaryFresh: disk cache version-check (mem #8454) ────────────
-//
-// Builds a fake binary that responds to `--version` with a controllable
-// string. process.execPath (node itself) won't do — we need a binary
-// whose --version line we control. Smallest approach: shell wrapper.
-
-function buildFakeBinary(t, versionLine) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cgmcp-fake-bin-'));
-  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
-  const binPath = path.join(dir, BINARY_NAME);
-  // readBinaryVersion parses "code-graph-mcp X.Y.Z" via the binary's first
-  // stdout line on `--version`. Shell wrapper is simpler than compiling.
-  const script = process.platform === 'win32'
-    ? `@echo off\r\necho ${versionLine}\r\n`
-    : `#!/bin/sh\necho '${versionLine}'\n`;
-  fs.writeFileSync(binPath, script);
-  if (process.platform !== 'win32') fs.chmodSync(binPath, 0o755);
-  return binPath;
-}
-
-test('isCachedBinaryFresh: cache binary version >= pkg → fresh', (t) => {
-  const bin = buildFakeBinary(t, 'code-graph-mcp 9.9.9');
-  assert.equal(isCachedBinaryFresh(bin, '0.25.0'), true);
-});
-
-test('isCachedBinaryFresh: cache binary version equals pkg → fresh', (t) => {
-  const bin = buildFakeBinary(t, 'code-graph-mcp 0.25.0');
-  assert.equal(isCachedBinaryFresh(bin, '0.25.0'), true);
-});
-
-test('isCachedBinaryFresh: cache binary version < pkg → stale (THE BUG)', (t) => {
-  // Reproduces mem #8454: cache pointed at bin/code-graph-mcp v0.5.28
-  // while pkg was v0.25.0 → cache was returned silently with no
-  // version-check, shadowing the installed 0.25.0 platform binary.
-  // After this fix, returns false → caller clears cache + falls through.
-  const bin = buildFakeBinary(t, 'code-graph-mcp 0.5.28');
-  assert.equal(isCachedBinaryFresh(bin, '0.25.0'), false);
-});
-
-test('isCachedBinaryFresh: missing pkg version → permissive (trust cache)', (t) => {
-  // Caller couldn't read package.json; refusing the cache would leave us
-  // with nothing. Better to trust the one path we have.
-  const bin = buildFakeBinary(t, 'code-graph-mcp 0.5.28');
-  assert.equal(isCachedBinaryFresh(bin, null), true);
-  assert.equal(isCachedBinaryFresh(bin, ''), true);
-});
-
-test('isCachedBinaryFresh: unreadable cache binary version → permissive', (t) => {
-  // Old binary that doesn't support `--version`, or output we can't
-  // parse. Same permissive path as missing pkg version.
-  const bin = buildFakeBinary(t, 'whatever garbage no semver here');
-  assert.equal(isCachedBinaryFresh(bin, '0.25.0'), true);
-});
-
-test('isCachedBinaryFresh: cache path does not exist → not fresh', () => {
-  assert.equal(isCachedBinaryFresh('/nonexistent/path/code-graph-mcp', '0.25.0'), false);
-});
-
-test('isCachedBinaryFresh: empty/null cache path → not fresh', () => {
-  assert.equal(isCachedBinaryFresh('', '0.25.0'), false);
-  assert.equal(isCachedBinaryFresh(null, '0.25.0'), false);
-  assert.equal(isCachedBinaryFresh(undefined, '0.25.0'), false);
-});
-
-test('isCachedBinaryFresh: file basename mismatch → not fresh', (t) => {
-  // realpathSync.basename check inside isNativeBinary — wrong name = not ours.
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cgmcp-wrongname-'));
-  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
-  const wrongName = path.join(dir, 'other-tool');
-  fs.writeFileSync(wrongName, '#!/bin/sh\necho wrong\n');
-  if (process.platform !== 'win32') fs.chmodSync(wrongName, 0o755);
-  assert.equal(isCachedBinaryFresh(wrongName, '0.25.0'), false);
-});
-
-// ── unsupportedPlatformHint (actionable message for tails with no prebuilt binary) ──
-
-test('unsupportedPlatformHint flags Alpine/musl with a source/glibc-image hint', () => {
-  const hint = unsupportedPlatformHint('linux', 'x64', 'musl');
-  assert.ok(hint, 'musl should produce a hint');
-  assert.match(hint, /musl|Alpine/);
-  assert.match(hint, /cargo install/);
-});
-
-test('unsupportedPlatformHint flags native Windows-on-ARM with emulation/source hint', () => {
-  const hint = unsupportedPlatformHint('win32', 'arm64', 'glibc');
-  assert.ok(hint, 'win32-arm64 should produce a hint');
-  assert.match(hint, /Windows on ARM|arm64/);
-  assert.match(hint, /x64|cargo install/);
-});
-
-test('unsupportedPlatformHint returns null for supported platforms', () => {
-  assert.equal(unsupportedPlatformHint('linux', 'x64', 'glibc'), null);
-  assert.equal(unsupportedPlatformHint('linux', 'arm64', 'glibc'), null);
-  assert.equal(unsupportedPlatformHint('darwin', 'arm64', 'glibc'), null);
-  assert.equal(unsupportedPlatformHint('darwin', 'x64', 'glibc'), null);
-  assert.equal(unsupportedPlatformHint('win32', 'x64', 'glibc'), null);
-});

package/claude-plugin/scripts/hook-fire.test.js

@@ -1,117 +0,0 @@
-'use strict';
-// Layer-A "does the hook really fire" smoke test (v0.67.0). Distinct from
-// hooks.test.js (which inspects registration STRINGS) and the per-hook unit
-// tests (which import predicates): this spawns each REGISTERED hook script the
-// way Claude Code would — node + a synthetic CC stdin payload — and asserts it
-// runs end-to-end without erroring. Catches the "registered but inert on this
-// machine" class (broken require-chain, node-version, corrupt install) that
-// string/predicate tests can't see. See feedback_pretooluse_dark_under_green_health.md.
-const test = require('node:test');
-const assert = require('node:assert/strict');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { spawnSync } = require('child_process');
-const { verifyHooksFire } = require('./lifecycle');
-const { hookFireWarning, analyzeHookDark } = require('./session-init');
-
-test('verifyHooksFire: all real registered hooks run cleanly (exit 0)', () => {
-  const { ok, results } = verifyHooksFire();
-  // 3 PreToolUse + 2 PostToolUse (incremental-index + compound-grep inject) + 1 UserPromptSubmit = 6 settings.json hooks
-  assert.ok(results.length >= 6, `expected >=6 hook probes, got ${results.length}`);
-  for (const r of results) {
-    assert.ok(r.ok, `hook ${r.label} (${r.script}) did not fire cleanly: code=${r.code} err=${r.error}`);
-  }
-  assert.equal(ok, true);
-});
-
-test('verifyHooksFire: the grep hook actually engages (emits a decision)', () => {
-  const { results } = verifyHooksFire();
-  const grep = results.find(r => /pre-grep-guide/.test(r.script));
-  assert.ok(grep, 'no grep hook probe found');
-  assert.ok(grep.emitted,
-    'pre-grep-guide produced no output on an engaging grep payload — the firing path did not engage');
-});
-
-test('verifyHooksFire: reports a broken hook script (teeth)', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cg-hookfire-teeth-'));
-  const broken = path.join(dir, 'broken-hook.js');
-  fs.writeFileSync(broken, 'throw new Error("boom at runtime");\n');
-  try {
-    const { ok, results } = verifyHooksFire({ hooks: [{ label: 'broken', script: broken, payload: {} }] });
-    assert.equal(ok, false, 'a hook that throws must make ok=false');
-    assert.equal(results[0].ok, false);
-  } finally {
-    fs.rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test('verifyHooksFire: missing hook script is reported, not thrown (teeth)', () => {
-  const { ok, results } = verifyHooksFire({
-    hooks: [{ label: 'gone', script: path.join(os.tmpdir(), 'definitely-not-here-xyz.js'), payload: {} }],
-  });
-  assert.equal(ok, false);
-  assert.equal(results[0].ok, false);
-});
-
-// ── Layer A surface: hookFireWarning (pure interpreter of cached state) ──
-
-test('hookFireWarning: ok / absent state → no warning', () => {
-  assert.equal(hookFireWarning({ ok: true, failures: [] }), null);
-  assert.equal(hookFireWarning(null), null);
-  assert.equal(hookFireWarning({ ok: false, failures: [] }), null); // no names → nothing to say
-});
-
-test('hookFireWarning: failed state names the failed hook + points to doctor', () => {
-  const w = hookFireWarning({ ok: false, failures: ['PreToolUse:Bash'] });
-  assert.match(w, /PreToolUse:Bash/);
-  assert.match(w, /doctor/);
-});
-
-// ── Layer B dispatch canary: analyzeHookDark (pure) ──
-
-test('analyzeHookDark: edit fires repeatedly but grep/read never → warns', () => {
-  const lines = ['{"hook":"edit"}', '{"hook":"edit"}', '{"hook":"edit"}'].join('\n');
-  assert.match(analyzeHookDark(lines), /grep\/read/);
-});
-
-test('analyzeHookDark: any grep/read event present → no warning', () => {
-  const lines = ['{"hook":"edit"}', '{"hook":"edit"}', '{"hook":"edit"}', '{"hook":"read","action":"observe"}'].join('\n');
-  assert.equal(analyzeHookDark(lines), null);
-});
-
-test('analyzeHookDark: below the edit threshold / empty → no warning (low false-positive)', () => {
-  assert.equal(analyzeHookDark('{"hook":"edit"}\n{"hook":"edit"}'), null);
-  assert.equal(analyzeHookDark(''), null);
-  assert.equal(analyzeHookDark('garbage\n{not json}'), null);
-});
-
-// ── CLI wiring: `lifecycle.js verify-hooks-fire` writes the state file ──
-
-test('CLI verify-hooks-fire runs and writes hook-fire-state.json (HOME-redirected)', () => {
-  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'cg-hf-home-'));
-  try {
-    const r = spawnSync(process.execPath, [path.join(__dirname, 'lifecycle.js'), 'verify-hooks-fire'], {
-      env: { ...process.env, HOME: home }, encoding: 'utf8', timeout: 30000,
-    });
-    assert.equal(r.status, 0, `CLI exit ${r.status}: ${r.stderr}`);
-    assert.match(r.stdout, /Hook firing: (OK|FAIL)/);
-    const statePath = path.join(home, '.cache', 'code-graph', 'hook-fire-state.json');
-    assert.ok(fs.existsSync(statePath), 'hook-fire-state.json was not written');
-    const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
-    assert.equal(typeof state.ok, 'boolean');
-    assert.ok(state.ts, 'state missing timestamp');
-  } finally {
-    fs.rmSync(home, { recursive: true, force: true });
-  }
-});
-
-// ── doctor wiring: runDiagnostics surfaces a "Hook firing" check ──
-
-test('doctor runDiagnostics includes a Hook firing check', () => {
-  const { runDiagnostics } = require('./doctor');
-  const results = runDiagnostics();
-  const hf = results.find(r => r.name === 'Hook firing');
-  assert.ok(hf, 'doctor did not report a "Hook firing" check');
-  assert.ok(['ok', 'warn'].includes(hf.status), `unexpected status ${hf.status}`);
-});

package/claude-plugin/scripts/hooks.test.js

@@ -1,230 +0,0 @@
-'use strict';
-const test = require('node:test');
-const assert = require('node:assert/strict');
-const fs = require('fs');
-const path = require('path');
-const { execFileSync } = require('child_process');
-
-// Regression gate for v0.31.1: hooks.json matchers must be Claude Code's
-// literal/regex form, NOT the expression DSL `tool == "X"`. The earlier
-// matchers parsed as regex against tool names, never matched anything,
-// and left every PreToolUse hook silently inert from v0.25.0 through
-// v0.31.0. The bug was invisible to the existing unit tests because they
-// spawn the hook scripts directly via stdin, bypassing Claude Code's
-// matcher dispatch.
-
-const HOOKS_JSON = path.resolve(__dirname, '..', 'hooks', 'hooks.json');
-
-function loadHooks() {
-  const raw = fs.readFileSync(HOOKS_JSON, 'utf8');
-  return JSON.parse(raw);
-}
-
-function* iterMatchers(hooksByEvent) {
-  for (const [event, entries] of Object.entries(hooksByEvent || {})) {
-    if (!Array.isArray(entries)) continue;
-    for (let i = 0; i < entries.length; i++) {
-      const e = entries[i];
-      yield { event, idx: i, matcher: e && e.matcher };
-    }
-  }
-}
-
-test('hooks.json: file parses as JSON', () => {
-  assert.doesNotThrow(loadHooks);
-});
-
-test('hooks.json: every entry has a string matcher', () => {
-  const cfg = loadHooks();
-  let count = 0;
-  for (const { event, idx, matcher } of iterMatchers(cfg.hooks)) {
-    assert.equal(typeof matcher, 'string',
-      `hooks.${event}[${idx}].matcher should be a string, got ${typeof matcher}`);
-    count++;
-  }
-  assert.ok(count > 0, 'expected at least one matcher in hooks.json');
-});
-
-// The actual regression gate. Each banned token reflects a specific
-// failure mode we hit and want to keep out forever.
-const BANNED_TOKENS = [
-  // The original v0.25.0 → v0.31.0 bug: expression-style matcher treated
-  // as regex against tool name → never matched.
-  { token: '==', why: 'expression DSL (e.g. `tool == "Edit"`) is not supported; use literal tool name' },
-  // `tool ==` or `tool name == "X"` — same family, different spelling.
-  { token: 'tool ', why: 'expression DSL with `tool` variable is not supported' },
-  // Boolean ORs as expression operators (regex uses `|`, not `||`).
-  { token: '||', why: 'use `|` for pipe-list (e.g. `Write|Edit`), not `||`' },
-  // Boolean AND has no meaning in tool-name matching.
-  { token: '&&', why: '`&&` has no meaning in matchers' },
-  // Double-quotes inside the matcher are a strong hint of expression DSL
-  // (the broken syntax was `"tool == \"Edit\""`).
-  { token: '"', why: 'literal double-quote in matcher is almost always a copy-paste of expression DSL' },
-];
-
-test('hooks.json: matchers avoid banned expression-DSL tokens', () => {
-  const cfg = loadHooks();
-  const offenders = [];
-  for (const { event, idx, matcher } of iterMatchers(cfg.hooks)) {
-    for (const { token, why } of BANNED_TOKENS) {
-      if (matcher.includes(token)) {
-        offenders.push(`hooks.${event}[${idx}].matcher = ${JSON.stringify(matcher)} — contains banned ${JSON.stringify(token)} (${why})`);
-      }
-    }
-  }
-  assert.deepEqual(offenders, [],
-    'hooks.json matcher syntax regression — see v0.31.1 CHANGELOG:\n  ' + offenders.join('\n  '));
-});
-
-// v0.32.0 architecture: plugin-cache hooks.json ONLY carries SessionStart.
-// PreToolUse / PostToolUse / UserPromptSubmit are registered into
-// ~/.claude/settings.json by lifecycle.js (current Claude Code silently
-// ignores plugin-cache hooks.json entries for those events — confirmed
-// 2026-05-24 via session jsonl, see feedback_pretooluse_dark_under_green_health.md).
-test('hooks.json: contains SessionStart only (v0.32.0)', () => {
-  const cfg = loadHooks();
-  assert.deepEqual(Object.keys(cfg.hooks || {}), ['SessionStart'],
-    'plugin-cache hooks.json must contain only SessionStart; other events go via settings.json. ' +
-    'Adding entries here for PreToolUse/PostToolUse/UserPromptSubmit would be dead config — CC does not load them.');
-});
-
-test('hooks.json: SessionStart wires session-init.js', () => {
-  const cfg = loadHooks();
-  const entries = (cfg.hooks && cfg.hooks.SessionStart) || [];
-  assert.ok(entries.length > 0, 'SessionStart entry missing');
-  const cmd = entries[0].hooks && entries[0].hooks[0] && entries[0].hooks[0].command;
-  assert.match(cmd || '', /session-init\.js/);
-});
-
-// Cross-validate that lifecycle.js's buildSettingsHookEntries covers the
-// matchers we removed from hooks.json — keeps the migration whole. If a
-// future refactor accidentally drops a matcher in one place, this fails.
-test('lifecycle.buildSettingsHookEntries covers PreToolUse Edit/Bash/Read', () => {
-  const { buildSettingsHookEntries } = require('./lifecycle');
-  const desired = buildSettingsHookEntries();
-  const ptu = (desired.PreToolUse || []).map(e => e.matcher);
-  for (const tool of ['Edit', 'Bash', 'Read']) {
-    assert.ok(ptu.includes(tool), `lifecycle.js PreToolUse missing matcher: ${tool}; got ${JSON.stringify(ptu)}`);
-  }
-});
-
-test('lifecycle.buildSettingsHookEntries covers PostToolUse Write|Edit + UserPromptSubmit', () => {
-  const { buildSettingsHookEntries } = require('./lifecycle');
-  const desired = buildSettingsHookEntries();
-  const postMatchers = (desired.PostToolUse || []).map(e => e.matcher);
-  assert.ok(postMatchers.some(m => m === 'Write|Edit'),
-    `PostToolUse must have 'Write|Edit' matcher; got ${JSON.stringify(postMatchers)}`);
-  const upsMatchers = (desired.UserPromptSubmit || []).map(e => e.matcher);
-  assert.ok(upsMatchers.length > 0, 'UserPromptSubmit must have at least one matcher');
-});
-
-test('lifecycle.buildSettingsHookEntries: every entry carries description marker', () => {
-  // Description marker is the primary cleanup discriminator (immune to
-  // path/env pollution per feedback_plugin_env_isolation.md). If an entry
-  // lacks a description, isOurHookEntry falls back to path-fragment match
-  // which is less reliable. Force every entry to have one.
-  const { buildSettingsHookEntries } = require('./lifecycle');
-  const desired = buildSettingsHookEntries();
-  for (const [event, entries] of Object.entries(desired)) {
-    for (let i = 0; i < entries.length; i++) {
-      assert.ok(entries[i].description && entries[i].description.includes('[code-graph-mcp'),
-        `${event}[${i}] missing or malformed description marker`);
-    }
-  }
-});
-
-test('lifecycle.buildSettingsHookEntries: hook commands use absolute paths (no env vars)', () => {
-  // settings.json hook commands run with env pollution risk
-  // (feedback_plugin_env_isolation.md). Paths MUST be absolute, derived
-  // from __dirname, never from ${CLAUDE_PLUGIN_ROOT}.
-  const { buildSettingsHookEntries } = require('./lifecycle');
-  const desired = buildSettingsHookEntries();
-  for (const entries of Object.values(desired)) {
-    for (const e of entries) {
-      for (const h of e.hooks) {
-        assert.ok(!h.command.includes('${CLAUDE_PLUGIN_ROOT}'),
-          `command must not use \${CLAUDE_PLUGIN_ROOT}: ${h.command}`);
-        assert.ok(h.command.startsWith('node "/') || h.command.match(/node "[A-Z]:\\/),
-          `command path must be absolute: ${h.command}`);
-      }
-    }
-  }
-});
-
-// v0.67.0 hook-reliability Layer 1 (static firing invariants):
-// The tests above inspect matcher STRINGS but never the target script file. A
-// renamed/typo'd/moved hook script makes Claude Code unable to run it → the hook
-// is SILENTLY inert (the "dark hook" class — feedback_pretooluse_dark_under_green_health.md).
-// This collects every script CC will actually load — both registration channels —
-// and asserts each exists and parses. Cheapest possible guard against silent dark.
-const PLUGIN_ROOT = path.resolve(__dirname, '..'); // claude-plugin/
-
-function resolveHookScript(cmd) {
-  // command form: node "<path>"  (<path> may contain ${CLAUDE_PLUGIN_ROOT})
-  const m = (cmd || '').match(/"([^"]+\.js)"/);
-  return m ? m[1].replace('${CLAUDE_PLUGIN_ROOT}', PLUGIN_ROOT) : null;
-}
-
-function allRegisteredHookCommands() {
-  const commands = [];
-  // (1) settings.json side — lifecycle.buildSettingsHookEntries (PreToolUse/PostToolUse/UserPromptSubmit)
-  const { buildSettingsHookEntries } = require('./lifecycle');
-  for (const entries of Object.values(buildSettingsHookEntries())) {
-    for (const e of entries) for (const h of e.hooks || []) commands.push(h.command);
-  }
-  // (2) plugin-cache hooks.json side — SessionStart (the only event CC loads from here)
-  for (const entries of Object.values(loadHooks().hooks || {})) {
-    if (!Array.isArray(entries)) continue;
-    for (const e of entries) for (const h of e.hooks || []) commands.push(h.command);
-  }
-  return commands;
-}
-
-test('every registered hook script exists on disk', () => {
-  const commands = allRegisteredHookCommands();
-  // 3 PreToolUse + 2 PostToolUse (incremental-index + compound-grep inject) + 1 UserPromptSubmit + 1 SessionStart = 7
-  assert.ok(commands.length >= 7, `expected >=7 registered hook commands, got ${commands.length}`);
-  for (const cmd of commands) {
-    const p = resolveHookScript(cmd);
-    assert.ok(p, `could not extract a .js path from hook command: ${JSON.stringify(cmd)}`);
-    assert.ok(fs.existsSync(p),
-      `hook script missing on disk: ${p}\n  (from command ${JSON.stringify(cmd)})\n` +
-      `  A renamed/typo'd/moved script makes the hook silently inert — Claude Code cannot run a missing file.`);
-  }
-});
-
-test('every registered hook script parses (node --check)', () => {
-  for (const cmd of allRegisteredHookCommands()) {
-    const p = resolveHookScript(cmd);
-    assert.doesNotThrow(
-      () => execFileSync(process.execPath, ['--check', p], { stdio: 'pipe' }),
-      `hook script has a syntax error (node --check failed): ${p}`);
-  }
-});
-
-// Pin the EXACT matcher surface, not just "covers". The earlier tests assert the
-// set INCLUDES Edit/Bash/Read etc.; this asserts it EQUALS the intended set, so
-// adding/dropping a matcher must update this test — a deliberate decision, never a
-// silent coverage drift. A PreToolUse hook fires only on the literal tool name.
-// Deliberate exclusions (verified 2026-06-23; revisit if either premise changes):
-//   - MultiEdit: NOT a tool in current Claude Code (absent from the tool surface;
-//     the plugin targets recent CC per the v0.32.0 settings.json architecture), so
-//     a matcher for it would be dead config. Re-add only if CC (re)introduces it.
-//   - NotebookEdit: a real tool, but code-graph does NOT parse .ipynb (no jupyter
-//     support in the parser / supported-language set), so both pre-edit-guide
-//     (needs graph symbols) and incremental-index (needs to re-index the file)
-//     would no-op on a notebook. Prerequisite is .ipynb PARSING support (a parser
-//     feature); add the matcher as PART of that work, never before it.
-test('buildSettingsHookEntries: matcher surface is exactly the intended set', () => {
-  const { buildSettingsHookEntries } = require('./lifecycle');
-  const desired = buildSettingsHookEntries();
-  const setOf = (event) => (desired[event] || []).map(e => e.matcher).sort();
-  assert.deepEqual(setOf('PreToolUse'), ['Bash', 'Edit', 'Read'],
-    'PreToolUse matcher set changed — update this gate intentionally (does the new tool need a guide hook?)');
-  assert.deepEqual(setOf('PostToolUse'), ['Bash', 'Write|Edit'],
-    'PostToolUse matcher set changed — incremental-index (Write|Edit) + compound-grep inject (Bash) trigger surface must be deliberate');
-  assert.deepEqual(setOf('UserPromptSubmit'), [''],
-    'UserPromptSubmit matcher set changed unexpectedly');
-  assert.deepEqual(Object.keys(desired).sort(), ['PostToolUse', 'PreToolUse', 'UserPromptSubmit'],
-    'a new top-level hook event is registered into settings.json — confirm it is intended (SessionStart belongs in hooks.json)');
-});