@tyroneross/build-loop 0.30.3

package/hooks/test_rally_point_hooks.sh

@@ -0,0 +1,388 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025-2026 Tyrone Ross, Jr <46267523+tyroneross@users.noreply.github.com>
+# SPDX-License-Identifier: Apache-2.0
+# Fixture-driven tests for the Rally Point hooks:
+#   - session-start-rally-point.sh : one-line restore only on delta,
+#                                    silent + exit 0 otherwise
+#   - pre-edit-rally-point.sh      : cheap revision-stat hint, never blocks
+# Any failure exits non-zero.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(dirname "$SCRIPT_DIR")"
+SS_HOOK="${SCRIPT_DIR}/session-start-rally-point.sh"
+PE_HOOK="${SCRIPT_DIR}/pre-edit-rally-point.sh"
+PKG="${REPO_ROOT}/scripts/rally_point"
+
+PASS=0
+FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1 — $2"; FAIL=$((FAIL + 1)); }
+
+# Build a temp git repo (so channel_paths.app_slug resolves) + isolated
+# apps root.
+REPO=$(mktemp -d)
+APPS=$(mktemp -d)
+( cd "$REPO" && git init -q && git config user.email t@e.com \
+    && git config user.name t )
+export BUILD_LOOP_APPS_ROOT="$APPS"
+export BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1
+export BUILD_LOOP_RALLY_POINT_SKIP_WATCH=1
+
+# ---- Case 1: no channel yet -> SessionStart silent, exit 0 -------------
+OUT=$(CLAUDE_PROJECT_DIR="$REPO" bash "$SS_HOOK" </dev/null 2>/dev/null)
+RC=$?
+if [ "$RC" -eq 0 ] && [ -z "$OUT" ]; then
+  pass "SessionStart silent + exit 0 when no channel"
+else
+  fail "SessionStart no-channel" "rc=$RC out='$OUT'"
+fi
+
+# ---- Case 2: pre-edit never blocks, exit 0, joins and prints when in a repo
+# (the join fires immediately on first tool-use for a git repo with no prior
+# channel — this is the "newly joined" path, not a "no channel = silence" path).
+OUT=$(CLAUDE_PROJECT_DIR="$REPO" bash "$PE_HOOK" </dev/null 2>/dev/null)
+RC=$?
+if [ "$RC" -eq 0 ]; then
+  pass "pre-edit exit 0 when no prior channel (join fires or no-op)"
+else
+  fail "pre-edit no-channel" "rc=$RC out='$OUT'"
+fi
+
+# ---- Seed a delta: write a change + bump revision via the modules -----
+REPO="$REPO" APPS="$APPS" PKG="$PKG" python3 - <<'PYEOF'
+import os, sys
+sys.path.insert(0, os.environ["PKG"])
+import channel_paths as ap, changes as ch, revision as rev, presence as pr
+slug = ap.app_slug(cwd=os.environ["REPO"])
+chan = ap.ensure_channel_dir(slug)
+pr.write_presence(chan, session_id="peerX", tool="codex", model="m",
+                  run_id="rp", app_slug=slug, phase="execute",
+                  files_in_flight=["a.py"])
+ch.append_change(chan, ch.make_record(
+    kind="dep-change", tool="codex", model="m", run_id="rp",
+    app_slug=slug, payload={"manifests": ["package.json"]}, revision=1))
+rev.bump_revision(chan)
+PYEOF
+
+# ---- Case 3: pre-edit prints peer-ahead hint when revision advanced ----
+# Throttle is 60s (default); the Case 2 join wrote a presence record moments
+# ago so the join is throttled — only the hint fires.
+OUT=$(CLAUDE_PROJECT_DIR="$REPO" bash "$PE_HOOK" </dev/null 2>/dev/null)
+RC=$?
+if [ "$RC" -eq 0 ] && echo "$OUT" | grep -q "peer ahead"; then
+  pass "pre-edit prints 'peer ahead' hint when revision advanced"
+else
+  fail "pre-edit hint" "rc=$RC out='$OUT'"
+fi
+
+# ---- Case 4: SessionStart prints exactly one restore line on delta -----
+OUT=$(CLAUDE_PROJECT_DIR="$REPO" bash "$SS_HOOK" </dev/null 2>/dev/null)
+RC=$?
+LINES=$(printf '%s' "$OUT" | grep -c . || true)
+if [ "$RC" -eq 0 ] && [ "$LINES" -eq 1 ] \
+    && echo "$OUT" | grep -q "Rally Point:" \
+    && echo "$OUT" | grep -q "reinstall"; then
+  pass "SessionStart one-line restore on delta"
+else
+  fail "SessionStart restore" "rc=$RC lines=$LINES out='$OUT'"
+fi
+
+# ---- Case 5: SessionStart silent on the SECOND call (cursor advanced) --
+OUT=$(CLAUDE_PROJECT_DIR="$REPO" bash "$SS_HOOK" </dev/null 2>/dev/null)
+RC=$?
+if [ "$RC" -eq 0 ] && [ -z "$OUT" ]; then
+  pass "SessionStart silent after cursor advanced (delta-only)"
+else
+  fail "SessionStart second-call" "rc=$RC out='$OUT'"
+fi
+
+# =========================================================================
+# Codex-parity autojoin tests (2026-06-07)
+# =========================================================================
+
+# Per-repo isolation: ALL new cases write into their own APPS subdir so
+# they cannot read state from the cases above. Use NONREPO + REPO_X.
+NONREPO=$(mktemp -d)
+REPO_X=$(mktemp -d)
+( cd "$REPO_X" && git init -q && git config user.email t@e.com \
+    && git config user.name t )
+APPS2=$(mktemp -d)
+
+# macOS realpath: /var/folders/... -> /private/var/folders/... — the
+# operative-repo resolver runs `git rev-parse --show-toplevel` which
+# returns the resolved form, so compare against that.
+REPO_X_REAL=$(python3 -c "import os,sys; print(os.path.realpath(sys.argv[1]))" "$REPO_X")
+
+# Force a short throttle window so the throttle test does not have to
+# sleep for the full 60s default.
+export BUILD_LOOP_RALLY_PRE_EDIT_THROTTLE_SECONDS=5
+
+# ---- Case 6: SessionStart no-misregister when CLAUDE_PROJECT_DIR unset
+# AND $PWD is not a repo (home-like scenario). The hook must exit 0 and
+# write NOTHING under APPS2.
+BUILD_LOOP_APPS_ROOT="$APPS2" \
+  bash -c "cd '$NONREPO' && unset CLAUDE_PROJECT_DIR && BUILD_LOOP_APPS_ROOT='$APPS2' BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1 BUILD_LOOP_RALLY_POINT_SKIP_WATCH=1 bash '$SS_HOOK'" </dev/null >/tmp/_ss_nonrepo.out 2>/dev/null
+RC=$?
+WROTE=$(find "$APPS2" -type f 2>/dev/null | wc -l | tr -d ' ')
+if [ "$RC" -eq 0 ] && [ "$WROTE" -eq 0 ]; then
+  pass "SessionStart no-misregister when launch cwd is not a repo"
+else
+  fail "SessionStart no-misregister" "rc=$RC wrote=$WROTE out=$(cat /tmp/_ss_nonrepo.out 2>/dev/null)"
+fi
+
+# Reset APPS2 between cases (each new case starts clean).
+rm -rf "$APPS2" && mkdir -p "$APPS2"
+
+# ---- Case 7: pre-edit Edit/Write joins room of the OPERATIVE repo,
+# not the launch dir. We invoke from NONREPO but the file_path lives
+# inside REPO_X. Presence must land under REPO_X's slug.
+EVENT_JSON=$(printf '{"tool_input":{"file_path":"%s/a.py"}}' "$REPO_X")
+BUILD_LOOP_APPS_ROOT="$APPS2" BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1 \
+  bash -c "cd '$NONREPO' && unset CLAUDE_PROJECT_DIR && \
+           printf '%s' '$EVENT_JSON' | \
+           BUILD_LOOP_APPS_ROOT='$APPS2' BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1 \
+           BUILD_LOOP_RALLY_PRE_EDIT_THROTTLE_SECONDS=5 \
+           bash '$PE_HOOK'" >/tmp/_pe_edit.out 2>/dev/null
+RC=$?
+REPO_X_SLUG=$(basename "$REPO_X" | tr '[:upper:]' '[:lower:]')
+PRESENCE_COUNT=$(find "$APPS2" -path "*/$REPO_X_SLUG/sessions/*.json" -type f 2>/dev/null | wc -l | tr -d ' ')
+# Allow normalized slug variants (the slug normalizer maps unsafe chars).
+ANY_PRESENCE=$(find "$APPS2" -path "*/sessions/*.json" -type f 2>/dev/null | wc -l | tr -d ' ')
+if [ "$RC" -eq 0 ] && [ "$ANY_PRESENCE" -ge 1 ]; then
+  # Verify the presence record's cwd points into REPO_X, not NONREPO.
+  CWD_HIT=$(grep -l "\"cwd\":\"$REPO_X_REAL\"" "$APPS2"/*/sessions/*.json 2>/dev/null | head -1)
+  if [ -n "$CWD_HIT" ]; then
+    pass "pre-edit Edit joins operative repo room (not launch dir)"
+  else
+    fail "pre-edit Edit operative-repo cwd" "rc=$RC any_presence=$ANY_PRESENCE files=$(ls "$APPS2"/*/sessions/ 2>/dev/null)"
+  fi
+else
+  fail "pre-edit Edit operative-repo" "rc=$RC any_presence=$ANY_PRESENCE out=$(cat /tmp/_pe_edit.out 2>/dev/null)"
+fi
+
+# Reset between cases.
+rm -rf "$APPS2" && mkdir -p "$APPS2"
+
+# ---- Case 8: pre-edit Bash with leading `cd <repoX>` resolves repoX
+# from the command payload, even when the launch cwd is NONREPO.
+EVENT_JSON=$(printf '{"tool_input":{"command":"cd %s && echo hi"}}' "$REPO_X")
+bash -c "cd '$NONREPO' && unset CLAUDE_PROJECT_DIR && \
+         printf '%s' '$EVENT_JSON' | \
+         BUILD_LOOP_APPS_ROOT='$APPS2' BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1 \
+         BUILD_LOOP_RALLY_PRE_EDIT_THROTTLE_SECONDS=5 \
+         bash '$PE_HOOK'" >/tmp/_pe_bash.out 2>/dev/null
+RC=$?
+ANY_PRESENCE=$(find "$APPS2" -path "*/sessions/*.json" -type f 2>/dev/null | wc -l | tr -d ' ')
+if [ "$RC" -eq 0 ] && [ "$ANY_PRESENCE" -ge 1 ]; then
+  CWD_HIT=$(grep -l "\"cwd\":\"$REPO_X_REAL\"" "$APPS2"/*/sessions/*.json 2>/dev/null | head -1)
+  if [ -n "$CWD_HIT" ]; then
+    pass "pre-edit Bash 'cd <repoX>' resolves operative repo"
+  else
+    fail "pre-edit Bash cwd" "rc=$RC files=$(ls "$APPS2"/*/sessions/ 2>/dev/null)"
+  fi
+else
+  fail "pre-edit Bash operative-repo" "rc=$RC any_presence=$ANY_PRESENCE out=$(cat /tmp/_pe_bash.out 2>/dev/null)"
+fi
+
+# DO NOT reset between Case 8 and Case 9 — Case 9 verifies the throttle
+# blocks a SECOND write within the throttle window.
+
+# ---- Case 9: Throttle: a second rapid tool-use in the same room within
+# the throttle window must NOT write a fresh presence file AND must NOT
+# create a new presence file (each tool-use spawns a fresh python3 PID;
+# a PID-keyed session id would defeat the throttle).
+COUNT_BEFORE=$(find "$APPS2" -path "*/sessions/*.json" -type f 2>/dev/null | wc -l | tr -d ' ')
+PRESENCE_FILE=$(find "$APPS2" -path "*/sessions/*.json" -type f 2>/dev/null | head -1)
+if [ -z "$PRESENCE_FILE" ]; then
+  fail "throttle setup" "no presence file from case 8"
+else
+  MTIME_BEFORE=$(stat -f '%m' "$PRESENCE_FILE" 2>/dev/null || stat -c '%Y' "$PRESENCE_FILE" 2>/dev/null)
+  # Tiny sleep so any rewrite would change mtime (mtime resolution is 1s).
+  sleep 1
+  bash -c "cd '$NONREPO' && unset CLAUDE_PROJECT_DIR && \
+           printf '%s' '$EVENT_JSON' | \
+           BUILD_LOOP_APPS_ROOT='$APPS2' BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1 \
+           BUILD_LOOP_RALLY_PRE_EDIT_THROTTLE_SECONDS=30 \
+           bash '$PE_HOOK'" </dev/null >/dev/null 2>&1
+  COUNT_AFTER=$(find "$APPS2" -path "*/sessions/*.json" -type f 2>/dev/null | wc -l | tr -d ' ')
+  MTIME_AFTER=$(stat -f '%m' "$PRESENCE_FILE" 2>/dev/null || stat -c '%Y' "$PRESENCE_FILE" 2>/dev/null)
+  if [ "$MTIME_BEFORE" = "$MTIME_AFTER" ] && [ "$COUNT_BEFORE" = "$COUNT_AFTER" ]; then
+    pass "pre-edit throttle: no double-write + no new file within window"
+  else
+    fail "pre-edit throttle" "mtime before=$MTIME_BEFORE after=$MTIME_AFTER; count before=$COUNT_BEFORE after=$COUNT_AFTER"
+  fi
+fi
+
+# Reset between cases.
+rm -rf "$APPS2" && mkdir -p "$APPS2"
+
+# ---- Case 10: Fail-open under env -i / minimal PATH. Each changed hook
+# must exit 0 under the Claude Code minimal-PATH simulation, regardless of
+# rally state.
+for HOOK in "$SS_HOOK" "$PE_HOOK"; do
+  RC=$(env -i PATH=/usr/bin:/bin HOME=/tmp \
+       BUILD_LOOP_APPS_ROOT="$APPS2" \
+       BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1 \
+       BUILD_LOOP_RALLY_POINT_SKIP_WATCH=1 \
+       bash "$HOOK" </dev/null >/dev/null 2>&1; echo $?)
+  if [ "$RC" -eq 0 ]; then
+    pass "env -i PATH=/usr/bin:/bin exit 0 ($(basename "$HOOK"))"
+  else
+    fail "minimal-PATH exit 0 ($(basename "$HOOK"))" "rc=$RC"
+  fi
+done
+
+# ---- Case 11: Fail-open when the rally_point package is missing. We
+# point ``PKG`` (via shell-side directory absence check) at a stub root
+# without scripts/rally_point — the hooks must still exit 0 cleanly.
+STUB=$(mktemp -d)
+mkdir -p "$STUB/hooks" "$STUB/scripts"
+cp "$SS_HOOK" "$STUB/hooks/"
+cp "$PE_HOOK" "$STUB/hooks/"
+cp "$SCRIPT_DIR/_session_start_lib.sh" "$STUB/hooks/"
+for HOOK_NAME in session-start-rally-point.sh pre-edit-rally-point.sh; do
+  RC=$(BUILD_LOOP_APPS_ROOT="$APPS2" BUILD_LOOP_RALLY_POINT_SKIP_WATCH=1 \
+       bash "$STUB/hooks/$HOOK_NAME" </dev/null >/dev/null 2>&1; echo $?)
+  if [ "$RC" -eq 0 ]; then
+    pass "fail-open exit 0 when rally_point package missing ($HOOK_NAME)"
+  else
+    fail "fail-open missing-package ($HOOK_NAME)" "rc=$RC"
+  fi
+done
+
+# =========================================================================
+# New tests: status line, quiet flag, 64KB cap, socket hostname, cd guard
+# =========================================================================
+
+# ---- Case 12: visible status line "rally: joined <slug> room" prints on
+# real join (throttle window set to 0 so the write always fires).
+APPS3=$(mktemp -d)
+REPO_Y=$(mktemp -d)
+( cd "$REPO_Y" && git init -q && git config user.email t@e.com && git config user.name t )
+EVENT_JSON_Y=$(printf '{"tool_input":{"file_path":"%s/z.py"}}' "$REPO_Y")
+OUT=$(printf '%s' "$EVENT_JSON_Y" | \
+      BUILD_LOOP_APPS_ROOT="$APPS3" \
+      BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1 \
+      BUILD_LOOP_RALLY_PRE_EDIT_THROTTLE_SECONDS=0 \
+      CLAUDE_PROJECT_DIR="$REPO_Y" \
+      bash "$PE_HOOK" 2>/dev/null)
+RC=$?
+if [ "$RC" -eq 0 ] && echo "$OUT" | grep -q "rally: joined"; then
+  pass "visible status: 'rally: joined <slug> room' prints on real join"
+else
+  fail "visible status: join line missing" "rc=$RC out='$OUT'"
+fi
+
+# ---- Case 13: status line is SILENT when throttled (write was skipped).
+# Reuse APPS3 / REPO_Y from case 12; presence file is fresh, so the
+# throttle (30s) blocks the write AND the status print.
+OUT=$(printf '%s' "$EVENT_JSON_Y" | \
+      BUILD_LOOP_APPS_ROOT="$APPS3" \
+      BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1 \
+      BUILD_LOOP_RALLY_PRE_EDIT_THROTTLE_SECONDS=30 \
+      CLAUDE_PROJECT_DIR="$REPO_Y" \
+      bash "$PE_HOOK" 2>/dev/null)
+RC=$?
+if [ "$RC" -eq 0 ] && ! echo "$OUT" | grep -q "rally: joined"; then
+  pass "visible status: silent when throttled (no double-print)"
+else
+  fail "visible status: spurious join line when throttled" "rc=$RC out='$OUT'"
+fi
+
+# ---- Case 14: BUILD_LOOP_RALLY_QUIET=1 suppresses the status line even
+# on a real join (throttle=0 so a write would fire without the quiet flag).
+APPS4=$(mktemp -d)
+REPO_Z=$(mktemp -d)
+( cd "$REPO_Z" && git init -q && git config user.email t@e.com && git config user.name t )
+EVENT_JSON_Z=$(printf '{"tool_input":{"file_path":"%s/q.py"}}' "$REPO_Z")
+OUT=$(printf '%s' "$EVENT_JSON_Z" | \
+      BUILD_LOOP_APPS_ROOT="$APPS4" \
+      BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1 \
+      BUILD_LOOP_RALLY_PRE_EDIT_THROTTLE_SECONDS=0 \
+      BUILD_LOOP_RALLY_QUIET=1 \
+      CLAUDE_PROJECT_DIR="$REPO_Z" \
+      bash "$PE_HOOK" 2>/dev/null)
+RC=$?
+if [ "$RC" -eq 0 ] && [ -z "$OUT" ]; then
+  pass "BUILD_LOOP_RALLY_QUIET=1 suppresses join status line"
+else
+  fail "QUIET flag did not suppress output" "rc=$RC out='$OUT'"
+fi
+
+# ---- Case 15: 64 KB stdin cap — a payload larger than 64 KB must not
+# cause a failure; the hook must exit 0 cleanly.
+APPS5=$(mktemp -d)
+REPO_W=$(mktemp -d)
+( cd "$REPO_W" && git init -q && git config user.email t@e.com && git config user.name t )
+# Build a ~100 KB JSON-ish blob (INVALID JSON so hooks.py falls through
+# gracefully — the 64KB cap test is about not crashing, not about parsing).
+BIG_PAYLOAD=$(python3 -c "print('{\"tool_input\":{\"file_path\":\"/tmp/x.py\",\"extra\":\"' + 'A'*102400 + '\"}}')")
+RC=$(printf '%s' "$BIG_PAYLOAD" | \
+     BUILD_LOOP_APPS_ROOT="$APPS5" \
+     BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1 \
+     BUILD_LOOP_RALLY_PRE_EDIT_THROTTLE_SECONDS=5 \
+     CLAUDE_PROJECT_DIR="$REPO_W" \
+     bash "$PE_HOOK" >/dev/null 2>/dev/null; echo $?)
+if [ "$RC" -eq 0 ]; then
+  pass "64KB stdin cap: exit 0 on oversized payload"
+else
+  fail "64KB stdin cap: hook errored on large stdin" "rc=$RC"
+fi
+
+# ---- Case 16: socket.gethostname() — session_id must NOT end in "-host"
+# (which was the fallback when HOSTNAME env var was missing). Under env -i
+# the real hostname is always available via the syscall.
+APPS6=$(mktemp -d)
+REPO_H=$(mktemp -d)
+( cd "$REPO_H" && git init -q && git config user.email t@e.com && git config user.name t )
+EVENT_JSON_H=$(printf '{"tool_input":{"file_path":"%s/h.py"}}' "$REPO_H")
+env -i PATH=/usr/bin:/bin HOME=/tmp \
+    BUILD_LOOP_APPS_ROOT="$APPS6" \
+    BUILD_LOOP_BRIDGE_INTERNAL_ONLY=1 \
+    BUILD_LOOP_RALLY_PRE_EDIT_THROTTLE_SECONDS=0 \
+    bash -c "printf '%s' '$EVENT_JSON_H' | CLAUDE_PROJECT_DIR='$REPO_H' bash '$PE_HOOK'" \
+    >/dev/null 2>/dev/null
+PFILE=$(find "$APPS6" -path "*/sessions/*.json" -type f 2>/dev/null | head -1)
+if [ -n "$PFILE" ]; then
+  SID=$(python3 -c "import json,sys; d=json.load(open(sys.argv[1])); print(d.get('session_id',''))" "$PFILE" 2>/dev/null || true)
+  if echo "$SID" | grep -qv "\-host$"; then
+    pass "socket.gethostname(): session_id does not end in '-host' under env -i"
+  else
+    fail "socket.gethostname(): session_id still ends in '-host'" "sid='$SID'"
+  fi
+else
+  # No presence file written (env -i may lack python3 in /usr/bin path on this
+  # machine) — fall back to a direct Python unit check.
+  HOSTNAME_CHECK=$(env -i PATH=/usr/bin:/bin python3 -c "
+import socket, sys
+h = socket.gethostname()
+sys.exit(0 if h and h != 'host' else 1)
+" 2>/dev/null; echo $?)
+  if [ "$HOSTNAME_CHECK" = "0" ]; then
+    pass "socket.gethostname(): returns real hostname under env -i (direct check)"
+  else
+    fail "socket.gethostname(): returned empty or 'host' under env -i" ""
+  fi
+fi
+
+# ---- Case 17: non-first-line `cd` must resolve to None (not the evil path).
+# _extract_cd_target should return None for "echo x\ncd /evil".
+RESULT=$(python3 -c "
+import sys
+sys.path.insert(0, '${REPO_ROOT}/scripts')
+from rally_point.hooks import _extract_cd_target
+r = _extract_cd_target('echo x\ncd /evil')
+# .match() anchors at start; the leading 'echo' line must prevent the match.
+assert r is None, f'Expected None, got {r!r}'
+print('ok')
+" 2>/dev/null)
+if [ "$RESULT" = "ok" ]; then
+  pass "_extract_cd_target: non-first-line cd resolves to None (re.MULTILINE removed)"
+else
+  fail "_extract_cd_target: non-first-line cd wrongly matched" "result='$RESULT'"
+fi
+
+echo "Results: ${PASS} passed, ${FAIL} failed"
+[ "$FAIL" -eq 0 ] || exit 1

package/hooks/test_sec008_hooks.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025-2026 Tyrone Ross, Jr <46267523+tyroneross@users.noreply.github.com>
+# SPDX-License-Identifier: Apache-2.0
+# SEC-008 regression test for hooks/pre-commit and hooks/post-commit.
+#
+# Both hooks compute the repo toplevel via `git rev-parse --show-toplevel`.
+# If that resolution fails, the old code produced an empty path, the
+# `-f` file test silently failed, and the guard / capture was skipped —
+# fail-open. The fix: `exit 2` when toplevel cannot be resolved.
+#
+# This test runs each hook from a directory that is NOT inside a git
+# repo, so `git rev-parse --show-toplevel` yields nothing, and asserts
+# the hook exits 2 instead of 0.
+#
+# Any failure exits non-zero.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PRE_HOOK="${SCRIPT_DIR}/pre-commit"
+POST_HOOK="${SCRIPT_DIR}/post-commit"
+
+PASS=0
+FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1 — $2"; FAIL=$((FAIL + 1)); }
+
+# A directory guaranteed not to be inside a git repo.
+NOREPO=$(mktemp -d)
+trap 'rm -rf "$NOREPO"' EXIT
+
+# ---- Case 1: pre-commit exits 2 when toplevel cannot be resolved ------
+( cd "$NOREPO" && sh "$PRE_HOOK" </dev/null >/dev/null 2>&1 )
+RC=$?
+if [ "$RC" -eq 2 ]; then
+  pass "pre-commit fails closed (exit 2) with no resolvable toplevel"
+else
+  fail "pre-commit no-toplevel" "expected exit 2, got $RC"
+fi
+
+# ---- Case 2: post-commit exits 2 when toplevel cannot be resolved ----
+( cd "$NOREPO" && sh "$POST_HOOK" </dev/null >/dev/null 2>&1 )
+RC=$?
+if [ "$RC" -eq 2 ]; then
+  pass "post-commit fails closed (exit 2) with no resolvable toplevel"
+else
+  fail "post-commit no-toplevel" "expected exit 2, got $RC"
+fi
+
+# ---- Case 3: pre-commit exits 0 inside a repo with no guard script ---
+# (the .private-slug-check.py is not installed, so the guard segment
+#  finds no file and the hook proceeds to its trailing `exit 0`).
+REPO=$(mktemp -d)
+( cd "$REPO" && git init -q )
+( cd "$REPO" && sh "$PRE_HOOK" </dev/null >/dev/null 2>&1 )
+RC=$?
+rm -rf "$REPO"
+if [ "$RC" -eq 0 ]; then
+  pass "pre-commit exits 0 inside a repo when guard script absent"
+else
+  fail "pre-commit in-repo-no-guard" "expected exit 0, got $RC"
+fi
+
+echo "----"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/package.json

@@ -0,0 +1,111 @@
+{
+  "name": "@tyroneross/build-loop",
+  "version": "0.30.3",
+  "publishConfig": {
+    "registry": "https://npm.pkg.github.com",
+    "access": "public"
+  },
+  "description": "Multi-phase build orchestration with integrated debugging: assess, plan, execute, review, iterate.",
+  "main": "dist/src/index.js",
+  "types": "dist/src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "require": "./dist/src/index.js",
+      "import": "./dist/src/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "codex-skills",
+    "commands",
+    "skills",
+    "scripts/_paths.py",
+    "scripts/_db_url.py",
+    "scripts/blm.py",
+    "scripts/blm_api.py",
+    "scripts/check_cache_sync.py",
+    "scripts/embed_backend.py",
+    "scripts/install_memory.py",
+    "scripts/lessons_index",
+    "scripts/memory_context",
+    "scripts/memory_graph",
+    "scripts/project_resolver.py",
+    "scripts/semantic_index",
+    "scripts/sync_navgator_lessons.py",
+    "scripts/sync_plugin_cache.py",
+    "scripts/prune_plugin_cache.py",
+    "scripts/prune_codex_plugin_cache.py",
+    "hooks",
+    "agents",
+    "docs/agent-surface-policy.md",
+    "docs/memory-setup.md",
+    "templates/memory",
+    ".cursor",
+    ".claude-plugin",
+    ".codex-plugin",
+    ".agents",
+    "README.md",
+    "AGENTS.md",
+    "LICENSE",
+    "!**/__pycache__",
+    "!**/__pycache__/**",
+    "!**/*.pyc"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "watch": "tsc --watch",
+    "prepublishOnly": "npm run build",
+    "test": "python3 -m unittest scripts/test_commit_state_check.py scripts/test_bridge_preflight.py scripts/test_mcp_registration.py && bash scripts/hooks/test_hooks.sh",
+    "benchmark": "node benchmark-scoring.js",
+    "clean": "rm -rf dist",
+    "plugin:prune-cache": "python3 scripts/prune_plugin_cache.py --source .",
+    "plugin:prune-cache:apply": "python3 scripts/prune_plugin_cache.py --source . --apply",
+    "plugin:sync-cache": "python3 scripts/sync_plugin_cache.py --source . --host all",
+    "plugin:sync-cache:hooks": "python3 scripts/sync_plugin_cache.py --source . --host all --install-git-hooks",
+    "codex:prune-cache": "python3 scripts/prune_codex_plugin_cache.py --source .",
+    "codex:sync-cache": "python3 scripts/sync_plugin_cache.py --source . --host codex",
+    "codex:prune-cache:apply": "python3 scripts/prune_codex_plugin_cache.py --source . --apply",
+    "claude:prune-cache": "python3 scripts/prune_plugin_cache.py --source . --host claude",
+    "claude:sync-cache": "python3 scripts/sync_plugin_cache.py --source . --host claude",
+    "claude:prune-cache:apply": "python3 scripts/prune_plugin_cache.py --source . --host claude --apply"
+  },
+  "keywords": [
+    "build-loop",
+    "orchestration",
+    "codex",
+    "claude-code",
+    "plugin",
+    "agentic-development",
+    "spec-writing",
+    "evaluation"
+  ],
+  "author": "Tyrone Ross",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tyroneross/build-loop.git"
+  },
+  "bugs": {
+    "url": "https://github.com/tyroneross/build-loop/issues"
+  },
+  "homepage": "https://github.com/tyroneross/build-loop#readme",
+  "dependencies": {
+    "commander": "^14.0.3",
+    "prompts": "^2.4.2"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "@types/prompts": "^2.4.9",
+    "typescript": "^5.0.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "packageManager": "npm@10.x",
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ]
+}