devrites 3.0.6 → 3.1.0

package/engine/git_guard_test.go

@@ -0,0 +1,283 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/devrites/devrites/internal/harness"
+	"github.com/devrites/devrites/internal/lib"
+	"github.com/devrites/devrites/internal/reason"
+	"github.com/devrites/devrites/internal/toolpolicy"
+)
+
+func TestGitClassifierReasonIDsBelongToDiagnosticCatalog(t *testing.T) {
+	ids := []toolpolicy.ReasonID{
+		toolpolicy.ReasonInputTooLarge,
+		toolpolicy.ReasonAmbiguousSyntax,
+		toolpolicy.ReasonAmbiguousDynamic,
+		toolpolicy.ReasonAmbiguousAlias,
+		toolpolicy.ReasonAmbiguousGlobalOption,
+		toolpolicy.ReasonAmbiguousStdin,
+		toolpolicy.ReasonDestructiveReset,
+		toolpolicy.ReasonDestructiveClean,
+		toolpolicy.ReasonDestructiveCheckout,
+		toolpolicy.ReasonDestructiveRestore,
+		toolpolicy.ReasonDestructiveSwitch,
+		toolpolicy.ReasonDestructiveRemove,
+		toolpolicy.ReasonDestructiveBranch,
+		toolpolicy.ReasonDestructiveTag,
+		toolpolicy.ReasonDestructiveUpdateRef,
+		toolpolicy.ReasonDestructiveStash,
+		toolpolicy.ReasonDestructiveReflog,
+		toolpolicy.ReasonDestructivePrune,
+		toolpolicy.ReasonDestructiveHistory,
+		toolpolicy.ReasonDestructivePushForce,
+		toolpolicy.ReasonDestructivePushDelete,
+		toolpolicy.ReasonDestructiveWorktree,
+		toolpolicy.ReasonDestructiveRefDeletion,
+	}
+	for _, id := range ids {
+		if _, err := reason.Parse(string(id)); err != nil {
+			t.Errorf("%s: %v", id, err)
+		}
+	}
+}
+
+func TestGitGuardOrdinaryGitPassesSilently(t *testing.T) {
+	for _, command := range []string{
+		"git status --short",
+		"git diff -- reset",
+		"git add file && git commit -m safe",
+		"printf '%s\\n' 'git reset --hard HEAD'",
+	} {
+		var stdout, stderr bytes.Buffer
+		if code := hookGitGuard(harness.Claude, gitGuardInput("Bash", command), &stdout, &stderr); code != 0 {
+			t.Fatalf("%q code=%d", command, code)
+		}
+		if stdout.Len() != 0 || stderr.Len() != 0 {
+			t.Fatalf("%q emitted stdout=%q stderr=%q", command, stdout.String(), stderr.String())
+		}
+	}
+}
+
+func TestGitGuardAmbiguousHighImpactAlwaysDenies(t *testing.T) {
+	for _, host := range []harness.Harness{harness.Claude, harness.Codex} {
+		t.Run(string(host), func(t *testing.T) {
+			var stdout, stderr bytes.Buffer
+			if code := hookGitGuard(host, gitGuardInput("Bash", "eval 'git reset --hard HEAD'"), &stdout, &stderr); code != 0 {
+				t.Fatalf("code=%d", code)
+			}
+			if !strings.Contains(stdout.String(), `"permissionDecision":"deny"`) ||
+				!strings.Contains(stdout.String(), string(reason.GitAmbiguousDynamic)) ||
+				!strings.Contains(stdout.String(), "direct, literal git command") {
+				t.Fatalf("stdout=%q", stdout.String())
+			}
+			if strings.Contains(stdout.String(), "reset --hard") || stderr.Len() != 0 {
+				t.Fatalf("guard leaked command or stderr: stdout=%q stderr=%q", stdout.String(), stderr.String())
+			}
+		})
+	}
+}
+
+func TestGitGuardOpensResolvesAndConsumesExactQuestionForBothHosts(t *testing.T) {
+	var hostReasons []string
+	for _, host := range []harness.Harness{harness.Claude, harness.Codex} {
+		t.Run(string(host), func(t *testing.T) {
+			root := makeHookWorkspace(t)
+			work := filepath.Join(root, "work", "demo")
+			if err := os.WriteFile(filepath.Join(work, "questions.md"), []byte("# Questions\n\nNone.\n"), 0o644); err != nil {
+				t.Fatal(err)
+			}
+			t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
+			const command = "git reset --hard SECRET-REF"
+
+			var denied, deniedErr bytes.Buffer
+			if code := hookGitGuard(host, gitGuardInput("Bash", command), &denied, &deniedErr); code != 0 {
+				t.Fatalf("pending code=%d", code)
+			}
+			if !strings.Contains(denied.String(), `"permissionDecision":"deny"`) ||
+				!strings.Contains(denied.String(), string(reason.GitAuthorityPending)) {
+				t.Fatalf("pending stdout=%q", denied.String())
+			}
+			questionData, err := os.ReadFile(filepath.Join(work, "questions.md"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if bytes.Contains(questionData, []byte("SECRET-REF")) || bytes.Contains(questionData, []byte("reset --hard")) {
+				t.Fatalf("question leaked command: %s", questionData)
+			}
+			qid := gitGuardQuestionID(t, questionData)
+
+			t.Setenv("DEVRITES_NOW", "2026-07-23T10:01:00Z")
+			var resolveOut, resolveErr bytes.Buffer
+			if code := lib.Resolve(root, []string{qid, lib.GitAuthorityAnswer}, &resolveOut, &resolveErr); code != 0 {
+				t.Fatalf("resolve code=%d stderr=%q", code, resolveErr.String())
+			}
+
+			var allowed, allowedErr bytes.Buffer
+			if code := hookGitGuard(host, gitGuardInput("Bash", command), &allowed, &allowedErr); code != 0 {
+				t.Fatalf("allow code=%d", code)
+			}
+			if !strings.Contains(allowed.String(), `"permissionDecision":"allow"`) ||
+				!strings.Contains(allowed.String(), string(reason.GitAuthorityGranted)) {
+				t.Fatalf("allow stdout=%q", allowed.String())
+			}
+			ledger, err := os.ReadFile(filepath.Join(work, lib.GitAuthorityLedgerFile))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if bytes.Contains(ledger, []byte("SECRET-REF")) || bytes.Contains(ledger, []byte("reset --hard")) {
+				t.Fatalf("ledger leaked command: %s", ledger)
+			}
+			timeline, err := os.ReadFile(filepath.Join(root, "timeline.jsonl"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if bytes.Contains(timeline, []byte("SECRET-REF")) || bytes.Contains(timeline, []byte("reset --hard")) {
+				t.Fatalf("timeline leaked command: %s", timeline)
+			}
+			events := readV1HookEvents(t, root)
+			if len(events) != 2 {
+				t.Fatalf("events=%+v", events)
+			}
+			for _, event := range events {
+				if event.Boundary != lib.BoundaryGitPolicy || event.Event != "git-guard" ||
+					event.Host != lib.EventHost(host) || event.GuardStrength != lib.GuardEnforced {
+					t.Fatalf("event=%+v", event)
+				}
+			}
+			hostReasons = append(hostReasons, string(events[0].ReasonID)+"/"+string(events[0].Outcome))
+		})
+	}
+	if len(hostReasons) != 2 || hostReasons[0] != hostReasons[1] {
+		t.Fatalf("host policy drift: %v", hostReasons)
+	}
+}
+
+func TestGitGuardWrongDigestAndNoWorkspaceDeny(t *testing.T) {
+	root := makeHookWorkspace(t)
+	work := filepath.Join(root, "work", "demo")
+	if err := os.WriteFile(filepath.Join(work, "questions.md"), []byte("# Questions\n\nNone.\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
+
+	var first bytes.Buffer
+	hookGitGuard(harness.Claude, gitGuardInput("Bash", "git reset --hard HEAD"), &first, &bytes.Buffer{})
+	qdata, err := os.ReadFile(filepath.Join(work, "questions.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	qid := gitGuardQuestionID(t, qdata)
+	var resolveOut, resolveErr bytes.Buffer
+	if code := lib.Resolve(root, []string{qid, lib.GitAuthorityAnswer}, &resolveOut, &resolveErr); code != 0 {
+		t.Fatalf("resolve code=%d stderr=%q", code, resolveErr.String())
+	}
+	var mismatch bytes.Buffer
+	hookGitGuard(harness.Claude, gitGuardInput("Bash", "git clean -fd"), &mismatch, &bytes.Buffer{})
+	if !strings.Contains(mismatch.String(), `"permissionDecision":"deny"`) ||
+		strings.Contains(mismatch.String(), `"permissionDecision":"allow"`) {
+		t.Fatalf("wrong digest stdout=%q", mismatch.String())
+	}
+
+	t.Setenv("DEVRITES_ROOT", filepath.Join(t.TempDir(), ".devrites"))
+	if err := os.MkdirAll(os.Getenv("DEVRITES_ROOT"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	var absent bytes.Buffer
+	hookGitGuard(harness.Claude, gitGuardInput("Bash", "git reset --hard HEAD"), &absent, &bytes.Buffer{})
+	if !strings.Contains(absent.String(), string(reason.GitWorkspaceUnavailable)) ||
+		!strings.Contains(absent.String(), `"permissionDecision":"deny"`) {
+		t.Fatalf("no-workspace stdout=%q", absent.String())
+	}
+}
+
+func TestGitGuardEventFailureNeverChangesConsumedAllow(t *testing.T) {
+	root := makeHookWorkspace(t)
+	work := filepath.Join(root, "work", "demo")
+	if err := os.WriteFile(filepath.Join(work, "questions.md"), []byte("# Questions\n\nNone.\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("DEVRITES_NOW", "2026-07-23T10:00:00Z")
+	const command = "git reset --hard HEAD"
+	var pending bytes.Buffer
+	hookGitGuard(harness.Claude, gitGuardInput("Bash", command), &pending, &bytes.Buffer{})
+	qdata, err := os.ReadFile(filepath.Join(work, "questions.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	qid := gitGuardQuestionID(t, qdata)
+	var resolveOut, resolveErr bytes.Buffer
+	if code := lib.Resolve(root, []string{qid, lib.GitAuthorityAnswer}, &resolveOut, &resolveErr); code != 0 {
+		t.Fatalf("resolve code=%d stderr=%q", code, resolveErr.String())
+	}
+	timeline := filepath.Join(root, "timeline.jsonl")
+	if err := os.Remove(timeline); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Mkdir(timeline, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	var allowed bytes.Buffer
+	hookGitGuard(harness.Claude, gitGuardInput("Bash", command), &allowed, &bytes.Buffer{})
+	if !strings.Contains(allowed.String(), `"permissionDecision":"allow"`) {
+		t.Fatalf("telemetry failure changed allow: %q", allowed.String())
+	}
+	if _, err := os.Stat(filepath.Join(work, lib.GitAuthorityLedgerFile)); err != nil {
+		t.Fatalf("grant was not consumed before telemetry: %v", err)
+	}
+}
+
+func TestGitGuardDispatchAndKillPath(t *testing.T) {
+	root := makeHookWorkspace(t)
+	if err := os.WriteFile(filepath.Join(root, "work", "demo", "questions.md"), []byte("# Questions\n\nNone.\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	payload, _ := json.Marshal(map[string]any{
+		"tool_name":  "Bash",
+		"tool_input": map[string]string{"command": "git reset --hard HEAD"},
+	})
+
+	t.Setenv("DEVRITES_HOOK_PROFILE", "standard")
+	t.Setenv("DEVRITES_DISABLED_HOOKS", "git-guard")
+	var disabled bytes.Buffer
+	if code := run([]string{"hook", "git-guard", "--harness=claude"}, bytes.NewReader(payload), &disabled, &bytes.Buffer{}); code != 0 {
+		t.Fatalf("disabled code=%d", code)
+	}
+	if disabled.Len() != 0 {
+		t.Fatalf("disabled hook blocked: %q", disabled.String())
+	}
+
+	t.Setenv("DEVRITES_DISABLED_HOOKS", "")
+	var enabled bytes.Buffer
+	if code := run([]string{"hook", "git-guard", "--harness=claude"}, bytes.NewReader(payload), &enabled, &bytes.Buffer{}); code != 0 {
+		t.Fatalf("enabled code=%d", code)
+	}
+	if !strings.Contains(enabled.String(), `"permissionDecision":"deny"`) {
+		t.Fatalf("enabled hook did not deny: %q", enabled.String())
+	}
+}
+
+func gitGuardInput(tool, command string) *bytes.Reader {
+	data, _ := json.Marshal(map[string]any{
+		"tool_name":  tool,
+		"tool_input": map[string]string{"command": command},
+	})
+	return bytes.NewReader(data)
+}
+
+func gitGuardQuestionID(t *testing.T, data []byte) string {
+	t.Helper()
+	for _, line := range strings.Split(string(data), "\n") {
+		if strings.HasPrefix(line, "## q-") {
+			return strings.TrimPrefix(line, "## ")
+		}
+	}
+	t.Fatalf("question id missing:\n%s", data)
+	return ""
+}

package/engine/hookpolicy.go

@@ -5,65 +5,65 @@ import (
 	"strings"
 )
 
-// Hook control plane.
-//
-// Every wired hook has a canonical id: its `hook <name>` CLI verb (allow,
-// orient, stop-gate, …). That id is the addressable handle for two orthogonal
-// runtime controls, both read from the environment so an operator tunes safety
-// vs speed without editing any JSON:
+// Hook names are also their canonical IDs. Two environment settings control
+// whether a hook runs:
 //
 //   DEVRITES_HOOK_PROFILE=minimal|standard|strict   which hooks run at all
-//   DEVRITES_DISABLED_HOOKS="stop-gate,a1-guard"     an explicit per-id kill list
+//   DEVRITES_DISABLED_HOOKS="stop-gate,a1-guard"     hook IDs to disable
 //
-// The profile is a floor: a hook runs when its tier is at or below the active
-// profile AND it is not in the kill list. Everything else short-circuits to a
-// clean fail-open no-op in cmdHook: identical to the inline `command -v … ||
-// exit 0` guard, so a disabled hook is indistinguishable from an absent binary.
+// A hook runs when its tier is at or below the selected profile and its ID is
+// not disabled. Disabled hooks return success without doing anything, just as
+// they would if the binary were absent.
 //
-// A SEPARATE axis is enforce-vs-observe: the OBSERVE-by-default guards (a1-guard,
-// stop-gate, reviewer-readonly) only ever log until their specific
-// DEVRITES_*=enforce var is set. The `strict` profile is the ergonomic shortcut
-// that flips ALL of them on at once (see hookEnforce), so a hardened session is
-// one env var, not four.
+// Enforcement is separate from activation. Main-thread guards observe by
+// default until their DEVRITES_*=enforce variable is set. The strict profile
+// enforces every legacy observe path. reviewer-readonly and wright-scope always
+// enforce policy for declared DevRites leaf agents.
 
 // hookTier is the minimum profile level at which a hook is active.
 type hookTier int
 
 const (
-	tierMinimal  hookTier = iota // orientation-only; never blocks or mutates flow
-	tierStandard                 // the default working set: gates, guards, caches
-	tierStrict                   // reserved for experimental/aggressive hooks
+	tierMinimal  hookTier = iota // orientation only; never blocks or changes flow
+	tierStandard                 // default gates, guards, and caches
+	tierStrict                   // experimental or aggressive hooks
 )
 
-// hookRegistry maps each canonical hook id to the profile tier that first
-// activates it. A name absent from the registry is treated as tierMinimal
-// (always active): fail-open: an unrecognised hook is never silently disabled
-// by the profile mechanism.
-var hookRegistry = map[string]hookTier{
-	// minimal: orientation and auto-approval, which never interrupt work.
-	"allow":           tierMinimal,
-	"orient":          tierMinimal,
-	"subagent-orient": tierMinimal,
-	"cursor":          tierMinimal,
-	"statusline":      tierMinimal,
+type hookDefinition struct {
+	tier     hookTier
+	canBlock bool
+}
+
+// hookRegistry records each hook's tier and whether it can block. The blocker
+// audit derives its cases from canBlock, so a new blocker must cover reentry,
+// malformed input, bounds, and the disabled path. Unknown hook names stay
+// active instead of being silently disabled.
+var hookRegistry = map[string]hookDefinition{
+	// Minimal hooks provide orientation and automatic approval without
+	// interrupting work.
+	"allow":           {tier: tierMinimal},
+	"orient":          {tier: tierMinimal},
+	"subagent-orient": {tier: tierMinimal},
+	"cursor":          {tier: tierMinimal},
+	"statusline":      {tier: tierMinimal},
 
-	// standard: the default gates, guards, sentinels and caches.
-	"a1-guard":          tierStandard,
-	"stop-gate":         tierStandard,
-	"reviewer-readonly": tierStandard,
-	"wright-scope":      tierStandard,
-	"redwatch":          tierStandard,
-	"source-cache-pre":  tierStandard,
-	"source-cache-post": tierStandard,
-	"refresh-indexes":   tierStandard,
-	"event":             tierStandard,
-	"auq":               tierStandard,
-	"handoff-snapshot":  tierStandard,
+	// Standard hooks add the default gates, guards, sentinels, and caches.
+	"a1-guard":          {tier: tierStandard, canBlock: true},
+	"git-guard":         {tier: tierStandard, canBlock: true},
+	"stop-gate":         {tier: tierStandard, canBlock: true},
+	"reviewer-readonly": {tier: tierStandard, canBlock: true},
+	"wright-scope":      {tier: tierStandard, canBlock: true},
+	"redwatch":          {tier: tierStandard},
+	"source-cache-pre":  {tier: tierStandard},
+	"source-cache-post": {tier: tierStandard},
+	"refresh-indexes":   {tier: tierStandard},
+	"event":             {tier: tierStandard},
+	"auq":               {tier: tierStandard},
+	"handoff-snapshot":  {tier: tierStandard},
 }
 
-// hookProfileTier resolves DEVRITES_HOOK_PROFILE to a tier, defaulting to
-// standard on empty or unrecognised input (fail-open: a typo never silently
-// strips the working set below default).
+// hookProfileTier resolves DEVRITES_HOOK_PROFILE. Empty or unrecognized input
+// uses the standard tier so a typo cannot disable the default hooks.
 func hookProfileTier() hookTier {
 	switch strings.ToLower(strings.TrimSpace(os.Getenv("DEVRITES_HOOK_PROFILE"))) {
 	case "minimal":
@@ -75,21 +75,20 @@ func hookProfileTier() hookTier {
 	}
 }
 
-// hookActive reports whether a hook id may run under the current profile and
-// kill list. It is the single gate consulted at the top of cmdHook.
+// hookActive reports whether the current profile and disabled list allow a hook
+// ID to run. cmdHook checks it before dispatch.
 func hookActive(name string) bool {
 	if hookDisabled(name) {
 		return false
 	}
-	tier, known := hookRegistry[name]
+	def, known := hookRegistry[name]
 	if !known {
-		return true // unknown id: never disabled by profile
+		return true // Profiles do not disable unknown IDs.
 	}
-	return tier <= hookProfileTier()
+	return def.tier <= hookProfileTier()
 }
 
-// hookDisabled reports whether a hook id appears in the DEVRITES_DISABLED_HOOKS
-// comma-separated kill list.
+// hookDisabled reports whether DEVRITES_DISABLED_HOOKS contains the hook ID.
 func hookDisabled(name string) bool {
 	list := os.Getenv("DEVRITES_DISABLED_HOOKS")
 	if list == "" {
@@ -103,9 +102,8 @@ func hookDisabled(name string) bool {
 	return false
 }
 
-// hookEnforce reports whether an OBSERVE-default guard should block rather than
-// log. It is true when the guard's own DEVRITES_*=enforce var is set, OR when
-// the strict profile is active: strict enforces every guard at once.
+// hookEnforce reports whether a guard that normally observes should block. Its
+// own enforce variable or the strict profile enables blocking.
 func hookEnforce(specificVar string) bool {
 	if os.Getenv(specificVar) == "enforce" {
 		return true

package/engine/hookpolicy_test.go

@@ -1,6 +1,10 @@
 package main
 
-import "testing"
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
 
 func TestHookActiveProfileTiers(t *testing.T) {
 	cases := []struct {
@@ -62,3 +66,89 @@ func TestHookEnforce(t *testing.T) {
 		t.Error("strict profile should enforce every guard")
 	}
 }
+
+func TestBlockingHookExitAudit(t *testing.T) {
+	type exitContract struct {
+		reentry   string
+		malformed string
+		bound     string
+		killPath  string
+	}
+	audit := map[string]exitContract{
+		"stop-gate": {
+			reentry:   "explicit stop_hook_active=true lets the re-entered Stop complete",
+			malformed: "empty, malformed, missing, null, or non-boolean stop_hook_active fails open",
+			bound:     "one block before the host re-enters with stop_hook_active=true",
+			killPath:  "DEVRITES_DISABLED_HOOKS=stop-gate or DEVRITES_HOOK_PROFILE=minimal",
+		},
+		"reviewer-readonly": {
+			reentry:   "not applicable: each PreToolUse decision applies to one tool request",
+			malformed: "missing or malformed tool identity fails open",
+			bound:     "one synchronous deny; no retry or subprocess",
+			killPath:  "DEVRITES_DISABLED_HOOKS=reviewer-readonly or DEVRITES_HOOK_PROFILE=minimal",
+		},
+		"a1-guard": {
+			reentry:   "not applicable: each PreToolUse decision applies to one tool request",
+			malformed: "missing or malformed tool identity fails open",
+			bound:     "one synchronous deny; no retry or subprocess",
+			killPath:  "DEVRITES_DISABLED_HOOKS=a1-guard or DEVRITES_HOOK_PROFILE=minimal",
+		},
+		"wright-scope": {
+			reentry:   "not applicable: each PreToolUse decision applies to one tool request",
+			malformed: "missing or malformed tool identity fails open",
+			bound:     "one synchronous deny; no retry or subprocess",
+			killPath:  "DEVRITES_DISABLED_HOOKS=wright-scope or DEVRITES_HOOK_PROFILE=minimal",
+		},
+		"git-guard": {
+			reentry:   "not applicable: each PreToolUse decision applies to one tool request",
+			malformed: "missing or malformed structured tool input fails open",
+			bound:     "one synchronous deny or one consumed one-shot allow; no retry or subprocess",
+			killPath:  "DEVRITES_DISABLED_HOOKS=git-guard or DEVRITES_HOOK_PROFILE=minimal",
+		},
+	}
+
+	for name, def := range hookRegistry {
+		if !def.canBlock {
+			continue
+		}
+		contract, ok := audit[name]
+		if !ok {
+			t.Errorf("production blocker %q has no exit audit row", name)
+			continue
+		}
+		if contract.reentry == "" || contract.malformed == "" || contract.bound == "" || contract.killPath == "" {
+			t.Errorf("blocker %q has an incomplete exit audit row: %#v", name, contract)
+		}
+	}
+	for name := range audit {
+		def, ok := hookRegistry[name]
+		if !ok || !def.canBlock {
+			t.Errorf("exit audit row %q is not a production blocker", name)
+		}
+	}
+
+	for name := range audit {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv("DEVRITES_HOOK_PROFILE", "standard")
+			t.Setenv("DEVRITES_DISABLED_HOOKS", name)
+			if hookActive(name) {
+				t.Fatal("per-hook kill list did not disable blocker")
+			}
+
+			t.Setenv("DEVRITES_DISABLED_HOOKS", "")
+			t.Setenv("DEVRITES_HOOK_PROFILE", "minimal")
+			if hookActive(name) {
+				t.Fatal("minimal profile did not disable blocker")
+			}
+
+			t.Setenv("DEVRITES_HOOK_PROFILE", "standard")
+			var stdout, stderr bytes.Buffer
+			if code := run([]string{"hook", name, "--harness=claude"}, strings.NewReader("not-json"), &stdout, &stderr); code != exitOK {
+				t.Fatalf("malformed input exit = %d, want 0 (stderr %q)", code, stderr.String())
+			}
+			if stdout.Len() != 0 {
+				t.Fatalf("malformed input emitted a blocking decision: %q", stdout.String())
+			}
+		})
+	}
+}