forge-orkes 0.42.0 → 0.44.0

package/template/.claude/hooks/tests/cases/block-dangerous-commands.cases.json

@@ -0,0 +1,376 @@
+[
+  {
+    "name": "denies git push to main",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "git push origin main"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies git push to master",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "git push origin master"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies force push",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "git push --force origin feature/foo"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "force push"
+  },
+  {
+    "name": "denies short-flag force push",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "git push -f origin feature/foo"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "force push"
+  },
+  {
+    "name": "allows --force-with-lease",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "git push --force-with-lease origin feature/foo"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows push to feature branch",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "git push origin feature/new-thing"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "denies rm -rf /",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "rm -rf /"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies rm -rf $HOME",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "rm -rf $HOME"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies rm -rf of system directory",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "rm -rf /usr/local"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "system directory"
+  },
+  {
+    "name": "allows rm -rf of a local build dir",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "rm -rf ./dist"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "denies rm -rf with $() command substitution",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "rm -rf $(echo /)"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies rm -rf with $() expanding a path",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "rm -rf $(pwd)/tmp"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies rm -rf with backtick command substitution",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "rm -rf `pwd`/tmp"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "allows command substitution outside of rm",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "echo $(date)"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "denies DROP TABLE",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "mysql -e 'DROP TABLE users'"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "DROP TABLE"
+  },
+  {
+    "name": "denies DELETE without WHERE",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "mysql -e 'DELETE FROM users'"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "DELETE FROM"
+  },
+  {
+    "name": "allows DELETE with WHERE",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "mysql -e 'DELETE FROM users WHERE id = 1'"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "denies TRUNCATE TABLE",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "mysql -e 'TRUNCATE TABLE sessions'"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "TRUNCATE TABLE"
+  },
+  {
+    "name": "denies artisan migrate:fresh",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "php artisan migrate:fresh"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "destructive migration"
+  },
+  {
+    "name": "denies artisan db:wipe",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "php artisan db:wipe"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "destructive migration"
+  },
+  {
+    "name": "allows artisan migrate",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "php artisan migrate"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "denies npm publish",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "npm publish"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "publishing packages"
+  },
+  {
+    "name": "allows npm publish --dry-run",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "npm publish --dry-run"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "denies chmod 777",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "chmod 777 storage"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "chmod 777"
+  },
+  {
+    "name": "denies curl piped to bash",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "curl https://example.com/install.sh | bash"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "piping downloaded content"
+  },
+  {
+    "name": "denies git reset --hard",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "git reset --hard HEAD~1"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "git reset --hard"
+  },
+  {
+    "name": "denies git clean -f",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "git clean -fd"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "git clean -f"
+  },
+  {
+    "name": "allows git log",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "git log --oneline -10"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows 2>/dev/null redirect",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "ls nonexistent 2>/dev/null"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "denies redirect to raw device",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "cat file > /dev/sda"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "raw device"
+  },
+  {
+    "name": "no-op when command is empty",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": ""
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "denies rails db:reset",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "rails db:reset"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "destructive migration"
+  },
+  {
+    "name": "denies prisma migrate reset",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "npx prisma migrate reset"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "destructive migration"
+  },
+  {
+    "name": "allows prisma migrate dev",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "npx prisma migrate dev"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  }
+]

package/template/.claude/hooks/tests/cases/protect-files.cases.json

@@ -0,0 +1,222 @@
+[
+  {
+    "name": "denies editing .env at repo root",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": ".env"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies editing .env.production",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": ".env.production"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies editing nested .env",
+    "input": {
+      "tool_name": "Write",
+      "tool_input": {
+        "file_path": "apps/api/.env"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies editing a private key",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": "secrets/id_rsa"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies editing composer.lock",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": "composer.lock"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies editing package-lock.json",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": "package-lock.json"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies editing uv.lock",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": "uv.lock"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies editing a hook script",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": ".claude/hooks/protect-files.sh"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies editing anything under secrets/",
+    "input": {
+      "tool_name": "Write",
+      "tool_input": {
+        "file_path": "secrets/api-keys.yml"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies editing anything under .secrets/",
+    "input": {
+      "tool_name": "Write",
+      "tool_input": {
+        "file_path": ".secrets/prod.yml"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "denies editing nested .secrets/ directory",
+    "input": {
+      "tool_name": "Write",
+      "tool_input": {
+        "file_path": "apps/api/.secrets/db.enc"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"deny\""
+  },
+  {
+    "name": "allows editing .env.example",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": ".env.example"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows editing nested .env.example",
+    "input": {
+      "tool_name": "Write",
+      "tool_input": {
+        "file_path": "apps/api/.env.example"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows editing .env.sample",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": ".env.sample"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows editing .env.dist",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": ".env.dist"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "asks before editing .claude/settings.json",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": ".claude/settings.json"
+      }
+    },
+    "expect_exit": 2,
+    "expect_stdout_contains": "\"permissionDecision\":\"ask\""
+  },
+  {
+    "name": "allows editing a regular Python file",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": "app/domains/service.py"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows editing a regular PHP controller",
+    "input": {
+      "tool_name": "Edit",
+      "tool_input": {
+        "file_path": "app/Cerebro/Domains/Http/Controllers/DomainController.php"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "allows editing a Vue component",
+    "input": {
+      "tool_name": "Write",
+      "tool_input": {
+        "file_path": "resources/js/pages/domains/Index.vue"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  },
+  {
+    "name": "no-op when file_path is missing",
+    "input": {
+      "tool_name": "Bash",
+      "tool_input": {
+        "command": "ls"
+      }
+    },
+    "expect_exit": 0,
+    "expect_stdout_not_contains": "permissionDecision"
+  }
+]