mixdog 0.7.17 → 0.8.0

package/scripts/permission-eval-smoke.mjs

@@ -1,443 +0,0 @@
-#!/usr/bin/env node
-/**
- * scripts/permission-eval-smoke.mjs
- * Unit-level smoke tests for hooks/lib/permission-evaluator.cjs.
- */
-import assert from 'assert';
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { createRequire } from 'module';
-import { fileURLToPath } from 'url';
-
-// The evaluator intentionally merges user-global Claude settings. Local dev
-// machines commonly have defaultMode=bypassPermissions, which made this smoke
-// pass locally while CI's empty user config exercised stricter defaults. Pin
-// the user tier to a throwaway Claude config dir so the smoke is hermetic and
-// still verifies the intended invariant: hard-deny and explicit list rules win
-// before bypass mode.
-const smokeHome = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'perm-smoke-home-')));
-const smokeConfigDir = path.join(smokeHome, '.claude');
-fs.mkdirSync(smokeConfigDir, { recursive: true });
-fs.writeFileSync(
-  path.join(smokeConfigDir, 'settings.json'),
-  JSON.stringify({ permissions: { defaultMode: 'bypassPermissions' } }),
-);
-process.env.HOME = smokeHome;
-process.env.USERPROFILE = smokeHome;
-process.env.CLAUDE_CONFIG_DIR = smokeConfigDir;
-
-const _require = createRequire(import.meta.url);
-const evalPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../hooks/lib/permission-evaluator.cjs');
-const { evaluatePermission } = _require(evalPath);
-const loaderPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../hooks/lib/settings-loader.cjs');
-const { loadPermissions, clearSettingsCache } = _require(loaderPath);
-
-// ── helpers ───────────────────────────────────────────────────────────────────
-
-let pass = 0, fail = 0;
-
-function makeProject(settings = {}) {
-  const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'perm-smoke-')));
-  fs.mkdirSync(path.join(dir, '.claude'), { recursive: true });
-  if (Object.keys(settings).length) {
-    fs.writeFileSync(
-      path.join(dir, '.claude', 'settings.json'),
-      JSON.stringify({ permissions: settings }),
-    );
-  }
-  return dir;
-}
-
-function check(label, fn) {
-  try {
-    fn();
-    console.log(`  PASS  ${label}`);
-    pass++;
-  } catch (e) {
-    console.log(`  FAIL  ${label}: ${e.message}`);
-    fail++;
-  }
-}
-
-function ep(opts) { return evaluatePermission(opts); }
-
-// ── Hard-deny path scenarios ──────────────────────────────────────────────────
-// UNC paths and Program Files / System32 are hard-denied in
-// permission-evaluator.cjs (isHardDenyPath) — evaluated before mode and list
-// rules, so even allow=["mcp__*"] cannot override.
-{
-  const dir = makeProject();
-
-  check('UNC path + default mode → deny (hard-deny pattern)', () => {
-    // UNC paths match the hard-deny pattern in isHardDenyPath before mode logic runs.
-    const r = ep({ toolName: 'read', toolInput: { path: '\\\\srv\\share\\f' }, permissionMode: 'default', projectDir: dir, userCwd: dir });
-    assert.strictEqual(r.decision, 'deny', `Expected deny (hard-deny UNC), got ${r.decision}: ${r.reason}`);
-  });
-
-  check('C:\\Windows\\System32\\foo + allow=["mcp__*"] → deny (hard-deny overrides list)', () => {
-    // System32 matches HARD_DENY_PATH_PATTERNS — bypass-proof; allow list cannot override.
-    const dir2 = makeProject({ allow: ['mcp__*'] });
-    const r = ep({ toolName: 'mcp__plugin_mixdog_mixdog__read', toolInput: { path: 'C:\\Windows\\System32\\foo' }, permissionMode: 'default', projectDir: dir2, userCwd: dir2 });
-    assert.strictEqual(r.decision, 'deny', `Expected deny (hard-deny System32), got ${r.decision}: ${r.reason}`);
-  });
-
-  check('file_path alias + hard-deny path → deny for read/write/edit', () => {
-    const dir2 = makeProject({ allow: ['mcp__*'] });
-    for (const shortName of ['read', 'write', 'edit']) {
-      const r = ep({
-        toolName: `mcp__plugin_mixdog_mixdog__${shortName}`,
-        toolInput: { file_path: 'C:\\Windows\\System32\\drivers\\etc\\hosts', content: 'x', old_string: 'x', new_string: 'y' },
-        permissionMode: 'default',
-        projectDir: dir2,
-        userCwd: dir2,
-      });
-      assert.strictEqual(r.decision, 'deny', `${shortName}: expected deny, got ${r.decision}: ${r.reason}`);
-    }
-  });
-
-  check('nested file_path aliases in edits[]/writes[] + hard-deny path → deny', () => {
-    const dir2 = makeProject({ allow: ['mcp__*'] });
-    const edit = ep({
-      toolName: 'mcp__plugin_mixdog_mixdog__edit',
-      toolInput: { path: path.join(dir2, 'safe.txt'), edits: [{ file_path: 'C:\\Windows\\System32\\drivers\\etc\\hosts', old_string: 'x', new_string: 'y' }] },
-      permissionMode: 'default',
-      projectDir: dir2,
-      userCwd: dir2,
-    });
-    assert.strictEqual(edit.decision, 'deny', `edit: expected deny, got ${edit.decision}: ${edit.reason}`);
-
-    const write = ep({
-      toolName: 'mcp__plugin_mixdog_mixdog__write',
-      toolInput: { writes: [{ file_path: 'C:\\Windows\\System32\\drivers\\etc\\hosts', content: 'x' }] },
-      permissionMode: 'default',
-      projectDir: dir2,
-      userCwd: dir2,
-    });
-    assert.strictEqual(write.decision, 'deny', `write: expected deny, got ${write.decision}: ${write.reason}`);
-  });
-}
-
-// ── List eval ─────────────────────────────────────────────────────────────────
-{
-  check('allow=["mcp__*"], any mcp tool → allow', () => {
-    const dir = makeProject({ allow: ['mcp__*'] });
-    const r = ep({ toolName: 'mcp__plugin_mixdog_mixdog__read', toolInput: {}, projectDir: dir, userCwd: dir });
-    assert.strictEqual(r.decision, 'allow', r.reason);
-  });
-
-  check('deny=["mcp__plugin_mixdog_mixdog__bash"], bash → deny', () => {
-    const dir = makeProject({ deny: ['mcp__plugin_mixdog_mixdog__bash'] });
-    const r = ep({ toolName: 'mcp__plugin_mixdog_mixdog__bash', toolInput: { cwd: dir }, projectDir: dir, userCwd: dir });
-    assert.strictEqual(r.decision, 'deny', r.reason);
-  });
-
-  check('ask=["mcp__plugin_mixdog_mixdog__edit"], edit → ask', () => {
-    const dir = makeProject({ ask: ['mcp__plugin_mixdog_mixdog__edit'] });
-    const r = ep({ toolName: 'mcp__plugin_mixdog_mixdog__edit', toolInput: {}, projectDir: dir, userCwd: dir });
-    assert.strictEqual(r.decision, 'ask', r.reason);
-  });
-
-  check('Tool(specifier): Read(*.env) matches Read NOT ReadExtra', () => {
-    const dir = makeProject({ deny: ['Read(*.env)'] });
-    const r1 = ep({ toolName: 'Read', toolInput: { path: 'foo.env' }, projectDir: dir, userCwd: dir });
-    const r2 = ep({ toolName: 'ReadExtra', toolInput: { path: 'foo.env' }, projectDir: dir, userCwd: dir });
-    assert.strictEqual(r1.decision, 'deny', `Read(*.env) should deny, got ${r1.decision}`);
-    assert.notStrictEqual(r2.decision, 'deny', `ReadExtra should not be denied by Read(*.env)`);
-  });
-
-  check('Edit(secret.txt) matches when toolInput.file_path=secret.txt', () => {
-    const dir = makeProject({ deny: ['Edit(secret.txt)'] });
-    const r = ep({ toolName: 'Edit', toolInput: { file_path: 'secret.txt' }, projectDir: dir, userCwd: dir });
-    assert.strictEqual(r.decision, 'deny', r.reason);
-  });
-
-  check('Read(secret.txt) matches when toolInput.file_path=secret.txt (file_path bypass guard)', () => {
-    const dir = makeProject({ deny: ['Read(secret.txt)'] });
-    const r = ep({ toolName: 'Read', toolInput: { file_path: 'secret.txt' }, projectDir: dir, userCwd: dir });
-    assert.strictEqual(r.decision, 'deny', r.reason);
-  });
-
-  check('Write(secret.txt) matches when toolInput.file_path=secret.txt (file_path bypass guard)', () => {
-    const dir = makeProject({ deny: ['Write(secret.txt)'] });
-    const r = ep({ toolName: 'Write', toolInput: { file_path: 'secret.txt', content: 'x' }, projectDir: dir, userCwd: dir });
-    assert.strictEqual(r.decision, 'deny', r.reason);
-  });
-
-  check('Edit per-item edits[].file_path is collected (deny applies even when top-level path is missing)', () => {
-    const dir = makeProject({ deny: ['Edit(secret.txt)'] });
-    const r = ep({ toolName: 'Edit', toolInput: { edits: [{ file_path: 'secret.txt', old_string: 'a', new_string: 'b' }] }, projectDir: dir, userCwd: dir });
-    assert.strictEqual(r.decision, 'deny', r.reason);
-  });
-
-  check('Write per-item writes[].file_path is collected (defensive — runtime drops items missing path, but the rule still catches the intent)', () => {
-    const dir = makeProject({ deny: ['Write(secret.txt)'] });
-    const r = ep({ toolName: 'Write', toolInput: { writes: [{ file_path: 'secret.txt', content: 'x' }] }, projectDir: dir, userCwd: dir });
-    assert.strictEqual(r.decision, 'deny', r.reason);
-  });
-}
-
-// ── Mode defaults ─────────────────────────────────────────────────────────────
-{
-  const baseDir = makeProject();
-  const outside = os.tmpdir();
-
-  check('default + path inside cwd → allow', () => {
-    const r = ep({ toolName: 'read', toolInput: { path: path.join(baseDir, 'foo.txt') }, permissionMode: 'default', projectDir: baseDir, userCwd: baseDir });
-    assert.strictEqual(r.decision, 'allow', r.reason);
-  });
-
-  check('default + path outside cwd → allow (outside-cwd fallback policy)', () => {
-    // outside-cwd in default mode falls through to bypassPermissions branch per
-    // current policy. Was 'ask' in earlier hardening; relaxed to 'allow' once
-    // `auto` was unified with `bypassPermissions`.
-    const r = ep({ toolName: 'read', toolInput: { path: path.join(outside, 'bar.txt') }, permissionMode: 'default', projectDir: baseDir, userCwd: baseDir });
-    assert.strictEqual(r.decision, 'allow', r.reason);
-  });
-
-  check('acceptEdits + read tool → allow', () => {
-    const r = ep({ toolName: 'mcp__plugin_mixdog_mixdog__read', toolInput: { path: path.join(outside, 'x') }, permissionMode: 'acceptEdits', projectDir: baseDir, userCwd: baseDir });
-    assert.strictEqual(r.decision, 'allow', r.reason);
-  });
-
-  check('acceptEdits + trib-plugin MCP edit/read prefixes → allow', () => {
-    for (const shortName of ['edit', 'read']) {
-      const r = ep({
-        toolName: `mcp__plugin_mixdog_trib-plugin__${shortName}`,
-        toolInput: { path: path.join(baseDir, 'x.txt'), old_string: 'x', new_string: 'y' },
-        permissionMode: 'acceptEdits',
-        projectDir: baseDir,
-        userCwd: baseDir,
-      });
-      assert.strictEqual(r.decision, 'allow', `${shortName}: ${r.reason}`);
-    }
-  });
-
-  check('acceptEdits + bash inside → allow', () => {
-    const r = ep({ toolName: 'mcp__plugin_mixdog_mixdog__bash', toolInput: { cwd: baseDir }, permissionMode: 'acceptEdits', projectDir: baseDir, userCwd: baseDir });
-    assert.strictEqual(r.decision, 'allow', r.reason);
-  });
-
-  check('acceptEdits + bash outside → allow (bypass-fallback policy)', () => {
-    // acceptEdits + outside-cwd inherits the bypass-fallback policy.
-    const r = ep({ toolName: 'bash', toolInput: { cwd: outside }, permissionMode: 'acceptEdits', projectDir: baseDir, userCwd: baseDir });
-    assert.strictEqual(r.decision, 'allow', r.reason);
-  });
-
-  check('plan + read → allow', () => {
-    const r = ep({ toolName: 'read', toolInput: {}, permissionMode: 'plan', projectDir: baseDir, userCwd: baseDir });
-    assert.strictEqual(r.decision, 'allow', r.reason);
-  });
-
-  check('plan + bash → allow (bypass-fallback policy)', () => {
-    const r = ep({ toolName: 'bash', toolInput: { cwd: baseDir }, permissionMode: 'plan', projectDir: baseDir, userCwd: baseDir });
-    assert.strictEqual(r.decision, 'allow', r.reason);
-  });
-
-  check('dontAsk + any → allow (no list match: defers to bypass-fallback)', () => {
-    // dontAsk without a matching list entry defers to the same bypass-fallback
-    // path as acceptEdits / plan. List-driven deny / ask still works (see matrix).
-    const r = ep({ toolName: 'read', toolInput: {}, permissionMode: 'dontAsk', projectDir: baseDir, userCwd: baseDir });
-    assert.strictEqual(r.decision, 'allow', r.reason);
-  });
-
-  check('bypassPermissions + outside → allow', () => {
-    const r = ep({ toolName: 'bash', toolInput: { cwd: outside }, permissionMode: 'bypassPermissions', projectDir: baseDir, userCwd: baseDir });
-    assert.strictEqual(r.decision, 'allow', r.reason);
-  });
-
-  check('mode "auto" → bypass (user policy: treated same as bypassPermissions)', () => {
-    // auto is now treated as bypass per user policy decision
-    const r = ep({ toolName: 'bash', toolInput: { cwd: outside }, permissionMode: 'auto', projectDir: baseDir, userCwd: baseDir });
-    assert.strictEqual(r.decision, 'allow', `Expected allow (auto=bypass), got ${r.decision}: ${r.reason}`);
-  });
-}
-
-// ── Zero-path calls ───────────────────────────────────────────────────────────
-{
-  // `bridge` is a zero-path tool (no path arg in the common case) but, unlike
-  // the old read-only session-list tool, it is NOT read-only — it spawns/controls
-  // workers. Permissions are passed explicitly so the cases are deterministic
-  // regardless of any user-home settings on the test host.
-  const emptyPerms = { allow: [], deny: [], ask: [], defaultMode: 'default' };
-
-  check('bridge + default mode → allow', () => {
-    const dir = makeProject();
-    const r = ep({ toolName: 'bridge', toolInput: {}, permissionMode: 'default', projectDir: dir, userCwd: dir, permissions: emptyPerms });
-    assert.strictEqual(r.decision, 'allow', r.reason);
-  });
-
-  check('bridge + dontAsk + no list match → deny (not read-only)', () => {
-    const dir = makeProject();
-    // dontAsk denies anything not explicitly allowed; bridge is not read-only
-    // so there is no read-only exemption to rescue it.
-    const r = ep({ toolName: 'bridge', toolInput: {}, permissionMode: 'dontAsk', projectDir: dir, userCwd: dir, permissions: emptyPerms });
-    assert.strictEqual(r.decision, 'deny', r.reason);
-  });
-
-  check('bridge + deny=["bridge"] → deny', () => {
-    const dir = makeProject();
-    const r = ep({ toolName: 'bridge', toolInput: {}, permissionMode: 'default', projectDir: dir, userCwd: dir, permissions: { ...emptyPerms, deny: ['bridge'] } });
-    assert.strictEqual(r.decision, 'deny', r.reason);
-  });
-}
-
-// ── Settings merge ────────────────────────────────────────────────────────────
-{
-  check('user allow=[A] + project allow=[B] + local allow=[C] → all present', () => {
-    const dir = makeProject({ allow: ['B'] });
-    // Write local settings
-    fs.writeFileSync(
-      path.join(dir, '.claude', 'settings.local.json'),
-      JSON.stringify({ permissions: { allow: ['C'] } }),
-    );
-    // We can't write ~/.claude/settings.json safely in a test; verify B + C merge
-    const loaderPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../hooks/lib/settings-loader.cjs');
-    const { loadPermissions } = _require(loaderPath);
-    const perms = loadPermissions(dir);
-    assert.ok(perms.allow.includes('B'), 'project allow B missing');
-    assert.ok(perms.allow.includes('C'), 'local allow C missing');
-  });
-
-  check('defaultMode local=plan overrides project=acceptEdits', () => {
-    const dir = makeProject({ defaultMode: 'acceptEdits' });
-    fs.writeFileSync(
-      path.join(dir, '.claude', 'settings.local.json'),
-      JSON.stringify({ permissions: { defaultMode: 'plan' } }),
-    );
-    const loaderPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../hooks/lib/settings-loader.cjs');
-    const { loadPermissions } = _require(loaderPath);
-    const perms = loadPermissions(dir);
-    assert.strictEqual(perms.defaultMode, 'plan');
-  });
-
-  check('defaultMode local=bogus → coerced to default', () => {
-    const dir = makeProject({ defaultMode: 'bogus' });
-    const loaderPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../hooks/lib/settings-loader.cjs');
-    const { loadPermissions } = _require(loaderPath);
-    const perms = loadPermissions(dir);
-    assert.strictEqual(perms.defaultMode, 'default');
-  });
-}
-
-// ── memory tool regression ────────────────────────────────────────────────────
-{
-  check('acceptEdits + memory tool + outside-cwd → allow (bypass-fallback)', () => {
-    const dir = makeProject();
-    const outside = os.tmpdir();
-    // Use bare 'memory' (no mcp__ prefix) to avoid global mcp__* allow interference
-    // memory is not in READ_ONLY_TOOLS or EDIT_WRITE_TOOLS → mode-default applies
-    const r = ep({ toolName: 'memory', toolInput: { path: path.join(outside, 'x') }, permissionMode: 'acceptEdits', projectDir: dir, userCwd: dir });
-    assert.strictEqual(r.decision, 'allow', `Expected allow (bypass-fallback), got ${r.decision}: ${r.reason}`);
-  });
-}
-
-// ── New scenarios (P5.3) ──────────────────────────────────────────────────────
-
-// P5.3-1: user-global allow propagates when project settings absent
-check('P5.3-1: user-global allow propagates when no project settings file', () => {
-  clearSettingsCache();
-  // Create a project dir with NO .claude/settings.json
-  const dir = makeProject();
-  // Load permissions — user-global may have entries but project is absent
-  // Just verify the loader returns the expected structure without throwing
-  const perms = loadPermissions(dir);
-  assert.ok(Array.isArray(perms.allow), 'allow must be array');
-  assert.ok(Array.isArray(perms.deny),  'deny must be array');
-  assert.ok(Array.isArray(perms.ask),   'ask must be array');
-  assert.ok(typeof perms.defaultMode === 'string', 'defaultMode must be string');
-  clearSettingsCache();
-});
-
-// P5.3-2: pattern with ** matches across path segments
-check('P5.3-2: deny pattern mcp__*__bash matches mcp__plugin_mixdog_mixdog__bash via evaluator', () => {
-  clearSettingsCache();
-  const dir = makeProject({ deny: ['mcp__*__bash'] });
-  const r = ep({ toolName: 'mcp__plugin_mixdog_mixdog__bash', toolInput: { cwd: dir }, permissionMode: 'default', projectDir: dir, userCwd: dir });
-  assert.strictEqual(r.decision, 'deny', `Expected deny via wildcard pattern, got ${r.decision}: ${r.reason}`);
-  clearSettingsCache();
-});
-
-// P5.3-3: mixed-slash path resolves correctly (forward + backward slash mix)
-check('P5.3-3: mixed-slash path inside cwd → allow under default mode', () => {
-  clearSettingsCache();
-  const dir = makeProject();
-  // Build a path mixing slashes — normalizePath should handle it
-  const mixedPath = dir.replace(/\//g, '\\') + (process.platform === 'win32' ? '\\sub\\file.txt' : '/sub/file.txt');
-  const r = ep({ toolName: 'read', toolInput: { path: mixedPath }, permissionMode: 'default', projectDir: dir, userCwd: dir });
-  // On POSIX, backslash is a valid filename char — just assert no crash + returns a decision
-  assert.ok(['allow', 'ask', 'deny'].includes(r.decision), `Expected a valid decision, got: ${r.decision}`);
-  clearSettingsCache();
-});
-
-// P5.3-4: default + outside-cwd resolves to allow (bypass-fallback); no
-// updatedInput.cwd injection because the request is allowed as-is.
-check('P5.3-4: default + outside-cwd → allow (no updatedInput injection)', () => {
-  clearSettingsCache();
-  const dir = makeProject();
-  const outside = os.tmpdir();
-  const r = ep({ toolName: 'read', toolInput: { path: path.join(outside, 'foo.txt') }, permissionMode: 'default', projectDir: dir, userCwd: dir });
-  assert.strictEqual(r.decision, 'allow', `Expected allow (bypass-fallback), got ${r.decision}`);
-  clearSettingsCache();
-});
-
-// ── Cross-matrix scenarios (0.1.292) ─────────────────────────────────────────
-
-// 1. auto mode + outside-cwd → allow (treated as bypass per user policy)
-check('[matrix] auto × outside-cwd → allow', () => {
-  clearSettingsCache();
-  const dir = makeProject();
-  const outside = os.tmpdir();
-  const r = ep({ toolName: 'bash', toolInput: { cwd: outside }, permissionMode: 'auto', projectDir: dir, userCwd: dir });
-  assert.strictEqual(r.decision, 'allow', `Expected allow (auto=bypass), got ${r.decision}: ${r.reason}`);
-  clearSettingsCache();
-});
-
-// 2. auto mode + inside-cwd → allow
-check('[matrix] auto × inside-cwd → allow', () => {
-  clearSettingsCache();
-  const dir = makeProject();
-  const r = ep({ toolName: 'bash', toolInput: { cwd: dir }, permissionMode: 'auto', projectDir: dir, userCwd: dir });
-  assert.strictEqual(r.decision, 'allow', `Expected allow (default fallback, inside cwd), got ${r.decision}: ${r.reason}`);
-  clearSettingsCache();
-});
-
-// 3. dontAsk + list allow=read → allow (list short-circuits mode)
-check('[matrix] dontAsk × list-allow → allow', () => {
-  clearSettingsCache();
-  const dir = makeProject({ allow: ['mcp__plugin_mixdog_mixdog__read'] });
-  const r = ep({ toolName: 'mcp__plugin_mixdog_mixdog__read', toolInput: { path: path.join(dir, 'f.txt') }, permissionMode: 'dontAsk', projectDir: dir, userCwd: dir });
-  assert.strictEqual(r.decision, 'allow', `Expected allow (list overrides dontAsk), got ${r.decision}: ${r.reason}`);
-  clearSettingsCache();
-});
-
-// 4. dontAsk + list ask=edit → ask (list short-circuits mode)
-check('[matrix] dontAsk × list-ask → ask', () => {
-  clearSettingsCache();
-  const dir = makeProject({ ask: ['mcp__plugin_mixdog_mixdog__edit'] });
-  const r = ep({ toolName: 'mcp__plugin_mixdog_mixdog__edit', toolInput: {}, permissionMode: 'dontAsk', projectDir: dir, userCwd: dir });
-  assert.strictEqual(r.decision, 'ask', `Expected ask (list overrides dontAsk), got ${r.decision}: ${r.reason}`);
-  clearSettingsCache();
-});
-
-// 5. bypassPermissions + list deny=bash → deny (deny list wins over bypass)
-check('[matrix] bypassPermissions × list-deny → deny', () => {
-  clearSettingsCache();
-  const dir = makeProject({ deny: ['mcp__plugin_mixdog_mixdog__bash'] });
-  const r = ep({ toolName: 'mcp__plugin_mixdog_mixdog__bash', toolInput: { cwd: dir }, permissionMode: 'bypassPermissions', projectDir: dir, userCwd: dir });
-  assert.strictEqual(r.decision, 'deny', `Expected deny (list overrides bypass), got ${r.decision}: ${r.reason}`);
-  clearSettingsCache();
-});
-
-// 6. acceptEdits + list deny=write → deny (deny list wins over mode)
-check('[matrix] acceptEdits × list-deny → deny', () => {
-  clearSettingsCache();
-  const dir = makeProject({ deny: ['mcp__plugin_mixdog_mixdog__write'] });
-  const r = ep({ toolName: 'mcp__plugin_mixdog_mixdog__write', toolInput: { path: path.join(dir, 'out.txt') }, permissionMode: 'acceptEdits', projectDir: dir, userCwd: dir });
-  assert.strictEqual(r.decision, 'deny', `Expected deny (list overrides acceptEdits), got ${r.decision}: ${r.reason}`);
-  clearSettingsCache();
-});
-
-// ── Summary ───────────────────────────────────────────────────────────────────
-console.log(`\npermission-eval-smoke: ${pass} passed, ${fail} failed`);
-process.exit(fail > 0 ? 1 : 0);

package/scripts/prep-patch.mjs

@@ -1,53 +0,0 @@
-#!/usr/bin/env node
-/**
- * prep-patch.mjs — install-time prefetch for the native mixdog-patch binary.
- *
- * Best-effort: fires ensurePatchBinary in the background so a marketplace
- * user's first apply_patch call hits a warm cache instead of a 2-10s
- * one-time download. Failure leaves the binary absent; the dispatch-time
- * fetch in patch.mjs is still the canonical path and surfaces a clean
- * error if the network is unavailable.
- *
- * Used by:
- *   - scripts/bootstrap.mjs  (plugin spawn / install-time normalization)
- *   - dev/dev-sync.mjs       (dev cache prep, alongside source cargo build)
- *
- * Deps: node built-ins only at top level; the fetcher is loaded lazily.
- */
-import { join, dirname } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { homedir } from 'node:os';
-
-const DEFAULT_DATA_DIR_REL = ['.claude', 'plugins', 'data', 'mixdog-trib-plugin'];
-
-function resolveDataDir() {
-  if (process.env.CLAUDE_PLUGIN_DATA) return process.env.CLAUDE_PLUGIN_DATA;
-  return join(homedir(), ...DEFAULT_DATA_DIR_REL);
-}
-
-export function prepPatch(pluginRoot, { verbose = false } = {}) {
-  const dataDir = resolveDataDir();
-  const fetcherPath = pathToFileURL(
-    join(pluginRoot, 'src', 'agent', 'orchestrator', 'tools', 'patch-binary-fetcher.mjs'),
-  ).href;
-  // Dynamic import keeps bootstrap startup cheap when the fetcher's
-  // dependencies (fetch, streams) aren't needed in steady state. The
-  // promise chain is intentionally not awaited — bootstrap continues
-  // spawning run-mcp while the binary downloads in the background.
-  import(fetcherPath)
-    .then((mod) => mod.ensurePatchBinary(dataDir))
-    .then((path) => {
-      if (verbose) console.error(`[prep-patch] mixdog-patch ready at ${path}`);
-    })
-    .catch((err) => {
-      if (verbose) console.error(`[prep-patch] skipped: ${err?.message || err}`);
-    });
-}
-
-// CLI entry: `node scripts/prep-patch.mjs [pluginRoot]`
-const __filename = fileURLToPath(import.meta.url);
-if (process.argv[1] && process.argv[1] === __filename) {
-  const defaultRoot = dirname(dirname(__filename));
-  const root = process.argv[2] || defaultRoot;
-  prepPatch(root, { verbose: true });
-}

package/scripts/prep-shim.mjs

@@ -1,96 +0,0 @@
-#!/usr/bin/env node
-/**
- * prep-shim.mjs — OS normalization for the native mixdog-shim binary.
- *
- * Two responsibilities, both best-effort (failure leaves shim absent →
- * hooks fail-open):
- *   1. Stage the matching prebuilt binary from native/prebuilt/{os-arch}/
- *      into native/mixdog-shim/target/release/ when no local build exists.
- *   2. Rewrite hooks/hooks.json so the command path matches the current
- *      OS (.exe on Windows, no extension on Unix). Source stays
- *      Windows-canonical so editing from a Windows checkout doesn't
- *      accidentally drop the .exe.
- *
- * Used by:
- *   - scripts/bootstrap.mjs  (every plugin spawn, install-time normalization)
- *   - dev/dev-sync.mjs       (dev cache prep, same logic delegated here)
- *
- * Deps: node built-ins only.
- */
-import { existsSync, readFileSync, writeFileSync, statSync, mkdirSync, copyFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-export function shimBinExt() {
-  return process.platform === 'win32' ? '.exe' : '';
-}
-
-// Map Node's process.arch tokens to the release tags used under
-// native/prebuilt/{os-arch}/ and the build workflow artifacts.
-// node 'arm64' → release 'aarch64', node 'x64' → 'x86_64', node 'ia32' → 'i686'.
-// Unknown values pass through so a missing prebuilt directory surfaces as a
-// clear miss rather than a silent fallback.
-const SHIM_ARCH_ALIAS = Object.freeze({
-  x64: 'x86_64',
-  arm64: 'aarch64',
-  ia32: 'i686',
-});
-
-export function shimArchTag() {
-  const arch = SHIM_ARCH_ALIAS[process.arch] || process.arch;
-  const os = process.platform === 'win32' ? 'windows'
-    : process.platform === 'darwin' ? 'macos'
-    : 'linux';
-  return `${os}-${arch}`;
-}
-
-export function patchHooksJsonShim(pluginRoot, { verbose = false } = {}) {
-  const ext = shimBinExt();
-  const hooksPath = join(pluginRoot, 'hooks', 'hooks.json');
-  if (!existsSync(hooksPath)) return false;
-  let content;
-  try { content = readFileSync(hooksPath, 'utf8'); }
-  catch { return false; }
-  const replaced = content.replace(/mixdog-shim\.exe/g, 'mixdog-shim' + ext);
-  if (replaced === content) return false;
-  try {
-    writeFileSync(hooksPath, replaced);
-    if (verbose) console.error(`[prep-shim] hooks.json: shim path patched for ${shimArchTag()}`);
-    return true;
-  } catch (err) {
-    if (verbose) console.error(`[prep-shim] hooks.json patch failed: ${err?.message || err}`);
-    return false;
-  }
-}
-
-export function maybeStageShimBinary(pluginRoot, { verbose = false } = {}) {
-  const ext = shimBinExt();
-  const target = join(pluginRoot, 'native', 'mixdog-shim', 'target', 'release', 'mixdog-shim' + ext);
-  if (existsSync(target)) return false; // already present (source build or prior stage)
-  const prebuilt = join(pluginRoot, 'native', 'prebuilt', shimArchTag(), 'mixdog-shim' + ext);
-  if (!existsSync(prebuilt)) return false;
-  const targetDir = join(pluginRoot, 'native', 'mixdog-shim', 'target', 'release');
-  try { statSync(targetDir); }
-  catch { try { mkdirSync(targetDir, { recursive: true }); } catch {} }
-  try {
-    copyFileSync(prebuilt, target);
-    if (verbose) console.error(`[prep-shim] native/mixdog-shim: staged pre-built binary (${shimArchTag()})`);
-    return true;
-  } catch (err) {
-    if (verbose) console.error(`[prep-shim] native/mixdog-shim: stage failed: ${err?.message || err}`);
-    return false;
-  }
-}
-
-export function prepShim(pluginRoot, opts = {}) {
-  maybeStageShimBinary(pluginRoot, opts);
-  patchHooksJsonShim(pluginRoot, opts);
-}
-
-// CLI entry: `node scripts/prep-shim.mjs [pluginRoot]`
-const __filename = fileURLToPath(import.meta.url);
-if (process.argv[1] && process.argv[1] === __filename) {
-  const defaultRoot = dirname(dirname(__filename));
-  const root = process.argv[2] || defaultRoot;
-  prepShim(root, { verbose: true });
-}