nccgs 2.0.0 → 2.1.1

package/tests/hook-repair.test.mjs

@@ -0,0 +1,106 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+import { managedHookKey, requiredHookPresent } from '../.claude/nccgs/tools/hook-transport.mjs';
+import { safeSharedContextCommand } from '../.claude/nccgs/tools/shared-context-guard.mjs';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const sha = file => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+const fragment = JSON.parse(fs.readFileSync(path.join(root, '.claude/nccgs/settings.fragment.json')));
+const hooks = Object.values(fragment.hooks).flatMap(groups => groups.flatMap(x => x.hooks));
+
+test('hook identity migrates exact legacy commands without claiming unrelated node hooks', () => {
+  const keys = hooks.map(managedHookKey);
+  // The Unity CLI-only guard already exists in settings.fragment.json; R11 adds no hook.
+  const expectedIdentities = [
+    ['.claude/nccgs/hooks/session-start.mjs'],
+    ['.claude/nccgs/hooks/unity-transport-guard.mjs'],
+    ['.claude/nccgs/hooks/protect-git.mjs'],
+    ['.claude/nccgs/hooks/protect-write.mjs'],
+    ['.claude/nccgs/hooks/closure-guard.mjs', 'pre'],
+    ['.claude/nccgs/hooks/pre-compact.mjs'],
+    ['.claude/nccgs/hooks/post-compact.mjs'],
+    ['.claude/nccgs/hooks/agent-audit.mjs', 'start'],
+    ['.claude/nccgs/hooks/agent-audit.mjs', 'stop'],
+    ['.claude/nccgs/hooks/session-stop.mjs'],
+    ['.claude/nccgs/hooks/closure-guard.mjs', 'stop'],
+    ['.claude/nccgs/hooks/runtime-observation.mjs', 'failure'],
+    ['.claude/nccgs/hooks/runtime-observation.mjs'],
+  ].map(identity => JSON.stringify(identity));
+  assert.equal(keys.length, expectedIdentities.length);
+  assert.deepEqual([...new Set(keys)].sort(), expectedIdentities.sort());
+  for (const h of hooks) {
+    const legacy = { type: 'command', command: `node "${h.args[0]}"${h.args.length > 1 ? ' ' + h.args[1] : ''}` };
+    assert.equal(managedHookKey(legacy), managedHookKey(h));
+    assert.equal(managedHookKey({ ...legacy, command: legacy.command + ' && echo owner' }), null);
+  }
+  assert.equal(managedHookKey({ type: 'command', command: 'node', args: ['custom-owner.mjs'] }), null);
+  const expected = fragment.hooks.PreToolUse[2].hooks[0];
+  for (const change of [{args:[expected.args[0],'stop']},{args:[]},{onFailure:'continue'},{if:'Read(*)'},{once:true},{async:true}]) {
+    assert.equal(requiredHookPresent({ ...expected, ...change }, expected), false);
+  }
+});
+
+test('installed doctor checks argv and failure policy; update/uninstall preserve custom node argv', () => {
+  const parent = fs.realpathSync(os.tmpdir()), dir = fs.mkdtempSync(path.join(parent, 'nccgs-hook-repair-'));
+  const project = path.join(dir, 'Unity project Việt');
+  fs.mkdirSync(project);
+  for (const marker of ['Assets','Packages','ProjectSettings']) fs.mkdirSync(path.join(project, marker));
+  const env = { ...process.env };
+  for (const key of ['CLAUDECODE','CLAUDE_CODE_ENTRYPOINT','NCCGS_PROJECT_ROOT','NCCGS_TASK_AUTONOMY']) delete env[key];
+  const run = (...argv) => spawnSync(process.execPath,[path.join(root,'scripts/cli.mjs'),...argv,'--project',project],{cwd:dir,env,encoding:'utf8',windowsHide:true});
+  const write = (name,text) => { const f=path.join(project,name);fs.mkdirSync(path.dirname(f),{recursive:true});fs.writeFileSync(f,text);return f; };
+  try {
+    let r=run('install','--autonomy','guarded');assert.equal(r.status,0,r.stderr+r.stdout);
+    const file=path.join(project,'.claude/settings.json'), settings=JSON.parse(fs.readFileSync(file));
+    const custom={type:'command',command:'node',args:['owner-check.mjs'],timeout:8};
+    settings.hooks.SessionStart[0].hooks.push(custom);
+    const native=settings.hooks.SessionStart[0].hooks[0];
+    native.command=`node "${native.args[0]}"`;delete native.args;
+    fs.writeFileSync(file,JSON.stringify(settings));
+    r=run('update');assert.equal(r.status,0,r.stderr+r.stdout);
+    const updated=JSON.parse(fs.readFileSync(file));
+    assert.ok(updated.hooks.SessionStart.flatMap(x=>x.hooks).some(h=>JSON.stringify(h)===JSON.stringify(custom)));
+    assert.equal(run('doctor').status,0);
+    const good=JSON.stringify(updated);
+    for (const delta of [{args:[]},{onFailure:'continue'},{if:'Read(*)'},{once:true}]) {
+      const changed=JSON.parse(good);Object.assign(changed.hooks.PreToolUse[2].hooks[0],delta);
+      fs.writeFileSync(file,JSON.stringify(changed));assert.notEqual(run('doctor').status,0);
+    }
+    fs.writeFileSync(file,good);
+    // Trusted external binding is process-local and admits only exact read commands.
+    const wf=path.join(dir,'pinned workflow'), add=(rel,text)=>{const f=path.join(wf,rel);fs.mkdirSync(path.dirname(f),{recursive:true});fs.writeFileSync(f,text);return f;};
+    const pkg=add('package.json',JSON.stringify({name:'agent-project-workflow-candidate',version:'1.7.0'}));
+    const cli=add('tools/workflow.mjs','throw new Error("guard tests never execute the external reader");\n');
+    const manifest=add('implementation/ARTIFACT_MANIFEST.json',JSON.stringify({files:[pkg,cli].map(f=>({path:path.relative(wf,f).split(path.sep).join('/'),size:fs.statSync(f).size,sha256:sha(f)}))}));
+    const binding={NCCGS_SHARED_WORKFLOW_ROOT:wf,NCCGS_SHARED_WORKFLOW_MANIFEST_SHA256:sha(manifest)};
+    const config=write('docs/workflow/workflow.config.json','{}\n');
+    const base=`node .claude/nccgs/tools/shared-context.mjs --project "${project}" --workflow-root "${wf}"`;
+    const status=base+' --action status', query=base+' --action query --text Restore';
+    const common=`node "${cli}" status --config "${config}"`;
+    for(const command of [status,query,common])assert.equal(safeSharedContextCommand(command,project,binding),true,command);
+    assert.equal(safeSharedContextCommand(status,project,{}),false);
+    const rejected=[base+' --action refresh',base+' --action setup',query+' --hold x',query+' --text Other',status+'; node evil',status+' && node evil',status+' > out',query.replace('Restore','"$(evil)"'),query.replace('Restore',"'a; evil'"),common.replace(' status ',' graph '),common+' --project other',status.replace(wf,dir),status.replace(project,dir),status.replace('node ','node --eval '),'node --version'];
+    for(const command of rejected)assert.equal(safeSharedContextCommand(command,project,binding),false,command);
+    const saved=fs.readFileSync(cli);fs.appendFileSync(cli,'// changed reader\n');assert.equal(safeSharedContextCommand(common,project,binding),false);fs.writeFileSync(cli,saved);
+    assert.equal(safeSharedContextCommand(status,project,{...binding,NCCGS_SHARED_WORKFLOW_MANIFEST_SHA256:'0'.repeat(64)}),false);
+    const bridge=path.join(project,'.claude/nccgs/tools/shared-context.mjs'),original=fs.readFileSync(bridge);
+    fs.appendFileSync(bridge,'// changed bridge\n');assert.equal(safeSharedContextCommand(status,project,binding),false);fs.writeFileSync(bridge,original);
+    // Direct guard invocation exercises the same code the exec-form hook runs.
+    const hook=path.join(project,'.claude/nccgs/hooks/closure-guard.mjs');
+    const invoke=command=>spawnSync(process.execPath,[hook,'pre'],{cwd:project,env:{...env,...binding,NCCGS_PROJECT_ROOT:project,CLAUDE_PROJECT_DIR:project},input:JSON.stringify({tool_name:'PowerShell',tool_input:{command},session_id:'guard-test'}),encoding:'utf8'});
+    assert.equal(invoke(status).status,0);
+    assert.equal(invoke('node --version').status,2);
+    const removed=run('uninstall');assert.equal(removed.status,0,removed.stderr+removed.stdout);
+    const retained=JSON.parse(fs.readFileSync(file));
+    assert.ok(retained.hooks.SessionStart.flatMap(x=>x.hooks).some(h=>JSON.stringify(h)===JSON.stringify(custom)));
+  } finally {
+    assert.equal(path.dirname(fs.realpathSync(dir)),parent);assert.ok(path.basename(dir).startsWith('nccgs-hook-repair-'));
+    assert.equal(fs.lstatSync(dir).isSymbolicLink(),false);fs.rmSync(dir,{recursive:true,force:true});
+  }
+});