nccgs 2.1.0 → 2.1.1

package/tests/autonomy.test.mjs

@@ -1,113 +1,126 @@
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import test from "node:test";
-import { launchPlan } from "../scripts/run.mjs";
-import { autonomyPolicy, fullTaskAutonomy } from "../.claude/nccgs/tools/autonomy.mjs";
-import { safeTaskCommand } from "../.claude/nccgs/tools/tool-guard.mjs";
-import { canonicalInputs } from "../.claude/nccgs/tools/inputs.mjs";
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-function fixture() {
-  const base = fs.realpathSync(os.tmpdir());
-  const directory = fs.mkdtempSync(path.join(base, "nccgs-autonomy-test-"));
-  const project = path.join(directory, "Project with spaces");
-  fs.mkdirSync(project);
-  for (const name of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(project, name));
-  const env = { ...process.env };
-  for (const name of ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "NCCGS_PROJECT_ROOT", "NCCGS_TASK_AUTONOMY", "CLAUDE_PROJECT_DIR"]) delete env[name];
-  const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args, "--project", project], { cwd: directory, env, encoding: "utf8" });
-  const write = (relative, value) => { const file = path.join(project, relative); fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, JSON.stringify(value)); };
-  return { project, directory, env, run, write, dispose() {
-    assert.equal(path.dirname(fs.realpathSync(directory)).toLowerCase(), base.toLowerCase());
-    assert.ok(path.basename(directory).startsWith("nccgs-autonomy-test-"));
-    assert.equal(fs.lstatSync(directory).isSymbolicLink(), false);
-    fs.rmSync(directory, { recursive: true, force: true });
-  } };
-}
-
-test("fresh installs select full task sessions while native flags and all guards remain explicit", () => {
-  const f = fixture();
-  try {
-    const installed = f.run("install"); assert.equal(installed.status, 0, installed.stderr + installed.stdout);
-    assert.equal(autonomyPolicy(f.project).mode, "full");
-    const plan = launchPlan(["--project", f.project, "--claude", "C:/Program Files/Claude/claude.exe", "--", "-p", "literal ; task $()", "--model", "sonnet"], f.env);
-    assert.deepEqual(plan.args, ["--permission-mode", "bypassPermissions", "-p", "literal ; task $()", "--model", "sonnet"]);
-    assert.equal(plan.project, fs.realpathSync(f.project));
-    assert.equal(plan.env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS, "1");
-    assert.equal(launchPlan(["--project", f.project], { ...f.env, CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "0", CLAUDE_AUTO_BACKGROUND_TASKS: "1" }).env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS, "1");
-    assert.equal(fullTaskAutonomy(f.project, plan.env), true);
-    assert.equal(fullTaskAutonomy(f.project, f.env), false);
-    const settings = JSON.parse(fs.readFileSync(path.join(f.project, ".claude/settings.json")));
-    assert.ok(settings.permissions.deny.includes("Bash(git reset --hard*)"));
-    assert.match(JSON.stringify(settings.hooks), /CLAUDE_PROJECT_DIR/);
-    assert.equal(f.run("doctor").status, 0);
-    const dry = f.run("run", "--dry-run"); assert.equal(dry.status, 0, dry.stderr);
-    assert.equal(JSON.parse(dry.stdout).mode, "full");
-    assert.equal(JSON.parse(dry.stdout).nativeBackgroundTasks, false);
-    assert.throws(() => launchPlan(["--project", f.project, "--", "--permission-mode=default"], f.env), /conflicting/);
-    assert.throws(() => launchPlan(["--project", f.project], { ...f.env, CLAUDECODE: "1" }), /external/);
-    assert.throws(() => launchPlan(["--project", f.project, "--", "--setting-sources", "user"], f.env), /conflicting/);
-  } finally { f.dispose(); }
-});
-
-test("updates preserve legacy permissions and migrate hook paths without duplicating custom hooks", () => {
-  const f = fixture();
-  try {
-    assert.equal(f.run("install", "--autonomy", "guarded").status, 0);
-    fs.unlinkSync(path.join(f.project, ".nccgs/autonomy.json")); // legacy absence
-    const file = path.join(f.project, ".claude/settings.json");
-    const settings = JSON.parse(fs.readFileSync(file));
-    settings.permissions.ask = ["Bash(custom-policy-command *)"];
-    settings.hooks.SessionStart[0].hooks[0].command = "node .claude/nccgs/hooks/session-start.mjs";
-    settings.hooks.SessionStart[0].hooks.push({ type: "command", command: "custom-start" });
-    fs.writeFileSync(file, JSON.stringify(settings));
-    const dry = f.run("update", "--autonomy", "full", "--dry-run");
-    assert.equal(dry.status, 0, dry.stderr); assert.equal(autonomyPolicy(f.project).mode, "guarded");
-    const unchanged = f.run("update"); assert.equal(unchanged.status, 0, unchanged.stderr);
-    assert.equal(autonomyPolicy(f.project).mode, "guarded");
-    assert.equal(launchPlan(["--project", f.project], f.env).args[1], "default");
-    const enabled = f.run("update", "--autonomy", "full"); assert.equal(enabled.status, 0, enabled.stderr);
-    const actual = JSON.parse(fs.readFileSync(file));
-    assert.deepEqual(actual.permissions.ask, ["Bash(custom-policy-command *)"]);
-    const commands = actual.hooks.SessionStart.flatMap(group => group.hooks.map(h => h.command));
-    assert.equal(commands.filter(command => command.includes("session-start.mjs")).length, 1);
-    assert.ok(commands.includes("custom-start"));
-    assert.ok(actual.permissions.deny.includes("Bash(git reset --hard*)"));
-    const before = canonicalInputs(f.project).sha256;
-    f.write(".nccgs/autonomy.json", { schemaVersion: 1, mode: "guarded" });
-    assert.notEqual(canonicalInputs(f.project).sha256, before);
-  } finally { f.dispose(); }
-});
-
-test("report punctuation is data while shell composition and foreign task roots remain blocked", () => {
-  const f = fixture();
-  try {
-    const prefix = "node .claude/nccgs/tools/task.mjs report --id task --outcome partial --summary ";
-    for (const summary of ['"build passed; stress pending"', "'literal $(not executed); > output | text'", '"line one\nline two; done"']) assert.equal(safeTaskCommand(prefix + summary, f.project), "report");
-    for (const summary of ['"$(touch bad)"', '"`touch bad`"', '"unfinished', '"ok"; echo bad', '"ok" > bad', '"ok" && echo bad']) assert.equal(safeTaskCommand(prefix + summary, f.project), null);
-    const absolute = `node "${f.project.replaceAll("\\", "/")}/.claude/nccgs/tools/task.mjs" report --project "${f.project}" --summary "yes; report"`;
-    assert.equal(safeTaskCommand(absolute, f.project), "report");
-    assert.equal(safeTaskCommand(absolute.replace(`--project "${f.project}"`, `--project "${f.directory}"`), f.project), null);
-  } finally { f.dispose(); }
-});
-
-test("hook execution from outside the project still uses its policy and rejects forged DONE", () => {
-  const f = fixture();
-  try {
-    assert.equal(f.run("install").status, 0);
-    const env = { ...f.env, NCCGS_PROJECT_ROOT: f.project, NCCGS_TASK_AUTONOMY: "full", CLAUDE_PROJECT_DIR: f.project };
-    const hook = (file, mode, input) => spawnSync(process.execPath, [path.join(f.project, ".claude/nccgs/hooks", file), mode], { cwd: f.directory, env, input: JSON.stringify(input), encoding: "utf8" });
-    const start = hook("session-start.mjs", "", { session_id: "fixture-session" });
-    assert.equal(start.status, 0, start.stderr); assert.match(start.stdout, /TASK AUTONOMY/);
-    const report = hook("closure-guard.mjs", "pre", { tool_name: "Bash", tool_input: { command: `node "${f.project.replaceAll("\\", "/")}/.claude/nccgs/tools/task.mjs" report --project "${f.project}" --id task --summary "test; report"` } });
-    assert.equal(report.status, 0, report.stderr);
-    const destructive = hook("protect-git.mjs", "", { tool_input: { command: "git reset --hard HEAD" } });
-    assert.equal(destructive.status, 2);
-    const done = hook("closure-guard.mjs", "stop", { session_id: "fixture-session", last_assistant_message: "Status: DONE" });
-    assert.equal(JSON.parse(done.stdout).decision, "block");
-  } finally { f.dispose(); }
-});
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+import { launchPlan } from "../scripts/run.mjs";
+import { autonomyPolicy, conflictingLaunchOption, fullTaskAutonomy } from "../.claude/nccgs/tools/autonomy.mjs";
+import { safeTaskCommand } from "../.claude/nccgs/tools/tool-guard.mjs";
+import { canonicalInputs } from "../.claude/nccgs/tools/inputs.mjs";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+function fixture() {
+  const base = fs.realpathSync(os.tmpdir());
+  const directory = fs.mkdtempSync(path.join(base, "nccgs-autonomy-test-"));
+  const project = path.join(directory, "Project with spaces");
+  fs.mkdirSync(project);
+  for (const name of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(project, name));
+  const env = { ...process.env };
+  for (const name of ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "NCCGS_PROJECT_ROOT", "NCCGS_TASK_AUTONOMY", "CLAUDE_PROJECT_DIR"]) delete env[name];
+  const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args, "--project", project], { cwd: directory, env, encoding: "utf8" });
+  const write = (relative, value) => { const file = path.join(project, relative); fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, JSON.stringify(value)); };
+  return { project, directory, env, run, write, dispose() {
+    assert.equal(path.dirname(fs.realpathSync(directory)).toLowerCase(), base.toLowerCase());
+    assert.ok(path.basename(directory).startsWith("nccgs-autonomy-test-"));
+    assert.equal(fs.lstatSync(directory).isSymbolicLink(), false);
+    fs.rmSync(directory, { recursive: true, force: true });
+  } };
+}
+
+test("fresh installs select full task sessions while native flags and all guards remain explicit", () => {
+  const f = fixture();
+  try {
+    const installed = f.run("install"); assert.equal(installed.status, 0, installed.stderr + installed.stdout);
+    assert.equal(autonomyPolicy(f.project).mode, "full");
+    const plan = launchPlan(["--project", f.project, "--claude", "C:/Program Files/Claude/claude.exe", "--", "-p", "literal ; task $()", "--model", "sonnet"], f.env);
+    // R08: strict isolation directly follows the owned permission prefix, before every caller argument.
+    assert.deepEqual(plan.args, ["--permission-mode", "bypassPermissions", "--strict-mcp-config", "-p", "literal ; task $()", "--model", "sonnet", "--mcp-config", '{"mcpServers":{}}']);
+    assert.equal(plan.project, fs.realpathSync(f.project));
+    assert.equal(plan.env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS, "1");
+    assert.equal(launchPlan(["--project", f.project], { ...f.env, CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "0", CLAUDE_AUTO_BACKGROUND_TASKS: "1" }).env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS, "1");
+    assert.equal(fullTaskAutonomy(f.project, plan.env), true);
+    assert.equal(fullTaskAutonomy(f.project, f.env), false);
+    const settings = JSON.parse(fs.readFileSync(path.join(f.project, ".claude/settings.json")));
+    assert.ok(settings.permissions.deny.includes("Bash(git reset --hard*)"));
+    assert.match(JSON.stringify(settings.hooks), /CLAUDE_PROJECT_DIR/);
+    assert.equal(f.run("doctor").status, 0);
+    const dry = f.run("run", "--dry-run"); assert.equal(dry.status, 0, dry.stderr);
+    assert.equal(JSON.parse(dry.stdout).mode, "full");
+    assert.equal(JSON.parse(dry.stdout).nativeBackgroundTasks, false);
+    assert.throws(() => launchPlan(["--project", f.project, "--", "--permission-mode=default"], f.env), /conflicting/);
+    assert.throws(() => launchPlan(["--project", f.project], { ...f.env, CLAUDECODE: "1" }), /external/);
+    assert.throws(() => launchPlan(["--project", f.project, "--", "--setting-sources", "user"], f.env), /conflicting/);
+    for (const form of ["--restricted", "--restricted=true", "--restricted=false", "--restricted="])
+      assert.throws(() => launchPlan(["--project", f.project, "--", "-p", "x", form], f.env), /conflicting/, form);
+    assert.deepEqual(launchPlan(["--project", f.project, "--", "-p", "restricted", "--restricted-mode"], f.env).args.slice(0, 5),
+      ["--permission-mode", "bypassPermissions", "--strict-mcp-config", "-p", "restricted"]);
+  } finally { f.dispose(); }
+});
+
+test("R09 shared launch-ownership policy covers --restricted and keeps R08 forms", () => {
+  for (const form of ["--restricted", "--restricted=true", "--restricted=false", "--restricted=", "--bare", "--bare=", "--safe-mode", "--safe-mode=false", "--permission-mode", "--settings=x", "-w"])
+    assert.equal(conflictingLaunchOption.test(form), true, form);
+  for (const value of ["restricted", "--restricted-mode", "--restrictedx", "--unrestricted", "-restricted", "--print", "bare", "--bare-metal", "--safe-modes"])
+    assert.equal(conflictingLaunchOption.test(value), false, value);
+});
+
+test("updates preserve legacy permissions and migrate hook paths without duplicating custom hooks", () => {
+  const f = fixture();
+  try {
+    assert.equal(f.run("install", "--autonomy", "guarded").status, 0);
+    fs.unlinkSync(path.join(f.project, ".nccgs/autonomy.json")); // legacy absence
+    const file = path.join(f.project, ".claude/settings.json");
+    const settings = JSON.parse(fs.readFileSync(file));
+    settings.permissions.ask = ["Bash(custom-policy-command *)"];
+    delete settings.hooks.SessionStart[0].hooks[0].args;
+    settings.hooks.SessionStart[0].hooks[0].command = "node .claude/nccgs/hooks/session-start.mjs";
+    settings.hooks.SessionStart[0].hooks.push({ type: "command", command: "custom-start" });
+    fs.writeFileSync(file, JSON.stringify(settings));
+    const dry = f.run("update", "--autonomy", "full", "--dry-run");
+    assert.equal(dry.status, 0, dry.stderr); assert.equal(autonomyPolicy(f.project).mode, "guarded");
+    const unchanged = f.run("update"); assert.equal(unchanged.status, 0, unchanged.stderr);
+    assert.equal(autonomyPolicy(f.project).mode, "guarded");
+    assert.equal(launchPlan(["--project", f.project], f.env).args[1], "default");
+    const enabled = f.run("update", "--autonomy", "full"); assert.equal(enabled.status, 0, enabled.stderr);
+    const actual = JSON.parse(fs.readFileSync(file));
+    assert.deepEqual(actual.permissions.ask, ["Bash(custom-policy-command *)"]);
+    const commands = actual.hooks.SessionStart.flatMap(group => group.hooks.map(h => [h.command, ...(h.args ?? [])].join(" ")));
+    assert.equal(commands.filter(command => command.includes("session-start.mjs")).length, 1);
+    assert.ok(commands.includes("custom-start"));
+    assert.ok(actual.permissions.deny.includes("Bash(git reset --hard*)"));
+    const before = canonicalInputs(f.project).sha256;
+    f.write(".nccgs/autonomy.json", { schemaVersion: 1, mode: "guarded" });
+    assert.notEqual(canonicalInputs(f.project).sha256, before);
+  } finally { f.dispose(); }
+});
+
+test("report punctuation is data while shell composition and foreign task roots remain blocked", () => {
+  const f = fixture();
+  try {
+    const prefix = "node .claude/nccgs/tools/task.mjs report --id task --outcome partial --summary ";
+    for (const summary of ['"build passed; stress pending"', "'literal $(not executed); > output | text'", '"line one\nline two; done"']) assert.equal(safeTaskCommand(prefix + summary, f.project), "report");
+    for (const summary of ['"$(touch bad)"', '"`touch bad`"', '"unfinished', '"ok"; echo bad', '"ok" > bad', '"ok" && echo bad']) assert.equal(safeTaskCommand(prefix + summary, f.project), null);
+    const absolute = `node "${f.project.replaceAll("\\", "/")}/.claude/nccgs/tools/task.mjs" report --project "${f.project}" --summary "yes; report"`;
+    assert.equal(safeTaskCommand(absolute, f.project), "report");
+    assert.equal(safeTaskCommand(absolute.replace(`--project "${f.project}"`, `--project "${f.directory}"`), f.project), null);
+  } finally { f.dispose(); }
+});
+
+test("hook execution from outside the project still uses its policy and rejects forged DONE", () => {
+  const f = fixture();
+  try {
+    assert.equal(f.run("install").status, 0);
+    const env = { ...f.env, NCCGS_PROJECT_ROOT: f.project, NCCGS_TASK_AUTONOMY: "full", CLAUDE_PROJECT_DIR: f.project };
+    const hook = (file, mode, input) => spawnSync(process.execPath, [path.join(f.project, ".claude/nccgs/hooks", file), mode], { cwd: f.directory, env, input: JSON.stringify(input), encoding: "utf8" });
+    const start = hook("session-start.mjs", "", { session_id: "fixture-session" });
+    assert.equal(start.status, 0, start.stderr); assert.match(start.stdout, /TASK AUTONOMY/);
+    const report = hook("closure-guard.mjs", "pre", { tool_name: "Bash", tool_input: { command: `node "${f.project.replaceAll("\\", "/")}/.claude/nccgs/tools/task.mjs" report --project "${f.project}" --id task --summary "test; report"` } });
+    assert.equal(report.status, 0, report.stderr);
+    const destructive = hook("protect-git.mjs", "", { tool_input: { command: "git reset --hard HEAD" } });
+    assert.equal(destructive.status, 2);
+    const done = hook("closure-guard.mjs", "stop", { session_id: "fixture-session", last_assistant_message: "Status: DONE" });
+    assert.equal(JSON.parse(done.stdout).decision, "block");
+  } finally { f.dispose(); }
+});