principles-disciple 1.127.0 → 1.129.0

package/tests/hooks/gate-block-helper-profile.test.ts

@@ -1,186 +0,0 @@
-/**
- * Gate Block Helper — PROFILE loading resilience tests
- *
- * Verifies that recordGateBlockAndReturn handles malformed/oversized PROFILE
- * gracefully: try/catch, 1MB size guard, fallback to non-risky, no crash.
- *
- * ERR checklist:
- * - ERR-026: All PROFILE loads have try/catch (gate-block-helper.ts matches pain.ts)
- * - ERR-024/025: Production-path tests for the edge case
- */
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-import { WorkspaceContext } from '../../src/core/workspace-context.js';
-import { EventLogService } from '../../src/core/event-log.js';
-import { clearSession } from '../../src/core/session-tracker.js';
-import { resetPainDiagnosticGateForTest } from '../../src/core/pain-diagnostic-gate.js';
-
-vi.mock('fs');
-vi.mock('../../src/utils/io.js', () => ({
-  isRisky: vi.fn(() => false),
-}));
-vi.mock('../../src/core/evolution-engine.js', () => ({
-  recordEvolutionSuccess: vi.fn(),
-  recordEvolutionFailure: vi.fn(),
-}));
-vi.mock('../../src/core/evolution-logger.js', () => ({
-  createTraceId: vi.fn(() => 'trace-123'),
-  getEvolutionLogger: vi.fn(() => ({
-    logPainDetected: vi.fn(),
-  })),
-}));
-vi.mock('../../src/core/pd-config-loader.js', () => ({
-  loadPdConfigForPlugin: vi.fn(() => ({ ok: true, source: 'mock', effective: {}, errors: [] })),
-  loadFeatureFlagFromConfig: vi.fn(() => ({ enabled: true, source: 'test' })),
-}));
-
-const mockEmitSync = vi.fn();
-const mockRecordProbationFeedback = vi.fn();
-const mockUpdatePrincipleValueMetrics = vi.fn();
-
-function makeTestWctx(overrides: Record<string, unknown> = {}) {
-  return {
-    workspaceDir: '/mock/workspace',
-    stateDir: '/mock/state',
-    config: { get: vi.fn().mockReturnValue(40) },
-    eventLog: {
-      recordGateBlock: vi.fn(),
-      recordPainSignal: vi.fn(),
-    },
-    trajectory: {
-      recordGateBlock: vi.fn(),
-      recordPainEvent: vi.fn(),
-      recordToolCall: vi.fn(),
-    },
-    principleTreeLedger: {
-      updatePrincipleValueMetrics: mockUpdatePrincipleValueMetrics,
-    },
-    evolutionReducer: {
-      emitSync: mockEmitSync,
-      recordProbationFeedback: mockRecordProbationFeedback,
-      getPrincipleById: vi.fn(),
-    },
-    resolve: vi.fn().mockImplementation((key: string) => {
-      if (key === 'PROFILE') return '/mock/workspace/PROFILE.json';
-      return '';
-    }),
-    ...overrides,
-  };
-}
-
-describe('Gate Block Helper — PROFILE Resilience', () => {
-  const sessionId = 's-profile-test';
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockEmitSync.mockReset();
-    mockRecordProbationFeedback.mockReset();
-    mockUpdatePrincipleValueMetrics.mockReset();
-    vi.spyOn(WorkspaceContext, 'fromHookContext').mockReturnValue(makeTestWctx() as any);
-    vi.spyOn(EventLogService, 'get').mockReturnValue({} as any);
-    clearSession(sessionId);
-    resetPainDiagnosticGateForTest();
-  });
-
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it('malformed PROFILE.json does not throw, returns block result with non-risky fallback', async () => {
-    // Arrange: PROFILE exists but contains invalid JSON
-    vi.mocked(fs.existsSync).mockReturnValue(true);
-    vi.mocked(fs.readFileSync).mockReturnValue('{ invalid json }');
-
-    // Dynamic import AFTER mocks are set up
-    const { recordGateBlockAndReturn } = await import('../../src/hooks/gate-block-helper.js');
-
-    // Act & Assert: does NOT throw
-    const result = recordGateBlockAndReturn(
-      makeTestWctx() as any,
-      {
-        filePath: 'src/danger.ts',
-        reason: 'Test block reason',
-        toolName: 'write',
-        sessionId,
-      },
-      { warn: vi.fn(), error: vi.fn(), info: vi.fn() },
-    );
-
-    expect(result).toBeDefined();
-    expect(result.block).toBe(true);
-    expect(result.blockReason).toContain('Security Gate Blocked');
-    // verify emitPainDetectedEvent was NOT called (triage fell back to non-risky)
-    expect(mockEmitSync).not.toHaveBeenCalled();
-  });
-
-  it('oversized PROFILE (>1MB) falls back to non-risky without crash', async () => {
-    // Arrange: PROFILE > 1MB
-    vi.mocked(fs.existsSync).mockReturnValue(true);
-    vi.mocked(fs.readFileSync).mockReturnValue('x'.repeat(1024 * 1024 + 1));
-
-    const { recordGateBlockAndReturn } = await import('../../src/hooks/gate-block-helper.js');
-
-    const result = recordGateBlockAndReturn(
-      makeTestWctx() as any,
-      {
-        filePath: 'src/danger.ts',
-        reason: 'Test block reason',
-        toolName: 'write',
-        sessionId,
-      },
-      { warn: vi.fn(), error: vi.fn(), info: vi.fn() },
-    );
-
-    expect(result).toBeDefined();
-    expect(result.block).toBe(true);
-    expect(mockEmitSync).not.toHaveBeenCalled();
-  });
-
-  it('missing PROFILE.json defaults to non-risky without error', async () => {
-    // Arrange: PROFILE does not exist
-    vi.mocked(fs.existsSync).mockReturnValue(false);
-
-    const { recordGateBlockAndReturn } = await import('../../src/hooks/gate-block-helper.js');
-
-    const result = recordGateBlockAndReturn(
-      makeTestWctx() as any,
-      {
-        filePath: 'src/danger.ts',
-        reason: 'Test block',
-        toolName: 'edit',
-        sessionId,
-      },
-      { warn: vi.fn(), error: vi.fn(), info: vi.fn() },
-    );
-
-    expect(result).toBeDefined();
-    expect(result.block).toBe(true);
-  });
-
-  it('fs.readFileSync permission error falls back gracefully', async () => {
-    // Arrange: existsSync returns true but readFileSync throws
-    vi.mocked(fs.existsSync).mockReturnValue(true);
-    vi.mocked(fs.readFileSync).mockImplementation(() => {
-      throw new Error('EACCES: permission denied');
-    });
-
-    const { recordGateBlockAndReturn } = await import('../../src/hooks/gate-block-helper.js');
-
-    const result = recordGateBlockAndReturn(
-      makeTestWctx() as any,
-      {
-        filePath: 'src/danger.ts',
-        reason: 'Test block',
-        toolName: 'write',
-        sessionId,
-      },
-      { warn: vi.fn(), error: vi.fn(), info: vi.fn() },
-    );
-
-    expect(result).toBeDefined();
-    expect(result.block).toBe(true);
-  });
-});

package/tests/hooks/gate-no-path-write-tool.test.ts

@@ -1,171 +0,0 @@
-/**
- * Regression test: write tools without file_path must still go through RuleHost.
- *
- * PRI-286 P1: After removing confirm-first gate, write tools (apply_patch, patch, etc.)
- * that have no file_path/path/file/target param must NOT be silently allowed.
- * They must use a synthetic path `<tool:${toolName}>` and still evaluate via RuleHost.
- *
- * Uses vi.hoisted + mock of WorkspaceContext to avoid isolation issues in full suite.
- * WorkspaceContext is the key — in full suite, other test files initialize the real
- * context which caches a real EventLogService that doesn't have our mock methods.
- */
-
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-
-// vi.hoisted ensures these are available to vi.mock factories at hoist time
-const { mockEvaluate, mockEventLog, mockEvolution } = vi.hoisted(() => {
-  const mockEvaluate = vi.fn().mockReturnValue(undefined);
-  const mockEventLog = {
-    recordRuleHostEvaluated: vi.fn(),
-    recordRuleEnforced: vi.fn(),
-    recordRuleHostBlocked: vi.fn(),
-    recordRuleHostRequireApproval: vi.fn(),
-    recordRuleHostAutoCorrectProposed: vi.fn(),
-    recordRuleHostAutoCorrectApplied: vi.fn(),
-    recordGateBlock: vi.fn(),
-    recordSession: vi.fn(),
-  };
-  const mockEvolution = {
-    getTier: vi.fn().mockReturnValue(3),
-    getPoints: vi.fn().mockReturnValue(200),
-  };
-  return { mockEvaluate, mockEventLog, mockEvolution };
-});
-
-vi.mock('../../src/core/session-tracker.js', () => ({
-  getSession: vi.fn(() => ({ currentGfi: 0 })),
-  trackBlock: vi.fn(),
-  hasRecentThinking: vi.fn(() => false),
-}));
-
-vi.mock('../../src/core/evolution-engine.js', () => ({
-  getEvolutionEngine: vi.fn(() => mockEvolution),
-}));
-
-vi.mock('../../src/core/event-log.js', () => ({
-  EventLogService: { get: vi.fn(() => mockEventLog) },
-}));
-
-vi.mock('../../src/core/rule-host.js', () => ({
-  RuleHost: vi.fn(function(this: any, _stateDir: string, _logger: any) {
-    this.evaluate = mockEvaluate;
-  }),
-}));
-
-vi.mock('../../src/core/principle-tree-ledger.js', () => ({
-  loadLedger: vi.fn(),
-}));
-
-// Mock WorkspaceContext to return a controlled instance with our mockEventLog.
-// This prevents full-suite caching of real WorkspaceContext instances.
-vi.mock('../../src/core/workspace-context.js', () => {
-  return {
-    WorkspaceContext: {
-      fromHookContext: vi.fn((ctx: any) => ({
-        workspaceDir: ctx.workspaceDir,
-        stateDir: ctx.workspaceDir + '/.state',
-        eventLog: mockEventLog,
-        trajectory: {
-          recordGateBlock: vi.fn(),
-          recordPainEvent: vi.fn(),
-          recordSession: vi.fn(),
-        },
-        config: {
-          get: vi.fn().mockReturnValue(undefined),
-        },
-      })),
-    },
-  };
-});
-
-// Dynamic import AFTER mocks are set up
-const { handleBeforeToolCall } = await import('../../src/hooks/gate.js');
-
-const workspaceDir = '/mock/workspace';
-const sessionId = 'test-no-path';
-
-describe('Write tools without file_path must go through RuleHost', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockEvaluate.mockReturnValue(undefined);
-  });
-
-  it('apply_patch with no path triggers RuleHost evaluate', () => {
-    mockEvaluate.mockReturnValue(undefined); // allow
-
-    const result = handleBeforeToolCall(
-      { toolName: 'apply_patch', params: { patch: 'some diff content' } } as any,
-      { workspaceDir, sessionId } as any,
-    );
-
-    // Should not be blocked (RuleHost returned undefined = allow)
-    expect(result).toBeUndefined();
-    // But RuleHost MUST have been called
-    expect(mockEvaluate).toHaveBeenCalledTimes(1);
-    // Verify synthetic path was used
-    const input = mockEvaluate.mock.calls[0][0];
-    expect(input.action.normalizedPath).toBe('<tool:apply_patch>');
-  });
-
-  it('apply_patch with no path: RuleHost block must return block', () => {
-    mockEvaluate.mockReturnValue({
-      decision: 'block',
-      matched: true,
-      reason: 'Test block: write tool without path',
-      ruleId: 'R_TEST',
-      principleId: 'P_TEST',
-    });
-
-    const result = handleBeforeToolCall(
-      { toolName: 'apply_patch', params: { patch: 'dangerous content' } } as any,
-      { workspaceDir, sessionId } as any,
-    );
-
-    expect(result).toBeDefined();
-    expect(result?.block).toBe(true);
-    expect(result?.blockReason).toContain('Test block: write tool without path');
-    expect(mockEvaluate).toHaveBeenCalledTimes(1);
-    expect(mockEvaluate.mock.calls[0][0].action.normalizedPath).toBe('<tool:apply_patch>');
-  });
-
-  it('patch tool with no path triggers RuleHost evaluate', () => {
-    mockEvaluate.mockReturnValue(undefined); // allow
-
-    const result = handleBeforeToolCall(
-      { toolName: 'patch', params: {} } as any,
-      { workspaceDir, sessionId } as any,
-    );
-
-    expect(result).toBeUndefined();
-    expect(mockEvaluate).toHaveBeenCalledTimes(1);
-    expect(mockEvaluate.mock.calls[0][0].action.normalizedPath).toBe('<tool:patch>');
-  });
-
-  it('Write tool with valid file_path still uses real path', () => {
-    mockEvaluate.mockReturnValue(undefined); // allow
-
-    const result = handleBeforeToolCall(
-      { toolName: 'write', params: { file_path: '/mock/workspace/src/app.ts', content: 'x' } } as any,
-      { workspaceDir, sessionId } as any,
-    );
-
-    expect(result).toBeUndefined();
-    expect(mockEvaluate).toHaveBeenCalledTimes(1);
-    expect(mockEvaluate.mock.calls[0][0].action.normalizedPath).toBe('src/app.ts');
-  });
-
-  it('bash with no file target still goes through RuleHost (existing behavior)', () => {
-    mockEvaluate.mockReturnValue(undefined); // allow
-
-    const result = handleBeforeToolCall(
-      { toolName: 'bash', params: { command: 'echo hello' } } as any,
-      { workspaceDir, sessionId } as any,
-    );
-
-    expect(result).toBeUndefined();
-    expect(mockEvaluate).toHaveBeenCalledTimes(1);
-    // Bash without file target uses the full command as path (existing heuristic)
-    const input = mockEvaluate.mock.calls[0][0];
-    expect(input.action.normalizedPath).toContain('echo hello');
-  });
-});

package/tests/hooks/gate-rule-host-pipeline.test.ts

@@ -1,230 +0,0 @@
-/**
- * Gate Rule Host Only - Pipeline Integration Tests
- *
- * PURPOSE: Verify gate.ts with Rule Host Only (no hardcoded gates).
- *
- * Tests:
- * 1. Rule Host blocks operation → block result with blockSource='rule-host'
- * 2. Rule Host allow (no match) → operation passes
- * 3. Rule Host throws → degrades conservatively, allows operation
- * 4. Rule Host requireApproval → records event, does not block
- * 5. Non-target tools (read) → pass through early
- */
-
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { handleBeforeToolCall } from '../../src/hooks/gate.js';
-import * as sessionTracker from '../../src/core/session-tracker.js';
-import * as evolutionEngine from '../../src/core/evolution-engine.js';
-
-const workspaceDir = '/mock/workspace';
-const sessionId = 'test-session-rh';
-
-const mockEvolution = {
-  getTier: vi.fn().mockReturnValue(3),
-  getPoints: vi.fn().mockReturnValue(200),
-};
-
-vi.mock('../../src/core/session-tracker.js', () => ({
-  getSession: vi.fn(() => ({ currentGfi: 0 })),
-  trackBlock: vi.fn(),
-  hasRecentThinking: vi.fn(() => false),
-}));
-
-vi.mock('../../src/core/evolution-engine.js', () => ({
-  getEvolutionEngine: vi.fn(() => mockEvolution),
-}));
-
-const mockEventLogInstance = {
-  recordRuleHostEvaluated: vi.fn(),
-  recordRuleEnforced: vi.fn(),
-  recordRuleHostBlocked: vi.fn(),
-  recordRuleHostRequireApproval: vi.fn(),
-};
-vi.mock('../../src/core/event-log.js', () => ({
-  EventLogService: { get: vi.fn(() => mockEventLogInstance) },
-}));
-
-let _mockEvaluate = vi.fn().mockReturnValue(undefined);
-vi.mock('../../src/core/rule-host.js', () => ({
-  RuleHost: vi.fn(function(this: any, _stateDir: string, _logger: any) {
-    this.evaluate = _mockEvaluate;
-  }),
-}));
-
-vi.mock('../../src/core/principle-tree-ledger.js', () => ({
-  loadLedger: vi.fn(),
-}));
-
-describe('Gate Rule Host Only Pipeline', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    _mockEvaluate = vi.fn().mockReturnValue(undefined);
-  });
-
-  describe('Rule Host blocks', () => {
-    // PRE-EXISTING: passes in isolation, fails in full suite — unrelated to M8
-    it.skip('should block with blockSource=rule-host when Rule Host returns block', () => {
-      _mockEvaluate = vi.fn().mockReturnValue({
-        decision: 'block',
-        matched: true,
-        reason: 'Dangerous git force-push detected',
-        ruleId: 'R_001',
-        principleId: 'P_001',
-      });
-
-      const event = {
-        toolName: 'bash',
-        params: { command: 'git push --force' },
-      };
-
-      const result = handleBeforeToolCall(event as any, { workspaceDir, sessionId } as any);
-
-      expect(result).toBeDefined();
-      expect(result?.block).toBe(true);
-      expect(result?.blockReason).toContain('Dangerous git force-push detected');
-    });
-
-    it('should record rulehost_blocked event when Rule Host blocks', () => {
-      _mockEvaluate = vi.fn().mockReturnValue({
-        decision: 'block',
-        matched: true,
-        reason: 'High-risk path',
-        ruleId: 'R_002',
-      });
-
-      const event = {
-        toolName: 'write',
-        params: { file_path: 'src/danger.ts', content: 'bad' },
-      };
-
-      handleBeforeToolCall(event as any, { workspaceDir, sessionId } as any);
-
-      expect(mockEventLogInstance.recordRuleHostBlocked).toHaveBeenCalledWith(
-        expect.objectContaining({
-          toolName: 'write',
-          ruleId: 'R_002',
-        })
-      );
-    });
-  });
-
-  describe('Rule Host allows', () => {
-    it('should allow when Rule Host returns undefined (no match)', () => {
-      _mockEvaluate = vi.fn().mockReturnValue(undefined);
-
-      const event = {
-        toolName: 'write',
-        params: { file_path: 'src/safe.ts', content: 'const x = 1' },
-      };
-
-      const result = handleBeforeToolCall(event as any, { workspaceDir, sessionId } as any);
-
-      expect(result).toBeUndefined();
-    });
-
-    it('should record rulehost_evaluated even when no match', () => {
-      _mockEvaluate = vi.fn().mockReturnValue(undefined);
-
-      const event = {
-        toolName: 'edit',
-        params: { file_path: 'src/config.ts', oldText: 'x', newText: 'y' },
-      };
-
-      handleBeforeToolCall(event as any, { workspaceDir, sessionId } as any);
-
-      expect(mockEventLogInstance.recordRuleHostEvaluated).toHaveBeenCalledWith(
-        expect.objectContaining({
-          toolName: 'edit',
-          matched: false,
-          decision: 'allow',
-        })
-      );
-    });
-  });
-
-  describe('Rule Host degradation', () => {
-    it('should allow operation when Rule Host throws (conservative degradation)', () => {
-      _mockEvaluate = vi.fn().mockImplementation(() => {
-        throw new Error('Host internal error');
-      });
-
-      const event = {
-        toolName: 'bash',
-        params: { command: 'ls -la' },
-      };
-
-      const result = handleBeforeToolCall(event as any, { workspaceDir, sessionId } as any);
-
-      expect(result).toBeUndefined();
-    });
-  });
-
-  describe('Rule Host requireApproval', () => {
-    it('should not block when Rule Host returns requireApproval', () => {
-      _mockEvaluate = vi.fn().mockReturnValue({
-        decision: 'requireApproval',
-        matched: true,
-        reason: 'High-risk operation needs approval',
-        ruleId: 'R_003',
-      });
-
-      const event = {
-        toolName: 'bash',
-        params: { command: 'rm -rf node_modules' },
-      };
-
-      const result = handleBeforeToolCall(event as any, { workspaceDir, sessionId } as any);
-
-      expect(result).toBeUndefined();
-      expect(mockEventLogInstance.recordRuleEnforced).toHaveBeenCalledWith(
-        expect.objectContaining({ enforcement: 'requireApproval' })
-      );
-    });
-  });
-
-  describe('Early return for non-target tools', () => {
-    it('should allow read tool without calling Rule Host', () => {
-      const event = {
-        toolName: 'read',
-        params: { file_path: 'src/readonly.ts' },
-      };
-
-      const result = handleBeforeToolCall(event as any, { workspaceDir, sessionId } as any);
-
-      expect(result).toBeUndefined();
-      expect(_mockEvaluate).not.toHaveBeenCalled();
-    });
-
-    it('should allow agent tool without calling Rule Host when no workspace', () => {
-      const event = {
-        toolName: 'agent',
-        params: { task: 'do something' },
-      };
-
-      const result = handleBeforeToolCall(event as any, { sessionId } as any);
-
-      expect(result).toBeUndefined();
-      expect(_mockEvaluate).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('Session GFI context', () => {
-    it('should pass current GFI to Rule Host', () => {
-      _mockEvaluate = vi.fn().mockReturnValue(undefined);
-      vi.mocked(sessionTracker.getSession).mockReturnValue({ currentGfi: 75 } as any);
-
-      const event = {
-        toolName: 'write',
-        params: { file_path: 'src/test.ts', content: 'x' },
-      };
-
-      handleBeforeToolCall(event as any, { workspaceDir, sessionId } as any);
-
-      expect(_mockEvaluate).toHaveBeenCalledWith(
-        expect.objectContaining({
-          session: expect.objectContaining({ currentGfi: 75 }),
-        })
-      );
-    });
-  });
-});