thanh-kit 2.5.0 → 2.5.2

package/templates/hooks/__tests__/integration/path-resolution.test.cjs

@@ -0,0 +1,319 @@
+#!/usr/bin/env node
+/**
+ * Integration tests for Issue #327: Path Resolution
+ * Run: node --test .claude/hooks/__tests__/integration/path-resolution.test.cjs
+ *
+ * Tests the full workflow of path resolution across all hooks:
+ * - session-init.cjs
+ * - subagent-init.cjs
+ * - dev-rules-reminder.cjs
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const { spawn, execSync } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+const HOOKS_DIR = path.join(__dirname, '..', '..');
+
+/**
+ * Run a hook with given input
+ */
+function runHook(hookName, inputData, options = {}) {
+  return new Promise((resolve, reject) => {
+    const hookPath = path.join(HOOKS_DIR, hookName);
+    const proc = spawn('node', [hookPath], {
+      cwd: options.cwd || process.cwd(),
+      env: {
+        ...process.env,
+        CLAUDE_ENV_FILE: '',
+        ...options.env
+      }
+    });
+
+    let stdout = '';
+    let stderr = '';
+
+    proc.stdout.on('data', (data) => { stdout += data.toString(); });
+    proc.stderr.on('data', (data) => { stderr += data.toString(); });
+
+    if (inputData) {
+      proc.stdin.write(JSON.stringify(inputData));
+    }
+    proc.stdin.end();
+
+    proc.on('close', (code) => {
+      let output = null;
+      try { output = JSON.parse(stdout); } catch (e) { /* non-JSON is fine */ }
+      resolve({ stdout, stderr, exitCode: code, output });
+    });
+
+    proc.on('error', reject);
+    setTimeout(() => { proc.kill('SIGTERM'); reject(new Error('timeout')); }, 10000);
+  });
+}
+
+/**
+ * Get git root
+ */
+function getGitRoot(cwd = process.cwd()) {
+  try {
+    return execSync('git rev-parse --show-toplevel', { encoding: 'utf8', cwd }).trim();
+  } catch (e) {
+    return null;
+  }
+}
+
+describe('Issue #327: Path Resolution Integration', () => {
+
+  describe('Subdirectory Workflow', () => {
+
+    it('all hooks use CWD as base when in subdirectory', async () => {
+      const gitRoot = getGitRoot();
+      if (!gitRoot) {
+        console.log('  → Skipped: not in git repo');
+        return;
+      }
+
+      const subdirPath = path.join(gitRoot, '.claude', 'hooks');
+      if (!fs.existsSync(subdirPath)) {
+        console.log('  → Skipped: subdirectory does not exist');
+        return;
+      }
+
+      // Run session-init from subdirectory
+      const sessionResult = await runHook('session-init.cjs', { source: 'startup' }, { cwd: subdirPath });
+      assert.strictEqual(sessionResult.exitCode, 0, 'session-init should succeed');
+
+      // Run subagent-init with subdirectory cwd
+      const subagentResult = await runHook('subagent-init.cjs', {
+        agent_type: 'test-agent',
+        agent_id: 'integration-test',
+        cwd: subdirPath
+      }, { cwd: subdirPath });
+      assert.strictEqual(subagentResult.exitCode, 0, 'subagent-init should succeed');
+
+      // Run dev-rules-reminder from subdirectory
+      const devRulesResult = await runHook('dev-rules-reminder.cjs', { user_prompt: 'test' }, { cwd: subdirPath });
+      assert.strictEqual(devRulesResult.exitCode, 0, 'dev-rules-reminder should succeed');
+
+      // Verify subagent output includes subdirectory path
+      const subagentContext = subagentResult.output?.hookSpecificOutput?.additionalContext || '';
+      assert.ok(
+        subagentContext.includes(subdirPath) || subagentContext.includes('.claude/hooks'),
+        'Subagent should reference subdirectory'
+      );
+    });
+
+    it('session-init shows subdirectory info message', async () => {
+      const gitRoot = getGitRoot();
+      if (!gitRoot) {
+        console.log('  → Skipped: not in git repo');
+        return;
+      }
+
+      const subdirPath = path.join(gitRoot, '.claude', 'hooks');
+      if (!fs.existsSync(subdirPath)) {
+        console.log('  → Skipped: subdirectory does not exist');
+        return;
+      }
+
+      const result = await runHook('session-init.cjs', { source: 'startup' }, { cwd: subdirPath });
+
+      assert.strictEqual(result.exitCode, 0);
+      assert.ok(
+        result.stdout.includes('Subdirectory mode') || result.stdout.includes('Git root'),
+        'Should show subdirectory info when not at git root'
+      );
+    });
+
+    it('no subdirectory message when at git root', async () => {
+      const gitRoot = getGitRoot();
+      if (!gitRoot) {
+        console.log('  → Skipped: not in git repo');
+        return;
+      }
+
+      const result = await runHook('session-init.cjs', { source: 'startup' }, { cwd: gitRoot });
+
+      assert.strictEqual(result.exitCode, 0);
+      assert.ok(
+        !result.stdout.includes('Subdirectory mode'),
+        'Should NOT show subdirectory message at git root'
+      );
+    });
+
+  });
+
+  describe('Monorepo/Worktree Scenarios', () => {
+
+    it('subagent uses payload.cwd for path resolution', async () => {
+      const gitRoot = getGitRoot();
+      if (!gitRoot) {
+        console.log('  → Skipped: not in git repo');
+        return;
+      }
+
+      // Simulate subagent spawned with different CWD
+      const subdirPath = path.join(gitRoot, '.claude');
+      const result = await runHook('subagent-init.cjs', {
+        agent_type: 'fullstack-developer',
+        agent_id: 'monorepo-test',
+        cwd: subdirPath  // Payload CWD
+      }, { cwd: gitRoot });  // Process CWD different from payload
+
+      assert.strictEqual(result.exitCode, 0);
+      const context = result.output?.hookSpecificOutput?.additionalContext || '';
+      // Should use payload.cwd, not process.cwd()
+      assert.ok(
+        context.includes(subdirPath) || context.includes('.claude'),
+        'Should use payload.cwd for path resolution'
+      );
+    });
+
+    it('empty payload.cwd falls back to process.cwd()', async () => {
+      const result = await runHook('subagent-init.cjs', {
+        agent_type: 'test-agent',
+        agent_id: 'fallback-test',
+        cwd: ''  // Empty string
+      });
+
+      assert.strictEqual(result.exitCode, 0);
+      const context = result.output?.hookSpecificOutput?.additionalContext || '';
+      assert.ok(
+        context.includes(process.cwd()),
+        'Should fall back to process.cwd() for empty cwd'
+      );
+    });
+
+    it('whitespace-only payload.cwd falls back to process.cwd()', async () => {
+      const result = await runHook('subagent-init.cjs', {
+        agent_type: 'test-agent',
+        agent_id: 'whitespace-test',
+        cwd: '   '  // Whitespace only
+      });
+
+      assert.strictEqual(result.exitCode, 0);
+      const context = result.output?.hookSpecificOutput?.additionalContext || '';
+      assert.ok(
+        context.includes(process.cwd()),
+        'Should fall back to process.cwd() for whitespace cwd'
+      );
+    });
+
+  });
+
+  describe('Git Scenarios', () => {
+
+    it('handles detached HEAD gracefully', async () => {
+      const tempDir = path.join(os.tmpdir(), 'integration-detached-' + Date.now());
+      fs.mkdirSync(tempDir, { recursive: true });
+
+      try {
+        execSync('git init -q', { cwd: tempDir });
+        execSync('git config user.email "test@test.com"', { cwd: tempDir });
+        execSync('git config user.name "Test"', { cwd: tempDir });
+        fs.writeFileSync(path.join(tempDir, 'file.txt'), 'test');
+        execSync('git add .', { cwd: tempDir });
+        execSync('git commit -q -m "initial"', { cwd: tempDir });
+        const hash = execSync('git rev-parse HEAD', { cwd: tempDir, encoding: 'utf8' }).trim();
+        execSync(`git checkout -q ${hash}`, { cwd: tempDir });
+
+        // All hooks should succeed in detached HEAD state
+        const sessionResult = await runHook('session-init.cjs', { source: 'startup' }, { cwd: tempDir });
+        assert.strictEqual(sessionResult.exitCode, 0, 'session-init should succeed in detached HEAD');
+
+        const subagentResult = await runHook('subagent-init.cjs', {
+          agent_type: 'test',
+          agent_id: 'detached',
+          cwd: tempDir
+        }, { cwd: tempDir });
+        assert.strictEqual(subagentResult.exitCode, 0, 'subagent-init should succeed in detached HEAD');
+
+      } finally {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+      }
+    });
+
+    it('handles non-git directory gracefully', async () => {
+      const tempDir = path.join(os.tmpdir(), 'integration-no-git-' + Date.now());
+      fs.mkdirSync(tempDir, { recursive: true });
+
+      try {
+        // All hooks should succeed in non-git directory
+        const sessionResult = await runHook('session-init.cjs', { source: 'startup' }, { cwd: tempDir });
+        assert.strictEqual(sessionResult.exitCode, 0, 'session-init should succeed without git');
+
+        const subagentResult = await runHook('subagent-init.cjs', {
+          agent_type: 'test',
+          agent_id: 'no-git',
+          cwd: tempDir
+        }, { cwd: tempDir });
+        assert.strictEqual(subagentResult.exitCode, 0, 'subagent-init should succeed without git');
+
+      } finally {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+      }
+    });
+
+  });
+
+  describe('Path Consistency', () => {
+
+    it('reports path uses absolute format when baseDir provided', async () => {
+      const gitRoot = getGitRoot();
+      if (!gitRoot) {
+        console.log('  → Skipped: not in git repo');
+        return;
+      }
+
+      const result = await runHook('subagent-init.cjs', {
+        agent_type: 'test-agent',
+        agent_id: 'path-test',
+        cwd: gitRoot
+      });
+
+      assert.strictEqual(result.exitCode, 0);
+      const context = result.output?.hookSpecificOutput?.additionalContext || '';
+
+      // Reports and Plans paths should be absolute (start with /)
+      const reportsMatch = context.match(/Reports:\s*([^\n]+)/);
+      if (reportsMatch) {
+        assert.ok(
+          reportsMatch[1].startsWith('/'),
+          `Reports path should be absolute: ${reportsMatch[1]}`
+        );
+      }
+    });
+
+  });
+
+  describe('Error Handling', () => {
+
+    it('all hooks fail-open on errors', async () => {
+      // Send invalid JSON to each hook
+      const hooks = ['session-init.cjs', 'subagent-init.cjs', 'dev-rules-reminder.cjs'];
+
+      for (const hookName of hooks) {
+        const hookPath = path.join(HOOKS_DIR, hookName);
+        const proc = spawn('node', [hookPath], {
+          cwd: process.cwd(),
+          env: { ...process.env, CLAUDE_ENV_FILE: '' }
+        });
+
+        proc.stdin.write('invalid json{{{');
+        proc.stdin.end();
+
+        const exitCode = await new Promise((resolve) => {
+          proc.on('close', resolve);
+        });
+
+        assert.strictEqual(exitCode, 0, `${hookName} should fail-open with exit 0`);
+      }
+    });
+
+  });
+
+});

package/templates/hooks/__tests__/privacy-block.test.cjs

@@ -0,0 +1,273 @@
+#!/usr/bin/env node
+/**
+ * Tests for privacy-block.cjs hook
+ * Run: node --test .claude/hooks/__tests__/privacy-block.test.cjs
+ */
+
+const { describe, it, beforeEach, mock } = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+
+// Mock fs before requiring the module
+const fsMock = {
+  readFileSync: mock.fn(() => '{}'),
+};
+
+// We need to test the functions directly, so we'll require the module
+// Note: The module exports functions for unit testing
+const {
+  isSafeFile,
+  isPrivacySensitive,
+  hasApprovalPrefix,
+  stripApprovalPrefix,
+  extractPaths,
+} = require('../privacy-block.cjs');
+
+describe('privacy-block.cjs', () => {
+
+  describe('isSafeFile', () => {
+    it('returns true for .example files', () => {
+      assert.strictEqual(isSafeFile('.env.example'), true);
+      assert.strictEqual(isSafeFile('config.example'), true);
+      assert.strictEqual(isSafeFile('/path/to/.env.example'), true);
+    });
+
+    it('returns true for .sample files', () => {
+      assert.strictEqual(isSafeFile('.env.sample'), true);
+      assert.strictEqual(isSafeFile('config.sample'), true);
+    });
+
+    it('returns true for .template files', () => {
+      assert.strictEqual(isSafeFile('.env.template'), true);
+      assert.strictEqual(isSafeFile('config.template'), true);
+    });
+
+    it('returns false for actual sensitive files', () => {
+      assert.strictEqual(isSafeFile('.env'), false);
+      assert.strictEqual(isSafeFile('.env.local'), false);
+      assert.strictEqual(isSafeFile('credentials.json'), false);
+    });
+
+    it('handles null/undefined gracefully', () => {
+      assert.strictEqual(isSafeFile(null), false);
+      assert.strictEqual(isSafeFile(undefined), false);
+      assert.strictEqual(isSafeFile(''), false);
+    });
+  });
+
+  describe('hasApprovalPrefix', () => {
+    it('returns true for APPROVED: prefix', () => {
+      assert.strictEqual(hasApprovalPrefix('APPROVED:.env'), true);
+      assert.strictEqual(hasApprovalPrefix('APPROVED:/path/to/.env'), true);
+    });
+
+    it('returns false without prefix', () => {
+      assert.strictEqual(hasApprovalPrefix('.env'), false);
+      assert.strictEqual(hasApprovalPrefix('/path/to/.env'), false);
+    });
+
+    it('handles null/undefined gracefully', () => {
+      // hasApprovalPrefix returns falsy for null/undefined (short-circuit &&)
+      assert.ok(!hasApprovalPrefix(null));
+      assert.ok(!hasApprovalPrefix(undefined));
+      assert.ok(!hasApprovalPrefix(''));
+    });
+
+    it('is case-sensitive', () => {
+      assert.strictEqual(hasApprovalPrefix('approved:.env'), false);
+      assert.strictEqual(hasApprovalPrefix('Approved:.env'), false);
+    });
+  });
+
+  describe('stripApprovalPrefix', () => {
+    it('removes APPROVED: prefix', () => {
+      assert.strictEqual(stripApprovalPrefix('APPROVED:.env'), '.env');
+      assert.strictEqual(stripApprovalPrefix('APPROVED:/path/.env'), '/path/.env');
+    });
+
+    it('returns path unchanged without prefix', () => {
+      assert.strictEqual(stripApprovalPrefix('.env'), '.env');
+      assert.strictEqual(stripApprovalPrefix('/path/.env'), '/path/.env');
+    });
+
+    it('handles empty/null input', () => {
+      assert.strictEqual(stripApprovalPrefix(''), '');
+      assert.strictEqual(stripApprovalPrefix(null), null);
+    });
+  });
+
+  describe('isPrivacySensitive', () => {
+    describe('env files', () => {
+      it('blocks .env', () => {
+        assert.strictEqual(isPrivacySensitive('.env'), true);
+      });
+
+      it('blocks .env.local, .env.production, etc.', () => {
+        assert.strictEqual(isPrivacySensitive('.env.local'), true);
+        assert.strictEqual(isPrivacySensitive('.env.production'), true);
+        assert.strictEqual(isPrivacySensitive('.env.development'), true);
+      });
+
+      it('blocks paths containing .env', () => {
+        assert.strictEqual(isPrivacySensitive('/path/to/.env'), true);
+        assert.strictEqual(isPrivacySensitive('src/config/.env.local'), true);
+      });
+
+      it('allows .env.example, .env.sample, .env.template', () => {
+        assert.strictEqual(isPrivacySensitive('.env.example'), false);
+        assert.strictEqual(isPrivacySensitive('.env.sample'), false);
+        assert.strictEqual(isPrivacySensitive('.env.template'), false);
+      });
+    });
+
+    describe('credentials and secrets', () => {
+      it('blocks credentials files', () => {
+        assert.strictEqual(isPrivacySensitive('credentials.json'), true);
+        assert.strictEqual(isPrivacySensitive('Credentials.yaml'), true);
+        assert.strictEqual(isPrivacySensitive('/path/credentials.txt'), true);
+      });
+
+      it('blocks secrets files', () => {
+        assert.strictEqual(isPrivacySensitive('secrets.yaml'), true);
+        assert.strictEqual(isPrivacySensitive('secret.yml'), true);
+        assert.strictEqual(isPrivacySensitive('secrets.yml'), true);
+      });
+    });
+
+    describe('private keys', () => {
+      it('blocks .pem files', () => {
+        assert.strictEqual(isPrivacySensitive('private.pem'), true);
+        assert.strictEqual(isPrivacySensitive('/ssl/cert.pem'), true);
+      });
+
+      it('blocks .key files', () => {
+        assert.strictEqual(isPrivacySensitive('server.key'), true);
+        assert.strictEqual(isPrivacySensitive('/path/private.key'), true);
+      });
+
+      it('blocks SSH keys', () => {
+        assert.strictEqual(isPrivacySensitive('id_rsa'), true);
+        assert.strictEqual(isPrivacySensitive('id_ed25519'), true);
+        assert.strictEqual(isPrivacySensitive('~/.ssh/id_rsa'), true);
+      });
+    });
+
+    describe('path normalization', () => {
+      it('handles Windows paths', () => {
+        assert.strictEqual(isPrivacySensitive('C:\\path\\.env'), true);
+        assert.strictEqual(isPrivacySensitive('C:\\path\\.env.local'), true);
+      });
+
+      it('handles URI-encoded paths', () => {
+        // %2e = '.'
+        assert.strictEqual(isPrivacySensitive('%2eenv'), true);
+      });
+    });
+
+    describe('APPROVED: prefix handling', () => {
+      it('still detects sensitivity with APPROVED: prefix', () => {
+        assert.strictEqual(isPrivacySensitive('APPROVED:.env'), true);
+        assert.strictEqual(isPrivacySensitive('APPROVED:/path/.env.local'), true);
+      });
+    });
+
+    it('handles null/undefined gracefully', () => {
+      assert.strictEqual(isPrivacySensitive(null), false);
+      assert.strictEqual(isPrivacySensitive(undefined), false);
+      assert.strictEqual(isPrivacySensitive(''), false);
+    });
+  });
+
+  describe('extractPaths', () => {
+    it('extracts file_path', () => {
+      const paths = extractPaths({ file_path: '.env' });
+      assert.deepStrictEqual(paths, [{ value: '.env', field: 'file_path' }]);
+    });
+
+    it('extracts path', () => {
+      const paths = extractPaths({ path: '/src/.env' });
+      assert.deepStrictEqual(paths, [{ value: '/src/.env', field: 'path' }]);
+    });
+
+    it('extracts pattern', () => {
+      const paths = extractPaths({ pattern: '**/.env*' });
+      assert.deepStrictEqual(paths, [{ value: '**/.env*', field: 'pattern' }]);
+    });
+
+    it('extracts multiple fields', () => {
+      const paths = extractPaths({
+        file_path: '.env',
+        path: '/config',
+        pattern: '*.env'
+      });
+      assert.strictEqual(paths.length, 3);
+    });
+
+    describe('command parsing', () => {
+      it('extracts .env from commands', () => {
+        const paths = extractPaths({ command: 'cat .env' });
+        assert.deepStrictEqual(paths, [{ value: '.env', field: 'command' }]);
+      });
+
+      it('extracts .env.local from commands', () => {
+        const paths = extractPaths({ command: 'cat .env.local' });
+        assert.deepStrictEqual(paths, [{ value: '.env.local', field: 'command' }]);
+      });
+
+      it('extracts APPROVED: paths from commands', () => {
+        const paths = extractPaths({ command: 'cat APPROVED:.env' });
+        assert.deepStrictEqual(paths, [{ value: 'APPROVED:.env', field: 'command' }]);
+      });
+
+      it('prioritizes APPROVED: over plain .env in same command', () => {
+        const paths = extractPaths({ command: 'cat APPROVED:.env && echo .env' });
+        // Should only find APPROVED:.env, not the plain .env
+        assert.strictEqual(paths.length, 1);
+        assert.strictEqual(paths[0].value, 'APPROVED:.env');
+      });
+
+      it('extracts from variable assignments', () => {
+        const paths = extractPaths({ command: 'FILE=.env.local cat $FILE' });
+        const values = paths.map(p => p.value);
+        assert.ok(values.includes('.env.local'));
+      });
+
+      it('extracts from command substitution', () => {
+        const paths = extractPaths({ command: 'cat $(echo .env)' });
+        const values = paths.map(p => p.value);
+        assert.ok(values.includes('.env'));
+      });
+    });
+
+    it('handles null/undefined input', () => {
+      assert.deepStrictEqual(extractPaths(null), []);
+      assert.deepStrictEqual(extractPaths(undefined), []);
+      assert.deepStrictEqual(extractPaths({}), []);
+    });
+  });
+});
+
+describe('formatBlockMessage output structure', () => {
+  // Test formatBlockMessage by importing and calling directly
+  // Note: formatBlockMessage is not exported, so we test via hook execution in manual testing
+  // These unit tests verify the exported functions only
+
+  it('JSON structure contract is documented', () => {
+    // This test documents the expected JSON structure
+    // Actual integration testing is done manually via: echo '{"tool_input":{"file_path":".env"}}' | node privacy-block.cjs
+    const expectedStructure = {
+      type: 'PRIVACY_PROMPT',
+      file: 'string',
+      basename: 'string',
+      question: {
+        header: 'File Access',
+        text: 'string',
+        options: [
+          { label: 'Yes, approve access', description: 'string' },
+          { label: 'No, skip this file', description: 'string' }
+        ]
+      }
+    };
+    assert.ok(expectedStructure, 'JSON structure documented');
+  });
+});