588e194d59
Removes 9×20 LOC duplication of KEI_DISABLED_HOOKS gate logic from each hook into hooks/_lib/gate.sh. Next CVE in gate path fixes in ONE file, not 9. hooks/_lib/gate.sh (new, 57 LOC) — POSIX sh library, single kei_hook_gate() function. Exact-token tokenize on comma OR space (RED-1 fix preserved). Minimal-profile whitelist baked in: no-hand-edit-agents, assemble-validate, agent-fork-logger, session-end-dump. Idempotent re-source guard. hooks/_lib/test-gate.sh (new, 47 LOC) — 11 test cases covering empty/comma/space/whitespace/substring-NOT-match/literal 'all'/ minimal-profile included+excluded/minimal+disabled combo. Per-hook shim (exactly 2 LOC, same in all 9): _KEI_LIB="$(dirname "$0")/_lib/gate.sh" if [ -r "$_KEI_LIB" ]; then . "$_KEI_LIB"; kei_hook_gate "<name>" || exit 0; fi Net LOC delta: −171 (hooks) +104 (lib new) +15 (installer) = −52. Gate semantics bit-identical to v0.15.1 hotfix on the 6 enumerated behaviors; off/advisory-off profile values dropped per spec (only 'minimal' recognized, any other = full). Fail-open on missing lib — if _lib/gate.sh absent (old install pre-v0.17), hook falls through to normal operation. install.sh — +15 LOC copies hooks/_lib/*.sh to $HOOKS_DIR/_lib/, preserving relative path the shim expects. Note: v0.16 split this file; A1 worktree was based on pre-split main — merge into current main required resolving conflict so _lib-copy logic moved to install/lib-hooks.sh. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
47 lines
1.8 KiB
Bash
47 lines
1.8 KiB
Bash
#!/bin/sh
|
|
# hooks/_lib/test-gate.sh — POSIX sh unit test for kei_hook_gate.
|
|
# Run: sh hooks/_lib/test-gate.sh ; echo $?
|
|
|
|
set -u
|
|
|
|
_TEST_DIR=$(cd "$(dirname "$0")" 2>/dev/null && pwd)
|
|
. "$_TEST_DIR/gate.sh"
|
|
|
|
_pass=0
|
|
_total=0
|
|
|
|
# assert_rc <expected-rc> <case-name>
|
|
assert_rc() {
|
|
_total=$((_total+1))
|
|
_exp="$1"; _name="$2"
|
|
kei_hook_gate "$_hook_under_test"
|
|
_got=$?
|
|
if [ "$_got" = "$_exp" ]; then
|
|
_pass=$((_pass+1))
|
|
else
|
|
printf 'FAIL case %s: expected rc=%s got rc=%s (KEI_DISABLED_HOOKS=%s KEI_HOOK_PROFILE=%s name=%s)\n' \
|
|
"$_name" "$_exp" "$_got" "${KEI_DISABLED_HOOKS:-}" "${KEI_HOOK_PROFILE:-}" "$_hook_under_test" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
_hook_under_test='session-end-dump'
|
|
|
|
KEI_DISABLED_HOOKS=''; KEI_HOOK_PROFILE=''; assert_rc 0 empty_disabled_runs
|
|
KEI_DISABLED_HOOKS='session-end-dump,agent-fork-logger'; KEI_HOOK_PROFILE=''; assert_rc 1 comma_list_match
|
|
KEI_DISABLED_HOOKS='agent-fork-logger session-end-dump'; KEI_HOOK_PROFILE=''; assert_rc 1 space_list_match
|
|
KEI_DISABLED_HOOKS=' session-end-dump , agent-fork-logger '; KEI_HOOK_PROFILE=''; assert_rc 1 whitespace_tolerant
|
|
KEI_DISABLED_HOOKS='foo-session-end-dump-bar'; KEI_HOOK_PROFILE=''; assert_rc 0 substring_no_match
|
|
KEI_DISABLED_HOOKS='all'; KEI_HOOK_PROFILE=''; assert_rc 1 literal_all_skips
|
|
KEI_DISABLED_HOOKS='foo-all-bar'; KEI_HOOK_PROFILE=''; assert_rc 0 all_substring_no_match
|
|
KEI_DISABLED_HOOKS=''; KEI_HOOK_PROFILE='minimal'; assert_rc 0 minimal_whitelist_runs
|
|
|
|
_hook_under_test='tomd-preread'
|
|
KEI_DISABLED_HOOKS=''; KEI_HOOK_PROFILE='minimal'; assert_rc 1 minimal_excluded_skipped
|
|
KEI_DISABLED_HOOKS=''; KEI_HOOK_PROFILE='full'; assert_rc 0 unknown_profile_runs
|
|
|
|
_hook_under_test='session-end-dump'
|
|
KEI_DISABLED_HOOKS='session-end-dump'; KEI_HOOK_PROFILE='minimal'; assert_rc 1 minimal_plus_disabled_skips
|
|
|
|
printf 'PASS %d/%d\n' "$_pass" "$_total"
|
|
exit 0
|