fix: fold session manager blockers into one candidate

tests/scripts/codex-hooks.test.js

@@ -0,0 +1,84 @@
+/**
+ * Tests for Codex shell helpers.
+ */
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const repoRoot = path.join(__dirname, '..', '..');
+const installScript = path.join(repoRoot, 'scripts', 'codex', 'install-global-git-hooks.sh');
+const installSource = fs.readFileSync(installScript, 'utf8');
+
+function test(name, fn) {
+  try {
+    fn();
+    console.log(`  ✓ ${name}`);
+    return true;
+  } catch (error) {
+    console.log(`  ✗ ${name}`);
+    console.log(`    Error: ${error.message}`);
+    return false;
+  }
+}
+
+function createTempDir(prefix) {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+
+function cleanup(dirPath) {
+  fs.rmSync(dirPath, { recursive: true, force: true });
+}
+
+function runBash(scriptPath, args = [], env = {}, cwd = repoRoot) {
+  return spawnSync('bash', [scriptPath, ...args], {
+    cwd,
+    env: {
+      ...process.env,
+      ...env
+    },
+    encoding: 'utf8',
+    stdio: ['pipe', 'pipe', 'pipe']
+  });
+}
+
+let passed = 0;
+let failed = 0;
+
+if (
+  test('install-global-git-hooks.sh does not use eval and executes argv directly', () => {
+    assert.ok(!installSource.includes('eval "$*"'), 'Expected installer to avoid eval');
+    assert.ok(installSource.includes('    "$@"'), 'Expected installer to execute argv directly');
+    assert.ok(installSource.includes(`printf ' %q' "$@"`), 'Expected dry-run logging to shell-escape argv');
+  })
+)
+  passed++;
+else failed++;
+
+if (
+  test('install-global-git-hooks.sh handles quoted hook paths without shell injection', () => {
+    const homeDir = createTempDir('codex-hooks-home-');
+    const weirdHooksDir = path.join(homeDir, 'git-hooks "quoted"');
+
+    try {
+      const result = runBash(installScript, [], {
+        HOME: homeDir,
+        ECC_GLOBAL_HOOKS_DIR: weirdHooksDir
+      });
+
+      assert.strictEqual(result.status, 0, result.stderr || result.stdout);
+      assert.ok(fs.existsSync(path.join(weirdHooksDir, 'pre-commit')));
+      assert.ok(fs.existsSync(path.join(weirdHooksDir, 'pre-push')));
+    } finally {
+      cleanup(homeDir);
+    }
+  })
+)
+  passed++;
+else failed++;
+
+console.log(`\nPassed: ${passed}`);
+console.log(`Failed: ${failed}`);
+process.exit(failed > 0 ? 1 : 0);

tests/scripts/install-apply.test.js

@@ -94,6 +94,7 @@ function runTests() {
       assert.ok(fs.existsSync(path.join(claudeRoot, 'rules', 'typescript', 'testing.md')));
       assert.ok(fs.existsSync(path.join(claudeRoot, 'commands', 'plan.md')));
       assert.ok(fs.existsSync(path.join(claudeRoot, 'scripts', 'hooks', 'session-end.js')));
+      assert.ok(fs.existsSync(path.join(claudeRoot, 'scripts', 'lib', 'utils.js')));
       assert.ok(fs.existsSync(path.join(claudeRoot, 'skills', 'tdd-workflow', 'SKILL.md')));
       assert.ok(fs.existsSync(path.join(claudeRoot, 'skills', 'coding-standards', 'SKILL.md')));
       assert.ok(fs.existsSync(path.join(claudeRoot, 'plugin.json')));
@@ -132,6 +133,7 @@ function runTests() {
       assert.ok(fs.existsSync(path.join(projectDir, '.cursor', 'commands', 'plan.md')));
       assert.ok(fs.existsSync(path.join(projectDir, '.cursor', 'hooks.json')));
       assert.ok(fs.existsSync(path.join(projectDir, '.cursor', 'hooks', 'session-start.js')));
+      assert.ok(fs.existsSync(path.join(projectDir, '.cursor', 'scripts', 'lib', 'utils.js')));
       assert.ok(fs.existsSync(path.join(projectDir, '.cursor', 'skills', 'tdd-workflow', 'SKILL.md')));
       assert.ok(fs.existsSync(path.join(projectDir, '.cursor', 'skills', 'coding-standards', 'SKILL.md')));
 
@@ -239,6 +241,7 @@ function runTests() {
       assert.ok(fs.existsSync(path.join(claudeRoot, 'commands', 'plan.md')));
       assert.ok(fs.existsSync(path.join(claudeRoot, 'hooks', 'hooks.json')));
       assert.ok(fs.existsSync(path.join(claudeRoot, 'scripts', 'hooks', 'session-end.js')));
+      assert.ok(fs.existsSync(path.join(claudeRoot, 'scripts', 'lib', 'session-manager.js')));
       assert.ok(fs.existsSync(path.join(claudeRoot, 'plugin.json')));
 
       const state = readJson(path.join(claudeRoot, 'ecc', 'install-state.json'));

tests/scripts/sync-ecc-to-codex.test.js

@@ -0,0 +1,52 @@
+/**
+ * Source-level tests for scripts/sync-ecc-to-codex.sh
+ */
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const scriptPath = path.join(__dirname, '..', '..', 'scripts', 'sync-ecc-to-codex.sh');
+const source = fs.readFileSync(scriptPath, 'utf8');
+
+function test(name, fn) {
+  try {
+    fn();
+    console.log(`  ✓ ${name}`);
+    return true;
+  } catch (error) {
+    console.log(`  ✗ ${name}`);
+    console.log(`    Error: ${error.message}`);
+    return false;
+  }
+}
+
+function runTests() {
+  console.log('\n=== Testing sync-ecc-to-codex.sh ===\n');
+
+  let passed = 0;
+  let failed = 0;
+
+  if (test('run_or_echo does not use eval', () => {
+    assert.ok(!source.includes('eval "$@"'), 'run_or_echo should not execute through eval');
+  })) passed++; else failed++;
+
+  if (test('run_or_echo executes argv directly', () => {
+    assert.ok(source.includes('    "$@"'), 'run_or_echo should execute the argv vector directly');
+  })) passed++; else failed++;
+
+  if (test('dry-run output shell-escapes argv', () => {
+    assert.ok(source.includes(`printf ' %q' "$@"`), 'Dry-run mode should print shell-escaped argv');
+  })) passed++; else failed++;
+
+  if (test('filesystem-changing calls use argv-form run_or_echo invocations', () => {
+    assert.ok(source.includes('run_or_echo mkdir -p "$BACKUP_DIR"'), 'mkdir should use argv form');
+    assert.ok(source.includes('run_or_echo rm -rf "$dest"'), 'rm should use argv form');
+    assert.ok(source.includes('run_or_echo cp -R "$skill_dir" "$dest"'), 'recursive copy should use argv form');
+  })) passed++; else failed++;
+
+  console.log(`\nResults: Passed: ${passed}, Failed: ${failed}`);
+  process.exit(failed > 0 ? 1 : 0);
+}
+
+runTests();