everything-claude-code/tests/hooks/pre-bash-dev-server-block.test.js

/**
 * Tests for pre-bash-dev-server-block.js hook
 *
 * Run with: node tests/hooks/pre-bash-dev-server-block.test.js
 */

const assert = require('assert');
const path = require('path');
const { spawnSync } = require('child_process');

const script = path.join(__dirname, '..', '..', 'scripts', 'hooks', 'pre-bash-dev-server-block.js');

function test(name, fn) {
  try {
    fn();
    console.log(`  ✓ ${name}`);
    return true;
  } catch (err) {
    console.log(`  ✗ ${name}`);
    console.log(`    Error: ${err.message}`);
    return false;
  }
}

function runScript(command) {
  const input = { tool_input: { command } };
  const result = spawnSync('node', [script], {
    encoding: 'utf8',
    input: JSON.stringify(input),
    timeout: 10000,
  });
  return { code: result.status || 0, stdout: result.stdout || '', stderr: result.stderr || '' };
}

function runTests() {
  console.log('\n=== Testing pre-bash-dev-server-block.js ===\n');

  let passed = 0;
  let failed = 0;

  const isWindows = process.platform === 'win32';

  // --- Blocking tests (non-Windows only) ---

  if (!isWindows) {
    (test('blocks npm run dev (exit code 2, stderr contains BLOCKED)', () => {
      const result = runScript('npm run dev');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
      assert.ok(result.stderr.includes('BLOCKED'), `Expected stderr to contain BLOCKED, got: ${result.stderr}`);
    }) ? passed++ : failed++);

    (test('blocks pnpm dev (exit code 2)', () => {
      const result = runScript('pnpm dev');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks yarn dev (exit code 2)', () => {
      const result = runScript('yarn dev');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks bun run dev (exit code 2)', () => {
      const result = runScript('bun run dev');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);
  } else {
    console.log('  (skipping blocking tests on Windows)\n');
  }

  // --- Allow tests ---

  (test('allows tmux-wrapped npm run dev (exit code 0)', () => {
    const result = runScript('tmux new-session -d -s dev "npm run dev"');
    assert.strictEqual(result.code, 0, `Expected exit code 0, got ${result.code}`);
  }) ? passed++ : failed++);

  (test('allows npm install (exit code 0)', () => {
    const result = runScript('npm install');
    assert.strictEqual(result.code, 0, `Expected exit code 0, got ${result.code}`);
  }) ? passed++ : failed++);

  (test('allows npm test (exit code 0)', () => {
    const result = runScript('npm test');
    assert.strictEqual(result.code, 0, `Expected exit code 0, got ${result.code}`);
  }) ? passed++ : failed++);

  (test('allows npm run build (exit code 0)', () => {
    const result = runScript('npm run build');
    assert.strictEqual(result.code, 0, `Expected exit code 0, got ${result.code}`);
  }) ? passed++ : failed++);

  // --- Subshell bypass regression (issue: dev server slipped past via $(), ``, ()) ---

  if (!isWindows) {
    (test('blocks $(npm run dev) — command substitution', () => {
      const result = runScript('$(npm run dev)');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
      assert.ok(result.stderr.includes('BLOCKED'), 'expected BLOCKED in stderr');
    }) ? passed++ : failed++);

    (test('blocks `npm run dev` — backtick substitution', () => {
      const result = runScript('`npm run dev`');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks echo $(npm run dev) — substitution nested in argument', () => {
      const result = runScript('echo $(npm run dev)');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks (npm run dev) — plain subshell group', () => {
      const result = runScript('(npm run dev)');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks $(echo a; npm run dev) — substitution with sequenced segments', () => {
      const result = runScript('$(echo a; npm run dev)');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks (pnpm dev) — plain subshell group with pnpm', () => {
      const result = runScript('(pnpm dev)');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('allows tmux launcher inside subshell wrapping (exit code 0)', () => {
      const result = runScript('(tmux new-session -d -s dev "npm run dev")');
      assert.strictEqual(result.code, 0, `Expected exit code 0, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('allows single-quoted "(npm run dev)" — literal string, not a subshell', () => {
      const result = runScript("git commit -m '(npm run dev)'");
      assert.strictEqual(result.code, 0, `Expected exit code 0, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('allows double-quoted "(npm run dev)" — literal in double quotes (bash does not subshell)', () => {
      const result = runScript('echo "(npm run dev)"');
      assert.strictEqual(result.code, 0, `Expected exit code 0, got ${result.code}`);
    }) ? passed++ : failed++);

    (test("allows single-quoted '$(npm run dev)' — literal string, no substitution", () => {
      const result = runScript("git commit -m '$(npm run dev) fix'");
      assert.strictEqual(result.code, 0, `Expected exit code 0, got ${result.code}`);
    }) ? passed++ : failed++);
  }

  // --- Round 1 review fixes (Greptile + CodeRabbit on PR #1889) ---

  if (!isWindows) {
    (test('blocks $(echo ")"; (npm run dev)) — quoted ) does not terminate $() early', () => {
      const result = runScript('$(echo ")"; (npm run dev))');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks (echo ")"; npm run dev) — quoted ) does not terminate (...) early', () => {
      const result = runScript('(echo ")"; npm run dev)');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('allows $(echo "(npm run dev)") — () inside double-quoted substitution body is literal', () => {
      const result = runScript('$(echo "(npm run dev)")');
      assert.strictEqual(result.code, 0, `Expected exit code 0, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks { npm run dev; } — brace group runs in current shell', () => {
      const result = runScript('{ npm run dev; }');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks echo hi && { npm run dev; } — brace group after &&', () => {
      const result = runScript('echo hi && { npm run dev; }');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('allows {npm run dev} — bash requires space after { to form a group', () => {
      const result = runScript('{npm run dev}');
      assert.strictEqual(result.code, 0, `Expected exit code 0, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks yarn run dev — yarn 1.x convention', () => {
      const result = runScript('yarn run dev');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks bun dev — bun bare form', () => {
      const result = runScript('bun dev');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);

    (test('blocks "$(npm run dev)" — double-quoted substitution still substitutes', () => {
      const result = runScript('echo "$(npm run dev)"');
      assert.strictEqual(result.code, 2, `Expected exit code 2, got ${result.code}`);
    }) ? passed++ : failed++);
  }

  // --- Edge cases ---

  (test('empty/invalid input passes through (exit code 0)', () => {
    const result = spawnSync('node', [script], {
      encoding: 'utf8',
      input: '',
      timeout: 10000,
    });
    assert.strictEqual(result.status || 0, 0, `Expected exit code 0, got ${result.status}`);
  }) ? passed++ : failed++);

  (test('stdout contains original input on pass-through', () => {
    const input = { tool_input: { command: 'npm install' } };
    const inputStr = JSON.stringify(input);
    const result = spawnSync('node', [script], {
      encoding: 'utf8',
      input: inputStr,
      timeout: 10000,
    });
    assert.strictEqual(result.status || 0, 0);
    assert.strictEqual(result.stdout.trim(), inputStr, `Expected stdout to contain original input`);
  }) ? passed++ : failed++);

  // --- Summary ---

  console.log(`\nResults: Passed: ${passed}, Failed: ${failed}`);
  process.exit(failed > 0 ? 1 : 0);
}

runTests();