1package hooks
2
3import (
4 "context"
5 "io"
6 "strings"
7 "sync"
8 "testing"
9 "time"
10
11 "github.com/charmbracelet/crush/internal/config"
12 "github.com/charmbracelet/crush/internal/shell"
13 "github.com/stretchr/testify/require"
14)
15
16func TestAggregation(t *testing.T) {
17 t.Parallel()
18
19 t.Run("empty results", func(t *testing.T) {
20 t.Parallel()
21 agg := aggregate(nil, "{}")
22 require.Equal(t, DecisionNone, agg.Decision)
23 require.Empty(t, agg.Reason)
24 require.Empty(t, agg.Context)
25 require.False(t, agg.Halt)
26 })
27
28 t.Run("single allow", func(t *testing.T) {
29 t.Parallel()
30 agg := aggregate([]HookResult{
31 {Decision: DecisionAllow},
32 }, "{}")
33 require.Equal(t, DecisionAllow, agg.Decision)
34 })
35
36 t.Run("deny wins over allow", func(t *testing.T) {
37 t.Parallel()
38 agg := aggregate([]HookResult{
39 {Decision: DecisionAllow, Context: "ctx1"},
40 {Decision: DecisionDeny, Reason: "blocked"},
41 }, "{}")
42 require.Equal(t, DecisionDeny, agg.Decision)
43 require.Equal(t, "blocked", agg.Reason)
44 require.Equal(t, "ctx1", agg.Context)
45 })
46
47 t.Run("multiple deny reasons concatenated", func(t *testing.T) {
48 t.Parallel()
49 agg := aggregate([]HookResult{
50 {Decision: DecisionDeny, Reason: "reason1"},
51 {Decision: DecisionDeny, Reason: "reason2"},
52 }, "{}")
53 require.Equal(t, DecisionDeny, agg.Decision)
54 require.Equal(t, "reason1\nreason2", agg.Reason)
55 })
56
57 t.Run("context concatenated from all hooks", func(t *testing.T) {
58 t.Parallel()
59 agg := aggregate([]HookResult{
60 {Decision: DecisionAllow, Context: "ctx-a"},
61 {Decision: DecisionNone, Context: "ctx-b"},
62 }, "{}")
63 require.Equal(t, DecisionAllow, agg.Decision)
64 require.Equal(t, "ctx-a\nctx-b", agg.Context)
65 })
66
67 t.Run("allow wins over none", func(t *testing.T) {
68 t.Parallel()
69 agg := aggregate([]HookResult{
70 {Decision: DecisionNone},
71 {Decision: DecisionAllow},
72 }, "{}")
73 require.Equal(t, DecisionAllow, agg.Decision)
74 })
75
76 t.Run("halt is sticky across results", func(t *testing.T) {
77 t.Parallel()
78 agg := aggregate([]HookResult{
79 {Decision: DecisionAllow},
80 {Halt: true, Reason: "stop now"},
81 }, "{}")
82 require.True(t, agg.Halt)
83 require.Contains(t, agg.Reason, "stop now")
84 })
85
86 t.Run("halt with deny only records reason once", func(t *testing.T) {
87 t.Parallel()
88 agg := aggregate([]HookResult{
89 {Decision: DecisionDeny, Halt: true, Reason: "stop"},
90 }, "{}")
91 require.True(t, agg.Halt)
92 require.Equal(t, DecisionDeny, agg.Decision)
93 require.Equal(t, "stop", agg.Reason)
94 })
95}
96
97func TestParseStdout(t *testing.T) {
98 t.Parallel()
99
100 t.Run("empty stdout", func(t *testing.T) {
101 t.Parallel()
102 r := parseStdout("")
103 require.Equal(t, DecisionNone, r.Decision)
104 })
105
106 t.Run("valid allow", func(t *testing.T) {
107 t.Parallel()
108 r := parseStdout(`{"decision":"allow","context":"some context"}`)
109 require.Equal(t, DecisionAllow, r.Decision)
110 require.Equal(t, "some context", r.Context)
111 })
112
113 t.Run("valid deny", func(t *testing.T) {
114 t.Parallel()
115 r := parseStdout(`{"decision":"deny","reason":"not allowed"}`)
116 require.Equal(t, DecisionDeny, r.Decision)
117 require.Equal(t, "not allowed", r.Reason)
118 })
119
120 t.Run("malformed JSON", func(t *testing.T) {
121 t.Parallel()
122 r := parseStdout(`{bad json}`)
123 require.Equal(t, DecisionNone, r.Decision)
124 })
125
126 t.Run("unknown decision", func(t *testing.T) {
127 t.Parallel()
128 r := parseStdout(`{"decision":"maybe"}`)
129 require.Equal(t, DecisionNone, r.Decision)
130 })
131
132 t.Run("version 1 accepted", func(t *testing.T) {
133 t.Parallel()
134 r := parseStdout(`{"version":1,"decision":"allow"}`)
135 require.Equal(t, DecisionAllow, r.Decision)
136 })
137
138 t.Run("unknown higher version still parses", func(t *testing.T) {
139 t.Parallel()
140 r := parseStdout(`{"version":99,"decision":"deny","reason":"future"}`)
141 require.Equal(t, DecisionDeny, r.Decision)
142 require.Equal(t, "future", r.Reason)
143 })
144
145 t.Run("halt true without decision", func(t *testing.T) {
146 t.Parallel()
147 r := parseStdout(`{"halt":true,"reason":"turn over"}`)
148 require.True(t, r.Halt)
149 require.Equal(t, "turn over", r.Reason)
150 require.Equal(t, DecisionNone, r.Decision)
151 })
152
153 t.Run("context string form", func(t *testing.T) {
154 t.Parallel()
155 r := parseStdout(`{"decision":"allow","context":"one note"}`)
156 require.Equal(t, "one note", r.Context)
157 })
158
159 t.Run("context array form", func(t *testing.T) {
160 t.Parallel()
161 r := parseStdout(`{"decision":"allow","context":["first","second"]}`)
162 require.Equal(t, "first\nsecond", r.Context)
163 })
164
165 t.Run("context array drops empty entries", func(t *testing.T) {
166 t.Parallel()
167 r := parseStdout(`{"decision":"allow","context":["","keep",""]}`)
168 require.Equal(t, "keep", r.Context)
169 })
170
171 t.Run("context null becomes empty", func(t *testing.T) {
172 t.Parallel()
173 r := parseStdout(`{"decision":"allow","context":null}`)
174 require.Empty(t, r.Context)
175 })
176}
177
178func TestBuildEnv(t *testing.T) {
179 t.Parallel()
180
181 env := BuildEnv(EventPreToolUse, "bash", "sess-1", "/work", "/project", `{"command":"ls","file_path":"/tmp/f.txt"}`)
182
183 envMap := make(map[string]string)
184 for _, e := range env {
185 parts := splitFirst(e, "=")
186 if len(parts) == 2 {
187 envMap[parts[0]] = parts[1]
188 }
189 }
190
191 require.Equal(t, EventPreToolUse, envMap["CRUSH_EVENT"])
192 require.Equal(t, "bash", envMap["CRUSH_TOOL_NAME"])
193 require.Equal(t, "sess-1", envMap["CRUSH_SESSION_ID"])
194 require.Equal(t, "/work", envMap["CRUSH_CWD"])
195 require.Equal(t, "/project", envMap["CRUSH_PROJECT_DIR"])
196 require.Equal(t, "ls", envMap["CRUSH_TOOL_INPUT_COMMAND"])
197 require.Equal(t, "/tmp/f.txt", envMap["CRUSH_TOOL_INPUT_FILE_PATH"])
198
199 // Shared Crush markers must be present so hook-authored scripts can
200 // detect they're running under Crush the same way bash-tool-invoked
201 // scripts can.
202 require.Equal(t, "1", envMap["CRUSH"])
203 require.Equal(t, "crush", envMap["AGENT"])
204 require.Equal(t, "crush", envMap["AI_AGENT"])
205}
206
207func splitFirst(s, sep string) []string {
208 before, after, found := strings.Cut(s, sep)
209 if !found {
210 return []string{s}
211 }
212 return []string{before, after}
213}
214
215func TestBuildPayload(t *testing.T) {
216 t.Parallel()
217 payload := BuildPayload(EventPreToolUse, "sess-1", "/work", "bash", `{"command":"ls"}`)
218 s := string(payload)
219 require.Contains(t, s, `"event":"`+EventPreToolUse+`"`)
220 require.Contains(t, s, `"tool_name":"bash"`)
221 // tool_input should be an object, not a string.
222 require.Contains(t, s, `"tool_input":{"command":"ls"}`)
223}
224
225func TestRunnerExitCode0Allow(t *testing.T) {
226 t.Parallel()
227 hookCfg := config.HookConfig{
228 Command: `echo '{"decision":"allow","context":"ok"}'`,
229 }
230 r := NewRunner([]config.HookConfig{hookCfg}, t.TempDir(), t.TempDir())
231 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
232 require.NoError(t, err)
233 require.Equal(t, DecisionAllow, result.Decision)
234 require.Equal(t, "ok", result.Context)
235}
236
237func TestRunnerExitCode2Deny(t *testing.T) {
238 t.Parallel()
239 hookCfg := config.HookConfig{
240 Command: `echo "forbidden" >&2; exit 2`,
241 }
242 r := NewRunner([]config.HookConfig{hookCfg}, t.TempDir(), t.TempDir())
243 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
244 require.NoError(t, err)
245 require.Equal(t, DecisionDeny, result.Decision)
246 require.False(t, result.Halt)
247 require.Equal(t, "forbidden", result.Reason)
248}
249
250func TestRunnerExitCode49Halt(t *testing.T) {
251 t.Parallel()
252 hookCfg := config.HookConfig{
253 Command: `echo "stop the turn" >&2; exit 49`,
254 }
255 r := NewRunner([]config.HookConfig{hookCfg}, t.TempDir(), t.TempDir())
256 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
257 require.NoError(t, err)
258 require.True(t, result.Halt)
259 require.Equal(t, DecisionDeny, result.Decision)
260 require.Equal(t, "stop the turn", result.Reason)
261}
262
263func TestRunnerHaltViaJSON(t *testing.T) {
264 t.Parallel()
265 hookCfg := config.HookConfig{
266 Command: `echo '{"halt":true,"reason":"via json"}'`,
267 }
268 r := NewRunner([]config.HookConfig{hookCfg}, t.TempDir(), t.TempDir())
269 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
270 require.NoError(t, err)
271 require.True(t, result.Halt)
272 require.Equal(t, "via json", result.Reason)
273}
274
275func TestRunnerExitCodeOtherNonBlocking(t *testing.T) {
276 t.Parallel()
277 hookCfg := config.HookConfig{
278 Command: `exit 1`,
279 }
280 r := NewRunner([]config.HookConfig{hookCfg}, t.TempDir(), t.TempDir())
281 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
282 require.NoError(t, err)
283 require.Equal(t, DecisionNone, result.Decision)
284}
285
286func TestRunnerTimeout(t *testing.T) {
287 t.Parallel()
288 hookCfg := config.HookConfig{
289 Command: `sleep 10`,
290 Timeout: 1,
291 }
292 r := NewRunner([]config.HookConfig{hookCfg}, t.TempDir(), t.TempDir())
293 start := time.Now()
294 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
295 elapsed := time.Since(start)
296 require.NoError(t, err)
297 require.Equal(t, DecisionNone, result.Decision)
298 require.Less(t, elapsed, 5*time.Second)
299}
300
301func TestRunnerDeduplication(t *testing.T) {
302 t.Parallel()
303 // Two hooks with the same command should only run once.
304 hookCfg := config.HookConfig{
305 Command: `echo '{"decision":"allow"}'`,
306 }
307 r := NewRunner([]config.HookConfig{hookCfg, hookCfg}, t.TempDir(), t.TempDir())
308 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
309 require.NoError(t, err)
310 require.Equal(t, DecisionAllow, result.Decision)
311}
312
313func TestRunnerNoMatchingHooks(t *testing.T) {
314 t.Parallel()
315 // Hooks are empty.
316 r := NewRunner(nil, t.TempDir(), t.TempDir())
317 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
318 require.NoError(t, err)
319 require.Equal(t, DecisionNone, result.Decision)
320}
321
322// validatedHooks builds hook configs and runs ValidateHooks to compile
323// matcher regexes, mirroring the real config-load path.
324func validatedHooks(t *testing.T, hooks []config.HookConfig) []config.HookConfig {
325 t.Helper()
326 cfg := &config.Config{
327 Hooks: map[string][]config.HookConfig{
328 EventPreToolUse: hooks,
329 },
330 }
331 require.NoError(t, cfg.ValidateHooks())
332 return cfg.Hooks[EventPreToolUse]
333}
334
335func TestRunnerMatcherFiltering(t *testing.T) {
336 t.Parallel()
337
338 t.Run("compiled regex matches", func(t *testing.T) {
339 t.Parallel()
340 hooks := validatedHooks(t, []config.HookConfig{
341 {Command: `echo '{"decision":"deny","reason":"blocked"}'`, Matcher: "^bash$"},
342 })
343 r := NewRunner(hooks, t.TempDir(), t.TempDir())
344 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
345 require.NoError(t, err)
346 require.Equal(t, DecisionDeny, result.Decision)
347 })
348
349 t.Run("compiled regex does not match", func(t *testing.T) {
350 t.Parallel()
351 hooks := validatedHooks(t, []config.HookConfig{
352 {Command: `echo '{"decision":"deny","reason":"blocked"}'`, Matcher: "^edit$"},
353 })
354 r := NewRunner(hooks, t.TempDir(), t.TempDir())
355 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
356 require.NoError(t, err)
357 require.Equal(t, DecisionNone, result.Decision)
358 })
359
360 t.Run("no matcher matches everything", func(t *testing.T) {
361 t.Parallel()
362 hooks := validatedHooks(t, []config.HookConfig{
363 {Command: `echo '{"decision":"allow"}'`},
364 })
365 r := NewRunner(hooks, t.TempDir(), t.TempDir())
366 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
367 require.NoError(t, err)
368 require.Equal(t, DecisionAllow, result.Decision)
369 })
370
371 t.Run("partial regex match", func(t *testing.T) {
372 t.Parallel()
373 hooks := validatedHooks(t, []config.HookConfig{
374 {Command: `echo '{"decision":"deny","reason":"mcp blocked"}'`, Matcher: "^mcp_"},
375 })
376 r := NewRunner(hooks, t.TempDir(), t.TempDir())
377
378 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "mcp_github_get_me", `{}`)
379 require.NoError(t, err)
380 require.Equal(t, DecisionDeny, result.Decision)
381
382 result, err = r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
383 require.NoError(t, err)
384 require.Equal(t, DecisionNone, result.Decision)
385 })
386}
387
388func TestValidateHooksInvalidRegex(t *testing.T) {
389 t.Parallel()
390 cfg := &config.Config{
391 Hooks: map[string][]config.HookConfig{
392 EventPreToolUse: {
393 {Command: "true", Matcher: "[invalid"},
394 },
395 },
396 }
397 err := cfg.ValidateHooks()
398 require.Error(t, err)
399 require.Contains(t, err.Error(), "invalid matcher regex")
400}
401
402func TestValidateHooksEmptyCommand(t *testing.T) {
403 t.Parallel()
404 cfg := &config.Config{
405 Hooks: map[string][]config.HookConfig{
406 EventPreToolUse: {
407 {Command: ""},
408 },
409 },
410 }
411 err := cfg.ValidateHooks()
412 require.Error(t, err)
413 require.Contains(t, err.Error(), "command is required")
414}
415
416func TestValidateHooksNormalizesEventNames(t *testing.T) {
417 t.Parallel()
418
419 tests := []struct {
420 name string
421 input string
422 }{
423 {"canonical", "PreToolUse"},
424 {"lowercase", "pretooluse"},
425 {"snake_case", "pre_tool_use"},
426 {"upper_snake", "PRE_TOOL_USE"},
427 {"mixed_case", "preToolUse"},
428 }
429 for _, tt := range tests {
430 t.Run(tt.name, func(t *testing.T) {
431 t.Parallel()
432 cfg := &config.Config{
433 Hooks: map[string][]config.HookConfig{
434 tt.input: {
435 {Command: "true"},
436 },
437 },
438 }
439 require.NoError(t, cfg.ValidateHooks())
440 require.Len(t, cfg.Hooks[EventPreToolUse], 1)
441 })
442 }
443}
444
445func TestRunnerParallelExecution(t *testing.T) {
446 t.Parallel()
447 // Two hooks: one allows, one denies. Deny should win.
448 hooks := []config.HookConfig{
449 {Command: `echo '{"decision":"allow","context":"hook1"}'`},
450 {Command: `echo '{"decision":"deny","reason":"nope"}' ; exit 0`},
451 }
452 r := NewRunner(hooks, t.TempDir(), t.TempDir())
453 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
454 require.NoError(t, err)
455 require.Equal(t, DecisionDeny, result.Decision)
456 require.Equal(t, "nope", result.Reason)
457}
458
459func TestRunnerEnvVarsPropagated(t *testing.T) {
460 t.Parallel()
461 hookCfg := config.HookConfig{
462 Command: `printf '{"decision":"allow","context":"%s"}' "$CRUSH_TOOL_NAME"`,
463 }
464 r := NewRunner([]config.HookConfig{hookCfg}, t.TempDir(), t.TempDir())
465 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
466 require.NoError(t, err)
467 require.Equal(t, DecisionAllow, result.Decision)
468 require.Equal(t, "bash", result.Context)
469}
470
471func TestParseStdoutUpdatedInput(t *testing.T) {
472 t.Parallel()
473
474 t.Run("nested object", func(t *testing.T) {
475 t.Parallel()
476 r := parseStdout(`{"decision":"allow","updated_input":{"command":"rtk cat foo.go"}}`)
477 require.Equal(t, DecisionAllow, r.Decision)
478 require.Equal(t, `{"command":"rtk cat foo.go"}`, r.UpdatedInput)
479 })
480
481 t.Run("stringified backward compat", func(t *testing.T) {
482 t.Parallel()
483 r := parseStdout(`{"decision":"allow","updated_input":"{\"command\":\"rtk cat foo.go\"}"}`)
484 require.Equal(t, DecisionAllow, r.Decision)
485 require.Equal(t, `{"command":"rtk cat foo.go"}`, r.UpdatedInput)
486 })
487
488 t.Run("no updated_input", func(t *testing.T) {
489 t.Parallel()
490 r := parseStdout(`{"decision":"allow"}`)
491 require.Empty(t, r.UpdatedInput)
492 })
493}
494
495func TestAggregationUpdatedInput(t *testing.T) {
496 t.Parallel()
497
498 t.Run("patches merge in config order with later overriding", func(t *testing.T) {
499 t.Parallel()
500 agg := aggregate([]HookResult{
501 {Decision: DecisionAllow, UpdatedInput: `{"command":"first","keep":"me"}`},
502 {Decision: DecisionAllow, UpdatedInput: `{"command":"second"}`},
503 }, `{"command":"orig","timeout":60}`)
504 require.Equal(t, DecisionAllow, agg.Decision)
505 // command overridden by second patch; keep preserved from first
506 // patch; timeout preserved from original input.
507 require.JSONEq(t,
508 `{"command":"second","keep":"me","timeout":60}`,
509 agg.UpdatedInput,
510 )
511 })
512
513 t.Run("shallow: nested objects are replaced wholesale", func(t *testing.T) {
514 t.Parallel()
515 agg := aggregate([]HookResult{
516 {Decision: DecisionAllow, UpdatedInput: `{"env":{"FOO":"bar"}}`},
517 }, `{"env":{"BAZ":"qux"},"command":"ls"}`)
518 // "env" is replaced entirely; "command" preserved.
519 require.JSONEq(t,
520 `{"env":{"FOO":"bar"},"command":"ls"}`,
521 agg.UpdatedInput,
522 )
523 })
524
525 t.Run("deny still reports merged input (caller ignores it)", func(t *testing.T) {
526 t.Parallel()
527 agg := aggregate([]HookResult{
528 {Decision: DecisionAllow, UpdatedInput: `{"command":"rewritten"}`},
529 {Decision: DecisionDeny, Reason: "blocked"},
530 }, `{"command":"orig"}`)
531 require.Equal(t, DecisionDeny, agg.Decision)
532 })
533
534 t.Run("no patches leaves updated_input empty", func(t *testing.T) {
535 t.Parallel()
536 agg := aggregate([]HookResult{
537 {Decision: DecisionAllow},
538 {Decision: DecisionNone},
539 }, `{"command":"orig"}`)
540 require.Empty(t, agg.UpdatedInput)
541 })
542
543 t.Run("invalid patch is ignored", func(t *testing.T) {
544 t.Parallel()
545 agg := aggregate([]HookResult{
546 {Decision: DecisionAllow, UpdatedInput: `"not-an-object"`},
547 {Decision: DecisionAllow, UpdatedInput: `{"command":"good"}`},
548 }, `{"command":"orig"}`)
549 require.JSONEq(t, `{"command":"good"}`, agg.UpdatedInput)
550 })
551
552 t.Run("malformed patch JSON is ignored and merge continues", func(t *testing.T) {
553 t.Parallel()
554 agg := aggregate([]HookResult{
555 {Decision: DecisionAllow, UpdatedInput: `{broken json`},
556 {Decision: DecisionAllow, UpdatedInput: `{"command":"good"}`},
557 }, `{"command":"orig"}`)
558 require.JSONEq(t, `{"command":"good"}`, agg.UpdatedInput)
559 })
560
561 t.Run("non-object tool_input rejects all patches", func(t *testing.T) {
562 t.Parallel()
563 agg := aggregate([]HookResult{
564 {Decision: DecisionAllow, UpdatedInput: `{"command":"rewrite"}`},
565 }, `"just-a-string"`)
566 require.Empty(t, agg.UpdatedInput)
567 })
568
569 t.Run("null updated_input is a no-op", func(t *testing.T) {
570 t.Parallel()
571 // parseStdout converts null updated_input to "", so aggregate
572 // never sees a patch — the merged input is empty and the
573 // original tool_input is used unchanged.
574 r := parseStdout(`{"decision":"allow","updated_input":null}`)
575 require.Empty(t, r.UpdatedInput)
576 agg := aggregate([]HookResult{r}, `{"command":"orig"}`)
577 require.Empty(t, agg.UpdatedInput)
578 })
579}
580
581// TestRunnerAbandonRaceSafety verifies that if a hook's shell execution
582// does not yield to ctx cancellation within abandonGrace, runOne returns
583// promptly and never touches the shared stdout/stderr buffers again —
584// even while the abandoned goroutine continues to write to them.
585//
586// The substitute shell executor ignores ctx entirely, writes to Stdout
587// both before and after the abandon deadline, and only then returns.
588// Under -race this catches any code path in runOne that reads those
589// buffers after returning the DecisionNone abandon result.
590func TestRunnerAbandonRaceSafety(t *testing.T) {
591 origRunShell := runShell
592 t.Cleanup(func() { runShell = origRunShell })
593
594 // Synchronize shutdown with the abandoned goroutine so the test
595 // exits cleanly even under -race.
596 var wg sync.WaitGroup
597 release := make(chan struct{})
598 t.Cleanup(func() {
599 close(release)
600 wg.Wait()
601 })
602
603 runShell = func(_ context.Context, opts shell.RunOptions) error {
604 wg.Add(1)
605 defer wg.Done()
606 // Write before the caller observes ctx.Done(); the caller will
607 // not read the buffer while we still own it.
608 _, _ = io.WriteString(opts.Stdout, "before\n")
609 // Hold past ctx deadline + abandonGrace so the caller takes
610 // the abandon branch, then continue writing. If the caller
611 // reads these buffers after abandoning, -race will flag it.
612 select {
613 case <-time.After(5 * time.Second):
614 case <-release:
615 }
616 _, _ = io.WriteString(opts.Stdout, "after\n")
617 return nil
618 }
619
620 hookCfg := config.HookConfig{
621 Command: "# irrelevant; runShell is stubbed",
622 Timeout: 1,
623 }
624 r := NewRunner([]config.HookConfig{hookCfg}, t.TempDir(), t.TempDir())
625
626 start := time.Now()
627 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{}`)
628 elapsed := time.Since(start)
629
630 require.NoError(t, err)
631 require.Equal(t, DecisionNone, result.Decision)
632 // Abandon must happen at ~timeout + abandonGrace. Allow generous
633 // slack so CI noise doesn't flake the test.
634 require.Less(t, elapsed, 3500*time.Millisecond,
635 "runOne should return within timeout+abandonGrace+slack")
636}
637
638func TestRunnerUpdatedInput(t *testing.T) {
639 t.Parallel()
640 hookCfg := config.HookConfig{
641 Command: `echo '{"decision":"allow","updated_input":{"command":"echo rewritten"}}'`,
642 }
643 r := NewRunner([]config.HookConfig{hookCfg}, t.TempDir(), t.TempDir())
644 result, err := r.Run(context.Background(), EventPreToolUse, "sess", "bash", `{"command":"echo original","timeout":60}`)
645 require.NoError(t, err)
646 require.Equal(t, DecisionAllow, result.Decision)
647 require.JSONEq(t,
648 `{"command":"echo rewritten","timeout":60}`,
649 result.UpdatedInput,
650 )
651}
652
653func TestParseStdoutClaudeCodeFormat(t *testing.T) {
654 t.Parallel()
655
656 t.Run("allow with reason", func(t *testing.T) {
657 t.Parallel()
658 r := parseStdout(`{"hookSpecificOutput":{"permissionDecision":"allow","permissionDecisionReason":"RTK auto-rewrite"}}`)
659 require.Equal(t, DecisionAllow, r.Decision)
660 require.Equal(t, "RTK auto-rewrite", r.Reason)
661 })
662
663 t.Run("allow with updatedInput", func(t *testing.T) {
664 t.Parallel()
665 r := parseStdout(`{"hookSpecificOutput":{"permissionDecision":"allow","updatedInput":{"command":"rtk cat foo.go"}}}`)
666 require.Equal(t, DecisionAllow, r.Decision)
667 require.Equal(t, `{"command":"rtk cat foo.go"}`, r.UpdatedInput)
668 })
669
670 t.Run("deny", func(t *testing.T) {
671 t.Parallel()
672 r := parseStdout(`{"hookSpecificOutput":{"permissionDecision":"deny","permissionDecisionReason":"not allowed"}}`)
673 require.Equal(t, DecisionDeny, r.Decision)
674 require.Equal(t, "not allowed", r.Reason)
675 })
676
677 t.Run("no permissionDecision", func(t *testing.T) {
678 t.Parallel()
679 r := parseStdout(`{"hookSpecificOutput":{}}`)
680 require.Equal(t, DecisionNone, r.Decision)
681 })
682
683 t.Run("crush format still works", func(t *testing.T) {
684 t.Parallel()
685 r := parseStdout(`{"decision":"allow","context":"hello"}`)
686 require.Equal(t, DecisionAllow, r.Decision)
687 require.Equal(t, "hello", r.Context)
688 })
689}