1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
|
#!/usr/bin/env bash
# Case 01: 'git status' inside an .hg repository must be blocked.
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
mkdir -p "$tmp/repo/.hg"
mkdir -p "$tmp/repo/sub"
input=$(jq -n --arg cwd "$tmp/repo/sub" --arg cmd "git status" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
# Run hook; capture stderr and exit code.
err=$(echo "$input" | "$HOOK_SCRIPT" 2>&1 >/dev/null)
rc=$?
if [[ $rc -ne 2 ]]; then
echo "expected exit 2 (blocked), got $rc"
echo "stderr was: $err"
exit 1
fi
if ! grep -q "hg status" <<<"$err"; then
echo "expected stderr to suggest 'hg status', got: $err"
exit 1
fi
#!/usr/bin/env bash
# Case 02: 'git --version' outside any .hg/.git context must be allowed.
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
input=$(jq -n --arg cwd "$tmp" --arg cmd "git --version" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "expected exit 0 (allow), got non-zero"
exit 1
fi
#!/usr/bin/env bash
# Case 03: closer .git wins over outer .hg, AND bare git repos
# (HEAD/refs/objects in cwd, no .git subdir) inside an .hg ancestor allow.
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
# Sub-case A: regular .git nested under .hg
mkdir -p "$tmp/outer/.hg"
mkdir -p "$tmp/outer/inner/.git"
input=$(jq -n --arg cwd "$tmp/outer/inner" --arg cmd "git log" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "sub-case A (nested .git) expected exit 0, got non-zero"
exit 1
fi
# Sub-case B: bare git repo (no .git subdir) inside .hg ancestor
mkdir -p "$tmp/outer/testdata/repo.git/refs"
mkdir -p "$tmp/outer/testdata/repo.git/objects"
touch "$tmp/outer/testdata/repo.git/HEAD"
input=$(jq -n --arg cwd "$tmp/outer/testdata/repo.git" --arg cmd "git log" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "sub-case B (bare repo) expected exit 0, got non-zero"
exit 1
fi
#!/usr/bin/env bash
# Case 04: 'hg status' inside an .hg repo must be allowed (only git is blocked).
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
mkdir -p "$tmp/repo/.hg"
input=$(jq -n --arg cwd "$tmp/repo" --arg cmd "hg status" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "expected exit 0 (allow), got non-zero"
exit 1
fi
#!/usr/bin/env bash
# Case 05: 'FOO=bar git status' inside an .hg repo must be blocked
# (env-var prefix correctly skipped to find the real leading command).
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
mkdir -p "$tmp/repo/.hg"
input=$(jq -n --arg cwd "$tmp/repo" --arg cmd "FOO=bar GIT_PAGER=cat git status" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
err=$(echo "$input" | "$HOOK_SCRIPT" 2>&1 >/dev/null)
rc=$?
if [[ $rc -ne 2 ]]; then
echo "expected exit 2 (blocked), got $rc"
echo "stderr: $err"
exit 1
fi
#!/usr/bin/env bash
# Case 06: 'ls -la' inside an .hg repo must be allowed (not a git command).
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
mkdir -p "$tmp/repo/.hg"
input=$(jq -n --arg cwd "$tmp/repo" --arg cmd "ls -la" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "expected exit 0 (allow), got non-zero"
exit 1
fi
#!/usr/bin/env bash
# Case 07: 'cd /tmp && git init' inside an .hg repo must be allowed
# (only the leading token is inspected — this is the documented escape valve).
set -u
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT
mkdir -p "$tmp/repo/.hg"
input=$(jq -n --arg cwd "$tmp/repo" --arg cmd "cd /tmp && git init" '{
cwd: $cwd,
hook_event_name: "PreToolUse",
tool_name: "Bash",
tool_input: { command: $cmd }
}')
if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
echo "expected exit 0 (allow), got non-zero"
exit 1
fi
|