tests/hooks/gateguard-fact-force.test.js (1)

304-318: ⚡ Quick win

Consider adding test coverage for other destructive checkout forms.

Test 7b validates -f, but the implementation also gates git checkout ., git checkout --, and git checkout --force. Adding explicit tests for these patterns would prevent regressions if the logic changes.

🧪 Suggested additional test cases

   // --- Test 7b: gates force/path git checkout as destructive Bash ---
   clearState();
   if (test('denies git checkout -f as destructive Bash', () => {
     const input = {
       tool_name: 'Bash',
       tool_input: { command: 'git checkout -f main' }
     };
     const result = runBashHook(input);
     assert.strictEqual(result.code, 0, 'exit code should be 0');
     const output = parseOutput(result.stdout);
     assert.ok(output, 'should produce JSON output');
     assert.strictEqual(output.hookSpecificOutput.permissionDecision, 'deny');
     assert.ok(output.hookSpecificOutput.permissionDecisionReason.includes('Destructive'));
     assert.ok(output.hookSpecificOutput.permissionDecisionReason.includes('rollback'));
   })) passed++; else failed++;

+  // --- Test 7c: gates git checkout . as destructive Bash ---
+  clearState();
+  if (test('denies git checkout . as destructive Bash', () => {
+    expectDestructiveDeny('git checkout .', 'git checkout .');
+  })) passed++; else failed++;
+
+  // --- Test 7d: gates git checkout -- <path> as destructive Bash ---
+  clearState();
+  if (test('denies git checkout -- path as destructive Bash', () => {
+    expectDestructiveDeny('git checkout -- src/file.js', 'git checkout -- path');
+  })) passed++; else failed++;
+
+  // --- Test 7e: gates git checkout --force as destructive Bash ---
+  clearState();
+  if (test('denies git checkout --force as destructive Bash', () => {
+    expectDestructiveDeny('git checkout --force main', 'git checkout --force');
+  })) passed++; else failed++;
+
+  // --- Test 7f: allows plain git checkout (branch switch) ---
+  clearState();
+  if (test('allows plain git checkout branch switch', () => {
+    expectAllow('git checkout feature-branch', 'git checkout feature-branch');
+  })) passed++; else failed++;

Note: The expectDestructiveDeny and expectAllow helpers are defined later in the file (lines 1179-1204), so these tests would need to be placed after line 1175 or the helper definitions moved earlier.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/hooks/gateguard-fact-force.test.js` around lines 304 - 318, Add
explicit tests in tests/hooks/gateguard-fact-force.test.js that mirror "Test 7b"
(which uses runBashHook) to cover the other destructive checkout forms: "git
checkout .", "git checkout --", and "git checkout --force" and assert they
produce a deny with a Destructive/rollback reason; use the existing helpers
expectDestructiveDeny (or expectAllow for non-destructive cases) to keep
assertions concise and place these new test cases after the helper definitions
(or move expectDestructiveDeny/expectAllow above these tests) so they can be
referenced, and follow the same test pattern (clearState(), build input with
tool_name 'Bash' and tool_input.command, call runBashHook, parseOutput and
assert permissionDecision === 'deny' and reason includes 'Destructive' and
'rollback').