openmoat 0.14.0

Policy checks for AI coding agents: decides allow, defer, review or deny for every tool call from Claude Code, Codex, Cursor, OpenClaw, GitHub Copilot CLI, pi and Gemini CLI, configures Claude Code's, Codex's and Cursor's own OS sandboxes from the same policy, and keeps a local audit log.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

use std::path::Path;

use openmoat_hosts::Host;
use serde_json::{Value, json};

use super::super::{HookState, Outcome, install, remove, state};
use crate::home::Home;
use crate::install::HostConfig;

/// `init` writes one named `BeforeTool` entry with the timeout in
/// milliseconds, beside the person's own hooks and settings, and `uninstall`
/// takes away only it.
#[test]
fn the_entry_is_installed_once_and_removed_alone() {
    let dir = tempfile::tempdir().unwrap();
    let spec = Host::GeminiCli.spec().install.as_ref().unwrap();
    let config = HostConfig {
        host: Host::GeminiCli,
        settings_path: dir.path().join("settings.json"),
        dir: dir.path().to_path_buf(),
        hooks: spec.hooks,
        layout: spec.hook_file,
        blocks_on_failure: || false,
    };
    let theirs = json!({
        "ui": {"theme": "GitHub"},
        "hooks": {"BeforeTool": [{"matcher": "write_file", "hooks": [
            {"type": "command", "command": "node lint.js"}
        ]}]}
    });
    std::fs::write(&config.settings_path, theirs.to_string()).unwrap();
    let home = Home::at(dir.path().join("state"));
    let binary = Path::new("/opt/open moat/openmoat");
    assert_eq!(state(&config, binary), HookState::Missing);
    assert_eq!(
        install(&home, &config, binary, false).unwrap(),
        Outcome::Installed
    );
    assert_eq!(
        install(&home, &config, binary, false).unwrap(),
        Outcome::Unchanged
    );
    assert_eq!(state(&config, binary), HookState::Installed);
    let text = std::fs::read_to_string(&config.settings_path).unwrap();
    let mut root: Value = serde_json::from_str(&text).unwrap();
    let ours = &root["hooks"]["BeforeTool"][1];
    assert_eq!(ours["matcher"], "*");
    assert_eq!(ours["hooks"][0]["name"], "openmoat");
    assert_eq!(ours["hooks"][0]["type"], "command");
    assert_eq!(ours["hooks"][0]["timeout"], 600_000);
    assert!(
        ours["hooks"][0]["command"]
            .as_str()
            .unwrap()
            // PowerShell adds `; if (-not $?) { exit 2 }` on Windows
            .contains(" guard --host gemini-cli")
    );
    assert_eq!(
        state(&config, Path::new("/usr/bin/openmoat")),
        HookState::Stale {
            command: "/opt/open moat/openmoat".into()
        }
    );
    assert!(remove(&mut root, &config));
    assert_eq!(root, theirs);
}