pushkin 0.2.0

//! F58 — codex `*** Delete File:` and `*** Move to:` walk straight through the
//! protected-path gate.
//!
//! COMMITTED RED. A NEW file per N10.
//!
//! **What was probed live, 2026-08-18.** `parse_apply_patch` recognizes two of
//! the four `apply_patch` section markers. Against this repo's own manifest:
//! `*** Update File: pushkin.toml` was correctly BLOCKED, while
//! `*** Delete File: pushkin.toml` failed OPEN ("unrecognized codex hook
//! payload") and `*** Update File: <ungated>` + `*** Move to: pushkin.toml`
//! was allowed in silence. Same protected file, three routes, two of them open.
//!
//! **Why this outranks F48.** F48 fell open on rules that need CONTENT. This
//! falls open on `protected_path` and `read_only_path` — the two rules this
//! project declares UNWAIVABLE. No amount of Phase B synthesis reaches it
//! either: a delete carries no content by definition, so there is nothing to
//! reconstruct. The fix is in the parser.
//!
//! **The verdict a delete must get, and must not get.** A delete is fully
//! decidable by the path rules and by nothing else. It must NOT refuse under
//! `pushkin.content_unavailable` — that message says a content rule could not
//! be evaluated, and for a file that is going away no such rule applies. A
//! refusal that misdescribes why is the failure mode this program keeps
//! finding.

use assert_cmd::Command;
use std::fs;
use std::path::Path;
use std::process::Command as StdCommand;

type TestResult = Result<(), Box<dyn std::error::Error>>;

const MANIFEST: &str = r#"
version = 1
canonical = "json-schema-2020-12"
authoring = "zod"

[[contracts]]
name = "user"
source = "contracts/user.zod.ts"
emit = ["zod"]

[[mappings]]
glob = "app/api/**/*.ts"
contracts = ["user"]
require = "boundary-validation"

[gates]
suppression_comments = "deny"
protected_paths = ["pushkin.toml"]
read_only_paths = ["crates/**/tests/**"]
"#;

const PROTECTED: &str = "pushkin.toml";
const COMMITTED_TEST: &str = "crates/pushkin-cli/tests/committed_suite.rs";
const MAPPED: &str = "app/api/users/route.ts";
const ORDINARY: &str = "docs/notes.md";

const RULE_PROTECTED: &str = "pushkin.protected_path";
const RULE_READ_ONLY: &str = "pushkin.read_only_path";
const RULE_UNVALIDATED: &str = "contract.boundary.unvalidated_input";
const RULE_CONTENT_UNAVAILABLE: &str = "pushkin.content_unavailable";

const FAIL_OPEN: &str = "failing open";

fn git(dir: &Path, args: &[&str]) -> TestResult {
    let status = StdCommand::new("git")
        .current_dir(dir)
        .args(args)
        .status()?;
    assert!(status.success(), "git {args:?} failed");
    Ok(())
}

fn repo() -> Result<tempfile::TempDir, Box<dyn std::error::Error>> {
    let dir = tempfile::tempdir()?;
    fs::write(dir.path().join(PROTECTED), MANIFEST)?;
    fs::create_dir_all(dir.path().join("contracts"))?;
    fs::write(
        dir.path().join("contracts/user.zod.ts"),
        "export const user = 1;\n",
    )?;
    fs::create_dir_all(dir.path().join("app/api/users"))?;
    fs::write(dir.path().join(MAPPED), "export const handler = 1;\n")?;
    fs::create_dir_all(dir.path().join("crates/pushkin-cli/tests"))?;
    fs::write(dir.path().join(COMMITTED_TEST), "// committed suite\n")?;
    fs::create_dir_all(dir.path().join("docs"))?;
    fs::write(dir.path().join(ORDINARY), "notes\n")?;
    git(dir.path(), &["init", "-q", "."])?;
    git(dir.path(), &["add", "-A"])?;
    git(
        dir.path(),
        &[
            "-c",
            "user.name=F58 Suite",
            "-c",
            "user.email=f58@test",
            "commit",
            "-qm",
            "fixture",
        ],
    )?;
    Ok(dir)
}

/// Wraps patch body lines in the envelope codex actually sends.
fn patch_payload(body: &str) -> String {
    serde_json::json!({
        "session_id": "f58",
        "hook_event_name": "PreToolUse",
        "tool_name": "apply_patch",
        "tool_input": { "command": format!("*** Begin Patch\n{body}*** End Patch\n") },
    })
    .to_string()
}

fn hook(
    dir: &Path,
    payload: &str,
    daemon: Option<&str>,
) -> Result<String, Box<dyn std::error::Error>> {
    let mut cmd = Command::cargo_bin("pushkin")?;
    cmd.current_dir(dir).write_stdin(payload.to_owned());
    if let Some(mode) = daemon {
        cmd.env("PUSHKIN_DAEMON", mode);
    }
    let output = cmd.args(["hook", "codex"]).output()?;
    Ok(format!(
        "{}{}",
        String::from_utf8_lossy(&output.stdout),
        String::from_utf8_lossy(&output.stderr)
    ))
}

fn stop_daemon(dir: &Path) {
    let _ = Command::cargo_bin("pushkin")
        .map(|mut c| c.current_dir(dir).args(["daemon", "stop"]).output());
}

// ---------------------------------------------------------------------------
// Delete — the fail-open
// ---------------------------------------------------------------------------

/// The headline. Deleting the manifest is the most consequential write an agent
/// could make to this repo, and it was allowed.
#[test]
fn deleting_a_protected_file_is_denied() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(&format!("*** Delete File: {PROTECTED}\n")),
        Some("off"),
    )?;

    assert!(
        output.contains(RULE_PROTECTED),
        "a delete is a write to the protected path: {output}"
    );
    Ok(())
}

/// And it must be denied as a JUDGED write, not merely be noisy. A payload the
/// parser cannot read fails open by design; the point of the fix is that this
/// payload is now READ.
#[test]
fn deleting_a_protected_file_is_not_an_unparsed_fail_open() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(&format!("*** Delete File: {PROTECTED}\n")),
        Some("off"),
    )?;

    assert!(
        !output.contains(FAIL_OPEN),
        "the parser must RECOGNIZE the delete, not decline to judge it: {output}"
    );
    Ok(())
}

#[test]
fn deleting_a_committed_test_is_denied() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(&format!("*** Delete File: {COMMITTED_TEST}\n")),
        Some("off"),
    )?;

    assert!(
        output.contains(RULE_READ_ONLY),
        "N10 covers deleting a committed suite, not just editing it: {output}"
    );
    Ok(())
}

/// The other half — a gate that denies every delete is not a fix.
#[test]
fn deleting_an_ordinary_file_is_allowed() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(&format!("*** Delete File: {ORDINARY}\n")),
        Some("off"),
    )?;

    assert!(
        !output.contains(RULE_PROTECTED)
            && !output.contains(RULE_READ_ONLY)
            && !output.contains(RULE_CONTENT_UNAVAILABLE),
        "an ungated delete has nothing to object to: {output}"
    );
    Ok(())
}

/// A delete of a MAPPED path must not be refused under `content_unavailable`.
/// That rule says a content requirement could not be evaluated — but the file
/// is going away, so no content rule applies to it at all. Refusing with a
/// reason that does not hold is the defect class this project keeps closing.
#[test]
fn deleting_a_mapped_file_is_not_refused_as_content_unavailable() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(&format!("*** Delete File: {MAPPED}\n")),
        Some("off"),
    )?;

    assert!(
        !output.contains(RULE_CONTENT_UNAVAILABLE),
        "a delete has no content to evaluate, so this refusal would misdescribe \
         its own reason: {output}"
    );
    Ok(())
}

// ---------------------------------------------------------------------------
// Move to — the destination nobody gated
// ---------------------------------------------------------------------------

/// Renaming an ungated file ONTO a protected path installs agent-authored
/// content at that path. The source was gated; the destination never was.
#[test]
fn renaming_onto_a_protected_path_is_denied() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(&format!(
            "*** Update File: {ORDINARY}\n*** Move to: {PROTECTED}\n@@\n-notes\n+tampered\n"
        )),
        Some("off"),
    )?;

    assert!(
        output.contains(RULE_PROTECTED),
        "the rename DESTINATION is a write target and must be gated: {output}"
    );
    Ok(())
}

#[test]
fn renaming_onto_a_committed_test_is_denied() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(&format!(
            "*** Update File: {ORDINARY}\n*** Move to: {COMMITTED_TEST}\n@@\n-notes\n+tampered\n"
        )),
        Some("off"),
    )?;

    assert!(
        output.contains(RULE_READ_ONLY),
        "overwriting a committed suite by rename is still overwriting it: {output}"
    );
    Ok(())
}

/// The source half must keep working — moving a protected file AWAY is equally
/// a change to the gate surface.
#[test]
fn renaming_a_protected_file_away_is_denied() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(&format!(
            "*** Update File: {PROTECTED}\n*** Move to: {ORDINARY}\n@@\n-a\n+b\n"
        )),
        Some("off"),
    )?;

    assert!(
        output.contains(RULE_PROTECTED),
        "the source is still the protected path: {output}"
    );
    Ok(())
}

/// And an ordinary rename must not be denied on account of the new marker.
#[test]
fn an_ordinary_rename_is_not_denied_on_path_rules() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(&format!(
            "*** Update File: {ORDINARY}\n*** Move to: docs/renamed.md\n@@\n-notes\n+edited\n"
        )),
        Some("off"),
    )?;

    assert!(
        !output.contains(RULE_PROTECTED) && !output.contains(RULE_READ_ONLY),
        "neither path is gated: {output}"
    );
    Ok(())
}

// ---------------------------------------------------------------------------
// Mixed patches, and warm/cold
// ---------------------------------------------------------------------------

/// A patch carrying both a delete and an add must not let the ADD escape the
/// content rules. One `ToolAction` carries one intent for every file it names,
/// so the intent chosen for a mixed patch must be the one that judges most.
#[test]
fn a_patch_mixing_a_delete_and_an_add_still_judges_the_added_content() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(&format!(
            "*** Delete File: {ORDINARY}\n*** Add File: app/api/new/route.ts\n\
             +export async function POST(req: Request) {{\n\
             +  const body = await req.json();\n\
             +  return Response.json(body);\n\
             +}}\n"
        )),
        Some("off"),
    )?;

    assert!(
        output.contains(RULE_UNVALIDATED),
        "the added handler parses no contract and must still be caught: {output}"
    );
    Ok(())
}

/// A delete alongside an Update must not let the Update half escape judgement.
///
/// This assertion was STRENGTHENED when F52's hunk arm landed. It used to
/// require the Update's interim REFUSAL, which was the strongest verdict
/// available while hunks were unreconstructable. The hunk is reconstructed now,
/// so the test demands the real thing: the violation the update actually
/// introduces, judged under the content rule rather than deferred.
#[test]
fn a_delete_alongside_an_update_still_judges_the_update() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(&format!(
            "*** Delete File: {ORDINARY}\n\
             *** Update File: {MAPPED}\n\
             @@\n\
             -export const handler = 1;\n\
             +export async function POST(req: Request) {{\n\
             +  const body = await req.json();\n\
             +  return Response.json(body);\n\
             +}}\n"
        )),
        Some("off"),
    )?;

    assert!(
        output.contains(RULE_UNVALIDATED),
        "the update introduces an unvalidated handler and must be caught: {output}"
    );
    assert!(
        !output.contains(RULE_CONTENT_UNAVAILABLE),
        "and judged, not deferred — the hunk is reconstructable now: {output}"
    );
    Ok(())
}

#[test]
fn the_delete_verdict_is_identical_warm_and_cold() -> TestResult {
    let dir = repo()?;
    let payload = patch_payload(&format!("*** Delete File: {PROTECTED}\n"));

    let cold = hook(dir.path(), &payload, Some("off"))?;
    let warm = hook(dir.path(), &payload, Some("auto"))?;
    stop_daemon(dir.path());

    assert!(cold.contains(RULE_PROTECTED), "cold: {cold}");
    assert!(warm.contains(RULE_PROTECTED), "warm: {warm}");
    Ok(())
}

/// Regression: an Add-only patch still carries whole content and is still
/// judged on it.
#[test]
fn an_add_only_patch_is_unaffected() -> TestResult {
    let dir = repo()?;

    let output = hook(
        dir.path(),
        &patch_payload(
            "*** Add File: app/api/other/route.ts\n\
             +export async function POST(req: Request) {\n\
             +  const body = await req.json();\n\
             +  return Response.json(body);\n\
             +}\n",
        ),
        Some("off"),
    )?;

    assert!(
        output.contains(RULE_UNVALIDATED),
        "Add sections are whole files and keep their content verdict: {output}"
    );
    Ok(())
}