pushkin 0.2.0

Schema-first enforcement harness that gates AI coding agents' file writes against project contracts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

//! Phase 3 task 7: `pushkin stats` (spec §14). Committed first,
//! read-only hereafter (charter §4.1). Pins: blocks grouped by rule and
//! the compression savings (recorded by pointer emissions) surface in
//! the stats output — the observability floor for "knowing it's
//! working without watching it" (addendum §8).

use assert_cmd::Command;
use std::fs;

const MANIFEST: &str = r#"
version = 1
canonical = "json-schema-2020-12"
authoring = "zod"

[[contracts]]
name = "user"
source = "contracts/user.zod.ts"
emit = ["zod"]

[[mappings]]
glob = "app/api/**/*.ts"
contracts = ["user"]
require = "boundary-validation"

[gates]
protected_paths = ["pushkin.toml"]
"#;

const CONTRACT_SOURCE: &str = "import { z } from \"zod\";\n\n\
export const UserCreateSchema = z.object({ name: z.string(), email: z.string() }).strict();\n";

const NONCONFORMING: &str = "export async function POST(req: Request) {\n\
  const body = await req.json();\n\
  return Response.json({ name: body.name });\n\
}\n";

fn repo() -> std::io::Result<tempfile::TempDir> {
    let dir = tempfile::tempdir()?;
    fs::write(dir.path().join("pushkin.toml"), MANIFEST)?;
    fs::create_dir_all(dir.path().join("contracts"))?;
    fs::write(dir.path().join("contracts/user.zod.ts"), CONTRACT_SOURCE)?;
    Ok(dir)
}

fn run(dir: &tempfile::TempDir, args: &[&str], stdin: Option<String>) -> (i32, String) {
    let Ok(mut command) = Command::cargo_bin("pushkin") else {
        return (-1, "cargo_bin resolution failed".to_owned());
    };
    command.current_dir(dir.path()).args(args);
    if let Some(payload) = stdin {
        command.write_stdin(payload);
    }
    let Ok(output) = command.output() else {
        return (-1, "spawn failed".to_owned());
    };
    (
        output.status.code().unwrap_or(-1),
        String::from_utf8_lossy(&output.stdout).into_owned(),
    )
}

#[test]
fn stats_reports_blocks_by_rule_and_tokens_saved() {
    let dir = repo().unwrap();
    let payload = serde_json::json!({
        "session_id": "stats-1",
        "tool_name": "Write",
        "tool_input": { "file_path": "app/api/users/route.ts", "content": NONCONFORMING }
    })
    .to_string();
    // Two identical denials: the second collapses the slice to a pointer
    // and records a pushkin.compression savings event.
    run(&dir, &["hook", "claude"], Some(payload.clone()));
    run(&dir, &["hook", "claude"], Some(payload));

    let (code, stdout) = run(&dir, &["stats"], None);
    assert_eq!(code, 0);
    assert!(
        stdout.contains("contract.boundary.unvalidated_input"),
        "blocks grouped by rule: {stdout}"
    );
    assert!(
        stdout.contains("saved"),
        "compression savings surfaced: {stdout}"
    );
}