feat: enforce clean wraps and inbox-safe syncHEADmain

Centralize repository-state checks, bind teardown to a certified clean HEAD, and allow inbox-only refreshes. Guard installed symlinks from cross-project writes and add regression coverage.

1 files changed, 62 insertions, 4 deletions

diff --git a/scripts/tests/ai-wrap-teardown-hook.bats b/scripts/tests/ai-wrap-teardown-hook.bats
index 05c49f1..6e33cca 100644
--- a/scripts/tests/ai-wrap-teardown-hook.bats
+++ b/scripts/tests/ai-wrap-teardown-hook.bats
@@ -7,10 +7,18 @@
 setup() {
     REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../.." && pwd)"
     SCRIPT="$REPO_ROOT/hooks/ai-wrap-teardown.sh"
+    GATE="$REPO_ROOT/claude-templates/bin/git-worktree-gate"
     TMPDIR_T="$(mktemp -d)"
     PROJ="proj-$$-$BATS_TEST_NUMBER"          # unique so /tmp sentinels don't collide
     CWD="$TMPDIR_T/$PROJ"
     mkdir -p "$CWD"
+    git init -q "$CWD"
+    git -C "$CWD" config user.email test@example.com
+    git -C "$CWD" config user.name tester
+    printf 'base\n' >"$CWD/tracked"
+    git -C "$CWD" add tracked
+    git -C "$CWD" commit -qm init
+    bash "$GATE" certify "$CWD"
     TEARDOWN_SENTINEL="/tmp/ai-wrap-teardown-${PROJ}"
     SHUTDOWN_SENTINEL="/tmp/ai-wrap-shutdown-${PROJ}"
 
@@ -35,7 +43,7 @@ teardown() {
 run_hook() {
     # invoke with the stubbed emacsclient on PATH, feeding Stop-hook JSON
     printf '{"cwd":"%s","hook_event_name":"Stop"}' "$CWD" \
-        | PATH="$BIN:$PATH" bash "$SCRIPT"
+        | GIT_WORKTREE_GATE="$GATE" PATH="$BIN:$PATH" bash "$SCRIPT"
 }
 
 @test "no sentinel: silent no-op, emacsclient never called" {
@@ -81,7 +89,7 @@ run_hook() {
     : > "$TEARDOWN_SENTINEL"
     status=0
     output="$(printf '{"cwd":"%s","hook_event_name":"Stop"}' "$CWD" \
-        | PATH="/usr/bin:/bin" bash "$SCRIPT")" || status=$?
+        | GIT_WORKTREE_GATE="$GATE" PATH="/usr/bin:/bin" bash "$SCRIPT")" || status=$?
     [ "$status" -eq 0 ]
     [ ! -f "$TEARDOWN_SENTINEL" ]
 }
@@ -89,13 +97,63 @@ run_hook() {
 @test "falls back to PWD basename when cwd is absent from JSON" {
     # No cwd key: hook uses $PWD. Run from CWD so basename resolves to PROJ.
     : > "$TEARDOWN_SENTINEL"
-    run env "PATH=$BIN:$PATH" bash -c "cd '$CWD' && printf '{}' | bash '$SCRIPT'"
+    run env "GIT_WORKTREE_GATE=$GATE" "PATH=$BIN:$PATH" \
+        bash -c "cd '$CWD' && printf '{}' | bash '$SCRIPT'"
     [ "$status" -eq 0 ]
     grep -q "cj/ai-term-quit \"$PROJ\"" "$EC_LOG"
 }
 
 @test "emits no stderr noise on a normal stop" {
     err="$(printf '{"cwd":"%s","hook_event_name":"Stop"}' "$CWD" \
-        | PATH="$BIN:$PATH" bash "$SCRIPT" 2>&1 >/dev/null)"
+        | GIT_WORKTREE_GATE="$GATE" PATH="$BIN:$PATH" bash "$SCRIPT" 2>&1 >/dev/null)"
     [ -z "$err" ]
 }
+
+@test "dirty worktree blocks teardown, preserves sentinel, and names the path" {
+    printf 'late\n' >>"$CWD/tracked"
+    : >"$TEARDOWN_SENTINEL"
+    run run_hook
+    [ "$status" -eq 0 ]
+    echo "$output" | jq -e '.decision == "block"'
+    echo "$output" | jq -e '.reason | test("tracked")'
+    [ -f "$TEARDOWN_SENTINEL" ]
+    [ ! -f "$EC_LOG" ]
+}
+
+@test "changed HEAD after certification blocks teardown" {
+    git -C "$CWD" commit -q --allow-empty -m later
+    : >"$TEARDOWN_SENTINEL"
+    run run_hook
+    echo "$output" | jq -e '.reason | test("HEAD changed")'
+    [ -f "$TEARDOWN_SENTINEL" ]
+    [ ! -f "$EC_LOG" ]
+}
+
+@test "missing certificate blocks teardown" {
+    rm -f "$(git -C "$CWD" rev-parse --absolute-git-dir)/ai-wrap-clean"
+    : >"$TEARDOWN_SENTINEL"
+    run run_hook
+    echo "$output" | jq -e '.reason | test("no clean-tree certificate")'
+    [ -f "$TEARDOWN_SENTINEL" ]
+}
+
+@test "Codex payload receives continue false and a stop reason" {
+    printf 'late\n' >>"$CWD/tracked"
+    : >"$TEARDOWN_SENTINEL"
+    run bash -c \
+        "printf '{\"cwd\":\"$CWD\",\"hook_event_name\":\"Stop\",\"model\":\"gpt-test\"}' \
+         | GIT_WORKTREE_GATE='$GATE' PATH='$BIN:$PATH' bash '$SCRIPT'"
+    [ "$status" -eq 0 ]
+    echo "$output" | jq -e '.continue == false'
+    echo "$output" | jq -e '.stopReason | test("tracked")'
+    [ -f "$TEARDOWN_SENTINEL" ]
+}
+
+@test "successful teardown consumes the clean-tree certificate" {
+    : >"$TEARDOWN_SENTINEL"
+    cert="$(git -C "$CWD" rev-parse --absolute-git-dir)/ai-wrap-clean"
+    [ -f "$cert" ]
+    run run_hook
+    [ "$status" -eq 0 ]
+    [ ! -f "$cert" ]
+}