2 files changed, 226 insertions, 0 deletions
diff --git a/languages/elisp/tests/test-pre-commit-hook.bats b/languages/elisp/tests/test-pre-commit-hook.bats
new file mode 100644
index 0000000..413c71d
--- /dev/null
+++ b/languages/elisp/tests/test-pre-commit-hook.bats
@@ -0,0 +1,126 @@
+#!/usr/bin/env bats
+# Tests for githooks/pre-commit — the secret scan and paren check.
+#
+# The scan reads its input through a pipeline:
+#
+#   added_lines="$(git diff --cached ... | grep '^+' | grep -v '^+++' || true)"
+#
+# `grep` exits 1 when it matches nothing, which is the ordinary case, so the
+# `|| true` has to stay.  But with no `pipefail` it also swallows a failure of
+# `git diff` itself, and an empty `added_lines` makes the scan search nothing,
+# find nothing, and report clean.  A gate that passes without looking is the
+# failure this file exists to pin: the fail-open test drives a broken `git diff`
+# and asserts the hook refuses rather than exiting 0.
+#
+# Each test builds a throwaway git repo in BATS_TEST_TMPDIR, so nothing touches
+# the real repository or its hooks.
+
+setup() {
+    HOOK="${BATS_TEST_DIRNAME}/../githooks/pre-commit"
+    REPO="${BATS_TEST_TMPDIR}/repo"
+    mkdir -p "$REPO"
+    cd "$REPO" || return 1
+    git init -q .
+    git config user.email t@example.com
+    git config user.name  Test
+    # Split so the fixtures never appear as credential-shaped literals here.
+    AWS_TAIL="IOSFODNN7EXAMPLE"
+    WORD_TAIL="word"
+}
+
+# Put a stub `git` ahead of the real one that fails for the staged-diff call
+# and delegates everything else, so only the pipeline under test breaks.
+break_staged_diff() {
+    mkdir -p "${BATS_TEST_TMPDIR}/bin"
+    cat > "${BATS_TEST_TMPDIR}/bin/git" <<'STUB'
+#!/usr/bin/env bash
+if [ "${1:-}" = "diff" ] && [ "${2:-}" = "--cached" ] && [ "${3:-}" = "-U0" ]; then
+  echo "simulated git failure" >&2
+  exit 128
+fi
+exec /usr/bin/git "$@"
+STUB
+    chmod +x "${BATS_TEST_TMPDIR}/bin/git"
+    PATH="${BATS_TEST_TMPDIR}/bin:$PATH"
+}
+
+# ------------------------------- Normal cases -------------------------------
+
+@test "secret scan: blocks a staged AWS key" {
+    # Assembled at runtime: a literal key-shaped string in this file would trip
+    # the very hook under test on every commit that touches it, and this repo
+    # mirrors to a public remote.
+    printf 'aws = "%s"\n' "AKIA${AWS_TAIL}" > creds.txt
+    git add creds.txt
+    run "$HOOK"
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"potential secret"* ]]
+}
+
+@test "secret scan: blocks a staged keyword=value password" {
+    printf '%s = "%s"\n' "pass${WORD_TAIL}" "correcthorsebatterystaple" > conf.txt
+    git add conf.txt
+    run "$HOOK"
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"potential secret"* ]]
+}
+
+@test "secret scan: allows an ordinary staged file" {
+    printf 'just some prose\n' > notes.txt
+    git add notes.txt
+    run "$HOOK"
+    [ "$status" -eq 0 ]
+}
+
+# ------------------------------ Boundary cases ------------------------------
+
+@test "secret scan: allows a commit with nothing staged" {
+    run "$HOOK"
+    [ "$status" -eq 0 ]
+}
+
+@test "paren check: blocks an unbalanced staged .el file" {
+    printf '(defun broken ()\n  (message "no close"\n' > bad.el
+    git add bad.el
+    run "$HOOK"
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"paren check failed"* ]]
+}
+
+@test "paren check: allows a balanced staged .el file" {
+    printf '(defun fine ()\n  (message "ok"))\n' > good.el
+    git add good.el
+    run "$HOOK"
+    [ "$status" -eq 0 ]
+}
+
+# -------------------------------- Error cases -------------------------------
+
+@test "secret scan: refuses to pass when the staged diff cannot be read" {
+    # The scan must not report clean after searching nothing.  Without a
+    # pipefail-aware guard the broken diff yields an empty added_lines and the
+    # hook exits 0, letting a real secret through unscanned.
+    printf 'aws = "%s"\n' "AKIA${AWS_TAIL}" > creds.txt
+    git add creds.txt
+    break_staged_diff
+    run "$HOOK"
+    [ "$status" -ne 0 ]
+}
+
+@test "paren check: refuses to pass when the staged file list cannot be read" {
+    printf '(defun broken ()\n  (message "no close"\n' > bad.el
+    git add bad.el
+    mkdir -p "${BATS_TEST_TMPDIR}/bin2"
+    cat > "${BATS_TEST_TMPDIR}/bin2/git" <<'STUB'
+#!/usr/bin/env bash
+if [ "${1:-}" = "diff" ] && [ "${2:-}" = "--cached" ] && [ "${3:-}" = "--name-only" ]; then
+  echo "simulated git failure" >&2
+  exit 128
+fi
+exec /usr/bin/git "$@"
+STUB
+    chmod +x "${BATS_TEST_TMPDIR}/bin2/git"
+    PATH="${BATS_TEST_TMPDIR}/bin2:$PATH"
+    run "$HOOK"
+    [ "$status" -ne 0 ]
+}
diff --git a/languages/elisp/tests/test-validate-el-hook.bats b/languages/elisp/tests/test-validate-el-hook.bats
new file mode 100644
index 0000000..d4d6f23
--- /dev/null
+++ b/languages/elisp/tests/test-validate-el-hook.bats
@@ -0,0 +1,100 @@
+#!/usr/bin/env bats
+# Tests for .claude/hooks/validate-el.sh — the auto-test runner.
+#
+# The runner used to skip entirely above MAX_AUTO_TEST_FILES=20, with no else
+# branch: nothing printed, exit 0, indistinguishable from a passing run.  That
+# was live for the three largest families here (calendar-sync 63 test files,
+# music 45, ai-term 35), so every edit to those ran parens and byte-compile and
+# zero tests, silently.
+#
+# The cap was removed rather than made loud, because its premise did not hold.
+# Measured on this machine, running a whole family takes about a second:
+# ai-term 208 tests in 1.0s, music 403 in 1.7s, calendar-sync 633 in 0.9s.  It
+# was also concealing a real cross-test pollution bug in calendar-sync that
+# only appears when that family runs in one process.
+#
+# These tests pin that no file count is skipped.  Each builds a synthetic
+# project in BATS_TEST_TMPDIR and points CLAUDE_PROJECT_DIR at it, so nothing
+# runs against the real tree.
+
+setup() {
+    # Bundle layout: the hook ships at claude/hooks/ here and installs to
+    # .claude/hooks/ in a consuming project. This test was written against the
+    # installed layout, so re-homing it needed the path adjusted.
+    HOOK="${BATS_TEST_DIRNAME}/../claude/hooks/validate-el.sh"
+    PROJ="${BATS_TEST_TMPDIR}/proj"
+    mkdir -p "$PROJ/modules" "$PROJ/tests"
+    export CLAUDE_PROJECT_DIR="$PROJ"
+    printf '(provide (quote widget))\n' > "$PROJ/modules/widget.el"
+}
+
+# N green test files matching the widget stem.
+make_tests() {
+    local n="$1" i
+    for ((i = 1; i <= n; i++)); do
+        printf '(require (quote ert))\n(ert-deftest test-widget-%d () (should t))\n' \
+            "$i" > "$PROJ/tests/test-widget-${i}.el"
+    done
+}
+
+# One failing test file, to prove the run is real rather than merely quiet.
+make_failing_test() {
+    printf '(require (quote ert))\n(ert-deftest test-widget-bad () (should nil))\n' \
+        > "$PROJ/tests/test-widget-bad.el"
+}
+
+hook_input() {
+    printf '{"tool_input":{"file_path":"%s"}}' "$PROJ/modules/widget.el"
+}
+
+run_hook() {
+    run bash -c "$(printf '%q' "$HOOK") <<< '$(hook_input)'"
+}
+
+# ------------------------------- Normal cases -------------------------------
+
+@test "a small family runs and passes quietly" {
+    make_tests 3
+    run_hook
+    [ "$status" -eq 0 ]
+}
+
+@test "a failing test blocks, so a quiet pass means the tests really ran" {
+    make_tests 3
+    make_failing_test
+    run_hook
+    [ "$status" -eq 2 ]
+    [[ "$output" == *"TESTS FAILED"* ]]
+}
+
+# ------------------------------ Boundary cases ------------------------------
+
+@test "at the old cap of 20 files: runs" {
+    make_tests 20
+    run_hook
+    [ "$status" -eq 0 ]
+}
+
+@test "past the old cap: still runs, no longer skipped" {
+    make_tests 21
+    run_hook
+    [ "$status" -eq 0 ]
+    [[ "${output,,}" != *"skipped"* ]]
+}
+
+@test "well past the old cap: a failure in file 63 is still caught" {
+    # The regression this guards: at 63 files the runner used to skip, so a red
+    # test in a big family reported clean.  calendar-sync is exactly this size.
+    make_tests 63
+    make_failing_test
+    run_hook
+    [ "$status" -eq 2 ]
+    [[ "$output" == *"TESTS FAILED"* ]]
+}
+
+# -------------------------------- Error cases -------------------------------
+
+@test "no matching tests: exits clean without running anything" {
+    run_hook
+    [ "$status" -eq 0 ]
+}