Skip to content

fix(plugin): isolate Claude Pi guard fixtures from ancestor Git - #2092

Merged
dnlrsls merged 1 commit into
Gentleman-Programming:mainfrom
dnlrsls:fix/2089-claude-pi-guard-fixtures
Oct 24, 2026
Merged

dnlrsls merged 1 commit into
Gentleman-Programming:mainfrom
dnlrsls:fix/2089-claude-pi-guard-fixtures

Conversation

@dnlrsls

@dnlrsls dnlrsls commented Oct 24, 2026 •

Copy link
Copy Markdown
Member

🔗 Linked Issue

Closes #2089

Lifecycle Evidence

  • The linked issue is approved and has a real assignee.
  • Reproduction, root cause, and focused regression evidence are recorded below for implementation base 16e06bb0176e060b98ceab08f27dd391ce365b82, which matched remote main when work began.
  • Latest-main compatibility and broad hosted CI evidence: pending. Main advanced to b5c036532c1924888e4c4bdd4305325e16f7c59e before publication; this candidate has not been locally integrated with or tested against that newer revision.
  • Scope is fixture-only; production identity validation remains unchanged.

🏷️ PR Type

  • type:bug — Bug fix
  • type:feature — New feature
  • type:question — Question requiring tracked work
  • type:docs — Documentation only
  • type:refactor — Code refactoring
  • type:chore — Maintenance, dependencies, tooling
  • type:breaking-change — Breaking change

The maintainer authorized applying exactly one GitHub label: type:bug. Its application was verified on this PR.

📝 Summary

  • Bound Git discovery only in the native Claude Pi-guard fixture subprocess, preserving inherited ceilings and production fail-closed identity checks.
  • Cover plain temporary directories and a controlled broken ancestor gitfile without depending on WSL or the host temporary-directory location.
  • Assert bound input, ordered registration requests, exit status, empty stderr, and silent/no-request behavior with the Pi marker.

📂 Changes

File Change
plugin/claude_code_pi_guard_test.go Apply a fixture-local Git ceiling and exercise six marker/ancestry cases with stronger response assertions.

Commit: ce31e16c1fe2a547c02dc9e4f236ebf17949bc3b (one file, 71 additions and 30 deletions). No production scripts, timeouts, dependencies, or public contracts changed. Local .tmp/ diagnostic artifacts are excluded.

🧪 Test Plan

Existing evidence, not checks rerun for publication. Local execution used Go 1.26.4 on Windows/amd64.

  • Controlled RED before adding the ceiling: unset/empty marker controls received the reported registration denial and made only the initial session GET; the nonempty-marker case passed.
  • Focused GREEN: go test ./plugin -run '^TestClaudeCodeHooksAreNoOpUnderPi/(unset|empty|true)/claude-pre-tool-use$' -count=1 -v — all six final leaf cases passed, package 7.053s.
  • go test ./plugin ./internal/project -count=1 — internal/project passed, 16.244s; the plugin package failed on missing explicit Windows tool selectors and a separate native-jq CRLF mismatch.
  • Subsequent focused Claude response validation passed with exact LF output using a process-local, test-only jq binary-output adapter. jq 1.6 emulation was skipped on Windows because it requires the POSIX delegate.
  • Codex shell isolation preflight passed using reviewed Bash and the physical native jq executable rather than its Scoop alias.
  • Latest go test ./plugin -count=1 — FAILED, 388.562s, with one reported failure: TestCodexUnixUserPromptSubmitDetachesPromptPersistenceStdin, codex_unix_user_prompt_test.go:337: prompt persistence did not finish the stdin probe.
  • git diff --cached --check passed before committing. The committed fixture blob matches the previously checked candidate.
  • Full module/E2E/lint and hosted platform evidence — pending actual CI execution, not inferred from focused local results.

🤖 Automated Checks

All hosted results remain pending until observed on this PR. No hosted green or merge-readiness claim is made. The initial pre-label check failed before type:bug was applied. That historical result is retained; the label-event check must establish the current policy result.

✅ Contributor Checklist

  • Linked an approved and assigned issue.
  • Added exactly one type:* label — type:bug, explicitly authorized and verified.
  • Recorded actual focused and affected-package results, including failures and skipped coverage.
  • Identified missing latest-main and hosted CI evidence.
  • Documentation impact assessed: no user-facing behavior, CLI, configuration, or production contract changes; fixture comments explain isolation.
  • Conventional Commit; no Co-Authored-By trailers.
  • Reviewed the exact one-file scope against the transient-artifact policy; local diagnostics are not committed.

💬 Notes for Reviewers

The Codex stdin-probe failure is on a different test surface, but its root cause and baseline behavior remain unproven. Do not treat it as an established independent Engram bug or as a proven regression from this change.

An isolated path/EOF probe succeeded for native Windows and converted marker paths; it did not reproduce the proposed path mismatch or establish whole-hook dispatch behavior. Two later attempts to prepare fixture-only diagnostic instrumentation failed in our generators before Go ran. Those are diagnostic-tooling failures, not additional Engram runtime failures. Neither attempt produced runtime evidence. No assertions or deadlines were relaxed.

Native assessment returned the RDD-off writer-self-verification plan. Later assessments were unassessable because local untracked diagnostics require declaration; there is no native approval receipt. This draft preserves the verification gap rather than claiming the plugin suite is green.

Risk: none — source changes are limited to this fixture; production repository binding, security guards, state, concurrency, delivery, and dependencies are untouched.

Summary by CodeRabbit

  • Tests
    • Expanded automated coverage for tool-use behavior with and without the Pi coding-agent marker, including environments with Git discovery issues.
    • Added checks for response contents, session handling, and unexpected command output.

Bound Git discovery only in the native hook fixture subprocess. Cover plain and broken-ancestor directories and assert bound session input, request sequence, and silent Pi behavior.

Focused regression: six leaf cases passed after controlled RED. internal/project suite passed. Full plugin suite still fails TestCodexUnixUserPromptSubmitDetachesPromptPersistenceStdin on Windows; its cause remains unresolved. No full-suite or CI green claim.

Refs: Gentleman-Programming#2089
@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between b5c0365 and ce31e16.

Files selected for processing: 1
  • plugin/claude_code_pi_guard_test.go

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

Walkthrough

The Claude Pi guard subprocess test now covers plain and broken-Git-ancestor fixtures. It bounds Git discovery, checks silent no-op behavior when the Pi marker is set, and validates the response and session requests when the marker is absent.

Changes: Claude Pi guard tests

Layer / File(s) Summary
Fixture isolation and hook assertions
plugin/claude_code_pi_guard_test.go
The test runs plain and broken-Git-ancestor fixtures with bounded Git discovery while retaining inherited Git ceilings. It checks empty stderr, silent output and no requests with the Pi marker, and response fields and ordered session requests without the marker.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Possibly related issues

  • Gentleman-Programming/gentle-ai issue 5674: The test checks silent Claude hook behavior when PI_CODING_AGENT is set, which matches the issue’s suppression objective for other hook entry points.

Possibly related PRs

Suggested reviewers: edwinsaavedran, gentleman-programming

Merge Risk: Minimal · up to ce31e

No change-related issue is established; merge after normal validation.

Pre-merge checks: Passed 4
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the main change: isolating Claude Pi guard test fixtures from ancestor Git metadata.
Linked Issues check Passed Issue #2089 requires isolation of the Claude Pi-guard fixtures from unrelated ancestor Git metadata. The diff adds plain and broken-ancestor fixtures, sets a fixture-local GIT_CEILING_DIRECTORIES valu…
Out of Scope Changes check Passed The diff changes only plugin/claude_code_pi_guard_test.go. The added fixture setup and response assertions directly support issue #2089. No production code, timeout, dependency, public contract, or un…
Full details: Linked Issues check

Explanation

Issue #2089 requires isolation of the Claude Pi-guard fixtures from unrelated ancestor Git metadata. The diff adds plain and broken-ancestor fixtures, sets a fixture-local GIT_CEILING_DIRECTORIES value while retaining inherited ceilings, and preserves explicit repositories below the ceiling. It verifies unset and empty PI_CODING_AGENT registration, bound updatedInput, request order, exit status, and empty stderr. It verifies that a nonempty marker produces no output and no requests. The change is limited to the test fixture, so production identity validation is unchanged.

Full details: Out of Scope Changes check

Explanation

The diff changes only plugin/claude_code_pi_guard_test.go. The added fixture setup and response assertions directly support issue #2089. No production code, timeout, dependency, public contract, or unrelated test surface changed.

Finishing Touches: 💡 1
🛠️ Fix failing CI checks: 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dnlrsls dnlrsls added the type:bug Bug fix label Oct 24, 2026
@dnlrsls
dnlrsls marked this pull request as ready for review October 24, 2026 02:58
@dnlrsls
dnlrsls added this pull request to the merge queue Oct 24, 2026
Merged via the queue into Gentleman-Programming:main with commit aec0f4f Oct 24, 2026
51 of 52 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type:bug Bug fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug(tests): Claude Pi guard fixtures inherit unrelated ancestor Git metadata

1 participant