fix(claude): implement official Go hook contract
This commit is contained in:
ZacharyZhang-NY committed
1 parent
f71db95502
commit
15d044cf63
17 files changed
+3006
-236
No files matched your search
@@ -0,0 +1,293 @@
|
||||
package plugins
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"reflect"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func installClaudeRuntimeFixture(
|
||||
t *testing.T,
|
||||
status string,
|
||||
) (*claudeFixture, *codexTestAPI, *httptest.Server) {
|
||||
t.Helper()
|
||||
api := &codexTestAPI{status: status}
|
||||
server := httptest.NewServer(api)
|
||||
fixture := prepareClaudeFixture(t, claudeFixtureOptions{})
|
||||
fixture.config.BaseURL = server.URL
|
||||
fixture.config.Token = "ely_test_token"
|
||||
if err := fixture.plugin.Install(fixture.config); err != nil {
|
||||
server.Close()
|
||||
t.Fatalf("install Claude hooks: %v", err)
|
||||
}
|
||||
return fixture, api, server
|
||||
}
|
||||
|
||||
func TestClaudeGeneratedRuntimePreservesNativePayloadAuthAndChain(t *testing.T) {
|
||||
fixture, api, server := installClaudeRuntimeFixture(t, "active")
|
||||
defer server.Close()
|
||||
settings := readClaudeTestObject(t, fixture.configPath)
|
||||
guard := claudeTestManagedHandler(
|
||||
t,
|
||||
settings,
|
||||
"PreToolUse",
|
||||
claudeGuardScript,
|
||||
claudeGuardStatusMessage,
|
||||
)
|
||||
success := claudeTestManagedHandler(
|
||||
t,
|
||||
settings,
|
||||
"PostToolUse",
|
||||
claudeAuditScript,
|
||||
claudeAuditStatusMessage,
|
||||
)
|
||||
failure := claudeTestManagedHandler(
|
||||
t,
|
||||
settings,
|
||||
"PostToolUseFailure",
|
||||
claudeAuditScript,
|
||||
claudeAuditStatusMessage,
|
||||
)
|
||||
if exit, stdout, stderr := runClaudeHandler(
|
||||
t,
|
||||
guard,
|
||||
fixture,
|
||||
claudeOfficialPayload("PreToolUse"),
|
||||
); exit != 0 || stdout != "" || stderr != "" {
|
||||
t.Fatalf("guard result = %d, %q, %q", exit, stdout, stderr)
|
||||
}
|
||||
successPayload := claudeOfficialPayload("PostToolUse")
|
||||
failurePayload := claudeOfficialPayload("PostToolUseFailure")
|
||||
for _, item := range []struct {
|
||||
handler map[string]any
|
||||
payload map[string]any
|
||||
}{
|
||||
{success, successPayload},
|
||||
{failure, failurePayload},
|
||||
} {
|
||||
if exit, stdout, stderr := runClaudeHandler(
|
||||
t,
|
||||
item.handler,
|
||||
fixture,
|
||||
item.payload,
|
||||
); exit != 0 || stdout != "" || stderr != "" {
|
||||
t.Fatalf("audit result = %d, %q, %q", exit, stdout, stderr)
|
||||
}
|
||||
}
|
||||
getAuth, postAuth, operations := api.snapshot()
|
||||
if getAuth != "Bearer ely_test_token" || postAuth != "Bearer ely_test_token" {
|
||||
t.Fatalf("authorization headers = %q, %q", getAuth, postAuth)
|
||||
}
|
||||
if len(operations) != 2 ||
|
||||
!reflect.DeepEqual(operations[0]["payload"], successPayload) ||
|
||||
!reflect.DeepEqual(operations[1]["payload"], failurePayload) {
|
||||
t.Fatalf("Claude native operations = %#v", operations)
|
||||
}
|
||||
if operations[0]["prev_chain_hash"] !=
|
||||
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ||
|
||||
operations[1]["prev_chain_hash"] != operations[0]["chain_hash"] {
|
||||
t.Fatalf("Claude operation chain = %#v", operations)
|
||||
}
|
||||
}
|
||||
|
||||
func TestClaudeGuardUsesOfficialBlockingExitCode(t *testing.T) {
|
||||
for _, status := range []string{"frozen", "revoked"} {
|
||||
t.Run(status, func(t *testing.T) {
|
||||
fixture, _, server := installClaudeRuntimeFixture(t, status)
|
||||
defer server.Close()
|
||||
guard := claudeTestManagedHandler(
|
||||
t,
|
||||
readClaudeTestObject(t, fixture.configPath),
|
||||
"PreToolUse",
|
||||
claudeGuardScript,
|
||||
claudeGuardStatusMessage,
|
||||
)
|
||||
exit, stdout, stderr := runClaudeHandler(
|
||||
t,
|
||||
guard,
|
||||
fixture,
|
||||
claudeOfficialPayload("PreToolUse"),
|
||||
)
|
||||
if exit != 2 || stdout != "" ||
|
||||
!strings.Contains(strings.ToLower(stderr), status) {
|
||||
t.Fatalf("guard result = %d, %q, %q", exit, stdout, stderr)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestClaudeFailOpenGuardReportsInputConfigStatusAndAPIFailures(t *testing.T) {
|
||||
fixture, api, server := installClaudeRuntimeFixture(t, "active")
|
||||
guard := claudeTestManagedHandler(
|
||||
t,
|
||||
readClaudeTestObject(t, fixture.configPath),
|
||||
"PreToolUse",
|
||||
claudeGuardScript,
|
||||
claudeGuardStatusMessage,
|
||||
)
|
||||
runtimeConfig, err := os.ReadFile(fixture.runtimeConfig)
|
||||
if err != nil {
|
||||
t.Fatalf("read runtime config: %v", err)
|
||||
}
|
||||
malformedExit, _, malformedError := runClaudeRawHandler(
|
||||
t,
|
||||
guard,
|
||||
fixture,
|
||||
[]byte("{ malformed"),
|
||||
)
|
||||
if err := os.WriteFile(fixture.runtimeConfig, []byte("{ malformed"), 0600); err != nil {
|
||||
t.Fatalf("corrupt runtime config: %v", err)
|
||||
}
|
||||
configExit, _, configError := runClaudeHandler(
|
||||
t,
|
||||
guard,
|
||||
fixture,
|
||||
claudeOfficialPayload("PreToolUse"),
|
||||
)
|
||||
if err := os.WriteFile(fixture.runtimeConfig, runtimeConfig, 0600); err != nil {
|
||||
t.Fatalf("restore runtime config: %v", err)
|
||||
}
|
||||
_ = os.Remove(filepath.Join(fixture.agentDir, "status-cache.json"))
|
||||
api.mu.Lock()
|
||||
api.status = "unknown"
|
||||
api.mu.Unlock()
|
||||
statusExit, _, statusError := runClaudeHandler(
|
||||
t,
|
||||
guard,
|
||||
fixture,
|
||||
claudeOfficialPayload("PreToolUse"),
|
||||
)
|
||||
_ = os.Remove(filepath.Join(fixture.agentDir, "status-cache.json"))
|
||||
server.Close()
|
||||
apiExit, _, apiError := runClaudeHandler(
|
||||
t,
|
||||
guard,
|
||||
fixture,
|
||||
claudeOfficialPayload("PreToolUse"),
|
||||
)
|
||||
for _, result := range []struct {
|
||||
exit int
|
||||
err string
|
||||
want string
|
||||
}{
|
||||
{malformedExit, malformedError, "invalid JSON"},
|
||||
{configExit, configError, "Failed to read agent config"},
|
||||
{statusExit, statusError, "invalid agent status"},
|
||||
{apiExit, apiError, "Failed to resolve agent status"},
|
||||
} {
|
||||
if result.exit != 0 || !strings.Contains(result.err, result.want) {
|
||||
t.Fatalf("fail-open result = %d, %q; want %q", result.exit, result.err, result.want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestClaudeAuditRecordsMalformedInputAndAPIFailures(t *testing.T) {
|
||||
fixture, api, server := installClaudeRuntimeFixture(t, "active")
|
||||
defer server.Close()
|
||||
handler := claudeTestManagedHandler(
|
||||
t,
|
||||
readClaudeTestObject(t, fixture.configPath),
|
||||
"PostToolUseFailure",
|
||||
claudeAuditScript,
|
||||
claudeAuditStatusMessage,
|
||||
)
|
||||
malformedExit, malformedOutput, malformedError := runClaudeRawHandler(
|
||||
t,
|
||||
handler,
|
||||
fixture,
|
||||
[]byte("{ malformed"),
|
||||
)
|
||||
api.mu.Lock()
|
||||
api.postStatus = http.StatusServiceUnavailable
|
||||
api.mu.Unlock()
|
||||
upstreamExit, upstreamOutput, upstreamError := runClaudeHandler(
|
||||
t,
|
||||
handler,
|
||||
fixture,
|
||||
claudeOfficialPayload("PostToolUseFailure"),
|
||||
)
|
||||
log, err := os.ReadFile(filepath.Join(fixture.agentDir, "error.log"))
|
||||
if malformedExit != 0 || malformedOutput != "" || malformedError != "" ||
|
||||
upstreamExit != 0 || upstreamOutput != "" || upstreamError != "" ||
|
||||
err != nil || !strings.Contains(string(log), "invalid JSON") ||
|
||||
!strings.Contains(string(log), "HTTP 503") {
|
||||
t.Fatalf(
|
||||
"audit failures = (%d, %q, %q), (%d, %q, %q), log=%q, err=%v",
|
||||
malformedExit,
|
||||
malformedOutput,
|
||||
malformedError,
|
||||
upstreamExit,
|
||||
upstreamOutput,
|
||||
upstreamError,
|
||||
log,
|
||||
err,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
func TestClaudeStatusRequiresStrictRuntimeFiles(t *testing.T) {
|
||||
for _, name := range []string{"config.json", "private.key", "guard.js", "hook.js"} {
|
||||
t.Run("missing "+name, func(t *testing.T) {
|
||||
fixture := prepareClaudeFixture(t, claudeFixtureOptions{})
|
||||
if err := fixture.plugin.Install(fixture.config); err != nil {
|
||||
t.Fatalf("install Claude hooks: %v", err)
|
||||
}
|
||||
if err := os.Remove(filepath.Join(fixture.agentDir, name)); err != nil {
|
||||
t.Fatalf("remove %s: %v", name, err)
|
||||
}
|
||||
status, err := fixture.plugin.Status()
|
||||
if err != nil || status.Installed || !status.HookConfigured ||
|
||||
status.HookScriptExists {
|
||||
t.Fatalf("missing %s status = %#v, %v", name, status, err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestClaudeStatusSurfacesInvalidRuntimeMetadata(t *testing.T) {
|
||||
tests := []struct{ name, source, want string }{
|
||||
{"malformed", "{ malformed", "parse Elydora runtime config"},
|
||||
{"unsupported", `{"org_id":"o","agent_id":"agent-1","kid":"k","base_url":"https://api.test","agent_name":"claudecode","extra":true}`, "unsupported field"},
|
||||
{"identity", `{"org_id":"o","agent_id":"other","kid":"k","base_url":"https://api.test","agent_name":"claudecode"}`, "identity does not match"},
|
||||
}
|
||||
for _, testCase := range tests {
|
||||
t.Run(testCase.name, func(t *testing.T) {
|
||||
fixture := prepareClaudeFixture(t, claudeFixtureOptions{})
|
||||
if err := fixture.plugin.Install(fixture.config); err != nil {
|
||||
t.Fatalf("install Claude hooks: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(
|
||||
fixture.runtimeConfig,
|
||||
[]byte(testCase.source),
|
||||
0600,
|
||||
); err != nil {
|
||||
t.Fatalf("replace runtime config: %v", err)
|
||||
}
|
||||
_, err := fixture.plugin.Status()
|
||||
if err == nil || !strings.Contains(err.Error(), testCase.want) {
|
||||
t.Fatalf("status error = %v, want %q", err, testCase.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestClaudeRuntimeConfigOmitsEmptyToken(t *testing.T) {
|
||||
fixture := prepareClaudeFixture(t, claudeFixtureOptions{})
|
||||
fixture.config.Token = ""
|
||||
if err := fixture.plugin.Install(fixture.config); err != nil {
|
||||
t.Fatalf("install Claude hooks: %v", err)
|
||||
}
|
||||
config := readClaudeTestObject(t, fixture.runtimeConfig)
|
||||
if _, exists := config["token"]; exists {
|
||||
t.Fatalf("empty token persisted: %#v", config)
|
||||
}
|
||||
raw, err := json.Marshal(config)
|
||||
if err != nil || len(raw) == 0 {
|
||||
t.Fatalf("runtime config encoding = %q, %v", raw, err)
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user