[CLAUDE ROUTINE]: Test-coverage enhancement — per-policy tests for built-in policies with edge cases and params #156

Summary

__tests__/hooks/builtin-policies.test.ts does a nice job on registration and a happy-path per category, but the 30+ individual policies each have their own edge cases (quoted arguments, allow-lists, thresholdKb, ReDoS-ish inputs). A small test factory gets us parameterized per-policy coverage without ballooning the file count.

Where

• src/hooks/builtin-policies.ts (1615 lines — 30+ policies)
• __tests__/hooks/builtin-policies.test.ts
• __tests__/e2e/hooks/builtin-policies.e2e.test.ts

Why this helps

Builtin policies are the product. Subtle regressions (e.g. issue #49 — quoted args in block-env-files) historically slip through because each policy has only a narrow happy-path test. A test factory lets us cover:

• allow-list behaviour (block-sudo + allowPatterns)
• threshold behaviour (warn-large-file-write + thresholdKb)
• pathological-but-realistic inputs (shell quoting, heredocs, multi-line)
• param schema validation

This extends the excellent regression pattern used in block-read-outside-cwd.test.ts to the whole set.

Proposed enhancement

Test factory:

interface PolicyCase {
  policy: string;
  params?: Record<string, unknown>;
  input: Partial<PolicyContext>;
  expect: "allow" | "deny" | "instruct";
  reasonIncludes?: string;
}

const cases: PolicyCase[] = [
  { policy: "block-sudo", input: { payload: { tool_input: { command: "sudo ls" } } }, expect: "deny" },
  { policy: "block-sudo", params: { allowPatterns: ["^sudo systemctl status"] },
    input: { payload: { tool_input: { command: "sudo systemctl status" } } }, expect: "allow" },
  { policy: "block-env-files", input: { payload: { tool_input: { command: 'echo "copy .env.example to .env"' } } }, expect: "allow" },
  // … one row per policy × primary branches
];

describe.each(cases)("$policy", (c) => { /* evaluate, assert */ });

Two-dozen rows cover ~90% of the practical surface. Add rows whenever a user reports a regression — the test file becomes self-documenting.

Acceptance criteria

• Test factory exists with rows for every built-in policy's primary decision branches.
• At least one row per policy param (allow-list, threshold, etc.).
• The fixes for issues bug: block-env-files and protect-env-vars false-positive on quoted string content #49 (env-files quoted args) and any future regressions ship with the corresponding test row.
• CI coverage for builtin-policies.ts reaches ≥ 90% lines.