update skills

.agents/skills/git-guardrails-claude-code/scripts/test_guardrail.py

@@ -0,0 +1,61 @@
+"""Run with python3; command payloads are inspected, never executed."""
+
+import json
+import os
+from pathlib import Path
+import subprocess
+
+
+hook = Path(__file__).with_name("block-dangerous-git.sh")
+
+
+def check(payload, expected, env=None):
+    result = subprocess.run(
+        ["/bin/bash", str(hook)], input=payload, text=True, capture_output=True, env=env
+    )
+    assert result.returncode == expected, (payload, result.returncode, result.stderr)
+    if expected == 2:
+        assert result.stderr.startswith("BLOCKED:"), result.stderr
+
+
+for command in (
+    "git push origin main",
+    "git push --force-with-lease origin main",
+    "git -C /tmp/example push origin main",
+    "git -c core.pager=cat --no-pager push",
+    "git --git-dir=/tmp/example push",
+    "git  push",
+    "git status;git push",
+    "git status\ngit push",
+    "git \\\npush origin main",
+    "git pu\\\nsh origin main",
+    "git reset --ha\\\nrd HEAD",
+    "git reset --hard HEAD",
+    "git clean -xdf",
+    "git clean --force",
+    "git branch -D topic",
+    "git branch -df topic",
+    "git branch -vD topic",
+    "git branch --delete --force topic",
+    "git checkout -- .",
+    "git restore .",
+):
+    check(json.dumps({"tool_input": {"command": command}}), 2)
+
+for command in (
+    "git status",
+    "git diff",
+    "git -C /tmp/example status",
+    "git branch -d merged-topic",
+    "git reset --soft HEAD~1",
+    "echo 'git push origin main'",
+    'echo ""',
+    "git reset --soft HEAD; echo --hard",
+):
+    check(json.dumps({"tool_input": {"command": command}}), 0)
+
+for payload in ("", "{", "{}", "[]", '{"tool_input":{"command":null}}'):
+    check(payload, 2)
+check('{"tool_input":{"command":"git status"}}', 2, {**os.environ, "PATH": ""})
+check('{"tool_input":{"command":"git \\\""}}', 2)
+print("Guardrail checks passed")