From 8cab189c45bc8f0b674b8d240dc4d5f16c90c872 Mon Sep 17 00:00:00 2001
From: stevef <stevef@omen.home>
Date: Mon, 20 Apr 2026 07:20:49 +0200
Subject: [PATCH] test: add regression checks for security shield hook
 registration

---
 cmd/picoclaw/main_test.go | 23 +++++++++++++++++++++++
 pkg/agent/hook_mount.go   |  8 ++++++++
 2 files changed, 31 insertions(+)

diff --git a/cmd/picoclaw/main_test.go b/cmd/picoclaw/main_test.go
index c6d53d146..38329c9f3 100644
--- a/cmd/picoclaw/main_test.go
+++ b/cmd/picoclaw/main_test.go
@@ -10,7 +10,9 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/sipeed/picoclaw/cmd/picoclaw/internal"
+	"github.com/sipeed/picoclaw/pkg/agent"
 	"github.com/sipeed/picoclaw/pkg/config"
+	"github.com/sipeed/picoclaw/pkg/security"
 )
 
 func TestNewPicoclawCommand(t *testing.T) {
@@ -61,3 +63,24 @@ func TestNewPicoclawCommand(t *testing.T) {
 		assert.False(t, subcmd.Hidden)
 	}
 }
+
+func TestSecurityShieldRegistration_Regression(t *testing.T) {
+	// Initialize security hooks (registers them in pkg/agent)
+	security.Init()
+
+	expectedHooks := []string{
+		"security_policy",
+		"security_canary",
+		"security_behavior",
+		"security_pii",
+		"security_ipia",
+	}
+
+	for _, name := range expectedHooks {
+		t.Run(name, func(t *testing.T) {
+			assert.True(t, agent.IsBuiltinHookRegistered(name),
+				"Builtin hook %q is not registered. This usually means pkg/security was deleted "+
+					"or security.Init() is no longer called in main().", name)
+		})
+	}
+}
diff --git a/pkg/agent/hook_mount.go b/pkg/agent/hook_mount.go
index dcc2497c6..3dbee9287 100644
--- a/pkg/agent/hook_mount.go
+++ b/pkg/agent/hook_mount.go
@@ -76,6 +76,14 @@ func RegisterBuiltinHook(name string, factory BuiltinHookFactory) error {
 	return nil
 }
 
+// IsBuiltinHookRegistered returns true if a builtin hook factory is registered with the given name.
+func IsBuiltinHookRegistered(name string) bool {
+	builtinHookRegistryMu.RLock()
+	defer builtinHookRegistryMu.RUnlock()
+	_, exists := builtinHookRegistry[name]
+	return exists
+}
+
 func unregisterBuiltinHook(name string) {
 	if name == "" {
 		return