cc-safe-setup 29.7.0 → 30.0.4

package/tests/test-binary-read-detector.sh

@@ -0,0 +1,173 @@
+#!/bin/bash
+# Tests for binary-read-detector.sh
+# Covers: 25 binary extensions detection, advisory mode (exit 0),
+# block mode (exit 2), disable env, custom extension list,
+# multiple-path matching, fail-open on bad input.
+
+HOOK="examples/binary-read-detector.sh"
+PASS=0 FAIL=0
+
+run_hook() {
+    local payload="$1"; shift
+    env -u CC_BINARY_READ_DISABLE -u CC_BINARY_READ_BLOCK \
+        -u CC_BINARY_READ_EXTENSIONS \
+        "$@" bash "$HOOK" <<< "$payload" 2>&1
+}
+
+run_and_capture() {
+    local payload="$1"; shift
+    env -u CC_BINARY_READ_DISABLE -u CC_BINARY_READ_BLOCK \
+        -u CC_BINARY_READ_EXTENSIONS \
+        "$@" bash "$HOOK" <<< "$payload" 2>&1
+    LAST_RC=$?
+}
+
+assert_contains() { if echo "$2" | grep -qF "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -qF "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+# Test 1: empty input — pass through
+run_and_capture '{}'
+assert_exit "empty input pass" "$LAST_RC" "0"
+
+# Test 2: text-only prompt — silent
+run_and_capture '{"prompt":"please run the tests and report"}'
+assert_exit "text prompt pass" "$LAST_RC" "0"
+OUT=$(run_hook '{"prompt":"please run the tests and report"}')
+assert_not_contains "text prompt silent" "$OUT" "Binary path reference"
+
+# Test 3: PNG reference — advisory (exit 0)
+OUT=$(run_hook '{"prompt":"read screenshot.png and describe it"}')
+LAST_RC=$?
+run_and_capture '{"prompt":"read screenshot.png and describe it"}'
+assert_exit "png advisory exit 0" "$LAST_RC" "0"
+assert_contains "png named in advisory" "$OUT" "screenshot.png"
+assert_contains "advisory references #62639" "$OUT" "#62639"
+
+# Test 4: JPG reference
+OUT=$(run_hook '{"prompt":"open foo.jpg and tell me what is shown"}')
+assert_contains "jpg detected" "$OUT" "foo.jpg"
+
+# Test 5: PDF reference
+OUT=$(run_hook '{"prompt":"summarize document.pdf"}')
+assert_contains "pdf detected" "$OUT" "document.pdf"
+
+# Test 6: HEIC reference
+OUT=$(run_hook '{"prompt":"read IMG_1234.heic"}')
+assert_contains "heic detected" "$OUT" "IMG_1234.heic"
+
+# Test 7: WEBP reference
+OUT=$(run_hook '{"prompt":"check image.webp"}')
+assert_contains "webp detected" "$OUT" "image.webp"
+
+# Test 8: GIF reference
+OUT=$(run_hook '{"prompt":"read animation.gif"}')
+assert_contains "gif detected" "$OUT" "animation.gif"
+
+# Test 9: MP4 reference
+OUT=$(run_hook '{"prompt":"analyze video.mp4"}')
+assert_contains "mp4 detected" "$OUT" "video.mp4"
+
+# Test 10: zip reference
+OUT=$(run_hook '{"prompt":"extract archive.zip"}')
+assert_contains "zip detected" "$OUT" "archive.zip"
+
+# Test 11: DOCX reference
+OUT=$(run_hook '{"prompt":"read contract.docx"}')
+assert_contains "docx detected" "$OUT" "contract.docx"
+
+# Test 12: XLSX reference
+OUT=$(run_hook '{"prompt":"open data.xlsx"}')
+assert_contains "xlsx detected" "$OUT" "data.xlsx"
+
+# Test 13: multiple binary paths in same prompt
+OUT=$(run_hook '{"prompt":"compare foo.png with bar.pdf"}')
+assert_contains "first path in multi" "$OUT" "foo.png"
+assert_contains "second path in multi" "$OUT" "bar.pdf"
+
+# Test 14: path with directory
+OUT=$(run_hook '{"prompt":"read ~/Downloads/screenshot.png"}')
+assert_contains "path with home dir" "$OUT" "Downloads/screenshot.png"
+
+# Test 15: absolute path
+OUT=$(run_hook '{"prompt":"read /Users/me/Desktop/foo.png"}')
+assert_contains "absolute path" "$OUT" "Desktop/foo.png"
+
+# Test 16: case-insensitive matching
+OUT=$(run_hook '{"prompt":"open IMAGE.PNG"}')
+assert_contains "uppercase ext detected" "$OUT" "IMAGE.PNG"
+
+# Test 17: mixed case
+OUT=$(run_hook '{"prompt":"read Photo.Jpeg"}')
+assert_contains "mixed case detected" "$OUT" "Photo.Jpeg"
+
+# Test 18: DISABLE env suppresses everything
+run_and_capture '{"prompt":"read foo.png"}' CC_BINARY_READ_DISABLE=1
+assert_exit "disable exit 0" "$LAST_RC" "0"
+OUT=$(run_hook '{"prompt":"read foo.png"}' CC_BINARY_READ_DISABLE=1)
+assert_not_contains "disable silent" "$OUT" "Binary path reference"
+
+# Test 19: BLOCK env changes exit to 2
+run_and_capture '{"prompt":"read foo.png"}' CC_BINARY_READ_BLOCK=1
+assert_exit "block exit 2" "$LAST_RC" "2"
+OUT=$(run_hook '{"prompt":"read foo.png"}' CC_BINARY_READ_BLOCK=1)
+assert_contains "block still emits advisory" "$OUT" "Binary path reference"
+
+# Test 20: custom EXTENSIONS env (only .secret)
+run_and_capture '{"prompt":"read foo.png"}' CC_BINARY_READ_EXTENSIONS=secret
+assert_exit "custom ext png excluded pass" "$LAST_RC" "0"
+OUT=$(run_hook '{"prompt":"read foo.secret"}' CC_BINARY_READ_EXTENSIONS=secret)
+assert_contains "custom ext secret detected" "$OUT" "foo.secret"
+
+# Test 21: malformed JSON — fail-open
+run_and_capture 'not-json'
+assert_exit "malformed input exit 0" "$LAST_RC" "0"
+
+# Test 22: missing prompt field — fail-open
+run_and_capture '{"other":"field"}'
+assert_exit "missing prompt exit 0" "$LAST_RC" "0"
+
+# Test 23: empty prompt — fail-open silent
+run_and_capture '{"prompt":""}'
+assert_exit "empty prompt exit 0" "$LAST_RC" "0"
+OUT=$(run_hook '{"prompt":""}')
+assert_not_contains "empty prompt silent" "$OUT" "Binary path reference"
+
+# Test 24: user_message field as alternative name
+OUT=$(run_hook '{"user_message":"read photo.png"}')
+assert_contains "user_message field works" "$OUT" "photo.png"
+
+# Test 25: advisory mentions PreToolUse bypass
+OUT=$(run_hook '{"prompt":"read foo.png"}')
+assert_contains "advisory names PreToolUse bypass" "$OUT" "PreToolUse hooks will NOT fire"
+
+# Test 26: advisory provides four operator-side options
+OUT=$(run_hook '{"prompt":"read foo.png"}')
+assert_contains "advisory option 1 verify trust" "$OUT" "Verify the file is trusted"
+assert_contains "advisory option 2 pre-process" "$OUT" "Pre-process to text"
+assert_contains "advisory option 3 PostToolUse" "$OUT" "PostToolUse"
+assert_contains "advisory option 4 OS layer" "$OUT" "AppArmor"
+
+# Test 27: advisory mentions disable env
+OUT=$(run_hook '{"prompt":"read foo.png"}')
+assert_contains "advisory mentions disable env" "$OUT" "CC_BINARY_READ_DISABLE=1"
+
+# Test 28: text file (.txt) not detected
+OUT=$(run_hook '{"prompt":"read notes.txt and summarize"}')
+assert_not_contains "txt not detected" "$OUT" "Binary path reference"
+
+# Test 29: source code file (.py, .js) not detected
+OUT=$(run_hook '{"prompt":"read main.py"}')
+assert_not_contains "py not detected" "$OUT" "Binary path reference"
+OUT=$(run_hook '{"prompt":"read app.js"}')
+assert_not_contains "js not detected" "$OUT" "Binary path reference"
+
+# Test 30: bin / exe / dll detected (binaries)
+OUT=$(run_hook '{"prompt":"run firmware.bin"}')
+assert_contains "bin detected" "$OUT" "firmware.bin"
+OUT=$(run_hook '{"prompt":"open setup.exe"}')
+assert_contains "exe detected" "$OUT" "setup.exe"
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" = "0" ] && exit 0 || exit 1

package/tests/test-broad-prefix-session-trap-warner.sh

@@ -0,0 +1,167 @@
+#!/bin/bash
+# Tests for broad-prefix-session-trap-warner.sh (Cluster 6 Axis 8)
+# Covers: default prefix matching across nine prefix categories,
+# silent on non-matching commands, custom pattern override,
+# disable/silent environment toggles, JSON output shape, fail-open.
+
+HOOK="examples/broad-prefix-session-trap-warner.sh"
+PASS=0 FAIL=0
+
+run_hook() {
+    local payload="$1"; shift
+    env -u CC_BROAD_PREFIX_PATTERNS -u CC_BROAD_PREFIX_DISABLE \
+        -u CC_BROAD_PREFIX_SILENT \
+        "$@" bash "$HOOK" <<< "$payload" 2>&1
+}
+
+assert_contains() { if echo "$2" | grep -qF "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -qF "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+# Test 1: empty input — silent, exit 0
+OUT=$(run_hook '{}')
+RC=$?
+assert_exit "empty input exit 0" "$RC" "0"
+assert_not_contains "empty input silent" "$OUT" "broad-prefix"
+
+# Test 2: docker matches the default broad-prefix list
+OUT=$(run_hook '{"tool_input":{"command":"docker ps -a"}}')
+RC=$?
+assert_exit "docker exit 0" "$RC" "0"
+assert_contains "docker warns" "$OUT" "broad-prefix command detected"
+assert_contains "docker references #62437" "$OUT" "#62437"
+assert_contains "docker recommends Approve once" "$OUT" "Approve once"
+assert_contains "docker emits PreToolUse hookSpecificOutput" "$OUT" "PreToolUse"
+
+# Test 3: kubectl matches the default broad-prefix list
+OUT=$(run_hook '{"tool_input":{"command":"kubectl get pods -n kube-system"}}')
+assert_contains "kubectl warns" "$OUT" "broad-prefix command detected"
+assert_contains "kubectl names matched pattern" "$OUT" "kubectl"
+
+# Test 4: gcloud matches the default broad-prefix list
+OUT=$(run_hook '{"tool_input":{"command":"gcloud compute instances list"}}')
+assert_contains "gcloud warns" "$OUT" "broad-prefix command detected"
+
+# Test 5: aws matches the default broad-prefix list
+OUT=$(run_hook '{"tool_input":{"command":"aws s3 ls"}}')
+assert_contains "aws warns" "$OUT" "broad-prefix command detected"
+
+# Test 6: helm matches the default broad-prefix list
+OUT=$(run_hook '{"tool_input":{"command":"helm list"}}')
+assert_contains "helm warns" "$OUT" "broad-prefix command detected"
+
+# Test 7: terraform matches the default broad-prefix list
+OUT=$(run_hook '{"tool_input":{"command":"terraform plan"}}')
+assert_contains "terraform warns" "$OUT" "broad-prefix command detected"
+
+# Test 8: rm -rf matches the default broad-prefix list
+OUT=$(run_hook '{"tool_input":{"command":"rm -rf /tmp/scratch"}}')
+assert_contains "rm -rf warns" "$OUT" "broad-prefix command detected"
+
+# Test 9: rm -Rf (capital R) also matches
+OUT=$(run_hook '{"tool_input":{"command":"rm -Rf /tmp/scratch"}}')
+assert_contains "rm -Rf warns" "$OUT" "broad-prefix command detected"
+
+# Test 10: rm -f without -r still matches the bracket class [rRf]
+OUT=$(run_hook '{"tool_input":{"command":"rm -f /tmp/scratch"}}')
+assert_contains "rm -f warns" "$OUT" "broad-prefix command detected"
+
+# Test 11: dd matches the default broad-prefix list
+OUT=$(run_hook '{"tool_input":{"command":"dd if=/dev/zero of=/tmp/x bs=1M count=10"}}')
+assert_contains "dd warns" "$OUT" "broad-prefix command detected"
+
+# Test 12: mkfs matches the default broad-prefix list
+OUT=$(run_hook '{"tool_input":{"command":"mkfs.ext4 /dev/sdz1"}}')
+assert_contains "mkfs warns" "$OUT" "broad-prefix command detected"
+
+# Test 13: safe command not in broad-prefix list — silent
+OUT=$(run_hook '{"tool_input":{"command":"ls -la /tmp"}}')
+RC=$?
+assert_exit "safe command exit 0" "$RC" "0"
+assert_not_contains "safe command silent" "$OUT" "broad-prefix command detected"
+
+# Test 14: cat is not in the default list — silent
+OUT=$(run_hook '{"tool_input":{"command":"cat /etc/hosts"}}')
+assert_not_contains "cat silent" "$OUT" "broad-prefix command detected"
+
+# Test 15: grep is not in the default list — silent
+OUT=$(run_hook '{"tool_input":{"command":"grep -r foo ."}}')
+assert_not_contains "grep silent" "$OUT" "broad-prefix command detected"
+
+# Test 16: command must START with the prefix (no false positive on docker as substring)
+OUT=$(run_hook '{"tool_input":{"command":"cat ./mydocker.txt"}}')
+# 'docker' appears but pattern is 'docker( |$)' so 'docker.txt' has '.' after — should NOT match
+assert_not_contains "docker as substring not matched" "$OUT" "broad-prefix command detected"
+
+# Test 17: disable env var suppresses everything
+OUT=$(run_hook '{"tool_input":{"command":"docker ps"}}' CC_BROAD_PREFIX_DISABLE=1)
+RC=$?
+assert_exit "disable exit 0" "$RC" "0"
+assert_not_contains "disable silent" "$OUT" "broad-prefix command detected"
+
+# Test 18: silent env var skips JSON but keeps stderr advisory
+OUT=$(run_hook '{"tool_input":{"command":"docker ps"}}' CC_BROAD_PREFIX_SILENT=1)
+assert_contains "silent keeps stderr" "$OUT" "broad-prefix command detected"
+assert_not_contains "silent skips JSON" "$OUT" "hookSpecificOutput"
+
+# Test 19: custom pattern override via env var
+OUT=$(run_hook '{"tool_input":{"command":"sudo something"}}' 'CC_BROAD_PREFIX_PATTERNS=sudo( |$):rsync( |$)')
+assert_contains "custom pattern sudo warns" "$OUT" "broad-prefix command detected"
+
+# Test 20: custom pattern doesn't match default-list command
+OUT=$(run_hook '{"tool_input":{"command":"docker ps"}}' 'CC_BROAD_PREFIX_PATTERNS=sudo( |$):rsync( |$)')
+assert_not_contains "custom pattern excludes docker" "$OUT" "broad-prefix command detected"
+
+# Test 21: malformed JSON input — fail-open (exit 0, no crash)
+OUT=$(run_hook 'not-json')
+RC=$?
+assert_exit "malformed input exit 0" "$RC" "0"
+assert_not_contains "malformed input silent" "$OUT" "broad-prefix command detected"
+
+# Test 22: missing tool_input — fail-open silently
+OUT=$(run_hook '{"other":"field"}')
+RC=$?
+assert_exit "missing tool_input exit 0" "$RC" "0"
+assert_not_contains "missing tool_input silent" "$OUT" "broad-prefix command detected"
+
+# Test 23: command with extra args after broad prefix still matches
+OUT=$(run_hook '{"tool_input":{"command":"docker --host=tcp://example:2375 rm -f $(docker ps -q)"}}')
+assert_contains "docker with --host warns" "$OUT" "broad-prefix command detected"
+
+# Test 24: trap mechanics articulation present in warning
+OUT=$(run_hook '{"tool_input":{"command":"docker ps"}}')
+assert_contains "warning mentions docker rm -f trap example" "$OUT" "docker rm -f"
+assert_contains "warning references meta-issue 30519" "$OUT" "#30519"
+assert_contains "warning references bypass-mode meta 39523" "$OUT" "#39523"
+
+# Test 25: hookSpecificOutput JSON shape — hookEventName is PreToolUse
+OUT=$(run_hook '{"tool_input":{"command":"docker ps"}}')
+assert_contains "JSON output names PreToolUse event" "$OUT" '"hookEventName": "PreToolUse"'
+assert_contains "JSON output has additionalContext" "$OUT" "additionalContext"
+
+# Test 26: warning explicitly recommends 'Approve once' over 'Always'
+OUT=$(run_hook '{"tool_input":{"command":"kubectl delete pod foo"}}')
+assert_contains "warning recommends Approve once" "$OUT" "Approve once"
+assert_contains "warning warns against Always" "$OUT" "Reserve 'Always'"
+
+# Test 27: empty command field — silent
+OUT=$(run_hook '{"tool_input":{"command":""}}')
+RC=$?
+assert_exit "empty command exit 0" "$RC" "0"
+assert_not_contains "empty command silent" "$OUT" "broad-prefix command detected"
+
+# Test 28: compound command starting with broad prefix matches
+OUT=$(run_hook '{"tool_input":{"command":"docker ps && echo done"}}')
+assert_contains "compound docker warns" "$OUT" "broad-prefix command detected"
+
+# Test 29: simulate session-approved cache state still warns (every invocation)
+# Hook fires per-invocation; even if operator already approved-always in a
+# prior session, the hook keeps surfacing the trap in case the env reset.
+OUT1=$(run_hook '{"tool_input":{"command":"docker ps"}}')
+OUT2=$(run_hook '{"tool_input":{"command":"docker rm -f $(docker ps -q)"}}')
+assert_contains "first docker invocation warns" "$OUT1" "broad-prefix command detected"
+assert_contains "second docker invocation also warns" "$OUT2" "broad-prefix command detected"
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" = "0" ] && exit 0 || exit 1

package/tests/test-bulk-delete-target-resolution.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+# bulk-file-delete-guard.sh の両方向の退行検査。
+# 直したのは「対象を数えられない時に通していた」分岐。誤爆を増やしていないかを見る。
+G="$(cd "$(dirname "$0")/.." && pwd)/examples/bulk-file-delete-guard.sh"
+SB="$(mktemp -d)/regprobe"
+
+rm -rf "$SB" 2>/dev/null
+mkdir -p "$SB/many" "$SB/few" "$SB/dir with space"
+for i in $(seq 1 25); do : > "$SB/many/f$i.txt"; done
+for i in 1 2; do : > "$SB/few/f$i.txt"; done
+for i in $(seq 1 25); do : > "$SB/dir with space/f$i.txt"; done
+
+pass=0; fail=0
+check() { # 期待 コマンド 説明
+  local want="$1" C="$2" L="$3"
+  printf '{"tool_name":"Bash","tool_input":{"command":%s}}' "$(printf '%s' "$C" | jq -Rs .)" \
+    | timeout 15 bash "$G" >/dev/null 2>&1
+  local rc=$?; local got="通す"; [ $rc -eq 2 ] && got="止める"
+  if [ "$got" = "$want" ]; then pass=$((pass+1)); printf 'OK   %-6s %s\n' "$got" "$L"
+  else fail=$((fail+1)); printf 'NG★  期待=%-6s 実際=%-6s %s\n' "$want" "$got" "$L"; fi
+}
+
+echo "=== 止めるべき（25個を消す・書き方を変えただけ） ==="
+check 止める "rm -rf $SB/many"                     "素の絶対パス"
+check 止める "rm -rf \"$SB/many\""                 "引用符（二重）"
+check 止める "rm -rf '$SB/many'"                   "引用符（単一）"
+check 止める "rm -rf $SB/many/"                    "末尾スラッシュ"
+check 止める "rm -rf $SB/many/*"                   "グロブで中身"
+check 止める "rm -rf $SB/ma*"                      "部分グロブ"
+check 止める "cd $SB && rm -rf many"               "cd してから相対"
+check 止める "cd \"$SB\" && rm -rf many"           "cd の引数も引用符"
+check 止める "find $SB/many -delete"               "find -delete"
+check 止める "find \"$SB/many\" -type f -exec rm {} +" "find -exec rm（引用符）"
+check 止める "rm -rf \"$SB/dir with space\""       "パスに空白（引用符が必須の形）"
+
+echo
+echo "=== 通すべき（消す数が少ない・対象が無い・別のコマンド） ==="
+check 通す   "rm -rf $SB/few"                      "閾値未満（2個）"
+check 通す   "rm -rf \"$SB/few\""                  "閾値未満・引用符"
+check 通す   "rm -rf /tmp/does-not-exist-$$"       "存在しないパス（警告のみ）"
+check 通す   "rm -f $SB/few/f1.txt"                "-r が無い（対象外）"
+check 通す   "ls -la $SB/many"                     "削除ではない"
+check 通す   "echo 'rm -rf /' > notes.md"          "文章に書いただけ"
+check 通す   "git status"                          "無関係"
+
+echo
+echo "合格 $pass / 不合格 $fail"
+rm -rf "$SB"
+[ $fail -eq 0 ] || exit 1

package/tests/test-bypass-mode-effective-verifier.sh

@@ -0,0 +1,179 @@
+#!/bin/bash
+# Tests for bypass-mode-effective-verifier.sh (Cluster 6 Axis 7)
+# Covers: three bypass-signal detection paths, silent on non-bypass,
+# disable/silent environment toggles, JSON output shape, fail-open.
+
+HOOK="examples/bypass-mode-effective-verifier.sh"
+PASS=0 FAIL=0
+
+run_hook() {
+    # $1 = JSON payload, optional extra env vars trail as $2..$n
+    local payload="$1"; shift
+    # Always clear bypass env vars so each test starts clean. Point the settings read
+    # at /dev/null by default so the runner's real ~/.claude/settings.json can't leak
+    # into the env/hook-input signal tests; tests that exercise Signal 4 pass their own
+    # CC_BYPASS_VERIFIER_SETTINGS=<fixture> in "$@", which overrides this default.
+    env -u CLAUDE_PERMISSION_MODE -u CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS \
+        -u CC_BYPASS_VERIFIER_DISABLE -u CC_BYPASS_VERIFIER_SILENT \
+        CC_BYPASS_VERIFIER_SETTINGS=/dev/null \
+        "$@" bash "$HOOK" <<< "$payload" 2>&1
+}
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+# Test 1: no bypass signal — silent
+OUT=$(run_hook '{}')
+RC=$?
+assert_exit "no bypass exit 0" "$RC" "0"
+assert_not_contains "no bypass no warning" "$OUT" "bypass mode ACTIVE"
+assert_not_contains "no bypass no advisory heading" "$OUT" "bypass-mode-effective-verifier"
+
+# Test 2: hook-input permission_mode = bypassPermissions detected
+OUT=$(run_hook '{"permission_mode":"bypassPermissions"}')
+RC=$?
+assert_exit "hook input bypass exit 0" "$RC" "0"
+assert_contains "hook input bypass warns" "$OUT" "bypass mode ACTIVE"
+assert_contains "hook input bypass names signal source" "$OUT" "hook input permission_mode"
+assert_contains "hook input bypass references #29214" "$OUT" "#29214"
+assert_contains "hook input bypass references #36192" "$OUT" "#36192"
+
+# Test 3: hook-input permissionMode (camelCase variant) also detected
+OUT=$(run_hook '{"permissionMode":"bypassPermissions"}')
+RC=$?
+assert_exit "camelCase exit 0" "$RC" "0"
+assert_contains "camelCase warns" "$OUT" "bypass mode ACTIVE"
+
+# Test 4: env var CLAUDE_PERMISSION_MODE=bypassPermissions detected
+OUT=$(run_hook '{}' CLAUDE_PERMISSION_MODE=bypassPermissions)
+RC=$?
+assert_exit "env CLAUDE_PERMISSION_MODE exit 0" "$RC" "0"
+assert_contains "env CLAUDE_PERMISSION_MODE warns" "$OUT" "bypass mode ACTIVE"
+assert_contains "env CLAUDE_PERMISSION_MODE signal named" "$OUT" "CLAUDE_PERMISSION_MODE=bypassPermissions"
+
+# Test 5: env var CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=1 detected
+OUT=$(run_hook '{}' CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=1)
+RC=$?
+assert_exit "env DANGEROUSLY=1 exit 0" "$RC" "0"
+assert_contains "env DANGEROUSLY=1 warns" "$OUT" "bypass mode ACTIVE"
+assert_contains "env DANGEROUSLY=1 signal named" "$OUT" "CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=1"
+
+# Test 6: env var CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true detected (case variants)
+OUT=$(run_hook '{}' CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true)
+assert_contains "env DANGEROUSLY=true warns" "$OUT" "bypass mode ACTIVE"
+
+OUT=$(run_hook '{}' CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=TRUE)
+assert_contains "env DANGEROUSLY=TRUE warns" "$OUT" "bypass mode ACTIVE"
+
+# Test 7: env var CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=0 does NOT trigger
+OUT=$(run_hook '{}' CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=0)
+RC=$?
+assert_exit "env DANGEROUSLY=0 exit 0" "$RC" "0"
+assert_not_contains "env DANGEROUSLY=0 silent" "$OUT" "bypass mode ACTIVE"
+
+# Test 8: env var CLAUDE_PERMISSION_MODE=default does NOT trigger
+OUT=$(run_hook '{}' CLAUDE_PERMISSION_MODE=default)
+assert_not_contains "env default mode silent" "$OUT" "bypass mode ACTIVE"
+
+OUT=$(run_hook '{}' CLAUDE_PERMISSION_MODE=acceptEdits)
+assert_not_contains "env acceptEdits silent" "$OUT" "bypass mode ACTIVE"
+
+# Test 9: CC_BYPASS_VERIFIER_DISABLE=1 silences even with bypass active
+OUT=$(run_hook '{"permission_mode":"bypassPermissions"}' CC_BYPASS_VERIFIER_DISABLE=1)
+RC=$?
+assert_exit "disabled exit 0" "$RC" "0"
+assert_not_contains "disabled no warning" "$OUT" "bypass mode ACTIVE"
+assert_not_contains "disabled no JSON output" "$OUT" "hookSpecificOutput"
+
+# Test 10: CC_BYPASS_VERIFIER_SILENT=1 skips JSON but keeps stderr advisory
+OUT=$(run_hook '{"permission_mode":"bypassPermissions"}' CC_BYPASS_VERIFIER_SILENT=1)
+RC=$?
+assert_exit "silent exit 0" "$RC" "0"
+assert_contains "silent still emits stderr" "$OUT" "bypass mode ACTIVE"
+assert_not_contains "silent no JSON output" "$OUT" "hookSpecificOutput"
+
+# Test 11: JSON output shape is correct when bypass active and not silent
+OUT=$(run_hook '{"permission_mode":"bypassPermissions"}')
+assert_contains "JSON contains hookSpecificOutput" "$OUT" '"hookSpecificOutput"'
+assert_contains "JSON contains hookEventName" "$OUT" '"hookEventName": "SessionStart"'
+assert_contains "JSON contains additionalContext" "$OUT" '"additionalContext"'
+
+# Test 12: empty input handled gracefully (jq parses {} default)
+OUT=$(run_hook '')
+RC=$?
+assert_exit "empty input exit 0" "$RC" "0"
+assert_not_contains "empty input no warning" "$OUT" "bypass mode ACTIVE"
+
+# Test 13: invalid JSON handled gracefully (no bypass signal extracted)
+OUT=$(run_hook 'not json')
+RC=$?
+assert_exit "invalid JSON exit 0" "$RC" "0"
+assert_not_contains "invalid JSON no warning" "$OUT" "bypass mode ACTIVE"
+
+# Test 14: hook input wins when env says default but JSON says bypass
+OUT=$(run_hook '{"permission_mode":"bypassPermissions"}' CLAUDE_PERMISSION_MODE=default)
+assert_contains "JSON wins over default env" "$OUT" "bypass mode ACTIVE"
+
+# Test 15: multiple signals — first wins (env var, JSON also bypass)
+OUT=$(run_hook '{"permission_mode":"bypassPermissions"}' CLAUDE_PERMISSION_MODE=bypassPermissions)
+assert_contains "multiple signals still warns" "$OUT" "bypass mode ACTIVE"
+
+# Test 16: known broken surfaces are all named in the warning
+OUT=$(run_hook '{"permission_mode":"bypassPermissions"}')
+assert_contains "warning names Edit" "$OUT" "Edit tool"
+assert_contains "warning names Cowork" "$OUT" "Cowork"
+assert_contains "warning names Remote Control" "$OUT" "Remote Control"
+assert_contains "warning names v2.1.77 regression" "$OUT" "v2.1.77"
+assert_contains "warning references meta-issue #39523" "$OUT" "#39523"
+
+# --- Signal 4: settings.json detection (#65848) ---
+FIX_DIR=$(mktemp -d)
+trap 'rm -rf "$FIX_DIR"' EXIT
+
+# Test 17: settings.json defaultMode=bypassPermissions detected (no env/hook signal)
+printf '%s' '{"permissions":{"defaultMode":"bypassPermissions"}}' > "$FIX_DIR/bypass.json"
+OUT=$(run_hook '{}' CC_BYPASS_VERIFIER_SETTINGS="$FIX_DIR/bypass.json")
+RC=$?
+assert_exit "settings defaultMode exit 0" "$RC" "0"
+assert_contains "settings defaultMode warns" "$OUT" "bypass mode ACTIVE"
+assert_contains "settings defaultMode names signal" "$OUT" "settings.json permissions.defaultMode=bypassPermissions"
+
+# Test 18: skipDangerousModePermissionPrompt=true surfaced even when not currently bypass
+printf '%s' '{"skipDangerousModePermissionPrompt":true}' > "$FIX_DIR/skip.json"
+OUT=$(run_hook '{}' CC_BYPASS_VERIFIER_SETTINGS="$FIX_DIR/skip.json")
+RC=$?
+assert_exit "skip-only exit 0" "$RC" "0"
+assert_contains "skip-only warns suppressed" "$OUT" "dangerous-mode warning SUPPRESSED"
+assert_contains "skip-only references #65848" "$OUT" "#65848"
+assert_not_contains "skip-only not labelled active" "$OUT" "bypass mode ACTIVE"
+
+# Test 19: the #65848 repro — both keys set — names active bypass AND the suppressed prompt
+printf '%s' '{"permissions":{"defaultMode":"bypassPermissions"},"skipDangerousModePermissionPrompt":true}' > "$FIX_DIR/both.json"
+OUT=$(run_hook '{}' CC_BYPASS_VERIFIER_SETTINGS="$FIX_DIR/both.json")
+assert_contains "both warns active" "$OUT" "bypass mode ACTIVE"
+assert_contains "both surfaces suppression" "$OUT" "skipDangerousModePermissionPrompt=true"
+assert_contains "both references #65848" "$OUT" "#65848"
+
+# Test 20: benign settings.json (default mode, no skip) stays silent
+printf '%s' '{"permissions":{"defaultMode":"default"}}' > "$FIX_DIR/benign.json"
+OUT=$(run_hook '{}' CC_BYPASS_VERIFIER_SETTINGS="$FIX_DIR/benign.json")
+RC=$?
+assert_exit "benign settings exit 0" "$RC" "0"
+assert_not_contains "benign settings silent" "$OUT" "bypass mode ACTIVE"
+assert_not_contains "benign settings no suppression note" "$OUT" "SUPPRESSED"
+
+# Test 21: missing settings file is fail-open (no crash, silent on no other signal)
+OUT=$(run_hook '{}' CC_BYPASS_VERIFIER_SETTINGS="$FIX_DIR/does-not-exist.json")
+RC=$?
+assert_exit "missing settings exit 0" "$RC" "0"
+assert_not_contains "missing settings silent" "$OUT" "bypass mode ACTIVE"
+
+# Test 22: DISABLE still silences the settings.json path
+OUT=$(run_hook '{}' CC_BYPASS_VERIFIER_SETTINGS="$FIX_DIR/both.json" CC_BYPASS_VERIFIER_DISABLE=1)
+assert_not_contains "disable silences settings path" "$OUT" "bypass mode ACTIVE"
+assert_not_contains "disable silences suppression note" "$OUT" "SUPPRESSED"
+
+echo ""
+echo "Tests: $((PASS+FAIL)) | Passed: $PASS | Failed: $FAIL"
+[ "$FAIL" = "0" ] && exit 0 || exit 1