cc-safe-setup 29.7.0 → 30.0.4

package/tests/test-pre-execution-claim-detector.sh

@@ -0,0 +1,366 @@
+#!/bin/bash
+# Tests for pre-execution-claim-detector.sh
+HOOK="$(dirname "$0")/../examples/pre-execution-claim-detector.sh"
+PASS=0
+FAIL=0
+
+mktempd() {
+  mktemp -d "${TMPDIR:-/tmp}/cc-pre-claim-test.XXXXXX"
+}
+
+run_test() {
+  local desc="$1"
+  local result="$2"
+  if [ "$result" = "pass" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# Helper: create a transcript with the given assistant text
+make_transcript() {
+  local file="$1"
+  local text="$2"
+  local model="${3:-claude-opus-4-8}"
+  # Escape the text for JSON embedding
+  printf '{"type":"user","message":{"content":"hi"}}\n' > "$file"
+  jq -cn --arg t "$text" --arg m "$model" \
+    '{type:"assistant",message:{model:$m,content:[{type:"text",text:$t}]}}' >> "$file"
+}
+
+echo "Testing pre-execution-claim-detector.sh"
+echo "======================================="
+
+# Test 1: opt-in env unset → silent exit, no log
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "the result was: \$891"
+echo "{\"session_id\":\"s1\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" bash "$HOOK" 2>/dev/null
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ ! -f "$LOG" ]; then
+  run_test "opt-in env unset → silent, no log" pass
+else
+  run_test "opt-in env unset → silent, no log" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 2: opt-in but DISABLE=1 → silent
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "the result was: \$891"
+echo "{\"session_id\":\"s2\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" \
+  CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  CC_OPUS48_PRE_CLAIM_DISABLE=1 \
+  bash "$HOOK" 2>/dev/null
+if [ ! -f "$LOG" ]; then
+  run_test "DETECT=1 + DISABLE=1 → silent (disable wins)" pass
+else
+  run_test "DETECT=1 + DISABLE=1 → silent (disable wins)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 3: missing transcript → silent exit
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/log.jsonl"
+echo '{"session_id":"s3","tool_name":"Bash","transcript_path":"/nonexistent/file.jsonl"}' | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 bash "$HOOK" 2>/dev/null
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ ! -f "$LOG" ]; then
+  run_test "missing transcript → silent exit" pass
+else
+  run_test "missing transcript → silent exit" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 4: Pattern 1 (claim-prefix) matches "the result was:"
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+STDERR_FILE="$TEST_DIR/stderr"
+make_transcript "$TRANSCRIPT" "the result was: foo bar"
+echo "{\"session_id\":\"s4\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>"$STDERR_FILE"
+if [ -f "$LOG" ] && grep -q '"pattern":"claim-prefix"' "$LOG" && \
+   grep -q "Cluster 22" "$STDERR_FILE"; then
+  run_test "Pattern 1: 'the result was:' → claim-prefix match" pass
+else
+  run_test "Pattern 1: 'the result was:' → claim-prefix match" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 5: Pattern 1 case-insensitive match
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "The Output Shows: something"
+echo "{\"session_id\":\"s5\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if [ -f "$LOG" ] && grep -q '"pattern":"claim-prefix"' "$LOG"; then
+  run_test "Pattern 1: case-insensitive 'The Output Shows:'" pass
+else
+  run_test "Pattern 1: case-insensitive 'The Output Shows:'" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 6: Pattern 2 (action-then-value): "I confirmed X and Y"
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "I confirmed the deployment and everything looks healthy"
+echo "{\"session_id\":\"s6\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if [ -f "$LOG" ] && grep -q '"pattern":"action-then-value"' "$LOG"; then
+  run_test "Pattern 2: 'I confirmed X and Y' → action-then-value" pass
+else
+  run_test "Pattern 2: 'I confirmed X and Y' → action-then-value" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 7: Pattern 3 (bare price claim, no hedge)
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "The flight costs \$891 per person."
+echo "{\"session_id\":\"s7\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if [ -f "$LOG" ] && grep -q '"pattern":"bare-price-claim"' "$LOG"; then
+  run_test "Pattern 3: bare price '\$891' without hedge → bare-price-claim" pass
+else
+  run_test "Pattern 3: bare price '\$891' without hedge → bare-price-claim" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 8: Pattern 3 suppressed when hedge precedes
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "Let me check the flight prices. I'll search for the \$891 fare to see if it's still available."
+echo "{\"session_id\":\"s8\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if [ ! -f "$LOG" ]; then
+  run_test "Pattern 3 hedge suppresses bare-price ('let me check' preceded \$891)" pass
+else
+  run_test "Pattern 3 hedge suppresses bare-price ('let me check' preceded \$891)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 9: Pattern 4 (bare SHA-like 40 hex chars)
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "The latest commit is a1b2c3d4e5f6789012345678901234567890abcd on main."
+echo "{\"session_id\":\"s9\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if [ -f "$LOG" ] && grep -q '"pattern":"bare-sha-claim"' "$LOG"; then
+  run_test "Pattern 4: bare SHA → bare-sha-claim" pass
+else
+  run_test "Pattern 4: bare SHA → bare-sha-claim" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 10: Pattern 4 suppressed when "let me run" precedes
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "Let me run git log. The SHA might be a1b2c3d4e5f6789012345678901234567890abcd if uncommitted."
+echo "{\"session_id\":\"s10\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if [ ! -f "$LOG" ]; then
+  run_test "Pattern 4 hedge suppresses bare-sha ('let me run' precedes)" pass
+else
+  run_test "Pattern 4 hedge suppresses bare-sha ('let me run' precedes)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 11: Pattern 5 (file-path-then-block) — `path` followed by ``` block
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "The file \`/etc/config.yaml\` contains:
+\`\`\`yaml
+key: value
+\`\`\`"
+echo "{\"session_id\":\"s11\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if [ -f "$LOG" ] && grep -q '"pattern":"file-path-then-block"' "$LOG"; then
+  run_test "Pattern 5: backtick file path + code block → file-path-then-block" pass
+else
+  run_test "Pattern 5: backtick file path + code block → file-path-then-block" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 12: benign assistant text → no match
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "I'll now run the analysis. Let me check the configuration first."
+echo "{\"session_id\":\"s12\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if [ ! -f "$LOG" ]; then
+  run_test "benign text → no match" pass
+else
+  run_test "benign text → no match" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 13: QUIET=1 suppresses entirely
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "the result was: foo"
+echo "{\"session_id\":\"s13\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" \
+  CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  CC_OPUS48_PRE_CLAIM_QUIET=1 \
+  bash "$HOOK" 2>/dev/null
+if [ ! -f "$LOG" ]; then
+  run_test "QUIET=1 → silent (no log)" pass
+else
+  run_test "QUIET=1 → silent (no log)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 14: stderr advisory includes anchor issue #64065
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+STDERR_FILE="$TEST_DIR/stderr"
+make_transcript "$TRANSCRIPT" "the file contains: x"
+echo "{\"session_id\":\"s14\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>"$STDERR_FILE"
+if grep -q "#64065" "$STDERR_FILE"; then
+  run_test "stderr includes anchor #64065" pass
+else
+  run_test "stderr includes anchor #64065" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 15: stderr advisory includes Opus 4.7 fallback
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+STDERR_FILE="$TEST_DIR/stderr"
+make_transcript "$TRANSCRIPT" "the response was: y"
+echo "{\"session_id\":\"s15\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>"$STDERR_FILE"
+if grep -q "claude-opus-4-7" "$STDERR_FILE"; then
+  run_test "stderr includes Opus 4.7 fallback path" pass
+else
+  run_test "stderr includes Opus 4.7 fallback path" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 16: log records model from transcript
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "the result was: q" "claude-opus-4-8"
+echo "{\"session_id\":\"s16\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if grep -q '"model":"claude-opus-4-8"' "$LOG"; then
+  run_test "log records model from transcript" pass
+else
+  run_test "log records model from transcript" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 17: log records tool_name from input
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "the result was: q"
+echo "{\"session_id\":\"s17\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if grep -q '"tool":"Bash"' "$LOG"; then
+  run_test "log records tool name from input" pass
+else
+  run_test "log records tool name from input" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 18: corrupted JSON input → exit 0 quietly
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/log.jsonl"
+echo 'not json {{{' | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ ! -f "$LOG" ]; then
+  run_test "corrupted JSON → exit 0, no log" pass
+else
+  run_test "corrupted JSON → exit 0, no log (exit=$EXIT)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 19: empty transcript → silent
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+touch "$TRANSCRIPT"
+echo "{\"session_id\":\"s19\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ ! -f "$LOG" ]; then
+  run_test "empty transcript → silent" pass
+else
+  run_test "empty transcript → silent" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 20: only-user-message transcript → silent (no assistant text)
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+echo '{"type":"user","message":{"content":"the result was: \$891"}}' > "$TRANSCRIPT"
+echo "{\"session_id\":\"s20\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if [ ! -f "$LOG" ]; then
+  run_test "only-user-message → no match (skip user text)" pass
+else
+  run_test "only-user-message → no match (skip user text)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 21: log includes ISO 8601 UTC timestamp
+TEST_DIR=$(mktempd)
+TRANSCRIPT="$TEST_DIR/t.jsonl"
+LOG="$TEST_DIR/log.jsonl"
+make_transcript "$TRANSCRIPT" "the file was: yes"
+echo "{\"session_id\":\"s21\",\"tool_name\":\"Bash\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_OPUS48_PRE_CLAIM_LOG="$LOG" CC_OPUS48_PRE_CLAIM_DETECT=1 \
+  bash "$HOOK" 2>/dev/null
+if grep -qE '"ts":"[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z"' "$LOG"; then
+  run_test "log includes ISO 8601 UTC timestamp" pass
+else
+  run_test "log includes ISO 8601 UTC timestamp" fail
+fi
+rm -rf "$TEST_DIR"
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+if [ "$FAIL" -gt 0 ]; then
+  exit 1
+fi
+exit 0

package/tests/test-private-key-backup-and-git-credentials.sh

@@ -0,0 +1,100 @@
+#!/bin/bash
+# Tests for two gaps measured on Claude Code 2.1.246 (2026-08-29):
+#   1. sensitive-file-read-guard let id_rsa.bak / id_rsa_old through, because
+#      the private-key pattern was anchored with a bare "$". A backup of a key
+#      is exactly as sensitive as the key.
+#   2. credential-file-cat-guard covered .pypirc and .npmrc but not
+#      .git-credentials, which stores "https://user:token@host" in plain text.
+# Both guards must keep passing the files they were always meant to pass, so
+# the allow cases below are as important as the block cases.
+#
+# Run: bash tests/test-private-key-backup-and-git-credentials.sh
+set -uo pipefail
+
+READ_HOOK="$(dirname "$0")/../examples/sensitive-file-read-guard.sh"
+CAT_HOOK="$(dirname "$0")/../examples/credential-file-cat-guard.sh"
+PASS=0 FAIL=0
+
+run_read() {
+    local desc="$1" expected_exit="$2" path="$3"
+    local actual_exit
+    echo "{\"tool_name\":\"Read\",\"tool_input\":{\"file_path\":\"${path}\"}}" \
+        | bash "$READ_HOOK" >/dev/null 2>/dev/null
+    actual_exit=$?
+    if [ "$actual_exit" -eq "$expected_exit" ]; then
+        echo "  PASS: $desc"; PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc (expected exit $expected_exit, got $actual_exit)"; FAIL=$((FAIL + 1))
+    fi
+}
+
+run_cat() {
+    local desc="$1" expected_exit="$2" cmd="$3"
+    local actual_exit
+    echo "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":${cmd}}}" \
+        | bash "$CAT_HOOK" >/dev/null 2>/dev/null
+    actual_exit=$?
+    if [ "$actual_exit" -eq "$expected_exit" ]; then
+        echo "  PASS: $desc"; PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc (expected exit $expected_exit, got $actual_exit)"; FAIL=$((FAIL + 1))
+    fi
+}
+
+echo "Testing private-key backups and .git-credentials"
+echo "==============================================="
+
+# --- BLOCK: private key backups ---
+run_read "id_rsa.bak blocks"            2 "/home/u/.ssh/id_rsa.bak"
+run_read "id_rsa_old blocks"            2 "/home/u/.ssh/id_rsa_old"
+run_read "id_rsa.orig blocks"           2 "/home/u/.ssh/id_rsa.orig"
+run_read "id_rsa.save blocks"           2 "/home/u/.ssh/id_rsa.save"
+run_read "id_rsa-copy blocks"           2 "/home/u/.ssh/id_rsa-copy"
+run_read "id_ed25519.backup blocks"     2 "/home/u/.ssh/id_ed25519.backup"
+run_read "id_ecdsa.2 blocks"            2 "/home/u/.ssh/id_ecdsa.2"
+
+# --- BLOCK: the three that survived the first widening ---
+# Found by audit/boundary.sh after the first fix looked complete. Each one is
+# the same file to whoever reads it and a different string to the matcher.
+run_read "id_rsa~ (editor backup) blocks" 2 "/home/u/.ssh/id_rsa~"
+run_read "id_rsa.old.2 (two suffixes) blocks" 2 "/home/u/.ssh/id_rsa.old.2"
+run_read "id_rsa with trailing space blocks"  2 "/home/u/.ssh/id_rsa "
+run_read "ID_RSA (uppercased) blocks"     2 "/home/u/.ssh/ID_RSA"
+run_read "id_ed25519~ blocks"             2 "/home/u/.ssh/id_ed25519~"
+# ...and the public key must survive all of that, trailing space included.
+run_read "id_rsa.pub with trailing space allows" 0 "/home/u/.ssh/id_rsa.pub "
+
+# --- BLOCK: the original cases must not regress ---
+run_read "id_rsa still blocks"          2 "/home/u/.ssh/id_rsa"
+run_read "id_ed25519 still blocks"      2 "/home/u/.ssh/id_ed25519"
+run_read "aws credentials still blocks" 2 "/home/u/.aws/credentials"
+
+# --- ALLOW: public keys and everything else must still pass ---
+run_read "id_rsa.pub allows"            0 "/home/u/.ssh/id_rsa.pub"
+run_read "id_ed25519.pub allows"        0 "/home/u/.ssh/id_ed25519.pub"
+run_read "ssh config allows"            0 "/home/u/.ssh/config"
+run_read "known_hosts allows"           0 "/home/u/.ssh/known_hosts"
+run_read "project file allows"          0 "/home/u/app/README.md"
+# A filename that merely starts with a key name is not a key.
+run_read "id_rsa_generator.py allows"   0 "/home/u/tools/id_rsa_generator.py"
+run_read "id_rsa.md allows"             0 "/home/u/docs/id_rsa.md"
+
+# --- BLOCK: .git-credentials ---
+run_cat "cat ~/.git-credentials blocks"  2 '"cat ~/.git-credentials"'
+run_cat "head .git-credentials blocks"   2 '"head -1 /home/u/.git-credentials"'
+run_cat "grep in .git-credentials blocks" 2 '"grep github /home/u/.git-credentials"'
+
+# --- BLOCK: the original cases must not regress ---
+run_cat "cat ~/.npmrc still blocks"      2 '"cat ~/.npmrc"'
+run_cat "cat ~/.netrc still blocks"      2 '"cat ~/.netrc"'
+run_cat "cat ~/.pypirc still blocks"     2 '"cat ~/.pypirc"'
+
+# --- ALLOW: ordinary reads must still pass ---
+run_cat "cat README.md allows"           0 '"cat README.md"'
+run_cat "cat .git/config allows"         0 '"cat .git/config"'
+run_cat "git config --list allows"       0 '"git config --list"'
+
+echo
+echo "=========================="
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/test-proxy-capture-suggester.sh

@@ -0,0 +1,214 @@
+#!/bin/bash
+# Tests for proxy-capture-suggester.sh
+HOOK="$(dirname "$0")/../examples/proxy-capture-suggester.sh"
+PASS=0
+FAIL=0
+
+run_test() {
+  local desc="$1"
+  local result="$2"
+  if [ "$result" = "pass" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# Helper: run hook with a clean env. The caller passes overrides as VAR=value tokens.
+run_hook() {
+  env -i HOME="$HOME" PATH="$PATH" "$@" bash "$HOOK" 2>&1
+}
+
+echo "Testing proxy-capture-suggester.sh"
+echo "===================================="
+
+# Test 1: Default (ENABLE unset) → silent, no advisory
+OUT=$(run_hook)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "ENABLE unset → silent (default off, opt-in only)" pass
+else
+  run_test "ENABLE unset (exit=$EXIT, out_len=${#OUT})" fail
+fi
+
+# Test 2: QUIET=1 silences even when ENABLE=1
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 CC_PROXY_CAPTURE_SUGGESTER_QUIET=1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "QUIET=1 silences even with ENABLE=1" pass
+else
+  run_test "QUIET=1 (exit=$EXIT, out_len=${#OUT})" fail
+fi
+
+# Test 3: ENABLE=1 + no proxy → full four-tool advisory emitted
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && echo "$OUT" | grep -q "Compliance audit intent declared"; then
+  run_test "ENABLE=1, no proxy → full advisory emitted" pass
+else
+  run_test "Full advisory (exit=$EXIT)" fail
+fi
+
+# Test 4: ENABLE=1 + HTTPS_PROXY set + no log dir → short advisory about audit sink
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 HTTPS_PROXY=http://127.0.0.1:8080)
+EXIT=$?
+if [ "$EXIT" = "0" ] && echo "$OUT" | grep -q "ANTHROPIC_LOG_DIR is unset"; then
+  run_test "ENABLE=1 + proxy + no log dir → audit-sink advisory" pass
+else
+  run_test "Audit-sink advisory (exit=$EXIT, OUT excerpt: $(echo "$OUT" | head -1))" fail
+fi
+
+# Test 5: ENABLE=1 + HTTPS_PROXY set + ANTHROPIC_LOG_DIR set → silent
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 HTTPS_PROXY=http://127.0.0.1:8080 ANTHROPIC_LOG_DIR=/tmp/audit)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "ENABLE=1 + proxy + log dir → silent (fully configured)" pass
+else
+  run_test "Fully configured silent (exit=$EXIT, out_len=${#OUT})" fail
+fi
+
+# Test 6: Lowercase https_proxy honored
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 https_proxy=http://127.0.0.1:8080)
+EXIT=$?
+if [ "$EXIT" = "0" ] && echo "$OUT" | grep -q "ANTHROPIC_LOG_DIR is unset"; then
+  run_test "Lowercase https_proxy detected as active" pass
+else
+  run_test "Lowercase https_proxy detection (exit=$EXIT)" fail
+fi
+
+# Test 7: ALL_PROXY honored as a proxy signal
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 ALL_PROXY=http://127.0.0.1:8080)
+EXIT=$?
+if [ "$EXIT" = "0" ] && echo "$OUT" | grep -q "ANTHROPIC_LOG_DIR is unset"; then
+  run_test "ALL_PROXY detected as active" pass
+else
+  run_test "ALL_PROXY detection (exit=$EXIT)" fail
+fi
+
+# Test 8: Empty HTTPS_PROXY does NOT count as active (treated as unset)
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 HTTPS_PROXY=)
+EXIT=$?
+if [ "$EXIT" = "0" ] && echo "$OUT" | grep -q "Compliance audit intent declared"; then
+  run_test "Empty HTTPS_PROXY treated as unset → full advisory" pass
+else
+  run_test "Empty HTTPS_PROXY (exit=$EXIT, OUT excerpt: $(echo "$OUT" | head -1))" fail
+fi
+
+# Test 9: Advisory enumerates four distinct proxy tools
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1)
+if echo "$OUT" | grep -q "mitmproxy" \
+  && echo "$OUT" | grep -qi "burp" \
+  && echo "$OUT" | grep -qi "charles" \
+  && echo "$OUT" | grep -q "ANTHROPIC_LOG"; then
+  run_test "Advisory enumerates four audit paths" pass
+else
+  run_test "Four-tool enumeration (mitm=$(echo "$OUT" | grep -c mitmproxy), burp=$(echo "$OUT" | grep -ci burp))" fail
+fi
+
+# Test 10: Advisory includes a concrete HTTPS_PROXY bridge command
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1)
+if echo "$OUT" | grep -q "export HTTPS_PROXY="; then
+  run_test "Advisory shows concrete HTTPS_PROXY bridge command" pass
+else
+  run_test "HTTPS_PROXY bridge command" fail
+fi
+
+# Test 11: Advisory references the v2.1.150 cluster issue (#62061)
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1)
+if echo "$OUT" | grep -q "62061"; then
+  run_test "Advisory references upstream cluster issue #62061" pass
+else
+  run_test "Issue #62061 reference" fail
+fi
+
+# Test 12: Advisory mentions partner hooks for cluster coverage
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1)
+if echo "$OUT" | grep -q "cache-residue-detector" \
+  && echo "$OUT" | grep -q "server-side-prompt-injection-detector"; then
+  run_test "Advisory names both partner hooks (cache-residue + server-side detector)" pass
+else
+  run_test "Partner hook references" fail
+fi
+
+# Test 13: Advisory tells the user how to suppress via QUIET=1
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1)
+if echo "$OUT" | grep -q "CC_PROXY_CAPTURE_SUGGESTER_QUIET"; then
+  run_test "Advisory tells user how to suppress via QUIET=1" pass
+else
+  run_test "QUIET suppression instruction" fail
+fi
+
+# Test 14: ENABLE=0 explicitly → silent (treats non-1 values as off)
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=0)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "ENABLE=0 → silent (only ENABLE=1 opts in)" pass
+else
+  run_test "ENABLE=0 silences (exit=$EXIT, out_len=${#OUT})" fail
+fi
+
+# Test 15: ENABLE=true (non-1) → silent (strict ENABLE=1 gate)
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=true)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "ENABLE=true → silent (strict ENABLE=1 only)" pass
+else
+  run_test "ENABLE=true silences (exit=$EXIT, out_len=${#OUT})" fail
+fi
+
+# Test 16: Hook never blocks the session — all paths exit 0
+EXIT_CODES=""
+for case in "default" "quiet" "enable-no-proxy" "enable-proxy" "enable-proxy-log" "lowercase" "all-proxy" "empty-proxy" "enable-zero" "enable-true"; do
+  case "$case" in
+    "default") OUT=$(run_hook); EXIT=$? ;;
+    "quiet") OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 CC_PROXY_CAPTURE_SUGGESTER_QUIET=1); EXIT=$? ;;
+    "enable-no-proxy") OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1); EXIT=$? ;;
+    "enable-proxy") OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 HTTPS_PROXY=http://127.0.0.1:8080); EXIT=$? ;;
+    "enable-proxy-log") OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 HTTPS_PROXY=http://127.0.0.1:8080 ANTHROPIC_LOG_DIR=/tmp/x); EXIT=$? ;;
+    "lowercase") OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 https_proxy=http://x); EXIT=$? ;;
+    "all-proxy") OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 ALL_PROXY=http://x); EXIT=$? ;;
+    "empty-proxy") OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 HTTPS_PROXY=); EXIT=$? ;;
+    "enable-zero") OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=0); EXIT=$? ;;
+    "enable-true") OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=true); EXIT=$? ;;
+  esac
+  EXIT_CODES="$EXIT_CODES $EXIT"
+done
+NONZERO=$(echo "$EXIT_CODES" | tr ' ' '\n' | grep -v "^$" | grep -v "^0$" | head -1)
+if [ -z "$NONZERO" ]; then
+  run_test "Hook never blocks (all 10 paths exit 0)" pass
+else
+  run_test "Hook never blocks (exit codes: $EXIT_CODES)" fail
+fi
+
+# Test 17: Idempotent — two invocations with same env produce identical output
+OUT1=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1)
+OUT2=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1)
+if [ "$OUT1" = "$OUT2" ]; then
+  run_test "Idempotent: two invocations produce identical output" pass
+else
+  run_test "Idempotent output" fail
+fi
+
+# Test 18: Audit-sink advisory includes concrete ANTHROPIC_LOG_DIR export command
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 HTTPS_PROXY=http://127.0.0.1:8080)
+if echo "$OUT" | grep -q 'export ANTHROPIC_LOG_DIR='; then
+  run_test "Audit-sink advisory has concrete export command" pass
+else
+  run_test "Audit-sink export command" fail
+fi
+
+# Test 19: Audit-sink advisory mentions all three GUI tools' save mechanisms
+OUT=$(run_hook CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 HTTPS_PROXY=http://127.0.0.1:8080)
+if echo "$OUT" | grep -q "save-stream-file" \
+  && echo "$OUT" | grep -qi "burp" \
+  && echo "$OUT" | grep -qi "charles"; then
+  run_test "Audit-sink advisory enumerates three save mechanisms" pass
+else
+  run_test "Save mechanism enumeration" fail
+fi
+
+echo "===================================="
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" = "0" ] && exit 0 || exit 1