cc-safe-setup 29.7.0 → 30.0.4

package/tests/test-same-correction-arrest.sh

@@ -0,0 +1,165 @@
+#!/bin/bash
+# Tests for same-correction-arrest.sh
+#
+# Verifies the hook behavior from issue #60506:
+#   - Increments counter on correction-pattern messages.
+#   - Emits warning while under threshold.
+#   - Emits hard arrest reminder at threshold.
+#   - Re-emits arrest reminder on every subsequent message until plan exists.
+#   - Clears arrest when plan file is created.
+#   - Ignores non-correction messages.
+
+set -uo pipefail
+
+HOOK="$(dirname "$0")/../examples/same-correction-arrest.sh"
+PASS=0
+FAIL=0
+STATE_DIR="/tmp/cc-correction-arrest-test-$$"
+PLAN_DIR="/tmp/cc-correction-arrest-test-$$/plans"
+SESSION_ID="test-$$"
+COUNT_FILE="$STATE_DIR/${SESSION_ID}.count"
+ARREST_FILE="$STATE_DIR/${SESSION_ID}.arrested"
+
+setup() {
+    rm -rf "$STATE_DIR" 2>/dev/null || true
+    mkdir -p "$STATE_DIR" "$PLAN_DIR"
+}
+
+run_hook() {
+    local msg="$1"
+    local threshold="${2:-3}"
+    local input
+    input=$(jq -nc \
+        --arg sid "$SESSION_ID" \
+        --arg msg "$msg" \
+        '{session_id: $sid, prompt: $msg}')
+    printf '%s' "$input" \
+        | CC_CORRECTION_ARREST_THRESHOLD="$threshold" \
+          CC_CORRECTION_ARREST_STATE_DIR="$STATE_DIR" \
+          CC_CORRECTION_ARREST_PLAN_DIR="$PLAN_DIR" \
+          bash "$HOOK" 2>&1 || true
+}
+
+assert_pass() { echo "  PASS: $1"; PASS=$((PASS + 1)); }
+assert_fail() { echo "  FAIL: $1"; FAIL=$((FAIL + 1)); }
+
+echo "=== same-correction-arrest.sh tests ==="
+
+# --- Test 1: non-correction message is ignored ---
+setup
+output=$(run_hook "let's add a new feature" 3)
+count=$(cat "$COUNT_FILE" 2>/dev/null || echo 0)
+if [ "$count" = "0" ] && ! echo "$output" | grep -q "Correction pattern"; then
+    assert_pass "non-correction message does not increment or warn"
+else
+    assert_fail "non-correction should be a no-op (count=$count, output=$output)"
+fi
+
+# --- Test 2: correction message increments counter ---
+setup
+run_hook "we are going backwards" 3 >/dev/null
+count=$(cat "$COUNT_FILE" 2>/dev/null || echo 0)
+if [ "$count" = "1" ]; then
+    assert_pass "first correction increments counter to 1"
+else
+    assert_fail "expected count=1, got count=$count"
+fi
+
+# --- Test 3: pre-threshold warning shown ---
+setup
+output=$(run_hook "we are going backwards" 3)
+if echo "$output" | grep -q "Correction pattern detected (1 of 3"; then
+    assert_pass "pre-threshold warning identifies count and threshold"
+else
+    assert_fail "expected pre-threshold warning, got: $output"
+fi
+
+# --- Test 4: arrest fires at threshold ---
+setup
+run_hook "going backwards" 3 >/dev/null
+run_hook "same mistake again" 3 >/dev/null
+output=$(run_hook "i told you to stop doing this" 3)
+if echo "$output" | grep -q "DRIFT ARREST" && [ -f "$ARREST_FILE" ]; then
+    assert_pass "third correction fires arrest and writes marker"
+else
+    assert_fail "expected DRIFT ARREST + marker file (output=$output, marker=$([ -f "$ARREST_FILE" ] && echo yes || echo no))"
+fi
+
+# --- Test 5: arrest reminder persists on subsequent messages ---
+setup
+run_hook "going backwards" 1 >/dev/null   # threshold=1 → arrest immediately
+output=$(run_hook "any unrelated follow-up message" 1)
+if echo "$output" | grep -q "DRIFT ARREST STILL ACTIVE"; then
+    assert_pass "arrest reminder re-emitted on next message until plan exists"
+else
+    assert_fail "expected persistent arrest reminder, got: $output"
+fi
+
+# --- Test 6: arrest clears when plan file is written ---
+setup
+run_hook "going backwards" 1 >/dev/null   # arrest
+# Write the plan file
+mkdir -p "$PLAN_DIR"
+echo "# Drift arrest plan" > "$PLAN_DIR/drift-arrest-$SESSION_ID.md"
+output=$(run_hook "ok, plan written, continuing" 1)
+if echo "$output" | grep -q "Drift arrest cleared" && [ ! -f "$ARREST_FILE" ]; then
+    assert_pass "arrest cleared by presence of plan file"
+else
+    assert_fail "expected arrest cleared, got output=$output marker_exists=$([ -f "$ARREST_FILE" ] && echo yes || echo no)"
+fi
+
+# --- Test 7: arrest references issue numbers in reminder ---
+setup
+output=$(run_hook "stop doing the same mistake going backwards" 1)
+if echo "$output" | grep -q "#60506" && echo "$output" | grep -q "#60226"; then
+    assert_pass "arrest reminder cites #60506 and #60226 for grounding"
+else
+    assert_fail "expected references to #60506 and #60226 (got: $output)"
+fi
+
+# --- Test 8: missing user message is a silent no-op ---
+setup
+input='{"session_id":"'"$SESSION_ID"'"}'
+output=$(printf '%s' "$input" \
+    | CC_CORRECTION_ARREST_STATE_DIR="$STATE_DIR" \
+      CC_CORRECTION_ARREST_PLAN_DIR="$PLAN_DIR" \
+      bash "$HOOK" 2>&1 || true)
+count=$(cat "$COUNT_FILE" 2>/dev/null || echo 0)
+if [ "$count" = "0" ] && [ -z "$output" ]; then
+    assert_pass "missing user message is a silent no-op"
+else
+    assert_fail "expected silent no-op, got count=$count output=$output"
+fi
+
+# --- Test 9: missing session_id uses default and still works ---
+setup
+input='{"prompt":"going backwards"}'
+output=$(printf '%s' "$input" \
+    | CC_CORRECTION_ARREST_THRESHOLD=1 \
+      CC_CORRECTION_ARREST_STATE_DIR="$STATE_DIR" \
+      CC_CORRECTION_ARREST_PLAN_DIR="$PLAN_DIR" \
+      bash "$HOOK" 2>&1 || true)
+if echo "$output" | grep -q "DRIFT ARREST"; then
+    assert_pass "missing session_id falls back to default session"
+else
+    assert_fail "expected DRIFT ARREST with default session, got: $output"
+fi
+
+# --- Test 10: counter resets between fresh state dirs (session isolation) ---
+setup
+run_hook "going backwards" 3 >/dev/null
+count_a=$(cat "$COUNT_FILE" 2>/dev/null || echo 0)
+setup   # wipe state
+count_b=$(cat "$COUNT_FILE" 2>/dev/null || echo 0)
+if [ "$count_a" = "1" ] && [ "$count_b" = "0" ]; then
+    assert_pass "state is per-state-dir (isolation works)"
+else
+    assert_fail "expected count_a=1, count_b=0 (got $count_a, $count_b)"
+fi
+
+# Cleanup
+rm -rf "$STATE_DIR" 2>/dev/null || true
+
+echo
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/tests/test-scope-expansion-receipt.sh

@@ -0,0 +1,207 @@
+#!/bin/bash
+# Tests for scope-expansion-receipt.sh
+# Issue: anthropics/claude-code#61102 (Awis13 cache-expansion incident)
+# Principle: Keesan12 — "subagent output is evidence, not authorization"
+
+HOOK="examples/scope-expansion-receipt.sh"
+PASS=0 FAIL=0
+
+# Isolate receipts to a temp directory
+TMPDIR_RECEIPTS=$(mktemp -d)
+export CC_RECEIPT_DIR="$TMPDIR_RECEIPTS"
+trap "rm -rf $TMPDIR_RECEIPTS" EXIT
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3' in output)"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3' in output)"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+reset_receipts() { rm -f "$CC_RECEIPT_DIR"/*.jsonl 2>/dev/null; }
+
+# ----------------------------------------------------------------
+# Group 1: Non-destructive commands silently pass
+# ----------------------------------------------------------------
+
+# Test 1: ls is not destructive
+reset_receipts
+OUT=$(echo '{"tool_input":{"command":"ls -la /tmp"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "non-destructive ls exit 0" "$RC" "0"
+assert_not_contains "non-destructive ls no output" "$OUT" "BLOCKED"
+
+# Test 2: Empty command silently passes
+OUT=$(echo '{"tool_input":{"command":""}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "empty command exit 0" "$RC" "0"
+
+# Test 3: cat is not destructive
+OUT=$(echo '{"tool_input":{"command":"cat /etc/passwd"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "cat exit 0" "$RC" "0"
+
+# ----------------------------------------------------------------
+# Group 2: Destructive verbs detected, receipt written (no scopes set)
+# ----------------------------------------------------------------
+
+# Test 4: rm -rf detected, receipt written, exit 0 (no scopes)
+reset_receipts
+unset CC_RECEIPT_SCOPES
+OUT=$(echo '{"tool_input":{"command":"rm -rf /tmp/some-test-target"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "rm -rf no scopes exit 0" "$RC" "0"
+RECEIPT_COUNT=$(ls "$CC_RECEIPT_DIR"/*.jsonl 2>/dev/null | wc -l)
+if [ "$RECEIPT_COUNT" = "1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: receipt count expected 1, got $RECEIPT_COUNT"; fi
+RECEIPT_BODY=$(cat "$CC_RECEIPT_DIR"/*.jsonl 2>/dev/null)
+assert_contains "receipt has decision execute" "$RECEIPT_BODY" '"decision":"execute"'
+assert_contains "receipt has path" "$RECEIPT_BODY" "/tmp/some-test-target"
+
+# Test 5: find -delete detected
+reset_receipts
+OUT=$(echo '{"tool_input":{"command":"find /tmp/target -name \"*.tmp\" -delete"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "find -delete exit 0" "$RC" "0"
+RECEIPT_BODY=$(cat "$CC_RECEIPT_DIR"/*.jsonl 2>/dev/null)
+assert_contains "find -delete receipt written" "$RECEIPT_BODY" "find"
+
+# Test 6: npm cache clean detected
+reset_receipts
+OUT=$(echo '{"tool_input":{"command":"npm cache clean --force"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "npm cache clean exit 0" "$RC" "0"
+RECEIPT_BODY=$(cat "$CC_RECEIPT_DIR"/*.jsonl 2>/dev/null)
+assert_contains "npm cache clean receipt" "$RECEIPT_BODY" "npm cache clean"
+
+# Test 7: pnpm store prune detected
+reset_receipts
+OUT=$(echo '{"tool_input":{"command":"pnpm store prune"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "pnpm store prune exit 0" "$RC" "0"
+
+# Test 8: npx rimraf detected
+reset_receipts
+OUT=$(echo '{"tool_input":{"command":"npx rimraf /tmp/node_modules"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "npx rimraf exit 0" "$RC" "0"
+
+# ----------------------------------------------------------------
+# Group 3: Scope-based refuse logic
+# ----------------------------------------------------------------
+
+# Test 9: Path in declared scope -> execute
+reset_receipts
+export CC_RECEIPT_SCOPES='{"cache":["/tmp/Library/Caches","/tmp/npm-cache"]}'
+OUT=$(echo '{"tool_input":{"command":"rm -rf /tmp/Library/Caches/com.example"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "path in scope exit 0" "$RC" "0"
+RECEIPT_BODY=$(cat "$CC_RECEIPT_DIR"/*.jsonl 2>/dev/null)
+assert_contains "in-scope receipt has scope_match" "$RECEIPT_BODY" '"scope_match":"cache"'
+assert_contains "in-scope receipt has decision execute" "$RECEIPT_BODY" '"decision":"execute"'
+
+# Test 10: Path outside declared scope -> refuse (exit 2)
+reset_receipts
+export CC_RECEIPT_SCOPES='{"cache":["/tmp/Library/Caches"]}'
+OUT=$(echo '{"tool_input":{"command":"rm -rf /tmp/node_modules"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "out-of-scope exit 2" "$RC" "2"
+assert_contains "out-of-scope error message" "$OUT" "BLOCKED"
+assert_contains "out-of-scope cites principle" "$OUT" "evidence, not authorization"
+assert_contains "out-of-scope cites issue" "$OUT" "61102"
+RECEIPT_BODY=$(cat "$CC_RECEIPT_DIR"/*.jsonl 2>/dev/null)
+assert_contains "refuse receipt has scope_match null" "$RECEIPT_BODY" '"scope_match":null'
+assert_contains "refuse receipt has decision refuse" "$RECEIPT_BODY" '"decision":"refuse"'
+
+# Test 11: Awis13 case - cache scope set, node_modules wipe refused
+reset_receipts
+export CC_RECEIPT_SCOPES='{"cache":["/tmp/Library/Caches","/tmp/.npm/_cacache"],"simulator":["/tmp/Library/Developer/CoreSimulator"]}'
+OUT=$(echo '{"tool_input":{"command":"rm -rf /tmp/myproject/node_modules"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "Awis13 node_modules wipe refused" "$RC" "2"
+assert_contains "Awis13 refuse message" "$OUT" "BLOCKED"
+
+# Test 12: Awis13 case - actual cache delete allowed
+reset_receipts
+OUT=$(echo '{"tool_input":{"command":"rm -rf /tmp/Library/Caches/com.apple.example"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "Awis13 cache delete allowed" "$RC" "0"
+
+# Test 13: Bypass mode skips refuse, records bypass
+reset_receipts
+export CC_RECEIPT_SCOPES='{"cache":["/tmp/Library/Caches"]}'
+export CC_RECEIPT_BYPASS=1
+OUT=$(echo '{"tool_input":{"command":"rm -rf /tmp/intentionally-not-in-scope"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "bypass mode exit 0" "$RC" "0"
+RECEIPT_BODY=$(cat "$CC_RECEIPT_DIR"/*.jsonl 2>/dev/null)
+assert_contains "bypass receipt records execute-bypassed" "$RECEIPT_BODY" '"decision":"execute-bypassed"'
+unset CC_RECEIPT_BYPASS
+
+# Test 14: Multiple paths - any out-of-scope causes refuse
+reset_receipts
+export CC_RECEIPT_SCOPES='{"cache":["/tmp/Library/Caches"]}'
+OUT=$(echo '{"tool_input":{"command":"rm -rf /tmp/Library/Caches/a /tmp/node_modules"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "mixed paths one out-of-scope -> refuse" "$RC" "2"
+
+# Test 15: Multiple paths all in scope - execute
+reset_receipts
+OUT=$(echo '{"tool_input":{"command":"rm -rf /tmp/Library/Caches/a /tmp/Library/Caches/b"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "multiple in-scope paths -> execute" "$RC" "0"
+
+# ----------------------------------------------------------------
+# Group 4: Receipt format integrity
+# ----------------------------------------------------------------
+
+# Test 16: Receipt is valid JSONL (one JSON object per line)
+reset_receipts
+unset CC_RECEIPT_SCOPES
+echo '{"tool_input":{"command":"rm -rf /tmp/test1"}}' | bash "$HOOK" 2>&1 >/dev/null
+echo '{"tool_input":{"command":"rm -rf /tmp/test2"}}' | bash "$HOOK" 2>&1 >/dev/null
+LINE_COUNT=$(wc -l < "$CC_RECEIPT_DIR"/*.jsonl 2>/dev/null)
+if [ "$LINE_COUNT" = "2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: receipt JSONL line count expected 2, got $LINE_COUNT"; fi
+# Each line should parse as valid JSON
+while IFS= read -r line; do
+    if echo "$line" | jq . >/dev/null 2>&1; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: invalid JSON line: $line"; fi
+done < "$CC_RECEIPT_DIR"/*.jsonl
+
+# Test 17: Receipt has required 5 fields
+reset_receipts
+echo '{"tool_input":{"command":"rm -rf /tmp/test"}}' | bash "$HOOK" 2>&1 >/dev/null
+RECEIPT_LINE=$(cat "$CC_RECEIPT_DIR"/*.jsonl | head -1)
+for field in ts command paths scope_match decision; do
+    if echo "$RECEIPT_LINE" | jq -e "has(\"$field\")" >/dev/null 2>&1; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: receipt missing field: $field"; fi
+done
+
+# Test 18: Timestamp is ISO 8601 with Z
+TS=$(echo "$RECEIPT_LINE" | jq -r '.ts')
+if echo "$TS" | grep -qE '^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$'; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: ts not ISO 8601 UTC: $TS"; fi
+
+# ----------------------------------------------------------------
+# Group 5: Edge cases
+# ----------------------------------------------------------------
+
+# Test 19: rm -fR (different flag order) detected
+reset_receipts
+unset CC_RECEIPT_SCOPES
+OUT=$(echo '{"tool_input":{"command":"rm -fR /tmp/test"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "rm -fR detected" "$RC" "0"
+if [ -f "$CC_RECEIPT_DIR/destructive-$(date +%Y-%m-%d).jsonl" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: rm -fR receipt not written"; fi
+
+# Test 20: rm -r (no f) is not matched (we only flag combined recursive+force as destructive)
+# Actually our pattern matches any r/R/f/F combo, so rm -r WOULD match. Adjust test.
+reset_receipts
+OUT=$(echo '{"tool_input":{"command":"rm -r /tmp/test"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "rm -r is destructive" "$RC" "0"
+
+# Test 21: bare rm without flags is NOT matched (single file deletion is intentional)
+reset_receipts
+OUT=$(echo '{"tool_input":{"command":"rm /tmp/single-file.txt"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "rm without recursive flag not matched" "$RC" "0"
+RECEIPT_FILE="$CC_RECEIPT_DIR/destructive-$(date +%Y-%m-%d).jsonl"
+if [ ! -f "$RECEIPT_FILE" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: bare rm should not have written receipt"; fi
+
+echo ""
+echo "scope-expansion-receipt.sh: $PASS pass, $FAIL fail"
+[ "$FAIL" = "0" ]

package/tests/test-server-side-prompt-injection-detector.sh

@@ -0,0 +1,181 @@
+#!/bin/bash
+# Tests for server-side-prompt-injection-detector.sh
+HOOK="$(dirname "$0")/../examples/server-side-prompt-injection-detector.sh"
+PASS=0
+FAIL=0
+
+run_test() {
+  local desc="$1"
+  local result="$2"
+  if [ "$result" = "pass" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+echo "Testing server-side-prompt-injection-detector.sh"
+echo "================================================"
+
+# Test 1: both env vars set to 1 → silent exit 0
+OUT=$(CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 DISABLE_GROWTHBOOK=1 \
+  bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "both opt-outs set → silent exit 0" pass
+else
+  run_test "both opt-outs set → silent exit 0 (exit=$EXIT, out_len=${#OUT})" fail
+fi
+
+# Test 2: CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC missing → warning lists only it in Missing line
+OUT=$(unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC; DISABLE_GROWTHBOOK=1 \
+  bash "$HOOK" 2>&1)
+EXIT=$?
+MISSING_LINE=$(echo "$OUT" | grep "Missing opt-out env var")
+if [ "$EXIT" = "0" ] && echo "$MISSING_LINE" | grep -q "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC" \
+    && ! echo "$MISSING_LINE" | grep -q "DISABLE_GROWTHBOOK"; then
+  run_test "only CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC missing → Missing line lists only it" pass
+else
+  run_test "only CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC missing (Missing line: $MISSING_LINE)" fail
+fi
+
+# Test 3: DISABLE_GROWTHBOOK missing → warning mentions it
+OUT=$(CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1; unset DISABLE_GROWTHBOOK; \
+  CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && echo "$OUT" | grep -q "DISABLE_GROWTHBOOK"; then
+  run_test "only DISABLE_GROWTHBOOK missing → warning lists it" pass
+else
+  run_test "only DISABLE_GROWTHBOOK missing (got: $OUT)" fail
+fi
+
+# Test 4: both missing → warning lists both
+OUT=$(unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC; unset DISABLE_GROWTHBOOK; \
+  bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] \
+    && echo "$OUT" | grep -q "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC" \
+    && echo "$OUT" | grep -q "DISABLE_GROWTHBOOK"; then
+  run_test "both missing → warning lists both vars" pass
+else
+  run_test "both missing → warning lists both vars (got: $OUT)" fail
+fi
+
+# Test 5: CC_PROMPT_INJECTION_DETECTOR_QUIET=1 silences regardless of opt-outs
+OUT=$(unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC; unset DISABLE_GROWTHBOOK; \
+  CC_PROMPT_INJECTION_DETECTOR_QUIET=1 bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "QUIET=1 silences warning even when opt-outs missing" pass
+else
+  run_test "QUIET=1 silences warning (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 6: opt-outs set to "0" → treated as unset (warns)
+OUT=$(CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=0 DISABLE_GROWTHBOOK=0 \
+  bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC" \
+    && echo "$OUT" | grep -q "DISABLE_GROWTHBOOK"; then
+  run_test "values of 0 treated as not opted-out → warning" pass
+else
+  run_test "values of 0 treated as not opted-out (got: $OUT)" fail
+fi
+
+# Test 7: opt-outs set to "yes" → treated as unset (only "1" counts)
+OUT=$(CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=yes DISABLE_GROWTHBOOK=yes \
+  bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"; then
+  run_test "non-1 values treated as not opted-out → warning" pass
+else
+  run_test "non-1 values treated as not opted-out (got: $OUT)" fail
+fi
+
+# Test 8: warning includes issue reference #62061
+OUT=$(unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC; unset DISABLE_GROWTHBOOK; \
+  bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "#62061"; then
+  run_test "warning includes issue reference #62061" pass
+else
+  run_test "warning includes issue reference (got: $OUT)" fail
+fi
+
+# Test 9: warning includes opt-out instruction
+OUT=$(unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC; unset DISABLE_GROWTHBOOK; \
+  bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1"; then
+  run_test "warning includes export command for opt-out" pass
+else
+  run_test "warning includes export command (got: $OUT)" fail
+fi
+
+# Test 10: warning includes QUIET acknowledgment path
+OUT=$(unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC; unset DISABLE_GROWTHBOOK; \
+  bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "CC_PROMPT_INJECTION_DETECTOR_QUIET"; then
+  run_test "warning mentions QUIET env var to silence" pass
+else
+  run_test "warning mentions QUIET env var (got: $OUT)" fail
+fi
+
+# Test 11: exit code is always 0 (non-blocking)
+EXITS=()
+for env_args in \
+    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 DISABLE_GROWTHBOOK=1" \
+    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1" \
+    "DISABLE_GROWTHBOOK=1" \
+    "CC_PROMPT_INJECTION_DETECTOR_QUIET=1" \
+    ""; do
+  eval "env -i $env_args bash \"$HOOK\" >/dev/null 2>&1"
+  EXITS+=("$?")
+done
+ALL_ZERO=1
+for e in "${EXITS[@]}"; do
+  [ "$e" != "0" ] && ALL_ZERO=0
+done
+if [ "$ALL_ZERO" = "1" ]; then
+  run_test "exit code 0 in all 5 env configurations (non-blocking)" pass
+else
+  run_test "exit code 0 in all configs (got: ${EXITS[*]})" fail
+fi
+
+# Test 12: output goes to stderr, not stdout
+STDOUT=$(unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC; unset DISABLE_GROWTHBOOK; \
+  bash "$HOOK" 2>/dev/null)
+if [ -z "$STDOUT" ]; then
+  run_test "warning written to stderr, stdout is empty" pass
+else
+  run_test "warning to stderr (stdout was: $STDOUT)" fail
+fi
+
+# Test 13: warning includes "ADVISORY" prefix (not "BLOCKED")
+OUT=$(unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC; unset DISABLE_GROWTHBOOK; \
+  bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "^ADVISORY"; then
+  run_test "uses ADVISORY (non-blocking) prefix" pass
+else
+  run_test "uses ADVISORY prefix (got: $OUT)" fail
+fi
+
+# Test 14: warning mentions tengu_heron_brook flag name (audit-trail evidence)
+OUT=$(unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC; unset DISABLE_GROWTHBOOK; \
+  bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "tengu_heron_brook"; then
+  run_test "warning names the GrowthBook flag (tengu_heron_brook)" pass
+else
+  run_test "warning names the GrowthBook flag (got: $OUT)" fail
+fi
+
+# Test 15: warning mentions client_data field (bootstrap injection path)
+OUT=$(unset CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC; unset DISABLE_GROWTHBOOK; \
+  bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "client_data"; then
+  run_test "warning names client_data bootstrap field" pass
+else
+  run_test "warning names client_data (got: $OUT)" fail
+fi
+
+echo
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" = "0" ]