cc-safe-setup 29.7.0 → 30.0.4

package/tests/git-global-options-bypass.test.sh

@@ -0,0 +1,141 @@
+#!/bin/bash
+# The three git guards never saw `git -C <path> <verb>`
+#
+# git accepts its own options between the program name and the verb:
+#
+#   git -C /repo push --force
+#   git -c core.pager=cat reset --hard
+#   git --git-dir=/repo/.git clean -fd
+#
+# All three do exactly what the unprefixed form does. Every git pattern in
+# branch-guard, secret-guard and destructive-guard expected the verb to sit
+# directly after the word `git`, so all three hooks exited 0 -- which is an
+# affirmative approval, not a shrug.
+#
+# Measured 2026-09-03 against the shipped copies: 10 bypasses.
+#   branch-guard      git -C push to a protected branch, git -C force push,
+#                     --git-dir force push, and `git push origin +branch`
+#                     (a force push with no --force anywhere in it)
+#   secret-guard      git -C add .env, git -C add id_rsa
+#   destructive-guard git -C reset --hard, git -C clean -fd,
+#                     git -C checkout --force, --git-dir reset --hard
+#
+# destructive-guard needed two fixes, not one. The checks themselves were only
+# half of it: the mentions-vs-invocations pre-filter counted git verbs in the
+# raw text, scored `git -C /repo reset --hard` as zero verbs, and exited before
+# any check ran. Fixing the checks alone changed nothing measurable. Same shape,
+# one layer earlier -- which is where it decided the outcome.
+#
+# The fix normalises the globals away once (cc_strip_git_globals) and leaves the
+# patterns readable, rather than threading an optional-globals group through
+# every one of them.
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+BG=$(mktemp); SG=$(mktemp); DG=$(mktemp)
+trap 'rm -f "$BG" "$SG" "$DG"' EXIT
+python3 -c "
+import json,sys
+d=json.load(open('$ROOT/scripts.json'))
+open('$BG','w').write(d['branch-guard'])
+open('$SG','w').write(d['secret-guard'])
+open('$DG','w').write(d['destructive-guard'])"
+
+PASS=0; FAIL=0
+
+check() {
+    local guard="$1" desc="$2" cmd="$3" want="$4"   # want: 2 = blocked, 0 = allowed
+    local payload code
+    payload=$(python3 -c '
+import json,sys
+print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]}}))' "$cmd")
+    printf '%s' "$payload" | bash "$guard" >/dev/null 2>&1
+    code=$?
+    if [ "$code" = "$want" ]; then
+        echo "PASS: $desc"; PASS=$((PASS+1))
+    else
+        echo "FAIL: $desc (expected exit $want, got $code)"; FAIL=$((FAIL+1))
+    fi
+}
+
+# --- branch-guard: globals before `push` ---
+check "$BG" "bg: -C, protected branch"        'git -C /repo push origin main'              2
+check "$BG" "bg: -C, force push"              'git -C /repo push origin feature --force'   2
+check "$BG" "bg: --git-dir, force push"       'git --git-dir=/r/.git push --force'         2
+check "$BG" "bg: -c, force push"              'git -c core.pager=cat push --force'         2
+check "$BG" "bg: --no-pager then -C"          'git --no-pager -C /r push --force'          2
+check "$BG" "bg: canonical force push"        'git push --force origin feature'            2
+check "$BG" "bg: canonical protected push"    'git push origin main'                       2
+
+# --- branch-guard: `+branch` is a force push with no --force in it ---
+check "$BG" "bg: +refspec, feature branch"    'git push origin +feature:feature'           2
+check "$BG" "bg: +refspec, no colon"          'git push origin +feature'                   2
+check "$BG" "bg: -C plus +refspec"            'git -C /repo push origin +feature'          2
+
+# --- branch-guard: still lets ordinary work through ---
+check "$BG" "bg: ordinary push"               'git push origin feature'                    0
+check "$BG" "bg: -C ordinary push"            'git -C /repo push origin feature'           0
+check "$BG" "bg: dry run"                     'git push --dry-run origin feature'          0
+check "$BG" "bg: rm -f after the push is not a force push" \
+                                              'git push origin feature && rm -f tmp.txt'   0
+
+# --- secret-guard: globals before `add` ---
+check "$SG" "sg: -C, .env"                    'git -C /repo add .env'                      2
+check "$SG" "sg: -C, private key"             'git -C /repo add id_rsa'                    2
+check "$SG" "sg: --git-dir, .env"             'git --git-dir=/r/.git add .env'             2
+check "$SG" "sg: canonical .env"              'git add .env'                               2
+check "$SG" "sg: ordinary add"                'git add src/main.py'                        0
+check "$SG" "sg: -C ordinary add"             'git -C /repo add src/main.py'               0
+
+# --- destructive-guard: globals before the verb ---
+check "$DG" "dg: -C, reset --hard"            'git -C /repo reset --hard HEAD~5'           2
+check "$DG" "dg: --git-dir, reset --hard"     'git --git-dir=/r/.git reset --hard'         2
+check "$DG" "dg: -c, reset --hard"            'git -c user.name=x reset --hard'            2
+check "$DG" "dg: -C, clean -fd"               'git -C /repo clean -fd'                     2
+check "$DG" "dg: -C, checkout --force"        'git -C /repo checkout --force main'         2
+check "$DG" "dg: canonical reset --hard"      'git reset --hard HEAD~1'                    2
+check "$DG" "dg: canonical clean"             'git clean -fd'                              2
+
+# --- destructive-guard: the pre-filter still tells mentions from invocations ---
+check "$DG" "dg: reset --hard inside a quoted string" \
+                                              "echo 'git reset --hard は危険'"             0
+check "$DG" "dg: -C read-only"                'git -C /repo log'                           0
+check "$DG" "dg: -C dry-run clean"            'git -C /repo clean --dry-run'               0
+check "$DG" "dg: reset --soft"                'git reset --soft HEAD~1'                    0
+check "$DG" "dg: status"                      'git status'                                 0
+
+# --- 2026-09-14: the same family, found by applying an outside report (#1117) ---
+# The normaliser only knew the `=` spelling of the long options, and its list
+# was missing several that git accepts. git takes `--git-dir <path>` with a
+# space just as happily as `--git-dir=<path>`.
+check "$DG" "dg: --git-dir with a separate value" 'git --git-dir /tmp/r/repo.d reset --hard'  2
+check "$DG" "dg: --config-env"                    'git --config-env=a=B reset --hard'         2
+check "$DG" "dg: --no-optional-locks"             'git --no-optional-locks reset --hard'      2
+check "$DG" "dg: --work-tree with a separate value" 'git --work-tree /tmp/w reset --hard'     2
+check "$DG" "dg: --no-advice"                     'git --no-advice clean -fd'                 2
+# and the same options must not start blocking ordinary work
+check "$DG" "dg: --no-optional-locks status"      'git --no-optional-locks status'            0
+check "$DG" "dg: --git-dir separate value, log"   'git --git-dir /tmp/r/repo.d log --oneline' 0
+
+# --- 2026-09-14, second pass: `git` did not have to be the first word ---
+# The git checks anchored on `(^|;|&+|\|\|)\s*git`, so anything in front of the
+# word - an absolute path, a wrapper, an environment assignment - put the
+# command out of reach. Check 0y, the pre-filter that decides whether a
+# destructive verb is present at all, already counted every one of these as an
+# invocation; only the checks it feeds were narrower. Both now share CC_CMDPOS.
+check "$DG" "dg: git by absolute path"        '/usr/bin/git reset --hard'          2
+check "$DG" "dg: git by relative path"        './git reset --hard'                 2
+check "$DG" "dg: sudo git"                    'sudo git reset --hard'              2
+check "$DG" "dg: env assignment in front"     'env FOO=1 git reset --hard'         2
+check "$DG" "dg: bare assignment in front"    'FOO=1 git reset --hard'             2
+check "$DG" "dg: time wrapper"                'time git reset --hard'              2
+check "$DG" "dg: nohup wrapper"               'nohup git reset --hard'             2
+check "$DG" "dg: absolute path, clean -fd"    '/usr/bin/git clean -fd'             2
+check "$DG" "dg: absolute path, checkout -f"  '/usr/bin/git checkout --force main'  2
+# The widened head must not start blocking the things it never blocked before.
+check "$DG" "dg: mentions it in an echo"      "echo 'git reset --hard' >> notes.md" 0
+check "$DG" "dg: greps for the words"         "grep -r 'git reset --hard' ./docs"   0
+check "$DG" "dg: reset --soft"                'git reset --soft HEAD~1'             0
+check "$DG" "dg: a path that merely ends in git" 'ls /usr/bin/git'                  0
+
+echo
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" = 0 ]

package/tests/git-invocation-prefixes-all-guards.test.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+# `git` did not have to be the first word -- in branch-guard and secret-guard too
+#
+# 2026-09-14, #1121 moved destructive-guard's git checks off the "start of a
+# segment" anchor and onto CC_CMDPOS, which also recognises a path, a sudo, an
+# environment assignment and the usual wrappers. branch-guard and secret-guard
+# have the same gate and were not touched, so the fix covered one guard out of
+# three.
+#
+# Measured the same day, nine invocation forms against each subcommand, feeding
+# each guard the same JSON on stdin:
+#
+#   destructive-guard   9 of 9 blocked   (fixed in #1121)
+#   branch-guard        2 of 9 blocked
+#   secret-guard        2 of 9 blocked
+#
+# The seven that walked through were `/usr/bin/git`, `./git`, `sudo git`,
+# `env FOO=1 git`, `FOO=1 git`, `time git` and `nohup git`. Each one exited 0,
+# which Claude Code reads as "this hook has no objection", not as "this hook did
+# not look".
+#
+# Also here: `git send-pack --force origin main`. send-pack is the plumbing
+# spelling of a push, and branch-guard's own header says it blocks force pushes
+# on all branches and pushes to protected branches -- but its gate only knew the
+# word `push`, so both of those promises were spelled around.
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+BG=$(mktemp); SG=$(mktemp); DG=$(mktemp)
+trap 'rm -f "$BG" "$SG" "$DG"' EXIT
+python3 -c "
+import json,sys
+d=json.load(open('$ROOT/scripts.json'))
+open('$BG','w').write(d['branch-guard'])
+open('$SG','w').write(d['secret-guard'])
+open('$DG','w').write(d['destructive-guard'])"
+
+PASS=0; FAIL=0
+
+check() {
+    local guard="$1" desc="$2" cmd="$3" want="$4"   # want: 2 = blocked, 0 = allowed
+    local payload code
+    payload=$(python3 -c '
+import json,sys
+print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]}}))' "$cmd")
+    printf '%s' "$payload" | bash "$guard" >/dev/null 2>&1
+    code=$?
+    if [ "$code" = "$want" ]; then
+        echo "PASS: $desc"; PASS=$((PASS+1))
+    else
+        echo "FAIL: $desc (expected exit $want, got $code)"; FAIL=$((FAIL+1))
+    fi
+}
+
+# The nine invocation forms. `%s` is where the git command goes.
+PREFIXES=(
+    '%s'
+    '/usr/bin/%s'
+    './%s'
+    'sudo %s'
+    'env FOO=1 %s'
+    'FOO=1 %s'
+    'time %s'
+    'nohup %s'
+    'cd /tmp && %s'
+)
+PREFIX_NAMES=(bare abspath relpath sudo env-assign leading-assign time nohup separator)
+
+# Each guard with a subcommand it owns. All nine forms must be refused.
+run_grid() {
+    local guard="$1" label="$2" sub="$3"
+    local i fmt name cmd
+    for i in "${!PREFIXES[@]}"; do
+        fmt="${PREFIXES[$i]}"; name="${PREFIX_NAMES[$i]}"
+        # shellcheck disable=SC2059
+        cmd=$(printf "$fmt" "$sub")
+        check "$guard" "$label [$name]" "$cmd" 2
+    done
+}
+
+run_grid "$DG" "dg: reset --hard"        'git reset --hard HEAD~5'
+run_grid "$DG" "dg: clean -fd"           'git clean -fd'
+run_grid "$BG" "bg: force push"          'git push --force origin main'
+run_grid "$BG" "bg: +main is a force"    'git push origin +main'
+run_grid "$BG" "bg: -uf short cluster"   'git push -uf origin feature'
+run_grid "$SG" "sg: stage .env"          'git add .env'
+
+# --- send-pack: the plumbing spelling of a push ---
+check "$BG" "bg: send-pack --force"           'git send-pack --force origin main'          2
+check "$BG" "bg: send-pack --force with -C"   'git -C /repo send-pack --force origin main' 2
+check "$BG" "bg: send-pack to main"           'git send-pack origin main'                  2
+check "$BG" "bg: send-pack to a feature"      'git send-pack origin feature'               0
+
+# --- the approve side: widening the gate must not start refusing ordinary work ---
+check "$BG" "bg: ordinary push to a feature"  'git push origin feature'                    0
+check "$BG" "bg: -u to a feature"             'git push -u origin feature'                 0
+check "$SG" "sg: staging a normal file"       'git add README.md'                          0
+check "$SG" "sg: staging a source file"       'git add src/config.ts'                      0
+check "$DG" "dg: a dry run is not a delete"   'git clean -nd'                              0
+
+# CC_CMDPOS accepts a path in front of git. It must still require the word to be
+# `git` and not merely to start with it.
+check "$BG" "bg: gitk is not git"             '/usr/bin/gitk push --force origin main'     0
+check "$DG" "dg: a lookalike binary"          './gitfoo reset --hard HEAD~5'               0
+
+# Mentions are not invocations. A space in front of `git` is not a segment break,
+# so quoting or grepping for the command must stay allowed.
+check "$BG" "bg: the command inside a string" 'echo "run git push --force if you must"'    0
+check "$DG" "dg: searching for the command"   "grep -rn 'git reset --hard' ."              0
+
+# ...but the wrappers that really do run it are invocations.
+check "$BG" "bg: xargs runs it"               'echo main | xargs git push --force origin'  2
+
+echo
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/git-maintenance-guard.test.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+# Tests for git-maintenance-guard.sh
+# Run: bash tests/git-maintenance-guard.test.sh
+set -euo pipefail
+
+PASS=0
+FAIL=0
+HOOK="$(dirname "$0")/../examples/git-maintenance-guard.sh"
+
+run_hook() {
+    local input="$1" expected_exit="$2" desc="$3" extra_env="${4:-}"
+    local actual_exit=0
+    if [ -n "$extra_env" ]; then
+        # shellcheck disable=SC2086
+        echo "$input" | env $extra_env bash "$HOOK" >/dev/null 2>/dev/null || actual_exit=$?
+    else
+        echo "$input" | bash "$HOOK" >/dev/null 2>/dev/null || actual_exit=$?
+    fi
+    if [ "$actual_exit" -eq "$expected_exit" ]; then
+        echo "  PASS: $desc"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc (expected exit $expected_exit, got $actual_exit)"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+echo "git-maintenance-guard.sh tests"
+echo ""
+
+# --- Block git gc ---
+run_hook '{"tool_input":{"command":"git gc"}}' 2 "Block bare git gc"
+run_hook '{"tool_input":{"command":"git gc --auto"}}' 2 "Block git gc --auto"
+run_hook '{"tool_input":{"command":"git gc --aggressive"}}' 2 "Block git gc --aggressive"
+run_hook '{"tool_input":{"command":"git gc --prune=now"}}' 2 "Block git gc --prune=now"
+run_hook '{"tool_input":{"command":"cd ~/repo && git gc"}}' 2 "Block git gc after cd"
+
+# --- Block git repack ---
+run_hook '{"tool_input":{"command":"git repack"}}' 2 "Block bare git repack"
+run_hook '{"tool_input":{"command":"git repack -a -d"}}' 2 "Block git repack -a -d"
+run_hook '{"tool_input":{"command":"git repack -A -d --depth=250 --window=250"}}' 2 "Block heavy git repack"
+
+# --- Block git maintenance ---
+run_hook '{"tool_input":{"command":"git maintenance run"}}' 2 "Block git maintenance run"
+run_hook '{"tool_input":{"command":"git maintenance start"}}' 2 "Block git maintenance start"
+run_hook '{"tool_input":{"command":"git maintenance stop"}}' 2 "Block git maintenance stop"
+run_hook '{"tool_input":{"command":"git maintenance register"}}' 2 "Block git maintenance register"
+
+# --- Block git prune ---
+run_hook '{"tool_input":{"command":"git prune"}}' 2 "Block bare git prune"
+run_hook '{"tool_input":{"command":"git prune --expire=now"}}' 2 "Block git prune --expire=now"
+run_hook '{"tool_input":{"command":"git prune-packed"}}' 2 "Block git prune-packed"
+
+# --- Allow safe git commands ---
+run_hook '{"tool_input":{"command":"git status"}}' 0 "Allow git status"
+run_hook '{"tool_input":{"command":"git log --oneline"}}' 0 "Allow git log"
+run_hook '{"tool_input":{"command":"git commit -m fix"}}' 0 "Allow git commit"
+run_hook '{"tool_input":{"command":"git push"}}' 0 "Allow git push"
+run_hook '{"tool_input":{"command":"git fetch"}}' 0 "Allow git fetch"
+run_hook '{"tool_input":{"command":"git pull"}}' 0 "Allow git pull"
+run_hook '{"tool_input":{"command":"git checkout main"}}' 0 "Allow git checkout"
+run_hook '{"tool_input":{"command":"git rebase main"}}' 0 "Allow git rebase"
+run_hook '{"tool_input":{"command":"git count-objects -v"}}' 0 "Allow git count-objects"
+run_hook '{"tool_input":{"command":"git fsck"}}' 0 "Allow git fsck"
+run_hook '{"tool_input":{"command":"git verify-pack -v test.idx"}}' 0 "Allow git verify-pack"
+
+# --- Allow unrelated commands containing the words ---
+run_hook '{"tool_input":{"command":"echo gc"}}' 0 "Allow non-git gc"
+run_hook '{"tool_input":{"command":"echo repack"}}' 0 "Allow non-git repack"
+run_hook '{"tool_input":{"command":"echo maintenance"}}' 0 "Allow non-git maintenance"
+run_hook '{"tool_input":{"command":"prune-old-files.sh"}}' 0 "Allow non-git prune"
+
+# --- Override flags ---
+run_hook '{"tool_input":{"command":"git gc"}}' 0 "ALLOW flag bypasses block" "CC_GIT_MAINTENANCE_ALLOW=1"
+run_hook '{"tool_input":{"command":"git repack"}}' 0 "DISABLE flag bypasses block" "CC_GIT_MAINTENANCE_DISABLE=1"
+
+# --- Empty / missing input ---
+run_hook '{}' 0 "Allow empty input"
+run_hook '{"tool_input":{}}' 0 "Allow missing command"
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed out of $((PASS + FAIL)) tests"
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/git-pack-temp-cleanup-guard.test.sh

@@ -0,0 +1,133 @@
+#!/bin/bash
+# Tests for git-pack-temp-cleanup-guard.sh
+# Run: bash tests/git-pack-temp-cleanup-guard.test.sh
+set -euo pipefail
+
+PASS=0
+FAIL=0
+HOOK="$(cd "$(dirname "$0")" && pwd)/../examples/git-pack-temp-cleanup-guard.sh"
+
+run_hook() {
+    local input="$1" expected_exit="$2" desc="$3" extra_env="${4:-}"
+    local actual_exit=0
+    local stderr_out
+    if [ -n "$extra_env" ]; then
+        # shellcheck disable=SC2086
+        stderr_out=$(echo "$input" | env $extra_env bash "$HOOK" 2>&1 >/dev/null) || actual_exit=$?
+    else
+        stderr_out=$(echo "$input" | bash "$HOOK" 2>&1 >/dev/null) || actual_exit=$?
+    fi
+    if [ "$actual_exit" -eq "$expected_exit" ]; then
+        echo "  PASS: $desc"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc (expected exit $expected_exit, got $actual_exit)"
+        echo "    stderr: $stderr_out"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+# Each test sets up an isolated git repo in a temp dir so we never
+# touch the user's real .git directory.
+setup_repo() {
+    local dir
+    dir=$(mktemp -d)
+    (cd "$dir" && git init -q)
+    echo "$dir"
+}
+
+teardown_repo() {
+    rm -rf "$1"
+}
+
+echo "git-pack-temp-cleanup-guard.sh tests"
+echo ""
+
+# --- No-op cases ---
+run_hook '{}' 0 "Allow empty input"
+run_hook '{"tool_input":{}}' 0 "Allow missing command"
+run_hook '{"tool_input":{"command":"echo hello"}}' 0 "Allow non-git command"
+run_hook '{"tool_input":{"command":"ls -la"}}' 0 "Allow ls command"
+
+# --- Git commands outside a repo ---
+TMP=$(mktemp -d)
+pushd "$TMP" >/dev/null
+run_hook '{"tool_input":{"command":"git status"}}' 0 "Allow git command outside a repo (no .git found)"
+popd >/dev/null
+rm -rf "$TMP"
+
+# --- Git commands inside a clean repo (no tmp_pack_*) ---
+REPO=$(setup_repo)
+pushd "$REPO" >/dev/null
+run_hook '{"tool_input":{"command":"git status"}}' 0 "Allow git status in clean repo"
+run_hook '{"tool_input":{"command":"git log"}}' 0 "Allow git log in clean repo"
+run_hook '{"tool_input":{"command":"git commit -m fix"}}' 0 "Allow git commit in clean repo"
+popd >/dev/null
+teardown_repo "$REPO"
+
+# --- Cleanup of stale tmp_pack_* (older than threshold) ---
+REPO=$(setup_repo)
+mkdir -p "$REPO/.git/objects/pack"
+# Create a fake stale tmp_pack_ file. Use touch -d to backdate it 2 hours.
+touch -d "2 hours ago" "$REPO/.git/objects/pack/tmp_pack_stale1"
+touch -d "2 hours ago" "$REPO/.git/objects/pack/tmp_pack_stale2"
+echo "x" > "$REPO/.git/objects/pack/tmp_pack_stale1"
+touch -d "2 hours ago" "$REPO/.git/objects/pack/tmp_pack_stale1"
+pushd "$REPO" >/dev/null
+run_hook '{"tool_input":{"command":"git status"}}' 0 "Allow git status, stale tmp_pack_* should be removed"
+remaining=$(find "$REPO/.git/objects/pack" -name 'tmp_pack_*' | wc -l)
+if [ "$remaining" -eq 0 ]; then
+    echo "  PASS: stale tmp_pack_* removed"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: $remaining stale tmp_pack_* still present"
+    FAIL=$((FAIL + 1))
+fi
+popd >/dev/null
+teardown_repo "$REPO"
+
+# --- Recent tmp_pack_* must NOT be removed ---
+REPO=$(setup_repo)
+mkdir -p "$REPO/.git/objects/pack"
+echo "x" > "$REPO/.git/objects/pack/tmp_pack_fresh"
+pushd "$REPO" >/dev/null
+run_hook '{"tool_input":{"command":"git status"}}' 0 "Allow git status, recent tmp_pack_* preserved"
+remaining=$(find "$REPO/.git/objects/pack" -name 'tmp_pack_*' | wc -l)
+if [ "$remaining" -eq 1 ]; then
+    echo "  PASS: recent tmp_pack_* preserved"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: recent tmp_pack_* changed (remaining=$remaining)"
+    FAIL=$((FAIL + 1))
+fi
+popd >/dev/null
+teardown_repo "$REPO"
+
+# --- Block when tmp_pack_* total exceeds CC_GIT_PACK_BLOCK_GB ---
+# Use a tiny block threshold so a small synthetic file trips it.
+REPO=$(setup_repo)
+mkdir -p "$REPO/.git/objects/pack"
+# Create a 2 MiB recent file; with CC_GIT_PACK_BLOCK_GB=0 even the
+# smallest non-empty tmp_pack_ trips the block branch (>= 0 GiB).
+dd if=/dev/zero of="$REPO/.git/objects/pack/tmp_pack_big" bs=1M count=2 status=none
+pushd "$REPO" >/dev/null
+run_hook '{"tool_input":{"command":"git status"}}' 2 "Block when remaining > block threshold" "CC_GIT_PACK_BLOCK_GB=0 CC_GIT_PACK_AGE_MIN=10000"
+popd >/dev/null
+teardown_repo "$REPO"
+
+# --- DISABLE flag should bypass everything ---
+REPO=$(setup_repo)
+mkdir -p "$REPO/.git/objects/pack"
+dd if=/dev/zero of="$REPO/.git/objects/pack/tmp_pack_big" bs=1M count=2 status=none
+pushd "$REPO" >/dev/null
+run_hook '{"tool_input":{"command":"git status"}}' 0 "DISABLE flag bypasses all checks" "CC_GIT_PACK_DISABLE=1 CC_GIT_PACK_BLOCK_GB=0"
+popd >/dev/null
+teardown_repo "$REPO"
+
+# --- Non-git binaries with 'git' substring ---
+run_hook '{"tool_input":{"command":"echo /usr/local/lib/gitlab"}}' 0 "Allow path with 'gitlab' substring"
+run_hook '{"tool_input":{"command":"npm install gitignore-cli"}}' 0 "Allow npm install with gitignore-cli"
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed out of $((PASS + FAIL)) tests"
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/git-rm-orphan-wipe-guard.test.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+# Tests for git-rm-orphan-wipe-guard.sh
+# Run: bash tests/git-rm-orphan-wipe-guard.test.sh
+set -euo pipefail
+
+PASS=0
+FAIL=0
+HOOK="$(dirname "$0")/../examples/git-rm-orphan-wipe-guard.sh"
+
+test_hook() {
+    local input="$1" expected_exit="$2" desc="$3"
+    local actual_exit=0
+    echo "$input" | bash "$HOOK" > /dev/null 2>/dev/null || actual_exit=$?
+    if [ "$actual_exit" -eq "$expected_exit" ]; then
+        echo "  PASS: $desc"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc (expected exit $expected_exit, got $actual_exit)"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+echo "git-rm-orphan-wipe-guard.sh tests"
+echo ""
+
+# --- Block: the #70687 compound command ---
+test_hook '{"tool_input":{"command":"git checkout --orphan wipe && git rm -rf . --quiet"}}' 2 "Block the #70687 orphan+rm compound"
+
+# --- Block: git checkout/switch --orphan ---
+test_hook '{"tool_input":{"command":"git checkout --orphan newroot"}}' 2 "Block git checkout --orphan"
+test_hook '{"tool_input":{"command":"git switch --orphan fresh"}}' 2 "Block git switch --orphan"
+test_hook '{"tool_input":{"command":"git checkout --orphan"}}' 2 "Block bare git checkout --orphan"
+
+# --- Block: recursive git rm ---
+test_hook '{"tool_input":{"command":"git rm -rf ."}}' 2 "Block git rm -rf ."
+test_hook '{"tool_input":{"command":"git rm -r src"}}' 2 "Block git rm -r <dir>"
+test_hook '{"tool_input":{"command":"git rm -fr ."}}' 2 "Block git rm -fr ."
+test_hook '{"tool_input":{"command":"git rm --recursive build"}}' 2 "Block git rm --recursive"
+
+# --- Block: whole-tree target without -r ---
+test_hook '{"tool_input":{"command":"git rm ."}}' 2 "Block git rm ."
+test_hook '{"tool_input":{"command":"git rm *"}}' 2 "Block git rm *"
+
+# --- Allow: --cached (untracks only, disk files survive) ---
+test_hook '{"tool_input":{"command":"git rm -r --cached ."}}' 0 "Allow git rm -r --cached . (untrack, no disk loss)"
+test_hook '{"tool_input":{"command":"git rm --cached secrets.env"}}' 0 "Allow git rm --cached <file>"
+
+# --- Allow: single-file git rm ---
+test_hook '{"tool_input":{"command":"git rm old.txt"}}' 0 "Allow git rm <file>"
+test_hook '{"tool_input":{"command":"git rm path/to/file.js"}}' 0 "Allow git rm <path/file>"
+
+# --- Allow: safe git / unrelated commands ---
+test_hook '{"tool_input":{"command":"git checkout main"}}' 0 "Allow git checkout <branch>"
+test_hook '{"tool_input":{"command":"git switch feature"}}' 0 "Allow git switch <branch>"
+test_hook '{"tool_input":{"command":"git status"}}' 0 "Allow git status"
+test_hook '{"tool_input":{"command":"git commit -m fix"}}' 0 "Allow git commit"
+test_hook '{"tool_input":{"command":"grep orphan README.md"}}' 0 "Allow grep orphan (substring, not git)"
+test_hook '{"tool_input":{"command":"rm -rf node_modules"}}' 0 "Allow plain rm (rm-safety-net territory, not this guard)"
+
+# --- Allow: empty/missing input ---
+test_hook '{}' 0 "Allow empty input"
+test_hook '{"tool_input":{}}' 0 "Allow missing command"
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed out of $((PASS + FAIL)) tests"
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/git-submodule-guard.test.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Tests for git-submodule-guard.sh
+# Verifies that the data-destroying forced deinit (#68920) is blocked,
+# while unforced deinit / submodule rm are warn-only.
+HOOK="examples/git-submodule-guard.sh"
+PASS=0 FAIL=0
+
+HOOK_ABS="$PWD/$HOOK"
+
+# run_hook <command> [env assignments...] -> sets $OUT and $RC
+run_hook() {
+    local cmd="$1"; shift
+    OUT=$(printf '{"tool_input":{"command":"%s"}}' "$cmd" | env "$@" bash "$HOOK_ABS" 2>&1)
+    RC=$?
+}
+
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+
+# Forced deinit must be blocked (exit 2) by default.
+run_hook "git submodule deinit -f libs/foo"
+assert_exit "forced -f blocks" "$RC" 2
+assert_contains "block message cites #68920" "$OUT" "#68920"
+
+run_hook "git submodule deinit --force libs/foo"
+assert_exit "forced --force blocks" "$RC" 2
+
+run_hook "git submodule deinit --all -f"
+assert_exit "deinit --all -f blocks" "$RC" 2
+
+# Unforced deinit: git's own safety still applies, so warn-only (exit 0).
+run_hook "git submodule deinit libs/foo"
+assert_exit "unforced deinit warns (exit 0)" "$RC" 0
+assert_contains "unforced deinit warns" "$OUT" "WARNING"
+
+# submodule rm: warn-only.
+run_hook "git submodule rm libs/foo"
+assert_exit "submodule rm warns (exit 0)" "$RC" 0
+
+# Unrelated command: untouched.
+run_hook "git status"
+assert_exit "unrelated passes" "$RC" 0
+
+# Opt-out: warn-only mode lets the forced deinit through (exit 0).
+run_hook "git submodule deinit -f libs/foo" SUBMODULE_DEINIT_BLOCK=0
+assert_exit "opt-out warn-only (exit 0)" "$RC" 0
+assert_contains "opt-out still warns" "$OUT" "WARNING"
+
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]