cc-safe-setup 29.7.0 → 30.0.4

package/tests/test-bash-allowlist-secondary-check.sh

@@ -0,0 +1,143 @@
+#!/bin/bash
+# Tests for bash-allowlist-secondary-check.sh (Issue #56117 prevention)
+HOOK="examples/bash-allowlist-secondary-check.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; echo "  output: $2"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; echo "  output: $2"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+# Use a temp directory with a controlled settings.json so the test does not
+# depend on the host's user-level ~/.claude/settings.json.
+TMPDIR=$(mktemp -d)
+mkdir -p "$TMPDIR/.claude"
+HOOK_ABS="$(pwd)/$HOOK"
+
+cat > "$TMPDIR/.claude/settings.json" <<'EOF'
+{
+  "permissions": {
+    "allow": [
+      "Bash(git diff)",
+      "Bash(git log:*)",
+      "Bash(git status)",
+      "Bash(npm test:*)",
+      "Read(*)"
+    ]
+  }
+}
+EOF
+
+# Avoid leaking the host's user-level settings into the matcher.
+export HOME_BACKUP="$HOME"
+export HOME="$TMPDIR"
+
+cd "$TMPDIR" || exit 1
+
+# Test 1: empty command — silent pass
+OUT=$(echo '{"tool_input":{"command":""}}' | bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_not_contains "empty command no warning" "$OUT" "not matched"
+assert_exit "empty command exit 0" "$RC" "0"
+
+# Test 2: exact match
+OUT=$(echo '{"tool_input":{"command":"git diff"}}' | bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_not_contains "exact match no warning" "$OUT" "not matched"
+assert_exit "exact match exit 0" "$RC" "0"
+
+# Test 3: prefix match for "git log:*"
+OUT=$(echo '{"tool_input":{"command":"git log -10 --oneline"}}' | bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_not_contains "prefix match no warning" "$OUT" "not matched"
+assert_exit "prefix match exit 0" "$RC" "0"
+
+# Test 4: prefix match for "npm test:*"
+OUT=$(echo '{"tool_input":{"command":"npm test --watch"}}' | bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_not_contains "npm test prefix no warning" "$OUT" "not matched"
+assert_exit "npm test prefix exit 0" "$RC" "0"
+
+# Test 5: not in allowlist — Issue #56117 case (git push)
+OUT=$(echo '{"tool_input":{"command":"git push origin main"}}' | bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_contains "git push warns" "$OUT" "not matched by any settings.json allow pattern"
+assert_contains "git push references issue" "$OUT" "#56117"
+assert_contains "git push includes the command" "$OUT" "git push origin main"
+assert_exit "git push exit 0 advisory" "$RC" "0"
+
+# Test 6: not in allowlist — git add (also #56117 case)
+OUT=$(echo '{"tool_input":{"command":"git add -A"}}' | bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_contains "git add warns" "$OUT" "not matched"
+assert_exit "git add advisory exit 0" "$RC" "0"
+
+# Test 7: strict mode blocks
+OUT=$(echo '{"tool_input":{"command":"git push origin main"}}' | CC_BASH_ALLOWLIST_STRICT=1 bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_contains "strict still warns" "$OUT" "not matched"
+assert_exit "strict mode exit 2" "$RC" "2"
+
+# Test 8: quiet mode silences warning but still blocks in strict
+OUT=$(echo '{"tool_input":{"command":"git push origin main"}}' | CC_BASH_ALLOWLIST_QUIET=1 CC_BASH_ALLOWLIST_STRICT=1 bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_not_contains "quiet strict no stderr" "$OUT" "not matched"
+assert_exit "quiet strict exit 2" "$RC" "2"
+
+# Test 9: quiet alone is silent advisory
+OUT=$(echo '{"tool_input":{"command":"git push origin main"}}' | CC_BASH_ALLOWLIST_QUIET=1 bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_not_contains "quiet alone no stderr" "$OUT" "not matched"
+assert_exit "quiet alone exit 0" "$RC" "0"
+
+# Test 10: Bash(*) wildcard allows everything
+cat > "$TMPDIR/.claude/settings.json" <<'EOF'
+{ "permissions": { "allow": ["Bash(*)"] } }
+EOF
+OUT=$(echo '{"tool_input":{"command":"rm -rf /tmp/foo"}}' | bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_not_contains "wildcard allow no warning" "$OUT" "not matched"
+assert_exit "wildcard allow exit 0" "$RC" "0"
+
+# Test 11: empty allowlist — everything warns
+cat > "$TMPDIR/.claude/settings.json" <<'EOF'
+{ "permissions": { "allow": [] } }
+EOF
+OUT=$(echo '{"tool_input":{"command":"echo hello"}}' | bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_contains "empty allowlist warns" "$OUT" "not matched"
+assert_exit "empty allowlist advisory exit 0" "$RC" "0"
+
+# Test 12: missing settings file — silent pass (no allowlist to compare against)
+rm "$TMPDIR/.claude/settings.json"
+OUT=$(echo '{"tool_input":{"command":"echo hello"}}' | bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_contains "missing settings still warns (no patterns)" "$OUT" "not matched"
+assert_exit "missing settings exit 0" "$RC" "0"
+
+# Test 13: local settings file is also read
+cat > "$TMPDIR/.claude/settings.local.json" <<'EOF'
+{ "permissions": { "allow": ["Bash(echo:*)"] } }
+EOF
+OUT=$(echo '{"tool_input":{"command":"echo hello"}}' | bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_not_contains "local settings allow no warning" "$OUT" "not matched"
+assert_exit "local settings exit 0" "$RC" "0"
+
+# Test 14: non-Bash patterns (e.g. Read) are ignored
+cat > "$TMPDIR/.claude/settings.json" <<'EOF'
+{ "permissions": { "allow": ["Read(*)", "Edit(*)"] } }
+EOF
+rm -f "$TMPDIR/.claude/settings.local.json"
+OUT=$(echo '{"tool_input":{"command":"git push"}}' | bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_contains "non-Bash patterns ignored — git push warns" "$OUT" "not matched"
+assert_exit "non-Bash patterns advisory exit 0" "$RC" "0"
+
+# Restore HOME and clean up
+export HOME="$HOME_BACKUP"
+cd / && rm -rf "$TMPDIR"
+
+echo
+echo "Passed: $PASS"
+echo "Failed: $FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/test-bash-fanout-bounded-rewriter.sh

@@ -0,0 +1,186 @@
+#!/bin/bash
+# Tests for bash-fanout-bounded-rewriter.sh
+# Covers: 7 fan-out detection patterns, 5 safe-pass patterns,
+# override / disable env toggles, suggested-rewrite content,
+# fail-open on malformed input.
+
+HOOK="examples/bash-fanout-bounded-rewriter.sh"
+PASS=0 FAIL=0
+
+run_hook() {
+    local payload="$1"; shift
+    env -u CC_BASH_FANOUT_DISABLE -u CC_BASH_FANOUT_OVERRIDE \
+        -u CC_BASH_FANOUT_PARALLEL_BOUND \
+        "$@" bash "$HOOK" <<< "$payload" 2>&1
+    # bash exit status passes through; capture in caller via $?
+}
+
+assert_contains() { if echo "$2" | grep -qF "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -qF "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+run_and_capture() {
+    local payload="$1"; shift
+    env -u CC_BASH_FANOUT_DISABLE -u CC_BASH_FANOUT_OVERRIDE \
+        -u CC_BASH_FANOUT_PARALLEL_BOUND \
+        "$@" bash "$HOOK" <<< "$payload" 2>&1
+    LAST_RC=$?
+}
+
+# Test 1: empty input — pass through
+run_and_capture '{}'
+assert_exit "empty input pass" "$LAST_RC" "0"
+
+# Test 2: safe command (ls -la) — pass through silently
+run_and_capture '{"tool_input":{"command":"ls -la"}}'
+assert_exit "ls -la pass" "$LAST_RC" "0"
+
+# Test 3: find -exec — blocked
+run_and_capture '{"tool_input":{"command":"find . -name *.py -exec wc -l {} +"}}'
+assert_exit "find -exec blocked" "$LAST_RC" "2"
+OUT=$(run_hook '{"tool_input":{"command":"find . -name *.py -exec wc -l {} +"}}')
+assert_contains "find -exec advisory" "$OUT" "Unbounded fan-out detected"
+assert_contains "find -exec names pattern" "$OUT" "find ... -exec"
+assert_contains "find -exec references #62193" "$OUT" "#62193"
+assert_contains "find -exec suggests xargs -P rewrite" "$OUT" "xargs -0 -P 8"
+
+# Test 4: for ... in $(...) — blocked
+run_and_capture '{"tool_input":{"command":"for f in $(ls *.txt); do wc -l \"$f\"; done"}}'
+assert_exit "for in dollar paren blocked" "$LAST_RC" "2"
+OUT=$(run_hook '{"tool_input":{"command":"for f in $(ls *.txt); do wc -l \"$f\"; done"}}')
+assert_contains "for advisory" "$OUT" "for ... in"
+
+# Test 5: for in literal static list — pass through
+run_and_capture '{"tool_input":{"command":"for i in 1 2 3; do echo $i; done"}}'
+assert_exit "for in 1 2 3 pass" "$LAST_RC" "0"
+
+# Test 6: for ... in $VAR — blocked
+run_and_capture '{"tool_input":{"command":"for f in $FILES; do echo $f; done"}}'
+assert_exit "for in dollar var blocked" "$LAST_RC" "2"
+
+# Test 7: for ... in glob — blocked
+run_and_capture '{"tool_input":{"command":"for f in *.log; do tail -1 $f; done"}}'
+assert_exit "for in glob blocked" "$LAST_RC" "2"
+
+# Test 8: while read — blocked
+run_and_capture '{"tool_input":{"command":"cat list.txt | while read line; do process $line; done"}}'
+assert_exit "while read blocked" "$LAST_RC" "2"
+OUT=$(run_hook '{"tool_input":{"command":"cat list.txt | while read line; do process $line; done"}}')
+assert_contains "while read advisory" "$OUT" "while read"
+
+# Test 9: xargs without -P (serial xargs is safe) — pass through
+run_and_capture '{"tool_input":{"command":"cat list.txt | xargs grep foo"}}'
+assert_exit "xargs serial pass" "$LAST_RC" "0"
+
+# Test 10: parallel without -j — blocked
+run_and_capture '{"tool_input":{"command":"ls | parallel wc -l"}}'
+assert_exit "parallel no -j blocked" "$LAST_RC" "2"
+OUT=$(run_hook '{"tool_input":{"command":"ls | parallel wc -l"}}')
+assert_contains "parallel advisory" "$OUT" "parallel"
+assert_contains "parallel suggests -j" "$OUT" "parallel -j 8"
+
+# Test 11: parallel -j 4 — pass through (already bounded)
+run_and_capture '{"tool_input":{"command":"ls | parallel -j 4 wc -l"}}'
+assert_exit "parallel -j N pass" "$LAST_RC" "0"
+
+# Test 12: make -j (no number) — blocked
+run_and_capture '{"tool_input":{"command":"make -j all"}}'
+assert_exit "make -j blocked" "$LAST_RC" "2"
+OUT=$(run_hook '{"tool_input":{"command":"make -j all"}}')
+assert_contains "make -j advisory" "$OUT" "make -j without N"
+
+# Test 13: make -j4 — pass through
+run_and_capture '{"tool_input":{"command":"make -j4 all"}}'
+assert_exit "make -j4 pass" "$LAST_RC" "0"
+
+# Test 14: make -j 8 — pass through
+run_and_capture '{"tool_input":{"command":"make -j 8 all"}}'
+assert_exit "make -j 8 pass" "$LAST_RC" "0"
+
+# Test 15: seq 1000 piped to while — blocked (while-read pattern fires first, which is the correct earlier-pattern preemption)
+run_and_capture '{"tool_input":{"command":"seq 1000 | while read i; do echo $i; done"}}'
+assert_exit "seq 1000 to while blocked" "$LAST_RC" "2"
+OUT=$(run_hook '{"tool_input":{"command":"seq 1000 | while read i; do echo $i; done"}}')
+assert_contains "seq+while-read pattern names while" "$OUT" "while read"
+
+# Test 15b: seq 1000 piped to xargs serial — pattern 7 fires (no while-read precursor)
+# Note: seq + xargs is actually serial xargs (no -P), so it passes through.
+# To test pattern 7 in isolation we need a high-N seq without earlier-matching patterns.
+# An unusual but valid case: seq 1000 piped directly to a parallel command.
+run_and_capture '{"tool_input":{"command":"seq 1000 | parallel echo"}}'
+# This hits parallel-without-j pattern first.
+assert_exit "seq 1000 to parallel blocked" "$LAST_RC" "2"
+
+# Test 16: seq 5 piped to while — pass through (N <= 100)
+run_and_capture '{"tool_input":{"command":"seq 5 | while read i; do echo $i; done"}}'
+# Note: this one will hit while read pattern first; let's verify
+# The 'while read' check is earlier than seq, so seq is unreachable for low N.
+# But the while-read check is still active. Both should result in block.
+assert_exit "seq 5 to while still blocked by while pattern" "$LAST_RC" "2"
+
+# Test 17: seq 5 piped to xargs — pass through (serial xargs)
+run_and_capture '{"tool_input":{"command":"seq 5 | xargs echo"}}'
+assert_exit "seq 5 to xargs pass" "$LAST_RC" "0"
+
+# Test 18: DISABLE env suppresses all checks
+run_and_capture '{"tool_input":{"command":"find . -exec rm {} +"}}' CC_BASH_FANOUT_DISABLE=1
+assert_exit "disable env pass" "$LAST_RC" "0"
+
+# Test 19: OVERRIDE env allows one fan-out call
+run_and_capture '{"tool_input":{"command":"find . -exec rm {} +"}}' CC_BASH_FANOUT_OVERRIDE=1
+assert_exit "override env pass" "$LAST_RC" "0"
+
+# Test 20: PARALLEL_BOUND env changes suggested rewrite
+OUT=$(run_hook '{"tool_input":{"command":"find . -exec rm {} +"}}' CC_BASH_FANOUT_PARALLEL_BOUND=4)
+assert_contains "custom bound 4 in rewrite" "$OUT" "xargs -0 -P 4"
+
+# Test 21: malformed JSON — fail-open
+run_and_capture 'not-json'
+assert_exit "malformed input pass" "$LAST_RC" "0"
+
+# Test 22: missing tool_input — fail-open
+run_and_capture '{"other":"field"}'
+assert_exit "missing tool_input pass" "$LAST_RC" "0"
+
+# Test 23: empty command — fail-open
+run_and_capture '{"tool_input":{"command":""}}'
+assert_exit "empty command pass" "$LAST_RC" "0"
+
+# Test 24: advisory references PreToolUse layer vs cgroup
+OUT=$(run_hook '{"tool_input":{"command":"find . -exec rm {} +"}}')
+assert_contains "advisory names cgroup layer" "$OUT" "cgroup TasksMax"
+assert_contains "advisory explains layer choice" "$OUT" "rendering the tool useless"
+assert_contains "advisory gives override path" "$OUT" "CC_BASH_FANOUT_OVERRIDE=1"
+
+# Test 25: regular git commands pass through
+run_and_capture '{"tool_input":{"command":"git status"}}'
+assert_exit "git status pass" "$LAST_RC" "0"
+run_and_capture '{"tool_input":{"command":"git log --oneline -10"}}'
+assert_exit "git log pass" "$LAST_RC" "0"
+
+# Test 26: rm without fan-out passes through (deny is a different hook's job)
+run_and_capture '{"tool_input":{"command":"rm /tmp/file.txt"}}'
+assert_exit "rm simple pass" "$LAST_RC" "0"
+
+# Test 27: xargs -P 4 — pass through (already bounded)
+run_and_capture '{"tool_input":{"command":"cat list.txt | xargs -P 4 -n 1 process"}}'
+assert_exit "xargs -P 4 pass" "$LAST_RC" "0"
+
+# Test 28: find without -exec — pass through (find itself is fine)
+run_and_capture '{"tool_input":{"command":"find . -name *.py"}}'
+assert_exit "find without exec pass" "$LAST_RC" "0"
+
+# Test 29: find piped to xargs -P — pass through
+run_and_capture '{"tool_input":{"command":"find . -name *.py -print0 | xargs -0 -P 8 wc -l"}}'
+assert_exit "find piped to xargs -P pass" "$LAST_RC" "0"
+
+# Test 30: error message contains all four required sections
+OUT=$(run_hook '{"tool_input":{"command":"find . -exec rm {} +"}}')
+assert_contains "error has detection block" "$OUT" "Unbounded fan-out detected"
+assert_contains "error has rewrite block" "$OUT" "Bounded rewrite:"
+assert_contains "error has override path" "$OUT" "Override for this one call"
+assert_contains "error has disable path" "$OUT" "Disable entirely"
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" = "0" ] && exit 0 || exit 1

package/tests/test-bash-project-fence.sh

@@ -0,0 +1,127 @@
+#!/bin/bash
+# Tests for bash-project-fence.sh
+HOOK="$(dirname "$0")/../examples/bash-project-fence.sh"
+PASS=0 FAIL=0
+
+# Set up a fake project root in /tmp (already in default allow list, so we
+# override CC_BASH_FENCE_ALLOW empty in tests that need /tmp as project root)
+PROJECT_ROOT="/tmp/test-bash-project-fence-$$"
+mkdir -p "$PROJECT_ROOT/src"
+mkdir -p "$PROJECT_ROOT/docs"
+trap 'rm -rf "$PROJECT_ROOT"' EXIT
+
+run_test() {
+  local desc="$1" expected_exit="$2" cmd="$3"
+  shift 3
+  local actual_exit
+  echo "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":$(printf '%s' "$cmd" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))')}}" \
+    | env CLAUDE_PROJECT_DIR="$PROJECT_ROOT" "$@" bash "$HOOK" >/dev/null 2>/dev/null
+  actual_exit=$?
+  if [ "$actual_exit" -eq "$expected_exit" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS+1))
+  else
+    echo "  FAIL: $desc (expected exit $expected_exit, got $actual_exit)"
+    FAIL=$((FAIL+1))
+  fi
+}
+
+echo "Testing bash-project-fence.sh"
+echo "============================="
+
+# 1. Empty command — pass
+run_test "empty command passes" 0 ""
+
+# 2. Relative path — pass (no absolute path tokens)
+run_test "relative path passes" 0 "cat src/file.txt"
+
+# 3. Absolute path inside project root — pass
+run_test "absolute path inside project root passes" 0 "cat ${PROJECT_ROOT}/src/file.txt"
+
+# 4. find inside project root — pass
+run_test "find inside project root passes" 0 "find ${PROJECT_ROOT}/src -name '*.py'"
+
+# 5. /tmp path — pass (default allow list includes /tmp)
+run_test "/tmp path passes (default allow)" 0 "cat /tmp/something.txt"
+
+# 6. /dev/null — pass (default allow list)
+run_test "/dev/null passes (default allow)" 0 "command > /dev/null 2>&1"
+
+# 7. Issue #56739 reproduction: find across Desktop — BLOCK
+run_test "find across /Users Desktop blocks (#56739)" 2 \
+  "find /Users/admin/Desktop -name '*.png'"
+
+# 8. cat outside project — BLOCK
+run_test "cat /etc/passwd blocks" 2 "cat /etc/passwd"
+
+# 9. cp outside project — BLOCK (source outside)
+run_test "cp /etc/hosts to project blocks" 2 \
+  "cp /etc/hosts ${PROJECT_ROOT}/hosts.bak"
+
+# 10. cp to outside project — BLOCK (destination outside)
+run_test "cp project to /etc blocks" 2 \
+  "cp ${PROJECT_ROOT}/file.txt /etc/file.txt"
+
+# 11. ls outside project — BLOCK
+run_test "ls /home/user/Documents blocks" 2 "ls /home/user/Documents"
+
+# 12. grep outside project — BLOCK
+run_test "grep on /var/log blocks" 2 "grep error /var/log/syslog"
+
+# 13. Multiple paths, one outside — BLOCK
+run_test "command with mixed paths blocks if any outside" 2 \
+  "cp ${PROJECT_ROOT}/a /home/other/b"
+
+# 14. CC_BASH_FENCE_ALLOW expansion allows specific path
+run_test "CC_BASH_FENCE_ALLOW permits specified path" 0 \
+  "cat /home/user/config.json" CC_BASH_FENCE_ALLOW="/home/user"
+
+# 15. CC_BASH_FENCE_ACTION=warn returns 0 even when outside
+run_test "warn action passes (exit 0) but emits warning" 0 \
+  "cat /etc/passwd" CC_BASH_FENCE_ACTION=warn
+
+# 16. CC_BASH_FENCE_OFF=1 disables hook
+run_test "CC_BASH_FENCE_OFF=1 disables hook" 0 \
+  "cat /etc/passwd" CC_BASH_FENCE_OFF=1
+
+# 17. Tilde expansion to $HOME outside project
+run_test "tilde-expanded HOME outside project blocks" 2 \
+  "cat ~/Desktop/secret.png"
+
+# 18. URL is skipped (not treated as path)
+run_test "URL with absolute path scheme is skipped" 0 \
+  "curl https://example.com/api"
+
+# 19. Flag-like absolute argument is NOT skipped if it resolves outside.
+# This is a documented limitation — operators should not use absolute paths
+# as flag values pointing outside the project. The hook errs on the side of
+# blocking. We assert the block here for clarity.
+run_test "absolute path as command argument always checked" 2 \
+  "find / -type f -name '*.key'"
+
+# 20. find with -path option inside project — pass
+run_test "find with relative -path option passes" 0 \
+  "find ${PROJECT_ROOT} -path '*/docs/*'"
+
+# 21. Output redirect target outside project — BLOCK
+run_test "output redirect to /etc blocks" 2 \
+  "echo data > /etc/somefile"
+
+# 22. /proc/self/fd is in default allow list
+run_test "/proc/self/fd passes (default allow)" 0 \
+  "cat /proc/self/fd/0"
+
+# 23. Trailing slash on outside path — BLOCK
+run_test "trailing-slash outside path blocks" 2 "ls /home/user/"
+
+# 24. Quoted absolute path outside — BLOCK (after quote strip)
+run_test "quoted outside path blocks" 2 \
+  "cat \"/var/log/secure\""
+
+# 25. Path with .. that resolves outside — BLOCK
+run_test "../traversal to outside blocks" 2 \
+  "cat ${PROJECT_ROOT}/../../../etc/passwd"
+
+echo
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/test-bg-permission-prompt-warner.sh

@@ -0,0 +1,221 @@
+#!/bin/bash
+# test-bg-permission-prompt-warner.sh — Tests for bg-permission-prompt-warner.sh
+
+set -u
+
+HOOK="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/examples/bg-permission-prompt-warner.sh"
+
+PASS=0
+FAIL=0
+FAILED_TESTS=()
+
+run_test() {
+    local name="$1"
+    local expected_exit="$2"
+    local expected_pattern="$3"
+    shift 3
+    local stderr_file
+    stderr_file=$(mktemp)
+    local actual_exit
+    "$@" 2>"$stderr_file"
+    actual_exit=$?
+    local stderr_content
+    stderr_content=$(cat "$stderr_file")
+    rm -f "$stderr_file"
+
+    local exit_ok=false
+    if [[ "$actual_exit" == "$expected_exit" ]]; then
+        exit_ok=true
+    fi
+
+    local pattern_ok=false
+    if [[ -z "$expected_pattern" ]]; then
+        if [[ -z "$stderr_content" ]]; then
+            pattern_ok=true
+        fi
+    elif [[ "$expected_pattern" == "ANY" ]]; then
+        pattern_ok=true
+    else
+        if echo "$stderr_content" | grep -q "$expected_pattern"; then
+            pattern_ok=true
+        fi
+    fi
+
+    if [[ "$exit_ok" == "true" && "$pattern_ok" == "true" ]]; then
+        echo "✓ $name"
+        PASS=$((PASS + 1))
+    else
+        echo "✗ $name (exit: $actual_exit/$expected_exit, pattern: ${expected_pattern})"
+        if [[ -n "$stderr_content" ]]; then
+            echo "  stderr: $(echo "$stderr_content" | head -3 | tr '\n' ' ')"
+        fi
+        FAIL=$((FAIL + 1))
+        FAILED_TESTS+=("$name")
+    fi
+}
+
+STATE_DIR=$(mktemp -d)
+export CC_BG_WARN_STATE_DIR="$STATE_DIR"
+
+# Test 1: Disable switch
+run_test "disable switch silences hook" \
+    "0" "" \
+    env CC_BG_WARN_DISABLE=1 \
+        CC_BG_WARN_FORCE=1 \
+        CC_BG_WARN_SESSION_ID=test1 \
+        bash "$HOOK"
+
+# Test 2: Quiet mode emits nothing
+run_test "quiet mode emits nothing" \
+    "0" "" \
+    env CC_BG_WARN_QUIET=1 \
+        CC_BG_WARN_FORCE=1 \
+        CC_BG_WARN_SESSION_ID=test2 \
+        bash "$HOOK"
+
+# Test 3: No parent cmd, no force — exits silently
+run_test "no parent cmd no force exits silently" \
+    "0" "" \
+    env -u CC_BG_WARN_FORCE \
+        CC_BG_WARN_PARENT_CMD="" \
+        CC_BG_WARN_SESSION_ID=test3 \
+        bash "$HOOK"
+
+# Test 4: Parent cmd without --bg — exits silently
+run_test "parent cmd without --bg exits silently" \
+    "0" "" \
+    env -u CC_BG_WARN_FORCE \
+        CC_BG_WARN_PARENT_CMD="node /usr/local/bin/claude --print" \
+        CC_BG_WARN_SESSION_ID=test4 \
+        bash "$HOOK"
+
+# Test 5: Parent cmd with --bg — emits advisory
+run_test "parent cmd with --bg emits advisory" \
+    "0" "Cluster 24 axis 24A" \
+    env CC_BG_WARN_PARENT_CMD="node /usr/local/bin/claude --bg --model opus --name test" \
+        CC_BG_WARN_SESSION_ID=test5 \
+        bash "$HOOK"
+
+# Test 6: Parent cmd with --background — emits advisory
+run_test "parent cmd with --background emits advisory" \
+    "0" "Cluster 24 axis 24A" \
+    env CC_BG_WARN_PARENT_CMD="claude --background work" \
+        CC_BG_WARN_SESSION_ID=test6 \
+        bash "$HOOK"
+
+# Test 7: Advisory references anchor #64271
+run_test "advisory references #64271" \
+    "0" "64271" \
+    env CC_BG_WARN_PARENT_CMD="claude --bg work" \
+        CC_BG_WARN_SESSION_ID=test7 \
+        bash "$HOOK"
+
+# Test 8: Advisory mentions acceptEdits
+run_test "advisory mentions acceptEdits" \
+    "0" "acceptEdits" \
+    env CC_BG_WARN_PARENT_CMD="claude --bg" \
+        CC_BG_WARN_SESSION_ID=test8 \
+        bash "$HOOK"
+
+# Test 9: Advisory mentions the three sibling axes
+run_test "advisory mentions 24B sibling axis" \
+    "0" "24B" \
+    env CC_BG_WARN_PARENT_CMD="claude --bg" \
+        CC_BG_WARN_SESSION_ID=test9 \
+        bash "$HOOK"
+
+run_test "advisory mentions 24C sibling axis" \
+    "0" "24C" \
+    env CC_BG_WARN_PARENT_CMD="claude --bg" \
+        CC_BG_WARN_SESSION_ID=test9c \
+        bash "$HOOK"
+
+run_test "advisory mentions 24D sibling axis" \
+    "0" "24D" \
+    env CC_BG_WARN_PARENT_CMD="claude --bg" \
+        CC_BG_WARN_SESSION_ID=test9d \
+        bash "$HOOK"
+
+# Test 10: One-shot per session — second invocation does not re-fire
+env CC_BG_WARN_PARENT_CMD="claude --bg" \
+    CC_BG_WARN_SESSION_ID=test10 \
+    bash "$HOOK" 2>/dev/null
+run_test "second invocation does not re-fire" \
+    "0" "" \
+    env CC_BG_WARN_PARENT_CMD="claude --bg" \
+        CC_BG_WARN_SESSION_ID=test10 \
+        bash "$HOOK"
+
+# Test 11: Force flag bypasses parent detection
+run_test "FORCE flag emits without parent cmdline match" \
+    "0" "Cluster 24 axis 24A" \
+    env CC_BG_WARN_FORCE=1 \
+        CC_BG_WARN_PARENT_CMD="" \
+        CC_BG_WARN_SESSION_ID=test11 \
+        bash "$HOOK"
+
+# Test 12: Different session id fires independently
+run_test "different session id fires independently" \
+    "0" "Cluster 24 axis 24A" \
+    env CC_BG_WARN_PARENT_CMD="claude --bg" \
+        CC_BG_WARN_SESSION_ID=test12 \
+        bash "$HOOK"
+
+# Test 13: Quiet mode still marks guard
+env CC_BG_WARN_QUIET=1 \
+    CC_BG_WARN_FORCE=1 \
+    CC_BG_WARN_SESSION_ID=test13 \
+    bash "$HOOK"
+run_test "quiet mode marks guard so non-quiet later does not fire" \
+    "0" "" \
+    env CC_BG_WARN_FORCE=1 \
+        CC_BG_WARN_SESSION_ID=test13 \
+        bash "$HOOK"
+
+# Test 14: Advisory references disable env var
+run_test "advisory mentions CC_BG_WARN_DISABLE" \
+    "0" "CC_BG_WARN_DISABLE" \
+    env CC_BG_WARN_PARENT_CMD="claude --bg" \
+        CC_BG_WARN_SESSION_ID=test14 \
+        bash "$HOOK"
+
+# Test 15: Substring match in middle of cmdline
+run_test "--bg in middle of cmdline matches" \
+    "0" "Cluster 24 axis 24A" \
+    env CC_BG_WARN_PARENT_CMD="env FOO=bar node claude --bg --model opus extra-args" \
+        CC_BG_WARN_SESSION_ID=test15 \
+        bash "$HOOK"
+
+# Test 16: --bgwhatever should NOT match (word boundary)
+run_test "--bgsomething does not falsely match" \
+    "0" "" \
+    env -u CC_BG_WARN_FORCE \
+        CC_BG_WARN_PARENT_CMD="claude --bgsomething-suffix" \
+        CC_BG_WARN_SESSION_ID=test16 \
+        bash "$HOOK"
+
+# Test 17: Advisory references workaround steps
+run_test "advisory includes terminal-attached workaround" \
+    "0" "terminal attached" \
+    env CC_BG_WARN_PARENT_CMD="claude --bg" \
+        CC_BG_WARN_SESSION_ID=test17 \
+        bash "$HOOK"
+
+# Test 18: Advisory mentions audit tool-call distribution workaround
+run_test "advisory mentions tool-call distribution audit" \
+    "0" "tool-call distribution" \
+    env CC_BG_WARN_PARENT_CMD="claude --bg" \
+        CC_BG_WARN_SESSION_ID=test18 \
+        bash "$HOOK"
+
+# Cleanup
+rm -rf "$STATE_DIR"
+
+echo ""
+echo "─────────────────────────────"
+echo "Tests: $((PASS + FAIL)) | Pass: $PASS | Fail: $FAIL"
+if [[ $FAIL -gt 0 ]]; then
+    echo "Failed: ${FAILED_TESTS[*]}"
+    exit 1
+fi
+exit 0