cc-safe-setup 29.8.0 → 30.0.4

package/tests/test-cowork-fuse-staleness-watcher.sh

@@ -0,0 +1,287 @@
+#!/bin/bash
+# Tests for cowork-fuse-staleness-watcher.sh
+set -euo pipefail
+
+HOOK="$(dirname "$0")/../examples/cowork-fuse-staleness-watcher.sh"
+PASS=0
+FAIL=0
+
+run_hook() {
+    local cmd="$1"
+    local cwd="${2:-/home/user/project}"
+    local payload
+    payload=$(jq -nc --arg cmd "$cmd" --arg cwd "$cwd" \
+        '{tool_name:"Bash", tool_input:{command:$cmd}, cwd:$cwd}')
+    echo "$payload" | bash "$HOOK" 2>&1 || true
+}
+
+# --- Test 1: Warns for git status in Cowork FUSE mount ---
+output=$(run_hook "git status" "/sessions/abc123/mnt/havasu-chat")
+if echo "$output" | grep -q "Cowork FUSE mount detected"; then
+    echo "  PASS: warns for git status in FUSE mount"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should warn for git status in FUSE mount"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 2: Warns for git add in Cowork FUSE mount ---
+output=$(run_hook "git add ." "/sessions/xyz789/mnt/myrepo")
+if echo "$output" | grep -q "Cowork FUSE mount detected"; then
+    echo "  PASS: warns for git add in FUSE mount"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should warn for git add in FUSE mount"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 3: Warns for git commit in Cowork FUSE mount ---
+output=$(run_hook "git commit -m test" "/sessions/v43/mnt/havasu-chat")
+if echo "$output" | grep -q "Cowork FUSE mount detected"; then
+    echo "  PASS: warns for git commit in FUSE mount"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should warn for git commit in FUSE mount"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 4: Silent for git rev-parse (ref-only, safe under wedge) ---
+output=$(run_hook "git rev-parse HEAD" "/sessions/abc/mnt/repo")
+if [ -z "$output" ]; then
+    echo "  PASS: silent for git rev-parse (ref-only ops are safe)"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should not warn for git rev-parse: $output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 5: Silent for git log (ref-only) ---
+output=$(run_hook "git log --oneline -5" "/sessions/abc/mnt/repo")
+if [ -z "$output" ]; then
+    echo "  PASS: silent for git log (ref-only)"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should not warn for git log: $output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 6: Silent for non-git commands in FUSE mount ---
+output=$(run_hook "ls -la" "/sessions/abc/mnt/repo")
+if [ -z "$output" ]; then
+    echo "  PASS: silent for non-git command in FUSE mount"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should not warn for non-git command"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 7: Silent for git status OUTSIDE FUSE mount ---
+output=$(run_hook "git status" "/home/user/normal-project")
+if [ -z "$output" ]; then
+    echo "  PASS: silent for git status outside FUSE mount"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should not warn outside FUSE mount: $output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 8: Warns when FUSE path appears in command (not cwd) ---
+output=$(run_hook "git -C /sessions/abc/mnt/repo status" "/home/user")
+if echo "$output" | grep -q "Cowork FUSE mount detected"; then
+    echo "  PASS: warns when FUSE path is in command argument"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should warn when FUSE path in command"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 9: References issue #62932 ---
+output=$(run_hook "git status" "/sessions/abc/mnt/repo")
+if echo "$output" | grep -q "#62932"; then
+    echo "  PASS: references #62932"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should reference #62932"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 10: Mentions ref-walking as safe alternative ---
+output=$(run_hook "git status" "/sessions/abc/mnt/repo")
+if echo "$output" | grep -q "ref-walking"; then
+    echo "  PASS: mentions ref-walking as safe alternative"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should mention ref-walking"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 11: Mentions Read/Edit/Write tools as authoritative ---
+output=$(run_hook "git status" "/sessions/abc/mnt/repo")
+if echo "$output" | grep -qE "Read.*Edit.*Write|first-class file tools"; then
+    echo "  PASS: mentions Read/Edit/Write tools"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should mention first-class file tools"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 12: CC_COWORK_FUSE_QUIET suppresses recommendation block ---
+payload=$(jq -nc --arg cmd "git status" --arg cwd "/sessions/abc/mnt/repo" \
+    '{tool_name:"Bash", tool_input:{command:$cmd}, cwd:$cwd}')
+output=$(echo "$payload" | CC_COWORK_FUSE_QUIET=1 bash "$HOOK" 2>&1 || true)
+if echo "$output" | grep -q "Recommended:"; then
+    echo "  FAIL: CC_COWORK_FUSE_QUIET=1 should suppress recommendation"
+    FAIL=$((FAIL + 1))
+else
+    echo "  PASS: CC_COWORK_FUSE_QUIET=1 suppresses recommendation"
+    PASS=$((PASS + 1))
+fi
+
+# --- Test 13: Recommendation shows by default ---
+output=$(run_hook "git status" "/sessions/abc/mnt/repo")
+if echo "$output" | grep -q "Recommended:"; then
+    echo "  PASS: recommendation shown by default"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should show recommendation by default"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 14: Custom CC_COWORK_FUSE_PATTERN override ---
+payload=$(jq -nc --arg cmd "git status" --arg cwd "/custom/mount/repo" \
+    '{tool_name:"Bash", tool_input:{command:$cmd}, cwd:$cwd}')
+output=$(echo "$payload" | CC_COWORK_FUSE_PATTERN="/custom/mount/" bash "$HOOK" 2>&1 || true)
+if echo "$output" | grep -q "Cowork FUSE mount detected"; then
+    echo "  PASS: custom CC_COWORK_FUSE_PATTERN works"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should respect custom pattern"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 15: Always exits 0 (advisory only) ---
+echo "$payload" | bash "$HOOK" >/dev/null 2>&1
+status=$?
+if [ "$status" = "0" ]; then
+    echo "  PASS: exits 0 when fires (advisory only)"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should exit 0 when fires, got $status"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 16: Exits 0 when silent ---
+payload2=$(jq -nc --arg cmd "ls" --arg cwd "/home/user" \
+    '{tool_name:"Bash", tool_input:{command:$cmd}, cwd:$cwd}')
+echo "$payload2" | bash "$HOOK" >/dev/null 2>&1
+status=$?
+if [ "$status" = "0" ]; then
+    echo "  PASS: exits 0 when silent"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should exit 0 when silent, got $status"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 17: Warns for git stash ---
+output=$(run_hook "git stash" "/sessions/abc/mnt/repo")
+if echo "$output" | grep -q "Cowork FUSE mount detected"; then
+    echo "  PASS: warns for git stash"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should warn for git stash"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 18: Warns for git restore ---
+output=$(run_hook "git restore ." "/sessions/v37/mnt/havasu")
+if echo "$output" | grep -q "Cowork FUSE mount detected"; then
+    echo "  PASS: warns for git restore"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should warn for git restore"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 19: Warns for git checkout -- (path discard) ---
+output=$(run_hook "git checkout -- file.txt" "/sessions/abc/mnt/repo")
+if echo "$output" | grep -q "Cowork FUSE mount detected"; then
+    echo "  PASS: warns for git checkout -- (path discard)"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should warn for git checkout --"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 20: Silent for git checkout <branch> (branch switch, not worktree discard) ---
+output=$(run_hook "git checkout main" "/sessions/abc/mnt/repo")
+# Note: pure branch switch with no '-- ' or '.' is NOT in our matcher list.
+# We deliberately don't warn for this to avoid noise on a routine op.
+if [ -z "$output" ]; then
+    echo "  PASS: silent for git checkout <branch>"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should not warn for branch switch: $output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 21: Mentions .git/config rewrite recovery ---
+output=$(run_hook "git status" "/sessions/abc/mnt/repo")
+if echo "$output" | grep -q ".git/config"; then
+    echo "  PASS: mentions .git/config rewrite recovery"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should mention .git/config recovery"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 22: Log file is written when CC_COWORK_FUSE_LOG set ---
+LOG_FILE=$(mktemp /tmp/test-cowork-fuse-log.XXXXXX)
+rm -f "$LOG_FILE"
+payload=$(jq -nc --arg cmd "git status" --arg cwd "/sessions/abc/mnt/repo" \
+    '{tool_name:"Bash", tool_input:{command:$cmd}, cwd:$cwd}')
+echo "$payload" | CC_COWORK_FUSE_LOG="$LOG_FILE" bash "$HOOK" >/dev/null 2>&1
+if [ -f "$LOG_FILE" ] && grep -q "git status" "$LOG_FILE"; then
+    echo "  PASS: writes log entry when CC_COWORK_FUSE_LOG set"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: log file should contain entry"
+    FAIL=$((FAIL + 1))
+fi
+rm -f "$LOG_FILE"
+
+# --- Test 23: Handles missing tool_input gracefully ---
+output=$(echo '{"tool_name":"Bash"}' | bash "$HOOK" 2>&1 || true)
+if [ -z "$output" ]; then
+    echo "  PASS: silent for missing tool_input"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should be silent for missing tool_input: $output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 24: Documents PreToolUse + Bash matcher ---
+if grep -q "PreToolUse" "$HOOK" && grep -q "Bash" "$HOOK"; then
+    echo "  PASS: documents PreToolUse + Bash matcher"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should document PreToolUse + Bash"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 25: Header documents the SELECTIVE wedge nature ---
+if grep -qi "selective" "$HOOK"; then
+    echo "  PASS: hook header documents selective wedge"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: header should describe selective wedge"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Summary ---
+echo ""
+echo "Tests: $((PASS + FAIL)) total, $PASS passed, $FAIL failed"
+
+if [ "$FAIL" -gt 0 ]; then
+    exit 1
+fi

package/tests/test-cowork-hook-absence-warner.sh

@@ -0,0 +1,230 @@
+#!/bin/bash
+# Tests for cowork-hook-absence-warner.sh
+HOOK="examples/cowork-hook-absence-warner.sh"
+PASS=0 FAIL=0
+TMPDIR=$(mktemp -d)
+trap "rm -rf $TMPDIR" EXIT
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+HOOK_ABS="$PWD/$HOOK"
+fresh_paths() {
+    local s="$TMPDIR/settings-$$-$RANDOM-$RANDOM.json"
+    local d="$TMPDIR/state-$$-$RANDOM-$RANDOM"
+    mkdir -p "$d"
+    echo "$s|$d"
+}
+
+run_hook() {
+    local settings="$1" state_dir="$2"
+    shift 2
+    local out rc
+    if [ "$#" -eq 0 ]; then
+        out=$(env -u CC_COWORK_WARNER_DISABLE \
+                  -u CC_COWORK_WARNER_DATE \
+                  -u CC_COWORK_WARNER_MIN_HOOKS \
+                  CC_COWORK_WARNER_SETTINGS="$settings" \
+                  CC_COWORK_WARNER_STATE_DIR="$state_dir" \
+                  bash "$HOOK_ABS" 2>&1)
+    else
+        out=$(env -u CC_COWORK_WARNER_DISABLE \
+                  -u CC_COWORK_WARNER_DATE \
+                  -u CC_COWORK_WARNER_MIN_HOOKS \
+                  CC_COWORK_WARNER_SETTINGS="$settings" \
+                  CC_COWORK_WARNER_STATE_DIR="$state_dir" "$@" \
+                  bash "$HOOK_ABS" 2>&1)
+    fi
+    rc=$?
+    echo "$out"
+    return $rc
+}
+
+# Test 1: No settings file → silent.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+OUT=$(run_hook "$S" "$D"); RC=$?
+assert_not_contains "no settings silent" "$OUT" "NOTE"
+assert_exit "no settings exit 0" "$RC" "0"
+
+# Test 2: Empty hooks block → silent.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{}}' > "$S"
+OUT=$(run_hook "$S" "$D"); RC=$?
+assert_not_contains "empty hooks silent" "$OUT" "NOTE"
+assert_exit "empty hooks exit 0" "$RC" "0"
+
+# Test 3: Settings file with 1 hook → emits NOTE.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"echo"}]}]}}' > "$S"
+OUT=$(run_hook "$S" "$D"); RC=$?
+assert_contains "1 hook emits NOTE" "$OUT" "NOTE"
+assert_contains "1 hook mentions count" "$OUT" "1"
+assert_contains "1 hook mentions 11E" "$OUT" "11E"
+assert_exit "1 hook exit 0" "$RC" "0"
+
+# Test 4: Settings file with 5 hooks across events → count of 5.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+cat > "$S" <<'JSON'
+{
+  "hooks": {
+    "SessionStart": [{"matcher":"","hooks":[{"type":"command","command":"a"}]}],
+    "UserPromptSubmit": [{"matcher":"","hooks":[{"type":"command","command":"b"}]}],
+    "Stop": [{"matcher":"","hooks":[{"type":"command","command":"c"}]}],
+    "PreToolUse": [{"matcher":"","hooks":[{"type":"command","command":"d"}]}],
+    "PostToolUse": [{"matcher":"","hooks":[{"type":"command","command":"e"}]}]
+  }
+}
+JSON
+OUT=$(run_hook "$S" "$D"); RC=$?
+assert_contains "5 hooks emits NOTE" "$OUT" "NOTE"
+assert_contains "5 hooks mentions count 5" "$OUT" "5 CLI hooks"
+assert_exit "5 hooks exit 0" "$RC" "0"
+
+# Test 5: Disable kill switch.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"echo"}]}]}}' > "$S"
+OUT=$(run_hook "$S" "$D" CC_COWORK_WARNER_DISABLE=1); RC=$?
+assert_not_contains "disable suppresses NOTE" "$OUT" "NOTE"
+assert_exit "disable exit 0" "$RC" "0"
+
+# Test 6: One-shot per calendar day — second run same day is silent.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"echo"}]}]}}' > "$S"
+OUT1=$(run_hook "$S" "$D" CC_COWORK_WARNER_DATE=2026-05-31)
+OUT2=$(run_hook "$S" "$D" CC_COWORK_WARNER_DATE=2026-05-31); RC2=$?
+assert_contains "first run emits NOTE" "$OUT1" "NOTE"
+assert_not_contains "second run same day silent" "$OUT2" "NOTE"
+assert_exit "second run exit 0" "$RC2" "0"
+
+# Test 7: Next day → fires again.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"echo"}]}]}}' > "$S"
+run_hook "$S" "$D" CC_COWORK_WARNER_DATE=2026-05-31 > /dev/null
+OUT=$(run_hook "$S" "$D" CC_COWORK_WARNER_DATE=2026-06-01); RC=$?
+assert_contains "next day fires again" "$OUT" "NOTE"
+assert_exit "next day exit 0" "$RC" "0"
+
+# Test 8: MIN_HOOKS threshold raises bar.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"echo"}]}]}}' > "$S"
+OUT=$(run_hook "$S" "$D" CC_COWORK_WARNER_MIN_HOOKS=5); RC=$?
+assert_not_contains "below threshold silent" "$OUT" "NOTE"
+assert_exit "below threshold exit 0" "$RC" "0"
+
+# Test 9: Malformed JSON → silent (jq fails).
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{not valid json' > "$S"
+OUT=$(run_hook "$S" "$D"); RC=$?
+assert_not_contains "malformed JSON silent" "$OUT" "NOTE"
+assert_exit "malformed JSON exit 0" "$RC" "0"
+
+# Test 10: NOTE mentions the three workarounds.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"a"}]}],"PreToolUse":[{"matcher":"","hooks":[{"type":"command","command":"b"}]}]}}' > "$S"
+OUT=$(run_hook "$S" "$D")
+assert_contains "advisory mentions Delay Cowork" "$OUT" "Delay Cowork"
+assert_contains "advisory mentions Manual execution" "$OUT" "Manual execution"
+assert_contains "advisory mentions CLI-only" "$OUT" "CLI-only"
+
+# Test 11: NOTE references issues #63360 and #63047.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"a"}]}]}}' > "$S"
+OUT=$(run_hook "$S" "$D")
+assert_contains "advisory cites #63360" "$OUT" "63360"
+assert_contains "advisory cites #63047" "$OUT" "63047"
+
+# Test 12: NOTE references cluster-tracker URL.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"a"}]}]}}' > "$S"
+OUT=$(run_hook "$S" "$D")
+assert_contains "advisory points at cluster-tracker" "$OUT" "cluster-tracker"
+
+# Test 13: Hook never blocks.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"a"}]}]}}' > "$S"
+OUT=$(run_hook "$S" "$D"); RC=$?
+assert_exit "advisory never blocks" "$RC" "0"
+
+# Test 14: Stop hooks count toward total.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+cat > "$S" <<'JSON'
+{
+  "hooks": {
+    "Stop": [{"matcher":"","hooks":[{"type":"command","command":"a"},{"type":"command","command":"b"},{"type":"command","command":"c"}]}]
+  }
+}
+JSON
+OUT=$(run_hook "$S" "$D")
+assert_contains "Stop array counts" "$OUT" "3 CLI hooks"
+
+# Test 15: PostToolUse hooks count.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"PostToolUse":[{"matcher":"","hooks":[{"type":"command","command":"a"}]}]}}' > "$S"
+OUT=$(run_hook "$S" "$D")
+assert_contains "PostToolUse counts" "$OUT" "1 CLI hook"
+
+# Test 16: Concurrent invocations don't trample each other.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"a"}]}]}}' > "$S"
+PIDS=()
+for i in 1 2 3 4 5; do
+    (run_hook "$S" "$D-$i" > /dev/null 2>&1) &
+    PIDS+=($!)
+done
+ALL_OK=1
+for pid in "${PIDS[@]}"; do
+    wait "$pid" || ALL_OK=0
+done
+if [ "$ALL_OK" = "1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: concurrent invocations"; fi
+
+# Test 17: Settings file values are NEVER echoed back (privacy).
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+cat > "$S" <<'JSON'
+{
+  "hooks": {
+    "SessionStart": [{"matcher":"","hooks":[{"type":"command","command":"echo SECRET_PROJECT_NAME"}]}]
+  }
+}
+JSON
+OUT=$(run_hook "$S" "$D")
+assert_not_contains "secret command never echoed" "$OUT" "SECRET_PROJECT_NAME"
+
+# Test 18: Hook event names are NOT echoed back individually (privacy).
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"echo"}]}]}}' > "$S"
+OUT=$(run_hook "$S" "$D")
+# The advisory lists event names statically (mentions UserPromptSubmit, Stop,
+# etc.) but does not enumerate which specific events the operator has configured.
+# This test ensures we list the standard set, not the operator-specific list.
+assert_contains "static event list mentions UserPromptSubmit" "$OUT" "UserPromptSubmit"
+
+# Test 19: NOTE explains the disable command.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"hooks":{"SessionStart":[{"matcher":"","hooks":[{"type":"command","command":"a"}]}]}}' > "$S"
+OUT=$(run_hook "$S" "$D")
+assert_contains "disable command shown" "$OUT" "CC_COWORK_WARNER_DISABLE=1"
+
+# Test 20: Settings with non-hooks fields don't affect count.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+cat > "$S" <<'JSON'
+{
+  "model": "claude-opus-4-7",
+  "permissions": {"defaultMode": "default"},
+  "hooks": {
+    "SessionStart": [{"matcher":"","hooks":[{"type":"command","command":"a"}]}]
+  }
+}
+JSON
+OUT=$(run_hook "$S" "$D")
+assert_contains "other fields ignored, count=1" "$OUT" "1 CLI hook"
+
+# Test 21: No hooks key at all → silent.
+PATHS=$(fresh_paths); S=${PATHS%|*}; D=${PATHS#*|}
+echo '{"model":"claude-opus-4-7"}' > "$S"
+OUT=$(run_hook "$S" "$D")
+assert_not_contains "no hooks key silent" "$OUT" "NOTE"
+
+echo
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" = "0" ] || exit 1