cc-safe-setup 29.8.0 → 30.0.4

package/tests/test-dotenv-anthropic-key-billing-guard.sh

@@ -0,0 +1,160 @@
+#!/bin/bash
+# Tests for dotenv-anthropic-key-billing-guard.sh
+
+# 絶対パスにする。テスト20はcd後にhookを実行するため、相対パスだと解決できずfalse negativeになる
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/examples/dotenv-anthropic-key-billing-guard.sh"
+PASS=0 FAIL=0
+
+# Use a unique tmpdir per test run
+TMPROOT="$(mktemp -d -t cc-dotenv-ak-test.XXXXXX)"
+trap 'rm -rf "$TMPROOT"' EXIT
+
+run_test() {
+  local desc="$1" expected_exit="$2" envfile="$3" content="$4" extra_env="$5"
+  local dir="$TMPROOT/$RANDOM-$RANDOM"
+  mkdir -p "$dir"
+  if [ -n "$envfile" ]; then
+    printf '%s' "$content" > "$dir/$envfile"
+  fi
+  local logfile="$dir/log"
+  local actual_exit
+  if [ -n "$extra_env" ]; then
+    env CLAUDE_PROJECT_DIR="$dir" CC_DOTENV_AK_LOG="$logfile" $extra_env bash "$HOOK" >/dev/null 2>/dev/null
+  else
+    env CLAUDE_PROJECT_DIR="$dir" CC_DOTENV_AK_LOG="$logfile" bash "$HOOK" >/dev/null 2>/dev/null
+  fi
+  actual_exit=$?
+  if [ "$actual_exit" -eq "$expected_exit" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS+1))
+  else
+    echo "  FAIL: $desc (expected exit $expected_exit, got $actual_exit)"
+    FAIL=$((FAIL+1))
+  fi
+}
+
+echo "Testing dotenv-anthropic-key-billing-guard.sh"
+echo "=============================================="
+
+# 1. No .env file at all — should pass silently
+run_test "no .env files passes silently" 0 "" ""
+
+# 2. .env without ANTHROPIC_API_KEY — pass
+run_test ".env without ANTHROPIC_API_KEY passes" 0 ".env" "FOO=bar
+DATABASE_URL=postgres://x"
+
+# 3. .env with ANTHROPIC_API_KEY assigned a value — warn (exit 0 default)
+run_test ".env with key (default warn) exits 0" 0 ".env" "ANTHROPIC_API_KEY=sk-ant-real-key"
+
+# 4. .env with ANTHROPIC_API_KEY in block mode — exit 2
+run_test ".env with key in block mode exits 2" 2 ".env" "ANTHROPIC_API_KEY=sk-ant-real-key" "CC_DOTENV_AK_ACTION=block"
+
+# 5. .env with key inside quotes
+run_test '.env with quoted key triggers warn' 0 ".env" 'ANTHROPIC_API_KEY="sk-ant-quoted"'
+
+# 6. .env with key inside single-quotes
+run_test ".env with single-quoted key triggers warn" 0 ".env" "ANTHROPIC_API_KEY='sk-ant-singlequoted'"
+
+# 7. .env with export prefix
+run_test ".env with export prefix triggers warn" 0 ".env" "export ANTHROPIC_API_KEY=sk-ant-exported"
+
+# 8. .env with leading whitespace
+run_test ".env with leading whitespace triggers warn" 0 ".env" "   ANTHROPIC_API_KEY=sk-ant-indented"
+
+# 9. .env with commented-out key — should NOT trigger
+run_test ".env with commented key passes silently" 0 ".env" "# ANTHROPIC_API_KEY=sk-ant-commented
+FOO=bar"
+
+# 10. .env with empty value (intentional override) — should NOT trigger
+run_test ".env with empty key value passes" 0 ".env" "ANTHROPIC_API_KEY="
+
+# 11. .env with empty quoted value — should NOT trigger
+run_test '.env with empty quoted value passes' 0 ".env" 'ANTHROPIC_API_KEY=""'
+
+# 12. .env.local with key — triggers
+run_test ".env.local with key triggers warn" 0 ".env.local" "ANTHROPIC_API_KEY=sk-ant-local"
+
+# 13. .env.production with key — triggers
+run_test ".env.production with key triggers warn" 0 ".env.production" "ANTHROPIC_API_KEY=sk-ant-prod"
+
+# 14. .env.development with key — triggers
+run_test ".env.development with key triggers warn" 0 ".env.development" "ANTHROPIC_API_KEY=sk-ant-dev"
+
+# 15. Unsupported file (.env.staging) ignored by default
+run_test ".env.staging ignored by default" 0 ".env.staging" "ANTHROPIC_API_KEY=sk-ant-staging"
+
+# 16. Custom CC_DOTENV_AK_FILES picks up .env.staging
+run_test "custom file list picks up .env.staging" 0 ".env.staging" "ANTHROPIC_API_KEY=sk-ant-staging" "CC_DOTENV_AK_FILES=.env.staging"
+
+# 17. Warn message goes to stderr
+DIR="$TMPROOT/output-test"
+mkdir -p "$DIR"
+echo "ANTHROPIC_API_KEY=sk-ant-real" > "$DIR/.env"
+OUTPUT=$(env CLAUDE_PROJECT_DIR="$DIR" bash "$HOOK" 2>&1 >/dev/null)
+if echo "$OUTPUT" | grep -q "ANTHROPIC_API_KEY detected"; then
+  echo "  PASS: warn message printed to stderr"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: warn message missing from stderr"
+  FAIL=$((FAIL+1))
+fi
+
+# 18. Stdout stays empty (so SessionStart payload is not corrupted)
+DIR="$TMPROOT/stdout-test"
+mkdir -p "$DIR"
+echo "ANTHROPIC_API_KEY=sk-ant-real" > "$DIR/.env"
+STDOUT=$(env CLAUDE_PROJECT_DIR="$DIR" bash "$HOOK" 2>/dev/null)
+if [ -z "$STDOUT" ]; then
+  echo "  PASS: stdout is empty"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: stdout is non-empty: $STDOUT"
+  FAIL=$((FAIL+1))
+fi
+
+# 19. Log file is created and contains the path
+DIR="$TMPROOT/log-test"
+mkdir -p "$DIR"
+echo "ANTHROPIC_API_KEY=sk-ant-real" > "$DIR/.env"
+LOG="$TMPROOT/test.log"
+env CLAUDE_PROJECT_DIR="$DIR" CC_DOTENV_AK_LOG="$LOG" bash "$HOOK" >/dev/null 2>/dev/null
+if [ -f "$LOG" ] && grep -q "$DIR/.env" "$LOG"; then
+  echo "  PASS: log file written"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: log file missing or empty"
+  FAIL=$((FAIL+1))
+fi
+
+# 20. Falls back to PWD when CLAUDE_PROJECT_DIR unset
+DIR="$TMPROOT/pwd-test"
+mkdir -p "$DIR"
+echo "ANTHROPIC_API_KEY=sk-ant-real" > "$DIR/.env"
+LOG="$DIR/log"
+( cd "$DIR" && env -u CLAUDE_PROJECT_DIR CC_DOTENV_AK_LOG="$LOG" bash "$HOOK" >/dev/null 2>/dev/null )
+if [ -f "$LOG" ] && grep -q "$DIR/.env" "$LOG"; then
+  echo "  PASS: PWD fallback works when CLAUDE_PROJECT_DIR unset"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: PWD fallback did not detect"
+  FAIL=$((FAIL+1))
+fi
+
+# 21. Multiple .env files all detected (log has both lines)
+DIR="$TMPROOT/multi-test"
+mkdir -p "$DIR"
+echo "ANTHROPIC_API_KEY=sk-ant-1" > "$DIR/.env"
+echo "ANTHROPIC_API_KEY=sk-ant-2" > "$DIR/.env.local"
+LOG="$DIR/log"
+env CLAUDE_PROJECT_DIR="$DIR" CC_DOTENV_AK_LOG="$LOG" bash "$HOOK" >/dev/null 2>/dev/null
+if [ -f "$LOG" ] && [ "$(grep -c 'ANTHROPIC_API_KEY' "$LOG")" -eq 2 ]; then
+  echo "  PASS: multiple .env files all logged"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: multiple .env files not all logged (got $(wc -l < "$LOG" 2>/dev/null) lines)"
+  FAIL=$((FAIL+1))
+fi
+
+echo "=============================================="
+echo "Result: PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/test-echo-probe-spam-detector.sh

@@ -0,0 +1,143 @@
+#!/bin/bash
+# Tests for echo-probe-spam-detector.sh
+HOOK="examples/echo-probe-spam-detector.sh"
+PASS=0 FAIL=0
+TMPDIR=$(mktemp -d)
+trap "rm -rf $TMPDIR" EXIT
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3', got: $2)"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3', got: $2)"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+HOOK_ABS="$PWD/$HOOK"
+
+# Isolate state per test via unique TMPDIR + session ID
+run_hook() {
+    local sid="$1"
+    local cmd="$2"
+    local extra_env="${3:-}"
+    local input='{"tool_input": {"command": '"$(printf '%s' "$cmd" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))')"'}}'
+    # shellcheck disable=SC2086
+    env TMPDIR="$TMPDIR" CLAUDE_SESSION_ID="$sid" $extra_env bash "$HOOK_ABS" 2>&1 <<< "$input"
+}
+run_hook_with_rc() {
+    local sid="$1"
+    local cmd="$2"
+    local extra_env="${3:-}"
+    local input='{"tool_input": {"command": '"$(printf '%s' "$cmd" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))')"'}}'
+    env TMPDIR="$TMPDIR" CLAUDE_SESSION_ID="$sid" $extra_env bash "$HOOK_ABS" 2>&1 <<< "$input"
+    return $?
+}
+
+# Test 1: Non-probe command exits 0 silently (no counter increment)
+OUT=$(run_hook "s1" "ls -la"); RC=$?
+assert_not_contains "non-probe no notice" "$OUT" "NOTICE"
+assert_not_contains "non-probe no block" "$OUT" "BLOCKED"
+assert_exit "non-probe exit 0" "$RC" "0"
+
+# Test 2: First echo s1 → NOTICE, exit 0
+OUT=$(run_hook "s2" "echo s1"); RC=$?
+assert_contains "echo s1 notice" "$OUT" "NOTICE"
+assert_contains "echo s1 mentions 1/3" "$OUT" "1/3"
+assert_exit "echo s1 first exit 0" "$RC" "0"
+
+# Test 3: Second echo s2 → NOTICE 2/3, exit 0
+OUT=$(run_hook "s2" "echo s2"); RC=$?
+assert_contains "echo s2 notice 2" "$OUT" "2/3"
+assert_exit "echo s2 second exit 0" "$RC" "0"
+
+# Test 4: Third echo s3 → BLOCKED, exit 2
+OUT=$(run_hook "s2" "echo s3"); RC=$?
+assert_contains "echo s3 blocked" "$OUT" "BLOCKED"
+assert_exit "echo s3 third exit 2" "$RC" "2"
+
+# Test 5: Non-probe in middle resets counter
+OUT=$(run_hook "s3" "echo s1"); _=$?  # 1
+OUT=$(run_hook "s3" "ls"); _=$?       # reset
+OUT=$(run_hook "s3" "echo s1"); RC=$?  # back to 1
+assert_contains "after reset count 1" "$OUT" "1/3"
+assert_exit "after reset exit 0" "$RC" "0"
+
+# Test 6: CC_ECHO_PROBE_DISABLE=1 → never warn or block
+OUT=$(run_hook "s4" "echo s1" "CC_ECHO_PROBE_DISABLE=1"); RC=$?
+assert_not_contains "DISABLE no notice" "$OUT" "NOTICE"
+assert_exit "DISABLE exit 0" "$RC" "0"
+OUT=$(run_hook "s4" "echo s2" "CC_ECHO_PROBE_DISABLE=1"); _=$?
+OUT=$(run_hook "s4" "echo s3" "CC_ECHO_PROBE_DISABLE=1"); RC=$?
+assert_not_contains "DISABLE no block" "$OUT" "BLOCKED"
+assert_exit "DISABLE 3rd exit 0" "$RC" "0"
+
+# Test 7: CC_ECHO_PROBE_QUIET=1 → silent but still blocks
+OUT=$(run_hook "s5" "echo s1" "CC_ECHO_PROBE_QUIET=1"); RC=$?
+assert_not_contains "QUIET no notice 1" "$OUT" "NOTICE"
+assert_exit "QUIET 1st exit 0" "$RC" "0"
+OUT=$(run_hook "s5" "echo s2" "CC_ECHO_PROBE_QUIET=1"); _=$?
+OUT=$(run_hook "s5" "echo s3" "CC_ECHO_PROBE_QUIET=1"); RC=$?
+assert_not_contains "QUIET no block message" "$OUT" "BLOCKED"
+assert_exit "QUIET 3rd exit 2" "$RC" "2"
+
+# Test 8: CC_ECHO_PROBE_THRESHOLD=2 → block at 2
+OUT=$(run_hook "s6" "echo s1" "CC_ECHO_PROBE_THRESHOLD=2"); RC=$?
+assert_contains "T=2 first 1/2" "$OUT" "1/2"
+assert_exit "T=2 first exit 0" "$RC" "0"
+OUT=$(run_hook "s6" "echo s2" "CC_ECHO_PROBE_THRESHOLD=2"); RC=$?
+assert_contains "T=2 second blocks" "$OUT" "BLOCKED"
+assert_exit "T=2 second exit 2" "$RC" "2"
+
+# Test 9: Short echo args (1-3 chars) detected
+OUT=$(run_hook "s7" "echo x"); RC=$?
+assert_contains "short arg detected" "$OUT" "NOTICE"
+assert_exit "short arg exit 0" "$RC" "0"
+
+# Test 10: Real echo with longer message NOT detected
+OUT=$(run_hook "s8" 'echo "Build successful"'); RC=$?
+assert_not_contains "real echo no notice" "$OUT" "NOTICE"
+assert_exit "real echo exit 0" "$RC" "0"
+
+# Test 11: sleep N; echo X detected
+OUT=$(run_hook "s9" "sleep 1; echo flush"); RC=$?
+assert_contains "sleep+echo detected" "$OUT" "NOTICE"
+assert_exit "sleep+echo exit 0" "$RC" "0"
+
+# Test 12: # RESET ECHO PROBE marker clears state
+OUT=$(run_hook "s10" "echo s1"); _=$?  # 1
+OUT=$(run_hook "s10" "echo s2"); _=$?  # 2
+OUT=$(run_hook "s10" "ls # RESET ECHO PROBE"); RC=$?
+assert_exit "RESET marker exit 0" "$RC" "0"
+OUT=$(run_hook "s10" "echo s1"); RC=$?
+assert_contains "after RESET count 1" "$OUT" "1/3"
+
+# Test 13: Empty input → exit 0
+OUT=$(env TMPDIR="$TMPDIR" CLAUDE_SESSION_ID="s11" bash "$HOOK_ABS" 2>&1 < /dev/null); RC=$?
+assert_exit "empty input exit 0" "$RC" "0"
+
+# Test 14: Missing tool_input.command → exit 0
+OUT=$(env TMPDIR="$TMPDIR" CLAUDE_SESSION_ID="s12" bash "$HOOK_ABS" 2>&1 <<< '{}'); RC=$?
+assert_exit "missing command exit 0" "$RC" "0"
+
+# Test 15: Different session IDs have independent counters
+OUT=$(run_hook "sess-A" "echo s1"); _=$?
+OUT=$(run_hook "sess-A" "echo s2"); _=$?
+OUT=$(run_hook "sess-B" "echo s1"); RC=$?
+assert_contains "session B count 1" "$OUT" "1/3"
+
+# Test 16: Block message includes anchor issue + Gist reference
+run_hook "s13" "echo s1" > /dev/null
+run_hook "s13" "echo s2" > /dev/null
+OUT=$(run_hook "s13" "echo s3"); RC=$?
+assert_contains "block mentions issue 63887" "$OUT" "63887"
+assert_contains "block mentions Gist" "$OUT" "5881286479969d5bac0323511dc33ab2"
+
+# Test 17: 4-char echo argument NOT detected (above threshold)
+OUT=$(run_hook "s14" "echo abcd"); RC=$?
+assert_not_contains "4-char echo not detected" "$OUT" "NOTICE"
+assert_exit "4-char echo exit 0" "$RC" "0"
+
+# Test 18: echo without arg NOT detected (non-probe shape)
+OUT=$(run_hook "s15" "echo"); RC=$?
+assert_not_contains "bare echo not detected" "$OUT" "NOTICE"
+assert_exit "bare echo exit 0" "$RC" "0"
+
+echo ""
+echo "echo-probe-spam-detector tests: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/test-edit-quote-ambiguity-guard.sh

@@ -0,0 +1,75 @@
+#!/bin/bash
+# Tests for edit-quote-ambiguity-guard.sh
+# Absolute path: tests build scratch files under TMPDIR.
+HOOK="$(cd "$(dirname "$0")/../examples" && pwd)/edit-quote-ambiguity-guard.sh"
+PASS=0
+FAIL=0
+
+run_test() {
+  local desc="$1" result="$2"
+  if [ "$result" = "pass" ]; then
+    echo "  PASS: $desc"; PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"; FAIL=$((FAIL + 1))
+  fi
+}
+
+D=$(mktemp -d "${TMPDIR:-/tmp}/cc-quote-guard-test.XXXXXX")
+
+# Scratch files. printf with \xe2\x80\x9c/\x9d = curly “ ”, \x9d/\x9c = reversed.
+printf 'message1 = "hello"\nmessage2 = \xe2\x80\x9chello\xe2\x80\x9d\n'        > "$D/mixed.py"
+printf 'message1 = \xe2\x80\x9dhello\xe2\x80\x9c\nmessage2 = \xe2\x80\x9chello\xe2\x80\x9d\n' > "$D/subtle.py"
+printf 'only = \xe2\x80\x9cgreeting\xe2\x80\x9d\n'                              > "$D/curly_only.py"
+printf 'a = "x"\nb = "y"\n'                                                    > "$D/plain.py"
+printf 'dup = "z"\ndup = "z"\n'                                                > "$D/rawdup.py"
+
+# Run hook with a JSON payload; print "exit|stderr_line_count".
+run_in() {
+  local payload="$1" err rc
+  err=$(printf '%s' "$payload" | bash "$HOOK" 2>&1 1>/dev/null); rc=$?
+  echo "$rc|$(printf '%s' "$err" | grep -c .)"
+}
+
+echo "Testing edit-quote-ambiguity-guard.sh"
+echo "====================================="
+
+# 1. Subtle variant (raw 0, norm 2) → BLOCK (exit 2 with message).
+R=$(run_in "{\"tool_input\":{\"file_path\":\"$D/subtle.py\",\"old_string\":\"\\\"hello\\\"\",\"new_string\":\"X\"}}")
+[ "${R%%|*}" = "2" ] && [ "${R##*|}" -gt 0 ] && run_test "subtle two-curly variant → blocks" pass || run_test "subtle → blocks ($R)" fail
+
+# 2. Mixed straight+curly (raw 1, norm 2) → BLOCK.
+R=$(run_in "{\"tool_input\":{\"file_path\":\"$D/mixed.py\",\"old_string\":\"\\\"hello\\\"\",\"new_string\":\"X\"}}")
+[ "${R%%|*}" = "2" ] && run_test "mixed exact-wins ambiguity → blocks" pass || run_test "mixed → blocks ($R)" fail
+
+# 3. Curly-only unique (raw 0, norm 1) → allow (exit 0).
+R=$(run_in "{\"tool_input\":{\"file_path\":\"$D/curly_only.py\",\"old_string\":\"\\\"greeting\\\"\",\"new_string\":\"X\"}}")
+[ "${R%%|*}" = "0" ] && run_test "curly-only unique normalized match → allows" pass || run_test "curly-only → allows ($R)" fail
+
+# 4. Plain unique (raw 1, norm 1) → allow.
+R=$(run_in "{\"tool_input\":{\"file_path\":\"$D/plain.py\",\"old_string\":\"\\\"x\\\"\",\"new_string\":\"X\"}}")
+[ "${R%%|*}" = "0" ] && run_test "plain unique match → allows" pass || run_test "plain → allows ($R)" fail
+
+# 5. Raw duplicate (raw 2, norm 2) → silent: the tool already rejects this.
+R=$(run_in "{\"tool_input\":{\"file_path\":\"$D/rawdup.py\",\"old_string\":\"\\\"z\\\"\",\"new_string\":\"X\"}}")
+[ "${R%%|*}" = "0" ] && run_test "raw duplicate (tool handles) → stays silent" pass || run_test "rawdup → silent ($R)" fail
+
+# 6. replace_all:true → allow (intentional all-variant change).
+R=$(run_in "{\"tool_input\":{\"file_path\":\"$D/subtle.py\",\"old_string\":\"\\\"hello\\\"\",\"new_string\":\"X\",\"replace_all\":true}}")
+[ "${R%%|*}" = "0" ] && run_test "replace_all:true → allows" pass || run_test "replace_all → allows ($R)" fail
+
+# 7. Non-Edit input (no file_path) → allow.
+R=$(run_in '{"tool_input":{"command":"ls"}}')
+[ "${R%%|*}" = "0" ] && run_test "no file_path → allows" pass || run_test "no file_path → allows ($R)" fail
+
+# 8. MultiEdit whose 2nd edit is the subtle variant → BLOCK.
+R=$(run_in "{\"tool_input\":{\"file_path\":\"$D/subtle.py\",\"edits\":[{\"old_string\":\"x\",\"new_string\":\"y\"},{\"old_string\":\"\\\"hello\\\"\",\"new_string\":\"X\"}]}}")
+[ "${R%%|*}" = "2" ] && run_test "MultiEdit with ambiguous edit → blocks" pass || run_test "MultiEdit → blocks ($R)" fail
+
+# 9. Malformed JSON → allow (never break the tool on bad input).
+R=$(run_in 'not json')
+[ "${R%%|*}" = "0" ] && run_test "malformed JSON → allows" pass || run_test "malformed → allows ($R)" fail
+
+rm -rf "$D"
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/test-ephemeral-container-detector.sh

@@ -0,0 +1,251 @@
+#!/bin/bash
+# Tests for ephemeral-container-detector.sh
+#
+# Verifies the SessionStart hook behavior for issue #61141:
+#   Layer 1 (container detected) AND Layer 2 (.claude/ looks recreated) →
+#   warning. Either layer alone → silent.
+
+set -uo pipefail
+
+HOOK="$(dirname "$0")/../examples/ephemeral-container-detector.sh"
+PASS=0
+FAIL=0
+
+assert_pass() { echo "  PASS: $1"; PASS=$((PASS + 1)); }
+assert_fail() { echo "  FAIL: $1"; FAIL=$((FAIL + 1)); }
+
+# Each test runs the hook in a clean env. Container signals that the hook
+# reads directly from the filesystem (/.dockerenv, /proc/1/cgroup) cannot be
+# mocked here; tests rely on env-var signals (CONTAINER, DEVCONTAINER, etc.)
+# which exercise the same code path.
+
+TEST_ROOT=$(mktemp -d)
+trap "rm -rf $TEST_ROOT" EXIT
+
+# Sandbox a fake CLAUDE_HOME so we never touch the real ~/.claude
+FAKE_HOME="$TEST_ROOT/claude-home"
+
+# Wrapper: run hook with a clean env containing only what each test sets.
+# Critically, the wrapper UNSETs the container env vars that may leak from the
+# test harness itself (CI workers can set CONTAINER/CODESPACES).
+run_hook() {
+    env -i \
+        HOME="$TEST_ROOT" \
+        PATH="$PATH" \
+        CC_CLAUDE_HOME="$FAKE_HOME" \
+        HOSTNAME="testhost" \
+        "$@" \
+        bash "$HOOK" 2>&1
+}
+
+echo "=== ephemeral-container-detector.sh tests ==="
+
+# --- Test 1: no container signals → silent ---
+rm -rf "$FAKE_HOME"
+output=$(run_hook)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "no container signals → silent"
+else
+    assert_fail "expected silent, got rc=$rc output=$output"
+fi
+
+# --- Test 2: CONTAINER env but no reset signal (settings present, approvals present) → silent ---
+mkdir -p "$FAKE_HOME"
+cat > "$FAKE_HOME/settings.json" <<'JSON'
+{
+  "mcpServers": {"slack": {"command": "slack-mcp"}},
+  "enabledMcpjsonServers": ["slack"]
+}
+JSON
+output=$(run_hook CONTAINER=docker)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "container + approvals present → silent"
+else
+    assert_fail "expected silent, got rc=$rc output=$output"
+fi
+
+# --- Test 3: CONTAINER env + missing settings.json → warning ---
+rm -rf "$FAKE_HOME"
+output=$(run_hook CONTAINER=docker)
+rc=$?
+if [ "$rc" -eq 0 ] && echo "$output" | grep -q "MCP approval state may not persist"; then
+    assert_pass "container + missing settings → warning"
+else
+    assert_fail "expected warning, got rc=$rc output=$output"
+fi
+
+# --- Test 4: warning references issue #61141 ---
+if echo "$output" | grep -q "claude-code#61141"; then
+    assert_pass "warning references issue #61141"
+else
+    assert_fail "missing issue ref, got $output"
+fi
+
+# --- Test 5: warning lists the CONTAINER env signal ---
+if echo "$output" | grep -q "CONTAINER env set"; then
+    assert_pass "warning lists CONTAINER env signal"
+else
+    assert_fail "missing CONTAINER signal, got $output"
+fi
+
+# --- Test 6: warning lists at least one mitigation ---
+if echo "$output" | grep -q "Mount a persistent volume"; then
+    assert_pass "warning lists persistent-volume mitigation"
+else
+    assert_fail "missing mitigation, got $output"
+fi
+
+# --- Test 7: DEVCONTAINER env triggers detection ---
+output=$(run_hook DEVCONTAINER=1)
+rc=$?
+if [ "$rc" -eq 0 ] && echo "$output" | grep -q "DEVCONTAINER env set"; then
+    assert_pass "DEVCONTAINER env triggers detection"
+else
+    assert_fail "expected DEVCONTAINER detection, got rc=$rc output=$output"
+fi
+
+# --- Test 8: CODESPACES env triggers detection ---
+output=$(run_hook CODESPACES=true)
+rc=$?
+if [ "$rc" -eq 0 ] && echo "$output" | grep -q "CODESPACES env set"; then
+    assert_pass "CODESPACES env triggers detection"
+else
+    assert_fail "expected CODESPACES detection, got rc=$rc output=$output"
+fi
+
+# --- Test 9: REMOTE_CONTAINERS env triggers detection ---
+output=$(run_hook REMOTE_CONTAINERS=true)
+rc=$?
+if [ "$rc" -eq 0 ] && echo "$output" | grep -q "REMOTE_CONTAINERS env set"; then
+    assert_pass "REMOTE_CONTAINERS env triggers detection"
+else
+    assert_fail "expected REMOTE_CONTAINERS detection, got rc=$rc output=$output"
+fi
+
+# --- Test 10: hex-pattern hostname triggers detection ---
+output=$(env -i \
+    HOME="$TEST_ROOT" \
+    PATH="$PATH" \
+    CC_CLAUDE_HOME="$FAKE_HOME" \
+    HOSTNAME="7b3a1f8d2c4e" \
+    bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && echo "$output" | grep -q "hostname looks like a container ID"; then
+    assert_pass "hex-pattern hostname triggers detection"
+else
+    assert_fail "expected hostname detection, got rc=$rc output=$output"
+fi
+
+# --- Test 11: settings.json with no mcpServers configured → silent (no MCP risk) ---
+mkdir -p "$FAKE_HOME"
+echo '{"theme": "dark"}' > "$FAKE_HOME/settings.json"
+output=$(run_hook CONTAINER=docker)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "container + no MCP configured → silent"
+else
+    assert_fail "expected silent, got rc=$rc output=$output"
+fi
+
+# --- Test 12: settings.json with mcpServers but empty approvals → warning ---
+cat > "$FAKE_HOME/settings.json" <<'JSON'
+{
+  "mcpServers": {"slack": {"command": "slack-mcp"}, "github": {"command": "gh-mcp"}},
+  "enabledMcpjsonServers": []
+}
+JSON
+output=$(run_hook CONTAINER=docker)
+rc=$?
+if [ "$rc" -eq 0 ] && echo "$output" | grep -q "2 mcpServers configured but enabledMcpjsonServers is empty"; then
+    assert_pass "container + configured-but-unapproved mcpServers → warning"
+else
+    assert_fail "expected warning with count, got rc=$rc output=$output"
+fi
+
+# --- Test 13: project-scoped mcpServers count toward reset signal ---
+cat > "$FAKE_HOME/settings.json" <<'JSON'
+{
+  "projects": {
+    "/home/user/foo": {"mcpServers": {"slack": {"command": "x"}}}
+  }
+}
+JSON
+output=$(run_hook CONTAINER=docker)
+rc=$?
+if [ "$rc" -eq 0 ] && echo "$output" | grep -q "mcpServers configured but enabledMcpjsonServers is empty"; then
+    assert_pass "project-scoped mcpServers detected"
+else
+    assert_fail "expected project mcpServers detection, got rc=$rc output=$output"
+fi
+
+# --- Test 14: disable flag silences even when both layers match ---
+rm -f "$FAKE_HOME/settings.json"
+output=$(run_hook CONTAINER=docker CC_EPHEMERAL_CONTAINER_DISABLE=1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "disable flag → silent even when both layers match"
+else
+    assert_fail "expected disabled, got rc=$rc output=$output"
+fi
+
+# --- Test 15: multiple container signals → all listed ---
+output=$(env -i \
+    HOME="$TEST_ROOT" \
+    PATH="$PATH" \
+    CC_CLAUDE_HOME="$FAKE_HOME" \
+    HOSTNAME="abc123def456" \
+    CONTAINER=docker \
+    DEVCONTAINER=1 \
+    bash "$HOOK" 2>&1)
+rc=$?
+sig_count=$(echo "$output" | grep -cE "CONTAINER env set|DEVCONTAINER env set|hostname looks like")
+if [ "$rc" -eq 0 ] && [ "$sig_count" -ge 3 ]; then
+    assert_pass "multiple container signals all listed (got $sig_count)"
+else
+    assert_fail "expected ≥3 signals, got $sig_count output=$output"
+fi
+
+# --- Test 16: hook exits 0 (does not block session start) ---
+if [ "$rc" -eq 0 ]; then
+    assert_pass "hook exits 0 (non-blocking)"
+else
+    assert_fail "hook returned non-zero rc=$rc"
+fi
+
+# --- Test 17: CC_CLAUDE_HOME override is honored ---
+ALT_HOME="$TEST_ROOT/alt-claude"
+mkdir -p "$ALT_HOME"
+output=$(env -i \
+    HOME="$TEST_ROOT" \
+    PATH="$PATH" \
+    CC_CLAUDE_HOME="$ALT_HOME" \
+    HOSTNAME="testhost" \
+    CONTAINER=docker \
+    bash "$HOOK" 2>&1)
+rc=$?
+# ALT_HOME exists but has no settings.json → should warn
+if [ "$rc" -eq 0 ] && echo "$output" | grep -qF "settings.json is missing at $ALT_HOME/settings.json"; then
+    assert_pass "CC_CLAUDE_HOME override honored in warning"
+else
+    assert_fail "expected ALT_HOME in output, got rc=$rc output=$output"
+fi
+
+# --- Test 18: hook handles malformed settings.json gracefully ---
+mkdir -p "$FAKE_HOME"
+echo 'not valid json {{{' > "$FAKE_HOME/settings.json"
+output=$(run_hook CONTAINER=docker 2>&1)
+rc=$?
+# jq will fail on the file. mcp_configured comes back as 0, so the hook
+# falls through to "no reset signal" and exits silently. That's the safe
+# behavior — the hook does not crash the session start on bad JSON.
+if [ "$rc" -eq 0 ]; then
+    assert_pass "malformed settings.json → hook exits 0 (does not crash)"
+else
+    assert_fail "expected rc=0 on bad JSON, got rc=$rc output=$output"
+fi
+
+echo ""
+echo "Summary: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1