cc-safe-setup 29.8.0 → 30.0.4

package/tests/test-mcp-permissions-ask-warner.sh

@@ -0,0 +1,207 @@
+#!/bin/bash
+# Tests for mcp-permissions-ask-warner.sh
+
+HOOK="$(dirname "$0")/../examples/mcp-permissions-ask-warner.sh"
+PASS=0 FAIL=0
+
+TMPROOT="$(mktemp -d -t cc-mcp-ask-test.XXXXXX)"
+trap 'rm -rf "$TMPROOT"' EXIT
+
+write_settings() {
+  local file="$1" body="$2"
+  mkdir -p "$(dirname "$file")"
+  printf '%s' "$body" > "$file"
+}
+
+run_test() {
+  local desc="$1" expected_exit="$2" files="$3" extra_env="$4"
+  local logfile="$TMPROOT/log-$RANDOM"
+  local actual_exit
+  if [ -n "$extra_env" ]; then
+    actual_exit=$(env CC_MCP_ASK_LOG="$logfile" CC_MCP_ASK_FILES="$files" $extra_env bash "$HOOK" >/dev/null 2>/dev/null; echo $?)
+  else
+    actual_exit=$(env CC_MCP_ASK_LOG="$logfile" CC_MCP_ASK_FILES="$files" bash "$HOOK" >/dev/null 2>/dev/null; echo $?)
+  fi
+  if [ "$actual_exit" -eq "$expected_exit" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS+1))
+  else
+    echo "  FAIL: $desc (expected $expected_exit, got $actual_exit)"
+    FAIL=$((FAIL+1))
+  fi
+}
+
+echo "Testing mcp-permissions-ask-warner.sh"
+echo "====================================="
+
+# 1. No settings.json at all → pass silently
+run_test "no settings.json passes silently" 0 "$TMPROOT/missing/settings.json"
+
+# 2. settings.json without permissions key → pass
+F="$TMPROOT/no-perms.json"
+write_settings "$F" '{"theme":"dark"}'
+run_test "settings without permissions key passes" 0 "$F"
+
+# 3. permissions.ask empty → pass
+F="$TMPROOT/empty-ask.json"
+write_settings "$F" '{"permissions":{"ask":[]}}'
+run_test "empty ask array passes" 0 "$F"
+
+# 4. permissions.ask with non-MCP entries only → pass
+F="$TMPROOT/no-mcp.json"
+write_settings "$F" '{"permissions":{"ask":["Bash(rm:*)","Write"]}}'
+run_test "ask with non-MCP entries passes" 0 "$F"
+
+# 5. permissions.ask with ONE MCP entry → warn (exit 0 default)
+F="$TMPROOT/one-mcp.json"
+write_settings "$F" '{"permissions":{"ask":["mcp__atlassian__create_page"]}}'
+run_test "one MCP entry warns" 0 "$F"
+
+# 6. Same with block mode → exit 2
+run_test "one MCP entry blocks in block mode" 2 "$F" "CC_MCP_ASK_ACTION=block"
+
+# 7. Multiple MCP entries → warn, log has all
+F="$TMPROOT/many-mcp.json"
+write_settings "$F" '{"permissions":{"ask":["mcp__a__b","mcp__c__d","Bash"]}}'
+LOG="$TMPROOT/many.log"
+env CC_MCP_ASK_LOG="$LOG" CC_MCP_ASK_FILES="$F" bash "$HOOK" >/dev/null 2>/dev/null
+if [ -f "$LOG" ] && [ "$(grep -c "mcp_in_ask" "$LOG")" -eq 2 ]; then
+  echo "  PASS: multiple MCP entries all logged"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: multiple MCP entries log count"
+  FAIL=$((FAIL+1))
+fi
+
+# 8. Two files, MCP entries in both → all detected
+F1="$TMPROOT/file1.json"
+F2="$TMPROOT/file2.json"
+write_settings "$F1" '{"permissions":{"ask":["mcp__foo__bar"]}}'
+write_settings "$F2" '{"permissions":{"ask":["mcp__baz__qux"]}}'
+LOG="$TMPROOT/two-files.log"
+env CC_MCP_ASK_LOG="$LOG" CC_MCP_ASK_FILES="$F1,$F2" bash "$HOOK" >/dev/null 2>/dev/null
+if [ -f "$LOG" ] && [ "$(grep -c "mcp_in_ask" "$LOG")" -eq 2 ]; then
+  echo "  PASS: MCP entries across multiple files detected"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: multi-file detection"
+  FAIL=$((FAIL+1))
+fi
+
+# 9. Disabled → pass
+F="$TMPROOT/disabled.json"
+write_settings "$F" '{"permissions":{"ask":["mcp__x__y"]}}'
+run_test "CC_MCP_ASK_DISABLE=1 disables hook" 0 "$F" "CC_MCP_ASK_DISABLE=1"
+
+# 10. Malformed JSON → pass silently (jq returns empty)
+F="$TMPROOT/malformed.json"
+write_settings "$F" '{"permissions":'
+run_test "malformed JSON passes silently" 0 "$F"
+
+# 11. permissions.ask with object entry (non-string) → ignored
+F="$TMPROOT/obj-entry.json"
+write_settings "$F" '{"permissions":{"ask":[{"tool":"mcp__x__y"}]}}'
+run_test "non-string ask entries ignored" 0 "$F"
+
+# 12. Warning to stderr, stdout empty
+F="$TMPROOT/stderr-test.json"
+write_settings "$F" '{"permissions":{"ask":["mcp__test__call"]}}'
+STDOUT=$(env CC_MCP_ASK_FILES="$F" bash "$HOOK" 2>/dev/null)
+STDERR=$(env CC_MCP_ASK_FILES="$F" bash "$HOOK" 2>&1 >/dev/null)
+if [ -z "$STDOUT" ] && echo "$STDERR" | grep -q "MCP tool entries"; then
+  echo "  PASS: stdout empty, stderr has warning"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: stdout/stderr separation"
+  FAIL=$((FAIL+1))
+fi
+
+# 13. Warning contains source file path
+F="$TMPROOT/named.json"
+write_settings "$F" '{"permissions":{"ask":["mcp__sample__action"]}}'
+STDERR=$(env CC_MCP_ASK_FILES="$F" bash "$HOOK" 2>&1 >/dev/null)
+if echo "$STDERR" | grep -qF "$F"; then
+  echo "  PASS: warning mentions source file"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: source file not in warning"
+  FAIL=$((FAIL+1))
+fi
+
+# 14. Auto-discovery via CLAUDE_PROJECT_DIR
+PROJDIR="$TMPROOT/proj"
+mkdir -p "$PROJDIR/.claude"
+echo '{"permissions":{"ask":["mcp__discovered__tool"]}}' > "$PROJDIR/.claude/settings.json"
+LOG="$TMPROOT/auto.log"
+EXIT=$(env -u CC_MCP_ASK_FILES CLAUDE_PROJECT_DIR="$PROJDIR" HOME="$TMPROOT/fakehome" CC_MCP_ASK_LOG="$LOG" bash "$HOOK" >/dev/null 2>/dev/null; echo $?)
+if [ "$EXIT" -eq 0 ] && [ -f "$LOG" ] && grep -q "mcp__discovered__tool" "$LOG"; then
+  echo "  PASS: auto-discovery via CLAUDE_PROJECT_DIR"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: CLAUDE_PROJECT_DIR auto-discovery"
+  FAIL=$((FAIL+1))
+fi
+
+# 15. permissions.ask is null → pass
+F="$TMPROOT/null-ask.json"
+write_settings "$F" '{"permissions":{"ask":null}}'
+run_test "ask=null passes silently" 0 "$F"
+
+# 16. permissions.allow has MCP but ask doesn't → pass
+F="$TMPROOT/allow-not-ask.json"
+write_settings "$F" '{"permissions":{"allow":["mcp__x__y"],"ask":["Bash"]}}'
+run_test "MCP in allow but not ask passes" 0 "$F"
+
+# 17. permissions.deny has MCP but ask doesn't → pass
+F="$TMPROOT/deny-not-ask.json"
+write_settings "$F" '{"permissions":{"deny":["mcp__x__y"],"ask":[]}}'
+run_test "MCP in deny but not ask passes" 0 "$F"
+
+# 18. Log contains action value
+F="$TMPROOT/action.json"
+write_settings "$F" '{"permissions":{"ask":["mcp__log__check"]}}'
+LOG="$TMPROOT/action.log"
+env CC_MCP_ASK_LOG="$LOG" CC_MCP_ASK_FILES="$F" CC_MCP_ASK_ACTION="block" bash "$HOOK" >/dev/null 2>/dev/null
+if grep -q "action=block" "$LOG"; then
+  echo "  PASS: log records action value"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: log missing action"
+  FAIL=$((FAIL+1))
+fi
+
+# 19. Mixed MCP and non-MCP only logs MCP
+F="$TMPROOT/mixed.json"
+write_settings "$F" '{"permissions":{"ask":["Bash","mcp__keep__me","Write","mcp__also__keep","Read"]}}'
+LOG="$TMPROOT/mixed.log"
+env CC_MCP_ASK_LOG="$LOG" CC_MCP_ASK_FILES="$F" bash "$HOOK" >/dev/null 2>/dev/null
+if [ "$(grep -c "mcp_in_ask" "$LOG")" -eq 2 ]; then
+  echo "  PASS: only MCP entries logged from mixed ask list"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: mixed list count"
+  FAIL=$((FAIL+1))
+fi
+
+# 20. mcp__ prefix with nothing after → still treated as MCP entry (degenerate but valid prefix)
+F="$TMPROOT/short.json"
+write_settings "$F" '{"permissions":{"ask":["mcp__just_prefix"]}}'
+run_test "MCP prefix with short name detected" 0 "$F"
+
+# 21. Pre-existing log file is appended, not overwritten
+F="$TMPROOT/append.json"
+write_settings "$F" '{"permissions":{"ask":["mcp__append__test"]}}'
+LOG="$TMPROOT/append.log"
+echo "OLD LOG LINE" > "$LOG"
+env CC_MCP_ASK_LOG="$LOG" CC_MCP_ASK_FILES="$F" bash "$HOOK" >/dev/null 2>/dev/null
+if grep -q "OLD LOG LINE" "$LOG" && grep -q "mcp__append__test" "$LOG"; then
+  echo "  PASS: log file appended, not overwritten"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: log overwritten"
+  FAIL=$((FAIL+1))
+fi
+
+echo "====================================="
+echo "Result: PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/test-mcp-routine-approval-detector.sh

@@ -0,0 +1,229 @@
+#!/bin/bash
+# Test for mcp-routine-approval-detector.sh
+#
+# Verifies the hook detects the May 2026 routine-approval cluster signature,
+# writes a structured receipt, emits an operator-visible warning, and stays
+# silent on all the cases that should NOT trigger.
+
+set -u
+
+HOOK="$(dirname "$0")/../examples/mcp-routine-approval-detector.sh"
+[ ! -x "$HOOK" ] && chmod +x "$HOOK"
+
+PASS=0
+FAIL=0
+
+# Per-test temp receipt dir so cases don't bleed into each other
+TEST_DIR=$(mktemp -d)
+trap 'rm -rf "$TEST_DIR"' EXIT
+
+run_case() {
+    local name="$1"
+    local input="$2"
+    local expect_receipt="$3"   # "yes" or "no"
+    local expect_warning="$4"   # "yes" or "no"
+    local extra_env="${5:-}"
+
+    local receipt_dir="$TEST_DIR/$(printf '%s' "$name" | tr -c 'A-Za-z0-9' '_')"
+    mkdir -p "$receipt_dir"
+
+    local stderr rc
+    stderr=$(printf '%s' "$input" | env -i \
+        HOME="$HOME" PATH="/usr/local/bin:/usr/bin:/bin" \
+        CC_MCP_ROUTINE_BLOCK_DIR="$receipt_dir" \
+        $extra_env \
+        "$HOOK" 2>&1 >/dev/null)
+    rc=$?
+
+    local receipt_count
+    receipt_count=$(find "$receipt_dir" -maxdepth 1 -type f -name '*.json' 2>/dev/null | wc -l)
+
+    local got_receipt=no
+    [ "$receipt_count" -gt 0 ] && got_receipt=yes
+
+    local got_warning=no
+    if echo "$stderr" | grep -q "mcp-routine-approval-detector"; then
+        got_warning=yes
+    fi
+
+    if [ "$rc" -ne 0 ]; then
+        FAIL=$((FAIL+1))
+        echo "FAIL: $name — exit $rc (expected 0)"
+        echo "      stderr: $stderr"
+        return
+    fi
+
+    if [ "$got_receipt" != "$expect_receipt" ]; then
+        FAIL=$((FAIL+1))
+        echo "FAIL: $name — receipt=$got_receipt (expected $expect_receipt)"
+        echo "      stderr: $stderr"
+        return
+    fi
+
+    if [ "$got_warning" != "$expect_warning" ]; then
+        FAIL=$((FAIL+1))
+        echo "FAIL: $name — warning=$got_warning (expected $expect_warning)"
+        echo "      stderr: $stderr"
+        return
+    fi
+
+    PASS=$((PASS+1))
+}
+
+# Test 1: cluster signature on Gmail connector triggers receipt and warning
+INPUT1='{
+  "tool_name": "mcp__claude_ai_Gmail__search_threads",
+  "tool_result": "Streamable HTTP error: Error POSTing to endpoint: MCP tool call requires approval",
+  "session_id": "test-1"
+}'
+run_case "cluster hit on Gmail writes receipt and warns" "$INPUT1" yes yes
+
+# Test 2: cluster signature on Slack connector triggers
+INPUT2='{
+  "tool_name": "mcp__claude_ai_Slack__send_message",
+  "tool_result": "Streamable HTTP error: Error POSTing to endpoint: MCP tool call requires approval",
+  "session_id": "test-2"
+}'
+run_case "cluster hit on Slack writes receipt and warns" "$INPUT2" yes yes
+
+# Test 3: non-MCP tool (Bash) skipped silently
+INPUT3='{
+  "tool_name": "Bash",
+  "tool_result": "MCP tool call requires approval",
+  "session_id": "test-3"
+}'
+run_case "non-MCP tool skipped silently" "$INPUT3" no no
+
+# Test 4: MCP tool but no cluster signature — silent
+INPUT4='{
+  "tool_name": "mcp__claude_ai_Gmail__search_threads",
+  "tool_result": "Found 5 threads",
+  "session_id": "test-4"
+}'
+run_case "successful MCP call stays silent" "$INPUT4" no no
+
+# Test 5: MCP tool with unrelated error — silent
+INPUT5='{
+  "tool_name": "mcp__claude_ai_Slack__send_message",
+  "tool_result": "Channel not found",
+  "session_id": "test-5"
+}'
+run_case "unrelated MCP error stays silent" "$INPUT5" no no
+
+# Test 6: DISABLE env silences entirely
+INPUT6='{
+  "tool_name": "mcp__claude_ai_Gmail__search_threads",
+  "tool_result": "Streamable HTTP error: Error POSTing to endpoint: MCP tool call requires approval",
+  "session_id": "test-6"
+}'
+run_case "DISABLE env skips entirely" "$INPUT6" no no "CC_MCP_ROUTINE_BLOCK_DISABLE=1"
+
+# Test 7: QUIET env writes receipt but suppresses warning
+INPUT7='{
+  "tool_name": "mcp__claude_ai_Notion__notion-fetch",
+  "tool_result": "Streamable HTTP error: Error POSTing to endpoint: MCP tool call requires approval",
+  "session_id": "test-7"
+}'
+run_case "QUIET env writes receipt but no warning" "$INPUT7" yes no "CC_MCP_ROUTINE_BLOCK_QUIET=1"
+
+# Test 8: missing tool_name skipped
+INPUT8='{
+  "tool_result": "Streamable HTTP error: Error POSTing to endpoint: MCP tool call requires approval"
+}'
+run_case "missing tool_name skipped" "$INPUT8" no no
+
+# Test 9: empty input skipped
+INPUT9=''
+run_case "empty input skipped" "$INPUT9" no no
+
+# Test 10: malformed JSON skipped
+INPUT10='not json at all'
+run_case "malformed input skipped" "$INPUT10" no no
+
+# Test 11: receipt content is well-formed JSON with all expected fields
+INPUT11='{
+  "tool_name": "mcp__claude_ai_Atlassian__searchJiraIssuesUsingJql",
+  "tool_result": "Streamable HTTP error: Error POSTing to endpoint: MCP tool call requires approval",
+  "session_id": "well-formed-test"
+}'
+RECEIPT_DIR_11="$TEST_DIR/well_formed_test"
+mkdir -p "$RECEIPT_DIR_11"
+printf '%s' "$INPUT11" | env -i HOME="$HOME" PATH="/usr/local/bin:/usr/bin:/bin" \
+    CC_MCP_ROUTINE_BLOCK_DIR="$RECEIPT_DIR_11" \
+    CC_MCP_ROUTINE_BLOCK_QUIET=1 \
+    "$HOOK" 2>/dev/null
+
+RECEIPT_FILE=$(find "$RECEIPT_DIR_11" -maxdepth 1 -type f -name '*.json' | head -1)
+if [ -z "$RECEIPT_FILE" ]; then
+    FAIL=$((FAIL+1))
+    echo "FAIL: receipt is well-formed JSON — no receipt file found"
+else
+    TOOL=$(jq -r '.tool_name' "$RECEIPT_FILE" 2>/dev/null)
+    SERVER=$(jq -r '.server' "$RECEIPT_FILE" 2>/dev/null)
+    OPERATION=$(jq -r '.operation' "$RECEIPT_FILE" 2>/dev/null)
+    SID=$(jq -r '.session_id' "$RECEIPT_FILE" 2>/dev/null)
+    ERR=$(jq -r '.error_excerpt' "$RECEIPT_FILE" 2>/dev/null)
+
+    if [ "$TOOL" = "mcp__claude_ai_Atlassian__searchJiraIssuesUsingJql" ] \
+       && [ "$SERVER" = "claude_ai_Atlassian" ] \
+       && [ "$OPERATION" = "searchJiraIssuesUsingJql" ] \
+       && [ "$SID" = "well-formed-test" ] \
+       && [ -n "$ERR" ]; then
+        PASS=$((PASS+1))
+    else
+        FAIL=$((FAIL+1))
+        echo "FAIL: receipt fields incorrect"
+        echo "      tool=$TOOL server=$SERVER operation=$OPERATION sid=$SID err=$ERR"
+    fi
+fi
+
+# Test 12: multiple hits in the same dir produce distinct files
+INPUT12='{
+  "tool_name": "mcp__claude_ai_Gmail__list_threads",
+  "tool_result": "Streamable HTTP error: Error POSTing to endpoint: MCP tool call requires approval",
+  "session_id": "multi-receipt"
+}'
+RECEIPT_DIR_12="$TEST_DIR/multi_receipt"
+mkdir -p "$RECEIPT_DIR_12"
+for _ in 1 2; do
+    printf '%s' "$INPUT12" | env -i HOME="$HOME" PATH="/usr/local/bin:/usr/bin:/bin" \
+        CC_MCP_ROUTINE_BLOCK_DIR="$RECEIPT_DIR_12" \
+        CC_MCP_ROUTINE_BLOCK_QUIET=1 \
+        "$HOOK" 2>/dev/null
+    sleep 1  # second-resolution timestamp keeps filenames distinct
+done
+COUNT=$(find "$RECEIPT_DIR_12" -maxdepth 1 -type f -name '*.json' | wc -l)
+if [ "$COUNT" = "2" ]; then
+    PASS=$((PASS+1))
+else
+    FAIL=$((FAIL+1))
+    echo "FAIL: multiple hits — expected 2 files, got $COUNT"
+fi
+
+# Test 13: error excerpt truncated to bounded length
+LONG_ERR=$(printf 'Streamable HTTP error: Error POSTing to endpoint: MCP tool call requires approval')
+LONG_PAD=$(printf 'X%.0s' $(seq 1 1500))
+LONG_RESULT="${LONG_ERR} ${LONG_PAD}"
+INPUT13=$(jq -nc \
+    --arg t "mcp__claude_ai_Gmail__list_threads" \
+    --arg r "$LONG_RESULT" \
+    --arg s "trunc-test" \
+    '{tool_name:$t, tool_result:$r, session_id:$s}')
+RECEIPT_DIR_13="$TEST_DIR/trunc_test"
+mkdir -p "$RECEIPT_DIR_13"
+printf '%s' "$INPUT13" | env -i HOME="$HOME" PATH="/usr/local/bin:/usr/bin:/bin" \
+    CC_MCP_ROUTINE_BLOCK_DIR="$RECEIPT_DIR_13" \
+    CC_MCP_ROUTINE_BLOCK_QUIET=1 \
+    "$HOOK" 2>/dev/null
+RECEIPT_FILE_13=$(find "$RECEIPT_DIR_13" -maxdepth 1 -type f -name '*.json' | head -1)
+EXCERPT_LEN=$(jq -r '.error_excerpt | length' "$RECEIPT_FILE_13" 2>/dev/null)
+if [ -n "$EXCERPT_LEN" ] && [ "$EXCERPT_LEN" -le 400 ]; then
+    PASS=$((PASS+1))
+else
+    FAIL=$((FAIL+1))
+    echo "FAIL: excerpt truncation — length=$EXCERPT_LEN (expected ≤ 400)"
+fi
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/test-mcp-startup-bloat-detector.sh

@@ -0,0 +1,141 @@
+#!/bin/bash
+# Test for mcp-startup-bloat-detector.sh
+#
+# Verifies the hook warns when claude mcp list shows enough
+# claude.ai-prefixed connectors to cross the threshold, and
+# stays silent below the threshold or when explicitly disabled.
+
+set -u
+
+HOOK="$(dirname "$0")/../examples/mcp-startup-bloat-detector.sh"
+[ ! -x "$HOOK" ] && chmod +x "$HOOK"
+
+PASS=0
+FAIL=0
+
+LOG_DIR="${HOME}/.claude/logs"
+mkdir -p "$LOG_DIR"
+
+# Stub claude binary that prints a controlled mcp list
+STUB_DIR=$(mktemp -d)
+trap 'rm -rf "$STUB_DIR"' EXIT
+
+make_stub() {
+    local connector_count="$1"
+    cat > "$STUB_DIR/claude" <<STUB
+#!/bin/bash
+if [ "\$1" = "mcp" ] && [ "\$2" = "list" ]; then
+    echo "Checking MCP server health..."
+    echo ""
+STUB
+    for i in $(seq 1 "$connector_count"); do
+        printf '    echo "claude.ai Service%d: https://example.com/mcp/v1 - ✓ Connected"\n' "$i" >> "$STUB_DIR/claude"
+    done
+    cat >> "$STUB_DIR/claude" <<'STUB'
+    echo "local-server: node /tmp/local.js - ✓ Connected"
+fi
+STUB
+    chmod +x "$STUB_DIR/claude"
+}
+
+run_case() {
+    local name="$1"
+    local connector_count="$2"
+    local threshold="$3"
+    local expect_warn="$4"   # "yes" or "no"
+    local extra_env="${5:-}"
+
+    make_stub "$connector_count"
+
+    local sess="bloat-test-$(date +%s%N)-$$"
+    local input
+    input=$(jq -nc --arg sid "$sess" '{session_id:$sid}')
+
+    local stderr rc
+    stderr=$(echo "$input" | env -i HOME="$HOME" PATH="$STUB_DIR:/usr/bin:/bin" \
+        MCP_BLOAT_THRESHOLD_COUNT="$threshold" $extra_env "$HOOK" 2>&1 >/dev/null)
+    rc=$?
+
+    local warned=no
+    if echo "$stderr" | grep -q "mcp-startup-bloat-detector"; then
+        warned=yes
+    fi
+
+    if [ "$rc" -ne 0 ]; then
+        FAIL=$((FAIL+1))
+        echo "FAIL: $name — exit $rc (expected 0)"
+    elif [ "$warned" = "$expect_warn" ]; then
+        PASS=$((PASS+1))
+    else
+        FAIL=$((FAIL+1))
+        echo "FAIL: $name — warned=$warned, expected $expect_warn"
+        echo "      stderr: $stderr"
+    fi
+
+    # Cleanup the per-session log so reruns are deterministic
+    [ -f "$LOG_DIR/mcp-bloat-warned-$sess" ] && rm -f "$LOG_DIR/mcp-bloat-warned-$sess"
+}
+
+# Test 1: count below threshold → silent
+run_case "below threshold stays silent" 3 5 no
+
+# Test 2: count at threshold → warns
+run_case "at threshold warns" 5 5 yes
+
+# Test 3: count above threshold → warns
+run_case "above threshold warns" 12 5 yes
+
+# Test 4: zero connectors → silent
+run_case "zero connectors stays silent" 0 5 no
+
+# Test 5: disable env silences even above threshold
+run_case "disable env silences" 12 5 no "MCP_BLOAT_DETECTOR_DISABLE=1"
+
+# Test 6: second run in the same session is silent
+SESS2="bloat-test-twice-$(date +%s%N)-$$"
+make_stub 12
+INPUT2=$(jq -nc --arg sid "$SESS2" '{session_id:$sid}')
+FIRST=$(echo "$INPUT2" | env -i HOME="$HOME" PATH="$STUB_DIR:/usr/bin:/bin" \
+    MCP_BLOAT_THRESHOLD_COUNT=5 "$HOOK" 2>&1 >/dev/null)
+SECOND=$(echo "$INPUT2" | env -i HOME="$HOME" PATH="$STUB_DIR:/usr/bin:/bin" \
+    MCP_BLOAT_THRESHOLD_COUNT=5 "$HOOK" 2>&1 >/dev/null)
+if echo "$FIRST" | grep -q "mcp-startup-bloat-detector" \
+   && ! echo "$SECOND" | grep -q "mcp-startup-bloat-detector"; then
+    PASS=$((PASS+1))
+else
+    FAIL=$((FAIL+1))
+    echo "FAIL: second run in same session not silenced"
+    echo "      first:  $FIRST"
+    echo "      second: $SECOND"
+fi
+[ -f "$LOG_DIR/mcp-bloat-warned-$SESS2" ] && rm -f "$LOG_DIR/mcp-bloat-warned-$SESS2"
+
+# Test 7: claude binary missing → exits cleanly (silent)
+SESS7="bloat-test-noclaude-$(date +%s%N)-$$"
+INPUT7=$(jq -nc --arg sid "$SESS7" '{session_id:$sid}')
+NOCLAUDE_DIR=$(mktemp -d)
+trap 'rm -rf "$STUB_DIR" "$NOCLAUDE_DIR"' EXIT
+STDERR7=$(echo "$INPUT7" | env -i HOME="$HOME" PATH="$NOCLAUDE_DIR:/usr/bin:/bin" \
+    MCP_BLOAT_THRESHOLD_COUNT=5 "$HOOK" 2>&1 >/dev/null)
+RC7=$?
+if [ "$RC7" -eq 0 ] && ! echo "$STDERR7" | grep -q "mcp-startup-bloat-detector"; then
+    PASS=$((PASS+1))
+else
+    FAIL=$((FAIL+1))
+    echo "FAIL: missing claude binary should exit 0 silent (rc=$RC7, stderr=$STDERR7)"
+fi
+
+# Test 8: malformed input (no session_id) → still safe
+STDERR8=$(echo '{}' | env -i HOME="$HOME" PATH="$STUB_DIR:/usr/bin:/bin" \
+    MCP_BLOAT_THRESHOLD_COUNT=5 "$HOOK" 2>&1 >/dev/null)
+RC8=$?
+if [ "$RC8" -eq 0 ]; then
+    PASS=$((PASS+1))
+else
+    FAIL=$((FAIL+1))
+    echo "FAIL: malformed input should exit 0 (rc=$RC8)"
+fi
+
+echo
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]