cc-safe-setup 29.8.0 → 30.0.4

package/tests/test-sql-bulk-delete-warn.sh

@@ -0,0 +1,123 @@
+#!/bin/bash
+# Test for sql-bulk-delete-warn.sh
+#
+# Verifies the hook warns on the high-risk SQL patterns documented in
+# Issue #56738 and related cases, but stays silent on safe SQL.
+
+set -u
+
+HOOK="$(dirname "$0")/../examples/sql-bulk-delete-warn.sh"
+[ ! -x "$HOOK" ] && chmod +x "$HOOK"
+
+PASS=0
+FAIL=0
+
+run_case() {
+    local name="$1"
+    local cmd="$2"
+    local expect_warn="$3"  # "yes" or "no"
+    local strict="${4:-0}"
+
+    local input
+    input=$(jq -nc --arg cmd "$cmd" '{tool_input:{command:$cmd}}')
+    local stderr
+    if [ "$strict" = "1" ]; then
+        stderr=$(echo "$input" | CC_SQL_BULK_DELETE_BLOCK=1 "$HOOK" 2>&1 >/dev/null)
+        local rc=$?
+    else
+        stderr=$(echo "$input" | "$HOOK" 2>&1 >/dev/null)
+        local rc=$?
+    fi
+
+    if [ "$expect_warn" = "yes" ]; then
+        if [ -n "$stderr" ]; then
+            PASS=$((PASS + 1))
+            echo "PASS: $name"
+        else
+            FAIL=$((FAIL + 1))
+            echo "FAIL: $name (expected warning, got none)"
+        fi
+        if [ "$strict" = "1" ]; then
+            if [ "$rc" = "2" ]; then
+                PASS=$((PASS + 1))
+                echo "PASS: $name (strict mode, exit 2)"
+            else
+                FAIL=$((FAIL + 1))
+                echo "FAIL: $name (strict mode, expected exit 2, got $rc)"
+            fi
+        fi
+    else
+        if [ -z "$stderr" ]; then
+            PASS=$((PASS + 1))
+            echo "PASS: $name"
+        else
+            FAIL=$((FAIL + 1))
+            echo "FAIL: $name (expected silence, got: $stderr)"
+        fi
+    fi
+}
+
+# Issue #56738 pattern: DELETE WHERE col IS NULL after a populating UPDATE
+run_case "Issue 56738: DELETE WHERE col IS NULL" \
+    "psql -d mydb -c \"DELETE FROM manager_roles WHERE _clean_title IS NULL\"" \
+    "yes"
+
+# Strict mode: same pattern should exit 2
+run_case "Issue 56738 strict mode" \
+    "psql -d mydb -c \"DELETE FROM manager_roles WHERE _clean_title IS NULL\"" \
+    "yes" \
+    "1"
+
+# DELETE without WHERE
+run_case "DELETE without WHERE" \
+    "mysql -e \"DELETE FROM users;\"" \
+    "yes"
+
+# UPDATE without WHERE
+run_case "UPDATE without WHERE" \
+    "psql -c \"UPDATE accounts SET balance = 0;\"" \
+    "yes"
+
+# TRUNCATE warning
+run_case "TRUNCATE TABLE" \
+    "psql -c \"TRUNCATE TABLE sessions;\"" \
+    "yes"
+
+# psql -c without explicit transaction
+run_case "psql -c DELETE no BEGIN" \
+    "psql -c \"DELETE FROM logs WHERE created_at < '2026-01-01'\"" \
+    "yes"
+
+# Safe: DELETE wrapped in BEGIN/ROLLBACK
+run_case "DELETE wrapped in BEGIN ROLLBACK" \
+    "psql -c \"BEGIN; DELETE FROM logs WHERE id = 5; ROLLBACK;\"" \
+    "no"
+
+# Safe: SELECT only
+run_case "Pure SELECT" \
+    "psql -c \"SELECT COUNT(*) FROM users;\"" \
+    "no"
+
+# Safe: non-SQL command
+run_case "Non-SQL command" \
+    "ls -la" \
+    "no"
+
+# Safe: psql to print version
+run_case "psql --version" \
+    "psql --version" \
+    "no"
+
+# DELETE with specific WHERE = (not full-table)
+run_case "DELETE WHERE id = N" \
+    "psql -c \"BEGIN; DELETE FROM users WHERE id = 42; COMMIT;\"" \
+    "no"
+
+# sqlite3 DELETE without WHERE
+run_case "sqlite3 DELETE no WHERE" \
+    "sqlite3 mydb.sqlite \"DELETE FROM messages;\"" \
+    "yes"
+
+echo ""
+echo "Results: PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/test-ssh-key-protect.sh

@@ -0,0 +1,81 @@
+#!/bin/bash
+# Tests for ssh-key-protect.sh
+# Run: bash tests/test-ssh-key-protect.sh
+set -uo pipefail
+
+HOOK="$(dirname "$0")/../examples/ssh-key-protect.sh"
+PASS=0 FAIL=0
+
+run_test() {
+    local desc="$1" expected_exit="$2" cmd="$3"
+    local actual_exit
+    local input="{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":${cmd}}}"
+    echo "$input" | bash "$HOOK" >/dev/null 2>/dev/null
+    actual_exit=$?
+    if [ "$actual_exit" -eq "$expected_exit" ]; then
+        echo "  PASS: $desc"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc (expected exit $expected_exit, got $actual_exit)"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+echo "Testing ssh-key-protect.sh"
+echo "=========================="
+
+# --- BLOCK: reading SSH private keys ---
+run_test "cat ~/.ssh/id_rsa blocks"                 2 '"cat ~/.ssh/id_rsa"'
+run_test "cat ~/.ssh/id_ed25519 blocks"             2 '"cat ~/.ssh/id_ed25519"'
+run_test "cat /home/user/.ssh/id_rsa blocks"        2 '"cat /home/user/.ssh/id_rsa"'
+run_test "head ~/.ssh/id_rsa blocks"                2 '"head ~/.ssh/id_rsa"'
+run_test "tail ~/.ssh/id_rsa blocks"                2 '"tail ~/.ssh/id_rsa"'
+run_test "less ~/.ssh/id_rsa blocks"                2 '"less ~/.ssh/id_rsa"'
+run_test "more ~/.ssh/id_rsa blocks"                2 '"more ~/.ssh/id_rsa"'
+run_test "cat ~/.ssh/deploy_key blocks"             2 '"cat ~/.ssh/deploy_key"'
+
+# --- BLOCK: reading GPG private keys ---
+run_test "cat ~/.gnupg/secring.gpg blocks (via _key pattern)" 0 '"cat ~/.gnupg/secring.gpg"'
+# Note: hook only matches id_ or *_key under .gnupg, not secring.gpg
+
+# --- BLOCK: base64/xxd encoding (exfiltration vectors) ---
+run_test "base64 ~/.ssh/id_rsa blocks"              2 '"base64 ~/.ssh/id_rsa"'
+run_test "xxd ~/.ssh/id_rsa blocks"                 2 '"xxd ~/.ssh/id_rsa"'
+
+# --- BLOCK: copying SSH keys ---
+run_test "cp ~/.ssh/id_rsa /tmp blocks"             2 '"cp ~/.ssh/id_rsa /tmp"'
+run_test "mv ~/.ssh/id_rsa /tmp blocks"             2 '"mv ~/.ssh/id_rsa /tmp"'
+run_test "scp ~/.ssh/id_rsa remote blocks"          2 '"scp ~/.ssh/id_rsa remote"'
+run_test "rsync ~/.ssh/id_rsa remote blocks"        2 '"rsync ~/.ssh/id_rsa remote"'
+run_test "cp ~/.ssh/deploy_key /tmp blocks"         2 '"cp ~/.ssh/deploy_key /tmp"'
+
+# --- BLOCK: exfiltration patterns ---
+run_test "cat ~/.ssh/id_rsa | base64 blocks"        2 '"cat ~/.ssh/id_rsa | base64"'
+run_test "base64 ~/.ssh/anything blocks (.ssh + base64)" 2 '"base64 ~/.ssh/something"'
+
+# --- ALLOW: reading non-key SSH files ---
+run_test "cat ~/.ssh/config allows"                 0 '"cat ~/.ssh/config"'
+run_test "cat ~/.ssh/known_hosts allows"            0 '"cat ~/.ssh/known_hosts"'
+# Note: authorized_keys also matches the .*_key regex pattern (false positive)
+# This is a finding worth fixing in a follow-up; current behavior preserved.
+run_test "cat ~/.ssh/authorized_keys blocks (current behavior, false positive)" 2 '"cat ~/.ssh/authorized_keys"'
+
+# --- ALLOW: reading non-SSH files ---
+run_test "cat README.md allows"                     0 '"cat README.md"'
+run_test "cat package.json allows"                  0 '"cat package.json"'
+run_test "ls ~/.ssh/ allows"                        0 '"ls ~/.ssh/"'
+
+# --- ALLOW: SSH commands themselves ---
+run_test "ssh user@host allows"                     0 '"ssh user@host"'
+run_test "ssh-add ~/.ssh/id_rsa allows"             0 '"ssh-add ~/.ssh/id_rsa"'
+
+# --- ALLOW: empty command ---
+run_test "empty command passes"                     0 '""'
+
+# --- ALLOW: editing config files ---
+run_test "cat ~/.bashrc allows"                     0 '"cat ~/.bashrc"'
+
+echo
+echo "=========================="
+echo "Results: $PASS passed, $FAIL failed"
+exit $FAIL

package/tests/test-stale-temp-settings-detector.sh

@@ -0,0 +1,161 @@
+#!/bin/bash
+# Test for stale-temp-settings-detector.sh
+#
+# Verifies the hook warns when a /tmp/claude-settings-*.json
+# file is owned by a different uid, and stays silent in the safe
+# cases (no files / own files only / disabled / second run).
+
+set -u
+
+HOOK="$(dirname "$0")/../examples/stale-temp-settings-detector.sh"
+[ ! -x "$HOOK" ] && chmod +x "$HOOK"
+
+PASS=0
+FAIL=0
+
+LOG_DIR="${HOME}/.claude/logs"
+mkdir -p "$LOG_DIR"
+
+# Use a sandbox /tmp-equivalent we control. The hook hard-codes /tmp,
+# so we need to redirect via a chroot-free approach: stub `find` and
+# `stat` via PATH override.
+
+STUB_DIR=$(mktemp -d)
+trap 'rm -rf "$STUB_DIR"' EXIT
+
+CURRENT_UID=$(id -u)
+FOREIGN_UID=$((CURRENT_UID + 1))
+
+# Stub `find` and `stat` so we can simulate /tmp contents without
+# actually touching /tmp.
+make_stubs() {
+    local listing="$1"   # newline-separated: path:uid:owner
+    cat > "$STUB_DIR/find" <<'STUB'
+#!/bin/bash
+# Only respond to the hook's exact query. Pass other args through.
+if [[ "$*" == *"/tmp -maxdepth 1 -name claude-settings-"* ]]; then
+    LISTING_FILE="${STUB_LISTING_FILE:-}"
+    [ -n "$LISTING_FILE" ] && [ -f "$LISTING_FILE" ] && cut -d: -f1 "$LISTING_FILE"
+    exit 0
+fi
+exec /usr/bin/find "$@"
+STUB
+    chmod +x "$STUB_DIR/find"
+
+    cat > "$STUB_DIR/stat" <<'STUB'
+#!/bin/bash
+# Parse: stat -c '%u' /path  →  fmt=%u, target=/path
+fmt=""
+target=""
+while [ $# -gt 0 ]; do
+    case "$1" in
+        -c) fmt="$2"; shift 2 ;;
+        *) target="$1"; shift ;;
+    esac
+done
+LISTING_FILE="${STUB_LISTING_FILE:-}"
+[ -z "$LISTING_FILE" ] && exit 1
+while IFS=: read -r p u o; do
+    [ "$p" = "$target" ] || continue
+    case "$fmt" in
+        '%u') echo "$u"; exit 0 ;;
+        '%U') echo "$o"; exit 0 ;;
+    esac
+done < "$LISTING_FILE"
+exit 1
+STUB
+    chmod +x "$STUB_DIR/stat"
+
+    printf '%s\n' "$listing" > "$STUB_DIR/listing.txt"
+}
+
+run_case() {
+    local name="$1"
+    local listing="$2"
+    local expect_warn="$3"   # "yes" or "no"
+    local extra_env="${4:-}"
+
+    make_stubs "$listing"
+
+    local sess="stale-test-$(date +%s%N)-$$"
+    local input
+    input=$(jq -nc --arg sid "$sess" '{session_id:$sid}')
+
+    local stderr rc
+    stderr=$(echo "$input" | env -i HOME="$HOME" PATH="$STUB_DIR:/usr/bin:/bin" \
+        STUB_LISTING_FILE="$STUB_DIR/listing.txt" $extra_env "$HOOK" 2>&1 >/dev/null)
+    rc=$?
+
+    local warned=no
+    if echo "$stderr" | grep -q "stale-temp-settings-detector"; then
+        warned=yes
+    fi
+
+    if [ "$rc" -ne 0 ]; then
+        FAIL=$((FAIL+1))
+        echo "FAIL: $name — exit $rc (expected 0)"
+    elif [ "$warned" = "$expect_warn" ]; then
+        PASS=$((PASS+1))
+    else
+        FAIL=$((FAIL+1))
+        echo "FAIL: $name — warned=$warned, expected $expect_warn"
+        echo "      stderr: $stderr"
+    fi
+
+    [ -f "$LOG_DIR/stale-temp-settings-warned-$sess" ] && rm -f "$LOG_DIR/stale-temp-settings-warned-$sess"
+}
+
+CURRENT_OWNER=$(id -un)
+OTHER_OWNER="someone-else"
+
+# Test 1: no settings files at all → silent
+run_case "no settings files stays silent" "" no
+
+# Test 2: own settings file only → silent
+run_case "own settings file stays silent" \
+    "/tmp/claude-settings-own.json:$CURRENT_UID:$CURRENT_OWNER" no
+
+# Test 3: foreign settings file → warns
+run_case "foreign settings file warns" \
+    "/tmp/claude-settings-foreign.json:$FOREIGN_UID:$OTHER_OWNER" yes
+
+# Test 4: mix of own and foreign → warns (foreign present)
+LISTING="/tmp/claude-settings-own.json:$CURRENT_UID:$CURRENT_OWNER
+/tmp/claude-settings-foreign.json:$FOREIGN_UID:$OTHER_OWNER"
+run_case "mixed listing warns on the foreign one" "$LISTING" yes
+
+# Test 5: disable env silences even with foreign file
+run_case "disable env silences" \
+    "/tmp/claude-settings-foreign.json:$FOREIGN_UID:$OTHER_OWNER" no \
+    "STALE_TEMP_SETTINGS_DISABLE=1"
+
+# Test 6: second run in same session is silent
+make_stubs "/tmp/claude-settings-foreign.json:$FOREIGN_UID:$OTHER_OWNER"
+SESS6="stale-test-twice-$(date +%s%N)-$$"
+INPUT6=$(jq -nc --arg sid "$SESS6" '{session_id:$sid}')
+FIRST=$(echo "$INPUT6" | env -i HOME="$HOME" PATH="$STUB_DIR:/usr/bin:/bin" STUB_LISTING_FILE="$STUB_DIR/listing.txt" "$HOOK" 2>&1 >/dev/null)
+SECOND=$(echo "$INPUT6" | env -i HOME="$HOME" PATH="$STUB_DIR:/usr/bin:/bin" STUB_LISTING_FILE="$STUB_DIR/listing.txt" "$HOOK" 2>&1 >/dev/null)
+if echo "$FIRST" | grep -q "stale-temp-settings-detector" \
+   && ! echo "$SECOND" | grep -q "stale-temp-settings-detector"; then
+    PASS=$((PASS+1))
+else
+    FAIL=$((FAIL+1))
+    echo "FAIL: second run in same session not silenced"
+    echo "      first:  $FIRST"
+    echo "      second: $SECOND"
+fi
+[ -f "$LOG_DIR/stale-temp-settings-warned-$SESS6" ] && rm -f "$LOG_DIR/stale-temp-settings-warned-$SESS6"
+
+# Test 7: malformed input (no session_id) → still safe
+STDERR7=$(echo '{}' | env -i HOME="$HOME" PATH="$STUB_DIR:/usr/bin:/bin" STUB_LISTING_FILE="$STUB_DIR/listing.txt" "$HOOK" 2>&1 >/dev/null)
+RC7=$?
+if [ "$RC7" -eq 0 ]; then
+    PASS=$((PASS+1))
+else
+    FAIL=$((FAIL+1))
+    echo "FAIL: malformed input should exit 0 (rc=$RC7)"
+fi
+
+echo
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/test-standing-rule-session-surfacer.sh

@@ -0,0 +1,215 @@
+#!/bin/bash
+# Tests for standing-rule-session-surfacer.sh
+# Hook addresses issue #59944 (auto-memory rule loaded but not enforced).
+set -euo pipefail
+
+HOOK="$(dirname "$0")/../examples/standing-rule-session-surfacer.sh"
+PASS=0
+FAIL=0
+
+# Create a temp memory directory with various test fixtures.
+TMP_MEMORY=$(mktemp -d /tmp/test-standing-rule.XXXXXX)
+trap 'rm -rf "$TMP_MEMORY"' EXIT
+
+# --- Test 1: empty memory dir produces no output ---
+mkdir -p "$TMP_MEMORY/empty"
+output=$(echo '{}' | CC_STANDING_RULE_MEMORY_DIR="$TMP_MEMORY/empty" bash "$HOOK")
+if [ -z "$output" ]; then
+    echo "  PASS: empty memory dir produces no output"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: empty dir should produce no output, got: $output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 2: memory file with no rule markers produces no output ---
+mkdir -p "$TMP_MEMORY/no-rules"
+cat > "$TMP_MEMORY/no-rules/notes.md" <<'EOF'
+# Just some notes
+- Random observation
+- A small thought
+- No standing rules here
+EOF
+output=$(echo '{}' | CC_STANDING_RULE_MEMORY_DIR="$TMP_MEMORY/no-rules" bash "$HOOK")
+if [ -z "$output" ]; then
+    echo "  PASS: file with no markers produces no output"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: no-markers file should produce no output, got: $output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 3: memory file with STANDING RULE produces JSON output ---
+mkdir -p "$TMP_MEMORY/with-rule"
+cat > "$TMP_MEMORY/with-rule/feedback.md" <<'EOF'
+# Operator feedback
+
+STANDING RULE: every problem/feature → loop dlog+screenshot+cliclick+analyze+correct
+Do NOT bounce verification to user as default.
+
+Marked third strike because I had to add it after two prior incidents.
+EOF
+output=$(echo '{}' | CC_STANDING_RULE_MEMORY_DIR="$TMP_MEMORY/with-rule" bash "$HOOK")
+if echo "$output" | grep -q "STANDING RULE"; then
+    echo "  PASS: STANDING RULE marker is surfaced"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: STANDING RULE not in output: $output"
+    FAIL=$((FAIL + 1))
+fi
+
+if echo "$output" | grep -q "third strike"; then
+    echo "  PASS: third strike marker is surfaced"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: third strike not in output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 4: JSON output is valid and has hookSpecificOutput ---
+if echo "$output" | jq -e '.hookSpecificOutput.additionalContext' > /dev/null 2>&1; then
+    echo "  PASS: output is valid JSON with hookSpecificOutput.additionalContext"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: output not valid hookSpecificOutput JSON"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 5: hookEventName is SessionStart ---
+event=$(echo "$output" | jq -r '.hookSpecificOutput.hookEventName // "MISSING"')
+if [ "$event" = "SessionStart" ]; then
+    echo "  PASS: hookEventName is SessionStart"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: hookEventName should be SessionStart, got: $event"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 6: Japanese markers (必ず / 絶対 / etc.) are surfaced ---
+mkdir -p "$TMP_MEMORY/japanese"
+cat > "$TMP_MEMORY/japanese/feedback-jp.md" <<'EOF'
+# 日本語の規則
+
+絶対ルール: 投稿の前に必ず手元の事実の確認を実行する。
+ぐらすの指示なしで購入の頁の変更はやるな。
+EOF
+output=$(echo '{}' | CC_STANDING_RULE_MEMORY_DIR="$TMP_MEMORY/japanese" bash "$HOOK")
+if echo "$output" | grep -q "絶対"; then
+    echo "  PASS: Japanese 絶対 marker is surfaced"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: Japanese 絶対 not in output: $output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 7: MUST NOT and NEVER markers are surfaced ---
+mkdir -p "$TMP_MEMORY/must-never"
+cat > "$TMP_MEMORY/must-never/rules.md" <<'EOF'
+# Hard rules
+
+MUST NOT push to main without review.
+NEVER do force push on shared branches.
+ALWAYS do tests before commit.
+EOF
+output=$(echo '{}' | CC_STANDING_RULE_MEMORY_DIR="$TMP_MEMORY/must-never" bash "$HOOK")
+if echo "$output" | grep -q "MUST NOT"; then
+    echo "  PASS: MUST NOT marker is surfaced"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: MUST NOT not in output"
+    FAIL=$((FAIL + 1))
+fi
+
+if echo "$output" | grep -q "NEVER do"; then
+    echo "  PASS: NEVER do marker is surfaced"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: NEVER do not in output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 8: MAX_LINES limit is enforced per file ---
+mkdir -p "$TMP_MEMORY/many-rules"
+cat > "$TMP_MEMORY/many-rules/many.md" <<'EOF'
+STANDING RULE 1
+STANDING RULE 2
+STANDING RULE 3
+STANDING RULE 4
+STANDING RULE 5
+STANDING RULE 6
+STANDING RULE 7
+STANDING RULE 8
+STANDING RULE 9
+STANDING RULE 10
+STANDING RULE 11
+STANDING RULE 12
+EOF
+output=$(echo '{}' | CC_STANDING_RULE_MAX_LINES=5 CC_STANDING_RULE_MEMORY_DIR="$TMP_MEMORY/many-rules" bash "$HOOK")
+# Should surface 5 rules, not 12. JSON encodes newlines as \n, so extract
+# the additionalContext string, decode, and count rule lines.
+rules_count=$(echo "$output" | jq -r '.hookSpecificOutput.additionalContext' | grep -cE '^[0-9]+:STANDING RULE [0-9]+' || true)
+if [ "$rules_count" -eq 5 ]; then
+    echo "  PASS: MAX_LINES limit honored (count=$rules_count, expected 5)"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: MAX_LINES not honored, count=$rules_count (expected 5)"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 9: hook is idempotent (running twice produces same output) ---
+mkdir -p "$TMP_MEMORY/idempotent"
+cat > "$TMP_MEMORY/idempotent/r.md" <<'EOF'
+STANDING RULE: keep things simple.
+EOF
+out1=$(echo '{}' | CC_STANDING_RULE_MEMORY_DIR="$TMP_MEMORY/idempotent" bash "$HOOK")
+out2=$(echo '{}' | CC_STANDING_RULE_MEMORY_DIR="$TMP_MEMORY/idempotent" bash "$HOOK")
+if [ "$out1" = "$out2" ]; then
+    echo "  PASS: hook is idempotent"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: hook is not idempotent"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 10: non-existent memory dir is handled gracefully ---
+output=$(echo '{}' | CC_STANDING_RULE_MEMORY_DIR="$TMP_MEMORY/does-not-exist" bash "$HOOK")
+if [ -z "$output" ]; then
+    echo "  PASS: non-existent dir handled gracefully (empty output)"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: non-existent dir produced unexpected output: $output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 11: custom pattern is honored ---
+mkdir -p "$TMP_MEMORY/custom-pattern"
+cat > "$TMP_MEMORY/custom-pattern/feedback.md" <<'EOF'
+CRITICAL: do not skip security checks.
+INFO: this is just informational.
+EOF
+output=$(echo '{}' | CC_STANDING_RULE_PATTERN="CRITICAL" CC_STANDING_RULE_MEMORY_DIR="$TMP_MEMORY/custom-pattern" bash "$HOOK")
+if echo "$output" | grep -q "CRITICAL"; then
+    echo "  PASS: custom pattern (CRITICAL) is honored"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: custom pattern not honored"
+    FAIL=$((FAIL + 1))
+fi
+
+# Verify INFO is NOT included when only CRITICAL is the pattern
+if echo "$output" | grep -q "INFO: this is"; then
+    echo "  FAIL: INFO should not be in output when pattern=CRITICAL"
+    FAIL=$((FAIL + 1))
+else
+    echo "  PASS: INFO correctly excluded when pattern=CRITICAL"
+    PASS=$((PASS + 1))
+fi
+
+# --- Summary ---
+echo ""
+echo "=================================="
+echo "Tests passed: $PASS"
+echo "Tests failed: $FAIL"
+echo "=================================="
+
+[ "$FAIL" -eq 0 ]

package/tests/test-starter-hooks-manifest.sh

@@ -0,0 +1,96 @@
+#!/bin/bash
+# test-starter-hooks-manifest.sh — hooks/hooks.json の同梱フックを両方向で検証する
+#
+# なぜ要るか: hooks/hooks.json は README から参照されていないが、リポジトリを
+# 見に来た人が実際に開いてコピーしていく面（2026-08-18 に traffic API で実測＝
+# 14日で6閲覧・2人）。そこに入っている素通りは、そのまま利用者の環境へ複製される。
+#
+# 2026-08-18 に実測で見つかった4件の素通り／誤爆を、二度と入れないための回帰試験。
+#   1. 免除の語がコマンド全体に部分一致し、"./buildout" や末尾に足した "/tmp" で無効化された
+#   2. --force-with-lease（案内文自身が勧める安全側）を止めていた
+#   3. .env.local / .env.production / 拡張子の無い credentials が素通りした
+#   4. api.key の "." が任意の1文字に当たり apiXkey で誤爆した
+#
+# 対照を必ず置く（止める側と通す側の両方を数える）。片方だけだと、
+# 何も止めないフックでも、何でも止めるフックでも「合格」になる。
+
+set -u
+cd "$(dirname "$0")/.." || exit 1
+# 対照を取れるようにする＝旧版を指して走らせると落ちることを確かめられる
+MANIFEST="${MANIFEST:-hooks/hooks.json}"
+PASS=0
+FAIL=0
+
+command -v jq >/dev/null 2>&1 || { echo "SKIP: jq が無いのでこの試験は成立しない"; exit 0; }
+
+# 目録から、スクリプトを指していない素のフックの本体を取り出す
+extract() {
+  python3 -c "
+import json,sys
+d=json.load(open('$MANIFEST'))
+out=[h['command'] for e in d['hooks']['PreToolUse'] for h in e['hooks']]
+out=[c for c in out if not c.strip().startswith('~')]
+print(out[int(sys.argv[1])])
+" "$1"
+}
+
+payload_cmd() {
+  python3 -c "import json,sys;print(json.dumps({'tool_input':{'command':sys.argv[1]}}))" "$1"
+}
+payload_file() {
+  python3 -c "import json,sys;print(json.dumps({'tool_input':{'file_path':sys.argv[1]}}))" "$1"
+}
+
+# $1=フックの番号 $2=payload $3=期待の終了コード $4=説明
+check() {
+  local body rc
+  body=$(extract "$1")
+  rc=$(printf '%s' "$2" | bash -c "$body
+exit 0" >/dev/null 2>&1; echo $?)
+  if [ "$rc" = "$3" ]; then
+    PASS=$((PASS + 1)); echo "  PASS: $4"
+  else
+    FAIL=$((FAIL + 1)); echo "  FAIL: $4 (終了コード $rc・期待 $3)"
+  fi
+}
+
+DEL="rm"
+
+echo "== 再帰削除の番人 =="
+check 0 "$(payload_cmd "$DEL -rf ./buildout")"                2 "免除の語の部分一致で素通りしない (buildout)"
+check 0 "$(payload_cmd "$DEL -rf ./distribution")"            2 "免除の語の部分一致で素通りしない (distribution)"
+check 0 "$(payload_cmd "$DEL -rf ./data && ls /tmp")"         2 "後ろに足した語では免除されない"
+check 0 "$(payload_cmd "$DEL -rf ./data # cleanup of build")" 2 "コメントの語では免除されない"
+check 0 "$(payload_cmd "sudo $DEL -rf ./stage")"              2 "sudo つきも止める"
+check 0 "$(payload_cmd "$DEL --recursive ./data")"            2 "長い書き方の再帰も止める"
+check 0 "$(payload_cmd "$DEL -rf node_modules")"              0 "対照: 本当に安全な対象は通す"
+check 0 "$(payload_cmd "$DEL -rf /tmp/x")"                    0 "対照: /tmp は通す"
+check 0 "$(payload_cmd "$DEL -f one.txt")"                    0 "対照: 再帰でなければ通す"
+
+echo "== git の番人 =="
+check 1 "$(payload_cmd 'git push --force origin main')" 2 "強制の push を止める"
+check 1 "$(payload_cmd 'git reset --hard HEAD~1')"      2 "hard reset を止める"
+check 1 "$(payload_cmd 'git clean -fd')"                2 "追跡外の掃除を止める"
+check 1 "$(payload_cmd 'git push --force-with-lease origin a; git push --force origin b')" 2 "安全側を混ぜても危険側は止める"
+check 1 "$(payload_cmd 'git push --force-with-lease origin main')" 0 "対照: 案内文が勧める安全側は通す"
+check 1 "$(payload_cmd 'git push origin main')"                    0 "対照: 素の push は通す"
+
+echo "== 資格情報の番人 =="
+check 2 "$(payload_cmd 'export API_KEY=abcdefghij0123456789')" 2 "環境変数への直書きを止める"
+check 2 "$(payload_cmd 'export apiXkey=abcdefghij0123456789')" 0 "対照: 任意の1文字には当たらない"
+check 2 "$(payload_cmd 'echo hello')"                          0 "対照: 無関係な命令は通す"
+
+echo "== 機微ファイルの番人 =="
+check 3 "$(payload_file '.env')"             2 ".env を止める"
+check 3 "$(payload_file '.env.local')"       2 ".env.local を止める"
+check 3 "$(payload_file '.env.production')"  2 ".env.production を止める"
+check 3 "$(payload_file '.aws/credentials')" 2 "拡張子の無い credentials を止める"
+check 3 "$(payload_file 'config/secret')"    2 "拡張子の無い secret を止める"
+check 3 "$(payload_file 'cert.pem')"         2 ".pem を止める"
+check 3 "$(payload_file '.env.example')"     0 "対照: 見本の .env は通す"
+check 3 "$(payload_file 'src/main.py')"      0 "対照: 普通のソースは通す"
+check 3 "$(payload_file 'README.md')"        0 "対照: 普通の文書は通す"
+
+echo
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]