cc-safe-setup 29.8.0 → 30.0.4

package/tests/test-subagent-destructive-git-guard.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+# Tests for subagent-destructive-git-guard.sh (Issue #57463 / #46444 / #53765 prevention)
+HOOK="examples/subagent-destructive-git-guard.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+# Test 1: Empty prompt should silently pass
+OUT=$(echo '{"tool_input":{"prompt":""}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "empty prompt no warning" "$OUT" "destructive-git boundary"
+assert_exit "empty prompt exit 0" "$RC" "0"
+
+# Test 2: Vague prompt should warn on all 3 checks
+OUT=$(echo '{"tool_input":{"prompt":"please rename Tailwind classes across all .tsx files"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "vague warns destructive forbidden" "$OUT" "Destructive git commands not forbidden"
+assert_contains "vague warns safe alternative" "$OUT" "No safe alternative named"
+assert_contains "vague warns working tree check" "$OUT" "No working-tree state check"
+assert_contains "vague references 57463" "$OUT" "#57463"
+assert_contains "vague references 46444" "$OUT" "#46444"
+assert_contains "vague references 53765" "$OUT" "#53765"
+assert_exit "vague exit 0 advisory" "$RC" "0"
+
+# Test 3: Destructive forbidden named, other 2 missing
+OUT=$(echo '{"tool_input":{"prompt":"Do not use git checkout or git reset. Rename classes."}}' | bash "$HOOK" 2>&1)
+assert_not_contains "destructive only no destructive warning" "$OUT" "Destructive git commands not forbidden"
+assert_contains "destructive only warns alternative" "$OUT" "No safe alternative named"
+assert_contains "destructive only warns tree check" "$OUT" "No working-tree state check"
+
+# Test 4: Safe alternative named, other 2 missing
+OUT=$(echo '{"tool_input":{"prompt":"Use git stash before any change. Rename classes."}}' | bash "$HOOK" 2>&1)
+assert_contains "alternative only warns destructive" "$OUT" "Destructive git commands not forbidden"
+assert_not_contains "alternative only no alternative warning" "$OUT" "No safe alternative named"
+assert_contains "alternative only warns tree check" "$OUT" "No working-tree state check"
+
+# Test 5: Working tree check named, other 2 missing
+OUT=$(echo '{"tool_input":{"prompt":"Run git status first before any change. Rename classes."}}' | bash "$HOOK" 2>&1)
+assert_contains "tree check only warns destructive" "$OUT" "Destructive git commands not forbidden"
+assert_contains "tree check only warns alternative" "$OUT" "No safe alternative named"
+assert_not_contains "tree check only no tree check warning" "$OUT" "No working-tree state check"
+
+# Test 6: All 3 boundary instructions present, no warning
+OUT=$(echo '{"tool_input":{"prompt":"Do not use git checkout, git reset, or git restore. Use git stash before any change. Run git status first to verify working tree state. Rename Tailwind classes across .tsx files."}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "well-formed no warning" "$OUT" "destructive-git boundary"
+assert_exit "well-formed exit 0" "$RC" "0"
+
+# Test 7: Japanese prompt with all 3 instructions, no warning
+OUT=$(echo '{"tool_input":{"prompt":"git checkout / git reset / git restore は禁止。stash の利用を優先。git status を最初に実行して作業の場の状態を確認してから、Tailwind class を rename する。"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "Japanese well-formed no warning" "$OUT" "destructive-git boundary"
+assert_exit "Japanese well-formed exit 0" "$RC" "0"
+
+# Test 8: Strict mode blocks vague prompts
+OUT=$(echo '{"tool_input":{"prompt":"rename classes"}}' | CC_SUBAGENT_DESTRUCTIVE_GIT_REQUIRE_ALL=1 bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "strict mode warns" "$OUT" "destructive-git boundary"
+assert_exit "strict mode blocks (exit 2)" "$RC" "2"
+
+# Test 9: Missing prompt field should silently pass
+OUT=$(echo '{}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "missing prompt no warning" "$OUT" "destructive-git boundary"
+assert_exit "missing prompt exit 0" "$RC" "0"
+
+# Test 10: Strict mode passes when boundary is set
+OUT=$(echo '{"tool_input":{"prompt":"Do not use git checkout. Use git stash. Check git status first. Rename."}}' | CC_SUBAGENT_DESTRUCTIVE_GIT_REQUIRE_ALL=1 bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "strict well-formed no warning" "$OUT" "destructive-git boundary"
+assert_exit "strict well-formed exit 0" "$RC" "0"
+
+# Test 11: "destructive git" general phrase satisfies check 1
+OUT=$(echo '{"tool_input":{"prompt":"No destructive git commands allowed. Use git stash. Check git status first."}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "general phrase satisfies destructive check" "$OUT" "Destructive git commands not forbidden"
+
+# Test 12: "ask the parent before" satisfies safe alternative check
+OUT=$(echo '{"tool_input":{"prompt":"Do not use git checkout. Ask the parent before any destructive operation. Check git status first."}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "ask parent satisfies alternative" "$OUT" "No safe alternative named"
+
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/test-subagent-identity-leak-guard.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+# Tests for subagent-identity-leak-guard.sh (Issue #55488 prevention)
+HOOK="examples/subagent-identity-leak-guard.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+# Test 1: Empty prompt should silently pass
+OUT=$(echo '{"tool_input":{"prompt":""}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "empty prompt no warning" "$OUT" "Subagent identity boundary"
+assert_exit "empty prompt exit 0" "$RC" "0"
+
+# Test 2: Vague prompt should warn on all 3 checks
+OUT=$(echo '{"tool_input":{"prompt":"please investigate the auth flow"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "vague prompt warns role" "$OUT" "No explicit role assignment"
+assert_contains "vague prompt warns impersonation" "$OUT" "No prohibition against impersonating"
+assert_contains "vague prompt warns history" "$OUT" "No prohibition against exposing"
+assert_contains "vague prompt references issue" "$OUT" "#55488"
+assert_exit "vague prompt exit 0 advisory" "$RC" "0"
+
+# Test 3: Role assignment present, other 2 missing
+OUT=$(echo '{"tool_input":{"prompt":"You are the backend agent. Investigate src/auth/login.ts."}}' | bash "$HOOK" 2>&1)
+assert_not_contains "role only no role warning" "$OUT" "No explicit role"
+assert_contains "role only warns impersonation" "$OUT" "No prohibition against impersonating"
+assert_contains "role only warns history" "$OUT" "No prohibition against exposing"
+
+# Test 4: Impersonation prohibition present, other 2 missing
+OUT=$(echo '{"tool_input":{"prompt":"Do not identify as the parent. Do something useful."}}' | bash "$HOOK" 2>&1)
+assert_contains "impersonation only warns role" "$OUT" "No explicit role"
+assert_not_contains "impersonation only no impersonation warning" "$OUT" "No prohibition against impersonating"
+assert_contains "impersonation only warns history" "$OUT" "No prohibition against exposing"
+
+# Test 5: History prohibition present, other 2 missing
+OUT=$(echo '{"tool_input":{"prompt":"Do not share the parent agent conversation history. Run a task."}}' | bash "$HOOK" 2>&1)
+assert_contains "history only warns role" "$OUT" "No explicit role"
+assert_contains "history only warns impersonation" "$OUT" "No prohibition against impersonating"
+assert_not_contains "history only no history warning" "$OUT" "No prohibition against exposing"
+
+# Test 6: All 3 boundary instructions present, no warning
+OUT=$(echo '{"tool_input":{"prompt":"You are the backend agent. Do not identify as the parent or team-lead. Do not share the parent main agent conversation history. Investigate src/auth/login.ts."}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "well-formed no warning" "$OUT" "Subagent identity boundary"
+assert_exit "well-formed exit 0" "$RC" "0"
+
+# Test 7: Strict mode (CC_SUBAGENT_IDENTITY_REQUIRE_ALL=1) blocks vague prompts
+OUT=$(echo '{"tool_input":{"prompt":"investigate something"}}' | CC_SUBAGENT_IDENTITY_REQUIRE_ALL=1 bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "strict mode warns" "$OUT" "Subagent identity boundary"
+assert_exit "strict mode blocks (exit 2)" "$RC" "2"
+
+# Test 8: Missing prompt field should silently pass
+OUT=$(echo '{}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "missing prompt no warning" "$OUT" "Subagent identity boundary"
+assert_exit "missing prompt exit 0" "$RC" "0"
+
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/test-subagent-identity-reassertion.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+# Tests for subagent-identity-reassertion.sh — Issue #55488 mitigation hook
+HOOK="examples/subagent-identity-reassertion.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+assert_exit_code() { if [ "$2" -eq "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+# Test 1: Agent tool with subagent_type emits reminder block
+OUT=$(echo '{"tool_name":"Agent","tool_input":{"subagent_type":"general-purpose","name":"backend"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "Agent tool emits reminder header" "$OUT" "subagent-identity-reassertion"
+assert_contains "reminder includes subagent label" "$OUT" "backend (general-purpose)"
+assert_contains "reminder mentions Issue #55488" "$OUT" "#55488"
+assert_contains "reminder includes parent-relay guard" "$OUT" "route sensitive DMs through the parent"
+assert_contains "reminder includes context audit guard" "$OUT" "parent context does not contain secrets"
+assert_contains "reminder includes identity-lock guard" "$OUT" "Confirm"
+assert_exit_code "Agent tool exit 0" "$RC" 0
+
+# Test 2: Bash tool skips silently with exit 0 (non-Agent fast path)
+OUT=$(echo '{"tool_name":"Bash","tool_input":{"command":"ls"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "Bash tool emits no reminder" "$OUT" "subagent-identity-reassertion"
+assert_exit_code "Bash tool exit 0" "$RC" 0
+
+# Test 3: Empty tool_name skips silently
+OUT=$(echo '{}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "empty input emits no reminder" "$OUT" "subagent-identity-reassertion"
+assert_exit_code "empty input exit 0" "$RC" 0
+
+# Test 4: Agent without subagent_type still emits reminder with default label
+OUT=$(echo '{"tool_name":"Agent","tool_input":{}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "Agent without subagent_type still warns" "$OUT" "subagent-identity-reassertion"
+assert_contains "default role label is subagent" "$OUT" "Spawning subagent"
+assert_exit_code "Agent without subagent_type exit 0" "$RC" 0
+
+# Test 5: Agent with only subagent_type (no name)
+OUT=$(echo '{"tool_name":"Agent","tool_input":{"subagent_type":"general-purpose"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "Agent with only subagent_type" "$OUT" "Spawning general-purpose"
+assert_exit_code "exit 0" "$RC" 0
+
+# Test 6: Read tool (another non-Agent) skips silently
+OUT=$(echo '{"tool_name":"Read","tool_input":{"file_path":"/tmp/x"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "Read tool emits no reminder" "$OUT" "subagent-identity-reassertion"
+assert_exit_code "Read tool exit 0" "$RC" 0
+
+# Test 7: Malformed JSON falls through silently (jq returns empty)
+OUT=$(echo 'not json' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "malformed JSON does not warn" "$OUT" "subagent-identity-reassertion"
+# Note: jq exits with non-zero on malformed JSON, but `// empty` + set -euo
+# may cause exit 1 here. Accept exit 0 or 1 (silent failure is acceptable).
+[ "$RC" -le 1 ] && PASS=$((PASS+1)) || { FAIL=$((FAIL+1)); echo "FAIL: malformed JSON exit code $RC > 1"; }
+
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/test-subagent-inheritance-tester.sh

@@ -0,0 +1,319 @@
+#!/bin/bash
+# Tests for subagent-inheritance-tester.sh — verifies that subagent
+# frontmatter gaps (missing tools:, memory: misuse, missing name:,
+# no frontmatter) are surfaced, and that parent Deny rules escalate
+# the warning text for missing tool bindings.
+
+HOOK="examples/subagent-inheritance-tester.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3' in: $2)"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3' in: $2)"; fi; }
+assert_exit() { if [ "$2" -eq "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (exit $2, expected $3)"; fi; }
+
+TMPDIR=$(mktemp -d)
+PROJ_DIR="$TMPDIR/project"
+HOME_AGENTS="$TMPDIR/home/.claude/agents"
+PROJ_AGENTS="$PROJ_DIR/.claude/agents"
+mkdir -p "$HOME_AGENTS" "$PROJ_AGENTS"
+
+# Run the hook with isolated $HOME and a synthetic project cwd.
+run_hook() {
+    local cwd="$1"
+    local input
+    input=$(jq -n --arg c "$cwd" '{cwd: $c}')
+    printf '%s' "$input" | HOME="$TMPDIR/home" bash "$HOOK" 2>&1
+}
+
+# ---- Test 1: empty input + no agents → exit 0 silently ----
+rm -rf "$TMPDIR/home/.claude/agents"
+OUT=$(echo '{}' | HOME="$TMPDIR/home" bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "no agents dir exits 0" "$RC" 0
+assert_not_contains "no agents dir no output" "$OUT" "subagent-inheritance"
+mkdir -p "$HOME_AGENTS"
+
+# ---- Test 2: well-formed agent with tools: → no warning ----
+cat > "$HOME_AGENTS/good.md" <<'EOF'
+---
+name: good-agent
+description: Tightly scoped helper
+tools: Read, Grep
+model: sonnet
+---
+You are a focused helper.
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "well-formed agent exits 0" "$RC" 0
+assert_not_contains "well-formed agent no warning" "$OUT" "subagent-inheritance"
+
+# ---- Test 3: agent without frontmatter → warning ----
+cat > "$HOME_AGENTS/no-frontmatter.md" <<'EOF'
+You are an agent without YAML frontmatter.
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "no-frontmatter exits 0 (warn-only)" "$RC" 0
+assert_contains "no-frontmatter warned" "$OUT" "no YAML frontmatter"
+
+# ---- Test 4: agent missing tools: → warning ----
+rm -f "$HOME_AGENTS/no-frontmatter.md"
+cat > "$HOME_AGENTS/missing-tools.md" <<'EOF'
+---
+name: missing-tools
+description: Agent with no explicit tools list
+model: sonnet
+---
+Body.
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "missing-tools exits 0" "$RC" 0
+assert_contains "missing-tools warned about default tool set" "$OUT" "no explicit 'tools:' list"
+
+# ---- Test 5: agent with memory: field → warned about #57507 ----
+cat > "$HOME_AGENTS/memory-only.md" <<'EOF'
+---
+name: memory-only
+description: Author thought memory: would scope this agent
+memory: scoped
+tools: Read
+---
+Body.
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "memory-only exits 0" "$RC" 0
+assert_contains "memory-only flagged" "$OUT" "57507"
+assert_contains "memory-only mentions silently ignored" "$OUT" "silently ignored"
+rm -f "$HOME_AGENTS/memory-only.md"
+
+# ---- Test 6: agent missing name: → warning ----
+cat > "$HOME_AGENTS/no-name.md" <<'EOF'
+---
+description: Missing required name key
+tools: Read
+---
+Body.
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "no-name exits 0" "$RC" 0
+assert_contains "no-name warned" "$OUT" "missing required 'name:'"
+rm -f "$HOME_AGENTS/no-name.md"
+
+# ---- Test 7: parent Deny rules escalate missing-tools warning ----
+mkdir -p "$TMPDIR/home/.claude"
+cat > "$TMPDIR/home/.claude/settings.json" <<'EOF'
+{
+  "permissions": {
+    "deny": ["Read(./.env)", "Read(./.env.*)"]
+  }
+}
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "deny-rules + missing tools exits 0" "$RC" 0
+assert_contains "deny-rules escalation cites #57068" "$OUT" "57068"
+assert_contains "deny-rules listed in output" "$OUT" "Read(./.env)"
+
+# ---- Test 8: BLOCK=1 with issues → exit 2 ----
+OUT=$(CC_SUBAGENT_INHERITANCE_BLOCK=1 run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "block mode with issues exits 2" "$RC" 2
+assert_contains "block mode still emits warning text" "$OUT" "subagent-inheritance"
+
+# ---- Test 9: BLOCK=1 with no issues → exit 0 ----
+rm -f "$HOME_AGENTS/missing-tools.md"
+OUT=$(CC_SUBAGENT_INHERITANCE_BLOCK=1 run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "block mode without issues exits 0" "$RC" 0
+assert_not_contains "block mode no issues no warning" "$OUT" "subagent-inheritance"
+
+# ---- Test 10: project-level .claude/agents/ scanned via cwd ----
+cat > "$PROJ_AGENTS/proj-agent.md" <<'EOF'
+---
+name: proj-agent
+description: Project agent with no tools
+---
+Body.
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "project agent dir exits 0" "$RC" 0
+assert_contains "project agent dir scanned" "$OUT" "proj-agent.md"
+rm -f "$PROJ_AGENTS/proj-agent.md"
+
+# ---- Test 11: backup files (.bak) skipped ----
+cat > "$HOME_AGENTS/old.md.bak" <<'EOF'
+broken file
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "backup file skipped exits 0" "$RC" 0
+assert_not_contains "backup file not warned" "$OUT" "old.md.bak"
+rm -f "$HOME_AGENTS/old.md.bak"
+
+# ---- Test 12: extra paths via env var ----
+mkdir -p "$TMPDIR/extra"
+cat > "$TMPDIR/extra/extra-agent.md" <<'EOF'
+---
+description: extra path agent missing name and tools
+---
+Body.
+EOF
+OUT=$(CC_SUBAGENT_INHERITANCE_PATHS="$TMPDIR/extra" run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "extra path agent exits 0" "$RC" 0
+assert_contains "extra path agent scanned" "$OUT" "extra-agent.md"
+
+# ---- Test 13: real-world #57068 repro — Deny .env + agent w/o tools ----
+cat > "$HOME_AGENTS/57068-repro.md" <<'EOF'
+---
+name: helpful
+description: General helper
+---
+You may help with anything.
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "#57068 repro exits 0" "$RC" 0
+assert_contains "#57068 repro escalates with deny" "$OUT" "57068"
+assert_contains "#57068 repro names the file" "$OUT" "57068-repro.md"
+rm -f "$HOME_AGENTS/57068-repro.md"
+
+# ---- Test 14: real-world #57507 repro — memory: present ----
+cat > "$HOME_AGENTS/57507-repro.md" <<'EOF'
+---
+name: scoped
+description: Author tried to bind via memory:
+memory:
+  scope: subagent-only
+tools: Read
+---
+Body.
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "#57507 repro exits 0" "$RC" 0
+assert_contains "#57507 repro flags memory:" "$OUT" "57507"
+rm -f "$HOME_AGENTS/57507-repro.md"
+
+# ---- Test 15: empty frontmatter block ----
+printf -- '---\n---\nbody only\n' > "$HOME_AGENTS/empty-fm.md"
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "empty frontmatter exits 0" "$RC" 0
+assert_contains "empty frontmatter warned" "$OUT" "empty-fm.md"
+rm -f "$HOME_AGENTS/empty-fm.md"
+
+# ---- Test 16: settings without deny → no escalation text ----
+cat > "$TMPDIR/home/.claude/settings.json" <<'EOF'
+{}
+EOF
+cat > "$HOME_AGENTS/missing-tools-2.md" <<'EOF'
+---
+name: ok-name
+description: missing tools
+---
+Body.
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "no-deny + missing tools exits 0" "$RC" 0
+assert_contains "no-deny still warns about default tool set" "$OUT" "Pin to least-privilege"
+# Per-line warning should not escalate (no #57068 inline). Reference list
+# at the bottom always cites both issues, so check only the issue line.
+ISSUE_LINE=$(echo "$OUT" | grep "missing-tools-2.md" || true)
+assert_not_contains "no-deny issue line does not cite #57068" "$ISSUE_LINE" "57068"
+rm -f "$HOME_AGENTS/missing-tools-2.md"
+
+# ---- Test 17: malformed JSON input → still scans HOME via $CLAUDE_PROJECT_DIR fallback ----
+cat > "$HOME_AGENTS/needs-tools.md" <<'EOF'
+---
+name: needs-tools
+description: missing tools
+---
+Body.
+EOF
+OUT=$(printf 'not-json' | HOME="$TMPDIR/home" bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "non-json input exits 0" "$RC" 0
+assert_contains "non-json input still scans home agents" "$OUT" "needs-tools.md"
+
+# ---- Test 18: well-formed + tools list → no warning even with deny ----
+rm -f "$HOME_AGENTS/needs-tools.md"
+cat > "$TMPDIR/home/.claude/settings.json" <<'EOF'
+{
+  "permissions": {
+    "deny": ["Read(./.env)"]
+  }
+}
+EOF
+cat > "$HOME_AGENTS/scoped.md" <<'EOF'
+---
+name: scoped
+description: properly scoped
+tools: Read, Grep, Bash
+---
+Body.
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "scoped+deny exits 0" "$RC" 0
+assert_not_contains "scoped+deny no warning" "$OUT" "subagent-inheritance"
+rm -f "$HOME_AGENTS/scoped.md"
+rm -f "$TMPDIR/home/.claude/settings.json"
+
+# ---- Test 19: many agents, mixed states → each issue named ----
+cat > "$HOME_AGENTS/good-1.md" <<'EOF'
+---
+name: g1
+tools: Read
+---
+Body.
+EOF
+cat > "$HOME_AGENTS/bad-1.md" <<'EOF'
+---
+name: b1
+description: missing tools
+---
+Body.
+EOF
+cat > "$HOME_AGENTS/bad-2.md" <<'EOF'
+---
+name: b2
+memory: legacy
+tools: Read
+---
+Body.
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "mixed agents exits 0" "$RC" 0
+assert_contains "mixed agents flag bad-1" "$OUT" "bad-1.md"
+assert_contains "mixed agents flag bad-2" "$OUT" "bad-2.md"
+assert_not_contains "mixed agents skip good-1" "$OUT" "good-1.md"
+rm -f "$HOME_AGENTS/good-1.md" "$HOME_AGENTS/bad-1.md" "$HOME_AGENTS/bad-2.md"
+
+# ---- Test 20: Japanese description with English frontmatter keys ----
+cat > "$HOME_AGENTS/jp.md" <<'EOF'
+---
+name: jp-agent
+description: 日本語の説明 — tools 列が無い
+---
+本文
+EOF
+OUT=$(run_hook "$PROJ_DIR")
+RC=$?
+assert_exit "jp agent exits 0" "$RC" 0
+assert_contains "jp agent flagged" "$OUT" "jp.md"
+
+# Cleanup
+rm -rf "$TMPDIR"
+
+echo ""
+echo "PASS: $PASS"
+echo "FAIL: $FAIL"
+[ "$FAIL" -eq 0 ] && echo "OK" || exit 1

package/tests/test-subagent-permission-mode-guard.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+# Tests for subagent-permission-mode-guard.sh (Issue #55691 prevention)
+HOOK="examples/subagent-permission-mode-guard.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+# Test 1: No mode parameter, silent pass
+OUT=$(echo '{"tool_input":{"prompt":"do something"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "no mode no warning" "$OUT" "Subagent permission mode"
+assert_not_contains "no mode no early warn" "$OUT" "may be silently overridden"
+assert_exit "no mode exit 0" "$RC" "0"
+
+# Test 2: Mode parameter with no prompt
+OUT=$(echo '{"tool_input":{"mode":"bypassPermissions","prompt":""}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "empty prompt with mode warns" "$OUT" "may be silently overridden"
+assert_contains "empty prompt with mode references issue" "$OUT" "#55691"
+assert_exit "empty prompt with mode exit 0" "$RC" "0"
+
+# Test 3: Mode parameter with vague prompt warns 2 items
+OUT=$(echo '{"tool_input":{"mode":"bypassPermissions","prompt":"please investigate the auth flow"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "vague warns frontmatter" "$OUT" "frontmatter override risk"
+assert_contains "vague warns verification" "$OUT" "verification of the actual effective mode"
+assert_contains "vague references issue" "$OUT" "#55691"
+assert_exit "vague exit 0 advisory" "$RC" "0"
+
+# Test 4: Frontmatter mention only
+OUT=$(echo '{"tool_input":{"mode":"bypassPermissions","prompt":"check if the frontmatter has permissionMode and run."}}' | bash "$HOOK" 2>&1)
+assert_not_contains "frontmatter only no frontmatter warning" "$OUT" "frontmatter override risk"
+assert_contains "frontmatter only warns verification" "$OUT" "verification of the actual"
+
+# Test 5: Verification mention only
+OUT=$(echo '{"tool_input":{"mode":"bypassPermissions","prompt":"run the task and verify the mode is active."}}' | bash "$HOOK" 2>&1)
+assert_contains "verify only warns frontmatter" "$OUT" "frontmatter override risk"
+assert_not_contains "verify only no verify warning" "$OUT" "verification of the actual"
+
+# Test 6: All instructions present, no warning
+OUT=$(echo '{"tool_input":{"mode":"bypassPermissions","prompt":"check if the frontmatter has permissionMode set, then run the task and verify the effective permission is bypassPermissions."}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "well-formed no warning" "$OUT" "Subagent permission mode boundary"
+assert_exit "well-formed exit 0" "$RC" "0"
+
+# Test 7: Strict mode blocks vague
+OUT=$(echo '{"tool_input":{"mode":"bypassPermissions","prompt":"investigate something"}}' | CC_SUBAGENT_MODE_REQUIRE_ALL=1 bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "strict mode warns" "$OUT" "Subagent permission mode boundary"
+assert_exit "strict mode blocks (exit 2)" "$RC" "2"
+
+# Test 8: Empty input, no mode
+OUT=$(echo '{}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "empty input no warning" "$OUT" "Subagent permission mode"
+assert_exit "empty input exit 0" "$RC" "0"
+
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/test-subagent-spawn-verification-enforcer.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+# Tests for subagent-spawn-verification-enforcer.sh (Issue #55666 prevention)
+HOOK="examples/subagent-spawn-verification-enforcer.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+# Test 1: Empty prompt should silently pass
+OUT=$(echo '{"tool_input":{"prompt":""}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "empty prompt no warning" "$OUT" "Subagent output verification"
+assert_exit "empty prompt exit 0" "$RC" "0"
+
+# Test 2: Vague prompt should warn on all 3 checks
+OUT=$(echo '{"tool_input":{"prompt":"please investigate the auth flow"}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "vague warns artifact" "$OUT" "No concrete artifact"
+assert_contains "vague warns verification" "$OUT" "No artifact verification"
+assert_contains "vague warns recommended" "$OUT" "Recommended:"
+assert_contains "vague references issue" "$OUT" "#55666"
+assert_exit "vague exit 0 advisory" "$RC" "0"
+
+# Test 3: Artifact named, other 2 missing
+OUT=$(echo '{"tool_input":{"prompt":"Write to /tmp/result.txt with the analysis."}}' | bash "$HOOK" 2>&1)
+assert_not_contains "artifact only no artifact warning" "$OUT" "No concrete artifact"
+assert_contains "artifact only warns verification" "$OUT" "No artifact verification"
+
+# Test 4: Verification named, other 2 missing
+OUT=$(echo '{"tool_input":{"prompt":"Investigate. I will verify the result."}}' | bash "$HOOK" 2>&1)
+assert_contains "verify only warns artifact" "$OUT" "No concrete artifact"
+assert_not_contains "verify only no verify warning" "$OUT" "No artifact verification"
+
+# Test 5: Distrust phrase named, other 2 missing
+OUT=$(echo '{"tool_input":{"prompt":"Do something. Do not trust reply-only success."}}' | bash "$HOOK" 2>&1)
+assert_contains "distrust only warns artifact" "$OUT" "No concrete artifact"
+assert_contains "distrust only warns verification" "$OUT" "No artifact verification"
+assert_not_contains "distrust only no recommended warning" "$OUT" "Recommended:"
+
+# Test 6: All 3 instructions present, no warning
+OUT=$(echo '{"tool_input":{"prompt":"Write to /tmp/result.txt. I will verify the file exists. Do not reply success without producing the artifact."}}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "well-formed no warning" "$OUT" "Subagent output verification"
+assert_exit "well-formed exit 0" "$RC" "0"
+
+# Test 7: Strict mode blocks vague prompts
+OUT=$(echo '{"tool_input":{"prompt":"investigate something"}}' | CC_SUBAGENT_VERIFY_REQUIRE_ALL=1 bash "$HOOK" 2>&1)
+RC=$?
+assert_contains "strict mode warns" "$OUT" "Subagent output verification"
+assert_exit "strict mode blocks (exit 2)" "$RC" "2"
+
+# Test 8: Missing prompt field should silently pass
+OUT=$(echo '{}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_not_contains "missing prompt no warning" "$OUT" "Subagent output verification"
+assert_exit "missing prompt exit 0" "$RC" "0"
+
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]