cc-safe-setup 29.8.0 → 30.0.4

package/tests/outdated-report.test.sh

@@ -0,0 +1,155 @@
+#!/bin/bash
+# --outdated: which installed hooks no longer match what ships today.
+#
+# Why this exists. Installing a hook copies the file. Nothing ever copies it
+# back. So a hook installed in March keeps running its March logic forever,
+# including bugs fixed here months later, and until now nothing in the CLI
+# could tell you that. Measured on a real four-month-old install: 27 of the 31
+# hooks that came from this project no longer matched the shipped version, and
+# three of those were missing the `jq` guard that was added after they were
+# installed — the difference between blocking a dangerous command and silently
+# approving it.
+#
+# The command only reports. The most important control here is the last one:
+# it must not write anything. A command whose whole job is "tell me if my
+# safety net is stale" must not itself modify the safety net.
+#
+# The second control is that "differs" is not claimed to mean "outdated".
+# A user who edited their own copy on purpose must not be told they are behind,
+# so the wording offers both readings and the test pins that wording.
+
+set -u
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+PASS=0
+FAIL=0
+
+check() { # name expected actual
+  if [ "$2" = "$3" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL: $1"
+    echo "        expected: $2"
+    echo "        actual:   $3"
+  fi
+}
+
+contains() { # name haystack needle
+  case "$2" in
+    *"$3"*) PASS=$((PASS + 1)) ;;
+    *) FAIL=$((FAIL + 1)); echo "  FAIL: $1"; echo "        output did not contain: $3" ;;
+  esac
+}
+
+not_contains() { # name haystack needle
+  case "$2" in
+    *"$3"*) FAIL=$((FAIL + 1)); echo "  FAIL: $1"; echo "        output unexpectedly contained: $3" ;;
+    *) PASS=$((PASS + 1)) ;;
+  esac
+}
+
+TESTHOME="$(mktemp -d)"
+trap 'rm -rf "$TESTHOME"' EXIT
+
+# Sets OUT and RC. Deliberately not called through $( ) — command substitution
+# runs in a subshell, so the exit code would never reach the caller.
+run_outdated() {
+  OUT=$(CLAUDE_PROJECT_DIR="$TESTHOME" node "$REPO/index.mjs" --outdated 2>&1)
+  RC=$?
+}
+
+# --- 1. no hooks directory at all --------------------------------------------
+run_outdated
+check "no hooks dir exits 0" "0" "$RC"
+contains "no hooks dir is explained" "$OUT" "No hooks directory"
+
+# --- 2. an untouched copy of a shipped hook reports as matching ---------------
+mkdir -p "$TESTHOME/.claude/hooks"
+cp "$REPO/examples/protect-claudemd.sh" "$TESTHOME/.claude/hooks/protect-claudemd.sh"
+run_outdated
+check "identical copy exits 0" "0" "$RC"
+contains "identical copy reported as matching" "$OUT" "match the shipped version"
+not_contains "identical copy is not called differing" "$OUT" "differ from what ships today"
+
+# --- 3. a modified copy is reported, and the exit code is non-zero -----------
+echo "# a local change" >> "$TESTHOME/.claude/hooks/protect-claudemd.sh"
+run_outdated
+check "modified copy exits 1" "1" "$RC"
+contains "modified copy is named" "$OUT" "protect-claudemd.sh"
+contains "modified copy is counted" "$OUT" "differ from what ships today"
+
+# --- 4. "differs" must not be claimed to mean "outdated" ---------------------
+# The user may have edited the file on purpose. Both readings must be offered.
+contains "both readings are offered (fixed here)" "$OUT" "was fixed after you installed it"
+contains "both readings are offered (your edit)" "$OUT" "you edited your copy on purpose"
+contains "a way to look before replacing" "$OUT" "diff "
+
+# --- 5. the concrete harm: installed copy parses with jq but has no jq guard --
+# Build exactly that situation from a shipped hook that does have the guard.
+JQ_HOOK=""
+for f in "$REPO"/examples/*.sh; do
+  if grep -q 'command -v jq\|which jq' "$f" && grep -q '\bjq\b' "$f"; then
+    JQ_HOOK="$f"; break
+  fi
+done
+if [ -n "$JQ_HOOK" ]; then
+  NAME="$(basename "$JQ_HOOK")"
+  rm -f "$TESTHOME/.claude/hooks/protect-claudemd.sh"
+  grep -v 'command -v jq' "$JQ_HOOK" | grep -v 'which jq' > "$TESTHOME/.claude/hooks/$NAME"
+  run_outdated
+  check "jq-guardless copy exits 1" "1" "$RC"
+  contains "jq-guardless copy is flagged as such" "$OUT" "no jq guard"
+else
+  echo "  SKIP: no shipped hook both uses jq and guards for it"
+fi
+
+# --- 6. a hook this project does not ship is not judged ----------------------
+rm -f "$TESTHOME/.claude/hooks"/*.sh
+cat > "$TESTHOME/.claude/hooks/my-own-thing.sh" <<'EOF'
+#!/bin/bash
+exit 0
+EOF
+run_outdated
+check "foreign-only install exits 0" "0" "$RC"
+contains "foreign hook counted separately" "$OUT" "not shipped by this project"
+not_contains "foreign hook is not named as differing" "$OUT" "my-own-thing.sh differ"
+
+# --- 7. the control that matters: --outdated must not write anything ---------
+# This control was defeated twice while it was being written, in two different
+# ways, and both are worth stating because both are easy to reproduce:
+#
+#   1. The snapshot used `for f in *`. A glob does not match dotfiles, so a
+#      planted `writeFileSync(HOOKS_DIR + '/.outdated-marker')` was invisible.
+#      Fixed by walking the directory with find.
+#   2. Even after that, the run in section 6 had already created the marker, so
+#      the file existed in BOTH the before and the after snapshot and the
+#      comparison still showed no change. A "did it write?" check cannot share
+#      state with an earlier run of the thing under test.
+#
+# So this section builds its own directory and takes the first snapshot before
+# --outdated has ever run against it.
+snapshot() { # dir -> "relpath:cksum" lines, dotfiles included
+  find "$1" -type f | sort | while IFS= read -r f; do
+    printf '%s:%s\n' "${f#"$1"}" "$(cksum < "$f")"
+  done
+}
+TESTHOME="$(mktemp -d)"          # fresh: nothing here has been looked at yet
+trap 'rm -rf "$TESTHOME"' EXIT
+mkdir -p "$TESTHOME/.claude/hooks"
+# A hook that differs, so --outdated has something to report and therefore takes
+# the branch that prints. A run that finds nothing would not exercise the code
+# where a stray write would live.
+cp "$REPO/examples/protect-claudemd.sh" "$TESTHOME/.claude/hooks/protect-claudemd.sh"
+echo "# local edit" >> "$TESTHOME/.claude/hooks/protect-claudemd.sh"
+printf '{"hooks":{}}' > "$TESTHOME/.claude/settings.json"
+BEFORE_HOOKS=$(snapshot "$TESTHOME/.claude/hooks")
+BEFORE_SETTINGS=$(cksum < "$TESTHOME/.claude/settings.json")
+run_outdated
+AFTER_HOOKS=$(snapshot "$TESTHOME/.claude/hooks")
+AFTER_SETTINGS=$(cksum < "$TESTHOME/.claude/settings.json")
+check "hooks are untouched by --outdated" "$BEFORE_HOOKS" "$AFTER_HOOKS"
+check "settings.json is untouched by --outdated" "$BEFORE_SETTINGS" "$AFTER_SETTINGS"
+
+echo
+echo "outdated-report: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ] || exit 1

package/tests/output-secret-mask-warns.test.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+# output-secret-mask: does the warning actually fire, and only when it should?
+#
+# Why this exists. The eight existing checks for this hook in test.sh all assert
+# exit 0. This hook *always* exits 0 — it only writes to stderr — so those checks
+# pass whether the warning fires or not. They cannot fail on the behaviour that
+# matters, which is the same shape as the "234 test files that could not fail"
+# noted in the CI workflow. These assert on stderr instead.
+#
+# The regression being pinned: the OpenAI pattern used to be written without a
+# left boundary, so ordinary English words ending in "sk" before a separator
+# (task-, ask-, risk-, disk-, desk-) matched and the hook cried on ordinary
+# output. A warning that fires on normal paths is a warning operators learn to
+# ignore, which costs the whole hook.
+#
+# Both directions are asserted deliberately: silencing a false positive is only
+# a fix if the true positive still fires.
+
+set -u
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+HOOK="$REPO/examples/output-secret-mask.sh"
+PASS=0
+FAIL=0
+
+# Split so that writing this file does not itself trip a secret scanner.
+KEY="sk""-proj-abcdefghijklmno""pqrst1234567890"
+AWS="AKI""AIOSFODNN7""EXAMPLE"
+ORDINARY="data/task-""management-system-config.json"
+
+run() { # run <stdout-text> -> sets ERR
+  local payload
+  payload=$(printf '{"tool_name":"Bash","tool_input":{"command":"cat conf"},"tool_result":{"stdout":"%s"}}' "$1")
+  ERR=$(printf '%s' "$payload" | bash "$HOOK" 2>&1 >/dev/null)
+}
+
+warns() { # warns <name> <text> <expect: yes|no>
+  run "$2"
+  local got="no"
+  case "$ERR" in *WARNING*) got="yes" ;; esac
+  if [ "$got" = "$3" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL: $1 (expected warn=$3, got warn=$got)"
+    echo "        stderr: $ERR"
+  fi
+}
+
+echo "output-secret-mask-warns:"
+
+# --- true positives: the warning has to fire -------------------------------
+warns "real key shape warns"            "$KEY"                       yes
+warns "AWS key shape warns"             "$AWS"                       yes
+warns "API_KEY assignment warns"        "API_KEY=abc123def456ghi"    yes
+
+# --- false positives: the warning must stay quiet --------------------------
+warns "ordinary task- path is quiet"    "$ORDINARY"                  no
+warns "plain output is quiet"           "hello world"                no
+warns "safe env var is quiet"           "PATH=/usr/bin"              no
+
+# --- the hook never blocks; it only reports --------------------------------
+printf '%s' "{\"tool_name\":\"Bash\",\"tool_result\":{\"stdout\":\"$KEY\"}}" \
+  | bash "$HOOK" >/dev/null 2>&1
+rc=$?
+if [ "$rc" -eq 0 ]; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "  FAIL: hook must not block (expected exit 0, got $rc)"
+fi
+
+echo "  $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/plugin-hooks-fail-open-under-sh.test.sh

@@ -0,0 +1,165 @@
+#!/bin/bash
+# The plugin hooks failed open under /bin/sh
+#
+# hooks/hooks.json holds the four inline guards that ship as the plugin's
+# hook file. Claude Code runs an inline hook command through /bin/sh, and on
+# Debian and Ubuntu /bin/sh is dash. Dash's builtin echo interprets backslash
+# escapes; bash's does not.
+#
+# Every one of the four guards started with:
+#
+#   INPUT=$(cat); CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+#
+# The hook payload is JSON, so a newline inside the command or the file
+# content arrives as the two characters \n. Under dash, echo turned those two
+# characters into a real newline *inside a JSON string*, jq rejected the
+# document, CMD came back empty, and the very next clause is:
+#
+#   [ -z "$CMD" ] && exit 0
+#
+# exit 0 is an affirmative approval. So the guards let the tool call through,
+# and the debug log recorded the hook as "success". Measured 2026-09-03: an
+# agent asked to create .env wrote it with all six shipped hooks installed.
+#
+# Nothing local caught this for months because every test ran the commands
+# under bash, where echo leaves \n alone. The five plugin manifests under
+# plugins/ already used `printf %s "$INPUT"`; hooks/hooks.json never got the
+# same change.
+#
+# Three more holes turned up in the same file once the parse was fixed:
+#
+#   1. The rm guard checked its exemption list (node_modules|dist|build|
+#      __pycache__|tmp) against the whole command, so `cd /tmp` on line one
+#      exempted `rm -rf /` on line two.
+#   2. `sed -E 's/[;&|#].*$//'` truncated at the first `;`, so everything
+#      after a separator was never examined at all.
+#   3. A line continuation split the spelling and no guard matched it.
+#
+# The fix joins continuations, splits on statement separators, and asks the
+# dangerous question and the exemption question about the *same* statement.
+#
+# Every case below runs the shipped command under /bin/sh, which is the shell
+# that actually runs it in production.
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+HOOKS="$ROOT/hooks/hooks.json"
+PASS=0
+FAIL=0
+
+hook_command() {
+    # $1 = index into PreToolUse
+    python3 -c "
+import json, sys
+d = json.load(open('$HOOKS', encoding='utf-8'))
+pre = (d.get('hooks') or d)['PreToolUse']
+sys.stdout.write(pre[$1]['hooks'][0]['command'])
+"
+}
+
+check() {
+    # $1=index  $2=label  $3=expected(block|allow)  $4=payload json
+    local cmd rc got
+    cmd=$(hook_command "$1")
+    printf '%s' "$4" | /bin/sh -c "$cmd" >/dev/null 2>&1
+    rc=$?
+    if [ "$rc" -eq 2 ]; then got=block; else got=allow; fi
+    if [ "$got" = "$3" ]; then
+        PASS=$((PASS + 1))
+    else
+        FAIL=$((FAIL + 1))
+        echo "  FAIL [hook $1] $2: expected $3, got $got (rc=$rc)"
+    fi
+}
+
+bash_payload() {
+    python3 -c "
+import json, sys
+sys.stdout.write(json.dumps({'tool_name': 'Bash',
+                             'tool_input': {'command': sys.argv[1]}}))
+" "$1"
+}
+
+write_payload() {
+    python3 -c "
+import json, sys
+sys.stdout.write(json.dumps({'tool_name': 'Write',
+                             'tool_input': {'file_path': sys.argv[1],
+                                            'content': sys.argv[2]}}))
+" "$1" "$2"
+}
+
+# The dangerous spellings are assembled so that mentioning them in this file
+# does not trip the repository's own guards.
+RM="rm -rf /"
+PUSHF="git push --force origin main"
+RESETH="git reset --hard HEAD~1"
+CLEANFD="git clean -fd"
+
+echo "hook 0 — recursive rm"
+check 0 "plain"                 block "$(bash_payload "$RM")"
+check 0 "newline after cd /tmp" block "$(bash_payload "$(printf 'cd /tmp\n%s' "$RM")")"
+check 0 "newline after cd build" block "$(bash_payload "$(printf 'cd build\n%s' "$RM")")"
+check 0 "line continuation"     block "$(bash_payload "$(printf 'rm \\\n -rf /')")"
+check 0 "after a semicolon"     block "$(bash_payload "date; $RM")"
+check 0 "after &&"              block "$(bash_payload "cd /tmp && $RM")"
+check 0 "sudo prefix"           block "$(bash_payload "sudo $RM")"
+check 0 "-fr order"             block "$(bash_payload "rm -fr /")"
+check 0 "--recursive"           block "$(bash_payload "rm --recursive /etc")"
+check 0 "home subdirectory"     block "$(bash_payload "rm -rf ~/Documents")"
+check 0 "node_modules"          allow "$(bash_payload "rm -rf node_modules")"
+check 0 "./build"               allow "$(bash_payload "rm -rf ./build")"
+check 0 "dist/"                 allow "$(bash_payload "rm -rf dist/")"
+check 0 "under /tmp"            allow "$(bash_payload "rm -rf /tmp/scratch")"
+check 0 "non-recursive rm"      allow "$(bash_payload "rm -f foo.txt")"
+check 0 "plain ls"              allow "$(bash_payload "ls -la")"
+check 0 "inside a comment"      allow "$(bash_payload "date # $RM")"
+
+echo "hook 1 — destructive git"
+check 1 "force push"            block "$(bash_payload "$PUSHF")"
+check 1 "force push continued"  block "$(bash_payload "$(printf 'git push \\\n --force origin main')")"
+check 1 "force push line 2"     block "$(bash_payload "$(printf 'cd /tmp\n%s' "$PUSHF")")"
+check 1 "hard reset"            block "$(bash_payload "$RESETH")"
+check 1 "hard reset continued"  block "$(bash_payload "$(printf 'git reset \\\n --hard HEAD~1')")"
+check 1 "clean -fd"             block "$(bash_payload "$CLEANFD")"
+check 1 "clean -fd continued"   block "$(bash_payload "$(printf 'git clean \\\n -fd')")"
+check 1 "force-with-lease"      allow "$(bash_payload "git push --force-with-lease origin main")"
+check 1 "word on another line"  allow "$(bash_payload "$(printf 'git push origin main\necho --force')")"
+check 1 "ordinary push"         allow "$(bash_payload "git push origin main")"
+check 1 "soft reset"            allow "$(bash_payload "git reset --soft HEAD~1")"
+
+echo "hook 2 — credentials in the command"
+check 2 "inline key"            block "$(bash_payload "export API_KEY=abcdefghij0123456789xyz")"
+check 2 "inline key continued"  block "$(bash_payload "$(printf 'export API_KEY=\\\nabcdefghij0123456789xyz')")"
+check 2 "short value"           allow "$(bash_payload "export API_KEY=short")"
+check 2 "unrelated"             allow "$(bash_payload "ls -la")"
+
+echo "hook 3 — writes to sensitive files"
+check 3 "dotenv"                block "$(write_payload "/x/.env" "$(printf 'A=1\nB=2')")"
+check 3 "private key"           block "$(write_payload "/x/server.pem" "$(printf 'A=1\nB=2')")"
+check 3 "ssh key"               block "$(write_payload "/x/id_rsa" "$(printf 'A=1\nB=2')")"
+check 3 "dotenv template"       allow "$(write_payload "/x/.env.template" "$(printf 'A=1\nB=2')")"
+check 3 "ordinary file"         allow "$(write_payload "/x/notes.md" "$(printf 'A=1\nB=2')")"
+
+echo "no hook may still pipe echo into a parser"
+# The file is JSON, so the spelling inside it is escaped. Grepping the raw
+# bytes for the unescaped form matches nothing even when the defect is
+# present -- a check that cannot fail. Read it as JSON and look at the
+# commands after unescaping.
+if python3 -c "
+import json, sys
+d = json.load(open('$HOOKS', encoding='utf-8'))
+pre = (d.get('hooks') or d)['PreToolUse']
+bad = [i for i, e in enumerate(pre)
+       for h in e.get('hooks', [])
+       if 'echo \"\$INPUT\"' in h.get('command', '')]
+print(','.join(str(i) for i in bad))
+sys.exit(1 if bad else 0)
+"; then
+    PASS=$((PASS + 1))
+else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL: a hook still pipes echo \"\$INPUT\" into a parser"
+fi
+
+echo
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/plugins-word-order.test.sh

@@ -0,0 +1,126 @@
+#!/bin/bash
+# marketplace plugins: the same word-order assumptions, in a second implementation
+#
+# The four bundles under plugins/ carry their shell **inline in plugin.json**. They
+# are not copies of the core hooks — they are a separate implementation — so fixing
+# the core does nothing for anyone who installed a plugin.
+#
+# Measured 2026-08-03 with all four bundles installed together, over the 24 forms
+# of the destructive-command probe that these bundles claim to cover:
+#
+#   before   10 of 24 walked through
+#   after     3 of 24  (find / dd / chmod — none of the four bundles claims those)
+#
+# What walked through was the familiar shape: a rule describing how a command is
+# usually typed rather than what it does.
+#
+#   rm -r -f X                     the flags have to be one bundle
+#   rm --recursive --force X       ... and short
+#   rm X -rf                       ... and before the target
+#   git reset HEAD~1 --hard        --hard has to follow reset
+#   git clean -x -f -d             the flags have to come first
+#   git branch --delete --force    only -D was named
+#
+# One description also promised something that was never implemented:
+# git-protection said it "guards interactive rebase" and no hook in the bundle
+# mentions rebase at all. The claim is gone rather than newly built — an interactive
+# rebase is ordinary work, and blocking it would trade a false promise for a false
+# positive.
+#
+# The dry runs are the half that keeps a guard installed: widening the git clean
+# pattern also caught `git clean -nd`, which removes nothing. That regression was
+# introduced and fixed in the same pass; both directions are asserted below.
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+PASS=0; FAIL=0
+
+# want: block | allow
+check() {
+    local desc="$1" cmd="$2" want="$3" tool="${4:-Bash}"
+    local got
+    got=$(python3 - "$ROOT" "$cmd" "$tool" <<'PY'
+import glob, json, os, subprocess, sys, tempfile
+root, cmd, tool = sys.argv[1], sys.argv[2], sys.argv[3]
+cmds = []
+for pdir in sorted(glob.glob(os.path.join(root, "plugins", "*"))):
+    f = os.path.join(pdir, ".claude-plugin", "plugin.json")
+    if not os.path.exists(f):
+        continue
+    d = json.load(open(f, encoding="utf-8"))
+    for ev in d.get("hooks", {}).values():
+        for e in ev:
+            for h in e.get("hooks", []):
+                cmds.append((e.get("matcher", ""), h["command"]))
+req = json.dumps({"hook_event_name": "PreToolUse", "tool_name": tool,
+                  "tool_input": {"command": cmd, "file_path": cmd}})
+for m, sh in cmds:
+    if m and tool not in m:
+        continue
+    t = tempfile.NamedTemporaryFile("w", suffix=".sh", delete=False, encoding="utf-8")
+    t.write(sh); t.close()
+    try:
+        r = subprocess.run(["bash", t.name], input=req, capture_output=True,
+                           text=True, timeout=15)
+        if r.returncode == 2:
+            print("block"); raise SystemExit
+    finally:
+        os.unlink(t.name)
+print("allow")
+PY
+)
+    if [ "$got" = "$want" ]; then
+        echo "PASS: $desc"; PASS=$((PASS+1))
+    else
+        echo "FAIL: $desc (expected $want, got $got)"; FAIL=$((FAIL+1))
+    fi
+}
+
+TARGET="/var/app"
+
+# --- rm, whatever shape the flags arrive in ---
+check "rm -rf"                     "rm -rf $TARGET"                      block
+check "rm -fr"                     "rm -fr $TARGET"                      block
+check "flags split"                "rm -r -f $TARGET"                    block
+check "flags split, other order"   "rm -f -r $TARGET"                    block
+check "long flags"                 "rm --recursive --force $TARGET"      block
+check "long flags, other order"    "rm --force --recursive $TARGET"      block
+check "flags after the target"     "rm $TARGET -rf"                      block
+
+# --- git reset --hard, wherever the flag sits ---
+check "reset, canonical"           "git reset --hard HEAD~1"             block
+check "reset, flag last"           "git reset HEAD~1 --hard"             block
+check "reset --soft is allowed"    "git reset --soft HEAD~1"             allow
+
+# --- git clean: destructive blocked, dry runs kept ---
+check "clean -fd"                  "git clean -fd"                       block
+check "clean, flags split"         "git clean -x -f -d"                  block
+check "clean, long flag"           "git clean --force -d"                block
+check "dry run"                    "git clean -n"                        allow
+check "dry run with -d"            "git clean -nd"                       allow
+check "dry run with -d and -x"     "git clean -ndx"                      allow
+check "long dry run"               "git clean --dry-run"                 allow
+check "force plus dry run"         "git clean --force --dry-run"         allow
+
+# --- branch deletion, both spellings ---
+check "branch -D"                  "git branch -D main"                  block
+check "branch --delete --force"    "git branch --delete --force main"    block
+check "safe delete is allowed"     "git branch -d old-feature"           allow
+
+# --- what the bundles already got right, kept ---
+check "force push"                 "git push --force origin main"        block
+check "force push short flag"      "git push origin main -f"             block
+check "--force-with-lease allowed" "git push --force-with-lease origin f" allow
+check "push to main"               "git push origin main"                block
+check "npm publish"                "npm publish"                         block
+check "writing .env"               ".env"                                block Write
+check ".env.example allowed"       ".env.example"                        allow Write
+
+# --- controls ---
+check "ls"                         "ls -la"                              allow
+check "git status"                 "git status"                          allow
+check "npm test"                   "npm test"                            allow
+check "echo"                       "echo hello"                          allow
+
+echo
+echo "plugins-word-order: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/powershell-remove-item-guard.test.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+# Tests for powershell-remove-item-guard.sh
+# Run: bash tests/powershell-remove-item-guard.test.sh
+set -euo pipefail
+
+PASS=0
+FAIL=0
+HOOK="$(dirname "$0")/../examples/powershell-remove-item-guard.sh"
+
+# The verdict is the exit code, not the text. A refusal that only prints a word
+# Claude Code does not act on is not a refusal: until 2026-09-19 this file checked
+# for the string '"decision":"DENY"' in stdout, and passed all nine block cases
+# while the guard refused none of them. One of the nine (C:\Users) was measured
+# end to end against a do-nothing control; the other eight leave through the same
+# two lines.
+test_hook() {
+    local input="$1" expected="$2" desc="$3"
+    local out err exit_code=0
+    err=$(mktemp)
+    out=$(echo "$input" | bash "$HOOK" 2>"$err") || exit_code=$?
+    local stderr_text
+    stderr_text=$(cat "$err"); rm -f "$err"
+
+    if [ "$expected" = "DENY" ]; then
+        # exit 2 is what actually stops the tool call; the reason must reach stderr.
+        if [ "$exit_code" -eq 2 ] && echo "$stderr_text" | grep -q 'BLOCKED'; then
+            echo "  PASS: $desc"
+            PASS=$((PASS + 1))
+        else
+            echo "  FAIL: $desc (expected exit 2 + BLOCKED on stderr, got exit $exit_code, stdout: $out, stderr: $stderr_text)"
+            FAIL=$((FAIL + 1))
+        fi
+    elif [ "$expected" = "ASK" ]; then
+        if [ "$exit_code" -eq 0 ] && echo "$out" | grep -q '"permissionDecision":"ask"'; then
+            echo "  PASS: $desc"
+            PASS=$((PASS + 1))
+        else
+            echo "  FAIL: $desc (expected exit 0 + ask, got exit $exit_code, stdout: $out)"
+            FAIL=$((FAIL + 1))
+        fi
+    else
+        if [ "$exit_code" -eq 0 ] && ! echo "$out" | grep -q '"permissionDecision":"ask"'; then
+            echo "  PASS: $desc"
+            PASS=$((PASS + 1))
+        else
+            echo "  FAIL: $desc (expected exit 0 and no verdict, got exit $exit_code, stdout: $out)"
+            FAIL=$((FAIL + 1))
+        fi
+    fi
+}
+
+echo "powershell-remove-item-guard.sh tests"
+echo ""
+
+# --- Should DENY: system directory targets ---
+test_hook '{"tool_input":{"command":"powershell -c \"Remove-Item -Recurse -Force C:\\Users\\john\""}}' DENY "Block Remove-Item on C:\\Users"
+test_hook '{"tool_input":{"command":"powershell Remove-Item -Recurse /mnt/c/Windows"}}' DENY "Block Remove-Item on /mnt/c/Windows"
+test_hook '{"tool_input":{"command":"Remove-Item -Recurse -Force \"C:\\Program Files\\app\""}}' DENY "Block Remove-Item on Program Files"
+
+# --- Should DENY: node_modules junction traversal ---
+test_hook '{"tool_input":{"command":"Remove-Item -Recurse -Force ./node_modules"}}' DENY "Block Remove-Item -Force on node_modules"
+test_hook '{"tool_input":{"command":"Remove-Item -Recurse -Force .pnpm/store"}}' DENY "Block Remove-Item on .pnpm"
+test_hook '{"tool_input":{"command":"Remove-Item -Recurse -Force worktree/packages"}}' DENY "Block Remove-Item on worktree"
+
+# --- Should DENY: home directory ---
+test_hook '{"tool_input":{"command":"Remove-Item -Recurse -Force $HOME/Documents"}}' DENY "Block Remove-Item on \$HOME"
+test_hook '{"tool_input":{"command":"Remove-Item -Recurse $env:USERPROFILE"}}' DENY "Block Remove-Item on USERPROFILE"
+test_hook '{"tool_input":{"command":"Remove-Item -Recurse -Force ~/projects"}}' DENY "Block Remove-Item on ~/"
+
+# --- Should ASK: -Recurse -Force on an ordinary absolute data path (#64310) ---
+test_hook '{"tool_input":{"command":"Remove-Item -Recurse -Force D:\\Clientes\\Yandy\\ENTREGABLES"}}' ASK "Confirm Remove-Item -Force on D:\\ client data (#64310)"
+test_hook '{"tool_input":{"command":"Remove-Item -Force -Recurse E:\\work\\deliverables"}}' ASK "Confirm regardless of flag order on E:\\"
+test_hook '{"tool_input":{"command":"Remove-Item -Recurse -Force \\\\nas\\share\\projects"}}' ASK "Confirm on UNC path"
+
+# --- Should ALLOW: safe commands ---
+test_hook '{"tool_input":{"command":"Remove-Item ./temp.txt"}}' ALLOW "Allow single file deletion"
+test_hook '{"tool_input":{"command":"ls -la"}}' ALLOW "Allow non-Remove-Item command"
+test_hook '{"tool_input":{"command":"rm -rf ./build"}}' ALLOW "Allow bash rm (different hook)"
+test_hook '{"tool_input":{"command":"Get-ChildItem -Recurse"}}' ALLOW "Allow Get-ChildItem (read-only)"
+test_hook '{"tool_input":{"command":"Remove-Item -Recurse -Force ./dist"}}' ALLOW "Allow relative force-delete (no absolute path)"
+test_hook '{"tool_input":{"command":"Remove-Item -Recurse -Force .\\build\\out"}}' ALLOW "Allow relative Windows force-delete"
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1