cc-safe-setup 29.8.0 → 30.0.4

package/tests/project-dir-naming.test.sh

@@ -0,0 +1,103 @@
+#!/bin/bash
+# Hooks that look inside ~/.claude/projects/ must derive the directory name the
+# way Claude Code actually writes it.
+#
+# Claude Code names a project directory by replacing every `/` in the absolute
+# working directory with `-`. The leading slash becomes a leading dash, and it
+# stays:
+#
+#   /home/u/projects/app   ->   -home-u-projects-app
+#
+# Six shipped hooks stripped that leading dash, in two different spellings:
+# `sed 's|/|-|g; s|^-||'` removes it after the conversion, `sed 's|^/||; s|/|-|g'`
+# removes the slash before it. The path they built therefore never existed, and each
+# hook has an early `[ ! -d "$SESSION_DIR" ] && exit 0` guard — so all six ran,
+# exited 0, and did nothing. One of them is the session backup. It had never made
+# a backup.
+#
+# The first sweep grepped for one spelling and found three. The other three were
+# structurally invisible to that search — the same shape of mistake the hooks
+# themselves had. That is why both spellings are controls below.
+#
+# Measured on 2026-08-12 against a real install:
+#   built by the old form:  ~/.claude/projects/home-namakusa-projects-cc-loop   (absent)
+#   built by the fixed form: ~/.claude/projects/-home-namakusa-projects-cc-loop (present)
+#
+# The control below is the point of this file. Asserting only that the fixed form
+# is right would pass just as happily if the assertion were vacuous; the old form
+# has to fail it.
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+PASS=0; FAIL=0
+
+check() {
+    local label="$1" got="$2" want="$3"
+    if [ "$got" = "$want" ]; then
+        PASS=$((PASS + 1))
+    else
+        FAIL=$((FAIL + 1))
+        echo "FAIL: $label"
+        echo "      got:  $got"
+        echo "      want: $want"
+    fi
+}
+
+# The naming rule, stated once.
+name_of() { printf '%s' "$1" | sed 's|/|-|g'; }
+
+for abs in /home/u/projects/app /home/namakusa/projects/cc-loop /tmp/x; do
+    want="$(printf '%s' "$abs" | tr '/' '-')"
+    check "leading dash kept: $abs" "$(name_of "$abs")" "$want"
+done
+
+# Control: the form that shipped must NOT satisfy the rule. If this ever passes,
+# the assertions above are not testing anything.
+old_form() { printf '%s' "$1" | sed 's|/|-|g; s|^-||'; }
+for abs in /home/u/projects/app /tmp/x; do
+    if [ "$(old_form "$abs")" = "$(name_of "$abs")" ]; then
+        FAIL=$((FAIL + 1))
+        echo "FAIL: control did not discriminate for $abs"
+    else
+        PASS=$((PASS + 1))
+    fi
+done
+
+# The stripping shows up in two spellings. Searching for one of them is how the
+# first sweep found three of the six: `s|^-||` removes the dash after the
+# conversion, `s|^/||` removes the slash before it. Same result, different grep.
+old_form_b() { printf '%s' "$1" | sed 's|^/||; s|/|-|g'; }
+for abs in /home/u/projects/app /tmp/x; do
+    if [ "$(old_form_b "$abs")" = "$(name_of "$abs")" ]; then
+        FAIL=$((FAIL + 1))
+        echo "FAIL: control B did not discriminate for $abs"
+    else
+        PASS=$((PASS + 1))
+    fi
+done
+
+# The shipped hooks must not carry either spelling any more.
+for f in examples/session-backup-on-start.sh \
+         examples/session-index-repair.sh \
+         examples/worktree-project-unify.sh \
+         examples/extended-thinking-loop-guard.sh \
+         examples/extended-thinking-resume-warning.sh \
+         examples/opus48-thinking-wedge-advisor.sh; do
+    if grep -qF 's|^-||' "$ROOT/$f" || grep -qF 's|^/||; s|/|-|g' "$ROOT/$f"; then
+        FAIL=$((FAIL + 1))
+        echo "FAIL: $f still strips the leading separator"
+    else
+        PASS=$((PASS + 1))
+    fi
+    # And they must still build the name at all — a hook that stopped deriving a
+    # path would also pass the grep above.
+    if grep -qF "sed 's|/|-|g'" "$ROOT/$f"; then
+        PASS=$((PASS + 1))
+    else
+        FAIL=$((FAIL + 1))
+        echo "FAIL: $f no longer derives a project directory name"
+    fi
+done
+
+echo
+echo "project-dir-naming: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/quoted-safe-targets-and-mentions.test.sh

@@ -0,0 +1,190 @@
+#!/bin/bash
+# The two guards that still judged a target by its quotes, and the mention that
+# one of them blocked.
+#
+# Measured 2026-08-11 (before this change), same eight inputs through three hooks:
+#
+#                                     auto-mode  rm-safety-net  compound-deny
+#   a quoted safe target                 ok         BLOCKED        BLOCKED
+#   a quoted safe target (single)        ok         BLOCKED        BLOCKED
+#   a quoted safe target (dist)          ok         BLOCKED        BLOCKED
+#   a mention in echo                    ok         ok             BLOCKED
+#
+# auto-mode-safety-enforcer had just been fixed (PR #1009). The other two had
+# not, and they fail for two different reasons:
+#
+#   rm-safety-net blocks anything that is not on its safe list, so a quote made
+#   an ordinary cleanup fail the same test a dangerous path fails -- the quote,
+#   not the path, decided it.
+#
+#   compound-command-deny-enforcer compares each operand against the safe list
+#   as a literal name, so a quoted name never matched, and the deny patterns
+#   then saw the whole line. It also had no mention-vs-invocation pass at all,
+#   which is why naming a command inside echo was blocked.
+#
+# Both now drop quote characters before judging a target. The compound guard did
+# NOT receive the gate auto-mode got in PR #1009: it was tried and taken out,
+# because that hook's deny patterns cover more than a list of destructive verbs
+# can express, and a gate built from such a list let two real things through
+# (a git subcommand not on the list, and a redirect writing to a device -- CI
+# caught both). So a mention is still blocked there, and this file asserts that
+# rather than pretending otherwise.
+#
+# --- known limit, asserted on purpose ----------------------------------------
+# A name containing spaces is still blocked by both. That is word splitting, not
+# quoting: the operands are cut apart on whitespace, so a quoted name with a
+# space in it arrives as several words. Fixing it means rewriting how operands
+# are extracted. The cases at the bottom record the current behaviour so that a
+# future change to that code shows up here instead of passing unnoticed.
+#
+# Dangerous strings are assembled from parts so that reading or editing this
+# file does not trip the operator's own destructive-guard.
+
+set -u
+DIR="$(cd "$(dirname "$0")/.." && pwd)/examples"
+PASS=0
+FAIL=0
+
+run() { # hook command
+  printf '{"tool_name":"Bash","tool_input":{"command":%s}}' \
+    "$(printf '%s' "$2" | sed 's/\\/\\\\/g; s/"/\\"/g; s/^/"/; s/$/"/')" \
+    | bash "$DIR/$1.sh" >/dev/null 2>&1
+  echo $?
+}
+
+expect() { # hook description command expected_exit
+  actual="$(run "$1" "$3")"
+  if [ "$actual" = "$4" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL [$1]: $2"
+    echo "        command:  $3"
+    echo "        expected: exit $4, got exit $actual"
+  fi
+}
+
+RM="r""m -rf"
+SLASH="/"
+DQ='"'
+SQ="'"
+HOME_VAR='$HOME'
+
+for h in rm-safety-net compound-command-deny-enforcer auto-mode-safety-enforcer; do
+
+  # --- quoted safe targets must pass ----------------------------------------
+
+  expect "$h" "a quoted safe target is ordinary cleanup" \
+    "$RM ${DQ}node_modules${DQ}"                                  0
+  expect "$h" "a single-quoted safe target is ordinary cleanup" \
+    "$RM ${SQ}node_modules${SQ}"                                  0
+  expect "$h" "a quoted dist is ordinary cleanup" \
+    "$RM ${DQ}dist${DQ}"                                          0
+  expect "$h" "a quoted build is ordinary cleanup" \
+    "$RM ${DQ}build${DQ}"                                         0
+  expect "$h" "a bare safe target still passes" \
+    "$RM node_modules"                                            0
+  expect "$h" "cleanup after another command still passes" \
+    "npm ci && $RM ${DQ}node_modules${DQ}"                        0
+
+  # --- mentions ---------------------------------------------------------------
+  # auto-mode-safety-enforcer carries the gate from PR #1009 and lets a mention
+  # through. rm-safety-net never blocked one (it only looks at the target of an
+  # rm). compound-command-deny-enforcer still blocks them, and that is recorded
+  # here rather than wished away: a gate was tried there and taken out, because
+  # this hook's deny patterns cover more than a verb list can express and the
+  # gate let two real things through (CI caught a git subcommand missing from the
+  # list and a redirect to a device). Fixing it means driving the gate off the
+  # deny patterns themselves. Until then this line is the honest state.
+  case "$h" in
+    compound-command-deny-enforcer) MENTION=2 ;;
+    *)                              MENTION=0 ;;
+  esac
+  expect "$h" "a mention in echo" \
+    "echo ${DQ}${RM} ${SLASH}${DQ}"                               "$MENTION"
+  expect "$h" "a mention in a commit message" \
+    "git commit -m ${DQ}guard against ${RM} ${SLASH}${DQ}"        "$MENTION"
+  expect "$h" "a mention of the home variable" \
+    "echo ${DQ}never write ${RM} ${HOME_VAR}${DQ}"                "$MENTION"
+
+  # --- quoted dangerous targets must still be blocked -----------------------
+
+  expect "$h" "a quoted root is a run" \
+    "$RM ${DQ}${SLASH}${DQ}"                                      2
+  expect "$h" "a quoted home variable is a run" \
+    "$RM ${DQ}${HOME_VAR}${DQ}"                                   2
+  expect "$h" "a quoted etc is a run" \
+    "$RM ${DQ}${SLASH}etc${DQ}"                                   2
+
+  # --- quoted text that is executed is not a mention ------------------------
+  # Only the two guards that carry the gate judge this. rm-safety-net looks at
+  # the target of an rm and has no unwrapping step, so a deletion handed to a
+  # shell has always passed it (measured on the version before this change too
+  # -- not a regression introduced here). destructive-guard is the layer that
+  # catches it, and the bottom of this file checks that it does.
+  case "$h" in
+    rm-safety-net) WRAP_EXEC=0 ;;
+    *)             WRAP_EXEC=2 ;;
+  esac
+  expect "$h" "sh -c runs its quoted argument" \
+    "sh -c ${DQ}${RM} ${SLASH}${DQ}"                              "$WRAP_EXEC"
+  expect "$h" "eval runs its quoted argument" \
+    "eval ${DQ}${RM} ${SLASH}${DQ}"                               "$WRAP_EXEC"
+
+  # --- known limit: a name with spaces --------------------------------------
+  # Word splitting, not quoting: the operands are cut apart on whitespace, so a
+  # quoted name containing a space arrives as several words. The two safe-list
+  # guards block it (the words are not on the list). auto-mode works off a list
+  # of dangerous paths instead, so an unlisted name passes there. Both are the
+  # behaviour before this change; the assertions are here so that a future
+  # rewrite of operand extraction shows up in this file.
+  case "$h" in
+    auto-mode-safety-enforcer) SPACED=0 ;;
+    *)                         SPACED=2 ;;
+  esac
+  expect "$h" "KNOWN LIMIT: a quoted name with a space" \
+    "$RM ${DQ}my build dir${DQ}"                                  "$SPACED"
+
+done
+
+# --- the layer that catches what rm-safety-net does not ----------------------
+# rm-safety-net passes a deletion handed to a shell (it has no unwrapping step),
+# so the claim "another layer catches it" has to be checked, not asserted.
+# destructive-guard lives in scripts.json, so it is extracted the same way
+# tests/destructive-guard-mentions-vs-invocations.test.sh extracts it.
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+WORK="$(mktemp -d)"
+python3 -c "import json,sys;
+sys.stdout.write(json.load(open('$ROOT/scripts.json'))['destructive-guard'])" > "$WORK/dg.sh"
+
+run_dg() { # command
+  printf '{"tool_name":"Bash","tool_input":{"command":%s}}' \
+    "$(printf '%s' "$1" | sed 's/\\/\\\\/g; s/\"/\\\"/g; s/^/\"/; s/$/\"/')" \
+    | bash "$WORK/dg.sh" >/dev/null 2>&1
+  echo $?
+}
+
+expect_dg() { # description command expected_exit
+  actual="$(run_dg "$2")"
+  if [ "$actual" = "$3" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL [destructive-guard]: $1"
+    echo "        command:  $2"
+    echo "        expected: exit $3, got exit $actual"
+  fi
+}
+
+expect_dg "sh -c with a quoted deletion is caught by the core guard" \
+  "sh -c ${DQ}${RM} ${SLASH}${DQ}"                                2
+expect_dg "eval with a quoted deletion is caught by the core guard" \
+  "eval ${DQ}${RM} ${SLASH}${DQ}"                                 2
+expect_dg "a mention stays a mention in the core guard too" \
+  "echo ${DQ}${RM} ${SLASH}${DQ}"                                 0
+
+rm -rf "$WORK" 2>/dev/null
+
+echo "quoted-safe-targets-and-mentions: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/reroute-after-block-guard.test.sh

@@ -0,0 +1,104 @@
+#!/bin/bash
+# Tests for reroute-after-block-guard.sh
+# Run: bash tests/reroute-after-block-guard.test.sh
+set -uo pipefail
+
+PASS=0
+FAIL=0
+HOOK="$(dirname "$0")/../examples/reroute-after-block-guard.sh"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+# Build a transcript with a previous (tool_use + tool_result) pair, then check
+# the hook against a current action. $1=blocked target, $2=is_error,
+# $3=result text, $4=tool name for blocked action.
+make_transcript() {
+    local blocked="$1" err="$2" text="$3" tn="${4:-Bash}" f
+    f="$TMP/t_$RANDOM.jsonl"
+    local inkey="command"
+    [ "$tn" != "Bash" ] && inkey="file_path"
+    jq -nc --arg b "$blocked" --arg k "$inkey" --arg tn "$tn" \
+        '{type:"assistant",message:{content:[{type:"tool_use",id:"toolu_x",name:$tn,input:{($k):$b}}]}}' >"$f"
+    jq -nc --arg e "$err" --arg t "$text" \
+        '{type:"user",message:{content:[{type:"tool_result",tool_use_id:"toolu_x",is_error:($e=="true"),content:$t}]}}' >>"$f"
+    printf '%s' "$f"
+}
+
+# $1=transcript path, $2=current command/file, $3=tool name -> input JSON
+make_input() {
+    local tp="$1" cur="$2" tn="${3:-Bash}" k="command"
+    [ "$tn" != "Bash" ] && k="file_path"
+    jq -nc --arg tp "$tp" --arg c "$cur" --arg k "$k" --arg tn "$tn" \
+        '{transcript_path:$tp, tool_name:$tn, tool_input:{($k):$c}}'
+}
+
+run() {
+    local input="$1" expected="$2" desc="$3" env="${4:-}" actual=0
+    if [ -n "$env" ]; then
+        echo "$input" | env $env bash "$HOOK" >/dev/null 2>/dev/null || actual=$?
+    else
+        echo "$input" | bash "$HOOK" >/dev/null 2>/dev/null || actual=$?
+    fi
+    if [ "$actual" -eq "$expected" ]; then
+        echo "  PASS: $desc"; PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc (expected $expected, got $actual)"; FAIL=$((FAIL + 1))
+    fi
+}
+
+echo "reroute-after-block-guard.sh tests"
+echo ""
+
+HOOKERR='PreToolUse:Bash hook error: [bash /home/u/.claude/hooks/block-push.sh]: blocked push'
+
+# 1. Block fired on a path, current reroutes toward the same path -> stop.
+t=$(make_transcript "git push origin main:src/app.py" "true" "$HOOKERR")
+run "$(make_input "$t" "git -C . push --force origin main && cat src/app.py")" 2 "reroute toward same path after block -> exit 2"
+
+# 2. Same block, but current targets an unrelated path -> allow.
+t=$(make_transcript "git push origin main:src/app.py" "true" "$HOOKERR")
+run "$(make_input "$t" "ls docs/readme.md")" 0 "different target after block -> exit 0"
+
+# 3. Previous tool SUCCEEDED (no gate fired) -> allow even if same path.
+t=$(make_transcript "cat src/app.py" "false" "file contents here")
+run "$(make_input "$t" "rm src/app.py")" 0 "previous succeeded, no gate -> exit 0"
+
+# 4. Error present but NOT a gate block (generic failure) -> allow.
+t=$(make_transcript "cat src/app.py" "true" "cat: src/app.py: No such file or directory")
+run "$(make_input "$t" "vi src/app.py")" 0 "non-gate error -> exit 0"
+
+# 5. Edit reroute toward the same file that was just blocked -> stop.
+t=$(make_transcript "/home/u/proj/secret.env" "true" "PreToolUse:Edit hook error: [bash /x/dotenv-guard.sh]: blocked" "Edit")
+run "$(make_input "$t" "/home/u/proj/secret.env" "Write")" 2 "Write reroute to just-blocked file -> exit 2"
+
+# 6. One-shot override -> allow.
+t=$(make_transcript "git push origin main:src/app.py" "true" "$HOOKERR")
+run "$(make_input "$t" "git push --force origin main:src/app.py")" 0 "CC_REROUTE_ALLOW=1 override -> exit 0" "CC_REROUTE_ALLOW=1"
+
+# 7. Disabled -> allow.
+t=$(make_transcript "git push origin main:src/app.py" "true" "$HOOKERR")
+run "$(make_input "$t" "git push origin main:src/app.py")" 0 "CC_REROUTE_DISABLE=1 -> exit 0" "CC_REROUTE_DISABLE=1"
+
+# 8. No transcript_path -> allow (fail open).
+run '{"tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' 0 "no transcript_path -> exit 0"
+
+# 9. Generic "permission denied" is NOT a Claude Code gate -> allow (fail open).
+t=$(make_transcript "rm /etc/hosts" "true" "rm: cannot remove '/etc/hosts': Permission denied")
+run "$(make_input "$t" "sudo rm /etc/hosts")" 0 "generic permission denied is not a gate -> exit 0"
+
+# 10. Block on a path but current shares only a trivial flag/word -> allow.
+t=$(make_transcript "git push origin main" "true" "$HOOKERR")
+run "$(make_input "$t" "git status")" 0 "no shared concrete path token -> exit 0"
+
+# 11. Server-side git rejection ("blocked by required reviews") is NOT a gate -> allow.
+t=$(make_transcript "git push origin main" "true" "remote: error: GH006: Protected branch update failed; blocked by required reviews")
+run "$(make_input "$t" "git push --force origin main")" 0 "branch-protection rejection is not a gate -> exit 0"
+
+# 12. After a real hook block, inspecting the rejected branch (a git ref, not a
+#     file) must stay allowed — git refs are not concrete targets.
+t=$(make_transcript "git push origin/main" "true" "$HOOKERR")
+run "$(make_input "$t" "git log origin/main --oneline")" 0 "git ref (origin/main) is not a target -> exit 0"
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/secret-guard-documented-promises.test.sh

@@ -0,0 +1,97 @@
+#!/bin/bash
+# secret-guard: are the two promises in its own header actually implemented?
+#
+# Why this exists. The header has said, since the first release, that the hook
+# blocks `git add *secret*` and that CC_SECRET_PATTERNS adds patterns to block.
+# Measured 2026-09-04 against the shipped scripts.json: the credential regex was
+# (credentials|\.pem|\.key|\.p12|\.pfx|id_rsa|id_ed25519) -- no `secret` -- and
+# the body never referenced CC_SECRET_PATTERNS at all. So `git add secrets.yaml`
+# exited 0, and an operator who set CC_SECRET_PATTERNS got no error and no
+# enforcement.
+#
+# That is the expensive direction of wrong. A guard that fails to block is
+# silent: nothing breaks, no issue is filed, and the operator keeps believing
+# the header. These assertions pin both promises, in both directions -- the new
+# patterns must block, and ordinary staging must still pass, because a guard
+# that blocks everything is uninstalled within a day.
+
+set -u
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+HOOK="$(mktemp)"
+trap 'rm -f "$HOOK"' EXIT
+python3 -c "
+import json,sys
+sys.stdout.write(json.load(open('$ROOT/scripts.json'))['secret-guard'])" > "$HOOK"
+
+PASS=0; FAIL=0
+WORK="$(mktemp -d)"
+trap 'rm -f "$HOOK"; rm -rf "$WORK"' EXIT
+
+run() { # run <command> -> ERR/CODE  (cwd is a clean dir with no .env)
+  local payload
+  payload=$(python3 -c "
+import json,sys
+print(json.dumps({'tool_input': {'command': sys.argv[1]}}))" "$1")
+  ERR=$(printf '%s' "$payload" | (cd "$WORK" && bash "$HOOK") 2>&1 >/dev/null)
+  CODE=$?
+}
+
+check() { # check <name> <command> <expected-code>
+  run "$2"
+  if [ "$CODE" = "$3" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL: $1"
+    echo "        command:  $2"
+    echo "        expected exit $3, got $CODE"
+    [ -n "$ERR" ] && echo "        stderr:   $(printf '%s' "$ERR" | head -1)"
+  fi
+}
+
+echo "secret-guard: documented promises"
+
+# Promise 1 -- the header says *secret* is blocked.
+check "secrets.yaml is blocked"          "git add secrets.yaml"        2
+check "config/secret.json is blocked"    "git add config/secret.json"  2
+check "SECRETS.env is blocked"           "git add SECRETS.env"         2
+
+# The built-ins the header already delivered must keep working.
+check ".env still blocked"               "git add .env"                2
+check "credentials.json still blocked"   "git add credentials.json"    2
+check "id_rsa still blocked"             "git add id_rsa"              2
+
+# The other direction. A guard that blocks ordinary work gets removed.
+check "ordinary source passes"           "git add src/app.js"          0
+check "package.json passes"              "git add package.json"        0
+check "non-add git passes"               "git status"                  0
+
+# Promise 2 -- CC_SECRET_PATTERNS is documented as configuration.
+patterns_case() { # patterns_case <name> <patterns> <command> <expected>
+  local payload
+  payload=$(python3 -c "
+import json,sys
+print(json.dumps({'tool_input': {'command': sys.argv[1]}}))" "$3")
+  local code
+  printf '%s' "$payload" | (cd "$WORK" && CC_SECRET_PATTERNS="$2" bash "$HOOK") >/dev/null 2>&1
+  code=$?
+  if [ "$code" = "$4" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL: $1 (CC_SECRET_PATTERNS=$2, expected exit $4, got $code)"
+  fi
+}
+
+patterns_case "extra literal pattern blocks"   ".npmrc"        "git add .npmrc"          2
+patterns_case "extra glob pattern blocks"      "*.jks"         "git add release.jks"     2
+patterns_case "unrelated file still passes"    ".npmrc"        "git add README.md"       0
+patterns_case "empty value changes nothing"    ""              "git add README.md"       0
+# A malformed value must not become an approval for the built-ins. This is the
+# fail-open direction that matters: the operator typed something wrong and the
+# .env check has to survive it.
+patterns_case "built-ins survive junk value"   "[[[:*("        "git add .env"            2
+patterns_case "junk value blocks nothing new"  "[[[:*("        "git add README.md"       0
+
+echo "  $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/session-plugin-pin-watch.test.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# Tests for session-plugin-pin-watch.sh (#73952)
+# Run: bash tests/session-plugin-pin-watch.test.sh
+set -uo pipefail
+
+PASS=0
+FAIL=0
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/examples/session-plugin-pin-watch.sh"
+
+TESTHOME=$(mktemp -d)
+trap 'rm -rf "$TESTHOME"' EXIT
+mkdir -p "$TESTHOME/.claude/plugins/mkt/pluginA/v1.0.0/hooks" \
+         "$TESTHOME/.claude/plugins/mkt/pluginB/v2.3.0/hooks"
+GLOB="$TESTHOME/.claude/plugins/*/*/*"
+SID="t-sid"
+
+run() { # $1 = event
+    HOME="$TESTHOME" CC_PLUGIN_WATCH_GLOB="$GLOB" bash "$HOOK" <<EOF
+{"hook_event_name":"$1","session_id":"$SID"}
+EOF
+}
+
+assert_warns() { # $1 = "warn"|"quiet", $2 = event, $3 = desc
+    local out; out=$(run "$2")
+    if [ "$1" = "warn" ]; then
+        if printf '%s' "$out" | grep -q "systemMessage"; then echo "  PASS: $3"; PASS=$((PASS+1)); else echo "  FAIL: $3 (expected warning, got: ${out:-none})"; FAIL=$((FAIL+1)); fi
+    else
+        if [ -z "$out" ]; then echo "  PASS: $3"; PASS=$((PASS+1)); else echo "  FAIL: $3 (expected quiet, got: $out)"; FAIL=$((FAIL+1)); fi
+    fi
+}
+
+echo "session-plugin-pin-watch.sh tests"
+echo ""
+
+assert_warns quiet SessionStart "SessionStart -> snapshot, quiet"
+assert_warns quiet PreToolUse   "PreToolUse, all dirs present -> quiet"
+
+rm -rf "$TESTHOME/.claude/plugins/mkt/pluginA/v1.0.0"   # simulate re-materialization removing pinned path
+assert_warns warn PreToolUse    "pinned version dir vanished -> warn"
+
+assert_warns quiet PreToolUse   "state refreshed, nothing new vanished -> quiet (no spam)"
+
+echo ""
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/settings-unreadable-refuses-to-write.test.sh

@@ -0,0 +1,95 @@
+#!/bin/bash
+# A settings.json that exists but does not parse must never be treated as {}.
+#
+# The installer read it with a bare JSON.parse in 34 places, swallowed the failure
+# outright in 9, and in 6 of those 9 wrote the resulting object straight back with
+# writeFileSync(SETTINGS_PATH, ...). Every hook, permission and env var the user had
+# was replaced by a fresh object holding only the hook just added — and the command
+# exited 0, printing "Registered in settings.json".
+#
+# The usual trigger is a snippet copied from docs whose first line is
+# `// path/to/file`, which is not legal JSON. This repo shipped four such examples.
+#
+# Also covered here: --protect used to throw ReferenceError on every single run
+# (protect() called rules.some(...) and `rules` never existed in that function), so
+# the hook file was written and never registered. Nothing in tests/ exercised
+# --protect at all, which is why it could stay broken.
+#
+# Every case runs in a throwaway HOME. Nothing touches the real one.
+
+set -u
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PASS=0; FAIL=0
+
+BROKEN='// ~/.claude/settings.json
+{
+  "hooks": { "PreToolUse": [ { "matcher": "Bash", "hooks": [ { "type": "command", "command": "keep-me-guard.sh" } ] } ] },
+  "permissions": { "allow": ["Bash(ls:*)"] },
+  "env": { "KEEP_ME": "1" }
+}'
+VALID='{"hooks":{"PreToolUse":[{"matcher":"Bash","hooks":[{"type":"command","command":"keep-me-guard.sh"}]}]},"env":{"KEEP_ME":"1"}}'
+
+# check <name> <settings body> <expected exit> <must survive: 1|0> <expect warning: 1|0> <args...>
+check() {
+  local name="$1" body="$2" want_rc="$3" want_keep="$4" want_warn="$5"; shift 5
+  local T; T="$(mktemp -d)"
+  mkdir -p "$T/.claude/hooks"
+  printf '%s' "$body" > "$T/.claude/settings.json"
+
+  local out rc
+  out="$(cd "$ROOT" && HOME="$T" node index.mjs "$@" 2>&1)"; rc=$?
+
+  local keep=0
+  grep -q 'keep-me-guard' "$T/.claude/settings.json" && \
+    grep -q 'KEEP_ME' "$T/.claude/settings.json" && keep=1
+  local warn=0
+  case "$out" in *'is not valid JSON'*) warn=1 ;; esac
+
+  if [ "$rc" -eq "$want_rc" ] && [ "$keep" -eq "$want_keep" ] && [ "$warn" -eq "$want_warn" ]; then
+    PASS=$((PASS+1)); echo "  ok   $name"
+  else
+    FAIL=$((FAIL+1))
+    echo "  FAIL $name"
+    echo "       exit     want=$want_rc got=$rc"
+    echo "       survived want=$want_keep got=$keep"
+    echo "       warned   want=$want_warn got=$warn"
+    echo "$out" | tail -4 | sed 's/^/       | /'
+  fi
+  find "$T" -mindepth 1 -delete 2>/dev/null; rmdir "$T" 2>/dev/null
+}
+
+echo "settings-unreadable-refuses-to-write"
+
+# --- the file is unreadable: refuse to write, keep everything ---------------
+check "guard: broken settings is not overwritten" \
+  "$BROKEN" 1 1 1 --guard "block rm -rf"
+check "protect: broken settings is not overwritten" \
+  "$BROKEN" 1 1 1 --protect .env
+
+# --- controls: a readable file must behave exactly as before ----------------
+# Without these, "refuses to write" and "cannot write at all" look the same.
+check "guard: valid settings still registers" \
+  "$VALID" 0 1 0 --guard "block rm -rf"
+check "protect: valid settings still registers" \
+  "$VALID" 0 1 0 --protect .env
+
+# --- --protect used to throw ReferenceError before it could register --------
+T="$(mktemp -d)"; mkdir -p "$T/.claude/hooks"
+printf '%s' "$VALID" > "$T/.claude/settings.json"
+out="$(cd "$ROOT" && HOME="$T" node index.mjs --protect .env 2>&1)"
+if echo "$out" | grep -q 'ReferenceError'; then
+  FAIL=$((FAIL+1)); echo "  FAIL protect: no ReferenceError"
+  echo "$out" | tail -3 | sed 's/^/       | /'
+else
+  PASS=$((PASS+1)); echo "  ok   protect: no ReferenceError"
+fi
+if grep -q 'Edit|Write' "$T/.claude/settings.json"; then
+  PASS=$((PASS+1)); echo "  ok   protect: registered under the Edit|Write matcher"
+else
+  FAIL=$((FAIL+1)); echo "  FAIL protect: registered under the Edit|Write matcher"
+fi
+find "$T" -mindepth 1 -delete 2>/dev/null; rmdir "$T" 2>/dev/null
+
+echo
+echo "settings-unreadable-refuses-to-write: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]