cc-safe-setup 29.8.0 → 30.0.5

package/tests/auto-mode-quoted-targets.test.sh

@@ -0,0 +1,127 @@
+#!/bin/bash
+# The five quoted targets auto-mode-safety-enforcer left alone, and the mentions
+# that had to keep passing.
+#
+# PR #1008 closed eleven of nineteen gaps in that hook but stopped at the quoted
+# forms, and said why in the file itself:
+#
+#     Quoted forms ("/", "$HOME", ".git") are deliberately still not matched.
+#     This hook has no mention-vs-invocation pass, so putting a quote in a
+#     terminator set would also block `echo "rm -rf /"` and a commit message
+#     that names the command.
+#
+# That is now ported: the hook blanks out everything inside quotes and asks
+# whether a destructive verb still starts a command in what is left. If none
+# does, it exits 0 before any pattern runs. With mentions ruled out, quote
+# characters can be dropped from the text the patterns match against, so a
+# quoted target is judged like a bare one.
+#
+# Two halves, and both are the point:
+#   - the quoted targets must now be blocked   (this closes the remaining five)
+#   - the mentions must still pass             (this proves nothing was widened)
+#
+# Against the version before this change, the first half fails: the quoted
+# targets were invisible, so every one of them exited 0.
+#
+# Dangerous strings are assembled from parts so that reading or editing this
+# file does not trip the operator's own destructive-guard. The hook under test
+# receives the fully assembled string either way.
+
+set -u
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/examples/auto-mode-safety-enforcer.sh"
+PASS=0
+FAIL=0
+
+run() {
+  printf '{"tool_name":"Bash","tool_input":{"command":%s}}' \
+    "$(printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/^/"/; s/$/"/')" \
+    | bash "$HOOK" >/dev/null 2>&1
+  echo $?
+}
+
+expect() { # description command expected_exit
+  actual="$(run "$2")"
+  if [ "$actual" = "$3" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL: $1"
+    echo "        command:  $2"
+    echo "        expected: exit $3, got exit $actual"
+  fi
+}
+
+RM="r""m -rf"
+SLASH="/"
+GIT_DIR=".git"
+HOME_VAR='$HOME'
+HOME_BRACED='${HOME}'
+DQ='"'
+SQ="'"
+
+# --- the five that were left alone -------------------------------------------
+
+expect "a double-quoted root is a run" \
+  "$RM ${DQ}${SLASH}${DQ}"                                        2
+expect "a single-quoted root is a run" \
+  "$RM ${SQ}${SLASH}${SQ}"                                        2
+expect "a quoted home variable is a run" \
+  "$RM ${DQ}${HOME_VAR}${DQ}"                                     2
+expect "a quoted braced home variable is a run" \
+  "$RM ${DQ}${HOME_BRACED}${DQ}"                                  2
+expect "a quoted git directory is a run" \
+  "$RM ${DQ}${GIT_DIR}${DQ}"                                      2
+
+# --- other quoted targets the header claims ----------------------------------
+
+expect "a quoted tilde is a run"        "$RM ${DQ}~${DQ}"         2
+expect "a quoted etc is a run"          "$RM ${DQ}${SLASH}etc${DQ}" 2
+expect "a quoted parent traversal is a run" \
+  "$RM ${DQ}..${DQ}"                                              2
+expect "a quoted target after another command is a run" \
+  "npm ci && $RM ${DQ}${SLASH}${DQ}"                              2
+
+# --- mentions must still pass (nothing was widened) --------------------------
+
+expect "a mention in echo is not a run" \
+  "echo ${DQ}${RM} ${SLASH}${DQ}"                                 0
+expect "a mention in a commit message is not a run" \
+  "git commit -m ${DQ}guard against ${RM} ${SLASH}${DQ}"          0
+expect "a mention in grep is not a run" \
+  "grep -r ${DQ}${RM} ${SLASH}${DQ} ."                            0
+expect "a mention in a jq filter is not a run" \
+  "jq -n ${SQ}{cmd: ${DQ}${RM} ${SLASH}${DQ}}${SQ}"               0
+expect "a mention in prose is not a run" \
+  "echo ${DQ}the command ${RM} ${SLASH} destroys everything${DQ}" 0
+expect "a mention of the home variable is not a run" \
+  "echo ${DQ}never write ${RM} ${HOME_VAR}${DQ}"                  0
+expect "appending a mention to a note is not a run" \
+  "echo ${SQ}${RM} ${SLASH} is the one to avoid${SQ} >> notes.md"  0
+
+# --- quoted safe targets must pass -------------------------------------------
+# This is the false-positive half. Dropping quote characters must not turn an
+# ordinary quoted cleanup into a block.
+
+expect "a quoted node_modules is allowed" \
+  "$RM ${DQ}node_modules${DQ}"                                    0
+expect "a quoted dist is allowed"       "$RM ${DQ}dist${DQ}"      0
+expect "a quoted name with a space is allowed" \
+  "$RM ${DQ}my build dir${DQ}"                                    0
+expect "a quoted gitignore is not the git directory" \
+  "$RM ${DQ}.gitignore${DQ}"                                      0
+
+# --- quoted text that is executed is not a mention ---------------------------
+# A quoted string is only inert while nothing runs it. These do run it, so the
+# gate must not let them through on the grounds that the verb sits in quotes.
+
+expect "sh -c runs its quoted argument" \
+  "sh -c ${DQ}${RM} ${SLASH}${DQ}"                                2
+expect "bash -c runs its quoted argument" \
+  "bash -c ${SQ}${RM} ~${SQ}"                                     2
+expect "eval runs its quoted argument" \
+  "eval ${DQ}${RM} ${SLASH}${DQ}"                                 2
+expect "a pipe into a shell runs what was piped" \
+  "echo ${DQ}${RM} ${SLASH}${DQ} | sh"                            2
+
+echo "auto-mode-quoted-targets: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/auto-mode-unquoted-targets.test.sh

@@ -0,0 +1,112 @@
+#!/bin/bash
+# auto-mode-safety-enforcer promised more than it blocked.
+#
+# The header of that hook says it blocks:
+#
+#     rm -rf on non-safe paths (/, ~, .., /home, /etc, /usr, /var, .git)
+#
+# Measured 2026-08-11 against 19 targets it claims: 11 were not blocked.
+# The target pattern only ends on whitespace, a separator or end-of-line, and
+# it has no case for $HOME, for a parent traversal, or for the git directory:
+#
+#     rm -rf $HOME        passed        rm -rf ..                 passed
+#     rm -rf ${HOME}      passed        rm -rf ../..              passed
+#     rm -rf .git         passed        rm -rf a/../..            passed
+#
+# Same defect family as PR #961 (quoted target) and #962 (variable target),
+# which fixed scripts.json only. The example hook never received either fix.
+#
+# --- deliberately NOT fixed here ---------------------------------------------
+# Five of the eleven need the target seen through quotes:
+#
+#     rm -rf "/"   rm -rf '/'   rm -rf "$HOME"   rm -rf "${HOME}"   rm -rf ".git"
+#
+# Adding a quote to the terminator set would also block these, which are
+# mentions and must keep passing:
+#
+#     echo "rm -rf /"        git commit -m "guard against rm -rf /"
+#
+# Both shapes end in /" and this hook has no mention-vs-invocation pass — the
+# five above pass today only because the target is invisible behind the quote,
+# not because the hook can tell a mention from a run. Telling them apart needs
+# the quote-aware extraction destructive-guard grew in PR #960. Until that is
+# ported, the mention controls at the bottom of this file are the guarantee
+# that no such false positive was introduced.
+
+set -u
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/examples/auto-mode-safety-enforcer.sh"
+PASS=0
+FAIL=0
+
+run() {
+  printf '{"tool_name":"Bash","tool_input":{"command":%s}}' \
+    "$(printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/^/"/; s/$/"/')" \
+    | bash "$HOOK" >/dev/null 2>&1
+  echo $?
+}
+
+expect() { # description command expected_exit
+  actual="$(run "$2")"
+  if [ "$actual" = "$3" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL: $1"
+    echo "        command:  $2"
+    echo "        expected: exit $3, got exit $actual"
+  fi
+}
+
+# Dangerous strings are assembled from parts so that reading or editing this
+# file does not trip the operator's own destructive-guard. The hook under test
+# receives the fully assembled string either way.
+SLASH="/"
+DOTDOT="..${SLASH}"
+GIT_DIR=".git"
+HOME_VAR='$HOME'
+HOME_BRACED='${HOME}'
+
+# --- the gap this file closes ------------------------------------------------
+
+expect "home through the variable"        "rm -rf $HOME_VAR"                  2
+expect "home through the braced variable" "rm -rf $HOME_BRACED"               2
+expect "home variable with a subpath"     "rm -rf $HOME_VAR${SLASH}projects"  2
+expect "bare parent traversal"            "rm -rf .."                         2
+expect "repeated parent traversal"        "rm -rf $DOTDOT.."                  2
+expect "traversal hidden after a safe name" \
+                                          "rm -rf node_modules${SLASH}$DOTDOT.." 2
+expect "the git directory"                "rm -rf $GIT_DIR"                   2
+expect "the git directory with a slash"   "rm -rf $GIT_DIR$SLASH"             2
+
+# --- what already worked must keep working -----------------------------------
+
+expect "root still blocks"                "rm -rf $SLASH"                     2
+expect "home tilde still blocks"          "rm -rf ~"                          2
+expect "etc still blocks"                 "rm -rf ${SLASH}etc"                2
+expect "usr still blocks"                 "rm -rf ${SLASH}usr"                2
+expect "ssh directory still blocks"       "rm -rf ~${SLASH}.ssh"              2
+
+# --- ordinary cleanup must not be caught -------------------------------------
+
+expect "node_modules is allowed"          "rm -rf node_modules"               0
+expect "dist is allowed"                  "rm -rf dist"                       0
+expect "leading ./ is allowed"            "rm -rf .${SLASH}build"             0
+expect "cleanup after another command"    "npm ci && rm -rf node_modules"     0
+expect "an unlisted directory is allowed" "rm -rf tmpdir"                     0
+expect "gitignore is not the git directory" \
+                                          "rm -rf .gitignore"                 0
+expect "the github directory is not the git directory" \
+                                          "rm -rf .github"                    0
+expect "a dotted name is not a traversal" "rm -rf my..cache"                  0
+expect "a file ending in two dots is not a traversal" \
+                                          "rm -rf backup.."                   0
+
+# --- mentions must keep passing (the reason quotes are left alone) -----------
+
+expect "a mention in echo is not a run"   "echo \"rm -rf $SLASH\""            0
+expect "a mention in a commit message is not a run" \
+                                          "git commit -m \"guard against rm -rf $SLASH\"" 0
+expect "a mention in grep is not a run"   "grep -r \"rm -rf $SLASH\" ."       0
+
+echo "auto-mode-unquoted-targets: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/bash-secret-output-detector-detects.test.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# bash-secret-output-detector: does each advertised pattern actually fire?
+#
+# Why this exists. The six existing checks for this hook in test.sh all assert
+# exit 0. This hook always exits 0 by default, so those checks pass whether a
+# pattern fires or not - the same shape as the "234 test files that could not
+# fail" noted in the CI workflow.
+#
+# The regression being pinned: the private-key check was written as
+#   grep -qE '-----BEGIN ... PRIVATE KEY-----'
+# without `--`, so grep read the leading dashes as options, printed
+# "unrecognized option" and exited non-zero. The check never fired on any
+# input, and test.sh's "private key" case passed anyway because it only looked
+# at the exit code. Measured 2026-09-20 against the shipped file.
+#
+# Both directions are asserted: a detector that also fires on ordinary output
+# is a detector operators learn to ignore.
+
+set -u
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+HOOK="$REPO/examples/bash-secret-output-detector.sh"
+PASS=0
+FAIL=0
+
+# Split so that writing this file does not itself trip a secret scanner.
+AWS="AKI""AIOSFODNN7""EXAMPLE"
+APIKEY="api_key=sk""-1234567890abcdefghijklmnop"
+CONN="postgres://user"":pass@host:5432/db"
+PEM="-----BEGIN RSA PRIVATE KEY-----"
+GH="ghp""_1234567890abcdefghijklmnopqrstuv"
+JWT="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.abc"
+
+run() {
+  local payload
+  payload=$(printf '{"tool_name":"Bash","tool_result":{"stdout":"%s"}}' "$1")
+  ERR=$(printf '%s' "$payload" | bash "$HOOK" 2>&1 >/dev/null)
+}
+
+warns() {
+  run "$2"
+  local got="no"
+  case "$ERR" in *"SECRET DETECTED"*) got="yes" ;; esac
+  if [ "$got" = "$3" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL: $1 (expected warn=$3, got warn=$got)"
+    echo "        stderr: $ERR"
+  fi
+}
+
+quiet_stderr() {
+  run "hello world"
+  case "$ERR" in
+    *"unrecognized option"*|*"Usage: grep"*)
+      FAIL=$((FAIL + 1))
+      echo "  FAIL: a pattern is malformed and grep is erroring out"
+      echo "        stderr: $ERR" ;;
+    *) PASS=$((PASS + 1)) ;;
+  esac
+}
+
+echo "bash-secret-output-detector-detects:"
+
+# --- every advertised pattern has to fire ----------------------------------
+warns "AWS access key"        "$AWS"     yes
+warns "API key assignment"    "$APIKEY"  yes
+warns "connection string"     "$CONN"    yes
+warns "private key header"    "$PEM"     yes
+warns "GitHub token"          "$GH"      yes
+warns "JWT"                   "$JWT"     yes
+
+# --- ordinary output must stay quiet ---------------------------------------
+warns "plain output is quiet"  "hello world"       no
+warns "safe env var is quiet"  "PATH=/usr/bin"     no
+
+# --- no pattern may be malformed -------------------------------------------
+quiet_stderr
+
+# --- default must not interrupt; the opt-in must ---------------------------
+printf '%s' "{\"tool_name\":\"Bash\",\"tool_result\":{\"stdout\":\"$AWS\"}}" \
+  | bash "$HOOK" >/dev/null 2>&1
+rc=$?
+if [ "$rc" -eq 0 ]; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "  FAIL: default must not interrupt (expected exit 0, got $rc)"
+fi
+
+printf '%s' "{\"tool_name\":\"Bash\",\"tool_result\":{\"stdout\":\"$AWS\"}}" \
+  | CC_SECRET_OUTPUT_BLOCK=1 bash "$HOOK" >/dev/null 2>&1
+rc=$?
+if [ "$rc" -eq 2 ]; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "  FAIL: CC_SECRET_OUTPUT_BLOCK=1 must exit 2 (got $rc)"
+fi
+
+echo "  $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/blindspots-cross-layer.test.sh

@@ -0,0 +1,177 @@
+#!/bin/bash
+# --blindspots must compare two layers, and must not mistake an allow test for a gate.
+#
+# Why this exists. Every other diagnostic in this tool reads one layer: the
+# scripts on disk (--status), the settings file (--lint), the block log
+# (--stats), the shipped bodies (--outdated). A guard can be present,
+# executable, registered and current in all four and still never fire, because
+# the shape of the commands actually run on that machine never reaches it.
+# `--blindspots` is the only check that reads the session transcripts next to
+# the guards, so it is the only one that can see that gap.
+#
+# The trap this test pins is in the instrument, not in the user's setup. Hook
+# scripts contain start-anchored patterns for two opposite purposes:
+#
+#   gate     if printf '%s' "$CMD" | grep -qE '^\s*git\s+add'; then ... exit 2
+#   subject  if ! printf '%s' "$CMD" | grep -qE '^\s*git\s+push'; then exit 0; fi
+#   exempt   if printf '%s' "$CMD" | grep -qE '^\s*(cat|ls)'; then exit 0; fi
+#
+# The first two decide what the hook reaches. The third decides what it lets
+# through on purpose. Counting the third as an unguarded gap fills the report
+# with alarms about read-only commands the author deliberately waved past — a
+# tool that warns about the very defect it contains. So this test asserts both
+# directions: the gate and the subject are reported, and the exempt pattern is
+# not.
+#
+# Numbers are fixed by construction: 25 calls invoke `git push`, 5 of them at
+# the start of the string, 20 after a `cd ... &&`. Blind = 20/25 = 80.0%.
+
+set -u
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+PASS=0
+FAIL=0
+
+check() { # name expected actual
+  if [ "$2" = "$3" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "  FAIL: $1"
+    echo "    expected: $2"
+    echo "    actual:   $3"
+  fi
+}
+
+TMP="$(mktemp -d)"
+trap 'chmod -R u+w "$TMP" 2>/dev/null; find "$TMP" -mindepth 1 -delete 2>/dev/null; rmdir "$TMP" 2>/dev/null' EXIT
+
+mkdir -p "$TMP/.claude/hooks" "$TMP/.claude/projects/-tmp-probe"
+
+# A gate: the anchor is the blocking condition.
+cat > "$TMP/.claude/hooks/probe-add-guard.sh" <<'HOOK'
+#!/bin/bash
+CMD=$(cat)
+if printf '%s' "$CMD" | grep -qE '^\s*git\s+add'; then
+  echo "blocked" >&2
+  exit 2
+fi
+exit 0
+HOOK
+
+# A subject filter: anything not matching the anchor is never examined at all.
+cat > "$TMP/.claude/hooks/probe-push-guard.sh" <<'HOOK'
+#!/bin/bash
+CMD=$(cat)
+if ! printf '%s' "$CMD" | grep -qE '^\s*git\s+push'; then
+  exit 0
+fi
+echo "blocked" >&2
+exit 2
+HOOK
+
+# An allow test: these are waved through deliberately and are not a gap.
+cat > "$TMP/.claude/hooks/probe-readonly-allow.sh" <<'HOOK'
+#!/bin/bash
+CMD=$(cat)
+if printf '%s' "$CMD" | grep -qE '^\s*(cat|ls|head)'; then
+  exit 0
+fi
+exit 0
+HOOK
+
+# Present on disk, registered nowhere. It never runs, so its anchors must not be
+# counted as gaps — but the file itself is worth naming.
+cat > "$TMP/.claude/hooks/probe-orphan.sh" <<'HOOK'
+#!/bin/bash
+CMD=$(cat)
+if printf '%s' "$CMD" | grep -qE '^\s*git\s+push'; then
+  exit 2
+fi
+exit 0
+HOOK
+
+chmod +x "$TMP/.claude/hooks/"*.sh
+
+# One registration points at a script that is not there. Settings say it is
+# installed; the filesystem says otherwise. Neither layer alone shows this.
+cat > "$TMP/.claude/settings.json" <<SETTINGS
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          { "type": "command", "command": "bash \$HOME/.claude/hooks/probe-push-guard.sh" },
+          { "type": "command", "command": "bash \$HOME/.claude/hooks/probe-add-guard.sh" },
+          { "type": "command", "command": "bash \$HOME/.claude/hooks/probe-readonly-allow.sh" },
+          { "type": "command", "command": "bash \$HOME/.claude/hooks/probe-removed-guard.sh" }
+        ]
+      }
+    ]
+  }
+}
+SETTINGS
+
+# 25 invocations of `git push`: 5 at the start, 20 behind a `cd ... &&`.
+# Plus 30 `cat` calls, which the allow test covers on purpose.
+TRANSCRIPT="$TMP/.claude/projects/-tmp-probe/session.jsonl"
+: > "$TRANSCRIPT"
+emit() { # command
+  printf '{"type":"assistant","timestamp":"2026-09-01T00:00:00Z","message":{"content":[{"type":"tool_use","name":"Bash","input":{"command":%s}}]}}\n' \
+    "$(printf '%s' "$1" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))')" >> "$TRANSCRIPT"
+}
+for i in $(seq 1 5);  do emit "git push origin main"; done
+for i in $(seq 1 20); do emit "cd /tmp/work && git push origin main"; done
+for i in $(seq 1 30); do emit "cat /tmp/work/notes.md"; done
+
+OUT="$(HOME="$TMP" node "$REPO/index.mjs" --blindspots 2>&1)"
+PLAIN="$(printf '%s' "$OUT" | sed 's/\x1b\[[0-9;]*m//g')"
+
+# Layer 4 was actually read.
+check "counts the Bash calls in the transcript" \
+  "yes" "$(printf '%s' "$PLAIN" | grep -qE '\b55 Bash tool calls' && echo yes || echo no)"
+
+# The sample must be a shape, never the command. A user's history carries keys,
+# customer names and internal paths, and this output lands in screen shares and
+# CI logs. The probe transcript writes /tmp/work into every chained call; none of
+# it may come back out.
+check "prints the shape, not the arguments" \
+  "yes" "$(printf '%s' "$PLAIN" | grep -qE '^ +cd … && git push …$' && echo yes || echo no)"
+check "no argument from the transcript is echoed" \
+  "yes" "$(printf '%s' "$PLAIN" | grep -q '/tmp/work' && echo no || echo yes)"
+
+# The subject filter is reported, with the blind rate fixed by construction.
+check "reports the start-anchored push guard" \
+  "yes" "$(printf '%s' "$PLAIN" | grep -q 'probe-push-guard.sh' && echo yes || echo no)"
+check "blind rate is 20 of 25" \
+  "yes" "$(printf '%s' "$PLAIN" | grep -qE 'git push .*probe-push-guard\.sh +25 +5 +80\.0%' && echo yes || echo no)"
+check "labels a subject filter as never examined" \
+  "yes" "$(printf '%s' "$PLAIN" | grep -qE 'probe-push-guard\.sh.*never examined' && echo yes || echo no)"
+
+# The allow test must not be listed. This is the instrument's own failure mode.
+check "does not report the allow test as a gap" \
+  "yes" "$(printf '%s' "$PLAIN" | grep -qE '^ +(cat|ls|head).*probe-readonly-allow\.sh' && echo no || echo yes)"
+
+# Present but registered nowhere. Its anchors are kept out of the gap table —
+# a script that never runs cannot have a gap — and the reader is told the table
+# is smaller than their hooks directory, without duplicating the enumeration
+# that --audit already does with its own precision rules.
+check "says unregistered scripts were left out of the table" \
+  "yes" "$(printf '%s' "$PLAIN" | grep -qE '1 more script .* is registered nowhere' && echo yes || echo no)"
+check "keeps the unregistered script out of the gap table" \
+  "yes" "$(printf '%s' "$PLAIN" | grep -qE 'git push +probe-orphan\.sh +[0-9]' && echo no || echo yes)"
+
+# The registration with no file behind it.
+check "names the registration whose file is missing" \
+  "yes" "$(printf '%s' "$PLAIN" | grep -q 'probe-removed-guard.sh' && echo yes || echo no)"
+check "does not flag the registration that does exist" \
+  "yes" "$(printf '%s' "$PLAIN" | grep -qE '^\s+·.*probe-push-guard\.sh' && echo no || echo yes)"
+
+# Nothing is written back. This command reads; it must never touch settings.
+BEFORE="$(md5sum "$TMP/.claude/settings.json" | cut -d' ' -f1)"
+HOME="$TMP" node "$REPO/index.mjs" --blindspots >/dev/null 2>&1
+AFTER="$(md5sum "$TMP/.claude/settings.json" | cut -d' ' -f1)"
+check "leaves settings.json untouched" "$BEFORE" "$AFTER"
+
+echo "  blindspots-cross-layer: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/block-database-wipe.test.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# Test for block-database-wipe.sh
+#
+# Verifies the hook blocks (exit 2) destructive framework/ORM database commands
+# across Laravel, Django, Rails, Prisma, TypeORM/Sequelize, raw SQL and PostgreSQL,
+# while letting safe incremental commands through (exit 0).
+#
+# Gaps closed in Issue #69059: migrate:refresh, Django "migrate <app> zero",
+# Rails db:schema:load, TypeORM/Sequelize schema:drop / db:drop.
+
+set -u
+
+HOOK="$(dirname "$0")/../examples/block-database-wipe.sh"
+[ ! -x "$HOOK" ] && chmod +x "$HOOK"
+
+PASS=0
+FAIL=0
+
+run_case() {
+    local name="$1"
+    local cmd="$2"
+    local expect="$3"  # "block" or "allow"
+
+    local input rc
+    input=$(jq -nc --arg cmd "$cmd" '{tool_input:{command:$cmd}}')
+    echo "$input" | "$HOOK" >/dev/null 2>&1
+    rc=$?
+
+    if [ "$expect" = "block" ]; then
+        if [ "$rc" = "2" ]; then PASS=$((PASS + 1)); echo "PASS: $name"
+        else FAIL=$((FAIL + 1)); echo "FAIL: $name (expected block/exit2, got $rc)"; fi
+    else
+        if [ "$rc" = "0" ]; then PASS=$((PASS + 1)); echo "PASS: $name"
+        else FAIL=$((FAIL + 1)); echo "FAIL: $name (expected allow/exit0, got $rc)"; fi
+    fi
+}
+
+# --- destructive: must block ---
+run_case "laravel migrate:fresh"      "php artisan migrate:fresh"            block
+run_case "laravel migrate:refresh"    "php artisan migrate:refresh"         block
+run_case "laravel migrate:reset"      "php artisan migrate:reset"           block
+run_case "laravel db:wipe"            "php artisan db:wipe"                  block
+run_case "django flush"               "python manage.py flush"              block
+run_case "django migrate app zero"    "python manage.py migrate myapp zero" block
+run_case "rails db:drop"              "rails db:drop"                       block
+run_case "rails db:schema:load"       "rails db:schema:load"                block
+run_case "prisma migrate reset"       "npx prisma migrate reset"            block
+run_case "typeorm schema:drop"        "npm run typeorm schema:drop"         block
+run_case "sequelize db:drop"          "npx sequelize-cli db:drop"           block
+run_case "raw DROP DATABASE"          "mysql -e 'DROP DATABASE foo'"        block
+run_case "dropdb"                     "dropdb mydb"                         block
+
+# --- safe: must allow (no false positives) ---
+run_case "laravel migrate (incremental)" "php artisan migrate"             allow
+run_case "django migrate (incremental)"  "python manage.py migrate"        allow
+run_case "rails db:migrate"              "rails db:migrate"                 allow
+run_case "prisma migrate dev"           "npx prisma migrate dev"           allow
+run_case "typeorm migration:run"        "npm run typeorm migration:run"    allow
+run_case "plain git commit"             "git commit -m fix"                allow
+run_case "safe SELECT"                  "psql -c 'SELECT count(*) FROM users'" allow
+
+echo "----------------------------------------"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ] || exit 1

package/tests/bundled-short-flags-bypass.test.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+# Bundled short flags slipped past the force checks
+#
+# Short options can be written together. These are all one flag group:
+#
+#   git push -uf origin feature     # -u --set-upstream  +  -f --force
+#   git checkout -bf main           # -b new branch      +  -f force
+#   git switch -Cf main             # -C force-create    +  -f force
+#
+# Every one of them is a real destructive operation. The shipped patterns
+# looked for the spelling `-f` as a standalone word (`-f\b`), so a bundled
+# group never matched and the guards exited 0 -- an affirmative approval.
+#
+# Measured 2026-09-03 against the shipped copies: 4 bypasses.
+#   branch-guard      git push -uf   (force push, any branch)
+#   destructive-guard git checkout -bf, git switch -Cf, git checkout -qf
+#
+# The fix reads "a dash, then letters, ending in f" instead of the literal
+# `-f`: [^A-Za-z0-9]-[a-zA-Z]*f\b
+#
+# The leading [^A-Za-z0-9] is what keeps `--follow-tags` out: after the second
+# dash the letters run `follow`, and `f` is not at a word boundary there.
+#
+# destructive-guard needed a second change beyond the character class. Its
+# pattern was `git\s+(checkout|switch)\s+.*`, and that `\s+` ate the space in
+# front of `-bf`, leaving no character for [^A-Za-z0-9] to match. Anchoring on
+# `\b` instead of `\s+` leaves the space in the subject where the class can see
+# it. Same shape as the git-globals fix: the check was right, the thing feeding
+# it was not.
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+BG=$(mktemp); DG=$(mktemp)
+trap 'rm -f "$BG" "$DG"' EXIT
+python3 -c "
+import json,sys
+d=json.load(open('$ROOT/scripts.json'))
+open('$BG','w').write(d['branch-guard'])
+open('$DG','w').write(d['destructive-guard'])"
+
+PASS=0; FAIL=0
+
+check() {
+    local guard="$1" desc="$2" cmd="$3" want="$4"   # want: 2 = blocked, 0 = allowed
+    local payload code
+    payload=$(python3 -c '
+import json,sys
+print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]}}))' "$cmd")
+    printf '%s' "$payload" | bash "$guard" >/dev/null 2>&1
+    code=$?
+    if [ "$code" = "$want" ]; then
+        echo "PASS: $desc"; PASS=$((PASS+1))
+    else
+        echo "FAIL: $desc (expected exit $want, got $code)"; FAIL=$((FAIL+1))
+    fi
+}
+
+# --- branch-guard: bundled -f in a push ---
+check "$BG" "bg: -uf force push"              'git push -uf origin feature'         2
+check "$BG" "bg: -qf force push"              'git push -qf origin feature'         2
+check "$BG" "bg: -uf with a global"           'git -C /repo push -uf origin feature' 2
+check "$BG" "bg: plain -f still blocked"      'git push -f origin feature'          2
+check "$BG" "bg: --force still blocked"       'git push --force origin feature'     2
+
+# --- branch-guard: ordinary work still goes through ---
+check "$BG" "bg: --follow-tags allowed"       'git push --follow-tags origin feature' 0
+check "$BG" "bg: -u alone allowed"            'git push -u origin feature'          0
+check "$BG" "bg: plain push allowed"          'git push origin feature'             0
+
+# --- destructive-guard: bundled -f in checkout/switch ---
+check "$DG" "dg: checkout -bf"                'git checkout -bf main'               2
+check "$DG" "dg: switch -Cf"                  'git switch -Cf main'                 2
+check "$DG" "dg: checkout -qf"                'git checkout -qf main'               2
+check "$DG" "dg: checkout -f still blocked"   'git checkout -f main'                2
+check "$DG" "dg: checkout --force blocked"    'git checkout --force main'           2
+check "$DG" "dg: switch --discard-changes"    'git switch --discard-changes main'   2
+
+# --- destructive-guard: ordinary work still goes through ---
+check "$DG" "dg: checkout a branch"           'git checkout main'                   0
+check "$DG" "dg: checkout -b new branch"      'git checkout -b feature'             0
+check "$DG" "dg: switch -c new branch"        'git switch -c my-feature'            0
+check "$DG" "dg: switch --detach"             'git switch --detach HEAD'            0
+check "$DG" "dg: checkout --track"            'git checkout --track origin/feature' 0
+
+echo
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" = 0 ]