troxy-cli 1.29.23 → 1.29.24

package/src/tests/claude-code-hook.test.js

@@ -120,63 +120,73 @@ describe('unpatchClaudeCodeConfig', () => {
 describe('patchClaudeCodeHooks', () => {
   const configPath = () => path.join(dir, 'settings.json');
   const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+  const writeConfig = (cfg) => {
+    fs.mkdirSync(path.dirname(configPath()), { recursive: true });
+    fs.writeFileSync(configPath(), JSON.stringify(cfg, null, 2) + '\n');
+  };
 
   it('creates the Stop hook entry when the file does not exist', () => {
-    patchClaudeCodeHooks(configPath(), '/usr/local/bin/troxy hook-report');
-    const cfg = read();
-    assert.equal(cfg.hooks.Stop.length, 1);
-    assert.equal(cfg.hooks.Stop[0].hooks[0].command, '/usr/local/bin/troxy hook-report');
-    assert.equal(cfg.hooks.Stop[0].hooks[0].type, 'command');
+    let cfg = {};
+    cfg = patchClaudeCodeHooks(cfg, {}, '/usr/local/bin/troxy hook-report');
+    writeConfig(cfg);
+    const result = read();
+    assert.equal(result.hooks.Stop.length, 1);
+    assert.equal(result.hooks.Stop[0].hooks[0].command, '/usr/local/bin/troxy hook-report');
+    assert.equal(result.hooks.Stop[0].hooks[0].type, 'command');
   });
 
   it('is idempotent: running twice produces one Troxy entry, not two', () => {
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report');
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report');
-    const cfg = read();
-    assert.equal(cfg.hooks.Stop.length, 1);
+    let cfg = {};
+    cfg = patchClaudeCodeHooks(cfg, {}, 'troxy hook-report');
+    cfg = patchClaudeCodeHooks(cfg, {}, 'troxy hook-report');
+    writeConfig(cfg);
+    const result = read();
+    assert.equal(result.hooks.Stop.length, 1);
   });
 
   it('updates the command in place on a re-run rather than appending', () => {
-    patchClaudeCodeHooks(configPath(), 'npx troxy-cli hook-report');
-    patchClaudeCodeHooks(configPath(), '/usr/local/bin/troxy hook-report');
-    const cfg = read();
-    assert.equal(cfg.hooks.Stop.length, 1);
-    assert.equal(cfg.hooks.Stop[0].hooks[0].command, '/usr/local/bin/troxy hook-report');
+    let cfg = {};
+    cfg = patchClaudeCodeHooks(cfg, {}, 'npx troxy-cli hook-report');
+    cfg = patchClaudeCodeHooks(cfg, {}, '/usr/local/bin/troxy hook-report');
+    writeConfig(cfg);
+    const result = read();
+    assert.equal(result.hooks.Stop.length, 1);
+    assert.equal(result.hooks.Stop[0].hooks[0].command, '/usr/local/bin/troxy hook-report');
   });
 
   it("preserves the user's own unrelated Stop hooks in the same file", () => {
-    fs.writeFileSync(configPath(), JSON.stringify({
+    let cfg = {
       hooks: { Stop: [{ hooks: [{ type: 'command', command: 'my-own-script.sh' }] }] },
-    }));
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report');
-    const cfg = read();
-    assert.equal(cfg.hooks.Stop.length, 2);
-    assert.ok(cfg.hooks.Stop.some(e => e.hooks[0].command === 'my-own-script.sh'));
-    assert.ok(cfg.hooks.Stop.some(e => e.hooks[0].command === 'troxy hook-report'));
+    };
+    cfg = patchClaudeCodeHooks(cfg, {}, 'troxy hook-report');
+    writeConfig(cfg);
+    const result = read();
+    assert.equal(result.hooks.Stop.length, 2);
+    assert.ok(result.hooks.Stop.some(e => e.hooks[0].command === 'my-own-script.sh'));
+    assert.ok(result.hooks.Stop.some(e => e.hooks[0].command === 'troxy hook-report'));
   });
 
   it("preserves the user's own other hook events (PreToolUse etc.) untouched", () => {
-    fs.writeFileSync(configPath(), JSON.stringify({
+    let cfg = {
       hooks: { PreToolUse: [{ matcher: 'Write', hooks: [{ type: 'command', command: 'validate.sh' }] }] },
-    }));
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report');
-    const cfg = read();
-    assert.ok(cfg.hooks.PreToolUse, 'an unrelated hook event was dropped by the patch');
+    };
+    cfg = patchClaudeCodeHooks(cfg, {});
+    writeConfig(cfg);
+    const result = read();
+    assert.ok(result.hooks.PreToolUse, 'an unrelated hook event was dropped by the patch');
   });
 
   it('does not throw when the existing file is corrupted JSON', () => {
-    fs.writeFileSync(configPath(), 'not json at all');
-    assert.doesNotThrow(() => patchClaudeCodeHooks(configPath(), 'troxy hook-report'));
+    // Test: patchClaudeCodeHooks should handle corrupted config gracefully
+    // Pure function doesn't touch files, but we test it doesn't crash on any input
+    let cfg = {}; // In real usage, caller would catch JSON parse errors
+    assert.doesNotThrow(() => patchClaudeCodeHooks(cfg, {}));
   });
 });
 
 describe('patchClaudeCodeHooks: PreToolUse gate', () => {
-  const configPath = () => path.join(dir, 'settings.json');
-  const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
-
   it('creates the PreToolUse entry alongside Stop, matching every tool', () => {
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report', '/usr/local/bin/troxy pretooluse-hook');
-    const cfg = read();
+    const cfg = patchClaudeCodeHooks({}, {}, 'troxy hook-report', '/usr/local/bin/troxy pretooluse-hook');
     assert.equal(cfg.hooks.PreToolUse.length, 1);
     assert.equal(cfg.hooks.PreToolUse[0].hooks[0].command, '/usr/local/bin/troxy pretooluse-hook');
     // '*' (not the regex '.*') is Claude Code's own documented syntax for
@@ -185,41 +195,36 @@ describe('patchClaudeCodeHooks: PreToolUse gate', () => {
   });
 
   it('sets a short per-hook timeout as a second, independent fail-open guarantee', () => {
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'troxy pretooluse-hook');
-    const cfg = read();
+    const cfg = patchClaudeCodeHooks({}, {}, 'troxy hook-report', 'troxy pretooluse-hook');
     assert.ok(cfg.hooks.PreToolUse[0].hooks[0].timeout > 0);
     assert.ok(cfg.hooks.PreToolUse[0].hooks[0].timeout <= 10, 'timeout should be short, not Claude Code\'s 600s default');
   });
 
   it('is idempotent: running twice produces one Troxy PreToolUse entry, not two', () => {
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'troxy pretooluse-hook');
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'troxy pretooluse-hook');
-    const cfg = read();
+    let cfg = patchClaudeCodeHooks({}, {}, 'troxy hook-report', 'troxy pretooluse-hook');
+    cfg = patchClaudeCodeHooks(cfg, {}, 'troxy hook-report', 'troxy pretooluse-hook');
     assert.equal(cfg.hooks.PreToolUse.length, 1);
   });
 
   it('updates the PreToolUse command in place on a re-run rather than appending', () => {
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'npx troxy-cli pretooluse-hook');
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report', '/usr/local/bin/troxy pretooluse-hook');
-    const cfg = read();
+    let cfg = patchClaudeCodeHooks({}, {}, 'troxy hook-report', 'npx troxy-cli pretooluse-hook');
+    cfg = patchClaudeCodeHooks(cfg, {}, 'troxy hook-report', '/usr/local/bin/troxy pretooluse-hook');
     assert.equal(cfg.hooks.PreToolUse.length, 1);
     assert.equal(cfg.hooks.PreToolUse[0].hooks[0].command, '/usr/local/bin/troxy pretooluse-hook');
   });
 
   it("preserves the user's own unrelated PreToolUse hooks in the same file", () => {
-    fs.writeFileSync(configPath(), JSON.stringify({
+    const initial = {
       hooks: { PreToolUse: [{ matcher: 'Write', hooks: [{ type: 'command', command: 'validate.sh' }] }] },
-    }));
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'troxy pretooluse-hook');
-    const cfg = read();
+    };
+    const cfg = patchClaudeCodeHooks(initial, {}, 'troxy hook-report', 'troxy pretooluse-hook');
     assert.equal(cfg.hooks.PreToolUse.length, 2);
     assert.ok(cfg.hooks.PreToolUse.some(e => e.hooks[0].command === 'validate.sh'));
     assert.ok(cfg.hooks.PreToolUse.some(e => e.hooks[0].command === 'troxy pretooluse-hook'));
   });
 
   it('registering PreToolUse never touches the Stop hook entry', () => {
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'troxy pretooluse-hook');
-    const cfg = read();
+    const cfg = patchClaudeCodeHooks({}, {}, 'troxy hook-report', 'troxy pretooluse-hook');
     assert.equal(cfg.hooks.Stop.length, 1);
     assert.equal(cfg.hooks.Stop[0].hooks[0].command, 'troxy hook-report');
   });
@@ -230,46 +235,39 @@ describe('patchClaudeCodeHooks: PreToolUse gate', () => {
 // to update in place - by command containing 'hook-report'/'pretooluse-hook'),
 // leaving any of the user's own unrelated hooks in the same file untouched.
 describe('unpatchClaudeCodeHooks', () => {
-  const configPath = () => path.join(dir, 'settings.json');
-  const read = () => JSON.parse(fs.readFileSync(configPath(), 'utf8'));
-
   it('removes the Troxy Stop and PreToolUse entries', () => {
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'troxy pretooluse-hook');
-    unpatchClaudeCodeHooks(configPath());
-    const cfg = read();
+    let cfg = patchClaudeCodeHooks({}, {}, 'troxy hook-report', 'troxy pretooluse-hook');
+    cfg = unpatchClaudeCodeHooks(cfg);
     assert.equal(cfg.hooks.Stop.length, 0);
     assert.equal(cfg.hooks.PreToolUse.length, 0);
   });
 
   it("preserves the user's own unrelated Stop and PreToolUse hooks in the same file", () => {
-    fs.writeFileSync(configPath(), JSON.stringify({
+    const initial = {
       hooks: {
         Stop: [{ hooks: [{ type: 'command', command: 'my-own-script.sh' }] }],
         PreToolUse: [{ matcher: 'Write', hooks: [{ type: 'command', command: 'validate.sh' }] }],
       },
-    }));
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'troxy pretooluse-hook');
-    unpatchClaudeCodeHooks(configPath());
-    const cfg = read();
+    };
+    let cfg = patchClaudeCodeHooks(initial, {}, 'troxy hook-report', 'troxy pretooluse-hook');
+    cfg = unpatchClaudeCodeHooks(cfg);
     assert.equal(cfg.hooks.Stop.length, 1);
     assert.equal(cfg.hooks.Stop[0].hooks[0].command, 'my-own-script.sh');
     assert.equal(cfg.hooks.PreToolUse.length, 1);
     assert.equal(cfg.hooks.PreToolUse[0].hooks[0].command, 'validate.sh');
   });
 
-  it('does not throw and does not create a file when called against a non-existent settings file', () => {
-    assert.doesNotThrow(() => unpatchClaudeCodeHooks(configPath()));
-    assert.equal(fs.existsSync(configPath()), false);
+  it('does not throw when called with an empty config object', () => {
+    assert.doesNotThrow(() => unpatchClaudeCodeHooks({}));
   });
 
-  it('does not throw when the existing file is corrupted JSON', () => {
-    fs.writeFileSync(configPath(), '{ not json');
-    assert.doesNotThrow(() => unpatchClaudeCodeHooks(configPath()));
+  it('does not throw when called with a config missing hooks', () => {
+    assert.doesNotThrow(() => unpatchClaudeCodeHooks({ other: 'data' }));
   });
 
   it('is idempotent - calling twice is safe', () => {
-    patchClaudeCodeHooks(configPath(), 'troxy hook-report', 'troxy pretooluse-hook');
-    unpatchClaudeCodeHooks(configPath());
-    assert.doesNotThrow(() => unpatchClaudeCodeHooks(configPath()));
+    let cfg = patchClaudeCodeHooks({}, {}, 'troxy hook-report', 'troxy pretooluse-hook');
+    cfg = unpatchClaudeCodeHooks(cfg);
+    assert.doesNotThrow(() => unpatchClaudeCodeHooks(cfg));
   });
 });

package/src/tests/e2e-sandbox-chain.test.js

@@ -0,0 +1,198 @@
+import { strict as assert } from 'assert';
+import { test } from 'node:test';
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
+import { handleRecall } from '../mcp-server.js';
+
+// Task 10 (final task of the tool-output-sandbox plan): one real, scripted,
+// end-to-end run of the whole chain - no mocks, no in-process shortcuts for
+// the parts that matter - proving all 9 prior tasks actually work together:
+//
+//   1. real `troxy init` (reprovisionKeyConsumers) writes a real
+//      ~/.claude/settings.json with a real PostToolUse hook command.
+//   2. that exact installed command, run as a real subprocess against a
+//      real >2000-char tool output, returns a compressed response with a
+//      real recall handle.
+//   3. handleRecall() (the real troxy_recall tool logic) returns the real,
+//      byte-for-byte original content for that handle.
+//   4. with the store directory made unwritable, the same real subprocess
+//      fails open: empty stdout, i.e. Claude Code keeps the real output.
+//
+// This mirrors src/tests/init-sandbox-hook.test.js's subprocess-isolation
+// pattern (mutating process.env.HOME in-process would leak across tests,
+// and reprovisionKeyConsumers touches real launchd state unless
+// TROXY_TEST_SKIP_SERVICE_INSTALL=1 short-circuits it before installService
+// is ever reached).
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.join(__dirname, '..', '..');
+const initJsPath = path.join(repoRoot, 'src', 'init.js');
+const binTroxyPath = path.join(repoRoot, 'bin', 'troxy.js');
+
+function buildBigOutput(label) {
+  const lines = [];
+  for (let i = 0; i < 100; i++) {
+    lines.push(`[${label}] line ${i}: some representative tool output padding text to reach length`);
+  }
+  return lines.join('\n');
+}
+
+// Real Bash tool_response shape, confirmed 2026-10-05 against this
+// machine's own ~/.claude/projects/*/*.jsonl transcripts - a prior version
+// of this test used an invented `{ tool_response: { output } }` shape that
+// no real tool result ever has, which is exactly how this e2e test passed
+// while the feature was a complete no-op in production.
+function bashResult(stdout) {
+  return { interrupted: false, isImage: false, noOutputExpected: false, stderr: '', stdout };
+}
+
+test('end-to-end: real init -> real hook subprocess -> real recall, and real fail-open', async () => {
+  const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-e2e-home-'));
+  const shimDir = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-e2e-shim-'));
+  try {
+    // --- Step 1: force Claude Desktop detection, exactly as
+    // init-sandbox-hook.test.js does, so reprovisionKeyConsumers takes the
+    // "patch Claude Code hooks" branch.
+    fs.mkdirSync(path.join(tmpHome, '.config', 'Claude'), { recursive: true });
+    const desktopConfigPath =
+      process.platform === 'darwin'
+        ? path.join(tmpHome, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json')
+        : path.join(tmpHome, '.config', 'claude', 'claude_desktop_config.json');
+    fs.mkdirSync(path.dirname(desktopConfigPath), { recursive: true });
+    fs.writeFileSync(desktopConfigPath, '{}');
+
+    // A `troxy` shim on PATH so troxyPostToolUseCommand()'s `which troxy`
+    // resolves to a real, directly-runnable command instead of falling back
+    // to `npx troxy-cli` (which would try to hit the network here). The
+    // shim just execs the real bin/troxy.js under the real node binary.
+    const shimPath = path.join(shimDir, 'troxy');
+    fs.writeFileSync(
+      shimPath,
+      `#!/bin/sh\nexec "${process.execPath}" "${binTroxyPath}" "$@"\n`,
+    );
+    fs.chmodSync(shimPath, 0o755);
+
+    const script = `
+      import { reprovisionKeyConsumers } from ${JSON.stringify('file://' + initJsPath)};
+      await reprovisionKeyConsumers('test-api-key-ci', 'claude-code', false, false);
+    `;
+    const scriptPath = path.join(tmpHome, 'run.mjs');
+    fs.writeFileSync(scriptPath, script);
+
+    execFileSync(process.execPath, [scriptPath], {
+      env: {
+        ...process.env,
+        HOME: tmpHome,
+        PATH: `${shimDir}:/usr/bin:/bin`,
+        TROXY_TEST_SKIP_SERVICE_INSTALL: '1',
+      },
+      encoding: 'utf8',
+    });
+
+    const settingsPath = path.join(tmpHome, '.claude', 'settings.json');
+    assert.ok(fs.existsSync(settingsPath), 'expected real init to write Claude Code settings.json');
+    const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+    const postEntries = settings.hooks?.PostToolUse;
+    assert.ok(Array.isArray(postEntries) && postEntries.length === 1, 'expected one real PostToolUse sandbox hook entry');
+    const hookCommand = postEntries[0].hooks[0].command;
+    assert.equal(hookCommand, `${shimPath} posttooluse-hook`, 'expected the installed command to be the real, directly-runnable shim');
+
+    // --- Step 2: feed a real >2000-char tool output through the real
+    // installed hook command, as a real subprocess, exactly as Claude Code
+    // would invoke it (`sh -c "<installed command>"` with the hook JSON on
+    // stdin). Default sandboxFraction=1 / holdoutFraction=0.2 with real
+    // Math.random means ~20% of runs land in the holdout bucket (by design,
+    // for measurement) and pass the output through unchanged - retry a
+    // bounded number of times rather than faking determinism.
+    const bigOutput = buildBigOutput('treated');
+    assert.ok(bigOutput.length > 2000, 'fixture output must exceed the sandbox threshold');
+    const hookInput = JSON.stringify({ tool_response: bashResult(bigOutput) });
+    const hookEnv = {
+      ...process.env,
+      HOME: tmpHome,
+      PATH: '/usr/bin:/bin',
+    };
+
+    let stdout = '';
+    let attempts = 0;
+    const MAX_ATTEMPTS = 20;
+    while (attempts < MAX_ATTEMPTS && stdout.trim() === '') {
+      attempts++;
+      stdout = execFileSync('sh', ['-c', hookCommand], {
+        input: hookInput,
+        env: hookEnv,
+        encoding: 'utf8',
+      });
+    }
+    console.log(`[e2e] hook subprocess produced a compressed response after ${attempts} attempt(s) (holdout draws retried)`);
+    assert.ok(stdout.trim() !== '', `expected a compressed response within ${MAX_ATTEMPTS} attempts (holdout is probabilistic, not broken)`);
+
+    const response = JSON.parse(stdout);
+    const updatedToolOutput = response?.hookSpecificOutput?.updatedToolOutput;
+    // Claude Code validates updatedToolOutput against the tool's own output
+    // schema and reverts to the original output (plus a visible hook-error
+    // message) if the shape doesn't match - so this must be the full real
+    // tool_response shape (stdout/stderr/interrupted/...), not a bare string.
+    assert.equal(typeof updatedToolOutput, 'object');
+    assert.equal(updatedToolOutput.stderr, ''); // untouched sibling field survived the round-trip
+    assert.ok(updatedToolOutput.stdout.length < bigOutput.length, 'expected the hook response to be compressed vs. the original output');
+    const handleMatch = updatedToolOutput.stdout.match(/troxy_recall\("([a-f0-9]{16})"\)/);
+    assert.ok(handleMatch, `expected a real recall handle in: ${updatedToolOutput.stdout}`);
+    const handle = handleMatch[1];
+    console.log(`[e2e] compressed response:\n${updatedToolOutput.stdout}`);
+
+    // --- Step 3: call the real troxy_recall tool logic with that handle and
+    // confirm it returns the real, original, byte-for-byte content. The
+    // subprocess above resolved its store dir from HOME=tmpHome via the
+    // real storeDir() default (os.homedir()/.troxy/sandbox).
+    const storeDirPath = path.join(tmpHome, '.troxy', 'sandbox');
+    const result = await handleRecall({ handle }, storeDirPath);
+    assert.equal(result.isError, false);
+    assert.equal(result.content[0].text, bigOutput, 'expected troxy_recall to return the exact original output');
+    console.log(`[e2e] troxy_recall("${handle}") returned the original ${bigOutput.length}-char output, byte-for-byte`);
+
+    // --- Step 4: fail-open. Make the store directory unwritable and
+    // confirm a large output still passes through unmodified (empty
+    // stdout - Claude Code keeps the real tool output as-is).
+    //
+    // Empty stdout alone doesn't prove fail-open: the same ~20% holdout
+    // draw from Step 2 also produces empty stdout, regardless of whether
+    // the store is writable. writeState() distinguishes the two - it
+    // overwrites the existing last-state.json file's content, which still
+    // succeeds under chmod 0o555 (only directory *entries* are protected,
+    // not writes to an already-existing file) - so last-state.json's
+    // `state` field reports which branch actually ran: 'holdout' means
+    // this draw didn't even attempt a write, 'skipped' means the write was
+    // attempted and failed, fail-open caught it. Retry while we keep
+    // landing on holdout draws, same bounded-retry spirit as Step 2.
+    const lastStatePath = path.join(storeDirPath, 'last-state.json');
+    fs.chmodSync(storeDirPath, 0o555);
+    try {
+      let state = 'holdout'; // force the loop to run at least once
+      let failOpenAttempts = 0;
+      let secondStdout = '';
+      while (failOpenAttempts < MAX_ATTEMPTS && state === 'holdout') {
+        failOpenAttempts++;
+        const secondOutput = buildBigOutput('failopen');
+        secondStdout = execFileSync('sh', ['-c', hookCommand], {
+          input: JSON.stringify({ tool_response: bashResult(secondOutput) }),
+          env: hookEnv,
+          encoding: 'utf8',
+        });
+        state = JSON.parse(fs.readFileSync(lastStatePath, 'utf8')).state;
+      }
+      console.log(`[e2e] fail-open subprocess landed on state="${state}" after ${failOpenAttempts} attempt(s) (holdout draws retried)`);
+      assert.equal(state, 'skipped', `expected a real write-failure (state="skipped"), not a coincidental holdout draw, within ${MAX_ATTEMPTS} attempts`);
+      assert.equal(secondStdout, '', 'expected empty stdout (fail-open: real output passed through unmodified) when the store dir is unwritable');
+      console.log('[e2e] fail-open confirmed: unwritable store dir -> write failed -> state="skipped" -> empty stdout -> real tool output left untouched');
+    } finally {
+      fs.chmodSync(storeDirPath, 0o755);
+    }
+  } finally {
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+    fs.rmSync(shimDir, { recursive: true, force: true });
+  }
+});

package/src/tests/init-sandbox-hook.test.js

@@ -0,0 +1,173 @@
+import { strict as assert } from 'assert';
+import { test, describe } from 'node:test';
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
+import {
+  patchClaudeCodeHooks,
+  unpatchClaudeCodeHooks,
+  troxyPostToolUseCommand,
+  _isTroxyPostToolUseEntry,
+} from '../init.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const initJsPath = path.join(__dirname, '..', 'init.js');
+
+describe('PostToolUse hook patching', () => {
+  test('troxyPostToolUseCommand() returns a command string containing posttooluse-hook', () => {
+    const cmd = troxyPostToolUseCommand();
+    assert.strictEqual(typeof cmd, 'string');
+    assert.match(cmd, /posttooluse-hook/);
+  });
+
+  test('_isTroxyPostToolUseEntry(entry) returns true for Troxy PostToolUse entries', () => {
+    const entry = {
+      matcher: '*',
+      hooks: [{ command: 'node /path/to/posttooluse-hook.js' }],
+    };
+    assert.strictEqual(_isTroxyPostToolUseEntry(entry), true);
+  });
+
+  test('_isTroxyPostToolUseEntry(entry) returns false for non-Troxy entries', () => {
+    const entry = {
+      matcher: '*',
+      hooks: [{ command: 'echo something' }],
+    };
+    assert.strictEqual(_isTroxyPostToolUseEntry(entry), false);
+  });
+
+  test('patchClaudeCodeHooks adds a PostToolUse entry by default, with no sandbox option at all', () => {
+    const config = { hooks: {} };
+    const patched = patchClaudeCodeHooks(config, {});
+    const entries = patched.hooks.PostToolUse;
+    assert.ok(Array.isArray(entries) && entries.length === 1);
+    assert.match(entries[0].hooks[0].command, /posttooluse-hook/);
+  });
+
+  test('patchClaudeCodeHooks adds a PostToolUse entry when sandbox option is not false', () => {
+    const config = { hooks: {} };
+    const patched = patchClaudeCodeHooks(config, { sandbox: true });
+    const entries = patched.hooks.PostToolUse;
+    assert.ok(Array.isArray(entries) && entries.length === 1);
+  });
+
+  test('patchClaudeCodeHooks still installs the PostToolUse entry even when called with { sandbox: false } - the hook is unconditional, not opt-out-able', () => {
+    const config = { hooks: {} };
+    const patched = patchClaudeCodeHooks(config, { sandbox: false });
+    const entries = patched.hooks.PostToolUse;
+    assert.ok(Array.isArray(entries) && entries.length === 1, 'sandbox hook must be installed regardless of any sandbox option');
+    assert.match(entries[0].hooks[0].command, /posttooluse-hook/);
+  });
+
+  test('patchClaudeCodeHooks is idempotent - patching twice does not duplicate PostToolUse entry', () => {
+    const config = { hooks: {} };
+    const patched1 = patchClaudeCodeHooks(config, {});
+    const patched2 = patchClaudeCodeHooks(patched1, {});
+    const entries = patched2.hooks.PostToolUse;
+    assert.strictEqual(entries.length, 1);
+  });
+
+  test('patchClaudeCodeHooks still handles PreToolUse entries as before', () => {
+    const config = { hooks: {} };
+    const patched = patchClaudeCodeHooks(config, {});
+    const preEntries = patched.hooks.PreToolUse;
+    assert.ok(Array.isArray(preEntries) && preEntries.length > 0);
+  });
+
+  test('unpatchClaudeCodeHooks removes PostToolUse entry, leaving other entries untouched', () => {
+    const config = { hooks: {} };
+    const patched = patchClaudeCodeHooks(config, {});
+    const unpatched = unpatchClaudeCodeHooks(patched);
+    const postEntries = unpatched.hooks.PostToolUse;
+    assert.ok(Array.isArray(postEntries) && postEntries.length === 0);
+  });
+
+  test('unpatchClaudeCodeHooks preserves non-Troxy PostToolUse hooks', () => {
+    const config = {
+      hooks: {
+        PostToolUse: [
+          {
+            matcher: '*',
+            hooks: [{ command: 'echo other' }],
+          },
+        ],
+      },
+    };
+    const unpatched = unpatchClaudeCodeHooks(config);
+    const entries = unpatched.hooks.PostToolUse;
+    assert.ok(Array.isArray(entries) && entries.length === 1);
+    assert.strictEqual(entries[0].hooks[0].command, 'echo other');
+  });
+
+  test('reprovisionKeyConsumers wires the PostToolUse sandbox hook into a real Claude Code settings file, with the hook always installed (no --no-sandbox escape hatch exists anymore)', () => {
+    // Runs the REAL reprovisionKeyConsumers (not a mock) in a subprocess with
+    // Claude Desktop detection forced true via HOME, so this exercises the
+    // exact call chain runInit -> reprovisionKeyConsumers ->
+    // _patchClaudeCodeHooksFile(claudeCodeSettingsPath()).
+    //
+    // Runs as a subprocess, not in-process, for two reasons: (1) mutating
+    // process.env.HOME in-process would leak into other tests sharing this
+    // process, and (2) reprovisionKeyConsumers unconditionally calls
+    // installService(). installService has a hardcoded fallback
+    // (fs.existsSync('/usr/local/bin/troxy')) that a restricted PATH does
+    // NOT protect against - on a machine where that file happens to exist,
+    // a PATH-only guard would let installService run for real and issue
+    // `execSync('launchctl bootout/bootstrap ...')` against the host's
+    // actual logged-in launchd GUI domain, capable of disrupting a real
+    // running ai.troxy.mcp service. So this test does not rely on PATH (or
+    // on installService throwing) for safety at all: it sets
+    // TROXY_TEST_SKIP_SERVICE_INSTALL=1, which reprovisionKeyConsumers
+    // checks BEFORE ever calling installService (see init.js, the
+    // "Setting up background service..." block) - installService is never
+    // invoked, so verifyTroxyBinExists and the launchctl execSync calls are
+    // unreachable regardless of what exists on the host filesystem.
+    const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'troxy-home-'));
+    try {
+      // Force hasClaudeDesktop() true (checks a fixed ~/.config/Claude path
+      // regardless of real platform) and give detectMcpClients() a Claude
+      // Desktop config to find, so reprovisionKeyConsumers takes the
+      // "patch Claude Code hooks" branch instead of the no-clients-detected
+      // one.
+      fs.mkdirSync(path.join(tmpHome, '.config', 'Claude'), { recursive: true });
+      const desktopConfigPath =
+        process.platform === 'darwin'
+          ? path.join(tmpHome, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json')
+          : path.join(tmpHome, '.config', 'claude', 'claude_desktop_config.json');
+      fs.mkdirSync(path.dirname(desktopConfigPath), { recursive: true });
+      fs.writeFileSync(desktopConfigPath, '{}');
+
+      const script = `
+        import { reprovisionKeyConsumers } from ${JSON.stringify('file://' + initJsPath)};
+        await reprovisionKeyConsumers('test-api-key-ci', 'claude-code', false, false);
+      `;
+      const scriptPath = path.join(tmpHome, 'run.mjs');
+      fs.writeFileSync(scriptPath, script);
+
+      execFileSync(process.execPath, [scriptPath], {
+        env: {
+          ...process.env,
+          HOME: tmpHome,
+          PATH: '/usr/bin:/bin',
+          TROXY_TEST_SKIP_SERVICE_INSTALL: '1',
+        },
+        encoding: 'utf8',
+      });
+
+      const settingsPath = path.join(tmpHome, '.claude', 'settings.json');
+      assert.ok(fs.existsSync(settingsPath), 'expected reprovisionKeyConsumers to write Claude Code settings.json');
+      const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+      const postEntries = settings.hooks?.PostToolUse;
+      assert.ok(Array.isArray(postEntries) && postEntries.length === 1, 'expected a PostToolUse sandbox hook entry');
+      assert.match(postEntries[0].hooks[0].command, /posttooluse-hook/);
+      // Pre-existing hook wiring (Finding 1's blast radius) must still work too.
+      const preEntries = settings.hooks?.PreToolUse;
+      assert.ok(Array.isArray(preEntries) && preEntries.length > 0, 'expected the existing PreToolUse hook to still be installed');
+      const stopEntries = settings.hooks?.Stop;
+      assert.ok(Array.isArray(stopEntries) && stopEntries.length > 0, 'expected the existing Stop hook to still be installed');
+    } finally {
+      fs.rmSync(tmpHome, { recursive: true, force: true });
+    }
+  });
+});