Add ShellSpec harness and coverage

config/claude/security.sh

@@ -37,8 +37,10 @@ matches_pattern() {
   # Extract pattern from Bash(...) format
   if [[ $pattern =~ ^Bash\((.+)\)$ ]]; then
     local check_pattern="${BASH_REMATCH[1]}"
-    # Remove trailing :* if present (legacy format)
-    check_pattern="${check_pattern%:*}"
+    # Convert legacy trailing :* into a prefix glob (e.g. sudo:* -> sudo*)
+    if [[ $check_pattern == *':*' ]]; then
+      check_pattern="${check_pattern%:*}*"
+    fi
 
     # Use bash glob matching (extended globbing)
     shopt -s extglob
@@ -53,8 +55,7 @@ matches_pattern() {
 
 # Split command at logical operators to catch hidden dangerous commands
 # This handles: cmd1 ; cmd2, cmd1 && cmd2, cmd1 || cmd2, cmd1 | cmd2
-# shellcheck disable=SC2001
-IFS=$'\n' read -r -d '' -a segments < <(echo "$command" | sed 's/[;&|]\+/\n/g' && printf '\0') || true
+IFS=$'\n' read -r -d '' -a segments < <(echo "$command" | sed -E 's/[;&|]+/\n/g' && printf '\0') || true
 
 for segment in "${segments[@]}"; do
   # Trim leading/trailing whitespace

spec/notify_spec.sh

@@ -20,18 +20,14 @@ End
 
 Describe 'Notification hook (no Pushover)'
 setup() {
-  # Create mock osascript that does nothing
-  MOCK_BIN=$(mktemp -d)
-  printf '#!/bin/sh\nexit 0\n' >"$MOCK_BIN/osascript"
-  chmod +x "$MOCK_BIN/osascript"
-  export PATH="$MOCK_BIN:$PATH"
+  mock_bin_setup osascript
 
   # Unset Pushover credentials to ensure clean test environment
   unset PUSHOVER_API_TOKEN
   unset PUSHOVER_USER_KEY
 }
 cleanup() {
-  rm -rf "$MOCK_BIN"
+  mock_bin_cleanup
 }
 Before 'setup'
 After 'cleanup'
@@ -47,22 +43,25 @@ It 'exits 0 for waiting notification'
 When run bash -c 'echo "{\"message\": \"Claude is waiting for your input\"}" | env HOME=/nonexistent bash '"$SCRIPT"
 The status should be success
 End
+
+It 'sends Basso notification for permission request'
+When run bash -c 'echo "{\"message\": \"Claude needs your permission to use Bash\"}" | env HOME=/nonexistent bash '"$SCRIPT"'; cat "$MOCK_LOG"'
+The status should be success
+The output should include 'Bash permission required'
+The output should include 'sound name "Basso"'
+End
 End
 
 Describe 'SessionEnd hook (no Pushover)'
 setup() {
-  # Create mock osascript that does nothing
-  MOCK_BIN=$(mktemp -d)
-  printf '#!/bin/sh\nexit 0\n' >"$MOCK_BIN/osascript"
-  chmod +x "$MOCK_BIN/osascript"
-  export PATH="$MOCK_BIN:$PATH"
+  mock_bin_setup osascript
 
   # Unset Pushover credentials to ensure clean test environment
   unset PUSHOVER_API_TOKEN
   unset PUSHOVER_USER_KEY
 }
 cleanup() {
-  rm -rf "$MOCK_BIN"
+  mock_bin_cleanup
 }
 Before 'setup'
 After 'cleanup'
@@ -73,4 +72,45 @@ When run bash -c 'echo "{\"reason\": \"user_exit\"}" | env HOME=/nonexistent bas
 The status should be success
 End
 End
+
+Describe 'other hooks (no Pushover)'
+setup() {
+  mock_bin_setup osascript
+  TEMP_HOME=$(mktemp -d)
+
+  unset PUSHOVER_API_TOKEN
+  unset PUSHOVER_USER_KEY
+}
+cleanup() {
+  rm -rf "$TEMP_HOME"
+  mock_bin_cleanup
+}
+Before 'setup'
+After 'cleanup'
+
+It 'notifies on PreCompact auto trigger'
+When run bash -c 'echo "{\"trigger\": \"auto\"}" | env HOME=/nonexistent bash '"$SCRIPT"'; cat "$MOCK_LOG"'
+The status should be success
+The output should include 'Auto-compacting context'
+End
+
+It 'notifies on SubagentStop'
+When run bash -c 'echo "{\"stop_hook_active\": true}" | env HOME=/nonexistent bash '"$SCRIPT"'; cat "$MOCK_LOG"'
+The status should be success
+The output should include 'Subagent task completed'
+End
+
+It 'notifies on Stop with cwd and session id'
+When run bash -c 'echo "{\"cwd\": \"'"$TEMP_HOME"'/work\", \"session_id\": \"abcdef0123456789\"}" | env HOME="'"$TEMP_HOME"'" bash '"$SCRIPT"'; cat "$MOCK_LOG"'
+The status should be success
+The output should include 'Work completed in ~/work (abcdef01)'
+End
+
+It 'warns on risky PreToolUse Bash command'
+When run bash -c 'echo "{\"tool\": {\"name\": \"Bash\", \"input\": \"rm -rf /\"}}" | env HOME=/nonexistent bash '"$SCRIPT"'; cat "$MOCK_LOG"'
+The status should be success
+The output should include 'Risky: rm -rf /'
+The output should include 'sound name "Basso"'
+End
+End
 End

spec/pushover_spec.sh

@@ -6,18 +6,14 @@ SCRIPT="$PWD/config/claude/pushover.sh"
 
 Describe 'credential handling'
 setup() {
-  # Create a mock curl in case credentials leak through
-  MOCK_BIN=$(mktemp -d)
-  printf '#!/bin/sh\nexit 0\n' >"$MOCK_BIN/curl"
-  chmod +x "$MOCK_BIN/curl"
-  export PATH="$MOCK_BIN:$PATH"
+  mock_bin_setup curl
 
   # Unset credentials to ensure clean test environment
   unset PUSHOVER_API_TOKEN
   unset PUSHOVER_USER_KEY
 }
 cleanup() {
-  rm -rf "$MOCK_BIN"
+  mock_bin_cleanup
 }
 Before 'setup'
 After 'cleanup'
@@ -32,60 +28,106 @@ End
 
 Describe 'SessionEnd hook'
 setup() {
-  # Create a mock curl that does nothing
-  MOCK_BIN=$(mktemp -d)
-  printf '#!/bin/sh\nexit 0\n' >"$MOCK_BIN/curl"
-  chmod +x "$MOCK_BIN/curl"
-  export PATH="$MOCK_BIN:$PATH"
+  mock_bin_setup curl
 
   # Set test credentials
   export PUSHOVER_API_TOKEN="test_token"
   export PUSHOVER_USER_KEY="test_user"
 }
 cleanup() {
-  rm -rf "$MOCK_BIN"
+  mock_bin_cleanup
 }
 Before 'setup'
 After 'cleanup'
 
 It 'skips notification for "other" reason'
-When run bash -c 'echo "{\"reason\": \"other\"}" | bash '"$SCRIPT"
+When run bash -c 'echo "{\"reason\": \"other\"}" | bash '"$SCRIPT"'; cat "$MOCK_LOG"'
 The status should be success
 The output should eq ''
 End
 
 It 'processes notification for "user_exit" reason'
-When run bash -c 'echo "{\"reason\": \"user_exit\"}" | bash '"$SCRIPT"
+When run bash -c 'echo "{\"reason\": \"user_exit\"}" | bash '"$SCRIPT"'; cat "$MOCK_LOG"'
 The status should be success
+The output should include 'priority=0'
+The output should include 'https://api.pushover.net/1/messages.json'
 End
 End
 
 Describe 'Notification hook'
 setup() {
-  # Create a mock curl that does nothing
-  MOCK_BIN=$(mktemp -d)
-  printf '#!/bin/sh\nexit 0\n' >"$MOCK_BIN/curl"
-  chmod +x "$MOCK_BIN/curl"
-  export PATH="$MOCK_BIN:$PATH"
+  mock_bin_setup curl
 
   # Set test credentials
   export PUSHOVER_API_TOKEN="test_token"
   export PUSHOVER_USER_KEY="test_user"
 }
 cleanup() {
-  rm -rf "$MOCK_BIN"
+  mock_bin_cleanup
 }
 Before 'setup'
 After 'cleanup'
 
 It 'skips login notification'
-When run bash -c 'echo "{\"message\": \"Claude Code login successful\"}" | bash '"$SCRIPT"
+When run bash -c 'echo "{\"message\": \"Claude Code login successful\"}" | bash '"$SCRIPT"'; cat "$MOCK_LOG"'
 The status should be success
+The output should eq ''
 End
 
 It 'processes waiting notification'
-When run bash -c 'echo "{\"message\": \"Claude is waiting for your input\"}" | bash '"$SCRIPT"
+When run bash -c 'echo "{\"message\": \"Claude is waiting for your input\", \"cwd\": \"/tmp\"}" | bash '"$SCRIPT"'; cat "$MOCK_LOG"'
+The status should be success
+The output should include 'priority=1'
+The output should include 'Waiting'
+End
+
+It 'processes permission notification at high priority'
+When run bash -c 'echo "{\"message\": \"Claude needs your permission to use Bash\", \"cwd\": \"/tmp\"}" | bash '"$SCRIPT"'; cat "$MOCK_LOG"'
+The status should be success
+The output should include 'priority=1'
+The output should include 'Permission required'
+End
+End
+
+Describe 'Stop hook'
+setup() {
+  mock_bin_setup curl
+
+  export PUSHOVER_API_TOKEN="test_token"
+  export PUSHOVER_USER_KEY="test_user"
+
+  TRANSCRIPT=$(mktemp)
+}
+cleanup() {
+  rm -f "$TRANSCRIPT"
+  mock_bin_cleanup
+}
+Before 'setup'
+After 'cleanup'
+
+It 'notifies plan ready for approval (plan mode + ExitPlanMode + no files)'
+cat >"$TRANSCRIPT" <<'JSON'
+{"type":"user","message":{"content":[{"type":"text","text":"Do the thing"}]}}
+{"cwd":"/tmp/project"}
+{"type":"assistant","message":{"content":[{"type":"tool_use","name":"ExitPlanMode"}]}}
+JSON
+When run bash -c 'echo "{\"hook_event_name\": \"Stop\", \"transcript_path\": \"'"$TRANSCRIPT"'\", \"permission_mode\": \"plan\"}" | bash '"$SCRIPT"'; cat "$MOCK_LOG"'
+The status should be success
+The output should include 'Plan ready for approval'
+The output should include 'priority=1'
+End
+
+It 'notifies work completed when files were modified'
+cat >"$TRANSCRIPT" <<'JSON'
+{"type":"user","message":{"content":[{"type":"text","text":"Update config"}]}}
+{"cwd":"/tmp/project"}
+{"type":"tool_use","tool_use":{"name":"Write","input":{"file_path":"config/foo"}}}
+{"type":"assistant","message":{"content":[{"type":"tool_use","name":"Bash"}]}}
+JSON
+When run bash -c 'echo "{\"hook_event_name\": \"Stop\", \"transcript_path\": \"'"$TRANSCRIPT"'\", \"permission_mode\": \"plan\"}" | bash '"$SCRIPT"'; cat "$MOCK_LOG"'
 The status should be success
+The output should include 'Work completed'
+The output should include 'priority=0'
 End
 End
 End

spec/security_spec.sh

@@ -77,6 +77,20 @@ When run bash -c "HOME='$TEMP_HOME' bash '$SCRIPT'"
 The status should eq 2
 The stderr should include 'BLOCKED'
 End
+
+It 'blocks sudo with arguments (legacy sudo:* pattern)'
+Data '{"tool": {"name": "Bash", "input": {"command": "sudo rm -rf /"}}}'
+When run bash -c "HOME='$TEMP_HOME' bash '$SCRIPT'"
+The status should eq 2
+The stderr should include 'BLOCKED'
+End
+
+It 'blocks hidden dangerous command after semicolon'
+Data '{"tool": {"name": "Bash", "input": {"command": "echo ok; rm -rf /*"}}}'
+When run bash -c "HOME='$TEMP_HOME' bash '$SCRIPT'"
+The status should eq 2
+The stderr should include 'BLOCKED'
+End
 End
 
 Describe 'edge cases'

spec/support/custom_matcher.sh

@@ -1 +1,35 @@
 #!/usr/bin/env bash
+
+set -euo pipefail
+
+mock_bin_setup() {
+  MOCK_BIN="$(mktemp -d)"
+  MOCK_LOG="$MOCK_BIN/mock.log"
+  : >"$MOCK_LOG"
+
+  MOCK_ORIGINAL_PATH="${PATH:-}"
+  export MOCK_BIN MOCK_LOG MOCK_ORIGINAL_PATH
+  export PATH="$MOCK_BIN:$MOCK_ORIGINAL_PATH"
+
+  local cmd
+  for cmd in "$@"; do
+    cat >"$MOCK_BIN/$cmd" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+: "${MOCK_LOG:?MOCK_LOG must be set}"
+printf '%s\n' "$0 $*" >>"$MOCK_LOG"
+exit 0
+EOF
+    chmod +x "$MOCK_BIN/$cmd"
+  done
+}
+
+mock_bin_cleanup() {
+  if [[ -n "${MOCK_ORIGINAL_PATH:-}" ]]; then
+    export PATH="$MOCK_ORIGINAL_PATH"
+  fi
+  if [[ -n "${MOCK_BIN:-}" ]]; then
+    rm -rf "$MOCK_BIN"
+  fi
+  unset MOCK_BIN MOCK_LOG MOCK_ORIGINAL_PATH
+}