chore(hooks): give nobody test runs the .nvmrc node and drop an unreadable CA bundle

[aliasunder]

What does this PR do?

The root-test hook stops a test run in a root session and replies with a setpriv prefix that reruns it as nobody. In Claude Code's cloud containers, that prefix gave a run CI does not:

Problem	Effect
nobody's node is the container's own (v22), not the major version .nvmrc names and CI runs (24). nvm installs the right one under root's home, which nobody cannot enter.	server-error-contracts.test.ts run alone on main: 26 failed with RegExp.escape is not a function.
The container sets NODE_EXTRA_CA_CERTS to a file under root's home.	Every node that nobody starts prints "Ignoring extra certs … Permission denied" on stderr, so the two exact-stderr tests in render-social-preview.test.ts fail.

The prefix now matches CI in both respects:

• Node. When nobody's node has another major version than .nvmrc names, and root has a node of that major, the hook copies it to node_modules/.nobody-node/node-<version>/node and puts that folder first on PATH in the prefix.
  • Where the node comes from: the hook's own node (the binary it runs from, process.execPath, so a version-manager shim is never copied). Otherwise it takes the newest node of that major under $NVM_DIR, then ~/.nvm, matching the version only in nvm's own version folders. Claude Code starts hooks with its own PATH, not the session's, so in a cloud container the hook's node is usually the container's.
  • The copy: the folder and binary belong to root with mode 755, so nobody can run the copy but not replace it. The hook writes to a temp name and moves it into place, so a later run never reuses a partial copy, and it reuses a whole one.
  • What runs it: npx, npm exec and tsx look node up on PATH, and the integration harness starts servers with process.execPath, so all of them run the copy.
  • How the hook checks nobody's node: it runs /usr/bin/env node. setpriv keeps root's capabilities until it starts its command, so setpriv … node would find root's nvm node instead of the one nobody's run uses.
  • When no node of that major exists: the hook gives the old prefix and the old version warning.
• CA bundle. When NODE_EXTRA_CA_CERTS is set and nobody cannot read the file, the prefix adds -u NODE_EXTRA_CA_CERTS. The suites this prefix runs make no network calls. A file nobody can read stays set.
• Prefix form. The prefix names /usr/bin/env in full for the same reason the check does. It also quotes "$PATH", so a session PATH with a space in a folder name stays one argument.
• Runs the hook now stops. Main let each of these through as root. The first three matter because a run that keeps the reply's prefix but drops setpriv would otherwise go through:
  • a run through env, time, timeout, bash, sh or zsh named by path, such as /usr/bin/env HOME=… npm test;
  • env's -u NAME, also at the end of a group of flags (env -iu NAME npm test), and a setting that mixes quoted and unquoted text (PATH=/copy:"$PATH");
  • a setting with a backslash-escaped space, which is how the prefix writes a checkout path that holds a space (HOME=/my\ repo/…);
  • env's -C/--chdir and the folder it takes.

A reply in a cloud container now reads:

  setpriv --reuid=65534 --regid=65534 --clear-groups /usr/bin/env -u NODE_EXTRA_CA_CERTS HOME=/home/user/vault-cortex/node_modules/.nobody-home PATH=/home/user/vault-cortex/node_modules/.nobody-node/node-v24.21.0:"$PATH"
The folders nobody needs to write in /home/user/vault-cortex are ready.
nobody's own node is v22.22.0, so the prefix runs a copy of node v24.21.0, whose major version .nvmrc names and CI runs.

A session that is not root still exits at the hook's first check, so nothing changes on a developer machine.

Failure paths.

• If the nvm search cannot read a folder or meets a symlink loop, the hook keeps the nodes it could reach, and it still stops the run (exit 2).
• If the copy itself fails, for example on a full disk, the hook removes its temp file and exits 1, as any failing step in this hook does. Claude Code treats exit 1 as a non-blocking error, so that run goes through as root.

Not covered. Runs through sudo, nice, nohup or env -S '…' still go through as root, as on main.

Type of change

• New MCP tool
• Bug fix
• Refactoring
• Documentation
• CI / workflow change
• Infrastructure (SST, Docker)
• Other: Claude Code session hook (.claude/hooks/require-nonroot-tests.sh)

Checklist

• The pre-commit hook passed: typecheck, knip, and ESLint, Prettier, markdownlint and ShellCheck on the staged files
• npm test passes
• npm run build succeeds (no source the build compiles changed)
• New MCP tools follow the naming and description conventions in AGENTS.md (no tool changes)
• README or ARCHITECTURE.md updated (if user-facing behavior changed): no user-facing change. AGENTS.md's line for the hook now says the prefix runs a copy of root's Node of the .nvmrc major, if root has one

Tests

require-nonroot-tests.test.ts has 159 tests, up from 130 on main.

• Stubs.
  • A node stub answers the version and binary-path questions the hook asks of its own node, and hands every other call (the payload parse) to the real node.
  • The setpriv stub now models setpriv's own PATH search. A bare command name resolves on the hook's PATH; a command given by path searches nobody's PATH.
  • A cp stub cuts a copy short.
• New cases.
  • The copy is made, reused, and replaced after a cut-short copy.
  • The newest node is chosen, $NVM_DIR is searched before ~/.nvm, and ~/.nvm is used when $NVM_DIR has none.
  • A symlinked versions/node is followed, and a folder find cannot read is survived.
  • A /v24.x/ in the nvm folder's own path does not count as a match.
  • A full version in .nvmrc (v24.1.0) is honoured.
  • The hook copies the node binary rather than a shim.
  • The copy and its folders get mode 755 under umask 077.
  • The copy's folder is quoted when the checkout path holds a space, and the copy folder is never handed to nobody.
  • NODE_EXTRA_CA_CERTS is dropped or kept as described above.
  • Each run listed under "Runs the hook now stops" is stopped. A setting whose value ends in an escaped space (A=a\ npm test, which runs test) goes through.
• Mutation checks. 17 mutations from the test audit, plus 9 from later fixes. Each failed its intended test. They include reverting the /usr/bin/env check, which fails 9 tests.

Review

Ship-check phases 1–5 ran on this branch, plus delta reviews of every commit after them. Every finding was fixed on the branch:

• PR review:
  • checking nobody's node through /usr/bin/env;
  • making the copy atomic;
  • moving the copy out of nobody's HOME into a root-owned folder.
• Code quality: 30 readability fixes from a fresh-eyes read, with names, comments and a named condition. No behaviour change apart from one reply wording.
• Test audit: the stubs and cases above.
• Bug check:
  • quoting "$PATH";
  • copying process.execPath instead of a possible shim;
  • removing the temp file when the copy fails;
  • following symlinked nvm folders;
  • qualifying the AGENTS.md line.
• After the review bot:
  • keeping a failing find from ending the hook;
  • naming /usr/bin/env in the prefix;
  • listing the node stub in the test file's header.
• Delta reviews:
  • stopping runs through a command named by path;
  • anchoring the nvm search to nvm's version folders;
  • a comment naming the symlink loop;
  • stopping the full prefix without setpriv (env's -u, mixed quoting), and quieting the nvm search's cd;
  • stopping the prefix with an escaped space, and env's -C and grouped -u.

Live Test Results

Run in a Claude Code cloud container: a root session, nobody on node v22.22.0, nvm node v24.21.0 under /root/.nvm, and NODE_EXTRA_CA_CERTS=/root/.ccr/ca-bundle.crt. Both full-suite rows ran in the same checkout at e8ca7dd; only the prefix differs.

Probe	Before (main)	This branch
Hook reply to npx vitest run src/utils as root	prefix env HOME=…/.nobody-home, plus "nobody's node is v22.22.0, not the 24 that .nvmrc names"	the prefix and lines shown above
server-error-contracts.test.ts with the hook's prefix	26 failed (RegExp.escape is not a function)	passes
render-social-preview.test.ts with a Node 24 prefix that keeps NODE_EXTRA_CA_CERTS	2 failed (CA warning on stderr)	passes
Full suite with the hook's exact prefix	7 files failed: 39 failed, 5,404 passed, 1 skipped	117 files passed: 5,443 passed, 1 skipped, 0 failed
Leaked integration servers after that run (control)	0	0
The real hook on /usr/bin/env HOME=… npm test as root (at 231b599)	exit 0, the run goes through as root	exit 2, stopped with the reply

The bug check also exercised the hook live:

• Six concurrent runs left one whole copy.
• The first copy took about 0.15 s, well inside the hook's 10 s limit.
• The .nvmrc forms v24, 24.1.0 and CRLF 24 get a copy. lts/* and an empty file get none.
• A PATH holding a folder with a space works.

No test deploy was run: .dockerignore excludes .claude and **/__tests__/, and the Dockerfile does not copy AGENTS.md, so the image built from this branch has the same contents as main's.

🤖 Generated with Claude Code

[umm-actually]

Update the test header's stub list for the new node stub
Low severity · conventions · medium confidence

src/__tests__/require-nonroot-tests.test.ts:22 — beyond the diff's line ranges, in code the changes touch or depend on.

The header still says the hook runs 'with real node' and lists only id, setpriv and chown as stubs, but this PR adds a node stub first on PATH that intercepts the hook's node --version (delegating other calls to the real node). A reader trusting the header would assume every node call reaches the real binary.

Failure scenario: A contributor adds a hook-behavior test assuming the hook's node --version hits the real node; it silently gets the stubbed version instead, so the test passes or fails for the wrong reason.

Suggested fix

Reword the header to list the node stub and state that only `--version` is stubbed, with other calls handed to the real node.

---

umm-actually · z-ai/glm-5.3-flash

[umm-actually]

umm-actually re-reviewed at 5707820

3 new finding(s) posted (16 tracked finding(s) across all runs).

---

umm-actually · deepseek/deepseek-v4.1-flash, z-ai/glm-5.3-flash

[aliasunder]

Replying to umm-actually's PR-level finding "Update the test header's stub list for the new node stub" (comment 6113553059): fixed in 203b1df. The header of require-nonroot-tests.test.ts now lists the node stub alongside id, setpriv and chown. It also says the stub answers only the version and binary-path questions the hook asks of its own node, and hands every other call, such as the payload parse, to the real node.

---

🔍 ship-check · pr-monitor · claude-opus-5-5

---

Generated by Claude Code

[umm-actually]

Resolve cd targets with escaped spaces to the real directory
Low severity · subtle bugs · high confidence

.claude/hooks/require-nonroot-tests.sh:184 — beyond the diff's line ranges, in code the changes touch or depend on.

Pre-existing: an unquoted cd target is read only up to the first space, so the backslash-escaped spelling (cd /my; repo && npm test) resolves to the truncated folder /my; instead of the real one — the same spelling the reply's own prefix emits for a spaced checkout and that the variable-setting pattern was just extended to match. The run is still stopped, but the prepared folders and node copy land in the wrong checkout, and when the session's cwd is in no checkout both git lookups fail and the hook exits 0, letting the run through as root. The quoted form (cd ;/my repo;) is handled correctly, so only the escaped spelling is the gap.

Failure scenario: Root session with cwd outside any checkout (e.g. /root) and the command cd /spaced; repo && npm test, where /spaced repo is a checkout with node_modules: the walk resolves the cd target to /spaced;, both git rev-parse lookups fail, and the hook exits 0 — the suite runs as root. With the session's cwd inside a checkout, the same command stops the run but prepares that checkout's folders and offers a prefix whose HOME and PATH point there, so the rerun as nobody fails en masse with EACCES creating /spaced repo/node_modules/.vite-temp.

Suggested fix

Extend the two cd path atoms with the same escaped-character alternative the variable-setting grammar uses (e.g. (/([^[:space:]'\"\\\\]|\\\\.)*) and the relative equivalent) and strip the escaping backslashes before use (current_dir=${BASH_REMATCH[2]//\\/}) so git -C receives the real path; add a stop-case for `cd /spaced\\ repo && npm test` whose cwd is outside any checkout.

---

umm-actually · z-ai/glm-5.3-flash

[aliasunder]

Re: Resolve cd targets with escaped spaces to the real directory: fixed in 592cca1. I reproduced it: cd /path/sp\ ace && npm test from a folder in no checkout exited 0, while the quoted cd '/path/sp ace' exited 2.

• Both unquoted cd patterns now take a backslash-escaped character.
• The walk drops the backslash, as the shell does, before handing the path to git -C.

Two new tests cover an absolute and a relative escaped path, each run from a folder in no checkout. They fail when the pattern is reverted, and also when only the unescape is removed.

---

Generated by Claude Code

[aliasunder]

Closing unmerged. The root-test hook decides whether a Bash command runs vitest by reading the command text with regular expressions, and every review round found more shell forms it misreads in both directions. Instead, a follow-up PR replaces the hook with a check inside vitest itself, which runs only when vitest actually starts as root. That PR removes the hook, so this one's fixes to it won't be needed.

---

Generated by Claude Code

[umm-actually]

Treat <<< as a here-string, not a heredoc, in the command masker
Low severity · subtle bugs · high confidence

The new masker's HEREDOC_OPERATOR matches << without checking for a third <, so a here-string like grep x <<< 'nothing' is parsed as a heredoc whose delimiter is the quoted text; at the next newline the body reader then swallows every following line searching for the never-appearing delimiter. A test run on a later line is thereby dropped from the masker's output, changing the outcome from main's stop to a silent run as root. The same <<< blind spot also leaves a here-string fed to a shell (bash <<< 'npm test') unrecognized by the wrapper patterns.

Failure scenario: In a root cloud session the command grep -q x <<< 'nothing' followed by npm test on the next line: the masker consumes << 'nothing' as a heredoc operator, readHeredocBodies then drops the npm test line while searching for the delimiter 'nothing', the walk sees no run, and the hook exits 0 so vitest runs as root — on main the same command was stopped.

Suggested fix

Make HEREDOC_OPERATOR require that the `<<` is not part of `<<<` (e.g. check command[index+2] !== "<" before accepting the match, or add a negative check on the preceding character), and add a stop-case whose command is a here-string line followed by `npm test` on the next line.

---

umm-actually · z-ai/glm-5.3-flash

[umm-actually]

Stop test runs through eval like the other command wrappers
Low severity · correctness · high confidence

Pre-existing: the wrapper list covers env, time, exec, command, timeout and the shells, but not eval, so an eval'd test run is never recognized and the hook exits 0. exec and command are handled as sibling builtins that run a command, so eval is the asymmetry in the same family.

Failure scenario: In a root cloud session the command eval 'npm test' (or eval npm test): eval is not a wrapper, so no command_prefix matches, test_run fails, the hook exits 0 with no reply, and vitest runs as root with the root-only permission-test failures the hook exists to prevent.

Suggested fix

Add `eval` to the wrapper alternation with no flags (eval takes none), i.e. `|eval` beside `exec|command`, and add a stop-case for `eval 'npm test'`.

---

umm-actually · z-ai/glm-5.3-flash

[umm-actually]

Add a test for the heredoc reader's tab-stripping branch
Low severity · tests · high confidence

The new stripsTabs branch of readHeredocBodies (for <<- heredocs) has no test: every heredoc case in the stop and pass tables uses << or <<'EOF'. If the branch regresses, a tab-indented terminator never matches its delimiter and the reader consumes the rest of the command into the blanked body, so any test run after the heredoc is silently let through with no failing test.

Failure scenario: A regression flips stripsTabs (e.g. tabsFlag === false for <<-): for cat <<-EOF newline notes newline «tab»EOF newline npm test, the delimiter line «tab»EOF never equals EOF, readHeredocBodies swallows every remaining line including npm test, the hook exits 0, and the suite runs as root — no existing test fails because none exercises <<-.

Suggested fix

Add a stop case `cat <<-EOF` newline `notes` newline tab-`EOF` newline `npm test` (expected: the exact refusal) and, if the tab-indented body of a bash heredoc matters, a matching pass/stop pair — the delimiter-line handling under <<- is currently unexercised by all 159 tests.

---

umm-actually · z-ai/glm-5.3-flash