---

date: 2026-06-09 tags: [hooks, testing, claude-code, footgun] status: active graduated_to:

Testing a hook that cds to $CLAUDE_PROJECT_DIR from a fixture silently scans the real repo

Symptom — testing gate.sh from a /tmp fixture (cd /tmp/fix; echo payload | bash gate.sh) returned "allow" where "deny" was expected — it looked like a hook bug.

Root cause — the hook starts with cd "${CLAUDE_PROJECT_DIR:-.}". With CLAUDE_PROJECT_DIR still pointing at the live repo, the hook ignored the fixture CWD and scanned the real docs/brainstorms/ (all done) → no active doc → allow. The test was lying, not the hook.

Fix — drive the test with CLAUDE_PROJECT_DIR=/tmp/fix so the hook operates on the fixture. Once corrected, the deny / allow / bypass / token paths all verified.

Guard — when testing any hook that cds to an env-var directory, override that env var to the fixture. Note kept here; cheap to re-trip otherwise.