diff -r 70f96db78e62 -r 3fdeca5caf86 hooks/test/cases/03-git-inside-nested-git-allows.sh
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/hooks/test/cases/03-git-inside-nested-git-allows.sh	Sun May 03 15:23:11 2026 -0500
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Case 03: closer .git wins over outer .hg, AND bare git repos
+# (HEAD/refs/objects in cwd, no .git subdir) inside an .hg ancestor allow.
+set -u
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+# Sub-case A: regular .git nested under .hg
+mkdir -p "$tmp/outer/.hg"
+mkdir -p "$tmp/outer/inner/.git"
+
+input=$(jq -n --arg cwd "$tmp/outer/inner" --arg cmd "git log" '{
+  cwd: $cwd,
+  hook_event_name: "PreToolUse",
+  tool_name: "Bash",
+  tool_input: { command: $cmd }
+}')
+
+if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
+    echo "sub-case A (nested .git) expected exit 0, got non-zero"
+    exit 1
+fi
+
+# Sub-case B: bare git repo (no .git subdir) inside .hg ancestor
+mkdir -p "$tmp/outer/testdata/repo.git/refs"
+mkdir -p "$tmp/outer/testdata/repo.git/objects"
+touch    "$tmp/outer/testdata/repo.git/HEAD"
+
+input=$(jq -n --arg cwd "$tmp/outer/testdata/repo.git" --arg cmd "git log" '{
+  cwd: $cwd,
+  hook_event_name: "PreToolUse",
+  tool_name: "Bash",
+  tool_input: { command: $cmd }
+}')
+
+if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
+    echo "sub-case B (bare repo) expected exit 0, got non-zero"
+    exit 1
+fi
diff -r 70f96db78e62 -r 3fdeca5caf86 hooks/test/cases/04-hg-command-allows.sh
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/hooks/test/cases/04-hg-command-allows.sh	Sun May 03 15:23:11 2026 -0500
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Case 04: 'hg status' inside an .hg repo must be allowed (only git is blocked).
+set -u
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+mkdir -p "$tmp/repo/.hg"
+
+input=$(jq -n --arg cwd "$tmp/repo" --arg cmd "hg status" '{
+  cwd: $cwd,
+  hook_event_name: "PreToolUse",
+  tool_name: "Bash",
+  tool_input: { command: $cmd }
+}')
+
+if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
+    echo "expected exit 0 (allow), got non-zero"
+    exit 1
+fi
diff -r 70f96db78e62 -r 3fdeca5caf86 hooks/test/cases/05-env-var-prefix-stripped.sh
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/hooks/test/cases/05-env-var-prefix-stripped.sh	Sun May 03 15:23:11 2026 -0500
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Case 05: 'FOO=bar git status' inside an .hg repo must be blocked
+# (env-var prefix correctly skipped to find the real leading command).
+set -u
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+mkdir -p "$tmp/repo/.hg"
+
+input=$(jq -n --arg cwd "$tmp/repo" --arg cmd "FOO=bar GIT_PAGER=cat git status" '{
+  cwd: $cwd,
+  hook_event_name: "PreToolUse",
+  tool_name: "Bash",
+  tool_input: { command: $cmd }
+}')
+
+err=$(echo "$input" | "$HOOK_SCRIPT" 2>&1 >/dev/null)
+rc=$?
+
+if [[ $rc -ne 2 ]]; then
+    echo "expected exit 2 (blocked), got $rc"
+    echo "stderr: $err"
+    exit 1
+fi
diff -r 70f96db78e62 -r 3fdeca5caf86 hooks/test/cases/07-cd-then-git-allows.sh
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/hooks/test/cases/07-cd-then-git-allows.sh	Sun May 03 15:23:11 2026 -0500
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Case 07: 'cd /tmp && git init' inside an .hg repo must be allowed
+# (only the leading token is inspected — this is the documented escape valve).
+set -u
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+mkdir -p "$tmp/repo/.hg"
+
+input=$(jq -n --arg cwd "$tmp/repo" --arg cmd "cd /tmp && git init" '{
+  cwd: $cwd,
+  hook_event_name: "PreToolUse",
+  tool_name: "Bash",
+  tool_input: { command: $cmd }
+}')
+
+if ! echo "$input" | "$HOOK_SCRIPT" >/dev/null 2>&1; then
+    echo "expected exit 0 (allow), got non-zero"
+    exit 1
+fi