fix: reject recursive callback relays and verify profile display isolation

docker/plugin-setup/codex-auth-relay.js

@@ -30,6 +30,9 @@ function portFromEnv(name, fallback) {
 
 const listenPort = portFromEnv('ECC_RELAY_LISTEN', 1456);
 const targetPort = portFromEnv('ECC_RELAY_TARGET', 1455);
+if (listenPort === targetPort) {
+  throw new Error('ECC_RELAY_LISTEN and ECC_RELAY_TARGET must differ');
+}
 
 net.createServer(client => {
   const upstream = net.connect(targetPort, '127.0.0.1');

tests/docker/codex-auth-relay.test.js

@@ -3,7 +3,7 @@
 const assert = require('node:assert/strict');
 const net = require('node:net');
 const path = require('node:path');
-const { spawn } = require('node:child_process');
+const { spawn, spawnSync } = require('node:child_process');
 const { once } = require('node:events');
 const test = require('node:test');
 
@@ -60,3 +60,13 @@ for (const value of ['0', '-1', '65536', '1.5', 'not-a-port']) {
     assert.match(stderr, /ECC_RELAY_LISTEN must be an integer port/);
   });
 }
+
+for (const port of ['1455', '24567']) {
+  test(`rejects self-relaying port ${port} before listening`, () => {
+    const child = spawnSync(process.execPath, [script], { timeout: 1500, encoding: 'utf8',
+      env: { ...process.env, ECC_RELAY_LISTEN: port, ECC_RELAY_TARGET: port } });
+    assert.equal(child.status, 1, 'equal ports must exit immediately without a listener');
+    assert.match(child.stderr, /ECC_RELAY_LISTEN and ECC_RELAY_TARGET must differ/);
+    assert.equal(child.stdout, '');
+  });
+}

tests/hooks/ecc-statusline-usage.test.js

@@ -29,3 +29,32 @@ test('actual statusline usage display is opt-in and leaves provider settings alo
     fs.rmSync(home, { recursive: true, force: true });
   }
 });
+
+for (const hasSelectedPlugins of [true, false]) {
+  test(`selected Claude profile plugin metadata ${hasSelectedPlugins ? 'is displayed' : 'never borrows the default'}`, () => {
+    const home = fs.mkdtempSync(path.join(os.tmpdir(), 'ecc-statusline-profile-'));
+    try {
+      const selected = path.join(home, 'selected-profile');
+      const writePlugins = (directory, id) => {
+        fs.mkdirSync(path.join(directory, 'plugins'), { recursive: true });
+        fs.writeFileSync(path.join(directory, 'plugins', 'installed_plugins.json'),
+          JSON.stringify({ version: 2, plugins: { [id]: [{ version: '7.8.9' }] } }));
+        fs.writeFileSync(path.join(directory, 'settings.json'),
+          JSON.stringify({ enabledPlugins: { [id]: true } }));
+      };
+      writePlugins(path.join(home, '.claude'), 'default-profile-marker@fixture');
+      if (hasSelectedPlugins) writePlugins(selected, 'selected-profile-marker@fixture');
+      const child = spawnSync(process.execPath, [path.resolve(__dirname, '../../scripts/hooks/ecc-statusline.js')], {
+        input: JSON.stringify({ model: { display_name: 'Claude fixture' } }),
+        encoding: 'utf8', timeout: 5000,
+        env: { ...process.env, HOME: home, USERPROFILE: home, CLAUDE_CONFIG_DIR: selected,
+          ECC_STATUSLINE_USAGE: '1', ECC_BAR_GLYPHS: 'ascii' },
+      });
+      assert.equal(child.status, 0, child.stderr);
+      assert.doesNotMatch(child.stdout, /default-profile-marker/);
+      if (hasSelectedPlugins) assert.match(child.stdout, /selected-profile-marker/);
+    } finally {
+      fs.rmSync(home, { recursive: true, force: true });
+    }
+  });
+}