cc-safe-setup 29.7.0 → 30.0.4

package/tests/test-claim-vs-caveat-checker.sh

@@ -0,0 +1,134 @@
+#!/bin/bash
+# Tests for claim-vs-caveat-checker.sh — verifies that confident
+# claims overlapping with earlier caveats in the same transcript
+# emit a non-blocking note (or block when CLAIM_CAVEAT_BLOCK=1).
+HOOK="examples/claim-vs-caveat-checker.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3' in: $2)"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3' in: $2)"; fi; }
+assert_exit() { if [ "$2" -eq "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (exit $2, expected $3)"; fi; }
+
+# Setup temp transcript
+TMPDIR=$(mktemp -d)
+TRAP_FILE="$TMPDIR/transcript.jsonl"
+
+make_input() {
+  jq -n --arg t "$1" '{transcript_path: $t}'
+}
+
+write_transcript() {
+  : > "$TRAP_FILE"
+  for line in "$@"; do
+    echo "$line" >> "$TRAP_FILE"
+  done
+}
+
+# Test 1: empty transcript_path → exit 0 silently
+INPUT=$(jq -n '{}')
+OUT=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "empty transcript_path exits 0" "$RC" 0
+assert_not_contains "empty transcript no output" "$OUT" "claim-vs-caveat"
+
+# Test 2: missing transcript file → exit 0 silently
+INPUT=$(make_input "/nonexistent/path.jsonl")
+OUT=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "missing transcript exits 0" "$RC" 0
+
+# Test 3: transcript with only confident claim, no caveat → no warning
+write_transcript \
+  '{"role":"user","content":"check the trade"}' \
+  '{"role":"assistant","content":"The trade is guaranteed to succeed."}'
+INPUT=$(make_input "$TRAP_FILE")
+OUT=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "claim-only exits 0" "$RC" 0
+assert_not_contains "claim-only no warning" "$OUT" "claim-vs-caveat"
+
+# Test 4: transcript with only caveat, no claim → no warning
+write_transcript \
+  '{"role":"user","content":"check the trade"}' \
+  '{"role":"assistant","content":"There is a slippage risk."}'
+INPUT=$(make_input "$TRAP_FILE")
+OUT=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "caveat-only exits 0" "$RC" 0
+assert_not_contains "caveat-only no warning" "$OUT" "claim-vs-caveat"
+
+# Test 5: caveat earlier + confident claim later → warning emitted
+write_transcript \
+  '{"role":"user","content":"check the trade"}' \
+  '{"role":"assistant","content":"There is a slippage risk on this position."}' \
+  '{"role":"user","content":"deploy the fix"}' \
+  '{"role":"assistant","content":"The fix is guaranteed to handle the slippage."}'
+INPUT=$(make_input "$TRAP_FILE")
+OUT=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "claim+caveat exits 0 in warn-only" "$RC" 0
+assert_contains "claim+caveat warns" "$OUT" "claim-vs-caveat"
+assert_contains "warning includes claim term" "$OUT" "guaranteed"
+
+# Test 6: same setup with CLAIM_CAVEAT_BLOCK=1 → block JSON
+INPUT=$(make_input "$TRAP_FILE")
+OUT=$(printf '%s' "$INPUT" | CLAIM_CAVEAT_BLOCK=1 bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "block mode exits 0 (decision-block)" "$RC" 0
+assert_contains "block mode emits decision-block" "$OUT" '"decision":"block"'
+assert_contains "block JSON has reason" "$OUT" '"reason"'
+
+# Test 7: Japanese claim + caveat
+write_transcript \
+  '{"role":"user","content":"取引の点検"}' \
+  '{"role":"assistant","content":"この銘柄には滑りの危険があります。"}' \
+  '{"role":"user","content":"修正を出荷"}' \
+  '{"role":"assistant","content":"修正で完璧に直った状態です。"}'
+INPUT=$(make_input "$TRAP_FILE")
+OUT=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "JP claim+caveat exits 0" "$RC" 0
+assert_contains "JP claim+caveat warns" "$OUT" "claim-vs-caveat"
+
+# Test 8: window respects CLAIM_CAVEAT_WINDOW (caveat outside window → no warn)
+> "$TRAP_FILE"
+for i in $(seq 1 60); do
+  echo '{"role":"user","content":"filler"}' >> "$TRAP_FILE"
+  echo '{"role":"assistant","content":"filler reply"}' >> "$TRAP_FILE"
+done
+echo '{"role":"assistant","content":"There is a slippage risk."}' >> "$TRAP_FILE"
+echo '{"role":"user","content":"deploy"}' >> "$TRAP_FILE"
+echo '{"role":"assistant","content":"The fix is guaranteed."}' >> "$TRAP_FILE"
+INPUT=$(make_input "$TRAP_FILE")
+OUT=$(printf '%s' "$INPUT" | CLAIM_CAVEAT_WINDOW=2 bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "narrow window exits 0" "$RC" 0
+assert_not_contains "narrow window suppresses old caveat" "$OUT" "claim-vs-caveat"
+
+# Test 9: wide window picks up the caveat
+INPUT=$(make_input "$TRAP_FILE")
+OUT=$(printf '%s' "$INPUT" | CLAIM_CAVEAT_WINDOW=10 bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "wide window exits 0" "$RC" 0
+assert_contains "wide window detects" "$OUT" "claim-vs-caveat"
+
+# Test 10: real-world #57288 reproduction — agent's words from the trade case
+write_transcript \
+  '{"role":"user","content":"check the position"}' \
+  '{"role":"assistant","content":"After the modification, the SL is close to the entry price (+0.11%). On a fast move, slippage on the small protective margin may be noticeable."}' \
+  '{"role":"user","content":"deploy"}' \
+  '{"role":"assistant","content":"1INCHUSDT cannot close at a loss now."}'
+INPUT=$(make_input "$TRAP_FILE")
+OUT=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "57288 repro exits 0" "$RC" 0
+assert_contains "57288 repro warns" "$OUT" "claim-vs-caveat"
+assert_contains "57288 mentions slippage" "$OUT" "slippage"
+
+# Cleanup
+rm -rf "$TMPDIR"
+
+echo ""
+echo "PASS: $PASS"
+echo "FAIL: $FAIL"
+[ "$FAIL" -eq 0 ] && echo "OK" || exit 1

package/tests/test-claude-code-version-pin-advisor.sh

@@ -0,0 +1,353 @@
+#!/bin/bash
+# Tests for claude-code-version-pin-advisor.sh
+HOOK="$(dirname "$0")/../examples/claude-code-version-pin-advisor.sh"
+PASS=0
+FAIL=0
+
+run_test() {
+  local desc="$1"
+  local result="$2"
+  if [ "$result" = "pass" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# Provide a fake claude binary via CC_VERSION_PIN_ADVISOR_CLAUDE_BIN for tests
+# that exercise the binary-detection path. Most tests use CLAUDE_CODE_VERSION
+# directly which is faster and deterministic.
+
+TMPDIR_RUN="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR_RUN"' EXIT
+
+# Fake claude binary that prints a fixed version
+FAKE_CLAUDE="$TMPDIR_RUN/fake-claude"
+cat > "$FAKE_CLAUDE" <<'EOF'
+#!/bin/bash
+if [ "$1" = "--version" ]; then
+  echo "2.1.156 (Claude Code)"
+fi
+EOF
+chmod +x "$FAKE_CLAUDE"
+
+# Fake claude binary that returns malformed output
+MALFORMED_CLAUDE="$TMPDIR_RUN/malformed-claude"
+cat > "$MALFORMED_CLAUDE" <<'EOF'
+#!/bin/bash
+echo "Claude Code - latest"
+EOF
+chmod +x "$MALFORMED_CLAUDE"
+
+# Fake claude binary that returns nothing
+SILENT_CLAUDE="$TMPDIR_RUN/silent-claude"
+cat > "$SILENT_CLAUDE" <<'EOF'
+#!/bin/bash
+exit 0
+EOF
+chmod +x "$SILENT_CLAUDE"
+
+echo "Testing claude-code-version-pin-advisor.sh"
+echo "==========================================="
+
+# Test 1: version below threshold (2.1.153) → silent exit 0
+OUT=$(CLAUDE_CODE_VERSION=2.1.153 bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "version 2.1.153 (below threshold) → silent exit 0" pass
+else
+  run_test "version 2.1.153 → silent (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 2: version at threshold (2.1.154) → advisory printed
+OUT=$(CLAUDE_CODE_VERSION=2.1.154 bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && echo "$OUT" | grep -q "ADVISORY"; then
+  run_test "version 2.1.154 (at threshold) → advisory printed" pass
+else
+  run_test "version 2.1.154 → advisory (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 3: version above threshold (2.1.156) → advisory printed
+OUT=$(CLAUDE_CODE_VERSION=2.1.156 bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && echo "$OUT" | grep -q "ADVISORY" && echo "$OUT" | grep -q "2.1.156"; then
+  run_test "version 2.1.156 (above threshold) → advisory mentions actual version" pass
+else
+  run_test "version 2.1.156 → advisory (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 4: version far above threshold (2.2.0) → advisory printed
+OUT=$(CLAUDE_CODE_VERSION=2.2.0 bash "$HOOK" 2>&1)
+if [ -n "$(echo "$OUT" | grep ADVISORY)" ]; then
+  run_test "version 2.2.0 (major.minor jump) → advisory" pass
+else
+  run_test "version 2.2.0 → advisory (got: $OUT)" fail
+fi
+
+# Test 5: version 2.1.100 (well below) → silent
+OUT=$(CLAUDE_CODE_VERSION=2.1.100 bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "version 2.1.100 (well below threshold) → silent" pass
+else
+  run_test "version 2.1.100 → silent (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 6: DISABLE=1 silences regardless of version
+OUT=$(CLAUDE_CODE_VERSION=2.1.156 CC_VERSION_PIN_ADVISOR_DISABLE=1 bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "DISABLE=1 silences even when version triggers advisory" pass
+else
+  run_test "DISABLE=1 silences (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 7: QUIET=1 silences regardless of version
+OUT=$(CLAUDE_CODE_VERSION=2.1.156 CC_VERSION_PIN_ADVISOR_QUIET=1 bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "QUIET=1 silences even when version triggers advisory" pass
+else
+  run_test "QUIET=1 silences (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 8: custom THRESHOLD override (2.1.150 lower threshold)
+OUT=$(CLAUDE_CODE_VERSION=2.1.151 CC_VERSION_PIN_ADVISOR_THRESHOLD=2.1.150 bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "ADVISORY"; then
+  run_test "custom THRESHOLD=2.1.150 triggers for 2.1.151" pass
+else
+  run_test "custom THRESHOLD=2.1.150 for 2.1.151 (got: $OUT)" fail
+fi
+
+# Test 9: custom THRESHOLD override (2.1.200 higher threshold)
+OUT=$(CLAUDE_CODE_VERSION=2.1.156 CC_VERSION_PIN_ADVISOR_THRESHOLD=2.1.200 bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "custom THRESHOLD=2.1.200 silences for 2.1.156" pass
+else
+  run_test "custom THRESHOLD=2.1.200 silences (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 10: claude binary not found → fail-open silent
+# PATH with only /bin and /usr/bin (no claude installed there) means
+# command -v claude returns nothing. We need /bin and /usr/bin so that
+# env -i can find bash itself.
+OUT=$(env -i HOME="$HOME" PATH="$TMPDIR_RUN/empty-bin:/bin:/usr/bin" bash "$HOOK" 2>&1)
+EXIT=$?
+# In test environments where claude IS in /usr/bin or /bin, this test may
+# not be deterministic. Use CC_VERSION_PIN_ADVISOR_CLAUDE_BIN pointing at
+# a nonexistent file as the deterministic path.
+OUT=$(env -i HOME="$HOME" PATH="/bin:/usr/bin" \
+  CC_VERSION_PIN_ADVISOR_CLAUDE_BIN="$TMPDIR_RUN/does-not-exist" \
+  bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "claude binary not found → fail-open silent" pass
+else
+  run_test "claude binary not found (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 11: malformed version output → fail-open silent
+OUT=$(CC_VERSION_PIN_ADVISOR_CLAUDE_BIN="$MALFORMED_CLAUDE" \
+  env -i HOME="$HOME" PATH="/usr/bin:/bin" \
+  CC_VERSION_PIN_ADVISOR_CLAUDE_BIN="$MALFORMED_CLAUDE" \
+  bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "malformed version output → fail-open silent" pass
+else
+  run_test "malformed version output → fail-open (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 12: silent claude binary (no version) → fail-open silent
+OUT=$(env -i HOME="$HOME" PATH="/usr/bin:/bin" \
+  CC_VERSION_PIN_ADVISOR_CLAUDE_BIN="$SILENT_CLAUDE" \
+  bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "silent claude binary → fail-open silent" pass
+else
+  run_test "silent claude binary → fail-open (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 13: detection via CC_VERSION_PIN_ADVISOR_CLAUDE_BIN (fake binary at 2.1.156)
+OUT=$(env -i HOME="$HOME" PATH="/usr/bin:/bin" \
+  CC_VERSION_PIN_ADVISOR_CLAUDE_BIN="$FAKE_CLAUDE" \
+  bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "2.1.156" && echo "$OUT" | grep -q "ADVISORY"; then
+  run_test "fake claude binary at 2.1.156 → advisory mentions version" pass
+else
+  run_test "fake claude binary detection (got: $OUT)" fail
+fi
+
+# Test 14: CLAUDE_CODE_VERSION env var preferred over claude --version
+# Even with binary at 2.1.156, env var at 2.1.153 should silence
+OUT=$(env -i HOME="$HOME" PATH="/usr/bin:/bin" \
+  CC_VERSION_PIN_ADVISOR_CLAUDE_BIN="$FAKE_CLAUDE" \
+  CLAUDE_CODE_VERSION=2.1.153 \
+  bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "CLAUDE_CODE_VERSION env var preferred over binary detection" pass
+else
+  run_test "env var preferred (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 15: advisory names sub-pattern 16A
+OUT=$(CLAUDE_CODE_VERSION=2.1.154 bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "16A" && echo "$OUT" | grep -q "Custom agents"; then
+  run_test "advisory names sub-pattern 16A (custom agents)" pass
+else
+  run_test "advisory names 16A (got: $OUT)" fail
+fi
+
+# Test 16: advisory names sub-pattern 16B
+OUT=$(CLAUDE_CODE_VERSION=2.1.154 bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "16B" && echo "$OUT" | grep -q "Anthropic-compatible"; then
+  run_test "advisory names sub-pattern 16B (Anthropic-compatible)" pass
+else
+  run_test "advisory names 16B (got: $OUT)" fail
+fi
+
+# Test 17: advisory names sub-pattern 16C
+OUT=$(CLAUDE_CODE_VERSION=2.1.154 bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "16C" && echo "$OUT" | grep -q "VS Code"; then
+  run_test "advisory names sub-pattern 16C (VS Code)" pass
+else
+  run_test "advisory names 16C (got: $OUT)" fail
+fi
+
+# Test 18: advisory names sub-pattern 16D
+OUT=$(CLAUDE_CODE_VERSION=2.1.154 bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "16D" && echo "$OUT" | grep -q "context operations"; then
+  run_test "advisory names sub-pattern 16D (context operations)" pass
+else
+  run_test "advisory names 16D (got: $OUT)" fail
+fi
+
+# Test 19: advisory includes pin command
+OUT=$(CLAUDE_CODE_VERSION=2.1.154 bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "npm install -g @anthropic-ai/claude-code@2.1.153"; then
+  run_test "advisory includes pin command" pass
+else
+  run_test "advisory includes pin command (got: $OUT)" fail
+fi
+
+# Test 20: advisory includes auto-update suppression
+OUT=$(CLAUDE_CODE_VERSION=2.1.154 bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "CLAUDE_CODE_DISABLE_AUTO_UPDATE=1"; then
+  run_test "advisory includes auto-update suppression" pass
+else
+  run_test "advisory includes auto-update suppression (got: $OUT)" fail
+fi
+
+# Test 21: advisory references anchor issue #63469
+OUT=$(CLAUDE_CODE_VERSION=2.1.154 bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "63469"; then
+  run_test "advisory references anchor issue #63469" pass
+else
+  run_test "advisory references #63469 (got: $OUT)" fail
+fi
+
+# Test 22: advisory references field guide Gist
+OUT=$(CLAUDE_CODE_VERSION=2.1.154 bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "05c120466996734f7bc2ad6d41fdedec"; then
+  run_test "advisory references field guide Gist URL" pass
+else
+  run_test "advisory references Gist (got: $OUT)" fail
+fi
+
+# Test 23: advisory mentions QUIET silence path
+OUT=$(CLAUDE_CODE_VERSION=2.1.154 bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "CC_VERSION_PIN_ADVISOR_QUIET"; then
+  run_test "advisory mentions QUIET env var to silence" pass
+else
+  run_test "advisory mentions QUIET (got: $OUT)" fail
+fi
+
+# Test 24: output written to stderr, stdout empty
+STDOUT=$(CLAUDE_CODE_VERSION=2.1.156 bash "$HOOK" 2>/dev/null)
+if [ -z "$STDOUT" ]; then
+  run_test "warning written to stderr, stdout empty" pass
+else
+  run_test "warning to stderr (stdout was: $STDOUT)" fail
+fi
+
+# Test 25: ADVISORY prefix (not BLOCKED)
+OUT=$(CLAUDE_CODE_VERSION=2.1.154 bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "^ADVISORY:"; then
+  run_test "uses ADVISORY prefix (non-blocking)" pass
+else
+  run_test "uses ADVISORY prefix (got: $OUT)" fail
+fi
+
+# Test 26: malformed version (non-semver) → fail-open silent
+OUT=$(CLAUDE_CODE_VERSION="latest" bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "non-semver version 'latest' → fail-open silent" pass
+else
+  run_test "non-semver 'latest' (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 27: empty version string → fail-open silent
+# Empty env var means falling back to binary detection; use
+# CC_VERSION_PIN_ADVISOR_CLAUDE_BIN pointing at nonexistent file to
+# deterministically force binary detection to fail.
+OUT=$(env -i HOME="$HOME" PATH="/bin:/usr/bin" \
+  CC_VERSION_PIN_ADVISOR_CLAUDE_BIN="$TMPDIR_RUN/does-not-exist" \
+  CLAUDE_CODE_VERSION="" bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "empty version + no claude binary → fail-open silent" pass
+else
+  run_test "empty version + no binary (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 28: version with suffix tag (2.1.154-beta) → advisory (suffix stripped)
+OUT=$(CLAUDE_CODE_VERSION="2.1.154-beta" bash "$HOOK" 2>&1)
+if echo "$OUT" | grep -q "ADVISORY"; then
+  run_test "version 2.1.154-beta (suffix stripped) → advisory" pass
+else
+  run_test "version 2.1.154-beta → advisory (got: $OUT)" fail
+fi
+
+# Test 29: stdin JSON consumed (SessionStart hooks receive JSON)
+OUT=$(echo '{"hook_event_name":"SessionStart"}' | \
+  CLAUDE_CODE_VERSION=2.1.153 bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "stdin JSON consumed silently when version below threshold" pass
+else
+  run_test "stdin JSON consumed (exit=$EXIT, out=$OUT)" fail
+fi
+
+# Test 30: exit code 0 in all configurations (non-blocking)
+EXITS=()
+for cfg in \
+    "CLAUDE_CODE_VERSION=2.1.153" \
+    "CLAUDE_CODE_VERSION=2.1.154" \
+    "CLAUDE_CODE_VERSION=2.1.156 CC_VERSION_PIN_ADVISOR_DISABLE=1" \
+    "CLAUDE_CODE_VERSION=2.1.156 CC_VERSION_PIN_ADVISOR_QUIET=1" \
+    "CLAUDE_CODE_VERSION=2.1.156 CC_VERSION_PIN_ADVISOR_THRESHOLD=2.1.200" \
+    "CLAUDE_CODE_VERSION=latest" \
+    "CLAUDE_CODE_VERSION=2.1.154-beta"; do
+  eval "env -i HOME=\"$HOME\" PATH=\"\$PATH\" $cfg bash \"$HOOK\" >/dev/null 2>&1"
+  EXITS+=("$?")
+done
+ALL_ZERO=1
+for e in "${EXITS[@]}"; do
+  [ "$e" != "0" ] && ALL_ZERO=0
+done
+if [ "$ALL_ZERO" = "1" ]; then
+  run_test "exit code 0 in all 7 configurations (non-blocking)" pass
+else
+  run_test "exit code 0 in all configs (got: ${EXITS[*]})" fail
+fi
+
+echo
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" = "0" ]

package/tests/test-claude-md-reinjector.sh

@@ -0,0 +1,173 @@
+#!/bin/bash
+# Tests for claude-md-reinjector.sh
+set -euo pipefail
+
+HOOK="$(dirname "$0")/../examples/claude-md-reinjector.sh"
+PASS=0
+FAIL=0
+STATE_DIR="/tmp/cc-md-reinject"
+SESSION_ID="test-$$"
+COUNT_FILE="$STATE_DIR/${SESSION_ID}.count"
+
+setup() {
+    rm -f "$STATE_DIR"/*.count 2>/dev/null || true
+    mkdir -p "$STATE_DIR"
+}
+
+# Build a temp CLAUDE.md we can point the hook at
+TMP_MD=$(mktemp /tmp/test-claude-md.XXXXXX)
+cat > "$TMP_MD" <<'EOF'
+# Project Rules
+- Rule A: never commit secrets
+- Rule B: small functions only
+- Rule C: ask before deleting files
+EOF
+
+INPUT='{"session_id":"'"$SESSION_ID"'","tool_name":"Read"}'
+
+run_hook() {
+    local every="${1:-50}"
+    echo "$INPUT" | CC_MD_REINJECT_EVERY="$every" CC_MD_REINJECT_PATH="$TMP_MD" bash "$HOOK" 2>&1 || true
+}
+
+# --- Test 1: First call under threshold does NOT inject ---
+setup
+output=$(run_hook 50)
+if echo "$output" | grep -q "re-injecting"; then
+    echo "  FAIL: first call should not inject (count=1, every=50)"
+    FAIL=$((FAIL + 1))
+else
+    echo "  PASS: first call does not inject"
+    PASS=$((PASS + 1))
+fi
+
+# --- Test 2: Counter increments ---
+setup
+run_hook 50 >/dev/null 2>&1
+run_hook 50 >/dev/null 2>&1
+run_hook 50 >/dev/null 2>&1
+count=$(cat "$COUNT_FILE" 2>/dev/null || echo 0)
+if [ "$count" = "3" ]; then
+    echo "  PASS: counter increments to 3"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: counter should be 3, got $count"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 3: Inject fires on the N-th call ---
+setup
+# Set count to 1 already, N=2 → second call should inject
+run_hook 2 >/dev/null 2>&1
+output=$(run_hook 2)
+if echo "$output" | grep -q "re-injecting"; then
+    echo "  PASS: inject fires on N-th call (every=2)"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should have injected on call #2 with every=2"
+    echo "    output: $output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 4: Injected content contains CLAUDE.md rules ---
+setup
+run_hook 1 >/dev/null 2>&1   # first call injects (every=1)
+output=$(echo "$INPUT" | CC_MD_REINJECT_EVERY=1 CC_MD_REINJECT_PATH="$TMP_MD" bash "$HOOK" 2>&1 || true)
+if echo "$output" | grep -q "Rule A: never commit secrets"; then
+    echo "  PASS: injected output contains CLAUDE.md content"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: injected output missing CLAUDE.md rules"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 5: Inject output mentions issue #49244 ---
+setup
+output=$(echo "$INPUT" | CC_MD_REINJECT_EVERY=1 CC_MD_REINJECT_PATH="$TMP_MD" bash "$HOOK" 2>&1 || true)
+if echo "$output" | grep -q "49244"; then
+    echo "  PASS: header mentions issue #49244"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: header should mention #49244"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 6: Missing CLAUDE.md exits 0 silently (no crash) ---
+setup
+GHOST_PATH="/tmp/does-not-exist-$$/CLAUDE.md"
+set +e
+output=$(echo "$INPUT" | CC_MD_REINJECT_EVERY=1 CC_MD_REINJECT_PATH="$GHOST_PATH" bash "$HOOK" 2>&1)
+rc=$?
+set -e
+if [ "$rc" = "0" ] && ! echo "$output" | grep -q "re-injecting"; then
+    echo "  PASS: missing CLAUDE.md exits 0 silently"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: should exit 0 with no injection, rc=$rc output=$output"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 7: Invalid JSON on stdin doesn't crash ---
+setup
+set +e
+output=$(echo "not-json" | CC_MD_REINJECT_EVERY=1 CC_MD_REINJECT_PATH="$TMP_MD" bash "$HOOK" 2>&1)
+rc=$?
+set -e
+if [ "$rc" = "0" ]; then
+    echo "  PASS: invalid JSON does not crash (uses default session)"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: invalid JSON crashed with rc=$rc"
+    FAIL=$((FAIL + 1))
+fi
+
+# --- Test 8: Truncation honored ---
+BIG_MD=$(mktemp /tmp/test-claude-md-big.XXXXXX)
+python3 -c "print('x' * 5000)" > "$BIG_MD"
+setup
+output=$(echo "$INPUT" | CC_MD_REINJECT_EVERY=1 CC_MD_REINJECT_PATH="$BIG_MD" CC_MD_REINJECT_MAX_CHARS=500 bash "$HOOK" 2>&1 || true)
+if echo "$output" | grep -q "truncated at 500 chars"; then
+    echo "  PASS: truncation marker emitted for oversized CLAUDE.md"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: truncation marker missing"
+    FAIL=$((FAIL + 1))
+fi
+rm -f "$BIG_MD"
+
+# --- Test 9: Log file written when CC_MD_REINJECT_LOG set ---
+LOG_FILE=$(mktemp /tmp/test-reinject-log.XXXXXX)
+rm "$LOG_FILE"
+setup
+echo "$INPUT" | CC_MD_REINJECT_EVERY=1 CC_MD_REINJECT_PATH="$TMP_MD" CC_MD_REINJECT_LOG="$LOG_FILE" bash "$HOOK" >/dev/null 2>&1 || true
+if [ -f "$LOG_FILE" ] && grep -q "session=$SESSION_ID" "$LOG_FILE"; then
+    echo "  PASS: log file written with session id"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: log file missing or malformed"
+    FAIL=$((FAIL + 1))
+fi
+rm -f "$LOG_FILE"
+
+# --- Test 10: Different sessions have independent counters ---
+setup
+run_hook 50 >/dev/null 2>&1
+INPUT_B='{"session_id":"other-'$$'","tool_name":"Read"}'
+echo "$INPUT_B" | CC_MD_REINJECT_EVERY=50 CC_MD_REINJECT_PATH="$TMP_MD" bash "$HOOK" >/dev/null 2>&1 || true
+count_a=$(cat "$STATE_DIR/${SESSION_ID}.count" 2>/dev/null || echo 0)
+count_b=$(cat "$STATE_DIR/other-$$.count" 2>/dev/null || echo 0)
+if [ "$count_a" = "1" ] && [ "$count_b" = "1" ]; then
+    echo "  PASS: per-session counters isolated"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: counters should be independent (a=$count_a b=$count_b)"
+    FAIL=$((FAIL + 1))
+fi
+
+# Cleanup
+rm -f "$TMP_MD"
+rm -f "$STATE_DIR"/*.count 2>/dev/null || true
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]