cc-safe-setup 29.7.0 → 30.0.4

package/tests/test-tokenizer-ratio-alert-corpus.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+# Tests for tokenizer-ratio-alert-corpus.sh
+HOOK="examples/tokenizer-ratio-alert-corpus.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+assert_exit() { if [ "$2" -eq "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (exit $2, expected $3)"; fi; }
+
+HISTORY="/tmp/cc-tokenizer-ratio-history"
+SESSION_FLAG="/tmp/cc-tokenizer-ratio-session"
+rm -f "$HISTORY" "$SESSION_FLAG"
+
+# Test 1: Empty input exits cleanly with no log
+OUT=$(echo "{}" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "empty input exit 0" "$RC" 0
+if [ ! -f "$HISTORY" ] || [ ! -s "$HISTORY" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: history not empty for empty input"; fi
+
+# Test 2: Missing tool_response exits cleanly without alert
+INPUT='{"tool_input":{"command":"echo test"}}'
+OUT=$(echo "$INPUT" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "missing tokens exit 0" "$RC" 0
+assert_not_contains "no alert without tokens" "$OUT" "tokenizer-ratio-alert-corpus"
+
+# Test 3: Valid input logs entry
+rm -f "$HISTORY" "$SESSION_FLAG"
+INPUT='{"tool_input":{"command":"echo hello"},"tool_response":{"usage":{"input_tokens":100}}}'
+OUT=$(echo "$INPUT" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "valid input exit 0" "$RC" 0
+if [ -f "$HISTORY" ] && [ -s "$HISTORY" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: history not written"; fi
+
+# Test 4: Log entry format (timestamp|date|tokens|chars|ratio)
+LINE=$(tail -1 "$HISTORY")
+FIELDS=$(echo "$LINE" | awk -F'|' '{print NF}')
+if [ "$FIELDS" -eq 5 ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: log format wrong ($FIELDS fields, expected 5)"; fi
+
+# Test 5: Below baseline threshold = no alert (under 50 turns = baseline not yet established)
+rm -f "$HISTORY" "$SESSION_FLAG"
+for i in $(seq 1 49); do
+  echo '{"tool_input":{"command":"x"},"tool_response":{"usage":{"input_tokens":10}}}' | bash "$HOOK" 2>/dev/null
+done
+OUT=$(echo '{"tool_input":{"command":"y"},"tool_response":{"usage":{"input_tokens":10}}}' | bash "$HOOK" 2>&1)
+assert_not_contains "no alert below baseline turn count" "$OUT" "tokenizer-ratio-alert-corpus"
+
+# Test 6: After baseline + sustained 1.25x ratio, alert fires after 3 sessions
+rm -f "$HISTORY" "$SESSION_FLAG"
+# Establish baseline: 60 turns at ratio = 0.5 (tokens 50, chars 100)
+for i in $(seq 1 60); do
+  # Long string to give chars=~140
+  echo '{"tool_input":{"command":"abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcde"},"tool_response":{"usage":{"input_tokens":50}}}' | bash "$HOOK" 2>/dev/null
+done
+# Now spike with ratio = 1.0 (tokens 140, chars ~140) — well over 1.25 × 0.36 baseline = 0.45 threshold
+SPIKE_INPUT='{"tool_input":{"command":"abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcdefghij abcde"},"tool_response":{"usage":{"input_tokens":140}}}'
+# Session 1 (export so subshell inherits)
+export CLAUDE_SESSION_ID=session-1; OUT1=$(echo "$SPIKE_INPUT" | bash "$HOOK" 2>&1)
+# Session 2
+export CLAUDE_SESSION_ID=session-2; OUT2=$(echo "$SPIKE_INPUT" | bash "$HOOK" 2>&1)
+# Session 3 — should trigger alert
+export CLAUDE_SESSION_ID=session-3; OUT3=$(echo "$SPIKE_INPUT" | bash "$HOOK" 2>&1)
+unset CLAUDE_SESSION_ID
+assert_contains "session 3 alert fires" "$OUT3" "tokenizer-ratio-alert-corpus"
+assert_contains "alert mentions baseline" "$OUT3" "baseline"
+assert_contains "alert mentions Issue 46829" "$OUT3" "46829"
+
+# Test 7: Hook is non-blocking (exit 0 even when alerting)
+RC=$?
+assert_exit "alert is non-blocking" "$RC" 0
+
+# Cleanup
+rm -f "$HISTORY" "$SESSION_FLAG"
+
+echo "PASS: $PASS"
+echo "FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/test-tokenizer-ratio-alert.sh

@@ -0,0 +1,93 @@
+#!/bin/bash
+# Tests for tokenizer-ratio-alert.sh — uses a stub curl on PATH to avoid real
+# network calls. The stub inspects its argv for the model name and prints a
+# minimal JSON body with a hardcoded input_tokens count.
+HOOK="examples/tokenizer-ratio-alert.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3' in: $2)"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3' in: $2)"; fi; }
+assert_exit() { if [ "$2" -eq "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (exit $2, expected $3)"; fi; }
+
+make_stub_curl() {
+  local old_tokens="$1"
+  local new_tokens="$2"
+  local dir
+  dir=$(mktemp -d)
+  cat >"$dir/curl" <<EOF
+#!/usr/bin/env bash
+# Stub curl: returns hardcoded token counts based on the model in the
+# request body. Reads -d <payload> from argv.
+body=""
+while [ \$# -gt 0 ]; do
+  case "\$1" in
+    -d) body="\$2"; shift 2 ;;
+    *) shift ;;
+  esac
+done
+if echo "\$body" | grep -q '4-6'; then
+  printf '{"input_tokens": %s}\n' "$old_tokens"
+elif echo "\$body" | grep -q '4-7'; then
+  printf '{"input_tokens": %s}\n' "$new_tokens"
+else
+  printf '{}\n'
+fi
+EOF
+  chmod +x "$dir/curl"
+  printf '%s' "$dir"
+}
+
+LONG_PROMPT=$(printf 'x%.0s' {1..3000})   # 3000 chars ≫ default 2000 (= 500 tokens * 4)
+
+# Test 1: ratio above threshold → alert
+STUB=$(make_stub_curl 1000 1500)          # ratio 1.5 > default 1.40
+PAYLOAD=$(jq -n --arg p "$LONG_PROMPT" '{tool_input: {prompt: $p}}')
+export ANTHROPIC_API_KEY="test-key"
+OUT=$(PATH="$STUB:/usr/bin:/bin" printf '%s' "$PAYLOAD" | \
+  PATH="$STUB:/usr/bin:/bin" bash "$HOOK" 2>&1)
+# The above PATH-with-printf doesn't propagate; redo via explicit env:
+OUT=$(PATH="$STUB:/usr/bin:/bin" ANTHROPIC_API_KEY=test-key bash -c "printf '%s' \"\$1\" | bash \"$HOOK\"" _ "$PAYLOAD" 2>&1)
+RC=$?
+assert_exit "alert path exits 0" "$RC" 0
+assert_contains "alert mentions tokenizer-ratio" "$OUT" "tokenizer-ratio-alert"
+assert_contains "alert shows ratio 1.5" "$OUT" "1.5"
+rm -rf "$STUB"
+
+# Test 2: ratio below threshold → no alert
+STUB=$(make_stub_curl 1000 1300)          # 1.3 < 1.40
+OUT=$(PATH="$STUB:/usr/bin:/bin" ANTHROPIC_API_KEY=test-key bash -c "printf '%s' \"\$1\" | bash \"$HOOK\"" _ "$PAYLOAD" 2>&1)
+assert_not_contains "no alert when ratio below threshold" "$OUT" "tokenizer-ratio-alert:"
+rm -rf "$STUB"
+
+# Test 3: prompt too short → skip measurement entirely
+SHORT_PAYLOAD=$(jq -n '{tool_input: {prompt: "hi"}}')
+STUB=$(make_stub_curl 1000 1500)
+OUT=$(PATH="$STUB:/usr/bin:/bin" ANTHROPIC_API_KEY=test-key bash -c "printf '%s' \"\$1\" | bash \"$HOOK\"" _ "$SHORT_PAYLOAD" 2>&1)
+RC=$?
+assert_exit "short prompt exits 0" "$RC" 0
+assert_not_contains "short prompt no alert" "$OUT" "tokenizer-ratio-alert:"
+rm -rf "$STUB"
+
+# Test 4: no API key → no-op with notice
+unset ANTHROPIC_API_KEY
+OUT=$(printf '%s' "$PAYLOAD" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "no API key exits 0" "$RC" 0
+assert_contains "no-key notice printed" "$OUT" "ANTHROPIC_API_KEY not set"
+
+# Test 5: empty prompt and no transcript → silent no-op
+OUT=$(printf '{}' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "empty payload exits 0" "$RC" 0
+assert_not_contains "empty payload no alert" "$OUT" "tokenizer-ratio-alert:"
+
+# Test 6: custom threshold respected
+STUB=$(make_stub_curl 1000 1200)          # 1.2
+export ANTHROPIC_API_KEY="test-key"
+OUT=$(PATH="$STUB:/usr/bin:/bin" ANTHROPIC_API_KEY=test-key TOKENIZER_RATIO_THRESHOLD=1.10 \
+  bash -c "printf '%s' \"\$1\" | bash \"$HOOK\"" _ "$PAYLOAD" 2>&1)
+assert_contains "custom threshold alerts at 1.2 > 1.10" "$OUT" "tokenizer-ratio-alert"
+rm -rf "$STUB"
+
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/test-tool-result-correlation-checker.sh

@@ -0,0 +1,264 @@
+#!/bin/bash
+# Tests for tool-result-correlation-checker.sh
+HOOK="$(dirname "$0")/../examples/tool-result-correlation-checker.sh"
+PASS=0
+FAIL=0
+
+run_test() {
+  local desc="$1"
+  local result="$2"
+  if [ "$result" = "pass" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+STATE="$TMPDIR/state"
+TRANSCRIPT="$TMPDIR/transcript.jsonl"
+
+reset_state() {
+  rm -rf "$STATE"
+  mkdir -p "$STATE"
+  : > "$TRANSCRIPT"
+  unset CC_TOOL_CORRELATION_DISABLE
+  unset CC_TOOL_CORRELATION_QUIET
+  unset CC_TOOL_CORRELATION_THRESHOLD
+  unset CC_TOOL_CORRELATION_WINDOW_SEC
+}
+
+# Helper: build assistant turn with N tool_use blocks (ids id_1 .. id_N)
+make_assistant_turn() {
+  local count="$1"
+  local blocks=""
+  for i in $(seq 1 "$count"); do
+    blocks="${blocks}{\"type\":\"tool_use\",\"id\":\"id_${i}\",\"name\":\"Bash\",\"input\":{}}"
+    [ "$i" -lt "$count" ] && blocks="${blocks},"
+  done
+  printf '{"type":"assistant","message":{"content":[%s]}}\n' "$blocks"
+}
+
+# Helper: build user turn with tool_result blocks for given ids
+make_user_turn() {
+  local ids="$1"  # space-separated ids
+  local blocks=""
+  local first=1
+  for id in $ids; do
+    [ "$first" = "0" ] && blocks="${blocks},"
+    blocks="${blocks}{\"type\":\"tool_result\",\"tool_use_id\":\"${id}\",\"content\":\"ok\"}"
+    first=0
+  done
+  printf '{"type":"user","message":{"content":[%s]}}\n' "$blocks"
+}
+
+make_input() {
+  printf '{"transcript_path":"%s","tool_response":"ok"}' "$TRANSCRIPT"
+}
+
+echo "Testing tool-result-correlation-checker.sh"
+echo "==========================================="
+
+# Test 1: DISABLE=1 silences entirely
+reset_state
+make_assistant_turn 3 >> "$TRANSCRIPT"
+make_user_turn "id_99" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" CC_TOOL_CORRELATION_DISABLE=1 bash "$HOOK" 2>&1)
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ -z "$OUT" ]; then
+  run_test "DISABLE=1 silences entirely" pass
+else
+  run_test "DISABLE=1 (exit=$EXIT, out_len=${#OUT})" fail
+fi
+
+# Test 2: QUIET=1 silences entirely
+reset_state
+make_assistant_turn 3 >> "$TRANSCRIPT"
+make_user_turn "id_99" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" CC_TOOL_CORRELATION_QUIET=1 bash "$HOOK" 2>&1)
+if [ -z "$OUT" ]; then
+  run_test "QUIET=1 silences entirely" pass
+else
+  run_test "QUIET=1 (out_len=${#OUT})" fail
+fi
+
+# Test 3: perfect correlation produces no output
+reset_state
+make_assistant_turn 3 >> "$TRANSCRIPT"
+make_user_turn "id_1 id_2 id_3" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" bash "$HOOK" 2>&1)
+if [ -z "$OUT" ]; then
+  run_test "perfect correlation produces no output" pass
+else
+  run_test "perfect correlation (got output: ${OUT:0:80})" fail
+fi
+
+# Test 4: orphan result (no matching use) triggers warning
+reset_state
+make_assistant_turn 2 >> "$TRANSCRIPT"
+make_user_turn "id_99" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" bash "$HOOK" 2>&1)
+if printf '%s' "$OUT" | grep -q "correlation mismatch"; then
+  run_test "orphan result triggers warning" pass
+else
+  run_test "orphan result (out=${OUT:0:80})" fail
+fi
+
+# Test 5: duplicate result ids trigger warning
+reset_state
+make_assistant_turn 3 >> "$TRANSCRIPT"
+make_user_turn "id_1 id_1 id_3" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" bash "$HOOK" 2>&1)
+if printf '%s' "$OUT" | grep -q "correlation mismatch"; then
+  run_test "duplicate result ids trigger warning" pass
+else
+  run_test "duplicate result ids (out=${OUT:0:80})" fail
+fi
+
+# Test 6: missing result (use without result) does NOT trigger warning
+# Rationale: missing results are common during in-flight batches; we only
+# warn on orphan/duplicate which are unambiguous misrouting signals
+reset_state
+make_assistant_turn 5 >> "$TRANSCRIPT"
+make_user_turn "id_1 id_2 id_3" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" bash "$HOOK" 2>&1)
+if [ -z "$OUT" ]; then
+  run_test "missing result does NOT warn (in-flight is normal)" pass
+else
+  run_test "missing result false positive (out=${OUT:0:80})" fail
+fi
+
+# Test 7: empty transcript path produces no output
+reset_state
+INPUT='{"tool_response":"ok"}'
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" bash "$HOOK" 2>&1)
+if [ -z "$OUT" ]; then
+  run_test "empty transcript path is silent" pass
+else
+  run_test "empty transcript path (out=${OUT:0:80})" fail
+fi
+
+# Test 8: non-existent transcript file is silent
+reset_state
+INPUT='{"transcript_path":"/nonexistent/path.jsonl","tool_response":"ok"}'
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" bash "$HOOK" 2>&1)
+if [ -z "$OUT" ]; then
+  run_test "non-existent transcript is silent" pass
+else
+  run_test "non-existent transcript (out=${OUT:0:80})" fail
+fi
+
+# Test 9: malformed JSON in transcript is silent
+reset_state
+echo "this is not json" > "$TRANSCRIPT"
+echo "neither is this" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" bash "$HOOK" 2>&1)
+if [ -z "$OUT" ]; then
+  run_test "malformed JSON in transcript is silent" pass
+else
+  run_test "malformed JSON (out=${OUT:0:80})" fail
+fi
+
+# Test 10: THRESHOLD=2 requires 2 events to warn
+reset_state
+make_assistant_turn 2 >> "$TRANSCRIPT"
+make_user_turn "id_99" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+# First mismatch — should be silent with threshold 2
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" CC_TOOL_CORRELATION_THRESHOLD=2 bash "$HOOK" 2>&1)
+if [ -z "$OUT" ]; then
+  run_test "THRESHOLD=2 silent on first event" pass
+else
+  run_test "THRESHOLD=2 first event (out=${OUT:0:80})" fail
+fi
+
+# Second mismatch — should warn
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" CC_TOOL_CORRELATION_THRESHOLD=2 bash "$HOOK" 2>&1)
+if printf '%s' "$OUT" | grep -q "correlation mismatch"; then
+  run_test "THRESHOLD=2 warns on second event" pass
+else
+  run_test "THRESHOLD=2 second event (out=${OUT:0:80})" fail
+fi
+
+# Test 11: rolling window pruning (old events fall off)
+reset_state
+make_assistant_turn 2 >> "$TRANSCRIPT"
+make_user_turn "id_99" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+# Inject an old event manually (60s in the past with window=1s = old)
+OLD_TS=$(( $(date +%s) - 1000 ))
+mkdir -p "$STATE"
+echo "$OLD_TS" > "$STATE/events.log"
+# Fire with WINDOW_SEC=1 and THRESHOLD=2 — the old event should be pruned,
+# the new event becomes the first within window, so no warning
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" CC_TOOL_CORRELATION_WINDOW_SEC=1 CC_TOOL_CORRELATION_THRESHOLD=2 bash "$HOOK" 2>&1)
+if [ -z "$OUT" ]; then
+  run_test "rolling window prunes old events" pass
+else
+  run_test "window pruning (out=${OUT:0:80})" fail
+fi
+
+# Test 12: assistant turn with no tool_use blocks is silent
+reset_state
+echo '{"type":"assistant","message":{"content":[{"type":"text","text":"just text"}]}}' >> "$TRANSCRIPT"
+make_user_turn "id_1" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" bash "$HOOK" 2>&1)
+if [ -z "$OUT" ]; then
+  run_test "no tool_use blocks is silent" pass
+else
+  run_test "no tool_use (out=${OUT:0:80})" fail
+fi
+
+# Test 13: orphan result count is reported in warning
+reset_state
+make_assistant_turn 2 >> "$TRANSCRIPT"
+make_user_turn "id_98 id_99" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" bash "$HOOK" 2>&1)
+if printf '%s' "$OUT" | grep -q "Orphan results.*: 2"; then
+  run_test "orphan count reported in warning" pass
+else
+  run_test "orphan count (out=${OUT:0:120})" fail
+fi
+
+# Test 14: warning includes operator action
+reset_state
+make_assistant_turn 2 >> "$TRANSCRIPT"
+make_user_turn "id_99" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" bash "$HOOK" 2>&1)
+if printf '%s' "$OUT" | grep -q "Operator action"; then
+  run_test "warning includes operator action guidance" pass
+else
+  run_test "operator action missing (out=${OUT:0:120})" fail
+fi
+
+# Test 15: warning includes silencer hint
+reset_state
+make_assistant_turn 2 >> "$TRANSCRIPT"
+make_user_turn "id_99" >> "$TRANSCRIPT"
+INPUT=$(make_input)
+OUT=$(printf '%s' "$INPUT" | CC_TOOL_CORRELATION_STATE_DIR="$STATE" CC_TOOL_CORRELATION_TRANSCRIPT="$TRANSCRIPT" bash "$HOOK" 2>&1)
+if printf '%s' "$OUT" | grep -q "CC_TOOL_CORRELATION_QUIET"; then
+  run_test "warning includes silencer hint" pass
+else
+  run_test "silencer hint missing (out=${OUT:0:120})" fail
+fi
+
+echo ""
+echo "==========================================="
+echo "PASSED: $PASS"
+echo "FAILED: $FAIL"
+echo "==========================================="
+exit $FAIL

package/tests/test-tool-result-size-guard.sh

@@ -0,0 +1,121 @@
+#!/bin/bash
+# Tests for tool-result-size-guard.sh
+HOOK="examples/tool-result-size-guard.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3')"; echo "  output: $2"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; echo "  output: $2"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+run_hook() { echo "$1" | bash "$HOOK" 2>&1; }
+run_hook_exit() { echo "$1" | bash "$HOOK" > /dev/null 2>&1; echo $?; }
+
+# Test 1: empty command — silent pass
+OUT=$(run_hook '{"tool_input":{"command":""}}')
+RC=$(run_hook_exit '{"tool_input":{"command":""}}')
+assert_not_contains "empty command no warning" "$OUT" "WARNING"
+assert_exit "empty command exit 0" "$RC" "0"
+
+# Test 2: harmless command — silent pass
+OUT=$(run_hook '{"tool_input":{"command":"ls -la"}}')
+RC=$(run_hook_exit '{"tool_input":{"command":"ls -la"}}')
+assert_not_contains "harmless ls -la no warning" "$OUT" "WARNING"
+assert_exit "harmless ls -la exit 0" "$RC" "0"
+
+# Test 3: find / without -maxdepth — warns
+OUT=$(run_hook '{"tool_input":{"command":"find / -name foo"}}')
+RC=$(run_hook_exit '{"tool_input":{"command":"find / -name foo"}}')
+assert_contains "find / warns" "$OUT" "find / or find ~"
+assert_contains "find / suggests -maxdepth" "$OUT" "maxdepth"
+assert_exit "find / warn exit 0" "$RC" "0"
+
+# Test 4: find / with -maxdepth — silent pass
+OUT=$(run_hook '{"tool_input":{"command":"find / -maxdepth 3 -name foo"}}')
+RC=$(run_hook_exit '{"tool_input":{"command":"find / -maxdepth 3 -name foo"}}')
+assert_not_contains "find / -maxdepth no warning" "$OUT" "WARNING"
+assert_exit "find / -maxdepth exit 0" "$RC" "0"
+
+# Test 5: ls -R — warns
+OUT=$(run_hook '{"tool_input":{"command":"ls -R /tmp"}}')
+assert_contains "ls -R warns" "$OUT" "ls -R"
+
+# Test 6: ls -R piped to head — silent pass
+OUT=$(run_hook '{"tool_input":{"command":"ls -R /tmp | head -50"}}')
+assert_not_contains "ls -R | head no warning" "$OUT" "WARNING"
+
+# Test 7: tail -f — warns
+OUT=$(run_hook '{"tool_input":{"command":"tail -f /var/log/syslog"}}')
+assert_contains "tail -f warns" "$OUT" "tail -f"
+assert_contains "tail -f suggests one-shot" "$OUT" "one-shot"
+
+# Test 8: tail -n (one-shot) — silent pass
+OUT=$(run_hook '{"tool_input":{"command":"tail -n 100 /var/log/syslog"}}')
+assert_not_contains "tail -n no warning" "$OUT" "WARNING"
+
+# Test 9: dmesg — warns
+OUT=$(run_hook '{"tool_input":{"command":"dmesg"}}')
+assert_contains "dmesg warns" "$OUT" "dmesg"
+
+# Test 10: dmesg | tail — silent pass
+OUT=$(run_hook '{"tool_input":{"command":"dmesg | tail -100"}}')
+assert_not_contains "dmesg | tail no warning" "$OUT" "WARNING"
+
+# Test 11: journalctl without -n — warns
+OUT=$(run_hook '{"tool_input":{"command":"journalctl"}}')
+assert_contains "journalctl warns" "$OUT" "journalctl without"
+
+# Test 12: journalctl -n 100 — silent pass
+OUT=$(run_hook '{"tool_input":{"command":"journalctl -n 100"}}')
+assert_not_contains "journalctl -n no warning" "$OUT" "WARNING"
+
+# Test 13: git log without -n — warns
+OUT=$(run_hook '{"tool_input":{"command":"git log"}}')
+assert_contains "git log warns" "$OUT" "git log"
+
+# Test 14: git log --oneline — silent pass
+OUT=$(run_hook '{"tool_input":{"command":"git log --oneline"}}')
+assert_not_contains "git log --oneline no warning" "$OUT" "WARNING"
+
+# Test 15: git log -10 — silent pass
+OUT=$(run_hook '{"tool_input":{"command":"git log -10"}}')
+assert_not_contains "git log -10 no warning" "$OUT" "WARNING"
+
+# Test 16: npm ls -a — warns
+OUT=$(run_hook '{"tool_input":{"command":"npm ls -a"}}')
+assert_contains "npm ls -a warns" "$OUT" "npm ls"
+
+# Test 17: pip list — warns
+OUT=$(run_hook '{"tool_input":{"command":"pip list"}}')
+assert_contains "pip list warns" "$OUT" "pip list"
+
+# Test 18: pip list | grep — silent pass
+OUT=$(run_hook '{"tool_input":{"command":"pip list | grep claude"}}')
+assert_not_contains "pip list | grep no warning" "$OUT" "WARNING"
+
+# Test 19: docker logs without --tail — warns
+OUT=$(run_hook '{"tool_input":{"command":"docker logs mycontainer"}}')
+assert_contains "docker logs warns" "$OUT" "docker logs"
+
+# Test 20: docker logs --tail 200 — silent pass
+OUT=$(run_hook '{"tool_input":{"command":"docker logs --tail 200 mycontainer"}}')
+assert_not_contains "docker logs --tail no warning" "$OUT" "WARNING"
+
+# Test 21: BLOCK_MODE upgrade — find / blocks
+RC=$(CC_TOOL_RESULT_BLOCK=1 sh -c "echo '{\"tool_input\":{\"command\":\"find / -name foo\"}}' | bash $HOOK > /dev/null 2>&1; echo \$?")
+assert_exit "BLOCK_MODE find / blocks with exit 2" "$RC" "2"
+
+# Test 22: BLOCK_MODE harmless still passes
+RC=$(CC_TOOL_RESULT_BLOCK=1 sh -c "echo '{\"tool_input\":{\"command\":\"ls -la\"}}' | bash $HOOK > /dev/null 2>&1; echo \$?")
+assert_exit "BLOCK_MODE harmless passes" "$RC" "0"
+
+# Test 23: SKIP pattern — find / skipped
+OUT=$(CC_TOOL_RESULT_GUARD_SKIP=find sh -c "echo '{\"tool_input\":{\"command\":\"find / -name foo\"}}' | bash $HOOK 2>&1")
+assert_not_contains "SKIP find suppresses warning" "$OUT" "find / or find ~"
+
+# Test 24: Invalid JSON — silent pass (no crash)
+RC=$(echo 'not json' | bash "$HOOK" > /dev/null 2>&1; echo $?)
+assert_exit "invalid JSON exit 0" "$RC" "0"
+
+echo ""
+echo "PASS: $PASS / $((PASS+FAIL))"
+[ "$FAIL" -eq 0 ] || exit 1