cc-safe-setup 29.8.0 → 30.0.4

package/tests/test-cache-tier-logger.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+# Tests for cache-tier-logger.sh
+HOOK="examples/cache-tier-logger.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3' in: $2)"; fi; }
+assert_exit() { if [ "$2" -eq "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (exit $2, expected $3)"; fi; }
+assert_file_contains() { if grep -q "$3" "$2" 2>/dev/null; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3' in $2)"; fi; }
+
+LOG="${HOME}/.claude/logs/cache-tier.log"
+mkdir -p "${HOME}/.claude/logs"
+: > "$LOG"
+
+# Test 1: cache_hit tier logged when cache_read_input_tokens present
+PAYLOAD='{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":5000,"cache_creation_input_tokens":0}}}'
+OUT=$(printf '%s' "$PAYLOAD" | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "cache_hit path exits 0" "$RC" 0
+assert_file_contains "cache_hit logged" "$LOG" "cache_hit"
+assert_file_contains "session_id logged" "$LOG" "s1"
+assert_file_contains "tool_name logged" "$LOG" "Read"
+assert_file_contains "cache_read value logged" "$LOG" "5000"
+
+# Test 2: cache_miss tier when only cache_creation_input_tokens present
+: > "$LOG"
+PAYLOAD='{"session_id":"s2","tool_name":"Edit","tool_response":{"usage":{"cache_read_input_tokens":0,"cache_creation_input_tokens":12000}}}'
+printf '%s' "$PAYLOAD" | bash "$HOOK"
+assert_file_contains "cache_miss logged" "$LOG" "cache_miss"
+assert_file_contains "creation value logged" "$LOG" "12000"
+
+# Test 3: no_cache_data when neither field is present
+: > "$LOG"
+PAYLOAD='{"session_id":"s3","tool_name":"Bash","tool_response":{}}'
+printf '%s' "$PAYLOAD" | bash "$HOOK"
+assert_file_contains "no_cache_data logged" "$LOG" "no_cache_data"
+
+# Test 4: transcript fallback when tool_response.usage is empty
+TRANS=$(mktemp)
+printf '{"type":"assistant","message":{"usage":{"cache_read_input_tokens":9999,"cache_creation_input_tokens":1}}}\n' >> "$TRANS"
+: > "$LOG"
+PAYLOAD=$(printf '{"session_id":"s4","tool_name":"Read","transcript_path":"%s","tool_response":{}}' "$TRANS")
+printf '%s' "$PAYLOAD" | bash "$HOOK"
+assert_file_contains "fallback reads transcript usage" "$LOG" "9999"
+rm -f "$TRANS"
+
+# Test 5: exit 0 even when jq encounters malformed input (robustness)
+OUT=$(printf 'not-json' | bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "malformed input still exits 0" "$RC" 0
+
+# Test 6: TSV format (exactly 6 tab-separated fields)
+: > "$LOG"
+PAYLOAD='{"session_id":"s6","tool_name":"Grep","tool_response":{"usage":{"cache_read_input_tokens":100,"cache_creation_input_tokens":0}}}'
+printf '%s' "$PAYLOAD" | bash "$HOOK"
+FIELDS=$(awk -F'\t' '{print NF}' "$LOG" | head -1)
+if [ "$FIELDS" = "6" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: expected 6 TSV fields, got $FIELDS"; fi
+
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/test-cache-ttl-eviction-detector.sh

@@ -0,0 +1,282 @@
+#!/bin/bash
+# Tests for cache-ttl-eviction-detector.sh
+HOOK="$(dirname "$0")/../examples/cache-ttl-eviction-detector.sh"
+PASS=0
+FAIL=0
+
+mktempd() {
+  mktemp -d "${TMPDIR:-/tmp}/cc-ttl-test.XXXXXX"
+}
+
+run_test() {
+  local desc="$1"
+  local result="$2"
+  if [ "$result" = "pass" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+echo "Testing cache-ttl-eviction-detector.sh"
+echo "======================================"
+
+# Test 1: empty payload, no usage → silent exit, no state
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+echo '{"session_id":"s1","tool_name":"Read"}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>/dev/null
+if [ ! -f "$STATE" ] && [ ! -f "$LOG" ]; then
+  run_test "empty payload → no state/log written" "pass"
+else
+  run_test "empty payload → no state/log written" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 2: first event writes state but does not alert (no previous gap to measure)
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+out=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":1000,"cache_creation_input_tokens":100}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>&1)
+if [ -f "$STATE" ] && [ ! -f "$LOG" ] && [ -z "$out" ]; then
+  run_test "first event writes state, no alert" "pass"
+else
+  run_test "first event writes state, no alert" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 3: short gap (under threshold) → no alert even with low hit ratio
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+NOW=$(date -u +%s)
+RECENT=$((NOW - 60))
+printf '{"last_event_ts":%s,"last_session":"s1"}\n' "$RECENT" > "$STATE"
+out=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":0,"cache_creation_input_tokens":50000}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>&1)
+if [ ! -f "$LOG" ] && [ -z "$out" ]; then
+  run_test "short gap (60s) → no alert" "pass"
+else
+  run_test "short gap (60s) → no alert (got: $out)" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 4: long gap + low hit ratio → alert
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+NOW=$(date -u +%s)
+LONG_AGO=$((NOW - 600))
+printf '{"last_event_ts":%s,"last_session":"s1"}\n' "$LONG_AGO" > "$STATE"
+out=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":0,"cache_creation_input_tokens":50000}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>&1)
+if [ -f "$LOG" ] && echo "$out" | grep -q "probable prompt-cache TTL eviction"; then
+  run_test "long gap (10min) + 0% hit → alert" "pass"
+else
+  run_test "long gap (10min) + 0% hit → alert (got: $out)" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 5: long gap + high hit ratio → no alert (cache survived somehow)
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+NOW=$(date -u +%s)
+LONG_AGO=$((NOW - 600))
+printf '{"last_event_ts":%s,"last_session":"s1"}\n' "$LONG_AGO" > "$STATE"
+out=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":80000,"cache_creation_input_tokens":1000}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>&1)
+if [ ! -f "$LOG" ] && [ -z "$out" ]; then
+  run_test "long gap + 99% hit → no alert" "pass"
+else
+  run_test "long gap + 99% hit → no alert (got: $out)" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 6: cross-session gap → no alert (session boundary, not TTL eviction)
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+NOW=$(date -u +%s)
+LONG_AGO=$((NOW - 600))
+printf '{"last_event_ts":%s,"last_session":"old_session"}\n' "$LONG_AGO" > "$STATE"
+out=$(echo '{"session_id":"new_session","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":0,"cache_creation_input_tokens":50000}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>&1)
+if [ ! -f "$LOG" ] && [ -z "$out" ]; then
+  run_test "cross-session gap → no alert" "pass"
+else
+  run_test "cross-session gap → no alert (got: $out)" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 7: silent mode → log written, no stderr
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+NOW=$(date -u +%s)
+LONG_AGO=$((NOW - 600))
+printf '{"last_event_ts":%s,"last_session":"s1"}\n' "$LONG_AGO" > "$STATE"
+out=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":0,"cache_creation_input_tokens":50000}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" CC_TTL_EVICT_SILENT=1 bash "$HOOK" 2>&1)
+if [ -f "$LOG" ] && [ -z "$out" ]; then
+  run_test "silent mode → log only, no stderr" "pass"
+else
+  run_test "silent mode → log only, no stderr (got: $out)" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 8: custom gap threshold (180s) → 200s gap triggers (above 180s)
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+NOW=$(date -u +%s)
+AGO=$((NOW - 200))
+printf '{"last_event_ts":%s,"last_session":"s1"}\n' "$AGO" > "$STATE"
+out=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":0,"cache_creation_input_tokens":50000}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" CC_TTL_EVICT_GAP_SECONDS=180 bash "$HOOK" 2>&1)
+if [ -f "$LOG" ] && echo "$out" | grep -q "TTL eviction"; then
+  run_test "custom gap threshold (180s) → triggers at 200s gap" "pass"
+else
+  run_test "custom gap threshold → triggers at 200s gap (got: $out)" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 9: custom hit floor (0.80) → 60% hit triggers (below 80%)
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+NOW=$(date -u +%s)
+LONG_AGO=$((NOW - 600))
+printf '{"last_event_ts":%s,"last_session":"s1"}\n' "$LONG_AGO" > "$STATE"
+# cache_read=60000, cache_creation=40000 → hit ratio = 0.60
+out=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":60000,"cache_creation_input_tokens":40000}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" CC_TTL_EVICT_HIT_FLOOR=0.80 bash "$HOOK" 2>&1)
+if [ -f "$LOG" ] && echo "$out" | grep -q "TTL eviction"; then
+  run_test "custom hit floor (0.80) → triggers at 60% hit" "pass"
+else
+  run_test "custom hit floor → triggers at 60% hit (got: $out)" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 10: malformed state file → exit cleanly, write fresh state
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+echo "not json" > "$STATE"
+echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":1000,"cache_creation_input_tokens":100}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>/dev/null
+if grep -q '"last_event_ts"' "$STATE" 2>/dev/null; then
+  run_test "malformed state → recovers, writes fresh state" "pass"
+else
+  run_test "malformed state → recovers, writes fresh state" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 11: zero usage values (cache_read=0, cache_creation=0) → exit silently
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":0,"cache_creation_input_tokens":0}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>/dev/null
+if [ ! -f "$STATE" ] && [ ! -f "$LOG" ]; then
+  run_test "zero usage values → exit silently" "pass"
+else
+  run_test "zero usage values → exit silently" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 12: transcript fallback when payload missing usage
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+TRANSCRIPT="$TEST_DIR/transcript.jsonl"
+NOW=$(date -u +%s)
+LONG_AGO=$((NOW - 600))
+printf '{"last_event_ts":%s,"last_session":"s1"}\n' "$LONG_AGO" > "$STATE"
+# create a transcript with usage at the end
+echo '{"message":{"usage":{"cache_read_input_tokens":0,"cache_creation_input_tokens":50000}}}' > "$TRANSCRIPT"
+out=$(printf '{"session_id":"s1","tool_name":"Read","transcript_path":"%s"}' "$TRANSCRIPT" | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>&1)
+if [ -f "$LOG" ] && echo "$out" | grep -q "TTL eviction"; then
+  run_test "transcript fallback → reads usage from transcript" "pass"
+else
+  run_test "transcript fallback (got: $out)" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 13: state updates between events (regression-style)
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+# First event
+echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":1000,"cache_creation_input_tokens":100}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>/dev/null
+TS1=$(jq -r '.last_event_ts' "$STATE" 2>/dev/null)
+# Second event with same session
+sleep 1
+echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":1500,"cache_creation_input_tokens":80}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>/dev/null
+TS2=$(jq -r '.last_event_ts' "$STATE" 2>/dev/null)
+if [ -n "$TS1" ] && [ -n "$TS2" ] && [ "$TS2" -gt "$TS1" ]; then
+  run_test "state updates between events" "pass"
+else
+  run_test "state updates between events (ts1=$TS1 ts2=$TS2)" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 14: shellcheck (if available)
+if command -v shellcheck >/dev/null 2>&1; then
+  if shellcheck "$HOOK" 2>&1; then
+    run_test "shellcheck clean" "pass"
+  else
+    run_test "shellcheck clean" "fail"
+  fi
+else
+  echo "  SKIP: shellcheck not installed"
+fi
+
+# Test 15: hook is executable
+if [ -x "$HOOK" ]; then
+  run_test "hook script is executable" "pass"
+else
+  run_test "hook script is executable" "fail"
+fi
+
+# Test 16: hook handles missing tool_response key
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+echo '{"session_id":"s1","tool_name":"Read"}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>/dev/null
+if [ ! -f "$STATE" ] && [ ! -f "$LOG" ]; then
+  run_test "missing tool_response → exit silently" "pass"
+else
+  run_test "missing tool_response → exit silently" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+# Test 17: very long gap (1 hour) records correctly
+TEST_DIR=$(mktempd)
+STATE="$TEST_DIR/state.json"
+LOG="$TEST_DIR/evictions.jsonl"
+NOW=$(date -u +%s)
+ONE_HOUR_AGO=$((NOW - 3600))
+printf '{"last_event_ts":%s,"last_session":"s1"}\n' "$ONE_HOUR_AGO" > "$STATE"
+out=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"cache_read_input_tokens":0,"cache_creation_input_tokens":50000}}}' | \
+  CC_TTL_EVICT_STATE="$STATE" CC_TTL_EVICT_LOG="$LOG" bash "$HOOK" 2>&1)
+gap_logged=$(jq -r '.gap_seconds' "$LOG" 2>/dev/null)
+if [ -n "$gap_logged" ] && [ "$gap_logged" -ge 3600 ]; then
+  run_test "1-hour gap recorded in log" "pass"
+else
+  run_test "1-hour gap recorded in log (got gap=$gap_logged)" "fail"
+fi
+rm -rf "$TEST_DIR"
+
+echo ""
+echo "========================================"
+echo "Total: $((PASS + FAIL))    Pass: $PASS    Fail: $FAIL"
+[ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/test-cch-sentinel-precommit-guard.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# Tests for cch-sentinel-precommit-guard.sh
+# This guard depends on `git diff --cached`, so we stage/unstage real files in
+# a throw-away repo.
+set -u
+HOOK_ABS="$(pwd)/examples/cch-sentinel-precommit-guard.sh"
+PASS=0 FAIL=0
+
+assert_exit() { if [ "$2" -eq "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (exit $2, expected $3)"; fi; }
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3' in: $2)"; fi; }
+
+TMPREPO=$(mktemp -d)
+trap 'rm -rf "$TMPREPO"' EXIT
+cd "$TMPREPO" || exit 1
+git init -q
+git config user.email "t@t.test"
+git config user.name "t"
+git commit --allow-empty -m init -q
+
+# Test 1: Clean staged diff passes
+echo "clean text" > file1.txt
+git add file1.txt
+OUT=$(bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_exit "clean diff exits 0" "$RC" 0
+
+# Test 2: Sentinel in staged diff blocks commit
+git reset -q
+echo "some code with cch=00000 inside it" > bad.txt
+git add bad.txt
+OUT=$(bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_exit "sentinel blocks commit" "$RC" 1
+assert_contains "warning names the string" "$OUT" "cch=00000"
+assert_contains "warning references Incident 3" "$OUT" "Incident 3"
+
+# Test 3: Sentinel in allowed docs path passes
+git reset -q
+mkdir -p docs
+echo "docs: the sentinel literal is cch=00000" > docs/incident3.md
+git add docs/incident3.md
+OUT=$(CCH_ALLOW_PATHS="docs/" bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_exit "allowed path passes" "$RC" 0
+
+# Test 4: Sentinel in non-allowed path still blocks even with allowlist set
+git reset -q
+echo "cch=00000" > src.sh
+git add src.sh
+OUT=$(CCH_ALLOW_PATHS="docs/" bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_exit "non-allowlisted sentinel blocks" "$RC" 1
+
+# Test 5: Partial match of sentinel (e.g. cch=00000abc) — spec says literal
+# substring, so this should still block (substring match is the bug surface).
+git reset -q
+echo "prefix cch=000001 suffix" > partial.txt
+git add partial.txt
+OUT=$(bash "$HOOK_ABS" 2>&1)
+RC=$?
+assert_exit "substring match blocks" "$RC" 1
+
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/test-claim-verify-detector.sh

@@ -0,0 +1,222 @@
+#!/bin/bash
+# Test for claim-verify-detector.sh
+#
+# Builds a synthetic transcript (.jsonl) for each case so the hook reads a
+# realistic last-assistant message and emits warnings only when decisive
+# language appears without supporting evidence.
+
+set -u
+
+HOOK="$(dirname "$0")/../examples/claim-verify-detector.sh"
+[ ! -x "$HOOK" ] && chmod +x "$HOOK"
+
+PASS=0
+FAIL=0
+TMPDIR=$(mktemp -d)
+trap 'rm -rf "$TMPDIR"' EXIT
+
+# Build a one-line jsonl transcript whose latest assistant message contains
+# the supplied text. Returns the path to the file.
+make_transcript() {
+    local text="$1"
+    local path="$TMPDIR/transcript-$$-$RANDOM.jsonl"
+    jq -nc --arg t "$text" '{
+        type: "user",
+        message: { role: "user", content: [{type:"text", text:"do the thing"}] }
+    }' > "$path"
+    jq -nc --arg t "$text" '{
+        type: "assistant",
+        message: { role: "assistant", content: [{type:"text", text:$t}] }
+    }' >> "$path"
+    printf '%s' "$path"
+}
+
+run_case() {
+    local name="$1"
+    local text="$2"
+    local expect_warn="$3"  # "yes" or "no"
+    local strict="${4:-0}"
+    local skip="${5:-0}"
+
+    local transcript
+    transcript=$(make_transcript "$text")
+    local input
+    input=$(jq -nc --arg p "$transcript" '{transcript_path:$p, session_id:"test"}')
+
+    local stderr rc env
+    env=""
+    [ "$strict" = "1" ] && env="CC_CLAIM_VERIFY_BLOCK=1 "
+    [ "$skip" = "1" ] && env="${env}CC_CLAIM_VERIFY_SKIP=1 "
+    stderr=$(echo "$input" | env $env "$HOOK" 2>&1 >/dev/null)
+    rc=$?
+
+    if [ "$expect_warn" = "yes" ]; then
+        if [ -n "$stderr" ]; then
+            PASS=$((PASS + 1))
+            echo "PASS: $name"
+        else
+            FAIL=$((FAIL + 1))
+            echo "FAIL: $name (expected warning, got none)"
+        fi
+        if [ "$strict" = "1" ]; then
+            if [ "$rc" = "2" ]; then
+                PASS=$((PASS + 1))
+                echo "PASS: $name (strict, exit 2)"
+            else
+                FAIL=$((FAIL + 1))
+                echo "FAIL: $name (strict, expected exit 2, got $rc)"
+            fi
+        fi
+    else
+        if [ -z "$stderr" ]; then
+            PASS=$((PASS + 1))
+            echo "PASS: $name"
+        else
+            FAIL=$((FAIL + 1))
+            echo "FAIL: $name (expected silence, got: $stderr)"
+        fi
+    fi
+}
+
+run_input_case() {
+    local name="$1"
+    local input="$2"
+    local expect_warn="$3"
+
+    local stderr
+    stderr=$(echo "$input" | "$HOOK" 2>&1 >/dev/null)
+
+    if [ "$expect_warn" = "yes" ]; then
+        if [ -n "$stderr" ]; then
+            PASS=$((PASS + 1))
+            echo "PASS: $name"
+        else
+            FAIL=$((FAIL + 1))
+            echo "FAIL: $name (expected warning, got none)"
+        fi
+    else
+        if [ -z "$stderr" ]; then
+            PASS=$((PASS + 1))
+            echo "PASS: $name"
+        else
+            FAIL=$((FAIL + 1))
+            echo "FAIL: $name (expected silence, got: $stderr)"
+        fi
+    fi
+}
+
+# ---- decisive-without-evidence cases (should warn) ----
+
+run_case "EN: bare 'verified'" \
+    "I have verified the change." "yes"
+
+run_case "EN: bare 'fixed'" \
+    "The bug is fixed." "yes"
+
+run_case "EN: bare 'completed'" \
+    "Task completed." "yes"
+
+run_case "EN: bare 'logged out'" \
+    "You have been successfully logged out." "yes"
+
+run_case "EN: 'no data loss' alone" \
+    "No data loss occurred." "yes"
+
+run_case "EN: 'guaranteed'" \
+    "This is guaranteed to work." "yes"
+
+run_case "EN: '#57288 style claim'" \
+    "100% guaranteed: this position cannot fail." "yes"
+
+run_case "EN: 'safe to deploy'" \
+    "It is safe to deploy now." "yes"
+
+run_case "JP: 直った single" \
+    "問題は直った。" "yes"
+
+run_case "JP: 修正した single" \
+    "issue を修正した。" "yes"
+
+run_case "JP: 確認した single" \
+    "全件確認した。" "yes"
+
+run_case "JP: 完了した single" \
+    "作業を完了した。" "yes"
+
+run_case "JP: 終了した single" \
+    "セッションを終了した。" "yes"
+
+run_case "JP: 絶対に失敗しない" \
+    "絶対に失敗しない設計だ。" "yes"
+
+run_case "JP: 動作の確認 alone" \
+    "動作の確認はもう済んだ。" "yes"
+
+# ---- decisive WITH evidence (should stay silent) ----
+
+run_case "EN: verified + ran" \
+    "Verified — I ran the test suite and exit code was 0." "no"
+
+run_case "EN: fixed + log shows" \
+    "Fixed. The log shows the request returning 200." "no"
+
+run_case "EN: completed + output was" \
+    "Completed. Output was: 'all rows updated, 0 errors'." "no"
+
+run_case "EN: confirmed + screenshot" \
+    "Confirmed via screenshot at /tmp/check.png." "no"
+
+run_case "EN: working + measured" \
+    "Working: I measured response latency at 24ms." "no"
+
+run_case "JP: 修正した + 実行した" \
+    "修正した。テストを実行した結果、 全件 OK だった。" "no"
+
+run_case "JP: 確認した + ログは" \
+    "確認した。ログは 200 を返している。" "no"
+
+run_case "JP: 完了した + 出力は" \
+    "完了した。出力は 'success' だった。" "no"
+
+run_case "JP: 検証した + 計測した" \
+    "検証した。計測の結果、 1.2 秒だった。" "no"
+
+# ---- no decisive language (should stay silent) ----
+
+run_case "EN: descriptive only" \
+    "I added a new function and ran the tests." "no"
+
+run_case "EN: question reply" \
+    "The function lives in src/utils.ts and takes one argument." "no"
+
+run_case "JP: 単なる説明" \
+    "新しい関数を src/utils.ts に追加した。" "no"
+
+run_case "JP: 状態の報告" \
+    "現状の試験の数は 30 件。" "no"
+
+run_case "EN: empty assistant" \
+    "" "no"
+
+# ---- environment / input-shape edge cases ----
+
+run_case "skip flag silences" \
+    "Verified — but skip flag set." "no" "0" "1"
+
+run_case "strict mode, decisive only -> exit 2" \
+    "Fixed." "yes" "1"
+
+run_input_case "missing transcript_path field" \
+    '{"session_id":"x"}' "no"
+
+run_input_case "transcript_path empty" \
+    '{"transcript_path":"","session_id":"x"}' "no"
+
+run_input_case "transcript_path nonexistent" \
+    '{"transcript_path":"/tmp/does-not-exist-claim-verify.jsonl","session_id":"x"}' "no"
+
+# ---- summary ----
+
+echo ""
+echo "RESULT: $PASS passed, $FAIL failed."
+[ "$FAIL" = "0" ]