cc-safe-setup 29.8.0 → 30.0.4

package/tests/test-claude-md-size-monitor.sh

@@ -0,0 +1,107 @@
+set -u
+HOOK="$(dirname "$0")/../examples/claude-md-size-monitor.sh"
+PASS=0
+FAIL=0
+TMP=$(mktemp -d /tmp/test-md-size.XXXXXX)
+trap 'rm -rf "$TMP"' EXIT
+assert_no_output() {
+    local desc="$1"
+    local output="$2"
+    if [ -z "$output" ]; then
+        echo "  PASS: $desc"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc — unexpected output: $output"
+        FAIL=$((FAIL + 1))
+    fi
+}
+assert_contains() {
+    local desc="$1"
+    local output="$2"
+    local needle="$3"
+    if echo "$output" | grep -q "$needle"; then
+        echo "  PASS: $desc"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc — expected '$needle' in output: $output"
+        FAIL=$((FAIL + 1))
+    fi
+}
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/missing.md" bash "$HOOK")
+assert_no_output "missing file produces no output" "$output"
+> "$TMP/empty.md"
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/empty.md" bash "$HOOK")
+assert_no_output "empty file produces no output" "$output"
+echo "Hello, this is a short CLAUDE.md" > "$TMP/small.md"
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/small.md" bash "$HOOK")
+assert_no_output "small file under budget produces no output" "$output"
+python3 -c "print('x' * 30000)" > "$TMP/large.md"
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/large.md" CC_CLAUDE_MD_TOKEN_BUDGET=1000 bash "$HOOK")
+assert_contains "large file over budget triggers warning" "$output" "budget exceeded"
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/large.md" CC_CLAUDE_MD_TOKEN_BUDGET=1000 bash "$HOOK")
+assert_contains "warning includes character count" "$output" "30001 chars"
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/large.md" CC_CLAUDE_MD_TOKEN_BUDGET=1000 bash "$HOOK")
+assert_contains "warning includes tokens" "$output" "tokens"
+printf 'a%.0s' {1..4000} > "$TMP/multi-a.md"
+printf 'b%.0s' {1..5000} > "$TMP/multi-b.md"
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/multi-a.md:$TMP/multi-b.md" CC_CLAUDE_MD_TOKEN_BUDGET=2000 bash "$HOOK")
+assert_contains "combined files trigger warning" "$output" "budget exceeded"
+assert_contains "breakdown lists first file" "$output" "multi-a.md"
+assert_contains "breakdown lists second file" "$output" "multi-b.md"
+printf 'a%.0s' {1..500} > "$TMP/tiny-a.md"
+printf 'b%.0s' {1..500} > "$TMP/tiny-b.md"
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/tiny-a.md:$TMP/tiny-b.md" CC_CLAUDE_MD_TOKEN_BUDGET=2000 bash "$HOOK")
+assert_no_output "small combined files produce no output" "$output"
+python3 -c "print('y' * 10000)" > "$TMP/cpt.md"
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/cpt.md" CC_CLAUDE_MD_CHARS_PER_TOKEN=100 bash "$HOOK")
+assert_no_output "high chars-per-token override avoids warning" "$output"
+echo '{}' | CC_CLAUDE_MD_FILES="$TMP/large.md" CC_CLAUDE_MD_TOKEN_BUDGET=1000 bash "$HOOK" > /dev/null
+exit_code=$?
+if [ "$exit_code" -eq 0 ]; then
+    echo "  PASS: hook exits 0 even with findings"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: hook should exit 0, got $exit_code"
+    FAIL=$((FAIL + 1))
+fi
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/large.md" CC_CLAUDE_MD_TOKEN_BUDGET=1000 bash "$HOOK")
+if echo "$output" | jq empty 2>/dev/null; then
+    echo "  PASS: output is valid JSON"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: output should be valid JSON: $output"
+    FAIL=$((FAIL + 1))
+fi
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/large.md" CC_CLAUDE_MD_TOKEN_BUDGET=1000 bash "$HOOK")
+ctx=$(echo "$output" | jq -r '.hookSpecificOutput.additionalContext // empty')
+if [ -n "$ctx" ]; then
+    echo "  PASS: JSON has hookSpecificOutput.additionalContext"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: JSON should have additionalContext: $output"
+    FAIL=$((FAIL + 1))
+fi
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/large.md" CC_CLAUDE_MD_TOKEN_BUDGET=1000 bash "$HOOK")
+event=$(echo "$output" | jq -r '.hookSpecificOutput.hookEventName // empty')
+if [ "$event" = "SessionStart" ]; then
+    echo "  PASS: hookEventName is SessionStart"
+    PASS=$((PASS + 1))
+else
+    echo "  FAIL: hookEventName should be SessionStart, got '$event'"
+    FAIL=$((FAIL + 1))
+fi
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/large.md" CC_CLAUDE_MD_TOKEN_BUDGET=1000 bash "$HOOK")
+assert_contains "warning includes self-tuning suggestion" "$output" "CC_CLAUDE_MD_TOKEN_BUDGET="
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/large.md" CC_CLAUDE_MD_TOKEN_BUDGET=1000 bash "$HOOK")
+assert_contains "warning links to issue 42796" "$output" "42796"
+echo "content" > "$TMP/unreadable.md"
+chmod 000 "$TMP/unreadable.md" 2>/dev/null
+output=$(echo '{}' | CC_CLAUDE_MD_FILES="$TMP/unreadable.md" CC_CLAUDE_MD_TOKEN_BUDGET=1 bash "$HOOK" 2>/dev/null)
+chmod 644 "$TMP/unreadable.md" 2>/dev/null
+assert_no_output "unreadable file is skipped" "$output"
+echo ""
+echo "=============================="
+echo "Tests passed: $PASS"
+echo "Tests failed: $FAIL"
+echo "=============================="
+[ "$FAIL" -eq 0 ]

package/tests/test-claude-update-budget-guard.sh

@@ -0,0 +1,132 @@
+#!/bin/bash
+# Tests for claude-update-budget-guard.sh
+HOOK="examples/claude-update-budget-guard.sh"
+PASS=0 FAIL=0
+
+assert_exit() {
+  if [ "$2" -eq "$3" ]; then
+    PASS=$((PASS+1))
+  else
+    FAIL=$((FAIL+1)); echo "FAIL: $1 (exit $2, expected $3)"
+  fi
+}
+assert_contains() {
+  if printf '%s' "$2" | grep -q "$3"; then
+    PASS=$((PASS+1))
+  else
+    FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3' in: $2)"
+  fi
+}
+assert_not_contains() {
+  if printf '%s' "$2" | grep -q "$3"; then
+    FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3' in: $2)"
+  else
+    PASS=$((PASS+1))
+  fi
+}
+
+FIXTURE=$(mktemp)
+trap 'rm -f "$FIXTURE"' EXIT
+
+# Test 1: Non-Bash tool — pass through silently
+OUT=$(printf '{"tool_name":"Read","tool_input":{"file_path":"/tmp/x"}}' | bash "$HOOK" 2>&1)
+assert_exit "non-Bash tool exits 0" $? 0
+assert_not_contains "non-Bash has no banner" "$OUT" "claude-update-budget-guard"
+
+# Test 2: Unrelated Bash command — pass through silently
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"ls -la"}}' | bash "$HOOK" 2>&1)
+assert_exit "unrelated bash exits 0" $? 0
+assert_not_contains "unrelated has no banner" "$OUT" "claude-update-budget-guard"
+
+# Test 3: `echo about claude update later` — word boundary means this *does*
+# match (whitespace before `claude` and `update` after). That's correct: if a
+# user is literally about to `echo`, we still accept it as harmless. The real
+# false-positive to prevent is a hyphenated prefix — covered in test 11.
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"echo hello"}}' | bash "$HOOK" 2>&1)
+assert_exit "plain echo passes through" $? 0
+
+# Test 4: `claude update` with a failing probe → fallthrough warn, exit 0
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"claude update"}}' | \
+  CLAUDE_UPDATE_USAGE_CMD='false' bash "$HOOK" 2>&1)
+assert_exit "no probe fallthrough exits 0" $? 0
+assert_contains "no probe warns" "$OUT" "Cannot read /usage"
+assert_contains "no probe references issue" "$OUT" "52890"
+
+# Test 5: `claude self-update` — detected same way
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"claude self-update"}}' | \
+  CLAUDE_UPDATE_USAGE_CMD='false' bash "$HOOK" 2>&1)
+assert_exit "self-update detected" $? 0
+assert_contains "self-update shows banner" "$OUT" "claude-update-budget-guard"
+
+# Test 6: Quota tight (10% remaining, threshold 30) + MODE=warn (default) → exit 0 with warning
+printf '{"five_hour":{"remaining_percent":10}}' > "$FIXTURE"
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"claude update"}}' | \
+  CLAUDE_UPDATE_USAGE_CMD="cat $FIXTURE" \
+  CLAUDE_UPDATE_BUDGET_THRESHOLD=30 \
+  bash "$HOOK" 2>&1)
+assert_exit "quota tight warn exits 0" $? 0
+assert_contains "quota tight banner" "$OUT" "5-hour quota remaining: 10%"
+assert_contains "quota tight suggests skip" "$OUT" "skip until the next 5h reset"
+
+# Test 7: Quota tight + MODE=block → exit 2
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"claude update"}}' | \
+  CLAUDE_UPDATE_USAGE_CMD="cat $FIXTURE" \
+  CLAUDE_UPDATE_BUDGET_THRESHOLD=30 \
+  CLAUDE_UPDATE_BUDGET_MODE=block \
+  bash "$HOOK" 2>&1)
+assert_exit "quota tight block exits 2" $? 2
+assert_contains "block also shows reason" "$OUT" "10%"
+
+# Test 8: Quota OK (80% remaining) → exit 0, informational note
+printf '{"five_hour":{"remaining_percent":80}}' > "$FIXTURE"
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"claude update"}}' | \
+  CLAUDE_UPDATE_USAGE_CMD="cat $FIXTURE" \
+  CLAUDE_UPDATE_BUDGET_THRESHOLD=30 \
+  bash "$HOOK" 2>&1)
+assert_exit "quota OK exits 0" $? 0
+assert_contains "quota OK info banner" "$OUT" "info"
+assert_contains "quota OK shows remaining" "$OUT" "remaining: 80%"
+
+# Test 9: Alternative JSON shape (camelCase) supported
+printf '{"fiveHour":{"remainingPercent":15}}' > "$FIXTURE"
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"claude update"}}' | \
+  CLAUDE_UPDATE_USAGE_CMD="cat $FIXTURE" \
+  CLAUDE_UPDATE_BUDGET_THRESHOLD=30 \
+  bash "$HOOK" 2>&1)
+assert_exit "camelCase shape exits 0" $? 0
+assert_contains "camelCase parsed" "$OUT" "15%"
+
+# Test 10: Compound command `git commit && claude update` — detected
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"git commit -m x && claude update"}}' | \
+  CLAUDE_UPDATE_USAGE_CMD='false' \
+  bash "$HOOK" 2>&1)
+assert_exit "compound detected" $? 0
+assert_contains "compound shows banner" "$OUT" "claude-update-budget-guard"
+
+# Test 11: False positive guard — `my-claude update` must NOT trigger
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"my-claude update"}}' | bash "$HOOK" 2>&1)
+assert_exit "my-claude passes through" $? 0
+assert_not_contains "hyphen prefix no trigger" "$OUT" "claude-update-budget-guard"
+
+# Test 12: Empty input — exit 0 silently
+OUT=$(printf '' | bash "$HOOK" 2>&1)
+assert_exit "empty input exits 0" $? 0
+
+# Test 13: Default MODE (warn) does not block even at 0%
+printf '{"five_hour":{"remaining_percent":0}}' > "$FIXTURE"
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"claude update"}}' | \
+  CLAUDE_UPDATE_USAGE_CMD="cat $FIXTURE" \
+  bash "$HOOK" 2>&1)
+assert_exit "default MODE never blocks" $? 0
+
+# Test 14: Threshold override via env (set to 5 means 10% is above → exit 0 info)
+printf '{"five_hour":{"remaining_percent":10}}' > "$FIXTURE"
+OUT=$(printf '{"tool_name":"Bash","tool_input":{"command":"claude update"}}' | \
+  CLAUDE_UPDATE_USAGE_CMD="cat $FIXTURE" \
+  CLAUDE_UPDATE_BUDGET_THRESHOLD=5 \
+  bash "$HOOK" 2>&1)
+assert_exit "threshold override exits 0" $? 0
+assert_contains "threshold override above" "$OUT" "above threshold"
+
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/test-claude-update-smart.sh

@@ -0,0 +1,91 @@
+#!/bin/bash
+# Tests for claude-update-smart.sh
+HOOK="examples/claude-update-smart.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3' in: $2)"; fi; }
+assert_exit() { if [ "$2" -eq "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (exit $2, expected $3)"; fi; }
+
+TMPCACHE=$(mktemp)
+rm -f "$TMPCACHE"
+export CLAUDE_UPDATE_SMART_CACHE="$TMPCACHE"
+export CLAUDE_UPDATE_SMART_NO_EXEC=1
+
+# Test 1: up-to-date → skip
+OUT=$(CLAUDE_UPDATE_SMART_LOCAL="2.1.118" CLAUDE_UPDATE_SMART_LATEST="2.1.118" bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "skip when up-to-date exits 0" "$RC" 0
+assert_contains "skip message references #51243" "$OUT" "#51243"
+assert_contains "skip message says up to date" "$OUT" "up to date"
+assert_contains "decision line is skip" "$OUT" "decision=skip"
+
+# Test 2: update available → would run `claude update`
+OUT=$(CLAUDE_UPDATE_SMART_LOCAL="2.1.114" CLAUDE_UPDATE_SMART_LATEST="2.1.119" bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "update path exits 0 in NO_EXEC mode" "$RC" 0
+assert_contains "announces version diff" "$OUT" "2.1.114"
+assert_contains "announces target version" "$OUT" "2.1.119"
+assert_contains "decision line is update" "$OUT" "decision=update"
+
+# Test 3: cannot determine latest (stub npm + curl to empty, LATEST env blank)
+STUB_DIR=$(mktemp -d)
+cat >"$STUB_DIR/npm" <<'EOF'
+#!/bin/sh
+exit 1
+EOF
+cat >"$STUB_DIR/curl" <<'EOF'
+#!/bin/sh
+exit 1
+EOF
+chmod +x "$STUB_DIR/npm" "$STUB_DIR/curl"
+OUT=$(CLAUDE_UPDATE_SMART_LOCAL="2.1.118" PATH="$STUB_DIR:/usr/bin:/bin" bash "$HOOK" 2>&1)
+RC=$?
+# In NO_EXEC mode, we expect a fallthrough with decision=fallthrough and exit 2
+assert_exit "fallthrough when latest unknown exits 2" "$RC" 2
+assert_contains "fallthrough note printed" "$OUT" "fallthrough"
+rm -rf "$STUB_DIR"
+
+# Test 4: cache is written when a successful lookup occurs
+rm -f "$TMPCACHE"
+CLAUDE_UPDATE_SMART_LOCAL="2.1.118" CLAUDE_UPDATE_SMART_LATEST="2.1.119" bash "$HOOK" >/dev/null 2>&1
+# Note: when LATEST is provided via env, the script intentionally does NOT write the cache
+# (cache is only for network-resolved lookups). So the cache should NOT exist here.
+if [ ! -s "$TMPCACHE" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: cache should not be written when LATEST overridden"; fi
+
+# Test 5: local version not found → falls through with exit 127 in NO_EXEC
+STUB_DIR=$(mktemp -d)
+OUT=$(CLAUDE_UPDATE_SMART_LOCAL="" PATH="$STUB_DIR:/usr/bin:/bin" bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "no claude binary exits 127" "$RC" 127
+rm -rf "$STUB_DIR"
+
+# Test 6: manually seeded cache is honored (no override of LATEST env)
+rm -f "$TMPCACHE"
+printf '{"latest":"2.1.120","checked_at":%s}\n' "$(date +%s)" > "$TMPCACHE"
+OUT=$(CLAUDE_UPDATE_SMART_LOCAL="2.1.120" bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "cache-hit up-to-date exits 0" "$RC" 0
+assert_contains "cache-hit says up to date" "$OUT" "up to date"
+
+# Test 7: stale cache is ignored (TTL=1, file mtime set 10 s in the past)
+rm -f "$TMPCACHE"
+printf '{"latest":"2.1.120","checked_at":%s}\n' "$(($(date +%s) - 10))" > "$TMPCACHE"
+touch -d "10 seconds ago" "$TMPCACHE"
+STUB_DIR=$(mktemp -d)
+cat >"$STUB_DIR/npm" <<'EOF'
+#!/bin/sh
+exit 1
+EOF
+cat >"$STUB_DIR/curl" <<'EOF'
+#!/bin/sh
+exit 1
+EOF
+chmod +x "$STUB_DIR/npm" "$STUB_DIR/curl"
+OUT=$(CLAUDE_UPDATE_SMART_LOCAL="2.1.120" CLAUDE_UPDATE_SMART_TTL=1 PATH="$STUB_DIR:/usr/bin:/bin" bash "$HOOK" 2>&1)
+RC=$?
+assert_exit "stale cache + no network → fallthrough exit 2" "$RC" 2
+rm -rf "$STUB_DIR"
+
+rm -f "$TMPCACHE"
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/test-claudemd-tool-prohibition.sh

@@ -0,0 +1,239 @@
+#!/bin/bash
+# Tests for claudemd-tool-prohibition.sh
+# Run: bash tests/test-claudemd-tool-prohibition.sh
+set -uo pipefail
+
+HOOK="$(dirname "$0")/../examples/claudemd-tool-prohibition.sh"
+PASS=0 FAIL=0
+
+# Helper: run hook with a temp CLAUDE.md
+# Args:
+#   $1 — description
+#   $2 — expected exit code
+#   $3 — tool name (sent in tool_name field)
+#   $4 — CLAUDE.md content
+#   $5 — env vars (optional)
+run_test() {
+    local desc="$1" expected_exit="$2" tool="$3" claudemd_content="$4" envvars="${5:-}"
+    local tmpdir claudemd actual_exit input
+    tmpdir=$(mktemp -d)
+    claudemd="${tmpdir}/CLAUDE.md"
+    printf '%s' "$claudemd_content" > "$claudemd"
+
+    input=$(jq -nc --arg name "$tool" '{"tool_name": $name, "tool_input": {}}')
+
+    if [ -n "$envvars" ]; then
+        actual_exit=$(echo "$input" | env CC_CLAUDEMD_PATH="$claudemd" $envvars bash "$HOOK" >/dev/null 2>/dev/null; echo $?)
+    else
+        echo "$input" | CC_CLAUDEMD_PATH="$claudemd" bash "$HOOK" >/dev/null 2>/dev/null
+        actual_exit=$?
+    fi
+
+    rm -rf "$tmpdir"
+
+    if [ "$actual_exit" -eq "$expected_exit" ]; then
+        echo "  PASS: $desc"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc (expected exit $expected_exit, got $actual_exit)"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+# Stderr-content check
+expect_stderr_contains() {
+    local desc="$1" tool="$2" claudemd_content="$3" expect="$4" envvars="${5:-}"
+    local tmpdir claudemd stderr_out input
+    tmpdir=$(mktemp -d)
+    claudemd="${tmpdir}/CLAUDE.md"
+    printf '%s' "$claudemd_content" > "$claudemd"
+
+    input=$(jq -nc --arg name "$tool" '{"tool_name": $name, "tool_input": {}}')
+
+    if [ -n "$envvars" ]; then
+        stderr_out=$(echo "$input" | env CC_CLAUDEMD_PATH="$claudemd" $envvars bash "$HOOK" 2>&1 >/dev/null)
+    else
+        stderr_out=$(echo "$input" | CC_CLAUDEMD_PATH="$claudemd" bash "$HOOK" 2>&1 >/dev/null)
+    fi
+
+    rm -rf "$tmpdir"
+
+    if echo "$stderr_out" | grep -q -- "$expect"; then
+        echo "  PASS: $desc"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc (stderr missing '$expect')"
+        echo "       got: $stderr_out"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+echo "Testing claudemd-tool-prohibition.sh"
+echo "===================================="
+
+# --- BASELINE: empty / safe cases ---
+run_test "empty input exits 0" 0 "" ""
+run_test "no CLAUDE.md → exit 0" 0 "TaskCreate" ""
+run_test "CLAUDE.md without prohibitions → exit 0" 0 "TaskCreate" "# project notes\nuse anything you like"
+
+# --- PROSE PROHIBITIONS ---
+run_test "Do NOT use TaskCreate blocks TaskCreate" \
+    2 "TaskCreate" \
+    "Do NOT use \`TaskCreate\` for session-local work."
+
+run_test "Do not use TaskCreate (lowercase) blocks TaskCreate" \
+    2 "TaskCreate" \
+    "Do not use \`TaskCreate\` here."
+
+run_test "never use TaskUpdate blocks TaskUpdate" \
+    2 "TaskUpdate" \
+    "never use \`TaskUpdate\` in this project."
+
+run_test "do not call TaskList blocks TaskList" \
+    2 "TaskList" \
+    "Please do not call \`TaskList\` ever."
+
+# --- JAPANESE PROHIBITIONS ---
+run_test "Japanese: TaskCreate を使うな blocks TaskCreate" \
+    2 "TaskCreate" \
+    "\`TaskCreate\` を使うな。"
+
+run_test "Japanese: TaskList の使用は禁止 blocks TaskList" \
+    2 "TaskList" \
+    "\`TaskList\` の使用は禁止。"
+
+run_test "Japanese: 禁止する道具 header with list blocks TaskCreate" \
+    2 "TaskCreate" \
+    "## 禁止する道具
+
+- \`TaskCreate\`
+- \`TaskList\`"
+
+# --- LIST-UNDER-HEADER FORMAT ---
+run_test "Forbidden Tools header with list blocks TaskCreate" \
+    2 "TaskCreate" \
+    "# Project Rules
+
+## Forbidden Tools
+
+- \`TaskCreate\`
+- \`TaskList\`
+- \`TaskUpdate\`
+
+## Other Notes
+Anything else is fine."
+
+run_test "Prohibited Tools header with list blocks TaskUpdate" \
+    2 "TaskUpdate" \
+    "## Prohibited Tools
+
+- \`TaskCreate\`
+- \`TaskUpdate\`"
+
+# --- NEGATIVE CASES: tool NOT in prohibition list ---
+run_test "Other tool not in prohibition → exit 0" \
+    0 "Bash" \
+    "Do NOT use \`TaskCreate\` for session-local work."
+
+run_test "Prohibitions for TaskList only → TaskCreate allowed" \
+    0 "TaskCreate" \
+    "Do NOT use \`TaskList\` only."
+
+# --- ADVISORY MODE ---
+run_test "WARN=1 advisory mode exits 0" \
+    0 "TaskCreate" \
+    "Do NOT use \`TaskCreate\`." \
+    "CC_TOOL_PROHIBITION_WARN=1"
+
+# --- DISABLE FLAG ---
+run_test "DISABLE=1 short-circuits regardless" \
+    0 "TaskCreate" \
+    "Do NOT use \`TaskCreate\`." \
+    "CC_TOOL_PROHIBITION_DISABLE=1"
+
+# --- STDERR CONTENT ---
+expect_stderr_contains \
+    "BLOCKED message names the tool" \
+    "TaskCreate" \
+    "Do NOT use \`TaskCreate\`." \
+    "TaskCreate"
+
+expect_stderr_contains \
+    "BLOCKED message cites issue #60323" \
+    "TaskCreate" \
+    "Do NOT use \`TaskCreate\`." \
+    "#60323"
+
+expect_stderr_contains \
+    "WARN mode message says advisory" \
+    "TaskCreate" \
+    "Do NOT use \`TaskCreate\`." \
+    "advisory" \
+    "CC_TOOL_PROHIBITION_WARN=1"
+
+# --- EDGE CASES ---
+run_test "header without backticks in list items → not parsed → exit 0" \
+    0 "TaskCreate" \
+    "## Forbidden Tools
+
+- TaskCreate (no backticks)
+- TaskList"
+
+run_test "tool name without backticks in prose → not parsed → exit 0" \
+    0 "TaskCreate" \
+    "Do NOT use TaskCreate (no backticks)."
+
+run_test "case sensitivity: lowercase tool not matched to uppercase prohibition" \
+    0 "taskcreate" \
+    "Do NOT use \`TaskCreate\`."
+
+run_test "case sensitivity: uppercase tool matches exact case prohibition" \
+    2 "TaskCreate" \
+    "Do NOT use \`TaskCreate\`."
+
+# --- COMBINED FORMATS ---
+run_test "both prose and header list work together" \
+    2 "TaskCreate" \
+    "## Forbidden Tools
+- \`TaskList\`
+
+Also do not call \`TaskCreate\` separately."
+
+run_test "second tool only in header" \
+    2 "TaskList" \
+    "## Forbidden Tools
+- \`TaskList\`
+
+Also do not call \`TaskCreate\` separately."
+
+# --- REAL-WORLD: #60323 reporter's CLAUDE.md ---
+REAL_CLAUDEMD='## Task System Isolation (MANDATORY)
+
+`TaskCreate`/`TaskList` stores tasks globally — every session sees every task, causing cross-talk.
+
+- Do NOT use `TaskCreate` for session-local work. Track progress via `## Progress` blocks in responses.
+- `TaskCreate` only for intentionally shared cross-session coordination items.'
+
+run_test "real-world #60323 CLAUDE.md blocks TaskCreate" \
+    2 "TaskCreate" "$REAL_CLAUDEMD"
+
+# Note: The reporter's CLAUDE.md says TaskCreate is blocked but TaskList is
+# only mentioned descriptively (not via "do not use"). The hook is strict —
+# it only blocks tools that match prohibition patterns, not tools merely
+# mentioned in context. This is the correct behaviour (precision matters
+# in this rule space).
+run_test "real-world: TaskList is only described, not prohibited → exit 0" \
+    0 "TaskList" "$REAL_CLAUDEMD"
+
+# --- TOOLS NOT MATCHED ---
+run_test "Bash always allowed when only TaskCreate prohibited" \
+    0 "Bash" \
+    "Do NOT use \`TaskCreate\`."
+
+run_test "Read always allowed when only TaskList prohibited" \
+    0 "Read" \
+    "Do NOT use \`TaskList\`."
+
+echo ""
+echo "Result: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]