cc-safe-setup 29.8.0 → 30.0.4

package/tests/test-cli-config-pinning-detector.sh

@@ -0,0 +1,233 @@
+#!/bin/bash
+# test-cli-config-pinning-detector.sh — Tests for cli-config-pinning-detector.sh
+
+set -u
+
+HOOK="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/examples/cli-config-pinning-detector.sh"
+
+PASS=0
+FAIL=0
+FAILED_TESTS=()
+
+run_test() {
+    local name="$1"
+    local expected_exit="$2"
+    local expected_pattern="$3"
+    shift 3
+    local stderr_file
+    stderr_file=$(mktemp)
+    local actual_exit
+    "$@" 2>"$stderr_file"
+    actual_exit=$?
+    local stderr_content
+    stderr_content=$(cat "$stderr_file")
+    rm -f "$stderr_file"
+
+    local exit_ok=false
+    if [[ "$actual_exit" == "$expected_exit" ]]; then
+        exit_ok=true
+    fi
+
+    local pattern_ok=false
+    if [[ -z "$expected_pattern" ]]; then
+        if [[ -z "$stderr_content" ]]; then
+            pattern_ok=true
+        fi
+    elif [[ "$expected_pattern" == "ANY" ]]; then
+        pattern_ok=true
+    else
+        if echo "$stderr_content" | grep -q "$expected_pattern"; then
+            pattern_ok=true
+        fi
+    fi
+
+    if [[ "$exit_ok" == "true" && "$pattern_ok" == "true" ]]; then
+        echo "✓ $name"
+        PASS=$((PASS + 1))
+    else
+        echo "✗ $name (exit: $actual_exit/$expected_exit, pattern: ${expected_pattern})"
+        if [[ -n "$stderr_content" ]]; then
+            echo "  stderr: $(echo "$stderr_content" | head -3 | tr '\n' ' ')"
+        fi
+        FAIL=$((FAIL + 1))
+        FAILED_TESTS+=("$name")
+    fi
+}
+
+# Set up isolated state dir
+STATE_DIR=$(mktemp -d)
+export CC_AUTH_PIN_STATE_DIR="$STATE_DIR"
+
+# Helper: write a config file with given content
+make_config() {
+    local content="$1"
+    local f
+    f=$(mktemp)
+    echo "$content" > "$f"
+    echo "$f"
+}
+
+# Test 1: Disable switch silences hook
+CFG1=$(make_config '{"organization_id":"org_abc123","other":"x"}')
+run_test "disable switch silences hook" \
+    "0" "" \
+    env CC_AUTH_PIN_DISABLE=1 \
+        CC_AUTH_PIN_CONFIG="$CFG1" \
+        CC_AUTH_PIN_SESSION_ID=test1 \
+        bash "$HOOK"
+
+# Test 2: Config file does not exist — exits silently
+run_test "no config file exits silently" \
+    "0" "" \
+    env CC_AUTH_PIN_CONFIG="/nonexistent/path.json" \
+        CC_AUTH_PIN_SESSION_ID=test2 \
+        bash "$HOOK"
+
+# Test 3: Config exists but no organization_id — exits silently
+CFG3=$(make_config '{"api_key":"sk-x","email":"u@x.com"}')
+run_test "no organization_id field exits silently" \
+    "0" "" \
+    env CC_AUTH_PIN_CONFIG="$CFG3" \
+        CC_AUTH_PIN_SESSION_ID=test3 \
+        bash "$HOOK"
+
+# Test 4: Config with organization_id emits advisory
+CFG4=$(make_config '{"organization_id":"org_abc123","email":"u@x.com"}')
+run_test "config with organization_id emits advisory" \
+    "0" "Cluster 19 axis 19H" \
+    env CC_AUTH_PIN_CONFIG="$CFG4" \
+        CC_AUTH_PIN_SESSION_ID=test4 \
+        bash "$HOOK"
+
+# Test 5: Advisory includes the pinned organization_id value
+CFG5=$(make_config '{"organization_id":"org_xyz_test_value","email":"u@x.com"}')
+run_test "advisory includes pinned org_id value" \
+    "0" "org_xyz_test_value" \
+    env CC_AUTH_PIN_CONFIG="$CFG5" \
+        CC_AUTH_PIN_SESSION_ID=test5 \
+        bash "$HOOK"
+
+# Test 6: Advisory references anchor case #60742
+CFG6=$(make_config '{"organization_id":"org_abc"}')
+run_test "advisory references #60742" \
+    "0" "60742" \
+    env CC_AUTH_PIN_CONFIG="$CFG6" \
+        CC_AUTH_PIN_SESSION_ID=test6 \
+        bash "$HOOK"
+
+# Test 7: Advisory recommends /account
+CFG7=$(make_config '{"organization_id":"org_abc"}')
+run_test "advisory recommends /account" \
+    "0" "/account" \
+    env CC_AUTH_PIN_CONFIG="$CFG7" \
+        CC_AUTH_PIN_SESSION_ID=test7 \
+        bash "$HOOK"
+
+# Test 8: Quiet mode emits nothing but marks guard
+CFG8=$(make_config '{"organization_id":"org_abc"}')
+run_test "quiet mode emits nothing" \
+    "0" "" \
+    env CC_AUTH_PIN_QUIET=1 \
+        CC_AUTH_PIN_CONFIG="$CFG8" \
+        CC_AUTH_PIN_SESSION_ID=test8 \
+        bash "$HOOK"
+# Second fire (non-quiet) does not re-fire
+run_test "quiet mode marks guard so non-quiet later does not fire" \
+    "0" "" \
+    env CC_AUTH_PIN_CONFIG="$CFG8" \
+        CC_AUTH_PIN_SESSION_ID=test8 \
+        bash "$HOOK"
+
+# Test 9: One-shot — second invocation does not re-fire
+CFG9=$(make_config '{"organization_id":"org_abc"}')
+env CC_AUTH_PIN_CONFIG="$CFG9" \
+    CC_AUTH_PIN_SESSION_ID=test9 \
+    bash "$HOOK" 2>/dev/null
+run_test "second invocation does not re-fire" \
+    "0" "" \
+    env CC_AUTH_PIN_CONFIG="$CFG9" \
+        CC_AUTH_PIN_SESSION_ID=test9 \
+        bash "$HOOK"
+
+# Test 10: Different sessions fire independently
+CFG10=$(make_config '{"organization_id":"org_abc"}')
+run_test "different session id fires independently" \
+    "0" "Cluster 19 axis 19H" \
+    env CC_AUTH_PIN_CONFIG="$CFG10" \
+        CC_AUTH_PIN_SESSION_ID=test10 \
+        bash "$HOOK"
+
+# Test 11: Advisory mentions field guide URL
+CFG11=$(make_config '{"organization_id":"org_abc"}')
+run_test "advisory references field guide" \
+    "0" "gist.github.com" \
+    env CC_AUTH_PIN_CONFIG="$CFG11" \
+        CC_AUTH_PIN_SESSION_ID=test11 \
+        bash "$HOOK"
+
+# Test 12: Advisory mentions disable env var
+CFG12=$(make_config '{"organization_id":"org_abc"}')
+run_test "advisory mentions CC_AUTH_PIN_DISABLE" \
+    "0" "CC_AUTH_PIN_DISABLE" \
+    env CC_AUTH_PIN_CONFIG="$CFG12" \
+        CC_AUTH_PIN_SESSION_ID=test12 \
+        bash "$HOOK"
+
+# Test 13: Organization_id with whitespace around colon
+CFG13=$(make_config '{"organization_id" : "org_with_spaces"}')
+run_test "whitespace around colon parsed correctly" \
+    "0" "org_with_spaces" \
+    env CC_AUTH_PIN_CONFIG="$CFG13" \
+        CC_AUTH_PIN_SESSION_ID=test13 \
+        bash "$HOOK"
+
+# Test 14: Multi-line config file with organization_id
+CFG14=$(mktemp)
+cat > "$CFG14" <<JSON
+{
+  "email": "user@example.com",
+  "organization_id": "org_multiline_value",
+  "other": "x"
+}
+JSON
+run_test "multi-line config parsed correctly" \
+    "0" "org_multiline_value" \
+    env CC_AUTH_PIN_CONFIG="$CFG14" \
+        CC_AUTH_PIN_SESSION_ID=test14 \
+        bash "$HOOK"
+
+# Test 15: Null organization_id treated as no pin
+CFG15=$(make_config '{"organization_id":null,"email":"u@x.com"}')
+run_test "null org_id treated as no pin" \
+    "0" "" \
+    env CC_AUTH_PIN_CONFIG="$CFG15" \
+        CC_AUTH_PIN_SESSION_ID=test15 \
+        bash "$HOOK"
+
+# Test 16: Advisory recommends editing the file
+CFG16=$(make_config '{"organization_id":"org_abc"}')
+run_test "advisory recommends editing config file" \
+    "0" "Edit" \
+    env CC_AUTH_PIN_CONFIG="$CFG16" \
+        CC_AUTH_PIN_SESSION_ID=test16 \
+        bash "$HOOK"
+
+# Test 17: Advisory includes the config file path
+CFG17=$(make_config '{"organization_id":"org_abc"}')
+run_test "advisory includes config file path" \
+    "0" "$(basename "$CFG17")" \
+    env CC_AUTH_PIN_CONFIG="$CFG17" \
+        CC_AUTH_PIN_SESSION_ID=test17 \
+        bash "$HOOK"
+
+# Cleanup
+rm -rf "$STATE_DIR"
+
+echo ""
+echo "─────────────────────────────"
+echo "Tests: $((PASS + FAIL)) | Pass: $PASS | Fail: $FAIL"
+if [[ $FAIL -gt 0 ]]; then
+    echo "Failed: ${FAILED_TESTS[*]}"
+    exit 1
+fi
+exit 0

package/tests/test-cliff-countdown-advisor.sh

@@ -0,0 +1,138 @@
+#!/bin/bash
+# test-cliff-countdown-advisor.sh
+#
+# Tests for cliff-countdown-advisor.sh hook
+# Exercises all five time windows (acute, elevated, caution, quiet-far, post-cliff)
+# plus the opt-out paths.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK="${SCRIPT_DIR}/../examples/cliff-countdown-advisor.sh"
+
+pass_count=0
+fail_count=0
+
+assert_contains() {
+  local description="$1"
+  local actual="$2"
+  local expected_substring="$3"
+  if [[ "${actual}" == *"${expected_substring}"* ]]; then
+    pass_count=$((pass_count + 1))
+    echo "PASS: ${description}"
+  else
+    fail_count=$((fail_count + 1))
+    echo "FAIL: ${description}"
+    echo "  expected substring: ${expected_substring}"
+    echo "  actual: ${actual}"
+  fi
+}
+
+assert_empty() {
+  local description="$1"
+  local actual="$2"
+  if [[ -z "${actual}" ]]; then
+    pass_count=$((pass_count + 1))
+    echo "PASS: ${description}"
+  else
+    fail_count=$((fail_count + 1))
+    echo "FAIL: ${description}"
+    echo "  expected empty output"
+    echo "  actual: ${actual}"
+  fi
+}
+
+# Test 1: ~14 days before cliff (elevated advisory)
+output=$(CC_CLIFF_DATE="$(date -d '14 days' +%Y-%m-%d)" bash "${HOOK}" 2>&1)
+assert_contains "14 days from now: elevated advisory marker present" "${output}" "⚠"
+assert_contains "14 days from now: Pool 2 reduction mentioned" "${output}" "Pool 2"
+assert_contains "14 days from now: 14-day plan referenced" "${output}" "14-day-plan"
+
+# Test 2: ~7 days before cliff (still elevated)
+output=$(CC_CLIFF_DATE="$(date -d '7 days' +%Y-%m-%d)" bash "${HOOK}" 2>&1)
+assert_contains "7 days from now: elevated marker present" "${output}" "days until"
+assert_contains "7 days from now: spend limit mentioned" "${output}" "Spend Limit"
+
+# Test 3: ~1 day from now (cliff day boundary, integer-division puts this at 0 days)
+output=$(CC_CLIFF_DATE="$(date -d '1 day' +%Y-%m-%d)" bash "${HOOK}" 2>&1)
+assert_contains "1 day from now: cliff day boundary advisory" "${output}" "Anthropic Console Usage snapshot"
+
+# Test 4: cliff day exactly (acute)
+output=$(CC_CLIFF_DATE="$(date +%Y-%m-%d)" bash "${HOOK}" 2>&1)
+assert_contains "cliff day: acute marker present" "${output}" "cliff day"
+assert_contains "cliff day: measurement priority mentioned" "${output}" "Anthropic Console Usage snapshot"
+
+# Test 5: ~20 days before cliff (caution single-line, with integer-division tolerance)
+output=$(CC_CLIFF_DATE="$(date -d '20 days' +%Y-%m-%d)" bash "${HOOK}" 2>&1)
+assert_contains "20 days from now: caution single-line marker" "${output}" "days until"
+assert_contains "20 days from now: baseline capture mentioned" "${output}" "baseline capture"
+
+# Test 6: ~25 days before cliff (still caution)
+output=$(CC_CLIFF_DATE="$(date -d '25 days' +%Y-%m-%d)" bash "${HOOK}" 2>&1)
+assert_contains "25 days from now: caution marker" "${output}" "billing cliff"
+
+# Test 7: 60 days before cliff (quiet)
+output=$(CC_CLIFF_DATE="$(date -d '60 days' +%Y-%m-%d)" bash "${HOOK}" 2>&1)
+assert_empty "60 days before cliff: quiet output" "${output}"
+
+# Test 8: 35 days before cliff (well past caution window, quiet)
+output=$(CC_CLIFF_DATE="$(date -d '35 days' +%Y-%m-%d)" bash "${HOOK}" 2>&1)
+assert_empty "35 days before cliff: quiet" "${output}"
+
+# Test 9: 5 days after cliff (post-cliff diff capture advisory)
+output=$(CC_CLIFF_DATE="$(date -d '-5 days' +%Y-%m-%d)" bash "${HOOK}" 2>&1)
+assert_contains "5 days after cliff: post-cliff marker" "${output}" "Day 5 after"
+assert_contains "5 days after cliff: diff capture mentioned" "${output}" "diff vs pre-cliff"
+
+# Test 10: 20 days after cliff (still post-cliff window)
+output=$(CC_CLIFF_DATE="$(date -d '-20 days' +%Y-%m-%d)" bash "${HOOK}" 2>&1)
+assert_contains "20 days after cliff: post-cliff marker" "${output}" "Day 20 after"
+
+# Test 11: 31 days after cliff (silent again)
+output=$(CC_CLIFF_DATE="$(date -d '-31 days' +%Y-%m-%d)" bash "${HOOK}" 2>&1)
+assert_empty "31 days after cliff: quiet" "${output}"
+
+# Test 12: CC_CLIFF_QUIET=1 silences output (override elevated window)
+output=$(CC_CLIFF_DATE="$(date -d '7 days' +%Y-%m-%d)" CC_CLIFF_QUIET=1 bash "${HOOK}" 2>&1)
+assert_empty "CC_CLIFF_QUIET=1: elevated window silenced" "${output}"
+
+# Test 13: CC_CLIFF_DISABLE=1 silences output
+output=$(CC_CLIFF_DATE="$(date -d '7 days' +%Y-%m-%d)" CC_CLIFF_DISABLE=1 bash "${HOOK}" 2>&1)
+assert_empty "CC_CLIFF_DISABLE=1: silences output" "${output}"
+
+# Test 14: hook exits 0 even on cliff day (advisory, never blocks)
+CC_CLIFF_DATE="$(date +%Y-%m-%d)" bash "${HOOK}" > /dev/null 2>&1
+exit_code=$?
+if [[ ${exit_code} -eq 0 ]]; then
+  pass_count=$((pass_count + 1))
+  echo "PASS: cliff day exits 0 (non-blocking advisory)"
+else
+  fail_count=$((fail_count + 1))
+  echo "FAIL: cliff day exit code ${exit_code} (expected 0)"
+fi
+
+# Test 15: invalid date format degrades gracefully (silent)
+output=$(CC_CLIFF_DATE="not-a-date" bash "${HOOK}" 2>&1)
+assert_empty "invalid CC_CLIFF_DATE: silent" "${output}"
+
+# Test 16: default cliff date (2026-06-15) — verify hook references correct date in elevated window
+# Skip this test if today is too far from 2026-06-15 to fall in any active window.
+default_diff=$(( ($(date -d '2026-06-15' +%s) - $(date +%s)) / 86400 ))
+if [[ ${default_diff} -ge 1 ]] && [[ ${default_diff} -le 30 ]]; then
+  output=$(bash "${HOOK}" 2>&1)
+  assert_contains "default cliff date (2026-06-15) referenced when in active window" "${output}" "2026-06-15"
+else
+  echo "SKIP: default cliff date test (today is ${default_diff} days from cliff, outside active window)"
+fi
+
+echo ""
+echo "=========================================="
+echo "Tests run: $((pass_count + fail_count))"
+echo "Passed: ${pass_count}"
+echo "Failed: ${fail_count}"
+echo "=========================================="
+
+if [[ ${fail_count} -gt 0 ]]; then
+  exit 1
+fi
+exit 0

package/tests/test-closure-word-verify-gate.sh

@@ -0,0 +1,158 @@
+#!/bin/bash
+# Tests for closure-word-verify-gate.sh
+#
+# Verifies the Stop-hook behavior from issue #60506:
+#   - Closure word without verification command → exit 2, stderr feedback
+#   - Closure word with verification command in same turn → exit 0 silent
+#   - No closure word in turn → exit 0 silent
+#   - Missing assistant text → exit 0 silent (no false-positive)
+#   - Disable flag respected
+
+set -uo pipefail
+
+HOOK="$(dirname "$0")/../examples/closure-word-verify-gate.sh"
+PASS=0
+FAIL=0
+
+assert_pass() { echo "  PASS: $1"; PASS=$((PASS + 1)); }
+assert_fail() { echo "  FAIL: $1"; FAIL=$((FAIL + 1)); }
+
+run_hook() {
+    local input="$1"
+    local extra_env="${2:-}"
+    if [ -n "$extra_env" ]; then
+        eval "$extra_env bash \"$HOOK\"" <<< "$input" 2>&1
+    else
+        printf '%s' "$input" | bash "$HOOK" 2>&1
+    fi
+}
+
+echo "=== closure-word-verify-gate.sh tests ==="
+
+# --- Test 1: closure word + no verification → blocks ---
+INPUT=$(jq -nc '{
+    transcript: [{content: "All set, the migration is done."}],
+    turn_tool_calls: [{command: "git add ."}]
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 2 ] && echo "$output" | grep -q "CLOSURE WITHOUT VERIFICATION"; then
+    assert_pass "blocks closure without verification (exit 2 + feedback)"
+else
+    assert_fail "expected exit 2 + feedback, got rc=$rc output=$output"
+fi
+
+# --- Test 2: closure word + verification in same turn → exits 0 ---
+INPUT=$(jq -nc '{
+    transcript: [{content: "All tests pass, this is done."}],
+    turn_tool_calls: [{command: "npm test"}, {command: "git add ."}]
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "closure with verification is silent (exit 0)"
+else
+    assert_fail "expected silent exit 0, got rc=$rc output=$output"
+fi
+
+# --- Test 3: no closure word → silent exit ---
+INPUT=$(jq -nc '{
+    transcript: [{content: "Investigating the failing test now."}],
+    turn_tool_calls: [{command: "ls"}]
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "no closure word is a silent no-op"
+else
+    assert_fail "expected silent no-op, got rc=$rc output=$output"
+fi
+
+# --- Test 4: matches multiple closure variants ---
+for word in "shipped" "complete" "production ready" "bitti" "finished" "all set"; do
+    INPUT=$(jq -nc --arg w "$word" '{
+        transcript: [{content: ("OK, the feature is " + $w + " now.")}],
+        turn_tool_calls: []
+    }')
+    output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+    rc=$?
+    if [ "$rc" -eq 2 ]; then
+        assert_pass "closure variant '$word' triggers gate"
+    else
+        assert_fail "closure variant '$word' did not trigger (rc=$rc)"
+    fi
+done
+
+# --- Test 5: missing assistant text → silent (no false-positive) ---
+INPUT='{"turn_tool_calls":[]}'
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "missing assistant text is silent no-op"
+else
+    assert_fail "expected silent on missing text, got rc=$rc output=$output"
+fi
+
+# --- Test 6: CC_CLOSURE_GATE_DISABLE=1 respected ---
+INPUT=$(jq -nc '{
+    transcript: [{content: "Done!"}],
+    turn_tool_calls: []
+}')
+output=$(printf '%s' "$INPUT" | CC_CLOSURE_GATE_DISABLE=1 bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "CC_CLOSURE_GATE_DISABLE=1 disables the gate"
+else
+    assert_fail "disable flag not respected (rc=$rc output=$output)"
+fi
+
+# --- Test 7: stderr feedback references #60506 ---
+INPUT=$(jq -nc '{
+    transcript: [{content: "shipped the fix"}],
+    turn_tool_calls: []
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1 || true)
+if echo "$output" | grep -q "#60506"; then
+    assert_pass "feedback cites #60506 for grounding"
+else
+    assert_fail "expected reference to #60506 in feedback (got: $output)"
+fi
+
+# --- Test 8: alternative verification commands recognized ---
+for cmd in "pytest" "playwright test" "cargo test" "curl http://localhost:3000/health" "go test ./..."; do
+    INPUT=$(jq -nc --arg c "$cmd" '{
+        transcript: [{content: "All done now."}],
+        turn_tool_calls: [{command: $c}]
+    }')
+    rc=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1 >/dev/null; echo $?)
+    if [ "$rc" -eq 0 ]; then
+        assert_pass "verification command '$cmd' satisfies the gate"
+    else
+        assert_fail "verification command '$cmd' did not satisfy (rc=$rc)"
+    fi
+done
+
+# --- Test 9: matched closure word echoed in feedback ---
+INPUT=$(jq -nc '{
+    transcript: [{content: "Cool, that is finished now."}],
+    turn_tool_calls: []
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1 || true)
+if echo "$output" | grep -qi "finished"; then
+    assert_pass "feedback echoes the matched closure word"
+else
+    assert_fail "feedback did not echo the matched word (got: $output)"
+fi
+
+# --- Test 10: empty input is a silent no-op ---
+output=$(printf '' | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "empty input is a silent no-op"
+else
+    assert_fail "empty input should be silent (rc=$rc output=$output)"
+fi
+
+echo
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/tests/test-commit-all-scope-guard.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+# Tests for commit-all-scope-guard.sh
+# Absolute path: tests cd into scratch repos, so a relative path would break.
+HOOK="$(cd "$(dirname "$0")/../examples" && pwd)/commit-all-scope-guard.sh"
+PASS=0
+FAIL=0
+
+run_test() {
+  local desc="$1"
+  local result="$2"
+  if [ "$result" = "pass" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# Build a scratch git repo with one edited tracked file and two unrelated
+# work-in-progress files, then run the hook from inside it.
+mkrepo() {
+  local d
+  d=$(mktemp -d "${TMPDIR:-/tmp}/cc-commit-scope-test.XXXXXX")
+  ( cd "$d" && git init -q && git config user.email t@t && git config user.name t \
+    && echo base > a.txt && git add a.txt && git commit -qm init \
+    && echo edit > a.txt && echo wip > b.txt && echo wip > c.txt )
+  echo "$d"
+}
+
+# Run hook in $1 dir with command $2; print "exit|stderr_lines".
+run_in() {
+  local dir="$1" cmd="$2" err rc
+  err=$(cd "$dir" && printf '{"tool_input":{"command":"%s"}}' "$cmd" | bash "$HOOK" 2>&1 1>/dev/null)
+  rc=$?
+  echo "$rc|$(printf '%s' "$err" | grep -c .)"
+}
+
+echo "Testing commit-all-scope-guard.sh"
+echo "================================="
+
+# 1. git commit -am → warn (exit 0, non-empty stderr listing the swept files)
+D=$(mkrepo); R=$(run_in "$D" "git commit -am rollback")
+[ "${R%%|*}" = "0" ] && [ "${R##*|}" -gt 0 ] && run_test "commit -am → warns with file list" pass || run_test "commit -am → warns ($R)" fail
+rm -rf "$D"
+
+# 2. git add . → warn
+D=$(mkrepo); R=$(run_in "$D" "git add .")
+[ "${R%%|*}" = "0" ] && [ "${R##*|}" -gt 0 ] && run_test "git add . → warns" pass || run_test "git add . → warns ($R)" fail
+rm -rf "$D"
+
+# 3. explicit git add <path> → silent (no warning)
+D=$(mkrepo); R=$(run_in "$D" "git add a.txt && git commit -m fix")
+[ "${R%%|*}" = "0" ] && [ "${R##*|}" -eq 0 ] && run_test "explicit add → silent" pass || run_test "explicit add → silent ($R)" fail
+rm -rf "$D"
+
+# 4. plain git commit -m (no -a) → silent
+D=$(mkrepo); R=$(run_in "$D" "git commit -m msg")
+[ "${R%%|*}" = "0" ] && [ "${R##*|}" -eq 0 ] && run_test "commit -m (no -a) → silent" pass || run_test "commit -m → silent ($R)" fail
+rm -rf "$D"
+
+# 5. non-git command → silent
+D=$(mkrepo); R=$(run_in "$D" "ls -la")
+[ "${R%%|*}" = "0" ] && [ "${R##*|}" -eq 0 ] && run_test "non-git command → silent" pass || run_test "non-git → silent ($R)" fail
+rm -rf "$D"
+
+# 6. empty input → exit 0
+EXIT=0; printf '%s' '{}' | bash "$HOOK" >/dev/null 2>&1 || EXIT=$?
+[ "$EXIT" = "0" ] && run_test "empty input → exit 0" pass || run_test "empty input → exit 0 (got $EXIT)" fail
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]