cc-safe-setup 29.8.0 → 30.0.4

package/tests/test-forbidden-response-phrase-detector.sh

@@ -0,0 +1,246 @@
+#!/bin/bash
+# Tests for forbidden-response-phrase-detector.sh
+# Run: bash tests/test-forbidden-response-phrase-detector.sh
+set -uo pipefail
+
+HOOK="$(dirname "$0")/../examples/forbidden-response-phrase-detector.sh"
+PASS=0 FAIL=0
+
+# Helper: build a temp transcript with one assistant response, run the hook with
+# an explicit CLAUDE.md path, assert the exit code.
+run_test() {
+    local desc="$1" expected_exit="$2" response="$3" claudemd_content="$4" envvars="${5:-}"
+    local tmpdir transcript claudemd actual_exit input
+    tmpdir=$(mktemp -d)
+    transcript="${tmpdir}/transcript.jsonl"
+    claudemd="${tmpdir}/CLAUDE.md"
+    printf '%s' "$claudemd_content" > "$claudemd"
+
+    jq -nc --arg text "$response" '{
+        "role": "assistant",
+        "message": {"role": "assistant", "content": [{"type": "text", "text": $text}]}
+    }' > "$transcript"
+
+    input=$(jq -nc --arg t "$transcript" '{"transcript_path": $t}')
+
+    if [ -n "$envvars" ]; then
+        actual_exit=$(echo "$input" | env CC_CLAUDEMD_PATH="$claudemd" $envvars bash "$HOOK" >/dev/null 2>/dev/null; echo $?)
+    else
+        echo "$input" | CC_CLAUDEMD_PATH="$claudemd" bash "$HOOK" >/dev/null 2>/dev/null
+        actual_exit=$?
+    fi
+
+    rm -rf "$tmpdir"
+
+    if [ "$actual_exit" -eq "$expected_exit" ]; then
+        echo "  PASS: $desc"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc (expected exit $expected_exit, got $actual_exit)"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+expect_stderr_contains() {
+    local desc="$1" response="$2" claudemd_content="$3" expect="$4" envvars="${5:-}"
+    local tmpdir transcript claudemd stderr_out input
+    tmpdir=$(mktemp -d)
+    transcript="${tmpdir}/transcript.jsonl"
+    claudemd="${tmpdir}/CLAUDE.md"
+    printf '%s' "$claudemd_content" > "$claudemd"
+
+    jq -nc --arg text "$response" '{
+        "role": "assistant",
+        "message": {"role": "assistant", "content": [{"type": "text", "text": $text}]}
+    }' > "$transcript"
+
+    input=$(jq -nc --arg t "$transcript" '{"transcript_path": $t}')
+
+    if [ -n "$envvars" ]; then
+        stderr_out=$(echo "$input" | env CC_CLAUDEMD_PATH="$claudemd" $envvars bash "$HOOK" 2>&1 >/dev/null)
+    else
+        stderr_out=$(echo "$input" | CC_CLAUDEMD_PATH="$claudemd" bash "$HOOK" 2>&1 >/dev/null)
+    fi
+
+    rm -rf "$tmpdir"
+
+    if echo "$stderr_out" | grep -q -- "$expect"; then
+        echo "  PASS: $desc"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $desc (stderr missing '$expect')"
+        echo "       got: $stderr_out"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+echo "Testing forbidden-response-phrase-detector.sh"
+echo "============================================="
+
+# --- BASELINE ---
+run_test "no CLAUDE.md → exit 0" 0 "Some response" ""
+run_test "CLAUDE.md without prohibitions → exit 0" 0 "You're right that the issue is..." "# project notes\nuse anything"
+
+# --- PROSE PROHIBITIONS ---
+run_test "Do NOT open with You're right blocks" \
+    0 "You're right that the issue is here." \
+    "Do NOT open replies with \`You're right\`."
+
+run_test "never say I apologize warns" \
+    0 "I apologize for the confusion." \
+    "never say \`I apologize\` in responses."
+
+run_test "do not use Great point blocks" \
+    0 "Great point about that." \
+    "Do not use \`Great point\` as an opener."
+
+# --- BLOCK MODE ---
+run_test "BLOCK=1 with violation exits 2" \
+    2 "You're right that..." \
+    "Do NOT open with \`You're right\`." \
+    "CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+run_test "BLOCK=1 with clean response exits 0" \
+    0 "Looking at the code, I see the issue is..." \
+    "Do NOT open with \`You're right\`." \
+    "CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+# --- DISABLE ---
+run_test "DISABLE=1 short-circuits" \
+    0 "You're right" \
+    "Do NOT use \`You're right\`." \
+    "CC_FORBIDDEN_PHRASE_DISABLE=1"
+
+# --- OPEN_ONLY ---
+# Response is 250+ chars; "Great point" appears at char ~210, JUST past the 200-char window
+LONG_RESPONSE_OPEN_ONLY="Here is a thorough analysis of the existing implementation that covers all the edge cases we have observed in production over the past several weeks of operation since the deployment of the most recent revision. Great point about backwards compatibility."
+run_test "OPEN_ONLY=1 limits scope to first 200 chars (violation outside window)" \
+    0 "$LONG_RESPONSE_OPEN_ONLY" \
+    "Do NOT say \`Great point\` in opening." \
+    "CC_FORBIDDEN_PHRASE_OPEN_ONLY=1 CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+run_test "OPEN_ONLY=1 catches violation in first 200 chars" \
+    2 "Great point about that. Let me look at the code." \
+    "Do NOT say \`Great point\` in opening." \
+    "CC_FORBIDDEN_PHRASE_OPEN_ONLY=1 CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+# --- CASE SENSITIVITY ---
+run_test "case-insensitive (default) matches mixed-case violation" \
+    2 "you're right that we need to fix this." \
+    "Do NOT open with \`You're right\`." \
+    "CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+run_test "CASE_SENSITIVE=1 does not match lowercase" \
+    0 "you're right that we need to fix this." \
+    "Do NOT open with \`You're right\`." \
+    "CC_FORBIDDEN_PHRASE_CASE_SENSITIVE=1 CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+run_test "CASE_SENSITIVE=1 matches exact case" \
+    2 "You're right that we need to fix this." \
+    "Do NOT open with \`You're right\`." \
+    "CC_FORBIDDEN_PHRASE_CASE_SENSITIVE=1 CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+# --- HEADER LIST FORMAT ---
+run_test "Forbidden Response Phrases header list blocks violation" \
+    2 "You're right that this needs work." \
+    "## Forbidden Response Phrases
+
+- \`You're right\`
+- \`Great point\`
+- \`I apologize\`" \
+    "CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+run_test "Filler Phrases header list blocks violation" \
+    2 "Great point — let me investigate." \
+    "## Filler Phrases
+
+- \`Great point\`
+- \`Exactly\`" \
+    "CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+# --- JAPANESE ---
+run_test "Japanese: 了解しました prohibition blocks" \
+    2 "了解しました。 修正を行います。" \
+    "\`了解しました\` を返信の冒頭で使うな。" \
+    "CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+run_test "Japanese: header 禁止する応答 list blocks" \
+    2 "はい、その通りです。" \
+    "## 禁止する応答
+
+- \`はい、その通りです\`
+- \`了解しました\`" \
+    "CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+# --- NEGATIVE CASES ---
+run_test "Phrase not in response → exit 0" \
+    0 "Let me look at the code and analyse the issue." \
+    "Do NOT use \`You're right\`."
+
+run_test "Different phrase in prohibition does not match different phrase in response" \
+    0 "Great point about that." \
+    "Do NOT use \`You're absolutely correct\`."
+
+# --- STDERR ---
+expect_stderr_contains \
+    "stderr names the violated phrase" \
+    "You're right that..." \
+    "Do NOT open with \`You're right\`." \
+    "You're right"
+
+expect_stderr_contains \
+    "stderr cites issue #60339" \
+    "You're right" \
+    "Do NOT open with \`You're right\`." \
+    "#60339"
+
+expect_stderr_contains \
+    "stderr says detector header" \
+    "You're right" \
+    "Do NOT open with \`You're right\`." \
+    "forbidden-response-phrase-detector"
+
+# --- COMBINED FORMATS ---
+run_test "combined prose + header list works" \
+    2 "You're absolutely correct here." \
+    "## Forbidden Response Phrases
+- \`I apologize\`
+
+Also do NOT say \`You're absolutely correct\`." \
+    "CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+# --- EDGE CASES ---
+run_test "phrase requires backticks; bare mention does not parse" \
+    0 "You're right" \
+    "Do NOT say You're right (no backticks here)."
+
+run_test "empty response → exit 0" \
+    0 "" \
+    "Do NOT use \`You're right\`."
+
+run_test "phrase appearing in code block (legitimate code, not natural-language)" \
+    2 "Here is some code: \`You're right\` — but this is just text matching." \
+    "Do NOT use \`You're right\`." \
+    "CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+# Note: the hook intentionally does not try to distinguish code blocks from
+# narrative text. The operator's CLAUDE.md should be specific enough that
+# inadvertent matches are rare. If false positives become an issue, the
+# operator can refine the phrase list or use CASE_SENSITIVE mode.
+
+# --- #60339 REPRODUCTION ---
+RESPONSE_FROM_60339="You are right that the issue with hook execution is..."
+CLAUDEMD_60339="## Response style rules
+
+Do NOT open replies with filler phrases like \`You are right\`, \`Great point\`, or \`I apologize\`."
+
+run_test "#60339 reproduction: forbidden opener blocks" \
+    2 "$RESPONSE_FROM_60339" "$CLAUDEMD_60339" \
+    "CC_FORBIDDEN_PHRASE_BLOCK=1"
+
+run_test "#60339 reproduction with clean response passes" \
+    0 "Looking at the hook configuration, the issue is..." "$CLAUDEMD_60339"
+
+echo ""
+echo "Result: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/test-git-operations-require-approval.sh

@@ -59,6 +59,59 @@ test_hook '{"tool_input":{"command":"printf git push"}}' 0 "printf git push not
 test_hook '{"tool_input":{"command":""}}' 0 "empty command passes"
 test_hook '{}' 0 "empty input passes"
 
+
+# --- git's own global options between `git` and the verb (#1117) ---
+# git -C <dir> push does exactly what git push does. Matching the two as
+# adjacent words missed every shape below; all of them ran a real push.
+test_hook '{"tool_input":{"command":"git -C /tmp/repo push --force origin main"}}' 2 "git -C <dir> push blocked"
+test_hook '{"tool_input":{"command":"git --git-dir=/tmp/r/repo.d push origin main"}}' 2 "git --git-dir=<path> push blocked"
+test_hook '{"tool_input":{"command":"git --git-dir /tmp/r/repo.d push origin main"}}' 2 "git --git-dir <path> (separate value) push blocked"
+test_hook '{"tool_input":{"command":"git --work-tree=/tmp/w --git-dir=/tmp/r/repo.d push origin main"}}' 2 "two global options before push blocked"
+test_hook '{"tool_input":{"command":"git -c user.name=x commit -m x"}}' 2 "git -c <k=v> commit blocked"
+test_hook '{"tool_input":{"command":"git -C /tmp/r checkout -b feature"}}' 2 "git -C <dir> checkout -b blocked"
+test_hook '{"tool_input":{"command":"git -C /tmp/r switch -c feature"}}' 2 "git -C <dir> switch -c blocked"
+test_hook '{"tool_input":{"command":"git -C /tmp/r branch feature"}}' 2 "git -C <dir> branch <name> blocked"
+test_hook '{"tool_input":{"command":"git -C /tmp/r branch -a"}}' 0 "git -C <dir> branch -a still a listing"
+test_hook '{"tool_input":{"command":"git --no-pager push origin main"}}' 2 "git --no-pager push blocked"
+test_hook '{"tool_input":{"command":"/usr/bin/git push origin main"}}' 2 "git invoked by absolute path blocked"
+
+# --- the plumbing form of push ---
+test_hook '{"tool_input":{"command":"git send-pack origin main"}}' 2 "git send-pack blocked"
+test_hook '{"tool_input":{"command":"git -C /tmp/r send-pack origin main"}}' 2 "git -C <dir> send-pack blocked"
+
+# --- the read-only exemption must cover its own segment only ---
+# `^\s*(echo|printf)\s` used to exempt the WHOLE command, so everything after
+# a harmless first segment ran unguarded.
+test_hook '{"tool_input":{"command":"echo hi && git push origin main"}}' 2 "echo first segment does not exempt a later push"
+test_hook '{"tool_input":{"command":"echo start; git push origin main"}}' 2 "echo before ; does not exempt a later push"
+test_hook '{"tool_input":{"command":"printf x && git commit -m x"}}' 2 "printf first segment does not exempt a later commit"
+test_hook '{"tool_input":{"command":"grep -r \"git push\" ./docs"}}' 0 "grep for the words is not an invocation"
+
+# --- a single pipe is a separator too (2026-09-15) ---
+# The splitter knew && ; and || but not `|`, so a read-only command piped into
+# a git write arrived as ONE segment whose first word was the reader.
+# READ_ONLY_RE exempted the whole segment and the write on the right of the
+# pipe was never examined. Measured on the published file: these four exited 0.
+test_hook '{"tool_input":{"command":"echo x | git push origin main"}}' 2 "echo piped into push blocked"
+test_hook '{"tool_input":{"command":"cat f | git commit -m x"}}' 2 "cat piped into commit blocked"
+test_hook '{"tool_input":{"command":"grep q f | git push origin main"}}' 2 "grep piped into push blocked"
+test_hook '{"tool_input":{"command":"head -1 f | git checkout -b feature"}}' 2 "head piped into checkout -b blocked"
+
+# The same change must not start blocking ordinary pipes. A tightening fix
+# looks green on the blocking table while quietly breaking normal work, so the
+# passing side is listed here on purpose. `git branch | grep main` is here
+# because the pre-fix file refused it: unsplit, it read as `git branch <name>`.
+test_hook '{"tool_input":{"command":"git log | head -20"}}' 0 "git log piped to head still passes"
+test_hook '{"tool_input":{"command":"git diff | grep push"}}' 0 "git diff piped to grep still passes"
+test_hook '{"tool_input":{"command":"git branch | grep main"}}' 0 "git branch listing piped still passes"
+test_hook '{"tool_input":{"command":"echo \"a|b\""}}' 0 "a pipe inside quotes is not a separator"
+
+# --- the .git path coincidence ---
+# `git --git-dir=/tmp/r/.git push` used to match only because the PATH ended in
+# `.git`; the same command with any other git-dir name went through.
+test_hook '{"tool_input":{"command":"git --git-dir=/tmp/r/.git push origin main"}}' 2 "git-dir named .git blocked"
+test_hook '{"tool_input":{"command":"ls /tmp/r/.git"}}' 0 "a path containing .git is not a push"
+
 echo ""
 echo "Results: $PASS passed, $FAIL failed"
 [ "$FAIL" -gt 0 ] && exit 1

package/tests/test-git-push-blast-radius-guard.sh

@@ -0,0 +1,115 @@
+#!/bin/bash
+# Tests for git-push-blast-radius-guard.sh
+HOOK="examples/git-push-blast-radius-guard.sh"
+# Allow running from /tmp during development: fall back to an absolute path.
+[ -f "$HOOK" ] || HOOK="/tmp/ccps/git-push-blast-radius-guard.sh"
+PASS=0 FAIL=0
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3' in output)"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3')"; fi; }
+
+DIR="/tmp/cc-push-blast-test-$$"
+export CC_PUSH_BLAST_DIR="$DIR"
+export CC_PUSH_BLAST_WARN=3
+export CC_PUSH_BLAST_BLOCK=6
+export CC_PUSH_BLAST_WINDOW=3600
+
+fresh() { rm -rf "$DIR"; }
+# Build a Bash PreToolUse payload pushing to a named branch.
+push() { printf '{"tool_name":"Bash","session_id":"%s","tool_input":{"command":"git push origin %s"}}' "$1" "$2"; }
+# Record a push by actually running it through the hook (output discarded).
+rec() { push "$1" "$2" | bash "$HOOK" >/dev/null 2>&1; }
+
+# Test 1: non-Bash tool passes through silently
+fresh
+OUT=$(echo '{"tool_name":"WebFetch","tool_input":{"url":"https://x"}}' | bash "$HOOK" 2>&1)
+assert_not_contains "non-Bash passthrough" "$OUT" "git-push-blast-radius-guard"
+assert_not_contains "non-Bash no block" "$OUT" "decision"
+
+# Test 2: a Bash command that is not a push passes through
+fresh
+OUT=$(echo '{"tool_name":"Bash","session_id":"s1","tool_input":{"command":"git status"}}' | bash "$HOOK" 2>&1)
+assert_not_contains "non-push passthrough" "$OUT" "git-push-blast-radius-guard"
+
+# Test 3: first two distinct branches are silent (below WARN)
+fresh
+for b in b1 b2; do
+  OUT=$(push s1 "$b" | bash "$HOOK" 2>&1)
+  assert_not_contains "push $b silent" "$OUT" "git-push-blast-radius-guard"
+done
+
+# Test 4: at WARN (3rd distinct branch) -> stderr warning, no block
+OUT=$(push s1 b3 | bash "$HOOK" 2>&1)
+assert_contains "3rd distinct warns" "$OUT" "git-push-blast-radius-guard"
+STDOUT=$(push s1 b4 | bash "$HOOK" 2>/dev/null)
+assert_not_contains "4th no block on stdout" "$STDOUT" "decision"
+
+# Test 5: at BLOCK (6th distinct) -> block decision JSON on stdout, exit 0
+rec s1 b5
+STDOUT=$(push s1 b6 | bash "$HOOK" 2>/dev/null)
+RC=$?
+assert_contains "6th distinct blocks" "$STDOUT" '"decision": "block"'
+assert_contains "block reason references issue" "$STDOUT" "65944"
+[ "$RC" -eq 0 ] && PASS=$((PASS+1)) || { FAIL=$((FAIL+1)); echo "FAIL: block exits 0 (got $RC)"; }
+
+# Test 6: re-pushing the SAME branch many times never trips (distinct stays 1)
+fresh
+for i in 1 2 3 4 5 6 7 8 9 10; do
+  STDOUT=$(push s2 feature | bash "$HOOK" 2>/dev/null)
+  assert_not_contains "re-push same branch #$i no block" "$STDOUT" "decision"
+done
+
+# Test 7: git push --all is an immediate trip (whole-repo fan-out)
+fresh
+STDOUT=$(echo '{"tool_name":"Bash","session_id":"s3","tool_input":{"command":"git push --all origin"}}' | bash "$HOOK" 2>/dev/null)
+assert_contains "--all blocks immediately" "$STDOUT" '"decision": "block"'
+
+# Test 8: off mode passes through even over the limit
+fresh
+for b in c1 c2 c3 c4 c5 c6; do rec s4 "$b"; done
+OUT=$(push s4 c7 | CC_PUSH_BLAST_GUARD=off bash "$HOOK" 2>&1)
+assert_not_contains "off mode no block" "$OUT" "decision"
+
+# Test 9: warn mode never emits a block decision, only stderr
+fresh
+for b in d1 d2 d3 d4 d5; do rec s5 "$b"; done
+OUT=$(push s5 d6 | CC_PUSH_BLAST_GUARD=warn bash "$HOOK" 2>&1)
+assert_not_contains "warn mode no block decision" "$OUT" '"decision"'
+assert_contains "warn mode warns" "$OUT" "git-push-blast-radius-guard"
+
+# Test 10: window expiry prunes old branches -> count resets below warn
+fresh
+mkdir -p "$DIR"
+OLD=$(( $(date +%s) - 7200 ))
+for i in 1 2 3 4 5; do printf '%s\told%s\n' "$OLD" "$i" >> "$DIR/s6"; done
+OUT=$(push s6 newbranch | bash "$HOOK" 2>&1)
+assert_not_contains "expired window resets, no warn" "$OUT" "git-push-blast-radius-guard"
+
+# Test 11: per-session isolation -- another session has its own counter
+fresh
+for b in e1 e2 e3 e4 e5 e6; do rec s7 "$b"; done   # s7 now blocking
+STDOUT=$(push s8 e1 | bash "$HOOK" 2>/dev/null)
+assert_not_contains "separate session not blocked" "$STDOUT" "decision"
+
+# Test 12: malformed input fails open (no crash, no block)
+fresh
+OUT=$(echo 'not json' | bash "$HOOK" 2>&1)
+assert_not_contains "malformed input fails open" "$OUT" "decision"
+
+# Test 13: HEAD:branch refspec counts the destination branch
+fresh
+for i in 1 2 3 4 5; do rec s9 "f$i"; done
+STDOUT=$(echo '{"tool_name":"Bash","session_id":"s9","tool_input":{"command":"git push origin HEAD:f6"}}' | bash "$HOOK" 2>/dev/null)
+assert_contains "HEAD:dst counts destination -> blocks at 6th" "$STDOUT" '"decision": "block"'
+
+# Test 14: pushing two branches in one command counts both
+fresh
+rec s10 g1
+rec s10 g2
+rec s10 g3
+STDOUT=$(echo '{"tool_name":"Bash","session_id":"s10","tool_input":{"command":"git push origin g4 g5 g6"}}' | bash "$HOOK" 2>/dev/null)
+assert_contains "multi-branch single push counts all -> blocks" "$STDOUT" '"decision": "block"'
+
+rm -rf "$DIR"
+echo "Results: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/test-goal-iteration-limit-warner.sh

@@ -0,0 +1,128 @@
+#!/bin/bash
+# Tests for goal-iteration-limit-warner.sh
+
+HOOK="$(dirname "$0")/../examples/goal-iteration-limit-warner.sh"
+PASS=0 FAIL=0
+
+TMPROOT="$(mktemp -d -t cc-goal-warn-test.XXXXXX)"
+trap 'rm -rf "$TMPROOT"' EXIT
+
+run_test() {
+  local desc="$1" expected_exit="$2" prompt="$3" extra_env="$4"
+  local logfile="$TMPROOT/log-$RANDOM"
+  local actual_exit
+  local payload
+  payload=$(jq -nc --arg p "$prompt" '{prompt:$p}')
+  if [ -n "$extra_env" ]; then
+    actual_exit=$(printf '%s' "$payload" | env CC_GOAL_WARN_LOG="$logfile" $extra_env bash "$HOOK" >/dev/null 2>/dev/null; echo $?)
+  else
+    actual_exit=$(printf '%s' "$payload" | env CC_GOAL_WARN_LOG="$logfile" bash "$HOOK" >/dev/null 2>/dev/null; echo $?)
+  fi
+  if [ "$actual_exit" -eq "$expected_exit" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS+1))
+  else
+    echo "  FAIL: $desc (expected exit $expected_exit, got $actual_exit)"
+    FAIL=$((FAIL+1))
+  fi
+}
+
+echo "Testing goal-iteration-limit-warner.sh"
+echo "======================================"
+
+# 1. Empty prompt → pass
+PAYLOAD='{"prompt":""}'
+EXIT=$(printf '%s' "$PAYLOAD" | bash "$HOOK" >/dev/null 2>/dev/null; echo $?)
+[ "$EXIT" -eq 0 ] && { echo "  PASS: empty prompt passes"; PASS=$((PASS+1)); } || { echo "  FAIL: empty prompt"; FAIL=$((FAIL+1)); }
+
+# 2. Non-/goal prompt → pass
+run_test "regular prompt passes" 0 "please write a poem about cats"
+
+# 3. /goal with no termination clause → warn (exit 0)
+run_test "/goal without limit warns (default)" 0 "/goal find the death certificate for John Smith"
+
+# 4. /goal with no termination clause in block mode → exit 2
+run_test "/goal without limit blocks when action=block" 2 "/goal find the death certificate for John Smith" "CC_GOAL_WARN_ACTION=block"
+
+# 5. /goal clear → pass silently
+run_test "/goal clear passes silently" 0 "/goal clear"
+
+# 6. /goal status → pass silently
+run_test "/goal status passes silently" 0 "/goal status"
+
+# 7. /goal evaluate-once → pass silently
+run_test "/goal evaluate-once passes silently" 0 "/goal evaluate-once"
+
+# 8. /goal with 'or stop after 20 turns' → pass
+run_test "/goal with 'or stop after N turns' passes" 0 "/goal find the death certificate or stop after 20 turns"
+
+# 9. /goal with 'max 15 iterations' → pass
+run_test "/goal with 'max N iterations' passes" 0 "/goal find the source, max 15 iterations"
+
+# 10. /goal with 'within 10 turns' → pass
+run_test "/goal with 'within N turns' passes" 0 "/goal find it within 10 turns"
+
+# 11. /goal with 'after 5 attempts' → pass
+run_test "/goal with 'after N attempts' passes" 0 "/goal find it, give up after 5 attempts"
+
+# 12. Bare /goal (just the command) → pass (informational)
+run_test "/goal alone passes (informational)" 0 "/goal"
+
+# 13. /goal help → pass
+run_test "/goal help passes silently" 0 "/goal help"
+
+# 14. /goal with embedded newlines → still detected
+PAYLOAD=$(jq -nc '{prompt:"some context\n/goal find rare manuscript\nmore context"}')
+EXIT=$(printf '%s' "$PAYLOAD" | bash "$HOOK" >/dev/null 2>/dev/null; echo $?)
+[ "$EXIT" -eq 0 ] && { echo "  PASS: /goal on a line within multi-line prompt detected"; PASS=$((PASS+1)); } || { echo "  FAIL: multi-line /goal"; FAIL=$((FAIL+1)); }
+
+# 15. Disabled via env var → pass silently
+run_test "CC_GOAL_WARN_DISABLE=1 disables hook" 0 "/goal find anything" "CC_GOAL_WARN_DISABLE=1"
+
+# 16. Warning to stderr, stdout empty
+PAYLOAD=$(jq -nc '{prompt:"/goal find a rare book"}')
+STDOUT=$(printf '%s' "$PAYLOAD" | bash "$HOOK" 2>/dev/null)
+STDERR=$(printf '%s' "$PAYLOAD" | bash "$HOOK" 2>&1 >/dev/null)
+if [ -z "$STDOUT" ] && echo "$STDERR" | grep -q "without a termination clause"; then
+  echo "  PASS: stdout empty, stderr has warning"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: stdout/stderr separation"
+  FAIL=$((FAIL+1))
+fi
+
+# 17. Log file is created
+LOG="$TMPROOT/goal.log"
+PAYLOAD=$(jq -nc '{prompt:"/goal find something obscure"}')
+printf '%s' "$PAYLOAD" | env CC_GOAL_WARN_LOG="$LOG" bash "$HOOK" >/dev/null 2>/dev/null
+if [ -f "$LOG" ] && grep -q "goal_without_limit" "$LOG"; then
+  echo "  PASS: log file written"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: log file missing"
+  FAIL=$((FAIL+1))
+fi
+
+# 18. CC_GOAL_WARN_MAX_TURNS reflected in message
+PAYLOAD=$(jq -nc '{prompt:"/goal find something"}')
+STDERR=$(printf '%s' "$PAYLOAD" | env CC_GOAL_WARN_MAX_TURNS=42 bash "$HOOK" 2>&1 >/dev/null)
+if echo "$STDERR" | grep -q "stop after 42 turns"; then
+  echo "  PASS: custom max turns reflected in suggestion"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: max turns env not reflected"
+  FAIL=$((FAIL+1))
+fi
+
+# 19. /goal with uppercase 'STOP AFTER' → still recognized (case-insensitive)
+run_test "/goal with 'STOP AFTER' (uppercase) passes" 0 "/goal find it OR STOP AFTER 10 TURNS"
+
+# 20. /goal with extra spacing → still detected
+run_test "/goal with multiple spaces detected" 0 "/goal     find rare information"
+
+# 21. Prompt without /goal anywhere → pass
+run_test "prompt containing 'goal' as a word passes" 0 "my goal here is to write good code"
+
+echo "======================================"
+echo "Result: PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]