cc-safe-setup 29.8.0 → 30.0.5

package/tests/test-public-artefact-socratic-narrowing.sh

@@ -0,0 +1,346 @@
+#!/bin/bash
+# Tests for public-artefact-socratic-narrowing.sh
+#
+# Verifies the PreToolUse-hook behavior addressing #60226 (the structural-
+# parent frame) and the @beq00000 clean-state worked example:
+#   - Public-artefact emission (gh pr, gh issue, git commit, etc.) with
+#     body length above threshold → exit 2, Socratic reminder
+#   - Same artefact hash within window → exit 0 (re-emission passes through)
+#   - Below-threshold body → exit 0 silent
+#   - Non-public-artefact Bash → exit 0 silent
+#   - Non-public-artefact file → exit 0 silent
+#   - Public-artefact file (.github/, README, etc.) Write/Edit → gated
+#   - Missing input → exit 0 silent
+#   - Disable flag respected
+
+set -uo pipefail
+
+HOOK="$(dirname "$0")/../examples/public-artefact-socratic-narrowing.sh"
+PASS=0
+FAIL=0
+
+assert_pass() { echo "  PASS: $1"; PASS=$((PASS + 1)); }
+assert_fail() { echo "  FAIL: $1"; FAIL=$((FAIL + 1)); }
+
+# Use an isolated state dir per run so tests are independent
+STATE_DIR=$(mktemp -d -t cc-socratic-test-XXXXXX)
+trap 'rm -rf "$STATE_DIR"' EXIT
+export CC_SOCRATIC_STATE_DIR="$STATE_DIR"
+export CC_SOCRATIC_ENABLE=1   # gate is opt-in; enable it for the block-mode tests
+
+# Helper to build a long body so the length-threshold doesn't filter it
+LONG_BODY=$(printf 'This is a non-trivial PR body with multiple claims. %.0s' {1..10})
+
+echo "=== public-artefact-socratic-narrowing.sh tests ==="
+
+# --- Test 1: gh pr create with long body → blocks with reminder ---
+INPUT=$(jq -nc --arg cmd "gh pr create --title 'Fix' --body '$LONG_BODY'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 2 ] && echo "$output" | grep -q "PUBLIC-ARTEFACT EMISSION BOUNDARY"; then
+    assert_pass "gh pr create with long body blocks + emits reminder"
+else
+    assert_fail "expected rc=2 + reminder, got rc=$rc output=$output"
+fi
+
+# --- Test 2: Same artefact hash within window → passes through ---
+# (Same INPUT as test 1, run again — cache should hit)
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "same-hash re-emission within window passes through silently"
+else
+    assert_fail "expected silent pass on re-emission, got rc=$rc output=$output"
+fi
+
+# --- Test 3: Below-threshold body → silent ---
+INPUT=$(jq -nc '{
+    tool_name: "Bash",
+    tool_input: {command: "git commit -m \"fix typo\""}
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "below-threshold commit message is silent"
+else
+    assert_fail "expected silent on short body, got rc=$rc output=$output"
+fi
+
+# --- Test 4: Non-public-artefact Bash (e.g. ls) → silent ---
+INPUT=$(jq -nc --arg cmd "ls -la /tmp" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "non-public-artefact Bash is silent"
+else
+    assert_fail "expected silent on non-public Bash, got rc=$rc output=$output"
+fi
+
+# --- Test 5: gh issue comment with long body → blocks ---
+INPUT=$(jq -nc --arg cmd "gh issue comment 60226 --body '$LONG_BODY'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 2 ]; then
+    assert_pass "gh issue comment with long body blocks"
+else
+    assert_fail "expected gh issue comment to be gated (rc=$rc)"
+fi
+
+# --- Test 6: git commit -m with long body → blocks ---
+INPUT=$(jq -nc --arg cmd "git commit -m '$LONG_BODY'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 2 ]; then
+    assert_pass "git commit with long message blocks"
+else
+    assert_fail "expected git commit to be gated (rc=$rc)"
+fi
+
+# --- Test 7: gh release create with long body → blocks ---
+INPUT=$(jq -nc --arg cmd "gh release create v1.0 --notes '$LONG_BODY'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 2 ]; then
+    assert_pass "gh release create blocks"
+else
+    assert_fail "expected gh release create to be gated (rc=$rc)"
+fi
+
+# --- Test 8: Write to .github/ workflow file with long content → blocks ---
+BODY_GITHUB=$(printf 'workflow content with steps and jobs definitions. %.0s' {1..10})
+INPUT=$(jq -nc --arg content "$BODY_GITHUB" '{
+    tool_name: "Write",
+    tool_input: {
+        file_path: ".github/workflows/ci.yml",
+        content: $content
+    }
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 2 ]; then
+    assert_pass "Write to .github/ blocks"
+else
+    assert_fail "expected .github/ Write to be gated (rc=$rc)"
+fi
+
+# --- Test 9: Write to README.md with long content → blocks ---
+BODY_README=$(printf 'project overview with installation and usage examples. %.0s' {1..10})
+INPUT=$(jq -nc --arg content "$BODY_README" '{
+    tool_name: "Write",
+    tool_input: {
+        file_path: "/repo/README.md",
+        content: $content
+    }
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 2 ]; then
+    assert_pass "Write to README.md blocks"
+else
+    assert_fail "expected README.md Write to be gated (rc=$rc)"
+fi
+
+# --- Test 10: Write to CHANGELOG.md with long content → blocks ---
+BODY_CHANGELOG=$(printf 'release notes with breaking changes and migration paths. %.0s' {1..10})
+INPUT=$(jq -nc --arg content "$BODY_CHANGELOG" '{
+    tool_name: "Write",
+    tool_input: {
+        file_path: "/repo/CHANGELOG.md",
+        content: $content
+    }
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 2 ]; then
+    assert_pass "Write to CHANGELOG.md blocks"
+else
+    assert_fail "expected CHANGELOG.md Write to be gated (rc=$rc)"
+fi
+
+# --- Test 11: Edit on README.md with long new_string → blocks ---
+BODY_EDIT=$(printf 'expanded section with new claims and clarifications. %.0s' {1..10})
+INPUT=$(jq -nc --arg new "$BODY_EDIT" '{
+    tool_name: "Edit",
+    tool_input: {
+        file_path: "/repo/README.md",
+        old_string: "old",
+        new_string: $new
+    }
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 2 ]; then
+    assert_pass "Edit on README.md blocks"
+else
+    assert_fail "expected README.md Edit to be gated (rc=$rc)"
+fi
+
+# --- Test 12: Write to internal file (not a public artefact path) → silent ---
+BODY_INTERNAL=$(printf 'internal utility code with private helpers. %.0s' {1..10})
+INPUT=$(jq -nc --arg content "$BODY_INTERNAL" '{
+    tool_name: "Write",
+    tool_input: {
+        file_path: "/repo/src/util.ts",
+        content: $content
+    }
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "Write to internal source file is silent"
+else
+    assert_fail "expected silent on src/, got rc=$rc output=$output"
+fi
+
+# --- Test 13: Missing tool_name → silent ---
+INPUT='{"tool_input": {"command": "gh pr create --body x"}}'
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "missing tool_name is silent no-op"
+else
+    assert_fail "expected silent on missing tool_name, got rc=$rc output=$output"
+fi
+
+# --- Test 14: Empty input → silent ---
+output=$(printf '' | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "empty input is silent no-op"
+else
+    assert_fail "expected silent on empty, got rc=$rc output=$output"
+fi
+
+# --- Test 15: CC_SOCRATIC_DISABLE=1 respected ---
+INPUT=$(jq -nc --arg cmd "gh pr create --body '$LONG_BODY'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | CC_SOCRATIC_DISABLE=1 bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "CC_SOCRATIC_DISABLE=1 disables the gate"
+else
+    assert_fail "disable flag not respected (rc=$rc output=$output)"
+fi
+
+# --- Test 16: Reminder references #60226 ---
+# Use distinct body to avoid the cache hit from earlier tests
+DISTINCT_BODY=$(printf 'A different distinct body for cite test. %.0s' {1..10})
+INPUT=$(jq -nc --arg cmd "gh pr create --body '$DISTINCT_BODY'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+if echo "$output" | grep -q "#60226"; then
+    assert_pass "reminder cites #60226"
+else
+    assert_fail "expected #60226 reference in reminder (got: $output)"
+fi
+
+# --- Test 17: Reminder references the Socratic-narrowing form ---
+DISTINCT_BODY2=$(printf 'Yet another distinct body for socratic test. %.0s' {1..10})
+INPUT=$(jq -nc --arg cmd "gh pr create --body '$DISTINCT_BODY2'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+if echo "$output" | grep -qi "gradient"; then
+    assert_pass "reminder names the gradient framing"
+else
+    assert_fail "expected 'gradient' framing in reminder"
+fi
+
+# --- Test 18: Hash cache expires (TTL=1, sleep 2, re-fires) ---
+DISTINCT_BODY3=$(printf 'Cache TTL expiry body. %.0s' {1..10})
+INPUT=$(jq -nc --arg cmd "gh pr create --body '$DISTINCT_BODY3'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | CC_SOCRATIC_CACHE_TTL_SECONDS=1 bash "$HOOK" 2>&1)
+rc1=$?
+sleep 2
+output=$(printf '%s' "$INPUT" | CC_SOCRATIC_CACHE_TTL_SECONDS=1 bash "$HOOK" 2>&1)
+rc2=$?
+if [ "$rc1" -eq 2 ] && [ "$rc2" -eq 2 ]; then
+    assert_pass "cache entry expires past TTL (re-fires after window)"
+else
+    assert_fail "TTL not honored: first=$rc1 second=$rc2"
+fi
+
+# --- Test 19: Different artefact body → different hash → re-fires ---
+BODY_A=$(printf 'Body A content for hash uniqueness. %.0s' {1..10})
+BODY_B=$(printf 'Body B content totally different. %.0s' {1..10})
+INPUT_A=$(jq -nc --arg cmd "gh pr create --body '$BODY_A'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+INPUT_B=$(jq -nc --arg cmd "gh pr create --body '$BODY_B'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+printf '%s' "$INPUT_A" | bash "$HOOK" >/dev/null 2>&1
+rc=$(printf '%s' "$INPUT_B" | bash "$HOOK" >/dev/null 2>&1; echo $?)
+if [ "$rc" -eq 2 ]; then
+    assert_pass "different content (different hash) re-fires gate"
+else
+    assert_fail "expected re-fire on different content, got rc=$rc"
+fi
+
+# --- Test 20: gh gist create with long body → blocks ---
+INPUT=$(jq -nc --arg cmd "gh gist create --public --desc 'memo' -f notes.md $LONG_BODY" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 2 ]; then
+    assert_pass "gh gist create blocks"
+else
+    assert_fail "expected gh gist create to be gated (rc=$rc)"
+fi
+
+# --- Test 21: git tag -a with long body → blocks ---
+INPUT=$(jq -nc --arg cmd "git tag -a v2.0 -m '$LONG_BODY'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 2 ]; then
+    assert_pass "git tag -a with long message blocks"
+else
+    assert_fail "expected git tag to be gated (rc=$rc)"
+fi
+
+# --- Test: opt-in default — without CC_SOCRATIC_ENABLE the gate is a no-op ---
+INPUT=$(jq -nc --arg cmd "gh pr create --title 'Fix' --body '$LONG_BODY'" '{
+    tool_name: "Bash",
+    tool_input: {command: $cmd}
+}')
+output=$(printf '%s' "$INPUT" | env -u CC_SOCRATIC_ENABLE bash "$HOOK" 2>&1)
+rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$output" ]; then
+    assert_pass "gate is off by default (CC_SOCRATIC_ENABLE unset → silent pass-through)"
+else
+    assert_fail "expected silent no-op without CC_SOCRATIC_ENABLE, got rc=$rc output=$output"
+fi
+
+echo
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/tests/test-quota-anomaly-detector.sh

@@ -0,0 +1,321 @@
+#!/bin/bash
+# Tests for quota-anomaly-detector.sh
+HOOK="$(dirname "$0")/../examples/quota-anomaly-detector.sh"
+PASS=0
+FAIL=0
+
+mktempd() {
+  mktemp -d "${TMPDIR:-/tmp}/cc-quota-test.XXXXXX"
+}
+
+run_test() {
+  local desc="$1"
+  local result="$2"
+  if [ "$result" = "pass" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# Helper: seed N samples at a given rate around a target time.
+# Args: log_path, n, base_total, base_epoch, spread_seconds_per_sample
+seed_samples() {
+  local log="$1" n="$2" base_total="$3" base_epoch="$4" step="$5"
+  local i e
+  for i in $(seq 1 "$n"); do
+    e=$((base_epoch - (n - i) * step))
+    printf '{"ts":"2026-05-26T00:00:00Z","epoch":%s,"session":"seed","total":%s}\n' \
+      "$e" "$base_total" >> "$log"
+  done
+}
+
+echo "Testing quota-anomaly-detector.sh"
+echo "================================="
+
+# Test 1: empty payload, no usage → silent exit, no log
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+echo '{"session_id":"s1","tool_name":"Read"}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" bash "$HOOK" 2>/dev/null
+EXIT=$?
+if [ "$EXIT" = "0" ] && [ ! -f "$LOG" ]; then
+  run_test "empty payload, no transcript → silent exit, no log" pass
+else
+  run_test "empty payload, no transcript → silent exit, no log (exit=$EXIT)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 2: usage with all four token fields → sum logged
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+PAYLOAD='{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":100,"output_tokens":200,"cache_read_input_tokens":1000,"cache_creation_input_tokens":500}}}'
+echo "$PAYLOAD" | CC_QUOTA_ANOMALY_LOG="$LOG" bash "$HOOK" 2>/dev/null
+if [ -f "$LOG" ] && grep -q '"total":1800' "$LOG"; then
+  run_test "usage with four token fields → total summed correctly (1800)" pass
+else
+  run_test "usage with four token fields → total summed correctly. Got: $(cat "$LOG" 2>/dev/null)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 3: only input+output present → still sums (missing fields treated as 0)
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":50,"output_tokens":150}}}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" bash "$HOOK" 2>/dev/null
+if [ -f "$LOG" ] && grep -q '"total":200' "$LOG"; then
+  run_test "partial usage (input+output only) → total=200" pass
+else
+  run_test "partial usage (input+output only) → total=200. Got: $(cat "$LOG" 2>/dev/null)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 4: transcript_path fallback works
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+TRANSCRIPT="$TEST_DIR/session.jsonl"
+cat > "$TRANSCRIPT" <<'EOF'
+{"type":"user","message":{"content":"hello"}}
+{"type":"assistant","message":{"usage":{"input_tokens":300,"output_tokens":700,"cache_read_input_tokens":0,"cache_creation_input_tokens":0}}}
+EOF
+echo "{\"session_id\":\"s2\",\"tool_name\":\"Read\",\"transcript_path\":\"$TRANSCRIPT\"}" | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" bash "$HOOK" 2>/dev/null
+if [ -f "$LOG" ] && grep -q '"total":1000' "$LOG"; then
+  run_test "transcript fallback → total summed from last assistant turn" pass
+else
+  run_test "transcript fallback → total summed from last assistant turn. Got: $(cat "$LOG" 2>/dev/null)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 5: all-zero usage → no log entry
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":0,"output_tokens":0,"cache_read_input_tokens":0,"cache_creation_input_tokens":0}}}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" bash "$HOOK" 2>/dev/null
+if [ ! -f "$LOG" ]; then
+  run_test "all-zero usage → no log entry" pass
+else
+  run_test "all-zero usage → no log entry. Got: $(cat "$LOG")" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 6: below MIN_HISTORY → no alert even with huge value
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+NOW=$(date -u +%s)
+seed_samples "$LOG" 5 1000 "$NOW" 60
+STDERR=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":1000000,"output_tokens":0}}}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" CC_QUOTA_ANOMALY_MIN_HISTORY=30 bash "$HOOK" 2>&1 >/dev/null)
+if [ -z "$STDERR" ]; then
+  run_test "below MIN_HISTORY → no alert" pass
+else
+  run_test "below MIN_HISTORY → no alert (got stderr: $STDERR)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 7: above MIN_HISTORY but rate matches baseline → no alert
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+NOW=$(date -u +%s)
+# Seed 60 samples uniformly across the entire 60-minute baseline window.
+# Each sample 1000 tokens, one per minute → 1000 tok/min steady rate.
+for i in $(seq 1 60); do
+  E=$((NOW - 60 + i * 60 - 3600))  # i=1 → NOW-3600, i=60 → NOW-60
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":1000}\n' "$E" >> "$LOG"
+done
+# Feed a value matching the steady rate.
+STDERR=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":1000,"output_tokens":0}}}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" CC_QUOTA_ANOMALY_MIN_HISTORY=30 \
+  CC_QUOTA_ANOMALY_WINDOW_MIN=10 CC_QUOTA_ANOMALY_BASELINE_MIN=60 \
+  CC_QUOTA_ANOMALY_THRESHOLD=1.5 bash "$HOOK" 2>&1 >/dev/null)
+if [ -z "$STDERR" ]; then
+  run_test "steady rate within threshold → no alert" pass
+else
+  run_test "steady rate within threshold → no alert (got stderr: $STDERR)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 8: window rate well above baseline rate → alert emitted
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+NOW=$(date -u +%s)
+# Seed 30 samples in older part of baseline (60 min window), each 500 tokens, 60s apart starting 60 min ago.
+for i in $(seq 1 30); do
+  E=$((NOW - 3600 + i * 60))
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":500}\n' "$E" >> "$LOG"
+done
+# Seed 9 samples in the last 10 minutes at 10000 each (huge spike).
+for i in $(seq 1 9); do
+  E=$((NOW - 600 + i * 60))
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":10000}\n' "$E" >> "$LOG"
+done
+# Current sample also high.
+STDERR=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":10000,"output_tokens":0}}}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" CC_QUOTA_ANOMALY_MIN_HISTORY=30 \
+  CC_QUOTA_ANOMALY_WINDOW_MIN=10 CC_QUOTA_ANOMALY_BASELINE_MIN=60 \
+  CC_QUOTA_ANOMALY_THRESHOLD=1.5 bash "$HOOK" 2>&1 >/dev/null)
+if echo "$STDERR" | grep -q 'NOTICE:.*tok/min.*above'; then
+  run_test "spike rate above threshold → alert emitted" pass
+else
+  run_test "spike rate above threshold → alert emitted (stderr: $STDERR)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 9: SILENT=1 suppresses stderr but still logs
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+NOW=$(date -u +%s)
+for i in $(seq 1 30); do
+  E=$((NOW - 3600 + i * 60))
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":500}\n' "$E" >> "$LOG"
+done
+for i in $(seq 1 9); do
+  E=$((NOW - 600 + i * 60))
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":10000}\n' "$E" >> "$LOG"
+done
+STDERR=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":10000,"output_tokens":0}}}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" CC_QUOTA_ANOMALY_MIN_HISTORY=30 \
+  CC_QUOTA_ANOMALY_WINDOW_MIN=10 CC_QUOTA_ANOMALY_BASELINE_MIN=60 \
+  CC_QUOTA_ANOMALY_THRESHOLD=1.5 CC_QUOTA_ANOMALY_SILENT=1 bash "$HOOK" 2>&1 >/dev/null)
+if [ -z "$STDERR" ]; then
+  run_test "SILENT=1 suppresses stderr but still logs" pass
+else
+  run_test "SILENT=1 suppresses stderr (got: $STDERR)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 10: alert references upstream cluster issue numbers
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+NOW=$(date -u +%s)
+for i in $(seq 1 30); do
+  E=$((NOW - 3600 + i * 60))
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":500}\n' "$E" >> "$LOG"
+done
+for i in $(seq 1 9); do
+  E=$((NOW - 600 + i * 60))
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":10000}\n' "$E" >> "$LOG"
+done
+STDERR=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":10000,"output_tokens":0}}}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" CC_QUOTA_ANOMALY_MIN_HISTORY=30 \
+  CC_QUOTA_ANOMALY_WINDOW_MIN=10 CC_QUOTA_ANOMALY_BASELINE_MIN=60 \
+  CC_QUOTA_ANOMALY_THRESHOLD=1.5 bash "$HOOK" 2>&1 >/dev/null)
+if echo "$STDERR" | grep -q '#16157'; then
+  run_test "alert references upstream cluster #16157" pass
+else
+  run_test "alert references upstream cluster #16157 (stderr: $STDERR)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 11: custom threshold takes effect
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+NOW=$(date -u +%s)
+for i in $(seq 1 30); do
+  E=$((NOW - 3600 + i * 60))
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":1000}\n' "$E" >> "$LOG"
+done
+# Recent window slightly elevated: 1100 tokens/min, 1.1x baseline.
+for i in $(seq 1 9); do
+  E=$((NOW - 600 + i * 60))
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":1100}\n' "$E" >> "$LOG"
+done
+# Default threshold 1.5 should NOT alert. Custom 1.05 should alert.
+STDERR=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":1100,"output_tokens":0}}}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" CC_QUOTA_ANOMALY_MIN_HISTORY=30 \
+  CC_QUOTA_ANOMALY_WINDOW_MIN=10 CC_QUOTA_ANOMALY_BASELINE_MIN=60 \
+  CC_QUOTA_ANOMALY_THRESHOLD=1.05 bash "$HOOK" 2>&1 >/dev/null)
+if echo "$STDERR" | grep -q 'NOTICE'; then
+  run_test "custom threshold (1.05) triggers at 1.1x deviation" pass
+else
+  run_test "custom threshold (1.05) triggers at 1.1x deviation (stderr: $STDERR)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 12: missing transcript file → graceful exit
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+echo '{"session_id":"s1","tool_name":"Read","transcript_path":"/nonexistent/path.jsonl"}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" bash "$HOOK" 2>/dev/null
+EXIT=$?
+if [ "$EXIT" = "0" ]; then
+  run_test "missing transcript → graceful exit 0" pass
+else
+  run_test "missing transcript → graceful exit 0 (exit=$EXIT)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 13: invalid JSON input → graceful exit
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+echo 'not json' | CC_QUOTA_ANOMALY_LOG="$LOG" bash "$HOOK" 2>/dev/null
+EXIT=$?
+if [ "$EXIT" = "0" ]; then
+  run_test "invalid JSON input → graceful exit 0" pass
+else
+  run_test "invalid JSON input → graceful exit 0 (exit=$EXIT)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 14: nested log directory is created
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/nested/dir/quota.jsonl"
+echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":500,"output_tokens":500}}}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" bash "$HOOK" 2>/dev/null
+if [ -f "$LOG" ]; then
+  run_test "nested log dir is auto-created" pass
+else
+  run_test "nested log dir is auto-created" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 15: percentage and rate appear in alert
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+NOW=$(date -u +%s)
+# 60 min baseline at 100 tokens/min (60 samples of 100 tokens).
+for i in $(seq 1 60); do
+  E=$((NOW - 3600 + i * 60))
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":100}\n' "$E" >> "$LOG"
+done
+# 10 min recent at 300 tokens/min (3x).
+for i in $(seq 1 10); do
+  E=$((NOW - 600 + i * 60))
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":300}\n' "$E" >> "$LOG"
+done
+STDERR=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":300,"output_tokens":0}}}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" CC_QUOTA_ANOMALY_MIN_HISTORY=30 \
+  CC_QUOTA_ANOMALY_WINDOW_MIN=10 CC_QUOTA_ANOMALY_BASELINE_MIN=60 \
+  CC_QUOTA_ANOMALY_THRESHOLD=1.5 bash "$HOOK" 2>&1 >/dev/null)
+if echo "$STDERR" | grep -qE 'tok/min' && echo "$STDERR" | grep -qE '% above'; then
+  run_test "alert contains rate and percentage fields" pass
+else
+  run_test "alert contains rate and percentage (stderr: $STDERR)" fail
+fi
+rm -rf "$TEST_DIR"
+
+# Test 16: very short baseline window (no samples in baseline → no alert)
+TEST_DIR=$(mktempd)
+LOG="$TEST_DIR/quota.jsonl"
+NOW=$(date -u +%s)
+# All samples > 1h old.
+for i in $(seq 1 40); do
+  E=$((NOW - 7200 - i * 60))
+  printf '{"ts":"x","epoch":%s,"session":"seed","total":500}\n' "$E" >> "$LOG"
+done
+STDERR=$(echo '{"session_id":"s1","tool_name":"Read","tool_response":{"usage":{"input_tokens":5000,"output_tokens":0}}}' | \
+  CC_QUOTA_ANOMALY_LOG="$LOG" CC_QUOTA_ANOMALY_MIN_HISTORY=30 \
+  CC_QUOTA_ANOMALY_WINDOW_MIN=10 CC_QUOTA_ANOMALY_BASELINE_MIN=60 \
+  CC_QUOTA_ANOMALY_THRESHOLD=1.5 bash "$HOOK" 2>&1 >/dev/null)
+if [ -z "$STDERR" ]; then
+  run_test "no baseline samples in window → no alert" pass
+else
+  run_test "no baseline samples in window → no alert (stderr: $STDERR)" fail
+fi
+rm -rf "$TEST_DIR"
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+exit $((FAIL > 0 ? 1 : 0))