cc-safe-setup 29.8.0 → 30.0.5

package/tests/test-route-handler-emptiness-gate.sh

@@ -0,0 +1,300 @@
+#!/bin/bash
+# test-route-handler-emptiness-gate.sh — tests for route-handler-emptiness-gate.sh
+# Solves: validation of the hook that addresses anthropics/claude-code#61107
+# (Opus 4.7 produces structurally correct code that silently discards user input)
+
+set -uo pipefail
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/examples/route-handler-emptiness-gate.sh"
+
+if [ ! -x "$HOOK" ]; then
+    echo "FATAL: hook not executable at $HOOK"
+    exit 1
+fi
+
+PASS=0
+FAIL=0
+
+assert_exit() {
+    local name="$1"
+    local expected_exit="$2"
+    local actual_exit="$3"
+    if [ "$expected_exit" = "$actual_exit" ]; then
+        echo "  PASS: $name"
+        PASS=$((PASS + 1))
+    else
+        echo "  FAIL: $name (expected exit $expected_exit, got $actual_exit)"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+# Helper: build the JSON input that matches the harness shape
+build_input() {
+    local tool="$1"
+    local file_path="$2"
+    local content="$3"
+    python3 -c "
+import json, sys
+print(json.dumps({
+    'tool_name': sys.argv[1],
+    'tool_input': {
+        'file_path': sys.argv[2],
+        'content': sys.argv[3],
+    }
+}))
+" "$tool" "$file_path" "$content"
+}
+
+echo "=== route-handler-emptiness-gate tests ==="
+
+# Case 1: storeResearchReflection — the canonical #61107 case
+echo "[case 1] storeResearchReflection: auth + redirect, no save"
+INPUT=$(build_input "Write" "/app/Http/Controllers/ResearchController.php" '<?php
+class ResearchController extends Controller {
+    public function storeResearchReflection(Request $request) {
+        if (!auth()->check()) {
+            return redirect()->route("login");
+        }
+        $request->validate(["reflection" => "required"]);
+        return redirect()->route("research.index")->with("success", "Saved");
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "storeResearchReflection with no save → strict mode blocks" "2" "$EXIT"
+
+# Case 2: storeResearchReflection — advisory mode allows but warns
+echo "[case 2] storeResearchReflection: advisory mode"
+OUT=$(echo "$INPUT" | "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "advisory mode allows but warns" "0" "$EXIT"
+
+# Case 3: empty destroy() method
+echo "[case 3] empty destroy() method"
+INPUT=$(build_input "Write" "/app/Http/Controllers/UserController.php" '<?php
+class UserController extends Controller {
+    public function destroy($id) {
+        // TODO
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "empty destroy() → strict mode blocks" "2" "$EXIT"
+
+# Case 4: legitimate store() with save — should pass
+echo "[case 4] legitimate store() with save call"
+INPUT=$(build_input "Write" "/app/Http/Controllers/PostController.php" '<?php
+class PostController extends Controller {
+    public function store(Request $request) {
+        $validated = $request->validate(["title" => "required"]);
+        $post = Post::create($validated);
+        return redirect()->route("posts.show", $post);
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "store() with create → passes" "0" "$EXIT"
+
+# Case 5: legitimate destroy with delete — should pass
+echo "[case 5] legitimate destroy with delete"
+INPUT=$(build_input "Write" "/app/Http/Controllers/CommentController.php" '<?php
+class CommentController extends Controller {
+    public function destroy(Comment $comment) {
+        $this->authorize("delete", $comment);
+        $comment->delete();
+        return redirect()->route("comments.index");
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "destroy() with delete → passes" "0" "$EXIT"
+
+# Case 6: service-delegation pattern — should pass (service handles mutation)
+echo "[case 6] service-delegation pattern"
+INPUT=$(build_input "Write" "/app/Http/Controllers/OrderController.php" '<?php
+class OrderController extends Controller {
+    public function store(Request $request, OrderService $orderService) {
+        $validated = $request->validate(["sku" => "required"]);
+        $orderService->createOrder($validated);
+        return redirect()->route("orders.index");
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "store() with service delegation → passes" "0" "$EXIT"
+
+# Case 7: read-only method index() — exempt by name
+echo "[case 7] read-only index() exempt"
+INPUT=$(build_input "Write" "/app/Http/Controllers/PostController.php" '<?php
+class PostController extends Controller {
+    public function index() {
+        $posts = Post::all();
+        return view("posts.index", compact("posts"));
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "index() read-only exempt → passes" "0" "$EXIT"
+
+# Case 8: read-only show() — exempt by name
+echo "[case 8] read-only show() exempt"
+INPUT=$(build_input "Write" "/app/Http/Controllers/PostController.php" '<?php
+class PostController extends Controller {
+    public function show($id) {
+        $post = Post::findOrFail($id);
+        return view("posts.show", compact("post"));
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "show() read-only exempt → passes" "0" "$EXIT"
+
+# Case 9: non-PHP file — should exit early
+echo "[case 9] non-PHP file ignored"
+INPUT=$(build_input "Write" "/app/views/posts.blade.php.bak" 'some random content')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "non-PHP file → exits early" "0" "$EXIT"
+
+# Case 10: non-controller path — should exit early
+echo "[case 10] non-controller path ignored"
+INPUT=$(build_input "Write" "/app/Models/User.php" '<?php class User { public function destroy() { /* no mutation */ } }')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "non-controller path → exits early" "0" "$EXIT"
+
+# Case 11: disabled via env var
+echo "[case 11] CC_HANDLER_GATE_DISABLE=1"
+INPUT=$(build_input "Write" "/app/Http/Controllers/EmptyController.php" '<?php class Foo { public function store(Request $request) { return redirect()->back(); } }')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_DISABLE=1 CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "disabled via env → passes" "0" "$EXIT"
+
+# Case 12: update() with ->update() call
+echo "[case 12] update() with ->update() call"
+INPUT=$(build_input "Edit" "/app/Http/Controllers/UserController.php" '<?php
+class UserController extends Controller {
+    public function update(Request $request, User $user) {
+        $user->update($request->validated());
+        return redirect()->route("users.show", $user);
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "update() with mutation → passes" "0" "$EXIT"
+
+# Case 13: dead-conditional case (mutating method with conditional that never fires)
+echo "[case 13] mutating method with no mutation (dead conditional flag)"
+INPUT=$(build_input "Write" "/app/Http/Controllers/ReturnController.php" '<?php
+class ReturnController extends Controller {
+    public function process(Request $request) {
+        if ($request->is_returning) {
+            // never set anywhere; never executes
+        }
+        return redirect()->route("home");
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "mutating method with no mutation → strict blocks" "2" "$EXIT"
+
+# Case 14: bash allow other tools — should pass
+echo "[case 14] non-Write/Edit tool ignored"
+INPUT=$(build_input "Bash" "/some/file.php" 'irrelevant')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "Bash tool → exits early" "0" "$EXIT"
+
+# Case 15: multiple methods, mixed
+echo "[case 15] multiple methods, one bad one good"
+INPUT=$(build_input "Write" "/app/Http/Controllers/MixedController.php" '<?php
+class MixedController extends Controller {
+    public function index() {
+        return view("posts.index");
+    }
+    public function store(Request $request) {
+        $validated = $request->validate(["title" => "required"]);
+        return redirect()->route("posts.index");
+    }
+    public function update(Request $request, Post $post) {
+        $post->update($request->validated());
+        return redirect()->route("posts.show", $post);
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "mixed methods with one bad → strict blocks" "2" "$EXIT"
+
+# Case 16: empty file
+echo "[case 16] empty content"
+INPUT=$(build_input "Write" "/app/Http/Controllers/EmptyFile.php" '')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "empty content → exits early" "0" "$EXIT"
+
+# Case 17: private constructor exempt
+echo "[case 17] __construct exempt by name"
+INPUT=$(build_input "Write" "/app/Http/Controllers/Constructor.php" '<?php
+class Foo extends Controller {
+    public function __construct(Request $request) {
+        $this->middleware("auth");
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "__construct exempt → passes" "0" "$EXIT"
+
+# Case 18: Edit tool with new_string
+echo "[case 18] Edit tool with new_string"
+INPUT=$(python3 -c "
+import json
+print(json.dumps({
+    'tool_name': 'Edit',
+    'tool_input': {
+        'file_path': '/app/Http/Controllers/PatchController.php',
+        'old_string': 'placeholder',
+        'new_string': '''public function store(Request \$request) {
+            if (!auth()->check()) return redirect();
+            return redirect()->route(\"home\");
+        }'''
+    }
+}))")
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "Edit tool empty store() → strict blocks" "2" "$EXIT"
+
+# Case 19: dispatch-pattern (queued job is a form of service delegation)
+echo "[case 19] dispatch() job pattern"
+INPUT=$(build_input "Write" "/app/Http/Controllers/JobController.php" '<?php
+class JobController extends Controller {
+    public function store(Request $request) {
+        $validated = $request->validate(["payload" => "required"]);
+        ProcessJob::dispatch($validated);
+        return redirect()->route("jobs.index");
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "dispatch job pattern → passes" "0" "$EXIT"
+
+# Case 20: response()->json with no mutation
+echo "[case 20] API endpoint with response->json no mutation"
+INPUT=$(build_input "Write" "/app/Http/Controllers/Api/StatusController.php" '<?php
+class StatusController extends Controller {
+    public function store(Request $request) {
+        return response()->json(["ok" => true]);
+    }
+}')
+OUT=$(echo "$INPUT" | CC_HANDLER_GATE_MODE=strict "$HOOK" 2>/dev/null; echo "exit=$?")
+EXIT=$(echo "$OUT" | tail -1 | sed 's/exit=//')
+assert_exit "store() returning JSON with no mutation → strict blocks" "2" "$EXIT"
+
+echo ""
+echo "=== Results ==="
+echo "PASS: $PASS"
+echo "FAIL: $FAIL"
+
+if [ "$FAIL" -gt 0 ]; then
+    exit 1
+fi
+exit 0

package/tests/test-runtime-binary-change-detector.sh

@@ -0,0 +1,196 @@
+#!/bin/bash
+# Tests for runtime-binary-change-detector.sh
+HOOK="$(dirname "$0")/../examples/runtime-binary-change-detector.sh"
+PASS=0 FAIL=0
+
+TESTROOT=$(mktemp -d)
+trap "rm -rf '$TESTROOT'" EXIT
+
+# Build a fake `claude` binary so the hook has something to fingerprint.
+FAKE_BIN_DIR="$TESTROOT/bin"
+mkdir -p "$FAKE_BIN_DIR"
+FAKE_BIN="$FAKE_BIN_DIR/claude"
+cat > "$FAKE_BIN" <<'EOF'
+#!/bin/bash
+case "$1" in
+  --version) echo "${FAKE_CLAUDE_VERSION:-1.2.3 (Claude Code)}" ;;
+  *) echo "fake claude" ;;
+esac
+EOF
+chmod +x "$FAKE_BIN"
+
+# Helper: invoke the hook with a fresh HOME and the fake binary on PATH.
+run_hook() {
+  local home_dir="$1" event_json="$2"
+  shift 2
+  HOME="$home_dir" PATH="$FAKE_BIN_DIR:$PATH" \
+    env "$@" bash "$HOOK" <<< "$event_json"
+}
+
+# Helper: capture stderr only (the hook's warnings go there).
+run_hook_stderr() {
+  local home_dir="$1" event_json="$2"
+  shift 2
+  HOME="$home_dir" PATH="$FAKE_BIN_DIR:$PATH" \
+    env "$@" bash "$HOOK" <<< "$event_json" 2>&1 >/dev/null
+}
+
+assert_eq() {
+  local desc="$1" expected="$2" actual="$3"
+  if [ "$actual" = "$expected" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS+1))
+  else
+    echo "  FAIL: $desc"
+    echo "        expected: $expected"
+    echo "        actual:   $actual"
+    FAIL=$((FAIL+1))
+  fi
+}
+
+assert_contains() {
+  local desc="$1" needle="$2" haystack="$3"
+  if printf "%s" "$haystack" | grep -qF "$needle"; then
+    echo "  PASS: $desc"
+    PASS=$((PASS+1))
+  else
+    echo "  FAIL: $desc"
+    echo "        needle:   $needle"
+    echo "        haystack: $haystack"
+    FAIL=$((FAIL+1))
+  fi
+}
+
+assert_empty() {
+  local desc="$1" actual="$2"
+  if [ -z "$actual" ]; then
+    echo "  PASS: $desc"
+    PASS=$((PASS+1))
+  else
+    echo "  FAIL: $desc"
+    echo "        expected empty, got: $actual"
+    FAIL=$((FAIL+1))
+  fi
+}
+
+echo "Testing runtime-binary-change-detector.sh"
+echo "========================================="
+
+# Each test uses a fresh HOME so the state file starts clean.
+
+# 1. First session on session_start: creates state, no warning.
+HOME1=$(mktemp -d -p "$TESTROOT")
+out1=$(run_hook_stderr "$HOME1" '{"event":"session_start"}')
+exit1=$?
+assert_eq "first run exits 0" "0" "$exit1"
+assert_empty "first run prints no warning" "$out1"
+if [ -f "$HOME1/.claude/runtime-binary-state.txt" ]; then
+  echo "  PASS: first run created state file"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: first run did not create state file"
+  FAIL=$((FAIL+1))
+fi
+
+# 2. Identical second session: no warning.
+out2=$(run_hook_stderr "$HOME1" '{"event":"session_start"}')
+exit2=$?
+assert_eq "identical session exits 0" "0" "$exit2"
+assert_empty "identical session prints no warning" "$out2"
+
+# 3. Version changed: warning printed.
+HOME3=$(mktemp -d -p "$TESTROOT")
+run_hook "$HOME3" '{"event":"session_start"}' >/dev/null 2>&1
+# Now force the fake binary to return a different version.
+out3=$(run_hook_stderr "$HOME3" '{"event":"session_start"}' \
+  FAKE_CLAUDE_VERSION="2.0.0 (Claude Code)")
+exit3=$?
+assert_eq "version change exits 0" "0" "$exit3"
+assert_contains "version change warns" "binary changed" "$out3"
+assert_contains "version change shows old→new" "→" "$out3"
+assert_contains "version change cites release notes URL" \
+  "github.com/anthropics/claude-code/releases" "$out3"
+
+# 4. State file gets updated after the warning so the next session is silent.
+out4=$(run_hook_stderr "$HOME3" '{"event":"session_start"}' \
+  FAKE_CLAUDE_VERSION="2.0.0 (Claude Code)")
+assert_empty "second session after change is silent again" "$out4"
+
+# 5. Size/mtime change (same version string) is also caught.
+HOME5=$(mktemp -d -p "$TESTROOT")
+run_hook "$HOME5" '{"event":"session_start"}' >/dev/null 2>&1
+# Touch the binary to bump mtime.
+sleep 1
+touch "$FAKE_BIN"
+out5=$(run_hook_stderr "$HOME5" '{"event":"session_start"}')
+assert_contains "mtime-only change warns" "binary changed" "$out5"
+assert_contains "mtime-only change cites size/mtime path" "Path:" "$out5"
+
+# 6. CC_BINARY_DETECTOR_SILENT=1 suppresses the warning.
+HOME6=$(mktemp -d -p "$TESTROOT")
+run_hook "$HOME6" '{"event":"session_start"}' >/dev/null 2>&1
+out6=$(run_hook_stderr "$HOME6" '{"event":"session_start"}' \
+  FAKE_CLAUDE_VERSION="3.0.0 (Claude Code)" \
+  CC_BINARY_DETECTOR_SILENT="1")
+assert_empty "silent mode suppresses warning on version change" "$out6"
+# State should still update so subsequent non-silent sessions don't double-warn.
+out6b=$(run_hook_stderr "$HOME6" '{"event":"session_start"}' \
+  FAKE_CLAUDE_VERSION="3.0.0 (Claude Code)")
+assert_empty "silent mode still updates state (next session quiet)" "$out6b"
+
+# 7. Non-session_start event: hook returns 0 with no work.
+HOME7=$(mktemp -d -p "$TESTROOT")
+out7=$(run_hook_stderr "$HOME7" '{"event":"pre_tool_use","tool_name":"Bash"}')
+exit7=$?
+assert_eq "non-session event exits 0" "0" "$exit7"
+assert_empty "non-session event prints no warning" "$out7"
+if [ -f "$HOME7/.claude/runtime-binary-state.txt" ]; then
+  echo "  FAIL: non-session event should not create state file"
+  FAIL=$((FAIL+1))
+else
+  echo "  PASS: non-session event skipped state write"
+  PASS=$((PASS+1))
+fi
+
+# 8. PascalCase event name (SessionStart) is also accepted.
+HOME8=$(mktemp -d -p "$TESTROOT")
+out8=$(run_hook_stderr "$HOME8" '{"event":"SessionStart"}')
+exit8=$?
+assert_eq "PascalCase SessionStart exits 0" "0" "$exit8"
+if [ -f "$HOME8/.claude/runtime-binary-state.txt" ]; then
+  echo "  PASS: PascalCase SessionStart created state file"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: PascalCase SessionStart did not create state file"
+  FAIL=$((FAIL+1))
+fi
+
+# 9. hook_event_name as a fallback field.
+HOME9=$(mktemp -d -p "$TESTROOT")
+out9=$(run_hook_stderr "$HOME9" '{"hook_event_name":"SessionStart"}')
+exit9=$?
+assert_eq "hook_event_name fallback exits 0" "0" "$exit9"
+if [ -f "$HOME9/.claude/runtime-binary-state.txt" ]; then
+  echo "  PASS: hook_event_name fallback created state file"
+  PASS=$((PASS+1))
+else
+  echo "  FAIL: hook_event_name fallback did not create state file"
+  FAIL=$((FAIL+1))
+fi
+
+# 10. Missing claude binary: hook exits 0 silently.
+# PATH gets a dummy bin dir with no claude. Standard system bins (bash, etc.)
+# must remain reachable, so we prepend the empty dir to the existing PATH
+# instead of replacing it wholesale.
+HOME10=$(mktemp -d -p "$TESTROOT")
+EMPTY_BIN="$TESTROOT/empty"
+mkdir -p "$EMPTY_BIN"
+out10=$(HOME="$HOME10" PATH="$EMPTY_BIN:/usr/bin:/bin" bash "$HOOK" \
+  <<< '{"event":"session_start"}' 2>&1 >/dev/null)
+exit10=$?
+assert_eq "missing claude exits 0" "0" "$exit10"
+assert_empty "missing claude prints nothing" "$out10"
+
+echo "----"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ] || exit 1

package/tests/test-same-command-repeat-detector.sh

@@ -0,0 +1,165 @@
+#!/bin/bash
+# Tests for same-command-repeat-detector.sh
+HOOK="examples/same-command-repeat-detector.sh"
+PASS=0 FAIL=0
+TMPDIR=$(mktemp -d)
+trap "rm -rf $TMPDIR" EXIT
+
+assert_contains() { if echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected '$3', got: $2)"; fi; }
+assert_not_contains() { if ! echo "$2" | grep -q "$3"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (unexpected '$3', got: $2)"; fi; }
+assert_exit() { if [ "$2" = "$3" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $1 (expected exit $3, got $2)"; fi; }
+
+HOOK_ABS="$PWD/$HOOK"
+
+run_hook() {
+    local sid="$1"
+    local cmd="$2"
+    local extra_env="${3:-}"
+    local input
+    input='{"tool_input": {"command": '"$(printf '%s' "$cmd" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))')"'}}'
+    # shellcheck disable=SC2086
+    env TMPDIR="$TMPDIR" CLAUDE_SESSION_ID="$sid" $extra_env bash "$HOOK_ABS" 2>&1 <<< "$input"
+}
+
+# Test 1: First instance of a real command exits 0, no notice (streak = 1)
+OUT=$(run_hook "s1" "npm run build"); RC=$?
+assert_not_contains "first-real no block" "$OUT" "BLOCKED"
+assert_exit "first-real exit 0" "$RC" "0"
+
+# Test 2: Two different commands in a row — streak resets
+OUT=$(run_hook "s2" "npm run build"); _=$?
+OUT=$(run_hook "s2" "ls -la"); RC=$?
+assert_not_contains "different cmd no notice" "$OUT" "NOTICE"
+assert_exit "different cmd exit 0" "$RC" "0"
+
+# Test 3: Second identical command → NOTICE 2/3, exit 0
+OUT=$(run_hook "s3" "npm run build"); _=$?
+OUT=$(run_hook "s3" "npm run build"); RC=$?
+assert_contains "second-same notice" "$OUT" "NOTICE"
+assert_contains "second-same 2/3" "$OUT" "2/3"
+assert_exit "second-same exit 0" "$RC" "0"
+
+# Test 4: Third identical command → BLOCKED, exit 2
+OUT=$(run_hook "s4" "npm run build"); _=$?
+OUT=$(run_hook "s4" "npm run build"); _=$?
+OUT=$(run_hook "s4" "npm run build"); RC=$?
+assert_contains "third-same blocked" "$OUT" "BLOCKED"
+assert_contains "third-same mentions 25F" "$OUT" "25F"
+assert_contains "third-same cites 63887" "$OUT" "63887"
+assert_exit "third-same exit 2" "$RC" "2"
+
+# Test 5: After block, a different command resets the streak
+OUT=$(run_hook "s5" "npm run build"); _=$?
+OUT=$(run_hook "s5" "npm run build"); _=$?
+OUT=$(run_hook "s5" "npm test"); RC=$?  # different command
+assert_not_contains "after-reset no block" "$OUT" "BLOCKED"
+assert_exit "after-reset exit 0" "$RC" "0"
+
+# Test 6: Whitespace canonicalisation — internal whitespace runs collapsed
+OUT=$(run_hook "s6" "npm   run    build"); _=$?  # extra spaces
+OUT=$(run_hook "s6" "npm run build"); RC=$?       # normal — should match
+assert_contains "whitespace canon match" "$OUT" "2/3"
+assert_exit "whitespace canon exit 0" "$RC" "0"
+
+# Test 7: Leading/trailing whitespace stripped
+OUT=$(run_hook "s7" "  npm run build  "); _=$?
+OUT=$(run_hook "s7" "npm run build"); RC=$?
+assert_contains "trim canon match" "$OUT" "2/3"
+assert_exit "trim canon exit 0" "$RC" "0"
+
+# Test 8: Short commands (< 4 chars) are not tracked
+OUT=$(run_hook "s8" "ls"); _=$?
+OUT=$(run_hook "s8" "ls"); _=$?
+OUT=$(run_hook "s8" "ls"); RC=$?
+assert_not_contains "short cmd no block" "$OUT" "BLOCKED"
+assert_exit "short cmd exit 0" "$RC" "0"
+
+# Test 9: Short command (pwd) not tracked
+OUT=$(run_hook "s9" "pwd"); _=$?
+OUT=$(run_hook "s9" "pwd"); _=$?
+OUT=$(run_hook "s9" "pwd"); RC=$?
+assert_exit "pwd short exit 0" "$RC" "0"
+
+# Test 10: CC_SAME_CMD_REPEAT_DISABLE=1 — never block
+OUT=$(run_hook "s10" "make build" "CC_SAME_CMD_REPEAT_DISABLE=1"); _=$?
+OUT=$(run_hook "s10" "make build" "CC_SAME_CMD_REPEAT_DISABLE=1"); _=$?
+OUT=$(run_hook "s10" "make build" "CC_SAME_CMD_REPEAT_DISABLE=1"); RC=$?
+assert_not_contains "DISABLE no block" "$OUT" "BLOCKED"
+assert_not_contains "DISABLE no notice" "$OUT" "NOTICE"
+assert_exit "DISABLE exit 0" "$RC" "0"
+
+# Test 11: CC_SAME_CMD_REPEAT_QUIET=1 — silent but still blocks
+OUT=$(run_hook "s11" "make build" "CC_SAME_CMD_REPEAT_QUIET=1"); _=$?
+OUT=$(run_hook "s11" "make build" "CC_SAME_CMD_REPEAT_QUIET=1"); _=$?
+OUT=$(run_hook "s11" "make build" "CC_SAME_CMD_REPEAT_QUIET=1"); RC=$?
+assert_not_contains "QUIET no message" "$OUT" "BLOCKED"
+assert_exit "QUIET 3rd exit 2" "$RC" "2"
+
+# Test 12: CC_SAME_CMD_REPEAT_THRESHOLD=2 — block at 2nd
+OUT=$(run_hook "s12" "yarn dev" "CC_SAME_CMD_REPEAT_THRESHOLD=2"); _=$?
+OUT=$(run_hook "s12" "yarn dev" "CC_SAME_CMD_REPEAT_THRESHOLD=2"); RC=$?
+assert_contains "THRESHOLD=2 blocks 2nd" "$OUT" "BLOCKED"
+assert_exit "THRESHOLD=2 exit 2" "$RC" "2"
+
+# Test 13: CC_SAME_CMD_REPEAT_THRESHOLD=5 — does not block at 3rd
+OUT=$(run_hook "s13" "yarn build" "CC_SAME_CMD_REPEAT_THRESHOLD=5"); _=$?
+OUT=$(run_hook "s13" "yarn build" "CC_SAME_CMD_REPEAT_THRESHOLD=5"); _=$?
+OUT=$(run_hook "s13" "yarn build" "CC_SAME_CMD_REPEAT_THRESHOLD=5"); RC=$?
+assert_not_contains "THRESHOLD=5 no block at 3" "$OUT" "BLOCKED"
+assert_exit "THRESHOLD=5 3rd exit 0" "$RC" "0"
+
+# Test 14: Manual reset via "# RESET REPEAT" comment
+OUT=$(run_hook "s14" "go build"); _=$?
+OUT=$(run_hook "s14" "go build"); _=$?
+OUT=$(run_hook "s14" "go build # RESET REPEAT"); _=$?  # reset
+OUT=$(run_hook "s14" "go build"); RC=$?  # back to 1
+assert_not_contains "post-reset no block" "$OUT" "BLOCKED"
+assert_exit "post-reset exit 0" "$RC" "0"
+
+# Test 15: Empty input handled (no command in JSON)
+OUT=$(echo '{}' | env TMPDIR="$TMPDIR" CLAUDE_SESSION_ID="s15" bash "$HOOK_ABS" 2>&1); RC=$?
+assert_exit "empty input exit 0" "$RC" "0"
+
+# Test 16: Malformed JSON input handled
+OUT=$(echo 'not json' | env TMPDIR="$TMPDIR" CLAUDE_SESSION_ID="s16" bash "$HOOK_ABS" 2>&1); RC=$?
+assert_exit "malformed input exit 0" "$RC" "0"
+
+# Test 17: Session isolation — same command in two different sessions shouldn't compound
+OUT=$(run_hook "iso-a" "cargo build"); _=$?
+OUT=$(run_hook "iso-a" "cargo build"); _=$?
+OUT=$(run_hook "iso-b" "cargo build"); RC=$?  # different session, fresh streak
+assert_not_contains "iso-b no block" "$OUT" "BLOCKED"
+assert_exit "iso-b exit 0" "$RC" "0"
+
+# Test 18: Long command truncation in block message (display only, detection unchanged)
+LONG_CMD="docker run --rm -v /tmp:/tmp -e FOO=bar -e BAZ=qux -p 8080:80 --network host my-org/my-app:latest"
+OUT=$(run_hook "s18" "$LONG_CMD"); _=$?
+OUT=$(run_hook "s18" "$LONG_CMD"); _=$?
+OUT=$(run_hook "s18" "$LONG_CMD"); RC=$?
+assert_contains "long cmd block fires" "$OUT" "BLOCKED"
+assert_contains "long cmd display truncated" "$OUT" "..."
+assert_exit "long cmd block exit 2" "$RC" "2"
+
+# Test 19: Command with newlines / multiline collapsed to single canonical form
+OUT=$(run_hook "s19" "make
+build"); _=$?
+OUT=$(run_hook "s19" "make build"); RC=$?
+assert_contains "newline collapse match" "$OUT" "2/3"
+assert_exit "newline collapse exit 0" "$RC" "0"
+
+# Test 20: Universal mitigation reference appears in block message
+OUT=$(run_hook "s20" "npm install"); _=$?
+OUT=$(run_hook "s20" "npm install"); _=$?
+OUT=$(run_hook "s20" "npm install"); RC=$?
+assert_contains "block mentions opus-4-7" "$OUT" "opus-4-7"
+assert_exit "block exit 2" "$RC" "2"
+
+# Test 21: Block message names anchor case
+assert_contains "block mentions anchor" "$OUT" "63887"
+
+# Test 22: Cluster 25 framing present in block message
+assert_contains "block mentions cluster 25" "$OUT" "Cluster 25"
+
+echo ""
+echo "Results: $PASS/$((PASS+FAIL)) passed"
+[ "$FAIL" -eq 0 ] || exit 1