claude-code-superkit 0.0.0-stage → 1.5.3

package/packages/core/hooks/tests/chain-semantics/run-experiment.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+# run-experiment.sh — runs h1, h2, h3 directly (not via Claude Code) using
+# both sequential and background modes, so we can observe the mechanics of
+# each approach in isolation.
+#
+# For the TRUE Claude Code behaviour you must copy settings-experiment.json
+# into a test project's .claude/settings.json, open it in Claude Code,
+# invoke a Bash tool, and inspect the log. This script only proves the hook
+# scripts themselves work — not how Claude Code schedules them.
+#
+# Usage: bash run-experiment.sh
+
+set -u
+DIR=$(cd "$(dirname "$0")" && pwd)
+export CHAIN_TEST_LOG="${TMPDIR:-/tmp}/claude-chain-test.log"
+export CHAIN_TEST_MARKER="${TMPDIR:-/tmp}/claude-chain-test-h3-ran"
+
+rm -f "$CHAIN_TEST_LOG" "$CHAIN_TEST_MARKER"
+
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "▶ SEQUENTIAL mode (what settings.json LOOKS like it does)"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+bash "$DIR/h1.sh" >/dev/null 2>&1 && echo "  h1 exit=0"
+H1_EXIT=$?
+echo "  h1 exit=$H1_EXIT"
+bash "$DIR/h2.sh" >/dev/null 2>&1
+echo "  h2 exit=$?"
+bash "$DIR/h3.sh" >/dev/null 2>&1
+echo "  h3 exit=$?"
+echo ""
+echo "  LOG:"
+sed 's/^/    /' "$CHAIN_TEST_LOG"
+echo ""
+[ -f "$CHAIN_TEST_MARKER" ] && echo "  h3 marker exists: YES" || echo "  h3 marker exists: NO"
+rm -f "$CHAIN_TEST_LOG" "$CHAIN_TEST_MARKER"
+
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "▶ PARALLEL mode (what Anthropic docs say Claude Code actually does)"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+bash "$DIR/h1.sh" >/dev/null 2>&1 &
+bash "$DIR/h2.sh" >/dev/null 2>&1 &
+bash "$DIR/h3.sh" >/dev/null 2>&1 &
+wait
+echo ""
+echo "  LOG (sorted by timestamp — interleaving proves parallelism):"
+sort "$CHAIN_TEST_LOG" | sed 's/^/    /'
+echo ""
+[ -f "$CHAIN_TEST_MARKER" ] && echo "  h3 marker exists: YES (h3 ran despite h1 exit 2)" || echo "  h3 marker exists: NO"
+
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "▶ How to verify inside real Claude Code"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+cat <<'HELP'
+  1. Create a throwaway project:   mkdir /tmp/cc-chain-test && cd /tmp/cc-chain-test
+  2. Copy the experiment settings: mkdir -p .claude && \
+                                   cp <superkit>/packages/core/hooks/tests/chain-semantics/settings-experiment.json \
+                                      .claude/settings.json
+     (edit ${CLAUDE_PROJECT_DIR} substitutions to point at the superkit clone)
+  3. Open Claude Code in that directory.
+  4. Ask it to run any Bash command — e.g. "run: ls".
+  5. Inspect /tmp/claude-chain-test.log (interleaving) and /tmp/claude-chain-test-h3-ran (presence).
+  6. Record observations in CHAIN-SEMANTICS.md.
+HELP

package/packages/core/hooks/tests/chain-semantics/settings-experiment.json

@@ -0,0 +1,15 @@
+{
+  "_comment": "Temporary Claude Code settings for the hook-chain-semantics experiment. Place the file at .claude/settings.json inside a throwaway project directory, then open it with Claude Code and run a single `ls` command. The three hooks h1/h2/h3 will fire simultaneously. Observe /tmp/claude-chain-test.log for interleaving and /tmp/claude-chain-test-h3-ran for h3's marker. Restore your real settings.json afterwards.",
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          { "type": "command", "command": "${CLAUDE_PROJECT_DIR}/packages/core/hooks/tests/chain-semantics/h1.sh" },
+          { "type": "command", "command": "${CLAUDE_PROJECT_DIR}/packages/core/hooks/tests/chain-semantics/h2.sh" },
+          { "type": "command", "command": "${CLAUDE_PROJECT_DIR}/packages/core/hooks/tests/chain-semantics/h3.sh" }
+        ]
+      }
+    ]
+  }
+}

package/packages/core/hooks/tests/counts-verify_test.sh

@@ -0,0 +1,118 @@
+#!/bin/bash
+# counts-verify_test.sh — regression test for superkit-counts-verify.sh (Task 19)
+#
+# Asserts:
+#   1. the verifier PASSES (exit 0) on the current, correct repo (local commit)
+#   2. a skewed README count is DETECTED (exit 2), then the README is restored
+#   3. the network About check is gated: a local commit does NOT call `gh`,
+#      while --check-remote / git push opt in
+#
+# Hermetic: README.md is backed up and restored via a trap, even on failure.
+# The verifier resolves CLAUDE.md / README.md / packages/* relative to CWD,
+# so the test runs from the repo root.
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../../../.." && pwd)"
+HOOK="$REPO_ROOT/packages/core/hooks/superkit-counts-verify.sh"
+[ -x "$HOOK" ] || { echo "FAIL: hook not executable at $HOOK"; exit 1; }
+[ -f "$REPO_ROOT/README.md" ] || { echo "FAIL: README.md not found at repo root $REPO_ROOT"; exit 1; }
+
+README="$REPO_ROOT/README.md"
+BACKUP="$(mktemp "${TMPDIR:-/tmp}/counts-verify-readme-backup.XXXXXX")"
+cp "$README" "$BACKUP"
+
+restore() { cp "$BACKUP" "$README"; rm -f "$BACKUP"; }
+trap restore EXIT
+
+run_commit() {
+  # Run the verifier as a git-commit PreToolUse payload from the repo root.
+  # Force CHECK_REMOTE off so the test never makes a network call.
+  ( cd "$REPO_ROOT" && echo '{"tool_input":{"command":"git commit -m test"}}' \
+      | SUPERKIT_VERIFY_CHECK_REMOTE=0 bash "$HOOK" >/dev/null 2>&1 )
+}
+
+# ── Test 1: clean repo passes ─────────────────────────────────────────
+if run_commit; then
+  echo "PASS: verifier passes on the current correct repo"
+else
+  echo "FAIL: verifier should pass on the unmodified repo (exit non-zero)"
+  exit 1
+fi
+
+# ── Test 2: skewed README count is detected ───────────────────────────
+# Bump the "Core Agents" row number to a bogus value and confirm a block.
+# Uses the same label anchor the verifier relies on.
+LINE=$(grep -nE '^\| \*\*Core Agents\*\* \|' "$README" | head -1 | cut -d: -f1)
+if [ -z "$LINE" ]; then
+  echo "FAIL: could not find '| **Core Agents** |' row to skew"
+  exit 1
+fi
+ORIG=$(sed -n "${LINE}p" "$README")
+# Replace the first integer in the row cell with a clearly-wrong 999.
+SKEWED=$(printf '%s' "$ORIG" | sed -E 's/(\| \*\*Core Agents\*\* \| )[0-9]+/\1999/')
+if [ "$SKEWED" = "$ORIG" ]; then
+  echo "FAIL: could not skew the Core Agents count (regex did not match)"
+  exit 1
+fi
+# Write the skewed line back in place.
+TMP_README="$(mktemp "${TMPDIR:-/tmp}/counts-verify-skewed.XXXXXX")"
+awk -v ln="$LINE" -v repl="$SKEWED" 'NR==ln{print repl; next} {print}' "$README" > "$TMP_README"
+cp "$TMP_README" "$README"
+rm -f "$TMP_README"
+
+if run_commit; then
+  echo "FAIL: verifier should BLOCK when a README count is skewed"
+  restore; trap - EXIT
+  exit 1
+else
+  echo "PASS: verifier blocks on skewed README count"
+fi
+
+# Restore and confirm the repo is green again.
+restore
+trap - EXIT
+if run_commit; then
+  echo "PASS: verifier green again after restore"
+else
+  echo "FAIL: verifier should pass after restoring README"
+  exit 1
+fi
+
+# ── Test 3: network check is gated off for local commits ──────────────
+# Stub `gh` to touch a sentinel file when invoked. The verifier suppresses
+# gh's stderr (2>/dev/null), so signal via a file instead of stderr.
+# Prepend the stub dir to PATH so it wins over any real gh.
+STUB_DIR="$(mktemp -d "${TMPDIR:-/tmp}/counts-verify-stub.XXXXXX")"
+SENTINEL="$STUB_DIR/gh-was-called"
+cat > "$STUB_DIR/gh" <<STUB
+#!/bin/sh
+touch "$SENTINEL"
+# Emit an empty description so the verifier's [ -n "\$GH_DESC" ] guard skips
+# the About comparison (no false block).
+exit 0
+STUB
+chmod +x "$STUB_DIR/gh"
+
+rm -f "$SENTINEL"
+( cd "$REPO_ROOT" && echo '{"tool_input":{"command":"git commit -m test"}}' \
+  | PATH="$STUB_DIR:$PATH" SUPERKIT_VERIFY_CHECK_REMOTE=0 bash "$HOOK" >/dev/null 2>&1 ) || true
+if [ -f "$SENTINEL" ]; then
+  echo "FAIL: local commit invoked gh (network check should be gated off)"
+  rm -rf "$STUB_DIR"; exit 1
+fi
+echo "PASS: local commit does not invoke gh (network gated off)"
+
+# --check-remote opts in: the stub gh IS called.
+rm -f "$SENTINEL"
+( cd "$REPO_ROOT" && echo '{"tool_input":{"command":"git commit -m test"}}' \
+  | PATH="$STUB_DIR:$PATH" bash "$HOOK" --check-remote >/dev/null 2>&1 ) || true
+if [ -f "$SENTINEL" ]; then
+  echo "PASS: --check-remote invokes gh"
+else
+  echo "FAIL: --check-remote should invoke gh"
+  rm -rf "$STUB_DIR"; exit 1
+fi
+rm -rf "$STUB_DIR"
+
+echo ""
+echo "ALL COUNTS-VERIFY TESTS PASSED"

package/packages/core/hooks/tests/dev-required-on-commit_test.sh

@@ -0,0 +1,207 @@
+#!/bin/bash
+# dev-required-on-commit_test.sh — regression tests for dev-required-on-commit.sh
+# Usage: bash packages/core/hooks/tests/dev-required-on-commit_test.sh
+# Exit codes: 0 if all cases pass, 1 on first failure.
+
+set -u
+
+HOOK=$(cd "$(dirname "$0")/.." && pwd)/dev-required-on-commit.sh
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+
+SID="test-dev-required-$$"
+COUNTER="${TMPDIR:-/tmp}/claude-edit-count-${SID}"
+MARKER="${TMPDIR:-/tmp}/claude-dev-marker-${SID}"
+# Long-lived anti-reset cycle log — the hook derives this path from
+# SESSION_KEY (= session_id = SID).
+CYCLES_FILE="$HOME/.claude/state/dev-cycles-${SID}.jsonl"
+
+PASS=0
+FAIL=0
+FAIL_DETAILS=""
+
+# Clear ALL session state between cases — including the anti-reset cycle log,
+# so override cases never inherit a consecutive-override penalty from earlier
+# cases. (The final call also cleans up the long-lived file on the way out.)
+reset_state() { rm -f "$COUNTER" "$MARKER" "$CYCLES_FILE"; }
+
+run_case() {
+  local name="$1"
+  local expected="$2"
+  shift 2
+  local repo="$TMP/case-$PASS-$FAIL"
+  rm -rf "$repo"
+  mkdir -p "$repo"
+  (cd "$repo" && git init -q && git -c user.email=t@t -c user.name=t commit --allow-empty -qm init)
+  # NOTE: caller manages counter/marker state so we don't wipe pre-set values.
+  # shellcheck disable=SC2068
+  $@ "$repo"
+  local payload
+  payload=$(printf '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"git -C %s commit -m %s"},"session_id":"%s"}' "$repo" "${COMMIT_MSG:-test}" "$SID")
+  local actual
+  actual=$(echo "$payload" | bash "$HOOK" >/dev/null 2>&1; echo $?)
+  if [ "$actual" = "$expected" ]; then
+    echo "  ✓ $name (exit=$actual)"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ $name — expected $expected, got $actual"
+    FAIL=$((FAIL + 1))
+    FAIL_DETAILS="${FAIL_DETAILS}\n  - $name (expected=$expected actual=$actual)"
+  fi
+  unset COMMIT_MSG
+}
+
+# ── Case helpers ──────────────────────────────────────────────────────────
+
+stage_code() {
+  local r="$1"
+  (cd "$r" && mkdir -p backend && \
+    echo "package main" > backend/main.go && \
+    git add backend/main.go)
+}
+
+stage_docs_only() {
+  local r="$1"
+  (cd "$r" && \
+    echo "# readme" > README.md && \
+    git add README.md)
+}
+
+# Exempt-path stagers: a CODE file under memory/ or .claude/ must still be
+# treated as exempt (HAS_CODE stays false) — the D3 regression target.
+stage_memory() {
+  local r="$1"
+  (cd "$r" && mkdir -p memory && \
+    echo "package mem" > memory/snippet.go && \
+    git add memory/snippet.go)
+}
+
+stage_claude() {
+  local r="$1"
+  (cd "$r" && mkdir -p .claude && \
+    echo "package cfg" > .claude/config.go && \
+    git add .claude/config.go)
+}
+
+set_counter() { echo "$1" > "$COUNTER"; }
+set_marker() { touch "$MARKER"; }
+
+# ── Run suite ──────────────────────────────────────────────────────────────
+
+echo "dev-required-on-commit_test.sh — regression suite"
+echo ""
+
+# Case A: 0 edits + code staged → allow
+reset_state
+run_case "A: 0 edits + code staged → ALLOW" 0 stage_code
+
+# Case B: 3 edits + code + no /dev marker → BLOCK
+reset_state; set_counter 3
+run_case "B: 3 edits + code + no /dev → BLOCK" 2 stage_code
+
+# Case C: 3 edits + [quick: <rationale≥15 chars>] → ALLOW (Task 12)
+reset_state; set_counter 3
+COMMIT_MSG="'[quick: minor config path adjustment, no logic change]'"
+run_case "C: 3 edits + [quick: …] rationale → ALLOW" 0 stage_code
+[ ! -f "$COUNTER" ] && [ ! -f "$MARKER" ] && echo "    (state reset verified)" || echo "    WARN: state not reset after C"
+
+# Case D: 3 edits + marker present → ALLOW
+reset_state; set_counter 3; set_marker
+run_case "D: 3 edits + /dev marker → ALLOW" 0 stage_code
+
+# Case E: 5 edits + docs-only staged → ALLOW (docs-only exempt)
+reset_state; set_counter 5
+run_case "E: 5 edits + docs-only → ALLOW (exempt)" 0 stage_docs_only
+
+# Case F: [no-dev: <rationale>] override on any count → ALLOW
+reset_state; set_counter 10
+COMMIT_MSG="'[no-dev: infra-only change, .claude settings]'"
+run_case "F: [no-dev: …] rationale → ALLOW" 0 stage_code
+
+# ── Task 12 cases ─────────────────────────────────────────────────────────
+
+# Case G: bare [quick] without rationale → BLOCK (Task 12)
+reset_state; set_counter 3
+COMMIT_MSG="'[quick] typo'"
+run_case "G: bare [quick] (no rationale) → BLOCK" 2 stage_code
+
+# Case H: [quick: short] rationale <15 chars → BLOCK
+reset_state; set_counter 3
+COMMIT_MSG="'[quick: tiny]'"
+run_case "H: [quick: tiny] under 15 chars → BLOCK" 2 stage_code
+
+# Case I: [hotfix] without ticket → BLOCK
+reset_state; set_counter 3
+COMMIT_MSG="'[hotfix] emergency'"
+run_case "I: bare [hotfix] (no ticket) → BLOCK" 2 stage_code
+
+# Case J: [hotfix: #42 fix] → ALLOW (ticket present)
+reset_state; set_counter 3
+COMMIT_MSG="'[hotfix: #42 urgent auth regression]'"
+run_case "J: [hotfix: #42 …] ticket → ALLOW" 0 stage_code
+
+# Case K: [hotfix: no-ticket: <reason ≥15>] → ALLOW
+reset_state; set_counter 3
+COMMIT_MSG="'[hotfix: no-ticket: customer-reported 500 on payment flow]'"
+run_case "K: [hotfix: no-ticket: …] explicit justification → ALLOW" 0 stage_code
+
+# ── D3 regression: exempt short-circuit + intentional tag match ────────────
+
+# Case L: memory-only commit whose message MENTIONS a tag in prose → ALLOW.
+# (Old bug: the override regex grepped the whole command string, so a prose
+#  mention of [no-dev: x] — reason <15 chars — hard-blocked an exempt commit.)
+reset_state
+COMMIT_MSG="'note explaining the [no-dev: x] override tag for future readers'"
+run_case "L: memory-only + prose tag mention → ALLOW (exempt)" 0 stage_memory
+
+# Case M: memory-only, no tag at all → ALLOW
+reset_state
+run_case "M: memory-only + no tag → ALLOW (exempt)" 0 stage_memory
+
+# Case N: .claude-only commit → ALLOW
+reset_state
+run_case "N: .claude-only → ALLOW (exempt)" 0 stage_claude
+
+# Case O: code commit under anti-reset penalty (OVERRIDE_DISABLED) carrying a
+# real LEADING override tag → BLOCK. Seed 3 consecutive override cycles so
+# consecutive_override_tail ≥ 3 flips OVERRIDE_DISABLED=true.
+reset_state; set_counter 3
+mkdir -p "$(dirname "$CYCLES_FILE")"
+_now=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+{
+  printf '{"ts":"%s","outcome":"allow-override","tag":"[quick]","counter":0}\n' "$_now"
+  printf '{"ts":"%s","outcome":"allow-override","tag":"[quick]","counter":0}\n' "$_now"
+  printf '{"ts":"%s","outcome":"allow-override","tag":"[quick]","counter":0}\n' "$_now"
+} > "$CYCLES_FILE"
+COMMIT_MSG="'[no-dev: real infra change, but override path is locked now]'"
+run_case "O: code + penalty + real leading tag → BLOCK (penalty)" 2 stage_code
+
+# Case P: code commit with a valid LEADING tag, no penalty → ALLOW *and* a
+# cycle must be appended to the anti-reset log (feeds cycles_last_hour).
+reset_state; set_counter 3
+COMMIT_MSG="'[quick: legitimate small fix with enough rationale text]'"
+run_case "P: code + valid leading tag, no penalty → ALLOW" 0 stage_code
+if grep -q '"outcome":"allow-override"' "$CYCLES_FILE" 2>/dev/null; then
+  echo "  ✓ P-state: allow-override cycle appended"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ P-state: expected allow-override cycle in cycle log"
+  FAIL=$((FAIL + 1))
+  FAIL_DETAILS="${FAIL_DETAILS}\n  - P-state: no allow-override cycle appended"
+fi
+
+# Case Q: code commit whose message mentions a tag only MID-SENTENCE → NOT an
+# override; control falls to the normal edit-budget block (count 3, no /dev
+# marker) → BLOCK.
+reset_state; set_counter 3
+COMMIT_MSG="'fix the [no-dev: handling] path in the commit parser code'"
+run_case "Q: code + mid-sentence tag mention → BLOCK (not an override)" 2 stage_code
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+reset_state
+if [ "$FAIL" -gt 0 ]; then
+  echo -e "Failures:${FAIL_DETAILS}"
+  exit 1
+fi
+exit 0

package/packages/core/hooks/tests/dev-required-wip-on-main_test.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Regression: [wip] commit on main must be BLOCKED (exit 2).
+set -u
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/dev-required-on-commit.sh"
+TMP=$(mktemp -d); cd "$TMP"
+git init -q && git -c user.email=t@t -c user.name=t checkout -q -b main
+git -c user.email=t@t -c user.name=t commit -q --allow-empty -m "init"
+# Stage a CODE file: the wip-on-main rule lives in the override branch, which
+# (after the D3 fix) is reached only for non-exempt code commits. A non-code
+# ([wip] on a .txt) commit now correctly short-circuits to exit 0.
+echo "package main" > a.go && git add a.go
+
+PAYLOAD='{"tool_name":"Bash","tool_input":{"command":"git commit -m \"[wip] x\""}}'
+OUT=$(printf '%s' "$PAYLOAD" | bash "$HOOK" 2>&1); RC=$?
+
+if [ "$RC" -eq 2 ] && printf '%s' "$OUT" | grep -q "not allowed on main"; then
+  echo "PASS: [wip] on main blocked"; cd /; rm -rf "$TMP"; exit 0
+else
+  echo "FAIL: rc=$RC out=$OUT"; cd /; rm -rf "$TMP"; exit 1
+fi

package/packages/core/hooks/tests/doc-check-on-commit_test.sh

@@ -0,0 +1,122 @@
+#!/bin/bash
+# doc-check-on-commit_test.sh — regression tests for packages/core/hooks/doc-check-on-commit.sh
+#
+# Usage: bash packages/core/hooks/tests/doc-check-on-commit_test.sh
+# Exit codes: 0 if all cases pass, 1 on first failure.
+
+set -u
+
+HOOK=$(cd "$(dirname "$0")/.." && pwd)/doc-check-on-commit.sh
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+
+PASS=0
+FAIL=0
+FAIL_DETAILS=""
+
+run_case() {
+  local name="$1"
+  local expected="$2"
+  shift 2
+  # Each case prepares its own repo state in a subshell + checks exit.
+  local repo="$TMP/case-$PASS-$FAIL"
+  rm -rf "$repo"
+  mkdir -p "$repo"
+  (cd "$repo" && git init -q && git -c user.email=t@t -c user.name=t commit --allow-empty -qm init)
+  # shellcheck disable=SC2068
+  $@ "$repo"
+  # Payload uses `git -C <repo> commit` so the hook runs `git diff` against
+  # the right repo regardless of caller's cwd.
+  local payload
+  payload=$(printf '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"git -C %s commit -m test"}}' "$repo")
+  local actual
+  actual=$(echo "$payload" | CLAUDE_PROJECT_DIR="$repo" bash "$HOOK" >/dev/null 2>&1; echo $?)
+  if [ "$actual" = "$expected" ]; then
+    echo "  ✓ $name (exit=$actual)"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ $name — expected $expected, got $actual"
+    FAIL=$((FAIL + 1))
+    FAIL_DETAILS="${FAIL_DETAILS}\n  - $name (expected=$expected actual=$actual)"
+  fi
+}
+
+# ── Case setup helpers ─────────────────────────────────────────────────────
+
+stage_code_only() {
+  local r="$1"
+  (cd "$r" && mkdir -p backend/migrations && \
+    echo "CREATE TABLE foo();" > backend/migrations/001_foo.up.sql && \
+    git add backend/migrations/001_foo.up.sql)
+}
+
+stage_code_plus_plan() {
+  local r="$1"
+  (cd "$r" && mkdir -p backend/migrations docs/superpowers/plans && \
+    echo "CREATE TABLE foo();" > backend/migrations/001_foo.up.sql && \
+    echo "# plan" > docs/superpowers/plans/2026-04-14-foo.md && \
+    git add backend/migrations/001_foo.up.sql docs/superpowers/plans/2026-04-14-foo.md)
+}
+
+stage_code_plus_memory() {
+  local r="$1"
+  (cd "$r" && mkdir -p backend/migrations memory && \
+    echo "CREATE TABLE foo();" > backend/migrations/001_foo.up.sql && \
+    echo "# memory note" > memory/note.md && \
+    git add backend/migrations/001_foo.up.sql memory/note.md)
+}
+
+stage_code_plus_changelog() {
+  local r="$1"
+  (cd "$r" && mkdir -p backend/migrations && \
+    echo "CREATE TABLE foo();" > backend/migrations/001_foo.up.sql && \
+    echo "# changelog" > CHANGELOG.md && \
+    git add backend/migrations/001_foo.up.sql CHANGELOG.md)
+}
+
+stage_code_plus_arch_doc() {
+  local r="$1"
+  (cd "$r" && mkdir -p backend/migrations docs/architecture && \
+    echo "CREATE TABLE foo();" > backend/migrations/001_foo.up.sql && \
+    echo "# Database schema\nTable foo added" > docs/architecture/database-schema.md && \
+    echo "# CLAUDE" > CLAUDE.md && \
+    git add backend/migrations/001_foo.up.sql docs/architecture/database-schema.md CLAUDE.md)
+}
+
+stage_new_jobs_file() {
+  local r="$1"
+  (cd "$r" && mkdir -p backend/jobs && \
+    echo "package jobs" > backend/jobs/cleanup.go && \
+    git add backend/jobs/cleanup.go)
+}
+
+stage_modified_middleware() {
+  local r="$1"
+  (cd "$r" && mkdir -p backend/middleware && \
+    echo "package middleware // v1" > backend/middleware/auth.go && \
+    git add backend/middleware/auth.go && \
+    git -c user.email=t@t -c user.name=t commit -qm init-middleware && \
+    echo "package middleware // v2" > backend/middleware/auth.go && \
+    git add backend/middleware/auth.go)
+}
+
+# ── Run suite ──────────────────────────────────────────────────────────────
+
+echo "doc-check-on-commit_test.sh — regression suite"
+echo ""
+
+run_case "code-only commit (migration, no docs) → BLOCK"        2 stage_code_only
+run_case "code + plan file → BLOCK (plan does not satisfy)"     2 stage_code_plus_plan
+run_case "code + memory/*.md → BLOCK (memory does not satisfy)" 2 stage_code_plus_memory
+run_case "code + CHANGELOG → BLOCK (CHANGELOG does not satisfy)" 2 stage_code_plus_changelog
+run_case "code + matching arch doc + CLAUDE.md → ALLOW"         0 stage_code_plus_arch_doc
+run_case "new */jobs/**/*.go → BLOCK (backend-layers + tree)"   2 stage_new_jobs_file
+run_case "modified */middleware/*.go → BLOCK (backend-layers)"  2 stage_modified_middleware
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+if [ "$FAIL" -gt 0 ]; then
+  echo -e "Failures:${FAIL_DETAILS}"
+  exit 1
+fi
+exit 0

package/packages/core/hooks/tests/edit-streak-check_test.sh

@@ -0,0 +1,106 @@
+#!/bin/bash
+# edit-streak-check_test.sh — regression test for edit-streak-check.sh
+set -euo pipefail
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/edit-streak-check.sh"
+[ -x "$HOOK" ] || { echo "FAIL: hook not executable at $HOOK"; exit 1; }
+
+TMPDIR="${TMPDIR:-/tmp}"
+STREAK_FILE="$TMPDIR/claude-edit-streak-test-$$"
+export CLAUDE_EDIT_STREAK_FILE="$STREAK_FILE"
+rm -f "$STREAK_FILE"
+
+fire_edit() {
+  echo '{"tool_name":"Edit","tool_input":{"file_path":"/tmp/fake.txt"}}' | bash "$HOOK" 2>&1 >/dev/null
+}
+
+fire_bash() {
+  echo '{"tool_name":"Bash","tool_input":{"command":"echo hi"}}' | bash "$HOOK" 2>&1 >/dev/null
+}
+
+# Test 1: 4 edits — no warning yet
+for i in 1 2 3 4; do
+  OUT=$(fire_edit || true)
+  if echo "$OUT" | grep -q "edit streak"; then
+    echo "FAIL: warning fired at edit $i (should start at 5)"
+    exit 1
+  fi
+done
+echo "PASS: edits 1-4 silent"
+
+# Test 2: 5th edit — warning fires
+OUT=$(fire_edit || true)
+if ! echo "$OUT" | grep -q "edit streak — 5"; then
+  echo "FAIL: 5th edit should warn"
+  echo "stderr was: $OUT"
+  exit 1
+fi
+echo "PASS: 5th edit warns"
+
+# Test 3: Bash call resets counter
+fire_bash
+if [ -f "$STREAK_FILE" ]; then
+  echo "FAIL: Bash did not clear streak file"
+  exit 1
+fi
+echo "PASS: Bash resets streak"
+
+# Test 4: After reset, next edit is 1 again (silent)
+OUT=$(fire_edit || true)
+if echo "$OUT" | grep -q "edit streak"; then
+  echo "FAIL: first edit after reset should be silent"
+  exit 1
+fi
+echo "PASS: post-reset silent"
+
+# Test 5: CLAUDE_DISABLE_EDIT_STREAK=1 silences even at 10+
+rm -f "$STREAK_FILE"
+for i in 1 2 3 4 5 6 7 8 9 10; do
+  OUT=$(CLAUDE_DISABLE_EDIT_STREAK=1 fire_edit || true)
+  if echo "$OUT" | grep -q "edit streak"; then
+    echo "FAIL: CLAUDE_DISABLE_EDIT_STREAK=1 should silence"
+    exit 1
+  fi
+done
+echo "PASS: opt-out silences"
+
+# Test 6: fast profile skips entirely
+rm -f "$STREAK_FILE"
+OUT=$(CLAUDE_HOOK_PROFILE=fast fire_edit || true)
+# In fast, no file should be written
+if [ -f "$STREAK_FILE" ]; then
+  echo "FAIL: fast profile should not update streak file"
+  exit 1
+fi
+echo "PASS: fast profile skips"
+
+# Test 7: cross-call accumulation via SESSION_ID
+# Empirically proves whether per-session state survives across hook invocations.
+# Without fix: each `bash "$HOOK"` spawns a new PID → different PPID → count resets.
+# With fix (superkit_session_key): SESSION_ID wins, all 5 calls share one state file.
+export SESSION_ID="test-sess-$$"
+unset CLAUDE_EDIT_STREAK_FILE
+SESS_STREAK_FILE="${TMPDIR}/claude-edit-streak-${SESSION_ID}"
+rm -f "$SESS_STREAK_FILE"
+
+for i in 1 2 3 4 5; do
+  echo '{"tool_name":"Edit","tool_input":{"file_path":"/tmp/fake.txt"}}' | bash "$HOOK" 2>/dev/null || true
+done
+
+SESS_COUNT=$(cat "$SESS_STREAK_FILE" 2>/dev/null || echo 0)
+if [ "$SESS_COUNT" -lt 5 ]; then
+  echo "FAIL: cross-call accumulation — state did not accumulate across invocations (count=$SESS_COUNT, expected 5)"
+  echo "  Likely cause: hook uses bare \$PPID instead of superkit_session_key()"
+  unset SESSION_ID
+  rm -f "$SESS_STREAK_FILE"
+  exit 1
+fi
+echo "PASS: cross-call accumulation via SESSION_ID (count=$SESS_COUNT)"
+
+unset SESSION_ID
+rm -f "$SESS_STREAK_FILE"
+
+# Cleanup
+rm -f "$STREAK_FILE"
+echo ""
+echo "ALL EDIT-STREAK TESTS PASSED (7/7)"