specweave 0.33.3 → 0.33.5

package/plugins/specweave/hooks/hooks.json

@@ -40,6 +40,16 @@
           }
         ]
       },
+      {
+        "matcher": "Write",
+        "matcher_content": "\\.specweave/increments/\\d{3,4}E?-[^/]+/spec\\.md",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash -c 'W=\"${CLAUDE_PLUGIN_ROOT}/hooks/universal/fail-fast-wrapper.sh\"; S=\"${CLAUDE_PLUGIN_ROOT}/hooks/v2/guards/metadata-json-guard.sh\"; [[ -x \"$W\" ]] && exec \"$W\" \"$S\" || (cat >/dev/null && printf \"{\\\"decision\\\":\\\"allow\\\"}\")'"
+          }
+        ]
+      },
       {
         "matcher": "Write",
         "matcher_content": "\\.specweave/increments/\\d{3,4}E?-[^/]+/spec\\.md",

package/plugins/specweave/hooks/spec-project-validator.sh

@@ -61,18 +61,40 @@ fi
 # Extract YAML frontmatter
 FRONTMATTER=$(echo "$CONTENT" | sed -n '/^---$/,/^---$/p' | tail -n +2 | head -n -1)
 
-# Check for unresolved project placeholder
+# Check for unresolved project placeholder (legacy {{PROJECT_ID}})
 if echo "$FRONTMATTER" | grep -q 'project:\s*{{PROJECT_ID}}'; then
   echo '{"decision": "block", "reason": "spec.md has unresolved placeholder {{PROJECT_ID}}. Run '\''specweave context projects'\'' to get available projects, then select one."}'
   exit 0
 fi
 
-# Check for unresolved board placeholder
+# Check for unresolved board placeholder (legacy {{BOARD_ID}})
 if echo "$FRONTMATTER" | grep -q 'board:\s*{{BOARD_ID}}'; then
   echo '{"decision": "block", "reason": "spec.md has unresolved placeholder {{BOARD_ID}}. Run '\''specweave context boards --project=<id>'\'' to get available boards, then select one."}'
   exit 0
 fi
 
+# Check for ANY unresolved {{...}} placeholder in frontmatter (v0.34.0+)
+# This catches {{RESOLVED_PROJECT}}, {{RESOLVED_BOARD}}, and any other placeholders
+if echo "$FRONTMATTER" | grep -qE '\{\{[A-Z_]+\}\}'; then
+  FOUND_PLACEHOLDERS=$(echo "$FRONTMATTER" | grep -oE '\{\{[A-Z_]+\}\}' | tr '\n' ', ' | sed 's/,$//')
+  echo "{\"decision\": \"block\", \"reason\": \"spec.md has unresolved placeholders: ${FOUND_PLACEHOLDERS}\\n\\nYOU MUST RESOLVE these BEFORE creating spec.md:\\n1. Run: specweave context projects\\n2. Parse the JSON output to get valid project/board IDs\\n3. Replace placeholders with actual values from step 2\\n\\n❌ FORBIDDEN: Using placeholder templates directly\\n✅ REQUIRED: Resolve ALL placeholders to actual values\"}"
+  exit 0
+fi
+
+# Check for ANY unresolved {{...}} placeholder in full content (catches per-US **Project**: {{...}})
+if echo "$CONTENT" | grep -qE '\*\*Project\*\*:\s*\{\{[A-Z_]+\}\}'; then
+  FOUND_PLACEHOLDERS=$(echo "$CONTENT" | grep -oE '\*\*Project\*\*:\s*\{\{[A-Z_]+\}\}' | head -1)
+  echo "{\"decision\": \"block\", \"reason\": \"spec.md has unresolved **Project**: placeholder\\n\\nFound: ${FOUND_PLACEHOLDERS}\\n\\nEach user story MUST have a resolved **Project**: field.\\n\\n1. Run: specweave context projects\\n2. Get valid project IDs from the JSON output\\n3. Replace the placeholder with an actual project ID\"}"
+  exit 0
+fi
+
+# Check for unresolved **Board**: placeholders in full content (2-level structures)
+if echo "$CONTENT" | grep -qE '\*\*Board\*\*:\s*\{\{[A-Z_]+\}\}'; then
+  FOUND_PLACEHOLDERS=$(echo "$CONTENT" | grep -oE '\*\*Board\*\*:\s*\{\{[A-Z_]+\}\}' | head -1)
+  echo "{\"decision\": \"block\", \"reason\": \"spec.md has unresolved **Board**: placeholder\\n\\nFound: ${FOUND_PLACEHOLDERS}\\n\\nEach user story MUST have a resolved **Board**: field (for 2-level structures).\\n\\n1. Run: specweave context projects\\n2. Get valid board IDs from boardsByProject in the JSON output\\n3. Replace the placeholder with an actual board ID\"}"
+  exit 0
+fi
+
 # Extract project and board from frontmatter
 PROJECT=$(echo "$FRONTMATTER" | grep -E '^project:\s*' | sed 's/^project:\s*//' | tr -d '"'"'" | tr -d '[:space:]')
 BOARD=$(echo "$FRONTMATTER" | grep -E '^board:\s*' | sed 's/^board:\s*//' | tr -d '"'"'" | tr -d '[:space:]')

package/plugins/specweave/hooks/universal/hook-wrapper.cmd

@@ -1,26 +1,26 @@
-@echo off
-REM hook-wrapper.cmd - Windows resilient hook launcher
-REM Prevents crashes when dispatcher.mjs is temporarily unavailable
-
-setlocal enabledelayedexpansion
-
-set "HOOK_TYPE=%~1"
-if "%HOOK_TYPE%"=="" set "HOOK_TYPE=unknown"
-
-set "SCRIPT_DIR=%~dp0"
-set "DISPATCHER=%SCRIPT_DIR%dispatcher.mjs"
-
-REM Check if dispatcher exists
-if not exist "%DISPATCHER%" (
-    echo {"continue":true,"systemMessage":"Hook skipped: dispatcher.mjs not found"}
-    exit /b 0
-)
-
-REM Run dispatcher with error suppression
-node "%DISPATCHER%" "%HOOK_TYPE%" 2>nul
-if errorlevel 1 (
-    echo {"continue":true,"systemMessage":"Hook error, continuing"}
-    exit /b 0
-)
-
-exit /b 0
+@echo off
+REM hook-wrapper.cmd - Windows resilient hook launcher
+REM Prevents crashes when dispatcher.mjs is temporarily unavailable
+
+setlocal enabledelayedexpansion
+
+set "HOOK_TYPE=%~1"
+if "%HOOK_TYPE%"=="" set "HOOK_TYPE=unknown"
+
+set "SCRIPT_DIR=%~dp0"
+set "DISPATCHER=%SCRIPT_DIR%dispatcher.mjs"
+
+REM Check if dispatcher exists
+if not exist "%DISPATCHER%" (
+    echo {"continue":true,"systemMessage":"Hook skipped: dispatcher.mjs not found"}
+    exit /b 0
+)
+
+REM Run dispatcher with error suppression
+node "%DISPATCHER%" "%HOOK_TYPE%" 2>nul
+if errorlevel 1 (
+    echo {"continue":true,"systemMessage":"Hook error, continuing"}
+    exit /b 0
+)
+
+exit /b 0

package/plugins/specweave/hooks/universal/session-start.cmd

@@ -1,16 +1,16 @@
-@echo off
-:: Universal Session Start Hook for Windows
-:: Calls the Node.js dispatcher
-
-:: Find node.exe
-where node >nul 2>&1
-if %ERRORLEVEL% neq 0 (
-    echo {"continue": true, "error": "Node.js not found"}
-    exit /b 0
-)
-
-:: Get the directory of this script
-set "SCRIPT_DIR=%~dp0"
-
-:: Run the dispatcher
-node "%SCRIPT_DIR%dispatcher.mjs" session-start
+@echo off
+:: Universal Session Start Hook for Windows
+:: Calls the Node.js dispatcher
+
+:: Find node.exe
+where node >nul 2>&1
+if %ERRORLEVEL% neq 0 (
+    echo {"continue": true, "error": "Node.js not found"}
+    exit /b 0
+)
+
+:: Get the directory of this script
+set "SCRIPT_DIR=%~dp0"
+
+:: Run the dispatcher
+node "%SCRIPT_DIR%dispatcher.mjs" session-start

package/plugins/specweave/hooks/universal/session-start.ps1

@@ -1,16 +1,16 @@
-# Universal Session Start Hook for Windows PowerShell
-# Calls the Node.js dispatcher for cross-platform compatibility
-
-# Find node.exe
-$nodePath = Get-Command node -ErrorAction SilentlyContinue
-
-if (-not $nodePath) {
-    Write-Host '{"continue": true, "error": "Node.js not found"}'
-    exit 0
-}
-
-# Get script directory
-$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
-
-# Run the dispatcher
-& node "$scriptDir\dispatcher.mjs" session-start
+# Universal Session Start Hook for Windows PowerShell
+# Calls the Node.js dispatcher for cross-platform compatibility
+
+# Find node.exe
+$nodePath = Get-Command node -ErrorAction SilentlyContinue
+
+if (-not $nodePath) {
+    Write-Host '{"continue": true, "error": "Node.js not found"}'
+    exit 0
+}
+
+# Get script directory
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+
+# Run the dispatcher
+& node "$scriptDir\dispatcher.mjs" session-start

package/plugins/specweave/hooks/v2/guards/metadata-json-guard.sh

@@ -0,0 +1,87 @@
+#!/bin/bash
+#
+# metadata-json-guard.sh
+#
+# Pre-tool-use hook that ensures metadata.json exists BEFORE spec.md can be created.
+# This prevents increments from being created without proper metadata.
+#
+# ROOT CAUSE: When Claude creates increments via user prompt (not /specweave:increment),
+# metadata.json may be forgotten, causing:
+# - Status tracking broken
+# - WIP limits don't work
+# - External sync fails (GitHub/Jira/ADO)
+# - All increment commands fail
+#
+# SOLUTION: Block spec.md creation if metadata.json doesn't exist in same increment folder.
+# Claude MUST create metadata.json FIRST, then spec.md.
+#
+# Activation:
+# - tool_name: Write
+# - file_path matches: .specweave/increments/*/spec.md
+#
+# Returns exit code 2 (block) if metadata.json missing, 0 (allow) otherwise.
+#
+# Bypass: Set SPECWEAVE_FORCE_METADATA=1 to skip validation
+#
+# v0.34.0 - Initial implementation based on user project bug analysis
+
+set -e
+
+# Check for force bypass
+if [ "$SPECWEAVE_FORCE_METADATA" = "1" ]; then
+  echo '{"decision": "allow", "message": "metadata.json guard bypassed (SPECWEAVE_FORCE_METADATA=1)"}'
+  exit 0
+fi
+
+# Disable hooks bypass
+if [ "$SPECWEAVE_DISABLE_HOOKS" = "1" ]; then
+  echo '{"decision": "allow"}'
+  exit 0
+fi
+
+# Read tool input from stdin
+INPUT=$(cat)
+
+# Extract tool name
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // .tool_input.tool_name // ""' 2>/dev/null || echo "")
+
+# Only validate Write tool calls
+if [ "$TOOL_NAME" != "Write" ]; then
+  echo '{"decision": "allow"}'
+  exit 0
+fi
+
+# Extract file path - handle both formats
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .file_path // ""' 2>/dev/null || echo "")
+
+# Only validate spec.md files in increments folder
+# Match: 3-4 digits, optional E suffix, kebab-case name, spec.md
+if [[ ! "$FILE_PATH" =~ \.specweave/increments/([0-9]{3,4}E?-[^/]+)/spec\.md$ ]]; then
+  echo '{"decision": "allow"}'
+  exit 0
+fi
+
+# Extract increment folder path
+INCREMENT_DIR=$(dirname "$FILE_PATH")
+INCREMENT_ID="${BASH_REMATCH[1]}"
+
+# Check if metadata.json exists in the same increment folder
+METADATA_PATH="${INCREMENT_DIR}/metadata.json"
+
+if [ -f "$METADATA_PATH" ]; then
+  # metadata.json exists, allow spec.md creation
+  echo '{"decision": "allow"}'
+  exit 0
+fi
+
+# metadata.json doesn't exist - BLOCK spec.md creation
+NOW=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+cat << BLOCK_EOF
+{
+  "decision": "block",
+  "reason": "🚫 BLOCKED: Cannot create spec.md without metadata.json\n\n⚠️ CRITICAL RULE: metadata.json MUST be created FIRST!\n\nWithout metadata.json:\n  - ❌ Status tracking broken\n  - ❌ WIP limits don't work\n  - ❌ External sync fails (GitHub/Jira/ADO)\n  - ❌ All increment commands fail\n\n📋 CORRECT WORKFLOW:\n1. Create metadata.json FIRST:\n   Write({\n     file_path: \"${METADATA_PATH}\",\n     content: {\n       \"id\": \"${INCREMENT_ID}\",\n       \"status\": \"planned\",\n       \"type\": \"feature\",\n       \"priority\": \"P1\",\n       \"created\": \"${NOW}\",\n       \"lastActivity\": \"${NOW}\",\n       \"testMode\": \"TDD\",\n       \"coverageTarget\": 95,\n       \"feature_id\": null,\n       \"epic_id\": null,\n       \"externalLinks\": {}\n     }\n   })\n\n2. THEN create spec.md\n\n📖 See: CLAUDE.md section '3. metadata.json is MANDATORY'\n\n💡 Bypass: Set SPECWEAVE_FORCE_METADATA=1 to skip this validation"
+}
+BLOCK_EOF
+
+exit 2

package/plugins/specweave/hooks/v2/guards/metadata-json-guard.test.sh

@@ -0,0 +1,302 @@
+#!/bin/bash
+# Comprehensive test suite for metadata-json-guard.sh
+# Tests that spec.md creation is blocked when metadata.json is missing
+#
+# Usage: bash metadata-json-guard.test.sh
+#
+# v0.34.0 - Initial test suite
+
+set -e
+
+GUARD="$(dirname "$0")/metadata-json-guard.sh"
+TEST_DIR=$(mktemp -d)
+PASS=0
+FAIL=0
+TOTAL=0
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+cleanup() {
+  rm -rf "$TEST_DIR"
+}
+trap cleanup EXIT
+
+# Create test increment structure
+setup_test_increment() {
+  local with_metadata="$1"
+  local increment_name="${2:-0001-test-feature}"
+
+  mkdir -p "$TEST_DIR/.specweave/increments/$increment_name"
+
+  if [ "$with_metadata" = "true" ]; then
+    cat > "$TEST_DIR/.specweave/increments/$increment_name/metadata.json" << 'EOF'
+{
+  "id": "0001-test-feature",
+  "status": "planned",
+  "type": "feature",
+  "priority": "P1",
+  "created": "2025-12-10T00:00:00Z",
+  "lastActivity": "2025-12-10T00:00:00Z",
+  "testMode": "TDD",
+  "coverageTarget": 95,
+  "feature_id": null,
+  "epic_id": null,
+  "externalLinks": {}
+}
+EOF
+  fi
+}
+
+# Test helper: should block
+test_should_block() {
+  local name="$1"
+  local file_path="$2"
+  local content="$3"
+  TOTAL=$((TOTAL + 1))
+
+  # Build JSON input for the guard
+  local json_input
+  json_input=$(jq -n \
+    --arg tool_name "Write" \
+    --arg file_path "$file_path" \
+    --arg content "$content" \
+    '{tool_name: $tool_name, tool_input: {file_path: $file_path, content: $content}}')
+
+  result=$(echo "$json_input" | bash "$GUARD" 2>&1; echo "EXIT:$?")
+  exit_code=$(echo "$result" | grep -o 'EXIT:[0-9]*' | cut -d: -f2)
+
+  if [[ "$exit_code" == "2" ]]; then
+    echo -e "${GREEN}✓ BLOCKED${NC}: $name"
+    PASS=$((PASS + 1))
+  else
+    echo -e "${RED}✗ NOT BLOCKED${NC}: $name"
+    echo "  File: $file_path"
+    echo "  Exit code: $exit_code (expected 2)"
+    echo "  Output: $(echo "$result" | head -5)"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# Test helper: should allow
+test_should_allow() {
+  local name="$1"
+  local file_path="$2"
+  local content="$3"
+  TOTAL=$((TOTAL + 1))
+
+  # Build JSON input for the guard
+  local json_input
+  json_input=$(jq -n \
+    --arg tool_name "Write" \
+    --arg file_path "$file_path" \
+    --arg content "$content" \
+    '{tool_name: $tool_name, tool_input: {file_path: $file_path, content: $content}}')
+
+  result=$(echo "$json_input" | bash "$GUARD" 2>&1; echo "EXIT:$?")
+  exit_code=$(echo "$result" | grep -o 'EXIT:[0-9]*' | cut -d: -f2)
+
+  if [[ "$exit_code" == "0" ]]; then
+    echo -e "${GREEN}✓ ALLOWED${NC}: $name"
+    PASS=$((PASS + 1))
+  else
+    echo -e "${RED}✗ WRONGLY BLOCKED${NC}: $name"
+    echo "  File: $file_path"
+    echo "  Exit code: $exit_code (expected 0)"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# Test non-Write tools (should always allow)
+test_non_write_tool() {
+  local name="$1"
+  local tool_name="$2"
+  TOTAL=$((TOTAL + 1))
+
+  local json_input
+  json_input=$(jq -n \
+    --arg tool_name "$tool_name" \
+    --arg file_path "$TEST_DIR/.specweave/increments/0001-test/spec.md" \
+    '{tool_name: $tool_name, tool_input: {file_path: $file_path}}')
+
+  result=$(echo "$json_input" | bash "$GUARD" 2>&1; echo "EXIT:$?")
+  exit_code=$(echo "$result" | grep -o 'EXIT:[0-9]*' | cut -d: -f2)
+
+  if [[ "$exit_code" == "0" ]]; then
+    echo -e "${GREEN}✓ ALLOWED (non-Write)${NC}: $name"
+    PASS=$((PASS + 1))
+  else
+    echo -e "${RED}✗ WRONGLY BLOCKED${NC}: $name"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+echo "========================================"
+echo "  METADATA JSON GUARD - COMPREHENSIVE TESTS"
+echo "========================================"
+echo ""
+echo "Test directory: $TEST_DIR"
+echo ""
+
+echo -e "${YELLOW}=== CORE FUNCTIONALITY: BLOCK WHEN METADATA MISSING ===${NC}"
+
+# Setup without metadata
+setup_test_increment "false" "0001-no-metadata"
+test_should_block "spec.md without metadata.json (3-digit)" \
+  "$TEST_DIR/.specweave/increments/0001-no-metadata/spec.md" \
+  "---\nincrement: 0001-no-metadata\n---"
+
+setup_test_increment "false" "0012-no-metadata"
+test_should_block "spec.md without metadata.json (4-digit)" \
+  "$TEST_DIR/.specweave/increments/0012-no-metadata/spec.md" \
+  "---\nincrement: 0012-no-metadata\n---"
+
+setup_test_increment "false" "123-short"
+test_should_block "spec.md without metadata.json (3-digit short)" \
+  "$TEST_DIR/.specweave/increments/123-short/spec.md" \
+  "---\nincrement: 123-short\n---"
+
+setup_test_increment "false" "0001E-external"
+test_should_block "spec.md without metadata.json (external E suffix)" \
+  "$TEST_DIR/.specweave/increments/0001E-external/spec.md" \
+  "---\nincrement: 0001E-external\n---"
+
+echo ""
+echo -e "${YELLOW}=== CORE FUNCTIONALITY: ALLOW WHEN METADATA EXISTS ===${NC}"
+
+# Setup with metadata
+setup_test_increment "true" "0002-has-metadata"
+test_should_allow "spec.md WITH metadata.json present" \
+  "$TEST_DIR/.specweave/increments/0002-has-metadata/spec.md" \
+  "---\nincrement: 0002-has-metadata\n---"
+
+setup_test_increment "true" "0123E-external-with-meta"
+test_should_allow "spec.md WITH metadata.json (external E suffix)" \
+  "$TEST_DIR/.specweave/increments/0123E-external-with-meta/spec.md" \
+  "---\nincrement: 0123E-external-with-meta\n---"
+
+echo ""
+echo -e "${YELLOW}=== NON-SPEC FILES: SHOULD NOT VALIDATE ===${NC}"
+
+# Create increment without metadata for these tests
+setup_test_increment "false" "0003-other-files"
+test_should_allow "plan.md (not spec.md)" \
+  "$TEST_DIR/.specweave/increments/0003-other-files/plan.md" \
+  "# Plan"
+
+test_should_allow "tasks.md (not spec.md)" \
+  "$TEST_DIR/.specweave/increments/0003-other-files/tasks.md" \
+  "# Tasks"
+
+test_should_allow "metadata.json itself" \
+  "$TEST_DIR/.specweave/increments/0003-other-files/metadata.json" \
+  '{"id": "test"}'
+
+test_should_allow "report in subfolder" \
+  "$TEST_DIR/.specweave/increments/0003-other-files/reports/COMPLETION.md" \
+  "# Report"
+
+echo ""
+echo -e "${YELLOW}=== FILES OUTSIDE INCREMENTS: SHOULD NOT VALIDATE ===${NC}"
+
+test_should_allow "spec.md outside increments (docs)" \
+  "$TEST_DIR/.specweave/docs/internal/spec.md" \
+  "# Documentation"
+
+test_should_allow "spec.md in root" \
+  "$TEST_DIR/spec.md" \
+  "# Root spec"
+
+test_should_allow "Random file" \
+  "$TEST_DIR/random.txt" \
+  "Random content"
+
+echo ""
+echo -e "${YELLOW}=== NON-WRITE TOOLS: SHOULD ALWAYS ALLOW ===${NC}"
+
+test_non_write_tool "Read tool" "Read"
+test_non_write_tool "Edit tool" "Edit"
+test_non_write_tool "Glob tool" "Glob"
+test_non_write_tool "Grep tool" "Grep"
+test_non_write_tool "Bash tool" "Bash"
+
+echo ""
+echo -e "${YELLOW}=== BYPASS MODES ===${NC}"
+
+# Test SPECWEAVE_FORCE_METADATA bypass
+setup_test_increment "false" "0004-bypass"
+TOTAL=$((TOTAL + 1))
+json_input=$(jq -n \
+  --arg tool_name "Write" \
+  --arg file_path "$TEST_DIR/.specweave/increments/0004-bypass/spec.md" \
+  --arg content "---\nincrement: 0004-bypass\n---" \
+  '{tool_name: $tool_name, tool_input: {file_path: $file_path, content: $content}}')
+
+result=$(SPECWEAVE_FORCE_METADATA=1 bash -c "echo '$json_input' | bash '$GUARD'" 2>&1; echo "EXIT:$?")
+exit_code=$(echo "$result" | grep -o 'EXIT:[0-9]*' | cut -d: -f2)
+if [[ "$exit_code" == "0" ]] && echo "$result" | grep -q "bypassed"; then
+  echo -e "${GREEN}✓ ALLOWED (bypass)${NC}: SPECWEAVE_FORCE_METADATA=1 works"
+  PASS=$((PASS + 1))
+else
+  echo -e "${RED}✗ BYPASS FAILED${NC}: SPECWEAVE_FORCE_METADATA=1"
+  echo "  Exit code: $exit_code"
+  FAIL=$((FAIL + 1))
+fi
+
+# Test SPECWEAVE_DISABLE_HOOKS bypass
+TOTAL=$((TOTAL + 1))
+result=$(SPECWEAVE_DISABLE_HOOKS=1 bash -c "echo '$json_input' | bash '$GUARD'" 2>&1; echo "EXIT:$?")
+exit_code=$(echo "$result" | grep -o 'EXIT:[0-9]*' | cut -d: -f2)
+if [[ "$exit_code" == "0" ]]; then
+  echo -e "${GREEN}✓ ALLOWED (bypass)${NC}: SPECWEAVE_DISABLE_HOOKS=1 works"
+  PASS=$((PASS + 1))
+else
+  echo -e "${RED}✗ BYPASS FAILED${NC}: SPECWEAVE_DISABLE_HOOKS=1"
+  FAIL=$((FAIL + 1))
+fi
+
+echo ""
+echo -e "${YELLOW}=== EDGE CASES ===${NC}"
+
+# Test with empty file path
+TOTAL=$((TOTAL + 1))
+json_input='{"tool_name": "Write", "tool_input": {"file_path": "", "content": "test"}}'
+result=$(echo "$json_input" | bash "$GUARD" 2>&1; echo "EXIT:$?")
+exit_code=$(echo "$result" | grep -o 'EXIT:[0-9]*' | cut -d: -f2)
+if [[ "$exit_code" == "0" ]]; then
+  echo -e "${GREEN}✓ ALLOWED${NC}: Empty file path"
+  PASS=$((PASS + 1))
+else
+  echo -e "${RED}✗ FAILED${NC}: Empty file path should be allowed"
+  FAIL=$((FAIL + 1))
+fi
+
+# Test with malformed JSON (should fail gracefully)
+TOTAL=$((TOTAL + 1))
+result=$(echo "not json" | bash "$GUARD" 2>&1; echo "EXIT:$?")
+exit_code=$(echo "$result" | grep -o 'EXIT:[0-9]*' | cut -d: -f2)
+if [[ "$exit_code" == "0" ]]; then
+  echo -e "${GREEN}✓ ALLOWED${NC}: Malformed JSON handled gracefully"
+  PASS=$((PASS + 1))
+else
+  echo -e "${RED}✗ FAILED${NC}: Malformed JSON should be allowed (fail-safe)"
+  FAIL=$((FAIL + 1))
+fi
+
+echo ""
+echo "========================================"
+echo "  RESULTS"
+echo "========================================"
+echo -e "Total: $TOTAL"
+echo -e "${GREEN}Passed: $PASS${NC}"
+if [[ $FAIL -gt 0 ]]; then
+  echo -e "${RED}Failed: $FAIL${NC}"
+  exit 1
+else
+  echo -e "Failed: 0"
+  echo ""
+  echo -e "${GREEN}ALL TESTS PASSED!${NC}"
+fi