#!/usr/bin/env bash
H="${QC_HOOK:-/home/user/.claude/hooks/quietcontext-nudge.sh}"
run(){ jq -nc --arg c "$1" '{tool_name:"Bash",tool_input:{command:$c}}' | "$H" | grep -q deny && echo DENY || echo ALLOW; }
declare -a T=(
"DENY|grep -rn TODO ."
"DENY|find . -name '*.ts'"
"DENY|grep -r useState src/"
"DENY|git ls-files"
"DENY|cat src/*.ts"
"DENY|ls -R ."
"DENY|find . -name '*.ts' | sort"
"DENY|find . -type f -name '*.md' | xargs grep -l draft"
"ALLOW|find . -name '*.ts' | xargs wc -l | sort -rn | head -5"
"ALLOW|grep -rn TODO --include='*.js' . | wc -l"
"ALLOW|ls *.md | head -3"
"ALLOW|git ls-files | head"
"ALLOW|find . -name '*.ts' | sed -n '1,20p'"
"ALLOW|grep -rn TODO . | awk 'NR<=5'"
"ALLOW|grep -rc TODO src/"
"ALLOW|git ls-files | wc -l"
"ALLOW|find . -name '*.log' -delete"
"ALLOW|git status --short"
"ALLOW|npm run build"
"ALLOW|cat package.json"
"ALLOW|grep -rn TODO . # raw-ok"
"ALLOW|git ls-files | xargs sed -i 's/a/b/g'"
# Regression: quietcontext-gate false positive on cdx dispatch (2026-08-16).
# (a) cdx exec is an output-bounded dispatch wrapper — exempt outright, even
#     when its quoted prompt payload talks about reading/testing many files.
"ALLOW|cdx exec -m gpt-5 -c \"grep -r TODO . and run bash packaging/test-deploy-local.sh across every file\" \"read all the files in src/ and find bugs\""
# (b) a genuinely unbounded read still blocks (unchanged trigger case).
"DENY|grep -rn TODO ."
# (c) read-heavy prose inside a quoted literal, in an otherwise-innocent
#     (non-cdx) command, must not trip the scanner via the quoted text.
"ALLOW|echo \"find . -name '*.ts' and grep -r TODO src/\""
)
p=0;f=0
for t in "${T[@]}"; do
  exp="${t%%|*}"; cmd="${t#*|}"; got=$(run "$cmd")
  if [[ "$exp" == "$got" ]]; then p=$((p+1)); else f=$((f+1)); printf 'FAIL exp=%s got=%s :: %s\n' "$exp" "$got" "$cmd"; fi
done
echo "pass=$p fail=$f"