cc-safe-setup 11.2.0 → 11.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/.claude/session-snapshot.md +8 -8
  2. package/README.md +1 -1
  3. package/cc-safe-setup-export.json +1 -1
  4. package/examples/api-endpoint-guard.sh +31 -0
  5. package/examples/crontab-guard.sh +11 -0
  6. package/examples/dependency-version-pin.sh +36 -0
  7. package/index.mjs +1 -0
  8. package/package.json +1 -1
package/.claude/session-snapshot.md CHANGED
@@ -1,5 +1,5 @@
1
1
  # Session Snapshot (auto-generated)
2
- Updated: 2026-03-24T20:43:46+09:00
2
+ Updated: 2026-03-24T22:17:08+09:00
3
3
 
4
4
  ## Git
5
5
  - Branch: `main`
@@ -7,19 +7,19 @@ Updated: 2026-03-24T20:43:46+09:00
7
7
  ```
8
8
  M .claude/session-snapshot.md
9
9
  ```
10
- - Last commit: 5711024 checkpoint: auto-save 20:43:45
10
+ - Last commit: 98ecdeb checkpoint: auto-save 22:17:06
11
11
 
12
12
  ## Recent Files
13
13
  ```
14
14
  ./.claude/session-snapshot.md
15
15
  ./test.sh
16
16
  ./README.md
17
- ./examples/typosquat-guard.sh
18
- ./examples/typescript-strict-guard.sh
19
- ./examples/git-author-guard.sh
20
- ./examples/permission-cache.sh
17
+ ./examples/crontab-guard.sh
18
+ ./examples/api-endpoint-guard.sh
19
+ ./examples/dependency-version-pin.sh
20
+ ./examples/auto-approve-readonly.sh
21
+ ./examples/max-session-duration.sh
21
22
  ./CHANGELOG.md
22
- ./examples/stale-env-guard.sh
23
- ./examples/test-coverage-guard.sh
23
+ ./examples/typosquat-guard.sh
24
24
  ```
25
25
 
package/README.md CHANGED
@@ -6,7 +6,7 @@
6
6
 
7
7
  **One command to make Claude Code safe for autonomous operation.** [日本語](docs/README.ja.md)
8
8
 
9
- 8 built-in + 104 examples = **118 hooks**. 40 CLI commands. 544 tests. 5 languages. [**Hub**](https://yurukusa.github.io/cc-safe-setup/hub.html) · [Cheat Sheet](https://yurukusa.github.io/cc-safe-setup/hooks-cheatsheet.html) · [Builder](https://yurukusa.github.io/cc-safe-setup/builder.html) · [FAQ](https://yurukusa.github.io/cc-safe-setup/faq.html) · [Examples](https://yurukusa.github.io/cc-safe-setup/by-example.html) · [Matrix](https://yurukusa.github.io/cc-safe-setup/matrix.html) · [Playground](https://yurukusa.github.io/cc-hook-registry/playground.html)
9
+ 8 built-in + 104 examples = **118 hooks**. 40 CLI commands. 561 tests. 5 languages. [**Hub**](https://yurukusa.github.io/cc-safe-setup/hub.html) · [Cheat Sheet](https://yurukusa.github.io/cc-safe-setup/hooks-cheatsheet.html) · [Builder](https://yurukusa.github.io/cc-safe-setup/builder.html) · [FAQ](https://yurukusa.github.io/cc-safe-setup/faq.html) · [Examples](https://yurukusa.github.io/cc-safe-setup/by-example.html) · [Matrix](https://yurukusa.github.io/cc-safe-setup/matrix.html) · [Playground](https://yurukusa.github.io/cc-hook-registry/playground.html)
10
10
 
11
11
  ```bash
12
12
  npx cc-safe-setup
package/cc-safe-setup-export.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "version": "1.0",
3
3
  "generator": "cc-safe-setup",
4
- "exported_at": "2026-03-24T11:43:55.322Z",
4
+ "exported_at": "2026-03-24T13:17:16.952Z",
5
5
  "hooks": {
6
6
  "UserPromptSubmit": [
7
7
  {
package/examples/api-endpoint-guard.sh ADDED
@@ -0,0 +1,31 @@
1
+ #!/bin/bash
2
+ # ================================================================
3
+ # api-endpoint-guard.sh — Warn on requests to internal/sensitive APIs
4
+ # ================================================================
5
+ # PURPOSE:
6
+ # Claude sometimes sends requests to localhost, internal APIs,
7
+ # or metadata endpoints that could leak credentials or cause
8
+ # unintended side effects.
9
+ #
10
+ # TRIGGER: PreToolUse MATCHER: "Bash"
11
+ # ================================================================
12
+
13
+ COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
14
+ [ -z "$COMMAND" ] && exit 0
15
+
16
+ # Only check curl/wget/http commands
17
+ echo "$COMMAND" | grep -qE '^\s*(curl|wget|http|fetch)' || exit 0
18
+
19
+ # Check for internal/sensitive URLs
20
+ if echo "$COMMAND" | grep -qiE '(169\.254\.169\.254|metadata\.google|metadata\.aws)'; then
21
+ echo "BLOCKED: Request to cloud metadata endpoint detected." >&2
22
+ echo "This could leak IAM credentials." >&2
23
+ exit 2
24
+ fi
25
+
26
+ if echo "$COMMAND" | grep -qiE 'localhost:[0-9]+/(admin|api/internal|_debug|actuator)'; then
27
+ echo "WARNING: Request to internal API endpoint." >&2
28
+ echo "Verify this is intentional." >&2
29
+ fi
30
+
31
+ exit 0
package/examples/crontab-guard.sh ADDED
@@ -0,0 +1,11 @@
1
+ #!/bin/bash
2
+ # crontab-guard.sh — Warn before modifying crontab
3
+ # TRIGGER: PreToolUse MATCHER: "Bash"
4
+ COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
5
+ [ -z "$COMMAND" ] && exit 0
6
+ if echo "$COMMAND" | grep -qE '\bcrontab\s+(-r|-e|-)'; then
7
+ echo "WARNING: Modifying crontab. Current entries:" >&2
8
+ crontab -l 2>/dev/null | wc -l | xargs -I{} echo " {} existing cron jobs" >&2
9
+ echo " Use 'crontab -l' to review before editing." >&2
10
+ fi
11
+ exit 0
package/examples/dependency-version-pin.sh ADDED
@@ -0,0 +1,36 @@
1
+ #!/bin/bash
2
+ # ================================================================
3
+ # dependency-version-pin.sh — Warn on unpinned dependency versions
4
+ # ================================================================
5
+ # PURPOSE:
6
+ # Claude adds dependencies with ^ or ~ ranges. Without a lockfile,
7
+ # this means different installs get different versions. This hook
8
+ # warns when package.json is edited to add range-based versions.
9
+ #
10
+ # TRIGGER: PostToolUse MATCHER: "Edit"
11
+ # ================================================================
12
+
13
+ INPUT=$(cat)
14
+ FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
15
+ [ -z "$FILE" ] && exit 0
16
+ case "$FILE" in */package.json|package.json) ;; *) exit 0 ;; esac
17
+
18
+ NEW=$(echo "$INPUT" | jq -r '.tool_input.new_string // empty' 2>/dev/null)
19
+ [ -z "$NEW" ] && exit 0
20
+
21
+ # Check for range specifiers in new content
22
+ RANGES=$(echo "$NEW" | grep -oE '"\^[0-9]|"~[0-9]' | wc -l)
23
+ if [ "$RANGES" -gt 0 ]; then
24
+ # Check if lockfile exists
25
+ HAS_LOCK=0
26
+ [ -f "package-lock.json" ] && HAS_LOCK=1
27
+ [ -f "yarn.lock" ] && HAS_LOCK=1
28
+ [ -f "pnpm-lock.yaml" ] && HAS_LOCK=1
29
+
30
+ if [ "$HAS_LOCK" -eq 0 ]; then
31
+ echo "WARNING: $RANGES dependency(ies) with version ranges (^ or ~) but no lockfile." >&2
32
+ echo "Pin exact versions or add a lockfile for reproducible builds." >&2
33
+ fi
34
+ fi
35
+
36
+ exit 0
package/index.mjs CHANGED
@@ -398,6 +398,7 @@ function examples() {
398
398
  'auto-approve-gradle.sh': 'Auto-approve gradle/gradlew build/test',
399
399
  'auto-approve-maven.sh': 'Auto-approve mvn compile/test/verify',
400
400
  'permission-cache.sh': 'Auto-approve previously approved commands in session',
401
+ 'auto-approve-readonly.sh': 'Auto-approve 50+ read-only commands (cat, ls, grep, find)',
401
402
  },
402
403
  'Quality': {
403
404
  'branch-name-check.sh': 'Warn on non-conventional branch names',
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "cc-safe-setup",
3
- "version": "11.2.0",
3
+ "version": "11.4.0",
4
4
  "description": "One command to make Claude Code safe. 59 hooks (8 built-in + 51 examples). 26 CLI commands: dashboard, create, audit, lint, diff, migrate, compare, generate-ci. 284 tests.",
5
5
  "main": "index.mjs",
6
6
  "bin": {