cc-safe-setup 2.0.6 → 2.0.8

package/README.md

@@ -160,11 +160,12 @@ Or browse all available examples in [`examples/`](examples/):
 - **timeout-guard.sh** — Warn before long-running commands (npm start, rails s, docker-compose up)
 - **branch-name-check.sh** — Warn on non-conventional branch names (feature/, fix/, etc.)
 - **todo-check.sh** — Warn when committing files with TODO/FIXME/HACK markers
+- **path-traversal-guard.sh** — Block Edit/Write with `../../` path traversal and system directories
 
 ## Learn More
 
 - [Official Hooks Reference](https://code.claude.com/docs/en/hooks) — Claude Code hooks documentation
-- [Hooks Cookbook](https://github.com/yurukusa/claude-code-hooks/blob/main/COOKBOOK.md) — 17 ready-to-use recipes from real GitHub Issues
+- [Hooks Cookbook](https://github.com/yurukusa/claude-code-hooks/blob/main/COOKBOOK.md) — 18 ready-to-use recipes from real GitHub Issues
 - [Japanese guide (Qiita)](https://qiita.com/yurukusa/items/a9714b33f5d974e8f1e8) — この記事の日本語解説
 - [The incident that inspired this tool](https://github.com/anthropics/claude-code/issues/36339) — NTFS junction rm -rf
 

package/examples/README.md

@@ -1,6 +1,6 @@
 # Example Hooks
 
-19 hooks beyond the 8 built-in ones, organized by category.
+25 hooks beyond the 8 built-in ones, organized by category.
 
 ## Quick Start
 
@@ -48,6 +48,7 @@ npx cc-safe-setup --examples
 | **enforce-tests.sh** | Warn when source changes without tests | |
 | **large-file-guard.sh** | Warn when Write creates files >500KB | |
 | **todo-check.sh** | Warn when committing files with TODO/FIXME | |
+| **verify-before-commit.sh** | Block commit unless tests passed recently | [#37818](https://github.com/anthropics/claude-code/issues/37818) |
 
 ## Recovery
 

package/examples/block-database-wipe.sh

@@ -6,10 +6,11 @@
 #   - Django: flush, sqlflush
 #   - Rails: db:drop, db:reset
 #   - Raw SQL: DROP DATABASE, TRUNCATE
+#   - Symfony/Doctrine: fixtures:load (without --append), schema:drop, database:drop
 #   - Prisma: migrate reset, db push --force-reset
 #   - PostgreSQL: dropdb
 #
-# Born from GitHub Issues #37405, #37439, #34729
+# Born from GitHub Issues #37405, #37439, #34729, #37574
 #
 # Usage: Add to settings.json as a PreToolUse hook
 #
@@ -61,6 +62,12 @@ if echo "$COMMAND" | grep -qiE 'DROP\s+(DATABASE|TABLE|SCHEMA)|TRUNCATE\s+TABLE|
     exit 2
 fi
 
+# Symfony/Doctrine destructive commands
+if echo "$COMMAND" | grep -qiE 'doctrine:(fixtures:load|schema:drop|database:drop)' && ! echo "$COMMAND" | grep -qE '\-\-append'; then
+    echo "BLOCKED: Destructive Doctrine command (use --append for fixtures:load)" >&2
+    exit 2
+fi
+
 # Prisma destructive commands
 if echo "$COMMAND" | grep -qiE 'prisma\s+migrate\s+reset|prisma\s+db\s+push\s+--force-reset'; then
     echo "BLOCKED: Destructive Prisma database command" >&2

package/examples/verify-before-commit.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+# verify-before-commit.sh — Block git commit unless tests passed recently
+#
+# Solves: Claude saying "fixed" and committing without actually
+# verifying the fix works (#37818, #36970)
+#
+# How it works:
+# 1. Your test runner creates a marker file on success
+# 2. This hook checks for the marker before allowing commit
+# 3. Marker expires after 10 minutes (stale test results don't count)
+#
+# Marker creation (add to your test script or PostToolUse hook):
+#   touch "/tmp/cc-tests-passed-$(pwd | md5sum | cut -c1-8)"
+#
+# Usage: Add to settings.json as a PreToolUse hook
+#
+# {
+#   "hooks": {
+#     "PreToolUse": [{
+#       "matcher": "Bash",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/verify-before-commit.sh" }]
+#     }]
+#   }
+# }
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[[ -z "$COMMAND" ]] && exit 0
+
+# Only check git commit commands
+if ! echo "$COMMAND" | grep -qE '^\s*git\s+commit\b'; then
+    exit 0
+fi
+
+# Must be in a git repo
+git rev-parse --git-dir &>/dev/null || exit 0
+
+# Check for test marker (created by test runner)
+PROJECT_HASH=$(pwd | md5sum | cut -c1-8)
+MARKER="/tmp/cc-tests-passed-${PROJECT_HASH}"
+MAX_AGE=600  # 10 minutes
+
+if [ ! -f "$MARKER" ]; then
+    echo "BLOCKED: No test evidence found. Run tests before committing." >&2
+    echo "" >&2
+    echo "Your test runner should create: $MARKER" >&2
+    echo "Example: pytest && touch $MARKER" >&2
+    exit 2
+fi
+
+# Check marker age
+MARKER_AGE=$(( $(date +%s) - $(stat -c %Y "$MARKER" 2>/dev/null || echo 0) ))
+if (( MARKER_AGE > MAX_AGE )); then
+    echo "BLOCKED: Test results are stale (${MARKER_AGE}s old, max ${MAX_AGE}s)." >&2
+    echo "Run tests again before committing." >&2
+    exit 2
+fi
+
+exit 0

package/index.mjs

@@ -79,7 +79,7 @@ if (HELP) {
     npx cc-safe-setup --verify     Test each hook with sample inputs
     npx cc-safe-setup --dry-run    Preview without installing
     npx cc-safe-setup --uninstall  Remove all installed hooks
-    npx cc-safe-setup --examples   List 19 example hooks (5 categories)
+    npx cc-safe-setup --examples   List 25 example hooks (5 categories)
     npx cc-safe-setup --install-example <name>  Install a specific example
     npx cc-safe-setup --help       Show this help
 
@@ -185,7 +185,7 @@ function status() {
     'auto-approve-git-read.sh', 'auto-approve-python.sh', 'auto-approve-ssh.sh',
     'auto-checkpoint.sh', 'auto-snapshot.sh', 'block-database-wipe.sh', 'branch-name-check.sh', 'commit-message-check.sh', 'env-var-check.sh',
     'deploy-guard.sh', 'edit-guard.sh', 'enforce-tests.sh', 'git-config-guard.sh',
-    'large-file-guard.sh', 'network-guard.sh', 'notify-waiting.sh',
+    'large-file-guard.sh', 'network-guard.sh', 'notify-waiting.sh', 'path-traversal-guard.sh',
     'protect-dotfiles.sh', 'scope-guard.sh', 'test-before-push.sh', 'timeout-guard.sh', 'todo-check.sh',
   ];
   const installedExamples = exampleFiles.filter(f => existsSync(join(HOOKS_DIR, f)));
@@ -304,6 +304,7 @@ function examples() {
       'enforce-tests.sh': 'Warn when source files change without test files',
       'large-file-guard.sh': 'Warn when Write creates files over 500KB',
       'todo-check.sh': 'Warn when committing files with TODO/FIXME markers',
+      'verify-before-commit.sh': 'Block commit unless tests passed recently',
     },
     'Recovery': {
       'auto-checkpoint.sh': 'Auto-commit after edits for rollback protection',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safe-setup",
-  "version": "2.0.6",
+  "version": "2.0.8",
   "description": "One command to make Claude Code safe for autonomous operation. 8 built-in hooks + 25 installable examples. Destructive blocker, branch guard, database wipe protection, dotfile guard, and more.",
   "main": "index.mjs",
   "bin": {