cc-safe-setup 28.4.3 → 28.4.5

package/examples/hook-permission-fixer.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# ================================================================
+# hook-permission-fixer.sh — Auto-fix missing execute permissions on hooks
+# ================================================================
+# PURPOSE:
+#   Claude Code's plugin manager and some extraction tools strip
+#   execute permissions from shell scripts. This hook runs at session
+#   start and ensures all .sh files in the hooks directory are executable.
+#
+#   Without this, hooks fail with "Permission denied" errors.
+#   See: github.com/anthropics/claude-code/issues/38901
+#
+# TRIGGER: SessionStart  MATCHER: ""
+# ================================================================
+
+HOOKS_DIR="$HOME/.claude/hooks"
+PLUGINS_DIR="$HOME/.claude/plugins"
+FIXED=0
+
+# Fix hooks directory
+if [ -d "$HOOKS_DIR" ]; then
+  for f in "$HOOKS_DIR"/*.sh; do
+    [ -f "$f" ] || continue
+    if [ ! -x "$f" ]; then
+      chmod +x "$f"
+      FIXED=$((FIXED + 1))
+    fi
+  done
+fi
+
+# Fix plugin hooks
+if [ -d "$PLUGINS_DIR" ]; then
+  while IFS= read -r -d '' f; do
+    if [ ! -x "$f" ]; then
+      chmod +x "$f"
+      FIXED=$((FIXED + 1))
+    fi
+  done < <(find "$PLUGINS_DIR" -name "*.sh" -print0 2>/dev/null)
+fi
+
+if [ "$FIXED" -gt 0 ]; then
+  echo "Fixed execute permissions on $FIXED hook script(s)" >&2
+fi
+
+exit 0

package/examples/response-budget-guard.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# ================================================================
+# response-budget-guard.sh — Track and limit tool calls per response
+# ================================================================
+# PURPOSE:
+#   Prevents runaway tool call loops where Claude calls hundreds of
+#   tools in a single response. Common in autonomous mode when the
+#   agent enters a retry loop or tries to brute-force a solution.
+#
+#   Tracks tool calls per response cycle and warns after threshold.
+#
+# TRIGGER: PreToolUse  MATCHER: ""
+#
+# CONFIG:
+#   CC_RESPONSE_TOOL_LIMIT=50  (warn after this many tool calls)
+# ================================================================
+
+LIMIT="${CC_RESPONSE_TOOL_LIMIT:-50}"
+STATE="/tmp/cc-response-budget-$(echo "$PWD" | md5sum | cut -c1-8)"
+
+# Read current count
+COUNT=0
+if [ -f "$STATE" ]; then
+  COUNT=$(cat "$STATE")
+fi
+
+COUNT=$((COUNT + 1))
+echo "$COUNT" > "$STATE"
+
+if [ "$COUNT" -eq "$LIMIT" ]; then
+  echo "WARNING: $COUNT tool calls in this response cycle." >&2
+  echo "Consider whether you're in a retry loop." >&2
+  echo "Reset: rm $STATE" >&2
+fi
+
+# Hard block at 2x limit to prevent truly runaway sessions
+if [ "$COUNT" -gt $((LIMIT * 2)) ]; then
+  echo "BLOCKED: $COUNT tool calls exceeds safety limit ($((LIMIT * 2)))." >&2
+  echo "You appear to be in a loop. Stop and reassess." >&2
+  exit 2
+fi
+
+exit 0

package/index.mjs

@@ -405,6 +405,8 @@ function examples() {
       'pip-venv-guard.sh': 'Warn on pip install outside venv',
       'no-git-amend-push.sh': 'Warn on amending pushed commits',
       'typosquat-guard.sh': 'Detect npm/pip typosquatting attacks',
+      'hook-permission-fixer.sh': 'Auto-fix missing execute permissions on hooks (SessionStart)',
+      'response-budget-guard.sh': 'Track and limit tool calls per response (anti-loop)',
     },
     'Auto-Approve': {
       'auto-approve-build.sh': 'Auto-approve npm/yarn/cargo/go build, test, lint',
@@ -1573,7 +1575,7 @@ async function guard(description) {
   if (!settings.hooks) settings.hooks = {};
   if (!settings.hooks[trigger]) settings.hooks[trigger] = [];
 
-  const cmd = `bash ${hookPath}`;
+  const cmd = `bash ${toBashPath(hookPath)}`;
   const alreadyExists = JSON.stringify(settings.hooks).includes(hookName);
   if (!alreadyExists) {
     const existing = settings.hooks[trigger].find(e => e.matcher === matcher);
@@ -2435,7 +2437,7 @@ async function shield() {
 
   for (const f of hookFiles) {
     const content = readFileSync(join(HOOKS_DIR, f), 'utf-8');
-    const cmd = `bash ${join(HOOKS_DIR, f)}`;
+    const cmd = `bash ${toBashPath(join(HOOKS_DIR, f))}`;
 
     // Check if already in settings
     const alreadyConfigured = JSON.stringify(settings.hooks).includes(f);
@@ -4557,7 +4559,7 @@ FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
   if (!settings.hooks) settings.hooks = {};
   if (!settings.hooks.PreToolUse) settings.hooks.PreToolUse = [];
 
-  const hookCmd = `bash ${hookPath}`;
+  const hookCmd = `bash ${toBashPath(hookPath)}`;
 
   // Check all matchers for existing compiled-rules entry
   let found = false;
@@ -4679,7 +4681,7 @@ exit 0
   if (!settings.hooks.PreToolUse) settings.hooks.PreToolUse = [];
 
   // Register under specific matchers based on rule types (NEVER use "" matcher)
-  const hookCmd = `bash ${hookPath}`;
+  const hookCmd = `bash ${toBashPath(hookPath)}`;
   const hasBlocks = rules.some(r => r.type === 'block');
   const hasApproves = rules.some(r => r.type === 'approve');
   const hasProtects = rules.some(r => r.type === 'protect');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cc-safe-setup",
-  "version": "28.4.3",
-  "description": "One command to make Claude Code safe. 336 hooks (8 built-in + 328 examples). 49 CLI commands. 980 tests. 5 languages.",
+  "version": "28.4.5",
+  "description": "One command to make Claude Code safe. 336 hooks (8 built-in + 330 examples). 49 CLI commands. 987 tests. 5 languages.",
   "main": "index.mjs",
   "bin": {
     "cc-safe-setup": "index.mjs"