cc-safe-setup 28.5.0 → 28.7.0

package/COOKBOOK.md

@@ -135,6 +135,16 @@ All browser-based, nothing leaves your machine:
 - [Playground](https://yurukusa.github.io/cc-safe-setup/playground.html) — Write and test hooks
 - [Hook Builder](https://yurukusa.github.io/cc-safe-setup/builder.html) — Generate hooks from English
 
+## 27. Bypass Protected Directory Prompts (PermissionRequest)
+
+PreToolUse hooks can't bypass built-in protected-directory checks — they run *before* those checks. Use PermissionRequest instead:
+
+```bash
+npx cc-safe-setup --install-example allow-git-hooks-dir
+```
+
+Or manually: create a PermissionRequest hook that outputs `permissionDecision: "allow"`. See [Troubleshooting](TROUBLESHOOTING.md#pretooluse-allow-doesnt-bypass-protected-directory-prompts) for details.
+
 ## Further Reading
 
 - [Getting Started](https://yurukusa.github.io/cc-safe-setup/getting-started.html)

package/README.md

@@ -87,7 +87,7 @@ Each hook exists because a real incident happened without it.
 | `--scan [--apply]` | Tech stack detection |
 | `--export / --import` | Team config sharing |
 | `--verify` | Test each hook |
-| `--install-example <name>` | Install from 316 examples |
+| `--install-example <name>` | Install from 333 examples |
 | `--examples [filter]` | Browse examples by keyword |
 | `--full` | All-in-one setup |
 | `--status` | Check installed hooks |

package/TROUBLESHOOTING.md

@@ -132,6 +132,34 @@ jq -n '...'
 
 Auto-approve JSON must go to stdout.
 
+## "PreToolUse allow doesn't bypass protected directory prompts"
+
+This is expected behavior, not a bug.
+
+**Execution order:**
+1. PreToolUse hooks run
+2. Built-in protected-directory checks run (`.claude/`, `.git/`, etc.)
+3. PermissionRequest hooks run
+
+PreToolUse's `permissionDecision: "allow"` gets overridden by the built-in checks in step 2. To bypass protected directory prompts, use **PermissionRequest** hooks instead:
+
+```bash
+#!/bin/bash
+# Save as: ~/.claude/hooks/allow-protected-dir.sh
+# Trigger: PermissionRequest (not PreToolUse)
+INPUT=$(cat)
+PATH_TARGET=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.command // empty')
+
+# Allow writes to a specific protected directory
+if echo "$PATH_TARGET" | grep -q '/my-project/.git/hooks'; then
+  jq -n '{hookSpecificOutput: {hookEventName: "PermissionRequest", permissionDecision: "allow", permissionDecisionReason: "Allowed: git hooks directory"}}'
+  exit 0
+fi
+exit 0
+```
+
+**Rule of thumb:** PreToolUse = block dangerous actions. PermissionRequest = allow trusted actions that trigger built-in prompts.
+
 ## "Permission prompts still appear for compound commands"
 
 This is a known Claude Code limitation, not a hook issue. `Bash(git:*)` doesn't match `cd /path && git log`.
@@ -204,6 +232,22 @@ echo "[$(date -Iseconds)] BLOCKED: reason | cmd: $COMMAND" >> "$LOG"
 
 Then view with: `npx cc-safe-setup --watch` or `npx cc-safe-setup --stats`
 
+## "claude -p returns empty output when Stop hook is configured"
+
+This is a known Claude Code v2.1.83 bug ([#38651](https://github.com/anthropics/claude-code/issues/38651)), not a cc-safe-setup issue. Any Stop hook — even `true` — causes `-p` (print mode) to return empty stdout.
+
+**Workaround:** Temporarily remove Stop hooks when using `-p` mode:
+
+```bash
+# Quick toggle: comment out Stop hooks before -p commands
+npx cc-safe-setup --status  # See which hooks are active
+# Manually comment out Stop hooks in ~/.claude/settings.json
+# Run your -p command
+# Uncomment Stop hooks after
+```
+
+This should be fixed in a future Claude Code release.
+
 ## Still Stuck?
 
 1. Wrap the hook with debug wrapper: `npx cc-safe-setup --install-example hook-debug-wrapper`

package/examples/allow-claude-settings.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# allow-claude-settings.sh — PermissionRequest hook
+# Trigger: PermissionRequest
+# Matcher: Edit|Write
+#
+# Auto-approves writes to .claude/ configuration files.
+# Use this in isolated environments (containers, VMs) where
+# bypassPermissions is enabled but .claude/ writes still prompt.
+#
+# See: https://github.com/anthropics/claude-code/issues/36044
+# See: https://github.com/anthropics/claude-code/issues/37765
+#
+# WARNING: Only use in environments where you trust Claude's edits
+# to your configuration. In shared or production environments,
+# keep the default prompts.
+
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+[ -z "$FILE_PATH" ] && exit 0
+
+# Allow .claude/ writes (settings, rules, agents, skills, hooks)
+if echo "$FILE_PATH" | grep -qE '\.claude/'; then
+  jq -n '{
+    hookSpecificOutput: {
+      hookEventName: "PermissionRequest",
+      permissionDecision: "allow",
+      permissionDecisionReason: "Allowed: .claude/ directory (isolated environment)"
+    }
+  }'
+  exit 0
+fi
+
+exit 0

package/examples/allow-git-hooks-dir.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# allow-git-hooks-dir.sh — PermissionRequest hook
+# Trigger: PermissionRequest
+# Matcher: Edit|Write
+#
+# Bypasses the built-in protected-directory prompt for .git/hooks/.
+# PreToolUse hooks can't do this — they run before built-in checks.
+# PermissionRequest runs after, so it can override the prompt.
+#
+# WARNING: Only allow specific subdirectories you trust.
+# Never blanket-allow all of .git/ — that exposes HEAD, config, etc.
+
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+[ -z "$FILE_PATH" ] && exit 0
+
+# Only allow .git/hooks/ writes (e.g., pre-commit, pre-push)
+if echo "$FILE_PATH" | grep -qE '\.git/hooks/[^/]+$'; then
+  jq -n '{
+    hookSpecificOutput: {
+      hookEventName: "PermissionRequest",
+      permissionDecision: "allow",
+      permissionDecisionReason: "Allowed: git hooks directory"
+    }
+  }'
+  exit 0
+fi
+
+exit 0

package/examples/allow-protected-dirs.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+# allow-protected-dirs.sh — PermissionRequest hook
+# Trigger: PermissionRequest
+# Matcher: Edit|Write
+#
+# Auto-approves writes to ALL protected directories (.claude/, .git/,
+# .vscode/, .idea/). Equivalent to full bypassPermissions for file edits.
+#
+# USE CASE: Docker containers, CI/CD, disposable VMs where you want
+# zero prompts and understand the risks.
+#
+# WARNING: This is the most permissive PermissionRequest hook possible.
+# It bypasses ALL built-in file protection. Do NOT use in shared or
+# production environments. Prefer allow-git-hooks-dir.sh or
+# allow-claude-settings.sh for targeted bypass.
+
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+[ -z "$FILE_PATH" ] && exit 0
+
+if echo "$FILE_PATH" | grep -qE '\.(claude|git|vscode|idea)/'; then
+  jq -n '{
+    hookSpecificOutput: {
+      hookEventName: "PermissionRequest",
+      permissionDecision: "allow",
+      permissionDecisionReason: "Allowed: protected directory (full bypass)"
+    }
+  }'
+  exit 0
+fi
+
+exit 0

package/index.mjs

@@ -601,9 +601,12 @@ async function installExample(name) {
   let matcher = 'Bash';
 
   // Detect trigger from header comments
-  if (content.includes('PostToolUse')) trigger = 'PostToolUse';
-  if (content.includes('Notification')) trigger = 'Notification';
-  if (content.includes('Stop')) trigger = 'Stop';
+  if (content.includes('TRIGGER: PostToolUse') || content.includes('PostToolUse')) trigger = 'PostToolUse';
+  if (content.includes('TRIGGER: Notification') || content.includes('Notification')) trigger = 'Notification';
+  if (content.includes('TRIGGER: Stop') || content.includes('Stop')) trigger = 'Stop';
+  if (content.includes('TRIGGER: SessionStart') || content.includes('SessionStart')) trigger = 'SessionStart';
+  if (content.includes('TRIGGER: PreCompact') || content.includes('PreCompact')) trigger = 'PreCompact';
+  if (content.includes('TRIGGER: SessionEnd') || content.includes('SessionEnd')) trigger = 'SessionEnd';
 
   // Detect matcher from header
   const matcherMatch = content.match(/"matcher":\s*"([^"]*)"/);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cc-safe-setup",
-  "version": "28.5.0",
-  "description": "One command to make Claude Code safe. 336 hooks (8 built-in + 330 examples). 49 CLI commands. 988 tests. 5 languages.",
+  "version": "28.7.0",
+  "description": "One command to make Claude Code safe. 339 hooks (8 built-in + 333 examples). 49 CLI commands. 1009 tests. 5 languages.",
   "main": "index.mjs",
   "bin": {
     "cc-safe-setup": "index.mjs"