cc-safe-setup 28.6.0 → 28.7.0

package/README.md

@@ -87,7 +87,7 @@ Each hook exists because a real incident happened without it.
 | `--scan [--apply]` | Tech stack detection |
 | `--export / --import` | Team config sharing |
 | `--verify` | Test each hook |
-| `--install-example <name>` | Install from 331 examples |
+| `--install-example <name>` | Install from 333 examples |
 | `--examples [filter]` | Browse examples by keyword |
 | `--full` | All-in-one setup |
 | `--status` | Check installed hooks |

package/TROUBLESHOOTING.md

@@ -232,6 +232,22 @@ echo "[$(date -Iseconds)] BLOCKED: reason | cmd: $COMMAND" >> "$LOG"
 
 Then view with: `npx cc-safe-setup --watch` or `npx cc-safe-setup --stats`
 
+## "claude -p returns empty output when Stop hook is configured"
+
+This is a known Claude Code v2.1.83 bug ([#38651](https://github.com/anthropics/claude-code/issues/38651)), not a cc-safe-setup issue. Any Stop hook — even `true` — causes `-p` (print mode) to return empty stdout.
+
+**Workaround:** Temporarily remove Stop hooks when using `-p` mode:
+
+```bash
+# Quick toggle: comment out Stop hooks before -p commands
+npx cc-safe-setup --status  # See which hooks are active
+# Manually comment out Stop hooks in ~/.claude/settings.json
+# Run your -p command
+# Uncomment Stop hooks after
+```
+
+This should be fixed in a future Claude Code release.
+
 ## Still Stuck?
 
 1. Wrap the hook with debug wrapper: `npx cc-safe-setup --install-example hook-debug-wrapper`

package/examples/allow-claude-settings.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# allow-claude-settings.sh — PermissionRequest hook
+# Trigger: PermissionRequest
+# Matcher: Edit|Write
+#
+# Auto-approves writes to .claude/ configuration files.
+# Use this in isolated environments (containers, VMs) where
+# bypassPermissions is enabled but .claude/ writes still prompt.
+#
+# See: https://github.com/anthropics/claude-code/issues/36044
+# See: https://github.com/anthropics/claude-code/issues/37765
+#
+# WARNING: Only use in environments where you trust Claude's edits
+# to your configuration. In shared or production environments,
+# keep the default prompts.
+
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+[ -z "$FILE_PATH" ] && exit 0
+
+# Allow .claude/ writes (settings, rules, agents, skills, hooks)
+if echo "$FILE_PATH" | grep -qE '\.claude/'; then
+  jq -n '{
+    hookSpecificOutput: {
+      hookEventName: "PermissionRequest",
+      permissionDecision: "allow",
+      permissionDecisionReason: "Allowed: .claude/ directory (isolated environment)"
+    }
+  }'
+  exit 0
+fi
+
+exit 0

package/examples/allow-protected-dirs.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+# allow-protected-dirs.sh — PermissionRequest hook
+# Trigger: PermissionRequest
+# Matcher: Edit|Write
+#
+# Auto-approves writes to ALL protected directories (.claude/, .git/,
+# .vscode/, .idea/). Equivalent to full bypassPermissions for file edits.
+#
+# USE CASE: Docker containers, CI/CD, disposable VMs where you want
+# zero prompts and understand the risks.
+#
+# WARNING: This is the most permissive PermissionRequest hook possible.
+# It bypasses ALL built-in file protection. Do NOT use in shared or
+# production environments. Prefer allow-git-hooks-dir.sh or
+# allow-claude-settings.sh for targeted bypass.
+
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+[ -z "$FILE_PATH" ] && exit 0
+
+if echo "$FILE_PATH" | grep -qE '\.(claude|git|vscode|idea)/'; then
+  jq -n '{
+    hookSpecificOutput: {
+      hookEventName: "PermissionRequest",
+      permissionDecision: "allow",
+      permissionDecisionReason: "Allowed: protected directory (full bypass)"
+    }
+  }'
+  exit 0
+fi
+
+exit 0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cc-safe-setup",
-  "version": "28.6.0",
-  "description": "One command to make Claude Code safe. 337 hooks (8 built-in + 331 examples). 49 CLI commands. 996 tests. 5 languages.",
+  "version": "28.7.0",
+  "description": "One command to make Claude Code safe. 339 hooks (8 built-in + 333 examples). 49 CLI commands. 1009 tests. 5 languages.",
   "main": "index.mjs",
   "bin": {
     "cc-safe-setup": "index.mjs"