cc-safe-setup 29.6.27 → 29.6.28

package/README.md

@@ -4,7 +4,7 @@
 [![npm downloads](https://img.shields.io/npm/dw/cc-safe-setup)](https://www.npmjs.com/package/cc-safe-setup)
 [![tests](https://github.com/yurukusa/cc-safe-setup/actions/workflows/test.yml/badge.svg)](https://github.com/yurukusa/cc-safe-setup/actions/workflows/test.yml)
 
-**One command to make Claude Code safe for autonomous operation.** 507 example hooks · 7,341 tests · 1,000+ installs/day · [日本語](docs/README.ja.md)
+**One command to make Claude Code safe for autonomous operation.** 511 example hooks · 7,349 tests · 1,000+ installs/day · [日本語](docs/README.ja.md)
 
 ```bash
 npx cc-safe-setup
@@ -117,7 +117,7 @@ Install any of these: `npx cc-safe-setup --install-example <name>`
 | `--scan [--apply]` | Tech stack detection |
 | `--export / --import` | Team config sharing |
 | `--verify` | Test each hook |
-| `--install-example <name>` | Install from 507 examples |
+| `--install-example <name>` | Install from 511 examples |
 | `--examples [filter]` | Browse examples by keyword |
 | `--full` | All-in-one setup |
 | `--status` | Check installed hooks |

package/examples/credential-file-cat-guard.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+# credential-file-cat-guard.sh — Block cat/read of package manager credential files
+#
+# Solves: Agent displays full credential files in conversation
+#         (#34819 — cat ~/.netrc, ~/.npmrc, ~/.cargo/credentials.toml displayed all tokens)
+#
+# Complements credential-exfil-guard.sh which blocks hunting patterns.
+# This hook blocks direct read of known credential files that the
+# exfil guard misses: .netrc, .npmrc, .cargo/credentials, .docker/config.json, etc.
+#
+# Usage: Add to settings.json as a PreToolUse hook
+#
+# {
+#   "hooks": {
+#     "PreToolUse": [{
+#       "matcher": "Bash",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/credential-file-cat-guard.sh" }]
+#     }]
+#   }
+# }
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# Known credential files that contain tokens/passwords
+CRED_FILES='\.netrc|\.npmrc|\.yarnrc\.yml|\.cargo/credentials|\.docker/config\.json|\.kube/config|\.config/gh/hosts\.yml|\.nuget/NuGet\.Config|\.m2/settings\.xml|\.gradle/gradle\.properties|\.pypirc|\.gem/credentials|\.config/pip/pip\.conf|\.bowerrc|\.composer/auth\.json'
+
+# Block cat/head/tail/less/more/grep reading credential files
+if echo "$COMMAND" | grep -qE "(cat|head|tail|less|more|bat)\s+[^\|;]*($CRED_FILES)"; then
+    FILE=$(echo "$COMMAND" | grep -oE "[~\/][^\s;|]*($CRED_FILES)[^\s;|]*" | head -1)
+    echo "BLOCKED: Reading credential file: $FILE" >&2
+    echo "  These files contain authentication tokens. Use environment variables instead." >&2
+    exit 2
+fi
+
+# Block grep searching inside credential files
+if echo "$COMMAND" | grep -qE "grep\s+.*\s+[^\|;]*($CRED_FILES)"; then
+    echo "BLOCKED: Searching inside credential file" >&2
+    exit 2
+fi
+
+exit 0

package/examples/edit-retry-loop-guard.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# edit-retry-loop-guard.sh — Detect Edit tool stuck retrying the same file
+#
+# Solves: Edit tool path contamination in long sessions
+#         (#35576 — Edit gets "stuck" targeting wrong file, retrying 15+ times)
+#
+# Tracks consecutive Edit failures on the same file. After 3 failures,
+# warns the model to verify the file path.
+
+INPUT=$(cat)
+TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+
+[ "$TOOL" = "Edit" ] || exit 0
+
+FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+EXIT_CODE=$(echo "$INPUT" | jq -r '.tool_output.exit_code // empty' 2>/dev/null)
+OUTPUT=$(echo "$INPUT" | jq -r '.tool_output // empty' 2>/dev/null)
+
+[ -z "$FILE" ] && exit 0
+
+STATE_FILE="/tmp/.cc-edit-retry-$(echo "$FILE" | md5sum | cut -c1-8)"
+
+# Check if edit failed (non-zero exit or "no changes" in output)
+if [ "$EXIT_CODE" != "0" ] || echo "$OUTPUT" | grep -qiE 'no changes|not found|old_string.*not.*found'; then
+    COUNT=1
+    [ -f "$STATE_FILE" ] && COUNT=$(( $(cat "$STATE_FILE") + 1 ))
+    echo "$COUNT" > "$STATE_FILE"
+
+    if [ "$COUNT" -ge 3 ]; then
+        echo "WARNING: Edit has failed $COUNT times on: $FILE" >&2
+        echo "  Verify the file path is correct. Use Read to check the current content." >&2
+        echo "  The file may have been moved, renamed, or the content changed." >&2
+        rm -f "$STATE_FILE"
+    fi
+else
+    # Success — reset counter
+    rm -f "$STATE_FILE"
+fi
+
+exit 0

package/examples/push-requires-test-pass-record.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# push-requires-test-pass-record.sh — Record when tests pass (companion to push-requires-test-pass.sh)
+#
+# PostToolUse hook that detects successful test runs and records the timestamp.
+# The PreToolUse companion then checks this record before allowing git push.
+#
+# Detected test commands: npm test, pytest, cargo test, go test, make test, etc.
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+EXIT_CODE=$(echo "$INPUT" | jq -r '.tool_output.exit_code // .exit_code // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# Only record on exit code 0 (success)
+[ "$EXIT_CODE" = "0" ] || exit 0
+
+# Detect test commands
+if echo "$COMMAND" | grep -qE '(npm\s+test|npx\s+jest|npx\s+vitest|npx\s+mocha|pytest|python\s+-m\s+pytest|cargo\s+test|go\s+test|make\s+test|gradle\s+test|mvn\s+test|bundle\s+exec\s+rspec|php\s+artisan\s+test|dotnet\s+test|bash\s+test\.sh)'; then
+    STATE_FILE="/tmp/.cc-test-pass-$(pwd | md5sum | cut -c1-8)"
+    date +%s > "$STATE_FILE"
+fi
+
+exit 0

package/examples/push-requires-test-pass.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# push-requires-test-pass.sh — Block git push to main/production without test verification
+#
+# Solves: Agent pushes broken code to production without running tests
+#         (#36673 — pushed broken code 4 times, crashed live SaaS application)
+#
+# How it works:
+#   1. PostToolUse companion records when tests pass (creates state file)
+#   2. This PreToolUse hook blocks git push to protected branches unless tests passed
+#
+# Requires companion hook: push-requires-test-pass-record.sh (PostToolUse)
+#
+# Usage: Add BOTH hooks to settings.json
+#
+# {
+#   "hooks": {
+#     "PreToolUse": [{
+#       "matcher": "Bash",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/push-requires-test-pass.sh" }]
+#     }],
+#     "PostToolUse": [{
+#       "matcher": "Bash",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/push-requires-test-pass-record.sh" }]
+#     }]
+#   }
+# }
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# Only check git push commands
+echo "$COMMAND" | grep -qE '^\s*git\s+push\b' || exit 0
+
+# Protected branches
+PROTECTED='main|master|production|prod|release|deploy'
+
+# Check if pushing to a protected branch
+if echo "$COMMAND" | grep -qE "git\s+push\s+\S+\s+($PROTECTED)\b|git\s+push\s+($PROTECTED)\b|git\s+push\s*$"; then
+    STATE_FILE="/tmp/.cc-test-pass-$(pwd | md5sum | cut -c1-8)"
+
+    if [ ! -f "$STATE_FILE" ]; then
+        echo "BLOCKED: git push to protected branch without test verification" >&2
+        echo "  Run your test suite first. Tests must pass before pushing." >&2
+        echo "  Protected branches: main, master, production, prod, release, deploy" >&2
+        exit 2
+    fi
+
+    # Check if test pass is recent (within last 30 minutes)
+    if [ -f "$STATE_FILE" ]; then
+        PASS_TIME=$(cat "$STATE_FILE" 2>/dev/null)
+        NOW=$(date +%s)
+        AGE=$(( NOW - PASS_TIME ))
+        if [ "$AGE" -gt 1800 ]; then
+            echo "BLOCKED: Test pass record is stale ($(( AGE / 60 )) minutes old)" >&2
+            echo "  Re-run tests before pushing to protected branch." >&2
+            rm -f "$STATE_FILE"
+            exit 2
+        fi
+    fi
+fi
+
+exit 0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cc-safe-setup",
-  "version": "29.6.27",
-  "description": "One command to make Claude Code safe. 507 example hooks + 8 built-in. 56 CLI commands. 7341 tests. Works with Auto Mode.",
+  "version": "29.6.28",
+  "description": "One command to make Claude Code safe. 511 example hooks + 8 built-in. 56 CLI commands. 7349 tests. Works with Auto Mode.",
   "main": "index.mjs",
   "bin": {
     "cc-safe-setup": "index.mjs"