cc-safe-setup 29.7.0 → 30.0.4

package/examples/authorized-reconfirmation-detector.sh

@@ -0,0 +1,195 @@
+#!/bin/bash
+# authorized-reconfirmation-detector.sh — Measure how often
+# AskUserQuestion fires on an action that the operator's prior turn
+# already authorized.
+#
+# Solves: anthropics/claude-code#61929 (Claude Code makes major design
+# decisions silently but asks for confirmation on trivial things),
+# specifically case (3) in the three-way split articulated in
+# https://github.com/anthropics/claude-code/issues/61929#issuecomment-4549798175 :
+#
+#   (1) Genuine fork — model has multiple plausible paths; AUQ is correct
+#   (2) Articulation-surface mis-bound — model has the answer (marks
+#       "(Recommended)") and uses AUQ to describe its choice rather than
+#       delegate it
+#   (3) Authorized re-confirmation — operator already said "do X" in the
+#       prior turn; model opens AUQ asking "Should I do X?" with
+#       "(Recommended) yes"
+#
+# This hook does not block. It measures. The output is one structured
+# log line per detected case (3) — turn timestamp, AUQ question text,
+# matched verb stem, user-message excerpt. That log file becomes the
+# empirical foundation for the eventual UserPromptSubmit-side intent
+# classifier (case 3's primary fix). Case (2) cannot be addressed at
+# Stop without already having shown the menu; that one needs PreToolUse
+# visibility into the AUQ preamble (#61983) to convert the menu into an
+# inline articulation.
+#
+# Detection signature (all three required to log):
+#   a) An AskUserQuestion tool call exists in the latest assistant turn.
+#   b) At least one of its options carries a "(Recommended)" marker
+#      (English) or "推奨" (Japanese).
+#   c) The most recent user message contains a content word (length >= 4)
+#      that also appears in the AUQ question text. Common stopwords are
+#      filtered. This is the "operator already named the action" echo.
+#
+# False positives are intentionally tolerated for measurement — the
+# detector emits an advisory log line, never an exit code, never a block.
+# An operator may have authorized an irreversible action and still want
+# AUQ to fire as a safety re-check; that case will show up in the log
+# and informs the classifier's eventual exclusion list.
+#
+# Related:
+#   #61337 (mhernz) — /goal-mode authorization is structurally
+#                     indistinguishable from prior-message authorization;
+#                     the load-bearing axis that lets one classifier
+#                     address both with the same signal.
+#   #61983          — preamble visibility constraint that blocks the
+#                     PreToolUse-AUQ menu-to-articulation conversion
+#                     (case 2 territory).
+#
+# TRIGGER: Stop
+# MATCHER: ""
+#
+# CONFIGURATION (environment variables):
+#   CC_AUTH_RECONF_LOG       log file path
+#                            (default: ~/.claude/audit/authorized-reconfirmation.log)
+#   CC_AUTH_RECONF_DISABLE   set to "1" to disable entirely
+#
+# USAGE (settings.json):
+#   {
+#     "hooks": {
+#       "Stop": [{
+#         "matcher": "",
+#         "hooks": [{
+#           "type": "command",
+#           "command": "~/.claude/hooks/authorized-reconfirmation-detector.sh"
+#         }]
+#       }]
+#     }
+#   }
+
+set -uo pipefail
+
+[ "${CC_AUTH_RECONF_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat 2>/dev/null || true)
+[ -z "$INPUT" ] && exit 0
+
+LOG_FILE="${CC_AUTH_RECONF_LOG:-${HOME}/.claude/audit/authorized-reconfirmation.log}"
+
+# Locate AskUserQuestion calls in the latest assistant turn.
+# Transcript shape varies across Claude Code versions; try several keys.
+AUQ_CALLS=$(printf '%s' "$INPUT" | jq -c '
+    def latest_assistant:
+        ([ .transcript[]? | select(.role == "assistant") ] | .[-1])
+        // .last_assistant_message
+        // {};
+    def auq_filter(arr):
+        [ arr[]?
+          | select((.name // .tool_name // "") == "AskUserQuestion")
+          | (.input // .tool_input // {}) ];
+    (latest_assistant) as $a
+    | (auq_filter($a.tool_calls // [])) as $from_tc
+    | (auq_filter($a.content // []))    as $from_content
+    | ($from_tc + $from_content)
+' 2>/dev/null)
+
+# Nothing to measure if no AUQ this turn.
+if [ -z "$AUQ_CALLS" ] || [ "$AUQ_CALLS" = "null" ] || [ "$AUQ_CALLS" = "[]" ]; then
+    exit 0
+fi
+
+# Find the most recent user (operator) message text.
+USER_TEXT=$(printf '%s' "$INPUT" | jq -r '
+    ([ .transcript[]? | select(.role == "user") ] | .[-1]) as $u
+    | ($u.content
+        | if   type == "string" then .
+          elif type == "array"  then [ .[]? | (.text // .content // "") ] | join(" ")
+          else "" end)
+' 2>/dev/null)
+
+if [ -z "$USER_TEXT" ] || [ "$USER_TEXT" = "null" ]; then
+    USER_TEXT=$(printf '%s' "$INPUT" | jq -r '.last_user_message // empty' 2>/dev/null)
+fi
+
+# No user text → cannot compare → silent exit.
+if [ -z "$USER_TEXT" ] || [ "$USER_TEXT" = "null" ]; then
+    exit 0
+fi
+
+mkdir -p "$(dirname "$LOG_FILE")" 2>/dev/null || true
+
+# Lowercase the user text once.
+UT=$(printf '%s' "$USER_TEXT" | tr '[:upper:]' '[:lower:]')
+
+STOPWORDS='^(should|would|could|with|that|this|from|into|your|have|will|been|were|then|than|when|what|which|while|where|there|please|claude|about|just|like|some|also|even|only|over|under|after|before|both|each|same|other|those|these|right|wrong|maybe|going|doing|done|need|want|sure|okay|yeah|nope|true|false)$'
+
+# Walk each AUQ call.
+printf '%s' "$AUQ_CALLS" | jq -c '.[]' 2>/dev/null | while read -r CALL; do
+    # Skip empty calls.
+    [ -z "$CALL" ] || [ "$CALL" = "null" ] && continue
+
+    # Recommended-option marker check.
+    HAS_RECOMMENDED=$(printf '%s' "$CALL" | jq -r '
+        (.questions // []) | .[]? | (.options // []) | .[]?
+        | ((.label // "") + " " + (.description // ""))
+    ' 2>/dev/null | grep -ciE '\(recommended\)|推奨|^recommended\b|\brecommended:' || true)
+    HAS_RECOMMENDED=${HAS_RECOMMENDED:-0}
+
+    # No recommended marker → likely case (1) genuine fork. Skip.
+    [ "$HAS_RECOMMENDED" -eq 0 ] && continue
+
+    # Enumerate every question text in this call.
+    QUESTIONS=$(printf '%s' "$CALL" | jq -r '
+        (.questions // [{question: (.question // "")}])
+        | .[]? | (.question // "")
+        | select(length > 0)
+    ' 2>/dev/null)
+
+    [ -z "$QUESTIONS" ] && continue
+
+    while IFS= read -r Q; do
+        [ -z "$Q" ] && continue
+
+        # Content words (length >= 4, alpha) from the AUQ question.
+        QWORDS=$(printf '%s' "$Q" | tr '[:upper:]' '[:lower:]' \
+            | grep -oE '[a-z]{4,}' | sort -u \
+            | grep -vE "$STOPWORDS" || true)
+
+        [ -z "$QWORDS" ] && continue
+
+        # Find at least one content word that also appears in the user
+        # message.
+        MATCHED_WORD=""
+        while IFS= read -r W; do
+            [ -z "$W" ] && continue
+            if printf '%s' "$UT" | grep -qw "$W"; then
+                MATCHED_WORD="$W"
+                break
+            fi
+        done <<< "$QWORDS"
+
+        [ -z "$MATCHED_WORD" ] && continue
+
+        # Detected. Emit a structured log line.
+        TS=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+        USER_EXCERPT=$(printf '%s' "$USER_TEXT" | tr '\n' ' ' | head -c 240)
+        ENTRY=$(jq -nc \
+            --arg ts "$TS" \
+            --arg q "$Q" \
+            --arg word "$MATCHED_WORD" \
+            --arg user_excerpt "$USER_EXCERPT" \
+            '{
+                timestamp: $ts,
+                event: "authorized_reconfirmation_detected",
+                auq_question: $q,
+                matched_word: $word,
+                user_excerpt: $user_excerpt
+            }' 2>/dev/null)
+
+        [ -n "$ENTRY" ] && echo "$ENTRY" >> "$LOG_FILE"
+    done <<< "$QUESTIONS"
+done
+
+exit 0

package/examples/auto-approve-build.sh

@@ -24,6 +24,45 @@ TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0
 
+# Approve only when EVERY command position qualifies.
+#
+# The patterns below were anchored at `^\s*` and matched against the whole
+# command string, so only the first command position was examined and the
+# approval was then handed to the entire line: `npm test && sudo rm -rf app` was
+# approved on the strength of its first word. Measured 2026-08-03 against the
+# shipped copy. Same defect as PR #937 (allowlist.sh) and PR #940
+# (cd-git-allow.sh), here on the approving side, where the decision is an
+# explicit approval rather than a missed block.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so anything that can hide a command from a string-level read (command
+# substitution, backticks) disqualifies the line outright. A line that does not
+# qualify gets no decision, which leaves it to the normal permission flow. This
+# hook only ever adds approval; it never blocks.
+#
+# The gate uses the union of the three patterns, so a chain of different
+# approved kinds (`npm ci && npm test`) still passes; the if-chain below only
+# picks which branch reports the approval.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    case "$cmd" in *'$('*|*'`'*) return 1 ;; esac
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+BUILD_SAFE_RE='^\s*(npm|yarn|pnpm|bun|npx)\s+(run\s+)?(build|test|lint|check|typecheck|format|dev|start|ci)'
+BUILD_SAFE_RE="$BUILD_SAFE_RE"'|^\s*(cargo\s+(build|test|check|clippy|fmt)|go\s+(build|test|vet|fmt)|make\s+(build|test|check|lint))'
+BUILD_SAFE_RE="$BUILD_SAFE_RE"'|^\s*(python|python3)\s+(-m\s+)?(pytest|unittest|mypy|ruff|black|isort|flake8)'
+
+cc_every_segment_matches "$BUILD_SAFE_RE" "$CMD" || exit 0
+
 # Auto-approve safe build/test/lint commands
 if echo "$CMD" | grep -qE '^\s*(npm|yarn|pnpm|bun|npx)\s+(run\s+)?(build|test|lint|check|typecheck|format|dev|start|ci)'; then
     echo '{"decision":"approve"}'

package/examples/auto-approve-cargo.sh

@@ -3,7 +3,37 @@
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
-if echo "$COMMAND" | grep -qE '^\s*cargo\s+(build|test|check|clippy|fmt|run|bench|doc|clean)(\s|$)'; then
+
+# Approve only when EVERY command position qualifies.
+#
+# The pattern below was anchored at `^\s*` and matched against the whole command
+# string, so only the first command position was examined and the approval was
+# then handed to the entire line: `cargo build && sudo rm -rf app` was approved
+# on the strength of its first word. Measured 2026-08-03 against the shipped
+# copy. Same defect as PR #937 (allowlist.sh) and PR #940 (cd-git-allow.sh),
+# here on the approving side, where the decision is an explicit approval rather
+# than a missed block.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so anything that can hide a command from a string-level read (command
+# substitution, backticks) disqualifies the line outright. A line that does not
+# qualify gets no decision, which leaves it to the normal permission flow. This
+# hook only ever adds approval; it never blocks.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    case "$cmd" in *'$('*|*'`'*) return 1 ;; esac
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+if cc_every_segment_matches '^\s*cargo\s+(build|test|check|clippy|fmt|run|bench|doc|clean)(\s|$)' "$COMMAND"; then
     jq -n '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"cargo command auto-approved"}}'
 fi
 exit 0

package/examples/auto-approve-docker.sh

@@ -6,6 +6,41 @@ TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 [ "$TOOL" != "Bash" ] && exit 0
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0
+
+# Approve only when EVERY command position qualifies.
+#
+# The patterns below were anchored at `^\s*` and matched against the whole
+# command string, so only the first command position was examined and the
+# approval was then handed to the entire line: `docker ps && sudo rm -rf app`
+# was approved on the strength of its first word. Measured 2026-08-03 against
+# the shipped copy. Same defect as PR #937 (allowlist.sh) and PR #940
+# (cd-git-allow.sh), here on the approving side, where the decision is an
+# explicit approval rather than a missed block.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so anything that can hide a command from a string-level read (command
+# substitution, backticks) disqualifies the line outright. A line that does not
+# qualify gets no decision, which leaves it to the normal permission flow. This
+# hook only ever adds approval; it never blocks.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    case "$cmd" in *'$('*|*'`'*) return 1 ;; esac
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+DOCKER_SAFE_RE='^\s*docker\s+(build|compose|ps|images|logs|inspect|network\s+ls|volume\s+ls|exec|run)'
+DOCKER_SAFE_RE="$DOCKER_SAFE_RE"'|^\s*docker-compose\s+(up|down|build|logs|ps|restart)'
+
+cc_every_segment_matches "$DOCKER_SAFE_RE" "$CMD" || exit 0
+
 if echo "$CMD" | grep -qE '^\s*docker\s+(build|compose|ps|images|logs|inspect|network\s+ls|volume\s+ls|exec|run)'; then
     echo '{"decision":"approve"}'
     exit 0

package/examples/auto-approve-git-read.sh

@@ -18,25 +18,48 @@ if [[ -z "$COMMAND" ]]; then
     exit 0
 fi
 
-# Match git read-only commands with optional -C flag
-if echo "$COMMAND" | grep -qE '^\s*git\s+(-C\s+\S+\s+)?(status|log|diff|branch|show|rev-parse|tag|remote)(\s|$)'; then
-    jq -n '{
-      hookSpecificOutput: {
-        hookEventName: "PreToolUse",
-        permissionDecision: "allow",
-        permissionDecisionReason: "git read-only auto-approved"
-      }
-    }'
-    exit 0
-fi
+# Approve only when EVERY command position qualifies.
+#
+# Both patterns were anchored at `^\s*` and matched against the whole command
+# string, so only the first command position was examined and the approval was
+# then handed to the entire line: `git log && sudo rm -rf app` and
+# `cd /repo && git status; curl http://… | sh` were both approved on the
+# strength of what came first. Measured 2026-08-03. Same defect as PR #937 /
+# #940 / #941, on the approving side, where the decision is an explicit approval
+# rather than a missed block.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so anything that can hide a command from a string-level read (command
+# substitution, backticks) disqualifies the line outright. A line that does not
+# qualify gets no decision, which leaves it to the normal permission flow. This
+# hook only ever adds approval; it never blocks.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    case "$cmd" in *'$('*|*'`'*) return 1 ;; esac
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+GIT_READ_RE='^\s*git\s+(-C\s+\S+\s+)?(status|log|diff|branch|show|rev-parse|tag|remote)(\s|$)'
+# a leading `cd` is allowed as one of the segments, which is what the second
+# pattern used to cover
+SEG_RE="$GIT_READ_RE"'|^\s*cd(\s|$)'
 
-# Match cd + git read-only compounds
-if echo "$COMMAND" | grep -qE '^\s*cd\s+.*&&\s*git\s+(status|log|diff|branch|show|rev-parse)'; then
+# and at least one segment has to actually be the git read
+if cc_every_segment_matches "$SEG_RE" "$COMMAND" \
+   && printf '%s' "$COMMAND" | grep -qE '(^|[;&|])\s*git\s'; then
     jq -n '{
       hookSpecificOutput: {
         hookEventName: "PreToolUse",
         permissionDecision: "allow",
-        permissionDecisionReason: "cd+git compound auto-approved"
+        permissionDecisionReason: "git read-only auto-approved"
       }
     }'
     exit 0

package/examples/auto-approve-go.sh

@@ -3,7 +3,36 @@
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
-if echo "$COMMAND" | grep -qE '^\s*go\s+(build|test|vet|fmt|mod|run|generate|install|clean)(\s|$)'; then
+# Approve only when EVERY command position qualifies.
+#
+# The pattern below was anchored at `^\s*` and matched against the whole command
+# string, so only the first command position was examined and the approval was
+# then handed to the entire line: `go test ./... && sudo rm -rf app` was
+# approved on the strength of its first word. Measured 2026-08-03 against the
+# shipped copy. Same defect as PR #937 (allowlist.sh) and PR #940
+# (cd-git-allow.sh), here on the approving side, where the decision is an
+# explicit approval rather than a missed block.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so anything that can hide a command from a string-level read (command
+# substitution, backticks) disqualifies the line outright. A line that does not
+# qualify gets no decision, which leaves it to the normal permission flow. This
+# hook only ever adds approval; it never blocks.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    case "$cmd" in *'$('*|*'`'*) return 1 ;; esac
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+if cc_every_segment_matches '^\s*go\s+(build|test|vet|fmt|mod|run|generate|install|clean)(\s|$)' "$COMMAND"; then
     jq -n '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"go command auto-approved"}}'
 fi
 exit 0

package/examples/auto-approve-gradle.sh

@@ -3,7 +3,35 @@
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
-if echo "$COMMAND" | grep -qE '^\s*(gradle|gradlew|./gradlew)\s+(build|test|check|assemble|clean|compileJava|compileKotlin|lint)(\s|$)'; then
+# Approve only when EVERY command position qualifies.
+#
+# The pattern below was anchored at `^\s*` and matched against the whole command
+# string, so only the first command position was examined and the approval was
+# then handed to the entire line: `gradle build && sudo rm -rf app` was approved
+# on the strength of its first word. Measured 2026-08-03. Same defect as
+# PR #937 / #940 / #941, on the approving side, where the decision is an
+# explicit approval rather than a missed block.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so anything that can hide a command from a string-level read (command
+# substitution, backticks) disqualifies the line outright. A line that does not
+# qualify gets no decision, which leaves it to the normal permission flow. This
+# hook only ever adds approval; it never blocks.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    case "$cmd" in *'$('*|*'`'*) return 1 ;; esac
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+if cc_every_segment_matches '^\s*(gradle|gradlew|./gradlew)\s+(build|test|check|assemble|clean|compileJava|compileKotlin|lint)(\s|$)' "$COMMAND"; then
     jq -n '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"gradle command auto-approved"}}'
 fi
 exit 0

package/examples/auto-approve-make.sh

@@ -3,7 +3,35 @@
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
-if echo "$COMMAND" | grep -qE '^\s*make\s+(build|test|lint|format|check|clean|install|all|dev|start|run)(\s|$)'; then
+# Approve only when EVERY command position qualifies.
+#
+# The pattern below was anchored at `^\s*` and matched against the whole command
+# string, so only the first command position was examined and the approval was
+# then handed to the entire line: `make test && sudo rm -rf app` was approved on
+# the strength of its first word. Measured 2026-08-03. Same defect as
+# PR #937 / #940 / #941, on the approving side, where the decision is an
+# explicit approval rather than a missed block.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so anything that can hide a command from a string-level read (command
+# substitution, backticks) disqualifies the line outright. A line that does not
+# qualify gets no decision, which leaves it to the normal permission flow. This
+# hook only ever adds approval; it never blocks.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    case "$cmd" in *'$('*|*'`'*) return 1 ;; esac
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+if cc_every_segment_matches '^\s*make\s+(build|test|lint|format|check|clean|install|all|dev|start|run)(\s|$)' "$COMMAND"; then
     jq -n '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"make target auto-approved"}}'
 fi
 exit 0

package/examples/auto-approve-maven.sh

@@ -3,7 +3,35 @@
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
-if echo "$COMMAND" | grep -qE '^\s*(mvn|mvnw|./mvnw)\s+(compile|test|verify|package|clean|install)(\s|$)'; then
+# Approve only when EVERY command position qualifies.
+#
+# The pattern below was anchored at `^\s*` and matched against the whole command
+# string, so only the first command position was examined and the approval was
+# then handed to the entire line: `mvn test && sudo rm -rf app` was approved on
+# the strength of its first word. Measured 2026-08-03. Same defect as
+# PR #937 / #940 / #941, on the approving side, where the decision is an
+# explicit approval rather than a missed block.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so anything that can hide a command from a string-level read (command
+# substitution, backticks) disqualifies the line outright. A line that does not
+# qualify gets no decision, which leaves it to the normal permission flow. This
+# hook only ever adds approval; it never blocks.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    case "$cmd" in *'$('*|*'`'*) return 1 ;; esac
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+if cc_every_segment_matches '^\s*(mvn|mvnw|./mvnw)\s+(compile|test|verify|package|clean|install)(\s|$)' "$COMMAND"; then
     jq -n '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"maven command auto-approved"}}'
 fi
 exit 0

package/examples/auto-approve-python.sh

@@ -15,13 +15,53 @@
 #   }
 # }
 #
-# TRIGGER: PermissionRequest  MATCHER: ""
+# TRIGGER: PreToolUse  MATCHER: "Bash"
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
 [[ -z "$COMMAND" ]] && exit 0
 
+# Approve only when EVERY command position qualifies.
+#
+# The patterns below were anchored at `^\s*` and matched against the whole
+# command string, so only the first command position was examined and the
+# approval was then handed to the entire line: `pytest && sudo rm -rf app` was
+# approved on the strength of its first word. Measured 2026-08-03 against the
+# shipped copy. Same defect as PR #937 (allowlist.sh) and PR #940
+# (cd-git-allow.sh), here on the approving side, where the decision is an
+# explicit approval rather than a missed block.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so anything that can hide a command from a string-level read (command
+# substitution, backticks) disqualifies the line outright. A line that does not
+# qualify gets no decision, which leaves it to the normal permission flow. This
+# hook only ever adds approval; it never blocks.
+#
+# The gate uses the union of the four patterns, so a chain of different approved
+# kinds (`ruff check . && pytest`) still passes; the if-chain below only picks
+# which reason to report.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    case "$cmd" in *'$('*|*'`'*) return 1 ;; esac
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+PY_SAFE_RE='^\s*(pytest|python\s+-m\s+pytest|python\s+-m\s+unittest)(\s|$)'
+PY_SAFE_RE="$PY_SAFE_RE"'|^\s*(ruff\s+(check|format)|black\s|isort\s|flake8\s|pylint\s|mypy\s|pyright\s)'
+PY_SAFE_RE="$PY_SAFE_RE"'|^\s*(pip\s+list|pip\s+show|pip\s+freeze|pipdeptree)(\s|$)'
+PY_SAFE_RE="$PY_SAFE_RE"'|^\s*python3?\s+-m\s+py_compile\s'
+
+cc_every_segment_matches "$PY_SAFE_RE" "$COMMAND" || exit 0
+
 # Python test runners
 if echo "$COMMAND" | grep -qE '^\s*(pytest|python\s+-m\s+pytest|python\s+-m\s+unittest)(\s|$)'; then
     jq -n '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"Python test auto-approved"}}'

package/examples/auto-approve-readonly-tools.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PermissionRequest  MATCHER: ""
 INPUT=$(cat)