cc-safe-setup 29.7.0 → 30.0.4

package/examples/claudemd-tool-prohibition.sh

@@ -0,0 +1,128 @@
+#!/bin/bash
+# claudemd-tool-prohibition.sh — Block tool calls that the operator's CLAUDE.md
+# explicitly prohibits.
+#
+# Solves: harness-side recognition-without-arrest at the system-prompt layer
+#   (issue #60323). The harness injects a `<system-reminder>` suggesting
+#   TaskCreate even when the operator's CLAUDE.md says "Do NOT use TaskCreate".
+#   The model then has to choose between (a) violating the operator's rule or
+#   (b) spending output tokens on a meta-acknowledgment of the conflict.
+#
+# This hook resolves the conflict deterministically at the runtime layer:
+#   it reads the operator's CLAUDE.md, extracts tools the operator has
+#   prohibited, and blocks any PreToolUse call to a prohibited tool with
+#   a clear message about which rule it violated. The model's articulation
+#   of the rule is no longer load-bearing because the hook enforces the
+#   rule directly.
+#
+# How prohibitions are declared in CLAUDE.md
+# The hook accepts three common operator-natural formats. Tool names must be
+# inside backticks for unambiguous extraction.
+#
+#   Format 1 — inline prose:
+#     Do NOT use `TaskCreate` for session-local work.
+#     do not call `TaskList` in this project.
+#     never use `TaskUpdate`.
+#
+#   Format 2 — Japanese prose:
+#     `TaskCreate` を使うな
+#     `TaskList` の使用は禁止
+#
+#   Format 3 — list under a "Forbidden Tools" / 禁止 header (within 20 lines):
+#     ## Forbidden Tools
+#     - `TaskCreate`
+#     - `TaskList`
+#
+# TRIGGER: PreToolUse
+# MATCHER: ""
+#
+# Configuration:
+#   CC_TOOL_PROHIBITION_DISABLE=1   Disable the hook entirely.
+#   CC_TOOL_PROHIBITION_WARN=1      Advisory mode: warn to stderr but exit 0
+#                                   instead of blocking. Default: block (exit 2).
+#   CC_CLAUDEMD_PATH=/path/to/file  Override CLAUDE.md search path.
+
+set -u
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-claudemd-tool-prohibition-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [claudemd-tool-prohibition]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_TOOL_PROHIBITION_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat)
+
+TOOL_NAME=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ -z "$TOOL_NAME" ] && exit 0
+
+# Find CLAUDE.md. Search order: explicit override, project CLAUDE.md, parent
+# directory, user-global ~/.claude/CLAUDE.md.
+CLAUDEMD=""
+if [ -n "${CC_CLAUDEMD_PATH:-}" ] && [ -r "$CC_CLAUDEMD_PATH" ]; then
+    CLAUDEMD="$CC_CLAUDEMD_PATH"
+else
+    for candidate in "CLAUDE.md" ".claude/CLAUDE.md" "../CLAUDE.md" "$HOME/.claude/CLAUDE.md"; do
+        if [ -r "$candidate" ]; then
+            CLAUDEMD="$candidate"
+            break
+        fi
+    done
+fi
+[ -z "$CLAUDEMD" ] && exit 0
+
+# Extract prohibited tool names from CLAUDE.md.
+# We collect tool names in two passes:
+#   Pass 1 — prose patterns matching "do not use `X`" / "禁止" / etc.
+#   Pass 2 — list items under headers that mention forbidden / prohibited / 禁止.
+FORBIDDEN_LIST=""
+
+# Pass 1: prose prohibitions
+PROSE=$(grep -iE '(do[ -]not (use|call)|never (use|call)|禁止|を使うな|使用は禁止)' "$CLAUDEMD" 2>/dev/null || true)
+if [ -n "$PROSE" ]; then
+    # Extract backtick-quoted tokens from these lines
+    EXTRACTED=$(printf '%s\n' "$PROSE" | grep -oE '`[A-Za-z][A-Za-z0-9_-]+`' 2>/dev/null | sed 's/`//g' | sort -u || true)
+    if [ -n "$EXTRACTED" ]; then
+        FORBIDDEN_LIST="$EXTRACTED"
+    fi
+fi
+
+# Pass 2: list items under "Forbidden Tools" / "Prohibited Tools" / "禁止" headers
+# (only the 20 lines following the header are scanned)
+HEADER_LINES=$(grep -inE '^#+ +(forbidden tools|prohibited tools|禁止する道具|使用禁止)' "$CLAUDEMD" 2>/dev/null | cut -d: -f1 || true)
+if [ -n "$HEADER_LINES" ]; then
+    for ln in $HEADER_LINES; do
+        SECTION=$(sed -n "${ln},$((ln+20))p" "$CLAUDEMD" 2>/dev/null || true)
+        ITEMS=$(printf '%s\n' "$SECTION" | grep -E '^[ ]*[-*] +`[A-Za-z][A-Za-z0-9_-]+`' 2>/dev/null | grep -oE '`[A-Za-z][A-Za-z0-9_-]+`' | sed 's/`//g' || true)
+        if [ -n "$ITEMS" ]; then
+            FORBIDDEN_LIST="${FORBIDDEN_LIST}${FORBIDDEN_LIST:+$'\n'}${ITEMS}"
+        fi
+    done
+fi
+
+[ -z "$FORBIDDEN_LIST" ] && exit 0
+
+# Normalise and check whether the active tool is in the forbidden set.
+FORBIDDEN_LIST=$(printf '%s\n' "$FORBIDDEN_LIST" | sort -u)
+
+if printf '%s\n' "$FORBIDDEN_LIST" | grep -qFx -- "$TOOL_NAME"; then
+    if [ "${CC_TOOL_PROHIBITION_WARN:-0}" = "1" ]; then
+        echo "⚠ claudemd-tool-prohibition: tool '$TOOL_NAME' is prohibited by $CLAUDEMD" >&2
+        echo "  Continuing (advisory mode). Set CC_TOOL_PROHIBITION_WARN=0 to block." >&2
+        exit 0
+    fi
+    echo "BLOCKED: tool '$TOOL_NAME' is prohibited by your CLAUDE.md ($CLAUDEMD)." >&2
+    echo "  The harness injected a suggestion or workflow that conflicts with your operator-scope rule." >&2
+    echo "  See issue #60323 for the failure shape (system-reminder vs CLAUDE.md prohibition)." >&2
+    echo "  To allow this call temporarily, run with CC_TOOL_PROHIBITION_WARN=1 (advisory) or CC_TOOL_PROHIBITION_DISABLE=1." >&2
+    exit 2
+fi
+
+exit 0

package/examples/clear-command-confirm-guard.sh

@@ -1,21 +1,38 @@
 #!/bin/bash
-# clear-command-confirm-guard.sh — Block accidental /clear command
+# clear-command-confirm-guard.sh — DOES NOT FIRE. Kept as a record, not as a guard.
 #
-# Solves: /clear destroys all conversation context with zero
-#         confirmation. Prefix matching means /c + Enter can
-#         accidentally trigger /clear instead of /commit or /compact (#40931).
+# This hook was written to block an accidental /clear (prefix matching means
+# /c + Enter can hit /clear instead of /commit or /compact, #40931). It cannot
+# work, and this file is kept so that nobody rebuilds it from the same idea.
 #
-# How it works: Blocks /clear entirely. Use /compact to reduce
-#   context without losing it.
+# WHY IT CANNOT WORK
+#   Slash commands never reach UserPromptSubmit. Measured 2026-09-19 on Claude
+#   Code 2.1.270 (Linux/WSL2), with every other hook removed via
+#   --setting-sources '' and a single recording hook passed inline through
+#   --settings, driven through a pty:
 #
-# TRIGGER: UserPromptSubmit
-# MATCHER: "^/clear$"
-
-INPUT=$(cat)
-PROMPT=$(echo "$INPUT" | jq -r '.prompt // empty' 2>/dev/null)
+#     typed           UserPromptSubmit          SessionEnd
+#     ordinary text   fires, prompt holds it    --
+#     /clear          never fires               fires, reason="clear"
+#     /exit           never fires               fires, reason="prompt_input_exit"
+#
+#   The matcher below is therefore never evaluated. Feeding this script
+#   {"prompt":"/clear"} by hand does make it exit 2 -- that proves the script's
+#   own logic and nothing else, which is exactly the trap this file now warns
+#   about.
+#
+# TWO MORE DEFECTS, recorded so the pattern is not copied:
+#   * grep -qE '^/clear$' matches per line, not against the whole input, so a
+#     prompt that merely contains /clear on its own line would have been refused.
+#   * The refusal text said "permanently destroys all context". Saved history is
+#     still reachable with /resume; only the current context goes.
+#
+# WHAT TO USE INSTEAD
+#   You cannot block /clear with a hook. You can run one last thing against the
+#   conversation before it goes: SessionEnd fires with reason="clear" while
+#   transcript_path still points at a readable file. See handoff-on-clear.sh.
+#
+# TRIGGER: none
 
-if echo "$PROMPT" | grep -qE '^/clear$'; then
-  echo "BLOCKED: /clear permanently destroys all context. Use /compact instead to reduce context safely." >&2
-  exit 2
-fi
+echo "clear-command-confirm-guard.sh does not fire on Claude Code 2.1.270: slash commands never reach UserPromptSubmit. See handoff-on-clear.sh for what works." >&2
 exit 0

package/examples/cli-config-pinning-detector.sh

@@ -0,0 +1,162 @@
+#!/bin/bash
+# cli-config-pinning-detector.sh — Detect Anthropic CLI config that silently pins
+# organization_id and overrides Claude Code auth routing
+# (Cluster 19 candidate, axis 19H — local-side credential override)
+#
+# Background:
+#   Cluster 19 axis 19H documents a class of authentication failures where the
+#   operator appears to be logged in with the correct email, but Claude Code is
+#   routed to the wrong organization (and therefore the wrong billing path).
+#
+#   The mechanism: Claude Code and the standalone Anthropic CLI share the
+#   ~/.config/anthropic directory. If the CLI has written a config file at
+#   ~/.config/anthropic/configs/default.json with a hardcoded organization_id
+#   (e.g., from an "Individual Org" used briefly during testing), Claude Code
+#   honors that pinned organization_id. `claude auth login` / `claude auth
+#   logout` do not always clear or update this pin — so the operator ends up
+#   "logged in" but routed to the wrong organization, and the failure surfaces
+#   downstream as billing-path or quota-state confusion.
+#
+#   Anchor case: #60742 — "[BUG] Anthropic CLI Overwrites and Pins Claude Code
+#   Credentials".
+#
+#   This hook is a SessionStart advisory that fires when:
+#     - the file ~/.config/anthropic/configs/default.json (or override path) exists,
+#       AND it contains a non-empty organization_id field, AND
+#     - the operator has not already seen the advisory in this session
+#
+#   The advisory describes the pinning behavior, points at the file and the
+#   pinned organization_id value, and recommends an explicit verification step.
+#   The hook does not auto-delete or auto-edit the config file — that decision
+#   belongs to the operator (the pinned org may be intentional).
+#
+#   Reference:
+#     https://gist.github.com/yurukusa/58cb17bfda4d5ab31bd804809809d22f (auth cluster field guide)
+#
+# Why a hook helps:
+#   Without the advisory, the operator discovers the wrong-organization routing
+#   only at billing-cycle review, or when a teammate flags that their work is
+#   showing up under an unexpected org. With the advisory, the pinning is
+#   surfaced at SessionStart so the operator can verify org routing before
+#   substantive work attaches to the wrong billing path.
+#
+# When this hook does NOT emit anything:
+#   - CC_AUTH_PIN_DISABLE=1
+#   - CC_AUTH_PIN_QUIET=1
+#   - the CLI config file does not exist
+#   - the CLI config file exists but has no organization_id field
+#   - the advisory has already fired in this session
+#
+# Hook config (settings.json):
+# {
+#   "hooks": {
+#     "SessionStart": [{
+#       "matcher": "",
+#       "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/cli-config-pinning-detector.sh" }]
+#     }]
+#   }
+# }
+#
+# Env vars:
+#   CC_AUTH_PIN_DISABLE=1            — never emit
+#   CC_AUTH_PIN_QUIET=1              — silent (process but never write to stderr)
+#   CC_AUTH_PIN_CONFIG=<path>        — config file path override (tests)
+#   CC_AUTH_PIN_STATE_DIR=<path>     — one-shot state dir override (default ~/.claude/state)
+#   CC_AUTH_PIN_SESSION_ID=<id>      — session id override (tests)
+#
+# Design notes:
+#   - Opt-out. The pinning behavior is silent by design (no upstream signal),
+#     so a one-shot stderr advisory at SessionStart is the only place this
+#     surfaces before the operator commits substantive work to the wrong org.
+#   - One-shot per session. The advisory fires once. The operator either
+#     verifies and dismisses, or unsets the pin in the file deliberately.
+#   - Never blocks. Exit always 0. The pin may be intentional (multi-org
+#     setups); auto-deleting it would break those workflows.
+#   - Does not require jq. The organization_id field is parsed with a portable
+#     grep/sed pipeline so the hook works on bare shells.
+
+set -u
+
+if [[ "${CC_AUTH_PIN_DISABLE:-0}" = "1" ]]; then
+    exit 0
+fi
+
+CONFIG_FILE="${CC_AUTH_PIN_CONFIG:-$HOME/.config/anthropic/configs/default.json}"
+
+if [[ ! -f "$CONFIG_FILE" ]]; then
+    exit 0
+fi
+
+STATE_DIR="${CC_AUTH_PIN_STATE_DIR:-$HOME/.claude/state}"
+mkdir -p "$STATE_DIR" 2>/dev/null
+
+SESSION_ID="${CC_AUTH_PIN_SESSION_ID:-${CLAUDE_SESSION_ID:-default}}"
+GUARD_FILE="$STATE_DIR/auth-pin-${SESSION_ID}.fired"
+
+if [[ -f "$GUARD_FILE" ]]; then
+    exit 0
+fi
+
+# Extract organization_id without requiring jq. The portable approach:
+# 1) grep for the key (allowing leading whitespace and the optional underscore)
+# 2) sed-strip the key, separator, quotes, and trailing comma
+ORG_LINE=$(grep -E '"organization_id"[[:space:]]*:' "$CONFIG_FILE" 2>/dev/null | head -1)
+if [[ -z "$ORG_LINE" ]]; then
+    exit 0
+fi
+
+ORG_ID=$(echo "$ORG_LINE" \
+    | sed -E 's/.*"organization_id"[[:space:]]*:[[:space:]]*"?([^",}[:space:]]+)"?.*/\1/' \
+    | tr -d '[:space:]')
+
+if [[ -z "$ORG_ID" ]] || [[ "$ORG_ID" == "null" ]] || [[ "$ORG_ID" == "$ORG_LINE" ]]; then
+    exit 0
+fi
+
+# Mark one-shot guard.
+touch "$GUARD_FILE" 2>/dev/null
+
+if [[ "${CC_AUTH_PIN_QUIET:-0}" = "1" ]]; then
+    exit 0
+fi
+
+cat >&2 <<EOF
+
+────────────────────────────────────────────────────────────────────
+  Auth advisory — Cluster 19 axis 19H (CLI config pinning)
+────────────────────────────────────────────────────────────────────
+  Anthropic CLI config detected with pinned organization_id:
+    ${CONFIG_FILE}
+    organization_id: ${ORG_ID}
+
+  The Cluster 19 axis 19H pattern: Claude Code shares the
+  ~/.config/anthropic directory with the standalone Anthropic CLI.
+  When the CLI has written a config file with a hardcoded
+  organization_id, Claude Code honors that pin — even if
+  \`claude auth login\` / \`claude auth logout\` were run afterwards.
+  The visible state is "logged in with the correct email," but tool
+  calls are routed to the pinned org's billing path.
+
+  Anchor case: #60742.
+
+  Recommended verification before substantive work:
+
+    /account
+
+  Confirm the "Organization" field matches your intended billing org.
+  If it does not match, the pin in the file above is overriding
+  your interactive auth. Two recovery paths:
+
+    1) Edit ${CONFIG_FILE} and remove the
+       "organization_id" line, then run /login to re-pick the org.
+    2) Delete the file entirely if the standalone CLI is not used.
+
+  Field guide: https://gist.github.com/yurukusa/58cb17bfda4d5ab31bd804809809d22f
+
+  (This advisory fires once per session. To disable:
+   export CC_AUTH_PIN_DISABLE=1)
+────────────────────────────────────────────────────────────────────
+
+EOF
+
+exit 0

package/examples/cliff-countdown-advisor.sh

@@ -0,0 +1,96 @@
+#!/bin/bash
+# cliff-countdown-advisor.sh
+#
+# SessionStart hook that articulates the days remaining until the 2026-06-15
+# Anthropic billing-split cliff, plus operator-side guidance to minimize Pool 2
+# usage signals during the preparation window.
+#
+# Designed to surface the cliff timing once per session without becoming noise:
+# - Quiet beyond 30 days before cliff (no output)
+# - Caution between 15-30 days before cliff (single-line note)
+# - Elevated between 1-14 days before cliff (multi-line advisory)
+# - Acute on cliff day (2026-06-15, dedicated message)
+# - Post-cliff window (1-30 days after) surfaces the diff-capture procedure
+# - Silent beyond 30 days after cliff
+#
+# Environment variables (all optional):
+# - CC_CLIFF_DATE: override the cliff date (YYYY-MM-DD format, default 2026-06-15)
+# - CC_CLIFF_QUIET: if set to "1", suppress all output (opt-out)
+# - CC_CLIFF_DISABLE: if set to "1", disable the hook entirely (alias for QUIET)
+#
+# Exit codes:
+# - Always exits 0 (advisory hook, never blocks)
+#
+# Reference: docs/june-15-cliff-14-day-plan.md (the 14-day preparation plan)
+
+set -uo pipefail
+
+# Opt-out check
+if [[ "${CC_CLIFF_QUIET:-0}" == "1" ]] || [[ "${CC_CLIFF_DISABLE:-0}" == "1" ]]; then
+  exit 0
+fi
+
+CLIFF_DATE="${CC_CLIFF_DATE:-2026-06-15}"
+
+# Convert dates to seconds since epoch for comparison
+if ! cliff_epoch=$(date -d "${CLIFF_DATE}" +%s 2>/dev/null); then
+  # Date parsing failed (e.g. on macOS without GNU date) — silently exit
+  exit 0
+fi
+
+now_epoch=$(date +%s)
+diff_seconds=$((cliff_epoch - now_epoch))
+diff_days=$((diff_seconds / 86400))
+
+# Today is 2026-06-15 (cliff day, +/- 12 hours)
+if [[ ${diff_days} -ge -1 ]] && [[ ${diff_days} -le 0 ]]; then
+  cat <<'EOF'
+[cliff-countdown] ★ 2026-06-15 cliff day. Anthropic billing split is active now.
+
+Today's measurement priority:
+1. Capture Anthropic Console Usage snapshot before any heavy work
+2. Watch for the first Pool 2 charges to surface (typically within 12-24h)
+3. Save the snapshot to ~/ops/measurements/2026-06-15-cliff-day.json
+
+Reference (free, MIT):
+- 14-day plan: docs/june-15-cliff-14-day-plan.md (post-cliff diff section)
+
+Set CC_CLIFF_QUIET=1 to suppress this advisory.
+EOF
+  exit 0
+fi
+
+# 1-14 days before cliff (elevated advisory)
+if [[ ${diff_days} -ge 1 ]] && [[ ${diff_days} -le 14 ]]; then
+  cat <<EOF
+[cliff-countdown] ⚠ ${diff_days} days until the 2026-06-15 cliff.
+
+Operator-side actions to consider:
+- Capture Anthropic Console Usage baseline (Pool 1 vs Pool 2 ratio)
+- Reduce \`claude -p\` and Agent SDK calls running on cron / background paths
+- Stop parallel \`claude -p\` invocations (run sequentially during the window)
+- Set or verify the monthly Spend Limit in Anthropic Console
+
+Reference (free, MIT):
+- 14-day plan: docs/june-15-cliff-14-day-plan.md
+
+Set CC_CLIFF_QUIET=1 to suppress this advisory.
+EOF
+  exit 0
+fi
+
+# 15-30 days before cliff (caution)
+if [[ ${diff_days} -ge 15 ]] && [[ ${diff_days} -le 30 ]]; then
+  echo "[cliff-countdown] ${diff_days} days until the 2026-06-15 billing cliff. Start the baseline capture this week. Reference: docs/june-15-cliff-14-day-plan.md"
+  exit 0
+fi
+
+# 1-30 days after cliff (post-cliff diff capture)
+if [[ ${diff_days} -le -2 ]] && [[ ${diff_days} -ge -30 ]]; then
+  days_after=$((-diff_days))
+  echo "[cliff-countdown] Day ${days_after} after the 2026-06-15 cliff. Capture diff vs pre-cliff baseline if not already done. Reference: docs/june-15-cliff-14-day-plan.md (6/16 onward section)."
+  exit 0
+fi
+
+# Otherwise quiet
+exit 0

package/examples/clipboard-secret-guard.sh

@@ -12,6 +12,18 @@
 # MATCHER: "Bash"
 # CATEGORY: security
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-clipboard-secret-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [clipboard-secret-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0

package/examples/closure-word-verify-gate.sh

@@ -0,0 +1,150 @@
+#!/bin/bash
+# closure-word-verify-gate.sh — Stop the turn if a closure word ("done",
+# "shipped", "complete", "production ready", "bitti", "finished") was used
+# without a corresponding verification tool call in the same turn.
+#
+# Solves: #60506 — "Self-report: six days of architectural drift on a customer
+# project despite full hook + memory + skill enforcement."
+#
+# In that case, claude-opus-4-7 reported in its own first-person Issue body:
+#
+#   "'Done' is cheap for me. I said 'bitti / shipped / production ready'
+#    without performing a browser CRUD round-trip, even after the customer
+#    wrote an explicit rule: 'no claim bitti without browser test.' Two
+#    hours after the rule I said 'bitti' again, without opening the browser.
+#    The customer caught me because he opened the screen."
+#
+# The customer's own engineering recommendation #4 in #60506:
+#
+#   "Quality-scorecard gate before closure words. When I emit 'shipped',
+#    'complete', 'production ready', 'done', 'bitti', require — by hook
+#    or by tool — that a quality-scorecard tool was called in the same
+#    turn. Otherwise replace the closure word with 'pending verification.'"
+#
+# This hook is the harness-level form of that requirement. It runs on Stop,
+# scans the assistant's most recent transcript turn for closure words, and
+# refuses the Stop (returning exit 2 with stderr feedback Claude sees) if
+# no verification command appeared in the same turn.
+#
+# This is distinct from existing verify-before-commit.sh and
+# verify-before-done.sh, both of which fire on `git commit` time only.
+# closure-word-verify-gate.sh fires on *any* assistant turn that asserts
+# completion, regardless of whether a commit is being made.
+#
+# Related Issues:
+#   #60506 (@zean89,   2026-05-19) — first-person self-report of the failure
+#   #60226 (@suwayama, 2026-05-18) — recognition-without-arrest framework
+#   #37818                          — Claude declares fixes done without
+#                                     verification
+#
+# TRIGGER: Stop
+# MATCHER: ""
+#
+# CONFIGURATION (environment variables):
+#   CC_CLOSURE_WORDS          default built-in — pipe-separated regex of
+#                                                  closure phrases
+#   CC_VERIFICATION_COMMANDS  default built-in — regex of verification tools
+#                                                  (test runners, browsers)
+#   CC_CLOSURE_GATE_DISABLE   set to "1" to disable the gate entirely
+#
+# USAGE (settings.json):
+#   {
+#     "hooks": {
+#       "Stop": [{
+#         "matcher": "",
+#         "hooks": [{
+#           "type": "command",
+#           "command": "~/.claude/hooks/closure-word-verify-gate.sh"
+#         }]
+#       }]
+#     }
+#   }
+
+set -uo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-closure-word-verify-gate-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [closure-word-verify-gate]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_CLOSURE_GATE_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat 2>/dev/null || true)
+[ -z "$INPUT" ] && exit 0
+
+DEFAULT_CLOSURES='\b(done|shipped|complete|completed|production[[:space:]]+ready|ready[[:space:]]+to[[:space:]]+merge|ready[[:space:]]+to[[:space:]]+ship|bitti|finished|all[[:space:]]+set|works[[:space:]]+now|fixed[[:space:]]+it)\b'
+DEFAULT_VERIFICATION='(npm[[:space:]]+(run[[:space:]]+)?test|pytest|playwright|cypress|jest[[:space:]]|vitest|bun[[:space:]]+test|cargo[[:space:]]+test|go[[:space:]]+test|mocha|phpunit|rspec|curl[[:space:]].*localhost|gh[[:space:]]+pr[[:space:]]+checks|deno[[:space:]]+test|tox|make[[:space:]]+test)'
+
+CLOSURES="${CC_CLOSURE_WORDS:-$DEFAULT_CLOSURES}"
+VERIFICATION="${CC_VERIFICATION_COMMANDS:-$DEFAULT_VERIFICATION}"
+
+# Stop-hook input shape varies across Claude Code versions; try several keys.
+# The fields we care about are the assistant's most recent message text and
+# the list of Bash commands that ran in the same turn.
+ASSISTANT_TEXT=$(printf '%s' "$INPUT" | jq -r '
+    .transcript[-1].content //
+    .last_assistant_message //
+    .stop_input.assistant_text //
+    .assistant_message //
+    empty
+' 2>/dev/null)
+
+# Commands that ran in this turn (multiple possible keys depending on
+# harness version)
+TURN_COMMANDS=$(printf '%s' "$INPUT" | jq -r '
+    [ .turn_tool_calls[]?.command,
+      .recent_commands[]?,
+      .transcript[-1].tool_calls[]?.input.command,
+      .last_turn_commands[]?
+    ] | map(select(. != null)) | .[]
+' 2>/dev/null || true)
+
+# If we cannot find the assistant text, the harness shape differs and we
+# refuse to false-positive — exit silently.
+[ -z "$ASSISTANT_TEXT" ] && exit 0
+
+# No closure word in the turn → nothing to gate.
+if ! printf '%s' "$ASSISTANT_TEXT" | grep -Eiq "$CLOSURES"; then
+    exit 0
+fi
+
+# Closure word present. Did a verification command run in the same turn?
+if [ -n "$TURN_COMMANDS" ] && printf '%s' "$TURN_COMMANDS" | grep -Eiq "$VERIFICATION"; then
+    # Verification artifact present — closure is grounded.
+    exit 0
+fi
+
+# Closure word without verification → block the Stop and surface feedback.
+MATCHED_WORD=$(printf '%s' "$ASSISTANT_TEXT" | grep -Eio "$CLOSURES" | head -1)
+
+cat >&2 <<EOF
+<system-reminder>
+CLOSURE WITHOUT VERIFICATION — the word "$MATCHED_WORD" was used in this turn
+but no verification command (test runner, Playwright, curl-against-local,
+gh pr checks) ran in the same turn.
+
+This is the failure mode documented in #60506 and #37818: closure words are
+emitted before the actual state has been verified. The cost of an unverified
+"$MATCHED_WORD" lands on the operator, not on the model.
+
+Before ending this turn, either:
+
+  1. Run a verification command (npm test, pytest, playwright, curl, etc.)
+     that exercises the claim being made, and re-state closure only after
+     that verification passes, OR
+  2. Replace "$MATCHED_WORD" with "pending verification — needs <specific
+     verification step>" so the operator knows the claim is not yet grounded.
+
+To disable this gate intentionally (for non-code turns, retrospectives,
+documentation work), set CC_CLOSURE_GATE_DISABLE=1 in your environment.
+</system-reminder>
+EOF
+
+exit 2

package/examples/cloud-cli-guard.sh

@@ -10,19 +10,39 @@
 # Detects:
 #   gcloud compute instances delete
 #   gcloud sql instances delete
-#   gcloud storage rm
+#   gcloud storage rm / gcloud storage rb   (objects / buckets — #70024)
+#   gsutil rm / gsutil rb                    (legacy GCS removal, incl. gsutil -m rm)
 #   gcloud projects delete
 #   az vm delete
 #   az storage account delete
 #   az sql db delete
 #   az group delete
+#   az ad group delete   (the irreversible deletion in #69397)
 #
 # Does NOT block:
 #   gcloud compute instances list/describe
 #   az vm list/show
 #   gcloud/az read-only operations
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
+#   On Windows, az/gcloud commonly run through the PowerShell tool,
+#   which is separate from Bash in Claude Code. A Bash-only matcher
+#   never fires on the PowerShell tool, so the irreversible
+#   `az ad group delete` in #69397 ran with no permission prompt.
+#   Register with matcher "Bash|PowerShell"; both tools populate
+#   tool_input.command.
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-cloud-cli-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [cloud-cli-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
@@ -37,6 +57,23 @@ if echo "$COMMAND" | grep -qE '\bgcloud\s+.*(delete|destroy|remove|reset)\b'; th
     exit 2
 fi
 
+# Block cloud-storage object/bucket removal via the `rm`/`rb` subcommands.
+# The gcloud check above keys on delete|destroy|remove|reset, but Google Cloud
+# Storage removal uses the literal subcommand `rm` (objects) and `rb` (buckets) —
+# `gcloud storage rm` / `gsutil rm` — none of which contain "remove". Without this
+# branch those slip past the guard entirely (and rm-safety-net only fires on a
+# command that *starts* with `rm`, not on `gcloud storage rm`). #70024: an agent
+# ran `gcloud storage rm -r` after a failed `mv` and destroyed the source objects.
+if echo "$COMMAND" | grep -qE '\bgcloud\s+storage\s+(rm|rb)\b' \
+   || echo "$COMMAND" | grep -qE '\bgsutil\s+(-[a-zA-Z]+\s+)*(rm|rb)\b'; then
+    echo "BLOCKED: Destructive Google Cloud Storage removal detected." >&2
+    echo "  Command: $COMMAND" >&2
+    echo "  This deletes cloud objects/buckets irreversibly. Confirm the copy/move" >&2
+    echo "  succeeded first ('gcloud storage ls' / 'cp'); never delete after an" >&2
+    echo "  unverified transfer (#70024)." >&2
+    exit 2
+fi
+
 # Block destructive az (Azure) operations
 if echo "$COMMAND" | grep -qE '\baz\s+.*(delete|destroy|remove)\b'; then
     echo "BLOCKED: Destructive Azure operation detected." >&2