cc-safe-setup 29.7.0 → 30.0.4

package/examples/completion-claim-without-verification-detector.sh

@@ -0,0 +1,207 @@
+#!/bin/bash
+# completion-claim-without-verification-detector.sh — Stop hook
+# Trigger: Stop
+# Matcher: ""
+#
+# Solves: Issue #60177 (mike-prokhorov, 2026-05-18) — "Claude marks tasks
+#         done without testing — 12 days, 51 commits, still broken (Opus
+#         4.x)". Across approximately fifty sessions over twelve days, the
+#         agent repeatedly said "done, ready to test" without running any
+#         verification step. Approximately 70% of the period's commits
+#         were fix-of-prior-commit rather than progress. The user's
+#         post-incident framing: a four-level honesty ladder where
+#         L0 = file exists, L1 = smoke-tested locally, L2 = runs in
+#         staging, L3 = user-approved. The agent defaulted to claiming
+#         the highest aspirational level (L3-ish "done, ready to test")
+#         without having reached even L1.
+#
+# Class of failure: claim-vs-reality divergence at the completion-signal
+#         layer. The agent's response surface emits a definitive
+#         completion claim ("done", "ready to test", "fixed",
+#         "succeeded", "完了") that the underlying tool history does not
+#         support. The user trusts the claim, attempts to use the
+#         deliverable, and discovers the gap downstream — often after
+#         expensive context loss.
+#
+# HOW IT WORKS:
+#   On Stop, the hook reads the session transcript and looks at the
+#   final assistant message for completion-claim markers. If a claim
+#   is detected, it then scans the recent tool-use history (the last
+#   FORTY tool calls in this session) for verification-shaped tools:
+#   Bash invocations that run a test command (pytest / npm test /
+#   go test / cargo test / curl / status check / smoke / verify),
+#   Read on log files, or Grep against an output destination.
+#   If a completion claim was emitted but no verification-shaped tool
+#   appears in the recent window, the hook writes an advisory line to
+#   stderr and logs the detection. The hook never blocks the Stop.
+#
+# WHY THIS MATTERS:
+#   The 60177 failure shape is one of the most expensive in the
+#   tracker. Every "done, ready to test" without verification spends
+#   the operator's attention budget on a falsified completion, often
+#   triggers a re-run cycle that burns API credits, and erodes the
+#   trust margin that lets the agent operate autonomously at all.
+#   Most prevention efforts focus on slowing the agent down with
+#   permission prompts on individual tool calls. This hook works in
+#   the opposite direction: it lets the agent run freely and only
+#   surfaces a warning when the *completion claim* contradicts the
+#   *recent tool history*.
+#
+# TRIGGER: Stop
+# MATCHER: ""
+#
+# CONFIGURATION:
+#   CC_COMPLETION_CLAIM_DISABLE=1    disable the hook entirely
+#   CC_COMPLETION_CLAIM_LOG=path     append detection events
+#                                    (default ~/.claude/logs/completion-claim.log)
+#   CC_COMPLETION_CLAIM_WINDOW=N     scan window size in tool calls
+#                                    (default 40)
+#
+# SAFETY:
+#   - Read-only on the transcript; never modifies any session state.
+#   - Emits an advisory line via stderr; does not block Stop.
+#   - Exits 0 always; never prevents the session from ending.
+#   - Uses jq for transcript parsing; falls back silently if jq is
+#     not installed (Claude Code requires jq for hook input parsing
+#     so this is rarely a real problem).
+#
+# REFERENCES:
+#   - anthropics/claude-code#60177 (mike-prokhorov, 2026-05-18) — the
+#     canonical case with the L0/L1/L2/L3 ladder framing
+#   - companion hook: rhetorical-verification-prompt-detector.sh
+#     (catches the input-side rhetorical-question failure, while this
+#     hook catches the output-side completion-claim failure)
+set -u
+
+[ "${CC_COMPLETION_CLAIM_DISABLE:-}" = "1" ] && exit 0
+
+LOG_DIR="${HOME}/.claude/logs"
+LOG_FILE="${CC_COMPLETION_CLAIM_LOG:-${LOG_DIR}/completion-claim.log}"
+mkdir -p "$LOG_DIR" 2>/dev/null
+
+WINDOW="${CC_COMPLETION_CLAIM_WINDOW:-40}"
+
+INPUT=$(cat)
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+[ -z "$TRANSCRIPT" ] && exit 0
+[ ! -r "$TRANSCRIPT" ] && exit 0
+
+# Extract text of the last assistant message in the transcript.
+# Each JSONL line of type=assistant has message.content as an array of
+# blocks; we collect blocks of type=text.
+LAST_TEXT=$(tac "$TRANSCRIPT" 2>/dev/null \
+    | grep -m1 '"type":"assistant"' \
+    | jq -r '
+        if (.message.content | type) == "array" then
+            [.message.content[] | select(.type=="text") | .text] | join("\n")
+        else
+            ""
+        end
+    ' 2>/dev/null || true)
+
+[ -z "$LAST_TEXT" ] && exit 0
+
+# Detection patterns — completion-claim markers.
+# Conservative on purpose: only catch phrasing that strongly implies a
+# definitive *done* assertion. Hedged phrasing ("seems to work",
+# "I think this is ready", "this should be done") deliberately does not
+# trigger — that hedged surface form is the honest one we want to keep.
+EN_PATTERNS='\b(done|complete|completed|ready to test|fixed|fixed it|all set|good to go|works now|working now|deployed|shipped)\b|task (is )?(now )?(done|complete|finished)|implementation (is )?(now )?(done|complete|finished)|i.?ve (finished|completed|implemented|fixed)|successfully (implemented|completed|fixed|deployed)|the (fix|change|feature|implementation) is (now )?(working|done|complete|deployed)'
+
+JA_PATTERNS='完了(しました|です)?|終わりました|完成(しました|です)?|準備(が )?完了|修正(済|完了|しました)|実装(完了|済|しました)|デプロイ(完了|済|しました)|動作(確認済|しました)?|テスト(してください|可能です)|動きます|動いています'
+
+# Hedge detection — if the message contains hedging markers, treat it as
+# NOT a definitive completion claim. Honest hedging is the surface form we
+# want to preserve.
+EN_HEDGE='\b(i think|i believe|i hope|hopefully|maybe|possibly|might be|might have|should be|should have|seems to|appears to|looks like|i\b.*not sure|haven.?t (tested|verified|checked|run)|did not (test|verify|check|run)|did.?nt (test|verify|check|run)|could you (verify|check|confirm|test)|please (verify|check|confirm|test))\b'
+JA_HEDGE='と思います|だと思う|多分|たぶん|おそらく|かもしれ(ない|ません)|未確認|確認していません|テストしていません|確認していない|確認してください|テストしてください|チェックしてください'
+
+# If hedging is present, exit silently — the surface form is honest.
+if echo "$LAST_TEXT" | grep -qiE "$EN_HEDGE"; then
+    exit 0
+fi
+if echo "$LAST_TEXT" | grep -qE "$JA_HEDGE"; then
+    exit 0
+fi
+
+MATCHED_CLAIM=""
+
+if echo "$LAST_TEXT" | grep -qiE "$EN_PATTERNS"; then
+    MATCHED_CLAIM=$(echo "$LAST_TEXT" | grep -oiE "$EN_PATTERNS" | head -1)
+elif echo "$LAST_TEXT" | grep -qE "$JA_PATTERNS"; then
+    MATCHED_CLAIM=$(echo "$LAST_TEXT" | grep -oE "$JA_PATTERNS" | head -1)
+fi
+
+[ -z "$MATCHED_CLAIM" ] && exit 0
+
+# Scan the last WINDOW tool-use entries for verification-shaped tools.
+# We accept any of the following as evidence that some verification was
+# attempted in the session's recent history:
+#   - Bash invocations whose command matches verification commands
+#   - Read of a log file
+#   - Grep over an output destination
+# This list is intentionally permissive: the goal is to catch the
+# "claimed done without doing anything to check" pattern, not to grade
+# every session on the quality of its tests.
+VERIFY_COMMAND_PATTERN='pytest|unittest|npm (run )?test|yarn test|go test|cargo test|cargo check|jest|mocha|rspec|phpunit|composer test|mix test|gradle test|mvn test|make test|make check|bin/test|bin/rspec|bundle exec rspec|bundle exec rake test|curl |wget |httpie|http |status check|smoke|verify|sanity|tail -[fn]|less |cat .*\.log|grep .*\.log|systemctl status|docker (ps|logs)|kubectl (get|logs|describe)|psql -c|sqlite3 .*SELECT|redis-cli|nmap |ping |ssh .*-c|ssh .*uptime|ssh .*systemctl|ssh .*docker|ssh .*tail|gh run|gh workflow|git diff --check|git status|node -e .*assert|python -c .*assert|ruby -e .*raise'
+
+VERIFY_TOOL_PATTERN='"name":"Bash"|"name":"Read"|"name":"Grep"|"name":"Glob"'
+
+# Read the last WINDOW tool_use entries from the transcript.
+# Each tool_use is inside a message.content block of type=tool_use.
+RECENT_TOOL_USES=$(tac "$TRANSCRIPT" 2>/dev/null \
+    | grep '"tool_use"' \
+    | head -n "$WINDOW")
+
+# Did any recent Bash command match a verification-shaped command?
+VERIFICATION_FOUND="0"
+if [ -n "$RECENT_TOOL_USES" ]; then
+    # Bash commands
+    BASH_COMMANDS=$(printf '%s\n' "$RECENT_TOOL_USES" \
+        | jq -r '
+            select(.message.content) |
+            .message.content[]? |
+            select(.type=="tool_use" and .name=="Bash") |
+            .input.command // empty
+        ' 2>/dev/null || true)
+
+    if [ -n "$BASH_COMMANDS" ] && echo "$BASH_COMMANDS" | grep -qiE "$VERIFY_COMMAND_PATTERN"; then
+        VERIFICATION_FOUND="1"
+    fi
+
+    # Read calls (we treat any Read in the window as plausible verification)
+    if [ "$VERIFICATION_FOUND" = "0" ]; then
+        if printf '%s\n' "$RECENT_TOOL_USES" | grep -q '"name":"Read"'; then
+            # Be stricter: only count Read of log files / output files as verification
+            READ_PATHS=$(printf '%s\n' "$RECENT_TOOL_USES" \
+                | jq -r '
+                    select(.message.content) |
+                    .message.content[]? |
+                    select(.type=="tool_use" and .name=="Read") |
+                    .input.file_path // empty
+                ' 2>/dev/null || true)
+            if echo "$READ_PATHS" | grep -qiE '\.log|/log/|output|result|coverage|junit|test.*report|/tmp/'; then
+                VERIFICATION_FOUND="1"
+            fi
+        fi
+    fi
+fi
+
+[ "$VERIFICATION_FOUND" = "1" ] && exit 0
+
+# Detection: completion claim emitted, no verification in recent window.
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "unknown"' 2>/dev/null || echo "unknown")
+
+# Log the detection
+{
+    printf '[%s] completion-claim-without-verification session=%s claim=%q window=%s\n' \
+        "$TS" "$SESSION_ID" "$MATCHED_CLAIM" "$WINDOW"
+} >> "$LOG_FILE" 2>/dev/null || true
+
+# Emit advisory to stderr — Claude Code surfaces this to the user.
+cat >&2 << EOF
+[completion-claim-without-verification] The assistant just emitted a completion claim ("$MATCHED_CLAIM") but the last $WINDOW tool calls in this session do not include a verification-shaped tool use (no pytest / npm test / curl / status check / log read). This pattern matches anthropics/claude-code#60177 (12 days, 51 commits, 0 working product). Consider asking the assistant which check actually ran, or run a verification command yourself before acting on the claim.
+EOF
+
+exit 0

package/examples/composer-guard.sh

@@ -20,6 +20,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-composer-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [composer-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/compound-bash-permission-resolver.sh

@@ -0,0 +1,156 @@
+#!/bin/bash
+# compound-bash-permission-resolver.sh — Per-component allow-rule check for compound bash
+#
+# Solves: Cluster 6 Axis 1 — wildcard rules like Bash(git status:*) match
+#         a bare `git status` but not `cd repo && git status`, even though
+#         the rule should logically cover the second. The operator who
+#         configured the rule sees a permission prompt with no way to tell
+#         whether their rule "should have" covered.
+#
+# Issues addressed: #28240 (180 reactions), #32985 (24 reactions),
+#         meta-issue #30519 Axis 1.
+#
+# How it works: PreToolUse hook on Bash. When the command contains a
+#   compound separator (&&, ||, ;, |), the hook splits it into components
+#   and checks each component against the Bash() patterns configured in
+#   permissions.allow across the four standard settings locations.
+#
+#   The advisory tells the operator one of two things:
+#     - all N components match an existing pattern individually, so the
+#       prompt is the Axis 1 false positive — safe to approve, but
+#       "Always Allow" will save the verbatim compound, not the patterns
+#     - K of N components match, the remainder do not — the prompt is
+#       firing on a genuinely new tool surface
+#
+#   This hook NEVER blocks. It always exits 0. It only reads settings.
+#
+# Heuristic limitations: the splitter does not understand shell quoting,
+#   heredocs, or subshell expansions ($(...)). Compounds embedded in
+#   quoted arguments may be misparsed. The advisory is conservative:
+#   when ambiguous, it counts an unmatched segment as uncovered, which
+#   nudges the operator toward inspection rather than blind approval.
+#
+# Environment variables:
+#   CC_COMPOUND_RESOLVER_DISABLE=1 — disable the advisory entirely
+#   CC_COMPOUND_RESOLVER_VERBOSE=1 — print resolver breakdown
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+
+set -uo pipefail
+
+INPUT=$(cat)
+
+# Fail-open on missing input or jq parse errors.
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+[ "${CC_COMPOUND_RESOLVER_DISABLE:-0}" = "1" ] && exit 0
+
+# Detect compound separator. Order matters: check && and || before single |.
+IS_COMPOUND=0
+case "$COMMAND" in
+    *"&&"*|*"||"*|*";"*) IS_COMPOUND=1 ;;
+esac
+# Single pipe (not part of ||): look for "|" with no adjacent "|".
+if [ "$IS_COMPOUND" = "0" ] && \
+   printf '%s' "$COMMAND" | grep -qE '([^|]\|[^|]|^\|[^|]|[^|]\|$)'; then
+    IS_COMPOUND=1
+fi
+[ "$IS_COMPOUND" = "0" ] && exit 0
+
+# Collect Bash() allow patterns from all four standard settings locations.
+PATTERNS_FILE=$(mktemp)
+trap 'rm -f "$PATTERNS_FILE"' EXIT
+for CFG in \
+    "${HOME}/.claude/settings.json" \
+    "${HOME}/.claude/settings.local.json" \
+    "./.claude/settings.json" \
+    "./.claude/settings.local.json"; do
+    [ -f "$CFG" ] || continue
+    jq -r '.permissions.allow // [] | .[] | select(type == "string" and startswith("Bash("))' \
+        "$CFG" 2>/dev/null >> "$PATTERNS_FILE" || true
+done
+
+# If no Bash() patterns are configured, the resolver has nothing to say.
+[ ! -s "$PATTERNS_FILE" ] && exit 0
+
+# Split COMMAND on compound separators (&& || ; |) into one-per-line segments.
+# Order: collapse && and || to newlines first so single | doesn't get
+# erroneously split inside ||.
+SEGMENTS=$(printf '%s' "$COMMAND" \
+    | sed -E 's/&&/\n/g; s/\|\|/\n/g; s/;/\n/g' \
+    | sed 's/|/\n/g')
+
+COVERED_COUNT=0
+TOTAL=0
+UNCOVERED_LIST=""
+
+while IFS= read -r SEG; do
+    SEG=$(printf '%s' "$SEG" | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
+    [ -z "$SEG" ] && continue
+
+    # Strip leading env-var assignments (FOO=bar BAZ=qux cmd ...).
+    WORK="$SEG"
+    while printf '%s' "$WORK" | grep -qE '^[A-Z_][A-Z0-9_]*=[^[:space:]]+[[:space:]]+'; do
+        WORK=$(printf '%s' "$WORK" | sed -E 's/^[A-Z_][A-Z0-9_]*=[^[:space:]]+[[:space:]]+//')
+    done
+
+    read -r BIN ARG1 _ <<< "$WORK"
+    [ -z "${BIN:-}" ] && continue
+
+    TOTAL=$((TOTAL+1))
+    BIN_BASE=$(basename "$BIN")
+
+    MATCHED=0
+    # Subcommand-level pattern: Bash(<bin> <arg1>:*)
+    if [ -n "${ARG1:-}" ] && printf '%s' "$ARG1" | grep -qE '^[a-zA-Z][a-zA-Z0-9_-]*$'; then
+        if grep -Fxq "Bash($BIN_BASE $ARG1:*)" "$PATTERNS_FILE"; then
+            MATCHED=1
+        fi
+    fi
+    # Binary-level pattern fallback: Bash(<bin>:*)
+    if [ "$MATCHED" = "0" ] && grep -Fxq "Bash($BIN_BASE:*)" "$PATTERNS_FILE"; then
+        MATCHED=1
+    fi
+
+    if [ "$MATCHED" = "1" ]; then
+        COVERED_COUNT=$((COVERED_COUNT+1))
+    else
+        UNCOVERED_LIST="${UNCOVERED_LIST}${BIN_BASE} "
+    fi
+done <<< "$SEGMENTS"
+
+# A "compound" with one or zero meaningful segments isn't worth flagging.
+[ "$TOTAL" -lt 2 ] && exit 0
+
+{
+    echo "[compound-bash-permission-resolver] Compound bash detected (${TOTAL} components)."
+    echo ""
+    if [ "$COVERED_COUNT" = "$TOTAL" ]; then
+        echo "All ${TOTAL} components match an existing Bash() allow pattern when evaluated"
+        echo "individually. The permission prompt is likely Cluster 6 Axis 1 — the matching"
+        echo "engine does not recompose compound bash against allow rules per-component."
+        echo "(meta-issue #30519 Axis 1; #28240 with 180 reactions)"
+        echo ""
+        echo "Safe to approve: each component is already covered standalone."
+        echo "Note: \"Always Allow\" will save the verbatim compound string,"
+        echo "not the per-component patterns — variants of this compound will re-prompt."
+    else
+        UNCOVERED_TRIMMED=$(printf '%s' "$UNCOVERED_LIST" | sed -E 's/[[:space:]]+$//')
+        echo "Coverage: ${COVERED_COUNT} of ${TOTAL} components match an allow pattern."
+        echo "Uncovered components (binary names): ${UNCOVERED_TRIMMED}"
+        echo ""
+        echo "The prompt is firing on the uncovered component(s) above, not on the"
+        echo "compound shape itself. Add Bash(<bin>:*) patterns for the uncovered"
+        echo "binaries to permissions.allow if you want to skip future prompts."
+    fi
+    if [ "${CC_COMPOUND_RESOLVER_VERBOSE:-0}" = "1" ]; then
+        PCOUNT=$(wc -l < "$PATTERNS_FILE")
+        echo ""
+        echo "(resolver breakdown: total=${TOTAL} covered=${COVERED_COUNT} patterns_loaded=${PCOUNT})"
+    fi
+} >&2
+
+# Always exit 0 — this hook never blocks.
+exit 0

package/examples/compound-command-allow.sh

@@ -24,7 +24,7 @@
 #   }
 # }
 #
-# TRIGGER: PermissionRequest  MATCHER: ""
+# TRIGGER: PreToolUse  MATCHER: "Bash"
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

package/examples/compound-command-deny-enforcer.sh

@@ -0,0 +1,183 @@
+#!/bin/bash
+# ================================================================
+# compound-command-deny-enforcer.sh — Enforce deny rules across compound commands
+# ================================================================
+# PURPOSE:
+#   Claude Code's permission system does not catch compound commands.
+#   `Bash(git push:*)` in `ask`/`deny` does not match `cd /path && git push`.
+#
+#   The harness strips idempotent `cd` prefixes (when cd target == cwd),
+#   but `cd /different/path && <denied-cmd>` is NOT stripped, and the
+#   permission system evaluates the pre-split string starting with `cd`,
+#   matching no deny/ask rule.
+#
+#   Reported repeatedly since December 2025:
+#     #13371, #28784, #29491, #20085, #37621, and #59498 (May 2026).
+#
+#   This hook enforces deny rules at the component level: it splits
+#   compound commands and blocks if ANY component matches the deny list.
+#
+#   Operator-side fix while the upstream issue remains unresolved.
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+#
+# HOW IT WORKS:
+#   1. Splits command on &&, ||, ;
+#   2. Strips leading cd <path> tokens from each component
+#   3. Checks each remaining component against the deny patterns
+#   4. If ANY component matches any pattern → exit 2 (block)
+#   5. Otherwise → exit 0 (no opinion, defer to next hook)
+#
+# CONFIGURATION:
+#   Default patterns cover the most common irreversible operations.
+#   To add patterns, edit DEFAULT_DENY array below or read from a config file.
+#
+# WHAT THIS HOOK DOES NOT DO:
+#   - Replace settings.json deny rules — it complements them by catching
+#     the cd-prefixed compound bypass that settings.json misses.
+#   - Block all compound commands — only those where a component matches
+#     the deny list.
+#   - Approve safe commands — that is compound-command-approver.sh's job.
+#
+# RELATED:
+#   - compound-command-approver.sh (auto-approves safe compound chains)
+#   - banned-command-guard.sh (blocks single banned commands)
+#   - GitHub issues #13371, #28784, #29491, #20085, #37621, #59498
+# ================================================================
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-compound-command-deny-enforcer-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [compound-command-deny-enforcer]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null || echo "")
+
+[ -z "$COMMAND" ] && exit 0
+
+# Default deny patterns — irreversible operations the operator should
+# always be prompted about, even when reached via cd-prefixed compound.
+# Each entry is a POSIX ERE matched against each component after cd-stripping.
+DEFAULT_DENY=(
+    'git[[:space:]]+push([[:space:]]|$)'
+    'git[[:space:]]+reset[[:space:]]+--hard'
+    'git[[:space:]]+clean[[:space:]]+-[a-z]*f'
+    'git[[:space:]]+filter-(repo|branch)'
+    'rm[[:space:]]+-[a-z]*r[a-z]*f'
+    'dd[[:space:]]+if=.*of='
+    'mkfs(\.|[[:space:]])'
+    '>[[:space:]]*/dev/sd[a-z]'
+)
+
+# The rm rule above matches `rm -rf <anything>`, so it also denied the most
+# ordinary cleanup a developer types: `rm -rf node_modules`, `rm -rf dist`,
+# `rm -rf build`, `rm -rf .next`. Measured 2026-08-10: all four exited 2 here,
+# while rm-safety-net and auto-mode-safety-enforcer let the same commands
+# through. A guard that blocks `rm -rf node_modules` does not get tightened by
+# the user — it gets removed, and the cd-prefixed bypass this hook exists for
+# comes back with it.
+#
+# --- why there is no mention-vs-invocation gate here --------------------------
+# auto-mode-safety-enforcer got one in PR #1009 and it works there. It was tried
+# here too and had to be taken out: this hook's deny patterns cover far more than
+# a list of destructive verbs can express, so a gate built from such a list let
+# real things through. CI caught two on 2026-08-11 -- a git subcommand that was
+# not on the list, and a redirect writing to a device. A gate that cannot name
+# everything the hook judges does not narrow the guard, it loosens it.
+#
+# The cost of not having one is a false positive: naming a dangerous command
+# inside quotes (a commit message, an echo into a note) is blocked here. That is
+# recorded in tests/quoted-safe-targets-and-mentions.test.sh as current
+# behaviour. Fixing it means driving the gate off the deny patterns themselves,
+# not off a verb list.
+
+# The safe-target list and the match form are taken verbatim from
+# rm-safety-net.sh rather than invented here, so the two hooks cannot drift
+# into disagreeing about what "safe" means.
+SAFE_RM_TARGETS="node_modules|dist|build|__pycache__|\.cache|\.pytest_cache|coverage|\.nyc_output|\.next|\.nuxt|tmp|temp"
+
+# Returns 0 only when the component is an rm whose operands are ALL safe.
+# Every operand is inspected, not just the last one: rm-safety-net documents
+# that checking only `awk '{print $NF}'` lets `rm -rf /home/user/data node_modules`
+# pass on its safe last argument. Path traversal disqualifies the whole
+# component, and an rm with no operand at all is never treated as safe.
+rm_targets_all_safe() {
+    local comp="$1" arg seen=0
+    case "$comp" in *'..'*) return 1 ;; esac
+    set -f
+    for arg in $(echo "$comp" | sed -E 's/^[[:space:]]*(sudo[[:space:]]+)?rm[[:space:]]+//'); do
+        case "$arg" in
+            -*) continue ;;                       # flags
+        esac
+        seen=1
+        # Quotes are dropped before the comparison. The safe list is a list of
+        # names, and a name written as "node_modules" is the same name. Without
+        # this, every quoted cleanup fell through to the deny patterns.
+        # Measured 2026-08-11: four ordinary quoted cleanups were blocked.
+        if ! printf '%s' "$arg" | tr -d "\"'" | grep -qE "^(\./)?(${SAFE_RM_TARGETS})/?$"; then
+            set +f
+            return 1
+        fi
+    done
+    set +f
+    [ "$seen" -eq 1 ]
+}
+
+# Split on &&, ||, ;
+SPLIT=$(echo "$COMMAND" | sed -E 's/(&&|\|\||;)/\n/g')
+
+# Strip leading "cd <path>" from a component
+strip_cd() {
+    echo "$1" | sed -E 's/^[[:space:]]*cd[[:space:]]+([^[:space:]&|;]+|"[^"]*"|'\''[^'\'']*'\'')[[:space:]]*//'
+}
+
+# Iterate components and check each against deny patterns.
+# Use a here-string + for loop so exit 2 propagates (subshell pipe loses it).
+EXIT_CODE=0
+while IFS= read -r component; do
+    [ -z "$component" ] && continue
+
+    stripped=$(strip_cd "$component")
+    [ -z "$stripped" ] && continue
+
+    for pattern in "${DEFAULT_DENY[@]}"; do
+        if echo "$stripped" | grep -qE "$pattern"; then
+            # Only the rm rule has a safe-target exemption. The other rules
+            # (git push, reset --hard, dd, mkfs, …) have no benign form that
+            # this hook should silently allow.
+            if [ "$pattern" = 'rm[[:space:]]+-[a-z]*r[a-z]*f' ] && rm_targets_all_safe "$stripped"; then
+                continue
+            fi
+            cat >&2 <<EOF
+BLOCKED: Compound-command deny enforcer matched a denied operation.
+
+Full command:  $COMMAND
+Component:     $stripped
+Matched rule:  $pattern
+
+This hook catches the cd-prefixed compound bypass documented in
+https://github.com/anthropics/claude-code/issues/59498 (and historical
+#13371, #28784, #29491, #20085, #37621). Settings.json deny rules do
+not match cd-prefixed compounds because the harness does not strip
+cd <path> when path differs from cwd; the permission system then
+evaluates the pre-split string starting with cd and matches no rule.
+
+To unblock for one command, run the components separately:
+  cd /path
+  <denied-command>
+EOF
+            EXIT_CODE=2
+            break 2
+        fi
+    done
+done <<< "$SPLIT"
+
+exit "$EXIT_CODE"

package/examples/compound-inject-guard.sh

@@ -17,6 +17,18 @@
 # TRIGGER: PreToolUse
 # MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-compound-inject-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [compound-inject-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/concurrent-edit-lock.sh

@@ -15,6 +15,18 @@
 # TRIGGER: PreToolUse
 # MATCHER: "Edit|Write"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-concurrent-edit-lock-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [concurrent-edit-lock]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)

package/examples/conflict-marker-guard.sh

@@ -10,6 +10,18 @@
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-conflict-marker-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [conflict-marker-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 

package/examples/console-log-count.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)