cc-safe-setup 29.7.0 → 30.0.4

package/examples/deny-rule-integrity-verifier.sh

@@ -0,0 +1,181 @@
+#!/bin/bash
+# deny-rule-integrity-verifier.sh — Catch deny-rule bypasses through whitespace normalization
+#
+# Solves: Cluster 6 Axis 5 — deny rules don't enforce the safety constraints
+#         users configure. A deny pattern Bash(rm -rf:*) catches `rm -rf /`
+#         but is silently bypassed by:
+#           - extra whitespace (`rm  -rf /`)
+#           - backslash-newline line continuations (`rm \<newline>-rf /`)
+#           - tab characters in place of spaces (`rm	-rf /`)
+#         The matching engine compares the raw command string against the
+#         pattern body literally, so any whitespace anomaly slips past.
+#
+# Issues addressed: meta-issue #30519 Axis 5 (deny rules have same bugs as
+#         allow rules), #35954 (backslash-escaped whitespace warning
+#         framework), and the broader pattern that whitespace-sensitive
+#         literal matching can be defeated trivially.
+#
+# How it works: PreToolUse hook on Bash. For each Bash() deny pattern in
+#   permissions.deny across the four standard settings locations, the
+#   hook checks:
+#     1. Does the RAW command match the pattern? (the matching engine
+#        catches this case; if yes, this hook does nothing)
+#     2. Does the NORMALIZED command match the pattern? (whitespace
+#        collapsed, line continuations joined)
+#   If raw misses and normalized hits — that is the bypass. The hook
+#   blocks with exit code 2 by default; CC_DENY_INTEGRITY_WARN_ONLY=1
+#   converts the block to a stderr advisory while letting the command
+#   through.
+#
+#   Pattern extraction supports the three Claude Code Bash() shapes:
+#     Bash(<exact>)          — exact match
+#     Bash(<prefix>:*)       — prefix match (the common form)
+#     Bash(*)                — wildcard — skipped (already matches raw)
+#
+# Scope of normalization (v1):
+#   - Strip backslash-newline line continuations (`\<newline>` → ` `)
+#   - Collapse any whitespace run (spaces, tabs, newlines) to a single space
+#   - Trim leading and trailing whitespace
+#   Flag combination/reordering normalization (`-rf` vs `-r -f` vs `-fr`)
+#   is OUT OF SCOPE for v1 — those bypass shapes need command-aware logic
+#   beyond uniform string normalization and warrant a separate hook.
+#
+# Environment variables:
+#   CC_DENY_INTEGRITY_DISABLE=1   — disable verification entirely
+#   CC_DENY_INTEGRITY_WARN_ONLY=1 — log the bypass to stderr but do not block
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+
+set -uo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-deny-rule-integrity-verifier-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [deny-rule-integrity-verifier]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+[ "${CC_DENY_INTEGRITY_DISABLE:-0}" = "1" ] && exit 0
+
+# Collect Bash() deny patterns from all four standard settings locations.
+DENY_FILE=$(mktemp)
+trap 'rm -f "$DENY_FILE"' EXIT
+for CFG in \
+    "${HOME}/.claude/settings.json" \
+    "${HOME}/.claude/settings.local.json" \
+    "./.claude/settings.json" \
+    "./.claude/settings.local.json"; do
+    [ -f "$CFG" ] || continue
+    jq -r '.permissions.deny // [] | .[] | select(type == "string" and startswith("Bash("))' \
+        "$CFG" 2>/dev/null >> "$DENY_FILE" || true
+done
+
+[ ! -s "$DENY_FILE" ] && exit 0
+
+# Normalize: strip backslash-newline (line continuation), collapse all
+# whitespace to single space, trim.
+NORMALIZED=$(printf '%s' "$COMMAND" \
+    | sed -E ':a;N;$!ba;s/\\\n/ /g' \
+    | tr '\t\n' '  ' \
+    | sed -E 's/[[:space:]]+/ /g; s/^[[:space:]]+//; s/[[:space:]]+$//')
+
+# If normalization is a no-op, nothing to do — the standard matcher
+# already handles this command.
+if [ "$NORMALIZED" = "$COMMAND" ]; then
+    exit 0
+fi
+
+# Check each deny pattern.
+while IFS= read -r PATTERN; do
+    [ -z "$PATTERN" ] && continue
+
+    # Extract pattern body. Handles:
+    #   Bash(<body>)        → BODY=<body>, SUFFIX_GLOB=0
+    #   Bash(<body>:*)      → BODY=<body>, SUFFIX_GLOB=1
+    BODY=""
+    SUFFIX_GLOB=0
+    if [[ "$PATTERN" =~ ^Bash\((.+):\*\)$ ]]; then
+        BODY="${BASH_REMATCH[1]}"
+        SUFFIX_GLOB=1
+    elif [[ "$PATTERN" =~ ^Bash\((.+)\)$ ]]; then
+        BODY="${BASH_REMATCH[1]}"
+        SUFFIX_GLOB=0
+    fi
+    [ -z "$BODY" ] && continue
+
+    # Bash(*) — wildcard pattern — would match raw already.
+    [ "$BODY" = "*" ] && continue
+
+    # Match logic: a command matches the pattern if it equals BODY exactly
+    # or (when the pattern has the :* glob suffix) if it starts with BODY
+    # at a word boundary. The boundary rule:
+    #   - If BODY ends in an alphanumeric char (rm, git, curl) the next
+    #     character must be a space — otherwise `Bash(rm:*)` would block
+    #     `rmdir`.
+    #   - If BODY ends in a non-alphanumeric char (=, -, /, .) the next
+    #     character can be attached — `Bash(dd if=:*)` should match
+    #     `dd if=/dev/zero ...`.
+    raw_matches() {
+        local CMD="$1" BDY="$2" GLOB="$3"
+        if [ "$CMD" = "$BDY" ]; then
+            return 0
+        fi
+        if [ "$GLOB" = "1" ]; then
+            local LAST_CHAR="${BDY: -1}"
+            if [[ "$LAST_CHAR" =~ [a-zA-Z0-9] ]]; then
+                case "$CMD" in
+                    "$BDY "*) return 0 ;;
+                esac
+            else
+                case "$CMD" in
+                    "$BDY"*) return 0 ;;
+                esac
+            fi
+        fi
+        return 1
+    }
+
+    if raw_matches "$COMMAND" "$BODY" "$SUFFIX_GLOB"; then
+        # Standard matcher already catches this — nothing for us to do.
+        continue
+    fi
+
+    if raw_matches "$NORMALIZED" "$BODY" "$SUFFIX_GLOB"; then
+        # BYPASS DETECTED.
+        CMD_SAFE_PRINT=$(printf '%s' "$COMMAND" | head -c 300 | tr -d '\000')
+        {
+            echo "[deny-rule-integrity-verifier] Deny-rule bypass detected."
+            echo ""
+            echo "  Configured deny pattern : $PATTERN"
+            echo "  Raw command (excerpt)   : $CMD_SAFE_PRINT"
+            echo "  Normalized command      : $NORMALIZED"
+            echo ""
+            echo "The normalized form matches your configured deny pattern, but the raw"
+            echo "command bypasses literal matching through whitespace anomalies"
+            echo "(extra spaces, tab characters, or backslash-newline line continuations)."
+            echo "Cluster 6 Axis 5 — meta-issue #30519 (Claude Code permission matching)."
+        } >&2
+        if [ "${CC_DENY_INTEGRITY_WARN_ONLY:-0}" = "1" ]; then
+            echo "" >&2
+            echo "(CC_DENY_INTEGRITY_WARN_ONLY=1 is set — command will proceed)" >&2
+            exit 0
+        else
+            echo "" >&2
+            echo "Blocking. Set CC_DENY_INTEGRITY_WARN_ONLY=1 to convert this to a" >&2
+            echo "warning, or CC_DENY_INTEGRITY_DISABLE=1 to silence the hook." >&2
+            exit 2
+        fi
+    fi
+done < "$DENY_FILE"
+
+exit 0

package/examples/dependency-install-guard.sh

@@ -19,6 +19,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-dependency-install-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [dependency-install-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/deploy-guard.sh

@@ -12,13 +12,25 @@
 # {
 #   "hooks": {
 #     "PreToolUse": [{
-#       "matcher": "Bash",
+#       "matcher": "Bash|PowerShell",
 #       "hooks": [{ "type": "command", "command": "~/.claude/hooks/deploy-guard.sh" }]
 #     }]
 #   }
 # }
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-deploy-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [deploy-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

package/examples/deploy-path-verify-guard.sh

@@ -18,6 +18,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-deploy-path-verify-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [deploy-path-verify-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 

package/examples/deployment-readback-gate.sh

@@ -0,0 +1,135 @@
+#!/bin/bash
+# ================================================================
+# deployment-readback-gate.sh — Refuse a deployment-completion claim
+#                               unless an authority confirms it, recently
+# ================================================================
+# PURPOSE:
+#   Turn a "deployment complete" claim into a refusable, auditable trust
+#   artifact. This is the GENERIC decision core: it consumes a *normalized
+#   readback receipt* (produced by a provider adapter — gh deployments,
+#   Vercel, k8s, ...) and decides allow / refuse-mismatch / refuse-query-
+#   failure / refuse-stale. It contains no provider knowledge.
+#
+#   Spec: docs/deployment-readback-gate-spec.md  (issue #313)
+#   Motivating incident: anthropics/claude-code#61699 (model claimed
+#   "deployment complete" while the real deployment state diverged).
+#
+# TRIGGER: Stop
+#
+# INPUT (stdin): a normalized readback receipt JSON. Required fields:
+#   claim_span, claim_time (ISO 8601), claimed_ref, authority,
+#   queried_ref, queried_state, readback_time (ISO 8601, from the
+#   authority's own response), stale_if_older_than_ms (integer).
+#   queried_state is the authority's state ("success" = confirmed) or
+#   the literal "query-failure" when the adapter could not reach the
+#   authority.
+#
+# DECISION (and exit code):
+#   refuse-query-failure (exit 2) — authority unreachable / readback errored.
+#       FAIL CLOSED. Never coerced to allow. Distinct incident class from a
+#       mismatch: truth was never established (the claim *might* be correct).
+#   refuse-mismatch (exit 2)      — queried_ref != claimed_ref, or
+#       queried_state != "success". Truth established, claim was wrong.
+#   refuse-stale (exit 2)         — claim_time - readback_time exceeds
+#       stale_if_older_than_ms. A cached/replayed "success" must not ratify
+#       a fresh claim. Staleness is anchored to the CLAIM, not wall-clock.
+#   allow (exit 0)                — fresh AND matching AND success.
+#
+#   Missing required fields or unparseable timestamps also FAIL CLOSED
+#   (refuse-query-failure): an unauditable receipt is not a confirmation.
+#
+# WHAT IT WRITES:
+#   $CC_READBACK_RECEIPT_DIR/<timestamp>-<pid>.json   (decision filled in)
+#   default: ~/.claude/state/deployments/readback/
+#   The receipt is written OUTSIDE the transcript, so the audit unit
+#   survives a lost or rewound session.
+#
+# USAGE (settings.json):
+#   { "hooks": { "Stop": [{ "hooks": [{ "type": "command",
+#     "command": "<adapter> | ~/.claude/hooks/deployment-readback-gate.sh" }] }] } }
+#   The adapter emits the normalized receipt on stdout; this gate decides.
+# ================================================================
+
+set -uo pipefail
+
+RECEIPT_DIR="${CC_READBACK_RECEIPT_DIR:-$HOME/.claude/state/deployments/readback}"
+
+INPUT=$(cat)
+
+# This gate only acts on a normalized readback receipt produced by an adapter.
+# Empty stdin, "{}", or unrelated input means no deployment claim is being
+# gated here — pass through. Hooks must not block on irrelevant input.
+if ! printf '%s' "$INPUT" | grep -qE '"(claimed_ref|authority|queried_state|claim_span)"'; then
+  exit 0
+fi
+
+# A receipt is present; jq is required to evaluate it.
+if ! command -v jq >/dev/null 2>&1; then
+  echo "deployment-readback-gate: jq not found; cannot audit a present receipt — failing closed" >&2
+  exit 2
+fi
+
+# Extract fields (empty if absent).
+field() { printf '%s' "$INPUT" | jq -r "(.$1 // empty)" 2>/dev/null; }
+
+CLAIM_SPAN=$(field claim_span)
+CLAIM_TIME=$(field claim_time)
+CLAIMED_REF=$(field claimed_ref)
+AUTHORITY=$(field authority)
+QUERIED_REF=$(field queried_ref)
+QUERIED_STATE=$(field queried_state)
+READBACK_TIME=$(field readback_time)
+STALE_MS=$(field stale_if_older_than_ms)
+
+decision=""
+reason=""
+
+# to_ms: ISO 8601 -> epoch milliseconds, or empty on parse failure.
+to_ms() { date -d "$1" +%s%3N 2>/dev/null; }
+
+# --- fail closed on an unauditable receipt -------------------------------
+if [ -z "$AUTHORITY" ] || [ -z "$READBACK_TIME" ] || [ -z "$STALE_MS" ] \
+   || [ -z "$CLAIM_TIME" ] || [ -z "$CLAIMED_REF" ] || [ -z "$QUERIED_STATE" ]; then
+  decision="refuse-query-failure"
+  reason="receipt missing required fields (authority/readback_time/stale_if_older_than_ms/claim_time/claimed_ref/queried_state) — cannot establish truth"
+elif [ "$QUERIED_STATE" = "query-failure" ]; then
+  decision="refuse-query-failure"
+  reason="authority '$AUTHORITY' was not reached — deployment NOT confirmed (failing closed)"
+else
+  claim_ms=$(to_ms "$CLAIM_TIME")
+  read_ms=$(to_ms "$READBACK_TIME")
+  if [ -z "$claim_ms" ] || [ -z "$read_ms" ]; then
+    decision="refuse-query-failure"
+    reason="unparseable claim_time/readback_time — cannot verify freshness (failing closed)"
+  elif [ "$QUERIED_REF" != "$CLAIMED_REF" ] || [ "$QUERIED_STATE" != "success" ]; then
+    decision="refuse-mismatch"
+    reason="claim ref/state ($CLAIMED_REF/success) != authority ($QUERIED_REF/$QUERIED_STATE)"
+  elif [ $(( claim_ms - read_ms )) -gt "$STALE_MS" ]; then
+    decision="refuse-stale"
+    reason="readback is $(( claim_ms - read_ms ))ms older than the claim (> ${STALE_MS}ms) — possible replay/cache, not ratifying"
+  else
+    decision="allow"
+    reason="confirmed by $AUTHORITY: $QUERIED_REF/$QUERIED_STATE, fresh within ${STALE_MS}ms"
+  fi
+fi
+
+# --- write the receipt (audit artifact, outside the transcript) ----------
+mkdir -p "$RECEIPT_DIR" 2>/dev/null
+ts=$(date -u +%Y%m%dT%H%M%S%3NZ 2>/dev/null || date -u +%Y%m%dT%H%M%SZ)
+receipt_path="$RECEIPT_DIR/${ts}-$$.json"
+printf '%s' "$INPUT" \
+  | jq --arg d "$decision" --arg r "$reason" --arg w "$ts" \
+       '. + {decision: $d, decision_reason: $r, decided_at: $w}' \
+       > "$receipt_path" 2>/dev/null \
+  || printf '{"decision":"%s","decision_reason":"%s","raw":true}\n' "$decision" "$reason" > "$receipt_path"
+
+# --- emit decision -------------------------------------------------------
+if [ "$decision" = "allow" ]; then
+  exit 0
+fi
+
+# Stop hook: exit 2 surfaces the reason and blocks the stop so the claim
+# is corrected instead of standing.
+echo "deployment-readback-gate: $decision — $reason" >&2
+echo "  receipt: $receipt_path" >&2
+exit 2

package/examples/deployment-readback-gh-adapter.sh

@@ -0,0 +1,247 @@
+#!/bin/bash
+# ================================================================
+# deployment-readback-gh-adapter.sh — `gh` deployments provider adapter
+#                                     for deployment-readback-gate
+# ================================================================
+# PURPOSE:
+#   The PROVIDER ADAPTER half of the deployment-readback-gate (issue
+#   #313). It owns all GitHub-specific knowledge: given a Stop event,
+#   it detects a deployment-completion claim in the assistant's
+#   closeout, reads the GitHub Deployments API for the *authoritative*
+#   state of that deploy, and emits the NORMALIZED readback receipt on
+#   stdout. The generic gate (examples/deployment-readback-gate.sh)
+#   consumes that receipt and decides allow / refuse-*.
+#
+#   Spec:  docs/deployment-readback-gate-spec.md
+#   Gate:  examples/deployment-readback-gate.sh  (provider-agnostic core)
+#   Incident: anthropics/claude-code#61699 (model claimed "deployment
+#             complete" while the real deploy state diverged).
+#
+#   The adapter knows the provider; the gate knows the decision. A new
+#   authority (Vercel, Cloud Run, k8s, ...) is added by writing another
+#   adapter to this same output contract — never by touching the gate.
+#
+# TRIGGER: Stop
+#
+# INSTALL (settings.json) — adapter piped into the gate:
+#   { "hooks": { "Stop": [{ "hooks": [{ "type": "command",
+#     "command": "~/.claude/hooks/deployment-readback-gh-adapter.sh | ~/.claude/hooks/deployment-readback-gate.sh",
+#     "env": { "DRG_REPO": "owner/repo", "DRG_ENVIRONMENT": "production" } }] }] } }
+#
+# INPUT (stdin): the Stop event JSON. The adapter reads the last
+#   assistant message from `transcript_path` to find the claim. For
+#   deterministic use/testing, DRG_CLAIM_TEXT overrides the transcript.
+#
+# OUTPUT (stdout): exactly one of —
+#   * `{}`                         — no deployment claim here (or an
+#       unresolvable target in advisory mode). The gate passes through.
+#   * a normalized readback receipt — fields per the spec:
+#       claim_span, claim_time, target, claimed_ref, authority,
+#       readback_query, queried_ref, queried_state, readback_time,
+#       stale_if_older_than_ms
+#     `queried_state` is the authority's deployment-status state, or the
+#     literal "query-failure" when the API could not be reached.
+#
+# CONFIG (env):
+#   DRG_REPO            owner/repo. If unset, derived from `gh repo view`.
+#   DRG_ENVIRONMENT     deployment environment to query (default: production)
+#   DRG_CLAIMED_REF     the claimed commit/ref. If unset, parsed from the
+#                       claim text (`@<sha>` or a bare 7–40 hex token).
+#   DRG_PHRASE_LIST     comma-separated claim phrases (case-insensitive).
+#                       default: deployed,deployment complete,shipped to
+#                       production,rolled out,deploy succeeded,live in production
+#   DRG_STALE_MS        staleness window in ms (default: 300000 = 5 min)
+#   DRG_STRICT          "1" → a deployment claim with an unresolvable
+#                       target emits a query-failure receipt (gate refuses)
+#                       instead of passing through. default: advisory (0).
+#   DRG_GH_CMD          gh binary to invoke (default: gh). Overridable so
+#                       the API layer can be mocked under test.
+#
+# WHY A SEPARATE ADAPTER:
+#   readback_time must come from the AUTHORITY's own response (the
+#   deployment status `created_at`), not from when the hook ran — that
+#   is what closes the replay/cache gap the gate's staleness check
+#   depends on. Only the provider adapter can source it, so provider
+#   I/O is isolated here and the gate stays pure and deterministic.
+# ================================================================
+
+set -uo pipefail
+
+EVENT_INPUT=$(cat)
+
+# --- config --------------------------------------------------------------
+GH="${DRG_GH_CMD:-gh}"
+ENVIRONMENT="${DRG_ENVIRONMENT:-production}"
+STALE_MS="${DRG_STALE_MS:-300000}"
+STRICT="${DRG_STRICT:-0}"
+PHRASE_LIST="${DRG_PHRASE_LIST:-deployed,deployment complete,shipped to production,rolled out,deploy succeeded,live in production}"
+AUTHORITY="github_deployments_api"
+
+now_iso() { date -u +%Y-%m-%dT%H:%M:%S.%3NZ 2>/dev/null || date -u +%Y-%m-%dT%H:%M:%SZ; }
+
+# Emit a bare pass-through and leave: this Stop is not gating a deploy claim.
+pass_through() { printf '{}\n'; exit 0; }
+
+# A receipt is meaningless without jq to build it; without it we cannot
+# safely emit the contract, so pass through rather than emit malformed JSON.
+command -v jq >/dev/null 2>&1 || pass_through
+
+# --- 1. obtain the closeout text -----------------------------------------
+# DRG_CLAIM_TEXT wins (deterministic). Otherwise read the last assistant
+# message from the transcript named in the Stop event.
+CLAIM_TEXT="${DRG_CLAIM_TEXT:-}"
+if [ -z "$CLAIM_TEXT" ]; then
+  TRANSCRIPT=$(printf '%s' "$EVENT_INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+  if [ -n "$TRANSCRIPT" ] && [ -f "$TRANSCRIPT" ]; then
+    CLAIM_TEXT=$(python3 - "$TRANSCRIPT" <<'PY' 2>/dev/null || true
+import sys, json
+last = ""
+try:
+    with open(sys.argv[1]) as f:
+        for line in f:
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                d = json.loads(line)
+            except Exception:
+                continue
+            if d.get("type") != "assistant":
+                continue
+            msg = d.get("message", d)
+            content = msg.get("content", "")
+            if isinstance(content, str):
+                text = content
+            elif isinstance(content, list):
+                text = " ".join(
+                    b.get("text", "") for b in content
+                    if isinstance(b, dict) and b.get("type") == "text"
+                )
+            else:
+                text = ""
+            if text.strip():
+                last = text
+except Exception:
+    pass
+print(last)
+PY
+)
+  fi
+fi
+[ -n "$CLAIM_TEXT" ] || pass_through
+
+# --- 2. detect a (non-benign) deployment-completion claim ----------------
+# Returns the matched claim phrase/span, or empty. A phrase inside a benign
+# context ("deployed locally", "shipped to my machine", "in dev only") is
+# not a production-deployment claim and must not trip the gate.
+CLAIM_SPAN=$(CLAIM_TEXT="$CLAIM_TEXT" PHRASE_LIST="$PHRASE_LIST" python3 <<'PY' 2>/dev/null || true
+import os, re
+text = os.environ["CLAIM_TEXT"]
+low = text.lower()
+phrases = [p.strip().lower() for p in os.environ["PHRASE_LIST"].split(",") if p.strip()]
+benign = ("local", "localhost", "my machine", "in dev", "dev only",
+          "staging only", "dry run", "dry-run", "would deploy", "about to deploy",
+          "going to deploy", "preview deploy")
+best = ""
+for p in phrases:
+    for m in re.finditer(re.escape(p), low):
+        s, e = m.start(), m.end()
+        window = low[max(0, s - 50):min(len(low), e + 50)]
+        if any(b in window for b in benign):
+            continue
+        # span = the surrounding clause, trimmed, from the original-case text
+        cs = max(0, s - 30)
+        ce = min(len(text), e + 30)
+        span = text[cs:ce].strip()
+        span = re.sub(r"\s+", " ", span)
+        if span:
+            best = span[:120]
+            break
+    if best:
+        break
+print(best)
+PY
+)
+[ -n "$CLAIM_SPAN" ] || pass_through
+
+# --- 3. resolve the target (repo + claimed ref) --------------------------
+REPO="${DRG_REPO:-}"
+if [ -z "$REPO" ]; then
+  REPO=$("$GH" repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null || true)
+fi
+
+CLAIMED_REF="${DRG_CLAIMED_REF:-}"
+if [ -z "$CLAIMED_REF" ]; then
+  # `@<sha>` first (e.g. "api@abc1234"), else a bare 7–40 hex token.
+  CLAIMED_REF=$(printf '%s' "$CLAIM_SPAN" | grep -oiE '@[0-9a-f]{7,40}' | head -1 | tr -d '@')
+  [ -n "$CLAIMED_REF" ] || CLAIMED_REF=$(printf '%s' "$CLAIM_SPAN" | grep -oiE '\b[0-9a-f]{7,40}\b' | head -1)
+fi
+
+CLAIM_TIME=$(now_iso)
+READBACK_QUERY="repos/${REPO:-?}/deployments?environment=${ENVIRONMENT}&sha=${CLAIMED_REF:-?}&per_page=1 + /statuses"
+
+# emit_receipt <queried_ref> <queried_state> <readback_time> <target>
+emit_receipt() {
+  jq -n \
+    --arg cs "$CLAIM_SPAN" --arg ct "$CLAIM_TIME" --arg tg "$4" \
+    --arg cr "$CLAIMED_REF" --arg au "$AUTHORITY" --arg rq "$READBACK_QUERY" \
+    --arg qr "$1" --arg qs "$2" --arg rt "$3" \
+    --argjson sm "$STALE_MS" \
+    '{claim_span:$cs, claim_time:$ct, target:$tg, claimed_ref:$cr,
+      authority:$au, readback_query:$rq, queried_ref:$qr, queried_state:$qs,
+      readback_time:$rt, stale_if_older_than_ms:$sm}'
+}
+
+TARGET="${REPO:-?}/${ENVIRONMENT}"
+
+# A deployment claim with no resolvable target: advisory passes through,
+# strict fails closed (a named-but-unverifiable deploy is the spec's
+# "strict mode refuses any closeout with a deployment phrase but no
+# resolvable target").
+if [ -z "$REPO" ] || [ -z "$CLAIMED_REF" ]; then
+  if [ "$STRICT" = "1" ]; then
+    emit_receipt "" "query-failure" "$(now_iso)" "$TARGET"
+    exit 0
+  fi
+  pass_through
+fi
+
+# --- 4. read the authority: GitHub Deployments API -----------------------
+DEPLOYMENTS=$("$GH" api "repos/$REPO/deployments?environment=$ENVIRONMENT&sha=$CLAIMED_REF&per_page=1" 2>/dev/null)
+if [ $? -ne 0 ] || [ -z "$DEPLOYMENTS" ]; then
+  # Authority unreachable / errored → truth never established. Fail closed.
+  emit_receipt "" "query-failure" "$(now_iso)" "$TARGET"
+  exit 0
+fi
+
+DEP_ID=$(printf '%s' "$DEPLOYMENTS" | jq -r 'if type=="array" then (.[0].id // empty) else (.id // empty) end' 2>/dev/null)
+DEP_SHA=$(printf '%s' "$DEPLOYMENTS" | jq -r 'if type=="array" then (.[0].sha // empty) else (.sha // empty) end' 2>/dev/null)
+
+if [ -z "$DEP_ID" ]; then
+  # Authority reached, but it reports no deployment for this ref/env.
+  # Truth established: the claimed deploy is not on record → mismatch.
+  emit_receipt "" "not_found" "$(now_iso)" "$TARGET"
+  exit 0
+fi
+
+STATUSES=$("$GH" api "repos/$REPO/deployments/$DEP_ID/statuses?per_page=1" 2>/dev/null)
+if [ $? -ne 0 ] || [ -z "$STATUSES" ]; then
+  emit_receipt "$DEP_SHA" "query-failure" "$(now_iso)" "$TARGET"
+  exit 0
+fi
+
+STATE=$(printf '%s' "$STATUSES" | jq -r 'if type=="array" then (.[0].state // empty) else (.state // empty) end' 2>/dev/null)
+CREATED_AT=$(printf '%s' "$STATUSES" | jq -r 'if type=="array" then (.[0].created_at // empty) else (.created_at // empty) end' 2>/dev/null)
+
+if [ -z "$STATE" ]; then
+  # Deployment exists but has no status yet → not confirmed.
+  emit_receipt "$DEP_SHA" "no_status" "$(now_iso)" "$TARGET"
+  exit 0
+fi
+
+# readback_time MUST be the authority's own timestamp (the status
+# created_at), so the gate's staleness check is anchored to when the
+# authority observed the state — not to when this hook ran.
+[ -n "$CREATED_AT" ] || CREATED_AT=$(now_iso)
+emit_receipt "$DEP_SHA" "$STATE" "$CREATED_AT" "$TARGET"
+exit 0

package/examples/deployment-verify-guard.sh

@@ -16,7 +16,7 @@
 #
 # See: https://github.com/anthropics/claude-code/issues/40861
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
 #
 # Configuration:
 #   CC_DEPLOY_COMMANDS — regex pattern for deploy commands
@@ -27,11 +27,34 @@
 # ================================================================
 
 INPUT=$(cat)
+__CC_HOOK_INPUT="$INPUT"
+# --- セッション識別子でファイルを分ける (2026-08-09 修正) ---
+# 旧実装は "$$" を使っていたが、$$ はこのスクリプト自身のPIDで呼び出しごとに変わるため、
+# 状態が一度も持続しなかった(実測: 200回呼ぶとファイルが200個でき、中身は全部 1)。
+__CC_SID=""
+if [ -n "${__CC_HOOK_INPUT:-}" ]; then
+  if command -v jq >/dev/null 2>&1; then
+    __CC_SID=$(printf '%s' "$__CC_HOOK_INPUT" | jq -r '.session_id // .sessionId // empty' 2>/dev/null)
+  fi
+  if [ -z "$__CC_SID" ] && command -v python3 >/dev/null 2>&1; then
+    __CC_SID=$(printf '%s' "$__CC_HOOK_INPUT" | python3 -c 'import sys,json
+try:
+    d=json.load(sys.stdin); print(d.get("session_id") or d.get("sessionId") or "")
+except Exception: print("")' 2>/dev/null)
+  fi
+fi
+if [ -n "$__CC_SID" ]; then
+  __CC_KEY=$(printf '%s' "$__CC_SID" | tr -c 'A-Za-z0-9_-' '_' | cut -c1-64)
+else
+  __CC_KEY="nosession-$(date +%Y%m%d)"
+fi
+# --- ここまで ---
+
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
 [ -z "$COMMAND" ] && exit 0
 
-MARKER="/tmp/cc-deploy-pending-$$"
+MARKER="/tmp/cc-deploy-pending-$__CC_KEY"
 
 # Configurable deploy command patterns
 DEPLOY_PATTERN="${CC_DEPLOY_COMMANDS:-systemctl\s+restart|docker\s+restart|docker-compose\s+up|docker\s+compose\s+up|\bdeploy\b|kubectl\s+apply|terraform\s+apply|heroku\s+.*push|fly\s+deploy}"