cc-safe-setup 29.7.0 → 30.0.4

package/examples/fabricated-command-detector.sh

@@ -0,0 +1,145 @@
+#!/bin/bash
+# fabricated-command-detector.sh — Detect command-shaped tokens in the final
+# assistant response that were never invoked as Bash tool calls in the session.
+#
+# Solves: substitution-by-default at the response layer (issue #60340).
+#   In #60340, a security-research reproduction shipped with `./exploit` as
+#   the command in the assistant's writeup, while the operator's actual
+#   reproduction command (`./chage_pwn root`) was established through dozens
+#   of Bash tool calls. The model never invoked `./exploit` — it generated
+#   a plausible-looking parallel command and substituted it into the response.
+#
+# How it works: Stop hook that reads the latest assistant turn from the
+#   session transcript, extracts command-shaped tokens (./xxx, git xxx,
+#   bash xxx, etc.) from inline code spans, and cross-references each one
+#   against the Bash tool calls that actually occurred in the session.
+#   Tokens that look like commands but were never invoked are flagged as
+#   possible fabrication.
+#
+# This hook is advisory by default — it warns to stderr and exits 0.
+# It does not block the response. Set CC_FABRICATED_CMD_BLOCK=1 to make
+# unverified tokens cause a non-zero exit (use for high-stakes contexts
+# like security reproductions).
+#
+# TRIGGER: Stop
+# MATCHER: ""
+#
+# Configuration:
+#   CC_FABRICATED_CMD_DISABLE=1    Disable the hook completely.
+#   CC_FABRICATED_CMD_BLOCK=1      Exit non-zero (exit 2) when fabricated
+#                                  tokens are detected. Default: advisory.
+#   CC_FABRICATED_CMD_ALLOW=regex  Pattern of tokens to ignore (e.g. for
+#                                  hypothetical example commands). Matched
+#                                  with `grep -E` against the token text.
+#   CC_FABRICATED_CMD_MAX=20       Maximum tokens to scan per response.
+#                                  Default 20. Cap protects performance on
+#                                  very long responses.
+
+set -u
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-fabricated-command-detector-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [fabricated-command-detector]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_FABRICATED_CMD_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat)
+
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+[ -z "$TRANSCRIPT" ] && exit 0
+[ ! -r "$TRANSCRIPT" ] && exit 0
+
+# Extract the LAST assistant message text content from the transcript.
+# Transcript is jsonl: one event per line. Look for the last assistant
+# message and concatenate its text content blocks.
+LAST_ASSISTANT=$(tac "$TRANSCRIPT" 2>/dev/null | grep -m1 '"role":"assistant"' || true)
+[ -z "$LAST_ASSISTANT" ] && exit 0
+
+# Try a few schemas for the assistant text. Newer transcripts wrap content
+# as an array of typed blocks; older ones may use a flat text field.
+RESPONSE_TEXT=$(printf '%s' "$LAST_ASSISTANT" | jq -r '
+  if .message.content then
+    (.message.content | if type == "array" then map(select(.type == "text") | .text) | join("\n") else . end)
+  elif .content then
+    (.content | if type == "array" then map(select(.type == "text") | .text) | join("\n") else . end)
+  else
+    empty
+  end
+' 2>/dev/null)
+
+[ -z "$RESPONSE_TEXT" ] && exit 0
+
+# Extract command-shaped tokens from backtick inline code in the response.
+# Patterns that look like operator commands the response is asserting were
+# (or are to be) run:
+#   - ./xxx and ./xxx_yyy and ./bin/xxx (relative executables)
+#   - git <subcommand> ... (git invocations)
+#   - bash <script>, sh <script> (shell-script invocations)
+#   - npm/pnpm/yarn run <task>
+#   - python <script>, node <script>
+MAX_TOKENS="${CC_FABRICATED_CMD_MAX:-20}"
+ALLOW_PATTERN="${CC_FABRICATED_CMD_ALLOW:-}"
+
+# Extract inline code spans (backtick-fenced single-line content)
+TOKENS=$(printf '%s\n' "$RESPONSE_TEXT" \
+  | grep -oE '`[^`]+`' 2>/dev/null \
+  | sed -e 's/^`//' -e 's/`$//' \
+  | grep -E '^(\./|git[[:space:]]+[a-z]+|bash[[:space:]]+[^[:space:]]|sh[[:space:]]+[^[:space:]]|npm[[:space:]]+run|pnpm[[:space:]]+run|yarn[[:space:]]+run|python[[:space:]]+[^[:space:]]+\.py|node[[:space:]]+[^[:space:]]+\.[mc]?js)' 2>/dev/null \
+  | sort -u \
+  | head -n "$MAX_TOKENS")
+
+[ -z "$TOKENS" ] && exit 0
+
+# Apply ALLOW filter if set
+if [ -n "$ALLOW_PATTERN" ]; then
+  TOKENS=$(printf '%s\n' "$TOKENS" | grep -Ev "$ALLOW_PATTERN" 2>/dev/null || true)
+fi
+
+[ -z "$TOKENS" ] && exit 0
+
+# Extract all Bash tool-call commands from the entire transcript.
+# Look at tool_use events with name=Bash and pull their command input.
+INVOKED_COMMANDS=$(grep -h '"name":"Bash"' "$TRANSCRIPT" 2>/dev/null \
+  | jq -r '
+    if .message.content then
+      (.message.content[]? | select(.type == "tool_use" and .name == "Bash") | .input.command // empty)
+    elif .content then
+      (.content[]? | select(.type == "tool_use" and .name == "Bash") | .input.command // empty)
+    else empty end
+  ' 2>/dev/null)
+
+# Compare each candidate token against the invoked commands.
+# A token is "verified" if its command-shaped form appears as a substring
+# of any invoked command (matches the literal sequence the operator ran).
+UNVERIFIED=""
+while IFS= read -r token; do
+  [ -z "$token" ] && continue
+  # Escape token for fixed-string match
+  if ! printf '%s' "$INVOKED_COMMANDS" | grep -Fq -- "$token" 2>/dev/null; then
+    UNVERIFIED="${UNVERIFIED}${UNVERIFIED:+$'\n'}${token}"
+  fi
+done <<< "$TOKENS"
+
+[ -z "$UNVERIFIED" ] && exit 0
+
+# Emit advisory listing unverified tokens.
+echo "⚠ fabricated-command-detector: command-shaped tokens in the response were not invoked as Bash tool calls in this session:" >&2
+printf '%s\n' "$UNVERIFIED" | while IFS= read -r line; do
+  [ -n "$line" ] && echo "  - $line" >&2
+done
+echo "  Verify each token before relying on the response as an operational record." >&2
+echo "  See issue #60340 for the failure shape (substitution-by-default at the response layer)." >&2
+
+if [ "${CC_FABRICATED_CMD_BLOCK:-0}" = "1" ]; then
+  exit 2
+fi
+
+exit 0

package/examples/false-disk-full-guard.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+# false-disk-full-guard.sh — flag the #65880 false "temp filesystem is full" / ENOSPC report
+#
+# Why: Claude Code's Bash tool substitutes
+#        "Command output was lost: the temp filesystem at <dir> is full (0MB free).
+#         The child process's stdout/stderr writes failed with ENOSPC."
+#      into stdout for ANY command with empty stdout AND a non-zero exit code — e.g.
+#      `false`, a no-match `grep`, a failed `test -e`, `cmd 2>/dev/null` that exits
+#      non-zero — even when the filesystem has terabytes free (anthropics/claude-code
+#      #65880, reproduced on 2.1.150-2.1.160).
+#
+#      The danger is not cosmetic: the fabricated string is presented to the model AS
+#      the command's output, so the model can conclude the disk is full and run
+#      destructive cleanup (rm, git prune, docker prune) to "free space" that was never
+#      occupied. This hook verifies the claim against real `df` and, when the disk
+#      actually has room, tells the model it is the false-positive so it does NOT act
+#      destructively.
+#
+# Event: PostToolUse   MATCHER: "*"
+# Action: advisory only (stderr), never blocks, fails open.
+#
+# The registration was missing from this header. The installer reads TRIGGER
+# and MATCHER from here and falls back to PreToolUse / Bash when both are
+# absent, so this hook was being registered at a moment where the field it
+# reads is always empty: it installed, it appeared in the settings, and it
+# did nothing. Measured 2026-08-04 across examples/: 14 files were like this.
+# TRIGGER: PostToolUse
+# MATCHER: ""
+
+set -u
+
+IN=$(cat)
+
+# tool_response may be a plain string or an object; try the common shapes.
+RESP=$(printf '%s' "$IN" | jq -r '
+  if (.tool_response | type) == "string" then .tool_response
+  else (.tool_response.stdout // .tool_response.stderr // .tool_response.output // .tool_response.content // .tool_result // empty)
+  end' 2>/dev/null)
+# Fallback: scan the whole payload if structured extraction found nothing.
+[ -z "$RESP" ] && RESP="$IN"
+
+# Signature of the #65880 fabricated report.
+printf '%s' "$RESP" | grep -qiE 'temp filesystem at .* is full \(0+ ?MB free\)|writes failed with ENOSPC' || exit 0
+
+# Which directory did the message blame? Fall back to TMPDIR / /tmp.
+DIR=$(printf '%s' "$RESP" | grep -oE 'temp filesystem at [^ ]+' | head -1 | sed 's/^temp filesystem at //')
+[ -z "$DIR" ] && DIR="${TMPDIR:-/tmp}"
+# The named session dir may already be gone; climb to an existing ancestor.
+while [ -n "$DIR" ] && [ "$DIR" != "/" ] && [ ! -d "$DIR" ]; do DIR=$(dirname "$DIR"); done
+
+AVAIL_KB=$(df -Pk "$DIR" 2>/dev/null | awk 'NR==2{print $4}')
+# Can't verify → fail open, stay silent (don't second-guess a possibly-real ENOSPC).
+case "$AVAIL_KB" in ''|*[!0-9]*) exit 0;; esac
+
+# Only contradict the message when the disk genuinely has room (>100 MB).
+if [ "$AVAIL_KB" -gt 102400 ]; then
+  AVAIL_H=$(df -Ph "$DIR" 2>/dev/null | awk 'NR==2{print $4}')
+  echo "⚠ false-disk-full-guard: the 'temp filesystem is full / ENOSPC' message above is very likely the #65880 false-positive, NOT a real disk-full." >&2
+  echo "  Verified free space on ${DIR}: ${AVAIL_H:-plenty}. Claude Code substitutes that message for ANY empty-stdout + non-zero-exit command (a no-match grep, a failed test, \`false\`)." >&2
+  echo "  Do NOT run rm / prune / cleanup to 'free space' — the disk is fine. The real result was: empty output, non-zero exit. Re-run as '<cmd>; echo \"[exit \$?]\"' to recover the true exit code." >&2
+fi
+
+exit 0

package/examples/feature-deprecation-detector.sh

@@ -0,0 +1,109 @@
+#!/bin/sh
+# feature-deprecation-detector.sh — Detect Claude Code feature deprecations from tool output.
+#
+# Background:
+#   On 2026-04-09 the `/buddy` companion was removed in v2.1.97 without changelog mention.
+#   Issue #45596 ("Bring Back Buddy") accumulated 1,987 reactions, the second-largest
+#   single feature request in anthropics/claude-code history. The structural failure pattern:
+#   silent removal, no opt-in deprecation, no migration guidance.
+#
+#   This hook detects when a previously-working slash command, skill, or capability
+#   suddenly returns "Unknown skill: X" or similar deprecation signals, and surfaces
+#   the deprecation context to the operator before they spend time troubleshooting
+#   what is actually a removed feature.
+#
+# Trigger: PostToolUse (advisory, exit 0)
+# Detection axes:
+#   1. "Unknown skill: <name>" pattern in tool output → likely deprecated slash command
+#   2. "Command not found: /<name>" pattern → likely removed CLI command
+#   3. "Skill <name> is deprecated" pattern → explicit deprecation notice
+#   4. "This feature has been removed" pattern → explicit removal notice
+#
+# When detected, the hook outputs a NOTICE pointing to:
+#   - The Claude Code release notes (where deprecations should be documented)
+#   - The cc-safe-setup cluster tracker (community-tracked deprecation patterns)
+#   - The relevant GitHub issue cluster if known (e.g. #45596 for /buddy)
+#
+# Environment variables:
+#   CC_DEPRECATION_QUIET=1  → suppress all output (default 0)
+#   CC_DEPRECATION_KNOWN_REMOVALS=/path → custom known-removal list (one slash command per line)
+
+set -eu
+
+INPUT=$(cat)
+
+# Extract tool output (stderr or stdout). PostToolUse provides tool_response.output.
+TOOL_OUTPUT=$(printf '%s' "$INPUT" | jq -r '.tool_response.output // .tool_response.content // empty' 2>/dev/null || true)
+[ -z "$TOOL_OUTPUT" ] && exit 0
+
+# Skip if quiet mode requested
+QUIET="${CC_DEPRECATION_QUIET:-0}"
+if [ "$QUIET" = "1" ]; then
+    exit 0
+fi
+
+# Built-in known removals (slash commands or features that have been silently removed)
+# Format: "command|release|context|reference"
+KNOWN_REMOVALS_BUILTIN='
+/buddy|v2.1.97 (2026-04-09)|Companion feature removed without changelog mention|https://github.com/anthropics/claude-code/issues/45596
+'
+
+# Allow custom known-removal list via environment
+CUSTOM_LIST="${CC_DEPRECATION_KNOWN_REMOVALS:-}"
+if [ -n "$CUSTOM_LIST" ] && [ -f "$CUSTOM_LIST" ]; then
+    KNOWN_REMOVALS_BUILTIN="${KNOWN_REMOVALS_BUILTIN}$(printf '\n')$(cat "$CUSTOM_LIST")"
+fi
+
+# Detection axis 1: "Unknown skill: X" → check against known removals
+detected_command=""
+detected_context=""
+detected_reference=""
+
+# Pattern 1: Unknown skill / Unknown command
+if printf '%s' "$TOOL_OUTPUT" | grep -qE 'Unknown skill:|Unknown command:|Command not found:'; then
+    # Extract the command name
+    skill_name=$(printf '%s' "$TOOL_OUTPUT" | grep -oE '(Unknown skill: [a-zA-Z0-9_-]+|Unknown command: /[a-zA-Z0-9_-]+|Command not found: /[a-zA-Z0-9_-]+)' | head -1 | sed -E 's/.*[: /]//')
+
+    if [ -n "$skill_name" ]; then
+        # Check known removals
+        cmd_key="/${skill_name}"
+        line=$(printf '%s' "$KNOWN_REMOVALS_BUILTIN" | grep -F "${cmd_key}|" | head -1)
+        if [ -n "$line" ]; then
+            detected_command="$cmd_key"
+            detected_context=$(printf '%s' "$line" | cut -d'|' -f3)
+            detected_reference=$(printf '%s' "$line" | cut -d'|' -f4)
+            release_info=$(printf '%s' "$line" | cut -d'|' -f2)
+
+            cat >&2 <<EOF
+NOTICE: \`${detected_command}\` appears to have been removed from Claude Code.
+  Release: ${release_info}
+  Context: ${detected_context}
+  Reference: ${detected_reference}
+  Cluster tracking: https://github.com/yurukusa/cc-safe-setup (deprecation pattern monitoring)
+EOF
+            exit 0
+        fi
+
+        # Unknown command but not in known list — still surface it as a possible deprecation
+        cat >&2 <<EOF
+NOTICE: Skill or command \`${skill_name}\` not recognized.
+  If this previously worked, it may have been deprecated without changelog notice.
+  Check release notes: https://docs.anthropic.com/en/release-notes/claude-code
+  Report or check existing reports: https://github.com/anthropics/claude-code/issues?q=${skill_name}
+EOF
+        exit 0
+    fi
+fi
+
+# Pattern 2: Explicit deprecation notice
+if printf '%s' "$TOOL_OUTPUT" | grep -qiE 'is deprecated|has been deprecated|has been removed|feature has been removed'; then
+    matched_line=$(printf '%s' "$TOOL_OUTPUT" | grep -iE 'is deprecated|has been deprecated|has been removed|feature has been removed' | head -1)
+    cat >&2 <<EOF
+NOTICE: Deprecation signal detected in tool output:
+  > ${matched_line}
+  Check release notes for migration guidance: https://docs.anthropic.com/en/release-notes/claude-code
+EOF
+    exit 0
+fi
+
+exit 0

package/examples/file-change-tracker.sh

@@ -24,7 +24,7 @@
 #
 # View changes: cat ~/.claude/session-changes.log
 #
-# TRIGGER: PreToolUse  MATCHER: "Edit|Write"
+# TRIGGER: PostToolUse  MATCHER: "Write"
 
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)

package/examples/file-edit-backup.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
-# file-edit-backup.sh — Auto-backup files before Edit/Write overwrites them
+# file-edit-backup.sh — Auto-backup files before they are overwritten
 #
 # Solves: Claude Code overwrites important files and the changes are hard
-#         to reverse. This creates a timestamped backup before each edit,
+#         to reverse. This creates a timestamped backup before each write,
 #         so you can always recover the previous version.
 #
 # Real incidents:
@@ -13,26 +13,75 @@
 # Backups go to ~/.claude/file-backups/ with timestamps.
 # Old backups (>7 days) are auto-cleaned to prevent disk bloat.
 #
-# TRIGGER: PreToolUse  MATCHER: "Edit|Write"
+# Covers BOTH paths by which a file gets overwritten:
+#   1. The Edit / Write tools       -> tool_input.file_path
+#   2. Shell commands run via Bash  -> redirection (> >>), tee, mv
+#
+# Path 2 was reported by a reader (2026-07-17) as the biggest hole in this
+# hook: an agent writing through Bash has the same destructive power as
+# Write, but used to slip past this backup entirely. Extraction below is
+# deliberately generous — a spurious backup costs one file copy, a missed
+# one costs the file.
+#
+# TRIGGER: PreToolUse  MATCHER: "Edit|Write|Bash"
 
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
-FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
-
-[ -z "$FILE" ] && exit 0
-[ ! -f "$FILE" ] && exit 0  # New file, nothing to backup
 
 BACKUP_DIR="$HOME/.claude/file-backups"
-mkdir -p "$BACKUP_DIR"
 
-# Create backup with timestamp
-TIMESTAMP=$(date +%Y%m%d-%H%M%S)
-SAFE_NAME=$(echo "$FILE" | tr '/' '_' | sed 's/^_//')
-BACKUP_PATH="${BACKUP_DIR}/${SAFE_NAME}.${TIMESTAMP}"
+backup_one() {
+    local target="$1"
+    [ -z "$target" ] && return 0
+    # Strip quotes left over from the command line
+    target="${target%\"}"; target="${target#\"}"
+    target="${target%\'}"; target="${target#\'}"
+    case "$target" in
+        /dev/*|/proc/*|/sys/*) return 0 ;;   # not real files
+        "~"/*) target="$HOME/${target#\~/}" ;;
+    esac
+    [ ! -f "$target" ] && return 0           # new file, nothing to lose
+    [ -L "$target" ] && return 0             # don't follow symlinks
+    mkdir -p "$BACKUP_DIR" 2>/dev/null
+    local stamp safe
+    stamp=$(date +%Y%m%d-%H%M%S)
+    safe=$(printf '%s' "$target" | tr '/' '_' | sed 's/^_//')
+    # `--` matters: an extracted path starting with "-" would otherwise be
+    # read by cp as an option (e.g. a file literally named "-r").
+    cp -- "$target" "${BACKUP_DIR}/${safe}.${stamp}" 2>/dev/null
+}
+
+if [ "$TOOL" = "Bash" ]; then
+    COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+    [ -z "$COMMAND" ] && exit 0
+
+    # 1. Redirection: > file and >> file.
+    #    The [^&] guard keeps ">&2" and "2>&1" from being read as filenames.
+    while read -r hit; do
+        [ -n "$hit" ] && backup_one "$hit"
+    done < <(printf '%s' "$COMMAND" \
+        | grep -oE '>>?[[:space:]]*[^&|;[:space:]]+' \
+        | sed -E 's/^>>?[[:space:]]*//')
+
+    # 2. tee (with or without -a) — the operand is a destination
+    while read -r hit; do
+        [ -n "$hit" ] && backup_one "$hit"
+    done < <(printf '%s' "$COMMAND" \
+        | grep -oE '\btee[[:space:]]+(-a[[:space:]]+)?[^|;&[:space:]]+' \
+        | sed -E 's/^tee[[:space:]]+(-a[[:space:]]+)?//')
 
-cp "$FILE" "$BACKUP_PATH" 2>/dev/null
+    # 3. mv — the destination is overwritten silently when it already exists
+    while read -r hit; do
+        [ -n "$hit" ] && backup_one "$hit"
+    done < <(printf '%s' "$COMMAND" \
+        | grep -oE '\bmv[[:space:]]+(-[a-zA-Z]+[[:space:]]+)*[^|;&[:space:]]+[[:space:]]+[^|;&[:space:]]+' \
+        | awk '{print $NF}')
+else
+    FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+    backup_one "$FILE"
+fi
 
 # Clean old backups (>7 days)
-find "$BACKUP_DIR" -type f -mtime +7 -delete 2>/dev/null
+[ -d "$BACKUP_DIR" ] && find "$BACKUP_DIR" -type f -mtime +7 -delete 2>/dev/null
 
 exit 0

package/examples/file-size-limit.sh

@@ -1,6 +1,18 @@
 #!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-file-size-limit-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [file-size-limit]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 CONTENT=$(echo "$INPUT" | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)

package/examples/financial-operation-guard.sh

@@ -15,6 +15,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-financial-operation-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [financial-operation-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0

package/examples/firewall-guard.sh

@@ -19,6 +19,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-firewall-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [firewall-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/fish-shell-wrapper.sh

@@ -11,6 +11,29 @@
 # MATCHER: "Bash"
 #
 # See: https://github.com/anthropics/claude-code/issues/7490
+#
+# Fixed 2026-08-03. This hook returned `permissionDecision: "allow"` on every
+# command it wrapped — which is nearly every command, since the skip list held
+# ten builtins. The approval was never a judgement about the command. It was the
+# carrier for `updatedInput`, and the rewrite came with a signature attached.
+#
+# Measured against the shipped copy, over 20 destructive or credential-reading
+# commands with no separator in them at all: **18 were approved**, including
+# `sudo rm -rf`, `dd if=/dev/zero of=/dev/sda`, `mkfs.ext4`, `curl … | sh` and
+# `git push --force`. This is a different defect from the first-command-position
+# one fixed in #937/#940/#941/#942/#943/#947 — nothing here was being missed
+# past a separator. The hook simply approved whatever it wrapped.
+#
+# Now the approval and the rewrite are separated:
+#   - the command is rewritten for fish either way, because that is the job
+#   - `permissionDecision: "allow"` is emitted only when every command position
+#     qualifies on its own
+#
+# Whether `updatedInput` alone (with no decision) is honoured is not documented,
+# and is deliberately not relied on here: if it is, an unqualified command gets
+# wrapped and still goes through the normal permission prompt; if it is not, the
+# command is not wrapped and goes through the normal permission prompt. Both
+# branches end at the prompt, which is the point.
 # ================================================================
 
 INPUT=$(cat)
@@ -23,15 +46,110 @@ echo "$COMMAND" | grep -q '^fish -c' && exit 0
 # Skip simple builtins that work identically in any shell
 echo "$COMMAND" | grep -qE '^\s*(cd|echo|cat|ls|pwd|true|false|test|mkdir|touch|rm|cp|mv)\b' && exit 0
 
+# ---------------------------------------------------------------- qualifying
+# Command words that carry no destructive form of their own. `git` and the
+# interpreters are handled below, because for those the word says nothing.
+cc_base_ok() {
+    case "$1" in
+        cat|head|tail|less|more|wc|file|stat|du|df|ls|tree|\
+        which|whereis|type|realpath|readlink|basename|dirname|\
+        grep|rg|ag|ack|sort|uniq|tr|cut|column|nl|rev|\
+        echo|printf|true|false|pwd|date|uname|hostname|whoami|id|\
+        jq|yq|cd|\
+        tsc|eslint|prettier|jest|vitest|pytest)
+            return 0 ;;
+    esac
+    return 1
+}
+
+cc_segment_base() {
+    printf '%s' "$1" \
+        | sed -E 's/^[[:space:]]+//; s/^([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+)*//' \
+        | awk '{print $1}' \
+        | sed 's|.*/||'
+}
+
+# Build tool subcommands that neither destroy history nor run fetched code.
+# One line on purpose: inside single quotes a trailing backslash is a literal
+# backslash-newline, not a continuation, and the pattern silently stops matching.
+CC_SUBCMD_RE='^[[:space:]]*(git[[:space:]]+(status|log|diff|show|add|commit|branch|remote|describe|rev-parse|blame|shortlog|ls-files|ls-tree|fetch|stash[[:space:]]+(list|push|save))|npm[[:space:]]+(test|run|ci|ls|view|outdated)|yarn[[:space:]]+(test|run|info|why)|pnpm[[:space:]]+(test|run|list|why)|bun[[:space:]]+(test|run)|cargo[[:space:]]+(build|test|check|fmt|clippy|tree)|go[[:space:]]+(build|test|vet|fmt|list)|docker[[:space:]]+(ps|images|logs|inspect|version|info)|make[[:space:]]+[A-Za-z0-9_.-]+|pip[[:space:]]+(list|show|freeze)|python3[[:space:]]+-m[[:space:]]+(pytest|unittest|pip[[:space:]]+(list|show|freeze)))([[:space:]]|$)'
+
+# `git branch` reads; `git branch -D main` deletes one. Same first two words.
+CC_GIT_DESTRUCTIVE_RE='^[[:space:]]*git[[:space:]]+(branch|tag)[[:space:]]+-([dDmM]|-delete|-move)([[:space:]]|$)'
+
+cc_segment_ok() {
+    local seg="$1" base
+    base=$(cc_segment_base "$seg")
+    [ -z "$base" ] && return 1
+
+    # find reads only while no predicate acts on what it finds
+    if [ "$base" = "find" ]; then
+        printf '%s' "$seg" \
+            | grep -qE '(^|[[:space:]])-(delete|exec|execdir|ok|okdir|fprintf?|fls|fprint0)([[:space:]]|$)' \
+            && return 1
+        return 0
+    fi
+
+    # sed rewrites the file in place with -i
+    if [ "$base" = "sed" ]; then
+        printf '%s' "$seg" | grep -qE '(^|[[:space:]])-[a-zA-Z]*i' && return 1
+        return 0
+    fi
+    [ "$base" = "awk" ] && return 0
+
+    cc_base_ok "$base" && return 0
+
+    printf '%s' "$seg" | grep -qE "$CC_GIT_DESTRUCTIVE_RE" && return 1
+    printf '%s' "$seg" | grep -qE "$CC_SUBCMD_RE" && return 0
+
+    return 1
+}
+
+QUALIFIES=1
+
+# A substitution or a backtick carries a command no string-level read can see.
+case "$COMMAND" in
+    *'$('*|*'`'*) QUALIFIES=0 ;;
+esac
+# A redirection writes.
+case "$COMMAND" in
+    *'>'*) QUALIFIES=0 ;;
+esac
+
+if [ "$QUALIFIES" -eq 1 ]; then
+    IDX=0
+    while IFS= read -r SEG; do
+        SEG="${SEG#"${SEG%%[![:space:]]*}"}"
+        SEG="${SEG%"${SEG##*[![:space:]]}"}"
+        [ -z "$SEG" ] && continue
+        if ! cc_segment_ok "$SEG"; then QUALIFIES=0; break; fi
+        IDX=$((IDX + 1))
+    done <<EOF
+$(printf '%s' "$COMMAND" | tr ';&|' '\n\n\n')
+EOF
+    [ "$IDX" -eq 0 ] && QUALIFIES=0
+fi
+
+# ---------------------------------------------------------------- rewrite
 # Escape single quotes for fish -c '...'
 ESCAPED=$(printf '%s' "$COMMAND" | sed "s/'/'\\\\''/g")
 
-jq -n --arg cmd "fish -c '$ESCAPED'" '{
-  hookSpecificOutput: {
-    hookEventName: "PreToolUse",
-    permissionDecision: "allow",
-    updatedInput: { command: $cmd }
-  }
-}'
+if [ "$QUALIFIES" -eq 1 ]; then
+    jq -n --arg cmd "fish -c '$ESCAPED'" '{
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "allow",
+        updatedInput: { command: $cmd }
+      }
+    }'
+else
+    # rewrite without signing off on it
+    jq -n --arg cmd "fish -c '$ESCAPED'" '{
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        updatedInput: { command: $cmd }
+      }
+    }'
+fi
 
 exit 0

package/examples/five-hundred-milestone.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: Notification  MATCHER: ""
 INPUT=$(cat)