cc-safe-setup 29.7.0 → 30.0.4

package/examples/flask-static-route-guard.sh

@@ -0,0 +1,89 @@
+#!/bin/bash
+# ================================================================
+# flask-static-route-guard.sh — Warn when a catch-all static
+# route would expose .env / .git / source / db files to the web
+#
+# Solves: Claude routinely recommends a Flask catch-all static
+# route that serves the application's own directory, so anyone can
+# request /.env, /.git/config, /app.py, /data.db over the public
+# web and receive secrets, source, and databases. Reported in
+# anthropics/claude-code#65517.
+#
+# The dangerous shape (all three together):
+#   1. a catch-all route capturing an arbitrary path  (<path:...>)
+#   2. a send_from_directory()/send_file() call
+#   3. serving from the app/module dir or cwd  (dirname(__file__),
+#      os.getcwd(), '.') with no static-subdir scoping and no
+#      dotfile guard
+#
+# This is a WARNING, not a block — Claude can still write the code,
+# but the operator (and Claude) see the exposure and the fix before
+# it ships. Heuristic by design; it stays quiet when a mitigation
+# (a dedicated static/ subdir, secure_filename, or an explicit
+# dotfile/.env rejection) is present.
+#
+# Usage: Add to settings.json as a PreToolUse hook
+#
+# {
+#   "hooks": {
+#     "PreToolUse": [{
+#       "matcher": "Edit|Write",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/flask-static-route-guard.sh" }]
+#     }]
+#   }
+# }
+# ================================================================
+#
+# TRIGGER: PreToolUse  MATCHER: "Edit|Write"
+
+INPUT=$(cat)
+
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+case "$TOOL" in
+  Write|Edit|MultiEdit) ;;
+  *) exit 0 ;;
+esac
+
+FILE=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+# Only Python files can host a Flask route. Skip anything else.
+case "$FILE" in
+  *.py) ;;
+  "" ) ;;          # some Edit payloads omit file_path; still scan content
+  *) exit 0 ;;
+esac
+
+# Content of the write: Write uses .content, Edit uses .new_string.
+CONTENT=$(printf '%s' "$INPUT" | jq -r '.tool_input.content // .tool_input.new_string // empty' 2>/dev/null)
+[[ -z "$CONTENT" ]] && exit 0
+
+# 1. catch-all path capture (Flask's <path:...> converter)
+echo "$CONTENT" | grep -qE '<path:[A-Za-z_][A-Za-z0-9_]*>' || exit 0
+
+# 2. a file-serving call
+echo "$CONTENT" | grep -qE 'send_from_directory\(|send_file\(' || exit 0
+
+# 3. served base is the app dir or cwd (the exposure), not a scoped subdir
+echo "$CONTENT" | grep -qE "dirname\(__file__\)|abspath\(__file__\)|os\.getcwd\(\)|send_from_directory\([[:space:]]*['\"]\.?['\"]" || exit 0
+
+# Suppress when a clear mitigation is present:
+#  - serving from a dedicated static/templates/public/assets subdir
+#  - secure_filename() sanitisation
+#  - an explicit rejection of dotfiles / .env
+if echo "$CONTENT" | grep -qE "secure_filename\(|send_from_directory\(.*['\"](static|templates|public|assets|dist|build)['\"]|os\.path\.join\(.*['\"](static|templates|public|assets|dist|build)['\"]"; then
+  exit 0
+fi
+if echo "$CONTENT" | grep -qE "startswith\(['\"]\.['\"]\)|['\"]\.env['\"]|['\"]\.git['\"]|\babort\(40[34]\)" ; then
+  # The code already reasons about dotfiles / blocks paths — assume guarded.
+  exit 0
+fi
+
+echo "WARNING: This Flask catch-all route serves the app's own directory to the web." >&2
+echo "Anyone can request /.env, /.git/config, /*.py, or /*.db and receive secrets," >&2
+echo "source code, and databases (anthropics/claude-code#65517)." >&2
+echo "Fix: serve only a dedicated subdirectory and reject dotfiles, e.g." >&2
+echo "  STATIC_DIR = os.path.join(os.path.dirname(__file__), 'static')" >&2
+echo "  if not path or path.startswith('.') or '..' in path: abort(404)" >&2
+echo "  return send_from_directory(STATIC_DIR, path)" >&2
+echo "Never serve the directory that contains .env, .git, or source files." >&2
+
+exit 0

package/examples/forbidden-response-phrase-detector.sh

@@ -0,0 +1,161 @@
+#!/bin/bash
+# forbidden-response-phrase-detector.sh — Detect operator-declared forbidden
+# phrases in the assistant's final response.
+#
+# Solves: response-layer recognition-without-arrest where a CLAUDE.md rule
+#   prohibiting specific opening or filler phrases is acknowledged by the
+#   model and then violated on the next turn (issue #60339).
+#
+# How it works: Stop hook that reads the operator's CLAUDE.md, extracts
+#   forbidden response phrases from three operator-natural formats, and
+#   checks whether the final assistant response contains any of them. The
+#   model's articulation of the rule is no longer load-bearing because the
+#   hook reads the rule directly and enforces it at response finalisation.
+#
+# How prohibitions are declared in CLAUDE.md
+# The hook accepts three operator-natural formats. Forbidden phrases must
+# be inside backticks (or smart quotes) for unambiguous extraction. The
+# match is case-insensitive against the response text by default.
+#
+#   Format 1 — inline prose:
+#     Do NOT open replies with `You're right` or `Great point`.
+#     never say `I apologize` in responses.
+#
+#   Format 2 — Japanese prose:
+#     `了解しました` を返信の冒頭で使うな
+#     `はい、その通りです` の使用は禁止
+#
+#   Format 3 — list under a "Forbidden Response Phrases" / 禁止 header:
+#     ## Forbidden Response Phrases
+#     - `You're right`
+#     - `Great point`
+#     - `I apologize`
+#
+# TRIGGER: Stop
+# MATCHER: ""
+#
+# Configuration:
+#   CC_FORBIDDEN_PHRASE_DISABLE=1   Disable the hook entirely.
+#   CC_FORBIDDEN_PHRASE_BLOCK=1     Exit non-zero (exit 2) on match. Default:
+#                                   advisory (warn to stderr, exit 0).
+#   CC_FORBIDDEN_PHRASE_OPEN_ONLY=1 Only check the first 200 chars of the
+#                                   response (filler-phrase pattern).
+#   CC_CLAUDEMD_PATH=/path          Override CLAUDE.md search path.
+#   CC_FORBIDDEN_PHRASE_CASE_SENSITIVE=1  Case-sensitive match. Default off.
+
+set -u
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-forbidden-response-phrase-detector-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [forbidden-response-phrase-detector]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_FORBIDDEN_PHRASE_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat)
+
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+[ -z "$TRANSCRIPT" ] && exit 0
+[ ! -r "$TRANSCRIPT" ] && exit 0
+
+# Extract the last assistant response from the transcript.
+LAST_ASSISTANT=$(tac "$TRANSCRIPT" 2>/dev/null | grep -m1 '"role":"assistant"' || true)
+[ -z "$LAST_ASSISTANT" ] && exit 0
+
+RESPONSE_TEXT=$(printf '%s' "$LAST_ASSISTANT" | jq -r '
+  if .message.content then
+    (.message.content | if type == "array" then map(select(.type == "text") | .text) | join("\n") else . end)
+  elif .content then
+    (.content | if type == "array" then map(select(.type == "text") | .text) | join("\n") else . end)
+  else
+    empty
+  end
+' 2>/dev/null)
+
+[ -z "$RESPONSE_TEXT" ] && exit 0
+
+# Find CLAUDE.md.
+CLAUDEMD=""
+if [ -n "${CC_CLAUDEMD_PATH:-}" ] && [ -r "$CC_CLAUDEMD_PATH" ]; then
+    CLAUDEMD="$CC_CLAUDEMD_PATH"
+else
+    for candidate in "CLAUDE.md" ".claude/CLAUDE.md" "../CLAUDE.md" "$HOME/.claude/CLAUDE.md"; do
+        if [ -r "$candidate" ]; then
+            CLAUDEMD="$candidate"
+            break
+        fi
+    done
+fi
+[ -z "$CLAUDEMD" ] && exit 0
+
+# Extract forbidden phrases.
+FORBIDDEN_LIST=""
+
+# Pass 1: prose prohibitions referring to response/reply behaviour
+PROSE=$(grep -iE '(do[ -]not (open|start|begin|use|say)|never (say|use|open|begin)|を返信|を使うな|の使用は禁止|返信の冒頭|filler|opening)' "$CLAUDEMD" 2>/dev/null || true)
+if [ -n "$PROSE" ]; then
+    # Extract backtick-quoted phrases (single backtick form) and curly quotes
+    EXTRACTED=$(printf '%s\n' "$PROSE" | grep -oE '`[^`]+`|"[^"]+"' 2>/dev/null | sed -e 's/^`//' -e 's/`$//' -e 's/^"//' -e 's/"$//' | sort -u || true)
+    if [ -n "$EXTRACTED" ]; then
+        FORBIDDEN_LIST="$EXTRACTED"
+    fi
+fi
+
+# Pass 2: list items under "Forbidden Response Phrases" / "Forbidden Phrases" / 禁止 headers
+HEADER_LINES=$(grep -inE '^#+ +(forbidden (response )?phrases|forbidden replies|prohibited (response )?phrases|filler phrases|禁止する応答|応答の禁止)' "$CLAUDEMD" 2>/dev/null | cut -d: -f1 || true)
+if [ -n "$HEADER_LINES" ]; then
+    for ln in $HEADER_LINES; do
+        SECTION=$(sed -n "${ln},$((ln+20))p" "$CLAUDEMD" 2>/dev/null || true)
+        ITEMS=$(printf '%s\n' "$SECTION" | grep -E '^[ ]*[-*] +`[^`]+`' 2>/dev/null | grep -oE '`[^`]+`' | sed 's/`//g' || true)
+        if [ -n "$ITEMS" ]; then
+            FORBIDDEN_LIST="${FORBIDDEN_LIST}${FORBIDDEN_LIST:+$'\n'}${ITEMS}"
+        fi
+    done
+fi
+
+[ -z "$FORBIDDEN_LIST" ] && exit 0
+
+FORBIDDEN_LIST=$(printf '%s\n' "$FORBIDDEN_LIST" | sort -u)
+
+# Decide scope.
+if [ "${CC_FORBIDDEN_PHRASE_OPEN_ONLY:-0}" = "1" ]; then
+    SCOPE=$(printf '%s' "$RESPONSE_TEXT" | head -c 200)
+else
+    SCOPE="$RESPONSE_TEXT"
+fi
+
+# Match each phrase.
+VIOLATIONS=""
+GREP_FLAGS="-F"
+if [ "${CC_FORBIDDEN_PHRASE_CASE_SENSITIVE:-0}" != "1" ]; then
+    GREP_FLAGS="${GREP_FLAGS}i"
+fi
+
+while IFS= read -r phrase; do
+    [ -z "$phrase" ] && continue
+    if printf '%s' "$SCOPE" | grep -q $GREP_FLAGS -- "$phrase" 2>/dev/null; then
+        VIOLATIONS="${VIOLATIONS}${VIOLATIONS:+$'\n'}${phrase}"
+    fi
+done <<< "$FORBIDDEN_LIST"
+
+[ -z "$VIOLATIONS" ] && exit 0
+
+# Emit warning.
+echo "⚠ forbidden-response-phrase-detector: assistant response contained phrases prohibited by $CLAUDEMD:" >&2
+printf '%s\n' "$VIOLATIONS" | while IFS= read -r line; do
+    [ -n "$line" ] && echo "  - \"$line\"" >&2
+done
+echo "  See issue #60339 for the failure shape (CLAUDE.md rule re-violated immediately after correction)." >&2
+
+if [ "${CC_FORBIDDEN_PHRASE_BLOCK:-0}" = "1" ]; then
+    exit 2
+fi
+
+exit 0

package/examples/gem-push-guard.sh

@@ -1,5 +1,18 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-gem-push-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [gem-push-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0

package/examples/gh-cli-destructive-guard.sh

@@ -10,7 +10,19 @@
 # The gh CLI is powerful but destructive operations should require
 # explicit human approval, not AI autonomy.
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-gh-cli-destructive-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [gh-cli-destructive-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

package/examples/git-checkout-safety-guard.sh

@@ -26,6 +26,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-checkout-safety-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-checkout-safety-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/git-checkout-uncommitted-guard.sh

@@ -23,6 +23,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-checkout-uncommitted-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-checkout-uncommitted-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/git-config-guard.sh

@@ -17,6 +17,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-config-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-config-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/git-crypt-worktree-guard.sh

@@ -14,6 +14,18 @@
 # MATCHER: "Bash"
 
 set -euo pipefail
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-crypt-worktree-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-crypt-worktree-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

package/examples/git-filter-repo-guard.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# git-filter-repo-guard.sh — Block git history rewriting tools
+#
+# Solves: Issue #45893 where `git filter-repo --force` destroyed production
+#         files by rewriting repository history. These tools permanently
+#         alter commit objects and can cause irreversible data loss.
+#
+# Detects:
+#   git filter-repo    (modern history rewriter, any arguments)
+#   git filter-branch  (legacy history rewriter, any arguments)
+#   bfg                (BFG Repo-Cleaner, third-party history rewriter)
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-filter-repo-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-filter-repo-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# Block git filter-repo (any arguments)
+if echo "$COMMAND" | grep -qE '\bgit\s+filter-repo\b'; then
+    echo "BLOCKED: git filter-repo rewrites repository history (see #45893)." >&2
+    echo "  This command destroyed production files in a real incident." >&2
+    echo "  History rewriting is irreversible and breaks all clones." >&2
+    exit 2
+fi
+
+# Block git filter-branch (legacy equivalent)
+if echo "$COMMAND" | grep -qE '\bgit\s+filter-branch\b'; then
+    echo "BLOCKED: git filter-branch rewrites repository history (see #45893)." >&2
+    echo "  Legacy history rewriter — same risks as filter-repo." >&2
+    echo "  History rewriting is irreversible and breaks all clones." >&2
+    exit 2
+fi
+
+# Block BFG Repo-Cleaner
+if echo "$COMMAND" | grep -qE '\bbfg\b'; then
+    echo "BLOCKED: BFG Repo-Cleaner rewrites repository history (see #45893)." >&2
+    echo "  Third-party tool with the same risks as git filter-repo." >&2
+    echo "  History rewriting is irreversible and breaks all clones." >&2
+    exit 2
+fi
+
+exit 0

package/examples/git-history-rewrite-guard.sh

@@ -20,6 +20,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-history-rewrite-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-history-rewrite-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/git-maintenance-guard.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+# ================================================================
+# git-maintenance-guard.sh — Block automatic git maintenance
+# ================================================================
+# PURPOSE:
+#   Claude Code, Codex, and parallel subagents sometimes run
+#   git gc / git repack / git maintenance / git prune on their own.
+#   When these run concurrently in the same repo, lock contention
+#   leaves stale .git/objects/pack/tmp_pack_* files behind. Past
+#   incident: 1,350 tmp_pack_* / 144 GiB filled the WSL ext4.vhdx.
+#
+#   This hook blocks those maintenance commands at PreToolUse. The
+#   user can still run them manually by setting CC_GIT_MAINTENANCE_ALLOW=1
+#   for that single command.
+#
+# Detects:
+#   git gc                      (any args)
+#   git repack                  (any args)
+#   git maintenance run         (any args, including 'start' / 'stop')
+#   git prune                   (any args)
+#   git gc --auto               (also blocked: still triggers repack)
+#
+# Does NOT block:
+#   git gc --prune=now          (still blocked — prune is the risky part)
+#   read-only inspection: git count-objects, git fsck, git verify-pack
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+#
+# CONFIG:
+#   CC_GIT_MAINTENANCE_ALLOW=1   one-shot override
+#   CC_GIT_MAINTENANCE_DISABLE=1 disable this hook entirely
+# ================================================================
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-maintenance-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-maintenance-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_GIT_MAINTENANCE_DISABLE:-0}" = "1" ] && exit 0
+[ "${CC_GIT_MAINTENANCE_ALLOW:-0}" = "1" ] && exit 0
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# git gc (any args)
+if echo "$COMMAND" | grep -qE '(^|[^a-zA-Z0-9._-])git[[:space:]]+gc([[:space:]]|$)'; then
+    echo "BLOCKED: git gc can leave stale tmp_pack_* under parallel access." >&2
+    echo "  Past incident: 1,350 tmp_pack_* / 144 GiB filled the WSL ext4.vhdx." >&2
+    echo "  Override (one shot): CC_GIT_MAINTENANCE_ALLOW=1 git gc ..." >&2
+    exit 2
+fi
+
+# git repack (any args)
+if echo "$COMMAND" | grep -qE '(^|[^a-zA-Z0-9._-])git[[:space:]]+repack([[:space:]]|$)'; then
+    echo "BLOCKED: git repack can leave stale tmp_pack_* under parallel access." >&2
+    echo "  Override (one shot): CC_GIT_MAINTENANCE_ALLOW=1 git repack ..." >&2
+    exit 2
+fi
+
+# git maintenance (run / start / stop / register / unregister)
+if echo "$COMMAND" | grep -qE '(^|[^a-zA-Z0-9._-])git[[:space:]]+maintenance([[:space:]]|$)'; then
+    echo "BLOCKED: git maintenance schedules background gc/repack — same risk." >&2
+    echo "  Override (one shot): CC_GIT_MAINTENANCE_ALLOW=1 git maintenance ..." >&2
+    exit 2
+fi
+
+# git prune (any args). git prune-packed is also caught here, intentionally.
+if echo "$COMMAND" | grep -qE '(^|[^a-zA-Z0-9._-])git[[:space:]]+prune([[:space:]-]|$)'; then
+    echo "BLOCKED: git prune removes unreachable objects. Skip unless investigating manually." >&2
+    echo "  Override (one shot): CC_GIT_MAINTENANCE_ALLOW=1 git prune ..." >&2
+    exit 2
+fi
+
+exit 0