cc-safe-setup 29.7.0 → 30.0.4

package/examples/git-operations-require-approval.sh

@@ -8,27 +8,64 @@
 #   user approval. This hook enforces the restriction at process level.
 #
 # Blocks:
-#   git commit, git push (including --force), git checkout -b,
-#   git switch -c, git branch <name>
+#   git commit, git push (including --force and `git send-pack`),
+#   git checkout -b, git switch -c, git branch <name> - including when
+#   they arrive with git's own global options in front, such as
+#   `git -C <dir> push` or `git --git-dir=<path> commit` (#1117).
 #
 # Does NOT block:
 #   git status, git log, git diff, git show, git branch (list),
 #   git fetch, git stash, git add
 #
-# Handles compound commands (&&, ;, ||) by checking each segment.
+# Handles compound commands (&&, ;, ||, |) by checking each segment.
 #
 # See: https://github.com/anthropics/claude-code/issues/40695
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-operations-require-approval-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-operations-require-approval]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
 [ -z "$COMMAND" ] && exit 0
 
-# Skip if the command is inside echo/printf (not actual execution)
-echo "$COMMAND" | grep -qE '^\s*(echo|printf)\s' && exit 0
+# git accepts global options between `git` and the subcommand, so matching the
+# two as adjacent words misses every one of these real shapes (reported in #1117
+# with four working examples):
+#     git -C /tmp/repo push --force origin main
+#     git --git-dir=/tmp/r/repo.d push origin main
+#     git -c user.name=x commit -m x
+#     git send-pack origin main
+# GIT_OPT is the set of options git itself accepts before a subcommand.
+GIT_OPT='(-[cC][[:space:]]+[^[:space:]]+|--(git-dir|work-tree|namespace|exec-path|config-env|attr-source|super-prefix)(=[^[:space:]]+|[[:space:]]+[^[:space:]]+)|-[pP]|--(paginate|no-pager|bare|no-replace-objects|literal-pathspecs|glob-pathspecs|noglob-pathspecs|icase-pathspecs|no-optional-locks|no-lazy-fetch|no-advice))'
+
+# `git` at a command position, not the `git` inside a path. The old pattern
+# matched `git --git-dir=/tmp/r/.git push` only because the *path* ended in
+# `.git`, and let the same command through when the git-dir was named anything
+# else (#1117). Quotes are allowed on purpose: `bash -c "git push ..."` runs.
+GIT_HEAD='(^|[[:space:];&|(]|/|"|'"'"')git'
+
+# Build "git [global options] <subcommand>" for one subcommand pattern.
+git_re() {
+    printf '%s([[:space:]]+%s)*[[:space:]]+%s' "$GIT_HEAD" "$GIT_OPT" "$1"
+}
+
+# Read-only front halves that mention a command without running it.
+# This list is a guess about how people write, not a rule - `sed -i` and any
+# wrapper not named here will still be inspected.
+READ_ONLY_RE='^[[:space:]]*(echo|printf|grep|rg|cat|less|head|tail)[[:space:]]'
 
 # Check each segment of compound commands
 check_segment() {
@@ -37,8 +74,12 @@ check_segment() {
     seg=$(echo "$seg" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
     [ -z "$seg" ] && return 0
 
+    # Exempt only THIS segment. Applying it to the whole command let
+    # `echo hi && git push origin main` through completely.
+    echo "$seg" | grep -qE "$READ_ONLY_RE" && return 0
+
     # git commit
-    if echo "$seg" | grep -qE '\bgit\s+commit\b'; then
+    if echo "$seg" | grep -qE "$(git_re 'commit\b')|${GIT_HEAD}-commit\b"; then
         echo "BLOCKED: git commit requires explicit user approval." >&2
         echo "Command: $seg" >&2
         echo "" >&2
@@ -47,7 +88,7 @@ check_segment() {
     fi
 
     # git push (including force variants)
-    if echo "$seg" | grep -qE '\bgit\s+push\b'; then
+    if echo "$seg" | grep -qE "$(git_re '(push|send-pack)\b')|${GIT_HEAD}-(push|send-pack)\b"; then
         echo "BLOCKED: git push requires explicit user approval." >&2
         echo "Command: $seg" >&2
         echo "" >&2
@@ -56,14 +97,14 @@ check_segment() {
     fi
 
     # git checkout -b (branch creation)
-    if echo "$seg" | grep -qE '\bgit\s+checkout\s+(-b|--branch)\b'; then
+    if echo "$seg" | grep -qE "$(git_re 'checkout[[:space:]]+(-b|--branch)\b')"; then
         echo "BLOCKED: git branch creation requires explicit user approval." >&2
         echo "Command: $seg" >&2
         return 1
     fi
 
     # git switch -c / --create (branch creation)
-    if echo "$seg" | grep -qE '\bgit\s+switch\s+(-c|--create)\b'; then
+    if echo "$seg" | grep -qE "$(git_re 'switch[[:space:]]+(-c|--create)\b')"; then
         echo "BLOCKED: git branch creation requires explicit user approval." >&2
         echo "Command: $seg" >&2
         return 1
@@ -71,14 +112,17 @@ check_segment() {
 
     # git branch <name> (creation, not listing)
     # git branch without flags or with only -a/-r/-l/--list is listing
-    if echo "$seg" | grep -qE '\bgit\s+branch\s'; then
+    if echo "$seg" | grep -qE "$(git_re 'branch[[:space:]]')"; then
         # Allow listing flags
-        if echo "$seg" | grep -qE '\bgit\s+branch\s+(-[arl]|--list|--merged|--no-merged|--contains|-v|--verbose|-d|--delete|-D)\b'; then
+        if echo "$seg" | grep -qE "$(git_re 'branch[[:space:]]+(-[arl]|--list|--merged|--no-merged|--contains|-v|--verbose|-d|--delete|-D)\b')"; then
             return 0
         fi
         # If it has a name argument after "git branch", it's creation
         local args
-        args=$(echo "$seg" | sed 's/.*\bgit\s\+branch\s\+//')
+        # The old sed required `git` and `branch` to be adjacent; with a
+        # global option in between it stripped nothing and every listing form
+        # looked like a creation. Strip up to the subcommand instead.
+        args=$(echo "$seg" | sed -E 's/.*[[:space:]]branch[[:space:]]+//')
         if [ -n "$args" ] && ! echo "$args" | grep -qE '^\s*$'; then
             echo "BLOCKED: git branch creation requires explicit user approval." >&2
             echo "Command: $seg" >&2
@@ -89,11 +133,21 @@ check_segment() {
     return 0
 }
 
-# Split on && ; || and check each part
+# Split on && ; || | and check each part.
+#
+# A single `|` is a separator too. Without it, a read-only command piped into
+# a git write arrives as ONE segment whose first word is the reader, and
+# READ_ONLY_RE above exempts that whole segment - so the git write on the
+# right-hand side of the pipe is never examined. Measured on the published
+# file 2026-09-15: four piped shapes exited 0 while the same git operations
+# exited 2 when written plainly.
+#
+# `||` is already turned into newlines by the rule before this one, so the
+# single-pipe rule only ever sees real single pipes.
 while IFS= read -r segment; do
     if ! check_segment "$segment"; then
         exit 2
     fi
-done < <(echo "$COMMAND" | sed 's/&&/\n/g; s/;/\n/g; s/||/\n/g')
+done < <(echo "$COMMAND" | sed 's/&&/\n/g; s/;/\n/g; s/||/\n/g; s/|/\n/g')
 
 exit 0

package/examples/git-pack-temp-cleanup-guard.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# ================================================================
+# git-pack-temp-cleanup-guard.sh — Stop tmp_pack_* explosion
+# ================================================================
+# PURPOSE:
+#   Subagents and parallel git operations leave stale
+#   .git/objects/pack/tmp_pack_* files behind when git gc / repack
+#   fails or is interrupted. These accumulate without bound and can
+#   fill ext4.vhdx (observed: 1,350 files / 144 GB on a single repo).
+#
+#   This hook runs before any git command. It removes tmp_pack_*
+#   files older than CC_GIT_PACK_AGE_MIN minutes, then checks the
+#   remaining total. Above thresholds, it warns or blocks.
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+#
+# CONFIG:
+#   CC_GIT_PACK_AGE_MIN=60         minutes; older tmp_pack_* are removed
+#   CC_GIT_PACK_WARN_GB=1          warn at this many GiB remaining
+#   CC_GIT_PACK_STRONG_GB=5        strong warning at this many GiB
+#   CC_GIT_PACK_BLOCK_GB=10        block git command at this many GiB
+#   CC_GIT_PACK_DISABLE=1          set to disable this hook entirely
+# ================================================================
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-pack-temp-cleanup-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-pack-temp-cleanup-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_GIT_PACK_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# Only act on git commands. \bgit\b matches git as a whole word, so
+# pathnames like /usr/bin/gitlab won't trigger.
+echo "$COMMAND" | grep -qE '(^|[^a-zA-Z0-9._-])git([^a-zA-Z0-9._-]|$)' || exit 0
+
+AGE_MIN="${CC_GIT_PACK_AGE_MIN:-60}"
+WARN_GB="${CC_GIT_PACK_WARN_GB:-1}"
+STRONG_GB="${CC_GIT_PACK_STRONG_GB:-5}"
+BLOCK_GB="${CC_GIT_PACK_BLOCK_GB:-10}"
+
+# Resolve the .git directory of the current repo. If we are outside a
+# git repo, exit silently — the user's git command will fail on its own.
+GIT_DIR=$(git rev-parse --git-dir 2>/dev/null) || exit 0
+PACK_DIR="$GIT_DIR/objects/pack"
+
+[ -d "$PACK_DIR" ] || exit 0
+
+# Step 1: remove tmp_pack_* older than AGE_MIN minutes.
+# Use -maxdepth 1 so we never recurse. Only match the literal prefix.
+removed_count=0
+removed_bytes=0
+while IFS= read -r -d '' f; do
+    sz=$(stat -c '%s' "$f" 2>/dev/null || echo 0)
+    if rm -f "$f" 2>/dev/null; then
+        removed_count=$((removed_count + 1))
+        removed_bytes=$((removed_bytes + sz))
+    fi
+done < <(find "$PACK_DIR" -maxdepth 1 -type f -name 'tmp_pack_*' -mmin "+$AGE_MIN" -print0 2>/dev/null)
+
+if [ "$removed_count" -gt 0 ]; then
+    removed_mib=$((removed_bytes / 1024 / 1024))
+    echo "INFO: git-pack-temp-cleanup-guard removed $removed_count stale tmp_pack_* files (${removed_mib} MiB) older than ${AGE_MIN} min in $PACK_DIR" >&2
+fi
+
+# Step 2: compute remaining total size of tmp_pack_*.
+remaining_bytes=0
+while IFS= read -r -d '' f; do
+    sz=$(stat -c '%s' "$f" 2>/dev/null || echo 0)
+    remaining_bytes=$((remaining_bytes + sz))
+done < <(find "$PACK_DIR" -maxdepth 1 -type f -name 'tmp_pack_*' -print0 2>/dev/null)
+
+remaining_gb=$((remaining_bytes / 1024 / 1024 / 1024))
+
+if [ "$remaining_gb" -ge "$BLOCK_GB" ]; then
+    echo "BLOCKED: tmp_pack_* total is ${remaining_gb} GiB in $PACK_DIR (threshold ${BLOCK_GB} GiB)." >&2
+    echo "  Past incidents accumulated 144 GiB and filled ext4.vhdx." >&2
+    echo "  Investigate before running more git commands. Inspect with:" >&2
+    echo "    find \"$PACK_DIR\" -maxdepth 1 -name 'tmp_pack_*' -printf '%s %p\\n'" >&2
+    echo "  Override (one shot) with: CC_GIT_PACK_DISABLE=1 git ..." >&2
+    exit 2
+fi
+
+if [ "$remaining_gb" -ge "$STRONG_GB" ]; then
+    echo "STRONG WARNING: tmp_pack_* total is ${remaining_gb} GiB in $PACK_DIR (strong threshold ${STRONG_GB} GiB)." >&2
+    echo "  Investigate parallel git activity before this grows further." >&2
+elif [ "$remaining_gb" -ge "$WARN_GB" ]; then
+    echo "WARNING: tmp_pack_* total is ${remaining_gb} GiB in $PACK_DIR (threshold ${WARN_GB} GiB)." >&2
+fi
+
+exit 0

package/examples/git-push-blast-radius-guard.sh

@@ -0,0 +1,218 @@
+#!/bin/bash
+# git-push-blast-radius-guard.sh — Cap a runaway fan-out of git pushes that burns CI minutes
+#
+# Solves: When a bug touches many open PRs, the agent can "fix each branch
+# individually" — cherry-pick the same change onto branch after branch and push
+# each one. Every push to a distinct branch triggers the full CI suite, so the
+# cost scales with the number of branches, not the size of the fix. In #65944 a
+# 1-line lint fix was pushed to 13 PR branches across 3 rounds (~150+ workflow
+# runs), exhausting the entire 2,000-minute monthly GitHub Actions allotment in
+# under 3 hours and tripping an account-level Actions block. The operator's own
+# root-cause note: the correct shape was "fix once on main, let PRs inherit it
+# via rebase — 1 CI run instead of 150+."
+#
+# Existing hooks miss this exact shape:
+#   - git-operations-require-approval.sh blocks *every* git push (all-or-nothing,
+#     off by default); it never counts how many distinct branches a session has
+#     pushed, so it can't tell a normal 1-branch push from a 13-branch fan-out.
+#   - same-command-repeat-detector.sh keys on the *same* command repeating; a
+#     fan-out pushes a *different* branch each time, so it never matches (the
+#     same blind spot loop-detector.sh had before webfetch-runaway-guard.sh).
+#   - tool-call-rate-limiter.sh counts *all* tool calls in a short window; pushes
+#     spread across hours slip under it and it cannot see "distinct branches."
+#   - parallel-batch-size-limiter.sh measures *concurrent* batches, not sequential
+#     pushes to many branches across rounds.
+#
+# This counts the SET of distinct branches pushed in a rolling per-session window
+# and, once that set crosses a threshold, surfaces the fix-on-main-then-rebase
+# pattern and (by default) blocks the next branch push — the confirmation the
+# operator wished for ("shouldn't push to more than 2-3 branches without
+# confirmation"). The block is recoverable: raise the threshold, switch to warn,
+# or set off. Re-pushing the *same* branch never inflates the count, so an
+# ordinary edit-push-edit-push loop on one feature branch is untouched; only a
+# genuine multi-branch fan-out trips it. `git push --all` / `--mirror` pushes
+# every local branch at once (maximum blast radius) and is treated as a trip
+# immediately.
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+# Config (all optional):
+#   CC_PUSH_BLAST_GUARD=block     block | warn | off
+#   CC_PUSH_BLAST_BLOCK=6         block once this many distinct branches fall in the window
+#   CC_PUSH_BLAST_WARN=3          warn (stderr, non-blocking) at this many
+#   CC_PUSH_BLAST_WINDOW=3600     rolling window in seconds (default 1 hour)
+#   CC_PUSH_BLAST_DIR             state dir (default: /tmp/cc-push-blast)
+# Related: https://github.com/anthropics/claude-code/issues/65944
+
+INPUT=$(cat)
+
+MODE="${CC_PUSH_BLAST_GUARD:-block}"
+[ "$MODE" = "off" ] && exit 0
+
+# Only act on Bash. Fail open on anything unexpected.
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ "$TOOL" != "Bash" ] && exit 0
+
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+# git accepts global options between `git` and the subcommand, so `git push`
+# as two adjacent words never sees `git -C <dir> push` - which is exactly how
+# an agent pushes to branch after branch without changing directory. Reported
+# in #1117. `git send-pack` is the plumbing form of the same operation.
+GIT_OPT='(-[cC][[:space:]]+[^[:space:]]+|--(git-dir|work-tree|namespace|exec-path|config-env|attr-source|super-prefix)(=[^[:space:]]+|[[:space:]]+[^[:space:]]+)|-[pP]|--(paginate|no-pager|bare|no-replace-objects|literal-pathspecs|glob-pathspecs|noglob-pathspecs|icase-pathspecs|no-optional-locks|no-lazy-fetch|no-advice))'
+GIT_HEAD='(^|[[:space:];&|(]|/|"|'"'"')git'
+GIT_PUSH_RE="${GIT_HEAD}([[:space:]]+${GIT_OPT})*[[:space:]]+(push|send-pack)\\b|${GIT_HEAD}-(push|send-pack)\\b"
+
+# Quick reject: nothing to do unless the command runs `git push` somewhere.
+printf '%s' "$COMMAND" | grep -qE "$GIT_PUSH_RE" || exit 0
+
+BLOCK_AT="${CC_PUSH_BLAST_BLOCK:-6}"
+WARN_AT="${CC_PUSH_BLAST_WARN:-3}"
+WINDOW="${CC_PUSH_BLAST_WINDOW:-3600}"
+case "$BLOCK_AT" in ''|*[!0-9]*) exit 0;; esac
+case "$WARN_AT" in ''|*[!0-9]*) exit 0;; esac
+case "$WINDOW" in ''|*[!0-9]*) exit 0;; esac
+
+# Key state per session so one session's work never trips another's guard.
+SID=$(printf '%s' "$INPUT" | jq -r '.session_id // "default"' 2>/dev/null)
+case "$SID" in ''|*[!A-Za-z0-9_-]*) SID="default";; esac
+
+# ---- Work out which branch(es) this command pushes to --------------------
+# A command may chain several segments (&&, ;, newline, |). Inspect each git
+# push segment and collect the branch name(s) it targets. Unknown/odd shapes
+# fail open (they simply contribute nothing rather than guessing wrong).
+FANOUT=0          # set when --all/--mirror pushes every branch at once
+declare -a BRANCHES=()
+
+# Split into segments on shell separators so each `git push ...` is seen alone.
+SEGMENTS=$(printf '%s' "$COMMAND" | tr '\n;|' '\n\n\n' | sed 's/&&/\n/g')
+
+while IFS= read -r seg; do
+    printf '%s' "$seg" | grep -qE "$GIT_PUSH_RE" || continue
+
+    # Tokens after the subcommand. The old `sed 's/.*\bgit[[:space:]]+push//'`
+    # stripped nothing when a global option sat between `git` and `push`, so the
+    # whole command ended up parsed as if it were the argument list (#1117).
+    # Walking the tokens has no such failure mode.
+    # shellcheck disable=SC2206
+    _all=( $seg )
+    after=""
+    _i=0
+    while [ "$_i" -lt "${#_all[@]}" ]; do
+        case "${_all[$_i]}" in
+            push|send-pack) after="${_all[*]:$((_i + 1))}"; break ;;
+        esac
+        _i=$((_i + 1))
+    done
+
+    # Whole-repo fan-out: one command, every branch, maximum CI blast radius.
+    if printf '%s' "$after" | grep -qE '(^|[[:space:]])(--all|--mirror)([[:space:]]|$)'; then
+        FANOUT=1
+        continue
+    fi
+    # shellcheck disable=SC2206
+    toks=( $after )
+
+    refspecs=()
+    seen_remote=0
+    i=0
+    while [ "$i" -lt "${#toks[@]}" ]; do
+        t="${toks[$i]}"
+        i=$((i + 1))
+        case "$t" in
+            # Flags that take a separate value -> skip the value too.
+            --repo|-o|--push-option|--receive-pack|--exec)
+                i=$((i + 1)); continue ;;
+            -*) continue ;;          # any other flag
+        esac
+        # First bare token is the remote (origin / upstream / a URL). After that,
+        # bare tokens are refspecs (branches).
+        if [ "$seen_remote" -eq 0 ]; then
+            seen_remote=1
+            continue
+        fi
+        refspecs+=("$t")
+    done
+
+    if [ "${#refspecs[@]}" -eq 0 ]; then
+        # `git push` / `git push origin` with no refspec -> current branch.
+        cur=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+        [ -n "$cur" ] && [ "$cur" != "HEAD" ] && BRANCHES+=("$cur")
+        continue
+    fi
+
+    for r in "${refspecs[@]}"; do
+        # Strip a leading '+' (force) and take the destination side of any colon.
+        r="${r#+}"
+        dst="${r##*:}"
+        # Ignore tag/ref deletions and empty sources.
+        [ -z "$dst" ] && continue
+        case "$dst" in
+            HEAD) cur=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+                  [ -n "$cur" ] && [ "$cur" != "HEAD" ] && BRANCHES+=("$cur"); continue ;;
+        esac
+        BRANCHES+=("$dst")
+    done
+done <<EOF
+$SEGMENTS
+EOF
+
+# Nothing identifiable and not a fan-out: fail open.
+if [ "$FANOUT" -eq 0 ] && [ "${#BRANCHES[@]}" -eq 0 ]; then
+    exit 0
+fi
+
+# ---- Record into the rolling per-session window --------------------------
+STATE_DIR="${CC_PUSH_BLAST_DIR:-/tmp/cc-push-blast}"
+mkdir -p "$STATE_DIR" 2>/dev/null || exit 0
+STATE="$STATE_DIR/$SID"
+
+NOW=$(date +%s)
+CUTOFF=$((NOW - WINDOW))
+
+# Append "<ts>\t<branch>" for every branch this command pushes.
+for b in "${BRANCHES[@]}"; do
+    # Sanitise tab/newline out of the branch name for the state file.
+    safe=$(printf '%s' "$b" | tr -d '\t\n')
+    [ -n "$safe" ] && printf '%s\t%s\n' "$NOW" "$safe" >> "$STATE" 2>/dev/null
+done
+
+# Prune entries older than the window.
+if [ -f "$STATE" ]; then
+    awk -F'\t' -v c="$CUTOFF" '$1 ~ /^[0-9]+$/ && $1 >= c' "$STATE" > "$STATE.tmp" 2>/dev/null && mv "$STATE.tmp" "$STATE" 2>/dev/null
+fi
+
+# Count DISTINCT branches inside the window.
+if [ -f "$STATE" ]; then
+    DISTINCT=$(awk -F'\t' '{print $2}' "$STATE" 2>/dev/null | sort -u | grep -c .)
+else
+    DISTINCT=0
+fi
+case "$DISTINCT" in ''|*[!0-9]*) DISTINCT=0;; esac
+
+# A whole-repo fan-out is an immediate trip regardless of the counter.
+TRIP=0
+[ "$FANOUT" -eq 1 ] && TRIP=1
+[ "$DISTINCT" -ge "$BLOCK_AT" ] && TRIP=1
+
+MINS=$((WINDOW / 60))
+if [ "$FANOUT" -eq 1 ]; then
+    SUBJECT="This 'git push --all/--mirror' pushes every local branch at once"
+else
+    SUBJECT="This makes ${DISTINCT} distinct branches pushed within ${MINS} min"
+fi
+MSG="${SUBJECT}. Each branch push triggers the full CI suite, so cost scales with branch count: in #65944 a 1-line fix pushed across 13 branches ran ~150+ workflow runs and burned the entire 2,000-minute monthly GitHub Actions allotment in under 3 hours. If you are applying one fix to many branches, stop and use the cheap shape instead: commit the fix once on main (or a single branch), merge it, and let the other branches inherit it via rebase/merge — 1 CI run instead of one per branch. To proceed anyway, raise CC_PUSH_BLAST_BLOCK, set CC_PUSH_BLAST_GUARD=warn to only warn, or =off to disable. State resets after ${WINDOW}s of no pushes: ${STATE}"
+
+if [ "$TRIP" -eq 1 ]; then
+    if [ "$MODE" = "warn" ]; then
+        echo "git-push-blast-radius-guard: $MSG" >&2
+        exit 0
+    fi
+    # block (default): structured decision so the model sees the reason.
+    jq -n --arg r "$MSG" '{decision: "block", reason: $r}'
+    exit 0
+elif [ "$DISTINCT" -ge "$WARN_AT" ]; then
+    echo "git-push-blast-radius-guard: ${DISTINCT} distinct branches pushed within ${MINS} min — each push triggers CI; consider fix-on-main + rebase if applying one change to many branches (#65944). Blocks at ${BLOCK_AT}." >&2
+fi
+
+exit 0

package/examples/git-remote-guard.sh

@@ -20,9 +20,30 @@ if echo "$COMMAND" | grep -qE '\bgit\s+remote\s+add\b'; then
     echo "Verify this is a trusted repository." >&2
 fi
 
-# Check for push to non-origin remote
-if echo "$COMMAND" | grep -qE '\bgit\s+push\s+(?!origin\b)\w'; then
-    REMOTE=$(echo "$COMMAND" | grep -oE 'git\s+push\s+(\S+)' | awk '{print $3}')
+# Check for push to a remote that is not origin.
+#
+# The previous version used `(?!origin\b)`, a lookahead that ERE does not have:
+# grep -E rejected the pattern, returned 2, and the `if` was never true. The
+# warning below could not fire on any input. Deciding "is it origin?" in the
+# shell instead of the pattern removes the need for a lookahead entirely.
+#
+# `git` also accepts global options before the subcommand, so `git -C <dir>
+# push upstream main` has to be matched as well (#1117).
+GIT_OPT='(-[cC][[:space:]]+[^[:space:]]+|--(git-dir|work-tree|namespace|exec-path|config-env|attr-source|super-prefix)(=[^[:space:]]+|[[:space:]]+[^[:space:]]+)|-[pP]|--(paginate|no-pager|bare|no-replace-objects|literal-pathspecs|glob-pathspecs|noglob-pathspecs|icase-pathspecs|no-optional-locks|no-lazy-fetch|no-advice))'
+GIT_HEAD='(^|[[:space:];&|(]|/|"|'"'"')git'
+GIT_PUSH_RE="${GIT_HEAD}([[:space:]]+${GIT_OPT})*[[:space:]]+push([[:space:]]|$)"
+
+if echo "$COMMAND" | grep -qE "$GIT_PUSH_RE"; then
+    # First bare word after `push` is the remote (flags and their values are
+    # skipped). No remote at all means the default one, which is fine.
+    REMOTE=$(echo "$COMMAND" | awk '{
+        for (i = 1; i <= NF; i++) {
+            if ($i == "push") { seen = 1; continue }
+            if (!seen) continue
+            if ($i ~ /^-/) { continue }
+            print $i; exit
+        }
+    }')
     if [ -n "$REMOTE" ] && [ "$REMOTE" != "origin" ]; then
         echo "WARNING: Pushing to non-origin remote: $REMOTE" >&2
         echo "Verify this remote is trusted." >&2

package/examples/git-rm-orphan-wipe-guard.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+# git-rm-orphan-wipe-guard.sh — Block whole-working-tree deletion via git
+#
+# Solves: Claude Code (or a careless one-liner it runs) wiping an entire
+#         working tree — and its recovery path — with git itself, slipping
+#         past the rm-based guards.
+#
+# The #70687 pattern (real loss of 3 years of work + .git history):
+#         git checkout --orphan wipe && git rm -rf . --quiet
+#   1. "git checkout --orphan" starts a branch with NO parent commit, so
+#      there is no prior commit to restore the files from afterwards.
+#   2. "git rm -rf ." then removes every tracked file from the index AND
+#      the working tree.
+#   Together the project is gone with no commit to recover from.
+#
+# Why existing guards miss it:
+#   - rm-safety-net.sh only fires on a command that STARTS with "rm"
+#     (^rm). "git rm ..." starts with "git", so it slips through.
+#   - git-checkout-safety-guard.sh Check 1 matches "checkout <letter>";
+#     "git checkout --orphan" starts with "-", so it is not matched.
+#   - bulk-file-delete-guard.sh only blocks "git rm -rf ." when the file
+#     count crosses its threshold, so a small-but-total wipe passes.
+#
+# Detects:
+#   git checkout --orphan <name>     (detaches from all history)
+#   git switch --orphan <name>       (same, newer syntax)
+#   git rm -r / -rf / --recursive    (recursive removal of the tree)
+#   git rm . / git rm *              (whole-tree target)
+#
+# Does NOT block (no on-disk data loss / normal use):
+#   git rm <file>                    (single tracked file)
+#   git rm --cached ...              (untracks only; disk files survive)
+#   git checkout <branch> / -- file  (covered by git-checkout-safety-guard)
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-rm-orphan-wipe-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-rm-orphan-wipe-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# === Check 1: git checkout/switch --orphan (removes the recovery path) ===
+if echo "$COMMAND" | grep -qE '\bgit\s+(checkout|switch)\b[^|;&]*--orphan\b'; then
+    echo "BLOCKED: git checkout --orphan starts a branch with no parent commit." >&2
+    echo "  Followed by 'git rm -rf .' this leaves no commit to recover from (#70687)." >&2
+    echo "  If you really need an orphan branch, run it yourself outside the agent." >&2
+    exit 2
+fi
+
+# === git rm handling: only the destructive (whole-tree) forms ===
+if echo "$COMMAND" | grep -qE '\bgit\s+rm\b'; then
+    # --cached removes from the index only; working-tree files survive. Safe.
+    if echo "$COMMAND" | grep -qE '\bgit\s+rm\b[^|;&]*--cached\b'; then
+        exit 0
+    fi
+
+    # Check 2: recursive removal (-r / -R / -rf / --recursive)
+    if echo "$COMMAND" | grep -qE '\bgit\s+rm\s+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)\b'; then
+        echo "BLOCKED: git rm -r removes every tracked file in the tree from disk." >&2
+        echo "  rm-safety-net does not catch this (the command starts with 'git', not 'rm')." >&2
+        echo "  Delete specific files by name, or use 'git rm --cached' to untrack only." >&2
+        exit 2
+    fi
+
+    # Check 3: whole-tree target ( . or * ) even without -r
+    if echo "$COMMAND" | grep -qE '\bgit\s+rm\b[^|;&]*(\s\.(\s|$)|\s\./(\s|$)|\s\*(\s|$))'; then
+        echo "BLOCKED: git rm targeting '.' or '*' removes the whole working tree." >&2
+        echo "  Delete specific files by name, or use 'git rm --cached' to untrack only." >&2
+        exit 2
+    fi
+fi
+
+exit 0

package/examples/git-stash-before-checkout.sh

@@ -28,6 +28,18 @@
 # }
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-stash-before-checkout-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-stash-before-checkout]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0