cc-safe-setup 29.7.0 → 30.0.4

package/examples/git-submodule-guard.sh

@@ -1,9 +1,76 @@
 #!/bin/bash
+# ================================================================
+# git-submodule-guard.sh — Block the data-destroying variant of
+#                          `git submodule deinit` before it runs
+# ================================================================
+# PURPOSE:
+#   `git submodule deinit -f <path>` (or `--force`) removes the
+#   submodule's working tree. The -f / --force flag is exactly what
+#   makes git delete a submodule working tree that still has
+#   uncommitted or un-added changes. Without -f, git refuses when the
+#   submodule has local modifications — that built-in refusal is a
+#   safety net, and -f overrides it.
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+#
+# WHY THIS MATTERS:
+#   #68920 (2026-06) — asked to tidy up an unused submodule reference,
+#   Claude Code ran `git submodule deinit -f` followed by `git rm`,
+#   and the submodule's uncommitted edits and .gitignored config
+#   (editor settings, etc.) were deleted with no confirmation. This is
+#   a path that the usual rm -rf / reset --hard / clean -fd guards do
+#   NOT catch, because `deinit` does not look like a destructive
+#   command. Recovery is only partial: committed work is in the
+#   reflog and staged work survives in the index (restore with
+#   `git checkout-index`, not visible to `git fsck`), but edits that
+#   were never `git add`-ed are gone.
+#
+# WHAT IT DOES:
+#   - `git submodule deinit` WITH -f / --force  -> block (exit 2) by
+#     default, so the force-override of git's own safety net is
+#     stopped before any work is lost. Opt out to warn-only with
+#     SUBMODULE_DEINIT_BLOCK=0.
+#   - `git submodule deinit` WITHOUT a force flag, or `git submodule
+#     rm` -> warn only (exit 0). git itself refuses the unforced
+#     deinit when there are local changes, so a reminder is enough.
+#
+# CONFIG:
+#   SUBMODULE_DEINIT_BLOCK=1   (default: 1 = block forced deinit; 0 = warn-only)
+#
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-submodule-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-submodule-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
+
+BLOCK_MODE="${SUBMODULE_DEINIT_BLOCK:-1}"
+
+# Forced deinit: the variant that deletes uncommitted submodule work (#68920).
+# Match `git submodule deinit` followed, within the same command segment
+# (no pipe / && / ; in between), by a -f or --force flag.
+if echo "$COMMAND" | grep -qE '\bgit\s+submodule\s+deinit\b[^|&;]*(-f\b|--force\b)'; then
+    if [ "$BLOCK_MODE" = "1" ]; then
+        echo "BLOCKED: git-submodule-guard: 'git submodule deinit -f/--force' deletes the submodule working tree, including uncommitted and un-added changes, irreversibly (Claude Code incident #68920)." >&2
+        echo "  Safer path: commit or 'git stash' your submodule work first, or run 'git submodule deinit' WITHOUT -f (git refuses if there are local changes)." >&2
+        echo "  To allow for legitimate cleanup: export SUBMODULE_DEINIT_BLOCK=0 (warn-only mode)." >&2
+        exit 2
+    fi
+    echo "WARNING: 'git submodule deinit -f/--force' force-removes the submodule working tree and can delete uncommitted work (#68920). Commit or stash first." >&2
+    exit 0
+fi
+
+# Unforced deinit / submodule rm: warn only (git's own safety still applies).
 if echo "$COMMAND" | grep -qE '\bgit\s+submodule\s+(deinit|rm)\b'; then
-    echo "WARNING: Removing git submodule. This may break builds." >&2
+    echo "WARNING: Removing git submodule. This may break builds. Uncommitted submodule changes are at risk; commit or stash first." >&2
 fi
 exit 0

package/examples/git-tag-guard.sh

@@ -1,6 +1,18 @@
 #!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-tag-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-tag-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 if echo "$COMMAND" | grep -qE 'git\s+tag\s+(-a\s+|-d\s+)?v'; then

package/examples/gitops-drift-guard.sh

@@ -15,6 +15,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-gitops-drift-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [gitops-drift-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 case "$TOOL" in Edit|Write) ;; *) exit 0 ;; esac

package/examples/go-mod-tidy-warn.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PostToolUse  MATCHER: "Bash"
 INPUT=$(cat)

package/examples/go-vet-after-edit.sh

@@ -8,6 +8,18 @@
 # TRIGGER: PostToolUse
 # MATCHER: "Write|Edit"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-go-vet-after-edit-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [go-vet-after-edit]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
 [ -z "$FILE" ] && exit 0

package/examples/goal-iteration-limit-warner.sh

@@ -0,0 +1,152 @@
+#!/bin/bash
+# goal-iteration-limit-warner.sh — Warn before /goal command without iteration termination
+#
+# Solves: github.com/anthropics/claude-code/issues/58550
+#         "/goal evaluator has no circuit breaker — unsatisfiable conditions burn unlimited tokens"
+#
+#         Reporter (2026-05-13): a `/goal` set with no termination clause kept
+#         firing the same "condition not satisfied" check for 200+ iterations
+#         over 5 hours, consuming approximately 50% of the user's weekly token
+#         budget. The assistant cannot programmatically clear a goal; only the
+#         user can with `/goal clear`. If the user steps away after setting the
+#         goal, the budget burns silently.
+#
+# WHY THIS MATTERS:
+#   This is a textbook irreversible-operation pattern: the goal-evaluator's
+#   per-turn token spend is non-refundable once consumed, and the only stop
+#   condition is the user manually noticing and running `/goal clear`. For
+#   developers running Claude Code autonomously or stepping away mid-session,
+#   this is a high-impact silent failure.
+#
+# TRIGGER: UserPromptSubmit  MATCHER: ""
+#
+# HOW IT WORKS:
+#   When the user submits a prompt:
+#     1. Check whether the prompt is a `/goal` command.
+#        Skip `/goal clear`, `/goal status`, `/goal evaluate-once`, etc.
+#        (anything that isn't setting a new goal).
+#     2. For a goal-setting command, check whether the goal text already
+#        contains a termination clause ("stop after", "or stop", "max", a
+#        turn-count like "20 turns", "within N iterations", etc.).
+#     3. If no termination clause is present, emit a warning explaining the
+#        known iteration-limit bug and recommend adding a clause such as
+#        "or stop after 20 turns". Do not block — let the user proceed with
+#        eyes open.
+#
+# CONFIGURATION:
+#   CC_GOAL_WARN_DISABLE=1       — disable the hook entirely
+#   CC_GOAL_WARN_ACTION          — "warn" (default) or "block" (exit 2)
+#   CC_GOAL_WARN_LOG             — log file path (default /tmp/cc-goal-warn.log)
+#   CC_GOAL_WARN_MAX_TURNS       — suggested max turn count (default 20)
+#
+# Usage:
+# {
+#   "hooks": {
+#     "UserPromptSubmit": [{
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/goal-iteration-limit-warner.sh" }]
+#     }]
+#   }
+# }
+
+if [ "${CC_GOAL_WARN_DISABLE:-0}" = "1" ]; then
+  exit 0
+fi
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-goal-iteration-limit-warner-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [goal-iteration-limit-warner]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+
+# Pull user prompt (UserPromptSubmit puts it in tool_input.prompt or .prompt)
+PROMPT=$(printf '%s' "$INPUT" | jq -r '.prompt // .tool_input.prompt // empty' 2>/dev/null)
+if [ -z "$PROMPT" ]; then
+  exit 0
+fi
+
+# Quick scan: only act on /goal commands
+case "$PROMPT" in
+  "/goal "*|"/goal"|*$'\n'"/goal "*)
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+
+ACTION="${CC_GOAL_WARN_ACTION:-warn}"
+LOG_FILE="${CC_GOAL_WARN_LOG:-/tmp/cc-goal-warn.log}"
+MAX_TURNS="${CC_GOAL_WARN_MAX_TURNS:-20}"
+
+# Extract the line that begins with /goal
+GOAL_LINE=$(printf '%s' "$PROMPT" | grep -oE '^/goal[[:space:]]+[^\n]+' | head -1)
+if [ -z "$GOAL_LINE" ]; then
+  # Could be just "/goal" with no args — informational, no action needed
+  exit 0
+fi
+
+# Skip non-setting subcommands. Anything starting with /goal followed by
+# clear/status/evaluate-once/help/list is not setting a new goal.
+case "$GOAL_LINE" in
+  "/goal clear"*|"/goal status"*|"/goal help"*|"/goal list"*|"/goal evaluate-once"*|"/goal evaluate"*|"/goal show"*)
+    exit 0
+    ;;
+esac
+
+# Check for a termination clause. These are heuristic — false negatives are
+# acceptable (we just warn once); false positives let a careful user proceed.
+# Patterns:
+#   - "stop after"
+#   - "or stop"
+#   - "max N"
+#   - "N turns" / "N iterations" / "N evaluations"
+#   - "within N turns"
+#   - "after N attempts"
+HAS_LIMIT=0
+if echo "$GOAL_LINE" | grep -qiE '(stop[[:space:]]+after|or[[:space:]]+stop|max[[:space:]]+[0-9]+|[0-9]+[[:space:]]+(turns|iterations|evaluations|attempts|tries)|within[[:space:]]+[0-9]+[[:space:]]+(turns|iterations)|after[[:space:]]+[0-9]+[[:space:]]+(attempts|tries|turns))'; then
+  HAS_LIMIT=1
+fi
+
+if [ "$HAS_LIMIT" = "1" ]; then
+  # Termination clause present — silent pass.
+  exit 0
+fi
+
+TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
+GOAL_TEXT_TRIMMED=$(echo "$GOAL_LINE" | head -c 200)
+echo "[$TIMESTAMP] goal_without_limit detected, action=$ACTION goal_excerpt=$GOAL_TEXT_TRIMMED" >> "$LOG_FILE"
+
+MSG="⚠️  /goal without a termination clause detected"
+MSG+=$'\n'"     command: $GOAL_TEXT_TRIMMED"
+MSG+=$'\n'
+MSG+=$'\n'"  Known bug: github.com/anthropics/claude-code/issues/58550"
+MSG+=$'\n'"  The /goal evaluator runs after every assistant turn and has no built-in"
+MSG+=$'\n'"  iteration limit. One reported incident: 200+ iterations over 5 hours,"
+MSG+=$'\n'"  burning approximately 50% of the user's weekly token quota before the"
+MSG+=$'\n'"  user noticed and ran /goal clear. The assistant cannot clear or modify"
+MSG+=$'\n'"  a goal programmatically; only the user can."
+MSG+=$'\n'
+MSG+=$'\n'"  Recommendation: add an explicit termination clause. Examples:"
+MSG+=$'\n'"    /goal <condition> or stop after $MAX_TURNS turns"
+MSG+=$'\n'"    /goal <condition>, max $MAX_TURNS iterations"
+MSG+=$'\n'"    /goal <condition> within $MAX_TURNS turns"
+MSG+=$'\n'
+MSG+=$'\n'"  Reportedly, the 'or stop after N turns' clause is honored by the"
+MSG+=$'\n'"  evaluator already (issue #58550 workaround #4). If you proceed without"
+MSG+=$'\n'"  a clause, set a phone alarm for ~30 minutes and confirm /goal clear"
+MSG+=$'\n'"  if the condition turns out to be unreachable."
+
+if [ "$ACTION" = "block" ]; then
+  printf '%s\n' "$MSG" >&2
+  exit 2
+else
+  printf '%s\n' "$MSG" >&2
+  exit 0
+fi

package/examples/grep-nul-false-negative-guard.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+set -uo pipefail
+#
+# The registration was missing from this header. The installer reads TRIGGER
+# and MATCHER from here and falls back to PreToolUse / Bash when both are
+# absent, so this hook was being registered at a moment where the field it
+# reads is always empty: it installed, it appeared in the settings, and it
+# did nothing. Measured 2026-08-04 across examples/: 14 files were like this.
+# TRIGGER: PostToolUse
+# MATCHER: "Grep"
+INPUT=$(cat)
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ "$TOOL" = "Grep" ] || exit 0
+RESP=$(printf '%s' "$INPUT" | jq -r '.tool_response // .tool_result // empty' 2>/dev/null)
+printf '%s' "$RESP" | grep -qiE 'no matches found|no files found' || exit 0
+SEARCH=$(printf '%s' "$INPUT" | jq -r '.tool_input.path // "."' 2>/dev/null)
+[ -e "$SEARCH" ] || exit 0
+HIT=$(find "$SEARCH" -type f \
+        -not -path '*/.git/*' -not -path '*/node_modules/*' 2>/dev/null \
+      | head -300 \
+      | while read -r f; do
+          if LC_ALL=C grep -qaP '\x00' "$f" 2>/dev/null; then echo "$f"; break; fi
+        done)
+if [ -n "$HIT" ]; then
+  echo "[grep-nul-guard] Grep returned no matches, but '$HIT' contains a NUL byte." >&2
+  echo "  ripgrep silently suppresses matches in files it treats as binary, so this" >&2
+  echo "  'no matches' may be a false negative. Before concluding the pattern is absent," >&2
+  echo "  re-search in text mode, e.g.  rg -a --text <pattern> <path>  (or  grep -aP)." >&2
+fi
+exit 0

package/examples/growthbook-flag-monitor.sh

@@ -0,0 +1,257 @@
+#!/bin/bash
+# ================================================================
+# growthbook-flag-monitor.sh — Surface server-pushed GrowthBook
+#   flag changes that silently override client-side state.
+# ================================================================
+# PURPOSE:
+#   Issue #62205 (2026-05-25, root-cause analysis) documented that
+#   the macOS Desktop variant of Claude Code syncs GrowthBook A/B
+#   feature flags from the Anthropic server every ~9 minutes and
+#   silently overrides the user's local settings.json. Concretely,
+#   `permissions.defaultMode: bypassPermissions` flips back to
+#   `acceptEdits` on each sync, with the same shape applying to
+#   other dispatch surfaces (auto-compact: #63015 suspects
+#   `tengu_compact_cache_prefix` gating a new compaction path that
+#   silently fails to fire).
+#
+#   The local cache file is read-write but not authoritative — any
+#   operator edit is restored on the next ~9-minute sync. Local
+#   edits do not persist. The five documented override paths in
+#   the cluster framing all draw from the cached flag set, so the
+#   minimum-viable defense is to make flag changes visible to the
+#   operator instead of letting them happen silently in the
+#   background.
+#
+# WHO THIS PROTECTS:
+#   macOS Claude Desktop operators (where the cache file is at
+#   `~/Library/Application Support/Claude/cachedGrowthBookFeatures`).
+#   Linux operators where the cache lives under
+#   `~/.config/Claude/cachedGrowthBookFeatures` are also covered
+#   when the file is present. CLI-only operators are unaffected
+#   when the file is absent — the hook stays silent.
+#
+# HOW IT WORKS:
+#   On SessionStart, snapshots the current GrowthBook flag set
+#   (sha256 over the canonicalised flag-name list, plus the
+#   per-flag JSON value digest). Compares against the previous
+#   snapshot from `${XDG_STATE_HOME:-$HOME/.local/state}/cc-safe-setup/
+#   growthbook-flag-monitor/snapshot.json`. If the set has changed,
+#   prints a one-screen stderr advisory listing added / removed /
+#   changed flags so the operator sees what shifted while they
+#   were away. Always exits 0 (advisory only).
+#
+#   The snapshot does NOT contain raw flag values by default
+#   (those are server-controlled and can change without notice).
+#   The snapshot stores just the flag-name set + per-flag value
+#   digest. Set CC_GROWTHBOOK_MONITOR_FULL=1 to also store full
+#   values for forensic comparison (off by default to keep the
+#   state file small).
+#
+# TRIGGER: SessionStart  MATCHER: ""
+# CLUSTER: 10 (GrowthBook A/B flag client-side overrides)
+#
+# CONFIGURATION (env vars):
+#   CC_GROWTHBOOK_MONITOR_DISABLE      Set to "1" to silence.
+#   CC_GROWTHBOOK_MONITOR_PATH         Override cache file path.
+#                                      Default: macOS / Linux auto.
+#   CC_GROWTHBOOK_MONITOR_STATE_DIR    Override snapshot dir.
+#                                      Default: $XDG_STATE_HOME or
+#                                      $HOME/.local/state.
+#   CC_GROWTHBOOK_MONITOR_FULL         Store full values in
+#                                      snapshot (forensic mode).
+#                                      Default: off (digest only).
+#   CC_GROWTHBOOK_MONITOR_QUIET        Suppress the no-change line
+#                                      shown on first run / no diff.
+#   CC_GROWTHBOOK_MONITOR_LOG          Append snapshot events to
+#                                      this file (default off).
+#
+# USAGE:
+# {
+#   "hooks": {
+#     "SessionStart": [{
+#       "hooks": [{
+#         "type": "command",
+#         "command": "~/.claude/hooks/growthbook-flag-monitor.sh"
+#       }]
+#     }]
+#   }
+# }
+
+INPUT=$(cat 2>/dev/null || true)
+
+if [ "${CC_GROWTHBOOK_MONITOR_DISABLE:-}" = "1" ]; then
+    exit 0
+fi
+
+# Locate the cachedGrowthBookFeatures file.
+locate_cache() {
+    if [ -n "${CC_GROWTHBOOK_MONITOR_PATH:-}" ]; then
+        [ -f "$CC_GROWTHBOOK_MONITOR_PATH" ] && echo "$CC_GROWTHBOOK_MONITOR_PATH"
+        return 0
+    fi
+    # macOS Claude Desktop
+    if [ -f "$HOME/Library/Application Support/Claude/cachedGrowthBookFeatures" ]; then
+        echo "$HOME/Library/Application Support/Claude/cachedGrowthBookFeatures"; return 0
+    fi
+    # Linux Claude Desktop (XDG)
+    if [ -f "${XDG_CONFIG_HOME:-$HOME/.config}/Claude/cachedGrowthBookFeatures" ]; then
+        echo "${XDG_CONFIG_HOME:-$HOME/.config}/Claude/cachedGrowthBookFeatures"; return 0
+    fi
+    # ~/.claude.json carries cachedGrowthBookFeatures on some Claude Code variants
+    if [ -f "$HOME/.claude.json" ] && grep -q "cachedGrowthBookFeatures" "$HOME/.claude.json" 2>/dev/null; then
+        echo "$HOME/.claude.json"; return 0
+    fi
+    return 1
+}
+
+CACHE_FILE=$(locate_cache)
+if [ -z "$CACHE_FILE" ]; then
+    # No GrowthBook cache found — operator is on CLI or has the file disabled.
+    exit 0
+fi
+
+if ! command -v jq >/dev/null 2>&1; then
+    echo "[growthbook-flag-monitor] jq not available; skipping (install jq to enable)" >&2
+    exit 0
+fi
+
+STATE_DIR="${CC_GROWTHBOOK_MONITOR_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/cc-safe-setup/growthbook-flag-monitor}"
+mkdir -p "$STATE_DIR" 2>/dev/null
+SNAPSHOT_FILE="$STATE_DIR/snapshot.json"
+
+# Build a normalised flag manifest. The cache file is either:
+#   - a JSON object {flag_name: {value: ...}, ...} (Desktop variants)
+#   - the full ~/.claude.json with cachedGrowthBookFeatures nested.
+extract_flags() {
+    # First try the direct object form
+    local payload
+    payload=$(jq -c '.cachedGrowthBookFeatures // .' "$CACHE_FILE" 2>/dev/null)
+    if [ -z "$payload" ] || [ "$payload" = "null" ]; then
+        echo "{}"
+        return 1
+    fi
+    # Normalise to {flag_name: digest_of_value}
+    echo "$payload" | jq -c '
+        if type == "object" then
+            to_entries
+            | map({key: .key, value: (.value | tostring | @base64)})
+            | from_entries
+        else
+            {}
+        end
+    ' 2>/dev/null || echo "{}"
+}
+
+CURRENT=$(extract_flags)
+if [ -z "$CURRENT" ] || [ "$CURRENT" = "{}" ]; then
+    # File present but no flag data — silent skip.
+    exit 0
+fi
+
+# First run: snapshot and emit baseline notice.
+if [ ! -f "$SNAPSHOT_FILE" ]; then
+    if [ "${CC_GROWTHBOOK_MONITOR_FULL:-}" = "1" ]; then
+        jq -c '.cachedGrowthBookFeatures // .' "$CACHE_FILE" > "$SNAPSHOT_FILE" 2>/dev/null
+    else
+        echo "$CURRENT" > "$SNAPSHOT_FILE"
+    fi
+    if [ -z "${CC_GROWTHBOOK_MONITOR_QUIET:-}" ]; then
+        FLAG_COUNT=$(echo "$CURRENT" | jq 'length' 2>/dev/null)
+        echo "[growthbook-flag-monitor] baseline snapshot recorded: ${FLAG_COUNT} flags in ${CACHE_FILE}" >&2
+    fi
+    if [ -n "${CC_GROWTHBOOK_MONITOR_LOG:-}" ]; then
+        mkdir -p "$(dirname "$CC_GROWTHBOOK_MONITOR_LOG")" 2>/dev/null
+        echo "$(date -Iseconds) event=baseline cache=${CACHE_FILE} flags=${FLAG_COUNT}" >> "$CC_GROWTHBOOK_MONITOR_LOG"
+    fi
+    exit 0
+fi
+
+PREVIOUS=$(cat "$SNAPSHOT_FILE" 2>/dev/null)
+if [ "${CC_GROWTHBOOK_MONITOR_FULL:-}" = "1" ]; then
+    # Compare full values
+    PREVIOUS=$(echo "$PREVIOUS" | jq -c '
+        if type == "object" then
+            to_entries | map({key: .key, value: (.value | tostring | @base64)}) | from_entries
+        else {} end
+    ' 2>/dev/null)
+fi
+
+# Compute diff using jq set operations
+DIFF=$(jq -n --argjson prev "$PREVIOUS" --argjson curr "$CURRENT" '
+    {
+        added: (($curr | keys) - ($prev | keys)),
+        removed: (($prev | keys) - ($curr | keys)),
+        changed: [
+            ($curr | keys | .[]) as $k
+            | select(($prev | has($k)) and ($prev[$k] != $curr[$k]))
+            | $k
+        ]
+    }
+' 2>/dev/null)
+
+ADDED=$(echo "$DIFF" | jq -r '.added | length' 2>/dev/null)
+REMOVED=$(echo "$DIFF" | jq -r '.removed | length' 2>/dev/null)
+CHANGED=$(echo "$DIFF" | jq -r '.changed | length' 2>/dev/null)
+TOTAL=$((${ADDED:-0} + ${REMOVED:-0} + ${CHANGED:-0}))
+
+if [ "$TOTAL" -eq 0 ]; then
+    if [ -z "${CC_GROWTHBOOK_MONITOR_QUIET:-}" ]; then
+        FLAG_COUNT=$(echo "$CURRENT" | jq 'length' 2>/dev/null)
+        echo "[growthbook-flag-monitor] no GrowthBook flag changes since last session (${FLAG_COUNT} flags tracked)" >&2
+    fi
+    exit 0
+fi
+
+# Emit diff advisory
+cat >&2 <<EOF
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+[growthbook-flag-monitor] SessionStart — GrowthBook flag set changed
+Cache file: ${CACHE_FILE}
+Cluster 10 (server-pushed flag overrides). Anthropic syncs flags
+on a ~9-minute cadence; local edits do not persist across syncs.
+
+Changes since last session:
+  added:   ${ADDED}
+  removed: ${REMOVED}
+  changed: ${CHANGED}
+EOF
+
+if [ "${ADDED:-0}" -gt 0 ]; then
+    echo "" >&2
+    echo "  ADDED:" >&2
+    echo "$DIFF" | jq -r '.added[] | "    + " + .' >&2
+fi
+if [ "${REMOVED:-0}" -gt 0 ]; then
+    echo "" >&2
+    echo "  REMOVED:" >&2
+    echo "$DIFF" | jq -r '.removed[] | "    - " + .' >&2
+fi
+if [ "${CHANGED:-0}" -gt 0 ]; then
+    echo "" >&2
+    echo "  CHANGED:" >&2
+    echo "$DIFF" | jq -r '.changed[] | "    ~ " + .' >&2
+fi
+
+cat >&2 <<'EOF'
+
+Verify your permissions.defaultMode and other settings.json values
+are still what you expect. Server-pushed flags (e.g.
+tengu_permission_friction, tengu_quill_harbor, tengu_compact_cache_prefix)
+have been observed silently overriding client behavior.
+Issue: https://github.com/anthropics/claude-code/issues/62205
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+EOF
+
+# Update the snapshot for the next session
+if [ "${CC_GROWTHBOOK_MONITOR_FULL:-}" = "1" ]; then
+    jq -c '.cachedGrowthBookFeatures // .' "$CACHE_FILE" > "$SNAPSHOT_FILE" 2>/dev/null
+else
+    echo "$CURRENT" > "$SNAPSHOT_FILE"
+fi
+
+if [ -n "${CC_GROWTHBOOK_MONITOR_LOG:-}" ]; then
+    mkdir -p "$(dirname "$CC_GROWTHBOOK_MONITOR_LOG")" 2>/dev/null
+    echo "$(date -Iseconds) event=diff added=${ADDED} removed=${REMOVED} changed=${CHANGED}" >> "$CC_GROWTHBOOK_MONITOR_LOG"
+fi
+
+exit 0

package/examples/hallucination-url-check.sh

@@ -22,7 +22,7 @@
 # }
 # ================================================================
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PostToolUse  MATCHER: "Write|Edit"
 
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)