cc-safe-setup 29.7.0 → 30.0.4

package/examples/mcp-routine-approval-detector.sh

@@ -0,0 +1,154 @@
+#!/bin/bash
+# mcp-routine-approval-detector.sh — Surface the May 2026 routine-approval cluster
+#
+# PROBLEM (cluster, active since ~2026-05-20):
+#   Scheduled and Remote Claude.ai Routines silently fail every MCP tool call
+#   on Anthropic-hosted connectors (Gmail, Calendar, Microsoft 365, Notion,
+#   Slack, Datadog, Atlassian, Snowflake, Linear, Granola) with:
+#
+#     Streamable HTTP error: Error POSTing to endpoint:
+#     MCP tool call requires approval
+#
+#   Cluster anchors: #61015 (52r/40c), #61027 (33r/18c), #61097 (6r/11c,
+#   has architectural fix proposal), #61044 (3r/3c, open).
+#
+#   The routine has no UI surface to approve the prompt, so the call becomes
+#   a permanent no-op. Custom user-registered MCP servers work fine in the
+#   same routine — the bug is scoped to the CCR proxy's approval gate.
+#
+# HOW THIS HELPS:
+#   PostToolUse hook on mcp__* matcher. Reads tool_result. If the error
+#   string matches the cluster signature, writes a structured diagnostic
+#   receipt under ~/.claude/state/mcp-routine-approval-blocks/ and emits
+#   a stderr warning so the operator sees the silent failure.
+#
+#   The hook does NOT block the failure — the call has already failed on
+#   the server side. The hook surfaces it.
+#
+# RECEIPT FORMAT (one JSON file per block):
+#   {
+#     "blocked_at": "2026-05-25T12:00:00Z",
+#     "tool_name": "mcp__claude_ai_Gmail__search_threads",
+#     "server": "claude_ai_Gmail",
+#     "operation": "search_threads",
+#     "session_id": "<from input>",
+#     "error_excerpt": "Streamable HTTP error: ..."
+#   }
+#
+# CONFIG (all optional):
+#   CC_MCP_ROUTINE_BLOCK_DIR        receipt directory (default: ~/.claude/state/mcp-routine-approval-blocks)
+#   CC_MCP_ROUTINE_BLOCK_DISABLE=1  skip the hook entirely
+#   CC_MCP_ROUTINE_BLOCK_WEBHOOK    if set to a URL, POST a JSON body on each block
+#   CC_MCP_ROUTINE_BLOCK_QUIET=1    suppress the stderr warning (still writes receipt)
+#
+# TRIGGER: PostToolUse
+# MATCHER: mcp__.*
+#
+# OPERATOR NEXT STEPS (printed in stderr warning):
+#   - Confirm cluster signature via the Fallback Architecture Gist:
+#     https://gist.github.com/yurukusa/7ed7176a8e79ea4635995d717b9af703
+#   - Subscribe to the open anchor for the fix-landed signal:
+#     https://github.com/anthropics/claude-code/issues/61044
+#   - Aggregate receipts to see how many blocks happened today:
+#     find ~/.claude/state/mcp-routine-approval-blocks -mtime -1 | wc -l
+
+set -u
+
+[ "${CC_MCP_ROUTINE_BLOCK_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat)
+
+# Need jq for structured field extraction; silent skip if missing
+if ! command -v jq >/dev/null 2>&1; then
+    exit 0
+fi
+
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ -z "$TOOL" ] && exit 0
+
+# Only inspect MCP tool calls
+case "$TOOL" in
+    mcp__*) ;;
+    *) exit 0 ;;
+esac
+
+# Extract the tool result text (could be string or structured)
+RESULT_TEXT=$(printf '%s' "$INPUT" | jq -r '
+    .tool_result // .tool_response // "" |
+    if type == "string" then .
+    elif type == "object" then (.content // .text // .error // "" | tostring)
+    elif type == "array" then map(tostring) | join(" ")
+    else tostring end
+' 2>/dev/null)
+
+[ -z "$RESULT_TEXT" ] && exit 0
+
+# Cluster signature: the exact error string the four anchor issues report
+SIG_PRIMARY="MCP tool call requires approval"
+SIG_SECONDARY="Streamable HTTP error"
+
+# Both signatures present = high-confidence cluster match
+if ! printf '%s' "$RESULT_TEXT" | grep -qF "$SIG_PRIMARY"; then
+    exit 0
+fi
+
+# At this point we have a confirmed cluster hit. Write a receipt.
+RECEIPT_DIR="${CC_MCP_ROUTINE_BLOCK_DIR:-${HOME}/.claude/state/mcp-routine-approval-blocks}"
+if ! mkdir -p "$RECEIPT_DIR" 2>/dev/null; then
+    # State dir not writable — silent skip per the existing-hook convention
+    exit 0
+fi
+
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+# Server / operation extraction. Tool names look like mcp__<server>__<operation>
+# where server can itself contain underscores (e.g. claude_ai_Gmail).
+# The separator is the double underscore __, not a single _.
+TOOL_REST="${TOOL#mcp__}"
+SERVER="${TOOL_REST%%__*}"
+OPERATION="${TOOL_REST#*__}"
+
+# Truncate error excerpt to keep receipt files small
+ERROR_EXCERPT=$(printf '%s' "$RESULT_TEXT" | head -c 400)
+
+# Receipt filename: timestamp + tool + short hash of error
+SAFE_TOOL=$(printf '%s' "$TOOL" | tr -c 'A-Za-z0-9_-' '_')
+RECEIPT_NAME="${TIMESTAMP//:/-}-${SAFE_TOOL}.json"
+RECEIPT_PATH="${RECEIPT_DIR}/${RECEIPT_NAME}"
+
+if jq -nc \
+    --arg ts "$TIMESTAMP" \
+    --arg tool "$TOOL" \
+    --arg server "$SERVER" \
+    --arg op "$OPERATION" \
+    --arg sid "$SESSION_ID" \
+    --arg err "$ERROR_EXCERPT" \
+    '{blocked_at: $ts, tool_name: $tool, server: $server, operation: $op, session_id: $sid, error_excerpt: $err}' \
+    > "$RECEIPT_PATH" 2>/dev/null; then
+    :
+else
+    # Receipt write failed — silent skip
+    exit 0
+fi
+
+# Optional webhook
+if [ -n "${CC_MCP_ROUTINE_BLOCK_WEBHOOK:-}" ] && command -v curl >/dev/null 2>&1; then
+    curl -s --max-time 5 -X POST \
+        -H "Content-Type: application/json" \
+        --data-binary "@${RECEIPT_PATH}" \
+        "$CC_MCP_ROUTINE_BLOCK_WEBHOOK" >/dev/null 2>&1 || true
+fi
+
+# Stderr warning unless quiet
+if [ "${CC_MCP_ROUTINE_BLOCK_QUIET:-0}" != "1" ]; then
+    cat >&2 <<EOF
+mcp-routine-approval-detector: silent failure detected on $TOOL
+  → cluster: #61015 / #61027 / #61097 / #61044 (May 2026 routine-approval regression)
+  → receipt: $RECEIPT_PATH
+  → fallback architecture: https://gist.github.com/yurukusa/7ed7176a8e79ea4635995d717b9af703
+  → fix-landed signal: https://github.com/anthropics/claude-code/issues/61044
+EOF
+fi
+
+exit 0

package/examples/mcp-server-allowlist.sh

@@ -16,6 +16,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-mcp-server-allowlist-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [mcp-server-allowlist]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 [ -z "$TOOL" ] && exit 0

package/examples/mcp-server-guard.sh

@@ -23,6 +23,18 @@
 #   }
 # }
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-mcp-server-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [mcp-server-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 

package/examples/mcp-startup-bloat-detector.sh

@@ -0,0 +1,87 @@
+#!/bin/bash
+# ================================================================
+# mcp-startup-bloat-detector.sh — Warn when claude.ai connector
+#   sync inflates the System tools context at session start.
+# ================================================================
+# PURPOSE:
+#   Pro / Claude.ai-OAuth users inherit every connector configured
+#   on their claude.ai account into every CLI session. The MCP
+#   tool definitions and authentication entries each consume
+#   ~250-330 tokens of context, and at scale they can dominate
+#   the context window before the user has typed anything.
+#
+# TRIGGER: SessionStart
+# MATCHER: (none)
+#
+# WHY THIS MATTERS:
+#   Issue #50062 (closed 2026-04-19) reported ~100k tokens of
+#   silent connector bloat; the v2.1.14 fix added the
+#   ENABLE_CLAUDEAI_MCP_SERVERS=false escape hatch.
+#
+#   Issue #57235 (filed 2026-05-08, v2.1.133) reports the same
+#   pattern at 2.9M tokens — 29x larger — leaving /context at
+#   1,460% before the first user turn. Either the v2.1.14 fix
+#   regressed, or a new path bypasses it.
+#
+#   This detector reads claude mcp list and warns when the count
+#   of claude.ai-prefixed connectors crosses a threshold, giving
+#   users a chance to set ENABLE_CLAUDEAI_MCP_SERVERS=false
+#   before the bloat hurts them.
+#
+# CONFIGURATION:
+#   MCP_BLOAT_THRESHOLD_COUNT  number of claude.ai connectors to
+#                              trigger warning (default: 5)
+#   MCP_BLOAT_DETECTOR_DISABLE set to 1 to silence this hook
+#
+# RELATED ISSUES:
+#   https://github.com/anthropics/claude-code/issues/50062
+#   https://github.com/anthropics/claude-code/issues/57235
+# ================================================================
+
+set -u
+
+[ "${MCP_BLOAT_DETECTOR_DISABLE:-0}" = "1" ] && exit 0
+
+THRESHOLD="${MCP_BLOAT_THRESHOLD_COUNT:-5}"
+LOG_DIR="${HOME}/.claude/logs"
+mkdir -p "$LOG_DIR" 2>/dev/null
+
+INPUT=$(cat 2>/dev/null || true)
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)
+[ -z "$SESSION_ID" ] && SESSION_ID="unknown-$(date +%s)"
+
+# One warning per session
+WARN_LOG="$LOG_DIR/mcp-bloat-warned-$SESSION_ID"
+[ -f "$WARN_LOG" ] && exit 0
+
+# Need claude binary to inspect MCP state
+if ! command -v claude >/dev/null 2>&1; then
+    exit 0
+fi
+
+# Count claude.ai-prefixed connectors. The CLI prints one per line as:
+#   claude.ai <Name>: <url> - <status>
+MCP_OUTPUT=$(claude mcp list 2>/dev/null || true)
+[ -z "$MCP_OUTPUT" ] && exit 0
+
+COUNT=$(printf '%s\n' "$MCP_OUTPUT" | grep -cE '^claude\.ai[[:space:]]' || true)
+COUNT=${COUNT:-0}
+
+if [ "$COUNT" -ge "$THRESHOLD" ]; then
+    EST_TOKENS=$((COUNT * 290))
+    cat >&2 <<MSG
+mcp-startup-bloat-detector: $COUNT claude.ai connectors auto-loaded
+  (estimated ~${EST_TOKENS} tokens of context overhead at ~290 tokens each).
+
+  If /context shows an unusually high "System tools" load, set
+  ENABLE_CLAUDEAI_MCP_SERVERS=false in your shell, remove
+  ~/.claude/.credentials.json, and re-run /login. OAuth stays;
+  the connector sync is what gets disabled.
+
+  Background: Issue #50062 (closed v2.1.14, ~100k tokens) and
+  Issue #57235 (filed 2026-05-08 v2.1.133, ~2.9M tokens).
+MSG
+    touch "$WARN_LOG"
+fi
+
+exit 0

package/examples/mcp-stdio-compatibility-test.sh

@@ -0,0 +1,153 @@
+#!/bin/bash
+# mcp-stdio-compatibility-test.sh — MCP regression test harness (Incident 8)
+# Why: v2.1.105 changed PreToolUse additionalContext + stdio framing and
+#      broke MCP servers that had worked on v2.1.104. The regression was
+#      largely fixed by v2.1.118 but custom MCP servers still need
+#      re-validation after every Claude Code upgrade. This harness
+#      exercises every MCP server registered in your settings against a
+#      known-good suite of calls so you can distinguish "MCP regression"
+#      from "auth expired" / "external resource down."
+# Event: standalone CLI, not a Claude Code hook.
+# Usage:   bash examples/mcp-stdio-compatibility-test.sh [path-to-settings.json]
+#          (defaults to ~/.claude/settings.json)
+# Exit:    0 if all servers OK; 1 if one or more regressions (parse errors,
+#          stdio framing failures). Non-regression failures (auth, network)
+#          are reported as [AUTH] or [NET] and do not set exit code 1.
+
+set -u
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-mcp-stdio-compatibility-test-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [mcp-stdio-compatibility-test]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+SETTINGS="${1:-${HOME}/.claude/settings.json}"
+LOG_DIR="${HOME}/.claude/logs"
+LOG_FILE="${LOG_DIR}/mcp-compat.log"
+mkdir -p "$LOG_DIR" 2>/dev/null
+
+if [ ! -r "$SETTINGS" ]; then
+  echo "mcp-stdio-compatibility-test: settings file not readable: $SETTINGS" >&2
+  exit 2
+fi
+
+# Reject malformed JSON up front so a parse failure isn't reported as
+# "nothing to test" — that would mask a broken config and exit 0.
+if ! jq empty "$SETTINGS" 2>/dev/null; then
+  echo "mcp-stdio-compatibility-test: settings file is not valid JSON: $SETTINGS" >&2
+  exit 2
+fi
+
+if ! jq -e '.mcpServers // empty' "$SETTINGS" >/dev/null 2>&1; then
+  echo "[info] no mcpServers block in $SETTINGS — nothing to test"
+  exit 0
+fi
+
+# Pick whichever timeout binary is available; macOS ships only `gtimeout`
+# via coreutils, while Linux usually has `timeout`. Without one of these
+# a misbehaving server could hang the whole probe loop, so fall back to
+# a no-timeout invocation only when we have warned the operator.
+if command -v timeout >/dev/null 2>&1; then
+  TIMEOUT_CMD="timeout"
+elif command -v gtimeout >/dev/null 2>&1; then
+  TIMEOUT_CMD="gtimeout"
+else
+  TIMEOUT_CMD=""
+  echo "[warn] no timeout/gtimeout in PATH — server probes may hang on misbehaving servers" >&2
+fi
+
+SERVERS=$(jq -r '.mcpServers | keys[]' "$SETTINGS" 2>/dev/null)
+if [ -z "$SERVERS" ]; then
+  echo "[info] mcpServers block is empty — nothing to test"
+  exit 0
+fi
+
+REGRESSION_COUNT=0
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+# Each MCP server speaks JSON-RPC over stdio. A viable smoke test is to
+# send the initialize request and verify the server replies with a valid
+# JSON-RPC response containing serverInfo. Parse errors or non-JSON
+# output indicate the v2.1.105-class regression.
+send_initialize() {
+  local cmd="$1"
+  local args_json="$2"
+  local args_array=()
+  if [ -n "$args_json" ] && [ "$args_json" != "null" ]; then
+    while IFS= read -r a; do args_array+=("$a"); done < <(printf '%s' "$args_json" | jq -r '.[]' 2>/dev/null)
+  fi
+  local init_req='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"cc-safe-setup-compat-test","version":"1.0"}}}'
+  if [ -n "$TIMEOUT_CMD" ]; then
+    printf '%s\n' "$init_req" | "$TIMEOUT_CMD" 5 "$cmd" "${args_array[@]}" 2>&1
+  else
+    printf '%s\n' "$init_req" | "$cmd" "${args_array[@]}" 2>&1
+  fi
+}
+
+for name in $SERVERS; do
+  CMD=$(jq -r ".mcpServers[\"$name\"].command // empty" "$SETTINGS" 2>/dev/null)
+  ARGS=$(jq -c ".mcpServers[\"$name\"].args // []" "$SETTINGS" 2>/dev/null)
+  if [ -z "$CMD" ]; then
+    echo "[skip] $name: no command field"
+    printf '%s\t%s\t%s\n' "$TS" "$name" "skip-no-command" >> "$LOG_FILE"
+    continue
+  fi
+  if ! command -v "$CMD" >/dev/null 2>&1 && [ ! -x "$CMD" ]; then
+    echo "[skip] $name: command not executable ($CMD)"
+    printf '%s\t%s\t%s\n' "$TS" "$name" "skip-not-executable" >> "$LOG_FILE"
+    continue
+  fi
+  OUTPUT=$(send_initialize "$CMD" "$ARGS" 2>&1) || true
+  RESPONSE=$(printf '%s' "$OUTPUT" | grep -m1 '"jsonrpc"' || true)
+  if [ -z "$RESPONSE" ]; then
+    echo "[FAIL] $name: no JSON-RPC response (regression candidate)"
+    printf '%s\t%s\t%s\n' "$TS" "$name" "regression-no-response" >> "$LOG_FILE"
+    REGRESSION_COUNT=$((REGRESSION_COUNT + 1))
+    continue
+  fi
+  if ! printf '%s' "$RESPONSE" | jq -e . >/dev/null 2>&1; then
+    echo "[FAIL] $name: non-JSON response (v2.1.105-class regression)"
+    printf '%s\t%s\t%s\n' "$TS" "$name" "regression-parse-error" >> "$LOG_FILE"
+    REGRESSION_COUNT=$((REGRESSION_COUNT + 1))
+    continue
+  fi
+  ERR=$(printf '%s' "$RESPONSE" | jq -r '.error.code // empty' 2>/dev/null)
+  if [ -n "$ERR" ]; then
+    MSG=$(printf '%s' "$RESPONSE" | jq -r '.error.message // ""' 2>/dev/null)
+    case "$MSG" in
+      *auth*|*Auth*|*AUTH*|*permission*|*Permission*)
+        echo "[AUTH] $name: $MSG"
+        printf '%s\t%s\t%s\n' "$TS" "$name" "auth-$ERR" >> "$LOG_FILE"
+        ;;
+      *network*|*timeout*|*connect*|*DNS*)
+        echo "[NET]  $name: $MSG"
+        printf '%s\t%s\t%s\n' "$TS" "$name" "network-$ERR" >> "$LOG_FILE"
+        ;;
+      *)
+        echo "[FAIL] $name: error $ERR — $MSG"
+        printf '%s\t%s\t%s\n' "$TS" "$name" "regression-error-$ERR" >> "$LOG_FILE"
+        REGRESSION_COUNT=$((REGRESSION_COUNT + 1))
+        ;;
+    esac
+    continue
+  fi
+  echo "[ok]   $name"
+  printf '%s\t%s\t%s\n' "$TS" "$name" "ok" >> "$LOG_FILE"
+done
+
+if [ "$REGRESSION_COUNT" -gt 0 ]; then
+  echo
+  echo "$REGRESSION_COUNT MCP server(s) have regressions. Review the log:"
+  echo "  $LOG_FILE"
+  echo "Consider pinning an older Claude Code version:"
+  echo "  npm install -g @anthropic-ai/claude-code@2.1.104"
+  exit 1
+fi
+exit 0

package/examples/mcp-tool-guard.sh

@@ -1,9 +1,50 @@
 #!/bin/bash
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# mcp-tool-guard.sh — Guard destructive / side-effecting MCP tool calls.
+#
+# TRIGGER: PreToolUse
+# MATCHER: ".*"   (fires on every tool; the hook self-filters to mcp__ tools.
+#                  NOTE: the previous "Bash" matcher was wrong — a Bash matcher
+#                  never sees an mcp__ tool name, so the hook never fired.)
+#
+# Why this exists: an MCP tool can perform a destructive action whose tool NAME
+#   looks harmless. The clearest case is browser automation: a model in an
+#   auto-approve mode calls e.g. mcp__playwright__browser_click on a "delete"
+#   confirmation button and removes production data with no prompt (anthropics/
+#   claude-code#65563). The tool name ("browser_click") contains no destructive
+#   word, so name-based detection alone misses it.
+#
+# CONFIG (all opt-in; defaults preserve the original warn-only behavior):
+#   CC_MCP_WARN_ALL=1            Log every MCP tool call.
+#   CC_MCP_BLOCKED_TOOLS="a,b"   Hard-block (exit 2) MCP tools matching these.
+#   CC_MCP_PROD_HOSTS="h1,h2"    Deny any MCP call whose input references these
+#                                 hosts/paths. Reliable for browser navigate
+#                                 (the target URL is in tool_input) — keeps an
+#                                 "investigation" from reaching production.
+#   CC_MCP_AUTOMATION_GUARD=off|warn|ask|block   (default: warn)
+#                                 How to treat automation tools (click/navigate/
+#                                 fill/type/...) while a permission mode is
+#                                 auto-approving. warn=stderr note; ask=prompt;
+#                                 block=exit 2. Addresses #65563's root cause.
+#   CC_MCP_AUTOMATION_TOOLS="click,navigate,fill,type,press,submit,upload"
+#                                 Tool-name substrings treated as automation.
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-mcp-tool-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [mcp-tool-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 echo "$TOOL" | grep -q '^mcp__' || exit 0
+MODE=$(echo "$INPUT" | jq -r '.permission_mode // empty' 2>/dev/null)
+INPUT_BLOB=$(echo "$INPUT" | jq -r '.tool_input | tostring' 2>/dev/null)
 if [ "${CC_MCP_WARN_ALL:-0}" = "1" ]; then
     echo "NOTE: MCP tool call: $TOOL" >&2
 fi
@@ -18,6 +59,65 @@ if [ -n "$BLOCKED" ]; then
         fi
     done
 fi
+
+# Deny any MCP call that references a configured production host/path. For
+# browser navigate tools the destination URL is in tool_input, so this reliably
+# stops an "investigation" session from reaching production data.
+PROD="${CC_MCP_PROD_HOSTS:-}"
+if [ -n "$PROD" ] && [ -n "$INPUT_BLOB" ]; then
+    IFS=',' read -ra HOSTS <<< "$PROD"
+    for h in "${HOSTS[@]}"; do
+        h=$(echo "$h" | xargs)
+        [ -z "$h" ] && continue
+        if printf '%s' "$INPUT_BLOB" | grep -qiF "$h"; then
+            printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"MCP tool %s targets a production host (%s). Investigate against staging/local, not production."}}\n' "$TOOL" "$h"
+            exit 0
+        fi
+    done
+fi
+
+# #65563: while a permission mode is auto-approving, an automation tool can
+# perform a destructive UI action (e.g. clicking a delete button) that the tool
+# name does not reveal. Escalate such tools so a click cannot auto-run.
+GUARD="${CC_MCP_AUTOMATION_GUARD:-warn}"
+if [ "$GUARD" != "off" ]; then
+    case "$MODE" in
+        acceptEdits|bypassPermissions|auto|dontAsk)
+            AUTOM="${CC_MCP_AUTOMATION_TOOLS:-click,navigate,fill,type,press,submit,upload}"
+            IFS=',' read -ra ATOOLS <<< "$AUTOM"
+            for a in "${ATOOLS[@]}"; do
+                a=$(echo "$a" | xargs)
+                [ -z "$a" ] && continue
+                if [[ "$TOOL" == *"$a"* ]]; then
+                    case "$GUARD" in
+                        # VERSION NOTE (measured 2026-08-13 on 2.1.228; this
+                        # comment previously claimed the opposite): #77212
+                        # reported "ask" being silently auto-approved under
+                        # bypassPermissions — the very mode this branch fires
+                        # in. It does not reproduce on 2.1.228: interactively,
+                        # the confirmation appears under both
+                        # --dangerously-skip-permissions and
+                        # --permission-mode auto. Control: with the hook removed
+                        # both modes ran unprompted, so the mode was in effect.
+                        # Older builds may differ. Use
+                        # CC_MCP_AUTOMATION_GUARD=block when no operator is
+                        # present to answer; block is enforced in every mode.
+                        ask)
+                            printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"Confirm MCP automation action %s — permission mode %s is auto-approving."}}\n' "$TOOL" "$MODE"
+                            exit 0 ;;
+                        block)
+                            echo "BLOCKED: MCP automation tool $TOOL under auto-approve mode $MODE. Re-run in default mode so the action is confirmed." >&2
+                            exit 2 ;;
+                        *)
+                            echo "WARNING: MCP automation tool $TOOL is running under auto-approve mode $MODE — a UI action could change data without a prompt." >&2 ;;
+                    esac
+                    break
+                fi
+            done
+            ;;
+    esac
+fi
+
 case "$TOOL" in
     *delete*|*remove*|*drop*|*destroy*|*purge*)
         echo "WARNING: Potentially destructive MCP tool: $TOOL" >&2

package/examples/memory-chain-audit.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# memory-chain-audit.sh — extractMemories double-cache detector (Incident 7)
+# Why: Claude Code's extractMemories feature fires a background call at the
+#      end of each turn to update persistent memory. When the default is ON,
+#      this background call carries its own cache chain that roughly doubles
+#      the API cost per turn. Users who have not set
+#      CLAUDE_CODE_DISABLE_AUTO_MEMORY=1 are paying for the feature silently.
+# Event: PostToolUse  MATCHER: "*"   (the extractMemories background call
+#                                     fires as a Stop-event after the turn,
+#                                     so we observe it one turn later)
+# Action: Log cumulative main-chain vs extractMemories-chain cost per session.
+#         If the ratio is consistently ≥ 1 (extractMemories costs match or
+#         exceed the main chain), the log shows the user that the feature is
+#         doubling their bill.
+#
+# Review with:
+#   awk -F'\t' '{ main+=$3; mem+=$4 } END { if (main>0) printf "main=%d mem=%d ratio=%.2f\n", main, mem, mem/main }' \
+#     ~/.claude/logs/memory-chain.log
+#
+# If the ratio is near or above 1 and you do not actively rely on auto-memory,
+# set CLAUDE_CODE_DISABLE_AUTO_MEMORY=1 in your shell rc.
+
+set -u
+
+LOG_DIR="${HOME}/.claude/logs"
+LOG_FILE="${LOG_DIR}/memory-chain.log"
+mkdir -p "$LOG_DIR" 2>/dev/null
+
+INPUT=$(cat)
+
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "unknown"' 2>/dev/null)
+[ "$SESSION_ID" = "unknown" ] && exit 0
+
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+[ -z "$TRANSCRIPT" ] && exit 0
+[ ! -r "$TRANSCRIPT" ] && exit 0
+
+# Main-chain cost = total input+output for the last assistant turn tagged
+# "main". extractMemories-chain cost = the same for the last turn tagged as
+# a memory call. Tags differ between client versions; we match on the
+# presence of "extractMemories" / "memory" in the request metadata.
+
+MAIN=$(tac "$TRANSCRIPT" 2>/dev/null \
+       | grep -m1 '"type":"assistant"' \
+       | jq -r '(.message.usage.input_tokens // 0) + (.message.usage.output_tokens // 0)' 2>/dev/null)
+
+MEM=$(grep 'extractMemor\|"memory"' "$TRANSCRIPT" 2>/dev/null | tail -1 \
+      | jq -r '(.message.usage.input_tokens // 0) + (.message.usage.output_tokens // 0)' 2>/dev/null)
+
+MAIN=${MAIN:-0}
+MEM=${MEM:-0}
+
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+printf '%s\t%s\t%s\t%s\n' "$TS" "$SESSION_ID" "$MAIN" "$MEM" >> "$LOG_FILE"
+
+exit 0