cc-safe-setup 29.7.0 → 30.0.4

package/examples/no-console-log-commit.sh

@@ -24,6 +24,18 @@
 # }
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-console-log-commit-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-console-log-commit]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/no-cors-wildcard.sh

@@ -1,10 +1,13 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
 [[ -z "$FILE" ]] && exit 0
 [[ ! -f "$FILE" ]] && exit 0
-if grep -qP "origin:\s*['\"]?\*['\"]?|Access-Control-Allow-Origin.*\*|cors\(\)" "$FILE" 2>/dev/null; then
+# -P は GNU 拡張で、macOS の BSD grep では grep 自体がエラーになり警告が黙って消える。
+# 内容は POSIX の拡張正規表現で書けるので -E にする（\s → [[:space:]]）。
+if grep -qE "origin:[[:space:]]*['\"]?\*['\"]?|Access-Control-Allow-Origin.*\*|cors\(\)" "$FILE" 2>/dev/null; then
     echo "WARNING: Wildcard CORS origin in $(basename "$FILE")." >&2
     echo "cors(*) allows any website to call your API." >&2
     echo "Specify allowed origins explicitly." >&2

package/examples/no-dangling-await.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/no-debug-commit.sh

@@ -26,6 +26,18 @@
 # The "if" field (v2.1.85+) skips this hook for non-commit commands.
 # Without "if", the hook still works — it checks internally and exits early.
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-debug-commit-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-debug-commit]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/no-deep-relative-import.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/no-deploy-friday.sh

@@ -1,7 +1,19 @@
 #!/bin/bash
 # no-deploy-friday.sh — Block deploys on Fridays
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
 # "Don't deploy on Friday" — every ops team ever
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-deploy-friday-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-deploy-friday]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 DOW=$(date +%u)  # 5 = Friday

package/examples/no-eval-template.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)
@@ -5,7 +6,8 @@ FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
 [[ -z "$FILE" ]] && exit 0
 [[ ! -f "$FILE" ]] && exit 0
 case "$FILE" in *.ts|*.js|*.tsx|*.jsx) ;; *) exit 0 ;; esac
-if grep -qP 'eval\s*\(`|new Function\s*\(`' "$FILE" 2>/dev/null; then
+# -P は GNU 拡張。BSD grep では警告が黙って消えるので -E にする。
+if grep -qE 'eval[[:space:]]*\(`|new Function[[:space:]]*\(`' "$FILE" 2>/dev/null; then
     echo "WARNING: eval() or new Function() with template literal." >&2
     echo "File: $(basename "$FILE")" >&2
     echo "This is a code injection risk." >&2

package/examples/no-fixme-ship.sh

@@ -17,6 +17,18 @@
 #   }
 # }
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-fixme-ship-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-fixme-ship]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/no-force-flag.sh

@@ -11,9 +11,21 @@
 #   - docker system prune --force (removes all unused data)
 #
 # TRIGGER: PreToolUse
-# MATCHER: "Bash"
+# MATCHER: "Bash|PowerShell"
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-force-flag-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-force-flag]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
@@ -25,10 +37,15 @@ if echo "$COMMAND" | grep -qE 'npm\s+install.*--force|npm\s+i\s.*--force'; then
     exit 2
 fi
 
-# git push --force (not --force-with-lease)
-if echo "$COMMAND" | grep -qE 'git\s+push.*--force($|\s)' && ! echo "$COMMAND" | grep -q 'force-with-lease'; then
-    echo "BLOCKED: git push --force can destroy remote history." >&2
-    echo "Use --force-with-lease for safer force-push." >&2
+# git push --force / -f (not --force-with-lease)
+# -f is git's official short form and is exactly equivalent to --force; the old
+# pattern only matched the long form, so `git push -f` slipped through entirely.
+# Require -f to be a standalone flag (preceded by whitespace) so a branch name
+# ending in "-f" (e.g. `git push origin feature-f`) is not falsely blocked.
+if echo "$COMMAND" | grep -qE 'git\s+push.*\s(-f\b|--force($|\s))' && ! echo "$COMMAND" | grep -q 'force-with-lease'; then
+    echo "BLOCKED: git push --force/-f can destroy remote history and overwrite others' commits." >&2
+    echo "If --force-with-lease just failed, that failure means someone else pushed changes you do not have locally." >&2
+    echo "Do NOT escalate to --force; run git fetch, then rebase/merge, then push again. (issue #70378)" >&2
     exit 2
 fi
 

package/examples/no-git-amend.sh

@@ -12,6 +12,18 @@
 # TRIGGER: PreToolUse
 # MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-git-amend-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-git-amend]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/no-global-install.sh

@@ -27,6 +27,18 @@
 # }
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-global-install-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-global-install]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/no-hardcoded-port.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/no-http-url.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/no-inline-styles.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/no-install-global.sh

@@ -1,6 +1,18 @@
 #!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-install-global-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-install-global]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 if echo "$COMMAND" | grep -qE 'npm\s+install\s+-g\s|npm\s+i\s+-g\s'; then

package/examples/no-mixed-line-endings.sh

@@ -3,5 +3,12 @@
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 CONTENT=$(cat | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)
 [ -z "$CONTENT" ] && exit 0
-if echo "$CONTENT" | grep -qP "\r\n" && echo "$CONTENT" | grep -qP "[^\r]\n"; then echo "NOTE: Mixed line endings (CRLF + LF)" >&2; fi
+# 元は grep -qP "\r\n" で CRLF を探していたが、grep は行単位で読んで行末の改行を
+# パターンに渡さないので、この式は -P があっても一度も一致しない（GNU grep で実測）。
+# 行の終わりに \r があるかどうかを行ごとに数える形へ変える。
+MIXED=$(printf '%s' "$CONTENT" | awk '
+    /\r$/ { crlf++; next }
+    { lf++ }
+    END { print (crlf > 0 && lf > 0) ? "yes" : "no" }')
+if [ "$MIXED" = "yes" ]; then echo "NOTE: Mixed line endings (CRLF + LF)" >&2; fi
 exit 0

package/examples/no-output-truncation.sh

@@ -22,6 +22,18 @@
 #   }
 # }
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-output-truncation-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-output-truncation]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0

package/examples/no-package-lock-edit.sh

@@ -1,6 +1,18 @@
 #!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-package-lock-edit-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-package-lock-edit]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 FILE=$(cat | jq -r '.tool_input.file_path // empty' 2>/dev/null)
 [ -z "$FILE" ] && exit 0
 case "$FILE" in */package-lock.json|*/yarn.lock|*/pnpm-lock.yaml|*/Cargo.lock)

package/examples/no-push-without-tests.sh

@@ -9,6 +9,18 @@
 # TRIGGER: PreToolUse
 # MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-push-without-tests-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-push-without-tests]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/no-root-user-docker.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/no-root-write.sh

@@ -1,6 +1,18 @@
 #!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-root-write-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-root-write]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 FILE=$(cat | jq -r '.tool_input.file_path // empty' 2>/dev/null)
 [ -z "$FILE" ] && exit 0
 case "$FILE" in /etc/*|/usr/*|/bin/*|/sbin/*|/boot/*|/sys/*|/proc/*)

package/examples/no-secrets-in-args.sh

@@ -1,9 +1,12 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0
-if echo "$COMMAND" | grep -qP '(--(password|token|secret|api-key|auth)\s*=?\s*\S{8,})|(-p\s+\S{8,})'; then
+# -P は GNU 拡張。BSD grep では、秘密情報が引数に出ていても警告が黙って消える。
+# \s → [[:space:]]、\S → [^[:space:]] で -E に置き換えられる。
+if echo "$COMMAND" | grep -qE '(--(password|token|secret|api-key|auth)[[:space:]]*=?[[:space:]]*[^[:space:]]{8,})|(-p[[:space:]]+[^[:space:]]{8,})'; then
     echo "WARNING: Possible secret in command arguments." >&2
     echo "Secrets in CLI args are visible in process listings and shell history." >&2
     echo "Use environment variables or stdin instead." >&2

package/examples/no-star-import-python.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/no-sudo-guard.sh

@@ -1,6 +1,18 @@
 #!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-sudo-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-sudo-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 if echo "$COMMAND" | grep -qE '^\s*sudo\s'; then

package/examples/no-todo-in-production.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 INPUT=$(cat)

package/examples/no-verify-blocker.sh

@@ -14,6 +14,18 @@
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-verify-blocker-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-verify-blocker]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/no-wget-piped-bash.sh

@@ -7,6 +7,18 @@
 # TRIGGER: PreToolUse
 # MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-no-wget-piped-bash-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [no-wget-piped-bash]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0