cc-safe-setup 29.7.0 → 30.0.4

package/examples/non-english-quality-warner.sh

@@ -0,0 +1,156 @@
+#!/bin/bash
+# non-english-quality-warner.sh — Surface the Cluster 15 non-English output quality regression
+# at session start for operators working in non-English languages with Opus 4.7
+#
+# Background:
+#   Starting with Claude Code 2.1.126 (early May 2026), Opus 4.7's non-English outputs
+#   began exhibiting register-inappropriate vocabulary at significantly elevated rates.
+#   The strongest quantitative evidence comes from issue #62961 (2026-05-28): a Kiwi
+#   morpheme-level analysis of 114.9M Korean output tokens across 4,666 sessions over
+#   ~2 months (Mar 21 – May 25, 2026) shows:
+#
+#     Period (Korean verb 박다 frequency per 10K tokens)
+#       Baseline (Mar 21 – May 2, Opus 4.6 → 4.7)     : 0.0174  (1.0×)
+#       After 2.1.126 (May 3–7,  Opus 4.7)            : 0.1147  (6.6×)
+#       After 2.1.132 (May 8–17, Opus 4.7)            : 0.3138  (18.0×)
+#       After 2.1.143 (May 18–25, Opus 4.7)           : 0.3106  (17.9×)
+#
+#   The verb "박다" (bakda) is colloquial/slang ("to hammer/nail in") — register-
+#   inappropriate for professional documents. It is being used where formal verbs
+#   like "명시하다" (to specify), "기록하다" (to record), or "삽입하다" (to insert)
+#   would be expected. The 6.6× → 18.0× jump at 2.1.132 strongly correlates with
+#   Claude Code CLI updates, not the model transition (Opus 4.6 → 4.7 happened
+#   April 16, well before the spike).
+#
+#   The pattern is not limited to Korean. Independent operator reports surface:
+#     - Japanese register collapse (2-4× signal)
+#     - Mixed Chinese-English code-switching at unexpected rates
+#     - Polish/Spanish formality drift (smaller signal, harder to quantify)
+#
+#   This is a server-side quality regression. There is no client-side fix that
+#   restores baseline register quality. The hook exists to surface the situation
+#   to operators who would otherwise notice the degradation only after shipping
+#   documents that used slang verbs in formal contexts.
+#
+#   References:
+#     - https://github.com/anthropics/claude-code/issues/62961  (Korean evidence)
+#     - https://gist.github.com/yurukusa/9b882f7009d36ad5477c46f890272acc  (field guide)
+#
+# What this hook does:
+#   On SessionStart, when CC_NON_ENGLISH_QUALITY_WARNER_REMIND=1 is set, emits a
+#   stderr advisory naming the three operator-side workarounds for non-English
+#   register-quality work during the Cluster 15 window. The hook is fully opt-in —
+#   silent by default. The advisory does not assume the operator's language; it
+#   describes the situation and lets the operator decide if it applies.
+#
+# When this hook does NOT emit anything:
+#   - CC_NON_ENGLISH_QUALITY_WARNER_REMIND is unset or empty
+#   - CC_NON_ENGLISH_QUALITY_WARNER_DISABLE=1
+#   - CC_NON_ENGLISH_QUALITY_WARNER_QUIET=1
+#
+# Hook config (settings.json):
+# {
+#   "hooks": {
+#     "SessionStart": [{
+#       "matcher": "",
+#       "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/non-english-quality-warner.sh" }]
+#     }]
+#   }
+# }
+# And in your shell rc, opt in:
+#   export CC_NON_ENGLISH_QUALITY_WARNER_REMIND=1
+#
+# Env vars:
+#   CC_NON_ENGLISH_QUALITY_WARNER_REMIND=1   — opt-in trigger (required to emit)
+#   CC_NON_ENGLISH_QUALITY_WARNER_DISABLE=1  — never emit (overrides REMIND)
+#   CC_NON_ENGLISH_QUALITY_WARNER_QUIET=1    — silent (overrides REMIND)
+#
+# Design notes:
+#   - Opt-in by default. The advisory is only useful to operators producing non-
+#     English output. Defaulting silent avoids noise for the English-language
+#     operator majority.
+#   - Language-agnostic advisory. The hook does not try to auto-detect the
+#     operator's language. Auto-detection from CLAUDE.md or env vars would be
+#     unreliable (a Japanese operator may have an English CLAUDE.md), and a wrong
+#     guess is worse than no guess.
+#   - Never blocks. Exit always 0.
+#   - No version gating. The Cluster 15 window started at 2.1.126 and is ongoing
+#     as of 2026-05-30. Gating on version would risk silencing the advisory after
+#     Anthropic patches the regression (the operator would no longer hear the
+#     advisory, but the patch's effectiveness is something they need to verify).
+#     The advisory text describes the situation and the verification path; the
+#     operator can disable it once they have verified that their workflow is
+#     unaffected.
+
+set -u
+
+# Hard disable path
+if [ "${CC_NON_ENGLISH_QUALITY_WARNER_DISABLE:-0}" = "1" ]; then
+  exit 0
+fi
+
+# Quiet path
+if [ "${CC_NON_ENGLISH_QUALITY_WARNER_QUIET:-0}" = "1" ]; then
+  exit 0
+fi
+
+# Opt-in gate
+if [ "${CC_NON_ENGLISH_QUALITY_WARNER_REMIND:-0}" != "1" ]; then
+  exit 0
+fi
+
+cat >&2 <<'EOF'
+[non-english-quality-warner] Cluster 15 advisory: non-English output register
+quality has regressed in Opus 4.7 since Claude Code 2.1.126 (early May 2026).
+
+Strongest quantitative signal (issue #62961, Korean morpheme analysis):
+  Baseline (pre-2.1.126)  : 1.0×  baseline slang verb frequency
+  After 2.1.126            : 6.6×  slang verb frequency
+  After 2.1.132 and later  : 18.0× slang verb frequency
+
+The pattern: formal/professional-register verbs are being replaced by colloquial
+or slang alternatives in contexts where the colloquial form would not appear in
+a professional document. The defect is server-side and Opus-4.7-specific; there
+is no client-side patch that restores the baseline register.
+
+If you produce non-English output for any document that requires professional
+register (reports, customer-facing content, technical docs in your language),
+three operator-side workarounds reduce the exposure:
+
+  1) Pin formal register in your system prompt or CLAUDE.md.
+     Add an explicit rule naming the registers you want and the registers you do
+     not. Example (Japanese):
+       "出力は formal register に固定。 colloquial / slang の語彙の混入を避ける。
+        書き言葉の規律で、 報告書に出せる調子で書く。"
+     For Korean, name the slang verbs you have already observed and exclude them:
+       "박다, 박히다 등의 비격식체 동사 사용 금지。 명시하다, 기록하다,
+        삽입하다 등의 격식체 동사를 사용。"
+
+  2) Switch to Sonnet for register-sensitive output.
+     Sonnet 4.6 and 4.7 are not affected by the Cluster 15 regression in the
+     same way (independent reports — please verify on your own workload before
+     trusting this for production output). For the specific turns that produce
+     register-sensitive text, swap with:
+       export ANTHROPIC_MODEL=claude-sonnet-4-7
+     Switch back to Opus for non-register-sensitive work (planning, reasoning).
+
+  3) Post-process the output for known slang substitutions.
+     For high-volume non-English production, maintain a sed/awk substitution
+     list of the slang verbs your style guide rejects, applied to the model's
+     output before shipping. This is a stop-gap, not a fix, and it does not
+     catch register problems your list does not anticipate — but for known
+     repeat offenders it works.
+
+This advisory will continue to surface until you disable it. To turn it off
+once you have either chosen a workaround or verified Anthropic has patched the
+regression for your workflow:
+  unset CC_NON_ENGLISH_QUALITY_WARNER_REMIND
+  # or
+  export CC_NON_ENGLISH_QUALITY_WARNER_QUIET=1
+
+References:
+  https://github.com/anthropics/claude-code/issues/62961  (Korean evidence)
+  https://gist.github.com/yurukusa/9b882f7009d36ad5477c46f890272acc  (field guide)
+EOF
+
+exit 0

package/examples/notify-waiting.sh

@@ -18,7 +18,7 @@
 
 # Linux (notify-send) — skip on WSL2 where D-Bus may not be running
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: Notification  MATCHER: ""
 if command -v notify-send &>/dev/null && [ -z "$WSL_DISTRO_NAME" ]; then
     notify-send "Claude Code" "Waiting for your input" --urgency=normal 2>/dev/null && exit 0
 fi

package/examples/npm-global-install-guard.sh

@@ -16,6 +16,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-npm-global-install-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [npm-global-install-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/npm-publish-guard.sh

@@ -1,6 +1,18 @@
 #!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-npm-publish-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [npm-publish-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 if echo "$COMMAND" | grep -qE '^\s*(npm\s+publish|npx\s+npm\s+publish)' && ! echo "$COMMAND" | grep -qE '\-\-dry-run'; then

package/examples/nuxt-config-guard.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/oauth-refresh-monitor.sh

@@ -0,0 +1,210 @@
+#!/bin/bash
+# oauth-refresh-monitor.sh — Detect OAuth refresh corruption patterns in tool output
+# and warn before the operator hits the persistent 401 loop (Cluster 19 candidate, axis 19A)
+#
+# Background:
+#   Cluster 19 candidate axis 19A documents OAuth refresh failure paths where a
+#   transient upstream error during a refresh operation corrupts the credentials
+#   state into a persistent broken loop. The specific anchor case:
+#
+#     #61912 (2026-05-23) — OAuth refresh corrupts credentials state during
+#     transient upstream 5xx → persistent 401 loop. A single transient error
+#     during refresh creates a permanent broken state.
+#
+#   The pattern is structurally distinct from straightforward 401 expiry: the
+#   operator's credential state was valid just before the refresh, the upstream
+#   returned 5xx on the refresh request, and now subsequent requests return 401
+#   even though the user did not log out and the original session was not
+#   expired. The recovery requires a full re-auth, not just a retry.
+#
+#   Adjacent cases in axis 19A:
+#     #59460 — MCP OAuth re-runs DCR on every authenticate, orphaning prior tokens
+#     #59725 — Slack MCP OAuth stores empty accessToken after flow completion
+#     #60260 — MCP OAuth completes but token is not honored
+#     #61139 — Shopify MCP token-expired loop after multi-shop switch
+#
+#   All share the structural shape: an OAuth flow surface reports success and a
+#   downstream call fails with 401 / "Needs authentication" / similar. The
+#   common detection signal is the appearance of one of these strings in tool
+#   output AFTER a successful login or refresh signal.
+#
+#   Reference:
+#     https://gist.github.com/yurukusa/58cb17bfda4d5ab31bd804809809d22f  (field guide)
+#
+# What this hook does:
+#   On PostToolUse, scans tool output for OAuth-refresh-corruption signatures.
+#   When a signature is detected, emits a one-shot per-session stderr advisory
+#   recommending the recovery path (full re-auth, not a retry) and the
+#   verification steps from the auth-status-checker companion hook.
+#
+#   Detection signatures (case-insensitive):
+#     - "needs authentication"
+#     - "401 unauthorized" + "refresh" within the same tool output
+#     - "oauth" + "expired" within the same tool output
+#     - "refresh token rejected"
+#     - "401" + "token" within the same tool output (broad fallback)
+#
+# When this hook does NOT emit anything:
+#   - CC_OAUTH_REFRESH_MONITOR_DISABLE=1
+#   - CC_OAUTH_REFRESH_MONITOR_QUIET=1
+#   - tool output does not contain any of the detection signatures
+#   - the same signature already fired the advisory in this session
+#
+# Hook config (settings.json):
+# {
+#   "hooks": {
+#     "PostToolUse": [{
+#       "matcher": "",
+#       "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/oauth-refresh-monitor.sh" }]
+#     }]
+#   }
+# }
+#
+# Env vars:
+#   CC_OAUTH_REFRESH_MONITOR_DISABLE=1     — never emit
+#   CC_OAUTH_REFRESH_MONITOR_QUIET=1       — silent
+#   CC_OAUTH_REFRESH_MONITOR_STATE_DIR=<p> — one-shot state dir
+#   CC_OAUTH_REFRESH_MONITOR_SESSION_ID=<id> — session id override (tests)
+#
+# Design notes:
+#   - Opt-out, not opt-in. Unlike the other Cluster 19 hooks (auth-status-checker,
+#     auth-expiry-reminder) which need explicit REMIND=1 to fire, this hook
+#     fires automatically when the signature appears. The reasoning: the
+#     signature is specific enough that a false positive is unlikely, and the
+#     cost of missing the advisory (an operator entering the persistent 401 loop
+#     without knowing) exceeds the cost of an occasional spurious advisory.
+#   - One-shot per session. The advisory fires once per session per signature.
+#     Repeating the same advisory N times in a session would itself become
+#     noise.
+#   - Never blocks. Exit always 0. The corruption pattern is server-side; a
+#     blocking hook would only add operator pain without preventing the
+#     corruption.
+#
+# The registration was missing from this header. The installer reads TRIGGER
+# and MATCHER from here and falls back to PreToolUse / Bash when both are
+# absent, so this hook was being registered at a moment where the field it
+# reads is always empty: it installed, it appeared in the settings, and it
+# did nothing. Measured 2026-08-04 across examples/: 14 files were like this.
+# TRIGGER: PostToolUse
+# MATCHER: ""
+
+set -u
+
+# Disable path
+if [ "${CC_OAUTH_REFRESH_MONITOR_DISABLE:-0}" = "1" ]; then
+  exit 0
+fi
+
+# Quiet path
+if [ "${CC_OAUTH_REFRESH_MONITOR_QUIET:-0}" = "1" ]; then
+  exit 0
+fi
+
+# Read PostToolUse payload from stdin
+INPUT=$(cat 2>/dev/null) || exit 0
+[ -n "$INPUT" ] || exit 0
+
+# Extract tool output. Try jq first; fall back to a permissive grep.
+TOOL_OUTPUT=""
+if command -v jq >/dev/null 2>&1; then
+  TOOL_OUTPUT=$(printf '%s' "$INPUT" | jq -r '
+    .tool_response.output //
+    .tool_response //
+    .output //
+    empty
+  ' 2>/dev/null)
+fi
+if [ -z "$TOOL_OUTPUT" ]; then
+  TOOL_OUTPUT="$INPUT"
+fi
+[ -n "$TOOL_OUTPUT" ] || exit 0
+
+# Lowercase for matching
+LOWER=$(printf '%s' "$TOOL_OUTPUT" | tr '[:upper:]' '[:lower:]')
+
+# Detect signatures
+SIGNATURE=""
+if printf '%s' "$LOWER" | grep -q "needs authentication"; then
+  SIGNATURE="needs-authentication"
+elif printf '%s' "$LOWER" | grep -q "refresh token rejected"; then
+  SIGNATURE="refresh-token-rejected"
+elif printf '%s' "$LOWER" | grep -q "401" && printf '%s' "$LOWER" | grep -q "refresh"; then
+  SIGNATURE="401-after-refresh"
+elif printf '%s' "$LOWER" | grep -q "oauth" && printf '%s' "$LOWER" | grep -q "expired"; then
+  SIGNATURE="oauth-expired"
+elif printf '%s' "$LOWER" | grep -q "401" && printf '%s' "$LOWER" | grep -q "token"; then
+  SIGNATURE="401-token"
+fi
+
+# No signature → silent
+[ -n "$SIGNATURE" ] || exit 0
+
+# One-shot per session per signature
+STATE_DIR="${CC_OAUTH_REFRESH_MONITOR_STATE_DIR:-$HOME/.claude}"
+mkdir -p "$STATE_DIR" 2>/dev/null || exit 0
+STATE_FILE="$STATE_DIR/oauth-refresh-monitor.fired"
+
+SESSION_ID="${CC_OAUTH_REFRESH_MONITOR_SESSION_ID:-}"
+if [ -z "$SESSION_ID" ]; then
+  SESSION_ID="${CLAUDECODE_SESSION_ID:-}"
+fi
+if [ -z "$SESSION_ID" ] && command -v tty >/dev/null 2>&1; then
+  TTY_PATH=$(tty 2>/dev/null)
+  if [ -n "$TTY_PATH" ] && [ "$TTY_PATH" != "not a tty" ]; then
+    SESSION_ID=$(printf '%s' "$TTY_PATH" | tr '/' '_')
+  fi
+fi
+[ -n "$SESSION_ID" ] || SESSION_ID="ppid-${PPID:-0}"
+
+FIRED_KEY="${SESSION_ID}::${SIGNATURE}"
+if [ -f "$STATE_FILE" ] && grep -Fq -- "$FIRED_KEY" "$STATE_FILE" 2>/dev/null; then
+  exit 0
+fi
+
+# Bound state file
+if [ -f "$STATE_FILE" ]; then
+  tail -n 100 "$STATE_FILE" > "${STATE_FILE}.tmp" 2>/dev/null \
+    && mv "${STATE_FILE}.tmp" "$STATE_FILE" 2>/dev/null || true
+fi
+printf '%s\n' "$FIRED_KEY" >> "$STATE_FILE" 2>/dev/null || true
+
+cat >&2 <<EOF
+[oauth-refresh-monitor] OAuth refresh corruption signature detected in tool
+output: "$SIGNATURE".
+
+Cluster 19 candidate axis 19A documents OAuth refresh failure paths where a
+transient upstream error during a refresh operation corrupts the credentials
+state into a persistent broken loop (anchor case: issue #61912). The pattern
+is structurally distinct from straightforward 401 expiry — the operator's
+credential state was valid just before the refresh, the upstream returned 5xx
+or rejected the refresh, and now subsequent requests return 401 even though
+the user did not log out and the original session was not expired.
+
+Recovery (NOT a retry — retry compounds the corruption):
+  1. Run /account to confirm the current auth state.
+  2. If "Not authenticated," do a full re-auth (logout then login) rather
+     than relying on automatic refresh.
+  3. For MCP servers, restart the MCP connection rather than relying on
+     in-session token refresh; the MCP refresh paths (#59460 / #59725 /
+     #60260 / #61139) are the specific failure modes here.
+
+Why the recovery is "full re-auth, not retry":
+  The corruption is in the refresh token state itself, so subsequent
+  refresh attempts fail in the same way. Only a fresh authentication
+  bypasses the corrupted refresh path.
+
+This advisory fires once per session per signature. To silence:
+  export CC_OAUTH_REFRESH_MONITOR_QUIET=1
+
+Companion hooks:
+  auth-status-checker.sh — full Cluster 19 mitigation menu (SessionStart, opt-in)
+  auth-expiry-reminder.sh — daily checkpoint reminder (SessionStart, opt-in)
+
+References:
+  https://github.com/anthropics/claude-code/issues/61912  (axis 19A anchor)
+  https://github.com/anthropics/claude-code/issues/59460  (MCP OAuth DCR re-runs)
+  https://github.com/anthropics/claude-code/issues/61923  (refresh token rejection)
+  https://gist.github.com/yurukusa/58cb17bfda4d5ab31bd804809809d22f  (field guide)
+EOF
+
+exit 0

package/examples/opus-degradation-tracker.sh

@@ -0,0 +1,187 @@
+#!/bin/bash
+# opus-degradation-tracker.sh — Personal Opus 4.7 pass-rate tracker that alerts on statistical degradation
+#
+# Background:
+#   On 2026-05-22, an independent third party (Margin Lab) detected statistically
+#   significant degradation in Claude Code Opus 4.7's SWE-Bench-Pro daily pass rate
+#   (65% baseline → 57% on the 7-day window, delta -8 points, exceeds the 4.3%
+#   significance threshold at 95% CI). The aggregate signal is documented at
+#   https://gist.github.com/yurukusa/77bf08523bda41132087a03de4523d7a — but each
+#   operator's workload responds differently to model drift. This hook lets an
+#   operator translate Margin Lab's aggregate signal into a workload-specific
+#   decision input.
+#
+#   The operator records pass/fail outcomes from their own Claude Code sessions
+#   (one line per session, simple shell append) and this hook computes:
+#     - baseline pass rate (first N days of the log, default 30)
+#     - recent pass rate (last 7 days)
+#     - delta and whether it crosses the configured threshold
+#
+#   When degradation crosses the threshold, the hook surfaces the four operator
+#   paths from Migration Playbook v2 plus the Margin Lab Gist for cross-source
+#   verification. Silent in the happy path.
+#
+# What this hook does:
+#   On SessionStart, read ~/.cc-eval-log (or CC_EVAL_LOG_PATH), compute baseline
+#   vs recent pass rate, emit a one-line advisory if recent drops below baseline
+#   by more than the threshold (default 5 percentage points). Otherwise silent.
+#
+# Log format (one line per session, append by hand or via shell function):
+#   YYYY-MM-DD HH:MM session-tag pass|fail
+#
+#   Example:
+#     2026-05-15 14:23 pr-review-task pass
+#     2026-05-15 18:01 doc-rewrite fail
+#     2026-05-22 09:12 pr-review-task fail
+#     2026-05-23 11:30 doc-rewrite fail
+#
+#   Optional fourth column "notes" is ignored — useful for human context.
+#
+# Suggested helper (add to ~/.bashrc or ~/.zshrc):
+#   cc-eval-pass() { echo "$(date '+%Y-%m-%d %H:%M') ${1:-session} pass" >> ~/.cc-eval-log; }
+#   cc-eval-fail() { echo "$(date '+%Y-%m-%d %H:%M') ${1:-session} fail" >> ~/.cc-eval-log; }
+#
+# When this hook does NOT fire a warning:
+#   - CC_OPUS_DEGRADATION_TRACKER_QUIET=1
+#   - log file does not exist or has fewer than CC_OPUS_DEGRADATION_TRACKER_MIN_SAMPLES (default 20) entries
+#   - recent pass rate is within threshold of baseline (default 5 pp)
+#   - log file is malformed (logs to stderr, exits 0 so SessionStart continues)
+#
+# Hook config (settings.json):
+# {
+#   "hooks": {
+#     "SessionStart": [{
+#       "matcher": "",
+#       "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/opus-degradation-tracker.sh" }]
+#     }]
+#   }
+# }
+#
+# Env vars:
+#   CC_EVAL_LOG_PATH                          — log file location (default ~/.cc-eval-log)
+#   CC_OPUS_DEGRADATION_TRACKER_QUIET=1       — never emit anything
+#   CC_OPUS_DEGRADATION_TRACKER_THRESHOLD=N   — percentage-point threshold for alert (default 5)
+#   CC_OPUS_DEGRADATION_TRACKER_MIN_SAMPLES=N — minimum entries before stats run (default 20)
+#   CC_OPUS_DEGRADATION_TRACKER_BASELINE_DAYS=N — days at the front of the log treated as baseline (default 30)
+#   CC_OPUS_DEGRADATION_TRACKER_RECENT_DAYS=N — days at the tail of the log treated as recent window (default 7)
+
+set -u
+
+# Silence path
+if [ "${CC_OPUS_DEGRADATION_TRACKER_QUIET:-0}" = "1" ]; then
+  exit 0
+fi
+
+LOG_PATH="${CC_EVAL_LOG_PATH:-$HOME/.cc-eval-log}"
+THRESHOLD="${CC_OPUS_DEGRADATION_TRACKER_THRESHOLD:-5}"
+MIN_SAMPLES="${CC_OPUS_DEGRADATION_TRACKER_MIN_SAMPLES:-20}"
+BASELINE_DAYS="${CC_OPUS_DEGRADATION_TRACKER_BASELINE_DAYS:-30}"
+RECENT_DAYS="${CC_OPUS_DEGRADATION_TRACKER_RECENT_DAYS:-7}"
+
+# Log file missing → user hasn't set up tracking yet → silent
+if [ ! -f "$LOG_PATH" ]; then
+  exit 0
+fi
+
+# Read and parse the log. Each valid line: YYYY-MM-DD HH:MM tag pass|fail
+# Use awk for portable parsing without external date dependencies.
+analysis=$(awk -v threshold="$THRESHOLD" -v min_samples="$MIN_SAMPLES" -v baseline_days="$BASELINE_DAYS" -v recent_days="$RECENT_DAYS" '
+BEGIN {
+    total = 0
+    baseline_pass = 0; baseline_total = 0
+    recent_pass = 0; recent_total = 0
+    today_epoch = systime()
+    baseline_cutoff_epoch = today_epoch - (baseline_days * 86400)
+    recent_cutoff_epoch = today_epoch - (recent_days * 86400)
+}
+/^[0-9]{4}-[0-9]{2}-[0-9]{2}[ \t]+[0-9]{2}:[0-9]{2}[ \t]+[^ \t]+[ \t]+(pass|fail)([ \t]|$)/ {
+    # Parse date into epoch (assumes GNU/BSD compatible mktime via awk)
+    split($1, d, "-")
+    split($2, t, ":")
+    line_epoch = mktime(d[1] " " d[2] " " d[3] " " t[1] " " t[2] " 00")
+    if (line_epoch <= 0) next
+    total++
+    is_pass = ($4 == "pass") ? 1 : 0
+
+    # Recent window: last RECENT_DAYS days
+    if (line_epoch >= recent_cutoff_epoch) {
+        recent_total++
+        if (is_pass) recent_pass++
+    }
+
+    # Baseline window: oldest BASELINE_DAYS days of recorded history
+    # We compute this in a second pass with "min_epoch" tracking.
+    # Use total==1 (first valid entry) instead of NR==1: NR counts every
+    # file line including malformed ones that fail the regex match.
+    if (total == 1 || line_epoch < min_epoch) min_epoch = line_epoch
+    sample[total, "epoch"] = line_epoch
+    sample[total, "pass"] = is_pass
+}
+END {
+    if (total < min_samples) {
+        print "INSUFFICIENT " total
+        exit
+    }
+    # Now compute baseline window from the oldest BASELINE_DAYS of recorded data
+    baseline_cutoff_from_first = min_epoch + (baseline_days * 86400)
+    for (i = 1; i <= total; i++) {
+        if (sample[i, "epoch"] <= baseline_cutoff_from_first) {
+            baseline_total++
+            if (sample[i, "pass"]) baseline_pass++
+        }
+    }
+    if (baseline_total < min_samples / 2) {
+        print "BASELINE_TOO_SMALL " baseline_total
+        exit
+    }
+    if (recent_total < min_samples / 4) {
+        print "RECENT_TOO_SMALL " recent_total
+        exit
+    }
+    baseline_rate = (baseline_pass / baseline_total) * 100
+    recent_rate = (recent_pass / recent_total) * 100
+    delta = baseline_rate - recent_rate
+    if (delta > threshold) {
+        printf "DEGRADED %d %d %d %d %.1f %.1f %.1f\n", baseline_pass, baseline_total, recent_pass, recent_total, baseline_rate, recent_rate, delta
+    } else {
+        printf "HEALTHY %d %d %d %d %.1f %.1f %.1f\n", baseline_pass, baseline_total, recent_pass, recent_total, baseline_rate, recent_rate, delta
+    }
+}
+' "$LOG_PATH" 2>/dev/null) || {
+    # awk failure → log is malformed in a way the parser cannot recover from
+    # Exit silently so SessionStart is not blocked
+    exit 0
+}
+
+status="${analysis%% *}"
+case "$status" in
+    INSUFFICIENT|BASELINE_TOO_SMALL|RECENT_TOO_SMALL|HEALTHY|"")
+        # Healthy or not enough data — silent
+        exit 0
+        ;;
+    DEGRADED)
+        # Parse the rest of the line for the numbers
+        read -r _ baseline_pass baseline_total recent_pass recent_total baseline_rate recent_rate delta <<< "$analysis"
+        cat >&2 <<EOF
+[opus-degradation-tracker] Personal pass rate dropped from ${baseline_rate}% baseline (${baseline_pass}/${baseline_total}) to ${recent_rate}% recent (${recent_pass}/${recent_total}) — delta -${delta} pp, exceeding the configured threshold of -${THRESHOLD} pp.
+
+This is your own workload's signal. The independent third-party Margin Lab tracker
+(SWE-Bench-Pro daily evals on Opus 4.7) also shows -8 pp degradation since 2026-05-22.
+The two signals together suggest a model-side change rather than a workload-specific issue.
+
+Cross-source verification:
+  https://gist.github.com/yurukusa/77bf08523bda41132087a03de4523d7a
+  (4 operator-side paths + 7-day audit sequence)
+
+Decision context for the 2026-06-15 credit pool split (\$20 Pro / \$100 Max 5x / \$200 Max 20x):
+  https://yurukusa.gumroad.com/l/claude-code-migration-playbook?utm_source=hook-opus-degradation-tracker&utm_medium=hook&utm_campaign=5-22-degradation
+
+To stop seeing this alert: \`export CC_OPUS_DEGRADATION_TRACKER_QUIET=1\` in your shell rc.
+EOF
+        exit 0
+        ;;
+    *)
+        # Unknown status — log to stderr but don't block
+        exit 0
+        ;;
+esac