cc-safe-setup 29.7.0 → 30.0.4

package/examples/persisted-1m-model-advisor.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+# persisted-1m-model-advisor.sh — Warn at SessionStart when a 1M-context model
+# is PINNED in your settings or default-model env vars (the reason /clear and
+# restarts don't reduce your usage)
+#
+# Solves: On Max/Team/Enterprise, Opus runs with a 1M context window. When you
+# pick a 1M variant once (e.g. /model opus[1m]), v2.1.153+ persists it to the
+# `model` field of your settings file, so every new session re-reads it — and a
+# 1M window keeps far more context resident before compaction, so each turn
+# reprocesses more tokens and the weekly/5h limit drains faster. Users report
+# the limit gone in 2-2.5 days (#65678, $200/mo cancelled), "1M credits
+# required" with usage still left (#65283), and /clear / restart not helping
+# (#65283, #65545, #65329) — precisely because the pin lives in a file, not in
+# the conversation.
+#
+# Gap this fills: cowork-model-picker-advisor.sh checks the ANTHROPIC_MODEL env
+# var only; model-version-lock.sh detects a switch AFTER it happens. Neither
+# reads the PERSISTED `model` field in settings.json or the
+# ANTHROPIC_DEFAULT_OPUS_MODEL / ANTHROPIC_DEFAULT_SONNET_MODEL env vars, which
+# are the sticky source `/clear` cannot clear. This hook inspects exactly those
+# and names which one is pinning 1M, with the verified fixes.
+#
+# Honest scope: this is ADVISORY. The automatic 1M upgrade on Max happens
+# platform-side with no tool event, so a hook cannot block that resolution — it
+# can only surface a pin you control and the official off-switch. It never
+# blocks; it only prints once at SessionStart.
+#
+# TRIGGER: SessionStart  MATCHER: ""
+# Config:
+#   CC_1M_ADVISOR=off     disable entirely (default: on)
+#   CC_1M_ADVISOR_QUIET=1 stay silent when no 1M pin is found (default: silent anyway)
+# Related: https://github.com/anthropics/claude-code/issues/65678 , #65283
+
+[ "${CC_1M_ADVISOR:-on}" = "off" ] && exit 0
+
+INPUT=$(cat 2>/dev/null)
+
+# Resolve the project dir for project-level settings. Prefer the explicit env,
+# fall back to the SessionStart payload's cwd. Fail open if neither is usable.
+PROJ="${CLAUDE_PROJECT_DIR:-}"
+if [ -z "$PROJ" ]; then
+    PROJ=$(printf '%s' "$INPUT" | jq -r '.cwd // empty' 2>/dev/null)
+fi
+
+# Read a settings file's top-level .model field, ignoring parse errors.
+read_model_field() {
+    [ -r "$1" ] || return 0
+    jq -r '.model // empty' "$1" 2>/dev/null
+}
+
+hits=""
+
+add_hit() {
+    # $1 = source label, $2 = value; record only when value ends with [1m]
+    case "${2,,}" in
+        *'[1m]') hits="${hits}  - ${1}: ${2}"$'\n' ;;
+    esac
+}
+
+add_hit "user settings (~/.claude/settings.json) model" "$(read_model_field "$HOME/.claude/settings.json")"
+add_hit "user settings (settings.local.json) model"     "$(read_model_field "$HOME/.claude/settings.local.json")"
+if [ -n "$PROJ" ]; then
+    add_hit "project settings (.claude/settings.json) model"       "$(read_model_field "$PROJ/.claude/settings.json")"
+    add_hit "project settings (.claude/settings.local.json) model" "$(read_model_field "$PROJ/.claude/settings.local.json")"
+fi
+add_hit "env ANTHROPIC_DEFAULT_OPUS_MODEL"   "${ANTHROPIC_DEFAULT_OPUS_MODEL:-}"
+add_hit "env ANTHROPIC_DEFAULT_SONNET_MODEL" "${ANTHROPIC_DEFAULT_SONNET_MODEL:-}"
+add_hit "env ANTHROPIC_MODEL"                "${ANTHROPIC_MODEL:-}"
+
+if [ -z "$hits" ]; then
+    # No persisted 1M pin found — stay silent (advisory hooks should not add noise).
+    exit 0
+fi
+
+{
+    echo "persisted-1m-model-advisor: a 1M-context model is PINNED in your config:"
+    printf '%s' "$hits"
+    echo "This persists across /clear and restarts, so it keeps draining your weekly/5h"
+    echo "limit faster (a 1M window holds more context before compaction = more tokens"
+    echo "reprocessed per turn). To stop it, do any of:"
+    echo "  - /model <a non-[1m] model> then Enter to save it as the default, or"
+    echo "  - remove the [1m] suffix from the settings 'model' field / the env var above, or"
+    echo "  - set CLAUDE_CODE_DISABLE_1M_CONTEXT=1 to remove 1M variants entirely."
+    echo "On Max, Opus 1M is included (no premium), so this is about token volume against"
+    echo "your limit, not a surcharge. Set CC_1M_ADVISOR=off to silence this notice."
+} >&2
+
+exit 0

package/examples/php-lint-on-edit.sh

@@ -17,7 +17,7 @@
 # }
 # ================================================================
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PostToolUse  MATCHER: "Edit|Write"
 
 INPUT=$(cat)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)

package/examples/pii-upload-guard.sh

@@ -15,6 +15,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-pii-upload-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [pii-upload-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0

package/examples/pip-publish-guard.sh

@@ -1,5 +1,18 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-pip-publish-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [pip-publish-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0

package/examples/pip-requirements-guard.sh

@@ -19,6 +19,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-pip-requirements-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [pip-requirements-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/pip-venv-required.sh

@@ -17,6 +17,18 @@
 #   }
 # }
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-pip-venv-required-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [pip-venv-required]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/plan-mode-edit-guard.sh

@@ -21,6 +21,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-plan-mode-edit-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [plan-mode-edit-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 

package/examples/plan-mode-enforcer.sh

@@ -30,6 +30,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-plan-mode-enforcer-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [plan-mode-enforcer]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 STATE_FILE="/tmp/.cc-plan-mode-active"
 [ -f "$STATE_FILE" ] || exit 0
 

package/examples/plan-mode-strict-guard.sh

@@ -17,6 +17,18 @@
 # TRIGGER: PreToolUse
 # MATCHER: "Edit|Write|Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-plan-mode-strict-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [plan-mode-strict-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 [ -z "$TOOL" ] && exit 0

package/examples/plugin-hooks-json-bloat-detector.sh

@@ -0,0 +1,169 @@
+#!/bin/bash
+# ================================================================
+# plugin-hooks-json-bloat-detector.sh — Detect duplicated hook
+#   registrations inside plugin hooks.json files (additive growth
+#   from the multi-agent dispatch path).
+# ================================================================
+# PURPOSE:
+#   Issue #64022 documents a class where a plugin's
+#   `hooks/hooks.json` registrations multiply additively in
+#   multi-agent sessions (observed 1× → 122× per hook). At high
+#   multiples every hook fires N times per tool call and tool
+#   output is corrupted. The reporter's plugin had no additive
+#   writer; the only mechanism that fits is the harness re-running
+#   its plugin-hook load/merge and appending instead of replacing.
+#
+#   The growth is silent until output corruption surfaces it. This
+#   hook scans every installed plugin's hooks.json at session
+#   start, counts duplicate command-string registrations within
+#   each file, and warns when a single command appears more than a
+#   threshold (default 5 times) — well below the 122× blowup but
+#   well above any legitimate "one event, one command, multiple
+#   matchers" registration shape.
+#
+# DETECTION MODEL:
+#   SessionStart fires once per session. We walk every
+#   `~/.claude/plugins/cache/**/hooks/hooks.json` (plus the canonical
+#   `~/.claude/plugins/marketplace/**/hooks/hooks.json` if it exists),
+#   parse each JSON, and within each file count how many times each
+#   distinct command string appears across all event types. If any
+#   command string appears more than CC_PLUGIN_HOOKS_BLOAT_THRESHOLD
+#   times in a single hooks.json, emit a warning identifying the
+#   plugin path, the command, and the duplicate count.
+#
+#   We deliberately ignore the cross-plugin case (the same command
+#   appearing in two different plugins is legitimate) and the
+#   multi-event case (the same command registered for PreToolUse
+#   AND PostToolUse — count each event-bucket separately).
+#
+# CLUSTER:
+#   Candidate cluster #21 — Plugin lifecycle integrity gap
+#   Sub-axis 21A — additive hook-registration growth (#64022).
+#
+# TRIGGER: SessionStart  MATCHER: ""
+#
+# ENV:
+#   CC_PLUGIN_HOOKS_BLOAT_THRESHOLD     default 5  (warn when same command appears >5×)
+#   CC_PLUGIN_HOOKS_BLOAT_DISABLE       non-empty → silent
+#   CC_PLUGIN_HOOKS_BLOAT_QUIET         non-empty → silent
+#   CC_PLUGIN_HOOKS_BLOAT_ROOT          default $HOME/.claude/plugins
+#   CC_PLUGIN_HOOKS_BLOAT_STATE_DIR     default /tmp/cc-plugin-hooks-bloat
+# ================================================================
+
+set -u
+
+# Disable / quiet
+if [ -n "${CC_PLUGIN_HOOKS_BLOAT_DISABLE:-}" ] || [ -n "${CC_PLUGIN_HOOKS_BLOAT_QUIET:-}" ]; then
+    exit 0
+fi
+
+THRESHOLD="${CC_PLUGIN_HOOKS_BLOAT_THRESHOLD:-5}"
+PLUGINS_ROOT="${CC_PLUGIN_HOOKS_BLOAT_ROOT:-$HOME/.claude/plugins}"
+STATE_DIR="${CC_PLUGIN_HOOKS_BLOAT_STATE_DIR:-/tmp/cc-plugin-hooks-bloat}"
+WARN_FILE="$STATE_DIR/last-warn"
+
+mkdir -p "$STATE_DIR" 2>/dev/null || exit 0
+
+# If plugin root doesn't exist, nothing to scan
+[ -d "$PLUGINS_ROOT" ] || exit 0
+
+# Need jq for JSON parsing; fail-soft if missing
+if ! command -v jq >/dev/null 2>&1; then
+    exit 0
+fi
+
+# Read input (Claude Code passes session context on stdin; we don't use it for
+# this detector, but consume it so the harness doesn't block).
+INPUT=$(cat 2>/dev/null || true)
+
+# Track findings across all plugin hooks.json files
+declare -a FINDINGS=()
+
+# Walk every hooks.json under the plugins tree
+while IFS= read -r -d '' HOOKS_FILE; do
+    # Skip if not a file (broken symlink etc.)
+    [ -f "$HOOKS_FILE" ] || continue
+
+    # Skip if the file is not valid JSON (fail-soft, do not warn on broken files
+    # — those are a separate problem)
+    if ! jq -e . "$HOOKS_FILE" >/dev/null 2>&1; then
+        continue
+    fi
+
+    # Extract every hook command string, grouped per event-bucket so that the
+    # same command legitimately registered for PreToolUse AND PostToolUse
+    # doesn't trip the detector. Output format: "<event>\t<command>"
+    EVENT_CMDS=$(jq -r '
+        (.hooks // {}) | to_entries[] |
+        .key as $event |
+        (.value // []) | .[] |
+        ((.hooks // []) | .[]) |
+        select(.command != null) |
+        ($event + "\t" + (.command | tostring))
+    ' "$HOOKS_FILE" 2>/dev/null) || continue
+
+    [ -z "$EVENT_CMDS" ] && continue
+
+    # Count duplicates per event+command pair
+    DUPES=$(printf '%s\n' "$EVENT_CMDS" | sort | uniq -c | awk -v t="$THRESHOLD" '$1 > t {print $0}')
+
+    if [ -n "$DUPES" ]; then
+        # Strip the canonical install root prefix for readability in the warning
+        DISPLAY_PATH="${HOOKS_FILE#$PLUGINS_ROOT/}"
+        FINDINGS+=("$DISPLAY_PATH")
+        FINDINGS+=("$DUPES")
+        FINDINGS+=("---")
+    fi
+done < <(find "$PLUGINS_ROOT" -type f -name 'hooks.json' -path '*/hooks/*' -print0 2>/dev/null)
+
+# No findings → silent exit
+if [ "${#FINDINGS[@]}" -eq 0 ]; then
+    exit 0
+fi
+
+# Debounce: only warn once per hour even if the session restarts repeatedly
+NOW_S=$(date +%s)
+LAST_WARN=0
+if [ -f "$WARN_FILE" ]; then
+    LAST_WARN=$(cat "$WARN_FILE" 2>/dev/null || echo 0)
+fi
+HOUR_AGO=$((NOW_S - 3600))
+if [ "$LAST_WARN" -gt "$HOUR_AGO" ] 2>/dev/null; then
+    exit 0
+fi
+printf '%s' "$NOW_S" > "$WARN_FILE" 2>/dev/null
+
+# Emit advisory warning
+cat >&2 <<EOF
+
+⚠️  Plugin hooks.json bloat detected — duplicate hook registrations.
+
+One or more installed plugins have a hooks.json file where the same command
+string appears more than ${THRESHOLD} times within a single event bucket.
+This is the fingerprint of the additive growth pattern documented in
+anthropics/claude-code Issue #64022 — the harness's plugin-hook load/merge
+path can re-run and append instead of replacing, causing each hook to fire
+N times per tool call.
+
+Findings:
+EOF
+
+for line in "${FINDINGS[@]}"; do
+    printf '  %s\n' "$line" >&2
+done
+
+cat >&2 <<EOF
+
+What to do:
+
+  1. Restore canonical hooks.json from the plugin source (a fresh
+     reinstall of the plugin from its canonical marketplace usually works).
+  2. If the file regrows after restoration, file the recurrence against
+     anthropics/claude-code Issue #64022 with your version and a count.
+  3. Lower this hook's threshold if the false-positive rate is acceptable
+     for your environment (export CC_PLUGIN_HOOKS_BLOAT_THRESHOLD=3).
+
+This warning is advisory. Set CC_PLUGIN_HOOKS_BLOAT_DISABLE=1 to silence.
+EOF
+
+exit 0

package/examples/polyglot-rm-guard.sh

@@ -21,6 +21,18 @@
 #   }
 # }
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-polyglot-rm-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [polyglot-rm-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0

package/examples/post-compact-safety.sh

@@ -27,6 +27,18 @@
 #
 # Config: CC_POST_COMPACT_GUARD=10 (block for first 10 calls after compact)
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-post-compact-safety-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [post-compact-safety]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/post-edit-disk-verify.sh

@@ -0,0 +1,152 @@
+#!/bin/bash
+# post-edit-disk-verify.sh — Catch "Edit/Write reported success but didn't
+# persist to disk" silent failures at the tool boundary.
+#
+# Solves: anthropics/claude-code#61303 — Windows MAX_PATH(260) + isolated
+# worktree + deep nested path yielded an `Edit`/`Write` that reported success
+# in-tool while the filesystem still showed the original content. The agent's
+# `Read` reflected the "edited" state; the disk did not. A defensive
+# verification step inside the dispatched subagent caught it, but the failure
+# mode was invisible until that defensive step fired.
+#
+# The structural class is broader than the MAX_PATH trigger: any condition
+# under which the harness reports a successful write but the on-disk content
+# diverges from the claimed write should be caught at the tool boundary, not
+# at the next session's read.
+#
+# Type: PostToolUse hook on Edit and Write.
+#
+# Decision rule:
+#
+#   exit 0  — verification passed, or hook does not apply
+#   exit 2  — verification failed; stderr explains why and Claude sees it
+#
+# The hook is intentionally permissive on edge cases (Edit with no content
+# field, ephemeral files, non-regular files) and intentionally strict on the
+# specific divergence shape #61303 names.
+#
+# Configuration env vars:
+#
+#   CC_POST_EDIT_VERIFY_DISABLE=1  — skip the hook entirely
+#   CC_POST_EDIT_VERIFY_QUIET=1    — exit 0 even on detected divergence,
+#                                    but still write the divergence to
+#                                    ~/.claude/receipts/post-edit-divergence.jsonl
+#                                    for audit (the "observe but don't gate"
+#                                    mode useful for first-week deployment)
+
+set -u
+
+# Read tool input from stdin (Claude Code passes a JSON envelope).
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-post-edit-disk-verify-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [post-edit-disk-verify]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[[ -z "$TOOL" ]] && exit 0
+[[ "$TOOL" != "Edit" && "$TOOL" != "Write" ]] && exit 0
+
+# Honor the global disable.
+[[ "${CC_POST_EDIT_VERIFY_DISABLE:-0}" == "1" ]] && exit 0
+
+FILE=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+[[ -z "$FILE" ]] && exit 0
+
+# Helper: append a divergence record to the receipt log.
+# Defined before first use — the missing-after-write path below calls it.
+_record_divergence() {
+    local file="$1"
+    local tool="$2"
+    local kind="$3"
+    local msg="$4"
+    local dir="${CC_POST_EDIT_VERIFY_RECEIPT_DIR:-$HOME/.claude/receipts}"
+    mkdir -p "$dir" 2>/dev/null || return 0
+    local ts
+    ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+    # The missing-after-write path calls this for a file that does not exist,
+    # so guard the redirection to avoid a leaked "No such file" shell error.
+    local file_size=0
+    [ -f "$file" ] && file_size=$(wc -c < "$file" 2>/dev/null || echo 0)
+    printf '{"ts":"%s","tool":"%s","file":"%s","kind":"%s","file_size":%s}\n' \
+        "$ts" "$tool" "$file" "$kind" "$file_size" \
+        >> "$dir/post-edit-divergence.jsonl" 2>/dev/null || true
+}
+
+# File must exist (Write may have created it; Edit always operates on existing).
+[[ ! -e "$FILE" ]] && {
+    # If the tool reported success on a Write to a path that doesn't exist
+    # post-call, that is itself a divergence.
+    if [[ "$TOOL" == "Write" ]]; then
+        msg="post-edit-disk-verify: $TOOL claimed success on $FILE but file does not exist on disk (silent fail-to-persist; see anthropics/claude-code#61303)"
+        _record_divergence "$FILE" "$TOOL" "missing-after-write" "$msg"
+        if [[ "${CC_POST_EDIT_VERIFY_QUIET:-0}" != "1" ]]; then
+            echo "$msg" >&2
+            exit 2
+        fi
+    fi
+    exit 0
+}
+
+# Regular file only (skip symlinks, sockets, devices).
+[[ ! -f "$FILE" ]] && exit 0
+
+# --- Check 1: Write with claimed content vs actual on-disk size ---
+# If a Write claimed N bytes but disk shows much less, that is the
+# strongest single signal of silent fail-to-persist.
+if [[ "$TOOL" == "Write" ]]; then
+    CLAIMED=$(printf '%s' "$INPUT" | jq -r '.tool_input.content // ""' 2>/dev/null)
+    CLAIMED_LEN=${#CLAIMED}
+    ACTUAL_LEN=$(wc -c < "$FILE" 2>/dev/null || echo 0)
+
+    # Only fire when claimed content is non-trivial (avoid empty-write false positives).
+    if [[ "$CLAIMED_LEN" -gt 100 ]]; then
+        # Allow up to 2x slack for CRLF / encoding / final newline differences,
+        # but a >50% shortfall is highly suggestive of fail-to-persist.
+        if [[ "$ACTUAL_LEN" -lt $((CLAIMED_LEN / 2)) ]]; then
+            msg="post-edit-disk-verify: Write to $FILE claimed $CLAIMED_LEN bytes but disk shows $ACTUAL_LEN bytes (>50% shortfall — likely silent fail-to-persist per anthropics/claude-code#61303). Check Windows MAX_PATH (260) on Windows, deep worktrees, or filesystem encoding."
+            _record_divergence "$FILE" "$TOOL" "size-shortfall" "$msg"
+            if [[ "${CC_POST_EDIT_VERIFY_QUIET:-0}" != "1" ]]; then
+                echo "$msg" >&2
+                exit 2
+            fi
+        fi
+    fi
+fi
+
+# --- Check 2: Edit with no diff in git ---
+# If an Edit reported success on a git-tracked file and produces no diff,
+# either the Edit was a no-op (legitimate) or the change failed to persist.
+# The hook treats a "claimed-non-trivial Edit with no diff" as the latter.
+if [[ "$TOOL" == "Edit" ]]; then
+    NEW=$(printf '%s' "$INPUT" | jq -r '.tool_input.new_string // ""' 2>/dev/null)
+    OLD=$(printf '%s' "$INPUT" | jq -r '.tool_input.old_string // ""' 2>/dev/null)
+
+    # Only check if old_string != new_string (a real claimed change).
+    if [[ -n "$NEW" && "$NEW" != "$OLD" ]]; then
+        # Find git root for the file's directory.
+        FILE_DIR=$(dirname "$FILE")
+        if git -C "$FILE_DIR" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+            # File is in a git repo. Check whether the new_string appears in
+            # the on-disk content. If not, the Edit did not persist.
+            if ! grep -F -q -- "$NEW" "$FILE" 2>/dev/null; then
+                msg="post-edit-disk-verify: Edit on $FILE claimed to insert content that is not found in the on-disk file (silent fail-to-persist per anthropics/claude-code#61303). Either the Edit did not land, or in-tool Read is showing stale-cached content."
+                _record_divergence "$FILE" "$TOOL" "edit-not-in-file" "$msg"
+                if [[ "${CC_POST_EDIT_VERIFY_QUIET:-0}" != "1" ]]; then
+                    echo "$msg" >&2
+                    exit 2
+                fi
+            fi
+        fi
+    fi
+fi
+
+exit 0