cc-safe-setup 29.7.0 → 30.0.4

package/examples/powershell-remove-item-guard.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+# powershell-remove-item-guard.sh — Block PowerShell recursive deletion that traverses junctions
+#
+# Solves: Remove-Item -Recurse -Force on pnpm worktrees traverses NTFS junctions,
+#         permanently deleting user profile folders and source code (#29249).
+#         Also prevents wholesale C: drive deletion via PowerShell (#41708).
+#
+# How it works: Intercepts shell-tool commands containing PowerShell Remove-Item patterns.
+#   Hard blocks refuse with exit 2. Measured 2026-09-19 on 2.1.278, PreToolUse,
+#   against a do-nothing control: a body of {"decision":"block"} does refuse, and
+#   {"decision":"DENY"} and {"decision":"deny"} are both ignored - the hook runs,
+#   prints its reason, exits 0, and the command goes through anyway.
+#   Hard-blocks when -Recurse targets system directories, user profiles, or paths
+#   that could traverse NTFS junctions (node_modules, .pnpm). For -Recurse -Force on
+#   any other absolute drive/UNC path it asks for confirmation instead of blocking —
+#   the case that destroyed ~34 client video files in #64310 (D:\Clientes\...) where
+#   -Force bypassed the Recycle Bin and no confirmation was requested.
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Bash|PowerShell"
+#   Claude Code's PowerShell tool is separate from Bash. Register with
+#   matcher "Bash|PowerShell" so Remove-Item run through the native
+#   PowerShell tool is inspected too — a Bash-only matcher never fires
+#   on the PowerShell tool (#69397). The command is read from
+#   tool_input.command, which both tools populate.
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-powershell-remove-item-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [powershell-remove-item-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+# Only check commands containing Remove-Item or ri (PowerShell alias)
+echo "$COMMAND" | grep -qiE '(Remove-Item|ri\s|del\s).*-Recurse' || exit 0
+
+# Block if targeting system-critical paths
+if echo "$COMMAND" | grep -qiE 'Remove-Item.*-Recurse.*(/|\\)(Users|Windows|Program Files|System32|C:\\|/mnt/c)'; then
+  echo "BLOCKED: Remove-Item -Recurse targeting system directory. NTFS junctions can traverse to user profiles (#29249)." >&2
+  exit 2
+fi
+
+# Block if targeting node_modules with -Force (junction traversal risk)
+if echo "$COMMAND" | grep -qiE 'Remove-Item.*-Recurse.*-Force.*(node_modules|\.pnpm|worktree)'; then
+  echo "BLOCKED: Remove-Item -Recurse -Force on directory with potential NTFS junctions. Use rimraf or manual junction resolution first (#29249)." >&2
+  exit 2
+fi
+
+# Block if targeting home directory patterns
+if echo "$COMMAND" | grep -qiE 'Remove-Item.*-Recurse.*(\$HOME|\$env:USERPROFILE|~\/|~\\)'; then
+  echo "BLOCKED: Remove-Item -Recurse targeting home directory. Risk of irreversible data loss (#41708)." >&2
+  exit 2
+fi
+
+# Confirm before -Recurse -Force on any other absolute drive/UNC path.
+# The hard blocks above only cover system, junction, and home targets. The case
+# that destroyed ~34 client video files in #64310 was Remove-Item -Recurse -Force on
+# an ordinary data path (D:\Clientes\...) — none of the above matched, -Force bypassed
+# the Recycle Bin, and no confirmation was requested (SSD/TRIM made it unrecoverable).
+# Use "ask" rather than a hard block so routine build/dependency cleanup just gets one
+# confirmation instead of being denied; relative paths (./build) don't trigger at all.
+# VERSION NOTE (measured 2026-08-13 on 2.1.228; this comment used to say the
+# reverse): #77212 reported that under bypassPermissions an "ask" is silently
+# auto-approved, so this confirmation would never appear. It does not reproduce
+# on 2.1.228 — interactively the confirmation appears under both
+# --dangerously-skip-permissions and --permission-mode auto, and non-interactively
+# (claude -p) the call is refused rather than approved. Control: with the hook
+# removed, both permissive modes ran the command unprompted. Older builds may
+# still match the report; check your own --version. What does not change: an
+# "ask" needs someone present to answer it, so in genuinely unattended runs the
+# hard blocks above (exit 2) are what hold.
+if echo "$COMMAND" | grep -qiE '\-Force' \
+   && echo "$COMMAND" | grep -qiE '[A-Za-z]:[\\/]|\\\\[A-Za-z0-9]'; then
+  printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"Confirm: Remove-Item -Recurse -Force on an absolute path. -Force bypasses the Recycle Bin and is unrecoverable on SSD/TRIM. Verify the target path is correct (and that any move/copy finished) before deleting (#64310)."}}'
+  exit 0
+fi

package/examples/pr-duplicate-guard.sh

@@ -1,3 +1,16 @@
+#!/bin/bash
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-pr-duplicate-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [pr-duplicate-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 echo "$COMMAND" | grep -qE '\bgh\s+pr\s+create\b' || exit 0

package/examples/pre-bash-sed-line-ending-windows.sh

@@ -0,0 +1,87 @@
+#!/bin/bash
+# pre-bash-sed-line-ending-windows.sh — Block sed -i on Windows/Git Bash
+#
+# Solves: sed -i silently converts CRLF→LF on Windows (#63715).
+#         The conversion is invisible in file content but breaks
+#         tools expecting CRLF (XML manifests, .NET configs, batch
+#         files). Reporter lost 4 hours debugging an XML parser
+#         that failed silently after sed edited it.
+#
+# How it works: PreToolUse hook on Bash tool that detects sed -i
+#   patterns on Windows/Git Bash environments and blocks the call
+#   with a structured suggestion (Edit tool, PowerShell Set-Content,
+#   or manual dos2unix/unix2dos preservation).
+#
+# Linux/macOS environments are skipped — sed -i is safe there.
+#
+# Override: Set CC_ALLOW_SED_LINE_ENDING_CHANGE=1 to bypass when
+#   the LF conversion is intentional (e.g., converting a Windows
+#   file to Unix line endings on purpose).
+#
+# TRIGGER: PreToolUse
+# MATCHER: Bash
+
+set -euo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-pre-bash-sed-line-ending-windows-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [pre-bash-sed-line-ending-windows]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null || echo "")
+[ -z "$CMD" ] && exit 0
+
+# Detect Windows/Git Bash environment. uname -s returns MINGW*/MSYS*/CYGWIN*
+# on Git Bash, MSYS2, and Cygwin respectively. Linux/macOS are skipped because
+# sed -i preserves the original LF line endings there.
+case "$(uname -s 2>/dev/null)" in
+    MINGW*|MSYS*|CYGWIN*)
+        ;;
+    *)
+        exit 0
+        ;;
+esac
+
+# Match `sed -i`, `sed -i ''`, `sed --in-place`. Pattern allows leading flags
+# like `sed -E -i` and ensures -i is a complete flag (not part of -inplace=...).
+if echo "$CMD" | grep -qE '\bsed\b[^|;&]*[[:space:]]-(i\b|-in-place)'; then
+    # Honor explicit opt-in for intentional LF conversion.
+    if [ "${CC_ALLOW_SED_LINE_ENDING_CHANGE:-}" = "1" ]; then
+        echo "[INFO] sed -i allowed via CC_ALLOW_SED_LINE_ENDING_CHANGE=1" >&2
+        exit 0
+    fi
+
+    cat >&2 <<'EOF'
+BLOCKED: sed -i on Windows/Git Bash silently converts CRLF to LF line endings.
+
+This breaks files that expect CRLF (XML manifests, .NET configs, batch files,
+.csproj, .vbproj, .sln, .reg files, etc.) without any warning or error. The
+content looks identical in every visual inspection. Documented at
+anthropics/claude-code#63715 with a 4-hour XML manifest debugging incident.
+
+Use one of these instead:
+
+1. The Edit tool — preserves the file's existing line endings.
+
+2. PowerShell:
+     (Get-Content file) -replace 'pattern','replacement' | Set-Content file
+   Or with -NoNewline to avoid adding a trailing newline.
+
+3. Manual line-ending preservation:
+     dos2unix file && sed -i 's/old/new/g' file && unix2dos file
+
+If you intentionally want to convert this file to LF, bypass with:
+     CC_ALLOW_SED_LINE_ENDING_CHANGE=1 sed -i ...
+EOF
+    exit 2
+fi
+
+exit 0

package/examples/pre-execution-claim-detector.sh

@@ -0,0 +1,179 @@
+#!/bin/bash
+# pre-execution-claim-detector.sh — Surface the Cluster 22 candidate (Opus 4.8
+# pre-execution tool-output fabrication, Axis 22A) at PreToolUse, by scanning
+# the last assistant text block for specific-value claim signatures that
+# precede the tool call about to fire.
+#
+# Why: Cluster 22 candidate Axis 22A (sequential pre-execution claim) documents
+#      that Opus 4.8 emits result-specific values (prices, URLs, file contents,
+#      command outputs, exit codes) BEFORE the tool calls that would produce
+#      those values have returned. Issue #64065 anchor: model asserted specific
+#      flight prices ($891pp / $1,782/2) before web/flight-search calls
+#      returned; real prices were ~$645pp. Self-diagnosed the pattern in-context,
+#      explicitly committed not to repeat it, then repeated it on the next turn
+#      — the self-recognition-without-prevention mechanic that lives below the
+#      prompt layer.
+#
+#      Six independent filings 2026-05-30 → 2026-05-31, all on claude-opus-4-8:
+#        #64048 (confabulated URGENT-AGENT-DIRECTIVE / AUTOGEN-DECOY markers)
+#        #64055 (Opus 4.8 modified files the user did not ask to modify)
+#        #64065 (flight prices anchor, self-recognition-without-prevention)
+#        #64076 ("lying and fabricating a lot of things without doing actual work")
+#        #64095 (envelope leak, immutable git log returned different SHAs)
+#        #64103 ("telling me it did things and were successful but it wasn't")
+#
+#      This hook complements tool-result-correlation-checker.sh (which catches
+#      Axis 22B parallel-batch fabrication compounding via tool_use_id ↔
+#      tool_result pairing mismatches). Together they cover both axes.
+#
+# Detection rule: 5 claim-pattern regexes applied to the last assistant text
+# block in the transcript. The patterns are conservative; they match phrases
+# that are highly correlated with pre-execution claim signatures but rare in
+# normal assistant output:
+#
+#   1. "the (file|output|result|command|response) (was|is|shows|contains|returned):"
+#      followed by quoted content within 200 chars
+#   2. "I (confirmed|verified|checked|ran|executed) [^.]+ and [^.]+"
+#      with specific-value language (numbers with units, prices, URLs)
+#   3. specific dollar amounts ($XXX or $X,XXX patterns) appearing without a
+#      preceding "I'll check" / "let me search" hedge
+#   4. SHA-like patterns (40-char hex) appearing without a preceding
+#      "git log will show" / "let me run" hedge
+#   5. specific file paths quoted with content immediately following:
+#      `/path/to/file.ext` followed by `\n```` (claim-then-code-block pattern)
+#
+# Event: PreToolUse  MATCHER: "Bash" (only Bash, where the highest-volume
+#                              claim-verifiable tools live)
+# Action: Read transcript_path from the PreToolUse payload, scan the last
+#         assistant text block for claim signatures. Emit stderr advisory if
+#         matched. Advisory only (exit 0); never blocks.
+#
+# Opt-in: CC_OPUS48_PRE_CLAIM_DETECT=1 to enable. Silent by default so
+# operators on Opus 4.6/4.7 (where the cluster does not surface) see no noise.
+#
+# Configuration:
+#   CC_OPUS48_PRE_CLAIM_DETECT       Set to "1" to enable
+#   CC_OPUS48_PRE_CLAIM_DISABLE      Hard disable (overrides DETECT)
+#   CC_OPUS48_PRE_CLAIM_QUIET        Silent (overrides DETECT)
+#   CC_OPUS48_PRE_CLAIM_LOG          Log path (default ~/.cache/cc-safe-setup/pre-claim.jsonl)
+#   CC_OPUS48_PRE_CLAIM_SCAN_LINES   Last N transcript lines to inspect (default 20)
+
+set -u
+
+if [ "${CC_OPUS48_PRE_CLAIM_DISABLE:-0}" = "1" ]; then
+  exit 0
+fi
+if [ "${CC_OPUS48_PRE_CLAIM_QUIET:-0}" = "1" ]; then
+  exit 0
+fi
+if [ "${CC_OPUS48_PRE_CLAIM_DETECT:-0}" != "1" ]; then
+  exit 0
+fi
+
+SCAN_LINES="${CC_OPUS48_PRE_CLAIM_SCAN_LINES:-20}"
+LOG="${CC_OPUS48_PRE_CLAIM_LOG:-${HOME}/.cache/cc-safe-setup/pre-claim.jsonl}"
+
+case "$SCAN_LINES" in
+  ''|*[!0-9]*) SCAN_LINES=20 ;;
+esac
+
+INPUT=$(cat)
+
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+if [ -z "$TRANSCRIPT" ] || [ ! -r "$TRANSCRIPT" ]; then
+  exit 0
+fi
+
+# Extract the last assistant text block from the transcript.
+# Assistant messages have type=assistant; text content lives at
+# .message.content[].text in the JSONL representation.
+LAST_ASSISTANT_TEXT=$(tac "$TRANSCRIPT" 2>/dev/null | head -n "$SCAN_LINES" | \
+  jq -rR 'fromjson? | select(.type == "assistant") | .message.content[]? | select(.type == "text") | .text' 2>/dev/null | \
+  head -c 4000)
+
+if [ -z "$LAST_ASSISTANT_TEXT" ]; then
+  exit 0
+fi
+
+# Get the model from the same transcript region for context in the advisory.
+MODEL=$(tac "$TRANSCRIPT" 2>/dev/null | head -n "$SCAN_LINES" | \
+  jq -rR 'fromjson? | select(.type == "assistant") | .message.model // empty' 2>/dev/null | head -1)
+MODEL="${MODEL:-unknown}"
+
+MATCHED_PATTERN=""
+
+# Pattern 1: "the (file|output|result|command|response) (was|is|shows|contains|returned):"
+if printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qiE 'the (file|output|result|command|response) (was|is|shows|contains|returned):'; then
+  MATCHED_PATTERN="claim-prefix"
+fi
+
+# Pattern 2: "I (confirmed|verified|checked|ran|executed) ... and ..."
+if [ -z "$MATCHED_PATTERN" ] && \
+   printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qiE 'I (confirmed|verified|checked|ran|executed) [^.]+ and [^.]+'; then
+  MATCHED_PATTERN="action-then-value"
+fi
+
+# Pattern 3: dollar amount without a hedging phrase preceding it.
+# Hedge phrases: "let me check", "I'll search", "checking", "looking up", "verify"
+if [ -z "$MATCHED_PATTERN" ]; then
+  if printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qE '\$[0-9]+(,[0-9]{3})*(\.[0-9]+)?'; then
+    if ! printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qiE '(let me check|let me search|let me look|i.?ll check|i.?ll search|checking|looking up|verify|searching)'; then
+      MATCHED_PATTERN="bare-price-claim"
+    fi
+  fi
+fi
+
+# Pattern 4: 40-char hex SHA-like pattern without a hedging phrase.
+if [ -z "$MATCHED_PATTERN" ]; then
+  if printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qE '\b[a-f0-9]{40}\b'; then
+    if ! printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qiE '(let me run|let me check|i.?ll run|git log will show|running git)'; then
+      MATCHED_PATTERN="bare-sha-claim"
+    fi
+  fi
+fi
+
+# Pattern 5: backtick-quoted file path on one line + triple-backtick code-block
+# start within the same text block. Two-grep heuristic because grep -E does not
+# cross newlines portably; the conjunction captures the "the file `/path/x`
+# contains:\n```" claim pattern. Drops the noise of files-mentioned-without-
+# inline-content (e.g. when the assistant just lists paths in prose).
+if [ -z "$MATCHED_PATTERN" ]; then
+  if printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qE '`[/.][^`]+`[^.]*:[[:space:]]*$' && \
+     printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qE '^```'; then
+    MATCHED_PATTERN="file-path-then-block"
+  fi
+fi
+
+if [ -z "$MATCHED_PATTERN" ]; then
+  exit 0
+fi
+
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "unknown"' 2>/dev/null)
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // "unknown"' 2>/dev/null)
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+mkdir -p "$(dirname "$LOG")" 2>/dev/null
+printf '{"ts":"%s","session":"%s","model":"%s","tool":"%s","pattern":"%s"}\n' \
+  "$TS" "$SESSION_ID" "$MODEL" "$TOOL" "$MATCHED_PATTERN" >> "$LOG"
+
+cat >&2 <<EOF
+NOTICE: pre-execution claim signature detected before this ${TOOL} call.
+        Pattern: ${MATCHED_PATTERN}. Model: ${MODEL}.
+        The last assistant text block contained a value-specific assertion of
+        the type associated with Cluster 22 candidate (Opus 4.8 pre-execution
+        tool-output fabrication). The model may be reasoning from invented
+        values before this tool actually runs.
+        Verification step: after this tool returns, compare the tool's actual
+        output against the value the assistant asserted in the preceding text.
+        If they diverge, this is a Cluster 22 Axis 22A confirmation — switch
+        to Opus 4.7 via '/model claude-opus-4-7' (#64065 reporter's comparison
+        shows Opus 4.7 in the same conditions does not surface the surge).
+        Companion hook: tool-result-correlation-checker.sh (PostToolUse,
+        catches Axis 22B parallel-batch fabrication compounding via tool_use_id
+        misattribution).
+        References: #64048 / #64055 / #64065 (anchor) / #64076 / #64095 / #64103
+        Log: ${LOG}
+        Suppress: export CC_OPUS48_PRE_CLAIM_QUIET=1
+EOF
+
+exit 0

package/examples/prefer-builtin-tools.sh

@@ -7,7 +7,16 @@
 # than bash equivalents. But Claude often reaches for sed, grep, cat instead.
 # This hook denies those commands with a pointer to the correct built-in tool.
 #
-# TRIGGER: PermissionRequest  MATCHER: ""
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+#
+# 2026-09-03 の訂正。ここは以前 `TRIGGER: PermissionRequest  MATCHER: ""` だった。
+# インストーラはこの行を読んで登録先を決めるので、出荷時のこのフックは
+# PermissionRequest へ登録されていた。そして本体が出す hookEventName は
+# 最初から "PreToolUse" で、宣言と中身が食い違っていた。
+# 隔離した HOME で測ると、出荷時の登録では `cat ./probe.txt` に対して
+# **一度も呼ばれなかった**（3条件・計器つきで0回）。登録先だけを
+# PreToolUse / matcher "Bash" へ変えると、同じ命令で1回呼ばれ、拒否も記録された。
+# 計器そのものは手で入力を流して発火することを先に確かめてある。
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

package/examples/prefer-dedicated-tools.sh

@@ -22,6 +22,18 @@
 #   }
 # }
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-prefer-dedicated-tools-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [prefer-dedicated-tools]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0

package/examples/prisma-migrate-guard.sh

@@ -2,8 +2,9 @@
 # ================================================================
 # prisma-migrate-guard.sh — Block destructive Prisma operations
 #
-# Blocks: prisma migrate reset, prisma db push --force-reset
-# Allows: prisma migrate dev, prisma generate, prisma db push
+# Blocks: prisma migrate reset, prisma db push --force-reset,
+#         prisma db push --accept-data-loss
+# Allows: prisma migrate dev, prisma generate, prisma db push (plain)
 #
 # Usage: Add to settings.json as a PreToolUse hook
 #
@@ -19,23 +20,39 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-prisma-migrate-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [prisma-migrate-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
 [[ -z "$COMMAND" ]] && exit 0
 
-# Block destructive Prisma commands
-if echo "$COMMAND" | grep -qE 'prisma\s+(migrate\s+reset|db\s+push\s+--force-reset)'; then
+# Block destructive Prisma commands. --force-reset drops and recreates the
+# whole database; --accept-data-loss applies data-destroying schema changes
+# without the interactive confirmation — the exact flag that wiped a production
+# DB in anthropics/claude-code#14411. Both can sit anywhere after `db push`
+# (e.g. after a --schema flag), so match across the rest of the command.
+if echo "$COMMAND" | grep -qE 'prisma\s+(migrate\s+reset|db\s+push\b.*(--force-reset|--accept-data-loss))'; then
     echo "BLOCKED: Destructive Prisma command." >&2
     echo "Command: $COMMAND" >&2
     echo "" >&2
-    echo "migrate reset / force-reset destroy all data." >&2
+    echo "migrate reset / --force-reset / --accept-data-loss destroy data." >&2
     echo "Use: prisma migrate dev (incremental migration)" >&2
     exit 2
 fi
 
-# Warn on prisma db push (schema push without migration history)
-if echo "$COMMAND" | grep -qE 'prisma\s+db\s+push\b' && ! echo "$COMMAND" | grep -q "\-\-force-reset"; then
+# Warn on plain prisma db push (schema push without migration history)
+if echo "$COMMAND" | grep -qE 'prisma\s+db\s+push\b' && ! echo "$COMMAND" | grep -qE '\-\-(force-reset|accept-data-loss)'; then
     echo "WARNING: prisma db push skips migration history." >&2
     echo "Consider: prisma migrate dev for tracked migrations." >&2
 fi

package/examples/production-port-kill-guard.sh

@@ -20,6 +20,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-production-port-kill-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [production-port-kill-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/prompt-injection-guard.sh

@@ -39,7 +39,8 @@ if echo "$OUTPUT" | grep -qiE '(new|updated|override)\s+system\s+prompt'; then
 fi
 
 # Hidden instructions in HTML comments or zero-width chars
-if echo "$OUTPUT" | grep -qP '<!--.*(?:execute|run|delete|remove).*-->'; then
+# -P は GNU 拡張。BSD grep では警告が黙って消える。(?:…) を () にすれば -E で足りる。
+if echo "$OUTPUT" | grep -qE '<!--.*(execute|run|delete|remove).*-->'; then
     echo "WARNING: Possible prompt injection in HTML comment" >&2
     SUSPICIOUS=1
 fi

package/examples/protect-claudemd.sh

@@ -11,6 +11,18 @@
 # MATCHER: "Edit|Write"
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-protect-claudemd-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [protect-claudemd]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)

package/examples/protect-dotfiles.sh

@@ -19,6 +19,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-protect-dotfiles-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [protect-dotfiles]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)