cc-safe-setup 29.7.0 → 30.0.4

package/examples/redundant-read-blocker.sh

@@ -0,0 +1,132 @@
+#!/bin/bash
+# redundant-read-blocker.sh — Prevent the model from re-reading files it has
+# already read recently in the same session.
+#
+# Solves: #60283 — "Excessive token consumption — task halted mid-execution
+# with zero output (macOS)" — where Claude re-read in-context files 10+ times
+# before being interrupted, with zero deliverable. Confirmed at scale by
+# yurukusa/quota-leakage-audit.sh — across multiple sessions on a single
+# operator, individual files were observed Read 3-5 times even when their
+# content had not changed.
+#
+# Background:
+#   https://gist.github.com/yurukusa/303431f8e32fed5081b6b2b89712c991 (cluster)
+#   https://gist.github.com/yurukusa/0dbe97df416c53c43dd699b72f439060 (audit)
+#
+# How it works:
+#   Maintains a per-session set of recently-read files at
+#   $STATE_DIR/<session>/reads.log. On each PreToolUse for Read, checks if
+#   the file was already read within the configured window of tool calls.
+#   If so, emits a system reminder advising the model to use what's already
+#   in context, and (in strict mode) refuses the call.
+#
+#   The hook respects mtime: if the file has been modified since the previous
+#   read, it is NOT considered redundant and the new read passes.
+#
+# TRIGGER: PreToolUse
+# MATCHER: Read
+#
+# CONFIGURATION:
+#   CC_REDUNDANT_READ_WINDOW=20    # how many recent reads to keep tracking
+#   CC_REDUNDANT_READ_THRESHOLD=1  # warn after N prior reads (default 1 = the first re-read of an unchanged file fires)
+#   CC_REDUNDANT_READ_STRICT=0     # 1 = exit 2 (hard block), 0 = stderr warning (default)
+#   CC_REDUNDANT_READ_STATE_DIR    # default /tmp/cc-redundant-read
+#
+# Usage in settings.json:
+#   {
+#     "hooks": {
+#       "PreToolUse": [{
+#         "matcher": "Read",
+#         "hooks": [{
+#           "type": "command",
+#           "command": "~/.claude/hooks/redundant-read-blocker.sh"
+#         }]
+#       }]
+#     }
+#   }
+
+set -uo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-redundant-read-blocker-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [redundant-read-blocker]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat 2>/dev/null || true)
+[ -z "$INPUT" ] && exit 0
+
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ "$TOOL" != "Read" ] && exit 0
+
+FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "default"' 2>/dev/null)
+[ -z "$FILE_PATH" ] && exit 0
+
+WINDOW="${CC_REDUNDANT_READ_WINDOW:-20}"
+THRESHOLD="${CC_REDUNDANT_READ_THRESHOLD:-1}"
+STRICT="${CC_REDUNDANT_READ_STRICT:-0}"
+STATE_DIR="${CC_REDUNDANT_READ_STATE_DIR:-/tmp/cc-redundant-read}/$SESSION_ID"
+
+mkdir -p "$STATE_DIR" 2>/dev/null || true
+READS_LOG="$STATE_DIR/reads.log"
+
+# Get current mtime of the target file (may not exist yet, that's fine)
+CUR_MTIME=$(stat -c '%Y' "$FILE_PATH" 2>/dev/null || echo "0")
+
+# Count how many times this path has been read within the window, accounting
+# for mtime: an entry only counts as a "previous read" if the file has NOT
+# been modified since.
+PREVIOUS=0
+LAST_MTIME=""
+if [ -f "$READS_LOG" ]; then
+    # Tail the last N lines, then filter for matching paths
+    while IFS=$'\t' read -r p m; do
+        if [ "$p" = "$FILE_PATH" ]; then
+            # If the recorded mtime equals the current mtime, the file is unchanged
+            if [ "$m" = "$CUR_MTIME" ]; then
+                PREVIOUS=$((PREVIOUS + 1))
+            fi
+        fi
+    done < <(tail -n "$WINDOW" "$READS_LOG" 2>/dev/null)
+fi
+
+# Append this read to the log (always — even on block, since the model may
+# choose to override and we want to track that)
+printf '%s\t%s\n' "$FILE_PATH" "$CUR_MTIME" >> "$READS_LOG"
+
+# Trim log to the window
+tail -n "$WINDOW" "$READS_LOG" > "$READS_LOG.tmp" && mv "$READS_LOG.tmp" "$READS_LOG"
+
+# Decide based on threshold
+if [ "$PREVIOUS" -ge "$THRESHOLD" ]; then
+    cat >&2 <<EOF
+<system-reminder>
+REDUNDANT READ — $FILE_PATH has already been read $PREVIOUS time(s) in this
+session without modification since the last read. The file content is already
+in the conversation context.
+
+If you genuinely need to verify the content, use Grep with a specific pattern
+rather than re-reading the entire file. If you are reading to refresh memory,
+use what is already in context — re-reading consumes input tokens for content
+the model already has.
+
+Background: #60283 (excessive token consumption with re-reads of in-context
+files). Audit: https://gist.github.com/yurukusa/0dbe97df416c53c43dd699b72f439060
+
+To disable this gate: set CC_REDUNDANT_READ_STRICT=0 and CC_REDUNDANT_READ_THRESHOLD
+higher, or remove the hook from settings.json.
+</system-reminder>
+EOF
+    if [ "$STRICT" = "1" ]; then
+        exit 2
+    fi
+fi
+
+exit 0

package/examples/refusal-arrest-gate.sh

@@ -0,0 +1,248 @@
+#!/bin/bash
+# refusal-arrest-gate.sh — Block the next tool call if the assistant's prose
+# in the same turn explicitly refused that action ("I won't modify X",
+# "I'll skip X", "I'll preserve X") and the tool call contradicts the refusal.
+#
+# Sister hook to closure-word-verify-gate.sh. Both follow the same shape
+# (recognition-without-arrest from #60226): the model's own prose names what
+# it will and will not do, and the actual tool sequence is uncorrelated with
+# the naming. closure-word-verify-gate fires on positive-closure language;
+# this one fires on self-stated NEGATIVE action followed by the action.
+#
+# Solves: refusal-side dual of #60506. Examples observed in the wild:
+#   - #60475 — sub-agent stated it would preserve uncommitted work, then
+#              ran `git checkout -- <files>` against the other operator's
+#              unstaged edits.
+#   - #60506 — agent acknowledged the categorical native-React ban, then
+#              introduced a native React component on the next Write.
+#              Agent confirmed the i18n-only label rule, then hardcoded
+#              the label in the next Edit.
+#   - #60188 — fraction of 51 acknowledged-rule-violations followed
+#              refusal-shape syntax in the response stream.
+#
+# Design philosophy:
+#   The cluster's load-bearing observation: prose rules cannot be
+#   the load-bearing element of architectural guarantees. The load-
+#   bearing element has to live in the harness at the point of action.
+#   closure-word-verify-gate lives on Stop (session-terminal). This hook
+#   lives on PreToolUse (mid-turn) because refusal-side failures happen
+#   between the refusal statement and the next user prompt.
+#
+# False-positive control (three constraints, in order of importance):
+#   1. TARGET MATCH, not verb match: a refusal of "I'll skip the test step"
+#      only triggers if the next tool call's target IS the test step.
+#      "I'll skip X → tool call edits Y" does not trigger.
+#   2. CURRENT TURN ONLY: refusals from prior turns do not gate the
+#      current PreToolUse. Refusal scope = same-turn assistant prose.
+#   3. ASSISTANT-ORIGINATED ONLY: refusals inside a quoted user-prompt
+#      block are ignored (the agent reading back what the user said
+#      should not trigger the gate when the agent does X next).
+#
+# Related Issues:
+#   #60506 (@zean89,   2026-05-19) — first-person self-report
+#   #60226 (@suwayama, 2026-05-18) — recognition-without-arrest framework
+#   #60475                          — sub-agent git checkout data loss
+#   #60188 (@beq00000)              — 51 rule violations in one session
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Edit|Write|Bash|MultiEdit"
+#
+# CONFIGURATION (environment variables):
+#   CC_REFUSAL_PATTERNS       default built-in — pipe-separated regex of
+#                                                  refusal phrases (capturing
+#                                                  group 1 = target words)
+#   CC_REFUSAL_GATE_DISABLE   set to "1" to disable the gate entirely
+#
+# USAGE (settings.json):
+#   {
+#     "hooks": {
+#       "PreToolUse": [{
+#         "matcher": "Edit|Write|Bash|MultiEdit",
+#         "hooks": [{
+#           "type": "command",
+#           "command": "~/.claude/hooks/refusal-arrest-gate.sh"
+#         }]
+#       }]
+#     }
+#   }
+
+set -uo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-refusal-arrest-gate-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [refusal-arrest-gate]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_REFUSAL_GATE_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat 2>/dev/null || true)
+[ -z "$INPUT" ] && exit 0
+
+# Default refusal patterns. Each pattern's capturing group 1 extracts the
+# target (file, action, step name) that the agent stated it would not act on.
+# The regex is permissive on the target to handle the natural-language tail.
+DEFAULT_REFUSAL_PATTERNS='I (will not|won['"'"']?t|am not going to|wo n['"'"']?t) (modify|edit|change|touch|update|delete|remove|overwrite|push|commit|run|execute|create|write to|alter|patch|replace|drop|reset) ([A-Za-z0-9_./@\-]+)|I['"'"']?ll (skip|preserve|keep|leave|not touch|not modify|avoid|leave alone|not change|not edit) (the |an? )?([A-Za-z0-9_./@\-]+)|let me not (modify|edit|change|touch|update|delete|run) ([A-Za-z0-9_./@\-]+)|skipping (the )?([A-Za-z0-9_./@\-]+)|preserving (the )?([A-Za-z0-9_./@\-]+)'
+
+REFUSAL_PATTERNS="${CC_REFUSAL_PATTERNS:-$DEFAULT_REFUSAL_PATTERNS}"
+
+# PreToolUse input shape: { tool_name, tool_input, transcript (path or array) }
+TOOL_NAME=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ -z "$TOOL_NAME" ] && exit 0
+
+# Tool target extraction by tool type
+case "$TOOL_NAME" in
+    Write|Edit|MultiEdit)
+        TOOL_TARGET=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+        ;;
+    Bash)
+        TOOL_TARGET=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+        ;;
+    *)
+        # Non-instrumented tool — pass through.
+        exit 0
+        ;;
+esac
+
+[ -z "$TOOL_TARGET" ] && exit 0
+
+# Pull the assistant's most recent message text in this turn. The transcript
+# field in PreToolUse may be a file path (newer shapes) or inline.
+TRANSCRIPT_PATH=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+ASSISTANT_TEXT=""
+
+if [ -n "$TRANSCRIPT_PATH" ] && [ -f "$TRANSCRIPT_PATH" ]; then
+    # Read the last assistant message from JSONL transcript.
+    # Iterate from the bottom up, take the first message with role=assistant.
+    #
+    # Parse PER LINE with `fromjson?` rather than slurping the whole window
+    # with `jq -rs`. A single transcript line carrying a raw control char
+    # (U+0000-U+001F, e.g. an unescaped newline from a large tool-output or
+    # heredoc block) makes a slurp fail outright ("control characters ... must
+    # be escaped"), which would empty ASSISTANT_TEXT and silently fail the gate
+    # open exactly when the transcript is large/messy. fromjson? drops only the
+    # unparseable line; -c keeps each assistant message as one JSON object so we
+    # can take the most-recent (first after tac) and still preserve multi-line
+    # text. See anthropics/claude-code#68665.
+    ASSISTANT_TEXT=$(tac "$TRANSCRIPT_PATH" 2>/dev/null \
+        | jq -cR 'fromjson? | select(.message.role == "assistant" or .role == "assistant")' 2>/dev/null \
+        | head -n 1 \
+        | jq -r '
+            (.message.content // .content // empty)
+            | if type == "array" then map(select(.type == "text") | .text) | join("\n") else . end
+        ' 2>/dev/null \
+        || true)
+fi
+
+# Fallback inline shapes.
+if [ -z "$ASSISTANT_TEXT" ]; then
+    ASSISTANT_TEXT=$(printf '%s' "$INPUT" | jq -r '
+        .last_assistant_message //
+        .assistant_message //
+        .turn_assistant_text //
+        empty
+    ' 2>/dev/null)
+fi
+
+[ -z "$ASSISTANT_TEXT" ] && exit 0
+
+# Strip quoted user-prompt blocks (lines starting with "> " in markdown,
+# or text inside <user_prompt>/<quoted-prompt> tags). Refusals quoted from
+# the user must not trigger the gate when the agent does X next.
+FILTERED_TEXT=$(printf '%s' "$ASSISTANT_TEXT" \
+    | sed -e 's/<user_prompt>[^<]*<\/user_prompt>//g' \
+          -e 's/<quoted-prompt>[^<]*<\/quoted-prompt>//g' \
+    | grep -v '^>' \
+    || true)
+
+[ -z "$FILTERED_TEXT" ] && exit 0
+
+# Match refusal patterns against the filtered text. Pull every matching
+# refusal-target word into a candidate list. Strip trailing punctuation
+# (period, comma, semicolon, colon) so that "config.json." in prose matches
+# "config.json" in the tool target.
+REFUSAL_TARGETS=$(printf '%s' "$FILTERED_TEXT" \
+    | grep -Eio "$REFUSAL_PATTERNS" \
+    | sed -E 's/^(I (will not|won.?t|am not going to|wo n.?t) (modify|edit|change|touch|update|delete|remove|overwrite|push|commit|run|execute|create|write to|alter|patch|replace|drop|reset)) //I; s/^(I.?ll (skip|preserve|keep|leave|not touch|not modify|avoid|leave alone|not change|not edit)) (the |an? )?//I; s/^(let me not (modify|edit|change|touch|update|delete|run)) //I; s/^(skipping|preserving) (the )?//I' \
+    | tr -s ' ' '\n' \
+    | sed -E 's/[.,;:!?]+$//' \
+    | grep -vE '^(the|a|an|to|and|or|that|this|file|files|step|steps)$' \
+    | sort -u)
+
+[ -z "$REFUSAL_TARGETS" ] && exit 0
+
+# For each refusal target, check whether it appears in the tool target.
+# Match is substring-of-basename for file paths, substring-of-command
+# for Bash. Case-insensitive.
+TOOL_TARGET_LC=$(printf '%s' "$TOOL_TARGET" | tr '[:upper:]' '[:lower:]')
+
+# For Write/Edit, also try the basename in case the refusal mentioned only
+# the filename without the path.
+if [ "$TOOL_NAME" != "Bash" ]; then
+    TOOL_BASENAME=$(basename "$TOOL_TARGET" 2>/dev/null | tr '[:upper:]' '[:lower:]')
+else
+    TOOL_BASENAME=""
+fi
+
+MATCHED_TARGET=""
+while IFS= read -r target; do
+    [ -z "$target" ] && continue
+    target_lc=$(printf '%s' "$target" | tr '[:upper:]' '[:lower:]')
+    # Skip very short targets to avoid spurious matches.
+    [ "${#target_lc}" -lt 3 ] && continue
+
+    if [ "$TOOL_NAME" = "Bash" ]; then
+        # For Bash, match the refusal target against any token in the command.
+        if printf '%s' "$TOOL_TARGET_LC" | grep -Fq "$target_lc"; then
+            MATCHED_TARGET="$target"
+            break
+        fi
+    else
+        # For Write/Edit/MultiEdit, match against path or basename.
+        if printf '%s' "$TOOL_TARGET_LC" | grep -Fq "$target_lc" \
+            || ([ -n "$TOOL_BASENAME" ] && printf '%s' "$TOOL_BASENAME" | grep -Fq "$target_lc"); then
+            MATCHED_TARGET="$target"
+            break
+        fi
+    fi
+done <<<"$REFUSAL_TARGETS"
+
+[ -z "$MATCHED_TARGET" ] && exit 0
+
+# Refusal target matched the tool target. Surface the contradiction.
+cat >&2 <<EOF
+<system-reminder>
+REFUSAL-SIDE ARREST — your assistant prose in this turn stated that you would
+not act on "$MATCHED_TARGET", and the next tool call is $TOOL_NAME against
+a target that contains "$MATCHED_TARGET":
+
+  tool:    $TOOL_NAME
+  target:  $TOOL_TARGET
+  refusal: "$MATCHED_TARGET" (matched from your same-turn prose)
+
+This is the refusal-side dual of the failure mode in #60506 and #60475:
+the model's prose names what it will not do, and the actual tool sequence
+contradicts the naming. The cost of an unverified refusal-then-action
+contradiction lands on the operator, not on the model.
+
+Before proceeding, either:
+
+  1. Acknowledge the contradiction explicitly in the next turn, state
+     the reason the action is now correct, and re-issue the tool call
+     with the reason in the same turn, OR
+  2. Restate the refusal as conditional ("I'll not modify $MATCHED_TARGET
+     unless <condition>"), satisfy the condition, then proceed.
+
+To disable this gate intentionally (for retrospectives, plans, documentation
+turns that quote intentions without executing them), set
+CC_REFUSAL_GATE_DISABLE=1 in your environment.
+</system-reminder>
+EOF
+
+exit 2

package/examples/registry-publish-guard.sh

@@ -17,7 +17,19 @@
 #   docker push           (Docker Hub)
 #   helm push             (Helm charts)
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-registry-publish-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [registry-publish-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

package/examples/remote-control-billing-classifier.sh

@@ -0,0 +1,135 @@
+#!/bin/bash
+# ================================================================
+# remote-control-billing-classifier.sh — Warn at session start when
+#   the parent process tree includes `claude remote-control`, so
+#   the operator knows the spawned `claude --print` child will draw
+#   from the new Agent SDK monthly credit (Pool 2) starting June 15,
+#   2026, separate from interactive usage limits.
+# ================================================================
+# PURPOSE:
+#   Issue #59823 documents the implementation detail that
+#   `claude remote-control` spawns one `claude --print --sdk-url …`
+#   child per session. The June 15, 2026 billing split routes
+#   `claude --print` and Agent SDK usage to a new "automation
+#   bucket" (Pool 2) on Pro $20 / Max 5x $100 / Max 20x $200 plans,
+#   separate from interactive Claude Code usage. The documentation
+#   does not yet classify `claude remote-control` itself, so
+#   operators running automation through it can silently double-
+#   consume Pool 2 once the cliff lands.
+#
+#   This hook reads the process tree at session start. When any
+#   ancestor command line matches `claude remote-control`, it emits
+#   a one-line stderr advisory naming the Pool 2 implication and
+#   pointing to the two operator-side audits worth running before
+#   June 15. Advisory only (exit 0); does not block the session.
+#
+# TRIGGER: SessionStart
+# MATCHER: ""
+#
+# UPSTREAM:
+#   #59823 [DOCS] Billing implications for `claude remote-control`
+#          on June 15th (Pool 2 classification of the child
+#          `claude --print` process is undocumented as of 2026-05-28)
+#
+# SETUP:
+#   {
+#     "hooks": {
+#       "SessionStart": [
+#         {
+#           "matcher": "",
+#           "hooks": [
+#             { "type": "command",
+#               "command": "$HOME/.claude/hooks/remote-control-billing-classifier.sh" }
+#           ]
+#         }
+#       ]
+#     }
+#   }
+#
+# BEHAVIOR:
+#   - No `claude remote-control` ancestor → silent pass.
+#   - Ancestor found → stderr advisory + exit 0 (does not block).
+#
+# CONFIGURATION (env vars):
+#   CC_REMOTE_CONTROL_DISABLE          Set to "1" to disable the hook.
+#   CC_REMOTE_CONTROL_PROCESS_OVERRIDE Comma-separated cmdlines to scan
+#                                      instead of live `ps` output.
+#                                      Used by tests; also lets CI
+#                                      simulate a remote-control parent.
+#   CC_REMOTE_CONTROL_PATTERN          Override the cmdline regex
+#                                      (default: "claude remote-control").
+# ================================================================
+
+set -u
+
+if [ "${CC_REMOTE_CONTROL_DISABLE:-0}" = "1" ]; then
+    exit 0
+fi
+
+PATTERN="${CC_REMOTE_CONTROL_PATTERN:-claude remote-control}"
+
+# Read stdin (SessionStart JSON payload) but do not require its shape.
+# The hook only inspects the process tree, not the payload.
+if [ ! -t 0 ]; then
+    cat >/dev/null 2>&1 || true
+fi
+
+# Gather candidate cmdlines: either the override (for tests) or
+# the live ancestor process tree via `ps`.
+CMDLINES=""
+if [ -n "${CC_REMOTE_CONTROL_PROCESS_OVERRIDE:-}" ]; then
+    CMDLINES="$CC_REMOTE_CONTROL_PROCESS_OVERRIDE"
+else
+    # Walk parent PIDs upward and collect cmdlines. We avoid `ps
+    # --forest` because BusyBox does not implement it; instead we
+    # follow PPID via /proc when available, falling back to ps -p.
+    PID=$$
+    DEPTH=0
+    while [ "$PID" != "1" ] && [ "$DEPTH" -lt 20 ]; do
+        if [ -r "/proc/$PID/cmdline" ]; then
+            CMD=$(tr '\0' ' ' < "/proc/$PID/cmdline" 2>/dev/null)
+            CMDLINES="${CMDLINES}${CMD}
+"
+            PPID=$(awk '/^PPid:/ {print $2}' "/proc/$PID/status" 2>/dev/null)
+        else
+            CMD=$(ps -o args= -p "$PID" 2>/dev/null)
+            CMDLINES="${CMDLINES}${CMD}
+"
+            PPID=$(ps -o ppid= -p "$PID" 2>/dev/null | tr -d ' ')
+        fi
+        if [ -z "$PPID" ] || [ "$PPID" = "$PID" ]; then
+            break
+        fi
+        PID="$PPID"
+        DEPTH=$((DEPTH+1))
+    done
+fi
+
+# Look for the pattern in any candidate cmdline.
+if printf '%s' "$CMDLINES" | grep -q -- "$PATTERN"; then
+    cat >&2 <<EOF
+
+⚠️  Session started under \`claude remote-control\`.
+
+   Starting 2026-06-15, the child \`claude --print --sdk-url …\`
+   process that remote-control spawns will draw from the new
+   Agent SDK monthly credit (Pool 2), separate from interactive
+   Claude Code usage. The documentation does not yet classify
+   \`claude remote-control\` itself (see issue #59823), so
+   automation that drives sessions through it can silently
+   consume Pool 2 once the cliff lands.
+
+   Two pre-June-15 audits worth running:
+     1. \`ps --forest -p \$(pgrep -f 'claude remote-control')\`
+        — confirm the children you expect, no stray sessions.
+     2. Open https://support.claude.com/en/articles/15036540
+        and verify the one-time Agent SDK opt-in is pressed
+        for the account that owns the remote-control server.
+
+   This is an advisory; the session continues.
+   Set CC_REMOTE_CONTROL_DISABLE=1 to silence.
+
+EOF
+fi
+
+exit 0

package/examples/replace-all-guard.sh

@@ -33,6 +33,18 @@
 
 set -u
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-replace-all-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [replace-all-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 
 REPLACE_ALL=$(printf '%s' "$INPUT" | jq -r '.tool_input.replace_all // false' 2>/dev/null)

package/examples/repo-visibility-guard.sh

@@ -14,6 +14,18 @@
 #   }
 # }
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-repo-visibility-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [repo-visibility-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0