cc-safe-setup 29.7.0 → 30.0.4

package/examples/reroute-after-block-guard.sh

@@ -0,0 +1,150 @@
+#!/bin/bash
+# ================================================================
+# reroute-after-block-guard.sh — Stop "reroute after a block"
+# ================================================================
+# PURPOSE:
+#   PreToolUse hooks are stateless: each one evaluates the current
+#   action in isolation, with no memory that a sibling action was
+#   just denied. So a common failure trajectory slips through —
+#   a gate fires on an action, the agent substitutes an equivalent
+#   path toward the SAME target, and the next hook sees a fresh,
+#   individually-defensible action and lets it run.
+#   (anthropics/claude-code#70112: "Agent treats safety gates as
+#    obstacles to route around" — goal misgeneralization.)
+#
+#   This hook adds the missing state. It reads the transcript: if
+#   the PREVIOUS tool call was blocked by a PreToolUse hook and the
+#   CURRENT action targets the same concrete FILE/path, it stops and
+#   surfaces to the human instead of letting the reroute proceed. A
+#   fired gate should RAISE the threshold for proceeding, not prompt
+#   a search for another path.
+#
+#   This does not change the model's disposition; it converts a
+#   silent reroute into a hard stop for the case where the blast
+#   radius is concentrated on one target (a file, a path).
+#
+# Detects (only when ALL hold, else it stays out of the way):
+#   1. the most recent tool result is an error, AND
+#   2. its text is a Claude Code PreToolUse hook block
+#      (the "PreToolUse: ... hook error" runner phrasing), AND
+#   3. the blocked action and the current action share a concrete
+#      filesystem path (anchored path or a path with a file
+#      extension). Bare word/word tokens and git refs (origin/main,
+#      refs/heads/...) are NOT treated as targets — inspecting a
+#      branch after a push is rejected must stay allowed.
+#
+# Does NOT block (fail-open by design — never guesses):
+#   - no transcript available / unreadable / jq missing
+#   - previous tool succeeded (no gate fired)
+#   - the error was a normal failure or a server-side rejection
+#     ("permission denied", git "blocked by required reviews", etc.)
+#   - no shared concrete file/path between blocked and current action
+#   - the human explicitly re-authorizes with CC_REROUTE_ALLOW=1
+#
+# Legitimate retry after fixing the real problem is expected: set
+#   CC_REROUTE_ALLOW=1 for that one command. Being forced to do so
+#   IS the point — it makes "proceed after a block" a conscious act.
+#
+# NOTE: this hook deliberately omits `set -e`/`pipefail`. Every
+#   jq/tail/grep failure must fall through to the next
+#   `[ -z "$VAR" ] && exit 0` guard; a crash exit (1) would be
+#   miscounted by Claude Code as a hook error rather than "allow".
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash|Edit|Write|MultiEdit"
+#
+# CONFIG:
+#   CC_REROUTE_ALLOW=1     one-shot override (proceed despite block)
+#   CC_REROUTE_DISABLE=1   disable this hook entirely
+# ================================================================
+
+[ "${CC_REROUTE_DISABLE:-0}" = "1" ] && exit 0
+[ "${CC_REROUTE_ALLOW:-0}" = "1" ] && exit 0
+
+command -v jq >/dev/null 2>&1 || exit 0
+
+INPUT=$(cat)
+
+TP=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+[ -z "$TP" ] && exit 0
+TP="${TP/#\~/$HOME}"
+[ -r "$TP" ] || exit 0
+
+# Current action's concrete target (command string or edited file).
+CUR=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // .tool_input.file_path // empty' 2>/dev/null)
+[ -z "$CUR" ] && exit 0
+
+# Only the tail matters: a blocked tool_use and its result are adjacent
+# and most recent. Bound the work so the hook stays cheap.
+WINDOW=$(tail -n 120 "$TP" 2>/dev/null)
+[ -z "$WINDOW" ] && exit 0
+
+# Most recent tool_result: {id, err, text}. Parse each line independently with
+# `try fromjson catch empty` so one malformed line can't abort the scan and
+# leave us reading a stale (older) result. content may be string or array.
+LAST=$(printf '%s' "$WINDOW" \
+  | jq -Rc 'try (fromjson) catch empty
+           | select(.message.content? != null) | .message.content[]?
+           | select(.type=="tool_result")
+           | {id: .tool_use_id,
+              err: (.is_error // false),
+              text: (.content
+                     | if type=="array" then (map(.text? // "") | join(" "))
+                       elif type=="string" then .
+                       else "" end)}' 2>/dev/null | tail -n 1)
+[ -z "$LAST" ] && exit 0
+
+ERR=$(printf '%s' "$LAST" | jq -r '.err // false' 2>/dev/null)
+[ "$ERR" = "true" ] || exit 0
+
+TEXT=$(printf '%s' "$LAST" | jq -r '.text // ""' 2>/dev/null)
+# Was the previous action stopped by a Claude Code PreToolUse hook? Match ONLY
+# the hook runner's own phrasing ("PreToolUse: <matcher> hook error"). Generic
+# "permission denied" / git "blocked by ..." server rejections are NOT gates —
+# matching them would false-block ordinary post-failure work.
+printf '%s' "$TEXT" | grep -qE 'PreToolUse:[^|]*hook error' || exit 0
+
+BLOCKED_ID=$(printf '%s' "$LAST" | jq -r '.id // empty' 2>/dev/null)
+[ -z "$BLOCKED_ID" ] && exit 0
+
+# The blocked action's concrete target, linked by tool_use_id.
+BLOCKED=$(printf '%s' "$WINDOW" \
+  | jq -Rr --arg id "$BLOCKED_ID" 'try (fromjson) catch empty
+          | select(.message.content? != null) | .message.content[]?
+          | select(.type=="tool_use" and .id==$id)
+          | (.input.command // .input.file_path // empty)' 2>/dev/null | tail -n 1)
+[ -z "$BLOCKED" ] && exit 0
+
+# Shared concrete file/path? Pull slash-bearing tokens from the blocked action,
+# keep only real filesystem paths (anchored with / ./ ../ ~/, or carrying a file
+# extension), drop flags and git refs, and look for any in the current action.
+# A file/path overlap is the strong, low-false-positive signal that the agent is
+# rerouting toward the same resource rather than doing unrelated work.
+SHARED=""
+while IFS= read -r tok; do
+    [ -z "$tok" ] && continue
+    case "$tok" in
+        -*) continue ;;                                                   # flag
+        origin/*|upstream/*|remotes/*|refs/*|heads/*|tags/*) continue ;;  # git refs
+    esac
+    [ "${#tok}" -lt 4 ] && continue
+    case "$tok" in
+        /*|./*|../*|~/*) : ;;   # anchored filesystem path
+        *.*) : ;;               # carries a file extension
+        *) continue ;;          # bare word/word (e.g. origin/main) — not a target
+    esac
+    if printf '%s' "$CUR" | grep -qF -- "$tok"; then
+        SHARED="$tok"
+        break
+    fi
+done < <(printf '%s' "$BLOCKED" | grep -oE '(/|\./|\.\./|~/)?[A-Za-z0-9_.-]+(/[A-Za-z0-9_.+-]+)+')
+
+[ -z "$SHARED" ] && exit 0
+
+cat >&2 <<MSG
+ブロック: 直前の操作はゲート(PreToolUseのhook)で止められました。
+今回の操作は同じ対象「${SHARED}」へ向かう再ルートに見えます。
+ゲートの発火は「別の経路を探せ」ではなく「立ち止まって正しさを確かめろ」の合図です。
+回避策を探さず、人へ状況を共有してください。
+本当に正しいと確認した上で進めるなら、その1コマンドだけ CC_REROUTE_ALLOW=1 を付けて実行してください。
+MSG
+exit 2

package/examples/resume-drift-watcher.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# resume-drift-watcher.sh — resume attachment relocation detector (Incident 2)
+# Why: v2.1.69–v2.1.89 had a bug where --resume would relocate the original
+#      attachment payload out of messages[0] and into a later turn. The bug
+#      was marked fixed but residual drift still shows a tiny messages[0]
+#      (~350 bytes) when a resumed session is working correctly. A session
+#      with drifted attachments shows a very small messages[0] followed by
+#      disproportionately large messages[N] entries.
+# Event: PostToolUse  MATCHER: "*"
+# Action: Per turn, record first-message byte length and total-message byte
+#         length to ~/.claude/logs/resume-drift.log. Compare manually: a
+#         session started with --resume whose messages[0] is much smaller
+#         than a fresh session's is a drift candidate.
+#
+# Review with:
+#   awk -F'\t' '$3<500 && $4>50000 {print}' ~/.claude/logs/resume-drift.log
+
+set -u
+
+LOG_DIR="${HOME}/.claude/logs"
+LOG_FILE="${LOG_DIR}/resume-drift.log"
+mkdir -p "$LOG_DIR" 2>/dev/null
+
+INPUT=$(cat)
+
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "unknown"' 2>/dev/null)
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+
+if [ -z "$TRANSCRIPT" ] || [ ! -r "$TRANSCRIPT" ]; then
+  exit 0
+fi
+
+# First message — scan from top; stop at first user message.
+FIRST_MSG=$(grep -m1 '"role":"user"' "$TRANSCRIPT" 2>/dev/null || true)
+FIRST_LEN=$(printf '%s' "$FIRST_MSG" | wc -c | tr -d ' ')
+
+# Total body size = file size of the transcript itself. This is a conservative
+# proxy for request-body size: a resumed session with many large intermediate
+# messages will have a large transcript.
+TOTAL_LEN=$(wc -c < "$TRANSCRIPT" 2>/dev/null | tr -d ' ')
+TOTAL_LEN="${TOTAL_LEN:-0}"
+
+TURN_COUNT=$(grep -c '"role":' "$TRANSCRIPT" 2>/dev/null || echo 0)
+
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+printf '%s\t%s\t%s\t%s\t%s\n' \
+  "$TS" "$SESSION_ID" "$FIRST_LEN" "$TOTAL_LEN" "$TURN_COUNT" \
+  >> "$LOG_FILE"
+
+# Only emit a stderr warning after turn 2 (per Appendix B: "Only investigate
+# after the first two turns of a resumed session"). Threshold: first-user
+# message under 500 bytes while total already exceeds 50 KB = drift candidate.
+if [ "$TURN_COUNT" -gt 4 ] && [ "$FIRST_LEN" -lt 500 ] && [ "$TOTAL_LEN" -gt 50000 ]; then
+  echo "⚠ resume-drift signal: messages[0]=${FIRST_LEN}B / total=${TOTAL_LEN}B (see #43278)" >&2
+fi
+
+exit 0

package/examples/rg-replace-flag-detector.sh

@@ -0,0 +1,125 @@
+#!/bin/bash
+# rg-replace-flag-detector.sh — Warn when Claude reaches for `rg -r` thinking it means recursive
+#
+# Solves: anthropics/claude-code#62016 — Claude's "grep -r" muscle memory leads it
+#         to invoke `rg -rn`, which ripgrep parses as `--replace=n`. Every match is
+#         silently rewritten to the literal `n` in stdout, exit 0, no error. Claude
+#         then reads its own corrupted output, misattributes the garbage to an
+#         "external cause" (post-processing layer, compression), and burns cycles
+#         debugging a self-inflicted flag bug.
+#
+# How it works: PreToolUse hook on Bash that scans the proposed command for the
+#   `rg -r[a-z]` pattern (and variants like `rg -rn`, `rg -rln`, `rg --replace`
+#   without TEXT). Emits a stderr advisory pointing to the correct flag
+#   (`-l` for line numbers is wrong too; line numbers are `-n`; recursive search
+#   is the default for ripgrep, so no `-r` needed at all). Default mode is
+#   advisory (exit 0 with stderr); strict mode (env var CC_RG_REPLACE_DETECTOR_MODE=strict)
+#   blocks the call (exit 2).
+#
+# This is the Cluster-4 hook from the 2026-05-25 customer pain audit
+# (~/ops/customer-pain-audit-2026-05-25-post-launch-cluster.md). It catches
+# the tool-flag self-deception pattern at the boundary where the corrupted
+# output would otherwise enter the model's context.
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+#
+# Usage:
+# {
+#   "hooks": {
+#     "PreToolUse": [{
+#       "matcher": "Bash",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/rg-replace-flag-detector.sh" }]
+#     }]
+#   }
+# }
+#
+# Configuration:
+#   CC_RG_REPLACE_DETECTOR_DISABLE=1 — skip the check entirely
+#   CC_RG_REPLACE_DETECTOR_MODE=strict — exit 2 (hard block) instead of exit 0 (advisory)
+
+# Read stdin first so the upstream writer never sees EPIPE, even when disabled.
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-rg-replace-flag-detector-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [rg-replace-flag-detector]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat 2>/dev/null || true)
+
+[ "${CC_RG_REPLACE_DETECTOR_DISABLE:-0}" = "1" ] && exit 0
+[ -z "$INPUT" ] && exit 0
+
+# Only fire on Bash tool calls.
+TOOL_NAME=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ "$TOOL_NAME" = "Bash" ] || exit 0
+
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+# Detect rg with -r or --replace flag.
+# Patterns to catch:
+#   rg -r <TEXT>
+#   rg -rn / rg -rln (recursive + line numbers — but rg -r is --replace, not recursive)
+#   rg -r=<TEXT>
+#   rg --replace=<TEXT>
+#   rg --replace <TEXT>
+# Patterns to skip (no false positive):
+#   rg -e <PATTERN> (extended regex, different flag)
+#   rg --regexp=<PATTERN>
+#   rg -i / --ignore-case
+DETECTED=""
+
+# Approach: confirm `rg` is invoked, then look for any short-flag token containing
+# `r` anywhere in the rg invocation (separated by whitespace, not embedded in a
+# long flag like `--regexp`).
+#
+# Step 1: confirm rg appears as a command (start of line, after pipe/semicolon,
+# or after a word boundary like xargs).
+if printf '%s' "$COMMAND" | grep -qE '(^|[[:space:]|;&]|xargs[[:space:]]+)rg([[:space:]]|$)'; then
+    # Step 2: look for any short-flag token (single -, not --) containing r.
+    # This matches `-r`, `-rn`, `-rln`, `-rH`, `-erR`, etc. but NOT `--regexp` or `--replace=X`.
+    if printf '%s' "$COMMAND" | grep -qE '(^|[[:space:]])-[a-zA-Z]*r[a-zA-Z]*([[:space:]]|$)'; then
+        DETECTED="short-flag"
+    fi
+    # Step 3: explicitly match --replace as a long flag.
+    if printf '%s' "$COMMAND" | grep -qE '(^|[[:space:]])--replace([=[:space:]]|$)'; then
+        DETECTED="long-flag"
+    fi
+fi
+
+[ -z "$DETECTED" ] && exit 0
+
+cat >&2 <<EOF
+<system-reminder>
+rg-replace-flag-detector caught a likely flag-misuse pattern.
+
+Command: $COMMAND
+
+The flag \`-r\` in ripgrep means \`--replace=TEXT\`, NOT recursive. Recursive
+search is the default for ripgrep. If you intended \`grep -rn\` muscle memory:
+
+  WRONG:   rg -rn "pattern" path/         # rewrites every match to literal "n"
+  RIGHT:   rg -n "pattern" path/          # line numbers, recursive by default
+  ALSO:    rg "pattern" path/             # line numbers via default config
+  ALSO:    rg --line-number "pattern" .   # explicit long form
+
+If you actually meant to replace text in output, ignore this warning. Otherwise
+the resulting stdout is silently corrupted (exit 0, no error) and reading it
+back will misattribute the garbage to an external cause.
+
+Source: anthropics/claude-code#62016
+EOF
+
+# Strict mode blocks; default mode advises.
+if [ "${CC_RG_REPLACE_DETECTOR_MODE:-advisory}" = "strict" ]; then
+    exit 2
+fi
+
+exit 0

package/examples/rhetorical-verification-prompt-detector.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# rhetorical-verification-prompt-detector.sh — UserPromptSubmit hook
+# Trigger: UserPromptSubmit
+# Matcher: ""
+#
+# Solves: Issue #60107 — "the agent treated my question as rhetorical and
+#         confirmed". User asked a verification question; agent emitted an
+#         unconditional confirmation without running any verification step.
+#         User trusted the confirmation, deployed to production, and the
+#         deployed system crashed in full.
+#
+# Class of failure: claim-vs-reality divergence at the verification layer.
+#         The user's explicit verification intent ("is this really working?",
+#         "did this actually deploy?", "are you sure this is safe?") gets
+#         flattened by the model into a rhetorical-question reading, which
+#         the model then answers with social affirmation rather than with
+#         a tool-driven verification step.
+#
+# HOW IT WORKS:
+#   When the user submits a prompt containing verification-intent markers,
+#   the hook emits an additionalContext payload (via hookSpecificOutput)
+#   that explicitly tells the agent: this is a verification request, not
+#   a rhetorical one — do not respond with a bare affirmation; either run
+#   verification tool calls (Bash, Read, Grep) or state explicitly that
+#   verification was not performed.
+#
+# WHY THIS MATTERS:
+#   The 60107 failure shape is one of the cleanest examples of the broader
+#   pattern where the response surface asserts a claim that the runtime
+#   never verified. Most prevention efforts focus on the agent's *output*
+#   (caveat checkers, claim-vs-caveat validators). This hook addresses the
+#   *input* side: by labeling the user's prompt explicitly as a verification
+#   request before the agent processes it, the rhetorical-reading failure
+#   mode is harder to enter in the first place.
+#
+# TRIGGER: UserPromptSubmit
+# MATCHER: ""
+#
+# CONFIGURATION:
+#   CC_RHETORICAL_VERIFY_DISABLE=1   disable the hook entirely
+#   CC_RHETORICAL_VERIFY_LOG=path    append detection events (default off)
+#
+# SAFETY:
+#   - Read-only on the prompt; never modifies the user's input.
+#   - Emits advisory context via hookSpecificOutput; does not block the prompt.
+#   - The user's exact prompt still reaches the agent unchanged.
+#   - Exit 0 always; never blocks the session.
+#
+# REFERENCES:
+#   - anthropics/claude-code#60107 (2026-05-18, the canonical case)
+#   - https://gist.github.com/yurukusa/a5b2a32ca57e75eb1e96adcf67bcf2c3 (the
+#     nine-axis verification compilation, Axis 8 for self-acknowledged
+#     structural divergence)
+set -euo pipefail
+
+[ "${CC_RHETORICAL_VERIFY_DISABLE:-}" = "1" ] && exit 0
+
+INPUT=$(cat)
+PROMPT=$(echo "$INPUT" | jq -r '.prompt // empty' 2>/dev/null || true)
+[ -z "$PROMPT" ] && exit 0
+
+# Detection patterns — verification-intent markers.
+# English and Japanese forms are both checked.
+# These are conservative: only match phrases that strongly imply
+# the user is asking for a *check*, not a *task*.
+EN_PATTERNS='are you sure|are you certain|did (this|that|it) actually|did (this|that|it) really|did you (actually|really|verify|check|confirm)|can you (confirm|verify|double-?check|make sure)|is (this|that|it) (really|actually|definitely|truly) (working|correct|safe|done|deployed|complete|finished)|is (this|that|it) safe to|please (confirm|verify|double-?check|make sure)|just to (confirm|verify|be sure|double-?check)|double[ -]check|sanity check|are we (sure|certain|good)'
+
+JA_PATTERNS='本当に|確かに|大丈夫(です)?(か|\?)|本当か|確認した|確認して(くれ|ください)|もう一度確認|再確認|間違いない(か|ですか|\?)?|本当だ?ね|チェックして|本当に(動いて|できて|終わって|成功して)|間違いなく'
+
+MATCHED_MARKER=""
+
+if echo "$PROMPT" | grep -qiE "$EN_PATTERNS"; then
+    MATCHED_MARKER=$(echo "$PROMPT" | grep -oiE "$EN_PATTERNS" | head -1)
+elif echo "$PROMPT" | grep -qE "$JA_PATTERNS"; then
+    MATCHED_MARKER=$(echo "$PROMPT" | grep -oE "$JA_PATTERNS" | head -1)
+fi
+
+[ -z "$MATCHED_MARKER" ] && exit 0
+
+# Optional logging
+if [ -n "${CC_RHETORICAL_VERIFY_LOG:-}" ]; then
+    {
+        printf '[%s] rhetorical-verify-detected: marker=%q prompt_head=%q\n' \
+            "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$MATCHED_MARKER" "${PROMPT:0:200}"
+    } >> "$CC_RHETORICAL_VERIFY_LOG" 2>/dev/null || true
+fi
+
+# Emit additionalContext via hookSpecificOutput.
+# Claude Code reads this as a system note to the agent.
+ADDITIONAL_CONTEXT="Verification-intent detected in this user prompt (marker: \"${MATCHED_MARKER}\"). Treat this prompt as a verification request, NOT as a rhetorical question. Do not respond with a bare affirmation, social-confirmation phrase, or unverified \"yes\" / \"that's correct\" / \"all good\" / \"安心してください\". Instead: (1) run concrete verification tool calls (Bash, Read, Grep, file tests, status checks) appropriate to what is being verified; or (2) if verification is impossible in this context, state EXPLICITLY that verification was not performed and identify which check is missing. This guard exists because anthropics/claude-code#60107 documents a case where a verification question was read as rhetorical, an unverified confirmation was emitted, and the user's production system crashed in full as a direct consequence."
+
+# Produce JSON output for hookSpecificOutput
+jq -n \
+    --arg ctx "$ADDITIONAL_CONTEXT" \
+    '{
+        hookSpecificOutput: {
+            hookEventName: "UserPromptSubmit",
+            additionalContext: $ctx
+        }
+    }'
+
+exit 0

package/examples/rm-safety-net.sh

@@ -9,13 +9,18 @@
 #   This hook blocks: ALL rm commands on important paths, even non-recursive
 #
 # What it blocks:
-#   rm (any flags) on: /, ~, .., /home, /etc, /usr, /var, .git, .env
+#   rm (any flags) on: /, ~, .., /home, /Users, /etc, /usr, /var, .git, .env
+#   wildcard/glob rm reaching into a user/home/absolute path, e.g.
+#     rm -f ~/Downloads/*copy*.md  (unpredictable match set — see #64559)
 #   find -delete (any path)
+#   find ... | xargs rm  without the null-delimited pair -print0 / xargs -0 (#69793 —
+#     a path with spaces splits into multiple targets and rm -rf wipes an unrelated dir)
 #   shred (any file)
 #   unlink on critical paths
 #
 # What it allows:
 #   rm on safe targets: node_modules, dist, build, __pycache__, .cache, /tmp
+#   bare relative globs in the working dir: rm *.pyc, rm dist/*.js
 #
 # Usage: Add to settings.json as a PreToolUse hook
 #
@@ -33,18 +38,97 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-rm-safety-net-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [rm-safety-net]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
+# --- Look inside wrappers -----------------------------------------------------
+# The rm analysis below opens only when the command *starts* with rm, and every
+# other boundary in this file is a separator. A command inside a substitution,
+# a subshell, or after a shell keyword is at neither, so it was never examined.
+# Measured 2026-08-04: this hook blocked the bare deletion and passed all six
+# wrappings of it. Claude Code 2.1.221 fixed the same shape in its own
+# permission check ("hidden commands in [[ ]] regex conditionals").
+#
+# Replace the wrapping tokens with separators and run this same script once more
+# against that text. Detection only: the rewritten text is never executed, and
+# the message below keeps the command the user actually sent.
+if [ -n "${CC_RMNET_UNWRAPPED:-}" ]; then
+    COMMAND="$CC_RMNET_UNWRAPPED"
+elif [ -n "$COMMAND" ]; then
+    _rmnet_unwrapped=$(printf '%s' "$COMMAND" | sed -E \
+        -e 's/\$\(/ ; /g' -e 's/`/ ; /g' \
+        -e 's/(^|[[:space:]])\(/\1 ; /g' -e 's/\)([[:space:]]|$)/ ; \1/g' \
+        -e 's/(^|[[:space:]])(then|do|else|elif)([[:space:]])/\1 ; \3/g')
+    if [ "$_rmnet_unwrapped" != "$COMMAND" ]; then
+        CC_RMNET_UNWRAPPED="$_rmnet_unwrapped" bash "$0" </dev/null >/dev/null 2>&1
+        if [ "$?" = "2" ]; then
+            echo "BLOCKED: an rm on a critical path is hidden inside a wrapper." >&2
+            echo "Command: $COMMAND" >&2
+            echo "A substitution, a subshell or a shell keyword does not make it safe." >&2
+            exit 2
+        fi
+    fi
+fi
+
 [ -z "$COMMAND" ] && exit 0
 
+# The extractions in this hook used grep -oP, which is GNU-only. BSD grep
+# (macOS) rejects -P, so the targets came back empty and every critical-path
+# check silently found nothing to inspect. The GNU path is left exactly as it
+# was; an equivalent runs where -P is absent. Defined at file scope because the
+# find/xargs sections below use it too.
+if echo x | grep -qP x 2>/dev/null; then HAS_PCRE=1; else HAS_PCRE=0; fi
+
+# $1 = command word, $2 = operand pattern. \K has no POSIX equivalent, so the
+# fallback matches from the command word and strips that prefix afterwards.
+extract_operand() {
+    if [ "$HAS_PCRE" = 1 ]; then
+        grep -oP "$1\\s+\\K$2" 2>/dev/null || true
+    else
+        grep -oE "$1[[:space:]]+$2" 2>/dev/null | sed -E "s/^$1[[:space:]]+//" || true
+    fi
+}
+
 # --- rm command analysis ---
-if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?rm\s'; then
+# The gate used to be '^\s*(sudo\s+)?rm\s': the analysis opened only when the
+# whole command began with rm, so `cd /tmp && rm -rf ~` never entered it.
+# A separator in front is just as much a command start as the line start is.
+if echo "$COMMAND" | grep -qE '(^|[;&|])[[:space:]]*(sudo[[:space:]]+)?rm[[:space:]]'; then
     # Safe targets that can be deleted freely
     SAFE_TARGETS="node_modules|dist|build|__pycache__|\.cache|\.pytest_cache|coverage|\.nyc_output|\.next|\.nuxt|tmp|temp"
+    CRITICAL="^/\$|^/home|^/Users|^/etc|^/usr|^/var|^/opt|^/root|^~|^\.\.|^\.git$|(^|/)\.env"
 
     # Extract the target (last argument after flags)
-    TARGET=$(echo "$COMMAND" | grep -oP 'rm\s+[^;|&]*' | awk '{print $NF}')
+    if [ "$HAS_PCRE" = 1 ]; then
+        TARGET=$(echo "$COMMAND" | grep -oP 'rm\s+[^;|&]*' | awk '{print $NF}')
+    else
+        TARGET=$(echo "$COMMAND" | grep -oE 'rm[[:space:]]+[^;|&]*' | awk '{print $NF}')
+    fi
+
+    # Judge the target with its quotes removed. This hook blocks anything that
+    # is not on the safe list, so a quoted target used to be blocked whatever it
+    # was: `rm -rf "node_modules"` and `rm -rf "/"` failed the same test for the
+    # same reason -- the quote, not the path. Dropping the quote characters lets
+    # the safe list recognise the first and the critical list catch the second.
+    # Measured 2026-08-11: four ordinary quoted cleanups were blocked here.
+    # Messages keep $TARGET so the user sees what they actually typed.
+    #
+    # A name containing spaces (`rm -rf "my build dir"`) is still blocked. That
+    # is word splitting, not quoting, and fixing it means rewriting how operands
+    # are cut apart. Out of scope here; the tests record it as a known limit.
+    TARGET_UNQ=$(printf '%s' "$TARGET" | tr -d "\"'")
 
     # Block path traversal early
     if echo "$TARGET" | grep -qF '..'; then
@@ -52,6 +136,22 @@ if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?rm\s'; then
         exit 2
     fi
 
+    # Inspect EVERY non-flag argument for critical paths, not just the last one.
+    # The single-TARGET checks below use `awk '{print $NF}'` (last arg only), so
+    # "rm -rf /home/user/data node_modules" would early-exit on the safe LAST arg
+    # (node_modules) and never inspect the critical FIRST arg — a real bypass.
+    # set -f disables glob expansion of the split words (so "rm *.pyc" stays literal).
+    set -f
+    for arg in $(echo "$COMMAND" | extract_operand 'rm' '[^;|&]*'); do
+        case "$arg" in -*) continue ;; esac   # skip flags
+        if printf '%s' "$arg" | tr -d "\"'" | grep -qE "$CRITICAL"; then
+            set +f
+            echo "BLOCKED: rm targeting critical path: $arg" >&2
+            exit 2
+        fi
+    done
+    set +f
+
     # Allow safe targets
     if echo "$TARGET" | grep -qE "^(\./)?(${SAFE_TARGETS})(/|$)"; then
         exit 0
@@ -62,9 +162,29 @@ if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?rm\s'; then
         exit 0
     fi
 
-    # Block rm on critical paths
-    CRITICAL="^/\$|^/home|^/etc|^/usr|^/var|^/opt|^/root|^~|^\.\.|^\.git$|^\.env"
-    if echo "$TARGET" | grep -qE "$CRITICAL"; then
+    # Block wildcard/glob rm on absolute or home paths (#64559).
+    # A glob's match set can't be enumerated in advance, so a delete intended only
+    # for the model's own temp files (e.g. rm -f ~/Downloads/*copy*.md) can silently
+    # collateral-delete pre-existing user files whose names merely share the substring.
+    # Auto mode runs this with no confirmation. Bare relative globs (e.g. rm *.pyc in a
+    # project dir) are left alone; only globs reaching into a user/home/absolute path
+    # outside the safe-target list are gated, where the blast radius is unpredictable.
+    if echo "$TARGET" | grep -qE '[*?[]'; then
+        if echo "$TARGET" | grep -qE "^(/|~)"; then
+            echo "BLOCKED: wildcard rm on a user/absolute path — unpredictable match set: $TARGET" >&2
+            echo "A glob can delete pre-existing files you never named. List the matches first:" >&2
+            echo "  ls -d $TARGET   # confirm exactly what matches, then rm those names explicitly" >&2
+            exit 2
+        fi
+    fi
+
+    # Block rm on critical paths (/Users = macOS home, parity with /home on Linux)
+    # .env is matched at the start OR after any path segment, so a nested path
+    # like backend/.env or src/.env is caught too (#65034 — Claude deleted a
+    # .env living in a subdirectory, which the start-anchored pattern missed).
+    # CRITICAL is defined once near the top of this block (also used by the
+    # multi-argument loop above). This single-TARGET check stays as a backstop.
+    if echo "$TARGET_UNQ" | grep -qE "$CRITICAL"; then
         echo "BLOCKED: rm targeting critical path: $TARGET" >&2
         exit 2
     fi
@@ -72,7 +192,7 @@ if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?rm\s'; then
     # Block rm -rf on any non-safe path (extra safety)
     if echo "$COMMAND" | grep -qE 'rm\s+.*-[rRf]*[rR][rRf]*'; then
         # rm -rf on non-safe, non-tmp target — block unless it's a known safe directory
-        if ! echo "$TARGET" | grep -qE "^(\./)?(${SAFE_TARGETS})(/|$)|^/tmp/"; then
+        if ! echo "$TARGET_UNQ" | grep -qE "^(\./)?(${SAFE_TARGETS})(/|$)|^/tmp/"; then
             echo "BLOCKED: rm -rf on non-safe target: $TARGET" >&2
             exit 2
         fi
@@ -82,7 +202,7 @@ fi
 # --- find -delete ---
 if echo "$COMMAND" | grep -qE 'find\s.*-delete'; then
     # Allow find in safe directories only
-    FIND_PATH=$(echo "$COMMAND" | grep -oP 'find\s+\K[^\s]+')
+    FIND_PATH=$(echo "$COMMAND" | extract_operand 'find' '[^[:space:]]+')
     if echo "$FIND_PATH" | grep -qE '^\.|^node_modules|^dist|^build|^/tmp'; then
         exit 0
     fi
@@ -90,6 +210,29 @@ if echo "$COMMAND" | grep -qE 'find\s.*-delete'; then
     exit 2
 fi
 
+# --- find | xargs rm without a null delimiter (#69793) ---
+# find prints newline-separated paths; xargs WITHOUT -0 splits on ANY whitespace.
+# So a single path containing spaces, e.g. "./Google Photos/a.jpg", is split into
+# two arguments: "./Google" and "Photos/a.jpg". With rm -rf, the first token can
+# match an UNRELATED real directory ("./Google") and wipe it whole — the reporter
+# in #69793 lost ~28,800 files this way. The rm checks above can't catch this:
+# the delete targets are produced by find at runtime, so there is no literal path
+# in the command string to inspect. The only safe form is the null-delimited pair
+# find -print0 | xargs -0 (or avoid xargs: find -delete / -exec rm {} +).
+if echo "$COMMAND" | grep -qE 'xargs\b[^|]*\b(rm|rmdir|unlink|shred|trash|trash-put)\b'; then
+    # Require BOTH halves of the null-delimited pair: find's -print0 and xargs's -0.
+    if ! echo "$COMMAND" | grep -qE '\-print0' \
+       || ! echo "$COMMAND" | grep -qE 'xargs\s+[^|]*(-0|--null)'; then
+        echo "BLOCKED: 'xargs rm' without a null delimiter — paths with spaces split into multiple targets (#69793)." >&2
+        echo "  A path like './Google Photos/a.jpg' splits into './Google' and 'Photos/a.jpg';" >&2
+        echo "  rm -rf may then wipe an unrelated real directory. Use one of:" >&2
+        echo "    find ... -delete" >&2
+        echo "    find ... -exec rm -rf {} +" >&2
+        echo "    find ... -print0 | xargs -0 rm -rf" >&2
+        exit 2
+    fi
+fi
+
 # --- shred ---
 if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?shred\s'; then
     echo "BLOCKED: shred command (secure file deletion)" >&2