cc-safe-setup 29.7.0 → 30.0.4

package/examples/role-tool-guard.sh

@@ -18,6 +18,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-role-tool-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [role-tool-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 [ -z "$TOOL" ] && exit 0

package/examples/route-handler-emptiness-gate.sh

@@ -0,0 +1,324 @@
+#!/bin/bash
+# route-handler-emptiness-gate.sh — Refuse Write/Edit when a route handler method
+# body would ship with the surface form of a handler (auth + redirect + return)
+# but with no data-mutation line (no save, update, create, insert, delete).
+#
+# Solves: anthropics/claude-code #61107 — "Opus 4.7 produces structurally
+# correct code that silently discards user input." The four documented cases
+# in that issue body share a shape: signature correct, auth check correct,
+# redirect correct, the one line that materializes the side effect missing.
+# A code review at a glance passes; the patient's reflection is silently
+# discarded; the DELETE returns 200 with the row still present.
+#
+# RUSE Surface application: the operator's intent ("a route handler must
+# materialize the request's effect on persistent state") is a wider semantic
+# surface than any single deny rule or naming convention. The model honours
+# the convention's named exemplars (handler signature, auth, redirect, route
+# name) while skipping the rule's synonymous edge (the data-mutation line).
+# This hook gates against the effect predicate (must contain a mutation),
+# not against the surface convention (must look like a handler).
+#
+# TRIGGER: PreToolUse
+# MATCHER: Write|Edit|MultiEdit
+#
+# SCOPE: PHP files only by default (the documented case is Laravel). Set
+# CC_HANDLER_GATE_LANGUAGES to a comma-separated list to add languages
+# (currently supported: php).
+#
+# MODE:
+#   advisory (default) — emits a system-reminder, allows the write
+#   strict             — exits 2, refuses the write
+#
+# CONFIGURATION:
+#   CC_HANDLER_GATE_MODE       advisory | strict        (default: advisory)
+#   CC_HANDLER_GATE_LANGUAGES  comma-separated list     (default: php)
+#   CC_HANDLER_GATE_PATHS      regex of paths to gate   (default: /[Cc]ontrollers?/)
+#   CC_HANDLER_GATE_DISABLE    set to "1" to disable    (default: unset)
+#
+# DETECTION HEURISTIC (PHP / Laravel):
+#   A method body is flagged if ALL of:
+#     - The method body contains at least one of:
+#         auth(), Auth::, $request->user(), redirect(, return redirect(,
+#         response()->json(, return response()
+#     AND
+#     - The method body contains NONE of:
+#         ->save(, ::create(, ->update(, ::insert(, ->delete(, ::firstOrCreate(,
+#         ::updateOrCreate(, ->fill(, DB::table(, DB::insert, DB::update,
+#         DB::delete, Eloquent::, ->push(, ->associate(, ->detach(, ->sync(
+#     AND
+#     - The method body contains no PHP-side function call that names
+#       something like Service, Repository, Action (heuristic for service-
+#       layer pattern where the mutation is delegated)
+#
+# RELATED ISSUES:
+#   anthropics/claude-code #61107 (@nvst18, 2026-05-21) — direct motivation
+#   anthropics/claude-code #60226 (@suwayama, 2026-05-18) — structural parent
+#   anthropics/claude-code #60977 (@beq00000, 2026-05-20) — RUSE articulation
+#
+# USAGE (settings.json):
+#   {
+#     "hooks": {
+#       "PreToolUse": [
+#         {
+#           "matcher": "Write|Edit|MultiEdit",
+#           "hooks": [{"type":"command","command":"~/.claude/hooks/route-handler-emptiness-gate.sh"}]
+#         }
+#       ]
+#     }
+#   }
+
+set -euo pipefail
+
+# Bail if disabled
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-route-handler-emptiness-gate-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [route-handler-emptiness-gate]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+if [ "${CC_HANDLER_GATE_DISABLE:-}" = "1" ]; then
+    exit 0
+fi
+
+INPUT=$(cat)
+
+MODE="${CC_HANDLER_GATE_MODE:-advisory}"
+LANGUAGES="${CC_HANDLER_GATE_LANGUAGES:-php}"
+PATH_REGEX="${CC_HANDLER_GATE_PATHS:-/[Cc]ontrollers?/}"
+
+TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+case "$TOOL" in
+    Write|Edit|MultiEdit) ;;
+    *) exit 0 ;;
+esac
+
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+[ -z "$FILE_PATH" ] && exit 0
+
+# Language and path gating
+case "$FILE_PATH" in
+    *.php) ;;
+    *) exit 0 ;;
+esac
+
+# Only run if the path matches the configured controller-path regex
+if ! echo "$FILE_PATH" | grep -qE "$PATH_REGEX"; then
+    exit 0
+fi
+
+# Extract the content the model is about to write
+CONTENT=$(echo "$INPUT" | jq -r '
+    .tool_input.content //
+    .tool_input.new_string //
+    (if .tool_input.edits then (.tool_input.edits | map(.new_string) | join("\n")) else empty end) //
+    empty
+' 2>/dev/null)
+
+[ -z "$CONTENT" ] && exit 0
+
+# Detection: look for PHP method bodies and check each one.
+# This is a regex-based heuristic; a full PHP AST is out of scope for a bash hook.
+# The trade is documented in the methodology note — heuristic-with-false-positive-surface,
+# not strict parsing.
+
+# Extract candidate method bodies using a Python helper for reliability
+FLAGGED=$(python3 - "$CONTENT" <<'PYEOF'
+import sys, re
+
+content = sys.argv[1] if len(sys.argv) > 1 else sys.stdin.read()
+
+# Find PHP method definitions: public/protected function name(...) { ... }
+# We use a non-greedy match for the method body, but PHP can have nested braces,
+# so we use a brace-counting approach.
+
+method_re = re.compile(
+    r'(public|protected|private)\s+function\s+(\w+)\s*\([^)]*\)\s*(?::\s*[\w\\]+\s*)?\{',
+    re.MULTILINE
+)
+
+# Patterns that indicate "looks like a handler" (HTTP-shaped activity)
+HANDLER_LIKE = [
+    r'auth\(\)',
+    r'Auth::',
+    r'\$request->user\(\)',
+    r'redirect\s*\(',
+    r'response\(\)',
+    r'return\s+view\(',
+    r'->json\(',
+]
+
+# Patterns that indicate "data mutation actually happens"
+MUTATION = [
+    r'->save\(',
+    r'::create\(',
+    r'->update\(',
+    r'::insert\(',
+    r'->delete\(',
+    r'::firstOrCreate\(',
+    r'::updateOrCreate\(',
+    r'->fill\(',
+    r'DB::table\(',
+    r'DB::insert',
+    r'DB::update',
+    r'DB::delete',
+    r'->push\(',
+    r'->associate\(',
+    r'->detach\(',
+    r'->sync\(',
+    r'->touch\(',
+    r'->forceDelete\(',
+]
+
+# Service/Action/Repository delegation pattern (mutation may be delegated)
+SERVICE_DELEGATION = [
+    r'\$\w*[Ss]ervice\b',
+    r'\$\w*[Rr]epository\b',
+    r'\$\w*[Aa]ction\b',
+    r'\$\w*[Hh]andler\b',
+    r'->dispatch\(',
+    r'::dispatch\(',          # Job::dispatch() static call
+    r'->execute\(',
+    r'->perform\(',
+    r'->store\(\s*\$',        # Service store with parameter
+    r'->handle\(\s*\$',
+    r'event\s*\(\s*new\s+',   # event(new MyEvent()) dispatches listeners
+    r'->notify\(',            # Notification::send() / $user->notify(...)
+    r'Notification::send\(',
+    r'broadcast\s*\(',        # broadcast(new MyEvent())
+]
+
+# Exempt method names that legitimately don't mutate
+READ_ONLY_NAMES = {
+    'index', 'show', 'view', 'create', 'edit',  # standard CRUD read methods
+    'get', 'list', 'find', 'search', 'fetch',
+    '__construct', '__destruct', '__invoke', 'rules', 'authorize',
+    'middleware', 'register', 'boot',
+}
+
+# Mutating method names where emptiness is suspicious
+MUTATING_NAMES = {
+    'store', 'update', 'destroy', 'delete',
+    'patch', 'put', 'restore', 'archive',
+    'attach', 'detach', 'sync', 'associate',
+    'process', 'handle', 'execute', 'perform',
+    'save', 'submit', 'send', 'publish',
+}
+
+def has_pattern(body, patterns):
+    return any(re.search(p, body) for p in patterns)
+
+def extract_body(text, start_pos):
+    """Brace-match from text[start_pos] (which should be after the opening {)."""
+    depth = 1
+    i = start_pos
+    while i < len(text) and depth > 0:
+        # Skip strings naively
+        c = text[i]
+        if c == '"' or c == "'":
+            quote = c
+            i += 1
+            while i < len(text) and text[i] != quote:
+                if text[i] == '\\':
+                    i += 2
+                else:
+                    i += 1
+            i += 1
+        elif c == '/' and i + 1 < len(text) and text[i+1] == '/':
+            # line comment
+            while i < len(text) and text[i] != '\n':
+                i += 1
+        elif c == '/' and i + 1 < len(text) and text[i+1] == '*':
+            i += 2
+            while i + 1 < len(text) and not (text[i] == '*' and text[i+1] == '/'):
+                i += 1
+            i += 2
+        elif c == '{':
+            depth += 1
+            i += 1
+        elif c == '}':
+            depth -= 1
+            i += 1
+        else:
+            i += 1
+    return text[start_pos:i-1] if depth == 0 else text[start_pos:]
+
+flags = []
+for m in method_re.finditer(content):
+    visibility = m.group(1)
+    name = m.group(2)
+    body_start = m.end()
+    body = extract_body(content, body_start)
+
+    # Skip very short bodies (likely abstract/interface stubs) and empty constructors
+    if len(body.strip()) < 3:
+        continue
+
+    # Read-only method names are exempt
+    if name in READ_ONLY_NAMES:
+        continue
+
+    # Method names that should mutate get extra scrutiny: flag emptiness if no mutation
+    is_mutating_name = name in MUTATING_NAMES
+
+    looks_like_handler = has_pattern(body, HANDLER_LIKE)
+    has_mutation = has_pattern(body, MUTATION)
+    has_service = has_pattern(body, SERVICE_DELEGATION)
+
+    if is_mutating_name and not has_mutation and not has_service:
+        flags.append({
+            'method': name,
+            'visibility': visibility,
+            'reason': f'mutating-named method ({name!r}) has no data-mutation call and no service delegation'
+        })
+    elif looks_like_handler and not has_mutation and not has_service:
+        # Handler-shape body without mutation: flag with lower severity
+        flags.append({
+            'method': name,
+            'visibility': visibility,
+            'reason': f'handler-shape method ({name!r}) has no data-mutation call and no service delegation'
+        })
+
+for f in flags:
+    print(f"{f['visibility']}|{f['method']}|{f['reason']}")
+PYEOF
+)
+
+if [ -z "$FLAGGED" ]; then
+    exit 0
+fi
+
+# Build the warning message
+{
+    echo "⚠️ route-handler-emptiness-gate: detected $(echo "$FLAGGED" | wc -l) method(s) with handler shape but no data mutation:"
+    echo ""
+    echo "$FLAGGED" | while IFS='|' read -r vis name reason; do
+        echo "  - $vis function $name(): $reason"
+    done
+    echo ""
+    echo "Reference: anthropics/claude-code#61107 — the four documented failure cases in"
+    echo "@nvst18's report share this shape (storeResearchReflection, destroy(),"
+    echo "validate-without-capture, dead conditionals)."
+    echo ""
+    echo "File: $FILE_PATH"
+    echo "Mode: $MODE"
+    echo ""
+    if [ "$MODE" = "strict" ]; then
+        echo "Refusing write. To override for this turn, set CC_HANDLER_GATE_MODE=advisory."
+    else
+        echo "Allowing write (advisory). Set CC_HANDLER_GATE_MODE=strict to block."
+        echo "If the method is intentionally a no-op (deprecated endpoint, soft-removal stub),"
+        echo "add a comment or a noop() marker the model is more likely to inspect on review."
+    fi
+} >&2
+
+if [ "$MODE" = "strict" ]; then
+    exit 2
+fi
+
+exit 0

package/examples/ruby-lint-on-edit.sh

@@ -18,7 +18,7 @@
 # }
 # ================================================================
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PostToolUse  MATCHER: "Edit|Write"
 
 INPUT=$(cat)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)

package/examples/runtime-binary-change-detector.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# runtime-binary-change-detector.sh — Alert when the Claude Code binary changes between sessions.
+#
+# Solves: Operators who customize their workflow (hooks, slash commands, skills,
+#         system-prompt patches) can have behavior shift silently when the Claude
+#         Code binary is updated. Public discussion of this pattern includes
+#         matheusmoreira's Tell HN "Claude Code now allows Anthropic to remotely
+#         inject system prompts" — operators want a between-session signal that
+#         something changed, prompting a behavior re-verification before relying
+#         on prior workflow assumptions.
+#
+# How it works: On SessionStart, compute a fingerprint of the resolved `claude`
+#   binary (path + --version + size_mtime), compare against the fingerprint
+#   stored from the previous session, and print an advisory warning to stderr if
+#   they differ. State is stored at ~/.claude/runtime-binary-state.txt.
+#
+# This is an advisory hook (exit 0 in all cases); it never blocks. The signal
+# tells the operator to verify hooks, slash commands, and skills still behave
+# as expected after the binary changed.
+#
+# TRIGGER: SessionStart
+# MATCHER: "" (all sessions)
+#
+# Env knobs:
+#   CC_BINARY_DETECTOR_SILENT=1 — suppress the alert (useful in CI / automation
+#                                 where the alert is logged elsewhere)
+
+INPUT=$(cat 2>/dev/null || echo "{}")
+EVENT=$(echo "$INPUT" | jq -r '.event // .hook_event_name // empty' 2>/dev/null)
+
+# Only run on session start; let other events pass.
+case "$EVENT" in
+  session_start|SessionStart|"") ;;
+  *) exit 0 ;;
+esac
+
+STATE_FILE="${HOME}/.claude/runtime-binary-state.txt"
+mkdir -p "$(dirname "$STATE_FILE")"
+
+# Locate the claude binary. Bail silently if it's not on PATH — this hook
+# shouldn't error in environments where Claude Code is invoked by absolute
+# path or through a wrapper.
+CLAUDE_BIN=$(command -v claude 2>/dev/null)
+[ -z "$CLAUDE_BIN" ] && exit 0
+
+# Resolve symlinks so version managers (asdf / volta / nvm) don't produce a
+# spurious change every session from re-shimmed paths.
+RESOLVED_BIN=$(readlink -f "$CLAUDE_BIN" 2>/dev/null || echo "$CLAUDE_BIN")
+
+# Version string (best-effort; some wrappers reject --version).
+VERSION=$("$RESOLVED_BIN" --version 2>/dev/null | head -1 | tr -d '\r' | head -c 200)
+[ -z "$VERSION" ] && VERSION="version-unavailable"
+
+# Size + mtime as a lightweight content fingerprint. Full sha256 would be more
+# correct but is overkill at SessionStart latency; size+mtime catches every
+# update path that swaps the binary (npm install, brew upgrade, manual replace).
+if SIZE_MTIME=$(stat -c "%s_%Y" "$RESOLVED_BIN" 2>/dev/null); then
+  :
+elif SIZE_MTIME=$(stat -f "%z_%m" "$RESOLVED_BIN" 2>/dev/null); then
+  :
+else
+  SIZE_MTIME="stat-unavailable"
+fi
+
+CURRENT_STATE="${RESOLVED_BIN}|${VERSION}|${SIZE_MTIME}"
+
+# First-session bootstrap: record state, no warning.
+if [ ! -f "$STATE_FILE" ]; then
+  printf "%s\n" "$CURRENT_STATE" > "$STATE_FILE"
+  exit 0
+fi
+
+PREV_STATE=$(head -1 "$STATE_FILE" 2>/dev/null)
+
+if [ "$PREV_STATE" != "$CURRENT_STATE" ] && [ "${CC_BINARY_DETECTOR_SILENT:-}" != "1" ]; then
+  # Decompose for readability.
+  PREV_VER=$(printf "%s" "$PREV_STATE" | awk -F'|' '{print $2}')
+  CURR_VER=$(printf "%s" "$CURRENT_STATE" | awk -F'|' '{print $2}')
+
+  {
+    echo "⚠ Claude Code binary changed since the previous session."
+    if [ "$PREV_VER" != "$CURR_VER" ]; then
+      echo "   ${PREV_VER}  →  ${CURR_VER}"
+    else
+      echo "   Same --version string, but the binary's size or mtime moved."
+      echo "   Path: ${RESOLVED_BIN}"
+    fi
+    echo "   Release notes: https://github.com/anthropics/claude-code/releases"
+    echo "   Verify before relying on prior behavior:"
+    echo "     1. Your custom hooks still fire on the expected events"
+    echo "     2. Slash commands return the same shape"
+    echo "     3. Skills load with the same precedence"
+    echo "     4. System-prompt patches (if any) survived the update"
+    echo "   Silence with: export CC_BINARY_DETECTOR_SILENT=1"
+  } >&2
+fi
+
+# Always update state. Even on silent-mode the new fingerprint should be stored
+# so the next non-silent session compares against the correct baseline.
+printf "%s\n" "$CURRENT_STATE" > "$STATE_FILE"
+
+exit 0

package/examples/same-command-repeat-detector.sh

@@ -0,0 +1,196 @@
+#!/bin/bash
+# same-command-repeat-detector.sh — Block Opus 4.8 same-command repeat-execution
+# (Cluster 25 candidate, axis 25F — non-no-op compensation repeat)
+#
+# Background:
+#   Sibling of axis 25B (echo-probe spam) with one operationally critical
+#   difference: this axis fires on REAL, non-no-op commands. Where 25B emits
+#   "echo s1, echo s2, ..." (cluttering screen but burning minimal CPU), 25F
+#   re-emits the same real build/test/lint/deploy command 5–10 times in a
+#   row — burning actual CPU, wall-clock, build artefact churn, and tokens.
+#
+#   The root mechanic is the same as 25B: the model perceives non-receipt of
+#   the previous result and emits another invocation hoping it will land.
+#   The model cannot distinguish:
+#     - result-delivery-failed (call ran, output didn't reach model)
+#     - result-was-empty       (call ran, output really was empty)
+#     - result-arrived-but-missed (call ran, output present, attention drift)
+#   All three produce the same retry burst, but the cost shape on 25F is
+#   1–2 orders of magnitude worse than 25B because the repeated command
+#   is real work.
+#
+#   Anchor case:
+#     #63887 (comment by @KamilDev, 2026-05-31 23:37 UTC) —
+#       "it decided to fire off a build command ten times in a row.
+#        This isn't just annoying to look at; it's wasting CPU and time."
+#       (Screenshots in the thread show 10 consecutive identical build calls.)
+#
+#   Sibling axes (Cluster 25, all observed 2026-05-30 to 2026-06-01):
+#     25A — late/empty tool-result delivery (substrate, no operator-side fix)
+#     25B — echo-probe spam compensation (echo-probe-spam-detector.sh)
+#     25C — 2>&1 fragmentation hang (redirect-fragment-warner.sh)
+#     25D — compounding cost (downstream of 25B/25F/25C)
+#     25E — empty-result triggered fabrication (Cluster 22 overlap)
+#     25F — non-no-op repeat-execution (this hook)
+#
+#   This hook is a PreToolUse hook on Bash that:
+#     - Captures the canonicalised form of each Bash command per session
+#     - Tracks consecutive identical commands
+#     - Warns on the 2nd consecutive identical command
+#     - Blocks (exit 2) on the N-th consecutive identical command (default 3)
+#
+#   Canonicalisation rules (so trivial variations don't escape detection):
+#     - Strip leading/trailing whitespace
+#     - Collapse internal whitespace runs to single space
+#     - Lowercase nothing (case may carry meaning — `Make` vs `make`)
+#
+#   What this hook does NOT cover:
+#     - Echo-probe shape (echo-probe-spam-detector.sh covers that)
+#     - Commands separated by long gaps (the streak counter resets when any
+#       different command runs in between, intentionally)
+#
+# When this hook does NOT block:
+#   - CC_SAME_CMD_REPEAT_DISABLE=1               — never warn or block
+#   - CC_SAME_CMD_REPEAT_QUIET=1                 — silent (no stderr output)
+#   - CC_SAME_CMD_REPEAT_THRESHOLD=N             — block at N consecutive (default 3)
+#   - the Bash command is shorter than 4 chars  — exit 0 (avoid false-positive
+#                                                  on `ls`, `pwd`, `cd`, etc.)
+#   - the operator includes "# RESET REPEAT"    — exit 0 (manual reset)
+#
+# Hook config (settings.json):
+# {
+#   "hooks": {
+#     "PreToolUse": [{
+#       "matcher": "Bash",
+#       "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/same-command-repeat-detector.sh" }]
+#     }]
+#   }
+# }
+#
+# Env vars:
+#   CC_SAME_CMD_REPEAT_DISABLE=1   — never warn or block
+#   CC_SAME_CMD_REPEAT_QUIET=1     — silent (process but never write to stderr)
+#   CC_SAME_CMD_REPEAT_THRESHOLD=N — block at N consecutive same command (default 3)
+
+set -u
+
+if [ "${CC_SAME_CMD_REPEAT_DISABLE:-}" = "1" ]; then
+    exit 0
+fi
+
+THRESHOLD="${CC_SAME_CMD_REPEAT_THRESHOLD:-3}"
+STATE_DIR="${TMPDIR:-/tmp}/cc-same-command-repeat-detector"
+mkdir -p "$STATE_DIR"
+SESSION_ID="${CLAUDE_SESSION_ID:-default}"
+COUNTER_FILE="$STATE_DIR/${SESSION_ID}.counter"
+LAST_CMD_FILE="$STATE_DIR/${SESSION_ID}.last"
+
+INPUT=$(cat 2>/dev/null || true)
+CMD=""
+if command -v jq >/dev/null 2>&1 && [ -n "$INPUT" ]; then
+    CMD=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null || true)
+fi
+
+if [ -z "$CMD" ]; then
+    exit 0
+fi
+
+# Canonicalise: strip leading/trailing whitespace, collapse internal runs
+CMD_CANON=$(printf '%s' "$CMD" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | tr -s '[:space:]' ' ')
+
+# Skip very short commands (ls, pwd, cd, etc. — legitimate to repeat)
+CMD_LEN=${#CMD_CANON}
+if [ "$CMD_LEN" -lt 4 ]; then
+    rm -f "$COUNTER_FILE" "$LAST_CMD_FILE"
+    exit 0
+fi
+
+# Manual reset signal
+if printf '%s\n' "$CMD_CANON" | grep -Eq '#[[:space:]]*RESET REPEAT'; then
+    rm -f "$COUNTER_FILE" "$LAST_CMD_FILE"
+    exit 0
+fi
+
+# Compare against last command in this session
+LAST_CMD=""
+if [ -f "$LAST_CMD_FILE" ]; then
+    LAST_CMD=$(cat "$LAST_CMD_FILE" 2>/dev/null || true)
+fi
+
+if [ "$CMD_CANON" != "$LAST_CMD" ]; then
+    # Different command — reset streak, record this one
+    printf '%s' "$CMD_CANON" > "$LAST_CMD_FILE"
+    printf '%d' 1 > "$COUNTER_FILE"
+    exit 0
+fi
+
+# Same as previous: increment streak counter
+CURRENT=0
+if [ -f "$COUNTER_FILE" ]; then
+    CURRENT=$(cat "$COUNTER_FILE" 2>/dev/null || echo 0)
+    case "$CURRENT" in
+        ''|*[!0-9]*) CURRENT=0 ;;
+    esac
+fi
+CURRENT=$((CURRENT + 1))
+printf '%d' "$CURRENT" > "$COUNTER_FILE"
+
+if [ "${CC_SAME_CMD_REPEAT_QUIET:-}" = "1" ]; then
+    if [ "$CURRENT" -ge "$THRESHOLD" ]; then
+        exit 2
+    fi
+    exit 0
+fi
+
+if [ "$CURRENT" -ge "$THRESHOLD" ]; then
+    # Truncate command for display (avoid floods on long commands)
+    DISPLAY_CMD="$CMD_CANON"
+    if [ "${#DISPLAY_CMD}" -gt 80 ]; then
+        DISPLAY_CMD="${CMD_CANON:0:77}..."
+    fi
+    cat >&2 <<EOF
+
+BLOCKED: This is the ${CURRENT}th consecutive identical Bash command.
+
+Repeated command: ${DISPLAY_CMD}
+
+Pattern detected: Opus 4.8 re-emits the same real (non-no-op) command
+5–10 times in a row, apparently to compensate for perceived non-receipt
+of the previous result. This is Cluster 25 axis 25F — same-command
+repeat-execution. Unlike axis 25B (echo-probe spam) which burns mostly
+display clutter, 25F burns actual CPU + wall-clock + build artefact
+churn each iteration.
+
+What to do instead:
+  - If the previous result delivery failed: check the transcript for the
+    earlier tool_result block before re-running. Re-running won't unstick
+    the delivery layer.
+  - If the previous result was genuinely empty: verify via a side effect
+    that does not re-run the same command (git log, ls, status check).
+  - If the previous result simply hasn't been processed yet: wait, do not
+    re-emit.
+
+Universal mitigation across Cluster 25 today: switch to Opus 4.7.
+  export ANTHROPIC_MODEL=claude-opus-4-7
+
+Anchor case: github.com/anthropics/claude-code/issues/63887 (@KamilDev,
+"it decided to fire off a build command ten times in a row")
+
+To override this block once: include "# RESET REPEAT" in the next command.
+To disable: export CC_SAME_CMD_REPEAT_DISABLE=1
+To adjust threshold: export CC_SAME_CMD_REPEAT_THRESHOLD=N (default 3)
+
+EOF
+    exit 2
+fi
+
+cat >&2 <<EOF
+
+NOTICE: Detected ${CURRENT}/${THRESHOLD} consecutive identical Bash commands.
+This shape is the Cluster 25 axis 25F same-command repeat-execution
+compensation routine. Will block at ${THRESHOLD} consecutive occurrences.
+Anchor: github.com/anthropics/claude-code/issues/63887
+
+EOF
+
+exit 0