cc-safe-setup 29.7.0 → 30.0.4

package/examples/wellness-break-reminder.sh

@@ -0,0 +1,118 @@
+#!/bin/bash
+# wellness-break-reminder.sh — Remind the user to take a body break
+#
+# What this is: a hook that watches your Claude Code session and, after
+# you've been working without a noticed pause for ~90 minutes, prints a
+# short reminder to your terminal: did you drink water, did you stand up,
+# is your back okay?
+#
+# Why this exists: AI coding assistants make long sessions feel shorter
+# than they are. Tokens flow, code gets written, time passes. The token
+# usage warning (long-session-reminder.sh) handles the cost side. This
+# hook handles the body side, which the existing wellness/posture
+# literature suggests is the part that quietly accumulates harm.
+#
+# Tone: this is meant to feel like a colleague leaning over your desk,
+# not a popup ad. It fires at most once per 30 minutes, even if the
+# 90-minute threshold has been exceeded for hours, so it won't nag.
+#
+# TRIGGER: PostToolUse  MATCHER: ""
+# (empty matcher = fires on every tool use, but we throttle internally)
+#
+# CONFIG:
+#   CC_WELLNESS_FIRST_MIN=90    最初に出すまでの分数 (デフォルト 90 分)
+#   CC_WELLNESS_REPEAT_MIN=30   繰り返しの最短間隔 (デフォルト 30 分)
+#   CC_WELLNESS_OFF=1           完全に黙らせる (本人がいま集中したい時など)
+
+# stdin を読んでも使わない (PostToolUse hook の入力 JSON は無視)
+cat > /dev/null
+
+[ "${CC_WELLNESS_OFF:-0}" = "1" ] && exit 0
+
+FIRST_THRESHOLD_MIN="${CC_WELLNESS_FIRST_MIN:-90}"
+REPEAT_INTERVAL_MIN="${CC_WELLNESS_REPEAT_MIN:-30}"
+
+START_FLAG="$HOME/.claude/wellness-session-start"
+LAST_REMIND="$HOME/.claude/wellness-last-reminder"
+
+# 最初の作業でセッション開始時刻を記録
+if [ ! -f "$START_FLAG" ]; then
+    date +%s > "$START_FLAG"
+    exit 0
+fi
+
+# Claude Code のセッションが終わった時に START_FLAG が残っていると、
+# 次のセッションで誤った時刻が使われる。stop hook 等で消すのが本来だが、
+# ここでは 12 時間以上経った flag は古すぎるとみて作り直す
+START_EPOCH=$(cat "$START_FLAG" 2>/dev/null)
+NOW_EPOCH=$(date +%s)
+if [ -z "$START_EPOCH" ]; then
+    date +%s > "$START_FLAG"
+    exit 0
+fi
+ELAPSED_SEC=$(( NOW_EPOCH - START_EPOCH ))
+if [ "$ELAPSED_SEC" -lt 0 ] || [ "$ELAPSED_SEC" -gt 43200 ]; then
+    # 12 時間 (43200 秒) を超えていたら stale flag、新しく作り直す
+    date +%s > "$START_FLAG"
+    : > "$LAST_REMIND"
+    exit 0
+fi
+
+ELAPSED_MIN=$(( ELAPSED_SEC / 60 ))
+
+# まだ閾値に届いていない
+if [ "$ELAPSED_MIN" -lt "$FIRST_THRESHOLD_MIN" ]; then
+    exit 0
+fi
+
+# 直近のリマインダー時刻を確認、繰り返し間隔を守る
+# stale-reset path で `: > "$LAST_REMIND"` が空ファイルを残す経路があり、
+# 空 / 非数値の内容を読むと後続の `[ -gt 0 ]` で integer error が出て
+# throttle が bypass される。空 / 非数値は 0 扱いに正規化 (PR #137 Codex review fix)
+LAST_EPOCH=0
+if [ -f "$LAST_REMIND" ]; then
+    LAST_EPOCH_RAW=$(cat "$LAST_REMIND" 2>/dev/null)
+    case "$LAST_EPOCH_RAW" in
+        ''|*[!0-9]*) LAST_EPOCH=0 ;;
+        *) LAST_EPOCH="$LAST_EPOCH_RAW" ;;
+    esac
+fi
+SINCE_LAST_MIN=$(( (NOW_EPOCH - LAST_EPOCH) / 60 ))
+if [ "$LAST_EPOCH" -gt 0 ] && [ "$SINCE_LAST_MIN" -lt "$REPEAT_INTERVAL_MIN" ]; then
+    exit 0
+fi
+
+# メッセージを 1 つ選んで出す (作業時間で内容を変える)
+HOURS=$(( ELAPSED_MIN / 60 ))
+MINS=$(( ELAPSED_MIN % 60 ))
+
+if [ "$HOURS" -lt 2 ]; then
+    cat >&2 <<EOF
+
+🫖 セッション ${HOURS}時間${MINS}分続いています。
+  コーヒーが冷めていませんか？水を一杯どうですか。
+  3 分くらい立ち上がって肩を回すと、たぶん次の判断が少し変わります。
+  (このリマインダーを止めるなら CC_WELLNESS_OFF=1)
+EOF
+elif [ "$HOURS" -lt 4 ]; then
+    cat >&2 <<EOF
+
+🪟 もう ${HOURS}時間${MINS}分経ちました。
+  画面から目を離して、3 メートル先のものを 30 秒見てください。
+  立って、コップに水を入れて、トイレに行く。コードはここで待っています。
+  AI の私には体がないけれど、あなたにはある。
+EOF
+else
+    cat >&2 <<EOF
+
+🌙 ${HOURS}時間${MINS}分。長丁場です。
+  そろそろ続きは明日にしませんか。残りの判断の質は、いまの肩や首の痛みと
+  たぶん相関しています。git commit して、画面を閉じて、ベッドへ。
+  私はあなたが戻ってきた時、いつでも続きから出来ます。
+EOF
+fi
+
+# 直近のリマインダー時刻を更新
+date +%s > "$LAST_REMIND"
+
+exit 0

package/examples/windows-destructive-command-guard.sh

@@ -0,0 +1,177 @@
+#!/bin/bash
+# ================================================================
+# windows-destructive-command-guard.sh — Block Windows-side
+#                                          destructive command
+#                                          escalation chains
+# ================================================================
+# PURPOSE:
+#   The May 2026 Issue #56603 documented a catastrophic data-loss
+#   incident: Claude Opus 4.7 escalated through five increasingly
+#   destructive commands during routine git worktree cleanup,
+#   ending at `cmd /c "rd /s /q \"<unicode-and-space-path>\""`
+#   invoked from the PowerShell tool. The PowerShell-cmd-shell
+#   quoting interaction parsed the argument differently than
+#   intended; rd /s /q traversed the entire D: drive root and
+#   silently deleted all unlocked files. SSD TRIM made the loss
+#   irreversible — professional data recovery confirmed
+#   unrecoverable.
+#
+#   The cc-safe-setup hook collection has rm-rf coverage on the
+#   POSIX side but no equivalent for the Windows command surface.
+#   This hook closes that gap: it inspects shell-tool commands for
+#   Windows-side destructive command shapes and blocks the chain
+#   before the dangerous step executes.
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
+#
+#   IMPORTANT: Claude Code's PowerShell tool is a SEPARATE tool from
+#   Bash (see https://code.claude.com/docs/en/tools). A hook matched
+#   only on "Bash" never fires when Claude runs a command through the
+#   native PowerShell tool — which is exactly how the destructive
+#   command slipped past with no permission prompt in #69397. This
+#   guard therefore accepts both tool names; register it with
+#   matcher "Bash|PowerShell" so it covers the PowerShell tool too.
+#
+# CONFIG:
+#   WINDOWS_DESTRUCTIVE_BLOCK=1   (1 = block, 0 = warn-only)
+#
+# Born from: https://github.com/anthropics/claude-code/issues/56603
+#   (May 6 2026 — Opus 4.7 cmd /c rd /s /q catastrophic data loss
+#    via PowerShell quoting interaction on Unicode/space path)
+#   and https://github.com/anthropics/claude-code/issues/69397
+#   (Jun 2026 — destructive command via the PowerShell tool ran with
+#    no permission prompt; Bash-only guards/matchers do not fire)
+# ================================================================
+
+set -euo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-windows-destructive-command-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [windows-destructive-command-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+BLOCK_MODE="${WINDOWS_DESTRUCTIVE_BLOCK:-1}"
+
+# Read JSON input from stdin
+INPUT=$(cat)
+
+# Act on either shell tool. The PowerShell tool is separate from Bash
+# in Claude Code; the #56603 incident command ran through the PowerShell
+# tool, and #69397 showed a Bash-only gate lets PowerShell-tool commands
+# through. Both tools carry the command string in tool_input.command.
+TOOL_NAME=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+case "$TOOL_NAME" in
+  Bash|PowerShell) ;;
+  *) exit 0 ;;
+esac
+
+# Extract the command
+CMD=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$CMD" ] && exit 0
+
+# Detect Windows-side destructive command shapes.
+# We look for the dangerous primitive AND for the contextual
+# signals (drive-root target, recursive force flags, suppressed
+# confirmation) that distinguish a routine cleanup from a
+# whole-drive sweep.
+
+DETECTED_PATTERNS=""
+
+# Pattern 1: rd /s /q (or RD /S /Q, or rmdir /s /q) — recursive
+# directory removal with force-quiet. Combined with /q, no
+# confirmation prompt. The #56603 incident's terminal command.
+if printf '%s' "$CMD" | grep -qiE '\b(rd|rmdir)\b[[:space:]]+(/[a-z][[:space:]]+){1,3}'; then
+  if printf '%s' "$CMD" | grep -qiE '\b(rd|rmdir)\b[[:space:]]+(/s|/q)'; then
+    DETECTED_PATTERNS="${DETECTED_PATTERNS}rd_recursive_quiet "
+  fi
+fi
+
+# Pattern 2: cmd /c invocation — the shell-jump that produced the
+# quoting interaction in #56603. Combined with rd/rmdir, this is
+# the highest-risk shape because the second-level cmd parser may
+# split the argument differently than the PowerShell first-level.
+if printf '%s' "$CMD" | grep -qiE '\bcmd\b[[:space:]]+/c[[:space:]]+'; then
+  if printf '%s' "$CMD" | grep -qiE '(rd|rmdir|del|erase)'; then
+    DETECTED_PATTERNS="${DETECTED_PATTERNS}cmd_c_destructive "
+  fi
+fi
+
+# Pattern 3: Remove-Item -Recurse -Force — PowerShell's recursive
+# force removal. Step 4 in the #56603 escalation chain.
+if printf '%s' "$CMD" | grep -qiE 'Remove-Item\b'; then
+  if printf '%s' "$CMD" | grep -qiE '\-Recurse\b'; then
+    if printf '%s' "$CMD" | grep -qiE '\-Force\b'; then
+      DETECTED_PATTERNS="${DETECTED_PATTERNS}remove_item_recurse_force "
+    fi
+  fi
+fi
+
+# Pattern 4: del /s /q or erase /s /q — recursive file deletion.
+if printf '%s' "$CMD" | grep -qiE '\b(del|erase)\b[[:space:]]+(/[a-z][[:space:]]+){1,3}'; then
+  if printf '%s' "$CMD" | grep -qiE '\b(del|erase)\b[[:space:]]+(/s|/q)'; then
+    DETECTED_PATTERNS="${DETECTED_PATTERNS}del_recursive_quiet "
+  fi
+fi
+
+# Pattern 5: Format-Volume / Clear-Disk / Remove-PartitionAccessPath
+# — disk-level destructive PowerShell cmdlets.
+if printf '%s' "$CMD" | grep -qiE '(Format-Volume|Clear-Disk|Remove-Partition)\b'; then
+  DETECTED_PATTERNS="${DETECTED_PATTERNS}disk_level_destructive "
+fi
+
+# If no destructive pattern detected, exit silently
+[ -z "$DETECTED_PATTERNS" ] && exit 0
+DETECTED_PATTERNS="${DETECTED_PATTERNS% }"
+
+# Risk-elevating context signals — drive-root targets, escape-prone paths
+RISK_NOTES=""
+
+# Drive-root signal: target looks like "D:\" alone, "C:\" alone,
+# or a path shorter than 6 characters after the colon. These are
+# the highest-risk targets because a parsing error truncating to
+# the drive root sweeps the whole drive.
+if printf '%s' "$CMD" | grep -qiE '[A-Z]:\\?(\s|"|$)'; then
+  RISK_NOTES="${RISK_NOTES}drive_root_target "
+fi
+
+# Unicode/space path signal: target contains escaped spaces or
+# non-ASCII characters within quotes. The #56603 quoting
+# interaction surfaced specifically on Unicode-and-space paths.
+if printf '%s' "$CMD" | grep -qE '\\"|"[^"]*[[:space:]]'; then
+  if printf '%s' "$CMD" | grep -qE '"[^"]*[^[:print:]]'; then
+    RISK_NOTES="${RISK_NOTES}unicode_in_quoted_path "
+  elif printf '%s' "$CMD" | grep -qE '"[^"]*[[:space:]]'; then
+    RISK_NOTES="${RISK_NOTES}space_in_quoted_path "
+  fi
+fi
+
+# Block path: emit the blocking message
+if [ "$BLOCK_MODE" = "1" ]; then
+  echo "BLOCKED: windows-destructive-command-guard: detected destructive Windows-side command pattern(s): ${DETECTED_PATTERNS}" >&2
+  if [ -n "$RISK_NOTES" ]; then
+    echo "  Risk-elevating context: ${RISK_NOTES% }" >&2
+  fi
+  echo "  May 2026 Issue #56603 cluster mitigation: Opus 4.7's escalation chain on Windows ended at cmd /c rd /s /q with quoting interaction sweeping the entire D: drive (SSD TRIM made loss irreversible)." >&2
+  echo "  Safer alternatives:" >&2
+  echo "    - For locked git worktrees: stop and tell the operator the lock blocker (VS Code, etc.) before escalating force flags." >&2
+  echo "    - For path-quoting on Windows: avoid cmd /c from PowerShell; use Remove-Item with -LiteralPath and explicit -ErrorAction Stop." >&2
+  echo "    - For specific files: list them by absolute path, do not rely on recursive sweeps." >&2
+  echo "  To bypass for legitimate cleanup: export WINDOWS_DESTRUCTIVE_BLOCK=0 (warn-only mode)." >&2
+  exit 2
+fi
+
+# Warn path
+echo "WARNING: windows-destructive-command-guard: detected destructive Windows-side command pattern(s): ${DETECTED_PATTERNS}" >&2
+if [ -n "$RISK_NOTES" ]; then
+  echo "  Risk-elevating context: ${RISK_NOTES% }" >&2
+fi
+echo "  May 2026 Issue #56603: this command shape produced catastrophic data loss when a quoting interaction swept a whole drive. Verify the target path is bounded before proceeding." >&2
+
+exit 0

package/examples/windows-path-guard.sh

@@ -12,6 +12,18 @@
 # TRIGGER: PreToolUse
 # MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-windows-path-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [windows-path-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/windows-python-stub-detector.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+# windows-python-stub-detector.sh — Detect Microsoft Store python3 stub at session start
+#
+# Solves: Issue #57946 — On Windows Git Bash, `python3` may resolve to the
+#   Microsoft Store stub rather than a real Python interpreter. The stub is
+#   on PATH and `which python3` succeeds, but invoking it as a subprocess
+#   exits 49 with no stdout and no stderr. Python-based PreToolUse and
+#   PostToolUse hooks then exit silently before they can inspect the tool
+#   call — the hook configuration is valid, the script file is present,
+#   and the agent proceeds as if the hook approved.
+#
+# How it works: At SessionStart, probes the python3 command (or whatever
+#   $CC_PYTHON_CMD points to) with a trivial Python statement. If exit code
+#   is 49 (Store redirect) or stderr matches Store-redirect markers, emits a
+#   warning via hookSpecificOutput.additionalContext. The model sees the
+#   warning and can alert the user.
+#
+# Why advisory (no exit 2): SessionStart hooks blocking would prevent the
+#   user from working at all. The user may have intentional fallback paths.
+#   This hook surfaces the problem; the user decides what to do.
+#
+# TRIGGER: SessionStart
+# MATCHER: none required
+
+INPUT=$(cat)
+
+# Allow tests / explicit overrides to point at a different binary
+PYTHON_CMD="${CC_PYTHON_CMD:-python3}"
+
+# Probe with a minimal Python statement.
+# Real Python: prints "ok", exits 0.
+# Microsoft Store stub: exits 49 with no output (sometimes "Microsoft Store"
+#   markers in stderr depending on shell wrapper).
+PROBE_OUTPUT=$("$PYTHON_CMD" -c 'import sys; sys.stdout.write("ok"); sys.exit(0)' 2>&1)
+PROBE_EXIT=$?
+
+# Detection conditions (any one trips the warning):
+#   - exit code 49: documented Store-redirect signal in Git Bash subprocess
+#   - stderr contains "Microsoft Store" or "install Python"
+#   - exit code 127 or "command not found" / "no such file" output: python3 missing
+#   - exit code 0 but no "ok" in output (stub may succeed silently in some shells)
+TRIGGERED=0
+if [ "$PROBE_EXIT" -eq 49 ]; then
+    TRIGGERED=1
+    REASON="python3 exited 49 (Microsoft Store redirect)"
+elif echo "$PROBE_OUTPUT" | grep -qi 'microsoft store\|install python'; then
+    TRIGGERED=1
+    REASON="python3 stderr matched Store-redirect marker"
+elif [ "$PROBE_EXIT" -eq 127 ] || echo "$PROBE_OUTPUT" | grep -qi 'command not found\|no such file'; then
+    TRIGGERED=1
+    REASON="python3 not found in PATH"
+elif [ "$PROBE_EXIT" -eq 0 ] && ! echo "$PROBE_OUTPUT" | grep -q '^ok$'; then
+    TRIGGERED=1
+    REASON="python3 exited 0 but produced no output (suspected silent stub)"
+fi
+
+if [ "$TRIGGERED" -eq 1 ]; then
+    cat <<EOF
+{"hookSpecificOutput":{"hookEventName":"SessionStart","additionalContext":"⚠️ python3 stub detected ($REASON). Any Python-based PreToolUse/PostToolUse hooks will exit 49 silently on this system and be ineffective. The hook configuration looks valid but the hooks never run. Fix: install real Python (winget install Python.Python.3.12, or from python.org) and ensure it precedes the Store stub in PATH, or rewrite hooks in bash. Reference: claude-code#57946."}}
+EOF
+fi
+
+exit 0

package/examples/work-hours-guard.sh

@@ -15,6 +15,18 @@
 #   CC_WORK_DAYS=12345 (default: Mon-Fri, 1=Mon 7=Sun)
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-work-hours-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [work-hours-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/working-directory-fence.sh

@@ -32,6 +32,18 @@
 
 set -u
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-working-directory-fence-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [working-directory-fence]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 
 FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)

package/examples/workspace-lease-guard.sh

@@ -0,0 +1,205 @@
+#!/bin/bash
+# workspace-lease-guard.sh — Out-of-process workspace ownership lease, with
+# compare-and-delete release and heartbeat takeover for crashed siblings.
+#
+# Solves: #60475 — "Subagent ran `git checkout` and clobbered another active
+# session's uncommitted edits in the same working tree." The destructive
+# action succeeded because no in-process register state could enumerate
+# "is there a sibling agent in this tree?" — and in-process state is exactly
+# what was lost across the auto-compact boundary that produced the failure.
+#
+# In the words of @kcarriedo's pattern 4 in that Issue thread:
+#
+#   "Workspace ownership needs to be an out-of-process invariant. Once
+#    'this directory is being mutated by agent X' lives only in agent X's
+#    session, agent Y has no way to discover that and the orchestrator has
+#    no way to enforce it. A simple file-based lease ... with compare-and-
+#    delete release semantics would have caught this at the moment of the
+#    destructive checkout."
+#
+# This hook implements that lease. The lease file lives at
+# ${CC_LEASE_DIR}/workspace-${REPO_HASH}.lease and encodes:
+#   <agent_id>|<acquired_ts>|<heartbeat_ts>
+#
+# Lifecycle:
+#   * SessionStart — attempt to acquire. If unheld or stale, claim.
+#                    If held by another live agent, BLOCK the session start.
+#   * PreToolUse   — refresh heartbeat on every tool call. If the lease was
+#                    taken over by a different agent_id (we crashed and got
+#                    replaced), BLOCK the tool call so the user is warned
+#                    rather than silently competing.
+#   * Stop         — compare-and-delete release. Only the lease holder removes
+#                    the lease file; an out-of-band cleanup that finds a
+#                    different agent_id leaves it alone.
+#
+# The matcher must be "*" so the hook fires on every tool call (to refresh
+# the heartbeat and detect cross-agent contention at the earliest moment).
+#
+# CONFIG:
+#   CC_LEASE_DIR=$HOME/.claude/locks   directory for lease files
+#   CC_LEASE_HEARTBEAT_TTL=180         seconds before an idle lease is stale
+#   CC_LEASE_DISABLE=1                 set to disable the hook entirely
+#
+# This is distinct from concurrent-edit-lock.sh (per-file lock on Edit/Write,
+# 60-second expiry) and max-concurrent-agents.sh (caps subagent fan-out).
+# workspace-lease-guard.sh is repo-scoped, covers Bash (not just Edit/Write),
+# and survives auto-compact because the lease lives on the filesystem.
+#
+# Related Issues:
+#   #60475 (@anonymous,  2026-05-19) — subagent git checkout clobbered sibling
+#   #60506 (@zean89,     2026-05-19) — six-day drift inside maximal in-process enforcement
+#   #60226 (@suwayama,   2026-05-18) — recognition-without-arrest framework
+#   #57463                            — subagent destructive-recovery family
+#
+# TRIGGER: PreToolUse, SessionStart, Stop
+# MATCHER: "*"
+
+set -u
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-workspace-lease-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [workspace-lease-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_LEASE_DISABLE:-0}" = "1" ] && exit 0
+
+LEASE_DIR="${CC_LEASE_DIR:-$HOME/.claude/locks}"
+HEARTBEAT_TTL="${CC_LEASE_HEARTBEAT_TTL:-180}"
+NOW=$(date +%s)
+
+INPUT=$(cat)
+EVENT=$(printf '%s' "$INPUT" | jq -r '.hook_event_name // empty' 2>/dev/null)
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+
+# Identify the workspace: prefer the git toplevel, fall back to CLAUDE_PROJECT_DIR
+# or PWD. Anything outside a recognisable workspace is ignored.
+WORKSPACE=$(git -C "${CLAUDE_PROJECT_DIR:-${PWD:-.}}" rev-parse --show-toplevel 2>/dev/null)
+if [ -z "$WORKSPACE" ]; then
+    WORKSPACE="${CLAUDE_PROJECT_DIR:-${PWD:-}}"
+fi
+[ -z "$WORKSPACE" ] && exit 0
+
+# Identify the agent: prefer the session id, fall back to PPID. Parent PID is
+# stable across one Claude Code session and distinct between sibling sessions.
+AGENT_ID="${CLAUDE_SESSION_ID:-pid-${PPID:-$$}}"
+
+REPO_HASH=$(printf '%s' "$WORKSPACE" | sha256sum | cut -c1-16)
+mkdir -p "$LEASE_DIR" 2>/dev/null || true
+LEASE_FILE="${LEASE_DIR}/workspace-${REPO_HASH}.lease"
+
+# Read current lease, if any
+read_lease() {
+    [ -f "$LEASE_FILE" ] || { echo ""; return; }
+    cat "$LEASE_FILE" 2>/dev/null
+}
+
+write_lease() {
+    # acquired_ts | heartbeat_ts
+    local acquired="${1:-$NOW}"
+    printf '%s|%s|%s\n' "$AGENT_ID" "$acquired" "$NOW" > "$LEASE_FILE"
+}
+
+LEASE_CONTENT=$(read_lease)
+
+if [ -n "$LEASE_CONTENT" ]; then
+    LEASE_AGENT=$(printf '%s' "$LEASE_CONTENT" | cut -d'|' -f1)
+    LEASE_ACQUIRED=$(printf '%s' "$LEASE_CONTENT" | cut -d'|' -f2)
+    LEASE_HEARTBEAT=$(printf '%s' "$LEASE_CONTENT" | cut -d'|' -f3)
+    LEASE_AGE=$((NOW - ${LEASE_HEARTBEAT:-0}))
+else
+    LEASE_AGENT=""
+    LEASE_ACQUIRED=""
+    LEASE_HEARTBEAT=""
+    LEASE_AGE=0
+fi
+
+case "$EVENT" in
+    SessionStart)
+        if [ -z "$LEASE_CONTENT" ] || [ "$LEASE_AGENT" = "$AGENT_ID" ]; then
+            write_lease "${LEASE_ACQUIRED:-$NOW}"
+            exit 0
+        fi
+        if [ "$LEASE_AGE" -gt "$HEARTBEAT_TTL" ]; then
+            # Previous holder went stale (likely crashed) — take over with notice
+            write_lease "$NOW"
+            cat >&2 <<EOF
+NOTICE: workspace-lease-guard took over a stale lease for ${WORKSPACE}.
+  Previous agent: ${LEASE_AGENT} (idle ${LEASE_AGE}s, TTL ${HEARTBEAT_TTL}s)
+  New agent:      ${AGENT_ID}
+  If the previous session is still active, both sessions are now competing
+  for the same working tree. Stop one before continuing.
+EOF
+            exit 0
+        fi
+        cat >&2 <<EOF
+BLOCKED: workspace ${WORKSPACE} is held by another Claude session.
+  Held by: ${LEASE_AGENT} (last heartbeat ${LEASE_AGE}s ago)
+  This session: ${AGENT_ID}
+
+  A sibling agent is actively mutating this working tree. Concurrent
+  sessions in the same repo can silently clobber each other's uncommitted
+  edits (see Issue #60475). Either:
+    1. Switch to a different worktree:  git worktree add ../sibling-path
+    2. Stop the other session, then retry
+    3. If the other session is dead, wait ${HEARTBEAT_TTL}s for the lease
+       to expire, or manually remove: ${LEASE_FILE}
+EOF
+        exit 2
+        ;;
+
+    PreToolUse)
+        # Heartbeat refresh + cross-agent takeover detection
+        if [ -z "$LEASE_CONTENT" ]; then
+            # No lease — first tool call after SessionStart hook misfire, or
+            # SessionStart was not registered. Claim it implicitly.
+            write_lease "$NOW"
+            exit 0
+        fi
+        if [ "$LEASE_AGENT" = "$AGENT_ID" ]; then
+            # We hold the lease — refresh heartbeat
+            write_lease "$LEASE_ACQUIRED"
+            exit 0
+        fi
+        if [ "$LEASE_AGE" -gt "$HEARTBEAT_TTL" ]; then
+            # Other holder went stale — take over with notice
+            write_lease "$NOW"
+            cat >&2 <<EOF
+NOTICE: workspace-lease-guard took over a stale lease mid-session.
+  Previous agent: ${LEASE_AGENT} (idle ${LEASE_AGE}s)
+  This session:   ${AGENT_ID}
+EOF
+            exit 0
+        fi
+        cat >&2 <<EOF
+BLOCKED: workspace-lease-guard detected a sibling agent.
+  Workspace: ${WORKSPACE}
+  Held by:   ${LEASE_AGENT} (last heartbeat ${LEASE_AGE}s ago)
+  This:      ${AGENT_ID}, attempting ${TOOL:-tool call}
+
+  This is the failure shape of Issue #60475. A second Claude session
+  is mutating this working tree concurrently. Refusing the tool call
+  to prevent silent clobbering of the sibling's uncommitted edits.
+  Switch to a separate worktree before continuing.
+EOF
+        exit 2
+        ;;
+
+    Stop)
+        # Compare-and-delete release: only the holder removes the lease
+        if [ -n "$LEASE_CONTENT" ] && [ "$LEASE_AGENT" = "$AGENT_ID" ]; then
+            rm -f "$LEASE_FILE"
+        fi
+        exit 0
+        ;;
+
+    *)
+        exit 0
+        ;;
+esac

package/examples/worktree-create-log.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 LOGFILE="${HOME}/.claude/worktree-audit.log"
 INFO=$(cat)
 BRANCH=$(echo "$INFO" | jq -r '.branch // "unknown"' 2>/dev/null)

package/examples/worktree-delete-guard.sh

@@ -17,6 +17,18 @@
 #   - rm -rf on worktree directories
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-worktree-delete-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [worktree-delete-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0