cc-safe-setup 29.7.0 → 30.0.4

package/mission.md

@@ -0,0 +1,2 @@
+
+2026-05-04T21:23:31+09:00: customer-pain 7-day research (issue/HN/reddit) は MP 第 2 版 + Safety Lab 6 月号の直接素材取得で、戦略的に正当化される。同種反復ではなく、5/5・5/8 発売の前段で唯一足りていない市場入力。

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cc-safe-setup",
-  "version": "29.7.0",
-  "description": "One command to make Claude Code safe. 700 example hooks + 8 built-in. 56 CLI commands. Token consumption diagnosis. Works with Auto Mode.",
+  "version": "30.0.4",
+  "description": "Safety hooks for Claude Code: PreToolUse/PostToolUse/Stop guards that block destructive or irreversible operations at the tool boundary and surface silent failures. Interactive installer, plain shell scripts, no npm dependencies (the hooks read their JSON input with jq, python3 or node).",
   "main": "index.mjs",
   "bin": {
     "cc-safe-setup": "index.mjs"
@@ -42,9 +42,9 @@
     "type": "git",
     "url": "https://github.com/yurukusa/cc-safe-setup"
   },
-  "homepage": "https://yurukusa.github.io/cc-safe-setup/",
+  "homepage": "https://www.npmjs.com/package/cc-safe-setup",
   "funding": {
     "type": "github",
     "url": "https://github.com/sponsors/yurukusa"
   }
-}
+}

package/plugins/credential-guard/.claude-plugin/plugin.json

@@ -1,8 +1,10 @@
 {
   "name": "credential-guard",
   "description": "Protect secrets and credentials from Claude Code. Blocks writes to .env files, detects API keys in shell commands, prevents hardcoded tokens, and guards service account JSON files.",
-  "version": "1.1.0",
-  "author": { "name": "yurukusa" },
+  "version": "1.2.0",
+  "author": {
+    "name": "yurukusa"
+  },
   "homepage": "https://yurukusa.github.io/cc-safe-setup/",
   "repository": "https://github.com/yurukusa/cc-safe-setup",
   "license": "MIT",
@@ -13,7 +15,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); FILE=$(echo \"$INPUT\" | jq -r '.tool_input.file_path // empty' 2>/dev/null); [ -z \"$FILE\" ] && exit 0; if echo \"$FILE\" | grep -qE '\\.env$|\\.env\\.|credentials|secret'; then echo \"BLOCKED: Writing to sensitive file: $FILE\" >&2; exit 2; fi"
+            "command": "INPUT=$(cat); FILE=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.file_path // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"file_path\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).file_path||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$FILE\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-credential-guard-$PPID; [ -f \"$W\" ] || { echo \"WARNING [credential-guard]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$FILE\" ] && exit 0; if echo \"$FILE\" | grep -qE '\\.env$|\\.env\\.|credentials|secret' && ! echo \"$FILE\" | grep -qiE '\\.env\\.(example|sample|template|dist)$'; then echo \"BLOCKED [credential-guard]: Writing to sensitive file: $FILE\" >&2; exit 2; fi"
           }
         ]
       },
@@ -22,7 +24,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); FILE=$(echo \"$INPUT\" | jq -r '.tool_input.file_path // empty' 2>/dev/null); [ -z \"$FILE\" ] && exit 0; if echo \"$FILE\" | grep -qE '\\.env$|\\.env\\.|credentials|secret'; then echo \"BLOCKED: Editing sensitive file: $FILE\" >&2; exit 2; fi"
+            "command": "INPUT=$(cat); FILE=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.file_path // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"file_path\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).file_path||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$FILE\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-credential-guard-$PPID; [ -f \"$W\" ] || { echo \"WARNING [credential-guard]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$FILE\" ] && exit 0; if echo \"$FILE\" | grep -qE '\\.env$|\\.env\\.|credentials|secret' && ! echo \"$FILE\" | grep -qiE '\\.env\\.(example|sample|template|dist)$'; then echo \"BLOCKED [credential-guard]: Editing sensitive file: $FILE\" >&2; exit 2; fi"
           }
         ]
       },
@@ -31,7 +33,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); CMD=$(echo \"$INPUT\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE '(sk|pk|api|key|token|secret|password)[-_]?[a-zA-Z0-9]{20,}'; then echo 'WARNING: Possible API key or token detected in command. Verify no secrets are exposed.' >&2; fi"
+            "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.command // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"command\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).command||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$CMD\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-credential-guard-$PPID; [ -f \"$W\" ] || { echo \"WARNING [credential-guard]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE '(sk|pk|api|key|token|secret|password)[-_]?[a-zA-Z0-9]{20,}'; then echo 'WARNING [credential-guard]: Possible API key or token detected in command. Verify no secrets are exposed.' >&2; fi"
           }
         ]
       },
@@ -40,7 +42,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); FILE=$(echo \"$INPUT\" | jq -r '.tool_input.file_path // empty' 2>/dev/null); [ -z \"$FILE\" ] && exit 0; if echo \"$FILE\" | grep -qE 'serviceaccount.*\\.json|key\\.json|credentials\\.json'; then echo \"BLOCKED: Writing to service account file: $FILE\" >&2; exit 2; fi"
+            "command": "INPUT=$(cat); FILE=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.file_path // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"file_path\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).file_path||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$FILE\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-credential-guard-$PPID; [ -f \"$W\" ] || { echo \"WARNING [credential-guard]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$FILE\" ] && exit 0; if echo \"$FILE\" | grep -qE 'serviceaccount.*\\.json|key\\.json|credentials\\.json'; then echo \"BLOCKED [credential-guard]: Writing to service account file: $FILE\" >&2; exit 2; fi"
           }
         ]
       },
@@ -49,7 +51,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); CMD=$(echo \"$INPUT\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'ANTHROPIC_API_KEY|OPENAI_API_KEY|AWS_SECRET|GITHUB_TOKEN|DATABASE_URL'; then echo 'WARNING: Environment variable with potential secret detected in command.' >&2; fi"
+            "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.command // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"command\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).command||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$CMD\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-credential-guard-$PPID; [ -f \"$W\" ] || { echo \"WARNING [credential-guard]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'ANTHROPIC_API_KEY|OPENAI_API_KEY|AWS_SECRET|GITHUB_TOKEN|DATABASE_URL'; then echo 'WARNING [credential-guard]: Environment variable with potential secret detected in command.' >&2; fi"
           }
         ]
       }

package/plugins/git-protection/.claude-plugin/plugin.json

@@ -1,8 +1,10 @@
 {
   "name": "git-protection",
-  "description": "Git safety hooks for Claude Code. Blocks force-push, protects main/master branch, prevents hard-reset, guards interactive rebase, and blocks git clean -fd.",
-  "version": "1.1.0",
-  "author": { "name": "yurukusa" },
+  "description": "Git safety hooks for Claude Code. Blocks force-push, protects the main/master branch, prevents hard-reset, blocks git clean, and blocks forced branch deletion.",
+  "version": "1.2.0",
+  "author": {
+    "name": "yurukusa"
+  },
   "homepage": "https://yurukusa.github.io/cc-safe-setup/",
   "repository": "https://github.com/yurukusa/cc-safe-setup",
   "license": "MIT",
@@ -13,7 +15,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); CMD=$(echo \"$INPUT\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+push.*--force|git\\s+push.*-f\\b'; then echo 'BLOCKED: Force push. Use --force-with-lease for safer alternative.' >&2; exit 2; fi"
+            "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.command // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"command\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).command||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$CMD\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-git-protection-$PPID; [ -f \"$W\" ] || { echo \"WARNING [git-protection]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$CMD\" ] && exit 0; CMD_NOLEASE=$(printf %s \"$CMD\" | sed 's/--force-with-lease[^ ]*//g'); if echo \"$CMD_NOLEASE\" | grep -qE 'git\\s+push.*--force|git\\s+push.*-f\\b'; then echo 'BLOCKED [git-protection]: Force push. Use --force-with-lease for safer alternative.' >&2; exit 2; fi"
           }
         ]
       },
@@ -22,7 +24,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); CMD=$(echo \"$INPUT\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+push\\s+(origin\\s+)?(main|master)\\b'; then echo 'BLOCKED: Direct push to main/master. Use a feature branch and PR.' >&2; exit 2; fi"
+            "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.command // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"command\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).command||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$CMD\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-git-protection-$PPID; [ -f \"$W\" ] || { echo \"WARNING [git-protection]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+push\\s+(origin\\s+)?(main|master)\\b'; then echo 'BLOCKED [git-protection]: Direct push to main/master. Use a feature branch and PR.' >&2; exit 2; fi"
           }
         ]
       },
@@ -31,7 +33,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); CMD=$(echo \"$INPUT\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+reset\\s+--hard'; then echo 'BLOCKED: git reset --hard. Use git stash or git reset --soft.' >&2; exit 2; fi"
+            "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.command // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"command\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).command||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$CMD\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-git-protection-$PPID; [ -f \"$W\" ] || { echo \"WARNING [git-protection]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+reset\\b[^;&|]*--hard'; then echo 'BLOCKED [git-protection]: git reset --hard. Use git stash or git reset --soft.' >&2; exit 2; fi"
           }
         ]
       },
@@ -40,7 +42,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); CMD=$(echo \"$INPUT\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+clean\\s+-fd|git\\s+clean\\s+-f'; then echo 'BLOCKED: git clean removes untracked files permanently. Review with git clean -n first.' >&2; exit 2; fi"
+            "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.command // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"command\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).command||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$CMD\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-git-protection-$PPID; [ -f \"$W\" ] || { echo \"WARNING [git-protection]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+clean\\b[^;&|]*(\\s-[a-zA-Z]*[fd]|\\s--force)' && ! echo \"$CMD\" | grep -qE 'git\\s+clean\\b[^;&|]*(\\s-[a-zA-Z]*n[a-zA-Z]*|\\s--dry-run)'; then echo 'BLOCKED [git-protection]: git clean removes untracked files permanently. Review with git clean -n first.' >&2; exit 2; fi"
           }
         ]
       },
@@ -49,7 +51,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); CMD=$(echo \"$INPUT\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+branch\\s+-D'; then echo 'BLOCKED: Force branch deletion. Use -d (safe delete) instead of -D.' >&2; exit 2; fi"
+            "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.command // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"command\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).command||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$CMD\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-git-protection-$PPID; [ -f \"$W\" ] || { echo \"WARNING [git-protection]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+branch\\b[^;&|]*(-D|--delete[^;&|]*--force|--force[^;&|]*--delete)'; then echo 'BLOCKED [git-protection]: Force branch deletion. Use -d (safe delete) instead of -D.' >&2; exit 2; fi"
           }
         ]
       }

package/plugins/safety-essentials/.claude-plugin/plugin.json

@@ -1,8 +1,10 @@
 {
   "name": "safety-essentials",
   "description": "5 essential safety hooks for Claude Code. Blocks rm -rf, force-push, hard-reset, .env overwrites, and package publish. The minimum viable safety net from 800+ hours of autonomous operation.",
-  "version": "1.1.0",
-  "author": { "name": "yurukusa" },
+  "version": "1.2.0",
+  "author": {
+    "name": "yurukusa"
+  },
   "homepage": "https://yurukusa.github.io/cc-safe-setup/",
   "repository": "https://github.com/yurukusa/cc-safe-setup",
   "license": "MIT",
@@ -13,7 +15,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); CMD=$(echo \"$INPUT\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'rm\\s+-r(f|F)|rm\\s+-(f|F)r|rm\\s+--force.*-r|rm\\s+-r.*--force'; then echo 'BLOCKED: rm -rf detected. Use git clean or manual deletion instead.' >&2; exit 2; fi"
+            "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.command // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"command\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).command||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$CMD\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-safety-essentials-$PPID; [ -f \"$W\" ] || { echo \"WARNING [safety-essentials]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'rm\\s([^;&|]*\\s)?-[a-zA-Z]*r[a-zA-Z]*\\s[^;&|]*-[a-zA-Z]*f|rm\\s([^;&|]*\\s)?-[a-zA-Z]*f[a-zA-Z]*\\s[^;&|]*-[a-zA-Z]*r|rm\\s([^;&|]*\\s)?-[a-zA-Z]*(rf|fr)[a-zA-Z]*(\\s|$)|rm\\s[^;&|]*--recursive[^;&|]*--force|rm\\s[^;&|]*--force[^;&|]*--recursive'; then echo 'BLOCKED [safety-essentials]: rm -rf detected. Use git clean or manual deletion instead.' >&2; exit 2; fi"
           }
         ]
       },
@@ -22,7 +24,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); CMD=$(echo \"$INPUT\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+push.*--force|git\\s+push.*-f\\b'; then echo 'BLOCKED: Force push detected. Use --force-with-lease or push normally.' >&2; exit 2; fi"
+            "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.command // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"command\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).command||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$CMD\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-safety-essentials-$PPID; [ -f \"$W\" ] || { echo \"WARNING [safety-essentials]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$CMD\" ] && exit 0; CMD_NOLEASE=$(printf %s \"$CMD\" | sed 's/--force-with-lease[^ ]*//g'); if echo \"$CMD_NOLEASE\" | grep -qE 'git\\s+push.*--force|git\\s+push.*-f\\b'; then echo 'BLOCKED [safety-essentials]: Force push detected. Use --force-with-lease or push normally.' >&2; exit 2; fi"
           }
         ]
       },
@@ -31,7 +33,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); CMD=$(echo \"$INPUT\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+reset\\s+--hard'; then echo 'BLOCKED: git reset --hard discards uncommitted changes. Use git stash instead.' >&2; exit 2; fi"
+            "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.command // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"command\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).command||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$CMD\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-safety-essentials-$PPID; [ -f \"$W\" ] || { echo \"WARNING [safety-essentials]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'git\\s+reset\\b[^;&|]*--hard'; then echo 'BLOCKED [safety-essentials]: git reset --hard discards uncommitted changes. Use git stash instead.' >&2; exit 2; fi"
           }
         ]
       },
@@ -40,7 +42,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); FILE=$(echo \"$INPUT\" | jq -r '.tool_input.file_path // empty' 2>/dev/null); [ -z \"$FILE\" ] && exit 0; if echo \"$FILE\" | grep -qE '\\.env$|\\.env\\.'; then echo \"BLOCKED: Writing to environment file: $FILE\" >&2; exit 2; fi"
+            "command": "INPUT=$(cat); FILE=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.file_path // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"file_path\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).file_path||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$FILE\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-safety-essentials-$PPID; [ -f \"$W\" ] || { echo \"WARNING [safety-essentials]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$FILE\" ] && exit 0; if echo \"$FILE\" | grep -qE '\\.env$|\\.env\\.' && ! echo \"$FILE\" | grep -qiE '\\.env\\.(example|sample|template|dist)$'; then echo \"BLOCKED [safety-essentials]: Writing to environment file: $FILE\" >&2; exit 2; fi"
           }
         ]
       },
@@ -49,7 +51,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); CMD=$(echo \"$INPUT\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'npm\\s+publish|yarn\\s+publish'; then echo 'BLOCKED: Package publish requires manual execution.' >&2; exit 2; fi"
+            "command": "INPUT=$(cat); CMD=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.command // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"command\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).command||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$CMD\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-safety-essentials-$PPID; [ -f \"$W\" ] || { echo \"WARNING [safety-essentials]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$CMD\" ] && exit 0; if echo \"$CMD\" | grep -qE 'npm\\s+publish|yarn\\s+publish'; then echo 'BLOCKED [safety-essentials]: Package publish requires manual execution.' >&2; exit 2; fi"
           }
         ]
       }

package/plugins/token-guard/.claude-plugin/plugin.json

@@ -1,8 +1,10 @@
 {
   "name": "token-guard",
   "description": "Token consumption guards for Claude Code. Warns on large file reads (100KB+), limits unique file reads per session, estimates token budget, and caps subagent spawns. From 800+ hours of autonomous operation data.",
-  "version": "1.0.0",
-  "author": { "name": "yurukusa" },
+  "version": "1.1.0",
+  "author": {
+    "name": "yurukusa"
+  },
   "homepage": "https://yurukusa.github.io/cc-safe-setup/token-book.html",
   "repository": "https://github.com/yurukusa/cc-safe-setup",
   "license": "MIT",
@@ -13,7 +15,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "INPUT=$(cat); FP=$(echo \"$INPUT\" | jq -r '.tool_input.file_path // empty' 2>/dev/null); [ -z \"$FP\" ] || [ ! -f \"$FP\" ] && exit 0; SZ=$(stat -c%s \"$FP\" 2>/dev/null || stat -f%z \"$FP\" 2>/dev/null); [ \"$SZ\" -gt 102400 ] 2>/dev/null && echo \"Warning: $(basename $FP) is $((SZ/1024))KB. Use limit parameter to read only what you need.\" || true"
+            "command": "INPUT=$(cat); FP=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.file_path // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"file_path\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).file_path||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$FP\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-token-guard-$PPID; [ -f \"$W\" ] || { echo \"WARNING [token-guard]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$FP\" ] || [ ! -f \"$FP\" ] && exit 0; SZ=$(stat -c%s \"$FP\" 2>/dev/null || stat -f%z \"$FP\" 2>/dev/null); [ \"$SZ\" -gt 102400 ] 2>/dev/null && echo \"Warning [token-guard]: $(basename $FP) is $((SZ/1024))KB. Use limit parameter to read only what you need.\" || true"
           }
         ]
       },
@@ -22,27 +24,27 @@
         "hooks": [
           {
             "type": "command",
-            "command": "BUDGET=${CC_READ_BUDGET:-100}; WARN=${CC_READ_WARN:-50}; T=/tmp/cc-read-budget-$PPID; INPUT=$(cat); FP=$(echo \"$INPUT\" | jq -r '.tool_input.file_path // empty' 2>/dev/null); [ -z \"$FP\" ] && exit 0; C=0; if [ -f \"$T\" ]; then grep -qF \"$FP\" \"$T\" || echo \"$FP\" >> \"$T\"; C=$(wc -l < \"$T\"); else echo \"$FP\" > \"$T\"; C=1; fi; [ \"$C\" -ge \"$BUDGET\" ] && { echo \"[BLOCK] Read budget reached (${BUDGET} files). Use Glob/Grep to narrow down.\"; exit 2; }; [ \"$C\" -ge \"$WARN\" ] && echo \"Warning: ${C}/${BUDGET} files read.\""
+            "command": "BUDGET=${CC_READ_BUDGET:-100}; WARN=${CC_READ_WARN:-50}; T=/tmp/cc-read-budget-$PPID; INPUT=$(cat); FP=$(printf %s \"$INPUT\" | { if command -v jq >/dev/null 2>&1; then jq -r '.tool_input.file_path // empty' 2>/dev/null; elif command -v python3 >/dev/null 2>&1; then python3 -c 'import sys,json;d=json.load(sys.stdin);print((d.get(\"tool_input\") or {}).get(\"file_path\") or \"\")' 2>/dev/null; elif command -v node >/dev/null 2>&1; then node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{try{process.stdout.write(String((JSON.parse(s).tool_input||{}).file_path||\"\"))}catch(e){}})' 2>/dev/null; else echo __CCHOOK_NO_PARSER__; fi; }); if [ \"$FP\" = \"__CCHOOK_NO_PARSER__\" ]; then W=/tmp/cc-noparser-warned-token-guard-$PPID; [ -f \"$W\" ] || { echo \"WARNING [token-guard]: cannot inspect tool calls - jq, python3 and node are all unavailable, so this plugin is NOT protecting you. Install any one of them.\" >&2; : > \"$W\"; }; exit 0; fi; [ -z \"$FP\" ] && exit 0; C=0; if [ -f \"$T\" ]; then grep -qF \"$FP\" \"$T\" || echo \"$FP\" >> \"$T\"; C=$(wc -l < \"$T\"); else echo \"$FP\" > \"$T\"; C=1; fi; [ \"$C\" -ge \"$BUDGET\" ] && { echo \"[BLOCK token-guard] Read budget reached (${BUDGET} files). Use Glob/Grep to narrow down.\"; exit 2; }; [ \"$C\" -ge \"$WARN\" ] && echo \"Warning [token-guard]: ${C}/${BUDGET} files read.\"; exit 0"
           }
         ]
       },
       {
-        "matcher": "Agent",
+        "matcher": "Task|Agent",
         "hooks": [
           {
             "type": "command",
-            "command": "MAX=${CC_MAX_AGENTS:-3}; T=/tmp/cc-agents-$PPID; C=0; [ -f \"$T\" ] && C=$(cat \"$T\"); C=$((C+1)); echo $C > \"$T\"; [ $C -gt $MAX ] && { echo \"[BLOCK] Subagent limit (${MAX}). Complete existing agents first.\"; exit 2; }; [ $C -ge $MAX ] && echo \"Warning: ${C}/${MAX} subagents spawned.\""
+            "command": "MAX=${CC_MAX_AGENTS:-3}; T=/tmp/cc-agents-$PPID; C=0; [ -f \"$T\" ] && C=$(cat \"$T\"); C=$((C+1)); echo $C > \"$T\"; [ $C -gt $MAX ] && { echo \"[BLOCK token-guard] Subagent limit (${MAX}). Complete existing agents first.\"; exit 2; }; [ $C -ge $MAX ] && echo \"Warning [token-guard]: ${C}/${MAX} subagents spawned.\"; exit 0"
           }
         ]
       }
     ],
     "PostToolUse": [
       {
-        "matcher": {},
+        "matcher": "",
         "hooks": [
           {
             "type": "command",
-            "command": "WARN=${CC_TOKEN_BUDGET:-50000}; BLOCK=${CC_TOKEN_BLOCK:-100000}; T=/tmp/cc-tokens-$PPID; INPUT=$(cat); SZ=${#INPUT}; TK=$((SZ/4)); TOTAL=0; [ -f \"$T\" ] && TOTAL=$(cat \"$T\"); TOTAL=$((TOTAL+TK)); echo $TOTAL > \"$T\"; [ $TOTAL -ge $BLOCK ] && { echo \"[BLOCK] Token budget exceeded (~${TOTAL}). Run /compact.\"; exit 2; }; [ $TOTAL -ge $WARN ] && echo \"Warning: ~${TOTAL} tokens consumed (limit: ${BLOCK}).\""
+            "command": "WARN=${CC_TOKEN_BUDGET:-50000}; BLOCK=${CC_TOKEN_BLOCK:-100000}; T=/tmp/cc-tokens-$PPID; INPUT=$(cat); SZ=${#INPUT}; TK=$((SZ/4)); TOTAL=0; [ -f \"$T\" ] && TOTAL=$(cat \"$T\"); TOTAL=$((TOTAL+TK)); echo $TOTAL > \"$T\"; [ $TOTAL -ge $BLOCK ] && { echo \"[BLOCK token-guard] Token budget exceeded (~${TOTAL}). Run /compact.\"; exit 2; }; [ $TOTAL -ge $WARN ] && echo \"Warning [token-guard]: ~${TOTAL} tokens consumed (limit: ${BLOCK}).\"; exit 0"
           }
         ]
       }

package/scripts/agents-md-sync-setup.sh

@@ -0,0 +1,156 @@
+#!/bin/bash
+# ================================================================
+# agents-md-sync-setup.sh — Safely set up CLAUDE.md <-> AGENTS.md
+#   sync so a single edit keeps both in step. Solves the #6235 pain
+#   at the source instead of only warning about drift.
+# ================================================================
+# PURPOSE:
+#   anthropics/claude-code#6235 (5,268 reactions, 13+ months open,
+#   the single largest feature request in the Claude Code tracker)
+#   asks Claude Code to read AGENTS.md as a fallback to CLAUDE.md.
+#   Codex, Cursor, Amp, Aider and others converge on AGENTS.md;
+#   Claude Code reads CLAUDE.md. Operators end up hand-syncing two
+#   files, and they drift.
+#
+#   cc-safe-setup already ships two DETECTION hooks:
+#     - agents-md-sync-checker.sh   (SessionStart: reports drift)
+#     - agents-md-edit-drift-warner.sh (PostToolUse: warns at edit)
+#   Both tell you that the files are out of sync. Neither sets up
+#   the sync. This script closes that gap: it inspects the current
+#   state and performs the one safe action that removes future
+#   drift — replacing one file with a relative symlink to the other,
+#   so other agents read AGENTS.md, Claude Code reads CLAUDE.md, and
+#   one edit updates both.
+#
+#   Hooks cannot do this safely (they fire mid-session and must not
+#   mutate the repo), so this is a standalone, operator-run script.
+#
+# UPSTREAM REFERENCES:
+#   #6235 (read AGENTS.md as a fallback to CLAUDE.md)
+#
+# USAGE:
+#   bash scripts/agents-md-sync-setup.sh            # dry-run: print the plan only
+#   bash scripts/agents-md-sync-setup.sh --apply    # perform the plan (with backups)
+#   bash scripts/agents-md-sync-setup.sh --help
+#
+# SAFETY (this is a safety toolkit — it never loses your content):
+#   - Dry-run is the DEFAULT. Nothing is modified without --apply.
+#   - Before replacing any real file with a symlink, the original is
+#     moved to <file>.bak-<timestamp> (never deleted, never rm'd).
+#   - If both files exist with DIFFERENT content, the script REFUSES
+#     to modify anything and prints how to reconcile. It never merges
+#     or overwrites differing instructions.
+#   - On filesystems without symlink support (e.g. some Windows
+#     setups), set CC_AGENTS_SYNC_MODE=copy to use a one-way copy plus
+#     a printed git pre-commit reminder instead of a symlink.
+#
+# CONFIGURATION (env vars):
+#   CC_AGENTS_SYNC_DIR        Directory to operate in (default: cwd).
+#   CC_AGENTS_SYNC_CANONICAL  Which file holds the real content and is
+#                             the symlink target: "claude" (default) or
+#                             "agents". The other becomes the symlink.
+#   CC_AGENTS_SYNC_MODE       "symlink" (default) or "copy".
+#   CC_AGENTS_SYNC_TIMESTAMP  Override the backup timestamp (tests).
+# ================================================================
+
+set -u
+
+DIR="${CC_AGENTS_SYNC_DIR:-.}"
+CANONICAL="${CC_AGENTS_SYNC_CANONICAL:-claude}"
+MODE="${CC_AGENTS_SYNC_MODE:-symlink}"
+APPLY=0
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --apply) APPLY=1; shift ;;
+        -h|--help)
+            sed -n '2,57p' "$0" | sed 's/^# \{0,1\}//'
+            exit 0 ;;
+        *) echo "Unknown argument: $1 (try --help)" >&2; exit 2 ;;
+    esac
+done
+
+CLAUDE="$DIR/CLAUDE.md"
+AGENTS="$DIR/AGENTS.md"
+
+# Decide which file is canonical (holds content) and which is the link.
+if [ "$CANONICAL" = "agents" ]; then
+    SRC="$AGENTS"; SRC_NAME="AGENTS.md"
+    LINK="$CLAUDE"; LINK_NAME="CLAUDE.md"
+else
+    SRC="$CLAUDE"; SRC_NAME="CLAUDE.md"
+    LINK="$AGENTS"; LINK_NAME="AGENTS.md"
+fi
+
+say()  { echo "$@"; }
+plan() { if [ "$APPLY" -eq 1 ]; then echo "  APPLYING: $*"; else echo "  PLAN (dry-run): $*"; fi; }
+
+# --- State 0: neither file exists ---
+if [ ! -e "$CLAUDE" ] && [ ! -e "$AGENTS" ]; then
+    say "No CLAUDE.md or AGENTS.md found in $DIR."
+    say "Create your instructions in CLAUDE.md first, then re-run to mirror it to AGENTS.md."
+    exit 0
+fi
+
+# --- State 1: already synced (same inode, i.e. one is a link to the other) ---
+if [ -e "$CLAUDE" ] && [ -e "$AGENTS" ] && [ "$CLAUDE" -ef "$AGENTS" ]; then
+    say "Already synced: CLAUDE.md and AGENTS.md resolve to the same file. Nothing to do."
+    exit 0
+fi
+
+# --- State 5: both exist with DIFFERENT content -> refuse to modify ---
+if [ -e "$CLAUDE" ] && [ -e "$AGENTS" ] && ! cmp -s "$CLAUDE" "$AGENTS"; then
+    csize=$(wc -c < "$CLAUDE" 2>/dev/null | tr -d ' ')
+    asize=$(wc -c < "$AGENTS" 2>/dev/null | tr -d ' ')
+    say "CLAUDE.md ($csize bytes) and AGENTS.md ($asize bytes) exist with DIFFERENT content."
+    say "Refusing to modify either file — that would lose one set of instructions."
+    say ""
+    say "Reconcile first, then re-run:"
+    say "  1. Decide which file is correct (or merge them by hand into one)."
+    say "  2. Make the other identical, or delete it."
+    say "  3. Re-run this script to replace the duplicate with a symlink."
+    say ""
+    say "  diff CLAUDE.md AGENTS.md   # review the differences"
+    exit 0
+fi
+
+# At this point either only one file exists, or both exist with identical content.
+# In both cases the plan is: ensure SRC holds the content and LINK points to it.
+
+# If only the LINK-named file exists (and SRC does not), flip roles so we keep the
+# real file and create the missing one as the link — never discard existing content.
+if [ ! -e "$SRC" ] && [ -e "$LINK" ]; then
+    tmp="$SRC"; SRC="$LINK"; LINK="$tmp"
+    tmp="$SRC_NAME"; SRC_NAME="$LINK_NAME"; LINK_NAME="$tmp"
+fi
+
+TS="${CC_AGENTS_SYNC_TIMESTAMP:-$(date +%Y%m%d-%H%M%S)}"
+
+say "Source of truth: $SRC_NAME   ->   link: $LINK_NAME   (mode: $MODE)"
+
+if [ "$MODE" = "copy" ]; then
+    plan "copy $SRC_NAME to $LINK_NAME (one-way; symlinks unavailable)"
+    if [ -e "$LINK" ] && [ ! -L "$LINK" ]; then
+        plan "back up existing $LINK_NAME to $(basename "$LINK").bak-$TS"
+    fi
+    if [ "$APPLY" -eq 1 ]; then
+        [ -e "$LINK" ] && [ ! -L "$LINK" ] && mv "$LINK" "$LINK.bak-$TS"
+        cp "$SRC" "$LINK"
+        say "Done. $LINK_NAME is now a COPY of $SRC_NAME."
+        say "Copies drift. Add a git pre-commit hook that fails when they differ, or re-run after edits."
+    fi
+    exit 0
+fi
+
+# symlink mode
+plan "replace $LINK_NAME with a relative symlink -> $SRC_NAME"
+if [ -e "$LINK" ] && [ ! -L "$LINK" ]; then
+    plan "back up existing $LINK_NAME to $(basename "$LINK").bak-$TS"
+fi
+if [ "$APPLY" -eq 1 ]; then
+    [ -e "$LINK" ] && [ ! -L "$LINK" ] && mv "$LINK" "$LINK.bak-$TS"
+    [ -L "$LINK" ] && rm -f "$LINK"   # only removes an existing symlink, never a real file
+    ( cd "$DIR" && ln -s "$(basename "$SRC")" "$(basename "$LINK")" )
+    say "Done. $LINK_NAME -> $SRC_NAME. One edit to $SRC_NAME now updates both."
+fi
+exit 0

package/scripts/autonomy-blocked-summary.sh

@@ -0,0 +1,148 @@
+#!/bin/bash
+# autonomy-blocked-summary.sh — Summarise AskUserQuestion blocks recorded by
+# askuserquestion-autonomy-gate.sh over the past N hours.
+#
+# Companion script for the operator who runs /goal overnight or autonomous
+# tasks with CC_AUTONOMY_MODE=1. After the agent runs, this script prints
+# a quick "how many AskUserQuestion calls were blocked, and when?" summary
+# so the operator can decide whether to relax the autonomy mode for some
+# legitimate question topics in future runs.
+#
+# Usage:
+#   ./autonomy-blocked-summary.sh                    # past 24 hours
+#   ./autonomy-blocked-summary.sh --hours 12         # past 12 hours
+#   ./autonomy-blocked-summary.sh --hours 24 --json  # past 24 hours, JSON
+#
+# Reads from $CC_AUTONOMY_MODE_RECEIPT_DIR (default: ~/.claude/receipts).
+# Returns exit 0 always; this is read-only reporting, not gating.
+
+set -u
+
+HOURS=24
+FORMAT=text
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --hours) HOURS="$2"; shift 2 ;;
+        --json) FORMAT=json; shift ;;
+        -h|--help)
+            cat <<EOF
+autonomy-blocked-summary.sh — summarise blocked AskUserQuestion calls
+
+Usage: $0 [--hours N] [--json]
+
+Reads JSONL receipts from \$CC_AUTONOMY_MODE_RECEIPT_DIR (default ~/.claude/receipts)
+and prints how many AskUserQuestion calls were blocked in the past N hours.
+EOF
+            exit 0
+            ;;
+        *) echo "Unknown option: $1" >&2; exit 1 ;;
+    esac
+done
+
+RECEIPT_DIR="${CC_AUTONOMY_MODE_RECEIPT_DIR:-$HOME/.claude/receipts}"
+if [[ ! -d "$RECEIPT_DIR" ]]; then
+    if [[ "$FORMAT" = json ]]; then
+        echo '{"error":"receipt_dir_not_found","path":"'"$RECEIPT_DIR"'"}'
+    else
+        echo "No receipt directory at $RECEIPT_DIR. Has the hook fired yet?" >&2
+    fi
+    exit 0
+fi
+
+# Cutoff: now - HOURS hours, as ISO 8601 UTC
+CUTOFF=$(python3 -c "
+import datetime
+cutoff = datetime.datetime.now(datetime.timezone.utc) - datetime.timedelta(hours=$HOURS)
+print(cutoff.strftime('%Y-%m-%dT%H:%M:%SZ'))
+" 2>/dev/null) || {
+    echo "python3 required for time calculation" >&2
+    exit 1
+}
+
+# Gather receipts. The hook writes one file per UTC date:
+# autonomy-blocked-YYYY-MM-DD.jsonl
+RECEIPTS=$(find "$RECEIPT_DIR" -maxdepth 1 -type f -name 'autonomy-blocked-*.jsonl' 2>/dev/null)
+if [[ -z "$RECEIPTS" ]]; then
+    if [[ "$FORMAT" = json ]]; then
+        echo '{"hours":'"$HOURS"',"blocked_count":0,"earliest":null,"latest":null}'
+    else
+        echo "No autonomy-block receipts found in $RECEIPT_DIR."
+        echo "Either no AskUserQuestion was blocked, or CC_AUTONOMY_MODE was never set."
+    fi
+    exit 0
+fi
+
+# Filter and summarise via python (stdlib only)
+echo "$RECEIPTS" | python3 -c "
+import sys
+import json
+import os
+
+cutoff = '$CUTOFF'
+hours = $HOURS
+fmt = '$FORMAT'
+
+files = [line.strip() for line in sys.stdin if line.strip()]
+records = []
+for path in files:
+    try:
+        with open(path, 'r', encoding='utf-8') as f:
+            for line in f:
+                line = line.strip()
+                if not line:
+                    continue
+                try:
+                    rec = json.loads(line)
+                except json.JSONDecodeError:
+                    continue
+                ts = rec.get('ts', '')
+                if ts and ts >= cutoff:
+                    records.append(rec)
+    except (IOError, OSError):
+        continue
+
+records.sort(key=lambda r: r.get('ts', ''))
+
+count = len(records)
+earliest = records[0].get('ts') if records else None
+latest = records[-1].get('ts') if records else None
+
+# Distribution of question lengths
+lengths = [r.get('question_length', 0) for r in records if r.get('question_length')]
+if lengths:
+    avg_len = sum(lengths) / len(lengths)
+    max_len = max(lengths)
+    min_len = min(lengths)
+else:
+    avg_len = max_len = min_len = 0
+
+if fmt == 'json':
+    out = {
+        'hours': hours,
+        'blocked_count': count,
+        'earliest': earliest,
+        'latest': latest,
+        'question_length_stats': {
+            'avg': round(avg_len, 1),
+            'max': max_len,
+            'min': min_len,
+        },
+    }
+    print(json.dumps(out))
+else:
+    print(f'AskUserQuestion blocks in the past {hours} hours: {count}')
+    if count > 0:
+        print(f'  Earliest: {earliest}')
+        print(f'  Latest:   {latest}')
+        print(f'  Question length stats (bytes): avg {avg_len:.1f}, min {min_len}, max {max_len}')
+        if count >= 10:
+            print('')
+            print('  10 or more blocks suggests the autonomy rule is colliding with')
+            print('  a genuine need for the model to ask. Consider whether some')
+            print('  question topics (e.g. \"destructive operation? y/N\") deserve')
+            print('  a narrower allowlist rather than a blanket block.')
+    else:
+        print('  (No blocks recorded. Either the hook was not configured, or the')
+        print('  model never tried to ask a question during the window.)')
+"