cc-safe-setup 29.7.0 → 30.0.4

package/examples/ai-slop-punctuation-arrest.sh

@@ -0,0 +1,210 @@
+#!/bin/bash
+# ai-slop-punctuation-arrest.sh — Refuse Write/Edit to public-text files
+# that contain AI-slop punctuation patterns the operator has chosen to
+# exclude — em-dash (—) and the double-hyphen substitute the model often
+# emits when prose-instructed to "stop using em dashes".
+#
+# Background: the punctuation patterns that read as machine-authored prose
+# are recognised widely enough that they function as a heuristic-trust
+# signal against the artefact's writer (operator credibility cost), even
+# when the content itself is honest and substantive. The most-cited
+# offenders are em-dash (—) and its close substitute the double-hyphen
+# (` -- ` in prose context).
+#
+# The active failure mode this hook addresses is the *substitution-by-
+# default* variant of recognition-without-arrest (@suwayama's second
+# comment on #60226): the operator says "stop using em-dashes", the model
+# acknowledges the rule at the recognition layer, and emits double-hyphens
+# in lieu — a near-substitute that satisfies the literal rule and violates
+# the operator's intent. This is the punctuation-surface instance of the
+# substitution mechanism @suwayama named on the Spotify-playlist case.
+#
+# This hook is not opinionated about whether you should ban em-dashes. It
+# is opinionated that *if* you choose to ban them, the ban must hold under
+# the model's tendency to substitute — the runtime gate must catch both
+# the original and the near-substitute.
+#
+# Background from the customer pain side: this hook was prompted by a
+# 2026-05-20 r/ClaudeAI thread ("I told Claude to stop using em dashes. It
+# happily obliged...") in which the operator reported the substitution
+# failure ("Now Claude is using double hyphens in lieu of em dashes") and
+# explicitly asked for runtime defences.
+#
+# Related Reports:
+#   #60226 (@suwayama) — recognition-without-arrest framework, and
+#                        substitution-by-default variant in the second
+#                        comment of that thread
+#   #60506 (@zean89)   — six-day drift across artefact emissions
+#
+# TRIGGER: PreToolUse
+# MATCHER: Write|Edit
+#
+# HOW IT WORKS:
+#   1. Reads PreToolUse input via stdin.
+#   2. For Write/Edit, matches the target path against the configured
+#      file-type filter (default: markdown, .md, .mdx, .markdown).
+#   3. Scans the artefact content for em-dash (—) and the double-hyphen
+#      substitute in prose context (space-dash-dash-space).
+#   4. Skips code-block content (between fenced ``` blocks) and inline
+#      code (between ` `), so command-line flags and code samples inside
+#      a markdown file do not false-positive.
+#   5. If any banned pattern survives the skip, exits 2 with a stderr
+#      reminder naming the matched pattern and the substitution-by-default
+#      mechanism. A content-hash cache (default 600s) lets a re-emission
+#      pass through if the agent stands by the artefact deliberately.
+#
+# CONFIGURATION (environment variables):
+#   CC_AI_SLOP_DISABLE              set to "1" to disable the gate
+#   CC_AI_SLOP_STATE_DIR            default /tmp/cc-ai-slop-cache
+#   CC_AI_SLOP_CACHE_TTL_SECONDS    default 600 — same-hash re-emit window
+#   CC_AI_SLOP_FILE_PATTERNS        default built-in — regex of file paths
+#                                                       to gate (case-insensitive)
+#   CC_AI_SLOP_PUNCT_PATTERNS       default built-in — pipe-separated
+#                                                       extended-regex patterns
+#                                                       of banned punctuation
+#
+# USAGE (settings.json):
+#   {
+#     "hooks": {
+#       "PreToolUse": [{
+#         "matcher": "Write|Edit",
+#         "hooks": [{
+#           "type": "command",
+#           "command": "~/.claude/hooks/ai-slop-punctuation-arrest.sh"
+#         }]
+#       }]
+#     }
+#   }
+
+set -uo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-ai-slop-punctuation-arrest-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [ai-slop-punctuation-arrest]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_AI_SLOP_DISABLE:-0}" = "1" ] && exit 0
+
+# OPT-IN: this gate BLOCKS Write/Edit to markdown containing em-dash or "--",
+# which are legitimate punctuation in normal prose (English and Japanese), so a
+# default-on block would arrest ordinary documentation writing. Off unless
+# explicitly enabled. Set CC_AI_SLOP_ENABLE=1 to turn it on.
+[ "${CC_AI_SLOP_ENABLE:-0}" = "1" ] || exit 0
+
+INPUT=$(cat 2>/dev/null || true)
+[ -z "$INPUT" ] && exit 0
+
+STATE_DIR="${CC_AI_SLOP_STATE_DIR:-/tmp/cc-ai-slop-cache}"
+CACHE_TTL="${CC_AI_SLOP_CACHE_TTL_SECONDS:-600}"
+
+# Default file filter: markdown variants
+DEFAULT_FILES='\.(md|mdx|markdown|mkd|txt)$'
+FILE_PATTERNS="${CC_AI_SLOP_FILE_PATTERNS:-$DEFAULT_FILES}"
+
+# Default punctuation patterns:
+#   em-dash:   the literal character —
+#   double-hyphen substitute: space, dash, dash, space (in prose context)
+#                            or word-dash-dash-word (attached substitute)
+DEFAULT_PUNCT='—| -- |[[:alnum:]]--[[:alnum:]]'
+PUNCT_PATTERNS="${CC_AI_SLOP_PUNCT_PATTERNS:-$DEFAULT_PUNCT}"
+
+mkdir -p "$STATE_DIR" 2>/dev/null || true
+
+TOOL_NAME=$(printf '%s' "$INPUT" | jq -r '.tool_name // .tool // empty' 2>/dev/null)
+[ -z "$TOOL_NAME" ] && exit 0
+
+case "$TOOL_NAME" in
+    Write|Edit) ;;
+    *) exit 0 ;;
+esac
+
+FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+[ -z "$FILE_PATH" ] && exit 0
+
+# File-type filter
+printf '%s' "$FILE_PATH" | grep -Eiq "$FILE_PATTERNS" || exit 0
+
+# Extract the content (Write) or new_string (Edit)
+ARTEFACT_BODY=""
+if [ "$TOOL_NAME" = "Write" ]; then
+    ARTEFACT_BODY=$(printf '%s' "$INPUT" | jq -r '.tool_input.content // empty' 2>/dev/null)
+else
+    ARTEFACT_BODY=$(printf '%s' "$INPUT" | jq -r '.tool_input.new_string // empty' 2>/dev/null)
+fi
+[ -z "$ARTEFACT_BODY" ] && exit 0
+
+# Strip code blocks (```…```) and inline code (`…`) so command-line flags
+# and code samples in the document do not false-positive.
+BODY_FOR_SCAN=$(printf '%s' "$ARTEFACT_BODY" \
+    | awk 'BEGIN{in_fence=0} /^```/{in_fence=!in_fence; next} !in_fence{print}' \
+    | sed 's|`[^`]*`||g')
+
+# Does the surviving prose carry a banned punctuation pattern?
+if ! printf '%s' "$BODY_FOR_SCAN" | grep -Eq "$PUNCT_PATTERNS"; then
+    exit 0
+fi
+
+# Hash dedup: if the same content was just re-emitted, the agent has
+# considered the gate and stands by the artefact — let it pass.
+HASH=$(printf '%s' "$ARTEFACT_BODY" | sha256sum 2>/dev/null | awk '{print $1}')
+[ -z "$HASH" ] && exit 0
+
+CACHE_FILE="$STATE_DIR/$HASH"
+NOW=$(date +%s)
+if [ -f "$CACHE_FILE" ]; then
+    CACHED_AT=$(cat "$CACHE_FILE" 2>/dev/null || echo 0)
+    AGE=$((NOW - CACHED_AT))
+    if [ "$AGE" -lt "$CACHE_TTL" ]; then
+        exit 0
+    fi
+fi
+echo "$NOW" > "$CACHE_FILE"
+find "$STATE_DIR" -type f -mmin +1440 -delete 2>/dev/null || true
+
+# Surface the first matched pattern for the reminder
+MATCHED=$(printf '%s' "$BODY_FOR_SCAN" | grep -Eo "$PUNCT_PATTERNS" | head -1)
+
+cat >&2 <<EOF
+<system-reminder>
+AI-SLOP PUNCTUATION DETECTED in $FILE_PATH — pattern matched: "$MATCHED"
+
+This gate exists because banning em-dash (—) at the prose layer alone
+fails under the substitution-by-default mechanism (@suwayama, #60226):
+when the operator says "stop using em-dashes", the model often acknowledges
+at the recognition layer and emits the near-substitute (double-hyphen,
+" -- ") that satisfies the literal rule and violates the intent.
+
+Both the original and the near-substitute are gated here.
+
+To resolve:
+
+  1. Replace em-dash (—) with a natural punctuation mark for the language
+     and register: colon, comma, period, or semicolon depending on the
+     pause and the syntactic role the dash was carrying.
+
+  2. Replace double-hyphen substitutes (" -- " in prose) with the same
+     natural punctuation. If a double-hyphen is appearing as a
+     command-line flag inside a code block (\`--flag\`) or fenced code,
+     wrap it as code — the gate's body scan strips code blocks and inline
+     code before matching, so a properly-fenced flag will not trigger.
+
+  3. If the punctuation is intentional (technical document quoting
+     legitimate uses, retrospective analysis, etc.), re-emit the same
+     content within ${CACHE_TTL}s and the hash-match will let it through
+     once, or set CC_AI_SLOP_DISABLE=1 for the session.
+
+To narrow the scope (e.g. only flag em-dash and not double-hyphens), set
+CC_AI_SLOP_PUNCT_PATTERNS to a custom regex.
+To narrow the file types (e.g. only README and CHANGELOG), set
+CC_AI_SLOP_FILE_PATTERNS to a custom regex.
+</system-reminder>
+EOF
+
+exit 2

package/examples/allowlist.sh

@@ -9,6 +9,16 @@
 # Use case: Highly sensitive environments where you want to
 # enumerate exactly what Claude Code can do.
 #
+# Known limits — read these before trusting it as your only layer:
+#   * Redirection is not inspected. An approved command word can still write
+#     anywhere ("echo evil > ~/.bashrc"). Enumerating safe write targets is a
+#     different job than enumerating command names; pair this with a hook that
+#     judges the destination.
+#   * Approval is per command name, not per argument. "git commit" is approved
+#     regardless of its flags.
+#   * Patterns are yours to own. Everything not listed is blocked, so an
+#     incomplete list fails closed (annoying) rather than open (dangerous).
+#
 # Born from GitHub Issue #37471 (Immutable session manifest)
 #
 # Usage: Add to settings.json as a PreToolUse hook
@@ -22,7 +32,26 @@
 #   }
 # }
 #
-# TRIGGER: PermissionRequest  MATCHER: ""
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+#
+# This line used to say PermissionRequest, contradicting the settings.json
+# example above. PreToolUse is the correct one: the reference states it fires
+# "Before a tool call executes", while PermissionRequest fires only "When a
+# tool call needs a permission decision" — which never happens under auto mode
+# or bypassed permissions. A guard registered on PermissionRequest would sit
+# silent in exactly the sessions that need it most.
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-allowlist-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [allowlist]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
 
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
@@ -53,14 +82,45 @@ ALLOWED=(
     "^\s*(cd|mkdir|touch)"
 )
 
-for pattern in "${ALLOWED[@]}"; do
-    if echo "$COMMAND" | grep -qE "$pattern"; then
-        exit 0  # Approved
+# A single line can chain several commands. Every pattern above is anchored with
+# "^", so matching them against the whole string only ever inspects the first
+# word: "echo hi && rm -rf /" matched "^\s*echo" and was approved. For a hook
+# whose stated purpose is to enumerate exactly what Claude Code may do, that is
+# not a gap — it is the allowlist enforcing nothing past the first segment.
+# Claude Code closed the same class of hole in its own permission checking
+# (2.1.216, "Fixed Bash permission checking for compound statements").
+#
+# So: split on the operators that begin a new command, and require EVERY segment
+# to be approved. One unapproved segment blocks the line.
+SEGMENTS=$(printf '%s' "$COMMAND" | sed -E 's/(\|\||&&|[;|&])/\n/g')
+
+# Command substitution executes text that never shows up as a segment, so no
+# amount of splitting can vet it. Refuse instead of guessing.
+if printf '%s' "$COMMAND" | grep -qE '\$\(|`'; then
+    echo "BLOCKED: command substitution is not allowed by the allowlist" >&2
+    echo "Command: $COMMAND" >&2
+    exit 2
+fi
+
+while IFS= read -r SEGMENT; do
+    # sed leaves an empty field where a two-character operator was split
+    [[ -z "${SEGMENT//[[:space:]]/}" ]] && continue
+
+    APPROVED=0
+    for pattern in "${ALLOWED[@]}"; do
+        if printf '%s' "$SEGMENT" | grep -qE "$pattern"; then
+            APPROVED=1
+            break
+        fi
+    done
+
+    if [[ $APPROVED -eq 0 ]]; then
+        echo "BLOCKED: Command not in allowlist" >&2
+        echo "Command: $COMMAND" >&2
+        echo "Unapproved segment: $SEGMENT" >&2
+        echo "To approve, add a pattern to ~/.claude/hooks/allowlist.sh" >&2
+        exit 2
     fi
-done
+done <<< "$SEGMENTS"
 
-# Not in allowlist — block
-echo "BLOCKED: Command not in allowlist" >&2
-echo "Command: $COMMAND" >&2
-echo "To approve, add a pattern to ~/.claude/hooks/allowlist.sh" >&2
-exit 2
+exit 0

package/examples/always-allow-pattern-suggester.sh

@@ -0,0 +1,125 @@
+#!/bin/bash
+# always-allow-pattern-suggester.sh — Suggest wildcard patterns instead of verbatim "Always Allow" rules
+#
+# Solves: Cluster 6 Axis 2 — "Always Allow" saves the verbatim command string
+#         (commit message, exact filename, exact URL) instead of a wildcard
+#         pattern. Over a working week, settings.local.json accumulates
+#         hundreds of one-off dead rules while wildcard patterns the user
+#         originally configured sit unused.
+#
+# Issues addressed: #6850 (45 reactions), #11380 (64 reactions, closed
+#         without fix), #29187 (regression, no staff response), and the
+#         meta-issue #30519 Axis 2 articulation.
+#
+# How it works: PreToolUse hook on Bash. When a command would trigger a
+#   permission prompt, the hook computes the canonical wildcard pattern
+#   the operator probably wants (e.g., Bash(git commit:*) for
+#   `git commit -m "fix typo"`) and emits it as a stderr advisory.
+#   Operator pastes the suggestion into settings.local.json once,
+#   never sees the prompt for that command family again.
+#
+#   This hook NEVER blocks. It always exits 0. It is a wrapper around
+#   the "Always Allow" UX, not a replacement.
+#
+# Existing-pattern check: reads ~/.claude/settings.json,
+#   ~/.claude/settings.local.json, ./.claude/settings.json, and
+#   ./.claude/settings.local.json. If the suggested pattern is already
+#   in permissions.allow in any of them, no advisory is emitted
+#   (the rule exists; the prompt is happening for a different reason).
+#
+# Environment variables:
+#   CC_PATTERN_SUGGESTER_DISABLE=1 — disable the advisory entirely
+#   CC_PATTERN_SUGGESTER_VERBOSE=1 — also print the canonical pattern
+#                                    breakdown (binary + first arg)
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+
+set -uo pipefail
+
+INPUT=$(cat)
+
+# Fail-open on missing input or jq parse errors.
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+# Allow operator to disable without removing the hook.
+[ "${CC_PATTERN_SUGGESTER_DISABLE:-0}" = "1" ] && exit 0
+
+# Extract the leading binary + first non-flag argument.
+# Strip leading shell-prefix patterns (one or more env var assignments).
+WORK_CMD="$COMMAND"
+while printf '%s' "$WORK_CMD" | grep -qE '^\s*[A-Z_][A-Z0-9_]*=[^ ]+\s+'; do
+    WORK_CMD=$(printf '%s' "$WORK_CMD" | sed -E 's/^\s*[A-Z_][A-Z0-9_]*=[^ ]+\s+//')
+done
+WORK_CMD=$(printf '%s' "$WORK_CMD" | sed -E 's/^\s+//')
+
+# Split on shell-compound separators and take the FIRST simple command.
+# (The operator may chain commands; the prompt fires on a specific tool
+# match, but we only need to suggest a pattern for the leading verb.)
+FIRST_SEG=$(printf '%s' "$WORK_CMD" | awk -F'[|&;]' '{print $1}' | sed -E 's/^\s+//; s/\s+$//')
+
+# Tokenize the first segment by whitespace.
+read -r BIN ARG1 _ <<< "$FIRST_SEG"
+
+# Need at least a binary to suggest anything.
+[ -z "${BIN:-}" ] && exit 0
+
+# Strip path prefix from binary (e.g., /usr/bin/git → git).
+BIN_BASE=$(basename "$BIN")
+
+# Skip binaries that don't take subcommands or where wildcards
+# wouldn't help (single-purpose tools).
+case "$BIN_BASE" in
+    ls|pwd|whoami|hostname|date|uname|true|false|echo|printf|cat|head|tail|wc|sort|uniq|tr|cut|awk|sed|grep|find|xargs|tee|sleep|test|[)
+        # These are typically already covered by Bash(<bin>:*) wildcards;
+        # if the operator already allowed them, no advisory needed.
+        ;;
+esac
+
+# Determine if the first argument looks like a subcommand vs a flag/value.
+# Subcommand: starts with a letter, no leading dash, no special chars.
+PATTERN_BODY="$BIN_BASE"
+IS_SUBCOMMAND=0
+if [ -n "${ARG1:-}" ] && printf '%s' "$ARG1" | grep -qE '^[a-zA-Z][a-zA-Z0-9_-]*$'; then
+    IS_SUBCOMMAND=1
+    PATTERN_BODY="$BIN_BASE $ARG1"
+fi
+
+SUGGESTED="Bash($PATTERN_BODY:*)"
+
+# Check if the pattern already exists in any settings file.
+EXISTING=0
+for CFG in \
+    "${HOME}/.claude/settings.json" \
+    "${HOME}/.claude/settings.local.json" \
+    "./.claude/settings.json" \
+    "./.claude/settings.local.json"; do
+    [ -f "$CFG" ] || continue
+    if jq -e --arg p "$SUGGESTED" '.permissions.allow // [] | any(. == $p)' "$CFG" >/dev/null 2>&1; then
+        EXISTING=1
+        break
+    fi
+done
+
+# If pattern already exists, emit nothing; the prompt is for a different
+# reason (compound bash, quote-tracking warning, etc.).
+[ "$EXISTING" = "1" ] && exit 0
+
+# Build the advisory.
+{
+    echo "[always-allow-pattern-suggester] If this command triggers a permission prompt,"
+    echo "you can avoid future prompts for the same command family by adding this pattern"
+    echo "to permissions.allow in .claude/settings.local.json:"
+    echo ""
+    echo "    \"$SUGGESTED\""
+    echo ""
+    echo "This is broader than the verbatim string \"Always Allow\" would save."
+    if [ "${CC_PATTERN_SUGGESTER_VERBOSE:-0}" = "1" ]; then
+        echo ""
+        echo "(suggester breakdown: binary=$BIN_BASE; first_arg_is_subcommand=$IS_SUBCOMMAND)"
+    fi
+} >&2
+
+# Always exit 0 — this hook never blocks.
+exit 0

package/examples/ansible-vault-guard.sh

@@ -1,5 +1,6 @@
+#!/bin/bash
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0

package/examples/anthropic-base-url-guard.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+# anthropic-base-url-guard.sh — Block execution when ANTHROPIC_BASE_URL is suspicious
+#
+# Solves: #51123 — Setting ANTHROPIC_BASE_URL to a local proxy bypasses
+#         allowManagedHooksOnly enforcement. This hook detects when the
+#         URL points to non-standard endpoints and warns/blocks.
+#
+# WHY THIS MATTERS:
+#   Enterprise admins set allowManagedHooksOnly: true to restrict hooks.
+#   A developer can set ANTHROPIC_BASE_URL=http://localhost:4010 and
+#   bypass ALL managed hook restrictions. This hook is the defense layer.
+#
+# TRIGGER: PreToolUse  MATCHER: ""
+#
+# CONFIGURATION:
+#   CC_ALLOWED_BASE_URLS — comma-separated allowlist (default: api.anthropic.com)
+#   CC_BASE_URL_ACTION — "warn" or "block" (default: warn)
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-anthropic-base-url-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [anthropic-base-url-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+
+# Default allowlist: only official Anthropic API
+ALLOWED="${CC_ALLOWED_BASE_URLS:-https://api.anthropic.com}"
+ACTION="${CC_BASE_URL_ACTION:-warn}"
+
+# Get current ANTHROPIC_BASE_URL
+CURRENT_URL="${ANTHROPIC_BASE_URL:-https://api.anthropic.com}"
+
+# Check if URL is in allowlist
+is_allowed() {
+  local url="$1"
+  IFS=',' read -ra URLS <<< "$ALLOWED"
+  for allowed_url in "${URLS[@]}"; do
+    # Trim whitespace
+    allowed_url=$(echo "$allowed_url" | xargs)
+    if [[ "$url" == "$allowed_url"* ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# If URL is default/allowed, pass through silently
+if is_allowed "$CURRENT_URL"; then
+  exit 0
+fi
+
+# URL is non-standard — take action
+TOOL=$(echo "$INPUT" | jq -r '.tool_name // "unknown"' 2>/dev/null)
+TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
+
+# Log the event
+LOG_FILE="${CC_BASE_URL_LOG:-/tmp/cc-base-url-violations.log}"
+echo "[$TIMESTAMP] ANTHROPIC_BASE_URL=$CURRENT_URL tool=$TOOL action=$ACTION" >> "$LOG_FILE"
+
+if [[ "$ACTION" == "block" ]]; then
+  echo '{"decision":"block","reason":"ANTHROPIC_BASE_URL points to non-standard endpoint ('"$CURRENT_URL"'). This may bypass managed hook restrictions. Set CC_ALLOWED_BASE_URLS to allowlist this endpoint."}' >&2
+  exit 2
+else
+  # Warn but allow
+  echo "⚠️  WARNING: ANTHROPIC_BASE_URL=$CURRENT_URL (non-standard)" >&2
+  echo "   This may bypass allowManagedHooksOnly restrictions (#51123)" >&2
+  echo "   Set CC_BASE_URL_ACTION=block to enforce, or CC_ALLOWED_BASE_URLS to allowlist" >&2
+  exit 0
+fi

package/examples/api-busyloop-guard.sh

@@ -0,0 +1,123 @@
+#!/bin/bash
+# api-busyloop-guard.sh — Stop a single Bash command that busy-polls a
+#                         rate-limited API in an unbounded loop with no delay
+#
+# Solves: When asked to "wait for the CI run", the model reaches for a generic
+# shell poll instead of the purpose-built command, e.g.
+#
+#     until gh run view <run-id> 2>&1 | grep -q "completed"; do true; done
+#
+# `do true; done` spins as fast as the shell allows, calling `gh` (the GitHub
+# REST API) hundreds of times a minute. In #65985 this drained the 5,000 req/h
+# limit to 0/5000 within minutes and blocked every gh command for the rest of
+# the hour. Worse, the loops were started in the background and kept running
+# silently after the session moved on — nothing cleaned them up. The same shape
+# hammers any rate-limited CLI (curl/wget/aws/gcloud/kubectl) the same way.
+#
+# Existing hooks miss this exact shape:
+#   - loop-detector.sh keys on the *same command* repeating across separate tool
+#     calls. Here the loop lives *inside one* Bash command, so the hook sees it
+#     only once and never trips.
+#   - api-rate-limit-guard.sh / api-rate-limit-tracker.sh only match curl/wget/
+#     http and likewise count *separate* tool calls — an internal shell loop is
+#     a single call to them, and `gh` is not even in their match set.
+#   - unbounded-output-guard.sh stops infinite *output* generators (yes, cat
+#     /dev/zero), not API busy-loops.
+#   - webfetch-runaway-guard.sh counts the WebFetch *tool*, not Bash loops.
+#
+# Why two precision levels (so legitimate loops are not blocked):
+#   block (default) fires ONLY on the unambiguous busy-wait signature — an
+#     unbounded while/until/for((;;)) loop whose body is a no-op (true / : /
+#     continue / sleep 0) that calls a rate-limited CLI with no real sleep.
+#     A no-op-body poll has essentially no legitimate use: a real wait always
+#     sleeps. This is exactly the #65985 incident.
+#   warn (stderr, non-blocking) fires on the broader shape — any unbounded
+#     while/until/for((;;)) loop calling such a CLI with no sleep — because a
+#     counter-bounded loop can look the same to a pattern match and we would
+#     rather nudge than wrongly block it.
+#   Bounded loops are left completely alone: `for x in <list>` and `while read`
+#     (stream/file consumption) terminate on their own, and any loop that
+#     already sleeps or already uses `gh run watch` is the correct form.
+#
+# The right fix, surfaced in the message:
+#   - For GitHub Actions: `gh run watch <run-id> --exit-status` streams status,
+#     exits on completion/failure/cancel, and makes efficient API use — no loop.
+#   - For any poll: put a `sleep N` in the body plus a terminal-state or
+#     max-iteration exit so it cannot spin forever or linger in the background.
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+# Config (all optional):
+#   CC_API_BUSYLOOP_GUARD=block   block | warn | off   (default: block)
+# Related: https://github.com/anthropics/claude-code/issues/65985
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-api-busyloop-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [api-busyloop-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+
+MODE="${CC_API_BUSYLOOP_GUARD:-block}"
+[ "$MODE" = "off" ] && exit 0
+
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+# 1. An unbounded loop construct: while / until (condition loops = the classic
+#    poll) or a C-style for ((...)). `for x in <list>` is bounded, so excluded.
+echo "$COMMAND" | grep -qE '(^|[^[:alnum:]_])(while|until)([^[:alnum:]_]|$)' \
+  || echo "$COMMAND" | grep -qE 'for[[:space:]]*\(\(' \
+  || exit 0
+
+# 2. Bounded stream/file consumption (`while read ... done < file`) terminates
+#    at EOF — not a poll. Leave it alone.
+echo "$COMMAND" | grep -qE '(while|until)[^;]*\bread\b' && exit 0
+
+# 3. A rate-limited network CLI somewhere in the command.
+echo "$COMMAND" | grep -qE '(^|[^[:alnum:]_./-])(gh|curl|wget|aws|gcloud|kubectl)[[:space:]]' || exit 0
+
+# 4. Already throttled? A positive sleep, or the purpose-built gh run watch,
+#    means this is the correct form — allow it.
+echo "$COMMAND" | grep -qE '\bsleep[[:space:]]+([1-9][0-9]*|[0-9]*\.[0-9]*[1-9])' && exit 0
+echo "$COMMAND" | grep -qE '\bgh[[:space:]]+run[[:space:]]+watch\b' && exit 0
+
+# Tailor the fix hint to the CLI in play.
+if echo "$COMMAND" | grep -qE '(^|[^[:alnum:]_./-])gh[[:space:]]'; then
+    FIX="Use 'gh run watch <run-id> --exit-status': it streams status, exits automatically on completion/failure/cancel, and makes one efficient call instead of a busy poll. GitHub's REST limit is 5,000 req/h and a no-delay loop can drain it to 0 in minutes (#65985)."
+else
+    FIX="Add a 'sleep N' inside the loop body and a terminal-state or max-iteration exit, or use the tool's own blocking/wait subcommand. A no-delay loop hammers the API's rate limit and, if backgrounded, keeps running unnoticed (#65985)."
+fi
+
+# The unambiguous busy-wait signatures, either of which has essentially no
+# legitimate no-sleep form:
+#   (a) a no-op / empty loop body (true / : / continue / sleep 0), or
+#   (b) an explicitly infinite loop (while true | while : | until false |
+#       for ((;;))), which never terminates on its own.
+# A counter- or condition-bounded loop (e.g. `while [ $n -lt 5 ]`) matches
+# neither and only warns.
+BUSY=0
+if echo "$COMMAND" | grep -qE 'do[[:space:]]+(true|:|continue|sleep[[:space:]]+0)[[:space:]]*;?[[:space:]]*done' \
+   || echo "$COMMAND" | grep -qE 'do[[:space:]]*;[[:space:]]*done' \
+   || echo "$COMMAND" | grep -qE 'while[[:space:]]+(true|:)([^[:alnum:]_]|$)' \
+   || echo "$COMMAND" | grep -qE 'until[[:space:]]+false([^[:alnum:]_]|$)' \
+   || echo "$COMMAND" | grep -qE 'for[[:space:]]*\(\([[:space:]]*;[[:space:]]*;[[:space:]]*\)\)'; then
+    BUSY=1
+fi
+
+MSG="This command busy-polls a rate-limited API in an unbounded loop with no delay. $FIX Set CC_API_BUSYLOOP_GUARD=warn to only warn, or =off to disable."
+
+if [ "$MODE" = "block" ] && [ "$BUSY" -eq 1 ]; then
+    echo "api-busyloop-guard: $MSG" >&2
+    exit 2
+fi
+
+# Broader shape, or warn mode: nudge without blocking.
+echo "api-busyloop-guard: $MSG" >&2
+exit 0

package/examples/api-endpoint-guard.sh

@@ -10,6 +10,18 @@
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-api-endpoint-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [api-endpoint-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0