cc-safe-setup 29.8.0 → 30.0.4

package/examples/background-task-guard.sh

@@ -15,6 +15,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-background-task-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [background-task-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0

package/examples/banned-command-guard.sh

@@ -21,6 +21,18 @@
 #   CC_BANNED_COMMANDS — colon-separated list of regex patterns to block
 #   Default: "sed -i:awk -i inplace:perl -pi:perl .*-i"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-banned-command-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [banned-command-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/bash-allowlist-secondary-check.sh

@@ -0,0 +1,157 @@
+#!/bin/bash
+# ================================================================
+# bash-allowlist-secondary-check.sh — Re-check Bash commands against
+#                                     the user's settings.json allowlist
+# ================================================================
+# PURPOSE:
+#   When the Bash tool fires, this hook independently parses the
+#   allowlist from `.claude/settings.json` (and global
+#   `~/.claude/settings.json`) and verifies the command matches an
+#   allowed pattern. If no pattern matches, it warns to stderr (or
+#   blocks in strict mode) — providing a second line of defence
+#   against authorization-layer bypasses.
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+#
+# WHY THIS MATTERS:
+#   Issue #56117 reported that during a session running a Skill,
+#   `Bash` tool calls for commands NOT present in the settings.json
+#   allowlist (e.g. `git add`, `git commit`, `git push`) executed
+#   without triggering the authorization prompt. The user was never
+#   asked to approve. The allowlist contained only `git diff`, `git
+#   log`, `git status`, no `Bash(*)` broad rule, and
+#   `--dangerously-skip-permissions` was not used.
+#
+#   This is an authorization-layer bypass: the tool that should have
+#   enforced the allowlist failed to do so silently. Skills, custom
+#   agents, or other inner contexts may continue to expose similar
+#   bypasses.
+#
+#   This hook re-evaluates the allowlist independently of Claude
+#   Code's internal logic. It does not replace the primary check —
+#   it backs it up.
+#
+# WHAT IT CHECKS:
+#   1. Reads `permissions.allow` from `.claude/settings.json` (project)
+#      and `~/.claude/settings.json` (user). Local settings
+#      (`.claude/settings.local.json`) are also merged.
+#   2. Extracts Bash patterns of the form `Bash(<pattern>)`.
+#   3. Tests the Bash command against each pattern using a simple
+#      matcher: exact match, prefix match for patterns ending in `:*`,
+#      and wildcard for `Bash(*)`.
+#   4. If no pattern matches, emits a warning that names the command
+#      and references #56117.
+#
+# OUTPUT:
+#   Warning to stderr when the command does not match any allowlist
+#   pattern. Default: exit 0 (advisory). Strict mode: exit 2 (block).
+#
+# CONFIGURATION:
+#   CC_BASH_ALLOWLIST_STRICT — set to "1" to block when no pattern
+#       matches (default: warn only)
+#   CC_BASH_ALLOWLIST_QUIET — set to "1" to silence warnings (still
+#       blocks in strict mode)
+#
+# LIMITATIONS:
+#   - The matcher is intentionally simple. It does not perfectly
+#     replicate Claude Code's internal matching, which uses richer
+#     glob semantics. Some allowlist entries may produce false
+#     warnings; tune patterns or use strict mode selectively.
+#   - The hook reads JSON via `jq`. If `jq` is missing, the hook
+#     exits 0 silently rather than failing the Bash call.
+#   - This hook does not record approvals. Repeated commands matching
+#     the same gap will repeat the warning.
+#
+# RELATED ISSUES:
+#   https://github.com/anthropics/claude-code/issues/56117
+# ================================================================
+
+set -u
+
+INPUT=$(cat)
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+# No command, nothing to check.
+[ -z "$COMMAND" ] && exit 0
+
+# jq is required to read settings; fall through silently if missing.
+command -v jq >/dev/null 2>&1 || exit 0
+
+STRICT="${CC_BASH_ALLOWLIST_STRICT:-0}"
+QUIET="${CC_BASH_ALLOWLIST_QUIET:-0}"
+
+# Collect allow patterns from up to three settings files.
+collect_allow_patterns() {
+    local f
+    for f in \
+        "$HOME/.claude/settings.json" \
+        ".claude/settings.json" \
+        ".claude/settings.local.json"
+    do
+        [ -r "$f" ] || continue
+        jq -r '.permissions.allow // [] | .[]' "$f" 2>/dev/null
+    done
+}
+
+PATTERNS=$(collect_allow_patterns)
+
+# Extract only Bash() patterns. Other tools are out of scope.
+BASH_PATTERNS=$(printf '%s\n' "$PATTERNS" | grep -E '^Bash\(' | sed -E 's/^Bash\((.*)\)$/\1/')
+
+# Strip outer whitespace from the command for matching purposes.
+TRIMMED_CMD=$(printf '%s' "$COMMAND" | sed -E 's/^[[:space:]]+//;s/[[:space:]]+$//')
+
+# A Bash(*) pattern allows everything — matches and exits.
+if printf '%s\n' "$BASH_PATTERNS" | grep -qx '\*'; then
+    exit 0
+fi
+
+# Try to match the command against any pattern.
+matched=0
+while IFS= read -r pat; do
+    [ -z "$pat" ] && continue
+    case "$pat" in
+        *":*")
+            # Prefix match: pattern is "<prefix>:*" — match if the command starts with <prefix>.
+            prefix="${pat%:\*}"
+            case "$TRIMMED_CMD" in
+                "$prefix"|"$prefix "*|"$prefix"$'\t'*)
+                    matched=1
+                    break
+                    ;;
+            esac
+            ;;
+        *)
+            # Exact-or-prefix-with-space: pattern matches if the command is exactly the
+            # pattern, or the pattern is the leading token followed by a space/tab.
+            case "$TRIMMED_CMD" in
+                "$pat"|"$pat "*|"$pat"$'\t'*)
+                    matched=1
+                    break
+                    ;;
+            esac
+            ;;
+    esac
+done <<< "$BASH_PATTERNS"
+
+if [ "$matched" -eq 1 ]; then
+    exit 0
+fi
+
+# No match. Emit a warning unless quiet, and block in strict mode.
+if [ "$QUIET" != "1" ]; then
+    SHORT_CMD=$(printf '%s' "$TRIMMED_CMD" | head -c 120)
+    printf '⚠️  Bash command not matched by any settings.json allow pattern (Issue #56117 defence-in-depth):\n' >&2
+    printf '    command: %s\n' "$SHORT_CMD" >&2
+    printf '    note:    Claude Code should have prompted before running this. If it did not, the\n' >&2
+    printf '             primary allowlist check may have been bypassed (e.g. inside a Skill).\n' >&2
+    printf '    action:  Add an explicit allow rule, deny the run, or set CC_BASH_ALLOWLIST_STRICT=1 to block.\n' >&2
+    printf '    issue:   https://github.com/anthropics/claude-code/issues/56117\n' >&2
+fi
+
+if [ "$STRICT" = "1" ]; then
+    exit 2
+fi
+
+exit 0

package/examples/bash-domain-allowlist.sh

@@ -24,6 +24,18 @@
 # Configuration: Set CC_ALLOWED_DOMAINS env var (comma-separated)
 #   or edit the ALLOWED_DOMAINS array below.
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-bash-domain-allowlist-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [bash-domain-allowlist]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0

package/examples/bash-fanout-bounded-rewriter.sh

@@ -0,0 +1,191 @@
+#!/bin/bash
+# ================================================================
+# bash-fanout-bounded-rewriter.sh — Detect and refuse unbounded
+# bash fan-out patterns that can spawn thousands of subprocesses
+# ================================================================
+# PURPOSE:
+#   Issue #62193 documented a 3,079-bash-in-17-seconds spawn event
+#   from a single Bash tool call, leading to an OS-level lockup
+#   (1.4 TB VSZ on parent, contiguous PIDs 21300-24379, OOM killer
+#   hitting `code` first). The pattern: a single Bash command that
+#   internally fans out (find ... -exec, unbounded loops, parallel
+#   without -j N, xargs without -P N) hands the kernel an
+#   uncapped concurrency demand.
+#
+#   The cleanest architectural answer is cgroup-based isolation
+#   (systemd-run --scope -p TasksMax=N). That works but renders
+#   bash useless under pressure because every command including
+#   light single-process ones hits the TasksMax ceiling.
+#
+#   This hook covers the gap: detect fan-out signatures in the
+#   bash command BEFORE the shell sees them. Refuse the call with
+#   a clear advisory naming the unbounded pattern and a bounded
+#   rewrite (xargs -P N -n 1, parallel -j N, GNU make -j N).
+#
+# WHO THIS PROTECTS:
+#   Operators running Claude Code on a workstation where a single
+#   uncapped fan-out can lock the OS. Especially relevant when
+#   running on Max-plan accounts where the model is more willing
+#   to generate aggressive parallelism.
+#
+# DETECTION:
+#   PreToolUse on Bash. Scan the command string for fan-out
+#   signatures in order of severity:
+#     1. find ... -exec (worst: shell-spawning per result)
+#     2. for ... in ... ; do (unbounded loop)
+#     3. while read ... ; do (unbounded loop)
+#     4. xargs without -P N -n N (single process per line)
+#     5. parallel without -j N (defaults to one-per-core)
+#     6. GNU make -j (without explicit N; defaults to infinite)
+#     7. seq N | while ... (high-N sequence to loop)
+#
+# OUTPUT:
+#   On detection, blocks the call (exit 2) with a stderr message
+#   that names the matched pattern and shows a bounded rewrite.
+#   The operator can override per-call by setting
+#   CC_BASH_FANOUT_OVERRIDE=1 (e.g., for legitimate parallelism)
+#   or globally with CC_BASH_FANOUT_DISABLE=1.
+#
+# CONFIGURATION:
+#   CC_BASH_FANOUT_DISABLE   — set to 1 to disable entirely
+#   CC_BASH_FANOUT_OVERRIDE  — set to 1 to allow this call once
+#                              (clear after the call to re-arm)
+#   CC_BASH_FANOUT_MAX_LOOP_LINES — refuse loops with more than
+#                              this many lines in the body
+#                              (default: refuse all unbounded)
+#   CC_BASH_FANOUT_PARALLEL_BOUND — default bounded N to suggest
+#                              in advisories (default: 8)
+#
+# RELATED ISSUES:
+#   https://github.com/anthropics/claude-code/issues/62193
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+# ================================================================
+
+set -u
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-bash-fanout-bounded-rewriter-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [bash-fanout-bounded-rewriter]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat 2>/dev/null || echo "{}")
+
+[ "${CC_BASH_FANOUT_DISABLE:-0}" = "1" ] && exit 0
+[ "${CC_BASH_FANOUT_OVERRIDE:-0}" = "1" ] && exit 0
+
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+BOUND="${CC_BASH_FANOUT_PARALLEL_BOUND:-8}"
+
+# Detection signatures, ordered most-severe-first
+MATCHED_PATTERN=""
+SUGGESTED_REWRITE=""
+
+# Pattern 1: find ... -exec
+if printf '%s' "$COMMAND" | grep -qE 'find +.*-exec +'; then
+    MATCHED_PATTERN="find ... -exec (shell-spawning per result, unbounded)"
+    SUGGESTED_REWRITE="find ... -print0 | xargs -0 -P $BOUND -n 1 <cmd>"
+fi
+
+# Pattern 2: for ... in ... ; do (only if the in-list is dynamic or large)
+# Static lists like 'for i in 1 2 3' are fine; the danger is
+# 'for f in $(...)', 'for f in *', or 'for f in $LIST'.
+if [ -z "$MATCHED_PATTERN" ]; then
+    if printf '%s' "$COMMAND" | grep -qE 'for +[A-Za-z_][A-Za-z0-9_]* +in +(\$\(|`|\*|\$[A-Za-z_])'; then
+        MATCHED_PATTERN="for ... in \$(...) / glob / \$VAR (unbounded loop body)"
+        SUGGESTED_REWRITE="<list-source> | xargs -P $BOUND -n 1 <cmd>"
+    fi
+fi
+
+# Pattern 3: while read ... ; do
+if [ -z "$MATCHED_PATTERN" ]; then
+    if printf '%s' "$COMMAND" | grep -qE 'while +(read|IFS=)'; then
+        MATCHED_PATTERN="while read ... (unbounded loop, one-process-per-line)"
+        SUGGESTED_REWRITE="<input> | xargs -P $BOUND -n 1 <cmd>"
+    fi
+fi
+
+# Pattern 4: xargs without -P
+if [ -z "$MATCHED_PATTERN" ]; then
+    if printf '%s' "$COMMAND" | grep -qE 'xargs +' && \
+       ! printf '%s' "$COMMAND" | grep -qE 'xargs +.*-P +[0-9]+'; then
+        MATCHED_PATTERN="xargs without -P N (defaults to single-process serial, OK; but if the upstream pipe is high-cardinality, refuse)"
+        # xargs without -P is actually safe (serial). Skip unless follows hi-card pipe.
+        # We don't actually block this — note for advisory only.
+        MATCHED_PATTERN=""  # Reset; serial xargs is fine.
+    fi
+fi
+
+# Pattern 5: parallel without -j
+if [ -z "$MATCHED_PATTERN" ]; then
+    if printf '%s' "$COMMAND" | grep -qE '(^| )parallel +' && \
+       ! printf '%s' "$COMMAND" | grep -qE 'parallel +.*-j +[0-9]+'; then
+        MATCHED_PATTERN="GNU parallel without -j N (defaults to one-per-core, can exceed cgroup TasksMax)"
+        SUGGESTED_REWRITE="parallel -j $BOUND <cmd>"
+    fi
+fi
+
+# Pattern 6: make -j without N
+if [ -z "$MATCHED_PATTERN" ]; then
+    if printf '%s' "$COMMAND" | grep -qE 'make +.*-j( |$)' && \
+       ! printf '%s' "$COMMAND" | grep -qE 'make +.*-j *[0-9]+'; then
+        MATCHED_PATTERN="make -j without N (defaults to infinite parallelism)"
+        SUGGESTED_REWRITE="make -j$BOUND <target>"
+    fi
+fi
+
+# Pattern 7: seq N | (where N > 100)
+if [ -z "$MATCHED_PATTERN" ]; then
+    SEQ_N=$(printf '%s' "$COMMAND" | grep -oE 'seq +[0-9]+' | head -1 | grep -oE '[0-9]+' || true)
+    if [ -n "$SEQ_N" ] && [ "$SEQ_N" -gt 100 ]; then
+        if printf '%s' "$COMMAND" | grep -qE 'seq +[0-9]+ *\| *(while|for|xargs)'; then
+            MATCHED_PATTERN="seq $SEQ_N piped to loop/xargs (high-cardinality fan-out)"
+            SUGGESTED_REWRITE="seq $SEQ_N | xargs -P $BOUND -n 1 <cmd>"
+        fi
+    fi
+fi
+
+# Nothing matched — pass through silently.
+[ -z "$MATCHED_PATTERN" ] && exit 0
+
+# Build the refusal message.
+MSG="Unbounded fan-out detected: $MATCHED_PATTERN
+
+This pattern can spawn an uncapped number of subprocesses. Issue #62193
+documented a single Bash tool call that spawned 3,079 bash processes in
+17 seconds, leading to an OS-level lockup (1.4 TB VSZ on parent, OOM
+killer hitting Claude Code's parent process before reaching the runaways).
+
+Bounded rewrite: $SUGGESTED_REWRITE
+
+Why this layer (PreToolUse hook) instead of just cgroup TasksMax: a
+TasksMax ceiling blocks ALL bash including light single-process calls,
+rendering the tool useless under pressure. This hook intercepts only the
+fan-out shape, so unrelated bash calls keep working at full speed.
+
+Override for this one call:
+  CC_BASH_FANOUT_OVERRIDE=1 (then retry)
+
+Disable entirely (operator already aware):
+  CC_BASH_FANOUT_DISABLE=1
+
+The bounded rewrite is the actual safe form of the same command — it
+runs the same workload at a cap of $BOUND concurrent processes, which is
+sustainable on every workstation tested in the cc-safe-setup matrix.
+
+Related: cc-safe-setup Cluster 1 (Sub-Agent Observability), scope
+expansion sub-pattern. The OS-level manifestation of the same primitive."
+
+echo "[bash-fanout-bounded-rewriter] $MSG" >&2
+
+exit 2

package/examples/bash-heuristic-approver.sh

@@ -11,7 +11,7 @@
 #         These cannot be bypassed with permissions.allow or acceptEdits.
 #
 # This PermissionRequest hook detects heuristic-triggered prompts and
-# auto-approves them when the base command is in a safe list.
+# auto-approves them when every command position is in a safe list.
 #
 # TRIGGER: PermissionRequest
 # MATCHER: ""
@@ -25,6 +25,32 @@
 #     }]
 #   }
 # }
+#
+# Fixed 2026-08-03. The safe list held bare command *words* — `git`, `curl`,
+# `chmod`, `sed`, `node`, `python3`, `npx` — and a word says nothing about what
+# the command does. `git commit -m "fix"` and `git push --force origin main`
+# have the same first word.
+#
+# Measured against the shipped copy, over 20 destructive or credential-reading
+# commands with no separator in them at all: **15 were approved**, among them
+# `git push --force`, `git reset --hard`, `git clean -fdx`, `chmod -R 777 /`,
+# `curl … | sh`, `node -e '…rmSync…'` and `cat ~/.aws/credentials`.
+#
+# ★ Measuring this hook needs the prompt text. It only acts when `.message`
+# matches a heuristic warning, so a probe that puts the command in `.message`
+# gets 0/20 back and reads as "no defect". The first sweep of this file did
+# exactly that. A control — does a plainly safe command get approved at all? —
+# is what separates "clean" from "not running".
+#
+# This is a different defect from the first-command-position one repaired in
+# #937/#940/#941/#942/#943/#947, and mixing the two produces a number that looks
+# right and is not: nothing here was hiding past a separator. (That defect was
+# here too, and is fixed in the same pass.)
+#
+# Substitution is the subject of this hook, so it cannot simply refuse `$(…)`
+# the way the others do. Instead the substitution's contents become command
+# positions of their own and have to qualify: `echo $(git status)` is approved,
+# `echo $(sudo rm -rf app)` is not.
 
 INPUT=$(cat)
 
@@ -44,16 +70,92 @@ fi
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 
-# Safe base commands — only auto-approve for known-safe tools
-SAFE_COMMANDS="git|npm|npx|bun|yarn|pnpm|docker|make|cargo|go|pip|python3|node|tsc|eslint|prettier|jest|vitest|pytest|gh|curl|wget|rsync|tar|zip|unzip|find|grep|sed|awk|cat|echo|ls|mkdir|cp|mv|chmod|wc|sort|head|tail|jq|python3"
+# A redirection writes a file, whatever the command word says.
+case "$COMMAND" in
+    *'>'*) exit 0 ;;
+esac
 
-# Extract first meaningful command (skip env vars, cd, whitespace)
-BASE_CMD=$(echo "$COMMAND" | tr '\n' ' ' | sed 's/^[[:space:]]*//' | sed 's/^[A-Z_]*=[^ ]* //' | sed 's/^cd [^&;]* *[&;]* *//' | awk '{print $1}' | sed 's|.*/||')
+# Command words that carry no destructive form of their own. Anything that takes
+# code as an argument (`node -e`, `python3 -c`, `npx`) or fetches and runs
+# (`curl`, `wget`) is deliberately absent: for those the word says nothing.
+cc_base_ok() {
+    case "$1" in
+        cat|head|tail|less|more|wc|file|stat|du|df|ls|tree|\
+        which|whereis|type|realpath|readlink|basename|dirname|\
+        grep|rg|ag|ack|sort|uniq|tr|cut|column|nl|rev|awk|\
+        echo|printf|true|false|pwd|date|uname|hostname|whoami|id|\
+        jq|yq|cd|\
+        tsc|eslint|prettier|jest|vitest|pytest)
+            return 0 ;;
+    esac
+    return 1
+}
 
-if echo "$BASE_CMD" | grep -qE "^($SAFE_COMMANDS)$"; then
-  jq -n '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}'
-  exit 0
-fi
+# One line on purpose: inside single quotes a trailing backslash is a literal
+# backslash-newline, not a continuation, and the pattern silently stops matching.
+CC_SUBCMD_RE='^[[:space:]]*(git[[:space:]]+(status|log|diff|show|add|commit|branch|remote|describe|rev-parse|blame|shortlog|ls-files|ls-tree|fetch|stash[[:space:]]+(list|push|save))|npm[[:space:]]+(test|run|ci|ls|view|outdated)|yarn[[:space:]]+(test|run|info|why)|pnpm[[:space:]]+(test|run|list|why)|bun[[:space:]]+(test|run)|cargo[[:space:]]+(build|test|check|fmt|clippy|tree)|go[[:space:]]+(build|test|vet|fmt|list)|docker[[:space:]]+(ps|images|logs|inspect|version|info)|make[[:space:]]+[A-Za-z0-9_.-]+|pip[[:space:]]+(list|show|freeze)|python3[[:space:]]+-m[[:space:]]+(pytest|unittest|pip[[:space:]]+(list|show|freeze)))([[:space:]]|$)'
+
+cc_subcommand_ok() {
+    printf '%s' "$1" | grep -qE "$CC_SUBCMD_RE"
+}
+
+cc_segment_base() {
+    printf '%s' "$1" \
+        | sed -E 's/^[[:space:]]+//; s/^([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+)*//' \
+        | awk '{print $1}' \
+        | sed 's|.*/||'
+}
+
+# `git branch` reads; `git branch -D main` deletes one. Same first two words.
+CC_GIT_DESTRUCTIVE_RE='^[[:space:]]*git[[:space:]]+(branch|tag)[[:space:]]+-([dDmM]|-delete|-move)([[:space:]]|$)'
+
+cc_segment_ok() {
+    local seg="$1" base
+    base=$(cc_segment_base "$seg")
+    [ -z "$base" ] && return 1
+
+    if [ "$base" = "find" ]; then
+        printf '%s' "$seg" \
+            | grep -qE '(^|[[:space:]])-(delete|exec|execdir|ok|okdir|fprintf?|fls|fprint0)([[:space:]]|$)' \
+            && return 1
+        return 0
+    fi
+    if [ "$base" = "sed" ]; then
+        printf '%s' "$seg" | grep -qE '(^|[[:space:]])-[a-zA-Z]*i' && return 1
+        return 0
+    fi
+
+    cc_base_ok "$base" && return 0
+    printf '%s' "$seg" | grep -qE "$CC_GIT_DESTRUCTIVE_RE" && return 1
+    cc_subcommand_ok "$seg" && return 0
+    return 1
+}
+
+# Split into command positions. Substitutions become positions of their own,
+# so what runs inside them has to qualify too. `)` is only turned into a break
+# when a substitution was opened, so `awk '{print $1}'` is left intact.
+SPLIT=$(printf '%s' "$COMMAND" | tr ';&|' '\n\n\n')
+case "$COMMAND" in
+    *'$('*|*'`'*)
+        SPLIT=$(printf '%s' "$SPLIT" | sed 's/\$(/\n/g; s/`/\n/g; s/)/\n/g')
+        ;;
+esac
+
+IDX=0
+while IFS= read -r SEG; do
+    SEG="${SEG#"${SEG%%[![:space:]]*}"}"
+    SEG="${SEG%"${SEG##*[![:space:]]}"}"
+    # a fragment left over from splitting — a lone quote, a stray brace — is not
+    # a command position
+    STRIPPED=$(printf '%s' "$SEG" | tr -d "\"'{} 	")
+    [ -z "$STRIPPED" ] && continue
+    cc_segment_ok "$SEG" || exit 0
+    IDX=$((IDX + 1))
+done <<EOF
+$SPLIT
+EOF
+
+[ "$IDX" -eq 0 ] && exit 0
 
-# Unknown base command — let the prompt through for safety
+jq -n '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}'
 exit 0