cc-safe-setup 29.8.0 → 30.0.4

package/examples/block-database-wipe.sh

@@ -2,15 +2,16 @@
 # block-database-wipe.sh — Block destructive database commands
 #
 # Prevents accidental database destruction from commands like:
-#   - Laravel: migrate:fresh, migrate:reset, db:wipe
-#   - Django: flush, sqlflush
-#   - Rails: db:drop, db:reset
+#   - Laravel: migrate:fresh, migrate:refresh, migrate:reset, db:wipe
+#   - Django: flush, sqlflush, migrate <app> zero
+#   - Rails: db:drop, db:reset, db:schema:load
 #   - Raw SQL: DROP DATABASE, TRUNCATE
 #   - Symfony/Doctrine: fixtures:load (without --append), schema:drop, database:drop
 #   - Prisma: migrate reset, db push --force-reset
+#   - TypeORM/Sequelize: schema:drop, db:drop
 #   - PostgreSQL: dropdb
 #
-# Born from GitHub Issues #37405, #37439, #34729, #37574
+# Born from GitHub Issues #37405, #37439, #34729, #37574, #69059
 #
 # Usage: Add to settings.json as a PreToolUse hook
 #
@@ -25,13 +26,25 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-block-database-wipe-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [block-database-wipe]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
 [[ -z "$COMMAND" ]] && exit 0
 
 # Laravel destructive commands
-if echo "$COMMAND" | grep -qiE 'artisan\s+(migrate:fresh|migrate:reset|db:wipe|db:seed\s+--force)'; then
+if echo "$COMMAND" | grep -qiE 'artisan\s+(migrate:fresh|migrate:refresh|migrate:reset|db:wipe|db:seed\s+--force)'; then
     echo "BLOCKED: Destructive Laravel database command" >&2
     echo "Command: $COMMAND" >&2
     exit 2
@@ -39,21 +52,26 @@ fi
 
 # Laravel --env flag without corresponding .env file
 if echo "$COMMAND" | grep -qE 'artisan.*--env='; then
-    ENV_NAME=$(echo "$COMMAND" | grep -oP '(?<=--env=)\w+')
+    # -P は GNU 拡張。BSD grep では ENV_NAME が空になり、下の「.env.<名前> が無い」検査だけが
+    # 静かに消える（この入力では別の exit 2 が先に止めるので結果は変わらないが、検査は消えている）。
+    # 後読み (?<=…) の代わりに、-- 以降を切り出して前置きを落とす。
+    ENV_NAME=$(echo "$COMMAND" | grep -oE '\-\-env=[A-Za-z0-9_]+' | sed -E 's/^--env=//')
     if [ -n "$ENV_NAME" ] && [ ! -f ".env.$ENV_NAME" ]; then
         echo "BLOCKED: .env.$ENV_NAME does not exist. Command would fall back to .env (possibly production)" >&2
         exit 2
     fi
 fi
 
-# Django destructive commands
-if echo "$COMMAND" | grep -qiE 'manage\.py\s+(flush|sqlflush)'; then
+# Django destructive commands (flush wipes data; "migrate <app> zero" unapplies all
+# migrations for an app, dropping its tables)
+if echo "$COMMAND" | grep -qiE 'manage\.py\s+(flush|sqlflush)' \
+   || echo "$COMMAND" | grep -qiE 'manage\.py\s+migrate\s+\w+\s+zero'; then
     echo "BLOCKED: Destructive Django database command" >&2
     exit 2
 fi
 
-# Rails destructive commands
-if echo "$COMMAND" | grep -qiE 'rake\s+db:(drop|reset)|rails\s+db:(drop|reset)'; then
+# Rails destructive commands (db:schema:load drops and recreates every table from schema.rb)
+if echo "$COMMAND" | grep -qiE '(rake|rails)\s+db:(drop|reset|schema:load)'; then
     echo "BLOCKED: Destructive Rails database command" >&2
     exit 2
 fi
@@ -76,6 +94,13 @@ if echo "$COMMAND" | grep -qiE 'prisma\s+migrate\s+reset|prisma\s+db\s+push\s+--
     exit 2
 fi
 
+# TypeORM / Sequelize destructive commands
+# typeorm "schema:drop" drops the whole schema; sequelize(-cli) "db:drop" drops the database
+if echo "$COMMAND" | grep -qiE 'typeorm\s+schema:drop|sequelize(-cli)?\s+db:drop'; then
+    echo "BLOCKED: Destructive TypeORM/Sequelize database command" >&2
+    exit 2
+fi
+
 # PostgreSQL CLI
 if echo "$COMMAND" | grep -qE '^\s*dropdb\s'; then
     echo "BLOCKED: dropdb command" >&2

package/examples/branch-name-check.sh

@@ -15,7 +15,7 @@
 #   }
 # }
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PostToolUse  MATCHER: "Bash"
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
@@ -28,11 +28,16 @@ if ! echo "$COMMAND" | grep -qE 'git\s+(checkout\s+-b|branch|switch\s+-c)\s'; th
 fi
 
 # Extract branch name
-BRANCH=$(echo "$COMMAND" | grep -oP '(?:checkout\s+-b|branch|switch\s+-c)\s+\K\S+')
+# -P は GNU 拡張で、BSD grep では BRANCH が空になり、下の「空なら exit 0」で
+# 検査そのものが消える。\K に POSIX の等価物は無いので、コマンド語から一致させて
+# 前置きを sed で落とす。
+BRANCH=$(echo "$COMMAND" \
+    | grep -oE '(checkout[[:space:]]+-b|branch|switch[[:space:]]+-c)[[:space:]]+[^[:space:]]+' \
+    | sed -E 's/^(checkout[[:space:]]+-b|branch|switch[[:space:]]+-c)[[:space:]]+//')
 [[ -z "$BRANCH" ]] && exit 0
 
 # Check for spaces or special characters
-if echo "$BRANCH" | grep -qP '[^a-zA-Z0-9/_.-]'; then
+if echo "$BRANCH" | grep -qE '[^a-zA-Z0-9/_.-]'; then
     echo "" >&2
     echo "WARNING: Branch name contains special characters: $BRANCH" >&2
     echo "Use only: a-z, 0-9, /, -, ., _" >&2

package/examples/broad-find-guard.sh

@@ -29,6 +29,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-broad-find-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [broad-find-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/broad-prefix-session-trap-warner.sh

@@ -0,0 +1,106 @@
+#!/bin/bash
+# ================================================================
+# broad-prefix-session-trap-warner.sh — Cluster 6 Axis 8
+# Warn before a broad static `ask` rule is session-approved
+# ================================================================
+# PURPOSE:
+#   Cluster 6 Axis 8 (surfaced 2026-05-26 via #62437).
+#
+#   When a static ask rule like `Bash(docker --host:*)` exists in
+#   settings.json and the operator selects "Approve always for
+#   this session" on the first matching command, the matching
+#   engine caches the approval. Subsequent commands that match the
+#   SAME pattern then bypass the PreToolUse hook chain entirely —
+#   the hook's `permissionDecision: deny` output is never reached.
+#
+#   The trap is broad-prefix session approval. A single approval
+#   of `docker --host=unix:///var/run/docker.sock ps` silently
+#   whitelists `docker --host=unix:///var/run/docker.sock rm -f *`
+#   for the rest of the session, even though a PreToolUse hook is
+#   actively trying to deny destructive `docker rm` commands.
+#
+#   This hook fires on every PreToolUse for matching commands so
+#   that the first session-level approval is at least visible:
+#   the operator sees the trap articulated before they click
+#   "Always" and inadvertently shadow their own deny logic.
+#
+# DETECTION:
+#   PreToolUse on Bash. For each Bash command, check if it matches
+#   any configured broad-prefix pattern. A broad prefix is one
+#   where the same root command can introduce both safe and
+#   destructive subcommands (docker, gcloud, aws, kubectl, helm,
+#   terraform, rm -rf, dd, mkfs). If matched, advise the operator
+#   to use "Approve once" rather than "Approve always for this
+#   session".
+#
+# OUTPUT:
+#   stderr advisory naming the matched prefix and the deny-bypass
+#   trap, plus a JSON additionalContext block summarising the same
+#   for the model. Exit 0 always (advisory, not blocking) so the
+#   permission gate still owns the actual decision.
+#
+# CONFIGURATION:
+#   CC_BROAD_PREFIX_PATTERNS — colon-separated grep -E patterns
+#                              matched against the Bash command.
+#                              Default covers common broad-prefix
+#                              admin tools.
+#   CC_BROAD_PREFIX_DISABLE  — set to 1 to suppress entirely
+#                              (operator already aware of trap).
+#   CC_BROAD_PREFIX_SILENT   — set to 1 to skip JSON output but
+#                              still emit stderr advisory.
+#
+# RELATED ISSUES:
+#   https://github.com/anthropics/claude-code/issues/62437
+#   https://github.com/anthropics/claude-code/issues/30519 (meta)
+#   https://github.com/anthropics/claude-code/issues/39523 (meta)
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+# ================================================================
+
+set -u
+
+INPUT=$(cat 2>/dev/null || echo "{}")
+
+[ "${CC_BROAD_PREFIX_DISABLE:-0}" = "1" ] && exit 0
+
+# Default broad prefixes. The principle: the same root command can
+# introduce a safe read-only invocation OR a destructive one, so
+# session-wide approval of the prefix is the trap.
+DEFAULT_PATTERNS='docker( |$):gcloud( |$):aws( |$):kubectl( |$):helm( |$):terraform( |$):rm +-[rRf]:dd( |$):mkfs'
+PATTERNS="${CC_BROAD_PREFIX_PATTERNS:-$DEFAULT_PATTERNS}"
+
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+MATCHED_PATTERN=""
+IFS=':' read -ra PATTERN_ARR <<< "$PATTERNS"
+for pat in "${PATTERN_ARR[@]}"; do
+    [ -z "$pat" ] && continue
+    if printf '%s' "$COMMAND" | grep -qE "$pat"; then
+        MATCHED_PATTERN="$pat"
+        break
+    fi
+done
+
+[ -z "$MATCHED_PATTERN" ] && exit 0
+
+MSG="broad-prefix command detected: '$MATCHED_PATTERN' matches this command. Cluster 6 Axis 8 trap (#62437): if you select 'Approve always for this session' on the upcoming prompt, the matching engine caches the approval for the prefix — and subsequent commands matching the same prefix will bypass the PreToolUse hook chain entirely (your hook's permissionDecision: deny will never fire).
+
+Recommendation: select 'Approve once' for this invocation. Reserve 'Always' for narrow, fully-qualified commands (not broad prefixes like '$MATCHED_PATTERN').
+
+Trap mechanics: a session approval of 'docker ps' silently whitelists 'docker rm -f *' for the rest of the session even if a PreToolUse hook is actively denying destructive docker subcommands. Related: meta-issue #30519, bypass-mode meta #39523."
+
+echo "[broad-prefix-session-trap-warner] $MSG" >&2
+
+if [ "${CC_BROAD_PREFIX_SILENT:-0}" != "1" ]; then
+    jq -n --arg msg "$MSG" '
+    {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "additionalContext": $msg
+        }
+    }' 2>/dev/null || true
+fi
+
+exit 0

package/examples/bulk-file-delete-guard.sh

@@ -17,6 +17,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-bulk-file-delete-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [bulk-file-delete-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0
@@ -27,22 +39,55 @@ THRESHOLD=10
 IS_BULK=0
 TARGET=""
 
+# Normalise a target so it can actually be counted.
+# Measured 2026-09-18: the same 25-file directory was let through when the path
+# was quoted, reached via `cd`, or written as a glob - only a bare absolute path
+# was blocked. Every one of those is an ordinary way to write the command, so the
+# guard was warning instead of blocking on the shapes people use most.
+resolve_target() {
+    local t="$1"
+    # Strip surrounding quotes - the counting test below is a literal -d check
+    t="${t%\"}"; t="${t#\"}"
+    t="${t%\'}"; t="${t#\'}"
+    # `cd <dir> && rm -rf <name>`: count relative to the directory we cd into
+    if [[ "$t" != /* ]]; then
+        local cd_dir
+        cd_dir=$(echo "$COMMAND" | grep -oE '^[[:space:]]*cd[[:space:]]+[^&;|]+' | sed 's/^[[:space:]]*cd[[:space:]]\+//')
+        # Trim trailing whitespace BEFORE unquoting - `cd "dir" && rm -rf x`
+        # leaves a space after the closing quote, and stripping quotes first
+        # then silently does nothing (measured 2026-09-18).
+        cd_dir="${cd_dir%"${cd_dir##*[![:space:]]}"}"
+        cd_dir="${cd_dir%\"}"; cd_dir="${cd_dir#\"}"
+        cd_dir="${cd_dir%\'}"; cd_dir="${cd_dir#\'}"
+        [[ -n "$cd_dir" ]] && t="${cd_dir%/}/$t"
+    fi
+    # A trailing glob still names a real parent - count that instead
+    if [[ "$t" == *[\*\?]* ]]; then
+        local parent="${t%/*}"
+        [[ "$parent" != "$t" ]] && t="$parent"
+    fi
+    printf '%s' "${t%/}"
+}
+
 # rm -rf / rm -r with wildcards or broad directory paths
 if echo "$COMMAND" | grep -qE 'rm\s+(-[a-zA-Z]*r[a-zA-Z]*f?|(-[a-zA-Z]*f[a-zA-Z]*r))\s'; then
     # Extract the target path
     TARGET=$(echo "$COMMAND" | grep -oE 'rm\s+-[a-zA-Z]+\s+(.+)' | sed 's/rm\s\+-[a-zA-Z]\+\s\+//')
+    TARGET=$(resolve_target "$TARGET")
     IS_BULK=1
 fi
 
 # find ... -delete
 if echo "$COMMAND" | grep -qE 'find\s+.*-delete'; then
     TARGET=$(echo "$COMMAND" | grep -oE 'find\s+(\S+)' | sed 's/find\s\+//')
+    TARGET=$(resolve_target "$TARGET")
     IS_BULK=1
 fi
 
 # find ... -exec rm
 if echo "$COMMAND" | grep -qE 'find\s+.*-exec\s+rm'; then
     TARGET=$(echo "$COMMAND" | grep -oE 'find\s+(\S+)' | sed 's/find\s\+//')
+    TARGET=$(resolve_target "$TARGET")
     IS_BULK=1
 fi
 

package/examples/bypass-mode-effective-verifier.sh

@@ -0,0 +1,203 @@
+#!/bin/bash
+# ================================================================
+# bypass-mode-effective-verifier.sh — Warn when bypass mode is actually in effect
+# ================================================================
+# PURPOSE:
+#   This hook reports at session start via hookSpecificOutput /
+#   additionalContext. Without the TRIGGER header below, the
+#   installer registered it under the default PreToolUse/Bash,
+#   so it fired on every Bash call and never ran at session start.
+#
+# TRIGGER: SessionStart
+# MATCHER: ""
+# ================================================================
+
+# ================================================================
+# bypass-mode-effective-verifier.sh — Warn about partial bypass-mode
+# coverage when --dangerously-skip-permissions is active
+# ================================================================
+# PURPOSE:
+#   Cluster 6 Axis 7. The --dangerously-skip-permissions flag
+#   (a.k.a. "bypass mode") does NOT bypass every permission gate
+#   the way operators expect. Documented exceptions and known bugs:
+#     - Edit tool prompts still fire (#36192)
+#     - Cowork scheduled tasks ignore "Always allow" rules and
+#       re-prompt every run (#47180)
+#     - Mobile Remote Control shows permission prompts despite the
+#       flag being set (#29214, 71 reactions)
+#     - The flag itself stopped working entirely after v2.1.77
+#       (#36168, 63 reactions, regression open as of v2.1.150)
+#   Meta-issue #39523 tracks the regression with 12+ duplicates
+#   over 9 months.
+#
+#   The reverse case, added 2026-08-11 from a first-hand test on
+#   2.1.226: crossSessionInbound. The changelog says inbound peer
+#   messages are held for approval when permissions are bypassed.
+#   Measured here, with the setting unset they were delivered and
+#   acted on with no dialog; setting it to "refuse" blocked them.
+#   So this is a gate operators believe the default gives them and
+#   it did not. The hook flags it when bypass is active and the
+#   setting is absent. See SETTINGS_REFERENCE.md for the four-row
+#   measurement table.
+#
+#   Operators run with --dangerously-skip-permissions expecting
+#   "no prompts at all" and only discover the partial coverage
+#   when something they assumed was bypassed surfaces a prompt
+#   anyway, mid-task. The hook makes the partial coverage legible
+#   at session start so the operator can plan accordingly.
+#
+# DETECTION:
+#   At SessionStart, detect bypass mode via three signals:
+#     1. env var CLAUDE_PERMISSION_MODE = "bypassPermissions"
+#     2. env var CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS = "1"/"true"
+#     3. permission_mode field in the hook input JSON
+#   If any signal indicates bypass mode is active, emit the warning.
+#
+# OUTPUT:
+#   hookSpecificOutput.additionalContext naming the four known
+#   tool surfaces that the bypass does NOT cover, with issue links
+#   so the operator can verify the current upstream state. Kept
+#   short to minimize cache_creation tokens at session start
+#   (Cluster 4 — Pro Max quota anomaly — interaction).
+#
+# CONFIGURATION:
+#   CC_BYPASS_VERIFIER_DISABLE  — set to 1 to suppress the warning
+#                                 entirely (operator already aware).
+#   CC_BYPASS_VERIFIER_SILENT   — set to 1 to skip JSON output but
+#                                 still emit stderr advisory.
+#
+# RELATED ISSUES:
+#   https://github.com/anthropics/claude-code/issues/29214
+#   https://github.com/anthropics/claude-code/issues/36168
+#   https://github.com/anthropics/claude-code/issues/36192
+#   https://github.com/anthropics/claude-code/issues/39523
+#   https://github.com/anthropics/claude-code/issues/47180
+# ================================================================
+
+set -u
+
+INPUT=$(cat 2>/dev/null || echo "{}")
+
+# Allow operator to disable without removing the hook.
+[ "${CC_BYPASS_VERIFIER_DISABLE:-0}" = "1" ] && exit 0
+
+# Detect bypass mode via three independent signals.
+BYPASS_ACTIVE=0
+BYPASS_SIGNAL=""
+
+# Signal 1: env var CLAUDE_PERMISSION_MODE
+if [ "${CLAUDE_PERMISSION_MODE:-}" = "bypassPermissions" ]; then
+    BYPASS_ACTIVE=1
+    BYPASS_SIGNAL="CLAUDE_PERMISSION_MODE=bypassPermissions"
+fi
+
+# Signal 2: env var CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS
+case "${CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS:-}" in
+    1|true|TRUE|True|yes|YES)
+        BYPASS_ACTIVE=1
+        BYPASS_SIGNAL="CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=${CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS}"
+        ;;
+esac
+
+# Signal 3: permission_mode field in the hook input JSON
+INPUT_MODE=$(printf '%s' "$INPUT" | jq -r '.permission_mode // .permissionMode // empty' 2>/dev/null)
+if [ "$INPUT_MODE" = "bypassPermissions" ]; then
+    BYPASS_ACTIVE=1
+    BYPASS_SIGNAL="hook input permission_mode=bypassPermissions"
+fi
+
+# Signal 4: settings.json. Env vars and hook input miss the case where bypass is
+# set as the *saved default* (#65848): accepting the warning prompt silently writes
+# `defaultMode: bypassPermissions` and `skipDangerousModePermissionPrompt: true` to
+# settings.json permanently, and the upstream prompt never reappears — so the operator
+# loses the per-session awareness that they are in dangerous mode at all. Read the
+# settings file directly so a silently-persisted default is still surfaced each session.
+# CC_BYPASS_VERIFIER_SETTINGS overrides the path (used by tests).
+SETTINGS_FILE="${CC_BYPASS_VERIFIER_SETTINGS:-$HOME/.claude/settings.json}"
+SKIP_PROMPT_PERSISTED=0
+if [ -f "$SETTINGS_FILE" ]; then
+    SETTINGS_MODE=$(jq -r '.permissions.defaultMode // empty' "$SETTINGS_FILE" 2>/dev/null)
+    if [ "$SETTINGS_MODE" = "bypassPermissions" ]; then
+        BYPASS_ACTIVE=1
+        [ -z "$BYPASS_SIGNAL" ] && BYPASS_SIGNAL="settings.json permissions.defaultMode=bypassPermissions"
+    fi
+    SKIP_PROMPT=$(jq -r '.skipDangerousModePermissionPrompt // empty' "$SETTINGS_FILE" 2>/dev/null)
+    case "$SKIP_PROMPT" in 1|true|TRUE|True|yes|YES) SKIP_PROMPT_PERSISTED=1 ;; esac
+fi
+
+# Cross-session inbound messages (2.1.224+). This is the reverse of the cases above: not a
+# gate that survives bypass unexpectedly, but a gate operators believe they have and do not.
+#
+# Measured 2026-08-11 on 2.1.226 (Linux/WSL2), receiver under --dangerously-skip-permissions
+# with `crossSessionInbound` absent from every settings file: SendMessage from another session
+# was DELIVERED with no approval dialog and no hold — from a bypass-class sender and from a
+# prompting-class sender alike — and the receiver acted on the content unattended. Setting
+# `crossSessionInbound: "refuse"` on the receiver blocked delivery under the identical
+# procedure, so the gate itself works; the default is what does not gate. The changelog
+# wording ("held for your approval" when permissions are bypassed) did not reproduce here.
+#
+# An explicit value is resolved before any mode-based default, so setting it always wins.
+# Only the user settings file is inspected: a value in settings.local.json or a project file
+# would also count, so this is a prompt to check, not a verdict.
+CSI_UNSET=0
+if [ "$BYPASS_ACTIVE" = "1" ]; then
+    CSI_VALUE=""
+    if [ -f "$SETTINGS_FILE" ]; then
+        CSI_VALUE=$(jq -r '.crossSessionInbound // empty' "$SETTINGS_FILE" 2>/dev/null)
+    fi
+    [ -z "$CSI_VALUE" ] && CSI_UNSET=1
+fi
+
+# Nothing to warn about if bypass isn't active AND the dangerous-mode prompt
+# has not been silently suppressed.
+[ "$BYPASS_ACTIVE" = "0" ] && [ "$SKIP_PROMPT_PERSISTED" = "0" ] && exit 0
+
+# The standing note about the silently-persisted dangerous-mode prompt (#65848).
+# Accepting the bypass warning writes `skipDangerousModePermissionPrompt: true` to
+# settings.json permanently with no disclosure, so Claude Code never re-warns. The
+# hook re-surfaces that suppressed awareness each session.
+SKIP_NOTE=""
+if [ "$SKIP_PROMPT_PERSISTED" = "1" ]; then
+    SKIP_NOTE="
+- skipDangerousModePermissionPrompt=true is set in settings.json: the upstream dangerous-mode warning is silently suppressed on this machine (#65848). Claude Code will not re-warn you when entering bypass mode. Remove that key to restore the prompt, or keep this hook as the standing warning."
+fi
+
+# Cross-session inbound is unset while bypass is active: peer messages arrive ungated.
+CSI_NOTE=""
+if [ "$CSI_UNSET" = "1" ]; then
+    CSI_NOTE="
+- crossSessionInbound is not set in settings.json. Measured on 2.1.226: under bypass, SendMessage from your other sessions was delivered with no approval dialog and acted on, and \"refuse\" blocked it under the identical test. If nobody is watching this session, set \"refuse\" (opt out) or \"hold\" (park for review; note held messages expire on overflow and at shutdown). Check settings.local.json and project settings too — a value there also counts."
+fi
+
+# Build the warning message. Kept compact to minimize cache_creation
+# token growth at session start.
+if [ "$BYPASS_ACTIVE" = "1" ]; then
+    MSG="bypass mode ACTIVE ($BYPASS_SIGNAL). --dangerously-skip-permissions does NOT cover every permission gate. Known exceptions in cc-safe-setup Cluster 6 Axis 7 tracking:
+
+- Edit tool still prompts (#36192)
+- Cowork scheduled tasks re-prompt every run (#47180)
+- Mobile Remote Control shows prompts (#29214)
+- Bypass flag itself broken after v2.1.77 (#36168, regression open)${SKIP_NOTE}${CSI_NOTE}
+
+If you depend on bypass for unattended runs (cron, watchdog, automation), test the specific tool surfaces you use BEFORE the run, not during. Tracking meta-issue: #39523 (12+ duplicates over 9 months)."
+else
+    # Bypass is not currently the active mode, but the dangerous-mode warning has been
+    # permanently suppressed — surface that disabled guardrail on its own (#65848).
+    MSG="dangerous-mode warning SUPPRESSED.${SKIP_NOTE}"
+fi
+
+# Always echo to stderr for operator visibility.
+echo "[bypass-mode-effective-verifier] $MSG" >&2
+
+# Emit JSON additionalContext unless silent mode is requested.
+if [ "${CC_BYPASS_VERIFIER_SILENT:-0}" != "1" ]; then
+    jq -n --arg msg "$MSG" '
+    {
+        "hookSpecificOutput": {
+            "hookEventName": "SessionStart",
+            "additionalContext": $msg
+        }
+    }' 2>/dev/null || true
+fi
+
+exit 0

package/examples/cache-creation-drift-detector.sh

@@ -0,0 +1,120 @@
+#!/bin/bash
+# cache-creation-drift-detector.sh — alert when per-request cache_creation drifts above baseline
+#
+# Why: Issue #46917 documents that Claude Code v2.1.100+ inflates
+#      cache_creation_input_tokens by ~20K vs v2.1.98 on the SAME payload, server-side.
+#      This is the load-bearing reproduction in a ~2,200-reaction Pro Max quota
+#      anomaly cluster (#16157 / #38335 / #46917 / #45756 / #29579 / #41788 / #13585
+#      / #23706 / #16856 / #19673). Four issues name a runtime version or date
+#      boundary (2026-03-23 / v2.1.89 / v2.1.100 / 2.1.1), so the inflation is
+#      version-correlated and operator-side measurable.
+#
+#      The existing cache-tier-logger.sh logs every event but never computes
+#      drift — operators have to write awk pipelines to spot the regression.
+#      This hook does the drift computation inline and surfaces a one-line
+#      stderr warning when the current request's cache_creation exceeds the
+#      trailing-window mean by a configurable multiplier.
+#
+# Event: PostToolUse  MATCHER: "" (all tools)
+# Action: Read cache_creation_input_tokens from the PostToolUse payload (or the
+#         last assistant turn in the transcript as fallback). Append to a rolling
+#         JSONL log. Compute the mean of the last N nonzero samples. If the
+#         current value exceeds threshold * mean, emit a warning to stderr.
+#         Advisory only (exit 0); does not block.
+#
+# Configuration (all optional):
+#   CC_CACHE_DRIFT_LOG          Log path (default: ~/.cache/cc-safe-setup/cache-creation-drift.jsonl)
+#   CC_CACHE_DRIFT_THRESHOLD    Multiplier for alert (default: 1.25 = 25% above mean)
+#   CC_CACHE_DRIFT_MIN_HISTORY  Minimum samples before alerting (default: 20)
+#   CC_CACHE_DRIFT_WINDOW       Trailing window size for mean (default: 200 samples)
+#   CC_CACHE_DRIFT_SILENT       Set to "1" to suppress stderr (still logs)
+#
+# Inspect the log:
+#   tail -50 ~/.cache/cc-safe-setup/cache-creation-drift.jsonl
+#   jq -s 'map(.cc_tokens) | add / length' ~/.cache/cc-safe-setup/cache-creation-drift.jsonl
+#
+# The registration was missing from this header. The installer reads TRIGGER
+# and MATCHER from here and falls back to PreToolUse / Bash when both are
+# absent, so this hook was being registered at a moment where the field it
+# reads is always empty: it installed, it appeared in the settings, and it
+# did nothing. Measured 2026-08-04 across examples/: 14 files were like this.
+# TRIGGER: PostToolUse
+# MATCHER: ""
+
+set -u
+
+LOG="${CC_CACHE_DRIFT_LOG:-${HOME}/.cache/cc-safe-setup/cache-creation-drift.jsonl}"
+THRESHOLD="${CC_CACHE_DRIFT_THRESHOLD:-1.25}"
+MIN_HISTORY="${CC_CACHE_DRIFT_MIN_HISTORY:-20}"
+WINDOW="${CC_CACHE_DRIFT_WINDOW:-200}"
+SILENT="${CC_CACHE_DRIFT_SILENT:-0}"
+
+mkdir -p "$(dirname "$LOG")" 2>/dev/null
+
+INPUT=$(cat)
+
+# Extract cache_creation from the PostToolUse payload (path varies by tool).
+CC_TOKENS=$(printf '%s' "$INPUT" | jq -r '.tool_response.usage.cache_creation_input_tokens // empty' 2>/dev/null)
+
+# Fallback: read the last assistant turn's usage from the transcript.
+if [ -z "$CC_TOKENS" ]; then
+  TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+  if [ -n "$TRANSCRIPT" ] && [ -r "$TRANSCRIPT" ]; then
+    LAST_USAGE=$(tac "$TRANSCRIPT" 2>/dev/null | grep -m1 '"usage"' || true)
+    if [ -n "$LAST_USAGE" ]; then
+      CC_TOKENS=$(printf '%s' "$LAST_USAGE" | \
+        jq -r '.message.usage.cache_creation_input_tokens // .usage.cache_creation_input_tokens // empty' 2>/dev/null)
+    fi
+  fi
+fi
+
+# No usable measurement — exit quietly (this is the common case for many tools).
+if [ -z "$CC_TOKENS" ] || [ "$CC_TOKENS" = "0" ] || [ "$CC_TOKENS" = "null" ]; then
+  exit 0
+fi
+
+# Validate the value is a positive integer.
+case "$CC_TOKENS" in
+  ''|*[!0-9]*) exit 0 ;;
+esac
+
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "unknown"' 2>/dev/null)
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+# Append this sample to the rolling log as a JSONL line.
+printf '{"ts":"%s","session":"%s","cc_tokens":%s}\n' "$TS" "$SESSION_ID" "$CC_TOKENS" >> "$LOG"
+
+# How many historical samples do we have so far? (Includes the line we just appended.)
+SAMPLE_COUNT=$(wc -l < "$LOG" 2>/dev/null | tr -d ' ')
+SAMPLE_COUNT="${SAMPLE_COUNT:-0}"
+
+# Need at least MIN_HISTORY samples before we trust the baseline.
+if [ "$SAMPLE_COUNT" -lt "$MIN_HISTORY" ]; then
+  exit 0
+fi
+
+# Compute the mean of the trailing window (excluding the just-written sample).
+# We exclude the current sample so the alert compares "this" against "the past".
+TAIL_LINES=$((WINDOW + 1))
+MEAN=$(tail -n "$TAIL_LINES" "$LOG" 2>/dev/null | head -n -1 | \
+  jq -s 'if length > 0 then (map(.cc_tokens) | add / length) else 0 end' 2>/dev/null)
+
+# If the baseline mean is invalid or zero, skip (defensive).
+if [ -z "$MEAN" ] || [ "$MEAN" = "0" ] || [ "$MEAN" = "null" ]; then
+  exit 0
+fi
+
+# Compute ratio = CC_TOKENS / MEAN. Use awk because bash lacks float arithmetic.
+RATIO=$(awk -v c="$CC_TOKENS" -v m="$MEAN" 'BEGIN { if (m > 0) printf "%.3f", c/m; else print "0" }')
+EXCEEDS=$(awk -v r="$RATIO" -v t="$THRESHOLD" 'BEGIN { print (r > t) ? 1 : 0 }')
+
+if [ "$EXCEEDS" = "1" ] && [ "$SILENT" != "1" ]; then
+  # Format the baseline mean as an integer for the human-readable output.
+  MEAN_INT=$(awk -v m="$MEAN" 'BEGIN { printf "%d", m }')
+  PCT=$(awk -v r="$RATIO" 'BEGIN { printf "%d", (r - 1) * 100 }')
+  echo "NOTICE: cache_creation_input_tokens=${CC_TOKENS} is ${PCT}% above your trailing-${WINDOW}-sample baseline (~${MEAN_INT})." >&2
+  echo "        Possible version-correlated server-side inflation (see anthropics/claude-code #46917)." >&2
+  echo "        Inspect ${LOG} or run: jq -s 'map(.cc_tokens) | add/length' ${LOG}" >&2
+fi
+
+exit 0