cc-safe-setup 29.8.0 → 30.0.4

package/examples/cache-residue-detector.sh

@@ -0,0 +1,195 @@
+#!/bin/bash
+# ================================================================
+# cache-residue-detector.sh — Detect leftover server-side injection
+# caches that persist after opt-out env vars are set
+# ================================================================
+# PURPOSE:
+#   Cluster 8 (server-side prompt injection, v2.1.150+).
+#
+#   Setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 and
+#   DISABLE_GROWTHBOOK=1 closes the channel for FUTURE sync, but
+#   does NOT delete cache files written before the opt-out. The
+#   runtime still reads cached values on startup unless the cache
+#   keys are physically removed. This produces a silent gap: the
+#   operator believes injection is disabled, but the most recent
+#   cached value continues to register as a peer system prompt
+#   section until cache eviction or next sync.
+#
+#   This hook detects the gap: if opt-out env vars are set AND
+#   cache residue exists, it prints a one-screen advisory with
+#   exact cleanup commands (jq-based, idempotent).
+#
+# DETECTION:
+#   At SessionStart, check:
+#     1. Both opt-out env vars are set to 1.
+#     2. ~/.claude.json contains cachedGrowthBookFeatures,
+#        cachedExperimentFeatures, or cachedStatsigGates keys.
+#     3. macOS-only: ~/Library/Application Support/Claude/
+#        cachedGrowthBookFeatures file exists.
+#   When residue is found in step 2 or 3, print advisory naming
+#   the specific files/keys and the cleanup commands.
+#
+# TRIGGER: SessionStart
+# MATCHER: (none)
+#
+# OUTPUT:
+#   Advisory only, never blocks. Prints to stderr.
+#
+# CONFIGURATION:
+#   CC_CACHE_RESIDUE_DETECTOR_DISABLE=1  — disable entirely
+#   CC_CACHE_RESIDUE_DETECTOR_QUIET=1    — silence after acknowledgment
+#   CC_CACHE_RESIDUE_DETECTOR_STRICT=1   — also warn even when
+#                                          opt-out env vars are NOT
+#                                          set (operators who plan
+#                                          to opt out and want a
+#                                          forward-looking signal)
+#   CC_CACHE_RESIDUE_CLAUDE_JSON         — override default location
+#                                          for ~/.claude.json
+#
+# RELATED ISSUES:
+#   https://github.com/anthropics/claude-code/issues/62061 — central
+#     report of v2.1.150 server-side injection (46+ reactions).
+#   https://github.com/anthropics/claude-code/issues/25141 — earlier
+#     transparency request for experimental features.
+#   https://github.com/anthropics/claude-code/issues/28941 — earlier
+#     report of unauthorized server-side feature flag push.
+#
+# RELATED HOOKS:
+#   server-side-prompt-injection-detector.sh — warns when opt-out
+#     env vars are MISSING. Pair with this hook for full coverage:
+#     the other hook tells operators to opt out; this one tells
+#     them the cache cleanup that the env vars alone do not perform.
+#
+# DESIGN NOTES:
+#   - The hook does NOT touch the cache files. Cleanup is the
+#     operator's call; the hook only surfaces the state.
+#   - jq is required for reliable JSON inspection. When jq is
+#     missing, the hook prints a one-line advisory pointing at the
+#     installer and exits clean (fail-open).
+#   - The macOS path is reported as informational on non-macOS
+#     systems but never causes a failure.
+
+set -u
+
+if [ "${CC_CACHE_RESIDUE_DETECTOR_DISABLE:-0}" = "1" ]; then
+    exit 0
+fi
+if [ "${CC_CACHE_RESIDUE_DETECTOR_QUIET:-0}" = "1" ]; then
+    exit 0
+fi
+
+# Consume stdin if provided (SessionStart hooks receive JSON input)
+if [ ! -t 0 ]; then
+    cat >/dev/null 2>&1 || true
+fi
+
+OPT_OUT_NON_ESSENTIAL="${CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:-0}"
+OPT_OUT_GROWTHBOOK="${DISABLE_GROWTHBOOK:-0}"
+
+STRICT="${CC_CACHE_RESIDUE_DETECTOR_STRICT:-0}"
+
+# When strict mode is off, only warn if the operator has already opted out.
+# This matches the hook's primary purpose: catching the silent gap between
+# opt-out and cache cleanup. Strict mode flips it to forward-looking advisory.
+if [ "$STRICT" != "1" ]; then
+    if [ "$OPT_OUT_NON_ESSENTIAL" != "1" ] && [ "$OPT_OUT_GROWTHBOOK" != "1" ]; then
+        exit 0
+    fi
+fi
+
+CLAUDE_JSON="${CC_CACHE_RESIDUE_CLAUDE_JSON:-$HOME/.claude.json}"
+
+RESIDUE_KEYS=()
+RESIDUE_FILES=()
+NEEDS_JQ_ADVISORY=0
+
+if [ -f "$CLAUDE_JSON" ] && [ -r "$CLAUDE_JSON" ]; then
+    if command -v jq >/dev/null 2>&1; then
+        # Inspect known cache keys. Any one of these being present and non-empty
+        # is residue worth surfacing.
+        for key in cachedGrowthBookFeatures cachedExperimentFeatures cachedStatsigGates; do
+            count=$(jq --arg k "$key" '
+                if has($k) then
+                    (.[$k] | if type=="object" then (keys|length)
+                             elif type=="array" then length
+                             else 0 end)
+                else 0 end
+            ' "$CLAUDE_JSON" 2>/dev/null || echo 0)
+            if [ -n "$count" ] && [ "$count" -gt 0 ] 2>/dev/null; then
+                RESIDUE_KEYS+=("$key ($count entries)")
+            fi
+        done
+    else
+        # Fall back to a coarse grep when jq is missing. This avoids false
+        # positives in the cleanup advisory by labeling the result as coarse.
+        if grep -q '"cachedGrowthBookFeatures"' "$CLAUDE_JSON" 2>/dev/null; then
+            RESIDUE_KEYS+=("cachedGrowthBookFeatures (count unknown — jq missing)")
+        fi
+        if grep -q '"cachedExperimentFeatures"' "$CLAUDE_JSON" 2>/dev/null; then
+            RESIDUE_KEYS+=("cachedExperimentFeatures (count unknown — jq missing)")
+        fi
+        if grep -q '"cachedStatsigGates"' "$CLAUDE_JSON" 2>/dev/null; then
+            RESIDUE_KEYS+=("cachedStatsigGates (count unknown — jq missing)")
+        fi
+        if [ "${#RESIDUE_KEYS[@]}" -gt 0 ]; then
+            NEEDS_JQ_ADVISORY=1
+        fi
+    fi
+fi
+
+# macOS Desktop cache — informational on Linux/CLI installs.
+MAC_CACHE="$HOME/Library/Application Support/Claude/cachedGrowthBookFeatures"
+if [ -f "$MAC_CACHE" ]; then
+    RESIDUE_FILES+=("$MAC_CACHE")
+fi
+
+if [ "${#RESIDUE_KEYS[@]}" -eq 0 ] && [ "${#RESIDUE_FILES[@]}" -eq 0 ]; then
+    exit 0
+fi
+
+# Compose advisory. Keep it under one screen so operators can read it
+# without scrolling. The cleanup commands are idempotent and reversible
+# (the runtime repopulates the keys on next sync if opt-out env vars are
+# unset).
+{
+    echo "ADVISORY: server-side injection cache residue detected (Cluster 8)."
+    if [ "$STRICT" = "1" ]; then
+        if [ "$OPT_OUT_NON_ESSENTIAL" != "1" ] || [ "$OPT_OUT_GROWTHBOOK" != "1" ]; then
+            echo "  Strict mode is on; opt-out env vars are not fully set. Residue"
+            echo "  will continue to be written on the ~60s refresh cadence."
+        fi
+    fi
+    if [ "${#RESIDUE_KEYS[@]}" -gt 0 ]; then
+        echo "  ${CLAUDE_JSON}:"
+        for k in "${RESIDUE_KEYS[@]}"; do
+            echo "    - $k"
+        done
+    fi
+    if [ "${#RESIDUE_FILES[@]}" -gt 0 ]; then
+        echo "  Cache files present:"
+        for f in "${RESIDUE_FILES[@]}"; do
+            echo "    - $f"
+        done
+    fi
+    if [ "$NEEDS_JQ_ADVISORY" = "1" ]; then
+        echo "  jq was not found on PATH. Install jq for the exact entry counts and"
+        echo "  for the idempotent cleanup command below."
+    fi
+    echo "  Cleanup (idempotent; safe to run repeatedly):"
+    if command -v jq >/dev/null 2>&1; then
+        echo "    jq 'del(.cachedGrowthBookFeatures, .cachedExperimentFeatures, .cachedStatsigGates)' \\"
+        echo "      \"$CLAUDE_JSON\" > \"$CLAUDE_JSON.tmp\" && mv \"$CLAUDE_JSON.tmp\" \"$CLAUDE_JSON\""
+    fi
+    if [ "${#RESIDUE_FILES[@]}" -gt 0 ]; then
+        for f in "${RESIDUE_FILES[@]}"; do
+            echo "    rm -- \"$f\""
+        done
+    fi
+    echo "  Background: Setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 and"
+    echo "  DISABLE_GROWTHBOOK=1 closes the channel for future sync but does not"
+    echo "  delete already-cached values. The runtime continues to read them on"
+    echo "  startup. Reference: https://github.com/anthropics/claude-code/issues/62061"
+    echo "  Silence after acknowledgment: export CC_CACHE_RESIDUE_DETECTOR_QUIET=1"
+} >&2
+
+exit 0

package/examples/cache-tier-logger.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+# cache-tier-logger.sh — cache TTL regression detector (Incident 1)
+# Why: March 2026 regression silently downgraded the prompt-cache TTL from 1h to
+#      5m (ephemeral_5m), causing cache re-creation every turn. Users saw quota
+#      burn at 4-5x without any client-side change. Issue #46829 (119,866-call
+#      dataset), #46917 (cache_creation inflation).
+# Event: PostToolUse  MATCHER: "*"
+# Action: Per tool call, inspect the PostToolUse payload for cache usage fields
+#         and append a TSV line to ~/.claude/logs/cache-tier.log.
+#
+# Review weekly with:
+#   awk -F'\t' '{print $4}' ~/.claude/logs/cache-tier.log | sort | uniq -c
+# Main-conversation turns should skew toward large cache_read_input_tokens
+# relative to cache_creation_input_tokens. A session where cache_creation
+# dominates every turn is the silent-downgrade signal.
+#
+# The registration was missing from this header. The installer reads TRIGGER
+# and MATCHER from here and falls back to PreToolUse / Bash when both are
+# absent, so this hook was being registered at a moment where the field it
+# reads is always empty: it installed, it appeared in the settings, and it
+# did nothing. Measured 2026-08-04 across examples/: 14 files were like this.
+# TRIGGER: PostToolUse
+# MATCHER: ""
+
+set -u
+
+LOG_DIR="${HOME}/.claude/logs"
+LOG_FILE="${LOG_DIR}/cache-tier.log"
+mkdir -p "$LOG_DIR" 2>/dev/null
+
+INPUT=$(cat)
+
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "unknown"' 2>/dev/null)
+TOOL_NAME=$(printf '%s' "$INPUT" | jq -r '.tool_name // "unknown"' 2>/dev/null)
+CACHE_READ=$(printf '%s' "$INPUT" | jq -r '.tool_response.usage.cache_read_input_tokens // empty' 2>/dev/null)
+CACHE_CREATE=$(printf '%s' "$INPUT" | jq -r '.tool_response.usage.cache_creation_input_tokens // empty' 2>/dev/null)
+
+# Fallback: when PostToolUse payload has no usage (most tools), read the last
+# assistant turn from the transcript. This is cheap — one tac|head|jq.
+if [ -z "$CACHE_READ" ] && [ -z "$CACHE_CREATE" ]; then
+  TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+  if [ -n "$TRANSCRIPT" ] && [ -r "$TRANSCRIPT" ]; then
+    LAST_USAGE=$(tac "$TRANSCRIPT" 2>/dev/null | grep -m1 '"usage"' || true)
+    if [ -n "$LAST_USAGE" ]; then
+      CACHE_READ=$(printf '%s' "$LAST_USAGE" | jq -r '.message.usage.cache_read_input_tokens // .usage.cache_read_input_tokens // empty' 2>/dev/null)
+      CACHE_CREATE=$(printf '%s' "$LAST_USAGE" | jq -r '.message.usage.cache_creation_input_tokens // .usage.cache_creation_input_tokens // empty' 2>/dev/null)
+    fi
+  fi
+fi
+
+CACHE_READ="${CACHE_READ:-0}"
+CACHE_CREATE="${CACHE_CREATE:-0}"
+
+# Infer tier: if a turn had cache reads, the prefix was still valid (tier hit).
+# If only creations, the previous prefix expired — this is the signal that
+# matters for TTL regression. ephemeral_5m burns creations every turn.
+if [ "$CACHE_READ" -gt 0 ] 2>/dev/null; then
+  TIER="cache_hit"
+elif [ "$CACHE_CREATE" -gt 0 ] 2>/dev/null; then
+  TIER="cache_miss"
+else
+  TIER="no_cache_data"
+fi
+
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+printf '%s\t%s\t%s\t%s\t%s\t%s\n' \
+  "$TS" "$SESSION_ID" "$TOOL_NAME" "$TIER" "$CACHE_READ" "$CACHE_CREATE" \
+  >> "$LOG_FILE"
+
+exit 0

package/examples/cache-ttl-eviction-detector.sh

@@ -0,0 +1,149 @@
+#!/bin/bash
+# cache-ttl-eviction-detector.sh — alert when long idle gaps cause prompt-cache TTL eviction
+#
+# Why: Anthropic quietly reduced the prompt-cache TTL from 60 minutes to 5 minutes
+#      sometime before 2026-05-30 (community report:
+#      https://www.reddit.com/r/ClaudeAI/comments/1tqx8q5/spent_1156308524_input_tokens_in_may_sharing_what/
+#      top comment, with 80+ thread responses corroborating).
+#      For operators with stable long-running sessions, this can silently 10x
+#      effective cost: any idle gap >5 minutes evicts the cache, forcing a fresh
+#      cache_creation on the next request that previously would have hit
+#      cache_read at ~1/10th the per-token price.
+#
+#      The existing cache-creation-drift-detector.sh catches per-request
+#      inflation but does not correlate to inter-request time gaps. This hook
+#      tracks the gap between consecutive PostToolUse events and warns when
+#      a >5-minute gap is followed by a request that does NOT achieve the
+#      expected cache hit (cache_read_input_tokens below a configurable
+#      fraction of total input).
+#
+# Event: PostToolUse  MATCHER: "" (all tools)
+# Action: On each event, read cache_read_input_tokens, cache_creation_input_tokens,
+#         and input_tokens from the payload (with transcript fallback). Track the
+#         elapsed time since the previous event in a small state file. When the
+#         gap exceeds CC_TTL_EVICT_GAP_SECONDS (default 300 = 5 minutes) AND
+#         the post-gap event shows a low cache hit ratio
+#         (cache_read / (cache_read + cache_creation) < CC_TTL_EVICT_HIT_FLOOR,
+#         default 0.50), emit a one-line stderr advisory. Advisory only.
+#
+# Configuration (all optional):
+#   CC_TTL_EVICT_STATE         State file (default: ~/.cache/cc-safe-setup/cache-ttl-state.json)
+#   CC_TTL_EVICT_LOG           Event log (default: ~/.cache/cc-safe-setup/cache-ttl-evictions.jsonl)
+#   CC_TTL_EVICT_GAP_SECONDS   Idle gap that triggers the check (default: 300 = 5 min)
+#   CC_TTL_EVICT_HIT_FLOOR     Minimum cache-hit ratio expected post-gap (default: 0.50)
+#   CC_TTL_EVICT_SILENT        Set to "1" to suppress stderr (still logs)
+#
+# Inspect the log:
+#   tail -50 ~/.cache/cc-safe-setup/cache-ttl-evictions.jsonl
+#   jq -s 'length' ~/.cache/cc-safe-setup/cache-ttl-evictions.jsonl     # total evictions seen
+#
+# The registration was missing from this header. The installer reads TRIGGER
+# and MATCHER from here and falls back to PreToolUse / Bash when both are
+# absent, so this hook was being registered at a moment where the field it
+# reads is always empty: it installed, it appeared in the settings, and it
+# did nothing. Measured 2026-08-04 across examples/: 14 files were like this.
+# TRIGGER: PostToolUse
+# MATCHER: ""
+
+set -u
+
+STATE="${CC_TTL_EVICT_STATE:-${HOME}/.cache/cc-safe-setup/cache-ttl-state.json}"
+LOG="${CC_TTL_EVICT_LOG:-${HOME}/.cache/cc-safe-setup/cache-ttl-evictions.jsonl}"
+GAP_SECONDS="${CC_TTL_EVICT_GAP_SECONDS:-300}"
+HIT_FLOOR="${CC_TTL_EVICT_HIT_FLOOR:-0.50}"
+SILENT="${CC_TTL_EVICT_SILENT:-0}"
+
+mkdir -p "$(dirname "$STATE")" 2>/dev/null
+
+INPUT=$(cat)
+
+# Helper: extract a numeric usage field from the payload or transcript fallback.
+extract_usage() {
+  local field="$1"
+  local value
+  value=$(printf '%s' "$INPUT" | jq -r ".tool_response.usage.${field} // empty" 2>/dev/null)
+  if [ -z "$value" ] || [ "$value" = "null" ]; then
+    local transcript
+    transcript=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+    if [ -n "$transcript" ] && [ -r "$transcript" ]; then
+      local last_usage
+      last_usage=$(tac "$transcript" 2>/dev/null | grep -m1 '"usage"' || true)
+      if [ -n "$last_usage" ]; then
+        value=$(printf '%s' "$last_usage" | \
+          jq -r ".message.usage.${field} // .usage.${field} // empty" 2>/dev/null)
+      fi
+    fi
+  fi
+  case "$value" in
+    ''|null|*[!0-9]*) echo "0" ;;
+    *) echo "$value" ;;
+  esac
+}
+
+CACHE_READ=$(extract_usage "cache_read_input_tokens")
+CACHE_CREATION=$(extract_usage "cache_creation_input_tokens")
+
+# No measurement at all — nothing to track. Exit quietly.
+if [ "$CACHE_READ" = "0" ] && [ "$CACHE_CREATION" = "0" ]; then
+  exit 0
+fi
+
+NOW=$(date -u +%s)
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "unknown"' 2>/dev/null)
+
+# Load previous state (last event timestamp + session).
+PREV_TS=""
+PREV_SESSION=""
+if [ -r "$STATE" ]; then
+  PREV_TS=$(jq -r '.last_event_ts // empty' < "$STATE" 2>/dev/null)
+  PREV_SESSION=$(jq -r '.last_session // empty' < "$STATE" 2>/dev/null)
+fi
+
+# Write current state immediately so we don't lose it if downstream code errors.
+printf '{"last_event_ts":%s,"last_session":"%s"}\n' "$NOW" "$SESSION_ID" > "$STATE"
+
+# Only evaluate gap if we have a previous timestamp AND the session matches.
+# Cross-session gaps are not necessarily TTL eviction — session boundary itself
+# rebuilds the cache prefix, so we'd produce false positives.
+if [ -z "$PREV_TS" ] || [ "$PREV_SESSION" != "$SESSION_ID" ]; then
+  exit 0
+fi
+
+# Validate prev_ts is an integer (defensive).
+case "$PREV_TS" in
+  ''|*[!0-9]*) exit 0 ;;
+esac
+
+GAP=$((NOW - PREV_TS))
+
+# Gap not long enough to be TTL eviction — exit quietly.
+if [ "$GAP" -lt "$GAP_SECONDS" ]; then
+  exit 0
+fi
+
+# Gap is long enough. Now check the cache hit ratio of this event.
+# Ratio = cache_read / (cache_read + cache_creation).
+# When TTL has evicted the cache, cache_read goes to ~0 and cache_creation spikes.
+HIT_RATIO=$(awk -v r="$CACHE_READ" -v c="$CACHE_CREATION" \
+  'BEGIN { tot = r + c; if (tot > 0) printf "%.4f", r/tot; else print "0" }')
+
+# Compare against floor.
+EXCEEDS=$(awk -v h="$HIT_RATIO" -v f="$HIT_FLOOR" 'BEGIN { print (h < f) ? 1 : 0 }')
+
+if [ "$EXCEEDS" = "1" ]; then
+  # Log the eviction.
+  TS_ISO=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  printf '{"ts":"%s","session":"%s","gap_seconds":%d,"cache_read":%s,"cache_creation":%s,"hit_ratio":%s}\n' \
+    "$TS_ISO" "$SESSION_ID" "$GAP" "$CACHE_READ" "$CACHE_CREATION" "$HIT_RATIO" >> "$LOG"
+
+  if [ "$SILENT" != "1" ]; then
+    GAP_MIN=$(awk -v g="$GAP" 'BEGIN { printf "%.1f", g/60 }')
+    HIT_PCT=$(awk -v h="$HIT_RATIO" 'BEGIN { printf "%d", h*100 }')
+    echo "NOTICE: probable prompt-cache TTL eviction. ${GAP_MIN}-minute idle gap followed by ${HIT_PCT}% cache-hit ratio (floor=${HIT_FLOOR})." >&2
+    echo "        Anthropic reduced cache TTL from 60min to 5min (community report 2026-05-30)." >&2
+    echo "        Mitigation: avoid >5min idle gaps between requests, or accept the per-eviction recreation cost." >&2
+    echo "        Eviction log: ${LOG}" >&2
+  fi
+fi
+
+exit 0

package/examples/cargo-publish-guard.sh

@@ -1,5 +1,18 @@
+#!/bin/bash
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-cargo-publish-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [cargo-publish-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0

package/examples/case-insensitive-path-guard.sh

@@ -19,6 +19,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-case-insensitive-path-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [case-insensitive-path-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
@@ -37,12 +49,19 @@ TARGETS=""
 
 # rm: all non-flag arguments
 if echo "$COMMAND" | grep -qE '\brm\s'; then
-    TARGETS=$(echo "$COMMAND" | grep -oP '\brm\s+(-[a-zA-Z]+\s+)*\K[^\s;&|]+(\s+[^\s;&|]+)*' 2>/dev/null || true)
+    # -P は GNU 拡張。BSD grep では TARGETS が空になり検査が消える。
+    # このフックも case-insensitive なファイルシステム向けなので、発火する環境が
+    # まさに -P の無い環境。手元では発火させられないため構造の是正として直す。
+    TARGETS=$(echo "$COMMAND" \
+        | grep -oE '(^|[^A-Za-z0-9_])rm[[:space:]]+(-[a-zA-Z]+[[:space:]]+)*[^[:space:];&|]+([[:space:]]+[^[:space:];&|]+)*' 2>/dev/null \
+        | sed -E 's/^[^A-Za-z0-9_]?rm[[:space:]]+(-[a-zA-Z]+[[:space:]]+)*//' || true)
 fi
 
 # mv: first non-flag argument (source)
 if echo "$COMMAND" | grep -qE '\bmv\s'; then
-    MV_TARGET=$(echo "$COMMAND" | grep -oP '\bmv\s+(-[a-zA-Z]+\s+)*\K\S+' 2>/dev/null || true)
+    MV_TARGET=$(echo "$COMMAND" \
+        | grep -oE '(^|[^A-Za-z0-9_])mv[[:space:]]+(-[a-zA-Z]+[[:space:]]+)*[^[:space:]]+' 2>/dev/null \
+        | sed -E 's/^[^A-Za-z0-9_]?mv[[:space:]]+(-[a-zA-Z]+[[:space:]]+)*//' || true)
     TARGETS="$TARGETS $MV_TARGET"
 fi
 

package/examples/case-sensitive-guard.sh

@@ -34,6 +34,18 @@
 #   4. Block if collision detected
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-case-sensitive-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [case-sensitive-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
@@ -49,9 +61,18 @@ fi
 # Extract the target path
 TARGET=""
 if echo "$COMMAND" | grep -qE '^\s*mkdir'; then
-    TARGET=$(echo "$COMMAND" | grep -oP 'mkdir\s+(-p\s+)?\K\S+' | tail -1)
+    # -P は GNU 拡張。BSD grep では TARGET が空になり、下の「空なら exit 0」で検査が消える。
+    # このフックは case-insensitive なファイルシステムでしか発火しない設計なので、
+    # 発火する環境（macOS / Windows）がまさに -P の無い環境にあたる。
+    # 手元の case-sensitive な Linux では発火させて確かめられないため、
+    # 実測ではなく構造の是正として直している。
+    TARGET=$(echo "$COMMAND" \
+        | grep -oE 'mkdir[[:space:]]+(-p[[:space:]]+)?[^[:space:]]+' \
+        | sed -E 's/^mkdir[[:space:]]+(-p[[:space:]]+)?//' | tail -1)
 elif echo "$COMMAND" | grep -qE '^\s*rm\s'; then
-    TARGET=$(echo "$COMMAND" | grep -oP 'rm\s+(-[rf]+\s+)*\K\S+' | tail -1)
+    TARGET=$(echo "$COMMAND" \
+        | grep -oE 'rm[[:space:]]+(-[rf]+[[:space:]]+)*[^[:space:]]+' \
+        | sed -E 's/^rm[[:space:]]+(-[rf]+[[:space:]]+)*//' | tail -1)
 fi
 
 if [[ -z "$TARGET" ]]; then

package/examples/cch-sentinel-precommit-guard.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# cch-sentinel-precommit-guard.sh — native sentinel content guard (Incident 3)
+# Why: The standalone Bun Claude Code binary substitutes the literal string
+#      `cch=00000` at the native layer — below anything the JavaScript hook
+#      surface can intercept. Committing the literal into a file Claude reads
+#      triggers cache invalidation patterns and a 10-20x cost multiplier on
+#      affected sessions. This guard refuses the commit before the string
+#      ever reaches Claude's working set.
+# Event: git pre-commit (NOT a Claude Code hook)
+# Install:
+#   cp examples/cch-sentinel-precommit-guard.sh .git/hooks/pre-commit
+#   chmod +x .git/hooks/pre-commit
+# Or, to combine with existing pre-commit logic:
+#   append `bash path/to/cch-sentinel-precommit-guard.sh || exit 1` to your
+#   existing .git/hooks/pre-commit.
+#
+# False positive: documentation that writes ABOUT the sentinel bug will trip
+# this guard. Bypass via `git commit --no-verify` once, or exclude docs paths:
+#   CCH_ALLOW_PATHS="docs/|README" bash .git/hooks/pre-commit
+
+set -u
+
+# Allow opt-out for docs that discuss the bug (the Postmortems book itself
+# needs this escape hatch).
+ALLOW_PATHS="${CCH_ALLOW_PATHS:-}"
+
+if [ -n "$ALLOW_PATHS" ]; then
+  # Check only files that do not match the allowlist regex.
+  FILES_TO_CHECK=$(git diff --cached --name-only | grep -Ev "$ALLOW_PATHS" || true)
+  if [ -z "$FILES_TO_CHECK" ]; then
+    exit 0
+  fi
+  MATCH=$(git diff --cached -- $FILES_TO_CHECK 2>/dev/null | grep -n 'cch=00000' || true)
+else
+  MATCH=$(git diff --cached 2>/dev/null | grep -n 'cch=00000' || true)
+fi
+
+if [ -n "$MATCH" ]; then
+  echo "refusing commit: literal cch=00000 found in staged diff" >&2
+  echo "this string triggers native sentinel substitution in the Bun Claude Code binary" >&2
+  echo "see cc-safe-setup Incident 3 or set CCH_ALLOW_PATHS for documentation writes" >&2
+  echo "--- matching lines ---" >&2
+  printf '%s\n' "$MATCH" | head -5 >&2
+  exit 1
+fi
+
+exit 0

package/examples/check-abort-controller.sh

@@ -3,5 +3,5 @@
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 CONTENT=$(cat | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)
 [ -z "$CONTENT" ] && exit 0
-echo "NOTE: Warn on fetch without AbortController" >&2
+echo "$CONTENT" | grep -qE "fetch\(" && ! echo "$CONTENT" | grep -qE "AbortController|signal:" && echo "NOTE: fetch() without AbortController/signal — the request cannot be cancelled" >&2
 exit 0

package/examples/check-before-act-enforcer.sh

@@ -17,6 +17,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-check-before-act-enforcer-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [check-before-act-enforcer]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 

package/examples/check-debounce.sh

@@ -3,5 +3,5 @@
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 CONTENT=$(cat | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)
 [ -z "$CONTENT" ] && exit 0
-echo "NOTE: Warn on rapid event handlers without debounce" >&2
+echo "$CONTENT" | grep -qE "addEventListener\((['\"])(scroll|resize|mousemove|wheel|drag|input)" && ! echo "$CONTENT" | grep -qE "debounce|throttle" && echo "NOTE: high-frequency event listener without debounce/throttle" >&2
 exit 0

package/examples/check-error-class.sh

@@ -3,5 +3,5 @@
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 CONTENT=$(cat | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)
 [ -z "$CONTENT" ] && exit 0
-echo "NOTE: Warn on throwing non-Error objects" >&2
+echo "$CONTENT" | grep -qE "throw +['\"]" && echo "NOTE: throwing a string literal — use throw new Error(...) to preserve the stack" >&2
 exit 0

package/examples/check-error-logging.sh

@@ -3,5 +3,5 @@
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 CONTENT=$(cat | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)
 [ -z "$CONTENT" ] && exit 0
-echo "NOTE: Warn on missing error logging" >&2
+echo "$CONTENT" | grep -qE "catch *\(" && ! echo "$CONTENT" | grep -qE "console|log|logger|captureException|report" && echo "NOTE: catch block without any logging" >&2
 exit 0