cc-safe-setup 29.8.0 → 30.0.4

package/examples/forbidden-response-phrase-detector.sh

@@ -0,0 +1,161 @@
+#!/bin/bash
+# forbidden-response-phrase-detector.sh — Detect operator-declared forbidden
+# phrases in the assistant's final response.
+#
+# Solves: response-layer recognition-without-arrest where a CLAUDE.md rule
+#   prohibiting specific opening or filler phrases is acknowledged by the
+#   model and then violated on the next turn (issue #60339).
+#
+# How it works: Stop hook that reads the operator's CLAUDE.md, extracts
+#   forbidden response phrases from three operator-natural formats, and
+#   checks whether the final assistant response contains any of them. The
+#   model's articulation of the rule is no longer load-bearing because the
+#   hook reads the rule directly and enforces it at response finalisation.
+#
+# How prohibitions are declared in CLAUDE.md
+# The hook accepts three operator-natural formats. Forbidden phrases must
+# be inside backticks (or smart quotes) for unambiguous extraction. The
+# match is case-insensitive against the response text by default.
+#
+#   Format 1 — inline prose:
+#     Do NOT open replies with `You're right` or `Great point`.
+#     never say `I apologize` in responses.
+#
+#   Format 2 — Japanese prose:
+#     `了解しました` を返信の冒頭で使うな
+#     `はい、その通りです` の使用は禁止
+#
+#   Format 3 — list under a "Forbidden Response Phrases" / 禁止 header:
+#     ## Forbidden Response Phrases
+#     - `You're right`
+#     - `Great point`
+#     - `I apologize`
+#
+# TRIGGER: Stop
+# MATCHER: ""
+#
+# Configuration:
+#   CC_FORBIDDEN_PHRASE_DISABLE=1   Disable the hook entirely.
+#   CC_FORBIDDEN_PHRASE_BLOCK=1     Exit non-zero (exit 2) on match. Default:
+#                                   advisory (warn to stderr, exit 0).
+#   CC_FORBIDDEN_PHRASE_OPEN_ONLY=1 Only check the first 200 chars of the
+#                                   response (filler-phrase pattern).
+#   CC_CLAUDEMD_PATH=/path          Override CLAUDE.md search path.
+#   CC_FORBIDDEN_PHRASE_CASE_SENSITIVE=1  Case-sensitive match. Default off.
+
+set -u
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-forbidden-response-phrase-detector-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [forbidden-response-phrase-detector]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_FORBIDDEN_PHRASE_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat)
+
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+[ -z "$TRANSCRIPT" ] && exit 0
+[ ! -r "$TRANSCRIPT" ] && exit 0
+
+# Extract the last assistant response from the transcript.
+LAST_ASSISTANT=$(tac "$TRANSCRIPT" 2>/dev/null | grep -m1 '"role":"assistant"' || true)
+[ -z "$LAST_ASSISTANT" ] && exit 0
+
+RESPONSE_TEXT=$(printf '%s' "$LAST_ASSISTANT" | jq -r '
+  if .message.content then
+    (.message.content | if type == "array" then map(select(.type == "text") | .text) | join("\n") else . end)
+  elif .content then
+    (.content | if type == "array" then map(select(.type == "text") | .text) | join("\n") else . end)
+  else
+    empty
+  end
+' 2>/dev/null)
+
+[ -z "$RESPONSE_TEXT" ] && exit 0
+
+# Find CLAUDE.md.
+CLAUDEMD=""
+if [ -n "${CC_CLAUDEMD_PATH:-}" ] && [ -r "$CC_CLAUDEMD_PATH" ]; then
+    CLAUDEMD="$CC_CLAUDEMD_PATH"
+else
+    for candidate in "CLAUDE.md" ".claude/CLAUDE.md" "../CLAUDE.md" "$HOME/.claude/CLAUDE.md"; do
+        if [ -r "$candidate" ]; then
+            CLAUDEMD="$candidate"
+            break
+        fi
+    done
+fi
+[ -z "$CLAUDEMD" ] && exit 0
+
+# Extract forbidden phrases.
+FORBIDDEN_LIST=""
+
+# Pass 1: prose prohibitions referring to response/reply behaviour
+PROSE=$(grep -iE '(do[ -]not (open|start|begin|use|say)|never (say|use|open|begin)|を返信|を使うな|の使用は禁止|返信の冒頭|filler|opening)' "$CLAUDEMD" 2>/dev/null || true)
+if [ -n "$PROSE" ]; then
+    # Extract backtick-quoted phrases (single backtick form) and curly quotes
+    EXTRACTED=$(printf '%s\n' "$PROSE" | grep -oE '`[^`]+`|"[^"]+"' 2>/dev/null | sed -e 's/^`//' -e 's/`$//' -e 's/^"//' -e 's/"$//' | sort -u || true)
+    if [ -n "$EXTRACTED" ]; then
+        FORBIDDEN_LIST="$EXTRACTED"
+    fi
+fi
+
+# Pass 2: list items under "Forbidden Response Phrases" / "Forbidden Phrases" / 禁止 headers
+HEADER_LINES=$(grep -inE '^#+ +(forbidden (response )?phrases|forbidden replies|prohibited (response )?phrases|filler phrases|禁止する応答|応答の禁止)' "$CLAUDEMD" 2>/dev/null | cut -d: -f1 || true)
+if [ -n "$HEADER_LINES" ]; then
+    for ln in $HEADER_LINES; do
+        SECTION=$(sed -n "${ln},$((ln+20))p" "$CLAUDEMD" 2>/dev/null || true)
+        ITEMS=$(printf '%s\n' "$SECTION" | grep -E '^[ ]*[-*] +`[^`]+`' 2>/dev/null | grep -oE '`[^`]+`' | sed 's/`//g' || true)
+        if [ -n "$ITEMS" ]; then
+            FORBIDDEN_LIST="${FORBIDDEN_LIST}${FORBIDDEN_LIST:+$'\n'}${ITEMS}"
+        fi
+    done
+fi
+
+[ -z "$FORBIDDEN_LIST" ] && exit 0
+
+FORBIDDEN_LIST=$(printf '%s\n' "$FORBIDDEN_LIST" | sort -u)
+
+# Decide scope.
+if [ "${CC_FORBIDDEN_PHRASE_OPEN_ONLY:-0}" = "1" ]; then
+    SCOPE=$(printf '%s' "$RESPONSE_TEXT" | head -c 200)
+else
+    SCOPE="$RESPONSE_TEXT"
+fi
+
+# Match each phrase.
+VIOLATIONS=""
+GREP_FLAGS="-F"
+if [ "${CC_FORBIDDEN_PHRASE_CASE_SENSITIVE:-0}" != "1" ]; then
+    GREP_FLAGS="${GREP_FLAGS}i"
+fi
+
+while IFS= read -r phrase; do
+    [ -z "$phrase" ] && continue
+    if printf '%s' "$SCOPE" | grep -q $GREP_FLAGS -- "$phrase" 2>/dev/null; then
+        VIOLATIONS="${VIOLATIONS}${VIOLATIONS:+$'\n'}${phrase}"
+    fi
+done <<< "$FORBIDDEN_LIST"
+
+[ -z "$VIOLATIONS" ] && exit 0
+
+# Emit warning.
+echo "⚠ forbidden-response-phrase-detector: assistant response contained phrases prohibited by $CLAUDEMD:" >&2
+printf '%s\n' "$VIOLATIONS" | while IFS= read -r line; do
+    [ -n "$line" ] && echo "  - \"$line\"" >&2
+done
+echo "  See issue #60339 for the failure shape (CLAUDE.md rule re-violated immediately after correction)." >&2
+
+if [ "${CC_FORBIDDEN_PHRASE_BLOCK:-0}" = "1" ]; then
+    exit 2
+fi
+
+exit 0

package/examples/gem-push-guard.sh

@@ -1,5 +1,18 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-gem-push-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [gem-push-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0

package/examples/gh-cli-destructive-guard.sh

@@ -10,7 +10,19 @@
 # The gh CLI is powerful but destructive operations should require
 # explicit human approval, not AI autonomy.
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-gh-cli-destructive-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [gh-cli-destructive-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

package/examples/git-checkout-safety-guard.sh

@@ -26,6 +26,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-checkout-safety-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-checkout-safety-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/git-checkout-uncommitted-guard.sh

@@ -23,6 +23,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-checkout-uncommitted-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-checkout-uncommitted-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/git-config-guard.sh

@@ -17,6 +17,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-config-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-config-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/git-crypt-worktree-guard.sh

@@ -14,6 +14,18 @@
 # MATCHER: "Bash"
 
 set -euo pipefail
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-crypt-worktree-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-crypt-worktree-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

package/examples/git-filter-repo-guard.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# git-filter-repo-guard.sh — Block git history rewriting tools
+#
+# Solves: Issue #45893 where `git filter-repo --force` destroyed production
+#         files by rewriting repository history. These tools permanently
+#         alter commit objects and can cause irreversible data loss.
+#
+# Detects:
+#   git filter-repo    (modern history rewriter, any arguments)
+#   git filter-branch  (legacy history rewriter, any arguments)
+#   bfg                (BFG Repo-Cleaner, third-party history rewriter)
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-filter-repo-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-filter-repo-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# Block git filter-repo (any arguments)
+if echo "$COMMAND" | grep -qE '\bgit\s+filter-repo\b'; then
+    echo "BLOCKED: git filter-repo rewrites repository history (see #45893)." >&2
+    echo "  This command destroyed production files in a real incident." >&2
+    echo "  History rewriting is irreversible and breaks all clones." >&2
+    exit 2
+fi
+
+# Block git filter-branch (legacy equivalent)
+if echo "$COMMAND" | grep -qE '\bgit\s+filter-branch\b'; then
+    echo "BLOCKED: git filter-branch rewrites repository history (see #45893)." >&2
+    echo "  Legacy history rewriter — same risks as filter-repo." >&2
+    echo "  History rewriting is irreversible and breaks all clones." >&2
+    exit 2
+fi
+
+# Block BFG Repo-Cleaner
+if echo "$COMMAND" | grep -qE '\bbfg\b'; then
+    echo "BLOCKED: BFG Repo-Cleaner rewrites repository history (see #45893)." >&2
+    echo "  Third-party tool with the same risks as git filter-repo." >&2
+    echo "  History rewriting is irreversible and breaks all clones." >&2
+    exit 2
+fi
+
+exit 0

package/examples/git-history-rewrite-guard.sh

@@ -20,6 +20,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-history-rewrite-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-history-rewrite-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/git-maintenance-guard.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+# ================================================================
+# git-maintenance-guard.sh — Block automatic git maintenance
+# ================================================================
+# PURPOSE:
+#   Claude Code, Codex, and parallel subagents sometimes run
+#   git gc / git repack / git maintenance / git prune on their own.
+#   When these run concurrently in the same repo, lock contention
+#   leaves stale .git/objects/pack/tmp_pack_* files behind. Past
+#   incident: 1,350 tmp_pack_* / 144 GiB filled the WSL ext4.vhdx.
+#
+#   This hook blocks those maintenance commands at PreToolUse. The
+#   user can still run them manually by setting CC_GIT_MAINTENANCE_ALLOW=1
+#   for that single command.
+#
+# Detects:
+#   git gc                      (any args)
+#   git repack                  (any args)
+#   git maintenance run         (any args, including 'start' / 'stop')
+#   git prune                   (any args)
+#   git gc --auto               (also blocked: still triggers repack)
+#
+# Does NOT block:
+#   git gc --prune=now          (still blocked — prune is the risky part)
+#   read-only inspection: git count-objects, git fsck, git verify-pack
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+#
+# CONFIG:
+#   CC_GIT_MAINTENANCE_ALLOW=1   one-shot override
+#   CC_GIT_MAINTENANCE_DISABLE=1 disable this hook entirely
+# ================================================================
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-maintenance-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-maintenance-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_GIT_MAINTENANCE_DISABLE:-0}" = "1" ] && exit 0
+[ "${CC_GIT_MAINTENANCE_ALLOW:-0}" = "1" ] && exit 0
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# git gc (any args)
+if echo "$COMMAND" | grep -qE '(^|[^a-zA-Z0-9._-])git[[:space:]]+gc([[:space:]]|$)'; then
+    echo "BLOCKED: git gc can leave stale tmp_pack_* under parallel access." >&2
+    echo "  Past incident: 1,350 tmp_pack_* / 144 GiB filled the WSL ext4.vhdx." >&2
+    echo "  Override (one shot): CC_GIT_MAINTENANCE_ALLOW=1 git gc ..." >&2
+    exit 2
+fi
+
+# git repack (any args)
+if echo "$COMMAND" | grep -qE '(^|[^a-zA-Z0-9._-])git[[:space:]]+repack([[:space:]]|$)'; then
+    echo "BLOCKED: git repack can leave stale tmp_pack_* under parallel access." >&2
+    echo "  Override (one shot): CC_GIT_MAINTENANCE_ALLOW=1 git repack ..." >&2
+    exit 2
+fi
+
+# git maintenance (run / start / stop / register / unregister)
+if echo "$COMMAND" | grep -qE '(^|[^a-zA-Z0-9._-])git[[:space:]]+maintenance([[:space:]]|$)'; then
+    echo "BLOCKED: git maintenance schedules background gc/repack — same risk." >&2
+    echo "  Override (one shot): CC_GIT_MAINTENANCE_ALLOW=1 git maintenance ..." >&2
+    exit 2
+fi
+
+# git prune (any args). git prune-packed is also caught here, intentionally.
+if echo "$COMMAND" | grep -qE '(^|[^a-zA-Z0-9._-])git[[:space:]]+prune([[:space:]-]|$)'; then
+    echo "BLOCKED: git prune removes unreachable objects. Skip unless investigating manually." >&2
+    echo "  Override (one shot): CC_GIT_MAINTENANCE_ALLOW=1 git prune ..." >&2
+    exit 2
+fi
+
+exit 0

package/examples/git-operations-require-approval.sh

@@ -8,27 +8,64 @@
 #   user approval. This hook enforces the restriction at process level.
 #
 # Blocks:
-#   git commit, git push (including --force), git checkout -b,
-#   git switch -c, git branch <name>
+#   git commit, git push (including --force and `git send-pack`),
+#   git checkout -b, git switch -c, git branch <name> - including when
+#   they arrive with git's own global options in front, such as
+#   `git -C <dir> push` or `git --git-dir=<path> commit` (#1117).
 #
 # Does NOT block:
 #   git status, git log, git diff, git show, git branch (list),
 #   git fetch, git stash, git add
 #
-# Handles compound commands (&&, ;, ||) by checking each segment.
+# Handles compound commands (&&, ;, ||, |) by checking each segment.
 #
 # See: https://github.com/anthropics/claude-code/issues/40695
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-operations-require-approval-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-operations-require-approval]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
 [ -z "$COMMAND" ] && exit 0
 
-# Skip if the command is inside echo/printf (not actual execution)
-echo "$COMMAND" | grep -qE '^\s*(echo|printf)\s' && exit 0
+# git accepts global options between `git` and the subcommand, so matching the
+# two as adjacent words misses every one of these real shapes (reported in #1117
+# with four working examples):
+#     git -C /tmp/repo push --force origin main
+#     git --git-dir=/tmp/r/repo.d push origin main
+#     git -c user.name=x commit -m x
+#     git send-pack origin main
+# GIT_OPT is the set of options git itself accepts before a subcommand.
+GIT_OPT='(-[cC][[:space:]]+[^[:space:]]+|--(git-dir|work-tree|namespace|exec-path|config-env|attr-source|super-prefix)(=[^[:space:]]+|[[:space:]]+[^[:space:]]+)|-[pP]|--(paginate|no-pager|bare|no-replace-objects|literal-pathspecs|glob-pathspecs|noglob-pathspecs|icase-pathspecs|no-optional-locks|no-lazy-fetch|no-advice))'
+
+# `git` at a command position, not the `git` inside a path. The old pattern
+# matched `git --git-dir=/tmp/r/.git push` only because the *path* ended in
+# `.git`, and let the same command through when the git-dir was named anything
+# else (#1117). Quotes are allowed on purpose: `bash -c "git push ..."` runs.
+GIT_HEAD='(^|[[:space:];&|(]|/|"|'"'"')git'
+
+# Build "git [global options] <subcommand>" for one subcommand pattern.
+git_re() {
+    printf '%s([[:space:]]+%s)*[[:space:]]+%s' "$GIT_HEAD" "$GIT_OPT" "$1"
+}
+
+# Read-only front halves that mention a command without running it.
+# This list is a guess about how people write, not a rule - `sed -i` and any
+# wrapper not named here will still be inspected.
+READ_ONLY_RE='^[[:space:]]*(echo|printf|grep|rg|cat|less|head|tail)[[:space:]]'
 
 # Check each segment of compound commands
 check_segment() {
@@ -37,8 +74,12 @@ check_segment() {
     seg=$(echo "$seg" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
     [ -z "$seg" ] && return 0
 
+    # Exempt only THIS segment. Applying it to the whole command let
+    # `echo hi && git push origin main` through completely.
+    echo "$seg" | grep -qE "$READ_ONLY_RE" && return 0
+
     # git commit
-    if echo "$seg" | grep -qE '\bgit\s+commit\b'; then
+    if echo "$seg" | grep -qE "$(git_re 'commit\b')|${GIT_HEAD}-commit\b"; then
         echo "BLOCKED: git commit requires explicit user approval." >&2
         echo "Command: $seg" >&2
         echo "" >&2
@@ -47,7 +88,7 @@ check_segment() {
     fi
 
     # git push (including force variants)
-    if echo "$seg" | grep -qE '\bgit\s+push\b'; then
+    if echo "$seg" | grep -qE "$(git_re '(push|send-pack)\b')|${GIT_HEAD}-(push|send-pack)\b"; then
         echo "BLOCKED: git push requires explicit user approval." >&2
         echo "Command: $seg" >&2
         echo "" >&2
@@ -56,14 +97,14 @@ check_segment() {
     fi
 
     # git checkout -b (branch creation)
-    if echo "$seg" | grep -qE '\bgit\s+checkout\s+(-b|--branch)\b'; then
+    if echo "$seg" | grep -qE "$(git_re 'checkout[[:space:]]+(-b|--branch)\b')"; then
         echo "BLOCKED: git branch creation requires explicit user approval." >&2
         echo "Command: $seg" >&2
         return 1
     fi
 
     # git switch -c / --create (branch creation)
-    if echo "$seg" | grep -qE '\bgit\s+switch\s+(-c|--create)\b'; then
+    if echo "$seg" | grep -qE "$(git_re 'switch[[:space:]]+(-c|--create)\b')"; then
         echo "BLOCKED: git branch creation requires explicit user approval." >&2
         echo "Command: $seg" >&2
         return 1
@@ -71,14 +112,17 @@ check_segment() {
 
     # git branch <name> (creation, not listing)
     # git branch without flags or with only -a/-r/-l/--list is listing
-    if echo "$seg" | grep -qE '\bgit\s+branch\s'; then
+    if echo "$seg" | grep -qE "$(git_re 'branch[[:space:]]')"; then
         # Allow listing flags
-        if echo "$seg" | grep -qE '\bgit\s+branch\s+(-[arl]|--list|--merged|--no-merged|--contains|-v|--verbose|-d|--delete|-D)\b'; then
+        if echo "$seg" | grep -qE "$(git_re 'branch[[:space:]]+(-[arl]|--list|--merged|--no-merged|--contains|-v|--verbose|-d|--delete|-D)\b')"; then
             return 0
         fi
         # If it has a name argument after "git branch", it's creation
         local args
-        args=$(echo "$seg" | sed 's/.*\bgit\s\+branch\s\+//')
+        # The old sed required `git` and `branch` to be adjacent; with a
+        # global option in between it stripped nothing and every listing form
+        # looked like a creation. Strip up to the subcommand instead.
+        args=$(echo "$seg" | sed -E 's/.*[[:space:]]branch[[:space:]]+//')
         if [ -n "$args" ] && ! echo "$args" | grep -qE '^\s*$'; then
             echo "BLOCKED: git branch creation requires explicit user approval." >&2
             echo "Command: $seg" >&2
@@ -89,11 +133,21 @@ check_segment() {
     return 0
 }
 
-# Split on && ; || and check each part
+# Split on && ; || | and check each part.
+#
+# A single `|` is a separator too. Without it, a read-only command piped into
+# a git write arrives as ONE segment whose first word is the reader, and
+# READ_ONLY_RE above exempts that whole segment - so the git write on the
+# right-hand side of the pipe is never examined. Measured on the published
+# file 2026-09-15: four piped shapes exited 0 while the same git operations
+# exited 2 when written plainly.
+#
+# `||` is already turned into newlines by the rule before this one, so the
+# single-pipe rule only ever sees real single pipes.
 while IFS= read -r segment; do
     if ! check_segment "$segment"; then
         exit 2
     fi
-done < <(echo "$COMMAND" | sed 's/&&/\n/g; s/;/\n/g; s/||/\n/g')
+done < <(echo "$COMMAND" | sed 's/&&/\n/g; s/;/\n/g; s/||/\n/g; s/|/\n/g')
 
 exit 0