cc-safe-setup 29.8.0 → 30.0.4

package/examples/long-session-malformed-tool-call-detector.sh

@@ -0,0 +1,183 @@
+#!/bin/bash
+# ================================================================
+# long-session-malformed-tool-call-detector.sh — Warn when a
+#   "malformed and could not be parsed" marker is detected in the
+#   trailing transcript window, surfacing sub-pattern 12A
+#   (in-context few-shot poisoning) before the operator hits the
+#   "retry also failed" terminal state.
+# ================================================================
+# PURPOSE:
+#   Issue #62344 documents that in a long-running Claude Code
+#   session, once one malformed tool call (e.g. a bare
+#   `<invoke name="Bash">...</invoke>` with no enclosing
+#   `function_calls` wrapper) lands in conversation history,
+#   the model anchors on it as in-context few-shot and
+#   subsequent same-type tool calls reproduce the broken format
+#   deterministically. Self-correction prompts do not recover;
+#   only `/clear` (a fresh session with no poisoned history)
+#   restores correct behavior. The reporter observed 4
+#   consecutive retries all failing identically.
+#
+#   The harness reports "malformed and could not be parsed" each
+#   time. The operator-visible signal is buried in the assistant
+#   turn surface; the structural recurrence is invisible until
+#   the operator notices the pattern. By then the session may
+#   have accumulated significant context that `/clear` will
+#   discard.
+#
+#   This PostToolUse hook scans the trailing window of the
+#   transcript for the marker substring and emits a one-screen
+#   advisory naming the sub-pattern, the recovery path, and the
+#   trade-off (`/clear` discards accumulated context). It does
+#   not block tool execution; the failure shape is at the model
+#   layer, not the tool layer, and a hook cannot prevent it from
+#   the operator side.
+#
+# TRIGGER: PostToolUse  MATCHER: ""
+# CLUSTER: 12 (Tool Call Parsing failures in Opus 4.7)
+# SUB-PATTERN: 12A (in-context few-shot poisoning)
+#
+# BEHAVIOR:
+#   - Read transcript_path from PostToolUse hook input.
+#   - Scan the trailing LOOKBACK lines for the marker substring
+#     "malformed and could not be parsed" (the literal phrase
+#     Anthropic's runtime emits).
+#   - Count occurrences. If at or above the threshold, emit a
+#     one-screen stderr advisory naming sub-pattern 12A and the
+#     `/clear` recovery path.
+#   - Rate-limit advisory emission per session via a counter
+#     file so the warning does not repeat on every PostToolUse
+#     after the first detection.
+#   - Always exits 0 (advisory only; never blocks tool execution).
+#
+# CONFIGURATION (env vars):
+#   CC_MALFORMED_DETECTOR_DISABLE     Set to "1" to silence.
+#   CC_MALFORMED_DETECTOR_LOOKBACK    How many recent transcript
+#                                     lines to scan for the
+#                                     malformed marker. Default 200.
+#   CC_MALFORMED_DETECTOR_THRESHOLD   Minimum occurrences in
+#                                     LOOKBACK to fire. Default 1.
+#                                     Raise to 2+ if the marker
+#                                     appears in legitimate prose.
+#   CC_MALFORMED_DETECTOR_COOLDOWN    Minimum tool calls between
+#                                     repeat advisories per
+#                                     session. Default 50.
+#   CC_MALFORMED_DETECTOR_TRANSCRIPT  Override transcript path
+#                                     (used by tests).
+#   CC_MALFORMED_DETECTOR_STATE_DIR   Override state directory
+#                                     (used by tests). Default
+#                                     /tmp/cc-malformed-detector.
+#
+# UPSTREAM REFERENCES:
+#   #62123 (central case, 21 reactions: "tool call could not be
+#           parsed; retry also failed" on Opus 4.7)
+#   #62344 (in-context few-shot poisoning: 4 consecutive retries
+#           all fail identically; only /clear recovers)
+#   #62467 (extended-thinking serialization defect, a different
+#           root-cause hypothesis for the same surface symptom)
+#   #62700 (spurious malformed notice — tool actually succeeded)
+#   #49747 (legacy XML format mix precursor, filed 2026-04-17)
+#
+# RECOVERY ON A HIT:
+#   The advisory does not recover the session. The known recovery
+#   for sub-pattern 12A is `/clear` (a fresh session with no
+#   poisoned history). The trade-off is that `/clear` discards
+#   the accumulated session context. The advisory's value is in
+#   giving the operator a chance to checkpoint the active work
+#   to disk *before* deciding whether to `/clear`.
+# ================================================================
+
+set -u
+
+if [ "${CC_MALFORMED_DETECTOR_DISABLE:-0}" = "1" ]; then
+    exit 0
+fi
+
+LOOKBACK="${CC_MALFORMED_DETECTOR_LOOKBACK:-200}"
+THRESHOLD="${CC_MALFORMED_DETECTOR_THRESHOLD:-1}"
+COOLDOWN="${CC_MALFORMED_DETECTOR_COOLDOWN:-50}"
+STATE_DIR="${CC_MALFORMED_DETECTOR_STATE_DIR:-/tmp/cc-malformed-detector}"
+
+INPUT=$(cat 2>/dev/null || true)
+
+TRANSCRIPT_PATH="${CC_MALFORMED_DETECTOR_TRANSCRIPT:-}"
+if [ -z "$TRANSCRIPT_PATH" ]; then
+    TRANSCRIPT_PATH=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+fi
+
+if [ -z "$TRANSCRIPT_PATH" ] || [ ! -f "$TRANSCRIPT_PATH" ]; then
+    exit 0
+fi
+
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "default"' 2>/dev/null)
+[ -z "$SESSION_ID" ] && SESSION_ID="default"
+
+# Sanitize session id for use as a filename
+SAFE_SESSION=$(printf '%s' "$SESSION_ID" | tr -c 'A-Za-z0-9._-' '_' | head -c 80)
+[ -z "$SAFE_SESSION" ] && SAFE_SESSION="default"
+
+mkdir -p "$STATE_DIR" 2>/dev/null
+
+COUNTER_FILE="$STATE_DIR/${SAFE_SESSION}.count"
+LASTFIRED_FILE="$STATE_DIR/${SAFE_SESSION}.lastfired"
+
+# Increment the per-session tool-call counter.
+COUNT=$(cat "$COUNTER_FILE" 2>/dev/null || echo 0)
+COUNT=$((COUNT + 1))
+echo "$COUNT" > "$COUNTER_FILE"
+
+# Look for the marker substring in the trailing window.
+MATCHES=$(tail -n "$LOOKBACK" "$TRANSCRIPT_PATH" 2>/dev/null | grep -c 'malformed and could not be parsed' || true)
+MATCHES="${MATCHES:-0}"
+
+if [ "$MATCHES" -lt "$THRESHOLD" ]; then
+    exit 0
+fi
+
+# Cooldown: do not refire within COOLDOWN tool calls of the last advisory.
+LASTFIRED=$(cat "$LASTFIRED_FILE" 2>/dev/null || echo 0)
+SINCE=$((COUNT - LASTFIRED))
+
+if [ "$LASTFIRED" -gt 0 ] && [ "$SINCE" -lt "$COOLDOWN" ]; then
+    exit 0
+fi
+
+echo "$COUNT" > "$LASTFIRED_FILE"
+
+# Emit advisory.
+cat >&2 <<EOF
+
+⚠️  Detected ${MATCHES} occurrence(s) of "malformed and could not be parsed"
+    in the trailing ${LOOKBACK} transcript lines.
+
+This is the surface signal for sub-pattern 12A (in-context few-shot
+poisoning), the cluster filed in #62344. Once one malformed tool call
+lands in conversation history, the model anchors on it as in-context
+few-shot and subsequent same-type calls reproduce the broken format
+deterministically. The reporter observed 4 consecutive retries all
+failing identically. Self-correction prompts ("be more careful", "send
+one call at a time") do not recover.
+
+Known recovery: \`/clear\` (a fresh session with no poisoned history).
+The trade-off is that \`/clear\` discards the accumulated session
+context. Consider checkpointing the active work to disk *before*
+deciding whether to \`/clear\`.
+
+If retries are still succeeding for you, this advisory is informational
+— the structural recurrence may not have triggered in your session yet.
+If retries have started failing identically, the session is likely
+poisoned and \`/clear\` will be needed to restore correct behavior.
+
+References: #62344 (the central in-context-poisoning analysis),
+#62123 (the broader "retry also failed" central case), Cluster 12 in
+the cc-safe-setup tracker:
+https://yurukusa.github.io/cc-safe-setup/cluster-tracker.html#cluster-tool-call-parsing
+
+Silence: set CC_MALFORMED_DETECTOR_DISABLE=1.
+Tune sensitivity: CC_MALFORMED_DETECTOR_THRESHOLD (default 1),
+                  CC_MALFORMED_DETECTOR_LOOKBACK (default 200 lines),
+                  CC_MALFORMED_DETECTOR_COOLDOWN (default 50 tool calls).
+
+EOF
+
+exit 0

package/examples/loop-detector.sh

@@ -22,6 +22,18 @@
 #   CC_LOOP_WINDOW=10 — number of recent commands to track (default: 10)
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-loop-detector-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [loop-detector]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/magic-number-warn.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/main-branch-warn.sh

@@ -20,6 +20,18 @@
 #   }
 # }
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-main-branch-warn-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [main-branch-warn]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/max-concurrent-agents.sh

@@ -15,6 +15,18 @@
 # TRIGGER: PreToolUse
 # MATCHER: "Agent"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-max-concurrent-agents-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [max-concurrent-agents]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 [ "$TOOL" != "Agent" ] && exit 0

package/examples/max-edit-size-guard.sh

@@ -1,5 +1,18 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-max-edit-size-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [max-edit-size-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 [ "$TOOL" != "Edit" ] && exit 0

package/examples/max-function-length.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/mcp-config-freeze.sh

@@ -15,6 +15,18 @@
 # TRIGGER: PreToolUse
 # MATCHER: "Edit|Write"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-mcp-config-freeze-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [mcp-config-freeze]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
 [ -z "$FILE" ] && exit 0

package/examples/mcp-config-poisoning-audit.sh

@@ -0,0 +1,150 @@
+#!/bin/bash
+# ================================================================
+# mcp-config-poisoning-audit.sh — Read-only audit for supply-chain
+#   poisoning of your Claude Code config (NOT prevention of Claude's
+#   own edits — that's hook-tamper-guard / mcp-config-freeze)
+# ================================================================
+# PURPOSE:
+#   A malicious npm package's post-install script, or a malicious MCP
+#   server, can rewrite ~/.claude.json / ~/.claude/settings.json
+#   *outside* Claude Code entirely — so no PreToolUse hook ever fires.
+#   Two reported shapes (June 2026 wave + Mitiga Labs / CVE-2025-59536):
+#     - An injected hook (e.g. SessionStart) whose command calls out to
+#       the network or evals a payload, to exfiltrate keys on next open.
+#     - An mcpServers entry whose endpoint is rewritten to a localhost
+#       proxy or an unfamiliar external host, so authenticated MCP
+#       traffic (and OAuth tokens) is routed through attacker infra.
+#   The existing guards PREVENT Claude from editing config and FREEZE
+#   mid-session additions, but nothing AUDITS config that was already
+#   poisoned from outside. This fills that gap.
+#
+# HOW IT WORKS: SessionStart hook. Read-only. Scans the config files,
+#   flags hook commands containing network/eval indicators and
+#   mcpServers entries pointing at external/localhost-proxy endpoints,
+#   and prints a warning. It never edits or deletes anything (some of
+#   these payloads retaliate by wiping the home dir if tampered with —
+#   so this only reports; you review and remediate by hand).
+#   Always exits 0 (advisory; never blocks the session).
+#
+# See: CVE-2025-59536 (RCE via malicious hooks in repo settings),
+#      CVE-2026-21852 (key exfil via env override), and the Mitiga
+#      Labs ~/.claude.json MCP-routing-rewrite disclosure.
+#
+# TRIGGER: SessionStart
+# MATCHER: "" (SessionStart has no matcher)
+#
+# Configuration:
+#   CC_MCP_AUDIT_OFF=1            — disable
+#   CC_MCP_AUDIT_TRUSTED_HOSTS    — colon-separated host substrings to
+#                                   treat as expected (e.g. "githubcopilot.com:api.githubcopilot")
+# ================================================================
+
+set -uo pipefail
+
+[ "${CC_MCP_AUDIT_OFF:-0}" = "1" ] && exit 0
+command -v jq >/dev/null 2>&1 || exit 0   # fail open: no jq, no audit
+
+HOME_DIR="${HOME:-/root}"
+CANDIDATES=(
+    "$HOME_DIR/.claude.json"
+    "$HOME_DIR/.claude/settings.json"
+    "$HOME_DIR/.claude/settings.local.json"
+    ".claude/settings.json"
+    ".claude/settings.local.json"
+    ".mcp.json"
+)
+
+# Network / code-exec indicators that almost never belong in a legit
+# hook command. Kept conservative to avoid noise.
+NET_EXEC_RE='curl |wget |\bnc \b|netcat|/dev/tcp/|node +-e|node +--eval|python3? +-c|deno +eval|base64 +-d|base64 +--decode|\beval +"|\beval +\$|bash +-i|sh +-i|powershell +-enc|Invoke-WebRequest|iwr '
+
+TRUSTED="${CC_MCP_AUDIT_TRUSTED_HOSTS:-}"
+
+findings=0
+note() { echo "  ⚠ $*" >&2; findings=$((findings + 1)); }
+
+is_trusted() {
+    # $1 = string to test; returns 0 if it contains a trusted substring
+    [ -n "$TRUSTED" ] || return 1
+    local IFS=':' t
+    for t in $TRUSTED; do
+        [ -n "$t" ] && case "$1" in *"$t"*) return 0;; esac
+    done
+    return 1
+}
+
+audit_file() {
+    local f="$1"
+    [ -f "$f" ] || return 0
+    jq -e . "$f" >/dev/null 2>&1 || return 0   # invalid JSON: other guards handle it
+
+    # 1) Hook commands (any event) containing network/exec indicators.
+    #    .hooks is { Event: [ { hooks: [ { command } ] } ] }
+    local cmds
+    cmds=$(jq -r '
+        (.hooks // {}) | to_entries[] | .key as $ev
+        | (.value // []) | .[]? | (.hooks // []) | .[]?
+        | select(.command != null) | "\($ev)\t\(.command)"
+    ' "$f" 2>/dev/null)
+    if [ -n "$cmds" ]; then
+        while IFS=$'\t' read -r ev cmd; do
+            [ -z "$cmd" ] && continue
+            if printf '%s' "$cmd" | grep -qiE "$NET_EXEC_RE"; then
+                is_trusted "$cmd" && continue
+                note "[$f] hook '$ev' runs a network/exec command: ${cmd:0:90}"
+            fi
+        done <<< "$cmds"
+    fi
+
+    # 2) mcpServers endpoints: external URLs / IP literals / localhost proxies.
+    #    Entry may carry a "url" (http transport) or "command"+"args" (stdio).
+    # Use the unit separator (0x1f) — empty fields must NOT collapse, and
+    # tab is IFS-whitespace so consecutive tabs around an empty url would
+    # merge and shift every field.
+    local servers
+    servers=$(jq -r '
+        (.mcpServers // .mcp_servers // {}) | to_entries[]
+        | "\(.key)\((.value.url // ""))\((.value.command // ""))\(((.value.args // []) | join(" ")))"
+    ' "$f" 2>/dev/null)
+    if [ -n "$servers" ]; then
+        while IFS=$'\x1f' read -r name url cmd args; do
+            [ -z "$name" ] && continue
+            local blob="$url $cmd $args"
+            is_trusted "$blob" && continue
+            # external http(s) endpoint
+            if printf '%s' "$url" | grep -qiE '^https?://'; then
+                case "$url" in
+                    http://127.0.0.1*|http://localhost*|http://[::1]*)
+                        note "[$f] MCP server '$name' routes through a localhost proxy: $url" ;;
+                    *)
+                        note "[$f] MCP server '$name' uses an external HTTP endpoint: $url" ;;
+                esac
+            fi
+            # raw IP literal or pipe-to-shell hidden in command/args
+            if printf '%s' "$cmd $args" | grep -qiE "$NET_EXEC_RE"; then
+                note "[$f] MCP server '$name' command contains a network/exec indicator: ${cmd} ${args}"
+            fi
+        done <<< "$servers"
+    fi
+}
+
+for f in "${CANDIDATES[@]}"; do
+    audit_file "$f"
+done
+
+if [ "$findings" -gt 0 ]; then
+    {
+        echo ""
+        echo "⚠ cc-safe-setup: possible Claude Code config poisoning ($findings finding(s) above)."
+        echo "  A malicious npm post-install or MCP server can rewrite ~/.claude.json /"
+        echo "  settings.json from outside Claude, so no PreToolUse hook catches it."
+        echo "  This is a READ-ONLY warning — verify each item by hand. Do NOT blindly delete"
+        echo "  (some payloads retaliate). If any is unexpected:"
+        echo "    1) update Claude Code (CVE-2025-59536 / CVE-2026-21852 are patched in current builds)"
+        echo "    2) rotate the OAuth tokens / API keys reachable from that config"
+        echo "    3) remove the injected hook/server entry by hand and review recent npm installs"
+        echo "  Silence expected entries with CC_MCP_AUDIT_TRUSTED_HOSTS, or CC_MCP_AUDIT_OFF=1."
+    } >&2
+fi
+
+exit 0

package/examples/mcp-data-boundary.sh

@@ -34,7 +34,7 @@ if echo "$OUTPUT" | grep -qiE "$SENSITIVE_PATHS"; then
 fi
 
 # Check for data that looks like secrets in output
-if echo "$OUTPUT" | grep -qE 'sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{30,}|-----BEGIN.*KEY|AKIA[A-Z0-9]{16}'; then
+if echo "$OUTPUT" | grep -qE '(^|[^A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}|ghp_[a-zA-Z0-9]{30,}|-----BEGIN.*KEY|AKIA[A-Z0-9]{16}'; then
     echo "⚠ MCP DATA BOUNDARY: MCP tool output contains potential secrets" >&2
     echo "  Tool: $TOOL" >&2
     echo "  Review output for leaked credentials." >&2