cc-safe-setup 29.8.0 → 30.0.4

package/examples/pre-execution-claim-detector.sh

@@ -0,0 +1,179 @@
+#!/bin/bash
+# pre-execution-claim-detector.sh — Surface the Cluster 22 candidate (Opus 4.8
+# pre-execution tool-output fabrication, Axis 22A) at PreToolUse, by scanning
+# the last assistant text block for specific-value claim signatures that
+# precede the tool call about to fire.
+#
+# Why: Cluster 22 candidate Axis 22A (sequential pre-execution claim) documents
+#      that Opus 4.8 emits result-specific values (prices, URLs, file contents,
+#      command outputs, exit codes) BEFORE the tool calls that would produce
+#      those values have returned. Issue #64065 anchor: model asserted specific
+#      flight prices ($891pp / $1,782/2) before web/flight-search calls
+#      returned; real prices were ~$645pp. Self-diagnosed the pattern in-context,
+#      explicitly committed not to repeat it, then repeated it on the next turn
+#      — the self-recognition-without-prevention mechanic that lives below the
+#      prompt layer.
+#
+#      Six independent filings 2026-05-30 → 2026-05-31, all on claude-opus-4-8:
+#        #64048 (confabulated URGENT-AGENT-DIRECTIVE / AUTOGEN-DECOY markers)
+#        #64055 (Opus 4.8 modified files the user did not ask to modify)
+#        #64065 (flight prices anchor, self-recognition-without-prevention)
+#        #64076 ("lying and fabricating a lot of things without doing actual work")
+#        #64095 (envelope leak, immutable git log returned different SHAs)
+#        #64103 ("telling me it did things and were successful but it wasn't")
+#
+#      This hook complements tool-result-correlation-checker.sh (which catches
+#      Axis 22B parallel-batch fabrication compounding via tool_use_id ↔
+#      tool_result pairing mismatches). Together they cover both axes.
+#
+# Detection rule: 5 claim-pattern regexes applied to the last assistant text
+# block in the transcript. The patterns are conservative; they match phrases
+# that are highly correlated with pre-execution claim signatures but rare in
+# normal assistant output:
+#
+#   1. "the (file|output|result|command|response) (was|is|shows|contains|returned):"
+#      followed by quoted content within 200 chars
+#   2. "I (confirmed|verified|checked|ran|executed) [^.]+ and [^.]+"
+#      with specific-value language (numbers with units, prices, URLs)
+#   3. specific dollar amounts ($XXX or $X,XXX patterns) appearing without a
+#      preceding "I'll check" / "let me search" hedge
+#   4. SHA-like patterns (40-char hex) appearing without a preceding
+#      "git log will show" / "let me run" hedge
+#   5. specific file paths quoted with content immediately following:
+#      `/path/to/file.ext` followed by `\n```` (claim-then-code-block pattern)
+#
+# Event: PreToolUse  MATCHER: "Bash" (only Bash, where the highest-volume
+#                              claim-verifiable tools live)
+# Action: Read transcript_path from the PreToolUse payload, scan the last
+#         assistant text block for claim signatures. Emit stderr advisory if
+#         matched. Advisory only (exit 0); never blocks.
+#
+# Opt-in: CC_OPUS48_PRE_CLAIM_DETECT=1 to enable. Silent by default so
+# operators on Opus 4.6/4.7 (where the cluster does not surface) see no noise.
+#
+# Configuration:
+#   CC_OPUS48_PRE_CLAIM_DETECT       Set to "1" to enable
+#   CC_OPUS48_PRE_CLAIM_DISABLE      Hard disable (overrides DETECT)
+#   CC_OPUS48_PRE_CLAIM_QUIET        Silent (overrides DETECT)
+#   CC_OPUS48_PRE_CLAIM_LOG          Log path (default ~/.cache/cc-safe-setup/pre-claim.jsonl)
+#   CC_OPUS48_PRE_CLAIM_SCAN_LINES   Last N transcript lines to inspect (default 20)
+
+set -u
+
+if [ "${CC_OPUS48_PRE_CLAIM_DISABLE:-0}" = "1" ]; then
+  exit 0
+fi
+if [ "${CC_OPUS48_PRE_CLAIM_QUIET:-0}" = "1" ]; then
+  exit 0
+fi
+if [ "${CC_OPUS48_PRE_CLAIM_DETECT:-0}" != "1" ]; then
+  exit 0
+fi
+
+SCAN_LINES="${CC_OPUS48_PRE_CLAIM_SCAN_LINES:-20}"
+LOG="${CC_OPUS48_PRE_CLAIM_LOG:-${HOME}/.cache/cc-safe-setup/pre-claim.jsonl}"
+
+case "$SCAN_LINES" in
+  ''|*[!0-9]*) SCAN_LINES=20 ;;
+esac
+
+INPUT=$(cat)
+
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+if [ -z "$TRANSCRIPT" ] || [ ! -r "$TRANSCRIPT" ]; then
+  exit 0
+fi
+
+# Extract the last assistant text block from the transcript.
+# Assistant messages have type=assistant; text content lives at
+# .message.content[].text in the JSONL representation.
+LAST_ASSISTANT_TEXT=$(tac "$TRANSCRIPT" 2>/dev/null | head -n "$SCAN_LINES" | \
+  jq -rR 'fromjson? | select(.type == "assistant") | .message.content[]? | select(.type == "text") | .text' 2>/dev/null | \
+  head -c 4000)
+
+if [ -z "$LAST_ASSISTANT_TEXT" ]; then
+  exit 0
+fi
+
+# Get the model from the same transcript region for context in the advisory.
+MODEL=$(tac "$TRANSCRIPT" 2>/dev/null | head -n "$SCAN_LINES" | \
+  jq -rR 'fromjson? | select(.type == "assistant") | .message.model // empty' 2>/dev/null | head -1)
+MODEL="${MODEL:-unknown}"
+
+MATCHED_PATTERN=""
+
+# Pattern 1: "the (file|output|result|command|response) (was|is|shows|contains|returned):"
+if printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qiE 'the (file|output|result|command|response) (was|is|shows|contains|returned):'; then
+  MATCHED_PATTERN="claim-prefix"
+fi
+
+# Pattern 2: "I (confirmed|verified|checked|ran|executed) ... and ..."
+if [ -z "$MATCHED_PATTERN" ] && \
+   printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qiE 'I (confirmed|verified|checked|ran|executed) [^.]+ and [^.]+'; then
+  MATCHED_PATTERN="action-then-value"
+fi
+
+# Pattern 3: dollar amount without a hedging phrase preceding it.
+# Hedge phrases: "let me check", "I'll search", "checking", "looking up", "verify"
+if [ -z "$MATCHED_PATTERN" ]; then
+  if printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qE '\$[0-9]+(,[0-9]{3})*(\.[0-9]+)?'; then
+    if ! printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qiE '(let me check|let me search|let me look|i.?ll check|i.?ll search|checking|looking up|verify|searching)'; then
+      MATCHED_PATTERN="bare-price-claim"
+    fi
+  fi
+fi
+
+# Pattern 4: 40-char hex SHA-like pattern without a hedging phrase.
+if [ -z "$MATCHED_PATTERN" ]; then
+  if printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qE '\b[a-f0-9]{40}\b'; then
+    if ! printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qiE '(let me run|let me check|i.?ll run|git log will show|running git)'; then
+      MATCHED_PATTERN="bare-sha-claim"
+    fi
+  fi
+fi
+
+# Pattern 5: backtick-quoted file path on one line + triple-backtick code-block
+# start within the same text block. Two-grep heuristic because grep -E does not
+# cross newlines portably; the conjunction captures the "the file `/path/x`
+# contains:\n```" claim pattern. Drops the noise of files-mentioned-without-
+# inline-content (e.g. when the assistant just lists paths in prose).
+if [ -z "$MATCHED_PATTERN" ]; then
+  if printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qE '`[/.][^`]+`[^.]*:[[:space:]]*$' && \
+     printf '%s' "$LAST_ASSISTANT_TEXT" | grep -qE '^```'; then
+    MATCHED_PATTERN="file-path-then-block"
+  fi
+fi
+
+if [ -z "$MATCHED_PATTERN" ]; then
+  exit 0
+fi
+
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "unknown"' 2>/dev/null)
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // "unknown"' 2>/dev/null)
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+mkdir -p "$(dirname "$LOG")" 2>/dev/null
+printf '{"ts":"%s","session":"%s","model":"%s","tool":"%s","pattern":"%s"}\n' \
+  "$TS" "$SESSION_ID" "$MODEL" "$TOOL" "$MATCHED_PATTERN" >> "$LOG"
+
+cat >&2 <<EOF
+NOTICE: pre-execution claim signature detected before this ${TOOL} call.
+        Pattern: ${MATCHED_PATTERN}. Model: ${MODEL}.
+        The last assistant text block contained a value-specific assertion of
+        the type associated with Cluster 22 candidate (Opus 4.8 pre-execution
+        tool-output fabrication). The model may be reasoning from invented
+        values before this tool actually runs.
+        Verification step: after this tool returns, compare the tool's actual
+        output against the value the assistant asserted in the preceding text.
+        If they diverge, this is a Cluster 22 Axis 22A confirmation — switch
+        to Opus 4.7 via '/model claude-opus-4-7' (#64065 reporter's comparison
+        shows Opus 4.7 in the same conditions does not surface the surge).
+        Companion hook: tool-result-correlation-checker.sh (PostToolUse,
+        catches Axis 22B parallel-batch fabrication compounding via tool_use_id
+        misattribution).
+        References: #64048 / #64055 / #64065 (anchor) / #64076 / #64095 / #64103
+        Log: ${LOG}
+        Suppress: export CC_OPUS48_PRE_CLAIM_QUIET=1
+EOF
+
+exit 0

package/examples/prefer-builtin-tools.sh

@@ -7,7 +7,16 @@
 # than bash equivalents. But Claude often reaches for sed, grep, cat instead.
 # This hook denies those commands with a pointer to the correct built-in tool.
 #
-# TRIGGER: PermissionRequest  MATCHER: ""
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+#
+# 2026-09-03 の訂正。ここは以前 `TRIGGER: PermissionRequest  MATCHER: ""` だった。
+# インストーラはこの行を読んで登録先を決めるので、出荷時のこのフックは
+# PermissionRequest へ登録されていた。そして本体が出す hookEventName は
+# 最初から "PreToolUse" で、宣言と中身が食い違っていた。
+# 隔離した HOME で測ると、出荷時の登録では `cat ./probe.txt` に対して
+# **一度も呼ばれなかった**（3条件・計器つきで0回）。登録先だけを
+# PreToolUse / matcher "Bash" へ変えると、同じ命令で1回呼ばれ、拒否も記録された。
+# 計器そのものは手で入力を流して発火することを先に確かめてある。
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

package/examples/prefer-dedicated-tools.sh

@@ -22,6 +22,18 @@
 #   }
 # }
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-prefer-dedicated-tools-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [prefer-dedicated-tools]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0

package/examples/prisma-migrate-guard.sh

@@ -2,8 +2,9 @@
 # ================================================================
 # prisma-migrate-guard.sh — Block destructive Prisma operations
 #
-# Blocks: prisma migrate reset, prisma db push --force-reset
-# Allows: prisma migrate dev, prisma generate, prisma db push
+# Blocks: prisma migrate reset, prisma db push --force-reset,
+#         prisma db push --accept-data-loss
+# Allows: prisma migrate dev, prisma generate, prisma db push (plain)
 #
 # Usage: Add to settings.json as a PreToolUse hook
 #
@@ -19,23 +20,39 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-prisma-migrate-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [prisma-migrate-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
 [[ -z "$COMMAND" ]] && exit 0
 
-# Block destructive Prisma commands
-if echo "$COMMAND" | grep -qE 'prisma\s+(migrate\s+reset|db\s+push\s+--force-reset)'; then
+# Block destructive Prisma commands. --force-reset drops and recreates the
+# whole database; --accept-data-loss applies data-destroying schema changes
+# without the interactive confirmation — the exact flag that wiped a production
+# DB in anthropics/claude-code#14411. Both can sit anywhere after `db push`
+# (e.g. after a --schema flag), so match across the rest of the command.
+if echo "$COMMAND" | grep -qE 'prisma\s+(migrate\s+reset|db\s+push\b.*(--force-reset|--accept-data-loss))'; then
     echo "BLOCKED: Destructive Prisma command." >&2
     echo "Command: $COMMAND" >&2
     echo "" >&2
-    echo "migrate reset / force-reset destroy all data." >&2
+    echo "migrate reset / --force-reset / --accept-data-loss destroy data." >&2
     echo "Use: prisma migrate dev (incremental migration)" >&2
     exit 2
 fi
 
-# Warn on prisma db push (schema push without migration history)
-if echo "$COMMAND" | grep -qE 'prisma\s+db\s+push\b' && ! echo "$COMMAND" | grep -q "\-\-force-reset"; then
+# Warn on plain prisma db push (schema push without migration history)
+if echo "$COMMAND" | grep -qE 'prisma\s+db\s+push\b' && ! echo "$COMMAND" | grep -qE '\-\-(force-reset|accept-data-loss)'; then
     echo "WARNING: prisma db push skips migration history." >&2
     echo "Consider: prisma migrate dev for tracked migrations." >&2
 fi

package/examples/production-port-kill-guard.sh

@@ -20,6 +20,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-production-port-kill-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [production-port-kill-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/prompt-injection-guard.sh

@@ -39,7 +39,8 @@ if echo "$OUTPUT" | grep -qiE '(new|updated|override)\s+system\s+prompt'; then
 fi
 
 # Hidden instructions in HTML comments or zero-width chars
-if echo "$OUTPUT" | grep -qP '<!--.*(?:execute|run|delete|remove).*-->'; then
+# -P は GNU 拡張。BSD grep では警告が黙って消える。(?:…) を () にすれば -E で足りる。
+if echo "$OUTPUT" | grep -qE '<!--.*(execute|run|delete|remove).*-->'; then
     echo "WARNING: Possible prompt injection in HTML comment" >&2
     SUSPICIOUS=1
 fi

package/examples/protect-claudemd.sh

@@ -11,6 +11,18 @@
 # MATCHER: "Edit|Write"
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-protect-claudemd-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [protect-claudemd]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)

package/examples/protect-dotfiles.sh

@@ -19,6 +19,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-protect-dotfiles-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [protect-dotfiles]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)

package/examples/proxy-capture-suggester.sh

@@ -0,0 +1,159 @@
+#!/bin/bash
+# proxy-capture-suggester.sh — Surface HTTPS proxy capture path for compliance-bound operators
+#
+# Background:
+#   v2.1.150+ injects server-side strings into the system prompt via two cached channels:
+#   the bootstrap API `client_data` field and the GrowthBook `tengu_heron_brook` flag.
+#   The opt-out env vars (CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1, DISABLE_GROWTHBOOK=1)
+#   close the injection channel going forward, and cache-residue-detector.sh prompts
+#   removal of pre-opt-out cached values. Neither produces a reconstructible audit trail
+#   of what the agent was instructed at the time of any logged action.
+#
+#   For operators in regulated industries (financial services, healthcare, government,
+#   defense) the audit trail gap is the structural concern. The opt-outs answer
+#   "stop trusting Anthropic with the prompt", but compliance frameworks (SOX, HIPAA,
+#   FedRAMP, PCI-DSS, EU AI Act Article 12) also require "produce the exact prompt that
+#   was sent for any logged tool execution within the retention window".
+#
+#   The only operator-side path to that audit trail is HTTPS proxy capture: an MITM
+#   proxy between the Claude Code client and api.anthropic.com that records the full
+#   request body of every API call. Anthropic does not provide a first-party audit
+#   export; the proxy capture path is the workaround.
+#
+#   Reference: https://github.com/anthropics/claude-code/issues/62061 (46+ reactions)
+#              https://gist.github.com/yurukusa/03839b3c3f88e1cce38fb0f2c127544d (v2.1.150 audit paths)
+#
+# What this hook does:
+#   On SessionStart, when CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1 is set, inspect the
+#   environment for an active HTTPS proxy configuration. If none is present, emit a
+#   one-time advisory naming three audit-grade proxy tools with concrete invocation,
+#   the CA-trust step required for TLS termination, and the env-var bridge that wires
+#   Claude Code's API client into the proxy.
+#
+#   The hook is opt-in. Most operators do not need an audit trail and would not
+#   benefit from running an MITM proxy locally; it adds attack surface, latency, and
+#   maintenance overhead. The advisory only fires when an operator has explicitly
+#   declared compliance intent via the opt-in env var.
+#
+# When this hook does NOT fire:
+#   - CC_PROXY_CAPTURE_SUGGESTER_ENABLE is unset or set to 0 (the default)
+#   - CC_PROXY_CAPTURE_SUGGESTER_QUIET=1 (silenced after acknowledgement)
+#   - An HTTPS proxy is already active (HTTPS_PROXY / https_proxy / ALL_PROXY contains a value)
+#
+# When this hook DOES fire (default behavior with ENABLE=1):
+#   - SessionStart and no HTTPS_PROXY-family env var is set → emit the four-tool advisory
+#   - SessionStart and a proxy IS set but ANTHROPIC_LOG_DIR is unset → emit a shorter
+#     advisory pointing out that proxy capture is active but no local log sink is configured
+#
+# Hook config (settings.json):
+# {
+#   "hooks": {
+#     "SessionStart": [{
+#       "matcher": "",
+#       "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/proxy-capture-suggester.sh" }]
+#     }]
+#   }
+# }
+#
+# Env vars:
+#   CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1   — opt in to the advisory (default off)
+#   CC_PROXY_CAPTURE_SUGGESTER_QUIET=1    — silence permanently after acknowledgement
+#
+# Privacy: the hook reads only the names of standard proxy env vars (HTTPS_PROXY,
+# https_proxy, ALL_PROXY, NO_PROXY, ANTHROPIC_LOG_DIR). It never reads, transmits, or
+# logs the values themselves.
+
+set -u
+
+# Silenced permanently after acknowledgement
+if [ "${CC_PROXY_CAPTURE_SUGGESTER_QUIET:-0}" = "1" ]; then
+  exit 0
+fi
+
+# Opt-in: silent unless the operator explicitly declared compliance intent
+if [ "${CC_PROXY_CAPTURE_SUGGESTER_ENABLE:-0}" != "1" ]; then
+  exit 0
+fi
+
+# Check for an active HTTPS proxy (uppercase or lowercase, plus ALL_PROXY)
+PROXY_ACTIVE=0
+for var in HTTPS_PROXY https_proxy ALL_PROXY all_proxy; do
+  # shellcheck disable=SC1083
+  eval val="\${$var:-}"
+  if [ -n "${val:-}" ]; then
+    PROXY_ACTIVE=1
+    break
+  fi
+done
+
+if [ "$PROXY_ACTIVE" = "1" ]; then
+  # Proxy is active. Check whether an audit log sink is configured.
+  if [ -z "${ANTHROPIC_LOG_DIR:-}" ]; then
+    cat >&2 <<'EOF'
+[proxy-capture-suggester] HTTPS proxy is active but ANTHROPIC_LOG_DIR is unset.
+  Compliance-grade audit trails require a stable on-disk sink for the captured
+  request bodies. Configure one before relying on the proxy capture for evidence:
+
+    export ANTHROPIC_LOG_DIR="$HOME/.claude/api-audit-log"
+    mkdir -p "$ANTHROPIC_LOG_DIR"
+
+  mitmproxy: --save-stream-file "$ANTHROPIC_LOG_DIR/$(date -u +%Y%m%dT%H%M%SZ).flow"
+  Burp Suite: Project options -> HTTP -> Logging -> Requests -> file in $ANTHROPIC_LOG_DIR
+  Charles: Tools -> Auto Save -> directory in $ANTHROPIC_LOG_DIR, format .chlsj
+
+  Silence this advisory once configured:
+    export CC_PROXY_CAPTURE_SUGGESTER_QUIET=1
+EOF
+  fi
+  exit 0
+fi
+
+# No proxy active — emit the full four-tool advisory.
+cat >&2 <<'EOF'
+[proxy-capture-suggester] Compliance audit intent declared (CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1)
+but no HTTPS proxy is configured. Without one, you cannot reconstruct the system prompt that
+was sent at the time of any logged tool execution. The v2.1.150 server-side injection channel
+(GrowthBook tengu_heron_brook + bootstrap client_data) is acknowledged-intentional by Anthropic;
+opt-out env vars close the channel going forward but produce no audit trail.
+
+Four operator-side proxy options that terminate TLS and record the full request body:
+
+  1. mitmproxy (free, scriptable, recommended for compliance pipelines)
+       brew install mitmproxy            # macOS
+       pipx install mitmproxy            # Linux
+     Start:
+       mitmproxy --mode regular --listen-port 8080 \
+                 --save-stream-file "$HOME/.claude/api-audit-log/$(date -u +%Y%m%dT%H%M%SZ).flow"
+     Bridge:
+       export HTTPS_PROXY=http://127.0.0.1:8080
+       export SSL_CERT_FILE="$HOME/.mitmproxy/mitmproxy-ca-cert.pem"
+     Verify: a single Claude Code prompt should produce a .flow file with the request body.
+
+  2. Burp Suite Community (free, GUI, common in enterprise pen-test contexts)
+     Proxy listener: 127.0.0.1:8080. Configure HTTPS_PROXY as above. Export the Burp CA cert
+     and set SSL_CERT_FILE to its path. Project options -> HTTP -> Logging -> Requests for
+     persistent capture.
+
+  3. Charles Proxy (commercial, $50, GUI, common on macOS dev workstations)
+     Default listener 127.0.0.1:8888. Tools -> Auto Save for persistent capture. Trust the
+     Charles root certificate via Charles -> Help -> SSL Proxying.
+
+  4. Anthropic SDK direct logging (free, lightweight, no proxy)
+     Set ANTHROPIC_LOG=debug to dump every request to stderr; redirect stderr to a file
+     and rotate. This captures less metadata than a proper proxy (no response timing, no
+     TLS handshake detail) but produces a request-body audit trail with no MITM overhead.
+
+The four paths above produce an audit trail that pairs with cache-residue-detector.sh
+(closes the cache gap) and server-side-prompt-injection-detector.sh (warns on missing
+opt-outs). Together these three hooks cover the v2.1.150 audit surface for operators in
+regulated industries.
+
+Silence this advisory after configuring a proxy:
+  export CC_PROXY_CAPTURE_SUGGESTER_QUIET=1
+
+References:
+  https://github.com/anthropics/claude-code/issues/62061  (v2.1.150 injection report, 46+ reactions)
+  https://gist.github.com/yurukusa/03839b3c3f88e1cce38fb0f2c127544d  (four audit paths writeup)
+EOF
+
+exit 0