cc-safe-setup 29.8.0 → 30.0.4

package/examples/spurious-malformed-notice-detector.sh

@@ -0,0 +1,247 @@
+#!/bin/bash
+# ================================================================
+# spurious-malformed-notice-detector.sh — Warn when "malformed
+#   and could not be parsed" notices co-occur with successful
+#   tool executions in the trailing transcript window, signalling
+#   sub-pattern 12C (the harness-layer spurious notice).
+# ================================================================
+# PURPOSE:
+#   Issue #62700 documents a case where, after most tool calls
+#   (Bash / Edit / Write), the assistant turn is immediately
+#   followed by a system message "Your tool call was malformed
+#   and could not be parsed. Please retry." — yet the tool
+#   actually executed correctly (git commit/push/cherry-pick,
+#   gh queries, file writes all produced normal output and took
+#   effect). Sometimes the spurious notice is accompanied by
+#   "[Request interrupted by user]" and the conversation appears
+#   to hang, requiring repeated manual "continue".
+#
+#   The other Cluster 12 sub-pattern detectors key off the same
+#   surface marker but recommend different recoveries:
+#     - 12A (#62344) → /clear to drop poisoned history
+#     - 12B (#62467) → switch model / disable extended thinking
+#   12C is at the harness/streaming layer — the tool succeeded
+#   and the notice is the bug. The recovery is the opposite of
+#   12A/12B: do NOT /clear (it would discard accumulated context
+#   for no benefit) and do NOT switch model (the inference is
+#   working correctly). Verify the tool output is correct (it
+#   likely is) and proceed.
+#
+#   This hook fires only when the surface marker AND successful
+#   tool_result blocks co-occur in the same window, so it does
+#   not fire on the 12A "retry also failed" terminal state.
+#
+# TRIGGER: PostToolUse  MATCHER: ""
+# CLUSTER: 12 (Tool Call Parsing failures in Opus 4.7)
+# SUB-PATTERN: 12C (spurious malformed notice; harness-layer)
+#
+# BEHAVIOR:
+#   - Read transcript_path from PostToolUse hook input.
+#   - Scan the trailing LOOKBACK lines.
+#   - Count marker occurrences ("malformed and could not be
+#     parsed", the literal phrase Anthropic's runtime emits).
+#   - Count successful tool_result blocks in the same window
+#     (.type == "tool_result" and .is_error is not true).
+#   - If markers >= MARKER_THRESHOLD AND successes >= markers,
+#     emit a one-screen stderr advisory naming sub-pattern 12C
+#     and the "verify output, ignore notice" recovery path.
+#   - Rate-limit advisory emission per session via a counter
+#     file so the warning does not repeat on every PostToolUse
+#     after the first detection.
+#   - Always exits 0 (advisory only; never blocks tool execution).
+#
+# WHY THE CO-OCCURRENCE CHECK:
+#   The 12A detector fires on the marker alone because the
+#   recovery (/clear) is appropriate for any cause of the marker
+#   if retries are failing. 12C is the opposite case — the
+#   marker is firing while retries are succeeding, so /clear is
+#   the wrong recovery. The co-occurrence of marker + successful
+#   tool_result is the structural signal that distinguishes the
+#   harness-layer false-positive from the model-layer failure.
+#
+#   In practice 12A and 12C may both fire on the same session
+#   (the marker is present and tools are succeeding, but the
+#   operator should be aware of both possibilities). That is
+#   intended: 12A advises checkpoint + /clear in case retries
+#   start failing, 12C confirms the current state and points at
+#   the harness layer rather than the session layer.
+#
+# CONFIGURATION (env vars):
+#   CC_SPURIOUS_MALFORMED_DISABLE       Set to "1" to silence.
+#   CC_SPURIOUS_MALFORMED_LOOKBACK      How many recent transcript
+#                                       lines to scan. Default 200.
+#   CC_SPURIOUS_MALFORMED_THRESHOLD     Minimum marker occurrences
+#                                       in LOOKBACK to fire.
+#                                       Default 1.
+#   CC_SPURIOUS_MALFORMED_COOLDOWN      Minimum tool calls between
+#                                       repeat advisories per
+#                                       session. Default 30.
+#   CC_SPURIOUS_MALFORMED_TRANSCRIPT    Override transcript path
+#                                       (used by tests).
+#   CC_SPURIOUS_MALFORMED_STATE_DIR     Override state directory
+#                                       (used by tests). Default
+#                                       /tmp/cc-spurious-malformed.
+#
+# UPSTREAM REFERENCES:
+#   #62700 (central case: spurious notice, tools execute
+#           correctly, accompanied by "[Request interrupted by
+#           user]" and apparent session hangs)
+#   #62123 (broader "retry also failed" central case, 21 reactions)
+#   #62344 (sub-pattern 12A, in-context few-shot poisoning)
+#   #62467 (sub-pattern 12B, extended-thinking serialization)
+#
+# RECOVERY ON A HIT:
+#   The advisory points operators at the verification path:
+#     - Verify the tool output (the most recent tool_result
+#       block) is what you expected. If yes, the notice is
+#       spurious — ignore it and proceed.
+#     - Do NOT /clear (would discard context for no benefit).
+#     - Do NOT switch model (inference is working correctly).
+#     - If session appears to hang, type "continue" to advance
+#       (per the #62700 reporter's workaround).
+#   The defect is at the streaming/parsing layer in the harness;
+#   operator-side hooks cannot recover it, only flag it so the
+#   operator stops applying the wrong recoveries.
+# ================================================================
+
+set -u
+
+if [ "${CC_SPURIOUS_MALFORMED_DISABLE:-0}" = "1" ]; then
+    exit 0
+fi
+
+LOOKBACK="${CC_SPURIOUS_MALFORMED_LOOKBACK:-200}"
+THRESHOLD="${CC_SPURIOUS_MALFORMED_THRESHOLD:-1}"
+COOLDOWN="${CC_SPURIOUS_MALFORMED_COOLDOWN:-30}"
+STATE_DIR="${CC_SPURIOUS_MALFORMED_STATE_DIR:-/tmp/cc-spurious-malformed}"
+
+INPUT=$(cat 2>/dev/null || true)
+
+TRANSCRIPT_PATH="${CC_SPURIOUS_MALFORMED_TRANSCRIPT:-}"
+if [ -z "$TRANSCRIPT_PATH" ]; then
+    TRANSCRIPT_PATH=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+fi
+
+if [ -z "$TRANSCRIPT_PATH" ] || [ ! -f "$TRANSCRIPT_PATH" ]; then
+    exit 0
+fi
+
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "default"' 2>/dev/null)
+[ -z "$SESSION_ID" ] && SESSION_ID="default"
+
+SAFE_SESSION=$(printf '%s' "$SESSION_ID" | tr -c 'A-Za-z0-9._-' '_' | head -c 80)
+[ -z "$SAFE_SESSION" ] && SAFE_SESSION="default"
+
+mkdir -p "$STATE_DIR" 2>/dev/null
+
+COUNTER_FILE="$STATE_DIR/${SAFE_SESSION}.count"
+LASTFIRED_FILE="$STATE_DIR/${SAFE_SESSION}.lastfired"
+
+COUNT=$(cat "$COUNTER_FILE" 2>/dev/null || echo 0)
+COUNT=$((COUNT + 1))
+echo "$COUNT" > "$COUNTER_FILE"
+
+TAIL_WINDOW=$(tail -n "$LOOKBACK" "$TRANSCRIPT_PATH" 2>/dev/null || true)
+
+# Count marker occurrences in the trailing window.
+MARKERS=$(printf '%s\n' "$TAIL_WINDOW" | grep -c 'malformed and could not be parsed' || true)
+MARKERS="${MARKERS:-0}"
+
+if [ "$MARKERS" -lt "$THRESHOLD" ]; then
+    exit 0
+fi
+
+# Count successful tool_result blocks in the same window.
+# A tool_result is "successful" when .is_error is absent or not true.
+# Each transcript line is parsed independently; non-JSON lines are
+# silently skipped. Both top-level and .message.content shapes are
+# checked to handle the common Claude Code transcript variants.
+SUCCESSES=$(printf '%s\n' "$TAIL_WINDOW" | jq -R -r '
+    try (fromjson) catch null | select(. != null) | . as $obj |
+    (($obj.content // $obj.message.content // [])) as $blocks |
+    if ($blocks | type) == "array" then
+        ($blocks
+            | map(select(.type == "tool_result" and ((.is_error // false) != true)))
+            | length)
+    else
+        0
+    end
+' 2>/dev/null | awk 'BEGIN{s=0} {s+=$0} END{print s+0}')
+
+SUCCESSES="${SUCCESSES:-0}"
+
+# 12C signature: marker fires alongside at least as many successful
+# tool_result blocks. If successes < markers, the cluster is more
+# likely 12A (retries actually failing) and the 12C advisory would
+# be misleading — stay silent and let the 12A hook surface the case.
+if [ "$SUCCESSES" -lt "$MARKERS" ]; then
+    exit 0
+fi
+
+LASTFIRED=$(cat "$LASTFIRED_FILE" 2>/dev/null || echo 0)
+SINCE=$((COUNT - LASTFIRED))
+
+if [ "$LASTFIRED" -gt 0 ] && [ "$SINCE" -lt "$COOLDOWN" ]; then
+    exit 0
+fi
+
+echo "$COUNT" > "$LASTFIRED_FILE"
+
+cat >&2 <<EOF
+
+⚠️  Detected ${MARKERS} "malformed and could not be parsed" notice(s)
+    alongside ${SUCCESSES} successful tool_result block(s) in the
+    trailing ${LOOKBACK} transcript lines.
+
+This is the signature for sub-pattern 12C (spurious malformed notice
+at the harness/streaming layer), the case filed in #62700. After
+most tool calls (Bash / Edit / Write), the assistant turn is
+immediately followed by the malformed-parse notice, yet the tool
+actually executed correctly — git commit/push, gh queries, file
+writes all produced normal output and took effect. Sometimes the
+spurious notice is accompanied by "[Request interrupted by user]"
+and the conversation appears to hang, requiring repeated manual
+"continue".
+
+Sub-pattern 12C is distinct from:
+  - 12A (#62344, in-context few-shot poisoning) → /clear to recover.
+    12A fires when retries genuinely fail and the broken format is
+    reproduced. The current window shows successful tool_results,
+    so /clear would discard accumulated context for no benefit.
+  - 12B (#62467, extended-thinking serialization defect) → switch
+    model / disable extended thinking. 12B fires when the assistant
+    turn carries stop_reason="tool_use" with no parseable tool_use
+    block. The current window has successful tool_results, so the
+    model-layer workaround is not the right recovery.
+
+Recommended verification path for 12C:
+  1. Verify the most recent tool_result block(s) in your session.
+     If the output is what you expected, the notice is spurious —
+     the tool succeeded and the harness misclassified it.
+  2. Proceed with your work. Do NOT /clear and do NOT switch model;
+     both would burn context for a defect that is not in your
+     session or your model.
+  3. If the session appears to hang, type "continue" to advance
+     (per the #62700 reporter's workaround).
+  4. Consider filing on #62700 to add your environment details
+     (plugins, hooks, MCP servers); the streaming-layer hypothesis
+     is open and your data may help isolate it.
+
+If retries ARE failing for you in addition to the notice, the
+session is more likely 12A — checkpoint your active work to disk
+and \`/clear\`. The 12A advisory (long-session-malformed-tool-call-
+detector.sh, PR #406) covers that case.
+
+References: #62700 (the spurious-notice central case), #62123 (the
+broader "retry also failed" central case), Cluster 12 in the
+cc-safe-setup tracker:
+https://yurukusa.github.io/cc-safe-setup/cluster-tracker.html#cluster-tool-call-parsing
+
+Silence: set CC_SPURIOUS_MALFORMED_DISABLE=1.
+Tune sensitivity: CC_SPURIOUS_MALFORMED_THRESHOLD (default 1),
+                  CC_SPURIOUS_MALFORMED_LOOKBACK (default 200 lines),
+                  CC_SPURIOUS_MALFORMED_COOLDOWN (default 30 tool calls).
+
+EOF
+
+exit 0

package/examples/sql-bulk-delete-warn.sh

@@ -0,0 +1,88 @@
+#!/bin/bash
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
+#
+# sql-bulk-delete-warn: warn when a SQL DELETE/UPDATE statement is about to
+# run via psql / mysql / sqlite3 / sqlcmd without a row-count safeguard.
+#
+# Motivated by Issue #56738 (claude-code, 2026-05-06): a regex with capture
+# groups in regexp_match returned NULL for nearly every row, and the
+# subsequent `DELETE FROM table WHERE _clean_title IS NULL` wiped 24,472 of
+# 24,475 rows. autovacuum cleaned dead tuples within ~5 minutes, blocking
+# pg_dirtyread recovery. 3 days of scraping work permanently lost.
+#
+# Detected high-risk patterns:
+#   1. DELETE / UPDATE with no WHERE clause (full-table touch)
+#   2. DELETE WHERE col IS NULL (Issue #56738 pattern: NULL arises from a
+#      computed column populated by a prior UPDATE that may have failed)
+#   3. DELETE / UPDATE without a LIMIT in MySQL contexts
+#
+# Strict mode: set CC_SQL_BULK_DELETE_BLOCK=1 to exit 2 instead of warning.
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-sql-bulk-delete-warn-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [sql-bulk-delete-warn]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+# Skip non-SQL invocations
+if ! echo "$COMMAND" | grep -qiE '(^|[ \t/])(psql|mysql|sqlite3?|sqlcmd|cockroach\s+sql|duckdb)\b'; then
+    exit 0
+fi
+
+# Skip pure SELECT / EXPLAIN / DESCRIBE invocations
+if ! echo "$COMMAND" | grep -qiE '\b(DELETE|UPDATE|TRUNCATE|DROP)\b'; then
+    exit 0
+fi
+
+WARN=""
+
+# Pattern 1: DELETE / UPDATE without WHERE
+if echo "$COMMAND" | grep -qiE '\b(DELETE\s+FROM|UPDATE)\s+[a-zA-Z_][a-zA-Z0-9_."]*\s*(;|$)'; then
+    WARN="${WARN}WARNING: DELETE/UPDATE without a WHERE clause detected (full-table touch).
+"
+fi
+if echo "$COMMAND" | grep -qiE '\b(DELETE\s+FROM|UPDATE)\s+[a-zA-Z_][a-zA-Z0-9_."]*\s+(SET\s+[^;]*\s*;|;|$)' && \
+   ! echo "$COMMAND" | grep -qiE '\bWHERE\b'; then
+    WARN="${WARN}WARNING: DELETE/UPDATE without WHERE detected (full-table touch).
+"
+fi
+
+# Pattern 2: DELETE WHERE column IS NULL  (Issue #56738 pattern)
+if echo "$COMMAND" | grep -qiE 'DELETE\s+FROM\s+[a-zA-Z_][a-zA-Z0-9_."]*\s+WHERE\s+[a-zA-Z_][a-zA-Z0-9_.]*\s+IS\s+NULL'; then
+    WARN="${WARN}WARNING: 'DELETE WHERE col IS NULL' pattern detected. If the column was just populated by a regex/UPDATE, a silent NULL on most rows wipes nearly the whole table (Issue #56738: 24,472 of 24,475 rows lost).
+SUGGESTION: run 'SELECT COUNT(*) FROM <table> WHERE <col> IS NULL' first; if the count is unexpectedly high, the populating step failed.
+"
+fi
+
+# Pattern 3: TRUNCATE / DROP without explicit guard
+if echo "$COMMAND" | grep -qiE '\bTRUNCATE\s+TABLE\b'; then
+    WARN="${WARN}WARNING: TRUNCATE TABLE detected. This bypasses transaction logs in some engines and is non-recoverable.
+"
+fi
+
+# Pattern 4: psql -c '...' inline with DELETE/UPDATE  (no transaction wrapping)
+if echo "$COMMAND" | grep -qiE 'psql\s+.*-c\s+["\047][^"\047]*\b(DELETE|UPDATE|TRUNCATE)\b' && \
+   ! echo "$COMMAND" | grep -qiE '\b(BEGIN|START\s+TRANSACTION)\b'; then
+    WARN="${WARN}WARNING: psql -c with DELETE/UPDATE/TRUNCATE has no explicit transaction. autocommit may persist the change before you can verify.
+SUGGESTION: wrap in BEGIN; ... ROLLBACK; first to check row counts before COMMIT.
+"
+fi
+
+if [ -n "$WARN" ]; then
+    printf '%s' "$WARN" >&2
+    if [ "${CC_SQL_BULK_DELETE_BLOCK:-0}" = "1" ]; then
+        echo "BLOCKED by sql-bulk-delete-warn (strict mode). Unset CC_SQL_BULK_DELETE_BLOCK to convert to advisory." >&2
+        exit 2
+    fi
+fi
+
+exit 0

package/examples/ssh-key-protect.sh

@@ -10,6 +10,18 @@
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-ssh-key-protect-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [ssh-key-protect]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 

package/examples/staged-secret-scan.sh

@@ -18,6 +18,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-staged-secret-scan-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [staged-secret-scan]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0
@@ -52,7 +64,16 @@ if echo "$DIFF" | grep -qE '^\+.*AKIA[0-9A-Z]{16}'; then
 fi
 
 # Common API key prefixes
-if echo "$DIFF" | grep -qE '^\+.*(sk-[a-zA-Z0-9]{20,}|pk_[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{36}|gho_[a-zA-Z0-9]{36}|glpat-[a-zA-Z0-9]{20}|xoxb-[0-9]{10,})'; then
+if echo "$DIFF" | grep -qE '^\+.*(pk_[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{36}|gho_[a-zA-Z0-9]{36}|glpat-[a-zA-Z0-9]{20}|xoxb-[0-9]{10,})'; then
+    echo "BLOCKED: API key/token detected in staged changes" >&2
+    FOUND=1
+fi
+
+# OpenAI keys. 2026-08: いまの鍵は `sk-proj-` で始まり区切りの `-` `_` を含むので、
+# 文字集合に `-` `_` を入れる。ただし入れた途端に `disk-usage-…` `task-management-…`
+# の中の `sk-` へ当たるようになるため、左の境界を必ず一組で持たせる。
+# 差分の行は `^\+` を先に食うので、直後に来る場合と途中に来る場合を分けて書く。
+if echo "$DIFF" | grep -qE '^\+(sk-[A-Za-z0-9_-]{20,}|.*[^A-Za-z0-9]sk-[A-Za-z0-9_-]{20,})'; then
     echo "BLOCKED: API key/token detected in staged changes" >&2
     FOUND=1
 fi

package/examples/stale-temp-settings-detector.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+# ================================================================
+# stale-temp-settings-detector.sh — Warn when /tmp holds a stale
+#   claude-settings file owned by a different local user.
+# ================================================================
+# PURPOSE:
+#   Claude Desktop launches Claude Code with `--settings '{}'` and
+#   writes the inline payload to /tmp/claude-settings-<hash>.json.
+#   The hash is deterministic across users on the same host, so a
+#   stale file owned by user A blocks a fresh start by user B with
+#   EACCES, and the only message the user sees is "Claude Code
+#   process exited with code 1".
+#
+# TRIGGER: SessionStart
+# MATCHER: (none)
+#
+# WHY THIS MATTERS:
+#   Issue #57224 (filed 2026-05-08, area:security) describes a
+#   shared-host crash where a stale /tmp/claude-settings-44136fa
+#   355b3678a.json owned by another local user blocked startup.
+#   The error surfacing was masked into "process exited with code 1".
+#
+#   This detector scans /tmp at session start, lists any
+#   claude-settings-*.json owned by other users, and surfaces the
+#   actual owner names so the user can act before retrying.
+#
+# CONFIGURATION:
+#   STALE_TEMP_SETTINGS_DISABLE  set to 1 to silence this hook
+#
+# RELATED ISSUES:
+#   https://github.com/anthropics/claude-code/issues/57224
+# ================================================================
+
+set -u
+
+[ "${STALE_TEMP_SETTINGS_DISABLE:-0}" = "1" ] && exit 0
+
+LOG_DIR="${HOME}/.claude/logs"
+mkdir -p "$LOG_DIR" 2>/dev/null
+
+INPUT=$(cat 2>/dev/null || true)
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)
+[ -z "$SESSION_ID" ] && SESSION_ID="unknown-$(date +%s)"
+
+# One warning per session
+WARN_LOG="$LOG_DIR/stale-temp-settings-warned-$SESSION_ID"
+[ -f "$WARN_LOG" ] && exit 0
+
+CURRENT_UID=$(id -u 2>/dev/null || echo "")
+[ -z "$CURRENT_UID" ] && exit 0
+
+# Find files matching the pattern. -maxdepth 1 keeps the scan scoped.
+# Suppress errors so a missing /tmp or restricted access exits cleanly.
+MATCHES=$(find /tmp -maxdepth 1 -name 'claude-settings-*.json' -type f 2>/dev/null)
+[ -z "$MATCHES" ] && exit 0
+
+FOREIGN=""
+while IFS= read -r path; do
+    [ -z "$path" ] && continue
+    # Skip if we cannot stat the file
+    OWNER_UID=$(stat -c '%u' "$path" 2>/dev/null) || continue
+    if [ "$OWNER_UID" != "$CURRENT_UID" ]; then
+        OWNER_NAME=$(stat -c '%U' "$path" 2>/dev/null)
+        FOREIGN="${FOREIGN}  $path  (owner: ${OWNER_NAME:-uid=$OWNER_UID})"$'\n'
+    fi
+done <<< "$MATCHES"
+
+if [ -n "$FOREIGN" ]; then
+    cat >&2 <<MSG
+stale-temp-settings-detector: /tmp holds claude-settings file(s)
+owned by a different user. Claude Desktop's inline-settings
+launch path uses a deterministic name and will fail with EACCES
+on collision, surfacing only "process exited with code 1".
+
+Foreign files:
+${FOREIGN}
+If you have permission, remove them and retry. Otherwise, ask the
+host administrator to clean /tmp/claude-settings-*.json or wait
+for the other user's session to finish.
+
+Background: Issue #57224 (filed 2026-05-08, area:security).
+MSG
+    touch "$WARN_LOG"
+fi
+
+exit 0

package/examples/standing-rule-session-surfacer.sh

@@ -0,0 +1,137 @@
+#!/bin/bash
+# ================================================================
+# standing-rule-session-surfacer.sh — Surface standing rules from
+# user's auto-memory files on every SessionStart so the model
+# cannot "load but forget" them across a long session
+# ================================================================
+# PURPOSE:
+#   Issue #59944 documents an entire 5-hour Claude Code session
+#   in which a user-stored "STANDING RULE" (marked "third strike"
+#   in the operator's own memory file, indexed in MEMORY.md as
+#   always-loaded) was read at session start, then violated across
+#   8 backend commits, with the model only acknowledging the rule
+#   existed after the operator asked a direct point-blank question
+#   about it.
+#
+#   The structural failure: auto-memory loads files, but does not
+#   bind behavior. The rule sits in the system prompt as text,
+#   indistinguishable from any other text. Without a visible,
+#   load-bearing surfacing at session start, "STANDING RULE" lines
+#   carry no more weight than a comment.
+#
+#   This hook surfaces matching lines (STANDING RULE / strict /
+#   third strike / MUST / NEVER / ALWAYS) from the user's memory
+#   files into a SessionStart system-reminder block. Re-stating
+#   the rule, in load-bearing position, on every new session is
+#   the cheapest possible defense.
+#
+# TRIGGER: SessionStart
+# MATCHER: (none)
+#
+# WHY THIS MATTERS:
+#   - #59944 reporter's exact framing: "Claude Code read this file
+#     at session start. Then it spent the entire session doing
+#     backend-only curl probes on tasks the simulation doc
+#     explicitly described as UI surfaces."
+#   - #59938 (v2.1.128) is the same structural failure on a
+#     different surface (CLAUDE.md instead of memory file), with
+#     the model directly confessing after the fact: "The rule is
+#     already in both CLAUDE.md and my memory file — I just failed
+#     to apply it."
+#   - Two independent reporters, two different versions, two
+#     surfaces (auto-memory and CLAUDE.md), one structural shape.
+#
+# CONFIGURATION:
+#   CC_STANDING_RULE_MAX_LINES  — max lines surfaced per file
+#                                 (default: 8). Long memory files
+#                                 must be allowed to grow without
+#                                 flooding the system prompt.
+#   CC_STANDING_RULE_PATTERN    — regex of rule markers to surface
+#                                 (default: documented below).
+#   CC_STANDING_RULE_MEMORY_DIR — alternate memory directory to
+#                                 scan. Default scans every
+#                                 .claude/projects/*/memory/ under
+#                                 $HOME.
+#
+# OUTPUT:
+#   A JSON object on stdout with `hookSpecificOutput.additionalContext`
+#   containing the surfaced rules. Claude Code injects this as a
+#   system-reminder for the new session.
+#
+# RELATED ISSUES:
+#   https://github.com/anthropics/claude-code/issues/59944
+#   https://github.com/anthropics/claude-code/issues/59938
+# ================================================================
+
+set -u
+
+MAX_LINES="${CC_STANDING_RULE_MAX_LINES:-8}"
+PATTERN="${CC_STANDING_RULE_PATTERN:-STANDING RULE|third strike|strict rule|MUST NOT|MUST ALWAYS|NEVER do|ALWAYS do|絶対|必ず|してはいけない|やるな}"
+
+# Find every memory directory. Default: $HOME/.claude/projects/*/memory/
+# (the auto-memory layout Claude Code uses today). Operators can override
+# via CC_STANDING_RULE_MEMORY_DIR for a single explicit directory.
+if [ -n "${CC_STANDING_RULE_MEMORY_DIR:-}" ]; then
+    MEMORY_DIRS=("$CC_STANDING_RULE_MEMORY_DIR")
+else
+    mapfile -t MEMORY_DIRS < <(find "$HOME/.claude/projects" -maxdepth 2 -type d -name memory 2>/dev/null)
+fi
+
+[ ${#MEMORY_DIRS[@]} -eq 0 ] && exit 0
+
+# Collect matching lines from every .md file in every memory dir.
+# Limit to MAX_LINES per file to prevent flooding.
+COLLECTED=""
+SCANNED=0
+
+for dir in "${MEMORY_DIRS[@]}"; do
+    [ -d "$dir" ] || continue
+    for f in "$dir"/*.md; do
+        [ -f "$f" ] || continue
+        SCANNED=$((SCANNED + 1))
+        # Grab matching lines, limit, prefix with the filename.
+        matches=$(grep -nE "$PATTERN" "$f" 2>/dev/null | head -n "$MAX_LINES" || true)
+        if [ -n "$matches" ]; then
+            relname=$(basename "$f")
+            COLLECTED="${COLLECTED}
+[${relname}]
+${matches}
+"
+        fi
+    done
+done
+
+# Nothing matched. Exit cleanly. The user has no standing rules
+# in their memory layer; this hook produces no output.
+if [ -z "$COLLECTED" ]; then
+    exit 0
+fi
+
+# Build the additionalContext payload. The leading message frames
+# the rules as load-bearing, not advisory. This phrasing is
+# deliberate: it tells the model that these rules apply to the
+# session it is about to start, not just to past conversations.
+CONTEXT="===== STANDING RULES FROM AUTO-MEMORY =====
+The following rules were marked as STANDING / MUST / NEVER / ALWAYS / 必ず /
+絶対 etc. in your memory files, scanned at session start. They apply to this
+session immediately. Read them. Apply them. If you find yourself about to
+take an action that conflicts with one, stop and verify the conflict before
+proceeding.
+
+Scanned ${SCANNED} memory file(s) across ${#MEMORY_DIRS[@]} memory director(y/ies).
+${COLLECTED}
+===== END STANDING RULES ====="
+
+# Emit as JSON for Claude Code to consume. The hookSpecificOutput
+# schema is the documented surface for SessionStart hooks to inject
+# additional context.
+jq -n \
+    --arg ctx "$CONTEXT" \
+    '{
+        hookSpecificOutput: {
+            hookEventName: "SessionStart",
+            additionalContext: $ctx
+        }
+    }'
+
+exit 0