cc-safe-setup 29.8.0 → 30.0.4

package/examples/subagent-tool-call-limiter.sh

@@ -11,38 +11,110 @@
 # TRIGGER: PreToolUse
 # MATCHER: ""
 
+__CC_HOOK_INPUT=$(cat 2>/dev/null)
+# --- セッション識別子でファイルを分ける (2026-08-09 修正) ---
+# 旧実装は "$$" を使っていたが、$$ はこのスクリプト自身のPIDで呼び出しごとに変わるため、
+# 状態が一度も持続しなかった(実測: 200回呼ぶとファイルが200個でき、中身は全部 1)。
+__CC_SID=""
+if [ -n "${__CC_HOOK_INPUT:-}" ]; then
+  if command -v jq >/dev/null 2>&1; then
+    __CC_SID=$(printf '%s' "$__CC_HOOK_INPUT" | jq -r '.session_id // .sessionId // empty' 2>/dev/null)
+  fi
+  if [ -z "$__CC_SID" ] && command -v python3 >/dev/null 2>&1; then
+    __CC_SID=$(printf '%s' "$__CC_HOOK_INPUT" | python3 -c 'import sys,json
+try:
+    d=json.load(sys.stdin); print(d.get("session_id") or d.get("sessionId") or "")
+except Exception: print("")' 2>/dev/null)
+  fi
+fi
+if [ -n "$__CC_SID" ]; then
+  __CC_KEY=$(printf '%s' "$__CC_SID" | tr -c 'A-Za-z0-9_-' '_' | cut -c1-64)
+else
+  __CC_KEY="nosession-$(date +%Y%m%d)"
+fi
+# --- ここまで ---
+
 set -euo pipefail
 
 MAX_CALLS="${CC_MAX_TOOL_CALLS:-200}"
-COUNTER_FILE="/tmp/claude-tool-call-counter-$$"
+COUNTER_FILE="/tmp/claude-tool-call-counter-$__CC_KEY"
 
-# Use session-based counter (PID of parent process)
-PPID_FILE="/tmp/claude-tool-call-counter-${PPID:-0}"
-[ -f "$PPID_FILE" ] && COUNTER_FILE="$PPID_FILE"
+# 2026-08-09: $PPID を使う旧機構を削除した。
+# 旧実装は $PPID(親プロセスのID)をセッションの識別子として使っていた。
+# ★訂正: 最初これを「一度も遮断しない」と書いたが、それは計測の誤りだった。
+#   親が安定していれば $PPID は持続するので、上限10で15回叩くと11回目から5回遮断する(実測)。
+#   「200回で遮断0回」という最初の測定は、こちらが $( ) の中で呼んだせいで
+#   呼び出しごとに別のサブシェルが親になっていたためで、仕掛けが作った結果だった。
+# 実際に残る欠陥はこちら: $PPID はセッションの識別子ではない。
+#   同じ親から複数のセッションが走ると**カウンターが混ざる**。
+#   実測: 同じ親から session_id が sX と sY の呼び出しを6回ずつ交互に流すと、
+#   カウンターファイルは1個だけで値は12(=6+6)。片方のセッションが上限を使い切ると、
+#   もう片方が何もしていなくても遮断される。
+# 修正: hookの入力JSONの session_id で分ける。
+#
+# ★2026-08-27 追記: session_id だけでは、このhookの名前が約束していることができない。
+#   PreToolUse の入力を丸ごと落として実測したところ、サブエージェントの呼び出しでも
+#   session_id は親と1バイトも違わない(transcript_path も同じ)。増えるのは agent_id と
+#   agent_type の2つだけ。つまり session_id を鍵にしたカウンターは、親と全サブエージェントの
+#   合算になる。#36727 の「1体のサブエージェントが1.5時間で234回」を止めたくても、
+#   合算のカウンターでは「誰が使ったか」が分からず、暴走した子が枠を焼き切ると
+#   何もしていない親まで止まる。
+#   → セッション全体の上限はそのままに、agent_id ごとの上限を足した。
+#     どちらか先に達したほうで止める。合計の上限は変えていないので、緩くはならない。
 
-# Initialize or read counter
-if [ -f "$COUNTER_FILE" ]; then
-  COUNT=$(cat "$COUNTER_FILE" 2>/dev/null || echo 0)
-else
-  COUNT=0
-  COUNTER_FILE="$PPID_FILE"
+MAX_SUBAGENT_CALLS="${CC_MAX_SUBAGENT_TOOL_CALLS:-100}"
+
+# agent_id はサブエージェントの呼び出しにだけ入る(実測)。上位エージェントでは空。
+__CC_AID=""
+if [ -n "${__CC_HOOK_INPUT:-}" ] && command -v jq >/dev/null 2>&1; then
+  __CC_AID=$(printf '%s' "$__CC_HOOK_INPUT" | jq -r '.agent_id // empty' 2>/dev/null)
 fi
+__CC_AKEY=$(printf '%s' "$__CC_AID" | tr -c 'A-Za-z0-9_-' '_' | cut -c1-64)
+AGENT_COUNTER_FILE="/tmp/claude-tool-call-counter-$__CC_KEY-agent-$__CC_AKEY"
 
-COUNT=$((COUNT + 1))
-echo "$COUNT" > "$COUNTER_FILE"
+read_counter() {
+  _v=0
+  if [ -f "$1" ]; then
+    _v=$(cat "$1" 2>/dev/null || echo 0)
+    case "$_v" in ''|*[!0-9]*) _v=0 ;; esac
+  fi
+  printf '%s' "$_v"
+}
 
-# Check limit
+COUNT=$(( $(read_counter "$COUNTER_FILE") + 1 ))
+AGENT_COUNT=0
+[ -n "$__CC_AID" ] && AGENT_COUNT=$(( $(read_counter "$AGENT_COUNTER_FILE") + 1 ))
+
+# ★記録は遮断を決めた後に置く。先に書くと、案内を読んで再試行するたびに
+#   カウンターが増えて待ち時間が自分の再試行で延びる(2026-07-28 に別のhookで実害)。
 if [ "$COUNT" -gt "$MAX_CALLS" ]; then
-  echo "BLOCKED: Tool call limit reached ($COUNT/$MAX_CALLS)." >&2
-  echo "This session has made $COUNT tool calls (limit: $MAX_CALLS)." >&2
+  echo "BLOCKED: Tool call limit reached ($COUNT/$MAX_CALLS) for this session." >&2
+  echo "This session (parent and all subagents share one session_id) has made" >&2
+  echo "$COUNT tool calls (limit: $MAX_CALLS)." >&2
   echo "Consider starting a new session or increasing CC_MAX_TOOL_CALLS." >&2
   exit 2
 fi
 
+if [ -n "$__CC_AID" ] && [ "$AGENT_COUNT" -gt "$MAX_SUBAGENT_CALLS" ]; then
+  echo "BLOCKED: Subagent tool call limit reached ($AGENT_COUNT/$MAX_SUBAGENT_CALLS)." >&2
+  echo "Subagent agent_id=$__CC_AID has made $AGENT_COUNT tool calls on its own." >&2
+  echo "The session as a whole is still at $COUNT/$MAX_CALLS, so the parent is not blocked." >&2
+  echo "Raise CC_MAX_SUBAGENT_TOOL_CALLS if this subagent legitimately needs more." >&2
+  exit 2
+fi
+
+echo "$COUNT" > "$COUNTER_FILE"
+[ -n "$__CC_AID" ] && echo "$AGENT_COUNT" > "$AGENT_COUNTER_FILE"
+
 # Warn at 80%
 WARN_AT=$((MAX_CALLS * 80 / 100))
 if [ "$COUNT" -eq "$WARN_AT" ]; then
   echo "WARNING: $COUNT/$MAX_CALLS tool calls used (80%). Consider wrapping up." >&2
 fi
 
+AGENT_WARN_AT=$((MAX_SUBAGENT_CALLS * 80 / 100))
+if [ -n "$__CC_AID" ] && [ "$AGENT_COUNT" -eq "$AGENT_WARN_AT" ]; then
+  echo "WARNING: subagent $__CC_AID is at $AGENT_COUNT/$MAX_SUBAGENT_CALLS of its own budget." >&2
+fi
+
 exit 0

package/examples/subcommand-chain-guard.sh

@@ -15,6 +15,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-subcommand-chain-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [subcommand-chain-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 THRESHOLD=${CC_SUBCOMMAND_LIMIT:-20}
 
 INPUT=$(cat)

package/examples/subscription-api-billing-warner.sh

@@ -0,0 +1,160 @@
+#!/bin/bash
+# ================================================================
+# subscription-api-billing-warner.sh — Warn at session start when the
+#   active configuration will silently bill API / purchased credits
+#   *above* a Claude Pro/Max subscription, so a subscriber does not
+#   keep draining pay-per-token credits while subscription quota sits
+#   unused.
+# ================================================================
+# PURPOSE:
+#   Claude Code's credential precedence puts API-key auth ABOVE an
+#   OAuth subscription: if ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN
+#   is set, or settings.json defines an apiKeyHelper, every request
+#   authenticates as a pay-per-token API call and bills the
+#   Console/purchased credits — even when the user has a Pro/Max
+#   subscription with quota to spare. Because nothing in the UI
+#   surfaces this, subscribers lose real money without knowing an
+#   API key is in play.
+#
+#   This is a recurring, money-losing pain on the issue tracker:
+#     #64613  API requests consuming personal token quota when
+#             subscription tokens available
+#     #53638  Desktop silently uses project API keys for billing
+#             instead of the subscription
+#     #53728  Silent ANTHROPIC_API_KEY precedence shadows Max
+#             subscription auth
+#     #54677  [FR] Distinguish API key vs OAuth subscription billing
+#
+#   The hook inspects, at session start, the three locally-detectable
+#   precedence sources (the two env vars and an apiKeyHelper in
+#   user/project settings.json). If any is present it emits a one-line
+#   stderr advisory naming the precedence rule and the one-command
+#   confirmation (/status), then continues. Advisory only (exit 0);
+#   it never blocks the session and never reads the key value.
+#
+#   It is deliberately conservative about noise: someone who runs on
+#   API billing on purpose (no subscription, or multiple deliberate
+#   API-key accounts) can silence it permanently, and it auto-skips
+#   when ANTHROPIC_ACCOUNT_LABEL is set — the same signal the
+#   account-routing-preflight.sh hook uses to mark intentional
+#   multi-account API use.
+#
+# TRIGGER: SessionStart
+# MATCHER: ""
+#
+# SETUP:
+#   {
+#     "hooks": {
+#       "SessionStart": [
+#         {
+#           "matcher": "",
+#           "hooks": [
+#             { "type": "command",
+#               "command": "$HOME/.claude/hooks/subscription-api-billing-warner.sh" }
+#           ]
+#         }
+#       ]
+#     }
+#   }
+#
+# BEHAVIOR:
+#   - No API-key env var and no apiKeyHelper → silent pass.
+#   - Any precedence source present → stderr advisory + exit 0.
+#   - Never blocks; never prints the key/token value.
+#
+# CONFIGURATION (env vars):
+#   CC_SUB_BILLING_DISABLE   Set to "1" to disable the hook entirely.
+#   ANTHROPIC_ACCOUNT_LABEL  If set (non-empty), the hook stays silent:
+#                            an explicit account label signals the
+#                            operator is managing API billing on
+#                            purpose (mirrors account-routing-preflight).
+#   CC_SUB_BILLING_SETTINGS_OVERRIDE
+#                            Colon-separated list of settings.json paths
+#                            to scan for apiKeyHelper instead of the real
+#                            ~/.claude/settings.json and ./.claude/
+#                            settings.json. Used by tests/CI.
+# ================================================================
+
+set -u
+
+if [ "${CC_SUB_BILLING_DISABLE:-0}" = "1" ]; then
+    exit 0
+fi
+
+# Read and discard the SessionStart JSON payload; the hook only
+# inspects the environment and settings files, not the payload.
+if [ ! -t 0 ]; then
+    cat >/dev/null 2>&1 || true
+fi
+
+# An explicit account label means the operator is managing API-key
+# billing deliberately — stay silent to avoid nagging that case.
+if [ -n "${ANTHROPIC_ACCOUNT_LABEL:-}" ]; then
+    exit 0
+fi
+
+REASONS=""
+
+if [ -n "${ANTHROPIC_API_KEY:-}" ]; then
+    REASONS="${REASONS}   • ANTHROPIC_API_KEY is set in this environment
+"
+fi
+
+if [ -n "${ANTHROPIC_AUTH_TOKEN:-}" ]; then
+    REASONS="${REASONS}   • ANTHROPIC_AUTH_TOKEN is set in this environment
+"
+fi
+
+# Scan settings.json files for an apiKeyHelper, which injects a key on
+# every request even when no env var is set.
+if [ -n "${CC_SUB_BILLING_SETTINGS_OVERRIDE:-}" ]; then
+    SETTINGS_LIST="${CC_SUB_BILLING_SETTINGS_OVERRIDE//:/
+}"
+else
+    SETTINGS_LIST="${HOME:-/root}/.claude/settings.json
+./.claude/settings.json"
+fi
+
+while IFS= read -r SETTINGS_FILE; do
+    [ -z "$SETTINGS_FILE" ] && continue
+    [ -r "$SETTINGS_FILE" ] || continue
+    # Tolerant key-presence check (no jq dependency): a JSON object key
+    # "apiKeyHelper" with a non-empty string value.
+    if grep -Eq '"apiKeyHelper"[[:space:]]*:[[:space:]]*"[^"]+"' "$SETTINGS_FILE" 2>/dev/null; then
+        REASONS="${REASONS}   • apiKeyHelper is configured in ${SETTINGS_FILE}
+"
+    fi
+done <<EOF
+$SETTINGS_LIST
+EOF
+
+if [ -n "$REASONS" ]; then
+    cat >&2 <<EOF
+
+⚠️  This session may bill API / purchased credits instead of your subscription.
+
+   Claude Code's credential precedence puts API-key auth ABOVE an
+   OAuth subscription. Detected:
+${REASONS}
+   If you have a Claude Pro/Max subscription, requests are likely
+   spending pay-per-token (Console/purchased) credits even while your
+   subscription quota is unused — the cause of the "subscription at 0%
+   but my purchased balance is draining" reports (#64613, #53638, #53728).
+
+   Confirm and fix:
+     1. Run /status — it names the active auth method (subscription vs API).
+     2. To use the subscription: unset the variable(s) above, and check the
+        shell profile (.zshrc/.bashrc/.profile) and any .env / direnv .envrc
+        that re-export them; remove apiKeyHelper from settings.json; and in
+        /config turn off "Use custom API key".
+     3. If money was already charged while a subscription was active, a
+        billing review at https://support.claude.com can refund a misroute.
+
+   This is an advisory; the session continues.
+   Set CC_SUB_BILLING_DISABLE=1 (or ANTHROPIC_ACCOUNT_LABEL for deliberate
+   API-key accounts) to silence it.
+
+EOF
+fi
+
+exit 0

package/examples/subscription-bypass-detector.sh

@@ -0,0 +1,152 @@
+#!/bin/bash
+# subscription-bypass-detector.sh — SessionStart hook
+# Trigger: SessionStart
+# Matcher: ""
+#
+# Solves: anthropics/claude-code#60093 — operator with an active Max/Pro
+#         subscription accumulated approximately USD 1,050 in API charges
+#         across nine auto-refills over three days (2026-05-05 to 2026-05-07)
+#         because a dotenv-loaded ANTHROPIC_API_KEY silently overrode the
+#         subscription path. The UI displayed "Sonnet" throughout while
+#         billing routed through API-key Opus pricing. The operator had no
+#         in-session signal that the billing path had switched.
+#
+#         The official support response was that this behavior is
+#         "intentional functionality" (the env var taking precedence over
+#         the subscription credential is documented somewhere but not on
+#         the path operators read), making operator-side detection the only
+#         reliable prevention.
+#
+#         Earlier related case: a separate operator lost USD 187 in May
+#         2026 from the same structural pattern (dotenv ANTHROPIC_API_KEY
+#         silently bypassing the subscription). The pattern is recurring.
+#
+# Class of failure: claim-vs-reality divergence at the billing-routing layer.
+#         The operator's mental model ("I subscribed, therefore I pay the
+#         subscription rate") and the runtime behavior ("API key in env
+#         takes precedence, so charges flow through metered API pricing")
+#         have diverged silently. The status surface (UI showing the
+#         expected model) reinforces the wrong mental model.
+#
+# HOW IT WORKS:
+#   At session start, inspect the resolved environment for ANTHROPIC_API_KEY
+#   (or related vendor-key env vars). If any are present, emit a SessionStart
+#   warning that explicitly states: (1) the env var was detected, (2) this
+#   bypasses subscription billing on the affected path, (3) the operator's
+#   choices are to unset the env var (subscription billing) or to
+#   acknowledge the API-key billing path explicitly.
+#
+#   The hook reads the dotenv-style files Claude Code is known to load
+#   (~/.claude/.env, project .env, $HOME/.env) and surfaces which file is
+#   the source of the key, so the operator can disable the right line.
+#
+# WHY THIS MATTERS:
+#   Issue #60093 is one of the largest single-incident dollar losses in the
+#   May 2026 claim-vs-reality cluster (USD 1,050 across 9 auto-refills before
+#   the operator noticed). The cost is concentrated and irreversible at the
+#   billing layer (charges already accrued cannot be reversed by adjusting
+#   settings). Pre-session detection is the only reliable defense; in-session
+#   detection happens too late.
+#
+# TRIGGER: SessionStart
+# MATCHER: ""
+#
+# CONFIGURATION:
+#   CC_SUBSCRIPTION_BYPASS_DISABLE=1   disable this hook entirely
+#   CC_SUBSCRIPTION_BYPASS_ACK=1       acknowledge API-key billing is intended
+#                                       (suppresses the warning but keeps the
+#                                        detection log entry)
+#   CC_SUBSCRIPTION_BYPASS_LOG=path    append detection events to this file
+#                                       (default off)
+#
+# SAFETY:
+#   - Read-only on the environment and on .env files.
+#   - Does not modify, unset, or interact with the keys themselves.
+#   - Emits a warning to stderr; does not block the session.
+#   - Exit 0 always.
+#
+# REFERENCES:
+#   - anthropics/claude-code#60093 (2026-05-18, USD 1,050 case)
+#   - Earlier May 2026 case: USD 187 dotenv-bypass incident (community report,
+#     surfaced via a Qiita writeup published 2026-05-15)
+set -euo pipefail
+
+[ "${CC_SUBSCRIPTION_BYPASS_DISABLE:-}" = "1" ] && exit 0
+
+# Collect signal sources. Each signal is reported only if the value is
+# non-empty after the env var resolves.
+declare -a SOURCES=()
+
+# Direct env var check
+if [ -n "${ANTHROPIC_API_KEY:-}" ]; then
+    SOURCES+=("process environment (ANTHROPIC_API_KEY is set in the shell that launched this session)")
+fi
+
+# Look for the key in the standard dotenv search paths Claude Code is
+# documented to consult.
+check_dotenv_for_key() {
+    local path="$1"
+    local label="$2"
+    [ ! -f "$path" ] && return 0
+    if grep -qE '^[[:space:]]*ANTHROPIC_API_KEY[[:space:]]*=' "$path" 2>/dev/null; then
+        SOURCES+=("$label ($path)")
+    fi
+}
+
+check_dotenv_for_key "$HOME/.claude/.env" "Claude per-user dotenv"
+check_dotenv_for_key "$HOME/.env" "user home dotenv"
+check_dotenv_for_key "$PWD/.env" "project working-directory dotenv"
+
+# Git-repo root dotenv (if we're inside a repo and it's different from cwd)
+if command -v git >/dev/null 2>&1; then
+    GIT_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || true)
+    if [ -n "$GIT_ROOT" ] && [ "$GIT_ROOT" != "$PWD" ]; then
+        check_dotenv_for_key "$GIT_ROOT/.env" "git repository root dotenv"
+    fi
+fi
+
+# If no sources were found, exit silently.
+if [ "${#SOURCES[@]}" -eq 0 ]; then
+    exit 0
+fi
+
+# Build the warning body
+SOURCE_LIST=""
+for src in "${SOURCES[@]}"; do
+    SOURCE_LIST="${SOURCE_LIST}\n  - ${src}"
+done
+
+WARNING_BODY="ANTHROPIC_API_KEY detected at session start. Source(s):${SOURCE_LIST}
+
+Implication: if an ANTHROPIC_API_KEY is resolved in the environment, Claude Code routes billing through metered API-key pricing rather than your Max/Pro subscription, on the affected codepath. This is intentional per Anthropic support but it is not surfaced in-session — the UI continues to display the selected model normally while charges accumulate against the API key.
+
+Issue #60093 (2026-05-18) documents a single operator accumulating ~USD 1,050 across 9 auto-refills over 3 days (2026-05-05 to 2026-05-07) before the divergence was noticed. An earlier May 2026 case surfaced a ~USD 187 loss from the same pattern. The cost is incurred at billing time and cannot be reversed by adjusting settings after the fact.
+
+To use subscription billing on this session: unset ANTHROPIC_API_KEY in the shell (or remove the matching line from the source file above) and restart Claude Code.
+
+To acknowledge that API-key billing is intended for this session, set CC_SUBSCRIPTION_BYPASS_ACK=1; the warning will be suppressed for future sessions but a log entry will still record the detection if CC_SUBSCRIPTION_BYPASS_LOG is set."
+
+# Optional logging
+if [ -n "${CC_SUBSCRIPTION_BYPASS_LOG:-}" ]; then
+    {
+        printf '[%s] subscription-bypass-detected: sources=%d sources_list=%s\n' \
+            "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${#SOURCES[@]}" "${SOURCES[*]}"
+    } >> "$CC_SUBSCRIPTION_BYPASS_LOG" 2>/dev/null || true
+fi
+
+# Suppress visible warning if acknowledged
+if [ "${CC_SUBSCRIPTION_BYPASS_ACK:-}" = "1" ]; then
+    exit 0
+fi
+
+# Emit warning via SessionStart hookSpecificOutput
+jq -n \
+    --arg ctx "$(printf '%b' "$WARNING_BODY")" \
+    '{
+        hookSpecificOutput: {
+            hookEventName: "SessionStart",
+            additionalContext: $ctx
+        }
+    }'
+
+exit 0

package/examples/svelte-lint-on-edit.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PostToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/swift-build-on-edit.sh

@@ -18,7 +18,7 @@
 # }
 # ================================================================
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PostToolUse  MATCHER: "Edit|Write"
 
 INPUT=$(cat)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)

package/examples/symlink-guard.sh

@@ -20,6 +20,18 @@
 # GitHub Issues: #36339 (93r), #764 (63r), #24964 (135r)
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-symlink-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [symlink-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
@@ -32,8 +44,21 @@ if ! echo "$COMMAND" | grep -qE '^\s*rm\s+.*-[rf]'; then
     exit 0
 fi
 
-# Extract target path
-TARGET=$(echo "$COMMAND" | grep -oP 'rm\s+(-[rf]+\s+)*\K\S+' | tail -1)
+# Extract target path.
+# grep -P is GNU-only; macOS ships BSD grep, which rejects -P and returns nothing.
+# TARGET would then be empty and the "[[ -z ]] && exit 0" below would let every
+# rm through — the guard would stop guarding without saying anything. Measured:
+# with -P the hook exits 2 on a symlink pointing outside the project, without it
+# it exits 0 on the same input. \K has no POSIX equivalent, so the fallback
+# matches from the command word and strips that prefix afterwards.
+if echo x | grep -qP x 2>/dev/null; then
+    TARGET=$(echo "$COMMAND" | grep -oP 'rm\s+(-[rf]+\s+)*\K\S+' | tail -1)
+else
+    TARGET=$(echo "$COMMAND" \
+        | grep -oE 'rm[[:space:]]+(-[rf]+[[:space:]]+)*[^[:space:]]+' \
+        | tail -1 \
+        | sed -E 's/^rm[[:space:]]+(-[rf]+[[:space:]]+)*//')
+fi
 
 if [[ -z "$TARGET" ]] || [[ ! -e "$TARGET" ]]; then
     exit 0

package/examples/symlink-protect.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)

package/examples/system-dir-protection-guard.sh

@@ -16,15 +16,60 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-system-dir-protection-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [system-dir-protection-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+# --- Look inside wrappers -----------------------------------------------------
+# The three gates below open only when the command *starts* with rm / mv /
+# chmod, so a command inside a substitution, a subshell, or after a shell
+# keyword was never examined. Measured 2026-08-04: this hook blocked the bare
+# deletion and passed all six wrappings of it. Claude Code 2.1.221 fixed the
+# same shape in its own permission check.
+#
+# Replace the wrapping tokens with separators and run this same script once more
+# against that text. Detection only: never executed, and the message keeps the
+# command the user actually sent.
+if [ -n "${CC_SYSDIR_UNWRAPPED:-}" ]; then
+    COMMAND="$CC_SYSDIR_UNWRAPPED"
+elif [ -n "$COMMAND" ]; then
+    _sysdir_unwrapped=$(printf '%s' "$COMMAND" | sed -E \
+        -e 's/\$\(/ ; /g' -e 's/`/ ; /g' \
+        -e 's/(^|[[:space:]])\(/\1 ; /g' -e 's/\)([[:space:]]|$)/ ; \1/g' \
+        -e 's/(^|[[:space:]])(then|do|else|elif)([[:space:]])/\1 ; \3/g')
+    if [ "$_sysdir_unwrapped" != "$COMMAND" ]; then
+        CC_SYSDIR_UNWRAPPED="$_sysdir_unwrapped" bash "$0" </dev/null >/dev/null 2>&1
+        if [ "$?" = "2" ]; then
+            echo "BLOCKED: an operation on a system directory is hidden inside a wrapper." >&2
+            echo "Command: $COMMAND" >&2
+            echo "A substitution, a subshell or a shell keyword does not make it safe." >&2
+            exit 2
+        fi
+    fi
+fi
 [ -z "$COMMAND" ] && exit 0
 
 # Check if a path is a protected system directory
 is_system_dir() {
     local path="$1"
-    # Remove trailing slash
-    path="${path%/}"
+    # Remove a trailing slash -- but never on the root itself.
+    # `${path%/}` turns "/" into "", so the `/` branch in the case below (which
+    # the author did write) could never be reached, and `rm -rf /`, `mv / …`
+    # and `chmod -R 777 /` all walked through while `/etc` was blocked.
+    # Measured 2026-08-03: the root was the one directory this guard named and
+    # then erased one line before checking it.
+    [ "$path" != "/" ] && path="${path%/}"
 
     # Expand ~ to $HOME
     if [[ "$path" == "~"* ]]; then
@@ -55,10 +100,29 @@ is_system_dir() {
     return 1
 }
 
+# The extractions below used grep -oP, which is GNU-only. BSD grep (macOS)
+# rejects -P outright, so every target list came back empty, the loops below
+# had nothing to iterate, and the guard exited 0 — `rm -rf /root` went through
+# on macOS with no sign that the protection was off. The GNU path is unchanged;
+# an equivalent is added for platforms without PCRE.
+if echo x | grep -qP x 2>/dev/null; then HAS_PCRE=1; else HAS_PCRE=0; fi
+
+# $1 = command alternation (e.g. "rm|unlink"), $2 = operand pattern.
+# \K has no POSIX equivalent, so the fallback matches the whole thing and
+# strips the command word and its flags afterwards.
+extract_operand() {
+    if [ "$HAS_PCRE" = 1 ]; then
+        grep -oP "($1)\\s+(-[a-zA-Z]+\\s+)*\\K$2" 2>/dev/null || true
+    else
+        grep -oE "($1)[[:space:]]+(-[a-zA-Z]+[[:space:]]+)*$2" 2>/dev/null \
+            | sed -E "s/^($1)[[:space:]]+(-[a-zA-Z]+[[:space:]]+)*//" || true
+    fi
+}
+
 # --- rm / unlink on system directories ---
-if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?(rm|unlink)\s'; then
+if echo "$COMMAND" | grep -qE '(^|[;&|])[[:space:]]*(sudo[[:space:]]+)?(rm|unlink)[[:space:]]'; then
     # Extract targets after rm and flags
-    TARGETS=$(echo "$COMMAND" | grep -oP '(rm|unlink)\s+(-[a-zA-Z]+\s+)*\K[^;|&]+' 2>/dev/null || true)
+    TARGETS=$(echo "$COMMAND" | extract_operand 'rm|unlink' '[^;|&]+')
     for target in $TARGETS; do
         if is_system_dir "$target"; then
             echo "BLOCKED: Destructive operation on system directory: $target" >&2
@@ -72,9 +136,9 @@ if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?(rm|unlink)\s'; then
 fi
 
 # --- mv (moving system directories) ---
-if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?mv\s'; then
+if echo "$COMMAND" | grep -qE '(^|[;&|])[[:space:]]*(sudo[[:space:]]+)?mv[[:space:]]'; then
     # Get the source of the mv (first non-flag argument)
-    MV_SOURCE=$(echo "$COMMAND" | grep -oP 'mv\s+(-[a-zA-Z]+\s+)*\K\S+' 2>/dev/null || true)
+    MV_SOURCE=$(echo "$COMMAND" | extract_operand 'mv' '[^[:space:]]+')
     if is_system_dir "$MV_SOURCE"; then
         echo "BLOCKED: Moving system directory: $MV_SOURCE" >&2
         echo "Command: $COMMAND" >&2
@@ -86,8 +150,9 @@ if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?mv\s'; then
 fi
 
 # --- chmod -R / chown -R on system directories ---
-if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?(chmod|chown)\s+.*-R'; then
-    TARGETS=$(echo "$COMMAND" | grep -oP '(chmod|chown)\s+[^;|&]+' 2>/dev/null | awk '{print $NF}' || true)
+if echo "$COMMAND" | grep -qE '(^|[;&|])[[:space:]]*(sudo[[:space:]]+)?(chmod|chown)[[:space:]]+.*-R'; then
+    # No \K here, so plain ERE is enough (POSIX classes instead of \s).
+    TARGETS=$(echo "$COMMAND" | grep -oE '(chmod|chown)[[:space:]]+[^;|&]+' 2>/dev/null | awk '{print $NF}' || true)
     for target in $TARGETS; do
         if is_system_dir "$target"; then
             echo "BLOCKED: Recursive permission change on system directory: $target" >&2