cc-safe-setup 29.8.0 → 30.0.4

package/examples/tokenizer-ratio-alert-corpus.sh

@@ -0,0 +1,90 @@
+#!/bin/bash
+# tokenizer-ratio-alert-corpus.sh — 個人 corpus の input_tokens/character_count 比率 drift を検知 (PostToolUse rolling baseline 方式)
+# 関連: examples/tokenizer-ratio-alert.sh は同名異設計の PreToolUse + Anthropic API count_tokens 経由版 (Postmortems Incident 5)
+# Why: Anthropic がトークナイザーを silent に変更 (#46829 関連、Opus 4.7 で 1.35-1.46× インフレ実測 Simon Willison 2026-04-20)。
+#      個人の corpus に対し input_tokens / character_count を 7日 rolling baseline と比較、
+#      1.25× threshold を 3 連続 session で超えたら alert。
+#      Migration Playbook Chapter 4 (Path A Stay-and-Fortify) Hook 6 specification 実装。
+# Event: PostToolUse  MATCHER: ""
+# Action: 各 turn の input_tokens を log、baseline drift 検知時に stderr alert (non-blocking)
+#
+# The registration was missing from this header. The installer reads TRIGGER
+# and MATCHER from here and falls back to PreToolUse / Bash when both are
+# absent, so this hook was being registered at a moment where the field it
+# reads is always empty: it installed, it appeared in the settings, and it
+# did nothing. Measured 2026-08-04 across examples/: 14 files were like this.
+# TRIGGER: PostToolUse
+# MATCHER: ""
+
+HISTORY="/tmp/cc-tokenizer-ratio-history"
+SESSION_FLAG="/tmp/cc-tokenizer-ratio-session"
+TODAY=$(date +%Y-%m-%d)
+
+# stdin から JSON を取得 (Claude Code PostToolUse hook input)
+INPUT=$(cat 2>/dev/null || echo "{}")
+
+# tool_input から approximate character count を計算 (text-like fields の長さ合計)
+CHARS=$(echo "$INPUT" | jq -r '
+  .tool_input // {} |
+  [.. | strings] |
+  map(length) |
+  add // 0
+' 2>/dev/null)
+
+# tool_response から input_tokens を取得 (利用可能な場合)
+TOKENS=$(echo "$INPUT" | jq -r '
+  .tool_response // {} |
+  .usage.input_tokens //
+  .input_tokens //
+  0
+' 2>/dev/null)
+
+# どちらかが 0 なら処理中断 (signal 不足、log 汚染防止)
+[ -z "$CHARS" ] || [ "$CHARS" = "0" ] && exit 0
+[ -z "$TOKENS" ] || [ "$TOKENS" = "0" ] && exit 0
+
+# 比率計算 (tokens / chars)
+RATIO=$(awk "BEGIN { printf \"%.4f\", $TOKENS / $CHARS }")
+
+# log: timestamp|date|tokens|chars|ratio
+echo "$(date +%s)|$TODAY|$TOKENS|$CHARS|$RATIO" >> "$HISTORY"
+
+# 7日 rolling baseline 計算 (8日以上前は除外、POSIX awk safe で mean 採用)
+SEVEN_DAYS_AGO=$(date -d "7 days ago" +%s 2>/dev/null || date -v-7d +%s 2>/dev/null)
+[ -z "$SEVEN_DAYS_AGO" ] && exit 0
+
+BASELINE=$(awk -F'|' -v cutoff="$SEVEN_DAYS_AGO" '
+  $1 >= cutoff { sum += $5; n++ }
+  END {
+    if (n < 50) exit 1  # baseline 未確立 (50 turn 未満)
+    print sum / n
+  }
+' "$HISTORY" 2>/dev/null)
+
+# baseline 未確立時は exit (50 turn 蓄積待ち、blocking なし)
+[ -z "$BASELINE" ] && exit 0
+
+# 1.25× threshold チェック
+THRESHOLD=$(awk "BEGIN { printf \"%.4f\", $BASELINE * 1.25 }")
+EXCEEDS=$(awk "BEGIN { print ($RATIO > $THRESHOLD) ? 1 : 0 }")
+
+# 3 連続 session 超過判定
+SESSION_ID="${CLAUDE_SESSION_ID:-default}"
+LAST_SESSION=$(head -1 "$SESSION_FLAG" 2>/dev/null | cut -d'|' -f1)
+EXCEED_COUNT=$(head -1 "$SESSION_FLAG" 2>/dev/null | cut -d'|' -f2)
+EXCEED_COUNT=${EXCEED_COUNT:-0}
+
+if [ "$EXCEEDS" = "1" ]; then
+  if [ "$LAST_SESSION" != "$SESSION_ID" ]; then
+    EXCEED_COUNT=$((EXCEED_COUNT + 1))
+    echo "$SESSION_ID|$EXCEED_COUNT" > "$SESSION_FLAG"
+  fi
+  if [ "$EXCEED_COUNT" -ge 3 ]; then
+    echo "[tokenizer-ratio-alert-corpus] tokens/chars ratio ${RATIO} exceeds 1.25x baseline (${BASELINE}) for ${EXCEED_COUNT} consecutive sessions. Tokenizer may have shifted (Issue #46829 / Opus 4.7 inflation pattern). Review your /usage --json output." >&2
+  fi
+else
+  # 比率正常 = 連続カウンタ reset
+  echo "$SESSION_ID|0" > "$SESSION_FLAG"
+fi
+
+exit 0

package/examples/tokenizer-ratio-alert.sh

@@ -0,0 +1,104 @@
+#!/bin/bash
+# tokenizer-ratio-alert.sh — Opus 4.7 tokenizer inflation monitor (Incident 5)
+# Why: Opus 4.7 encodes the same prompt 1.35-1.46x larger than Opus 4.6
+#      (Anthropic stated ceiling 1.35, Simon Willison independent verification
+#      1.46 for system prompts). If you have pinned 4.6 but want to verify
+#      token accounting is actually on 4.6, this hook measures the ratio by
+#      calling the count_tokens endpoint against both models and alerts when
+#      the observed ratio exceeds a threshold.
+# Event: PreToolUse  MATCHER: "*"   (filter inside for model-bound turns)
+# Action: When the incoming tool call is a large enough user turn,
+#         compute count_tokens(4.6) and count_tokens(4.7) via the Anthropic
+#         API and emit a stderr alert if ratio > TOKENIZER_RATIO_THRESHOLD.
+#
+# Runtime cost: two network calls per eligible turn (tens to hundreds of ms).
+# This is the most expensive hook in the catalog. Enable only while actively
+# investigating an incident, then disable.
+#
+# Environment:
+#   ANTHROPIC_API_KEY              required for real count_tokens calls
+#   TOKENIZER_RATIO_THRESHOLD      ratio above which to alert (default 1.40)
+#   TOKENIZER_MIN_PROMPT_TOKENS    skip measurement for prompts below this
+#                                   many characters / 4 ≈ tokens (default 500)
+#   TOKENIZER_RATIO_ENDPOINT       override API base URL (for tests)
+#   TOKENIZER_RATIO_MODEL_OLD      (default claude-opus-4-6)
+#   TOKENIZER_RATIO_MODEL_NEW      (default claude-opus-4-7)
+#
+# The registration was missing from this header. The installer reads TRIGGER
+# and MATCHER from here and falls back to PreToolUse / Bash when both are
+# absent, so this hook was being registered at a moment where the field it
+# reads is always empty: it installed, it appeared in the settings, and it
+# did nothing. Measured 2026-08-04 across examples/: 14 files were like this.
+# TRIGGER: UserPromptSubmit
+# MATCHER: ""
+
+set -u
+
+THRESHOLD="${TOKENIZER_RATIO_THRESHOLD:-1.40}"
+MIN_CHARS="${TOKENIZER_MIN_PROMPT_TOKENS:-500}"   # used as char cutoff, not true tokens
+MIN_CHARS=$((MIN_CHARS * 4))                      # 1 token ≈ 4 chars for quick filter
+ENDPOINT="${TOKENIZER_RATIO_ENDPOINT:-https://api.anthropic.com}"
+MODEL_OLD="${TOKENIZER_RATIO_MODEL_OLD:-claude-opus-4-6}"
+MODEL_NEW="${TOKENIZER_RATIO_MODEL_NEW:-claude-opus-4-7}"
+
+INPUT=$(cat)
+
+# Extract prompt text. For a conversation-bound tool invocation, the most
+# recent user turn's text is a reasonable proxy for "what the model just
+# paid to encode."
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+PROMPT=""
+if [ -n "$TRANSCRIPT" ] && [ -r "$TRANSCRIPT" ]; then
+  PROMPT=$(tac "$TRANSCRIPT" 2>/dev/null \
+           | grep -m1 '"role":"user"' \
+           | jq -r '.message.content[0].text // .message.content // .content // empty' 2>/dev/null)
+fi
+
+# Fallback to direct prompt-like field on the payload (for tests and
+# unusual tools that carry the turn text inline).
+if [ -z "$PROMPT" ]; then
+  PROMPT=$(printf '%s' "$INPUT" | jq -r '.tool_input.prompt // .tool_input.text // empty' 2>/dev/null)
+fi
+
+[ -z "$PROMPT" ] && exit 0
+
+LEN=${#PROMPT}
+if [ "$LEN" -lt "$MIN_CHARS" ]; then
+  exit 0
+fi
+
+if [ -z "${ANTHROPIC_API_KEY:-}" ]; then
+  echo "tokenizer-ratio-alert: ANTHROPIC_API_KEY not set, skipping (hook is a no-op)" >&2
+  exit 0
+fi
+
+count_tokens() {
+  local model="$1"
+  local body
+  body=$(jq -n --arg model "$model" --arg text "$PROMPT" \
+    '{model: $model, messages: [{role: "user", content: $text}]}')
+  curl -s --max-time 10 -X POST "$ENDPOINT/v1/messages/count_tokens" \
+    -H "x-api-key: $ANTHROPIC_API_KEY" \
+    -H "anthropic-version: 2023-06-01" \
+    -H "content-type: application/json" \
+    -d "$body" 2>/dev/null \
+    | jq -r '.input_tokens // empty' 2>/dev/null
+}
+
+OLD=$(count_tokens "$MODEL_OLD")
+NEW=$(count_tokens "$MODEL_NEW")
+
+if [ -z "$OLD" ] || [ -z "$NEW" ] || [ "$OLD" -eq 0 ] 2>/dev/null; then
+  exit 0
+fi
+
+# Compute ratio as floating-point via awk (no bc dependency).
+RATIO=$(awk -v n="$NEW" -v o="$OLD" 'BEGIN { if (o > 0) printf "%.4f", n/o; else print "0" }')
+EXCEEDS=$(awk -v r="$RATIO" -v t="$THRESHOLD" 'BEGIN { print (r > t) ? 1 : 0 }')
+
+if [ "$EXCEEDS" = "1" ]; then
+  echo "⚠ tokenizer-ratio-alert: $MODEL_NEW=$NEW tokens vs $MODEL_OLD=$OLD tokens (ratio ${RATIO}, threshold ${THRESHOLD})" >&2
+  echo "  Opus 4.7 tokenizer encodes this prompt larger than 4.6 by more than the expected 1.35x ceiling." >&2
+fi
+
+exit 0

package/examples/tool-result-correlation-checker.sh

@@ -0,0 +1,167 @@
+#!/bin/bash
+# ================================================================
+# tool-result-correlation-checker.sh — Detect tool-result misattribution
+# ================================================================
+# PURPOSE:
+#   When Claude Code dispatches parallel tool calls in a single
+#   assistant turn, the harness must correlate each `tool_use_id`
+#   to exactly one `tool_result` block with the same id. Issue
+#   #64095 documents a failure mode where this correlation breaks:
+#
+#     - A `Skill(...)` call returned, as its results, the outputs
+#       of unrelated calls from earlier turns (multiple `Read`s,
+#       four `TaskCreate`s, and an `Agent` dispatch).
+#
+#   This is qualitatively different from cluster 20's cancellation
+#   cascade (#64047 / #64052 / #64059) — those produce cancelled
+#   batches, this produces *misrouted* results that the model
+#   reasons against as if they were the genuine output of the call
+#   it actually issued. The model then composes downstream replies
+#   from invented observations.
+#
+#   This hook scans the recent transcript for `tool_use_id` ↔
+#   `tool_result` pairing mismatches and surfaces them on stderr.
+#   It does NOT prevent misrouting (the routing happens upstream
+#   in the harness) — it surfaces the symptom so operators can
+#   recognize when the model's tool-output claims may be reasoning
+#   against misrouted data.
+#
+# CLUSTER:
+#   Candidate cluster #22 axis 22B (parallel-batch fabrication
+#   compounding) — Opus 4.8 pre-execution tool-output fabrication
+#   surfaces 6+ filings in 48 hours (#64048 / #64055 / #64065 /
+#   #64076 / #64095 / #64103 / #64118), with #64095 specifically
+#   documenting envelope leak + out-of-order misattribution.
+#
+#   Also addresses cluster 20 axis 20B (cancellation message
+#   indistinguishability) when a cancelled call's slot is filled
+#   by a routed-elsewhere result from another batch.
+#
+# TRIGGER: PostToolUse  MATCHER: ""
+#
+# ENV:
+#   CC_TOOL_CORRELATION_THRESHOLD   default 1 (warn on first mismatch)
+#   CC_TOOL_CORRELATION_WINDOW_SEC  default 60 (per-batch window)
+#   CC_TOOL_CORRELATION_DISABLE     non-empty → silent
+#   CC_TOOL_CORRELATION_QUIET       non-empty → silent
+#   CC_TOOL_CORRELATION_STATE_DIR   default /tmp/cc-tool-correlation
+#   CC_TOOL_CORRELATION_TRANSCRIPT  override transcript path (test-only)
+# ================================================================
+
+set -u
+
+# Disable / quiet
+if [ -n "${CC_TOOL_CORRELATION_DISABLE:-}" ] || [ -n "${CC_TOOL_CORRELATION_QUIET:-}" ]; then
+    exit 0
+fi
+
+THRESHOLD="${CC_TOOL_CORRELATION_THRESHOLD:-1}"
+WINDOW_SEC="${CC_TOOL_CORRELATION_WINDOW_SEC:-60}"
+STATE_DIR="${CC_TOOL_CORRELATION_STATE_DIR:-/tmp/cc-tool-correlation}"
+LOG_FILE="$STATE_DIR/events.log"
+
+mkdir -p "$STATE_DIR" 2>/dev/null || exit 0
+
+INPUT=$(cat)
+
+# Locate transcript: prefer env override (for tests), else parse from input
+TRANSCRIPT="${CC_TOOL_CORRELATION_TRANSCRIPT:-}"
+if [ -z "$TRANSCRIPT" ]; then
+    TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+fi
+
+# If no transcript, nothing to check
+[ -z "$TRANSCRIPT" ] && exit 0
+[ ! -r "$TRANSCRIPT" ] && exit 0
+
+# Extract the most recent assistant turn's tool_use blocks and the
+# corresponding user turn's tool_result blocks. We check the last
+# ~30 lines of transcript (enough for one assistant→user round-trip
+# even with large parallel batches).
+RECENT_LINES=$(tail -n 30 "$TRANSCRIPT" 2>/dev/null)
+[ -z "$RECENT_LINES" ] && exit 0
+
+# Collect tool_use_ids from the most recent assistant turn (newest first)
+# and tool_result tool_use_ids from the user turn that should answer them.
+# Format: one id per line.
+USE_IDS=$(printf '%s\n' "$RECENT_LINES" | jq -rR '
+    fromjson? |
+    select(.type == "assistant") |
+    .message.content[]? |
+    select(.type == "tool_use") |
+    .id
+' 2>/dev/null)
+
+RESULT_IDS=$(printf '%s\n' "$RECENT_LINES" | jq -rR '
+    fromjson? |
+    select(.type == "user") |
+    .message.content[]? |
+    select(.type == "tool_result") |
+    .tool_use_id
+' 2>/dev/null)
+
+# If either list is empty, no batch to correlate
+[ -z "$USE_IDS" ] && exit 0
+[ -z "$RESULT_IDS" ] && exit 0
+
+# Count tool_use ids and tool_result ids; mismatch indicates either:
+#   (a) duplicate result for one id (envelope leak)
+#   (b) result for an id never used (misrouting from earlier turn)
+#   (c) missing result for a used id (lost result)
+USE_COUNT=$(printf '%s\n' "$USE_IDS" | grep -c . || true)
+RESULT_COUNT=$(printf '%s\n' "$RESULT_IDS" | grep -c . || true)
+
+# Check for results without matching uses (misrouting signal)
+ORPHAN_RESULTS=$(comm -13 <(printf '%s\n' "$USE_IDS" | sort -u) <(printf '%s\n' "$RESULT_IDS" | sort -u) | grep -c . || true)
+
+# Check for duplicate result ids (envelope leak signal)
+DUP_RESULTS=$(printf '%s\n' "$RESULT_IDS" | sort | uniq -d | grep -c . || true)
+
+# Mismatch detected if either:
+#   - there are orphan results (results without matching uses), OR
+#   - there are duplicate result ids
+MISMATCH=0
+if [ "${ORPHAN_RESULTS:-0}" -gt 0 ] || [ "${DUP_RESULTS:-0}" -gt 0 ]; then
+    MISMATCH=1
+fi
+
+# Record event and check rolling-window count
+if [ "$MISMATCH" -eq 1 ]; then
+    NOW=$(date +%s)
+    printf '%s\n' "$NOW" >> "$LOG_FILE"
+
+    # Prune old events and count
+    CUTOFF=$((NOW - WINDOW_SEC))
+    COUNT=0
+    TMP_LOG=$(mktemp)
+    while IFS= read -r ts; do
+        if [ "${ts:-0}" -ge "$CUTOFF" ]; then
+            printf '%s\n' "$ts" >> "$TMP_LOG"
+            COUNT=$((COUNT + 1))
+        fi
+    done < "$LOG_FILE"
+    mv "$TMP_LOG" "$LOG_FILE"
+
+    # Warn if threshold crossed
+    if [ "$COUNT" -ge "$THRESHOLD" ]; then
+        cat >&2 <<EOF
+⚠️  tool-result correlation mismatch detected ($COUNT in last ${WINDOW_SEC}s)
+   Recent batch: $USE_COUNT tool_use, $RESULT_COUNT tool_result
+   Orphan results (no matching use): $ORPHAN_RESULTS
+   Duplicate result ids (envelope leak): $DUP_RESULTS
+
+   This is the symptom shape of cluster #22 axis 22B
+   (Opus 4.8 misrouted tool-result envelopes) per Issue #64095.
+
+   Operator action: do NOT trust the model's "I executed X" claims
+   from this turn — re-verify any tool-output values manually.
+   Consider switching to /model claude-opus-4-7 and dropping to
+   single sequential tool calls for the next critical step.
+
+   See: https://github.com/yurukusa/cc-safe-setup/blob/main/docs/cluster-tracker.html#cluster-22
+   Silence: export CC_TOOL_CORRELATION_QUIET=1
+EOF
+    fi
+fi
+
+exit 0

package/examples/tool-result-size-guard.sh

@@ -0,0 +1,132 @@
+#!/bin/bash
+# ================================================================
+# tool-result-size-guard.sh — Block or warn on Bash commands likely to produce oversized output
+# ================================================================
+# PURPOSE:
+#   Many Bash patterns produce unbounded or very large output even on small
+#   inputs: `find /` (root scan), `ls -R` (recursive ls), `tail -f`
+#   (streaming, never returns), `dmesg`, `journalctl` without -n,
+#   `git log` without -n / --oneline, `npm ls -a` / `pip list` without
+#   filter, `docker logs` without --tail. These burn Claude Code quota
+#   fast — a single such call can consume several percent of the monthly
+#   allowance on the Max $200 plan.
+#
+#   This hook detects such patterns BEFORE the command runs (PreToolUse)
+#   and warns with a specific safer alternative. Set CC_TOOL_RESULT_BLOCK=1
+#   to upgrade warning to a hard block.
+#
+#   Companion to large-read-guard.sh (which checks specific file sizes)
+#   and output-explosion-detector.sh (which warns AFTER the burn happened).
+#   This hook prevents the burn upfront.
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+#
+# CONFIG:
+#   CC_TOOL_RESULT_BLOCK=0      (default: warn only; set 1 to block)
+#   CC_TOOL_RESULT_GUARD_SKIP=  (comma-separated patterns to skip, e.g. "find,ls")
+# ================================================================
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-tool-result-size-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [tool-result-size-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+BLOCK_MODE="${CC_TOOL_RESULT_BLOCK:-0}"
+SKIP_PATTERNS="${CC_TOOL_RESULT_GUARD_SKIP:-}"
+
+# Helper: emit warning or block based on mode
+# Args: <id> <description> <suggested-alternative>
+emit() {
+    local id="$1" pattern="$2" suggest="$3"
+    # Skip if user explicitly opted out of this id (comma-separated)
+    if [ -n "$SKIP_PATTERNS" ] && echo "$SKIP_PATTERNS" | tr ',' '\n' | grep -qx "$id"; then
+        return 0
+    fi
+    if [ "$BLOCK_MODE" = "1" ]; then
+        echo "BLOCKED by tool-result-size-guard: $pattern is likely to produce oversized output." >&2
+        echo "Safer alternative: $suggest" >&2
+        echo "To override for this session: unset CC_TOOL_RESULT_BLOCK or set CC_TOOL_RESULT_GUARD_SKIP=$id" >&2
+        exit 2
+    fi
+    echo "WARNING (tool-result-size-guard): $pattern is likely to produce large output." >&2
+    echo "Safer alternative: $suggest" >&2
+    echo "Set CC_TOOL_RESULT_BLOCK=1 to block, or CC_TOOL_RESULT_GUARD_SKIP=$id to suppress." >&2
+}
+
+# Pattern 1: find / or find ~ (root/home scans without -maxdepth or limit)
+if echo "$COMMAND" | grep -qE '(^|;|&&|\|\| | && |\| )\s*find\s+(/|~)([^a-zA-Z0-9_/-]|$)'; then
+    if ! echo "$COMMAND" | grep -qE '\-maxdepth|\-quit|\| head|\| wc'; then
+        emit "find" "find / or find ~ without -maxdepth or head/wc piping" \
+             "find / -maxdepth 3 -name '<pattern>' | head -50"
+    fi
+fi
+
+# Pattern 2: ls -R (recursive without limit)
+if echo "$COMMAND" | grep -qE '(^|;|&&|\| )\s*ls\s+(-[a-zA-Z]*R[a-zA-Z]*)\b'; then
+    if ! echo "$COMMAND" | grep -qE '\| head|\| tail|\| wc'; then
+        emit "ls-r" "ls -R (recursive listing without limit)" \
+             "ls -R <dir> | head -100  OR  find <dir> -maxdepth 2 -type f"
+    fi
+fi
+
+# Pattern 3: tail -f (streaming, never returns in a Claude Code session)
+if echo "$COMMAND" | grep -qE '(^|;|&&|\| )\s*tail\s+(-[a-zA-Z]*f[a-zA-Z]*)\b'; then
+    emit "tail-f" "tail -f (streaming follow — does not return)" \
+         "tail -n 100 <file>  (one-shot read of last 100 lines)"
+fi
+
+# Pattern 4: dmesg (system log, often >1MB)
+if echo "$COMMAND" | grep -qE '(^|;|&&|\| )\s*(sudo\s+)?dmesg\b'; then
+    if ! echo "$COMMAND" | grep -qE '\| head|\| tail|\| wc|-T\s'; then
+        emit "dmesg" "dmesg without head/tail" \
+             "dmesg | tail -100  OR  dmesg --time-format=iso | grep <pattern>"
+    fi
+fi
+
+# Pattern 5: journalctl without -n
+if echo "$COMMAND" | grep -qE '(^|;|&&|\| )\s*(sudo\s+)?journalctl\b'; then
+    if ! echo "$COMMAND" | grep -qE '\-n\s+[0-9]|\-\-lines|\| head|\| tail|\| wc'; then
+        emit "journalctl" "journalctl without -n or pipe to head/tail" \
+             "journalctl -n 100  OR  journalctl --since '1 hour ago' | tail -200"
+    fi
+fi
+
+# Pattern 6: git log without -n or --oneline
+if echo "$COMMAND" | grep -qE '(^|;|&&|\| )\s*git\s+log\b'; then
+    if ! echo "$COMMAND" | grep -qE '\-n\s*[0-9]|\-\-max-count|\-[0-9]+|\-\-oneline|\| head|\| tail'; then
+        emit "git-log" "git log without -n / -<N> / --oneline limit" \
+             "git log -20 --oneline  OR  git log -20"
+    fi
+fi
+
+# Pattern 7: npm ls -a (full dependency tree) or pip list (without filter)
+if echo "$COMMAND" | grep -qE '(^|;|&&|\| )\s*npm\s+(ls|list)\s+(-a|--all)\b'; then
+    emit "npm-ls" "npm ls -a / npm ls --all (full recursive deps tree)" \
+         "npm ls --depth=0  OR  npm ls <package>"
+fi
+if echo "$COMMAND" | grep -qE '(^|;|&&|\| )\s*pip\s+list\b' && \
+   ! echo "$COMMAND" | grep -qE '\| grep|\| head|\| wc|\-\-format'; then
+    emit "pip-list" "pip list without filter" \
+         "pip list | grep <pattern>  OR  pip show <package>"
+fi
+
+# Pattern 8: docker logs without --tail
+if echo "$COMMAND" | grep -qE '(^|;|&&|\| )\s*docker\s+logs\b'; then
+    if ! echo "$COMMAND" | grep -qE '\-\-tail|\-n\s+[0-9]|\| head|\| tail'; then
+        emit "docker-logs" "docker logs without --tail" \
+             "docker logs --tail 200 <container>"
+    fi
+fi
+
+exit 0

package/examples/tool-retry-budget-guard.sh

@@ -9,6 +9,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-tool-retry-budget-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [tool-retry-budget-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 

package/examples/transcript-contamination-detector.sh

@@ -0,0 +1,138 @@
+#!/bin/bash
+# transcript-contamination-detector.sh — Detect synthetic entries injected
+# into session transcript .jsonl files by the /resume contamination bug.
+#
+# Solves: #60802 — "/resume renders an unselected session's transcript and
+# injects synthetic messages into its .jsonl (v2.1.139, Windows PowerShell)"
+#
+# In that case, /resume on Windows v2.1.139 contaminated *unselected* session
+# .jsonl logs with two synthetic entries:
+#
+#   - user message: { isMeta: true, content: "Continue from where you left off." }
+#   - assistant message: { model: "<synthetic>", content: "No response requested." }
+#
+# These entries appear in the .jsonl file of a session the user did NOT
+# resume. The contaminated session's log no longer faithfully records what
+# happened — a later audit would see message exchanges that never occurred.
+#
+# Related: #46603 (parentUuid chain breakage after compaction; different
+# mechanism but same structural family — transcript log losing fidelity to
+# the actual conversation).
+#
+# This hook runs on SessionStart and scans the user's per-project .jsonl
+# logs for the synthetic markers. If any are found, it surfaces the count
+# and file paths so the operator can decide whether to restore from backup
+# or annotate the log.
+#
+# The hook does NOT block session start (exit 0 even when contamination is
+# detected) because session-start blocking is too disruptive for a
+# detection-only signal. It does emit a system-reminder for Claude to see.
+#
+# TRIGGER: SessionStart
+# MATCHER: ""
+#
+# CONFIGURATION (environment variables):
+#   CC_PROJECTS_DIR                 default ~/.claude/projects
+#   CC_TRANSCRIPT_DETECTOR_DISABLE  set to "1" to skip
+#   CC_TRANSCRIPT_DETECTOR_MAX      max .jsonl files to scan (default 200)
+#
+# USAGE (settings.json):
+#   {
+#     "hooks": {
+#       "SessionStart": [{
+#         "matcher": "",
+#         "hooks": [{
+#           "type": "command",
+#           "command": "~/.claude/hooks/transcript-contamination-detector.sh"
+#         }]
+#       }]
+#     }
+#   }
+
+set -uo pipefail
+
+[ "${CC_TRANSCRIPT_DETECTOR_DISABLE:-0}" = "1" ] && exit 0
+
+PROJECTS_DIR="${CC_PROJECTS_DIR:-$HOME/.claude/projects}"
+MAX_FILES="${CC_TRANSCRIPT_DETECTOR_MAX:-200}"
+
+# If no projects directory, nothing to scan.
+[ ! -d "$PROJECTS_DIR" ] && exit 0
+
+# The two synthetic markers from #60802. Match conservatively — require both
+# the isMeta:true + the specific synthetic-model marker patterns.
+USER_MARKER='"isMeta"[[:space:]]*:[[:space:]]*true.*Continue from where you left off'
+ASSISTANT_MARKER='"model"[[:space:]]*:[[:space:]]*"<synthetic>".*No response requested'
+
+# Collect .jsonl files, capped at MAX_FILES, most-recently-modified first.
+mapfile -t FILES < <(
+    find "$PROJECTS_DIR" -maxdepth 3 -type f -name '*.jsonl' \
+        -printf '%T@ %p\n' 2>/dev/null \
+        | sort -rn \
+        | head -n "$MAX_FILES" \
+        | awk '{ $1=""; sub(/^ /, ""); print }'
+)
+
+[ "${#FILES[@]}" -eq 0 ] && exit 0
+
+CONTAMINATED=()
+for f in "${FILES[@]}"; do
+    # Both markers must be present on at least one line each (they don't
+    # need to be on the same line — they're separate messages).
+    if grep -Eq "$USER_MARKER" "$f" 2>/dev/null && grep -Eq "$ASSISTANT_MARKER" "$f" 2>/dev/null; then
+        CONTAMINATED+=("$f")
+    fi
+done
+
+[ "${#CONTAMINATED[@]}" -eq 0 ] && exit 0
+
+# Contamination found. Build a feedback message for Claude.
+# Limit output to first 5 paths to avoid wall-of-text.
+SHOWN=()
+for ((i = 0; i < ${#CONTAMINATED[@]} && i < 5; i++)); do
+    SHOWN+=("${CONTAMINATED[$i]}")
+done
+EXTRA=$(( ${#CONTAMINATED[@]} - ${#SHOWN[@]} ))
+
+cat >&2 <<EOF
+<system-reminder>
+TRANSCRIPT CONTAMINATION DETECTED — ${#CONTAMINATED[@]} session .jsonl file(s)
+contain the synthetic-entry markers introduced by the /resume bug
+documented in anthropics/claude-code#60802 (v2.1.139, originally Windows
+PowerShell — may affect other platforms / versions).
+
+Markers found (both must be present in a single .jsonl for it to be flagged):
+  - user message with "isMeta": true + content "Continue from where you left off."
+  - assistant message with "model": "<synthetic>" + content "No response requested."
+
+These entries are NOT real conversation. They were injected when /resume was
+invoked on a *different* session. The log of the affected file no longer
+faithfully records what actually happened in that session.
+
+Affected files (first 5):
+EOF
+for f in "${SHOWN[@]}"; do
+    echo "  $f" >&2
+done
+if [ "$EXTRA" -gt 0 ]; then
+    echo "  ... and $EXTRA more" >&2
+fi
+cat >&2 <<EOF
+
+Recommended next actions for the operator (NOT for the model to perform
+automatically):
+  1. If an offline backup of the session .jsonl exists from before the
+     /resume incident, restore the affected file from backup.
+  2. Otherwise, append an editorial note to the affected session
+     documenting that the synthetic entries were injected by the harness,
+     not authored by the operator or the model.
+  3. Avoid using /resume on multi-session projects on the affected version
+     until the upstream fix lands. Workaround: open the desired session
+     directly via the .jsonl path argument rather than the picker.
+
+To disable this detector, set CC_TRANSCRIPT_DETECTOR_DISABLE=1.
+</system-reminder>
+EOF
+
+# Exit 0 — detection-only, don't block session start.
+exit 0