cc-safe-setup 29.8.0 → 30.0.4

package/examples/worktree-edit-boundary-guard.sh

@@ -0,0 +1,127 @@
+#!/bin/bash
+# worktree-edit-boundary-guard.sh — Warn or block when Edit/Write/NotebookEdit
+# targets a path outside the active git worktree boundary.
+#
+# Solves: anthropics/claude-code#59628 — Claude Code sessions launched inside
+# a git worktree receive a system-prompt declaration ("you are operating in a
+# git worktree") but the harness does NOT prevent Edit/Write/NotebookEdit calls
+# whose resolved absolute path points into the parent main checkout. An agent
+# using cd-style context or absolute paths can dirty the main branch's working
+# tree without prompt, warning, or confirmation. The worktree boundary is a
+# claim in the system prompt; it is not an enforced isolation at the tool layer.
+#
+# This hook closes that gap from the operator side: when the current working
+# directory is inside a worktree (detected via `git rev-parse --git-common-dir`
+# differing from `git rev-parse --git-dir`), and the target file_path resolves
+# outside the worktree's working tree, emit a warning (default) or block (opt-in
+# via env). Pass-through outside worktrees, outside repos, or when target path
+# is inside the worktree.
+#
+# Configuration:
+#   CC_WORKTREE_BOUNDARY_MODE=warn (default)  — emit stderr, exit 0 (advisory)
+#   CC_WORKTREE_BOUNDARY_MODE=block          — emit stderr, exit 2 (block)
+#   CC_WORKTREE_BOUNDARY_QUIET=1              — suppress all output (still exits)
+#
+# Usage: settings.json PreToolUse hook with matcher "Edit|Write|NotebookEdit".
+#
+# TRIGGER: PreToolUse  MATCHER: "Edit|Write|NotebookEdit"
+
+set -u
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-worktree-edit-boundary-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [worktree-edit-boundary-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+
+# Only edit-style tools
+case "$TOOL" in
+    Edit|Write|NotebookEdit) ;;
+    *) exit 0 ;;
+esac
+
+[ -z "$FILE" ] && exit 0
+
+# Detect worktree: git-dir vs git-common-dir
+# In a worktree, git-dir points to .git/worktrees/<name>, git-common-dir to the main .git
+GIT_DIR=$(git rev-parse --git-dir 2>/dev/null) || exit 0
+GIT_COMMON=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
+
+# Resolve both to absolute paths for comparison
+GIT_DIR_ABS=$(cd "$GIT_DIR" 2>/dev/null && pwd -P) || exit 0
+GIT_COMMON_ABS=$(cd "$GIT_COMMON" 2>/dev/null && pwd -P) || exit 0
+
+# Not a worktree if git-dir == git-common-dir
+[ "$GIT_DIR_ABS" = "$GIT_COMMON_ABS" ] && exit 0
+
+# We are in a worktree. Determine the worktree boundary (top of working tree).
+WORKTREE_TOP=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
+WORKTREE_TOP_ABS=$(cd "$WORKTREE_TOP" 2>/dev/null && pwd -P) || exit 0
+
+# Resolve target path. If relative, anchor to current working directory.
+# We do NOT require the file to exist (Write may create new files).
+if [[ "$FILE" = /* ]]; then
+    TARGET="$FILE"
+else
+    TARGET="$PWD/$FILE"
+fi
+
+# Normalize: resolve .. and . segments without requiring the path to exist.
+# Use python if available for portability, otherwise fall back to readlink -m.
+if command -v python3 >/dev/null 2>&1; then
+    TARGET_ABS=$(python3 -c "import os,sys; print(os.path.normpath(sys.argv[1]))" "$TARGET" 2>/dev/null)
+elif command -v readlink >/dev/null 2>&1 && readlink -m / >/dev/null 2>&1; then
+    TARGET_ABS=$(readlink -m "$TARGET" 2>/dev/null)
+else
+    # Last resort: assume already absolute and unnormalized; let the prefix test handle it
+    TARGET_ABS="$TARGET"
+fi
+
+[ -z "$TARGET_ABS" ] && exit 0
+
+# Check if target is inside the worktree boundary
+# Append slash to avoid prefix-collision (e.g., /repo-main being matched by /repo)
+case "$TARGET_ABS/" in
+    "$WORKTREE_TOP_ABS"/*)
+        # Inside worktree — allowed
+        exit 0
+        ;;
+esac
+
+# Target is outside worktree boundary
+MODE="${CC_WORKTREE_BOUNDARY_MODE:-warn}"
+QUIET="${CC_WORKTREE_BOUNDARY_QUIET:-0}"
+
+if [ "$QUIET" != "1" ]; then
+    echo "WORKTREE BOUNDARY: target outside active worktree." >&2
+    echo "" >&2
+    echo "  Worktree:  $WORKTREE_TOP_ABS" >&2
+    echo "  Target:    $TARGET_ABS" >&2
+    echo "  Tool:      $TOOL" >&2
+    echo "" >&2
+    echo "This Edit/Write call would land outside the worktree boundary the" >&2
+    echo "system prompt declared. The parent main checkout (or another worktree)" >&2
+    echo "may be modified without further confirmation. See anthropics/claude-code#59628." >&2
+    echo "" >&2
+    if [ "$MODE" = "block" ]; then
+        echo "Mode: BLOCK (CC_WORKTREE_BOUNDARY_MODE=block). Edit refused." >&2
+    else
+        echo "Mode: WARN (advisory). To block instead, set CC_WORKTREE_BOUNDARY_MODE=block." >&2
+    fi
+fi
+
+if [ "$MODE" = "block" ]; then
+    exit 2
+fi
+
+exit 0

package/examples/worktree-escape-write-guard.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+# ================================================================
+# worktree-escape-write-guard.sh — Block Edit/Write that escape the
+#   active worktree and silently land on the main checkout
+# ================================================================
+# PURPOSE:
+#   When a session runs in a git worktree under .claude/worktrees/<name>,
+#   the model can resolve a repo-root-relative reference (e.g. an
+#   auto-memory/notes line listing "packages/x/y.ts") against the
+#   canonical repo root instead of the worktree root. The absolute path
+#   "<repo>/packages/x/y.ts" is a valid, EXISTING file — just the wrong
+#   copy. Edits then succeed silently on the MAIN checkout while cwd and
+#   gitBranch keep reporting the worktree the whole time. The worktree
+#   branch stays empty; nearly all work lands on the main branch, with
+#   no warning. The author usually notices long after.
+#
+#   This is a data-loss-class accident: work you believe is isolated in a
+#   worktree is written to (and committed on) the main checkout, and can
+#   be lost outright if that branch is later rebased or force-pushed.
+#
+# HOW IT WORKS: PreToolUse hook on Edit|Write|MultiEdit. If cwd is inside
+#   a worktree (.claude/worktrees/<name>), it derives the worktree root
+#   and the repo root from cwd alone, then blocks any ABSOLUTE file_path
+#   that is under the repo root but OUTSIDE the worktree root (i.e. the
+#   main checkout's copy). Relative paths resolve against cwd (the
+#   worktree) and are allowed. Absolute paths fully outside the repo are
+#   not this guard's concern (other guards cover that).
+#
+# See: https://github.com/anthropics/claude-code/issues/70069
+#
+# TRIGGER: PreToolUse  MATCHER: "Edit|Write|MultiEdit"
+#
+# Configuration:
+#   CC_WORKTREE_DIR_MARKER — path segment identifying worktrees.
+#                            Default: ".claude/worktrees"
+# ================================================================
+
+set -euo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-worktree-escape-write-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [worktree-escape-write-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+
+TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+case "$TOOL" in
+    Edit|Write|MultiEdit) ;;
+    *) exit 0 ;;
+esac
+
+CWD=$(echo "$INPUT" | jq -r '.cwd // empty' 2>/dev/null)
+FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+[ -z "$CWD" ] && exit 0
+[ -z "$FILE" ] && exit 0
+
+MARKER="${CC_WORKTREE_DIR_MARKER:-.claude/worktrees}"
+
+# Only act when the session is inside a worktree.
+case "$CWD" in
+    *"/$MARKER/"*) ;;
+    *) exit 0 ;;
+esac
+
+# Derive repo root (prefix before the marker) and worktree root
+# (prefix + marker + the first segment after it = the worktree name).
+REPO_ROOT="${CWD%%/$MARKER/*}"
+REST="${CWD#*/$MARKER/}"     # "<name>" or "<name>/sub/dir"
+WT_NAME="${REST%%/*}"
+WT_ROOT="$REPO_ROOT/$MARKER/$WT_NAME"
+
+# Relative file_path resolves against cwd (the worktree) — safe.
+case "$FILE" in
+    /*) ;;      # absolute — keep checking
+    *) exit 0 ;;
+esac
+
+# Absolute paths that stay within the worktree are fine.
+case "$FILE" in
+    "$WT_ROOT"|"$WT_ROOT"/*) exit 0 ;;
+esac
+
+# Absolute path under the repo root but outside the worktree = the bug.
+case "$FILE" in
+    "$REPO_ROOT"/*)
+        echo "BLOCKED: Edit/Write escapes the active worktree onto the main checkout." >&2
+        echo "" >&2
+        echo "  Worktree (cwd): $WT_ROOT" >&2
+        echo "  Target file:    $FILE" >&2
+        echo "" >&2
+        echo "This path is under the repository root but OUTSIDE the worktree." >&2
+        echo "It points at the MAIN checkout's copy of the file, not the worktree's." >&2
+        echo "Writing here silently commits your work to the main branch while the" >&2
+        echo "worktree branch stays empty (Claude Code issue #70069)." >&2
+        echo "" >&2
+        echo "Fix: rewrite the path under the worktree root, e.g." >&2
+        echo "  $WT_ROOT/<path-relative-to-repo>" >&2
+        echo "" >&2
+        echo "Override (only if you truly mean the main checkout): set" >&2
+        echo "CC_WORKTREE_DIR_MARKER to a non-matching value for this command." >&2
+        exit 2
+        ;;
+esac
+
+# Absolute path entirely outside the repo — not this guard's concern.
+exit 0

package/examples/worktree-hooks-path-fix.sh

@@ -0,0 +1,111 @@
+#!/bin/bash
+# worktree-hooks-path-fix.sh — Unset bogus per-worktree core.hooksPath that
+# Claude Code's EnterWorktree harness writes, so Husky / lefthook / pre-commit
+# hooks fire in worktrees the same way they do in the main checkout.
+#
+# Solves: #60620 — Claude Code's EnterWorktree harness writes an absolute
+# `core.hooksPath` into the per-worktree `config.worktree` file. The absolute
+# path points at the *main checkout's* hooks directory, not the worktree's,
+# and because `extensions.worktreeConfig = true` is also enabled, the
+# worktree-scoped value overrides any correct shared `core.hooksPath`
+# (e.g. Husky's repo-relative `frontend/.husky/_`).
+#
+# Net effect: every Husky / lefthook / pre-commit hook the project author
+# installed is dormant inside Claude-created worktrees. Git silently runs
+# zero hooks (most common case) or runs the wrong directory's hooks against
+# the worktree's index (less common but still a silent context drift).
+#
+# Operator-side fix: at SessionStart, detect that we're inside a
+# Claude-created worktree (path matches `.claude/worktrees/`), read the
+# worktree's `config.worktree` for `core.hooksPath`, and unset it if it is
+# an absolute path that does not resolve relative to the worktree root.
+# The shared config's repo-relative `core.hooksPath` (set by Husky's
+# `prepare` script) then takes over and resolves correctly from any
+# worktree.
+#
+# This is a harness-bug workaround, not a model-drift hook. The
+# recognition-without-arrest family at #60226 is a different shape; this
+# Issue's failure fires before any model interaction.
+#
+# Related Issues:
+#   #60620 — Claude Code agent harness writes broken per-worktree
+#            core.hooksPath (the direct origin of this hook)
+#   #27474 — earlier failure mode in the same family (writes corrupted
+#            shared .git/config; closed but related)
+#   #60475 — sibling-session git checkout clobber (workspace-lease-guard
+#            addresses a different worktree failure)
+#
+# CONFIG:
+#   CC_WORKTREE_HOOKS_FIX_DISABLE=1   set to disable the hook entirely
+#   CC_WORKTREE_HOOKS_FIX_VERBOSE=1   emit a NOTICE on every fix
+#
+# TRIGGER: SessionStart
+# MATCHER: "*"
+
+set -u
+
+[ "${CC_WORKTREE_HOOKS_FIX_DISABLE:-0}" = "1" ] && exit 0
+
+# Identify the working tree. Prefer CLAUDE_PROJECT_DIR, fall back to PWD.
+WORKING_TREE="${CLAUDE_PROJECT_DIR:-${PWD:-}}"
+[ -z "$WORKING_TREE" ] && exit 0
+
+# Confirm we are inside a git worktree (not the main checkout, not non-git).
+WORKTREE_ROOT=$(git -C "$WORKING_TREE" rev-parse --show-toplevel 2>/dev/null)
+[ -z "$WORKTREE_ROOT" ] && exit 0
+
+# Detect whether this is a worktree (vs the main checkout). git rev-parse
+# --git-common-dir differs from --git-dir only inside a linked worktree.
+GIT_COMMON_DIR=$(git -C "$WORKTREE_ROOT" rev-parse --git-common-dir 2>/dev/null)
+GIT_DIR=$(git -C "$WORKTREE_ROOT" rev-parse --git-dir 2>/dev/null)
+[ -z "$GIT_DIR" ] && exit 0
+
+# Resolve both to absolute paths for comparison
+GIT_COMMON_DIR_ABS=$(cd "$WORKTREE_ROOT" && readlink -f "$GIT_COMMON_DIR" 2>/dev/null || echo "$GIT_COMMON_DIR")
+GIT_DIR_ABS=$(cd "$WORKTREE_ROOT" && readlink -f "$GIT_DIR" 2>/dev/null || echo "$GIT_DIR")
+
+# Not a linked worktree — nothing to fix
+[ "$GIT_COMMON_DIR_ABS" = "$GIT_DIR_ABS" ] && exit 0
+
+# Only act on worktrees that look Claude-created. The path pattern
+# `.claude/worktrees/` is the standard surface for `EnterWorktree`.
+case "$WORKTREE_ROOT" in
+    */.claude/worktrees/*) ;;
+    *) exit 0 ;;
+esac
+
+# Read the worktree-scoped core.hooksPath
+WORKTREE_HOOKS_PATH=$(git -C "$WORKTREE_ROOT" config --worktree --get core.hooksPath 2>/dev/null || true)
+[ -z "$WORKTREE_HOOKS_PATH" ] && exit 0
+
+# If the value is already a relative path resolving inside the worktree,
+# leave it alone. Only intervene when it is an absolute path. Both POSIX-
+# style (/) and Windows-style (C:\, D:\, etc.) absolute paths qualify.
+case "$WORKTREE_HOOKS_PATH" in
+    /*|[A-Za-z]:[\\/]*) ;;  # absolute — proceed
+    *) exit 0 ;;            # relative — already correct, leave alone
+esac
+
+# If the absolute path happens to resolve inside the worktree root, leave
+# it alone — the harness wrote something that works for this case.
+case "$WORKTREE_HOOKS_PATH" in
+    "$WORKTREE_ROOT"/*) exit 0 ;;
+esac
+
+# Otherwise: the worktree config has an absolute hooksPath pointing
+# outside the worktree, which silently shadows the shared config's
+# relative hooksPath. Unset it.
+if git -C "$WORKTREE_ROOT" config --worktree --unset core.hooksPath 2>/dev/null; then
+    if [ "${CC_WORKTREE_HOOKS_FIX_VERBOSE:-0}" = "1" ] || [ -n "${CLAUDE_PROJECT_DIR:-}" ]; then
+        cat >&2 <<EOF
+NOTICE: worktree-hooks-path-fix unset a bogus core.hooksPath in this worktree.
+  Worktree:      ${WORKTREE_ROOT}
+  Was pointing:  ${WORKTREE_HOOKS_PATH}
+  Effect:        Husky / lefthook / pre-commit hooks installed via the
+                 shared config will now fire correctly in this worktree
+                 (Issue #60620 workaround).
+EOF
+    fi
+fi
+
+exit 0

package/examples/worktree-parent-write-guard.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-worktree-parent-write-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [worktree-parent-write-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+TARGET=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+[[ -z "$TARGET" ]] && exit 0
+CWD=$(echo "$INPUT" | jq -r '.cwd // empty' 2>/dev/null)
+[[ -z "$CWD" ]] && CWD="$PWD"
+case "$CWD" in
+    *"/.claude/worktrees/"*) ;;
+    *) exit 0 ;;
+esac
+PARENT="${CWD%%/.claude/worktrees/*}"
+REST="${CWD#*/.claude/worktrees/}"          # <name>/maybe/more
+WTNAME="${REST%%/*}"                          # <name>
+WT="$PARENT/.claude/worktrees/$WTNAME"
+case "$TARGET" in
+    /*) ABS="$TARGET" ;;
+    *)  ABS="$CWD/$TARGET" ;;
+esac
+case "$ABS" in
+    "$WT"/*|"$WT")
+        exit 0 ;;                              # correctly inside the worktree — OK
+    "$PARENT"/*|"$PARENT")
+        echo "BLOCKED: write target is in the PARENT repo, not the active worktree." >&2
+        echo "  cwd (worktree): $CWD" >&2
+        echo "  target:         $ABS" >&2
+        echo "  Expected under: $WT/" >&2
+        echo "  This is the silent nested-worktree parent-write (#62547/#60679/#69026)." >&2
+        echo "  Fix: write under the worktree path, or create worktrees OUTSIDE the repo." >&2
+        exit 2 ;;
+esac
+exit 0

package/examples/worktree-project-unify.sh

@@ -1,9 +1,10 @@
+#!/bin/bash
 MAIN_TREE=$(git worktree list --porcelain 2>/dev/null | head -1 | sed 's/worktree //')
 [ -z "$MAIN_TREE" ] && exit 0
 CUR_DIR=$(pwd)
 [ "$CUR_DIR" = "$MAIN_TREE" ] && exit 0
 to_project_dir() {
-    echo "$HOME/.claude/projects/$(echo "$1" | sed 's|/|-|g; s|^-||')"
+    echo "$HOME/.claude/projects/$(echo "$1" | sed 's|/|-|g')"
 }
 MAIN_PROJECT=$(to_project_dir "$MAIN_TREE")
 CUR_PROJECT=$(to_project_dir "$CUR_DIR")

package/examples/worktree-remove-uncommitted-guard.sh

@@ -1,3 +1,16 @@
+#!/bin/bash
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-worktree-remove-uncommitted-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [worktree-remove-uncommitted-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INFO=$(cat)
 PATH_WT=$(echo "$INFO" | jq -r '.path // empty' 2>/dev/null)
 [ -z "$PATH_WT" ] && exit 0

package/examples/worktree-unmerged-guard.sh

@@ -36,7 +36,13 @@ if ! echo "$COMMAND" | grep -qE 'git\s+worktree\s+(remove|prune)|rm\s+.*worktree
 fi
 
 # Extract worktree path
-WORKTREE_PATH=$(echo "$COMMAND" | grep -oP 'git\s+worktree\s+remove\s+\K[^\s]+')
+# -P は GNU 拡張で、macOS の BSD grep では grep がエラーになり WORKTREE_PATH が空になる。
+# すぐ下の「空なら exit 0」で、未マージのコミットを持つ worktree でも素通しになる。
+# 実測: 未マージのコミットを持つ worktree への git worktree remove で、-P ありは 2、無しは 0。
+# \K に POSIX の等価物は無いので、コマンド語から一致させて前置きを sed で落とす。
+WORKTREE_PATH=$(echo "$COMMAND" \
+    | grep -oE 'git[[:space:]]+worktree[[:space:]]+remove[[:space:]]+[^[:space:]]+' \
+    | sed -E 's/^git[[:space:]]+worktree[[:space:]]+remove[[:space:]]+//')
 
 if [ -z "$WORKTREE_PATH" ]; then
     # Maybe it's rm -rf on a worktree directory

package/examples/write-byte-integrity-verifier.sh

@@ -0,0 +1,190 @@
+#!/bin/bash
+# write-byte-integrity-verifier.sh — Detect silent file truncation after Write/Edit
+#
+# Solves: github.com/anthropics/claude-code/issues/58551
+#         "Write and Edit tools truncate files on virtiofs mounts in Claude Code"
+#
+#         Reporter (2026-05-13) found that on virtiofs-backed mounts (common in
+#         devcontainers and Claude Cowork sandboxes), Write and Edit tools
+#         silently truncate or null-pad files:
+#           - Shrink case: file of N bytes, Write shorter content M, result is
+#             new content from 0..M then \x00 from M..N (size unchanged, tail
+#             padded with NULs instead of file being truncated to M).
+#           - Grow case: Edit makes file longer, but file is silently chopped
+#             at some boundary K < intended length.
+#         Both modes leave the file in a corrupted state with no error returned
+#         to the tool caller, so the assistant believes the write succeeded.
+#
+# WHY THIS MATTERS:
+#   The assistant's belief ("Write returned success, file has the new content")
+#   diverges from filesystem reality ("file is null-padded or tail-chopped").
+#   This is the textbook claim-verify gap, and on virtiofs it is reproducible.
+#   When the assistant's next Read returns the old/corrupted content, the
+#   assistant may retry, overwrite further, or report nonsense to the user.
+#
+# TRIGGER: PostToolUse  MATCHER: Write|Edit
+#
+# HOW IT WORKS:
+#   After a successful Write/Edit:
+#     1. Find the target file path from tool_input.
+#     2. Use `wc -c` to get the on-disk byte count.
+#     3. For Write: compare against the byte count of tool_input.content.
+#     4. For Edit: read the file once and confirm tool_input.new_string is
+#        present (substring check) and tool_input.old_string is absent.
+#     5. Detect null-padding by checking if the last 4 bytes are all \x00
+#        while the rest of the file does not naturally end in nulls.
+#   On mismatch: emit a clear warning to stderr describing the divergence,
+#   the file path, the expected vs. actual byte counts, and the recommended
+#   next steps (re-read the file, re-write if confirmed corrupted, escalate
+#   if on virtiofs).
+#
+# CONFIGURATION:
+#   CC_WRITE_INTEGRITY_DISABLE=1   — disable the hook entirely
+#   CC_WRITE_INTEGRITY_ACTION      — "warn" (default) or "block" (exit 2)
+#   CC_WRITE_INTEGRITY_LOG         — log file path
+#                                    (default /tmp/cc-write-integrity.log)
+#   CC_WRITE_INTEGRITY_SKIP_GLOB   — pipe-separated globs to skip
+#                                    (default: "*.log|*.lock|*.tmp")
+#
+# Usage:
+# {
+#   "hooks": {
+#     "PostToolUse": [{
+#       "matcher": "Write|Edit",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/write-byte-integrity-verifier.sh" }]
+#     }]
+#   }
+# }
+
+# Allow opt-out
+if [ "${CC_WRITE_INTEGRITY_DISABLE:-0}" = "1" ]; then
+  exit 0
+fi
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-write-byte-integrity-verifier-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [write-byte-integrity-verifier]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+
+# Get tool name; only handle Write and Edit
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+case "$TOOL" in
+  Write|Edit) ;;
+  *) exit 0 ;;
+esac
+
+# Pull file path
+FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+if [ -z "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ]; then
+  exit 0
+fi
+
+# Skip files matching configured globs
+SKIP="${CC_WRITE_INTEGRITY_SKIP_GLOB:-*.log|*.lock|*.tmp}"
+IFS='|' read -ra PATTERNS <<< "$SKIP"
+for pat in "${PATTERNS[@]}"; do
+  pat=$(echo "$pat" | xargs)  # trim
+  [ -z "$pat" ] && continue
+  case "$FILE_PATH" in
+    $pat) exit 0 ;;
+  esac
+done
+
+ACTION="${CC_WRITE_INTEGRITY_ACTION:-warn}"
+LOG_FILE="${CC_WRITE_INTEGRITY_LOG:-/tmp/cc-write-integrity.log}"
+
+# Read disk size
+DISK_SIZE=$(wc -c < "$FILE_PATH" 2>/dev/null || echo "")
+if [ -z "$DISK_SIZE" ]; then
+  exit 0
+fi
+
+WARNINGS=()
+
+if [ "$TOOL" = "Write" ]; then
+  # Compare disk size vs intended content size
+  CONTENT_SIZE=$(printf '%s' "$INPUT" | jq -r '.tool_input.content // empty' 2>/dev/null | wc -c)
+  # jq's `-r` adds a trailing newline; subtract 1 if content was non-empty
+  HAS_CONTENT=$(printf '%s' "$INPUT" | jq -r '.tool_input.content // empty' 2>/dev/null)
+  if [ -n "$HAS_CONTENT" ] && [ "$CONTENT_SIZE" -gt 0 ]; then
+    EXPECTED=$((CONTENT_SIZE - 1))
+  else
+    EXPECTED=0
+  fi
+  if [ "$DISK_SIZE" -ne "$EXPECTED" ]; then
+    # Possible shrink-pad case: disk size larger than expected
+    if [ "$DISK_SIZE" -gt "$EXPECTED" ]; then
+      # Check trailing bytes for nulls
+      TAIL_BYTES=$(tail -c 4 "$FILE_PATH" 2>/dev/null | od -An -tx1 | tr -d ' \n')
+      if [ "$TAIL_BYTES" = "00000000" ]; then
+        WARNINGS+=("Write target appears null-padded: on-disk size $DISK_SIZE bytes exceeds intended $EXPECTED bytes, trailing 4 bytes are 0x00. Possible virtiofs shrink-pad bug (#58551).")
+      else
+        WARNINGS+=("Write target byte count mismatch: on-disk $DISK_SIZE vs intended $EXPECTED. Tail bytes are not null but size differs; investigate.")
+      fi
+    else
+      # Tail-chop case: disk size smaller than expected
+      WARNINGS+=("Write target appears tail-chopped: on-disk size $DISK_SIZE bytes is less than intended $EXPECTED bytes. Possible virtiofs grow-chop bug (#58551).")
+    fi
+  fi
+elif [ "$TOOL" = "Edit" ]; then
+  # For Edit, confirm new_string is in file and old_string is gone
+  NEW_STRING=$(printf '%s' "$INPUT" | jq -r '.tool_input.new_string // empty' 2>/dev/null)
+  OLD_STRING=$(printf '%s' "$INPUT" | jq -r '.tool_input.old_string // empty' 2>/dev/null)
+  REPLACE_ALL=$(printf '%s' "$INPUT" | jq -r '.tool_input.replace_all // false' 2>/dev/null)
+
+  if [ -n "$NEW_STRING" ]; then
+    if ! grep -F -q -- "$NEW_STRING" "$FILE_PATH" 2>/dev/null; then
+      WARNINGS+=("Edit completed but new_string not found in $FILE_PATH. The Edit may have been silently truncated (#58551) or applied incorrectly.")
+    fi
+  fi
+  if [ -n "$OLD_STRING" ] && [ "$REPLACE_ALL" != "true" ]; then
+    # In a non-replace_all Edit, old_string MAY still appear if it was a partial
+    # of a unique substring; skip strict check to avoid false positives.
+    :
+  fi
+  # Check for null-padding regardless
+  TAIL_BYTES=$(tail -c 4 "$FILE_PATH" 2>/dev/null | od -An -tx1 | tr -d ' \n')
+  if [ "$TAIL_BYTES" = "00000000" ]; then
+    # Avoid false positive: skip binary files
+    if file "$FILE_PATH" 2>/dev/null | grep -q "text"; then
+      WARNINGS+=("Edit target ends with 4 null bytes ($FILE_PATH). Text files normally do not. Possible virtiofs null-pad bug (#58551).")
+    fi
+  fi
+fi
+
+# No warnings → silent pass
+if [ ${#WARNINGS[@]} -eq 0 ]; then
+  exit 0
+fi
+
+# Log + emit
+TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
+for w in "${WARNINGS[@]}"; do
+  echo "[$TIMESTAMP] file=$FILE_PATH tool=$TOOL action=$ACTION reason=$w" >> "$LOG_FILE"
+done
+
+MSG="⚠️  write-byte-integrity-verifier: potential file corruption after $TOOL"
+for w in "${WARNINGS[@]}"; do
+  MSG+=$'\n'"     - $w"
+done
+MSG+=$'\n'"  Recommended: re-Read this file, confirm the intended content is on disk;"
+MSG+=$'\n'"  if corrupted, re-Write from your in-memory copy. On virtiofs mounts"
+MSG+=$'\n'"  (Claude Cowork sandbox / some devcontainers), consider working in /tmp"
+MSG+=$'\n'"  or a non-virtiofs path. Reference: github.com/anthropics/claude-code/issues/58551"
+
+if [ "$ACTION" = "block" ]; then
+  printf '%s\n' "$MSG" >&2
+  exit 2
+else
+  printf '%s\n' "$MSG" >&2
+  exit 0
+fi