cc-safe-setup 29.8.0 → 30.0.4

package/examples/write-empty-content-guard.sh

@@ -0,0 +1,67 @@
+#!/bin/bash
+# ================================================================
+# write-empty-content-guard.sh — Block clearing an existing non-empty file with empty content
+# ================================================================
+# PURPOSE:
+#   A Write that sends empty or whitespace-only content to a path that
+#   already holds a non-empty file silently clears that file. Reported in
+#   anthropics/claude-code#72666 (a tool wrote null/empty content and wiped
+#   the file with no safety confirmation). Almost every real edit has real
+#   content, so an empty write over a non-empty file is nearly always an
+#   accident — this blocks exactly that case and nothing else.
+#
+# HOW IT WORKS:
+#   PreToolUse on Write. If the target file exists and is non-empty, and the
+#   incoming `content` is empty or only whitespace, exit 2 (block) with a
+#   message. New files, and writes that carry real content, pass through.
+#   This is narrower than a generic overwrite warning: it does not fire on
+#   normal edits, only on the truncate-to-empty case.
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Write"
+#
+# CONFIGURATION:
+#   none
+# ================================================================
+set -uo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-write-empty-content-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [write-empty-content-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+FILE=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+
+# No path -> not our case.
+[ -z "$FILE" ] && exit 0
+# Target does not exist -> creating a (possibly empty) new file is fine.
+[ -f "$FILE" ] || exit 0
+# Target is already empty -> nothing to lose.
+[ -s "$FILE" ] || exit 0
+
+# `content` is absent for a Write only in odd cases; treat absent as empty.
+CONTENT=$(printf '%s' "$INPUT" | jq -r '.tool_input.content // ""' 2>/dev/null)
+
+# Is the incoming content empty or whitespace-only?
+if printf '%s' "$CONTENT" | grep -q '[^[:space:]]'; then
+    # Has at least one non-whitespace character -> real content, allow.
+    exit 0
+fi
+
+exist_lines=$(wc -l < "$FILE" 2>/dev/null | tr -d ' ')
+cat >&2 <<EOF
+BLOCKED: Write would clear an existing non-empty file with empty content.
+  file: $FILE (currently ~${exist_lines} lines)
+  incoming content is empty or whitespace-only — this silently wipes the file (#72666).
+If you really mean to empty it, do it explicitly (e.g. ': > "$FILE"') or write the
+intended content. If this was an accidental empty/null write, re-issue with real content.
+EOF
+exit 2

package/examples/write-nul-corruption-detector.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+# write-nul-corruption-detector.sh — Detect NUL-byte corruption after Write/Edit
+#
+# Solves: On some setups (notably the Windows Cowork workspace mount) Claude
+#         Code's Write/Edit tools return success while the file written to the
+#         host disk is silently corrupted — the tail is replaced with NUL bytes
+#         (\x00). Because the byte count can be unchanged, `wc -c` and a glance
+#         at `tail` look fine, so the corruption passes review and only surfaces
+#         later when the file fails to parse or build. (GitHub Issue #70414)
+#
+# How it works:
+#   After Write or Edit, if the target is a text-ish file (not a known binary
+#   extension) and contains NUL bytes, raise exit 2 so Claude is told the write
+#   landed corrupted and should re-verify, instead of trusting the reported
+#   success. NUL padding survives a byte-count check; this catches it. Pure
+#   truncation without NUL bytes needs a separate size comparison and is out of
+#   scope for this hook.
+#
+# Why exit 2 (not a silent warning): a corrupted write is a data-integrity event
+# — the model just recorded "done" against a file that is broken on disk. exit 2
+# feeds the message back so the model stops trusting the success and re-checks.
+#
+# TRIGGER: PostToolUse  MATCHER: "Write|Edit"
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-write-nul-corruption-detector-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [write-nul-corruption-detector]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.file // empty' 2>/dev/null)
+
+[ -z "$FILE" ] || [ ! -f "$FILE" ] && exit 0
+
+# Skip known binary formats — NUL bytes are legitimate there, not corruption.
+case "$FILE" in
+    *.png|*.jpg|*.jpeg|*.gif|*.webp|*.ico|*.bmp|*.tiff|*.pdf|*.zip|*.gz|*.tgz|*.bz2|*.xz|*.7z|*.rar|*.tar|*.jar|*.war|*.class|*.so|*.o|*.a|*.dylib|*.dll|*.exe|*.bin|*.wasm|*.woff|*.woff2|*.ttf|*.otf|*.eot|*.mp3|*.mp4|*.wav|*.avi|*.mov|*.mkv|*.flac|*.ogg|*.webm|*.pyc|*.pdb|*.db|*.sqlite|*.sqlite3|*.parquet|*.dat)
+        exit 0 ;;
+esac
+
+# Detect NUL bytes by counting them out. The previous check used `grep -aPq`,
+# but -P is GNU-only: on BSD grep (macOS) it failed, the failure was swallowed
+# by 2>/dev/null, and the corrupted write was reported as clean. Comparing the
+# byte count with and without NULs is exact and works on every platform.
+if [ "$(wc -c < "$FILE" 2>/dev/null || echo 0)" -ne "$(tr -d '\000' < "$FILE" 2>/dev/null | wc -c)" ]; then
+    echo "⚠ NUL bytes found in $FILE right after Write/Edit — the write may have landed corrupted (e.g. Cowork/Windows silent NUL-padding, #70414)." >&2
+    echo "  The tool reported success, but a text file should not contain NUL. The byte count can be unchanged, so 'wc -c' and 'tail' will not reveal this." >&2
+    echo "  Verify:  tr -d '\\000' < \"$FILE\" | wc -c   (compare with wc -c on the file itself)" >&2
+    echo "  Inspect: cat -v \"$FILE\" | tail        (NUL shows as ^@)" >&2
+    echo "  Recover: git checkout -- \"$FILE\"  (if tracked), or re-write and re-verify before trusting 'done'." >&2
+    exit 2
+fi
+
+exit 0

package/examples/write-overwrite-confirm.sh

@@ -1,40 +1,186 @@
 #!/bin/bash
-# write-overwrite-confirm.sh — Warn when Write tool overwrites large files
+# write-overwrite-confirm.sh — Warn when Write destroys content nobody looked at
 #
-# Solves: Write tool silently replacing large files with new content (#34597).
-#         A 500-line file can be overwritten with 10 lines without warning.
+# Solves (original): Write tool silently replacing large files with new content
+#         (#34597). A 500-line file can be overwritten with 10 lines.
 #
-# How it works: PreToolUse hook on Write that compares the new content
-#   size against the existing file. If the new content is significantly
-#   smaller, warns about potential data loss.
+# Solves (2026-08 addition): #78273 — the agent read FIVE lines of a hand-built
+#         file, confirmed it had content, then overwrote the whole file with its
+#         own analysis. The original was not in git and was unrecoverable.
+#         The size check below could not see this: the replacement was not
+#         smaller, so nothing fired.
+#
+#         A user on that thread named the general shape of the gap:
+#         "most guards key off the shape of a tool call rather than whether a
+#         write is about to destroy pre-existing, un-backed-up content
+#         (…) diffing intent against existing content before an overwrite is
+#         basically missing across the board right now."
+#
+# WHAT THIS ADDS: before an overwrite, ask two questions instead of one.
+#   1. Is the replacement much smaller?              (original check)
+#   2. Was the part being destroyed ever read?       (new check)
+#
+#   Question 2 needs a record of what was read, which is why this hook is
+#   paired with examples/record-read-coverage.sh (PostToolUse on Read).
+#   Without that recorder, no read coverage is known and this check stays
+#   silent rather than warning on everything — a guard that always fires is
+#   the same as no guard.
 #
 # TRIGGER: PreToolUse
 # MATCHER: "Write"
+#
+# TUNING (env):
+#   CC_WRITE_OVERWRITE_MIN_LINES   default 20  — check 2 only: ignore smaller files
+#   CC_WRITE_OVERWRITE_MAX_DESTROY default 10  — check 2 only: unseen lines before warning
+#   CC_WRITE_OVERWRITE_BLOCK=1                 — refuse the write (exit 2) instead of warning.
+#                                                Applies to BOTH checks below.
+#   CC_READ_LOG                    default /tmp/cc-read-files  — check 2 only
+#
+# WHAT BLOCK=1 DID NOT COVER BEFORE 2026-09-19: check 1 (the shrink check) always
+# exited 0, no matter how this was set, and check 2 exits early when the paired
+# recorder has never run. So someone who set BLOCK=1 without installing
+# examples/record-read-coverage.sh got exit 0 on every write while believing
+# overwrites were refused — measured with controls on 2026-09-19. That is the
+# failure this file names two screens down: a guard whose blocking mode does not
+# block teaches you to ignore the word.
 
-set -euo pipefail
+set -uo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-write-overwrite-confirm-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [write-overwrite-confirm]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
 
 INPUT=$(cat)
-FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+FILE=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null || true)
 [ -z "$FILE" ] && exit 0
 
 # Skip if file doesn't exist (new file creation)
 [ ! -f "$FILE" ] && exit 0
 
-# Get current file size (lines)
 CURRENT_LINES=$(wc -l < "$FILE" 2>/dev/null || echo 0)
+case "$CURRENT_LINES" in ''|*[!0-9]*) CURRENT_LINES=0 ;; esac
+
+NEW_CONTENT=$(printf '%s' "$INPUT" | jq -r '.tool_input.content // empty' 2>/dev/null || true)
+# printf '%s\n' and not '%s': the original used echo, which appends a newline, so
+# single-line content counted as 1. Dropping that newline made wc -l return 0 and
+# silently disabled the shrink check below.
+NEW_LINES=$(printf '%s\n' "$NEW_CONTENT" | wc -l 2>/dev/null || echo 0)
+case "$NEW_LINES" in ''|*[!0-9]*) NEW_LINES=0 ;; esac
 
-# Get new content size (approximate from JSON length)
-NEW_CONTENT=$(echo "$INPUT" | jq -r '.tool_input.content // empty' 2>/dev/null)
-NEW_LINES=$(echo "$NEW_CONTENT" | wc -l 2>/dev/null || echo 0)
+# The label has to match what this run actually does. A hook that prints
+# "BLOCKED" and then exits 0 teaches the reader to ignore the word. Decided
+# once, up here, because BOTH checks below print it and both have to agree.
+if [ "${CC_WRITE_OVERWRITE_BLOCK:-0}" = "1" ]; then
+  LABEL="BLOCKED"
+else
+  LABEL="WARNING"
+fi
 
-# Warn if shrinking by more than 50% and file is > 50 lines
+# ---------------------------------------------------------------
+# Check 1 (original): the replacement is much smaller than the file
+# ---------------------------------------------------------------
 if [ "$CURRENT_LINES" -gt 50 ] && [ "$NEW_LINES" -gt 0 ]; then
   RATIO=$((NEW_LINES * 100 / CURRENT_LINES))
   if [ "$RATIO" -lt 50 ]; then
-    echo "WARNING: File shrinking from $CURRENT_LINES to ~$NEW_LINES lines ($RATIO%)." >&2
+    echo "$LABEL: File shrinking from $CURRENT_LINES to ~$NEW_LINES lines ($RATIO%)." >&2
     echo "File: $FILE" >&2
     echo "Consider using Edit tool for targeted changes instead of full rewrite." >&2
+    # Before 2026-09-19 this fell straight through to exit 0, so the mode
+    # documented as "refuse the write" refused nothing here - and check 2,
+    # the only one that honoured it, exits early when the paired recorder
+    # has never run. Measured: 60 lines -> 1 line with BLOCK=1 returned 0.
+    [ "$LABEL" = "BLOCKED" ] && exit 2
   fi
 fi
 
+# ---------------------------------------------------------------
+# Check 2 (2026-08): the overwrite destroys lines nobody has read
+# ---------------------------------------------------------------
+MIN_LINES="${CC_WRITE_OVERWRITE_MIN_LINES:-20}"
+MAX_DESTROY="${CC_WRITE_OVERWRITE_MAX_DESTROY:-10}"
+READ_LOG="${CC_READ_LOG:-/tmp/cc-read-files}"
+
+case "$MIN_LINES"   in ''|*[!0-9]*) MIN_LINES=20 ;; esac
+case "$MAX_DESTROY" in ''|*[!0-9]*) MAX_DESTROY=10 ;; esac
+
+[ "$CURRENT_LINES" -lt "$MIN_LINES" ] && exit 0
+
+# No recorder installed means no coverage information at all. Staying silent is
+# deliberate: warning on every overwrite would make this hook noise, which is
+# exactly the failure mode read-before-edit.sh had while its recorder was missing.
+[ -f "$READ_LOG" ] || exit 0
+
+# Did the reads so far cover the whole file? Intervals are merged because a file
+# is often read in pages (offset 1 limit 100, then offset 101 limit 100, ...).
+# offset/limit of 0 means the Read carried no such argument, i.e. it started at
+# the top and ran to the tool's own cap, so treat it as covering what existed then.
+COVERED=$(awk -F'\t' -v f="$FILE" -v total="$CURRENT_LINES" '
+  # n must start as a number. An uninitialised awk variable is the empty string,
+  # and s[n] then writes to the subscript "" instead of 0, so every interval
+  # lands in one invisible slot and the file always looks unread.
+  BEGIN { n = 0 }
+  $1 == f {
+    off = ($2 + 0 < 1) ? 1 : $2 + 0
+    lim = $3 + 0
+    end = (lim > 0) ? off + lim - 1 : ($4 + 0 > 0 ? $4 + 0 : total)
+    if (end > total) end = total
+    if (end >= off) { s[n] = off; e[n] = end; n++ }
+  }
+  END {
+    if (n == 0) { print 0; exit }
+    for (i = 0; i < n; i++)
+      for (j = i + 1; j < n; j++)
+        if (s[j] < s[i]) { t=s[i];s[i]=s[j];s[j]=t; t=e[i];e[i]=e[j];e[j]=t }
+    reach = 0
+    for (i = 0; i < n; i++) {
+      if (s[i] > reach + 1) break
+      if (e[i] > reach) reach = e[i]
+    }
+    print (reach >= total) ? 1 : 0
+  }' "$READ_LOG" 2>/dev/null || echo 0)
+case "$COVERED" in ''|*[!0-9]*) COVERED=0 ;; esac
+
+[ "$COVERED" = "1" ] && exit 0
+
+# Count existing lines that do not appear anywhere in the replacement. This is a
+# deliberately crude diff: it asks "is this content going away", not "did the
+# line move". Moved lines are not destroyed, so undercounting them is correct.
+TMP_NEW=$(mktemp 2>/dev/null) || exit 0
+printf '%s\n' "$NEW_CONTENT" > "$TMP_NEW" 2>/dev/null || { rm -f "$TMP_NEW"; exit 0; }
+
+if [ ! -s "$TMP_NEW" ]; then
+  # Replacing a real file with nothing destroys all of it.
+  DESTROYED="$CURRENT_LINES"
+else
+  DESTROYED=$(grep -F -x -v -f "$TMP_NEW" -- "$FILE" 2>/dev/null | grep -c '[^[:space:]]' || echo 0)
+fi
+rm -f "$TMP_NEW"
+case "$DESTROYED" in ''|*[!0-9]*) DESTROYED=0 ;; esac
+
+[ "$DESTROYED" -lt "$MAX_DESTROY" ] && exit 0
+
+echo "" >&2
+echo "$LABEL: overwriting content that was never read." >&2
+echo "  File:            $FILE ($CURRENT_LINES lines)" >&2
+echo "  Lines destroyed: $DESTROYED (present now, absent from the replacement)" >&2
+echo "  Read coverage:   the whole file was never read in this session" >&2
+echo "" >&2
+echo "  This is the shape of issue #78273: a few lines were read, the file was" >&2
+echo "  confirmed to have content, and then all of it was replaced." >&2
+echo "" >&2
+echo "  Read the whole file first, or use Edit for a targeted change." >&2
+echo "  To allow this once: CC_WRITE_OVERWRITE_MAX_DESTROY=$((DESTROYED + 1))" >&2
+if [ "$LABEL" = "WARNING" ]; then
+  echo "  To refuse writes like this instead of warning: CC_WRITE_OVERWRITE_BLOCK=1" >&2
+fi
+
+[ "$LABEL" = "BLOCKED" ] && exit 2
 exit 0

package/examples/write-secret-guard.sh

@@ -27,6 +27,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-write-secret-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [write-secret-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 
@@ -75,13 +87,23 @@ if echo "$CONTENT" | grep -qE '(ghp_|gho_|ghs_|ghr_|github_pat_)[A-Za-z0-9_]{20,
 fi
 
 # OpenAI API key (sk-... or sk-proj-...)
-if echo "$CONTENT" | grep -qE 'sk-[A-Za-z0-9_-]{20,}' && ! echo "$CONTENT" | grep -qE 'sk-ant-'; then
+# The prefix has to START a token. Without the left boundary this pattern also
+# fired on ordinary English words that end in "sk" before a separator — task-,
+# ask-, risk-, disk-, desk- — so writing a file named
+# task-management-system-config.json was refused as a leaked OpenAI key.
+# (Found 2026-08-13 the hard way: this hook blocked a write here over the
+# filename ask-under-permissive-modes-firsthand-2026-08-13.json.)
+# A guard that refuses ordinary work is a guard people switch off, so the
+# false positive costs more than it looks. A real key never has a word
+# character immediately before its prefix, so the boundary loses no detection.
+if echo "$CONTENT" | grep -qE '(^|[^A-Za-z0-9_-])sk-[A-Za-z0-9_-]{20,}' \
+   && ! echo "$CONTENT" | grep -qE '(^|[^A-Za-z0-9_-])sk-ant-'; then
     # Exclude Anthropic keys (handled separately)
     BLOCKED="OpenAI API key (sk-...)"
 fi
 
-# Anthropic API key
-if echo "$CONTENT" | grep -qE 'sk-ant-[A-Za-z0-9-]{20,}'; then
+# Anthropic API key — same boundary, same reason as above
+if echo "$CONTENT" | grep -qE '(^|[^A-Za-z0-9_-])sk-ant-[A-Za-z0-9-]{20,}'; then
     BLOCKED="Anthropic API key (sk-ant-...)"
 fi
 
@@ -90,8 +112,8 @@ if echo "$CONTENT" | grep -qE '(xoxb-|xoxp-|xoxs-|xoxa-)[0-9A-Za-z-]{20,}'; then
     BLOCKED="Slack token"
 fi
 
-# Stripe keys
-if echo "$CONTENT" | grep -qE '(sk_live_|pk_live_|rk_live_)[A-Za-z0-9]{20,}'; then
+# Stripe keys — same boundary: task_live_/risk_live_ end in the same two letters
+if echo "$CONTENT" | grep -qE '(^|[^A-Za-z0-9_-])(sk_live_|pk_live_|rk_live_)[A-Za-z0-9]{20,}'; then
     BLOCKED="Stripe API key"
 fi
 

package/examples/write-shrink-guard.sh

@@ -16,6 +16,18 @@
 # DECISION: exit 2 = block, exit 0 = allow
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-write-shrink-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [write-shrink-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 [ "$TOOL" != "Write" ] && exit 0

package/examples/wsl-host-disk-space-guard.sh

@@ -0,0 +1,97 @@
+#!/bin/bash
+# ================================================================
+# wsl-host-disk-space-guard.sh — Watch the WSL host (Windows C:) too
+# ================================================================
+# PURPOSE:
+#   The bundled disk-space-guard.sh only inspects the working
+#   directory's filesystem (`df .`). On WSL2 that misses the actual
+#   choke point: the Windows host drive that backs ext4.vhdx.
+#
+#   Past incident (2026-05-04): WSL `/dev/sdd` had 162 GiB free, but
+#   Windows `C:` was at 96% (38 GiB free out of 931 GiB). Claude Code
+#   and Codex CLI both crashed with "getpwnam failed" / I/O errors
+#   because the host could no longer extend ext4.vhdx.
+#
+#   This hook checks `/`, `/home`, and `/mnt/c`, blocks Bash/Write
+#   when the host is critical, and warns earlier than that.
+#
+# TRIGGER: PreToolUse  MATCHER: "Write|Bash"
+#
+# CONFIG:
+#   CC_HOST_DISK_WARN_PCT=90       /mnt/c warn at this percent used
+#   CC_HOST_DISK_BLOCK_PCT=95      /mnt/c block at this percent used
+#   CC_LINUX_DISK_WARN_PCT=85      /, /home warn at this percent used
+#   CC_LINUX_DISK_BLOCK_PCT=95     /, /home block at this percent used
+#   CC_HOST_DISK_DISABLE=1         disable this hook entirely
+# ================================================================
+
+[ "${CC_HOST_DISK_DISABLE:-0}" = "1" ] && exit 0
+
+HOST_WARN="${CC_HOST_DISK_WARN_PCT:-90}"
+HOST_BLOCK="${CC_HOST_DISK_BLOCK_PCT:-95}"
+LINUX_WARN="${CC_LINUX_DISK_WARN_PCT:-85}"
+LINUX_BLOCK="${CC_LINUX_DISK_BLOCK_PCT:-95}"
+
+# Read percent used for a mount point, or empty if it does not exist.
+# We check existence so this hook works on non-WSL hosts too.
+pct_for() {
+    local mount="$1"
+    [ -d "$mount" ] || return 0
+    df --output=pcent "$mount" 2>/dev/null | tail -1 | tr -d ' %'
+}
+
+avail_for() {
+    local mount="$1"
+    [ -d "$mount" ] || return 0
+    df -h --output=avail "$mount" 2>/dev/null | tail -1 | tr -d ' '
+}
+
+block=0
+warn_lines=""
+
+check_linux() {
+    local mount="$1"
+    local pct
+    pct=$(pct_for "$mount")
+    [ -z "$pct" ] && return 0
+    if [ "$pct" -ge "$LINUX_BLOCK" ]; then
+        echo "BLOCKED: $mount is ${pct}% full ($(avail_for "$mount") free) — above ${LINUX_BLOCK}%." >&2
+        echo "  Free space inside WSL before more writes:" >&2
+        echo "    du -sh ~/.cache ~/.npm ~/.claude/debug ~/.local/share/Trash 2>/dev/null" >&2
+        block=1
+    elif [ "$pct" -ge "$LINUX_WARN" ]; then
+        warn_lines="${warn_lines}WARNING: $mount is ${pct}% full ($(avail_for "$mount") free) — above ${LINUX_WARN}%."$'\n'
+    fi
+}
+
+check_host() {
+    local mount="$1"
+    local pct
+    pct=$(pct_for "$mount")
+    [ -z "$pct" ] && return 0
+    if [ "$pct" -ge "$HOST_BLOCK" ]; then
+        echo "BLOCKED: Windows host $mount is ${pct}% full ($(avail_for "$mount") free) — above ${HOST_BLOCK}%." >&2
+        echo "  WSL can no longer safely extend ext4.vhdx. Past incident crashed CC and Codex." >&2
+        echo "  Recovery on Windows (admin PowerShell):" >&2
+        echo "    wsl --shutdown" >&2
+        echo "    Optimize-VHD -Path <ext4.vhdx> -Mode Full" >&2
+        block=1
+    elif [ "$pct" -ge "$HOST_WARN" ]; then
+        warn_lines="${warn_lines}WARNING: Windows host $mount is ${pct}% full ($(avail_for "$mount") free) — above ${HOST_WARN}%."$'\n'
+    fi
+}
+
+# /home is on the same vhdx as / on most WSL setups, but check both in
+# case the user mounted /home separately.
+check_linux /
+[ "$(stat -c '%d' /home 2>/dev/null)" != "$(stat -c '%d' / 2>/dev/null)" ] && check_linux /home
+
+# /mnt/c only exists on WSL.
+check_host /mnt/c
+
+if [ -n "$warn_lines" ]; then
+    printf '%s' "$warn_lines" >&2
+fi
+
+[ "$block" -eq 1 ] && exit 2
+exit 0