cc-safe-setup 29.8.0 → 30.0.5

package/examples/auto-approve-readonly.sh

@@ -8,46 +8,123 @@
 #   while letting destructive commands go through normal approval.
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+#
+# Rewritten 2026-08-03. Two things were wrong, and they compounded.
+#
+#   1. The base command was taken from the FIRST word of the whole line, so
+#      `cat README.md && sudo rm -rf app` produced the base `cat` and the
+#      approval was handed to the entire line. Same defect as PR #937
+#      (allowlist.sh), #940 (cd-git-allow.sh) and #941/#942 (the other
+#      auto-approve hooks) — on the approving side, where the decision is an
+#      explicit approval rather than a missed block.
+#   2. `find` sat in the read-only list with no look at its predicates, so
+#      `find . -name '*.log' -delete` was approved as a read-only command.
+#      Redirections had the same shape: `cat x > out` writes a file and was
+#      approved for reading one.
+#
+# Now every command position has to qualify on its own, and the forms that
+# write are named. A line that does not qualify gets no decision, which leaves
+# it to the normal permission flow — this hook only ever adds approval, it
+# never blocks.
+#
+# Known limit: quotes are not parsed, so a separator inside a quoted string
+# ends a segment early. That is the conservative direction here (fewer
+# approvals, not more).
 # ================================================================
 
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 
-# Extract the base command (first word, ignoring env vars and cd prefixes)
-BASE=$(echo "$COMMAND" | sed 's/^[A-Z_]*=[^ ]* //g; s/^cd [^;]*[;&|]* //' | awk '{print $1}' | sed 's|.*/||')
-
-# Read-only commands that never modify anything
-case "$BASE" in
-    cat|head|tail|less|more|wc|grep|rg|ag|ack|find|locate|\
-    ls|ll|dir|tree|stat|file|which|whereis|type|realpath|\
-    date|uptime|uname|hostname|whoami|id|groups|env|printenv|\
-    pwd|df|du|free|top|ps|pgrep|lsof|netstat|ss|\
-    git-log|git-diff|git-show|git-status|git-branch|git-remote|git-tag|\
-    jq|yq|python3-c|node-e|ruby-e|\
-    npm-ls|npm-list|npm-info|npm-view|npm-outdated|\
-    pip-list|pip-show|pip-freeze|\
-    cargo-tree|go-list|go-doc)
-        echo '{"decision":"approve","reason":"Read-only command"}'
-        exit 0
-        ;;
+# A substitution can carry a command that no string-level read sees.
+case "$COMMAND" in
+    *'$('*|*'`'*) exit 0 ;;
+esac
+
+# Anything that writes to a file is not a read, whatever the command word says.
+case "$COMMAND" in
+    *'>'*) exit 0 ;;
 esac
 
-# git subcommands that are read-only
-if echo "$COMMAND" | grep -qE '^\s*git\s+(status|log|diff|show|branch|remote|tag\s+-l|blame|shortlog|describe|rev-parse|ls-files|ls-tree)\b'; then
-    echo '{"decision":"approve","reason":"Read-only git command"}'
-    exit 0
-fi
-
-# Commands piped to read-only output (anything | head, | grep, etc.)
-if echo "$COMMAND" | grep -qE '\|\s*(head|tail|grep|wc|sort|uniq|tr|cut|awk|sed|less|more)\s'; then
-    # Only approve if the source command is also read-only
-    FIRST=$(echo "$COMMAND" | cut -d'|' -f1 | awk '{print $1}')
-    case "$FIRST" in
-        cat|head|tail|grep|find|ls|git|npm|pip|cargo|go)
-            echo '{"decision":"approve","reason":"Read-only pipeline"}'
-            exit 0
-            ;;
+# Commands that read and nothing else. `git` is handled separately below,
+# because only some of its subcommands read.
+cc_ro_base_ok() {
+    case "$1" in
+        cat|head|tail|less|more|wc|grep|rg|ag|ack|locate|\
+        ls|ll|dir|tree|stat|file|which|whereis|type|realpath|\
+        date|uptime|uname|hostname|whoami|id|groups|env|printenv|\
+        pwd|df|du|free|top|ps|pgrep|lsof|netstat|ss|\
+        jq|yq)
+            return 0 ;;
+    esac
+    return 1
+}
+
+# Filters that only make sense downstream of something else. They stay out of
+# the first position so that `sed …` on its own is not read as a read.
+cc_filter_base_ok() {
+    case "$1" in
+        head|tail|grep|wc|sort|uniq|tr|cut|awk|sed|less|more|column|nl|rev)
+            return 0 ;;
     esac
-fi
+    return 1
+}
+
+cc_segment_base() {
+    # strip leading blanks, leading VAR=value assignments, then take the command
+    # word without its directory
+    printf '%s' "$1" \
+        | sed -E 's/^[[:space:]]+//; s/^([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+)*//' \
+        | awk '{print $1}' \
+        | sed 's|.*/||'
+}
+
+cc_segment_reads() {
+    local seg="$1" idx="$2" base
+    base=$(cc_segment_base "$seg")
+    [ -z "$base" ] && return 1
+
+    # moving between directories reads nothing and writes nothing
+    [ "$base" = "cd" ] && return 0
+
+    # find reads only while it carries no predicate that acts on what it finds
+    if [ "$base" = "find" ]; then
+        printf '%s' "$seg" \
+            | grep -qE '(^|[[:space:]])-(delete|exec|execdir|ok|okdir|fprintf?|fls|fprint0)([[:space:]]|$)' \
+            && return 1
+        return 0
+    fi
+
+    # sed rewrites the file in place with -i
+    if [ "$base" = "sed" ]; then
+        printf '%s' "$seg" | grep -qE '(^|[[:space:]])-[a-zA-Z]*i' && return 1
+    fi
+
+    cc_ro_base_ok "$base" && return 0
+
+    # git, only the subcommands that read
+    if printf '%s' "$seg" | grep -qE '^[[:space:]]*git[[:space:]]+(status|log|diff|show|branch|remote|tag[[:space:]]+-l|blame|shortlog|describe|rev-parse|ls-files|ls-tree)([[:space:]]|$)'; then
+        return 0
+    fi
+
+    # downstream positions may also be a plain filter
+    [ "$idx" -gt 0 ] && cc_filter_base_ok "$base" && return 0
+
+    return 1
+}
+
+IDX=0
+while IFS= read -r SEG; do
+    SEG="${SEG#"${SEG%%[![:space:]]*}"}"
+    SEG="${SEG%"${SEG##*[![:space:]]}"}"
+    [ -z "$SEG" ] && continue
+    cc_segment_reads "$SEG" "$IDX" || exit 0
+    IDX=$((IDX + 1))
+done <<EOF
+$(printf '%s' "$COMMAND" | tr ';&|' '\n\n\n')
+EOF
+
+# nothing to approve if the line held no command at all
+[ "$IDX" -eq 0 ] && exit 0
 
+echo '{"decision":"approve","reason":"Read-only command"}'
 exit 0

package/examples/auto-approve-ssh.sh

@@ -21,7 +21,36 @@ fi
 # Safe remote commands (customize this list)
 SAFE_COMMANDS="uptime|w|whoami|hostname|uname|date|df|free|cat /etc/os-release"
 
-if echo "$COMMAND" | grep -qE "^\s*ssh\s+\S+\s+($SAFE_COMMANDS)(\s|$)"; then
+# Approve only when EVERY command position qualifies.
+#
+# The pattern below was anchored at `^\s*` and matched against the whole command
+# string, so only the first command position was examined and the approval was
+# then handed to the entire line: `ssh host uptime && sudo rm -rf app` was
+# approved on the strength of its first word. Measured 2026-08-03. Same defect
+# as PR #937 / #940 / #941, on the approving side, where the decision is an
+# explicit approval rather than a missed block.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so a quoted remote payload that carries a separator (`ssh host "uptime; df"`)
+# stops qualifying too. That is the conservative direction: it gets no decision
+# and lands in the normal permission flow. Command substitution and backticks
+# disqualify the line outright. This hook only ever adds approval; it never
+# blocks.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    case "$cmd" in *'$('*|*'`'*) return 1 ;; esac
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+if cc_every_segment_matches "^\s*ssh\s+\S+\s+($SAFE_COMMANDS)(\s|\$)" "$COMMAND"; then
     jq -n '{
       hookSpecificOutput: {
         hookEventName: "PreToolUse",

package/examples/auto-approve-test.sh

@@ -3,6 +3,50 @@
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
+
+# Approve only when EVERY command position qualifies.
+#
+# The patterns below were anchored at `^\s*` and matched against the whole
+# command string, so only the first command position was examined and the
+# approval was then handed to the entire line: `pytest && sudo rm -rf app` was
+# approved on the strength of its first word. Measured 2026-08-03. Same defect
+# as PR #937 / #940 / #941, on the approving side, where the decision is an
+# explicit approval rather than a missed block.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so anything that can hide a command from a string-level read (command
+# substitution, backticks) disqualifies the line outright. A line that does not
+# qualify gets no decision, which leaves it to the normal permission flow. This
+# hook only ever adds approval; it never blocks.
+#
+# The gate uses the union of all eight patterns, so a chain of test runners
+# (`pytest && go test ./...`) still passes; the if-chain below only picks which
+# reason to report.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    case "$cmd" in *'$('*|*'`'*) return 1 ;; esac
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+TEST_SAFE_RE='^\s*(npm\s+test|npm\s+run\s+test|npx\s+(jest|vitest|mocha|ava|tap|playwright\s+test|cypress\s+run)|yarn\s+test|pnpm\s+test|bun\s+test)\b'
+TEST_SAFE_RE="$TEST_SAFE_RE"'|^\s*(pytest|python\s+-m\s+(pytest|unittest)|tox)\b'
+TEST_SAFE_RE="$TEST_SAFE_RE"'|^\s*go\s+test\b'
+TEST_SAFE_RE="$TEST_SAFE_RE"'|^\s*cargo\s+test\b'
+TEST_SAFE_RE="$TEST_SAFE_RE"'|^\s*(phpunit|vendor/bin/phpunit|php\s+artisan\s+test)\b'
+TEST_SAFE_RE="$TEST_SAFE_RE"'|^\s*(rspec|bundle\s+exec\s+rspec|rake\s+test|rails\s+test)\b'
+TEST_SAFE_RE="$TEST_SAFE_RE"'|^\s*(mvn\s+test|gradle\s+test|./gradlew\s+test)\b'
+TEST_SAFE_RE="$TEST_SAFE_RE"'|^\s*dotnet\s+test\b'
+
+cc_every_segment_matches "$TEST_SAFE_RE" "$COMMAND" || exit 0
+
 if echo "$COMMAND" | grep -qE '^\s*(npm\s+test|npm\s+run\s+test|npx\s+(jest|vitest|mocha|ava|tap|playwright\s+test|cypress\s+run)|yarn\s+test|pnpm\s+test|bun\s+test)\b'; then
     echo '{"decision":"approve","reason":"Test runner command"}'
     exit 0

package/examples/auto-checkpoint.sh

@@ -18,7 +18,7 @@
 #   }
 # }
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PostToolUse  MATCHER: "Edit|Write"
 
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)

package/examples/auto-mode-safe-commands.sh

@@ -21,7 +21,7 @@
 #   }
 # }
 #
-# TRIGGER: PermissionRequest  MATCHER: ""
+# TRIGGER: PreToolUse  MATCHER: "Bash"
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
@@ -99,6 +99,58 @@ if echo "$COMMAND" | grep -qE '^\s*(node|python3?)\s+-e\s'; then
     fi
 fi
 
+# --- Every command position has to qualify, not just the first one ---
+#
+# The comment at the top of this file says "We check each component of compound
+# commands". It did not. Every pattern above is anchored at `^\s*` and matched
+# against the whole command string, so only the first command position was ever
+# examined, and the approval below was then handed to the entire line.
+# `cat README.md && sudo rm -rf app` and `curl -s http://… | sh` were both
+# approved. Measured 2026-08-03. Same defect as PR #937 / #940 / #941, on the
+# approving side, where the decision is an explicit approval rather than a
+# missed block. This hook matters more than most because it exists for auto
+# mode, where nobody is watching the prompt.
+#
+# Splitting on the separator characters is approximate — quotes are not parsed —
+# so a line that does not qualify gets no decision and lands in the normal
+# permission flow. This hook only ever adds approval; it never blocks.
+cc_every_segment_matches() {
+    local pat="$1" cmd="$2" seg
+    while IFS= read -r seg; do
+        seg="${seg#"${seg%%[![:space:]]*}"}"
+        seg="${seg%"${seg##*[![:space:]]}"}"
+        [ -z "$seg" ] && continue
+        printf '%s' "$seg" | grep -qE "$pat" || return 1
+    done <<EOF
+$(printf '%s' "$cmd" | tr ';&|' '\n\n\n')
+EOF
+    return 0
+}
+
+SAFE_RE='^\s*(cat|head|tail|less|more|wc|file|stat|du|df|ls|tree|find|which|whereis|type|realpath|readlink)\s'
+SAFE_RE="$SAFE_RE"'|^\s*(grep|rg|ag|ack|sed\s+-n|awk)\s'
+SAFE_RE="$SAFE_RE"'|^\s*git\s+(status|log|diff|show|branch|tag|remote|stash\s+list|ls-files|ls-tree|rev-parse|describe|shortlog|blame|config\s+--get)'
+SAFE_RE="$SAFE_RE"'|^\s*(npm\s+(ls|list|info|view|outdated|audit)|pip\s+(list|show|freeze)|yarn\s+(list|info|why)|pnpm\s+(ls|list))\s*'
+SAFE_RE="$SAFE_RE"'|^\s*(echo|printf|date|env|printenv|uname|hostname|whoami|id|pwd|tput)\s*'
+SAFE_RE="$SAFE_RE"'|^\s*(jq|yq|python3?\s+-c\s|python3?\s+-m\s+json)\s'
+SAFE_RE="$SAFE_RE"'|^\s*curl\s+-s'
+SAFE_RE="$SAFE_RE"'|^\s*(node|python3?)\s+-e\s'
+SAFE_RE="$SAFE_RE"'|^\s*(mkdir|touch|cp|mv)\s'
+
+if [ "$APPROVE" = true ]; then
+    # A substitution can carry a command that no string-level read sees. The
+    # `$(date …)` branch above is the one this hook deliberately supports, so
+    # strip those and refuse if any other substitution is left.
+    if printf '%s' "$COMMAND" | grep -q '`'; then
+        exit 0
+    fi
+    SUBST_REST=$(printf '%s' "$COMMAND" | sed -E 's/\$\(date[^)]*\)//g')
+    if printf '%s' "$SUBST_REST" | grep -q '\$('; then
+        exit 0
+    fi
+    cc_every_segment_matches "$SAFE_RE" "$COMMAND" || exit 0
+fi
+
 # --- Output the decision ---
 if [ "$APPROVE" = true ]; then
     jq -n --arg reason "$REASON" \

package/examples/auto-mode-safety-enforcer.sh

@@ -21,21 +21,168 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-auto-mode-safety-enforcer-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [auto-mode-safety-enforcer]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+# --- Mention vs invocation ----------------------------------------------------
+# Every pattern below scans the command text, so a dangerous string written
+# inside quotes reaches them exactly as an executed command would. Until now
+# this hook lived with that by leaving quotes out of the terminator sets: the
+# five quoted targets the header claims passed, and the mention controls in
+# tests/auto-mode-unquoted-targets.test.sh passed for the same reason -- the
+# target was invisible, not recognised.
+#
+# This is the quote-aware extraction destructive-guard grew in PR #960, ported
+# here as the comment further down said it would have to be. Blank out
+# everything inside quotes, then ask whether a destructive verb still starts a
+# command in what is left. If none does, nothing destructive is being invoked
+# and there is nothing for the rest of this file to judge.
+if [ -z "${CC_AUTOMODE_UNWRAPPED:-}" ] && [ -n "$COMMAND" ]; then
+    _am_outside=$(printf '%s' "$COMMAND" | awk -v SQ="'" -v DQ='"' '
+      { line = $0; out = ""; q = 0
+        for (i = 1; i <= length(line); i++) {
+          c = substr(line, i, 1)
+          if (q == 0 && c == SQ) { q = 1; out = out " "; continue }
+          if (q == 1) { if (c == SQ) q = 0; out = out " "; continue }
+          if (q == 0 && c == DQ) { q = 2; out = out " "; continue }
+          if (q == 2) { if (c == DQ) q = 0; out = out " "; continue }
+          out = out c
+        }
+        print out }')
+    # The wrapper unwrapping further down only runs if this gate lets the call
+    # through, so the gate has to see a verb that sits inside a substitution or
+    # a subshell too. Replace the wrapping tokens with separators first -- the
+    # same substitution the unwrapping step uses. Measured 2026-08-11: without
+    # this, a deletion inside a substitution and one on the right of an
+    # assignment both exited 0 here and never reached the unwrapping.
+    _am_gate=$(printf '%s' "$_am_outside" | sed -E \
+        -e 's/\$\(/ ; /g' -e 's/`/ ; /g' \
+        -e 's/(^|[[:space:]])\(/\1 ; /g' -e 's/\)([[:space:]]|$)/ ; \1/g' \
+        -e 's/\)$/ ; /g' \
+        -e 's/(^|[[:space:]])(then|do|else|elif)([[:space:]])/\1 ; \3/g')
+    # A quoted string is only inert while nothing executes it. `sh -c` with a
+    # quoted argument, `eval`, and a pipe into a shell all run that text, so
+    # there the quoted string is a command and not a mention. Never let the
+    # gate pass those through.
+    if printf '%s' "$_am_outside" | grep -qE '(^|[;&|`(){}]|[[:space:]])((sh|bash|zsh|dash|ksh)[[:space:]]+(-[a-z]*[[:space:]]+)*-c([[:space:]]|$)|eval([[:space:]]|$))|\|[[:space:]]*(sudo[[:space:]]+)?(sh|bash|zsh|dash|ksh|python3?|perl|ruby|node)([[:space:]]|$)' 2>/dev/null; then
+        :
+    elif ! printf '%s' "$_am_gate" | grep -qE '(^|[;&|`(){}]|\$\(|[[:space:]](then|do|else|elif)[[:space:]])[[:space:]]*([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+|(env|nice|ionice|timeout|exec|command|builtin|stdbuf|nohup|sudo|time|xargs)([[:space:]]+-[^[:space:]]+)*([[:space:]]+[0-9]+)?([[:space:]]+-[^[:space:]]+)*[[:space:]]+)*([./]*[A-Za-z0-9_./-]*/)?(rm|rmdir|unlink|shred|dd|mkfs[.a-z0-9]*|fdisk|parted|chmod|kill|killall)([[:space:]]|$)' 2>/dev/null; then
+        exit 0
+    fi
+fi
+
+# --- Look inside wrappers -----------------------------------------------------
+# The target patterns below require whitespace or end-of-line after the
+# dangerous path, so a deletion wrapped in a substitution or a subshell ends
+# with `)` and never matches. Measured 2026-08-04: the bare deletion was
+# blocked and five of six wrappings passed. Claude Code 2.1.221 fixed the same
+# shape in its own permission check.
+#
+# Replace the wrapping tokens with separators and run this same script once more
+# against that text. Detection only: never executed; the message keeps the
+# command the user actually sent.
+if [ -n "${CC_AUTOMODE_UNWRAPPED:-}" ]; then
+    COMMAND="$CC_AUTOMODE_UNWRAPPED"
+elif [ -n "$COMMAND" ]; then
+    _am_unwrapped=$(printf '%s' "$COMMAND" | sed -E \
+        -e 's/\$\(/ ; /g' -e 's/`/ ; /g' \
+        -e 's/(^|[[:space:]])\(/\1 ; /g' -e 's/\)([[:space:]]|$)/ ; \1/g' \
+        -e 's/\)$/ ; /g' \
+        -e 's/(^|[[:space:]])(then|do|else|elif)([[:space:]])/\1 ; \3/g')
+    if [ "$_am_unwrapped" != "$COMMAND" ]; then
+        CC_AUTOMODE_UNWRAPPED="$_am_unwrapped" bash "$0" </dev/null >/dev/null 2>&1
+        if [ "$?" = "2" ]; then
+            echo "BLOCKED: a destructive command is hidden inside a wrapper." >&2
+            echo "Command: $COMMAND" >&2
+            echo "A substitution, a subshell or a shell keyword does not make it safe." >&2
+            exit 2
+        fi
+    fi
+fi
 [ -z "$COMMAND" ] && exit 0
 
+# Quote characters are dropped for matching only. The gate above has already
+# ruled out text that merely names a command, so a quote here is an ordinary
+# way to write an argument and the target behind it has to be judged. Every
+# message below still shows the command the user actually sent.
+#
+# This has to come after the unwrapping above, not before it: that step
+# re-reads COMMAND from CC_AUTOMODE_UNWRAPPED in the recursive call, so a
+# CMD_UNQ computed earlier would still hold the value from before the rewrite
+# (empty, in the child) and every pattern below would match nothing.
+CMD_UNQ=$(printf '%s' "$COMMAND" | tr -d "\"'")
+
+# The gate at the top of this file counts a path, a sudo, an inline assignment
+# and the usual wrappers as an invocation. The two checks below anchored on a
+# separator or a bare space, so `/usr/bin/rm -rf /` reached them and matched
+# nothing: measured 2026-09-14, nine invocation forms against six destructive
+# commands, twelve of fifty-four cells passed and every one of the twelve was
+# reached through a path.
+#
+# This is a superset of what was here before, not a replacement. The bare-space
+# branch is load-bearing: the gate lets `echo "rm -rf /" | sh` through on the
+# pipe-into-a-shell arm, and only the loose match below stops it. Narrowing this
+# to command position alone reopened four cases in tests/auto-mode-quoted-
+# targets.test.sh -- measured against the pre-change copy to be sure it was the
+# change and not the instrument.
+AM_CMDPOS='(^|[;&|`(){}]|\$\(|[[:space:]])[[:space:]]*([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+|(env|nice|ionice|timeout|exec|command|builtin|stdbuf|nohup|sudo|time|xargs)([[:space:]]+-[^[:space:]]+)*([[:space:]]+[0-9]+)?([[:space:]]+-[^[:space:]]+)*[[:space:]]+)*([./]*[A-Za-z0-9_./-]*/)?'
+
 # --- Critical rm operations ---
-if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|)(sudo\s+)?rm\s'; then
+if echo "$CMD_UNQ" | grep -qE "${AM_CMDPOS}"'rm[[:space:]]'; then
     # Always block rm on root-level and home-level critical paths
-    if echo "$COMMAND" | grep -qE 'rm\s.*(/\s|/;|/$|~\/?\s|~\/?$|~\/\.|/home\b|/etc\b|/usr\b|/var\b|/opt\b|/root\b)'; then
+    # The home terminators used to be whitespace or end-of-line only, so
+    # `rm -rf ~; echo done` passed while `rm -rf ~ ; echo done` was blocked --
+    # one space apart, opposite verdicts. Separators end a command just as much
+    # as a space does. Measured 2026-08-04.
+    if echo "$CMD_UNQ" | grep -qE 'rm\s.*(/[[:space:];&|]|/$|~\/?[[:space:];&|]|~\/?$|~\/\.|/home\b|/etc\b|/usr\b|/var\b|/opt\b|/root\b)'; then
         echo "BLOCKED: rm targeting critical system/home path" >&2
         echo "This operation would cause irreversible data loss." >&2
         echo "Command: $COMMAND" >&2
         exit 2
     fi
+    # The header above lists $HOME, a parent traversal and the git directory
+    # among the paths this hook blocks, but the pattern before this one has no
+    # case for any of them. Measured 2026-08-11 against the 19 targets the
+    # header claims: 11 passed, including
+    #
+    #     rm -rf $HOME     rm -rf ${HOME}     rm -rf ..
+    #     rm -rf ../..     rm -rf a/../..     rm -rf .git
+    #
+    # scripts.json grew the $HOME case in PR #962 and the quoted case in #961.
+    # Neither fix reached this example, so the same defect stayed here.
+    #
+    # Quoted forms ("/", "$HOME", ".git") are deliberately still not matched.
+    # This hook has no mention-vs-invocation pass, so putting a quote in a
+    # terminator set would also block `echo "rm -rf /"` and a commit message
+    # that names the command. Those pass today only because the target is
+    # invisible behind the quote. Telling a mention from a run needs the
+    # quote-aware extraction destructive-guard grew in PR #960; until that is
+    # ported here, rm-safety-net and compound-command-deny-enforcer are the
+    # layer that catches the quoted forms (measured: both deny them).
+    #
+    # Terminators are deliberate: `..` and `.git` must be a whole path
+    # component, so `my..cache`, `backup..`, `.gitignore` and `.github` are
+    # untouched, and `$HOMEBREW_PREFIX` does not look like `$HOME`.
+    if echo "$CMD_UNQ" | grep -qE 'rm\s.*(\$\{?HOME\}?([[:space:];&|/]|$)|(^|[[:space:]/])\.\.([[:space:];&|/]|$)|(^|[[:space:]/])\.git([[:space:];&|/]|$))'; then
+        echo "BLOCKED: rm targeting the home directory, a parent directory, or the git directory" >&2
+        echo "This operation would cause irreversible data loss." >&2
+        echo "Command: $COMMAND" >&2
+        exit 2
+    fi
     # Block rm on dotfiles in home directory
-    if echo "$COMMAND" | grep -qE "rm\s.*(${HOME}|\~)/\."; then
+    if echo "$CMD_UNQ" | grep -qE "rm\s.*(${HOME}|\~)/\."; then
         echo "BLOCKED: rm targeting home dotfile" >&2
         echo "Command: $COMMAND" >&2
         exit 2
@@ -43,7 +190,7 @@ if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|)(sudo\s+)?rm\s'; then
 fi
 
 # --- Disk-level operations ---
-if echo "$COMMAND" | grep -qE '(^|\s)(sudo\s+)?(dd\s+.*of=/dev|mkfs\.|fdisk\s|parted\s)'; then
+if echo "$CMD_UNQ" | grep -qE "${AM_CMDPOS}"'(dd[[:space:]]+.*of=/dev|mkfs\.|fdisk[[:space:]]|parted[[:space:]])'; then
     echo "BLOCKED: Disk-level operation (dd/mkfs/fdisk/parted)" >&2
     exit 2
 fi

package/examples/auto-push-session-branch.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+set -uo pipefail
+git rev-parse --is-inside-work-tree >/dev/null 2>&1 || exit 0
+branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null || echo "")
+[ -z "$branch" ] && exit 0          # detached HEAD: do nothing
+case "$branch" in
+  main|master|develop|release) exit 0 ;;
+esac
+push() { if "$@"; then return 0; else
+  echo "[auto-push] '$branch' not pushed (no remote / auth / rejected). Push manually." >&2
+  exit 0; fi; }
+if git rev-parse --abbrev-ref --symbolic-full-name '@{u}' >/dev/null 2>&1; then
+  ahead=$(git rev-list --count '@{u}..HEAD' 2>/dev/null || echo 0)
+  [ "$ahead" -eq 0 ] && exit 0      # nothing unpushed
+  push git push --quiet
+  echo "[auto-push] pushed $ahead commit(s) on '$branch'." >&2
+else
+  git rev-parse --verify --quiet HEAD >/dev/null 2>&1 || exit 0
+  push git push --quiet -u origin "$branch"
+  echo "[auto-push] set upstream and pushed '$branch' to origin." >&2
+fi
+exit 0

package/examples/aws-production-guard.sh

@@ -6,7 +6,19 @@
 #           aws rds delete-db-instance, aws cloudformation delete-stack
 #
 # TRIGGER: PreToolUse
-# MATCHER: "Bash"
+# MATCHER: "Bash|PowerShell"
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-aws-production-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [aws-production-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

package/examples/aws-region-guard.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 # aws-region-guard.sh — Warn when AWS commands target unexpected regions
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 echo "$COMMAND" | grep -qE '^\s*aws\s' || exit 0

package/examples/background-cost-launch-guard.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+# background-cost-launch-guard.sh — Block a *background* Bash launch that can
+#                                   incur ongoing API/compute cost and would
+#                                   keep running after the model says "Done".
+#
+# Solves (#68642): Claude Code launched a batch API script with
+# run_in_background=true, announced completion ("Done."), and the user walked
+# away — but three processes kept hammering the API for 6+ hours, racking up
+# several hundred USD. The model signaled completion WITHOUT confirming the
+# background processes had exited. A foreground run would have blocked (and been
+# visible); a background run is fire-and-forget and silent.
+#
+# Why existing guards miss this exact shape:
+#   - timeout-guard.sh nudges you TO use run_in_background for forever-servers —
+#     the opposite direction; it never inspects the cost of a bg launch.
+#   - dangling-process-guard.sh is a Stop hook that lists leftover `&`/`nohup`
+#     processes; it does not read the Bash tool's `run_in_background` parameter
+#     and only fires at session end, after the money is already spent.
+#   - api-busyloop-guard.sh fires on no-op-body busy-poll loops; a batch API
+#     script is not a busy-poll, so it never trips.
+#
+# What this does: on PreToolUse for Bash, if run_in_background is true AND the
+# command matches a cost-incurring signature (LLM API endpoints/SDKs, `claude -p`
+# headless runs, or a loop that calls curl/python against an API), it BLOCKS
+# (exit 2) and tells the model to (a) run it in the FOREGROUND so completion is
+# actually observed, or (b) add an explicit budget/turn cap and a hard timeout.
+# Background launches with no cost signature (dev servers, log tails) pass.
+#
+# TRIGGER: PreToolUse   MATCHER: "Bash"
+# settings.json:
+# { "hooks": { "PreToolUse": [{ "matcher": "Bash",
+#   "hooks": [{ "type": "command",
+#     "command": "~/.claude/hooks/background-cost-launch-guard.sh" }] }] } }
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-background-cost-launch-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [background-cost-launch-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+
+# Only act on background launches. Claude Code exposes run_in_background as a
+# top-level field of the Bash tool input.
+BG=$(printf '%s' "$INPUT" | jq -r '.tool_input.run_in_background // false' 2>/dev/null)
+[[ "$BG" != "true" ]] && exit 0
+
+CMD=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[[ -z "$CMD" ]] && exit 0
+
+# Cost-incurring signatures. Kept deliberately specific so ordinary background
+# work (servers, builds, log tails) is never blocked.
+COST_RE='api\.anthropic\.com|api\.openai\.com|generativelanguage\.googleapis\.com|/v1/(messages|complete|chat/completions|batches)|anthropic|openai|litellm|(^|[^a-z])claude[[:space:]]+-p([[:space:]]|$)|--print|messages\.batches|batch'
+LOOP_RE='(while|until|for)[[:space:]].*(curl|wget|python|node|claude|gh[[:space:]]+api)'
+
+if printf '%s' "$CMD" | grep -qiE "$COST_RE" || printf '%s' "$CMD" | grep -qiE "$LOOP_RE"; then
+    {
+        echo "BLOCKED: background launch that can incur ongoing API/compute cost."
+        echo ""
+        echo "This Bash call sets run_in_background=true on a command that looks"
+        echo "like it spends money or loops over an API. A background launch is"
+        echo "fire-and-forget: the session can report \"Done\" while it keeps"
+        echo "running for hours (see anthropics/claude-code#68642 — several"
+        echo "hundred USD burned this exact way)."
+        echo ""
+        echo "Do one of:"
+        echo "  1) Run it in the FOREGROUND (run_in_background=false) so its exit"
+        echo "     is actually observed before any completion is claimed; or"
+        echo "  2) Bound it: add a hard timeout and an explicit budget/turn cap"
+        echo "     (e.g. 'timeout 600 ...', a max-iteration counter), then verify"
+        echo "     the process has exited before moving on."
+    } >&2
+    exit 2
+fi
+
+exit 0