cc-safe-setup 29.8.0 → 30.0.5

package/examples/false-disk-full-guard.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+# false-disk-full-guard.sh — flag the #65880 false "temp filesystem is full" / ENOSPC report
+#
+# Why: Claude Code's Bash tool substitutes
+#        "Command output was lost: the temp filesystem at <dir> is full (0MB free).
+#         The child process's stdout/stderr writes failed with ENOSPC."
+#      into stdout for ANY command with empty stdout AND a non-zero exit code — e.g.
+#      `false`, a no-match `grep`, a failed `test -e`, `cmd 2>/dev/null` that exits
+#      non-zero — even when the filesystem has terabytes free (anthropics/claude-code
+#      #65880, reproduced on 2.1.150-2.1.160).
+#
+#      The danger is not cosmetic: the fabricated string is presented to the model AS
+#      the command's output, so the model can conclude the disk is full and run
+#      destructive cleanup (rm, git prune, docker prune) to "free space" that was never
+#      occupied. This hook verifies the claim against real `df` and, when the disk
+#      actually has room, tells the model it is the false-positive so it does NOT act
+#      destructively.
+#
+# Event: PostToolUse   MATCHER: "*"
+# Action: advisory only (stderr), never blocks, fails open.
+#
+# The registration was missing from this header. The installer reads TRIGGER
+# and MATCHER from here and falls back to PreToolUse / Bash when both are
+# absent, so this hook was being registered at a moment where the field it
+# reads is always empty: it installed, it appeared in the settings, and it
+# did nothing. Measured 2026-08-04 across examples/: 14 files were like this.
+# TRIGGER: PostToolUse
+# MATCHER: ""
+
+set -u
+
+IN=$(cat)
+
+# tool_response may be a plain string or an object; try the common shapes.
+RESP=$(printf '%s' "$IN" | jq -r '
+  if (.tool_response | type) == "string" then .tool_response
+  else (.tool_response.stdout // .tool_response.stderr // .tool_response.output // .tool_response.content // .tool_result // empty)
+  end' 2>/dev/null)
+# Fallback: scan the whole payload if structured extraction found nothing.
+[ -z "$RESP" ] && RESP="$IN"
+
+# Signature of the #65880 fabricated report.
+printf '%s' "$RESP" | grep -qiE 'temp filesystem at .* is full \(0+ ?MB free\)|writes failed with ENOSPC' || exit 0
+
+# Which directory did the message blame? Fall back to TMPDIR / /tmp.
+DIR=$(printf '%s' "$RESP" | grep -oE 'temp filesystem at [^ ]+' | head -1 | sed 's/^temp filesystem at //')
+[ -z "$DIR" ] && DIR="${TMPDIR:-/tmp}"
+# The named session dir may already be gone; climb to an existing ancestor.
+while [ -n "$DIR" ] && [ "$DIR" != "/" ] && [ ! -d "$DIR" ]; do DIR=$(dirname "$DIR"); done
+
+AVAIL_KB=$(df -Pk "$DIR" 2>/dev/null | awk 'NR==2{print $4}')
+# Can't verify → fail open, stay silent (don't second-guess a possibly-real ENOSPC).
+case "$AVAIL_KB" in ''|*[!0-9]*) exit 0;; esac
+
+# Only contradict the message when the disk genuinely has room (>100 MB).
+if [ "$AVAIL_KB" -gt 102400 ]; then
+  AVAIL_H=$(df -Ph "$DIR" 2>/dev/null | awk 'NR==2{print $4}')
+  echo "⚠ false-disk-full-guard: the 'temp filesystem is full / ENOSPC' message above is very likely the #65880 false-positive, NOT a real disk-full." >&2
+  echo "  Verified free space on ${DIR}: ${AVAIL_H:-plenty}. Claude Code substitutes that message for ANY empty-stdout + non-zero-exit command (a no-match grep, a failed test, \`false\`)." >&2
+  echo "  Do NOT run rm / prune / cleanup to 'free space' — the disk is fine. The real result was: empty output, non-zero exit. Re-run as '<cmd>; echo \"[exit \$?]\"' to recover the true exit code." >&2
+fi
+
+exit 0

package/examples/feature-deprecation-detector.sh

@@ -0,0 +1,109 @@
+#!/bin/sh
+# feature-deprecation-detector.sh — Detect Claude Code feature deprecations from tool output.
+#
+# Background:
+#   On 2026-04-09 the `/buddy` companion was removed in v2.1.97 without changelog mention.
+#   Issue #45596 ("Bring Back Buddy") accumulated 1,987 reactions, the second-largest
+#   single feature request in anthropics/claude-code history. The structural failure pattern:
+#   silent removal, no opt-in deprecation, no migration guidance.
+#
+#   This hook detects when a previously-working slash command, skill, or capability
+#   suddenly returns "Unknown skill: X" or similar deprecation signals, and surfaces
+#   the deprecation context to the operator before they spend time troubleshooting
+#   what is actually a removed feature.
+#
+# Trigger: PostToolUse (advisory, exit 0)
+# Detection axes:
+#   1. "Unknown skill: <name>" pattern in tool output → likely deprecated slash command
+#   2. "Command not found: /<name>" pattern → likely removed CLI command
+#   3. "Skill <name> is deprecated" pattern → explicit deprecation notice
+#   4. "This feature has been removed" pattern → explicit removal notice
+#
+# When detected, the hook outputs a NOTICE pointing to:
+#   - The Claude Code release notes (where deprecations should be documented)
+#   - The cc-safe-setup cluster tracker (community-tracked deprecation patterns)
+#   - The relevant GitHub issue cluster if known (e.g. #45596 for /buddy)
+#
+# Environment variables:
+#   CC_DEPRECATION_QUIET=1  → suppress all output (default 0)
+#   CC_DEPRECATION_KNOWN_REMOVALS=/path → custom known-removal list (one slash command per line)
+
+set -eu
+
+INPUT=$(cat)
+
+# Extract tool output (stderr or stdout). PostToolUse provides tool_response.output.
+TOOL_OUTPUT=$(printf '%s' "$INPUT" | jq -r '.tool_response.output // .tool_response.content // empty' 2>/dev/null || true)
+[ -z "$TOOL_OUTPUT" ] && exit 0
+
+# Skip if quiet mode requested
+QUIET="${CC_DEPRECATION_QUIET:-0}"
+if [ "$QUIET" = "1" ]; then
+    exit 0
+fi
+
+# Built-in known removals (slash commands or features that have been silently removed)
+# Format: "command|release|context|reference"
+KNOWN_REMOVALS_BUILTIN='
+/buddy|v2.1.97 (2026-04-09)|Companion feature removed without changelog mention|https://github.com/anthropics/claude-code/issues/45596
+'
+
+# Allow custom known-removal list via environment
+CUSTOM_LIST="${CC_DEPRECATION_KNOWN_REMOVALS:-}"
+if [ -n "$CUSTOM_LIST" ] && [ -f "$CUSTOM_LIST" ]; then
+    KNOWN_REMOVALS_BUILTIN="${KNOWN_REMOVALS_BUILTIN}$(printf '\n')$(cat "$CUSTOM_LIST")"
+fi
+
+# Detection axis 1: "Unknown skill: X" → check against known removals
+detected_command=""
+detected_context=""
+detected_reference=""
+
+# Pattern 1: Unknown skill / Unknown command
+if printf '%s' "$TOOL_OUTPUT" | grep -qE 'Unknown skill:|Unknown command:|Command not found:'; then
+    # Extract the command name
+    skill_name=$(printf '%s' "$TOOL_OUTPUT" | grep -oE '(Unknown skill: [a-zA-Z0-9_-]+|Unknown command: /[a-zA-Z0-9_-]+|Command not found: /[a-zA-Z0-9_-]+)' | head -1 | sed -E 's/.*[: /]//')
+
+    if [ -n "$skill_name" ]; then
+        # Check known removals
+        cmd_key="/${skill_name}"
+        line=$(printf '%s' "$KNOWN_REMOVALS_BUILTIN" | grep -F "${cmd_key}|" | head -1)
+        if [ -n "$line" ]; then
+            detected_command="$cmd_key"
+            detected_context=$(printf '%s' "$line" | cut -d'|' -f3)
+            detected_reference=$(printf '%s' "$line" | cut -d'|' -f4)
+            release_info=$(printf '%s' "$line" | cut -d'|' -f2)
+
+            cat >&2 <<EOF
+NOTICE: \`${detected_command}\` appears to have been removed from Claude Code.
+  Release: ${release_info}
+  Context: ${detected_context}
+  Reference: ${detected_reference}
+  Cluster tracking: https://github.com/yurukusa/cc-safe-setup (deprecation pattern monitoring)
+EOF
+            exit 0
+        fi
+
+        # Unknown command but not in known list — still surface it as a possible deprecation
+        cat >&2 <<EOF
+NOTICE: Skill or command \`${skill_name}\` not recognized.
+  If this previously worked, it may have been deprecated without changelog notice.
+  Check release notes: https://docs.anthropic.com/en/release-notes/claude-code
+  Report or check existing reports: https://github.com/anthropics/claude-code/issues?q=${skill_name}
+EOF
+        exit 0
+    fi
+fi
+
+# Pattern 2: Explicit deprecation notice
+if printf '%s' "$TOOL_OUTPUT" | grep -qiE 'is deprecated|has been deprecated|has been removed|feature has been removed'; then
+    matched_line=$(printf '%s' "$TOOL_OUTPUT" | grep -iE 'is deprecated|has been deprecated|has been removed|feature has been removed' | head -1)
+    cat >&2 <<EOF
+NOTICE: Deprecation signal detected in tool output:
+  > ${matched_line}
+  Check release notes for migration guidance: https://docs.anthropic.com/en/release-notes/claude-code
+EOF
+    exit 0
+fi
+
+exit 0

package/examples/file-change-tracker.sh

@@ -24,7 +24,7 @@
 #
 # View changes: cat ~/.claude/session-changes.log
 #
-# TRIGGER: PreToolUse  MATCHER: "Edit|Write"
+# TRIGGER: PostToolUse  MATCHER: "Write"
 
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)

package/examples/file-edit-backup.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
-# file-edit-backup.sh — Auto-backup files before Edit/Write overwrites them
+# file-edit-backup.sh — Auto-backup files before they are overwritten
 #
 # Solves: Claude Code overwrites important files and the changes are hard
-#         to reverse. This creates a timestamped backup before each edit,
+#         to reverse. This creates a timestamped backup before each write,
 #         so you can always recover the previous version.
 #
 # Real incidents:
@@ -13,26 +13,75 @@
 # Backups go to ~/.claude/file-backups/ with timestamps.
 # Old backups (>7 days) are auto-cleaned to prevent disk bloat.
 #
-# TRIGGER: PreToolUse  MATCHER: "Edit|Write"
+# Covers BOTH paths by which a file gets overwritten:
+#   1. The Edit / Write tools       -> tool_input.file_path
+#   2. Shell commands run via Bash  -> redirection (> >>), tee, mv
+#
+# Path 2 was reported by a reader (2026-07-17) as the biggest hole in this
+# hook: an agent writing through Bash has the same destructive power as
+# Write, but used to slip past this backup entirely. Extraction below is
+# deliberately generous — a spurious backup costs one file copy, a missed
+# one costs the file.
+#
+# TRIGGER: PreToolUse  MATCHER: "Edit|Write|Bash"
 
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
-FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
-
-[ -z "$FILE" ] && exit 0
-[ ! -f "$FILE" ] && exit 0  # New file, nothing to backup
 
 BACKUP_DIR="$HOME/.claude/file-backups"
-mkdir -p "$BACKUP_DIR"
 
-# Create backup with timestamp
-TIMESTAMP=$(date +%Y%m%d-%H%M%S)
-SAFE_NAME=$(echo "$FILE" | tr '/' '_' | sed 's/^_//')
-BACKUP_PATH="${BACKUP_DIR}/${SAFE_NAME}.${TIMESTAMP}"
+backup_one() {
+    local target="$1"
+    [ -z "$target" ] && return 0
+    # Strip quotes left over from the command line
+    target="${target%\"}"; target="${target#\"}"
+    target="${target%\'}"; target="${target#\'}"
+    case "$target" in
+        /dev/*|/proc/*|/sys/*) return 0 ;;   # not real files
+        "~"/*) target="$HOME/${target#\~/}" ;;
+    esac
+    [ ! -f "$target" ] && return 0           # new file, nothing to lose
+    [ -L "$target" ] && return 0             # don't follow symlinks
+    mkdir -p "$BACKUP_DIR" 2>/dev/null
+    local stamp safe
+    stamp=$(date +%Y%m%d-%H%M%S)
+    safe=$(printf '%s' "$target" | tr '/' '_' | sed 's/^_//')
+    # `--` matters: an extracted path starting with "-" would otherwise be
+    # read by cp as an option (e.g. a file literally named "-r").
+    cp -- "$target" "${BACKUP_DIR}/${safe}.${stamp}" 2>/dev/null
+}
+
+if [ "$TOOL" = "Bash" ]; then
+    COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+    [ -z "$COMMAND" ] && exit 0
+
+    # 1. Redirection: > file and >> file.
+    #    The [^&] guard keeps ">&2" and "2>&1" from being read as filenames.
+    while read -r hit; do
+        [ -n "$hit" ] && backup_one "$hit"
+    done < <(printf '%s' "$COMMAND" \
+        | grep -oE '>>?[[:space:]]*[^&|;[:space:]]+' \
+        | sed -E 's/^>>?[[:space:]]*//')
+
+    # 2. tee (with or without -a) — the operand is a destination
+    while read -r hit; do
+        [ -n "$hit" ] && backup_one "$hit"
+    done < <(printf '%s' "$COMMAND" \
+        | grep -oE '\btee[[:space:]]+(-a[[:space:]]+)?[^|;&[:space:]]+' \
+        | sed -E 's/^tee[[:space:]]+(-a[[:space:]]+)?//')
 
-cp "$FILE" "$BACKUP_PATH" 2>/dev/null
+    # 3. mv — the destination is overwritten silently when it already exists
+    while read -r hit; do
+        [ -n "$hit" ] && backup_one "$hit"
+    done < <(printf '%s' "$COMMAND" \
+        | grep -oE '\bmv[[:space:]]+(-[a-zA-Z]+[[:space:]]+)*[^|;&[:space:]]+[[:space:]]+[^|;&[:space:]]+' \
+        | awk '{print $NF}')
+else
+    FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+    backup_one "$FILE"
+fi
 
 # Clean old backups (>7 days)
-find "$BACKUP_DIR" -type f -mtime +7 -delete 2>/dev/null
+[ -d "$BACKUP_DIR" ] && find "$BACKUP_DIR" -type f -mtime +7 -delete 2>/dev/null
 
 exit 0

package/examples/file-size-limit.sh

@@ -1,6 +1,18 @@
 #!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-file-size-limit-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [file-size-limit]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 CONTENT=$(echo "$INPUT" | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)

package/examples/financial-operation-guard.sh

@@ -15,6 +15,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-financial-operation-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [financial-operation-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$CMD" ] && exit 0

package/examples/firewall-guard.sh

@@ -19,6 +19,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-firewall-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [firewall-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/fish-shell-wrapper.sh

@@ -11,6 +11,29 @@
 # MATCHER: "Bash"
 #
 # See: https://github.com/anthropics/claude-code/issues/7490
+#
+# Fixed 2026-08-03. This hook returned `permissionDecision: "allow"` on every
+# command it wrapped — which is nearly every command, since the skip list held
+# ten builtins. The approval was never a judgement about the command. It was the
+# carrier for `updatedInput`, and the rewrite came with a signature attached.
+#
+# Measured against the shipped copy, over 20 destructive or credential-reading
+# commands with no separator in them at all: **18 were approved**, including
+# `sudo rm -rf`, `dd if=/dev/zero of=/dev/sda`, `mkfs.ext4`, `curl … | sh` and
+# `git push --force`. This is a different defect from the first-command-position
+# one fixed in #937/#940/#941/#942/#943/#947 — nothing here was being missed
+# past a separator. The hook simply approved whatever it wrapped.
+#
+# Now the approval and the rewrite are separated:
+#   - the command is rewritten for fish either way, because that is the job
+#   - `permissionDecision: "allow"` is emitted only when every command position
+#     qualifies on its own
+#
+# Whether `updatedInput` alone (with no decision) is honoured is not documented,
+# and is deliberately not relied on here: if it is, an unqualified command gets
+# wrapped and still goes through the normal permission prompt; if it is not, the
+# command is not wrapped and goes through the normal permission prompt. Both
+# branches end at the prompt, which is the point.
 # ================================================================
 
 INPUT=$(cat)
@@ -23,15 +46,110 @@ echo "$COMMAND" | grep -q '^fish -c' && exit 0
 # Skip simple builtins that work identically in any shell
 echo "$COMMAND" | grep -qE '^\s*(cd|echo|cat|ls|pwd|true|false|test|mkdir|touch|rm|cp|mv)\b' && exit 0
 
+# ---------------------------------------------------------------- qualifying
+# Command words that carry no destructive form of their own. `git` and the
+# interpreters are handled below, because for those the word says nothing.
+cc_base_ok() {
+    case "$1" in
+        cat|head|tail|less|more|wc|file|stat|du|df|ls|tree|\
+        which|whereis|type|realpath|readlink|basename|dirname|\
+        grep|rg|ag|ack|sort|uniq|tr|cut|column|nl|rev|\
+        echo|printf|true|false|pwd|date|uname|hostname|whoami|id|\
+        jq|yq|cd|\
+        tsc|eslint|prettier|jest|vitest|pytest)
+            return 0 ;;
+    esac
+    return 1
+}
+
+cc_segment_base() {
+    printf '%s' "$1" \
+        | sed -E 's/^[[:space:]]+//; s/^([A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*[[:space:]]+)*//' \
+        | awk '{print $1}' \
+        | sed 's|.*/||'
+}
+
+# Build tool subcommands that neither destroy history nor run fetched code.
+# One line on purpose: inside single quotes a trailing backslash is a literal
+# backslash-newline, not a continuation, and the pattern silently stops matching.
+CC_SUBCMD_RE='^[[:space:]]*(git[[:space:]]+(status|log|diff|show|add|commit|branch|remote|describe|rev-parse|blame|shortlog|ls-files|ls-tree|fetch|stash[[:space:]]+(list|push|save))|npm[[:space:]]+(test|run|ci|ls|view|outdated)|yarn[[:space:]]+(test|run|info|why)|pnpm[[:space:]]+(test|run|list|why)|bun[[:space:]]+(test|run)|cargo[[:space:]]+(build|test|check|fmt|clippy|tree)|go[[:space:]]+(build|test|vet|fmt|list)|docker[[:space:]]+(ps|images|logs|inspect|version|info)|make[[:space:]]+[A-Za-z0-9_.-]+|pip[[:space:]]+(list|show|freeze)|python3[[:space:]]+-m[[:space:]]+(pytest|unittest|pip[[:space:]]+(list|show|freeze)))([[:space:]]|$)'
+
+# `git branch` reads; `git branch -D main` deletes one. Same first two words.
+CC_GIT_DESTRUCTIVE_RE='^[[:space:]]*git[[:space:]]+(branch|tag)[[:space:]]+-([dDmM]|-delete|-move)([[:space:]]|$)'
+
+cc_segment_ok() {
+    local seg="$1" base
+    base=$(cc_segment_base "$seg")
+    [ -z "$base" ] && return 1
+
+    # find reads only while no predicate acts on what it finds
+    if [ "$base" = "find" ]; then
+        printf '%s' "$seg" \
+            | grep -qE '(^|[[:space:]])-(delete|exec|execdir|ok|okdir|fprintf?|fls|fprint0)([[:space:]]|$)' \
+            && return 1
+        return 0
+    fi
+
+    # sed rewrites the file in place with -i
+    if [ "$base" = "sed" ]; then
+        printf '%s' "$seg" | grep -qE '(^|[[:space:]])-[a-zA-Z]*i' && return 1
+        return 0
+    fi
+    [ "$base" = "awk" ] && return 0
+
+    cc_base_ok "$base" && return 0
+
+    printf '%s' "$seg" | grep -qE "$CC_GIT_DESTRUCTIVE_RE" && return 1
+    printf '%s' "$seg" | grep -qE "$CC_SUBCMD_RE" && return 0
+
+    return 1
+}
+
+QUALIFIES=1
+
+# A substitution or a backtick carries a command no string-level read can see.
+case "$COMMAND" in
+    *'$('*|*'`'*) QUALIFIES=0 ;;
+esac
+# A redirection writes.
+case "$COMMAND" in
+    *'>'*) QUALIFIES=0 ;;
+esac
+
+if [ "$QUALIFIES" -eq 1 ]; then
+    IDX=0
+    while IFS= read -r SEG; do
+        SEG="${SEG#"${SEG%%[![:space:]]*}"}"
+        SEG="${SEG%"${SEG##*[![:space:]]}"}"
+        [ -z "$SEG" ] && continue
+        if ! cc_segment_ok "$SEG"; then QUALIFIES=0; break; fi
+        IDX=$((IDX + 1))
+    done <<EOF
+$(printf '%s' "$COMMAND" | tr ';&|' '\n\n\n')
+EOF
+    [ "$IDX" -eq 0 ] && QUALIFIES=0
+fi
+
+# ---------------------------------------------------------------- rewrite
 # Escape single quotes for fish -c '...'
 ESCAPED=$(printf '%s' "$COMMAND" | sed "s/'/'\\\\''/g")
 
-jq -n --arg cmd "fish -c '$ESCAPED'" '{
-  hookSpecificOutput: {
-    hookEventName: "PreToolUse",
-    permissionDecision: "allow",
-    updatedInput: { command: $cmd }
-  }
-}'
+if [ "$QUALIFIES" -eq 1 ]; then
+    jq -n --arg cmd "fish -c '$ESCAPED'" '{
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "allow",
+        updatedInput: { command: $cmd }
+      }
+    }'
+else
+    # rewrite without signing off on it
+    jq -n --arg cmd "fish -c '$ESCAPED'" '{
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        updatedInput: { command: $cmd }
+      }
+    }'
+fi
 
 exit 0

package/examples/five-hundred-milestone.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: Notification  MATCHER: ""
 INPUT=$(cat)

package/examples/flask-static-route-guard.sh

@@ -0,0 +1,89 @@
+#!/bin/bash
+# ================================================================
+# flask-static-route-guard.sh — Warn when a catch-all static
+# route would expose .env / .git / source / db files to the web
+#
+# Solves: Claude routinely recommends a Flask catch-all static
+# route that serves the application's own directory, so anyone can
+# request /.env, /.git/config, /app.py, /data.db over the public
+# web and receive secrets, source, and databases. Reported in
+# anthropics/claude-code#65517.
+#
+# The dangerous shape (all three together):
+#   1. a catch-all route capturing an arbitrary path  (<path:...>)
+#   2. a send_from_directory()/send_file() call
+#   3. serving from the app/module dir or cwd  (dirname(__file__),
+#      os.getcwd(), '.') with no static-subdir scoping and no
+#      dotfile guard
+#
+# This is a WARNING, not a block — Claude can still write the code,
+# but the operator (and Claude) see the exposure and the fix before
+# it ships. Heuristic by design; it stays quiet when a mitigation
+# (a dedicated static/ subdir, secure_filename, or an explicit
+# dotfile/.env rejection) is present.
+#
+# Usage: Add to settings.json as a PreToolUse hook
+#
+# {
+#   "hooks": {
+#     "PreToolUse": [{
+#       "matcher": "Edit|Write",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/flask-static-route-guard.sh" }]
+#     }]
+#   }
+# }
+# ================================================================
+#
+# TRIGGER: PreToolUse  MATCHER: "Edit|Write"
+
+INPUT=$(cat)
+
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+case "$TOOL" in
+  Write|Edit|MultiEdit) ;;
+  *) exit 0 ;;
+esac
+
+FILE=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+# Only Python files can host a Flask route. Skip anything else.
+case "$FILE" in
+  *.py) ;;
+  "" ) ;;          # some Edit payloads omit file_path; still scan content
+  *) exit 0 ;;
+esac
+
+# Content of the write: Write uses .content, Edit uses .new_string.
+CONTENT=$(printf '%s' "$INPUT" | jq -r '.tool_input.content // .tool_input.new_string // empty' 2>/dev/null)
+[[ -z "$CONTENT" ]] && exit 0
+
+# 1. catch-all path capture (Flask's <path:...> converter)
+echo "$CONTENT" | grep -qE '<path:[A-Za-z_][A-Za-z0-9_]*>' || exit 0
+
+# 2. a file-serving call
+echo "$CONTENT" | grep -qE 'send_from_directory\(|send_file\(' || exit 0
+
+# 3. served base is the app dir or cwd (the exposure), not a scoped subdir
+echo "$CONTENT" | grep -qE "dirname\(__file__\)|abspath\(__file__\)|os\.getcwd\(\)|send_from_directory\([[:space:]]*['\"]\.?['\"]" || exit 0
+
+# Suppress when a clear mitigation is present:
+#  - serving from a dedicated static/templates/public/assets subdir
+#  - secure_filename() sanitisation
+#  - an explicit rejection of dotfiles / .env
+if echo "$CONTENT" | grep -qE "secure_filename\(|send_from_directory\(.*['\"](static|templates|public|assets|dist|build)['\"]|os\.path\.join\(.*['\"](static|templates|public|assets|dist|build)['\"]"; then
+  exit 0
+fi
+if echo "$CONTENT" | grep -qE "startswith\(['\"]\.['\"]\)|['\"]\.env['\"]|['\"]\.git['\"]|\babort\(40[34]\)" ; then
+  # The code already reasons about dotfiles / blocks paths — assume guarded.
+  exit 0
+fi
+
+echo "WARNING: This Flask catch-all route serves the app's own directory to the web." >&2
+echo "Anyone can request /.env, /.git/config, /*.py, or /*.db and receive secrets," >&2
+echo "source code, and databases (anthropics/claude-code#65517)." >&2
+echo "Fix: serve only a dedicated subdirectory and reject dotfiles, e.g." >&2
+echo "  STATIC_DIR = os.path.join(os.path.dirname(__file__), 'static')" >&2
+echo "  if not path or path.startswith('.') or '..' in path: abort(404)" >&2
+echo "  return send_from_directory(STATIC_DIR, path)" >&2
+echo "Never serve the directory that contains .env, .git, or source files." >&2
+
+exit 0