cc-safe-setup 29.8.0 → 30.0.5

package/examples/git-pack-temp-cleanup-guard.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# ================================================================
+# git-pack-temp-cleanup-guard.sh — Stop tmp_pack_* explosion
+# ================================================================
+# PURPOSE:
+#   Subagents and parallel git operations leave stale
+#   .git/objects/pack/tmp_pack_* files behind when git gc / repack
+#   fails or is interrupted. These accumulate without bound and can
+#   fill ext4.vhdx (observed: 1,350 files / 144 GB on a single repo).
+#
+#   This hook runs before any git command. It removes tmp_pack_*
+#   files older than CC_GIT_PACK_AGE_MIN minutes, then checks the
+#   remaining total. Above thresholds, it warns or blocks.
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+#
+# CONFIG:
+#   CC_GIT_PACK_AGE_MIN=60         minutes; older tmp_pack_* are removed
+#   CC_GIT_PACK_WARN_GB=1          warn at this many GiB remaining
+#   CC_GIT_PACK_STRONG_GB=5        strong warning at this many GiB
+#   CC_GIT_PACK_BLOCK_GB=10        block git command at this many GiB
+#   CC_GIT_PACK_DISABLE=1          set to disable this hook entirely
+# ================================================================
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-pack-temp-cleanup-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-pack-temp-cleanup-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_GIT_PACK_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# Only act on git commands. \bgit\b matches git as a whole word, so
+# pathnames like /usr/bin/gitlab won't trigger.
+echo "$COMMAND" | grep -qE '(^|[^a-zA-Z0-9._-])git([^a-zA-Z0-9._-]|$)' || exit 0
+
+AGE_MIN="${CC_GIT_PACK_AGE_MIN:-60}"
+WARN_GB="${CC_GIT_PACK_WARN_GB:-1}"
+STRONG_GB="${CC_GIT_PACK_STRONG_GB:-5}"
+BLOCK_GB="${CC_GIT_PACK_BLOCK_GB:-10}"
+
+# Resolve the .git directory of the current repo. If we are outside a
+# git repo, exit silently — the user's git command will fail on its own.
+GIT_DIR=$(git rev-parse --git-dir 2>/dev/null) || exit 0
+PACK_DIR="$GIT_DIR/objects/pack"
+
+[ -d "$PACK_DIR" ] || exit 0
+
+# Step 1: remove tmp_pack_* older than AGE_MIN minutes.
+# Use -maxdepth 1 so we never recurse. Only match the literal prefix.
+removed_count=0
+removed_bytes=0
+while IFS= read -r -d '' f; do
+    sz=$(stat -c '%s' "$f" 2>/dev/null || echo 0)
+    if rm -f "$f" 2>/dev/null; then
+        removed_count=$((removed_count + 1))
+        removed_bytes=$((removed_bytes + sz))
+    fi
+done < <(find "$PACK_DIR" -maxdepth 1 -type f -name 'tmp_pack_*' -mmin "+$AGE_MIN" -print0 2>/dev/null)
+
+if [ "$removed_count" -gt 0 ]; then
+    removed_mib=$((removed_bytes / 1024 / 1024))
+    echo "INFO: git-pack-temp-cleanup-guard removed $removed_count stale tmp_pack_* files (${removed_mib} MiB) older than ${AGE_MIN} min in $PACK_DIR" >&2
+fi
+
+# Step 2: compute remaining total size of tmp_pack_*.
+remaining_bytes=0
+while IFS= read -r -d '' f; do
+    sz=$(stat -c '%s' "$f" 2>/dev/null || echo 0)
+    remaining_bytes=$((remaining_bytes + sz))
+done < <(find "$PACK_DIR" -maxdepth 1 -type f -name 'tmp_pack_*' -print0 2>/dev/null)
+
+remaining_gb=$((remaining_bytes / 1024 / 1024 / 1024))
+
+if [ "$remaining_gb" -ge "$BLOCK_GB" ]; then
+    echo "BLOCKED: tmp_pack_* total is ${remaining_gb} GiB in $PACK_DIR (threshold ${BLOCK_GB} GiB)." >&2
+    echo "  Past incidents accumulated 144 GiB and filled ext4.vhdx." >&2
+    echo "  Investigate before running more git commands. Inspect with:" >&2
+    echo "    find \"$PACK_DIR\" -maxdepth 1 -name 'tmp_pack_*' -printf '%s %p\\n'" >&2
+    echo "  Override (one shot) with: CC_GIT_PACK_DISABLE=1 git ..." >&2
+    exit 2
+fi
+
+if [ "$remaining_gb" -ge "$STRONG_GB" ]; then
+    echo "STRONG WARNING: tmp_pack_* total is ${remaining_gb} GiB in $PACK_DIR (strong threshold ${STRONG_GB} GiB)." >&2
+    echo "  Investigate parallel git activity before this grows further." >&2
+elif [ "$remaining_gb" -ge "$WARN_GB" ]; then
+    echo "WARNING: tmp_pack_* total is ${remaining_gb} GiB in $PACK_DIR (threshold ${WARN_GB} GiB)." >&2
+fi
+
+exit 0

package/examples/git-push-blast-radius-guard.sh

@@ -0,0 +1,218 @@
+#!/bin/bash
+# git-push-blast-radius-guard.sh — Cap a runaway fan-out of git pushes that burns CI minutes
+#
+# Solves: When a bug touches many open PRs, the agent can "fix each branch
+# individually" — cherry-pick the same change onto branch after branch and push
+# each one. Every push to a distinct branch triggers the full CI suite, so the
+# cost scales with the number of branches, not the size of the fix. In #65944 a
+# 1-line lint fix was pushed to 13 PR branches across 3 rounds (~150+ workflow
+# runs), exhausting the entire 2,000-minute monthly GitHub Actions allotment in
+# under 3 hours and tripping an account-level Actions block. The operator's own
+# root-cause note: the correct shape was "fix once on main, let PRs inherit it
+# via rebase — 1 CI run instead of 150+."
+#
+# Existing hooks miss this exact shape:
+#   - git-operations-require-approval.sh blocks *every* git push (all-or-nothing,
+#     off by default); it never counts how many distinct branches a session has
+#     pushed, so it can't tell a normal 1-branch push from a 13-branch fan-out.
+#   - same-command-repeat-detector.sh keys on the *same* command repeating; a
+#     fan-out pushes a *different* branch each time, so it never matches (the
+#     same blind spot loop-detector.sh had before webfetch-runaway-guard.sh).
+#   - tool-call-rate-limiter.sh counts *all* tool calls in a short window; pushes
+#     spread across hours slip under it and it cannot see "distinct branches."
+#   - parallel-batch-size-limiter.sh measures *concurrent* batches, not sequential
+#     pushes to many branches across rounds.
+#
+# This counts the SET of distinct branches pushed in a rolling per-session window
+# and, once that set crosses a threshold, surfaces the fix-on-main-then-rebase
+# pattern and (by default) blocks the next branch push — the confirmation the
+# operator wished for ("shouldn't push to more than 2-3 branches without
+# confirmation"). The block is recoverable: raise the threshold, switch to warn,
+# or set off. Re-pushing the *same* branch never inflates the count, so an
+# ordinary edit-push-edit-push loop on one feature branch is untouched; only a
+# genuine multi-branch fan-out trips it. `git push --all` / `--mirror` pushes
+# every local branch at once (maximum blast radius) and is treated as a trip
+# immediately.
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+# Config (all optional):
+#   CC_PUSH_BLAST_GUARD=block     block | warn | off
+#   CC_PUSH_BLAST_BLOCK=6         block once this many distinct branches fall in the window
+#   CC_PUSH_BLAST_WARN=3          warn (stderr, non-blocking) at this many
+#   CC_PUSH_BLAST_WINDOW=3600     rolling window in seconds (default 1 hour)
+#   CC_PUSH_BLAST_DIR             state dir (default: /tmp/cc-push-blast)
+# Related: https://github.com/anthropics/claude-code/issues/65944
+
+INPUT=$(cat)
+
+MODE="${CC_PUSH_BLAST_GUARD:-block}"
+[ "$MODE" = "off" ] && exit 0
+
+# Only act on Bash. Fail open on anything unexpected.
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ "$TOOL" != "Bash" ] && exit 0
+
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+# git accepts global options between `git` and the subcommand, so `git push`
+# as two adjacent words never sees `git -C <dir> push` - which is exactly how
+# an agent pushes to branch after branch without changing directory. Reported
+# in #1117. `git send-pack` is the plumbing form of the same operation.
+GIT_OPT='(-[cC][[:space:]]+[^[:space:]]+|--(git-dir|work-tree|namespace|exec-path|config-env|attr-source|super-prefix)(=[^[:space:]]+|[[:space:]]+[^[:space:]]+)|-[pP]|--(paginate|no-pager|bare|no-replace-objects|literal-pathspecs|glob-pathspecs|noglob-pathspecs|icase-pathspecs|no-optional-locks|no-lazy-fetch|no-advice))'
+GIT_HEAD='(^|[[:space:];&|(]|/|"|'"'"')git'
+GIT_PUSH_RE="${GIT_HEAD}([[:space:]]+${GIT_OPT})*[[:space:]]+(push|send-pack)\\b|${GIT_HEAD}-(push|send-pack)\\b"
+
+# Quick reject: nothing to do unless the command runs `git push` somewhere.
+printf '%s' "$COMMAND" | grep -qE "$GIT_PUSH_RE" || exit 0
+
+BLOCK_AT="${CC_PUSH_BLAST_BLOCK:-6}"
+WARN_AT="${CC_PUSH_BLAST_WARN:-3}"
+WINDOW="${CC_PUSH_BLAST_WINDOW:-3600}"
+case "$BLOCK_AT" in ''|*[!0-9]*) exit 0;; esac
+case "$WARN_AT" in ''|*[!0-9]*) exit 0;; esac
+case "$WINDOW" in ''|*[!0-9]*) exit 0;; esac
+
+# Key state per session so one session's work never trips another's guard.
+SID=$(printf '%s' "$INPUT" | jq -r '.session_id // "default"' 2>/dev/null)
+case "$SID" in ''|*[!A-Za-z0-9_-]*) SID="default";; esac
+
+# ---- Work out which branch(es) this command pushes to --------------------
+# A command may chain several segments (&&, ;, newline, |). Inspect each git
+# push segment and collect the branch name(s) it targets. Unknown/odd shapes
+# fail open (they simply contribute nothing rather than guessing wrong).
+FANOUT=0          # set when --all/--mirror pushes every branch at once
+declare -a BRANCHES=()
+
+# Split into segments on shell separators so each `git push ...` is seen alone.
+SEGMENTS=$(printf '%s' "$COMMAND" | tr '\n;|' '\n\n\n' | sed 's/&&/\n/g')
+
+while IFS= read -r seg; do
+    printf '%s' "$seg" | grep -qE "$GIT_PUSH_RE" || continue
+
+    # Tokens after the subcommand. The old `sed 's/.*\bgit[[:space:]]+push//'`
+    # stripped nothing when a global option sat between `git` and `push`, so the
+    # whole command ended up parsed as if it were the argument list (#1117).
+    # Walking the tokens has no such failure mode.
+    # shellcheck disable=SC2206
+    _all=( $seg )
+    after=""
+    _i=0
+    while [ "$_i" -lt "${#_all[@]}" ]; do
+        case "${_all[$_i]}" in
+            push|send-pack) after="${_all[*]:$((_i + 1))}"; break ;;
+        esac
+        _i=$((_i + 1))
+    done
+
+    # Whole-repo fan-out: one command, every branch, maximum CI blast radius.
+    if printf '%s' "$after" | grep -qE '(^|[[:space:]])(--all|--mirror)([[:space:]]|$)'; then
+        FANOUT=1
+        continue
+    fi
+    # shellcheck disable=SC2206
+    toks=( $after )
+
+    refspecs=()
+    seen_remote=0
+    i=0
+    while [ "$i" -lt "${#toks[@]}" ]; do
+        t="${toks[$i]}"
+        i=$((i + 1))
+        case "$t" in
+            # Flags that take a separate value -> skip the value too.
+            --repo|-o|--push-option|--receive-pack|--exec)
+                i=$((i + 1)); continue ;;
+            -*) continue ;;          # any other flag
+        esac
+        # First bare token is the remote (origin / upstream / a URL). After that,
+        # bare tokens are refspecs (branches).
+        if [ "$seen_remote" -eq 0 ]; then
+            seen_remote=1
+            continue
+        fi
+        refspecs+=("$t")
+    done
+
+    if [ "${#refspecs[@]}" -eq 0 ]; then
+        # `git push` / `git push origin` with no refspec -> current branch.
+        cur=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+        [ -n "$cur" ] && [ "$cur" != "HEAD" ] && BRANCHES+=("$cur")
+        continue
+    fi
+
+    for r in "${refspecs[@]}"; do
+        # Strip a leading '+' (force) and take the destination side of any colon.
+        r="${r#+}"
+        dst="${r##*:}"
+        # Ignore tag/ref deletions and empty sources.
+        [ -z "$dst" ] && continue
+        case "$dst" in
+            HEAD) cur=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+                  [ -n "$cur" ] && [ "$cur" != "HEAD" ] && BRANCHES+=("$cur"); continue ;;
+        esac
+        BRANCHES+=("$dst")
+    done
+done <<EOF
+$SEGMENTS
+EOF
+
+# Nothing identifiable and not a fan-out: fail open.
+if [ "$FANOUT" -eq 0 ] && [ "${#BRANCHES[@]}" -eq 0 ]; then
+    exit 0
+fi
+
+# ---- Record into the rolling per-session window --------------------------
+STATE_DIR="${CC_PUSH_BLAST_DIR:-/tmp/cc-push-blast}"
+mkdir -p "$STATE_DIR" 2>/dev/null || exit 0
+STATE="$STATE_DIR/$SID"
+
+NOW=$(date +%s)
+CUTOFF=$((NOW - WINDOW))
+
+# Append "<ts>\t<branch>" for every branch this command pushes.
+for b in "${BRANCHES[@]}"; do
+    # Sanitise tab/newline out of the branch name for the state file.
+    safe=$(printf '%s' "$b" | tr -d '\t\n')
+    [ -n "$safe" ] && printf '%s\t%s\n' "$NOW" "$safe" >> "$STATE" 2>/dev/null
+done
+
+# Prune entries older than the window.
+if [ -f "$STATE" ]; then
+    awk -F'\t' -v c="$CUTOFF" '$1 ~ /^[0-9]+$/ && $1 >= c' "$STATE" > "$STATE.tmp" 2>/dev/null && mv "$STATE.tmp" "$STATE" 2>/dev/null
+fi
+
+# Count DISTINCT branches inside the window.
+if [ -f "$STATE" ]; then
+    DISTINCT=$(awk -F'\t' '{print $2}' "$STATE" 2>/dev/null | sort -u | grep -c .)
+else
+    DISTINCT=0
+fi
+case "$DISTINCT" in ''|*[!0-9]*) DISTINCT=0;; esac
+
+# A whole-repo fan-out is an immediate trip regardless of the counter.
+TRIP=0
+[ "$FANOUT" -eq 1 ] && TRIP=1
+[ "$DISTINCT" -ge "$BLOCK_AT" ] && TRIP=1
+
+MINS=$((WINDOW / 60))
+if [ "$FANOUT" -eq 1 ]; then
+    SUBJECT="This 'git push --all/--mirror' pushes every local branch at once"
+else
+    SUBJECT="This makes ${DISTINCT} distinct branches pushed within ${MINS} min"
+fi
+MSG="${SUBJECT}. Each branch push triggers the full CI suite, so cost scales with branch count: in #65944 a 1-line fix pushed across 13 branches ran ~150+ workflow runs and burned the entire 2,000-minute monthly GitHub Actions allotment in under 3 hours. If you are applying one fix to many branches, stop and use the cheap shape instead: commit the fix once on main (or a single branch), merge it, and let the other branches inherit it via rebase/merge — 1 CI run instead of one per branch. To proceed anyway, raise CC_PUSH_BLAST_BLOCK, set CC_PUSH_BLAST_GUARD=warn to only warn, or =off to disable. State resets after ${WINDOW}s of no pushes: ${STATE}"
+
+if [ "$TRIP" -eq 1 ]; then
+    if [ "$MODE" = "warn" ]; then
+        echo "git-push-blast-radius-guard: $MSG" >&2
+        exit 0
+    fi
+    # block (default): structured decision so the model sees the reason.
+    jq -n --arg r "$MSG" '{decision: "block", reason: $r}'
+    exit 0
+elif [ "$DISTINCT" -ge "$WARN_AT" ]; then
+    echo "git-push-blast-radius-guard: ${DISTINCT} distinct branches pushed within ${MINS} min — each push triggers CI; consider fix-on-main + rebase if applying one change to many branches (#65944). Blocks at ${BLOCK_AT}." >&2
+fi
+
+exit 0

package/examples/git-remote-guard.sh

@@ -20,9 +20,30 @@ if echo "$COMMAND" | grep -qE '\bgit\s+remote\s+add\b'; then
     echo "Verify this is a trusted repository." >&2
 fi
 
-# Check for push to non-origin remote
-if echo "$COMMAND" | grep -qE '\bgit\s+push\s+(?!origin\b)\w'; then
-    REMOTE=$(echo "$COMMAND" | grep -oE 'git\s+push\s+(\S+)' | awk '{print $3}')
+# Check for push to a remote that is not origin.
+#
+# The previous version used `(?!origin\b)`, a lookahead that ERE does not have:
+# grep -E rejected the pattern, returned 2, and the `if` was never true. The
+# warning below could not fire on any input. Deciding "is it origin?" in the
+# shell instead of the pattern removes the need for a lookahead entirely.
+#
+# `git` also accepts global options before the subcommand, so `git -C <dir>
+# push upstream main` has to be matched as well (#1117).
+GIT_OPT='(-[cC][[:space:]]+[^[:space:]]+|--(git-dir|work-tree|namespace|exec-path|config-env|attr-source|super-prefix)(=[^[:space:]]+|[[:space:]]+[^[:space:]]+)|-[pP]|--(paginate|no-pager|bare|no-replace-objects|literal-pathspecs|glob-pathspecs|noglob-pathspecs|icase-pathspecs|no-optional-locks|no-lazy-fetch|no-advice))'
+GIT_HEAD='(^|[[:space:];&|(]|/|"|'"'"')git'
+GIT_PUSH_RE="${GIT_HEAD}([[:space:]]+${GIT_OPT})*[[:space:]]+push([[:space:]]|$)"
+
+if echo "$COMMAND" | grep -qE "$GIT_PUSH_RE"; then
+    # First bare word after `push` is the remote (flags and their values are
+    # skipped). No remote at all means the default one, which is fine.
+    REMOTE=$(echo "$COMMAND" | awk '{
+        for (i = 1; i <= NF; i++) {
+            if ($i == "push") { seen = 1; continue }
+            if (!seen) continue
+            if ($i ~ /^-/) { continue }
+            print $i; exit
+        }
+    }')
     if [ -n "$REMOTE" ] && [ "$REMOTE" != "origin" ]; then
         echo "WARNING: Pushing to non-origin remote: $REMOTE" >&2
         echo "Verify this remote is trusted." >&2

package/examples/git-rm-orphan-wipe-guard.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+# git-rm-orphan-wipe-guard.sh — Block whole-working-tree deletion via git
+#
+# Solves: Claude Code (or a careless one-liner it runs) wiping an entire
+#         working tree — and its recovery path — with git itself, slipping
+#         past the rm-based guards.
+#
+# The #70687 pattern (real loss of 3 years of work + .git history):
+#         git checkout --orphan wipe && git rm -rf . --quiet
+#   1. "git checkout --orphan" starts a branch with NO parent commit, so
+#      there is no prior commit to restore the files from afterwards.
+#   2. "git rm -rf ." then removes every tracked file from the index AND
+#      the working tree.
+#   Together the project is gone with no commit to recover from.
+#
+# Why existing guards miss it:
+#   - rm-safety-net.sh only fires on a command that STARTS with "rm"
+#     (^rm). "git rm ..." starts with "git", so it slips through.
+#   - git-checkout-safety-guard.sh Check 1 matches "checkout <letter>";
+#     "git checkout --orphan" starts with "-", so it is not matched.
+#   - bulk-file-delete-guard.sh only blocks "git rm -rf ." when the file
+#     count crosses its threshold, so a small-but-total wipe passes.
+#
+# Detects:
+#   git checkout --orphan <name>     (detaches from all history)
+#   git switch --orphan <name>       (same, newer syntax)
+#   git rm -r / -rf / --recursive    (recursive removal of the tree)
+#   git rm . / git rm *              (whole-tree target)
+#
+# Does NOT block (no on-disk data loss / normal use):
+#   git rm <file>                    (single tracked file)
+#   git rm --cached ...              (untracks only; disk files survive)
+#   git checkout <branch> / -- file  (covered by git-checkout-safety-guard)
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash"
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-rm-orphan-wipe-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-rm-orphan-wipe-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# === Check 1: git checkout/switch --orphan (removes the recovery path) ===
+if echo "$COMMAND" | grep -qE '\bgit\s+(checkout|switch)\b[^|;&]*--orphan\b'; then
+    echo "BLOCKED: git checkout --orphan starts a branch with no parent commit." >&2
+    echo "  Followed by 'git rm -rf .' this leaves no commit to recover from (#70687)." >&2
+    echo "  If you really need an orphan branch, run it yourself outside the agent." >&2
+    exit 2
+fi
+
+# === git rm handling: only the destructive (whole-tree) forms ===
+if echo "$COMMAND" | grep -qE '\bgit\s+rm\b'; then
+    # --cached removes from the index only; working-tree files survive. Safe.
+    if echo "$COMMAND" | grep -qE '\bgit\s+rm\b[^|;&]*--cached\b'; then
+        exit 0
+    fi
+
+    # Check 2: recursive removal (-r / -R / -rf / --recursive)
+    if echo "$COMMAND" | grep -qE '\bgit\s+rm\s+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)\b'; then
+        echo "BLOCKED: git rm -r removes every tracked file in the tree from disk." >&2
+        echo "  rm-safety-net does not catch this (the command starts with 'git', not 'rm')." >&2
+        echo "  Delete specific files by name, or use 'git rm --cached' to untrack only." >&2
+        exit 2
+    fi
+
+    # Check 3: whole-tree target ( . or * ) even without -r
+    if echo "$COMMAND" | grep -qE '\bgit\s+rm\b[^|;&]*(\s\.(\s|$)|\s\./(\s|$)|\s\*(\s|$))'; then
+        echo "BLOCKED: git rm targeting '.' or '*' removes the whole working tree." >&2
+        echo "  Delete specific files by name, or use 'git rm --cached' to untrack only." >&2
+        exit 2
+    fi
+fi
+
+exit 0

package/examples/git-stash-before-checkout.sh

@@ -28,6 +28,18 @@
 # }
 # ================================================================
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-stash-before-checkout-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-stash-before-checkout]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/git-submodule-guard.sh

@@ -1,9 +1,76 @@
 #!/bin/bash
+# ================================================================
+# git-submodule-guard.sh — Block the data-destroying variant of
+#                          `git submodule deinit` before it runs
+# ================================================================
+# PURPOSE:
+#   `git submodule deinit -f <path>` (or `--force`) removes the
+#   submodule's working tree. The -f / --force flag is exactly what
+#   makes git delete a submodule working tree that still has
+#   uncommitted or un-added changes. Without -f, git refuses when the
+#   submodule has local modifications — that built-in refusal is a
+#   safety net, and -f overrides it.
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+#
+# WHY THIS MATTERS:
+#   #68920 (2026-06) — asked to tidy up an unused submodule reference,
+#   Claude Code ran `git submodule deinit -f` followed by `git rm`,
+#   and the submodule's uncommitted edits and .gitignored config
+#   (editor settings, etc.) were deleted with no confirmation. This is
+#   a path that the usual rm -rf / reset --hard / clean -fd guards do
+#   NOT catch, because `deinit` does not look like a destructive
+#   command. Recovery is only partial: committed work is in the
+#   reflog and staged work survives in the index (restore with
+#   `git checkout-index`, not visible to `git fsck`), but edits that
+#   were never `git add`-ed are gone.
+#
+# WHAT IT DOES:
+#   - `git submodule deinit` WITH -f / --force  -> block (exit 2) by
+#     default, so the force-override of git's own safety net is
+#     stopped before any work is lost. Opt out to warn-only with
+#     SUBMODULE_DEINIT_BLOCK=0.
+#   - `git submodule deinit` WITHOUT a force flag, or `git submodule
+#     rm` -> warn only (exit 0). git itself refuses the unforced
+#     deinit when there are local changes, so a reminder is enough.
+#
+# CONFIG:
+#   SUBMODULE_DEINIT_BLOCK=1   (default: 1 = block forced deinit; 0 = warn-only)
+#
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-submodule-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-submodule-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
+
+BLOCK_MODE="${SUBMODULE_DEINIT_BLOCK:-1}"
+
+# Forced deinit: the variant that deletes uncommitted submodule work (#68920).
+# Match `git submodule deinit` followed, within the same command segment
+# (no pipe / && / ; in between), by a -f or --force flag.
+if echo "$COMMAND" | grep -qE '\bgit\s+submodule\s+deinit\b[^|&;]*(-f\b|--force\b)'; then
+    if [ "$BLOCK_MODE" = "1" ]; then
+        echo "BLOCKED: git-submodule-guard: 'git submodule deinit -f/--force' deletes the submodule working tree, including uncommitted and un-added changes, irreversibly (Claude Code incident #68920)." >&2
+        echo "  Safer path: commit or 'git stash' your submodule work first, or run 'git submodule deinit' WITHOUT -f (git refuses if there are local changes)." >&2
+        echo "  To allow for legitimate cleanup: export SUBMODULE_DEINIT_BLOCK=0 (warn-only mode)." >&2
+        exit 2
+    fi
+    echo "WARNING: 'git submodule deinit -f/--force' force-removes the submodule working tree and can delete uncommitted work (#68920). Commit or stash first." >&2
+    exit 0
+fi
+
+# Unforced deinit / submodule rm: warn only (git's own safety still applies).
 if echo "$COMMAND" | grep -qE '\bgit\s+submodule\s+(deinit|rm)\b'; then
-    echo "WARNING: Removing git submodule. This may break builds." >&2
+    echo "WARNING: Removing git submodule. This may break builds. Uncommitted submodule changes are at risk; commit or stash first." >&2
 fi
 exit 0

package/examples/git-tag-guard.sh

@@ -1,6 +1,18 @@
 #!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-git-tag-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [git-tag-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0
 if echo "$COMMAND" | grep -qE 'git\s+tag\s+(-a\s+|-d\s+)?v'; then

package/examples/gitops-drift-guard.sh

@@ -15,6 +15,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-gitops-drift-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [gitops-drift-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 case "$TOOL" in Edit|Write) ;; *) exit 0 ;; esac

package/examples/go-mod-tidy-warn.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PostToolUse  MATCHER: "Bash"
 INPUT=$(cat)

package/examples/go-vet-after-edit.sh

@@ -8,6 +8,18 @@
 # TRIGGER: PostToolUse
 # MATCHER: "Write|Edit"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-go-vet-after-edit-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [go-vet-after-edit]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
 [ -z "$FILE" ] && exit 0