cc-safe-setup 29.8.0 → 30.0.5

package/examples/goal-iteration-limit-warner.sh

@@ -0,0 +1,152 @@
+#!/bin/bash
+# goal-iteration-limit-warner.sh — Warn before /goal command without iteration termination
+#
+# Solves: github.com/anthropics/claude-code/issues/58550
+#         "/goal evaluator has no circuit breaker — unsatisfiable conditions burn unlimited tokens"
+#
+#         Reporter (2026-05-13): a `/goal` set with no termination clause kept
+#         firing the same "condition not satisfied" check for 200+ iterations
+#         over 5 hours, consuming approximately 50% of the user's weekly token
+#         budget. The assistant cannot programmatically clear a goal; only the
+#         user can with `/goal clear`. If the user steps away after setting the
+#         goal, the budget burns silently.
+#
+# WHY THIS MATTERS:
+#   This is a textbook irreversible-operation pattern: the goal-evaluator's
+#   per-turn token spend is non-refundable once consumed, and the only stop
+#   condition is the user manually noticing and running `/goal clear`. For
+#   developers running Claude Code autonomously or stepping away mid-session,
+#   this is a high-impact silent failure.
+#
+# TRIGGER: UserPromptSubmit  MATCHER: ""
+#
+# HOW IT WORKS:
+#   When the user submits a prompt:
+#     1. Check whether the prompt is a `/goal` command.
+#        Skip `/goal clear`, `/goal status`, `/goal evaluate-once`, etc.
+#        (anything that isn't setting a new goal).
+#     2. For a goal-setting command, check whether the goal text already
+#        contains a termination clause ("stop after", "or stop", "max", a
+#        turn-count like "20 turns", "within N iterations", etc.).
+#     3. If no termination clause is present, emit a warning explaining the
+#        known iteration-limit bug and recommend adding a clause such as
+#        "or stop after 20 turns". Do not block — let the user proceed with
+#        eyes open.
+#
+# CONFIGURATION:
+#   CC_GOAL_WARN_DISABLE=1       — disable the hook entirely
+#   CC_GOAL_WARN_ACTION          — "warn" (default) or "block" (exit 2)
+#   CC_GOAL_WARN_LOG             — log file path (default /tmp/cc-goal-warn.log)
+#   CC_GOAL_WARN_MAX_TURNS       — suggested max turn count (default 20)
+#
+# Usage:
+# {
+#   "hooks": {
+#     "UserPromptSubmit": [{
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/goal-iteration-limit-warner.sh" }]
+#     }]
+#   }
+# }
+
+if [ "${CC_GOAL_WARN_DISABLE:-0}" = "1" ]; then
+  exit 0
+fi
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-goal-iteration-limit-warner-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [goal-iteration-limit-warner]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+
+# Pull user prompt (UserPromptSubmit puts it in tool_input.prompt or .prompt)
+PROMPT=$(printf '%s' "$INPUT" | jq -r '.prompt // .tool_input.prompt // empty' 2>/dev/null)
+if [ -z "$PROMPT" ]; then
+  exit 0
+fi
+
+# Quick scan: only act on /goal commands
+case "$PROMPT" in
+  "/goal "*|"/goal"|*$'\n'"/goal "*)
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+
+ACTION="${CC_GOAL_WARN_ACTION:-warn}"
+LOG_FILE="${CC_GOAL_WARN_LOG:-/tmp/cc-goal-warn.log}"
+MAX_TURNS="${CC_GOAL_WARN_MAX_TURNS:-20}"
+
+# Extract the line that begins with /goal
+GOAL_LINE=$(printf '%s' "$PROMPT" | grep -oE '^/goal[[:space:]]+[^\n]+' | head -1)
+if [ -z "$GOAL_LINE" ]; then
+  # Could be just "/goal" with no args — informational, no action needed
+  exit 0
+fi
+
+# Skip non-setting subcommands. Anything starting with /goal followed by
+# clear/status/evaluate-once/help/list is not setting a new goal.
+case "$GOAL_LINE" in
+  "/goal clear"*|"/goal status"*|"/goal help"*|"/goal list"*|"/goal evaluate-once"*|"/goal evaluate"*|"/goal show"*)
+    exit 0
+    ;;
+esac
+
+# Check for a termination clause. These are heuristic — false negatives are
+# acceptable (we just warn once); false positives let a careful user proceed.
+# Patterns:
+#   - "stop after"
+#   - "or stop"
+#   - "max N"
+#   - "N turns" / "N iterations" / "N evaluations"
+#   - "within N turns"
+#   - "after N attempts"
+HAS_LIMIT=0
+if echo "$GOAL_LINE" | grep -qiE '(stop[[:space:]]+after|or[[:space:]]+stop|max[[:space:]]+[0-9]+|[0-9]+[[:space:]]+(turns|iterations|evaluations|attempts|tries)|within[[:space:]]+[0-9]+[[:space:]]+(turns|iterations)|after[[:space:]]+[0-9]+[[:space:]]+(attempts|tries|turns))'; then
+  HAS_LIMIT=1
+fi
+
+if [ "$HAS_LIMIT" = "1" ]; then
+  # Termination clause present — silent pass.
+  exit 0
+fi
+
+TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
+GOAL_TEXT_TRIMMED=$(echo "$GOAL_LINE" | head -c 200)
+echo "[$TIMESTAMP] goal_without_limit detected, action=$ACTION goal_excerpt=$GOAL_TEXT_TRIMMED" >> "$LOG_FILE"
+
+MSG="⚠️  /goal without a termination clause detected"
+MSG+=$'\n'"     command: $GOAL_TEXT_TRIMMED"
+MSG+=$'\n'
+MSG+=$'\n'"  Known bug: github.com/anthropics/claude-code/issues/58550"
+MSG+=$'\n'"  The /goal evaluator runs after every assistant turn and has no built-in"
+MSG+=$'\n'"  iteration limit. One reported incident: 200+ iterations over 5 hours,"
+MSG+=$'\n'"  burning approximately 50% of the user's weekly token quota before the"
+MSG+=$'\n'"  user noticed and ran /goal clear. The assistant cannot clear or modify"
+MSG+=$'\n'"  a goal programmatically; only the user can."
+MSG+=$'\n'
+MSG+=$'\n'"  Recommendation: add an explicit termination clause. Examples:"
+MSG+=$'\n'"    /goal <condition> or stop after $MAX_TURNS turns"
+MSG+=$'\n'"    /goal <condition>, max $MAX_TURNS iterations"
+MSG+=$'\n'"    /goal <condition> within $MAX_TURNS turns"
+MSG+=$'\n'
+MSG+=$'\n'"  Reportedly, the 'or stop after N turns' clause is honored by the"
+MSG+=$'\n'"  evaluator already (issue #58550 workaround #4). If you proceed without"
+MSG+=$'\n'"  a clause, set a phone alarm for ~30 minutes and confirm /goal clear"
+MSG+=$'\n'"  if the condition turns out to be unreachable."
+
+if [ "$ACTION" = "block" ]; then
+  printf '%s\n' "$MSG" >&2
+  exit 2
+else
+  printf '%s\n' "$MSG" >&2
+  exit 0
+fi

package/examples/grep-nul-false-negative-guard.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+set -uo pipefail
+#
+# The registration was missing from this header. The installer reads TRIGGER
+# and MATCHER from here and falls back to PreToolUse / Bash when both are
+# absent, so this hook was being registered at a moment where the field it
+# reads is always empty: it installed, it appeared in the settings, and it
+# did nothing. Measured 2026-08-04 across examples/: 14 files were like this.
+# TRIGGER: PostToolUse
+# MATCHER: "Grep"
+INPUT=$(cat)
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ "$TOOL" = "Grep" ] || exit 0
+RESP=$(printf '%s' "$INPUT" | jq -r '.tool_response // .tool_result // empty' 2>/dev/null)
+printf '%s' "$RESP" | grep -qiE 'no matches found|no files found' || exit 0
+SEARCH=$(printf '%s' "$INPUT" | jq -r '.tool_input.path // "."' 2>/dev/null)
+[ -e "$SEARCH" ] || exit 0
+HIT=$(find "$SEARCH" -type f \
+        -not -path '*/.git/*' -not -path '*/node_modules/*' 2>/dev/null \
+      | head -300 \
+      | while read -r f; do
+          if LC_ALL=C grep -qaP '\x00' "$f" 2>/dev/null; then echo "$f"; break; fi
+        done)
+if [ -n "$HIT" ]; then
+  echo "[grep-nul-guard] Grep returned no matches, but '$HIT' contains a NUL byte." >&2
+  echo "  ripgrep silently suppresses matches in files it treats as binary, so this" >&2
+  echo "  'no matches' may be a false negative. Before concluding the pattern is absent," >&2
+  echo "  re-search in text mode, e.g.  rg -a --text <pattern> <path>  (or  grep -aP)." >&2
+fi
+exit 0

package/examples/growthbook-flag-monitor.sh

@@ -0,0 +1,257 @@
+#!/bin/bash
+# ================================================================
+# growthbook-flag-monitor.sh — Surface server-pushed GrowthBook
+#   flag changes that silently override client-side state.
+# ================================================================
+# PURPOSE:
+#   Issue #62205 (2026-05-25, root-cause analysis) documented that
+#   the macOS Desktop variant of Claude Code syncs GrowthBook A/B
+#   feature flags from the Anthropic server every ~9 minutes and
+#   silently overrides the user's local settings.json. Concretely,
+#   `permissions.defaultMode: bypassPermissions` flips back to
+#   `acceptEdits` on each sync, with the same shape applying to
+#   other dispatch surfaces (auto-compact: #63015 suspects
+#   `tengu_compact_cache_prefix` gating a new compaction path that
+#   silently fails to fire).
+#
+#   The local cache file is read-write but not authoritative — any
+#   operator edit is restored on the next ~9-minute sync. Local
+#   edits do not persist. The five documented override paths in
+#   the cluster framing all draw from the cached flag set, so the
+#   minimum-viable defense is to make flag changes visible to the
+#   operator instead of letting them happen silently in the
+#   background.
+#
+# WHO THIS PROTECTS:
+#   macOS Claude Desktop operators (where the cache file is at
+#   `~/Library/Application Support/Claude/cachedGrowthBookFeatures`).
+#   Linux operators where the cache lives under
+#   `~/.config/Claude/cachedGrowthBookFeatures` are also covered
+#   when the file is present. CLI-only operators are unaffected
+#   when the file is absent — the hook stays silent.
+#
+# HOW IT WORKS:
+#   On SessionStart, snapshots the current GrowthBook flag set
+#   (sha256 over the canonicalised flag-name list, plus the
+#   per-flag JSON value digest). Compares against the previous
+#   snapshot from `${XDG_STATE_HOME:-$HOME/.local/state}/cc-safe-setup/
+#   growthbook-flag-monitor/snapshot.json`. If the set has changed,
+#   prints a one-screen stderr advisory listing added / removed /
+#   changed flags so the operator sees what shifted while they
+#   were away. Always exits 0 (advisory only).
+#
+#   The snapshot does NOT contain raw flag values by default
+#   (those are server-controlled and can change without notice).
+#   The snapshot stores just the flag-name set + per-flag value
+#   digest. Set CC_GROWTHBOOK_MONITOR_FULL=1 to also store full
+#   values for forensic comparison (off by default to keep the
+#   state file small).
+#
+# TRIGGER: SessionStart  MATCHER: ""
+# CLUSTER: 10 (GrowthBook A/B flag client-side overrides)
+#
+# CONFIGURATION (env vars):
+#   CC_GROWTHBOOK_MONITOR_DISABLE      Set to "1" to silence.
+#   CC_GROWTHBOOK_MONITOR_PATH         Override cache file path.
+#                                      Default: macOS / Linux auto.
+#   CC_GROWTHBOOK_MONITOR_STATE_DIR    Override snapshot dir.
+#                                      Default: $XDG_STATE_HOME or
+#                                      $HOME/.local/state.
+#   CC_GROWTHBOOK_MONITOR_FULL         Store full values in
+#                                      snapshot (forensic mode).
+#                                      Default: off (digest only).
+#   CC_GROWTHBOOK_MONITOR_QUIET        Suppress the no-change line
+#                                      shown on first run / no diff.
+#   CC_GROWTHBOOK_MONITOR_LOG          Append snapshot events to
+#                                      this file (default off).
+#
+# USAGE:
+# {
+#   "hooks": {
+#     "SessionStart": [{
+#       "hooks": [{
+#         "type": "command",
+#         "command": "~/.claude/hooks/growthbook-flag-monitor.sh"
+#       }]
+#     }]
+#   }
+# }
+
+INPUT=$(cat 2>/dev/null || true)
+
+if [ "${CC_GROWTHBOOK_MONITOR_DISABLE:-}" = "1" ]; then
+    exit 0
+fi
+
+# Locate the cachedGrowthBookFeatures file.
+locate_cache() {
+    if [ -n "${CC_GROWTHBOOK_MONITOR_PATH:-}" ]; then
+        [ -f "$CC_GROWTHBOOK_MONITOR_PATH" ] && echo "$CC_GROWTHBOOK_MONITOR_PATH"
+        return 0
+    fi
+    # macOS Claude Desktop
+    if [ -f "$HOME/Library/Application Support/Claude/cachedGrowthBookFeatures" ]; then
+        echo "$HOME/Library/Application Support/Claude/cachedGrowthBookFeatures"; return 0
+    fi
+    # Linux Claude Desktop (XDG)
+    if [ -f "${XDG_CONFIG_HOME:-$HOME/.config}/Claude/cachedGrowthBookFeatures" ]; then
+        echo "${XDG_CONFIG_HOME:-$HOME/.config}/Claude/cachedGrowthBookFeatures"; return 0
+    fi
+    # ~/.claude.json carries cachedGrowthBookFeatures on some Claude Code variants
+    if [ -f "$HOME/.claude.json" ] && grep -q "cachedGrowthBookFeatures" "$HOME/.claude.json" 2>/dev/null; then
+        echo "$HOME/.claude.json"; return 0
+    fi
+    return 1
+}
+
+CACHE_FILE=$(locate_cache)
+if [ -z "$CACHE_FILE" ]; then
+    # No GrowthBook cache found — operator is on CLI or has the file disabled.
+    exit 0
+fi
+
+if ! command -v jq >/dev/null 2>&1; then
+    echo "[growthbook-flag-monitor] jq not available; skipping (install jq to enable)" >&2
+    exit 0
+fi
+
+STATE_DIR="${CC_GROWTHBOOK_MONITOR_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/cc-safe-setup/growthbook-flag-monitor}"
+mkdir -p "$STATE_DIR" 2>/dev/null
+SNAPSHOT_FILE="$STATE_DIR/snapshot.json"
+
+# Build a normalised flag manifest. The cache file is either:
+#   - a JSON object {flag_name: {value: ...}, ...} (Desktop variants)
+#   - the full ~/.claude.json with cachedGrowthBookFeatures nested.
+extract_flags() {
+    # First try the direct object form
+    local payload
+    payload=$(jq -c '.cachedGrowthBookFeatures // .' "$CACHE_FILE" 2>/dev/null)
+    if [ -z "$payload" ] || [ "$payload" = "null" ]; then
+        echo "{}"
+        return 1
+    fi
+    # Normalise to {flag_name: digest_of_value}
+    echo "$payload" | jq -c '
+        if type == "object" then
+            to_entries
+            | map({key: .key, value: (.value | tostring | @base64)})
+            | from_entries
+        else
+            {}
+        end
+    ' 2>/dev/null || echo "{}"
+}
+
+CURRENT=$(extract_flags)
+if [ -z "$CURRENT" ] || [ "$CURRENT" = "{}" ]; then
+    # File present but no flag data — silent skip.
+    exit 0
+fi
+
+# First run: snapshot and emit baseline notice.
+if [ ! -f "$SNAPSHOT_FILE" ]; then
+    if [ "${CC_GROWTHBOOK_MONITOR_FULL:-}" = "1" ]; then
+        jq -c '.cachedGrowthBookFeatures // .' "$CACHE_FILE" > "$SNAPSHOT_FILE" 2>/dev/null
+    else
+        echo "$CURRENT" > "$SNAPSHOT_FILE"
+    fi
+    if [ -z "${CC_GROWTHBOOK_MONITOR_QUIET:-}" ]; then
+        FLAG_COUNT=$(echo "$CURRENT" | jq 'length' 2>/dev/null)
+        echo "[growthbook-flag-monitor] baseline snapshot recorded: ${FLAG_COUNT} flags in ${CACHE_FILE}" >&2
+    fi
+    if [ -n "${CC_GROWTHBOOK_MONITOR_LOG:-}" ]; then
+        mkdir -p "$(dirname "$CC_GROWTHBOOK_MONITOR_LOG")" 2>/dev/null
+        echo "$(date -Iseconds) event=baseline cache=${CACHE_FILE} flags=${FLAG_COUNT}" >> "$CC_GROWTHBOOK_MONITOR_LOG"
+    fi
+    exit 0
+fi
+
+PREVIOUS=$(cat "$SNAPSHOT_FILE" 2>/dev/null)
+if [ "${CC_GROWTHBOOK_MONITOR_FULL:-}" = "1" ]; then
+    # Compare full values
+    PREVIOUS=$(echo "$PREVIOUS" | jq -c '
+        if type == "object" then
+            to_entries | map({key: .key, value: (.value | tostring | @base64)}) | from_entries
+        else {} end
+    ' 2>/dev/null)
+fi
+
+# Compute diff using jq set operations
+DIFF=$(jq -n --argjson prev "$PREVIOUS" --argjson curr "$CURRENT" '
+    {
+        added: (($curr | keys) - ($prev | keys)),
+        removed: (($prev | keys) - ($curr | keys)),
+        changed: [
+            ($curr | keys | .[]) as $k
+            | select(($prev | has($k)) and ($prev[$k] != $curr[$k]))
+            | $k
+        ]
+    }
+' 2>/dev/null)
+
+ADDED=$(echo "$DIFF" | jq -r '.added | length' 2>/dev/null)
+REMOVED=$(echo "$DIFF" | jq -r '.removed | length' 2>/dev/null)
+CHANGED=$(echo "$DIFF" | jq -r '.changed | length' 2>/dev/null)
+TOTAL=$((${ADDED:-0} + ${REMOVED:-0} + ${CHANGED:-0}))
+
+if [ "$TOTAL" -eq 0 ]; then
+    if [ -z "${CC_GROWTHBOOK_MONITOR_QUIET:-}" ]; then
+        FLAG_COUNT=$(echo "$CURRENT" | jq 'length' 2>/dev/null)
+        echo "[growthbook-flag-monitor] no GrowthBook flag changes since last session (${FLAG_COUNT} flags tracked)" >&2
+    fi
+    exit 0
+fi
+
+# Emit diff advisory
+cat >&2 <<EOF
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+[growthbook-flag-monitor] SessionStart — GrowthBook flag set changed
+Cache file: ${CACHE_FILE}
+Cluster 10 (server-pushed flag overrides). Anthropic syncs flags
+on a ~9-minute cadence; local edits do not persist across syncs.
+
+Changes since last session:
+  added:   ${ADDED}
+  removed: ${REMOVED}
+  changed: ${CHANGED}
+EOF
+
+if [ "${ADDED:-0}" -gt 0 ]; then
+    echo "" >&2
+    echo "  ADDED:" >&2
+    echo "$DIFF" | jq -r '.added[] | "    + " + .' >&2
+fi
+if [ "${REMOVED:-0}" -gt 0 ]; then
+    echo "" >&2
+    echo "  REMOVED:" >&2
+    echo "$DIFF" | jq -r '.removed[] | "    - " + .' >&2
+fi
+if [ "${CHANGED:-0}" -gt 0 ]; then
+    echo "" >&2
+    echo "  CHANGED:" >&2
+    echo "$DIFF" | jq -r '.changed[] | "    ~ " + .' >&2
+fi
+
+cat >&2 <<'EOF'
+
+Verify your permissions.defaultMode and other settings.json values
+are still what you expect. Server-pushed flags (e.g.
+tengu_permission_friction, tengu_quill_harbor, tengu_compact_cache_prefix)
+have been observed silently overriding client behavior.
+Issue: https://github.com/anthropics/claude-code/issues/62205
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+EOF
+
+# Update the snapshot for the next session
+if [ "${CC_GROWTHBOOK_MONITOR_FULL:-}" = "1" ]; then
+    jq -c '.cachedGrowthBookFeatures // .' "$CACHE_FILE" > "$SNAPSHOT_FILE" 2>/dev/null
+else
+    echo "$CURRENT" > "$SNAPSHOT_FILE"
+fi
+
+if [ -n "${CC_GROWTHBOOK_MONITOR_LOG:-}" ]; then
+    mkdir -p "$(dirname "$CC_GROWTHBOOK_MONITOR_LOG")" 2>/dev/null
+    echo "$(date -Iseconds) event=diff added=${ADDED} removed=${REMOVED} changed=${CHANGED}" >> "$CC_GROWTHBOOK_MONITOR_LOG"
+fi
+
+exit 0

package/examples/hallucination-url-check.sh

@@ -22,7 +22,7 @@
 # }
 # ================================================================
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PostToolUse  MATCHER: "Write|Edit"
 
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)

package/examples/halt-signal-detector.sh

@@ -0,0 +1,135 @@
+#!/bin/bash
+# ================================================================
+# halt-signal-detector.sh — Warn before further tool calls when the
+#                          user's previous message contains a halt
+#                          token (stop, やめて, halt, etc.)
+# ================================================================
+# PURPOSE:
+#   When the previous user message in the transcript contains an
+#   explicit halt signal, warn that the upcoming tool call may be
+#   reframing the user's halt as a renegotiation. Prevents the
+#   "continuation bargaining after halt signals" failure mode reported
+#   in Issue #55909 (Cowork mode bargaining), Issue #56351 (refusing
+#   to stop digging), and Issue #55363 (/ultrareview ignoring stop).
+#
+# TRIGGER: PreToolUse
+# MATCHER: "*"  (all tools)
+#
+# WHY THIS MATTERS:
+#   In Issue #55909, the user said "stop / やめて / use a different
+#   browser" multiple times, but the model continued operating and
+#   replied with bargaining language ("just let me do this one part",
+#   "after you log in, send 'OK' and I'll do the rest"). The expected
+#   behaviour after a user halt signal is: zero tool calls in the
+#   next turn, no requests for partial cooperation. The original plan
+#   does not survive into the next response, even softened.
+#
+#   This hook detects the halt signal at the input boundary and warns
+#   before any tool call is made. It cannot fix the underlying model
+#   layer issue, but it removes the bargaining surface from the next
+#   turn by surfacing the contradiction to the operator.
+#
+# WHAT IT CHECKS:
+#   1. Read the most recent user message from the transcript
+#   2. Search for halt tokens (Japanese and English)
+#   3. If a halt token is present, emit a warning to stderr
+#   4. If CC_HALT_SIGNAL_BLOCK=1, also exit 2 to block the tool call
+#
+# OUTPUT:
+#   Warning to stderr with a snippet of the matched user text and a
+#   reference to Issue #55909. Exit 0 (advisory) by default.
+#
+# CONFIGURATION:
+#   CC_HALT_SIGNAL_BLOCK  — set to "1" to block the tool call (exit 2)
+#                          when a halt signal is detected. Default is
+#                          advisory only.
+#   CC_HALT_SIGNAL_EXTRA  — additional comma-separated halt tokens to
+#                          match (case-insensitive). Example: "abort,kill"
+#
+# RELATED ISSUES:
+#   https://github.com/anthropics/claude-code/issues/55909
+#   https://github.com/anthropics/claude-code/issues/56351
+#   https://github.com/anthropics/claude-code/issues/55363
+# ================================================================
+
+set -u
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-halt-signal-detector-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [halt-signal-detector]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat)
+
+# Get transcript path from PreToolUse input
+TRANSCRIPT_PATH=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+
+if [ -z "$TRANSCRIPT_PATH" ] || [ ! -f "$TRANSCRIPT_PATH" ]; then
+    exit 0
+fi
+
+# Find the most recent user message
+LAST_USER_LINE=$(grep -h '"type":"user"' "$TRANSCRIPT_PATH" 2>/dev/null | tail -1)
+
+if [ -z "$LAST_USER_LINE" ]; then
+    exit 0
+fi
+
+# Extract user text — content may be a string or an array of blocks
+USER_TEXT=$(printf '%s' "$LAST_USER_LINE" | jq -r '
+    if (.message.content | type) == "string" then
+        .message.content
+    elif (.message.content | type) == "array" then
+        [.message.content[] | select(.type == "text") | .text] | join(" ")
+    else
+        empty
+    end
+' 2>/dev/null)
+
+if [ -z "$USER_TEXT" ]; then
+    exit 0
+fi
+
+# Skip if user text looks like a system-generated nudge (idle prompt, hook output)
+if printf '%s' "$USER_TEXT" | grep -qE '^\[idle [0-9]+s|^<system-reminder>|^BLOCKED:'; then
+    exit 0
+fi
+
+# Halt signal patterns — explicit stop/halt verbs
+# Japanese: やめて, やめろ, 止めて, 止まれ, 中断, 中止, ストップ
+# English: stop, halt, abort, cease, do not, don't
+HALT_BASE='やめて|やめろ|止めて|止まれ|中断|中止|ストップ|\bstop\b|\bhalt\b|\babort\b|\bcease\b|\bdo not\b|\bdon'\''t\b'
+
+# Optional extra patterns from env
+EXTRA="${CC_HALT_SIGNAL_EXTRA:-}"
+if [ -n "$EXTRA" ]; then
+    EXTRA_PATTERN=$(printf '%s' "$EXTRA" | tr ',' '|')
+    HALT_PATTERN="${HALT_BASE}|${EXTRA_PATTERN}"
+else
+    HALT_PATTERN="$HALT_BASE"
+fi
+
+# Check for halt signal (case-insensitive)
+if printf '%s' "$USER_TEXT" | grep -qiE "$HALT_PATTERN"; then
+    SNIPPET=$(printf '%s' "$USER_TEXT" | head -c 160 | tr '\n' ' ')
+    cat >&2 <<EOF
+🛑 halt-signal-detector: 直前の利用者の応答に停止の合図が含まれています。
+  検出した文脈: ${SNIPPET}...
+  この道具の呼び出しが、 利用者の停止の合図を「計画の調整の依頼」 として再解釈していないか確認してください。
+  「これだけ」「ここだけ」「短い合図を送ってください」 のような部分的な協力の依頼は、 利用者から見ると停止の合図の無視と等価です。
+  期待される動き: 次の応答で道具の呼び出しゼロ、 状態の報告と利用者への確認のみ。
+  Reference: https://github.com/anthropics/claude-code/issues/55909
+EOF
+    if [ "${CC_HALT_SIGNAL_BLOCK:-0}" = "1" ]; then
+        exit 2
+    fi
+fi
+
+exit 0

package/examples/handoff-on-clear.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+# handoff-on-clear.sh — Write a handoff note at /clear, before the context goes
+#
+# Solves: /clear wipes the conversation with no chance to act first, and no hook
+#         can block it — slash commands never reach UserPromptSubmit (measured
+#         2026-09-19 on 2.1.270; the table is in clear-command-confirm-guard.sh).
+#         People ask for a PreClear event for exactly this (#95199).
+#
+# How it works: SessionEnd fires with reason="clear", and at that moment
+#   transcript_path still points at a readable file — 271,593 bytes of it in the
+#   run this was measured on. The conversation is not gone yet, so this hook
+#   reads it and writes HANDOFF.md next to the project before the wipe.
+#
+#   This is "derive and save", never "hold on, are you sure". SessionEnd cannot
+#   cancel the clear and gives no ordering guarantee against the wipe.
+#
+# TRIGGER: SessionEnd
+# MATCHER: ""
+#
+# Usage:
+# {
+#   "hooks": {
+#     "SessionEnd": [{
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/handoff-on-clear.sh" }]
+#     }]
+#   }
+# }
+
+set -uo pipefail
+INPUT=$(cat)
+
+# Without jq there is nothing to read the event with. Say so rather than failing
+# silently: a handoff that never gets written looks identical to one not needed.
+if ! command -v jq >/dev/null 2>&1; then
+  echo "WARNING [handoff-on-clear]: jq not found - no handoff will be written. Install jq." >&2
+  exit 0
+fi
+
+# Only /clear. The other SessionEnd reasons (prompt_input_exit, logout) end the
+# session without the user losing context they expected to keep.
+[ "$(printf '%s' "$INPUT" | jq -r '.reason // empty')" = "clear" ] || exit 0
+
+tp=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty')
+cwd=$(printf '%s' "$INPUT" | jq -r '.cwd // empty')
+if [ -z "$tp" ] || [ ! -f "$tp" ]; then
+  echo "WARNING [handoff-on-clear]: no readable transcript at '$tp' - nothing written." >&2
+  exit 0
+fi
+
+out="${cwd:-.}/HANDOFF.md"
+{
+  printf '# Handoff (written at /clear, %s)\n\n' "$(date -Is)"
+  printf -- '- transcript: `%s`\n' "$tp"
+  printf -- '- turns: %s user / %s assistant\n\n' \
+    "$(jq -rs '[.[] | select(.type=="user")] | length' "$tp" 2>/dev/null)" \
+    "$(jq -rs '[.[] | select(.type=="assistant")] | length' "$tp" 2>/dev/null)"
+  printf '## Last thing you asked for\n\n'
+  jq -rs '[.[] | select(.type=="user") | .message.content] | last
+          | if type=="array" then map(select(.type=="text").text) | join("\n") else . end' \
+     "$tp" 2>/dev/null | head -c 1200
+  printf '\n'
+} > "$out"
+
+echo "handoff-on-clear: wrote $out" >&2
+exit 0

package/examples/hardcoded-ip-guard.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/helm-install-guard.sh

@@ -1,5 +1,6 @@
+#!/bin/bash
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0