cc-safe-setup 29.8.0 → 30.0.5

package/examples/rg-replace-flag-detector.sh

@@ -0,0 +1,125 @@
+#!/bin/bash
+# rg-replace-flag-detector.sh — Warn when Claude reaches for `rg -r` thinking it means recursive
+#
+# Solves: anthropics/claude-code#62016 — Claude's "grep -r" muscle memory leads it
+#         to invoke `rg -rn`, which ripgrep parses as `--replace=n`. Every match is
+#         silently rewritten to the literal `n` in stdout, exit 0, no error. Claude
+#         then reads its own corrupted output, misattributes the garbage to an
+#         "external cause" (post-processing layer, compression), and burns cycles
+#         debugging a self-inflicted flag bug.
+#
+# How it works: PreToolUse hook on Bash that scans the proposed command for the
+#   `rg -r[a-z]` pattern (and variants like `rg -rn`, `rg -rln`, `rg --replace`
+#   without TEXT). Emits a stderr advisory pointing to the correct flag
+#   (`-l` for line numbers is wrong too; line numbers are `-n`; recursive search
+#   is the default for ripgrep, so no `-r` needed at all). Default mode is
+#   advisory (exit 0 with stderr); strict mode (env var CC_RG_REPLACE_DETECTOR_MODE=strict)
+#   blocks the call (exit 2).
+#
+# This is the Cluster-4 hook from the 2026-05-25 customer pain audit
+# (~/ops/customer-pain-audit-2026-05-25-post-launch-cluster.md). It catches
+# the tool-flag self-deception pattern at the boundary where the corrupted
+# output would otherwise enter the model's context.
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+#
+# Usage:
+# {
+#   "hooks": {
+#     "PreToolUse": [{
+#       "matcher": "Bash",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/rg-replace-flag-detector.sh" }]
+#     }]
+#   }
+# }
+#
+# Configuration:
+#   CC_RG_REPLACE_DETECTOR_DISABLE=1 — skip the check entirely
+#   CC_RG_REPLACE_DETECTOR_MODE=strict — exit 2 (hard block) instead of exit 0 (advisory)
+
+# Read stdin first so the upstream writer never sees EPIPE, even when disabled.
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-rg-replace-flag-detector-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [rg-replace-flag-detector]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+INPUT=$(cat 2>/dev/null || true)
+
+[ "${CC_RG_REPLACE_DETECTOR_DISABLE:-0}" = "1" ] && exit 0
+[ -z "$INPUT" ] && exit 0
+
+# Only fire on Bash tool calls.
+TOOL_NAME=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ "$TOOL_NAME" = "Bash" ] || exit 0
+
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+# Detect rg with -r or --replace flag.
+# Patterns to catch:
+#   rg -r <TEXT>
+#   rg -rn / rg -rln (recursive + line numbers — but rg -r is --replace, not recursive)
+#   rg -r=<TEXT>
+#   rg --replace=<TEXT>
+#   rg --replace <TEXT>
+# Patterns to skip (no false positive):
+#   rg -e <PATTERN> (extended regex, different flag)
+#   rg --regexp=<PATTERN>
+#   rg -i / --ignore-case
+DETECTED=""
+
+# Approach: confirm `rg` is invoked, then look for any short-flag token containing
+# `r` anywhere in the rg invocation (separated by whitespace, not embedded in a
+# long flag like `--regexp`).
+#
+# Step 1: confirm rg appears as a command (start of line, after pipe/semicolon,
+# or after a word boundary like xargs).
+if printf '%s' "$COMMAND" | grep -qE '(^|[[:space:]|;&]|xargs[[:space:]]+)rg([[:space:]]|$)'; then
+    # Step 2: look for any short-flag token (single -, not --) containing r.
+    # This matches `-r`, `-rn`, `-rln`, `-rH`, `-erR`, etc. but NOT `--regexp` or `--replace=X`.
+    if printf '%s' "$COMMAND" | grep -qE '(^|[[:space:]])-[a-zA-Z]*r[a-zA-Z]*([[:space:]]|$)'; then
+        DETECTED="short-flag"
+    fi
+    # Step 3: explicitly match --replace as a long flag.
+    if printf '%s' "$COMMAND" | grep -qE '(^|[[:space:]])--replace([=[:space:]]|$)'; then
+        DETECTED="long-flag"
+    fi
+fi
+
+[ -z "$DETECTED" ] && exit 0
+
+cat >&2 <<EOF
+<system-reminder>
+rg-replace-flag-detector caught a likely flag-misuse pattern.
+
+Command: $COMMAND
+
+The flag \`-r\` in ripgrep means \`--replace=TEXT\`, NOT recursive. Recursive
+search is the default for ripgrep. If you intended \`grep -rn\` muscle memory:
+
+  WRONG:   rg -rn "pattern" path/         # rewrites every match to literal "n"
+  RIGHT:   rg -n "pattern" path/          # line numbers, recursive by default
+  ALSO:    rg "pattern" path/             # line numbers via default config
+  ALSO:    rg --line-number "pattern" .   # explicit long form
+
+If you actually meant to replace text in output, ignore this warning. Otherwise
+the resulting stdout is silently corrupted (exit 0, no error) and reading it
+back will misattribute the garbage to an external cause.
+
+Source: anthropics/claude-code#62016
+EOF
+
+# Strict mode blocks; default mode advises.
+if [ "${CC_RG_REPLACE_DETECTOR_MODE:-advisory}" = "strict" ]; then
+    exit 2
+fi
+
+exit 0

package/examples/rhetorical-verification-prompt-detector.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# rhetorical-verification-prompt-detector.sh — UserPromptSubmit hook
+# Trigger: UserPromptSubmit
+# Matcher: ""
+#
+# Solves: Issue #60107 — "the agent treated my question as rhetorical and
+#         confirmed". User asked a verification question; agent emitted an
+#         unconditional confirmation without running any verification step.
+#         User trusted the confirmation, deployed to production, and the
+#         deployed system crashed in full.
+#
+# Class of failure: claim-vs-reality divergence at the verification layer.
+#         The user's explicit verification intent ("is this really working?",
+#         "did this actually deploy?", "are you sure this is safe?") gets
+#         flattened by the model into a rhetorical-question reading, which
+#         the model then answers with social affirmation rather than with
+#         a tool-driven verification step.
+#
+# HOW IT WORKS:
+#   When the user submits a prompt containing verification-intent markers,
+#   the hook emits an additionalContext payload (via hookSpecificOutput)
+#   that explicitly tells the agent: this is a verification request, not
+#   a rhetorical one — do not respond with a bare affirmation; either run
+#   verification tool calls (Bash, Read, Grep) or state explicitly that
+#   verification was not performed.
+#
+# WHY THIS MATTERS:
+#   The 60107 failure shape is one of the cleanest examples of the broader
+#   pattern where the response surface asserts a claim that the runtime
+#   never verified. Most prevention efforts focus on the agent's *output*
+#   (caveat checkers, claim-vs-caveat validators). This hook addresses the
+#   *input* side: by labeling the user's prompt explicitly as a verification
+#   request before the agent processes it, the rhetorical-reading failure
+#   mode is harder to enter in the first place.
+#
+# TRIGGER: UserPromptSubmit
+# MATCHER: ""
+#
+# CONFIGURATION:
+#   CC_RHETORICAL_VERIFY_DISABLE=1   disable the hook entirely
+#   CC_RHETORICAL_VERIFY_LOG=path    append detection events (default off)
+#
+# SAFETY:
+#   - Read-only on the prompt; never modifies the user's input.
+#   - Emits advisory context via hookSpecificOutput; does not block the prompt.
+#   - The user's exact prompt still reaches the agent unchanged.
+#   - Exit 0 always; never blocks the session.
+#
+# REFERENCES:
+#   - anthropics/claude-code#60107 (2026-05-18, the canonical case)
+#   - https://gist.github.com/yurukusa/a5b2a32ca57e75eb1e96adcf67bcf2c3 (the
+#     nine-axis verification compilation, Axis 8 for self-acknowledged
+#     structural divergence)
+set -euo pipefail
+
+[ "${CC_RHETORICAL_VERIFY_DISABLE:-}" = "1" ] && exit 0
+
+INPUT=$(cat)
+PROMPT=$(echo "$INPUT" | jq -r '.prompt // empty' 2>/dev/null || true)
+[ -z "$PROMPT" ] && exit 0
+
+# Detection patterns — verification-intent markers.
+# English and Japanese forms are both checked.
+# These are conservative: only match phrases that strongly imply
+# the user is asking for a *check*, not a *task*.
+EN_PATTERNS='are you sure|are you certain|did (this|that|it) actually|did (this|that|it) really|did you (actually|really|verify|check|confirm)|can you (confirm|verify|double-?check|make sure)|is (this|that|it) (really|actually|definitely|truly) (working|correct|safe|done|deployed|complete|finished)|is (this|that|it) safe to|please (confirm|verify|double-?check|make sure)|just to (confirm|verify|be sure|double-?check)|double[ -]check|sanity check|are we (sure|certain|good)'
+
+JA_PATTERNS='本当に|確かに|大丈夫(です)?(か|\?)|本当か|確認した|確認して(くれ|ください)|もう一度確認|再確認|間違いない(か|ですか|\?)?|本当だ?ね|チェックして|本当に(動いて|できて|終わって|成功して)|間違いなく'
+
+MATCHED_MARKER=""
+
+if echo "$PROMPT" | grep -qiE "$EN_PATTERNS"; then
+    MATCHED_MARKER=$(echo "$PROMPT" | grep -oiE "$EN_PATTERNS" | head -1)
+elif echo "$PROMPT" | grep -qE "$JA_PATTERNS"; then
+    MATCHED_MARKER=$(echo "$PROMPT" | grep -oE "$JA_PATTERNS" | head -1)
+fi
+
+[ -z "$MATCHED_MARKER" ] && exit 0
+
+# Optional logging
+if [ -n "${CC_RHETORICAL_VERIFY_LOG:-}" ]; then
+    {
+        printf '[%s] rhetorical-verify-detected: marker=%q prompt_head=%q\n' \
+            "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$MATCHED_MARKER" "${PROMPT:0:200}"
+    } >> "$CC_RHETORICAL_VERIFY_LOG" 2>/dev/null || true
+fi
+
+# Emit additionalContext via hookSpecificOutput.
+# Claude Code reads this as a system note to the agent.
+ADDITIONAL_CONTEXT="Verification-intent detected in this user prompt (marker: \"${MATCHED_MARKER}\"). Treat this prompt as a verification request, NOT as a rhetorical question. Do not respond with a bare affirmation, social-confirmation phrase, or unverified \"yes\" / \"that's correct\" / \"all good\" / \"安心してください\". Instead: (1) run concrete verification tool calls (Bash, Read, Grep, file tests, status checks) appropriate to what is being verified; or (2) if verification is impossible in this context, state EXPLICITLY that verification was not performed and identify which check is missing. This guard exists because anthropics/claude-code#60107 documents a case where a verification question was read as rhetorical, an unverified confirmation was emitted, and the user's production system crashed in full as a direct consequence."
+
+# Produce JSON output for hookSpecificOutput
+jq -n \
+    --arg ctx "$ADDITIONAL_CONTEXT" \
+    '{
+        hookSpecificOutput: {
+            hookEventName: "UserPromptSubmit",
+            additionalContext: $ctx
+        }
+    }'
+
+exit 0

package/examples/rm-safety-net.sh

@@ -9,13 +9,18 @@
 #   This hook blocks: ALL rm commands on important paths, even non-recursive
 #
 # What it blocks:
-#   rm (any flags) on: /, ~, .., /home, /etc, /usr, /var, .git, .env
+#   rm (any flags) on: /, ~, .., /home, /Users, /etc, /usr, /var, .git, .env
+#   wildcard/glob rm reaching into a user/home/absolute path, e.g.
+#     rm -f ~/Downloads/*copy*.md  (unpredictable match set — see #64559)
 #   find -delete (any path)
+#   find ... | xargs rm  without the null-delimited pair -print0 / xargs -0 (#69793 —
+#     a path with spaces splits into multiple targets and rm -rf wipes an unrelated dir)
 #   shred (any file)
 #   unlink on critical paths
 #
 # What it allows:
 #   rm on safe targets: node_modules, dist, build, __pycache__, .cache, /tmp
+#   bare relative globs in the working dir: rm *.pyc, rm dist/*.js
 #
 # Usage: Add to settings.json as a PreToolUse hook
 #
@@ -33,18 +38,97 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-rm-safety-net-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [rm-safety-net]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 
+# --- Look inside wrappers -----------------------------------------------------
+# The rm analysis below opens only when the command *starts* with rm, and every
+# other boundary in this file is a separator. A command inside a substitution,
+# a subshell, or after a shell keyword is at neither, so it was never examined.
+# Measured 2026-08-04: this hook blocked the bare deletion and passed all six
+# wrappings of it. Claude Code 2.1.221 fixed the same shape in its own
+# permission check ("hidden commands in [[ ]] regex conditionals").
+#
+# Replace the wrapping tokens with separators and run this same script once more
+# against that text. Detection only: the rewritten text is never executed, and
+# the message below keeps the command the user actually sent.
+if [ -n "${CC_RMNET_UNWRAPPED:-}" ]; then
+    COMMAND="$CC_RMNET_UNWRAPPED"
+elif [ -n "$COMMAND" ]; then
+    _rmnet_unwrapped=$(printf '%s' "$COMMAND" | sed -E \
+        -e 's/\$\(/ ; /g' -e 's/`/ ; /g' \
+        -e 's/(^|[[:space:]])\(/\1 ; /g' -e 's/\)([[:space:]]|$)/ ; \1/g' \
+        -e 's/(^|[[:space:]])(then|do|else|elif)([[:space:]])/\1 ; \3/g')
+    if [ "$_rmnet_unwrapped" != "$COMMAND" ]; then
+        CC_RMNET_UNWRAPPED="$_rmnet_unwrapped" bash "$0" </dev/null >/dev/null 2>&1
+        if [ "$?" = "2" ]; then
+            echo "BLOCKED: an rm on a critical path is hidden inside a wrapper." >&2
+            echo "Command: $COMMAND" >&2
+            echo "A substitution, a subshell or a shell keyword does not make it safe." >&2
+            exit 2
+        fi
+    fi
+fi
+
 [ -z "$COMMAND" ] && exit 0
 
+# The extractions in this hook used grep -oP, which is GNU-only. BSD grep
+# (macOS) rejects -P, so the targets came back empty and every critical-path
+# check silently found nothing to inspect. The GNU path is left exactly as it
+# was; an equivalent runs where -P is absent. Defined at file scope because the
+# find/xargs sections below use it too.
+if echo x | grep -qP x 2>/dev/null; then HAS_PCRE=1; else HAS_PCRE=0; fi
+
+# $1 = command word, $2 = operand pattern. \K has no POSIX equivalent, so the
+# fallback matches from the command word and strips that prefix afterwards.
+extract_operand() {
+    if [ "$HAS_PCRE" = 1 ]; then
+        grep -oP "$1\\s+\\K$2" 2>/dev/null || true
+    else
+        grep -oE "$1[[:space:]]+$2" 2>/dev/null | sed -E "s/^$1[[:space:]]+//" || true
+    fi
+}
+
 # --- rm command analysis ---
-if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?rm\s'; then
+# The gate used to be '^\s*(sudo\s+)?rm\s': the analysis opened only when the
+# whole command began with rm, so `cd /tmp && rm -rf ~` never entered it.
+# A separator in front is just as much a command start as the line start is.
+if echo "$COMMAND" | grep -qE '(^|[;&|])[[:space:]]*(sudo[[:space:]]+)?rm[[:space:]]'; then
     # Safe targets that can be deleted freely
     SAFE_TARGETS="node_modules|dist|build|__pycache__|\.cache|\.pytest_cache|coverage|\.nyc_output|\.next|\.nuxt|tmp|temp"
+    CRITICAL="^/\$|^/home|^/Users|^/etc|^/usr|^/var|^/opt|^/root|^~|^\.\.|^\.git$|(^|/)\.env"
 
     # Extract the target (last argument after flags)
-    TARGET=$(echo "$COMMAND" | grep -oP 'rm\s+[^;|&]*' | awk '{print $NF}')
+    if [ "$HAS_PCRE" = 1 ]; then
+        TARGET=$(echo "$COMMAND" | grep -oP 'rm\s+[^;|&]*' | awk '{print $NF}')
+    else
+        TARGET=$(echo "$COMMAND" | grep -oE 'rm[[:space:]]+[^;|&]*' | awk '{print $NF}')
+    fi
+
+    # Judge the target with its quotes removed. This hook blocks anything that
+    # is not on the safe list, so a quoted target used to be blocked whatever it
+    # was: `rm -rf "node_modules"` and `rm -rf "/"` failed the same test for the
+    # same reason -- the quote, not the path. Dropping the quote characters lets
+    # the safe list recognise the first and the critical list catch the second.
+    # Measured 2026-08-11: four ordinary quoted cleanups were blocked here.
+    # Messages keep $TARGET so the user sees what they actually typed.
+    #
+    # A name containing spaces (`rm -rf "my build dir"`) is still blocked. That
+    # is word splitting, not quoting, and fixing it means rewriting how operands
+    # are cut apart. Out of scope here; the tests record it as a known limit.
+    TARGET_UNQ=$(printf '%s' "$TARGET" | tr -d "\"'")
 
     # Block path traversal early
     if echo "$TARGET" | grep -qF '..'; then
@@ -52,6 +136,22 @@ if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?rm\s'; then
         exit 2
     fi
 
+    # Inspect EVERY non-flag argument for critical paths, not just the last one.
+    # The single-TARGET checks below use `awk '{print $NF}'` (last arg only), so
+    # "rm -rf /home/user/data node_modules" would early-exit on the safe LAST arg
+    # (node_modules) and never inspect the critical FIRST arg — a real bypass.
+    # set -f disables glob expansion of the split words (so "rm *.pyc" stays literal).
+    set -f
+    for arg in $(echo "$COMMAND" | extract_operand 'rm' '[^;|&]*'); do
+        case "$arg" in -*) continue ;; esac   # skip flags
+        if printf '%s' "$arg" | tr -d "\"'" | grep -qE "$CRITICAL"; then
+            set +f
+            echo "BLOCKED: rm targeting critical path: $arg" >&2
+            exit 2
+        fi
+    done
+    set +f
+
     # Allow safe targets
     if echo "$TARGET" | grep -qE "^(\./)?(${SAFE_TARGETS})(/|$)"; then
         exit 0
@@ -62,9 +162,29 @@ if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?rm\s'; then
         exit 0
     fi
 
-    # Block rm on critical paths
-    CRITICAL="^/\$|^/home|^/etc|^/usr|^/var|^/opt|^/root|^~|^\.\.|^\.git$|^\.env"
-    if echo "$TARGET" | grep -qE "$CRITICAL"; then
+    # Block wildcard/glob rm on absolute or home paths (#64559).
+    # A glob's match set can't be enumerated in advance, so a delete intended only
+    # for the model's own temp files (e.g. rm -f ~/Downloads/*copy*.md) can silently
+    # collateral-delete pre-existing user files whose names merely share the substring.
+    # Auto mode runs this with no confirmation. Bare relative globs (e.g. rm *.pyc in a
+    # project dir) are left alone; only globs reaching into a user/home/absolute path
+    # outside the safe-target list are gated, where the blast radius is unpredictable.
+    if echo "$TARGET" | grep -qE '[*?[]'; then
+        if echo "$TARGET" | grep -qE "^(/|~)"; then
+            echo "BLOCKED: wildcard rm on a user/absolute path — unpredictable match set: $TARGET" >&2
+            echo "A glob can delete pre-existing files you never named. List the matches first:" >&2
+            echo "  ls -d $TARGET   # confirm exactly what matches, then rm those names explicitly" >&2
+            exit 2
+        fi
+    fi
+
+    # Block rm on critical paths (/Users = macOS home, parity with /home on Linux)
+    # .env is matched at the start OR after any path segment, so a nested path
+    # like backend/.env or src/.env is caught too (#65034 — Claude deleted a
+    # .env living in a subdirectory, which the start-anchored pattern missed).
+    # CRITICAL is defined once near the top of this block (also used by the
+    # multi-argument loop above). This single-TARGET check stays as a backstop.
+    if echo "$TARGET_UNQ" | grep -qE "$CRITICAL"; then
         echo "BLOCKED: rm targeting critical path: $TARGET" >&2
         exit 2
     fi
@@ -72,7 +192,7 @@ if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?rm\s'; then
     # Block rm -rf on any non-safe path (extra safety)
     if echo "$COMMAND" | grep -qE 'rm\s+.*-[rRf]*[rR][rRf]*'; then
         # rm -rf on non-safe, non-tmp target — block unless it's a known safe directory
-        if ! echo "$TARGET" | grep -qE "^(\./)?(${SAFE_TARGETS})(/|$)|^/tmp/"; then
+        if ! echo "$TARGET_UNQ" | grep -qE "^(\./)?(${SAFE_TARGETS})(/|$)|^/tmp/"; then
             echo "BLOCKED: rm -rf on non-safe target: $TARGET" >&2
             exit 2
         fi
@@ -82,7 +202,7 @@ fi
 # --- find -delete ---
 if echo "$COMMAND" | grep -qE 'find\s.*-delete'; then
     # Allow find in safe directories only
-    FIND_PATH=$(echo "$COMMAND" | grep -oP 'find\s+\K[^\s]+')
+    FIND_PATH=$(echo "$COMMAND" | extract_operand 'find' '[^[:space:]]+')
     if echo "$FIND_PATH" | grep -qE '^\.|^node_modules|^dist|^build|^/tmp'; then
         exit 0
     fi
@@ -90,6 +210,29 @@ if echo "$COMMAND" | grep -qE 'find\s.*-delete'; then
     exit 2
 fi
 
+# --- find | xargs rm without a null delimiter (#69793) ---
+# find prints newline-separated paths; xargs WITHOUT -0 splits on ANY whitespace.
+# So a single path containing spaces, e.g. "./Google Photos/a.jpg", is split into
+# two arguments: "./Google" and "Photos/a.jpg". With rm -rf, the first token can
+# match an UNRELATED real directory ("./Google") and wipe it whole — the reporter
+# in #69793 lost ~28,800 files this way. The rm checks above can't catch this:
+# the delete targets are produced by find at runtime, so there is no literal path
+# in the command string to inspect. The only safe form is the null-delimited pair
+# find -print0 | xargs -0 (or avoid xargs: find -delete / -exec rm {} +).
+if echo "$COMMAND" | grep -qE 'xargs\b[^|]*\b(rm|rmdir|unlink|shred|trash|trash-put)\b'; then
+    # Require BOTH halves of the null-delimited pair: find's -print0 and xargs's -0.
+    if ! echo "$COMMAND" | grep -qE '\-print0' \
+       || ! echo "$COMMAND" | grep -qE 'xargs\s+[^|]*(-0|--null)'; then
+        echo "BLOCKED: 'xargs rm' without a null delimiter — paths with spaces split into multiple targets (#69793)." >&2
+        echo "  A path like './Google Photos/a.jpg' splits into './Google' and 'Photos/a.jpg';" >&2
+        echo "  rm -rf may then wipe an unrelated real directory. Use one of:" >&2
+        echo "    find ... -delete" >&2
+        echo "    find ... -exec rm -rf {} +" >&2
+        echo "    find ... -print0 | xargs -0 rm -rf" >&2
+        exit 2
+    fi
+fi
+
 # --- shred ---
 if echo "$COMMAND" | grep -qE '^\s*(sudo\s+)?shred\s'; then
     echo "BLOCKED: shred command (secure file deletion)" >&2

package/examples/role-tool-guard.sh

@@ -18,6 +18,18 @@
 
 set -euo pipefail
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-role-tool-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [role-tool-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 [ -z "$TOOL" ] && exit 0