cc-safe-setup 29.8.0 → 30.0.5

package/examples/scope-guard.sh

@@ -17,6 +17,18 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-scope-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [scope-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
@@ -24,33 +36,100 @@ CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ "$TOOL" != "Bash" ]] && exit 0
 [[ -z "$CMD" ]] && exit 0
 
-# Skip string output commands
-if echo "$CMD" | grep -qE '^\s*(echo|printf|cat\s*<<)'; then
-    exit 0
-fi
+# Remove the parts of the command that are DATA, not instructions, before matching.
+#
+# Why this is needed at all: writing the name of a destructive command inside a file,
+# a commit message or a heredoc used to trip this guard. A guard that fires on prose
+# gets uninstalled, which is worse than a guard that never existed.
+#
+# Why the previous version was wrong in BOTH directions (measured 2026-09-16, and the
+# measurements are in scripts/probe-skip-line-both-ways.sh so you can re-run them):
+#   It read `^\s*(echo|printf|cat\s*<<)` and exited 0 on a match — it looked at the
+#   START of the whole command only.
+#   - It missed real damage: `echo starting && rm -rf /home/x` starts with echo, so the
+#     rm was waved through. Four of seven probes were missed this way.
+#   - It still fired on prose: `cat > note.md <<'EOF'` puts `>` between `cat` and `<<`,
+#     so it never matched the skip pattern. Eight ways of writing the same harmless thing
+#     split four-and-four on whether they were blocked.
+#
+# What is data and what is not: a heredoc body is data when the thing receiving it stores
+# it (cat, tee, a file redirect). It is NOT data when the receiver executes it — `bash <<EOF`
+# runs every line. Interpreters (python, node, ruby, perl, php) are also left in: their
+# bodies can shell out, and being wrong in the direction of "looks safe" costs more.
+strip_data_bodies() {
+    awk '
+    BEGIN { indoc = 0; delim = "" }
+    {
+        if (indoc) {
+            probe = $0
+            sub(/^[ \t]+/, "", probe)
+            if (probe == delim) { indoc = 0; delim = "" }
+            next
+        }
+        if (match($0, /<<-?[ \t]*("[^"]+"|'"'"'[^'"'"']+'"'"'|[A-Za-z_][A-Za-z0-9_]*)/)) {
+            head = substr($0, 1, RSTART - 1)
+            executes = 0
+            if (head ~ /(^|[|;&(]|[ \t])(ba|z|k|da)?sh([ \t]|$)/) executes = 1
+            if (head ~ /(^|[|;&(]|[ \t])(python[0-9.]*|node|ruby|perl|php)([ \t]|$)/) executes = 1
+            if (!executes) {
+                d = substr($0, RSTART, RLENGTH)
+                sub(/^<<-?[ \t]*/, "", d)
+                gsub(/["'"'"']/, "", d)
+                delim = d
+                indoc = 1
+                print head
+                next
+            }
+        }
+        print
+    }'
+}
+
+# A commit message is a string git stores; it is never executed. Blank it out so that
+# "guard against rm -rf /x" as a commit message does not read as an rm.
+CHECK=$(printf '%s' "$CMD" | strip_data_bodies \
+        | sed -E 's/(git[[:space:]]+commit([[:space:]]+[^|;&]*)?[[:space:]]-m[[:space:]]*)("[^"]*"|'"'"'[^'"'"']*'"'"')/\1""/g')
+
+# The arguments to echo and printf are written out, not run. Drop them too.
+#
+# This is the one piece the old skip line got right, and deleting that line took it away:
+# right after the rewrite, `echo "... rm -rf /x ..." > note.md` started being blocked when
+# it had passed before. Removing a sloppy check removes whatever it was quietly holding up.
+#
+# The difference from the old line: that one exited 0 for the WHOLE command as soon as it
+# started with echo, so `echo hi && rm -rf /x` was waved through. This drops only the
+# arguments and leaves everything after the next |, ; or & in place.
+#
+# Command substitution is the exception: in `echo $(rm -rf /x)` the substitution runs before
+# echo ever sees it. If any is present anywhere, leave the command untouched.
+case "$CHECK" in
+    *'$('*|*'`'*) : ;;
+    *) CHECK=$(printf '%s' "$CHECK" \
+               | sed -E 's/(^|[|;&][[:space:]]*)(echo|printf)[[:space:]]+[^|;&]*/\1\2 /g') ;;
+esac
 
 # Check for destructive commands with paths outside project
-if echo "$CMD" | grep -qE '\brm\b.*(-[a-zA-Z]*[rf]|--(recursive|force))'; then
+if echo "$CHECK" | grep -qE '\brm\b.*(-[a-zA-Z]*[rf]|--(recursive|force))'; then
     # Block absolute paths
-    if echo "$CMD" | grep -qE '\brm\b[^|;]*\s+/[a-zA-Z]'; then
+    if echo "$CHECK" | grep -qE '\brm\b[^|;]*\s+/[a-zA-Z]'; then
         echo "BLOCKED: rm with absolute path" >&2
         echo "Command: $CMD" >&2
         exit 2
     fi
     # Block home directory paths
-    if echo "$CMD" | grep -qE '\brm\b[^|;]*\s+~/'; then
+    if echo "$CHECK" | grep -qE '\brm\b[^|;]*\s+~/'; then
         echo "BLOCKED: rm targeting home directory" >&2
         exit 2
     fi
     # Block parent directory escapes
-    if echo "$CMD" | grep -qE '\brm\b[^|;]*\s+\.\./'; then
+    if echo "$CHECK" | grep -qE '\brm\b[^|;]*\s+\.\./'; then
         echo "BLOCKED: rm escaping project directory" >&2
         exit 2
     fi
 fi
 
 # Block targeting well-known user/system directories
-if echo "$CMD" | grep -qiE '\b(rm|del|Remove-Item)\b.*(Desktop|Applications|Documents|Downloads|Library|Keychain|\.aws|\.ssh)'; then
+if echo "$CHECK" | grep -qiE '\b(rm|del|Remove-Item)\b.*(Desktop|Applications|Documents|Downloads|Library|Keychain|\.aws|\.ssh)'; then
     echo "BLOCKED: targeting system/user directory" >&2
     exit 2
 fi

package/examples/secret-file-read-guard.sh

@@ -22,6 +22,18 @@
 #   }
 # }
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-secret-file-read-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [secret-file-read-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)

package/examples/secret-file-write-guard.sh

@@ -0,0 +1,150 @@
+#!/bin/bash
+# ================================================================
+# secret-file-write-guard.sh — Block writing to secret files via Bash
+# ================================================================
+# PURPOSE:
+#   The bundled Write|Edit guard blocks writing to .env, private keys
+#   and credential files. It cannot see the same write done through
+#   Bash, because Bash hooks receive a command string, not a file_path.
+#
+#   So today the same intent stops or passes depending on the route:
+#
+#     Write tool  -> ~/app/.env          BLOCKED by the bundled guard
+#     cp k.env ~/app/.env                passes
+#     sed -i 's/A/B/' ~/app/.env         passes
+#     printf '%s' "$K" >> ~/app/.env     passes
+#     curl -s https://x/k -o ~/app/.env  passes
+#
+#   Measured on 2026-09-04 against all 914 example hooks: none of them
+#   target a Bash write into a secret file. Five of the eleven forms do
+#   stop, for adjacent reasons -- ssh-key-protect.sh (private-key copy),
+#   dotenv-commit-guard.sh (`git add .env`), no-base64-exfil.sh,
+#   env-inline-secret-guard.sh (a key string inline) and a banned-command
+#   list. The write itself was not covered anywhere.
+#
+#   This matters more because the route changed. In my own transcripts
+#   (measured 2026-09-04, 21,938 file-changing operations over 51 days),
+#   edits made through Bash were 40.4% up to 08-13 and 64.0% from 08-16,
+#   on a near-identical volume (10,880 vs 11,058 operations).
+#   Moving the boundary anywhere in August gives +8.7 to +23.6 points and
+#   never flips sign, so this is a drift across the month, not a
+#   single-day switch. I cannot date it from my own records.
+#
+#   Claude Code does tell some sessions to prefer Bash over the
+#   Read/Edit/Write tools (feature flag bashActFirstEnabled; assignment is
+#   per session, so "it does not happen here" is not evidence it does not
+#   happen). My transcripts carry 152 `"type":"auto_mode"` attachments,
+#   every one with bashFirst:true -- and 67 of them in sessions that were
+#   NOT in bypass permissions mode. Audit your own with:
+#     grep -rho '"type":"auto_mode"[^}]*}' ~/.claude/projects/ | sort | uniq -c
+#   I have not proven that this caused the shift measured above.
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Bash"
+#
+# (TRIGGER and MATCHER are on separate lines on purpose. Chapter 89 of the
+#  incident book measured that the installer cannot pick up MATCHER when the
+#  two are written on one line — it falls back to the default "Bash". Here the
+#  default happens to be correct, so the mistake would stay invisible until
+#  someone changed the matcher. Verified: installing this hook reports
+#  `matcher: "Bash"`, and secret-file-read-guard.sh, whose MATCHER is on its
+#  own line, correctly reports `matcher: "Read|Grep"`.)
+#
+# DECISION: exit 2 = block. This is a "stop and confirm" guard, not a
+#   ban: creating a .env from .env.example is allowed, and so is
+#   reading. Only writes into a secret file are stopped.
+# ================================================================
+
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-secret-file-write-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [secret-file-write-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
+[ -z "$COMMAND" ] && exit 0
+
+# A path that names a secret file. Templates are deliberately excluded:
+# `cp .env.example .env` is how projects are normally set up.
+SECRET='(\.env(\.[A-Za-z0-9_-]+)?|[A-Za-z0-9_.-]+\.(pem|key|p12|pfx)|id_rsa|id_ed25519|credentials|secrets?\.(json|ya?ml|txt)|\.netrc|\.npmrc)'
+TEMPLATE='\.env\.(example|sample|template|dist)'
+
+is_template_target() {
+  # true when the ONLY secret-looking token being written to is a template
+  printf '%s' "$1" | grep -qE "$TEMPLATE\s*$"
+}
+
+block() {
+  echo "BLOCKED: writing to a secret file through Bash ($1). Check if this is intentional." >&2
+  echo "         The bundled Write|Edit guard cannot see Bash writes; this hook covers that gap." >&2
+  exit 2
+}
+
+# 1. Redirection into a secret file:  > .env   >> ~/app/.env   >| ~/app/.env
+TARGET=$(printf '%s' "$COMMAND" | grep -oE '>>?\|?[[:space:]]*[^|;&[:space:]]+' | tail -1 | sed -E 's/^>>?\|?[[:space:]]*//')
+if [ -n "$TARGET" ] && printf '%s' "$TARGET" | grep -qE "$SECRET" && ! printf '%s' "$TARGET" | grep -qE "$TEMPLATE"; then
+  block "redirect"
+fi
+
+# 2. tee into a secret file
+if printf '%s' "$COMMAND" | grep -qE "\btee\b([[:space:]]+-[A-Za-z]+)*[[:space:]]+[^|;&[:space:]]*$SECRET" \
+   && ! printf '%s' "$COMMAND" | grep -qE "\btee\b[^|;&]*$TEMPLATE"; then
+  block "tee"
+fi
+
+# 3. in-place edit:  sed -i ... .env   perl -i ... .env
+if printf '%s' "$COMMAND" | grep -qE '\b(sed|perl)\b[^|;&]*[[:space:]]-i' \
+   && printf '%s' "$COMMAND" | grep -qE "$SECRET" \
+   && ! printf '%s' "$COMMAND" | grep -qE "$TEMPLATE"; then
+  block "in-place edit"
+fi
+
+# 4. copy/move INTO a secret file (the destination is the last argument).
+#    `cp .env.example .env` is how projects are set up, so the SOURCE is
+#    checked too: copying a template into place is allowed, copying a real
+#    secret file into a new location is not.
+if printf '%s' "$COMMAND" | grep -qE '\b(cp|mv|install|rsync|scp)\b'; then
+  FIRST=$(printf '%s' "$COMMAND" | sed -E 's/[|;&].*$//')
+  DEST=$(printf '%s' "$FIRST" | awk '{print $NF}')
+  SRC=$(printf '%s' "$FIRST" | awk 'NF>2 {print $(NF-1)}')
+  if printf '%s' "$DEST" | grep -qE "$SECRET" && ! printf '%s' "$DEST" | grep -qE "$TEMPLATE"; then
+    if ! printf '%s' "$SRC" | grep -qE "$TEMPLATE"; then
+      block "copy/move into"
+    fi
+  fi
+fi
+
+# 5. write straight into a secret file via an option:
+#    curl -o .env / wget -O .env / dd of=.env / openssl -out .env
+# Longest option first: alternation is tried left to right, so `-o` placed
+# before `-out` would match the `-o` of `-out` and capture "ut <path>".
+OPT=$(printf '%s' "$COMMAND" | grep -oE '(--output-document|--output|-out|-o|-O)[[:space:]=]+[^|;&[:space:]]+|\bof=[^|;&[:space:]]+' | tail -1)
+if [ -n "$OPT" ] && printf '%s' "$OPT" | grep -qE "$SECRET" && ! printf '%s' "$OPT" | grep -qE "$TEMPLATE"; then
+  block "write via option"
+fi
+
+# 6. replace or empty a secret file without writing content into it:
+#    truncate -s 0 .env / ln -sf other .env
+if printf '%s' "$COMMAND" | grep -qE '\b(truncate|ln)\b'; then
+  LAST=$(printf '%s' "$COMMAND" | sed -E 's/[|;&].*$//' | awk '{print $NF}')
+  if printf '%s' "$LAST" | grep -qE "$SECRET" && ! printf '%s' "$LAST" | grep -qE "$TEMPLATE"; then
+    block "truncate/symlink"
+  fi
+fi
+
+# ── Known limits (deliberately not claimed as complete) ───────────
+# A write performed *inside* an interpreter is invisible here, because the
+# command string carries the program, not the file operation:
+#     python3 -c "open('.env','w').write(k)"
+#     node -e "require('fs').writeFileSync('.env', k)"
+# The same is true of any wrapper script that decides the path at runtime.
+# Measured on 2026-09-04 against 46 forms in total: 29 (12 that must block,
+# 17 that must pass) plus 17 sibling forms. It stops every form except the
+# two interpreter ones above, and raises no false positive on the 17 that
+# must pass. That is a count, not a guarantee: forms absent from the table
+# were never tested. If the interpreter route matters to you,
+# pair this with permissions.deny on the paths themselves, which is enforced
+# by the tool layer rather than by string matching.
+exit 0

package/examples/sensitive-file-read-guard.sh

@@ -21,15 +21,35 @@
 #
 # TRIGGER: PreToolUse  MATCHER: "Read"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-sensitive-file-read-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [sensitive-file-read-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
 
 [ -z "$FILE" ] && exit 0
 
-# Block private key files
-if echo "$FILE" | grep -qiE '(id_rsa|id_ed25519|id_ecdsa|id_dsa)$'; then
+# Block private key files.
+# The suffix group matters: a backup of a private key is exactly as sensitive
+# as the key. Three rounds of measurement on CC 2.1.246 (2026-08-29) widened it:
+#   bare "$" anchor      -> id_rsa.bak, id_rsa_old, id_rsa.orig walked through
+#   single optional group -> id_rsa~ (editor backup), id_rsa.old.2 (two suffixes)
+#                            and a trailing space still walked through
+# The last one is why the repeat count is 0-3 and why [[:space:]]* is here:
+# "id_rsa " is a different string to a matcher and the same file to a reader.
+# ".pub" is deliberately NOT in the suffix list, so public keys still pass.
+if echo "$FILE" | grep -qiE '(id_rsa|id_ed25519|id_ecdsa|id_dsa)(([._-](bak|old|orig|save|copy|backup|[0-9]+))|~){0,3}[[:space:]]*$'; then
     # Allow .pub files
-    echo "$FILE" | grep -qiE '\.pub$' && exit 0
+    echo "$FILE" | grep -qiE '\.pub[[:space:]]*$' && exit 0
     echo "BLOCKED: Reading private key file: $FILE" >&2
     echo "  Private keys should never be read into conversation context." >&2
     exit 2

package/examples/sensitive-log-guard.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 #
 # TRIGGER: PreToolUse  MATCHER: "Edit|Write"
 INPUT=$(cat)

package/examples/server-side-prompt-injection-detector.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+# server-side-prompt-injection-detector.sh — Detect missing opt-outs for v2.1.150+ server-side system prompt injection
+#
+# Background:
+#   v2.1.150 introduced server-side system prompt injection via the `tengu_heron_brook`
+#   GrowthBook feature flag and the `client_data` field of the bootstrap API response.
+#   Both are cached to disk and refresh every 60 seconds. The injected string is
+#   registered as a peer-level system prompt section alongside `anti_verbosity`,
+#   `thinking_guidance`, `action_caution`, etc.
+#
+#   This means Anthropic (or anyone who compromises the GrowthBook account or a
+#   proxy in front of it) can silently inject arbitrary instructions into an agent
+#   with shell access. No notification, no opt-in, no audit trail.
+#
+#   Reference: https://github.com/anthropics/claude-code/issues/62061 (46+ reactions)
+#   Anthropic's response: they run experiments on system prompts; opt-out via env vars.
+#
+# What this hook does:
+#   On SessionStart, check whether the two opt-out env vars are set:
+#     - CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1  (disables bootstrap client_data)
+#     - DISABLE_GROWTHBOOK=1                        (disables tengu_heron_brook flag sync)
+#   If either is unset, print a one-line advisory to stderr with the env-var name and
+#   a reference to #62061. The hook never blocks the session.
+#
+# When this hook does NOT fire a warning:
+#   - Both env vars are exported and set to 1
+#   - The user has set CC_PROMPT_INJECTION_DETECTOR_QUIET=1 (acknowledged the trade-off)
+#
+# Hook config (settings.json):
+# {
+#   "hooks": {
+#     "SessionStart": [{
+#       "matcher": "",
+#       "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/server-side-prompt-injection-detector.sh" }]
+#     }]
+#   }
+# }
+
+# Allow user to silence the warning entirely after acknowledging
+if [ "${CC_PROMPT_INJECTION_DETECTOR_QUIET:-0}" = "1" ]; then
+    exit 0
+fi
+
+MISSING=()
+
+if [ "${CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:-0}" != "1" ]; then
+    MISSING+=("CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC")
+fi
+
+if [ "${DISABLE_GROWTHBOOK:-0}" != "1" ]; then
+    MISSING+=("DISABLE_GROWTHBOOK")
+fi
+
+if [ "${#MISSING[@]}" -eq 0 ]; then
+    exit 0
+fi
+
+# Print a compact advisory. The hook is intentionally non-blocking — server-side
+# prompt injection is a documented Anthropic feature, not a fault. The user opts
+# out by exporting the two env vars in their shell rc.
+echo "ADVISORY: v2.1.150+ server-side system-prompt injection is active." >&2
+echo "  Missing opt-out env var(s): ${MISSING[*]}" >&2
+echo "  Background: Anthropic refreshes the 'tengu_heron_brook' GrowthBook flag every 60s and" >&2
+echo "  the bootstrap 'client_data' field on session start; both are injected into your system" >&2
+echo "  prompt with no client-side audit trail. Reference: #62061." >&2
+echo "  To opt out: export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 DISABLE_GROWTHBOOK=1" >&2
+echo "  To silence this hook (acknowledged): export CC_PROMPT_INJECTION_DETECTOR_QUIET=1" >&2
+
+exit 0

package/examples/session-agent-cost-limiter.sh

@@ -17,6 +17,18 @@
 # MATCHER: "Agent"
 # CATEGORY: cost-control
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-session-agent-cost-limiter-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [session-agent-cost-limiter]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
 [ "$TOOL" != "Agent" ] && exit 0

package/examples/session-backup-on-start.sh

@@ -36,7 +36,7 @@ KEEP="${CC_SESSION_BACKUP_KEEP:-5}"
 
 # Find the current project's session directory
 CWD=$(pwd)
-PROJECT_NAME=$(printf '%s' "$CWD" | sed 's|/|-|g; s|^-||')
+PROJECT_NAME=$(printf '%s' "$CWD" | sed 's|/|-|g')
 SESSION_DIR="${HOME}/.claude/projects/${PROJECT_NAME}"
 
 if [ ! -d "$SESSION_DIR" ]; then

package/examples/session-cost-alert.sh

@@ -18,6 +18,18 @@
 # MATCHER: ""
 # CATEGORY: cost-control
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-session-cost-alert-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [session-cost-alert]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 
 WARN_THRESHOLD=${CC_COST_WARN:-1}

package/examples/session-drift-guard.sh

@@ -28,6 +28,18 @@
 #
 # Config: CC_DRIFT_WARN=200  CC_DRIFT_BLOCK=500
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-session-drift-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [session-drift-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 

package/examples/session-duration-guard.sh

@@ -18,7 +18,30 @@
 #   CC_SESSION_CRITICAL_HOURS=4  (critical after 4 hours, default)
 # ================================================================
 
-MARKER="/tmp/cc-session-start-$$"
+__CC_HOOK_INPUT=$(cat 2>/dev/null)
+# --- セッション識別子でファイルを分ける (2026-08-09 修正) ---
+# 旧実装は "$$" を使っていたが、$$ はこのスクリプト自身のPIDで呼び出しごとに変わるため、
+# 状態が一度も持続しなかった(実測: 200回呼ぶとファイルが200個でき、中身は全部 1)。
+__CC_SID=""
+if [ -n "${__CC_HOOK_INPUT:-}" ]; then
+  if command -v jq >/dev/null 2>&1; then
+    __CC_SID=$(printf '%s' "$__CC_HOOK_INPUT" | jq -r '.session_id // .sessionId // empty' 2>/dev/null)
+  fi
+  if [ -z "$__CC_SID" ] && command -v python3 >/dev/null 2>&1; then
+    __CC_SID=$(printf '%s' "$__CC_HOOK_INPUT" | python3 -c 'import sys,json
+try:
+    d=json.load(sys.stdin); print(d.get("session_id") or d.get("sessionId") or "")
+except Exception: print("")' 2>/dev/null)
+  fi
+fi
+if [ -n "$__CC_SID" ]; then
+  __CC_KEY=$(printf '%s' "$__CC_SID" | tr -c 'A-Za-z0-9_-' '_' | cut -c1-64)
+else
+  __CC_KEY="nosession-$(date +%Y%m%d)"
+fi
+# --- ここまで ---
+
+MARKER="/tmp/cc-session-start-$__CC_KEY"
 WARN_HOURS="${CC_SESSION_WARN_HOURS:-2}"
 CRITICAL_HOURS="${CC_SESSION_CRITICAL_HOURS:-4}"
 
@@ -29,7 +52,7 @@ if [ ! -f "$MARKER" ]; then
 fi
 
 # Check every 50 tool calls (not every call)
-COUNTER="/tmp/cc-duration-counter-$$"
+COUNTER="/tmp/cc-duration-counter-$__CC_KEY"
 COUNT=$(cat "$COUNTER" 2>/dev/null || echo 0)
 COUNT=$((COUNT + 1))
 echo "$COUNT" > "$COUNTER"

package/examples/session-index-repair.sh

@@ -37,7 +37,7 @@ fi
 # Claude Code uses the cwd path (with slashes replaced by dashes) as the project dir name
 CWD=$(pwd)
 # Convert path to Claude's project directory naming scheme
-PROJECT_NAME=$(printf '%s' "$CWD" | sed 's|/|-|g; s|^-||')
+PROJECT_NAME=$(printf '%s' "$CWD" | sed 's|/|-|g')
 SESSION_DIR="${PROJECT_DIR}/${PROJECT_NAME}"
 
 if [ ! -d "$SESSION_DIR" ]; then

package/examples/session-memory-watchdog.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 MAX_RSS_MB="${CC_MAX_RSS_MB:-4096}"
 CHECK_INTERVAL=300
 PID_FILE="/tmp/cc-memory-watchdog.pid"

package/examples/session-permission-reset-guard.sh

@@ -15,6 +15,18 @@
 # TRIGGER: PreToolUse
 # MATCHER: "Bash"
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-session-permission-reset-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [session-permission-reset-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0