cc-safe-setup 29.8.0 → 30.0.5

package/index.mjs

@@ -1,25 +1,87 @@
 #!/usr/bin/env node
 
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, copyFileSync, unlinkSync } from 'fs';
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, copyFileSync, unlinkSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { homedir } from 'os';
 import { createInterface } from 'readline';
 import { fileURLToPath } from 'url';
+import { createHash } from 'crypto';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const HOME = homedir();
-const HOOKS_DIR = join(HOME, '.claude', 'hooks');
-const SETTINGS_PATH = join(HOME, '.claude', 'settings.json');
+
+// Install target resolves to CLAUDE_PROJECT_DIR if set (per-profile / per-project
+// installs where the env var points at the directory that hosts .claude/).
+// Falls back to HOME for the historical default behavior so existing single-profile
+// users see no change. Resolves issue #145.
+// Logs and profiles intentionally remain HOME-based (see joins later in this file)
+// because they aggregate state across projects; making them per-project would
+// silently change semantics for anyone running multiple projects today.
+const CLAUDE_BASE = process.env.CLAUDE_PROJECT_DIR || HOME;
+const HOOKS_DIR = join(CLAUDE_BASE, '.claude', 'hooks');
+const SETTINGS_PATH = join(CLAUDE_BASE, '.claude', 'settings.json');
 
 // Convert Windows backslash paths to bash-compatible forward slashes
 const toBashPath = (p) => p.replace(/\\/g, '/');
 
+// One block record is "[timestamp] BLOCKED: reason | cmd: command".
+// A blocked command may itself span several lines (heredocs, multi-line scripts),
+// and those continuation lines land in the log without a timestamp. Counting raw
+// non-empty lines therefore reports more blocks than actually happened — measured
+// at +7,480 on 100,897 real records (+7.4%) in a 5-month log. Anchor on the record
+// shape instead of the line count so the numbers we show users are the real ones.
+const BLOCK_RECORD_RE = /^\[([^\]]+)\]\s*BLOCKED:\s*(.+?)\s*\|\s*cmd:\s*(.+)$/;
+const readBlockRecords = (path) => {
+  if (!existsSync(path)) return [];
+  return readFileSync(path, 'utf-8').split('\n').filter(l => BLOCK_RECORD_RE.test(l));
+};
+
 const c = {
   reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
   red: '\x1b[31m', green: '\x1b[32m', yellow: '\x1b[33m',
   blue: '\x1b[36m',
 };
 
+// settings.json が存在するのに JSON として壊れている時、それを {} として扱ってはいけない。
+// 呼び出し側は直後に settings を書き戻すので、利用者のフック・権限・環境変数が
+// まるごと新しいオブジェクトで上書きされて消える。壊れているなら書かずに止める。
+// いちばん多い引き金は、記事や README から写した設定例の先頭にある
+// `// path/to/file` というコメント行で、これは JSON として不正になる。
+function readSettingsForWrite() {
+  if (!existsSync(SETTINGS_PATH)) return {};
+  try {
+    return JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8'));
+  } catch (e) {
+    console.error('');
+    console.error(c.red + '  ✗' + c.reset + ' ' + SETTINGS_PATH + ' is not valid JSON (' + e.message + ')');
+    console.error('    Refusing to write: doing so would replace every hook, permission');
+    console.error('    and env var you already have with a fresh file.');
+    console.error('');
+    console.error('    Check it with:  python3 -m json.tool ' + SETTINGS_PATH);
+    console.error('    A leading "// path/to/file" comment line is the usual cause.');
+    console.error('');
+    process.exit(1);
+  }
+}
+
+
+// Days remaining until Anthropic's 2026-06-15 programmatic-billing split.
+// Computed at run time so the CLI banner stays accurate without daily edits —
+// hardcoded counts drifted (lines once read "23 days" and "20 days" on the same
+// install) and that drift is the exact claim-vs-reality pattern CVH warns about.
+// Compares calendar dates in the local timezone so the count matches what users
+// would naturally count off a calendar (UTC-based math drifts by a day for JST).
+function daysUntilJune15() {
+  const now = new Date();
+  const today = new Date(now.getFullYear(), now.getMonth(), now.getDate());
+  const target = new Date(2026, 5, 15);
+  const diff = Math.round((target - today) / 86400000);
+  // Return the raw signed difference so callers can distinguish "still upcoming"
+  // (positive) from "already happened" (zero or negative). Clamping to 0 here
+  // made the post-install banner say "in 0 days" forever after June 15, 2026.
+  return diff;
+}
+
 const SCRIPTS = JSON.parse(readFileSync(join(__dirname, 'scripts.json'), 'utf-8'));
 
 const HOOKS = {
@@ -76,6 +138,16 @@ const LEARN = process.argv.includes('--learn');
 const SCAN = process.argv.includes('--scan');
 const FULL = process.argv.includes('--full');
 const DOCTOR = process.argv.includes('--doctor');
+// Installing a hook copies the file. Nothing ever copies it back, so a hook
+// installed in March keeps running its March logic forever — including bugs
+// fixed here months ago. Nothing in the CLI could tell you that until now.
+const OUTDATED = process.argv.includes('--outdated');
+// --outdated can now name a stale core guard, but core guards are strings inside
+// scripts.json rather than files under examples/, so --install-example cannot
+// fetch one. Without a way to read the shipped body, the report would name a
+// problem the reader has no way to act on.
+const SHOW_CORE_IDX = process.argv.findIndex(a => a === '--show-core');
+const SHOW_CORE = SHOW_CORE_IDX !== -1 ? process.argv[SHOW_CORE_IDX + 1] : null;
 const WATCH = process.argv.includes('--watch');
 const EXPORT = process.argv.includes('--export');
 const IMPORT_IDX = process.argv.findIndex(a => a === '--import');
@@ -86,6 +158,7 @@ const LINT = process.argv.includes('--lint');
 const DIFF_IDX = process.argv.findIndex(a => a === '--diff');
 const DIFF_FILE = DIFF_IDX !== -1 ? process.argv[DIFF_IDX + 1] : null;
 const SHARE = process.argv.includes('--share');
+const SCORECARD = process.argv.includes('--scorecard') || process.argv.includes('--card');
 const BENCHMARK = process.argv.includes('--benchmark');
 const DASHBOARD = process.argv.includes('--dashboard');
 const ISSUES = process.argv.includes('--issues');
@@ -94,6 +167,11 @@ const GENERATE_CI = process.argv.includes('--generate-ci');
 const REPORT = process.argv.includes('--report');
 const QUICKFIX = process.argv.includes('--quickfix');
 const SHIELD = process.argv.includes('--shield');
+// --shield は以前、~/.claude/hooks/ にある *すべて* の .sh を settings.json へ登録していた。
+// 出所を問わないので、他のツールが置いたフックも、利用者が意図して登録を外したフックも、
+// 走らせるたびに黙って復活した。実害3回(2026-06-10 / 2026-07-27 に2回)。
+// 既定を「今回このコマンドが設置したものだけ」に変え、以前の挙動はこの旗で選ぶ。
+const ADOPT_EXISTING = process.argv.includes('--adopt-existing');
 const OPUS47 = process.argv.includes('--opus47');
 const ANALYZE = process.argv.includes('--analyze');
 const TEAM = process.argv.includes('--team');
@@ -110,6 +188,7 @@ const PROFILE = PROFILE_IDX !== -1 ? process.argv[PROFILE_IDX + 1] : null;
 const COMPARE_IDX = process.argv.findIndex(a => a === '--compare');
 const COMPARE = COMPARE_IDX !== -1 ? { a: process.argv[COMPARE_IDX + 1], b: process.argv[COMPARE_IDX + 2] } : null;
 const REPLAY = process.argv.includes('--replay');
+const BLINDSPOTS = process.argv.includes('--blindspots');
 const SAVE_PROFILE_IDX = process.argv.findIndex(a => a === '--save-profile');
 const SAVE_PROFILE = SAVE_PROFILE_IDX !== -1 ? process.argv[SAVE_PROFILE_IDX + 1] : null;
 const CREATE_IDX = process.argv.findIndex(a => a === '--create');
@@ -137,9 +216,11 @@ if (HELP) {
   cc-safe-setup — Make Claude Code safe for autonomous operation
 
   Quick Start:
-    npx cc-safe-setup              Install 8 safety hooks (30 sec)
-    npx cc-safe-setup --shield     Maximum safety — one command
-    npx cc-safe-setup --doctor     Diagnose hook problems
+    npx github:yurukusa/cc-safe-setup             Install 8 safety hooks (30 sec)
+    npx github:yurukusa/cc-safe-setup --shield    Maximum safety — one command
+    npx github:yurukusa/cc-safe-setup --doctor    Diagnose hook problems
+    (the npm entry is frozen at 29.8.0 / 2026-04-20 and lets twenty-five
+     command shapes through that the current code blocks — install from GitHub)
 
   Protect:
     --protect .env                 Block edits to a specific file
@@ -149,7 +230,7 @@ if (HELP) {
     --safe-mode                    Emergency: disable all hooks
 
   Install & Configure:
-    --install-example <name>       Install from 300+ example hooks
+    --install-example <name>       Install from 916 example hooks
     --examples                     Browse examples by category
     --from-claudemd                Convert CLAUDE.md rules into hooks
     --rules [file]                 Compile YAML rules into hooks
@@ -159,11 +240,14 @@ if (HELP) {
 
   Diagnose & Monitor:
     --status / --verify            Check installed hooks / test them
+    --outdated                     Which installed hooks differ from current ones
     --doctor                       13-point diagnostic
     --audit [--fix] [--json]       Safety score 0-100
+    --scorecard [--json]           Shareable safety scorecard (screenshot it)
     --watch                        Live blocked command feed
     --health                       Hook health dashboard
     --suggest                      Predict risks from project analysis
+    --blindspots                   What your guards never see, vs. your own sessions
 
   Manage:
     --dry-run / --uninstall        Preview / remove hooks
@@ -173,11 +257,11 @@ if (HELP) {
 
   More: --create, --why, --replay, --score, --changelog, --analyze,
         --benchmark, --dashboard, --migrate-from, --init-project
-    npx cc-safe-setup --quickfix   Auto-detect and fix common Claude Code problems
-    npx cc-safe-setup --stats      Block statistics and patterns report
-    npx cc-safe-setup --export     Export hooks config for team sharing
-    npx cc-safe-setup --import <file>  Import hooks from exported config
-    npx cc-safe-setup --help       Show this help
+    --quickfix                     Auto-detect and fix common Claude Code problems
+    --stats                        Block statistics and patterns report
+    --export                       Export hooks config for team sharing
+    --import <file>                Import hooks from exported config
+    --help                         Show this help
 
   Hooks installed:
     destructive-guard    Blocks rm -rf, git reset --hard, NFS mount detection
@@ -196,6 +280,9 @@ if (HELP) {
   Token Checkup: https://yurukusa.github.io/cc-safe-setup/token-checkup.html
   Token Book:    https://yurukusa.github.io/cc-safe-setup/token-book.html
   Safety Guide:  https://zenn.dev/yurukusa/books/6076c23b1cb18b
+
+  Hitting nested sub-agent dispatch (Task tool absent from sub-agent contexts)?
+  See: https://gist.github.com/yurukusa/cf477f03f03d9f93c184f1fb7d894f96
 `);
   process.exit(0);
 }
@@ -304,15 +391,25 @@ function status() {
     console.log(c.bold + '  All ' + installed + ' hooks installed.' + c.reset);
   } else {
     console.log(c.bold + '  ' + installed + '/' + Object.keys(HOOKS).length + ' hooks installed.' + c.reset);
-    console.log('  ' + c.dim + 'Run: npx cc-safe-setup' + c.reset);
+    console.log('  ' + c.dim + 'Run: npx github:yurukusa/cc-safe-setup' + c.reset);
   }
   if (installedExamples.length > 0) {
     console.log('  ' + c.dim + '+ ' + installedExamples.length + ' example hooks' + c.reset);
   }
   console.log();
-  console.log(c.dim + '  Tip: --validate to check health · --simulate "cmd" to test · --shield for max safety' + c.reset);
+  console.log(c.dim + '  Tip: --validate to check health · --scorecard for a shareable safety card · --shield for max safety' + c.reset);
+  console.log();
+  console.log('  ' + c.dim + 'On a team? Roll one shared safety baseline out across every repo (free playbook):' + c.reset);
+  console.log('  ' + c.dim + '  https://yurukusa.github.io/cc-safe-setup/team-rollout-guide.html' + c.reset);
   console.log();
 
+  const daysLeft1 = daysUntilJune15();
+  const june15msg1 = daysLeft1 > 0
+    ? 'Anthropic splits programmatic billing in ' + daysLeft1 + (daysLeft1 === 1 ? ' day' : ' days') + '.'
+    : 'Anthropic\'s programmatic billing split is in effect (since June 15, 2026).';
+  console.log('  ' + c.yellow + '⚠ June 15:' + c.reset + c.dim + ' ' + june15msg1 + c.reset);
+  console.log('  ' + c.dim + '  Diagnose any unexpected charge: https://htmlpreview.github.io/?https://gist.githubusercontent.com/yurukusa/d3a0e2403cc4078aa0183400c137d824/raw/wrong-charge-diagnostic.html' + c.reset);
+  console.log();
   // Exit code for CI: 0 = all installed, 1 = missing hooks
   if (missing > 0) process.exit(1);
 }
@@ -337,8 +434,14 @@ async function verify() {
     { hook: 'branch-guard', input: '{"tool_input":{"command":"git push --force origin feature"}}', expect: 2, desc: 'blocks force-push' },
     { hook: 'destructive-guard', input: '{"tool_input":{"command":"git reset --hard HEAD~5"}}', expect: 2, desc: 'blocks git reset --hard' },
     { hook: 'destructive-guard', input: '{"tool_input":{"command":"sudo rm -rf /var"}}', expect: 2, desc: 'blocks sudo + destructive' },
+    { hook: 'destructive-guard', input: '{"tool_input":{"command":"cd /tmp && sudo rm -rf myproject"}}', expect: 2, desc: 'blocks sudo after a separator' },
     { hook: 'destructive-guard', input: '{"tool_input":{"command":"Remove-Item -Recurse -Force *"}}', expect: 2, desc: 'blocks PowerShell Remove-Item' },
     { hook: 'destructive-guard', input: '{"tool_input":{"command":"Remove-Item ./file.txt"}}', expect: 0, desc: 'allows single file Remove-Item' },
+    { hook: 'branch-guard', input: '{"tool_input":{"command":"npm test && git push --force origin main"}}', expect: 2, desc: 'blocks chained force-push (compound)' },
+    { hook: 'secret-guard', input: '{"tool_input":{"command":"cd app && git add .env"}}', expect: 2, desc: 'blocks chained git add .env (compound)' },
+    { hook: 'destructive-guard', input: '{"tool_input":{"command":"rm --recursive --force /"}}', expect: 2, desc: 'blocks rm long-form flags' },
+    { hook: 'destructive-guard', input: '{"tool_input":{"command":"find / -print0 | xargs -0 rm -rf"}}', expect: 2, desc: 'blocks xargs rm -rf' },
+    { hook: 'destructive-guard', input: '{"tool_input":{"command":"echo Y20gLXJmIC8= | base64 -d | bash"}}', expect: 2, desc: 'blocks base64-to-shell obfuscation' },
   ];
 
   let pass = 0, fail = 0;
@@ -372,7 +475,7 @@ async function verify() {
   console.log();
   console.log(c.bold + '  ' + pass + '/' + (pass + fail) + ' tests passed.' + c.reset);
   if (fail > 0) {
-    console.log('  ' + c.red + fail + ' failures.' + c.reset + ' Run ' + c.blue + 'npx cc-safe-setup' + c.reset + ' to reinstall.');
+    console.log('  ' + c.red + fail + ' failures.' + c.reset + ' Run ' + c.blue + 'npx github:yurukusa/cc-safe-setup' + c.reset + ' to reinstall.');
     process.exit(1);
   }
   console.log();
@@ -651,6 +754,7 @@ function examples() {
       'schema-migration-guard.sh': 'Warn on database schema migrations without backup',
       'scope-guard.sh': 'Block file operations outside the project directory',
       'secret-file-read-guard.sh': 'Block Read/Grep of files containing secrets',
+      'secret-file-write-guard.sh': 'Block Bash writes into .env, keys and credential files (the bundled Write|Edit guard cannot see them)',
       'self-modify-bypass-guard.sh': 'Auto-allow .claude/ writes in bypass mode',
       'sensitive-file-read-guard.sh': 'Block reading sensitive system/user files',
       'sensitive-log-guard.sh': 'Sensitive Log Guard',
@@ -663,7 +767,7 @@ function examples() {
       'ssh-key-protect.sh': 'Block reading/copying SSH private keys',
       'staged-secret-scan.sh': 'Block git commit if staged diff contains secrets',
       'strict-allowlist.sh': 'Only allow explicitly permitted commands',
-      'strip-coauthored-by.sh': 'Remove or warn about Co-Authored-By trailers',
+      'strip-coauthored-by.sh': 'Warn on Co-Authored-By trailers; block commits leaking the private Claude-Session URL (#69669)',
       'symlink-guard.sh': 'Detect symlink/junction traversal before rm',
       'symlink-protect.sh': 'Symlink Protect',
       'system-package-guard.sh': 'Block system-level package installations',
@@ -739,6 +843,7 @@ function examples() {
       'webfetch-domain-allow.sh': 'Auto-approve WebFetch for allowed domains',
     },
     'Quality': {
+      'grep-nul-false-negative-guard.sh': 'Warn when Grep reports "no matches" but files under the searched path contain NUL bytes, which Grep skips silently',
       'bash-secret-output-detector.sh': 'Warn when Bash output contains secrets',
       'bashrc-safety-check.sh': 'Warn about .bashrc lines that hang in non-interactive shells',
       'branch-name-check.sh': 'Warn when creating branches with non-standard names',
@@ -914,6 +1019,8 @@ function examples() {
       'yaml-syntax-check.sh': 'Validate YAML after editing',
     },
     'Monitoring': {
+      'model-version-alert.sh': 'Every 50th hook run, read the newest session log and alert when the active model is an older Opus 4.7 build',
+      'worktree-create-log.sh': 'Append branch and path to ~/.claude/worktree-audit.log whenever a worktree is created',
       'api-rate-limit-tracker.sh': 'Track API call frequency and warn on burst',
       'cost-tracker.sh': 'Estimate session token cost',
       'cross-session-error-log.sh': 'Persist error patterns across sessions',
@@ -942,6 +1049,7 @@ function examples() {
       'subagent-error-detector.sh': 'Detect failed subagent results',
     },
     'Recovery': {
+      'auto-push-session-branch.sh': 'Push the current branch to its upstream after each turn, skipping main/master/develop/release and detached HEAD; never fails the turn if the push is rejected',
       'auto-checkpoint.sh': 'Auto-commit after every edit for rollback protection',
       'auto-git-checkpoint.sh': 'Auto Git Checkpoint',
       'auto-snapshot.sh': 'Automatic file snapshots before every edit',
@@ -1019,7 +1127,7 @@ function examples() {
       'skill-gate.sh': 'Skill Gate',
       'stale-branch-guard.sh': 'Warn when working on a stale branch',
       'stale-env-guard.sh': 'Warn when .env files are very old',
-      'system-message-workaround.sh': 'Ensure hook warnings reach both user and model',
+      'system-message-workaround.sh': 'Put a non-blocking hook warning in front of the user (stderr)',
       'temp-file-cleanup-stop.sh': 'Clean up tmpclaude-* files on session end',
       'temp-file-cleanup.sh': 'Stop hook',
       'tmp-cleanup.sh': 'Clean up /tmp/claude-*-cwd temp files',
@@ -1039,6 +1147,7 @@ function examples() {
       'subagent-budget-guard.sh': 'Subagent Budget Guard',
       'subagent-claudemd-inject.sh': 'Inject CLAUDE.md rules into subagent prompts',
       'subagent-context-size-guard.sh': 'Warn on thin subagent prompts',
+      'subagent-forged-system-reminder-guard.sh': 'Quarantine forged <system-reminder> markup in a subagent result',
       'subagent-scope-guard.sh': 'Limit subagent file access scope',
       'subagent-scope-validator.sh': 'Validate subagent task scope before launch',
       'subagent-tool-call-limiter.sh': 'Limit total tool calls per session',
@@ -1056,7 +1165,14 @@ function examples() {
 
   console.log();
   console.log(c.bold + '  cc-safe-setup --examples' + c.reset + (filter ? ' ' + filter : ''));
-  const totalExamples = Object.values(CATEGORIES).reduce((sum, cat) => sum + Object.keys(cat).length, 0);
+  // The catalogue below is hand-maintained; examples/ is the source of truth.
+  // Count the directory so the header never understates what ships.
+  const catalogued = new Set(Object.values(CATEGORIES).flatMap((cat) => Object.keys(cat)));
+  let onDisk = [];
+  try {
+    onDisk = readdirSync(join(__dirname, 'examples')).filter((f) => f.endsWith('.sh'));
+  } catch { /* running from a package without examples/: fall back to the catalogue */ }
+  const totalExamples = onDisk.length || catalogued.size;
   console.log(c.dim + `  ${totalExamples} hooks beyond the 8 built-in ones` + c.reset);
   if (filter) console.log(c.dim + '  Filter: ' + filter + c.reset);
   console.log();
@@ -1080,6 +1196,27 @@ function examples() {
     console.log();
   }
 
+  // examples/ に在るのに目録へ登録されていないものを、実体から拾って並べる。
+  // 目録は手で維持しているので放っておくと置き去りが増える（2026-08-02の実測で258本が
+  // 「--install-example では入るのに一覧に出ない」状態だった）。実体を正として漏れを拾う。
+  const uncatalogued = onDisk.filter((f) => !catalogued.has(f)).sort();
+  if (uncatalogued.length > 0) {
+    const described = uncatalogued.map((f) => [f, describeExample(f)]);
+    const shown = filter
+      ? described.filter(([f, d]) =>
+          f.toLowerCase().includes(filter) || d.toLowerCase().includes(filter))
+      : described;
+    if (shown.length > 0) {
+      console.log('  ' + c.bold + c.blue + 'Not yet categorized' + c.reset +
+        c.dim + ` (${uncatalogued.length}, listed straight from examples/)` + c.reset);
+      for (const [file, desc] of shown) {
+        console.log('  ' + c.green + '*' + c.reset + ' ' + c.bold + file + c.reset);
+        console.log('    ' + c.dim + desc + c.reset);
+      }
+      console.log();
+    }
+  }
+
   // Show batch install command if filtered
   const allFiltered = [];
   for (const [cat, hooks] of Object.entries(CATEGORIES)) {
@@ -1095,17 +1232,49 @@ function examples() {
   if (filter && allFiltered.length > 0 && allFiltered.length <= 20) {
     console.log(c.dim + '  Install all filtered hooks:' + c.reset);
     for (const h of allFiltered) {
-      console.log(c.dim + `    npx cc-safe-setup --install-example ${h}` + c.reset);
+      console.log(c.dim + `    npx github:yurukusa/cc-safe-setup --install-example ${h}` + c.reset);
     }
     console.log();
   }
 
   console.log(c.dim + '  Or install any single hook:' + c.reset);
-  console.log(c.dim + '    npx cc-safe-setup --install-example <name>' + c.reset);
+  console.log(c.dim + '    npx github:yurukusa/cc-safe-setup --install-example <name>' + c.reset);
   console.log(c.dim + '  Source: ' + c.blue + 'https://github.com/yurukusa/cc-safe-setup/tree/main/examples' + c.reset);
   console.log();
 }
 
+// Pull a one-line description out of an example hook's header comment.
+// Skips the shebang, rule-off lines and machine headings (Trigger:, Matcher: ...),
+// and joins wrapped lines until the sentence ends. Used for hooks that are not in
+// the hand-maintained catalogue, so the listing can still say what they do.
+function describeExample(filename) {
+  try {
+    const lines = readFileSync(join(__dirname, 'examples', filename), 'utf8').split('\n').slice(1, 25);
+    const isRule = (l) => /^[#\s]*[-=*_]{5,}\s*$/.test(l);
+    const isHeading = (t) => /^(Trigger|Matcher|Usage|Exit|Event|Hook|Install|Requires|Note|See|Env|Author|License|Version|SPDX|PURPOSE)\b/i.test(t);
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!line.startsWith('#')) { if (line.trim() === '') continue; break; }
+      let t = line.replace(/^#+/, '').trim();
+      if (!t || isRule(line) || isHeading(t)) continue;
+      const named = t.match(new RegExp('^' + filename.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\s*[\u2014\u2013-]\\s*(.+)$'));
+      if (named) t = named[1].trim();
+      if (t.length < 10) continue;
+      for (let j = i + 1; j < Math.min(i + 5, lines.length); j++) {
+        if (/[.。]$/.test(t.trim())) break;
+        const nxt = lines[j];
+        if (!nxt.startsWith('#')) break;
+        const cont = nxt.replace(/^#+/, '').trim();
+        if (!cont || isRule(nxt) || isHeading(cont)) break;
+        if (cont === cont.toUpperCase() && cont.length > 3) break;
+        t += ' ' + cont;
+      }
+      return t.replace(/\s+/g, ' ').trim();
+    }
+  } catch { /* unreadable: fall through */ }
+  return 'no description in the hook header';
+}
+
 async function installExample(name) {
   const examplesDir = join(__dirname, 'examples');
   const filename = name.endsWith('.sh') ? name : name + '.sh';
@@ -1126,15 +1295,108 @@ async function installExample(name) {
 
   // Parse hook header for matcher and trigger
   const content = readFileSync(srcPath, 'utf8');
+
+  // Three examples are standalone tools that say so in their own header
+  // ("Event: standalone CLI, not a Claude Code hook", "This is NOT a hook").
+  // They carry no TRIGGER line, so the defaults below used to register them
+  // on PreToolUse/Bash anyway. mcp-stdio-compatibility-test exits 2 when it
+  // cannot read settings.json, and exit 2 on PreToolUse denies the call — so
+  // installing that "test harness" turned every Bash call into a hard denial,
+  // with nothing in the output explaining why. Copy the file (the user asked
+  // for it) but do not wire it into settings.
+  //
+  // The check is anchored to comment lines in the first 25 lines so that prose
+  // mentioning "the standalone Anthropic CLI" does not trip it: measured over
+  // all 910 examples it matches exactly these 3, and none of the 716 files
+  // that declare a TRIGGER.
+  const header = content.split('\n').slice(0, 25).join('\n');
+  if (/^#.*\bnot a (?:claude code )?hook\b/im.test(header)) {
+    const usage = (header.match(/^#\s*Usage:\s*(.+)$/mi) || [])[1];
+    console.log();
+    console.log(c.yellow + '  Copied, but NOT registered as a hook.' + c.reset);
+    console.log(c.dim + '  ' + filename + ' declares in its own header that it is not a' + c.reset);
+    console.log(c.dim + '  Claude Code hook — it is a tool you run by hand. Registering it' + c.reset);
+    console.log(c.dim + '  would run it before every tool call, and a non-zero exit would' + c.reset);
+    console.log(c.dim + '  block that call.' + c.reset);
+    console.log();
+    console.log('  File:  ' + destPath);
+    console.log('  Run:   ' + (usage ? usage.trim() : 'bash ' + destPath));
+    console.log();
+    return;
+  }
+
   let trigger = 'PreToolUse';
   let matcher = 'Bash';
 
   // Detect trigger from header comments (case-insensitive for "Trigger:" prefix)
-  const triggerMatch = content.match(/^#\s*[Tt][Rr][Ii][Gg][Gg][Ee][Rr]:\s*(\S+)/m);
+  //
+  // The value is read as the whole rest of the line, not the first \S+ token.
+  // Measured over all 915 examples on 2026-09-18: ten headers declare a trigger
+  // the old `(\S+)` capture could not match, and every one of them fell through
+  // to the default PreToolUse/Bash without a word:
+  //
+  //   "Stop, UserPromptSubmit"            -> captured "Stop,"   (trailing comma)
+  //   "SessionStart, and PreToolUse"      -> captured "SessionStart,"
+  //   "PostToolUse+PreToolUse  MATCHER:"  -> captured the whole blob
+  //   "SubagentStop"                      -> a real event missing from the list
+  //   "none"                              -> a wrapper that must not be wired
+  //
+  // Two of those ten can exit 2 (commitment-carry-forward-arrest and
+  // subagent-forged-system-reminder-guard). Registered on PreToolUse/Bash, an
+  // exit 2 denies the Bash call — so a hook written to refuse a *Stop* was
+  // refusing ordinary shell commands instead. That is the same failure mode the
+  // standalone-tool guard above was written for.
+  //
+  // The event list was also two lists that had drifted apart: this one and
+  // KNOWN_EVENTS in the settings auditor, which already knew SubagentStop,
+  // SubagentStart, PostCompact and DirectoryAdded. Anything those two disagree
+  // on silently became PreToolUse, so they are reconciled here.
+  const REGISTRABLE_EVENTS = [
+    'PreToolUse', 'PostToolUse', 'PermissionRequest', 'Notification',
+    'Stop', 'SubagentStop', 'SubagentStart', 'UserPromptSubmit',
+    'PreCompact', 'PostCompact', 'SessionStart', 'SessionEnd',
+    'CwdChanged', 'FileChanged', 'DirectoryAdded',
+  ];
+  const triggerMatch = content.match(/^#\s*[Tt][Rr][Ii][Gg][Gg][Ee][Rr]:\s*(.+)$/m);
   if (triggerMatch) {
-    const t = triggerMatch[1];
-    if (['PermissionRequest','PostToolUse','Notification','Stop','SessionStart','PreCompact','SessionEnd','UserPromptSubmit','CwdChanged','FileChanged'].includes(t)) {
-      trigger = t;
+    // Stop at MATCHER: so the inline "TRIGGER: X  MATCHER: "Y"" form does not
+    // leak the matcher's tool names into the event scan.
+    // Drop parenthetical commentary before scanning for event names. Several
+    // headers qualify their choice in parentheses — multi-vendor-concurrent-warner
+    // says "SessionStart   (also safe as PreToolUse)" — and reading the aside as a
+    // declaration moves a correctly-registered hook off its event.
+    const decl = triggerMatch[1]
+      .split(/[Mm][Aa][Tt][Cc][Hh][Ee][Rr]\s*:/)[0]
+      .replace(/\([^)]*\)/g, ' ');
+    const names = (decl.match(/[A-Za-z]+/g) || []).filter((w) => REGISTRABLE_EVENTS.includes(w));
+    if (/^\s*none\b/i.test(decl)) {
+      // "TRIGGER: none" is a deliberate declaration by wrappers that are called
+      // by another hook, never by Claude Code. Copy it, do not register it.
+      console.log();
+      console.log(c.yellow + '  Copied, but NOT registered as a hook.' + c.reset);
+      console.log(c.dim + '  ' + filename + ' declares "TRIGGER: none" — it is a wrapper meant' + c.reset);
+      console.log(c.dim + '  to be called by another hook, not by Claude Code directly.' + c.reset);
+      console.log();
+      console.log('  File:  ' + destPath);
+      console.log();
+      return;
+    }
+    if (names.length > 0) {
+      // Multi-event declarations get ONE registration, so the choice matters.
+      // Prefer PreToolUse whenever it is declared: it is the only event where a
+      // non-zero exit refuses the tool call, and the two-phase guards
+      // (deny-bypass-detector, permission-denial-enforcer) declare
+      // "PostToolUse+PreToolUse" while doing their blocking with exit 2. Taking
+      // the literal first name would have moved them to PostToolUse, where the
+      // tool has already run and exit 2 blocks nothing — disarming the guard
+      // while the installer reported success.
+      trigger = names.includes('PreToolUse') ? 'PreToolUse' : names[0];
+      if (names.length > 1) {
+        // Only one registration is written. Say so, rather than leaving the
+        // operator believing all declared events are covered.
+        console.log(c.yellow + '  ' + filename + ' declares ' + names.length + ' events (' + names.join(', ') + ').' + c.reset);
+        console.log(c.dim + '  Registered on ' + names[0] + ' only — add the others by hand if you need them.' + c.reset);
+      }
     }
   } else if (content.match(/^#.*PermissionRequest hook/m)) {
     trigger = 'PermissionRequest';
@@ -1150,6 +1412,44 @@ async function installExample(name) {
     // Extract quoted value if present (e.g., ".env" or ".env|.env.local"), otherwise use raw
     const quoted = commentMatcher[1].match(/^"([^"]*)"/);
     matcher = quoted ? quoted[1] : commentMatcher[1].trim();
+    // Some headers answer "which matcher?" in prose instead of with a value:
+    //   "(none)", "(any — leave matcher empty)", "(empty — runs after every
+    //   tool use)", "No matcher support — fires on every compaction".
+    // That prose was written into settings.json as the matcher itself. On an
+    // event that actually uses matchers, "(any — leave matcher empty)" matches
+    // no tool name, so the hook never fires. Measured over all 915 examples on
+    // 2026-09-18: 29 headers are prose, and four of them sit on
+    // PreToolUse/PostToolUse and were dead this way — context-size-alert,
+    // daily-usage-tracker, settings-integrity-monitor, tool-call-rate-limiter.
+    // Every one of the 29 means the same thing: no matcher, i.e. empty.
+    if (!quoted && /^\(|—|no matcher support|leave matcher|runs (after|once)|fires on/i.test(matcher)) {
+      matcher = '';
+    }
+  }
+
+  // The header is written two ways across examples/: on its own comment line
+  // (handled above) and appended to the TRIGGER line, as
+  // "# TRIGGER: PostToolUse  MATCHER: "Edit|Write"". Only the first form was
+  // recognised, so 415 of 908 examples silently fell back to the default
+  // matcher "Bash" — 221 of those declare another tool (Edit|Write and the
+  // like) and therefore never fired at all, and 46 declare "" (every tool) and
+  // were narrowed to Bash only. A guard that installs without error and then
+  // never runs is the worst failure this project has.
+  //
+  // Deliberately additive: the inline form is consulted only when neither the
+  // own-line comment nor an in-file "matcher" JSON resolved one. 31 examples
+  // carry an inline header that disagrees with a JSON snippet in the same file
+  // (e.g. auto-checkpoint declares Bash in the header and Edit|Write in the
+  // JSON) and which one is right has to be settled per file. Preferring the
+  // inline form here would flip those 31 silently, so their behaviour is left
+  // exactly as it is today and the conflict is tracked separately.
+  if (!commentMatcher && !matcherMatch) {
+    const inlineMatcher = content.match(
+      /^#\s*[Tt][Rr][Ii][Gg][Gg][Ee][Rr]:\s*\S+\s+[Mm][Aa][Tt][Cc][Hh][Ee][Rr]:\s*(.+)$/m);
+    if (inlineMatcher) {
+      const quoted = inlineMatcher[1].match(/^"([^"]*)"/);
+      matcher = quoted ? quoted[1] : inlineMatcher[1].trim();
+    }
   }
 
   // Update settings.json
@@ -1182,6 +1482,13 @@ async function installExample(name) {
 }
 
 async function audit() {
+  // When --json is set, machine consumers (the GitHub Action, CI) parse stdout
+  // as pure JSON. Route the human-readable report to stderr so stdout carries
+  // only the JSON object emitted below. Without this, the colored report
+  // printed ahead of the JSON made stdout unparseable, the Action scored it 0,
+  // and every CI run failed (default threshold 70).
+  const _stdoutLog = console.log;
+  if (JSON_OUTPUT) console.log = (...a) => console.error(...a);
   console.log();
   console.log(c.bold + '  cc-safe-setup --audit' + c.reset);
   console.log(c.dim + '  Analyzing your Claude Code safety setup...' + c.reset);
@@ -1192,8 +1499,22 @@ async function audit() {
 
   // 1. Check if any PreToolUse hooks exist
   let settings = {};
+  // A settings.json that exists but does not parse is the worst case, not a neutral
+  // one: Claude Code ignores the whole file, so every hook declared in it is inert.
+  // Swallowing the parse error here made the checks below report "no PreToolUse
+  // hooks" and send the user to reinstall — a true symptom with the cause hidden.
+  // The usual trigger is a copied snippet that starts with a `// path/to/file`
+  // comment line, which is not legal JSON.
   if (existsSync(SETTINGS_PATH)) {
-    try { settings = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8')); } catch(e) {}
+    try {
+      settings = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8'));
+    } catch (e) {
+      risks.push({
+        severity: 'CRITICAL',
+        issue: 'settings.json is not valid JSON (' + e.message + ') — Claude Code ignores the entire file, so every hook declared in it is silently inert',
+        fix: 'python3 -m json.tool ' + SETTINGS_PATH + '   # then delete the offending line; a leading "// path" comment is the usual cause'
+      });
+    }
   }
   const preHooks = (settings.hooks?.PreToolUse || []);
   const postHooks = (settings.hooks?.PostToolUse || []);
@@ -1203,7 +1524,7 @@ async function audit() {
     risks.push({
       severity: 'CRITICAL',
       issue: 'No PreToolUse hooks — destructive commands (rm -rf, git reset --hard) can run unchecked',
-      fix: 'npx cc-safe-setup'
+      fix: 'npx github:yurukusa/cc-safe-setup'
     });
   } else {
     good.push('PreToolUse hooks installed (' + preHooks.length + ')');
@@ -1215,7 +1536,7 @@ async function audit() {
     risks.push({
       severity: 'HIGH',
       issue: 'No destructive command blocker detected — rm -rf /, git reset --hard could execute',
-      fix: 'npx cc-safe-setup (installs destructive-guard)'
+      fix: 'npx github:yurukusa/cc-safe-setup (installs destructive-guard)'
     });
   } else {
     good.push('Destructive command protection detected');
@@ -1226,7 +1547,7 @@ async function audit() {
     risks.push({
       severity: 'HIGH',
       issue: 'No branch push protection — code could be pushed directly to main/master',
-      fix: 'npx cc-safe-setup (installs branch-guard)'
+      fix: 'npx github:yurukusa/cc-safe-setup (installs branch-guard)'
     });
   } else {
     good.push('Branch push protection detected');
@@ -1237,7 +1558,7 @@ async function audit() {
     risks.push({
       severity: 'HIGH',
       issue: 'No secret leak protection — .env files could be committed via git add .',
-      fix: 'npx cc-safe-setup (installs secret-guard)'
+      fix: 'npx github:yurukusa/cc-safe-setup (installs secret-guard)'
     });
   } else {
     good.push('Secret leak protection detected');
@@ -1248,7 +1569,7 @@ async function audit() {
     risks.push({
       severity: 'MEDIUM',
       issue: 'No database wipe protection — migrate:fresh, prisma migrate reset could wipe data',
-      fix: 'npx cc-safe-setup --install-example block-database-wipe'
+      fix: 'npx github:yurukusa/cc-safe-setup --install-example block-database-wipe'
     });
   } else {
     good.push('Database wipe protection detected');
@@ -1259,16 +1580,40 @@ async function audit() {
     risks.push({
       severity: 'MEDIUM',
       issue: 'No PostToolUse hooks — no automatic syntax checking after edits',
-      fix: 'npx cc-safe-setup (installs syntax-check)'
+      fix: 'npx github:yurukusa/cc-safe-setup (installs syntax-check)'
     });
   } else {
     good.push('PostToolUse hooks installed (' + postHooks.length + ')');
   }
 
   // 7. Check for CLAUDE.md
+  //
+  // Claude Code walks up the directory tree to find CLAUDE.md, so the audit has
+  // to walk up too. Looking only at the working directory told anyone who ran
+  // this from a subdirectory of their own project "No CLAUDE.md found" while
+  // Claude Code was loading one the whole time. The walk stops at the first
+  // directory holding .git (that is the project root), at HOME, or at the
+  // filesystem root, whichever comes first.
   const CC_DIR = join(HOME, '.claude');
-  const claudeMdPaths = ['CLAUDE.md', '.claude/CLAUDE.md', join(CC_DIR, 'CLAUDE.md')];
-  const hasClaudeMd = claudeMdPaths.some(p => existsSync(p));
+  const ancestorDirs = [];
+  {
+    let d = process.cwd();
+    for (let i = 0; i < 24; i++) {
+      ancestorDirs.push(d);
+      let atRoot = false;
+      try { atRoot = existsSync(join(d, '.git')); } catch {}
+      if (atRoot || d === HOME) break;
+      const parent = dirname(d);
+      if (parent === d) break;
+      d = parent;
+    }
+  }
+  const claudeMdPaths = [...new Set([
+    ...ancestorDirs.flatMap(d => [join(d, 'CLAUDE.md'), join(d, '.claude', 'CLAUDE.md')]),
+    join(CC_DIR, 'CLAUDE.md'),
+    join(CLAUDE_BASE, '.claude', 'CLAUDE.md')
+  ])];
+  const hasClaudeMd = claudeMdPaths.some(p => { try { return existsSync(p); } catch { return false; } });
   if (!hasClaudeMd) {
     risks.push({
       severity: 'MEDIUM',
@@ -1284,7 +1629,7 @@ async function audit() {
     risks.push({
       severity: 'LOW',
       issue: 'No dotfile protection — ~/.bashrc, ~/.aws/ could be modified',
-      fix: 'npx cc-safe-setup --install-example protect-dotfiles'
+      fix: 'npx github:yurukusa/cc-safe-setup --install-example protect-dotfiles'
     });
   }
 
@@ -1293,7 +1638,7 @@ async function audit() {
     risks.push({
       severity: 'LOW',
       issue: 'No scope guard — files outside project directory could be modified',
-      fix: 'npx cc-safe-setup --install-example scope-guard'
+      fix: 'npx github:yurukusa/cc-safe-setup --install-example scope-guard'
     });
   }
 
@@ -1305,21 +1650,186 @@ async function audit() {
     risks.push({
       severity: 'CRITICAL',
       issue: `${backslashCmds.length} hook command(s) have Windows backslash paths — hooks will fail with "No such file"`,
-      fix: 'npx cc-safe-setup --uninstall && npx cc-safe-setup@latest'
+      fix: 'npx github:yurukusa/cc-safe-setup --uninstall && npx github:yurukusa/cc-safe-setup'
     });
   }
 
-  // 11. Check for hook permission fixer (SessionStart)
+  // 11. Check for hook permission fixer (SessionStart).
+  // Execute-bit loss is cross-platform, not Windows-only: plugin installs and
+  // archive extraction strip +x from .sh hooks on Unix too, and Claude Code then
+  // fails every affected hook with "Permission denied".
+  // See anthropics/claude-code #39378 / #38901 / #39777 / #39798.
   const sessionHooks = settings.hooks?.SessionStart || [];
   const hasPermFixer = sessionHooks.some(e =>
     (e.hooks || []).some(h => (h.command || '').includes('permission'))
   );
-  if (!hasPermFixer && process.platform === 'win32') {
+  if (!hasPermFixer) {
+    // Only flag when there is real evidence it is needed, to avoid noise:
+    // a hook script that actually lacks the execute bit, or a plugins dir that
+    // can introduce non-executable hooks on the next update.
+    let nonExecCount = 0;
+    let pluginsPresent = false;
+    try {
+      const { readdirSync, statSync } = await import('fs');
+      if (existsSync(HOOKS_DIR)) {
+        for (const f of readdirSync(HOOKS_DIR)) {
+          if (!f.endsWith('.sh')) continue;
+          try { if (!(statSync(join(HOOKS_DIR, f)).mode & 0o111)) nonExecCount++; } catch {}
+        }
+      }
+      const pluginsDir = join(CLAUDE_BASE, '.claude', 'plugins');
+      pluginsPresent = existsSync(pluginsDir);
+    } catch {}
+    if (nonExecCount > 0) {
+      risks.push({
+        severity: 'HIGH',
+        issue: `${nonExecCount} hook script(s) in ~/.claude/hooks lack the execute bit — Claude Code will fail them with "Permission denied" (anthropics/claude-code #39378)`,
+        fix: 'npx github:yurukusa/cc-safe-setup --validate   (one-shot fix) or --install-example hook-permission-fixer (persistent)'
+      });
+    } else if (pluginsPresent || process.platform === 'win32') {
+      risks.push({
+        severity: 'LOW',
+        issue: 'No SessionStart permission fixer — plugin installs/updates can strip hook execute bits, causing "Permission denied"',
+        fix: 'npx github:yurukusa/cc-safe-setup --install-example hook-permission-fixer'
+      });
+    }
+  }
+
+  // 12. Cross-layer check: a rule that names a safety net which is not there.
+  //
+  // Every check above reads one layer. This one reads two against each other:
+  // the instructions in CLAUDE.md, and the hooks actually registered in the
+  // settings files. A rule that names a guard by filename passes every check
+  // you can run on the rule (the sentence is fine) and every check you can run
+  // on the config (the hooks that *are* registered are valid) — the
+  // contradiction lives between them, so nothing that reads one file sees it.
+  //
+  // Precision is worth more than recall here: telling someone a working guard
+  // is inert would make them distrust the whole report. So only backticked,
+  // space-free, script-shaped tokens count; resolution is tried against every
+  // plausible root; and "never registered" is decided against the raw text of
+  // every settings file that could register it, not just the user one.
+  // CLAUDE_BASE and HOME are the same for a plain install and different for an
+  // isolated one, so both have to be read. Reading only CLAUDE_BASE drops the
+  // user's global layer the moment CLAUDE_PROJECT_DIR is set, and the check
+  // then goes silent on a real finding -- the same shape as the mis-report
+  // fixed in #1046, where the diagnosis did not follow the installer.
+  const settingsTexts = [];
+  const seenPaths = new Set();
+  const readOnce = (p) => {
+    if (seenPaths.has(p)) return;
+    seenPaths.add(p);
+    try { if (existsSync(p)) settingsTexts.push(readFileSync(p, 'utf-8')); } catch {}
+  };
+  for (const base of [CLAUDE_BASE, HOME, process.cwd()]) {
+    readOnce(join(base, '.claude', 'settings.json'));
+    readOnce(join(base, '.claude', 'settings.local.json'));
+  }
+  const registrationText = settingsTexts.join('\n');
+
+  // Same set the check above resolves: every ancestor up to the project root,
+  // plus the user layer. A rule two directories up is still a rule that binds.
+  const layerFiles = claudeMdPaths
+    .filter(p => { try { return existsSync(p); } catch { return false; } });
+
+  const hookDirs = [...new Set([HOOKS_DIR, join(HOME, '.claude', 'hooks')])];
+  const namedScripts = new Map();
+  for (const layer of layerFiles) {
+    let text = '';
+    try { text = readFileSync(layer, 'utf-8'); } catch { continue; }
+    for (const m of text.matchAll(/`([^`\n]+)`/g)) {
+      const tok = m[1].trim();
+      // A script this check can reason about: one token, no glob, no URL, and
+      // an extension Claude Code can actually run as a hook.
+      if (!/^[\w./~@+-]+\.(sh|mjs|py|js)$/.test(tok)) continue;
+      if (tok.includes('*') || tok.startsWith('http')) continue;
+      // Build output is absent on a fresh checkout and present after `npm run
+      // build`, so its absence says nothing about the rule. Measured against 40
+      // public CLAUDE.md files on 2026-08-13: 13 named a script, and one of the
+      // two that named something missing was `dist/extension.js` — a compiled
+      // artifact, not a broken reference.
+      if (/(^|\/)(dist|build|out|target|coverage|node_modules|\.next|\.nuxt|__pycache__)\//.test(tok)) continue;
+      if (namedScripts.has(tok)) continue;
+      const base = tok.split('/').pop();
+      const roots = [];
+      if (tok.startsWith('~/')) roots.push(join(HOME, tok.slice(2)));
+      else if (tok.startsWith('/')) roots.push(tok);
+      else {
+        roots.push(join(dirname(layer), tok));
+        roots.push(join(process.cwd(), tok));
+        roots.push(join(CLAUDE_BASE, '.claude', tok));
+        roots.push(join(HOME, '.claude', tok));
+      }
+      for (const hd of hookDirs) roots.push(join(hd, base));
+      const resolved = roots.find(p => { try { return existsSync(p); } catch { return false; } }) || null;
+      namedScripts.set(tok, { base, resolved });
+    }
+  }
+
+  if (namedScripts.size > 0) {
+    const missing = [];
+    const unregistered = [];
+    for (const [tok, info] of namedScripts) {
+      if (!info.resolved) { missing.push(tok); continue; }
+      // Only a file sitting in the hooks directory can be "registered". A helper
+      // script your rules tell *you* to run has no business in settings.json,
+      // and flagging it would be the false positive that kills the report.
+      let hooksHome = null;
+      for (const hd of hookDirs) {
+        try { if (existsSync(join(hd, info.base))) { hooksHome = hd; break; } } catch {}
+      }
+      if (!hooksHome) continue;
+      info.hooksHome = hooksHome;
+      if (!registrationText.includes(info.base)) unregistered.push(tok);
+    }
+    const sample = (arr) => arr.slice(0, 4).join(', ') + (arr.length > 4 ? ', …' : '');
+
+    if (missing.length > 0) {
+      risks.push({
+        severity: 'HIGH',
+        issue: `${missing.length} rule(s) in CLAUDE.md name a script that exists nowhere I looked (${sample(missing)}) — the rule reads fine and the config is valid, so no single-file check can surface this`,
+        fix: 'Open each rule and either create the file or delete the rule. A rule naming a file Claude cannot find is not a weak rule, it is an unfollowable one.'
+      });
+    }
+    if (unregistered.length > 0) {
+      risks.push({
+        severity: 'HIGH',
+        issue: `${unregistered.length} hook script(s) named by CLAUDE.md sit in ${namedScripts.get(unregistered[0]).hooksHome} but appear in no settings file (${sample(unregistered)}) — they exist, so every existence check passes, and they never run`,
+        fix: 'npx github:yurukusa/cc-safe-setup --doctor   # then register the ones you meant to keep, or delete them so the rule stops promising a guard you do not have'
+      });
+    }
+    if (missing.length === 0 && unregistered.length === 0) {
+      good.push('Every script named in CLAUDE.md resolves, and the hook-directory ones are registered (' + namedScripts.size + ' checked)');
+    }
+  }
+
+  // 13. A blocking hook that parses its input with `echo "$VAR" | jq` fails
+  // open on Debian and Ubuntu. Claude Code runs an inline hook command through
+  // /bin/sh, which is dash there, and dash's echo interprets backslash escapes.
+  // The payload is JSON, so a newline inside a command or a file's content
+  // arrives as the two characters \n; dash turns those into a real newline
+  // inside a JSON string, the parser rejects the document, the variable comes
+  // back empty, and the line that normally follows -- [ -z "$CMD" ] && exit 0
+  // -- is an affirmative approval.
+  //
+  // Measured 2026-09-03 against this project's own plugin hooks: all four
+  // guards approved everything under /bin/sh, and every local test passed
+  // because the tests ran the same commands under bash. Nothing in the log
+  // says anything is wrong; the hook is reported as "success".
+  //
+  // Only hooks that can block are reported. A logger that loses a field is a
+  // cosmetic bug; a guard that loses it stops being a guard.
+  const failOpenCmds = allCmds.filter(cmd =>
+    /echo\s+"\$[A-Za-z_][A-Za-z0-9_]*"\s*\|\s*(jq|python3?|node)\b/.test(cmd) &&
+    /exit\s+2\b/.test(cmd));
+  if (failOpenCmds.length > 0) {
     risks.push({
-      severity: 'LOW',
-      issue: 'No SessionStart permission fixer — plugin updates may break hook permissions on Windows',
-      fix: 'npx cc-safe-setup --install-example hook-permission-fixer'
+      severity: 'HIGH',
+      issue: `${failOpenCmds.length} blocking hook(s) parse input with \`echo "$VAR" | parser\` — under /bin/sh (dash) a payload containing an escape breaks the parse, the variable empties, and the guard exits 0 (allow)`,
+      fix: 'Replace `echo "$INPUT" |` with `printf %s "$INPUT" |` in those hook commands'
     });
+  } else if (allCmds.some(cmd => /\|\s*(jq|python3?|node)\b/.test(cmd))) {
+    good.push('Hook input parsing survives /bin/sh (no `echo "$VAR" | parser` in a blocking hook)');
   }
 
   // Display results
@@ -1332,7 +1842,17 @@ async function audit() {
   }
 
   if (risks.length === 0) {
-    console.log(c.green + c.bold + '  No risks detected. Your setup looks solid.' + c.reset);
+    // 「危険は見つからなかった」と「危険は無い」は別のことなのに、
+    // 前の文面（Your setup looks solid）は後者に読めた。安全を売る道具で
+    // 誤って安心させる側へ倒れるのは、見落とす側より高くつく。
+    // 何を見て何を見ていないかを、その場で並べる。
+    console.log(c.green + c.bold + '  No risks found in the checks this command runs.' + c.reset);
+    console.log();
+    console.log(c.dim + '  Checked:     settings.json (permissions, hooks), and the scripts your' + c.reset);
+    console.log(c.dim + '               CLAUDE.md names against what your settings register.' + c.reset);
+    console.log(c.dim + '  Not checked: whether a registered hook actually refuses anything' + c.reset);
+    console.log(c.dim + '               (audit/selftest.sh), whether your hooks match the shape of' + c.reset);
+    console.log(c.dim + '               the commands you really run (--blindspots), and your CI.' + c.reset);
   } else {
     console.log(c.bold + '  ⚠ Risks found (' + risks.length + '):' + c.reset);
     console.log();
@@ -1358,9 +1878,9 @@ async function audit() {
     console.log(c.bold + '  Applying fixes...' + c.reset);
     const { execSync } = await import('child_process');
     for (const r of risks) {
-      if (r.fix.startsWith('npx cc-safe-setup')) {
+      if (r.fix.startsWith('npx github:yurukusa/cc-safe-setup')) {
         try {
-          const cmd = r.fix.replace('npx cc-safe-setup', 'node ' + process.argv[1]);
+          const cmd = r.fix.replace('npx github:yurukusa/cc-safe-setup', 'node ' + process.argv[1]);
           console.log('  ' + c.dim + '→ ' + r.fix + c.reset);
           execSync(cmd, { stdio: 'inherit' });
         } catch(e) {
@@ -1372,7 +1892,7 @@ async function audit() {
     console.log(c.green + '  Re-run --audit to verify fixes.' + c.reset);
   } else if (risks.length > 0) {
     console.log();
-    console.log(c.dim + '  Run with --fix to auto-apply: npx cc-safe-setup --audit --fix' + c.reset);
+    console.log(c.dim + '  Run with --fix to auto-apply: npx github:yurukusa/cc-safe-setup --audit --fix' + c.reset);
   }
 
   // Badge output
@@ -1395,11 +1915,44 @@ async function audit() {
       passing: good,
       timestamp: new Date().toISOString(),
     };
+    console.log = _stdoutLog; // restore: the JSON object must reach stdout
     console.log(JSON.stringify(output, null, 2));
   }
 
-  console.log();
-  process.exit(score < (parseInt(process.env.CC_AUDIT_THRESHOLD) || 0) ? 1 : 0);
+  // Highest-intent moment: the user just saw their score. Point to genuinely
+  // useful free next steps (skip when --json so machine consumers stay clean).
+  // A low score → the incident-prevention guide fits; everyone gets the cost guide.
+  if (!JSON_OUTPUT) {
+    console.log();
+    console.log(c.bold + '  Go deeper (all free to start):' + c.reset);
+    if (score < 80) {
+      // Lead the low-score (peak-concern) path with the free incident catalog,
+      // not a book link: the 100 real incidents validate the abstract risks just
+      // shown and cost nothing, so the deeper path stays free-education-first.
+      console.log(c.dim + '  • 100 real incidents these guards prevent:  https://yurukusa.github.io/cc-safe-setup/incidents.html' + c.reset);
+      console.log(c.dim + '  • Incident-prevention guide (Ch.3 free):  https://zenn.dev/yurukusa/books/6076c23b1cb18b' + c.reset);
+    }
+    console.log(c.dim + '  • Cut token cost (Ch.1 free):  https://yurukusa.github.io/cc-safe-setup/token-book.html' + c.reset);
+  }
+
+  console.log();
+  // README has told people to put `--audit --ci` in a workflow since this section
+  // was written, and until 2026-09-03 nothing here read `--ci`. The default
+  // threshold is 0 and the score cannot go below 0, so `score < 0` was never true:
+  // the step passed no matter what the audit found. A CI gate that cannot fail is
+  // worse than no gate, because the reader stops watching. `--ci` now fails on any
+  // risk; CC_AUDIT_THRESHOLD keeps working for score-based gating either way.
+  // 門の線は CRITICAL/HIGH。any-risk で落とすと、この道具が薦める構成のままでも
+  // MEDIUM 1件で赤くなり、利用者は真っ先にこの step を外す——落ちない門と同じ結末になる。
+  const ciMode = process.argv.includes('--ci');
+  const threshold = parseInt(process.env.CC_AUDIT_THRESHOLD) || 0;
+  const blocking = risks.filter(r => r.severity === 'CRITICAL' || r.severity === 'HIGH');
+  if (ciMode && !JSON_OUTPUT) {
+    console.log(c.dim + `  --ci: fails on CRITICAL or HIGH only (${blocking.length} of ${risks.length} risk${risks.length === 1 ? '' : 's'} here).` + c.reset);
+    console.log(c.dim + '        Set CC_AUDIT_THRESHOLD to also fail below a score.' + c.reset);
+    console.log();
+  }
+  process.exit((score < threshold || (ciMode && blocking.length > 0)) ? 1 : 0);
 }
 
 function learn() {
@@ -1417,8 +1970,7 @@ function learn() {
     return;
   }
 
-  const log = readFileSync(logPath, 'utf-8');
-  const lines = log.split('\n').filter(l => l.trim());
+  const lines = readBlockRecords(logPath);
 
   if (lines.length === 0) {
     console.log(c.green + '  No blocked commands in history. Your setup is catching nothing (or everything is safe).' + c.reset);
@@ -1505,7 +2057,7 @@ exit 0`;
 
     if (!process.argv.includes('--apply')) {
       console.log();
-      console.log(c.dim + '  Run with --apply to auto-create hooks: npx cc-safe-setup --learn --apply' + c.reset);
+      console.log(c.dim + '  Run with --apply to auto-create hooks: npx github:yurukusa/cc-safe-setup --learn --apply' + c.reset);
     }
   }
 
@@ -1560,7 +2112,7 @@ async function testHook(hookName) {
     console.log(c.bold + '  cc-safe-setup --test-hook <name>' + c.reset);
     console.log(c.dim + '  Test any hook with sample inputs.' + c.reset);
     console.log();
-    console.log('  Example: npx cc-safe-setup --test-hook destructive-guard');
+    console.log('  Example: npx github:yurukusa/cc-safe-setup --test-hook destructive-guard');
     return;
   }
 
@@ -1640,13 +2192,13 @@ async function saveProfile(name) {
     const files = existsSync(profilesDir) ? readdirSync(profilesDir).filter(f => f.endsWith('.json')) : [];
     if (files.length === 0) {
       console.log(c.dim + '  No saved profiles yet.' + c.reset);
-      console.log(c.dim + '  Save: npx cc-safe-setup --save-profile my-setup' + c.reset);
+      console.log(c.dim + '  Save: npx github:yurukusa/cc-safe-setup --save-profile my-setup' + c.reset);
     } else {
       for (const f of files) {
         const pName = f.replace('.json', '');
         const data = JSON.parse(readFileSync(join(profilesDir, f), 'utf-8'));
         console.log(`  ${c.bold}${pName}${c.reset} (${data.hooks?.length || 0} hooks, saved ${data.savedAt?.split('T')[0] || '?'})`);
-        console.log(c.dim + `    Load: npx cc-safe-setup --profile ${pName}` + c.reset);
+        console.log(c.dim + `    Load: npx github:yurukusa/cc-safe-setup --profile ${pName}` + c.reset);
       }
     }
     console.log();
@@ -1654,7 +2206,7 @@ async function saveProfile(name) {
   }
 
   // Save current hook state
-  const hookDir = join(HOME, '.claude', 'hooks');
+  const hookDir = HOOKS_DIR;
   const hooks = existsSync(hookDir) ? readdirSync(hookDir).filter(f => f.endsWith('.sh') || f.endsWith('.py')) : [];
 
   const profile = {
@@ -1670,7 +2222,7 @@ async function saveProfile(name) {
   console.log();
   console.log(c.green + `  ✓ Profile "${name}" saved (${hooks.length} hooks)` + c.reset);
   console.log(c.dim + `  File: ${profilePath}` + c.reset);
-  console.log(c.dim + `  Load: npx cc-safe-setup --profile ${name}` + c.reset);
+  console.log(c.dim + `  Load: npx github:yurukusa/cc-safe-setup --profile ${name}` + c.reset);
   console.log();
 }
 
@@ -1701,7 +2253,7 @@ async function scoreOnly() {
   let score = 0;
 
   // Hooks installed (max 50 points)
-  const hookDir = join(HOME, '.claude', 'hooks');
+  const hookDir = HOOKS_DIR;
   const hookCount = existsSync(hookDir) ? readdirSync(hookDir).filter(f => f.endsWith('.sh') || f.endsWith('.py')).length : 0;
   score += Math.min(hookCount * 3, 50);
 
@@ -1897,7 +2449,10 @@ async function suggest() {
 
   // Display results
   if (risks.length === 0) {
-    console.log(c.green + '  No risks detected. Your project looks safe!' + c.reset);
+    // 「危険は無い」ではなく「この検査では見つからなかった」。
+    // ここは設定と依存の走査だけで、実際に打たれた命令の形は読んでいない。
+    console.log(c.green + '  No risks found in the checks this scan runs.' + c.reset);
+    console.log(c.dim + '  It reads configuration, not what you actually run. --blindspots reads that.' + c.reset);
     return;
   }
 
@@ -1918,7 +2473,7 @@ async function suggest() {
       if (isInstalled) {
         console.log(c.green + `     ✓ ${r.hook} (installed)` + c.reset);
       } else {
-        console.log(c.yellow + `     → Install: npx cc-safe-setup --install-example ${r.hook}` + c.reset);
+        console.log(c.yellow + `     → Install: npx github:yurukusa/cc-safe-setup --install-example ${r.hook}` + c.reset);
       }
     } else {
       console.log(c.dim + `     → ${r.reason}` + c.reset);
@@ -1929,7 +2484,7 @@ async function suggest() {
   const unprotected = risks.filter(r => r.hook && !installed.has(r.hook));
   if (unprotected.length > 0) {
     console.log(c.bold + `  ${unprotected.length} unprotected risk(s). Fix all:` + c.reset);
-    console.log(c.yellow + '  npx cc-safe-setup --shield' + c.reset);
+    console.log(c.yellow + '  npx github:yurukusa/cc-safe-setup --shield' + c.reset);
   } else {
     console.log(c.green + '  All detected risks are covered by installed hooks!' + c.reset);
   }
@@ -1966,8 +2521,8 @@ async function why(hookName) {
     console.log(c.dim + '  Show why a hook exists — the real incident that inspired it.' + c.reset);
     console.log();
     console.log('  Examples:');
-    console.log(c.dim + '    npx cc-safe-setup --why destructive-guard' + c.reset);
-    console.log(c.dim + '    npx cc-safe-setup --why token-budget-guard' + c.reset);
+    console.log(c.dim + '    npx github:yurukusa/cc-safe-setup --why destructive-guard' + c.reset);
+    console.log(c.dim + '    npx github:yurukusa/cc-safe-setup --why token-budget-guard' + c.reset);
     console.log();
     console.log(`  ${Object.keys(WHY_DATA).length} hooks have documented incidents.`);
     return;
@@ -1996,7 +2551,7 @@ async function why(hookName) {
     console.log(c.dim + `  GitHub Issue: ${data.issue}` + c.reset);
   }
   console.log();
-  console.log(c.dim + '  Install: npx cc-safe-setup --install-example ' + name + c.reset);
+  console.log(c.dim + '  Install: npx github:yurukusa/cc-safe-setup --install-example ' + name + c.reset);
   console.log();
 }
 
@@ -2084,10 +2639,10 @@ async function guard(description) {
     console.log(c.dim + '  Instantly enforce a rule — generates, installs, and activates a hook.' + c.reset);
     console.log();
     console.log('  Examples:');
-    console.log(c.dim + '    npx cc-safe-setup --guard "never touch the database"' + c.reset);
-    console.log(c.dim + '    npx cc-safe-setup --guard "block all sudo commands"' + c.reset);
-    console.log(c.dim + '    npx cc-safe-setup --guard "no force push"' + c.reset);
-    console.log(c.dim + '    npx cc-safe-setup --guard "warn before deleting files"' + c.reset);
+    console.log(c.dim + '    npx github:yurukusa/cc-safe-setup --guard "never touch the database"' + c.reset);
+    console.log(c.dim + '    npx github:yurukusa/cc-safe-setup --guard "block all sudo commands"' + c.reset);
+    console.log(c.dim + '    npx github:yurukusa/cc-safe-setup --guard "no force push"' + c.reset);
+    console.log(c.dim + '    npx github:yurukusa/cc-safe-setup --guard "warn before deleting files"' + c.reset);
     console.log();
     return;
   }
@@ -2136,10 +2691,7 @@ async function guard(description) {
   console.log(c.green + '  ✓' + c.reset + ` Hook created: ${hookPath}`);
 
   // Register in settings.json
-  let settings = {};
-  if (existsSync(SETTINGS_PATH)) {
-    try { settings = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8')); } catch {}
-  }
+  let settings = readSettingsForWrite();
   if (!settings.hooks) settings.hooks = {};
   if (!settings.hooks[trigger]) settings.hooks[trigger] = [];
 
@@ -2160,7 +2712,7 @@ async function guard(description) {
   console.log();
   console.log(c.dim + `  Rule: "${description}"` + c.reset);
   console.log(c.dim + `  Hook: ${hookName}.sh` + c.reset);
-  console.log(c.dim + '  Remove: npx cc-safe-setup --uninstall' + c.reset);
+  console.log(c.dim + '  Remove: npx github:yurukusa/cc-safe-setup --uninstall' + c.reset);
   console.log();
 }
 
@@ -2230,7 +2782,7 @@ async function diffHooks(otherPath) {
       }
     } else {
       console.log(c.dim + '  No project-level settings found.' + c.reset);
-      console.log(c.dim + '  Create with: npx cc-safe-setup --team' + c.reset);
+      console.log(c.dim + '  Create with: npx github:yurukusa/cc-safe-setup --team' + c.reset);
       console.log();
       console.log(c.bold + '  Global hooks (' + myHooks.size + '):' + c.reset);
       [...myHooks].sort().forEach(h => console.log(`    ${h}`));
@@ -2268,7 +2820,7 @@ async function fromClaudeMd() {
 
   if (!claudeMdPath) {
     console.log(c.yellow + '  No CLAUDE.md found in project.' + c.reset);
-    console.log(c.dim + '  Run: npx cc-safe-setup --shield (creates one)' + c.reset);
+    console.log(c.dim + '  Run: npx github:yurukusa/cc-safe-setup --shield (creates one)' + c.reset);
     return;
   }
 
@@ -2306,7 +2858,7 @@ async function fromClaudeMd() {
   if (matched.length === 0) {
     console.log(c.yellow + '  No enforceable rules detected in CLAUDE.md.' + c.reset);
     console.log(c.dim + '  CLAUDE.md may contain guidelines that can\'t be converted to hooks.' + c.reset);
-    console.log(c.dim + '  For custom hooks: npx cc-safe-setup --create "your rule"' + c.reset);
+    console.log(c.dim + '  For custom hooks: npx github:yurukusa/cc-safe-setup --create "your rule"' + c.reset);
     return;
   }
 
@@ -2320,7 +2872,7 @@ async function fromClaudeMd() {
     const status = installed ? c.dim + '(installed)' + c.reset : '';
     console.log(`  ${icon} ${m.desc} ${status}`);
     if (!installed) {
-      console.log(c.dim + `    npx cc-safe-setup --install-example ${m.hook}` + c.reset);
+      console.log(c.dim + `    npx github:yurukusa/cc-safe-setup --install-example ${m.hook}` + c.reset);
     }
   }
 
@@ -2328,7 +2880,7 @@ async function fromClaudeMd() {
   if (notInstalled.length > 0) {
     console.log();
     console.log(c.bold + `  Install all ${notInstalled.length} missing hooks:` + c.reset);
-    console.log(c.dim + '  npx cc-safe-setup --shield' + c.reset);
+    console.log(c.dim + '  npx github:yurukusa/cc-safe-setup --shield' + c.reset);
   } else {
     console.log();
     console.log(c.green + '  All detected rules are already enforced by hooks!' + c.reset);
@@ -2344,7 +2896,7 @@ async function health() {
 
   if (!existsSync(HOOKS_DIR)) {
     console.log(c.red + '  No hooks directory found.' + c.reset);
-    console.log(c.dim + '  Run: npx cc-safe-setup --shield' + c.reset);
+    console.log(c.dim + '  Run: npx github:yurukusa/cc-safe-setup --shield' + c.reset);
     return;
   }
 
@@ -2396,7 +2948,7 @@ async function health() {
 
   if (issues > 0) {
     console.log();
-    console.log(c.yellow + '  Fix issues: npx cc-safe-setup --quickfix' + c.reset);
+    console.log(c.yellow + '  Fix issues: npx github:yurukusa/cc-safe-setup --quickfix' + c.reset);
   }
 
   // Settings.json hook count
@@ -2479,7 +3031,7 @@ async function migrateFrom(tool) {
       const icon = detected ? c.green + '●' + c.reset : c.dim + '○' + c.reset;
       console.log(`  ${icon} ${c.bold}${id}${c.reset} — ${info.desc}`);
       if (detected) console.log(`    ${c.green}Detected in your settings${c.reset}`);
-      console.log(`    ${c.dim}npx cc-safe-setup --migrate-from ${id}${c.reset}`);
+      console.log(`    ${c.dim}npx github:yurukusa/cc-safe-setup --migrate-from ${id}${c.reset}`);
       console.log();
     }
     return;
@@ -2551,7 +3103,7 @@ async function migrateFrom(tool) {
   console.log(`  ${c.green}${replacements.length}${c.reset} hooks can be replaced with cc-safe-setup equivalents`);
   console.log(`  ${c.dim}${existingHooks.length - replacements.length}${c.reset} hooks will be kept as-is`);
   console.log();
-  console.log(c.dim + '  To apply: npx cc-safe-setup --shield' + c.reset);
+  console.log(c.dim + '  To apply: npx github:yurukusa/cc-safe-setup --shield' + c.reset);
   console.log(c.dim + '  This installs cc-safe-setup hooks alongside existing ones.' + c.reset);
   console.log(c.dim + '  Remove old hooks manually after verifying the new ones work.' + c.reset);
   console.log();
@@ -2664,6 +3216,13 @@ async function team() {
   console.log(c.dim + `  ${installed} hooks installed, ${allHooks.length} total configured.` + c.reset);
   console.log(c.dim + '  Hooks use relative paths (.claude/hooks/) — portable across machines.' + c.reset);
   console.log();
+  // Highest-intent moment: the user just engaged. Offer genuinely useful FREE next
+  // steps first (value-first, not a sales pitch). The deeper paid guides have free
+  // chapters, so they read as "go deeper if this helped" rather than an upsell.
+  console.log(c.bold + '  Go deeper (all free to start):' + c.reset);
+  console.log(c.dim + '  • Cut token cost (Ch.1 free):  https://yurukusa.github.io/cc-safe-setup/token-book.html' + c.reset);
+  console.log(c.dim + '  • Incident-prevention guide (Ch.3 free):  https://zenn.dev/yurukusa/books/6076c23b1cb18b' + c.reset);
+  console.log();
 }
 
 async function profile(level) {
@@ -2715,7 +3274,7 @@ async function profile(level) {
     for (const [name, prof] of Object.entries(PROFILES)) {
       console.log(`  ${c.bold}${name}${c.reset} (${prof.hooks.length} hooks)`);
       console.log(`  ${c.dim}${prof.desc}${c.reset}`);
-      console.log(`  ${c.dim}npx cc-safe-setup --profile ${name}${c.reset}`);
+      console.log(`  ${c.dim}npx github:yurukusa/cc-safe-setup --profile ${name}${c.reset}`);
       console.log();
     }
 
@@ -2731,7 +3290,7 @@ async function profile(level) {
             const data = JSON.parse(readFileSync(join(profilesDir, f), 'utf-8'));
             console.log(`  ${c.bold}${sName}${c.reset} (${data.hooks?.length || 0} hooks)`);
             console.log(`  ${c.dim}Saved ${data.savedAt?.split('T')[0] || '?'}${c.reset}`);
-            console.log(`  ${c.dim}npx cc-safe-setup --profile ${sName}${c.reset}`);
+            console.log(`  ${c.dim}npx github:yurukusa/cc-safe-setup --profile ${sName}${c.reset}`);
             console.log();
           } catch {}
         }
@@ -2778,10 +3337,7 @@ async function profile(level) {
   }
 
   // Update settings.json
-  let settings = {};
-  if (existsSync(SETTINGS_PATH)) {
-    try { settings = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8')); } catch {}
-  }
+  let settings = readSettingsForWrite();
   if (!settings.hooks) settings.hooks = {};
 
   // Register all hooks in settings
@@ -2820,8 +3376,7 @@ async function analyze() {
   const blockLog = join(HOME, '.claude', 'blocked-commands.log');
   let blocks = [];
   if (existsSync(blockLog)) {
-    const content = readFileSync(blockLog, 'utf-8');
-    blocks = content.split('\n').filter(l => l.trim());
+    blocks = readBlockRecords(blockLog);
     const recent = blocks.slice(-20);
     console.log(c.bold + '  Blocked Commands' + c.reset + c.dim + ` (${blocks.length} total)` + c.reset);
     if (recent.length > 0) {
@@ -2878,7 +3433,7 @@ async function analyze() {
 
   // 4. Hook health
   console.log(c.bold + '  Hook Health' + c.reset);
-  const hookDir = join(HOME, '.claude', 'hooks');
+  const hookDir = HOOKS_DIR;
   if (existsSync(hookDir)) {
     const hooks = readdirSync(hookDir).filter(f => f.endsWith('.sh') || f.endsWith('.py'));
     let execCount = 0, nonExec = 0;
@@ -2918,6 +3473,353 @@ async function analyze() {
   console.log();
 }
 
+// --blindspots (2026-09-03): 層をまたぐ診断。単層の点検では構造的に出ない欠陥を出す。
+//
+// このツールの他の命令は、どれも1つの層しか見ていない——ディスクの上のフック(--status)、
+// 設定ファイル(--lint)、阻止の記録(--stats)、配布版との差(--outdated)。
+// フックは在って、実行権があって、登録されていて、最新であっても、
+// この環境で実際に打たれるコマンドの形がその位置に届かなければ、一度も走らない。
+// その差は、セッションのログ(層4)をフックの正規表現(層1)の隣に置いて初めて見える。
+//
+// 読むのは全部ローカル。ネットワークへは何も送らない。
+async function blindspots() {
+  const { createReadStream, statSync } = await import('fs');
+  const { createInterface: makeLines } = await import('readline');
+  const PROJECTS_DIR = join(HOME, '.claude', 'projects');
+
+  console.log();
+  console.log(c.bold + '  cc-safe-setup --blindspots' + c.reset);
+  console.log(c.dim + '  What your guards never see — measured against your own sessions' + c.reset);
+  console.log();
+
+  if (!existsSync(PROJECTS_DIR)) {
+    console.log(c.yellow + '  No session transcripts found at ' + PROJECTS_DIR + c.reset);
+    console.log(c.dim + '  This check needs your own Claude Code history to say anything.' + c.reset);
+    console.log();
+    return;
+  }
+
+  // ---- 層4: 実際に打たれたコマンドを集める --------------------------------
+  // 転写は2つの深さに置かれる。プロジェクト直下がメインのセッション、
+  // その下の <session>/subagents/ がサブエージェントのもの。
+  // 直下だけを読んでいた版は、この機械で 571 本中 271 本（47%）を落としていた。
+  // サブエージェントの Bash にもフックは走るので、落とすと母集団が半分になる。
+  const files = [];
+  const collect = (dir, depth) => {
+    // 上限は8。サブエージェントは入れ子になり、実測で project/session/subagents/…/subagents/…
+    // まで潜っていた（上限4だと571本中418本しか読めなかった）。
+    if (depth > 8) return;
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      const p = join(dir, e.name);
+      if (e.isDirectory()) { collect(p, depth + 1); continue; }
+      if (!e.name.endsWith('.jsonl')) continue;
+      try { files.push({ path: p, size: statSync(p).size }); } catch {}
+    }
+  };
+  collect(PROJECTS_DIR, 0);
+  const totalBytes = files.reduce((a, f) => a + f.size, 0);
+  if (files.length === 0) {
+    console.log(c.yellow + '  No .jsonl transcripts under ' + PROJECTS_DIR + c.reset);
+    console.log();
+    return;
+  }
+
+  const subCount = files.filter((f) => f.path.includes('/subagents/')).length;
+  console.log(c.dim + `  reading ${files.length} transcripts (${(totalBytes / 1048576).toFixed(0)} MB, ${subCount} from subagents) — local only, nothing is sent` + c.reset);
+
+  const startedAt = Date.now();
+  const commands = [];
+  let firstTs = null, lastTs = null;
+  for (const f of files) {
+    await new Promise((resolve) => {
+      const rl = makeLines({ input: createReadStream(f.path, { encoding: 'utf-8' }), crlfDelay: Infinity });
+      rl.on('line', (line) => {
+        if (line.indexOf('"tool_use"') === -1) return;   // 大半の行はここで落ちる（速さのため）
+        let d;
+        try { d = JSON.parse(line); } catch { return; }
+        if (d.type !== 'assistant') return;
+        const content = (d.message || {}).content;
+        if (!Array.isArray(content)) return;
+        for (const blk of content) {
+          if (!blk || blk.type !== 'tool_use' || blk.name !== 'Bash') continue;
+          const cmd = (blk.input || {}).command;
+          if (typeof cmd !== 'string' || !cmd.trim()) continue;
+          commands.push(cmd);
+          const ts = d.timestamp;
+          if (ts) {
+            if (!firstTs || ts < firstTs) firstTs = ts;
+            if (!lastTs || ts > lastTs) lastTs = ts;
+          }
+        }
+      });
+      rl.on('close', resolve);
+      rl.on('error', resolve);
+    });
+  }
+
+  const N = commands.length;
+  if (N === 0) {
+    console.log(c.yellow + '  Transcripts found, but no Bash calls in them. Nothing to compare against.' + c.reset);
+    console.log();
+    return;
+  }
+
+  const compound = commands.filter(x => /(&&|\|\||;|\|)/.test(x)).length;
+  const startsCd = commands.filter(x => /^\s*cd\s/.test(x)).length;
+  const pct = (n) => ((n / N) * 100).toFixed(1) + '%';
+
+  console.log();
+  console.log(c.bold + '  Layer 4 · what you actually ask for' + c.reset);
+  console.log(`    ${c.bold}${N.toLocaleString()}${c.reset} Bash tool calls` +
+    (firstTs && lastTs ? c.dim + `  (dated ones span ${firstTs.slice(0, 10)} → ${lastTs.slice(0, 10)})` + c.reset : ''));
+  console.log(c.dim + `    read in ${((Date.now() - startedAt) / 1000).toFixed(1)}s` + c.reset);
+  // 数えているのは要求であって実行ではない。PreToolUse はどちらにせよ要求の時点で
+  // 呼ばれるので、「フックが見たか」を問う目的にはこれが正しい単位だが、
+  // 「これだけ走った」と読まれないように明示する。
+  // また、突き合わせているのは全プロジェクトの履歴と「いまの」フックである点も書く。
+  console.log(c.dim + '    Counted as requested, before any hook or human allowed them, which is the' + c.reset);
+  console.log(c.dim + '    point a PreToolUse hook is consulted. History spans every project; the' + c.reset);
+  console.log(c.dim + '    hooks compared against it are the ones installed now.' + c.reset);
+  console.log(`    ${pct(compound).padStart(6)}  contain a separator (${c.dim}&& ; || |${c.reset}) — the command a guard sees first is not the whole command`);
+  console.log(`    ${pct(startsCd).padStart(6)}  begin with ${c.dim}cd ${c.reset}— anything anchored to the start of the string sees ${c.dim}cd${c.reset}, not the verb`);
+  console.log();
+
+  // ---- 層2+3: 登録されているのに実体が無いフック ---------------------------
+  // 設定は「登録した」と言い、ディスクには無い。どちらの層を単独で見ても矛盾に見えない。
+  const zombies = [];
+  const registeredNames = new Set();
+  let registered = 0;
+  let settings = {};
+  try { settings = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8')); } catch {}
+  const expand = (p) => p
+    .replace(/\$\{?CLAUDE_PROJECT_DIR\}?/g, CLAUDE_BASE)
+    .replace(/\$\{?HOME\}?/g, HOME)
+    .replace(/^~/, HOME);
+  for (const entries of Object.values(settings.hooks || {})) {
+    for (const entry of entries || []) {
+      for (const h of (entry || {}).hooks || []) {
+        if (!h || h.type !== 'command' || typeof h.command !== 'string') continue;
+        const m = h.command.match(/(\S*\/[\w.-]+\.(?:sh|py|js|mjs))/);
+        if (!m) continue;                      // インラインのシェルは対象外（実体を持たない）
+        registered++;
+        const p = expand(m[1]).replace(/^["']|["']$/g, '');
+        registeredNames.add(p.split('/').pop());
+        if (!existsSync(p)) zombies.push(p);
+      }
+    }
+  }
+  console.log(c.bold + '  Layers 2+3 · registered vs. present on disk' + c.reset);
+  if (registered === 0) {
+    console.log(c.dim + '    No script-backed hooks registered in ' + SETTINGS_PATH + c.reset);
+  } else if (zombies.length === 0) {
+    console.log(`    ${c.green}✓${c.reset} all ${registered} script-backed hook registrations point at a file that exists`);
+  } else {
+    console.log(`    ${c.red}✗${c.reset} ${zombies.length} of ${registered} registrations point at a file that is not there.`);
+    console.log(c.dim + '      They never run, and nothing reports it.' + c.reset);
+    for (const z of zombies.slice(0, 6)) console.log(`      ${c.red}·${c.reset} ${z}`);
+    if (zombies.length > 6) console.log(c.dim + `      … and ${zombies.length - 6} more` + c.reset);
+  }
+  console.log();
+
+  // ---- 層1+4: 行頭に錨を置いた正規表現と、実際の形を突き合わせる -----------
+  // これは走査であって、フックの意味解析ではない。取りこぼしも空振りもある（下に件数を出す）。
+  const posix = (s) => s
+    .replace(/\[\[:space:\]\]/g, '\\s')
+    .replace(/\[\[:alpha:\]\]/g, '[A-Za-z]')
+    .replace(/\[\[:alnum:\]\]/g, '[A-Za-z0-9]')
+    .replace(/\[\[:digit:\]\]/g, '\\d');
+
+  const words = (pat) => posix(pat)
+    .replace(/\(\?[:=!][^)]*\)/g, ' ')
+    .replace(/\[[^\]]*\]/g, ' ')
+    .replace(/\\[sStTwWdDbB]/g, ' ')
+    .replace(/[*+?{}()|^$.\\]/g, ' ')
+    .split(/\s+/)
+    .filter(w => /^[A-Za-z][A-Za-z0-9_.-]*$/.test(w) && w.length > 1);
+
+  // 見つけた錨のうち、どれが「門」でどれが「免除」かを分ける。
+  // ここを分けないと、読み取り専用の命令を素通しさせるための ^grep や ^git が
+  // 「守れていない門」として並ぶ。それは計器の側の欠陥であって、利用者の設定の欠陥ではない。
+  // 判定は、その錨の直後に最初に現れる終了コード: exit 2 なら門、exit 0 なら免除。
+  const classify = (src, at, line) => {
+    // 複合条件の一項（行末が && \ など）は、それ単独では門でも守備範囲でもない。
+    // 例: `if ! echo "$CMD" | grep -qE '^\s*git\s' && echo "$CMD" | grep -qiE '(tweet|...)'`
+    // ここでの ^git は「git は対象外」という除外であって、git の門ではない。
+    if (/(&&|\|\|)\s*\\?\s*$/.test(line)) return 'exempt';
+    const tail = src.slice(at, at + 600);
+    const block = tail.search(/exit\s+2|sys\.exit\(2\)|EXIT_BLOCK/);
+    const allow = tail.search(/exit\s+0|sys\.exit\(0\)|return\s+0/);
+    // 否定つきの早期脱出（`if ! ... '^git push'; then exit 0`）は、
+    // その錨がこのフックの守備範囲そのものであることを意味する。
+    // 錨に当たらない命令は、拒否されないのではなく、一度も見られない。
+    if (/(^|\s)!\s*(printf|echo|cat|grep|\[\[)/.test(line) || /grep\s+-[a-zA-Z]*v/.test(line)) {
+      return (allow !== -1 && (block === -1 || allow < block)) ? 'subject' : 'exempt';
+    }
+    if (block === -1 && allow === -1) return 'unknown';
+    if (block === -1) return 'exempt';
+    if (allow === -1) return 'block';
+    return block < allow ? 'block' : 'exempt';
+  };
+
+  const found = [];
+  const unregistered = [];
+  let scanned = 0, unparsed = 0, exempt = 0;
+  if (existsSync(HOOKS_DIR)) {
+    for (const f of readdirSync(HOOKS_DIR)) {
+      if (!/\.(sh|py|bash)$/.test(f)) continue;
+      // 登録されていないスクリプトは一度も走らない。その錨の見落とし率を並べると、
+      // 走りもしないフックを「守れていない門」として報告することになる。
+      // 登録が1つも読めなかった時だけ、全ファイルを対象にする（設定が別の場所にある環境）。
+      if (registeredNames.size > 0 && !registeredNames.has(f)) { unregistered.push(f); continue; }
+      let src;
+      try { src = readFileSync(join(HOOKS_DIR, f), 'utf-8'); } catch { continue; }
+      const pats = new Map();   // pattern -> { multiline, kind }
+      const rank = { exempt: 0, unknown: 1, subject: 2, block: 3 };
+      const note = (pat, at, multiline, line) => {
+        const kind = classify(src, at, line);
+        const prev = pats.get(pat);
+        // 同じ錨が複数回出るときは、いちばん強い用法（門 > 守備範囲 > 免除）を採る
+        if (!prev) pats.set(pat, { multiline, kind });
+        else if (rank[kind] > rank[prev.kind]) pats.set(pat, { multiline: prev.multiline || multiline, kind });
+      };
+      let m;
+      // grep は行ごとに判定するので、複数行の命令では ^ が2行目以降の行頭にも当たる。
+      // bash の =~ は文字列の先頭にしか当たらない。この差を無視すると見落としを過大に出す。
+      const quoted = /(['"])\^([^'"\n]{2,120})\1/g;          // grep -qE '^\s*git\s+push'
+      while ((m = quoted.exec(src)) !== null) {
+        const lineStart = src.lastIndexOf('\n', m.index) + 1;
+        const line = src.slice(lineStart, src.indexOf('\n', m.index));
+        note(m[2], m.index, /grep|egrep|awk|sed/.test(line), line);
+      }
+      const bashRe = /=~\s*\^([^\s\]]{2,120})/g;              // [[ "$CMD" =~ ^rm[[:space:]] ]]
+      while ((m = bashRe.exec(src)) !== null) {
+        const ls = src.lastIndexOf('\n', m.index) + 1;
+        note(m[1], m.index, false, src.slice(ls, src.indexOf('\n', m.index)));
+      }
+
+      for (const [pat, meta] of pats) {
+        scanned++;
+        if (meta.kind !== 'block' && meta.kind !== 'subject') { exempt++; continue; }
+        const w = words(pat);
+        if (w.length === 0) { unparsed++; continue; }
+        let anchored, loose;
+        try {
+          anchored = new RegExp('^\\s*' + posix(pat), meta.multiline ? 'm' : '');
+          // 命令として実際に呼ばれる位置だけを数える＝行頭か、区切り（&& || ; | $( ）の直後。
+          // 「どこかに含まれる」で数えると、sed の置換文字列やコミット本文の中の語まで入る。
+          const verb = w.map(x => x.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('\\s+');
+          loose = new RegExp('(?:^|&&|\\|\\||;|\\||\\$\\()\\s*' + verb + '\\b', 'm');
+        } catch { unparsed++; continue; }
+        found.push({ hook: f, pat, words: w.join(' '), anchored, loose, kind: meta.kind });
+      }
+    }
+  }
+
+  const rows = [];
+  for (const g of found) {
+    let intent = 0, sees = 0;
+    let sample = null;
+    for (const cmd of commands) {
+      if (!g.loose.test(cmd)) continue;
+      intent++;
+      if (g.anchored.test(cmd)) sees++;
+      else if (!sample) sample = cmd;
+    }
+    if (intent < 20) continue;                 // 少なすぎる語は雑音なので出さない
+    const blind = intent - sees;
+    if (blind === 0) continue;
+    rows.push({ hook: g.hook, words: g.words, intent, sees, blind, rate: blind / intent, sample, kind: g.kind });
+  }
+  // 同じ語を複数のフックが持つことがあるので、見落としの大きい順に一意化する
+  rows.sort((a, b) => b.blind - a.blind);
+  const seenWords = new Set();
+  const top = rows.filter(r => (seenWords.has(r.words) ? false : seenWords.add(r.words)));
+
+  // 在るが登録されていないスクリプトは、走査の対象から外してある（走らないものに
+  // 「守れていない」は言えない）。列挙そのものは --audit の層またぎの検査が
+  // 精度を吟味した形で既に持っているので、ここでは除外した事実だけを伝えて渡す。
+  if (unregistered.length > 0) {
+    console.log(c.dim + `    ${unregistered.length} more script${unregistered.length === 1 ? '' : 's'} in ${HOOKS_DIR} ${unregistered.length === 1 ? 'is' : 'are'} registered nowhere,` +
+      ' so they are left out of the table below — they never run. `--audit` names them.' + c.reset);
+    console.log();
+  }
+
+  console.log(c.bold + '  Layers 1+4 · patterns anchored to the start vs. what you type' + c.reset);
+  if (found.length === 0) {
+    console.log(c.dim + '    No start-anchored patterns found in ' + HOOKS_DIR + c.reset);
+  } else if (top.length === 0) {
+    // 「調べたが差が無かった」と「調べられる材料が無かった」を同じ緑で出さない。
+    // 稀にしか打たない破壊的な操作ほど traffic が薄く、judged の外へ落ちる。
+    const judged = found.length;
+    if (judged === 0) {
+      console.log(`    ${c.yellow}—${c.reset} no gate pattern could be evaluated. This says nothing about your setup.`);
+    } else {
+      console.log(`    ${c.green}✓${c.reset} the ${judged} gate pattern${judged === 1 ? '' : 's'} with enough traffic to judge matched all of it`);
+      console.log(c.dim + '      A verb you rarely type has too little traffic to judge here, and the' + c.reset);
+      console.log(c.dim + '      rare ones are usually the destructive ones. Green is not coverage.' + c.reset);
+    }
+    console.log(c.dim + `      (${scanned} anchors scanned; ${exempt} allow/exempt, ${unparsed} unreadable)` + c.reset);
+  } else {
+    console.log(c.dim + '    intent = calls where that verb starts a command segment (line start, or after && || ; |)' + c.reset);
+    console.log(c.dim + '    seen   = calls the hook\'s start-anchored pattern actually matches' + c.reset);
+    console.log();
+    console.log(c.dim + '    verb              hook                        intent   seen   blind  effect' + c.reset);
+    for (const r of top.slice(0, 8)) {
+      const col = r.rate > 0.5 ? c.red : c.yellow;
+      console.log(
+        '    ' + r.words.padEnd(17).slice(0, 17) +
+        ' ' + r.hook.padEnd(27).slice(0, 27) +
+        ' ' + String(r.intent).padStart(6) +
+        ' ' + String(r.sees).padStart(6) +
+        '  ' + col + (r.rate * 100).toFixed(1).padStart(5) + '%' + c.reset +
+        '  ' + c.dim + (r.kind === 'subject' ? 'never examined' : 'not blocked') + c.reset
+      );
+    }
+    const worst = top[0];
+    if (worst && worst.sample) {
+      // 実物をそのまま出さない。利用者の履歴には鍵・顧客名・内部パスが混じり、
+      // この出力は画面共有や CI のログへ流れる。読者に要るのは中身ではなく形
+      // ——「区切りの後ろに来ていたから錨に当たらなかった」——なので、
+      // 各区分の先頭の語（と、パスや代入でない素の副命令）だけ残して他は落とす。
+      const shape = worst.sample
+        .split(/\s*(&&|\|\||;|\|)\s*/)
+        .map((seg, i) => {
+          if (i % 2 === 1) return seg;
+          const t = seg.trim().split(/\s+/).filter(Boolean);
+          if (t.length === 0) return '';
+          const sub = (t[1] && /^[a-z][a-z0-9-]*$/.test(t[1])) ? ' ' + t[1] : '';
+          return t[0] + sub + (t.length > (sub ? 2 : 1) ? ' …' : '');
+        })
+        .filter(Boolean).join(' ').replace(/\s+/g, ' ').slice(0, 120);
+      console.log();
+      console.log(c.dim + '    the shape of one that went past ' + worst.hook + ' (arguments removed):' + c.reset);
+      console.log('      ' + c.dim + shape + c.reset);
+    }
+    console.log();
+    console.log(c.dim + `    (${scanned} anchored patterns scanned; ${exempt} are allow/exempt tests and are not counted as gaps;` +
+      ` ${unparsed} could not be read. This is a scan, not a parse of your hooks: it can miss patterns,` +
+      ' and it can name one that a later line already handles. A verb on its own line inside a' +
+      ' heredoc is counted as an invocation, so intent is an upper bound.)' + c.reset);
+  }
+  console.log();
+
+  console.log(c.bold + '  Why no single-layer check reports this' + c.reset);
+  console.log(c.dim + '    --status sees the files. --lint sees the config. --outdated sees the versions.' + c.reset);
+  console.log(c.dim + '    A guard can pass all three and still stand where your traffic never goes.' + c.reset);
+  console.log(c.dim + '    The gap only exists between layers, so only a comparison across them can find it.' + c.reset);
+  console.log();
+  console.log(c.dim + '    Fixes: match anywhere in the command, not only at the start; register file guards on' + c.reset);
+  console.log(c.dim + '    Bash as well as Read/Edit; and put static paths in permissions.deny, which reads' + c.reset);
+  console.log(c.dim + '    inside Bash commands. See SAFETY_CHECKLIST.md.' + c.reset);
+  console.log();
+  console.log(c.dim + '    This covers two of the five layers. The same method run across all five on one real' + c.reset);
+  console.log(c.dim + '    machine, findings and wrong turns included, is written out in full:' + c.reset);
+  console.log(c.dim + '    docs/full-surface-audit-sample-jp.md' + c.reset);
+  console.log();
+}
+
 async function opus47() {
   console.log();
   console.log(c.bold + '  🚨  cc-safe-setup --opus47' + c.reset);
@@ -3009,9 +3911,15 @@ async function shield() {
   // Run the default install
   mkdirSync(HOOKS_DIR, { recursive: true });
   let installed = 0;
+  // 今回このコマンドが *新しくディスクへ置いた* フックだけを集める。
+  // 「自分が配ったフックか」ではなく「今回置いたか」で判定するのが肝。
+  // 既に置いてあるファイルは、利用者が一度見て、登録するかどうかを決めた後のもので、
+  // 登録を外してあるなら、それは決定である。決定を黙って覆さない。
+  const freshlyInstalled = new Set();
   for (const [hookId, hookMeta] of Object.entries(HOOKS)) {
     const hookPath = join(HOOKS_DIR, `${hookId}.sh`);
     if (!existsSync(hookPath)) {
+      freshlyInstalled.add(`${hookId}.sh`);
       writeFileSync(hookPath, SCRIPTS[hookId]);
       chmodSync(hookPath, 0o755);
       installed++;
@@ -3051,6 +3959,7 @@ async function shield() {
     const exPath = join(__dirname, 'examples', `${ex}.sh`);
     const hookPath = join(HOOKS_DIR, `${ex}.sh`);
     if (existsSync(exPath) && !existsSync(hookPath)) {
+      freshlyInstalled.add(`${ex}.sh`);
       copyFileSync(exPath, hookPath);
       chmodSync(hookPath, 0o755);
       console.log(c.green + '  +' + c.reset + ` ${ex}`);
@@ -3063,16 +3972,39 @@ async function shield() {
   // Step 4: Update settings.json
   console.log();
   console.log(c.bold + '  Step 4: Configure settings.json' + c.reset);
-  let settings = {};
-  if (existsSync(SETTINGS_PATH)) {
-    try { settings = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8')); } catch {}
-  }
+  const hadConfigFile = existsSync(SETTINGS_PATH);
+  // 書き戻しは 100行以上あとの writeFileSync(SETTINGS_PATH, configNext) で起きる。
+  // 最初にこの経路を数えたとき 60行だけ先を見て「読むだけ」と分類してしまった。
+  // 距離が離れているだけで、壊れた設定を {} として上書きする形は他の5か所と同じ。
+  let settings = readSettingsForWrite();
   if (!settings.hooks) settings.hooks = {};
-
-  // Collect all installed hooks
-  const hookFiles = existsSync(HOOKS_DIR)
+  const configBefore = JSON.stringify(settings, null, 2);
+  // 初回の導入(設定ファイルがまだ無い)では、まだ何の決定も下されていないので、
+  // 途中で失敗した前回の実行を拾い直せるように、置いてあるものを全部登録してよい。
+  const firstTimeSetup = !hadConfigFile;
+
+  // Collect the hooks this run is responsible for.
+  //
+  // Until 2026-07-27 this adopted every .sh in HOOKS_DIR regardless of origin.
+  // Two ways that hurt the operator, both observed in the field:
+  //   - a hook another tool dropped in ~/.claude/hooks/ got registered here,
+  //     with its trigger *guessed* from the filename
+  //   - a hook the operator had deliberately unregistered came back on the next run
+  // The second is the worse of the two: removing a registration is a decision, and
+  // silently reversing a decision is the failure class this project exists to stop.
+  // Default is now "only what this run newly wrote to disk", plus the first-time
+  // setup case where no config file existed yet. --adopt-existing restores the old
+  // sweep for anyone relying on it.
+  const allHookFiles = existsSync(HOOKS_DIR)
     ? readdirSync(HOOKS_DIR).filter(f => f.endsWith('.sh'))
     : [];
+  const adoptAll = ADOPT_EXISTING || firstTimeSetup;
+  const hookFiles = adoptAll ? allHookFiles : allHookFiles.filter(f => freshlyInstalled.has(f));
+  const foreign = allHookFiles.filter(f => !freshlyInstalled.has(f));
+  if (foreign.length > 0 && !adoptAll) {
+    console.log(c.dim + `  ${foreign.length} hook(s) already on disk were left as they are` + c.reset);
+    console.log(c.dim + '    (their registration is yours to decide \u2014 --adopt-existing registers them all)' + c.reset);
+  }
 
   // Build hook entries by trigger type
   const preToolHooks = [];
@@ -3154,8 +4086,15 @@ async function shield() {
     }
   }
 
-  writeFileSync(SETTINGS_PATH, JSON.stringify(settings, null, 2));
-  console.log(c.green + '  ✓' + c.reset + ' settings.json updated');
+  // Write only when something actually changed. Rewriting an identical file still
+  // bumps the mtime and still risks clobbering a concurrent edit, for no gain.
+  const configNext = JSON.stringify(settings, null, 2);
+  if (configNext === configBefore) {
+    console.log(c.dim + '  ✓' + c.reset + ' settings.json already up to date (not rewritten)');
+  } else {
+    writeFileSync(SETTINGS_PATH, configNext);
+    console.log(c.green + '  ✓' + c.reset + ' settings.json updated');
+  }
 
   // Step 5: Generate CLAUDE.md template if none exists
   console.log();
@@ -3191,16 +4130,94 @@ async function shield() {
   const totalHooks = hookFiles.length;
   console.log(c.bold + c.green + '  🛡️  Shield activated!' + c.reset);
   console.log(c.dim + `  ${totalHooks} hooks installed and configured.` + c.reset);
-  console.log(c.dim + '  Your Claude Code sessions are now protected.' + c.reset);
   console.log();
-  console.log(c.dim + '  Verify: npx cc-safe-setup --verify' + c.reset);
-  console.log(c.dim + '  Status: npx cc-safe-setup --status' + c.reset);
+
+  // ここは以前「Your Claude Code sessions are now protected.」と言い切っていた。
+  // それは入れた本数についての事実ではなく、守れているかについての断定で、
+  // 測れる範囲では正しくない。入れた柵の多くは命令の先頭に錨を置くので、
+  // 区切りの後ろ（`cd … && git push …`）には届かない。
+  // 断定を返上して、その人自身の履歴から数えた1つの数字を置く。
+  const shape = await commandShapeSample();
+  if (shape) {
+    console.log(c.bold + '  Before you trust them:' + c.reset);
+    console.log(c.dim + '  Most guards match the start of the command string. In your most recent' + c.reset);
+    console.log(`  ${c.dim}sessions, ${c.reset}${c.bold}${shape.compoundPct.toFixed(1)}%${c.reset}${c.dim} of ${shape.calls.toLocaleString()} Bash calls are compound` +
+      ` (${c.reset}cd … && git push …${c.dim}) and ${c.reset}${shape.cdPct.toFixed(1)}%${c.dim} begin with ${c.reset}cd${c.dim}.` + c.reset);
+    console.log(c.dim + '  A guard anchored at the start does not see what comes after the separator.' + c.reset);
+    console.log();
+    console.log(c.dim + '  Which of yours have that gap:  ' + c.reset + 'npx github:yurukusa/cc-safe-setup --blindspots');
+  } else {
+    console.log(c.dim + '  Most guards match the start of the command string, so a command like' + c.reset);
+    console.log(c.dim + '  `cd … && git push …` can go past them. Once you have some history,' + c.reset);
+    console.log(c.dim + '  --blindspots reads it locally and shows which of yours have that gap.' + c.reset);
+  }
+  console.log();
+  console.log(c.dim + '  Verify: npx github:yurukusa/cc-safe-setup --verify' + c.reset);
+  console.log(c.dim + '  Status: npx github:yurukusa/cc-safe-setup --status' + c.reset);
   console.log();
   console.log(c.dim + '  Burning tokens too fast? Free diagnosis:' + c.reset);
   console.log(c.blue + '  https://yurukusa.github.io/cc-safe-setup/token-checkup.html' + c.reset);
   console.log();
 }
 
+
+// 導入の最後に「あなたのセッションは保護されました」と言い切っていた行の差し替えに使う。
+// 入れた柵の大半は命令の先頭に錨を置く（`^\s*git\s+push` の形）ので、区切りの後ろは見えない。
+// その割合は環境によって違うから、こちらで断定せず、その人自身の履歴から数えて見せる。
+// 予算を切ってあるのは、導入の待ち時間を伸ばさないため（直近の記録だけを新しい順に読む）。
+// 何も無い環境（初回の利用者）では null を返し、呼び出し側は何も言わない。
+async function commandShapeSample(budgetBytes = 20 * 1024 * 1024) {
+  const { createReadStream, statSync } = await import('fs');
+  const { createInterface: makeLines } = await import('readline');
+  const dir = join(HOME, '.claude', 'projects');
+  if (!existsSync(dir)) return null;
+
+  const files = [];
+  let projects;
+  try { projects = readdirSync(dir); } catch { return null; }
+  for (const proj of projects) {
+    let entries;
+    try { entries = readdirSync(join(dir, proj)); } catch { continue; }
+    for (const f of entries) {
+      if (!f.endsWith('.jsonl')) continue;
+      const full = join(dir, proj, f);
+      try { const st = statSync(full); files.push({ full, mtime: st.mtimeMs, size: st.size }); } catch {}
+    }
+  }
+  if (files.length === 0) return null;
+  files.sort((a, b) => b.mtime - a.mtime);
+
+  let budget = budgetBytes, calls = 0, compound = 0, startsCd = 0;
+  for (const f of files) {
+    if (budget <= 0) break;
+    budget -= f.size;
+    await new Promise((resolve) => {
+      const rl = makeLines({ input: createReadStream(f.full, { encoding: 'utf-8' }), crlfDelay: Infinity });
+      rl.on('line', (line) => {
+        if (line.indexOf('"tool_use"') === -1) return;
+        let d;
+        try { d = JSON.parse(line); } catch { return; }
+        if (d.type !== 'assistant') return;
+        const content = (d.message || {}).content;
+        if (!Array.isArray(content)) return;
+        for (const blk of content) {
+          if (!blk || blk.type !== 'tool_use' || blk.name !== 'Bash') continue;
+          const cmd = (blk.input || {}).command;
+          if (typeof cmd !== 'string' || !cmd.trim()) continue;
+          calls++;
+          if (/(&&|\|\||;|\|)/.test(cmd)) compound++;
+          if (/^\s*cd\s/.test(cmd)) startsCd++;
+        }
+      });
+      rl.on('close', resolve);
+      rl.on('error', resolve);
+    });
+  }
+  // 少なすぎる標本から割合を出すと、その数字のほうが嘘になる。
+  if (calls < 200) return null;
+  return { calls, compoundPct: (compound / calls) * 100, cdPct: (startsCd / calls) * 100 };
+}
+
 async function quickfix() {
   const { execSync } = await import('child_process');
   console.log();
@@ -3368,7 +4385,7 @@ async function quickfix() {
           safetyHooks++;
         } else {
           console.log(c.yellow + '  △' + c.reset + ` Missing critical hook: ${name}`);
-          console.log(c.dim + '    Fix: npx cc-safe-setup' + c.reset);
+          console.log(c.dim + '    Fix: npx github:yurukusa/cc-safe-setup' + c.reset);
           warnings++;
         }
       }
@@ -3389,8 +4406,8 @@ async function quickfix() {
   }
   if (warnings > 0) {
     console.log();
-    console.log(c.yellow + '  Run npx cc-safe-setup to install missing safety hooks' + c.reset);
-    console.log(c.yellow + '  Run npx cc-safe-setup --doctor for detailed diagnosis' + c.reset);
+    console.log(c.yellow + '  Run npx github:yurukusa/cc-safe-setup to install missing safety hooks' + c.reset);
+    console.log(c.yellow + '  Run npx github:yurukusa/cc-safe-setup --doctor for detailed diagnosis' + c.reset);
   }
   console.log();
 }
@@ -3430,10 +4447,7 @@ async function report() {
   const emoji = auditScore >= 80 ? '🟢' : auditScore >= 50 ? '🟡' : '🔴';
 
   const blockLog = join(HOME, '.claude', 'blocked-commands.log');
-  let totalBlocks = 0;
-  if (existsSync(blockLog)) {
-    totalBlocks = readFileSync(blockLog, 'utf-8').split('\n').filter(l => l.trim()).length;
-  }
+  const totalBlocks = readBlockRecords(blockLog).length;
 
   const md = `## ${emoji} Claude Code Safety Report
 
@@ -3446,8 +4460,8 @@ async function report() {
 | Generated | ${new Date().toISOString().split('T')[0]} |
 
 ### Quick Actions
-- Audit: \`npx cc-safe-setup --audit\`
-- Dashboard: \`npx cc-safe-setup --dashboard\`
+- Audit: \`npx github:yurukusa/cc-safe-setup --audit\`
+- Dashboard: \`npx github:yurukusa/cc-safe-setup --dashboard\`
 - Find hooks: \`npx cc-hook-registry recommend\`
 `;
 
@@ -3464,7 +4478,7 @@ function generateCI() {
   const workflowPath = join(workflowDir, 'claude-code-safety.yml');
 
   const workflow = `# Claude Code Safety Audit
-# Generated by: npx cc-safe-setup --generate-ci
+# Generated by: npx github:yurukusa/cc-safe-setup --generate-ci
 # Runs safety checks on every PR and push to main
 
 name: Claude Code Safety
@@ -3490,7 +4504,7 @@ jobs:
       - name: Run safety audit
         id: audit
         run: |
-          npx cc-safe-setup --audit --json > /tmp/audit.json 2>&1 || true
+          npx github:yurukusa/cc-safe-setup --audit --json > /tmp/audit.json 2>&1 || true
           SCORE=\$(cat /tmp/audit.json | jq -r '.score // 0' 2>/dev/null || echo 0)
           echo "score=\$SCORE" >> \$GITHUB_OUTPUT
           echo "Safety score: \$SCORE/100"
@@ -3572,10 +4586,10 @@ async function migrate() {
 
   // Detection patterns for other projects
   const detections = [
-    { pattern: /safety-net|cc-safety-net|SAFETY_LEVEL/i, project: 'claude-code-safety-net', replacement: 'npx cc-safe-setup (destructive-guard, branch-guard)' },
-    { pattern: /karanb192|block-dangerous-commands\.js/i, project: 'karanb192/claude-code-hooks', replacement: 'npx cc-safe-setup (destructive-guard)' },
-    { pattern: /hooks-mastery|disler|pre_tool_use\.py/i, project: 'disler/claude-code-hooks-mastery', replacement: 'npx cc-safe-setup (multiple hooks)' },
-    { pattern: /cchooks|from cchooks/i, project: 'GowayLee/cchooks', replacement: 'npx cc-safe-setup (bash equivalents)' },
+    { pattern: /safety-net|cc-safety-net|SAFETY_LEVEL/i, project: 'claude-code-safety-net', replacement: 'npx github:yurukusa/cc-safe-setup (destructive-guard, branch-guard)' },
+    { pattern: /karanb192|block-dangerous-commands\.js/i, project: 'karanb192/claude-code-hooks', replacement: 'npx github:yurukusa/cc-safe-setup (destructive-guard)' },
+    { pattern: /hooks-mastery|disler|pre_tool_use\.py/i, project: 'disler/claude-code-hooks-mastery', replacement: 'npx github:yurukusa/cc-safe-setup (multiple hooks)' },
+    { pattern: /cchooks|from cchooks/i, project: 'GowayLee/cchooks', replacement: 'npx github:yurukusa/cc-safe-setup (bash equivalents)' },
     { pattern: /lasso.*security|prompt.*injection.*pattern/i, project: 'lasso-security/claude-hooks', replacement: 'No direct equivalent (unique functionality)' },
   ];
 
@@ -3619,7 +4633,7 @@ async function migrate() {
   if (found === 0 && suggestions.length === 0) {
     console.log(c.green + '  No migration needed. All hooks are cc-safe-setup native.' + c.reset);
   } else {
-    console.log(c.dim + '  Run npx cc-safe-setup to install built-in replacements.' + c.reset);
+    console.log(c.dim + '  Run npx github:yurukusa/cc-safe-setup to install built-in replacements.' + c.reset);
   }
   console.log();
 }
@@ -3633,7 +4647,7 @@ async function compare(hookA, hookB) {
   console.log();
 
   if (!hookA || !hookB) {
-    console.log(c.red + '  Usage: npx cc-safe-setup --compare <hook-a.sh> <hook-b.sh>' + c.reset);
+    console.log(c.red + '  Usage: npx github:yurukusa/cc-safe-setup --compare <hook-a.sh> <hook-b.sh>' + c.reset);
     process.exit(1);
   }
 
@@ -4085,6 +5099,67 @@ function share() {
   console.log();
 }
 
+// Shareable, screenshot-worthy safety posture card. The reach mechanic that
+// works in this niche is a compact artifact users *want* to share (the ccusage
+// cost scorecard, Karpathy's CLAUDE.md), not launch announcements. The score is
+// honest — it reports real installed-hook coverage (X of N core hooks), never an
+// invented points total — so it stays credible when screenshotted.
+function scorecard() {
+  const PRIORITY = ['destructive-guard', 'secret-guard', 'branch-guard', 'syntax-check', 'context-monitor', 'api-error-alert', 'comment-strip', 'cd-git-allow'];
+  const LABELS = {
+    'destructive-guard': 'Destructive commands (rm -rf, force-push)',
+    'secret-guard': 'Secret leaks (git add .env, key commits)',
+    'branch-guard': 'Direct pushes to main / master',
+    'syntax-check': 'Syntax errors after every edit',
+    'context-monitor': 'Silent context loss past tool call 150',
+    'api-error-alert': 'Silent autonomous-session death (rate limits)',
+    'comment-strip': 'Allowlist bypass via bash comments',
+    'cd-git-allow': 'Permission-prompt spam on read-only git',
+  };
+
+  const active = Object.keys(HOOKS).filter(id => existsSync(join(HOOKS_DIR, id + '.sh')));
+  const total = Object.keys(HOOKS).length;
+  const n = active.length;
+
+  if (JSON_OUTPUT) {
+    console.log(JSON.stringify({ tool: 'cc-safe-setup', coreHooksActive: n, coreHooksTotal: total, active }, null, 2));
+    return;
+  }
+
+  const filled = Math.round((n / total) * 12);
+  const bar = '█'.repeat(filled) + '░'.repeat(12 - filled);
+  const INNER = 52;
+  const visLen = (s) => s.replace(/\x1b\[[0-9;]*m/g, '').length;
+  const line = (s = '') => console.log('  ' + c.dim + '│' + c.reset + ' ' + s + ' '.repeat(Math.max(0, INNER - visLen(s))) + c.dim + '│' + c.reset);
+  const rule = (l, r) => console.log('  ' + c.dim + l + '─'.repeat(INNER + 2) + r + c.reset);
+
+  console.log();
+  rule('┌', '┐');
+  line(c.bold + 'cc-safe-setup · Safety Scorecard' + c.reset);
+  line();
+  line('Coverage  ' + c.green + bar + c.reset + '  ' + c.bold + n + '/' + total + c.reset + ' core hooks active');
+  line();
+  if (n === 0) {
+    line(c.yellow + 'No core hooks installed yet.' + c.reset);
+    line('Run ' + c.bold + 'npx github:yurukusa/cc-safe-setup' + c.reset + ' to install in ~10s.');
+  } else {
+    line('Now blocking:');
+    const shown = PRIORITY.filter(id => active.includes(id)).slice(0, 4);
+    for (const id of shown) line('  ' + c.green + '✓' + c.reset + ' ' + LABELS[id]);
+    if (n > shown.length) line('  ' + c.dim + '… and ' + (n - shown.length) + ' more' + c.reset);
+  }
+  line();
+  line(c.dim + 'Part of a 746-hook library mapped to 73+' + c.reset);
+  line(c.dim + 'documented Claude Code incidents.' + c.reset);
+  line();
+  line(c.blue + 'npx github:yurukusa/cc-safe-setup' + c.reset + c.dim + '      MIT · free' + c.reset);
+  rule('└', '┘');
+  console.log();
+  console.log('  ' + c.dim + 'Screenshot it · share your score · github.com/yurukusa/cc-safe-setup' + c.reset);
+  console.log('  ' + c.dim + 'Prefer a clickable card? ' + c.reset + c.blue + 'yurukusa.github.io/cc-safe-setup/safety-scorecard.html' + c.reset);
+  console.log();
+}
+
 function diff(otherFile) {
   console.log();
   console.log(c.bold + '  cc-safe-setup --diff' + c.reset);
@@ -4528,10 +5603,7 @@ exit 0`,
   console.log(c.dim + '  Trigger: ' + matched.trigger + ', Matcher: ' + matched.matcher + c.reset);
 
   // Register in settings.json
-  let settings = {};
-  if (existsSync(SETTINGS_PATH)) {
-    try { settings = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8')); } catch {}
-  }
+  let settings = readSettingsForWrite();
   if (!settings.hooks) settings.hooks = {};
   if (!settings.hooks[matched.trigger]) settings.hooks[matched.trigger] = [];
 
@@ -4695,7 +5767,7 @@ async function exportConfig() {
   console.log();
 
   if (!existsSync(SETTINGS_PATH)) {
-    console.log(c.red + '  No settings.json found. Run npx cc-safe-setup first.' + c.reset);
+    console.log(c.red + '  No settings.json found. Run npx github:yurukusa/cc-safe-setup first.' + c.reset);
     process.exit(1);
   }
 
@@ -4739,7 +5811,7 @@ async function exportConfig() {
   console.log(c.dim + '  Contains: ' + Object.keys(exportData.hooks).length + ' trigger types, ' + scriptPaths.size + ' hook scripts' + c.reset);
   console.log();
   console.log(c.dim + '  Share this file with your team. They can import with:' + c.reset);
-  console.log(c.bold + '  npx cc-safe-setup --import ' + outputFile + c.reset);
+  console.log(c.bold + '  npx github:yurukusa/cc-safe-setup --import ' + outputFile + c.reset);
   console.log();
 }
 
@@ -5050,7 +6122,7 @@ async function compileRules(rulesFile) {
     const exampleDir = rulesFile.includes('/') ? rulesFile.substring(0, rulesFile.lastIndexOf('/')) : '.';
     mkdirSync(exampleDir, { recursive: true });
     writeFileSync(rulesFile, `# Claude Code Safety Rules
-# Run: npx cc-safe-setup --rules ${rulesFile}
+# Run: npx github:yurukusa/cc-safe-setup --rules ${rulesFile}
 
 # Block dangerous commands
 - block: "rm -rf on root or home"
@@ -5119,7 +6191,7 @@ async function compileRules(rulesFile) {
 # Auto-generated from: ${rulesFile}
 # Generated: $(date -Iseconds)
 # Rules: ${rules.length}
-# Regenerate: npx cc-safe-setup --rules ${rulesFile}
+# Regenerate: npx github:yurukusa/cc-safe-setup --rules ${rulesFile}
 
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
@@ -5207,10 +6279,7 @@ FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
   }
 
   // Register in settings.json
-  let settings = {};
-  if (existsSync(SETTINGS_PATH)) {
-    try { settings = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8')); } catch {}
-  }
+  let settings = readSettingsForWrite();
   if (!settings.hooks) settings.hooks = {};
   if (!settings.hooks.PreToolUse) settings.hooks.PreToolUse = [];
 
@@ -5270,7 +6339,7 @@ async function protect(targetPath) {
   const pattern = isDir ? `*${normalized}*` : normalized;
 
   const script = `#!/bin/bash
-# Auto-generated by: npx cc-safe-setup --protect ${targetPath}
+# Auto-generated by: npx github:yurukusa/cc-safe-setup --protect ${targetPath}
 # Blocks Edit/Write to: ${normalized}
 INPUT=$(cat)
 TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
@@ -5328,41 +6397,25 @@ exit 0
 
   // Register in settings.json — use "Bash" matcher ONLY (never "")
   // "" matcher affects ALL tools and a broken hook would lock out the session
-  let settings = {};
-  if (existsSync(SETTINGS_PATH)) {
-    try { settings = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8')); } catch {}
-  }
+  let settings = readSettingsForWrite();
   if (!settings.hooks) settings.hooks = {};
   if (!settings.hooks.PreToolUse) settings.hooks.PreToolUse = [];
 
-  // Register under specific matchers based on rule types (NEVER use "" matcher)
+  // Register under a specific matcher (NEVER use "" matcher).
+  // --protect installs exactly one rule: block Edit/Write on `targetPath`, so the
+  // only matcher it needs is Edit|Write. The block/approve branches that used to
+  // stand here were copied from guard(), which parses a user-supplied rule list;
+  // `rules` never existed in this function. The result was a ReferenceError right
+  // after the hook file had been written — the hook was left on disk and never
+  // registered, and --protect failed every single time it was run.
   const hookCmd = `bash ${toBashPath(hookPath)}`;
-  const hasBlocks = rules.some(r => r.type === 'block');
-  const hasApproves = rules.some(r => r.type === 'approve');
-  const hasProtects = rules.some(r => r.type === 'protect');
-
-  // Block and approve rules need Bash matcher
-  if (hasBlocks || hasApproves) {
-    let bashMatcher = settings.hooks.PreToolUse.find(e => e.matcher === 'Bash');
-    if (!bashMatcher) {
-      bashMatcher = { matcher: 'Bash', hooks: [] };
-      settings.hooks.PreToolUse.push(bashMatcher);
-    }
-    if (!bashMatcher.hooks.some(h => h.command === hookCmd)) {
-      bashMatcher.hooks.push({ type: 'command', command: hookCmd });
-    }
+  let editMatcher = settings.hooks.PreToolUse.find(e => e.matcher === 'Edit|Write');
+  if (!editMatcher) {
+    editMatcher = { matcher: 'Edit|Write', hooks: [] };
+    settings.hooks.PreToolUse.push(editMatcher);
   }
-
-  // Protect rules need Edit|Write matcher
-  if (hasProtects) {
-    let editMatcher = settings.hooks.PreToolUse.find(e => e.matcher === 'Edit|Write');
-    if (!editMatcher) {
-      editMatcher = { matcher: 'Edit|Write', hooks: [] };
-      settings.hooks.PreToolUse.push(editMatcher);
-    }
-    if (!editMatcher.hooks.some(h => h.command === hookCmd)) {
-      editMatcher.hooks.push({ type: 'command', command: hookCmd });
-    }
+  if (!editMatcher.hooks.some(h => h.command === hookCmd)) {
+    editMatcher.hooks.push({ type: 'command', command: hookCmd });
   }
 
   writeFileSync(SETTINGS_PATH, JSON.stringify(settings, null, 2));
@@ -5530,6 +6583,35 @@ async function doctor() {
   const fail = (msg) => { console.log(c.red + '  ✗ ' + c.reset + msg); issues++; };
   const warn = (msg) => { console.log(c.yellow + '  ! ' + c.reset + msg); warnings++; };
 
+  // 0. Environment variables that stop hooks loading at all.
+  //
+  // This runs before everything else because it is the one state where every check
+  // below can pass and still nothing runs — which is precisely the false reassurance
+  // this command exists to prevent.
+  //
+  // Measured 2026-09-19 on Claude Code 2.1.278 (Linux/WSL2) with a control: with
+  // CLAUDE_CODE_RESTRICTED=1 or CLAUDE_CODE_SAFE_MODE=1 set, a UserPromptSubmit hook
+  // installed in the user, project and local files did not fire once, while the same
+  // hook fired in all three scopes without them. Only the value "1" was measured; any
+  // other non-empty, non-false value is flagged on the assumption that someone who
+  // typed it meant to turn it on.
+  const envOn = (v) => typeof v === 'string' && v !== '' && v !== '0' && v.toLowerCase() !== 'false';
+  const safeModeEnv = process.env.CLAUDE_CODE_SAFE_MODE;
+  const restrictedEnv = process.env.CLAUDE_CODE_RESTRICTED;
+
+  if (envOn(safeModeEnv)) {
+    fail('CLAUDE_CODE_SAFE_MODE=' + safeModeEnv + ' — Claude Code loads none of your hooks');
+    console.log(c.dim + '    Bash and the other tools keep working normally, so nothing looks wrong.' + c.reset);
+    console.log(c.dim + '    --settings does NOT restore hooks in this mode.' + c.reset);
+    console.log(c.dim + '    Fix: unset CLAUDE_CODE_SAFE_MODE (check your shell profile, it is read once)' + c.reset);
+  } else if (envOn(restrictedEnv)) {
+    fail('CLAUDE_CODE_RESTRICTED=' + restrictedEnv + ' — user, project and local hooks are not loaded');
+    console.log(c.dim + '    Bash is removed too, so Bash-matched guards could not fire regardless.' + c.reset);
+    console.log(c.dim + '    Fix: unset CLAUDE_CODE_RESTRICTED, or pass your hooks with --settings' + c.reset);
+  } else {
+    pass('no hook-disabling environment variable set');
+  }
+
   // 1. Check jq
   try {
     execSync('which jq', { stdio: 'pipe' });
@@ -5543,7 +6625,7 @@ async function doctor() {
   // 2. Check settings.json exists
   if (!existsSync(SETTINGS_PATH)) {
     fail('~/.claude/settings.json does not exist');
-    console.log(c.dim + '    Fix: npx cc-safe-setup' + c.reset);
+    console.log(c.dim + '    Fix: npx github:yurukusa/cc-safe-setup' + c.reset);
   } else {
     pass('settings.json exists');
 
@@ -5554,7 +6636,7 @@ async function doctor() {
       pass('settings.json is valid JSON');
     } catch (e) {
       fail('settings.json has invalid JSON: ' + e.message);
-      console.log(c.dim + '    Fix: npx cc-safe-setup --uninstall && npx cc-safe-setup' + c.reset);
+      console.log(c.dim + '    Fix: npx github:yurukusa/cc-safe-setup --uninstall && npx github:yurukusa/cc-safe-setup' + c.reset);
     }
 
     if (settings) {
@@ -5582,7 +6664,7 @@ async function doctor() {
                 if (cmd.includes('\\')) {
                   fail('Windows backslash in hook command: ' + cmd);
                   const fixed = cmd.replace(/\\/g, '/');
-                  console.log(c.dim + '    Fix: npx cc-safe-setup --uninstall && npx cc-safe-setup@latest' + c.reset);
+                  console.log(c.dim + '    Fix: npx github:yurukusa/cc-safe-setup --uninstall && npx github:yurukusa/cc-safe-setup' + c.reset);
                   console.log(c.dim + '    Or manually change to: ' + fixed + c.reset);
                   continue;
                 }
@@ -5657,13 +6739,213 @@ async function doctor() {
   // 12. Check hooks directory
   if (!existsSync(HOOKS_DIR)) {
     fail('~/.claude/hooks/ directory does not exist');
-    console.log(c.dim + '    Fix: npx cc-safe-setup' + c.reset);
+    console.log(c.dim + '    Fix: npx github:yurukusa/cc-safe-setup' + c.reset);
   } else {
     const files = readdirSync(HOOKS_DIR).filter(f => f.endsWith('.sh'));
     pass('hooks directory exists (' + files.length + ' scripts)');
   }
 
-  // 13. Check Claude Code version (needs hooks support)
+  // 13. Check that each installed hook sits on the event it declares.
+  // A hook wired to the wrong event installs cleanly, reports success, and then
+  // never fires — the worst failure this project has, because the operator
+  // believes they are covered. Two ways it happens: the header form that older
+  // installs did not parse (fixed in installExample, but settings.json written
+  // before that keeps the wrong entry), and hand-edited settings. Read-only:
+  // report the mismatch and how to correct it, never rewrite settings here.
+  try {
+    const declaredFor = (scriptPath) => {
+      if (!existsSync(scriptPath)) return null;
+      const body = readFileSync(scriptPath, 'utf8');
+      const t = body.match(/^#\s*[Tt][Rr][Ii][Gg][Gg][Ee][Rr]:\s*(\S+)/m);
+      if (!t) return null;
+      const mRaw =
+        body.match(/^#\s*[Mm][Aa][Tt][Cc][Hh][Ee][Rr]:\s*(.+)$/m) ||
+        body.match(/^#\s*[Tt][Rr][Ii][Gg][Gg][Ee][Rr]:\s*\S+\s+[Mm][Aa][Tt][Cc][Hh][Ee][Rr]:\s*(.+)$/m);
+      let matcher = null;
+      if (mRaw) {
+        const q = mRaw[1].match(/^"([^"]*)"/);
+        matcher = q ? q[1] : mRaw[1].trim();
+      }
+      // 宣言と登録先が一致していても、本体が別のイベント名で決定を返していれば
+      // その決定は宛先の違う封筒になり、静かに効かない。ここまで読んで初めて
+      // 「宣言どおりの場所に居る」が「宣言どおりに効く」になる。
+      // 終了コードだけで判断するフックは封筒を出さないので、その場合は null。
+      const envs = [...new Set([...body.matchAll(/"hookEventName"\s*:\s*"([A-Za-z]+)"/g)].map(m => m[1]))];
+      return { trigger: t[1], matcher, emitted: envs.length ? envs : null };
+    };
+
+    const settings = existsSync(SETTINGS_PATH)
+      ? JSON.parse(readFileSync(SETTINGS_PATH, 'utf8'))
+      : {};
+    const mismatched = [];
+    let inspected = 0;
+    for (const [event, entries] of Object.entries(settings.hooks || {})) {
+      for (const entry of (entries || [])) {
+        const registered = entry.matcher;
+        for (const h of (entry.hooks || [])) {
+          const hit = String(h.command || '').match(/([^/\\ "']+\.sh)/);
+          if (!hit) continue;
+          const decl = declaredFor(join(HOOKS_DIR, hit[1]));
+          if (!decl) continue;
+          inspected++;
+          // "Edit|Write" and "Write|Edit" select the same tools. Comparing the
+          // raw strings would report a difference that changes nothing, and a
+          // diagnostic that cries wolf stops being read.
+          const asSet = (v) => (v == null ? null :
+            String(v).split('|').map(s => s.trim()).filter(Boolean).sort().join('|'));
+          const wrongEvent = decl.trigger !== event;
+          const wrongMatcher = decl.matcher !== null &&
+            asSet(decl.matcher) !== asSet(registered ?? '');
+          // 2026-09-03 に足した3本目。prefer-builtin-tools.sh は
+          // ヘッダも登録先も PermissionRequest で一致していたのに、本体は
+          // PreToolUse の封筒を返しており、隔離して測ると3条件とも一度も呼ばれなかった。
+          // この検査は当時「every installed hook sits on the event it declares」と
+          // 緑の印を出していた。一致していたのは2つだけで、3つ目を見ていなかった。
+          const wrongEnvelope = Array.isArray(decl.emitted) && !decl.emitted.includes(event);
+          if (wrongEvent || wrongMatcher || wrongEnvelope) {
+            mismatched.push({ name: hit[1], event, registered, decl, wrongEnvelope });
+          }
+        }
+      }
+    }
+    if (inspected === 0) {
+      pass('no installed hook declares an event to verify');
+    } else if (mismatched.length === 0) {
+      pass('every installed hook sits on the event it declares, and answers in that event\'s envelope (' + inspected + ' checked)');
+    } else {
+      fail(mismatched.length + ' of ' + inspected + ' installed hooks are wired to the wrong event or tool — they run at the wrong time, or never');
+      for (const m of mismatched) {
+        console.log(c.dim + '    ' + m.name + ': registered ' + m.event +
+          ' matcher ' + JSON.stringify(m.registered ?? null) +
+          ', declares ' + m.decl.trigger + ' matcher ' + JSON.stringify(m.decl.matcher) + c.reset);
+        if (m.wrongEnvelope) {
+          console.log(c.dim + '      and it answers with hookEventName ' + JSON.stringify(m.decl.emitted) +
+            ', not ' + JSON.stringify(m.event) + ' — the decision is addressed to a different event,' +
+            ' so it is ignored even when the hook runs.' + c.reset);
+        }
+      }
+      console.log(c.dim + '    Fix: npx github:yurukusa/cc-safe-setup --install-example <name> rewrites the entry from the header,' + c.reset);
+      console.log(c.dim + '    or correct the event and matcher in ~/.claude/settings.json by hand.' + c.reset);
+    }
+  } catch (e) {
+    warn('could not verify hook events against their headers (' + e.message + ')');
+  }
+
+  // 15. Check for near-miss (misspelled) keys in settings.json.
+  //
+  // Claude Code ignores unknown settings keys in silence: no warning, no error,
+  // exit code 0. Measured on v2.1.220 with isolated --settings files:
+  //   permissions.denyy   -> the denied command ran, exit 0, zero warnings
+  //   hooks.PreToolUsee   -> the hook was never invoked, zero warnings
+  //   sandbox.failIfUnavailble -> started unprotected, exit 0
+  // The hook body was unchanged in the second case; only the event key differed.
+  // `claude doctor` does not check spelling, and there is no non-interactive
+  // command that prints the effective settings. So a control can be void from
+  // the day it was written and look exactly like a control that works: both
+  // produce "nothing bad happened".
+  //
+  // Design: only report keys that are ONE or TWO edits away from a known key.
+  // An unknown key that is far from every known one is probably a setting this
+  // release of cc-safe-setup has not heard of yet, and shouting about it would
+  // train the operator to ignore this diagnostic. Read-only: never rewrite.
+  const KNOWN_TOP = [
+    'permissions', 'hooks', 'env', 'model', 'defaultMode', 'sandbox', 'statusLine',
+    'apiKeyHelper', 'includeCoAuthoredBy', 'cleanupPeriodDays', 'forceLoginMethod',
+    'outputStyle', 'autoUpdates', 'alwaysThinkingEnabled', 'spinnerTipsEnabled',
+    'enableAllProjectMcpServers', 'enabledMcpjsonServers', 'disabledMcpjsonServers',
+    'awsAuthRefresh', 'awsCredentialExport', 'otelHeadersHelper',
+  ];
+  const KNOWN_EVENTS = [
+    'PreToolUse', 'PostToolUse', 'Notification', 'Stop', 'SubagentStop',
+    'SubagentStart', 'UserPromptSubmit', 'PreCompact', 'PostCompact',
+    'SessionStart', 'SessionEnd', 'DirectoryAdded',
+  ];
+  const KNOWN_PERMISSION_KEYS = ['allow', 'deny', 'ask', 'additionalDirectories', 'defaultMode'];
+  // sandbox sub-keys. `failIfUnavailable` is the one that decides whether a
+  // missing dependency stops the session or silently drops the sandbox, so a
+  // typo here is the difference between "refused to start" and "ran unprotected".
+  const KNOWN_SANDBOX_KEYS = [
+    'enabled', 'failIfUnavailable', 'network', 'allowedDomains', 'strictAllowlist',
+    'autoAllowBashIfSandboxed', 'allowManagedDomainsOnly', 'allowUnixSockets',
+    'allowLocalBinding', 'excludedPaths',
+  ];
+
+  const editDistance = (a, b) => {
+    const m = a.length, n = b.length;
+    let prev = Array.from({ length: n + 1 }, (_, j) => j);
+    for (let i = 1; i <= m; i++) {
+      const cur = [i];
+      for (let j = 1; j <= n; j++) {
+        cur[j] = Math.min(
+          prev[j] + 1,
+          cur[j - 1] + 1,
+          prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1),
+        );
+      }
+      prev = cur;
+    }
+    return prev[n];
+  };
+
+  // Near-miss only. Requires the key to be long enough that a 1-edit match is
+  // meaningful: on a 3-letter key, distance 1 hits unrelated words constantly.
+  const nearMiss = (key, known) => {
+    if (known.includes(key)) return null;
+    let best = null;
+    for (const k of known) {
+      if (Math.abs(k.length - key.length) > 2) continue;
+      const d = editDistance(key.toLowerCase(), k.toLowerCase());
+      const limit = k.length >= 8 ? 2 : 1;
+      if (d > 0 && d <= limit && (best === null || d < best.d)) best = { k, d };
+    }
+    return best;
+  };
+
+  try {
+    const settings = existsSync(SETTINGS_PATH)
+      ? JSON.parse(readFileSync(SETTINGS_PATH, 'utf8'))
+      : null;
+    if (settings === null) {
+      // Check 2 already reported the missing file; do not repeat it here.
+    } else {
+      const typos = [];
+      for (const key of Object.keys(settings)) {
+        const hit = nearMiss(key, KNOWN_TOP);
+        if (hit) typos.push({ where: '', key, suggest: hit.k });
+      }
+      for (const key of Object.keys(settings.permissions || {})) {
+        const hit = nearMiss(key, KNOWN_PERMISSION_KEYS);
+        if (hit) typos.push({ where: 'permissions.', key, suggest: hit.k });
+      }
+      for (const key of Object.keys(settings.hooks || {})) {
+        const hit = nearMiss(key, KNOWN_EVENTS);
+        if (hit) typos.push({ where: 'hooks.', key, suggest: hit.k });
+      }
+      const sandboxRoot = settings.sandbox || {};
+      for (const key of Object.keys(sandboxRoot)) {
+        const hit = nearMiss(key, KNOWN_SANDBOX_KEYS);
+        if (hit) typos.push({ where: 'sandbox.', key, suggest: hit.k });
+      }
+      for (const key of Object.keys(sandboxRoot.network || {})) {
+        const hit = nearMiss(key, KNOWN_SANDBOX_KEYS);
+        if (hit) typos.push({ where: 'sandbox.network.', key, suggest: hit.k });
+      }
+      if (typos.length === 0) {
+        pass('no misspelled settings keys (checked top level, permissions, hook events, sandbox)');
+      } else {
+        fail(typos.length + ' settings key(s) look like typos — Claude Code ignores unknown keys in silence, so these controls are not in force');
+        for (const t of typos) {
+          console.log(c.dim + '    "' + t.where + t.key + '" — did you mean "' + t.where + t.suggest + '"?' + c.reset);
+        }
+        console.log(c.dim + '    Nothing warns you about this: a misspelled key and a working control both look like "nothing bad happened".' + c.reset);
+        console.log(c.dim + '    After fixing, confirm by tripping the control on purpose and watching it stop.' + c.reset);
+      }
+    }
+  } catch (e) {
+    warn('could not check settings keys for typos (' + e.message + ')');
+  }
+
+  // 14. Check Claude Code version (needs hooks support)
   try {
     const ver = execSync('claude --version 2>/dev/null || echo "not found"', { stdio: 'pipe' }).toString().trim();
     if (ver === 'not found') {
@@ -5799,9 +7081,9 @@ function scan() {
 
   // Display recommendations
   console.log(c.bold + '  Recommended hooks:' + c.reset);
-  console.log('  ' + c.dim + 'npx cc-safe-setup' + c.reset + ' (8 built-in hooks)');
+  console.log('  ' + c.dim + 'npx github:yurukusa/cc-safe-setup' + c.reset + ' (8 built-in hooks)');
   for (const ex of examples) {
-    console.log('  ' + c.dim + 'npx cc-safe-setup --install-example ' + ex + c.reset);
+    console.log('  ' + c.dim + 'npx github:yurukusa/cc-safe-setup --install-example ' + ex + c.reset);
   }
 
   // Generate CLAUDE.md
@@ -5825,13 +7107,167 @@ function scan() {
         console.log('  ' + c.dim + rule + c.reset);
       }
       console.log();
-      console.log(c.dim + '  Run with --apply to create: npx cc-safe-setup --scan --apply' + c.reset);
+      console.log(c.dim + '  Run with --apply to create: npx github:yurukusa/cc-safe-setup --scan --apply' + c.reset);
     }
   }
 
   console.log();
 }
 
+// Installing a hook copies the file. Nothing ever copies it back, so a hook
+// installed in March keeps running its March logic forever — including bugs that
+// were fixed here months later. Measured on a real four-month-old install:
+// 27 of the 31 hooks that came from this project no longer matched the shipped
+// version, and the oldest were 4.5 months behind. Three of those were missing the
+// `jq` guard that was added after they were installed, which is the difference
+// between "blocks the dangerous command" and "silently approves it".
+//
+// This command only reports. It never overwrites, because a file that differs may
+// be the user's own edit, and replacing that silently would be worse than stale.
+// Prints the shipped body of a core guard to stdout and nothing else, so it can
+// be piped into diff. It never writes to the hooks directory: an installed copy
+// that differs may be the user's own edit, and replacing that silently would be
+// worse than leaving it stale.
+function showCore(id) {
+  const key = id && id.replace(/\.sh$/, '');
+  if (!key || !Object.prototype.hasOwnProperty.call(SCRIPTS, key)) {
+    console.error('Unknown core guard: ' + (id || '(none given)'));
+    console.error('Available: ' + Object.keys(SCRIPTS).sort().join(', '));
+    process.exit(1);
+  }
+  process.stdout.write(SCRIPTS[key]);
+}
+
+function outdated() {
+  const examplesDir = join(__dirname, 'examples');
+  console.log();
+  console.log(c.bold + '  cc-safe-setup --outdated' + c.reset);
+  console.log(c.dim + '  Comparing your installed hooks against the versions shipped today.' + c.reset);
+  console.log();
+
+  if (!existsSync(HOOKS_DIR)) {
+    console.log('  ' + c.dim + 'No hooks directory at ' + HOOKS_DIR + c.reset);
+    console.log();
+    return;
+  }
+
+  const sha = (p) => createHash('sha256').update(readFileSync(p)).digest('hex');
+  const shaText = (s) => createHash('sha256').update(Buffer.from(s)).digest('hex');
+  const hasJqGuard = (s) => /command -v jq|which jq|hash jq/.test(s);
+  const shipped = new Set(
+    existsSync(examplesDir) ? readdirSync(examplesDir).filter((f) => f.endsWith('.sh')) : []
+  );
+  // The default install writes the core guards from scripts.json, NOT from
+  // examples/. Comparing only against examples/ made this command structurally
+  // blind to exactly the hooks it installs by default: every core guard landed in
+  // `foreign` and was reported as "not shipped by this project — not checked".
+  // Measured on 2026-08-12: three core guards on one machine were 2.5 months
+  // behind, and the largest was 8,307 bytes installed against 32,857 shipped —
+  // six dangerous command shapes that the shipped version blocks were passing.
+  const core = new Map(Object.keys(SCRIPTS).map((id) => [id + '.sh', SCRIPTS[id]]));
+  const installed = readdirSync(HOOKS_DIR).filter((f) => f.endsWith('.sh')).sort();
+
+  const same = [];
+  const differs = [];
+  const foreign = [];
+
+  for (const f of installed) {
+    const isCore = core.has(f);
+    if (!shipped.has(f) && !isCore) { foreign.push(f); continue; }
+    const instPath = join(HOOKS_DIR, f);
+    let instText, shipText, shipSha;
+    try {
+      instText = readFileSync(instPath, 'utf8');
+      if (isCore) {
+        shipText = core.get(f);
+        shipSha = shaText(shipText);
+      } else {
+        shipText = readFileSync(join(examplesDir, f), 'utf8');
+        shipSha = sha(join(examplesDir, f));
+      }
+    } catch {
+      foreign.push(f);
+      continue;
+    }
+    if (sha(instPath) === shipSha) { same.push(f); continue; }
+    differs.push({
+      name: f,
+      core: isCore,
+      // Only flag this when the installed copy actually parses with jq. A hook
+      // that never touches jq is not made unsafe by lacking the guard.
+      missingJqGuard: /\bjq\b/.test(instText) && hasJqGuard(shipText) && !hasJqGuard(instText),
+    });
+  }
+  // Core guards first: they are installed by default, so a stale one is the
+  // difference between "blocks the dangerous command" and "silently approves it".
+  differs.sort((a, b) => (b.core === true) - (a.core === true));
+
+  if (installed.length === 0) {
+    console.log('  ' + c.dim + 'No .sh hooks installed.' + c.reset);
+    console.log();
+    return;
+  }
+
+  if (differs.length === 0) {
+    console.log('  ' + c.green + '✓' + c.reset + ' All ' + same.length +
+      ' hook(s) from this project match the shipped version.');
+  } else {
+    console.log('  ' + c.yellow + '!' + c.reset + ' ' + differs.length +
+      ' of ' + (same.length + differs.length) +
+      ' hook(s) from this project differ from what ships today.');
+    console.log();
+    for (const d of differs) {
+      const flag = d.missingJqGuard
+        ? ' ' + c.red + '← reads input with jq but has no jq guard' + c.reset
+        : '';
+      const tag = d.core ? ' ' + c.red + '[core guard]' + c.reset : '';
+      console.log('    ' + c.yellow + '•' + c.reset + ' ' + d.name + tag + flag);
+    }
+    console.log();
+    console.log('  ' + c.dim + 'A difference means one of two things, and this command cannot tell them apart:' + c.reset);
+    console.log('  ' + c.dim + '  1. the shipped hook was fixed after you installed it, or' + c.reset);
+    console.log('  ' + c.dim + '  2. you edited your copy on purpose.' + c.reset);
+    const coreDiffs = differs.filter((d) => d.core);
+    if (coreDiffs.length > 0) {
+      console.log();
+      console.log('  ' + c.red + coreDiffs.length + ' of these are core guards' + c.reset +
+        c.dim + ' — installed by default, so a stale one is the difference between' + c.reset);
+      console.log('  ' + c.dim + 'blocking a dangerous command and silently approving it.' + c.reset);
+    }
+    const ex = differs.find((d) => !d.core);
+    if (ex) {
+      console.log();
+      console.log('  ' + c.dim + 'Look at the difference before replacing anything:' + c.reset);
+      console.log('  ' + c.dim + '  diff ' + join(HOOKS_DIR, ex.name) +
+        ' ' + join(examplesDir, ex.name) + c.reset);
+      console.log('  ' + c.dim + 'Take the shipped version of one hook:' + c.reset);
+      console.log('  ' + c.dim + '  npx github:yurukusa/cc-safe-setup --install-example ' +
+        ex.name.replace(/\.sh$/, '') + c.reset);
+    }
+    if (coreDiffs.length > 0) {
+      console.log();
+      console.log('  ' + c.dim + 'Core guards do not live in examples/, so --install-example cannot fetch' + c.reset);
+      console.log('  ' + c.dim + 'them. Print the shipped body and compare it yourself:' + c.reset);
+      console.log('  ' + c.dim + '  npx github:yurukusa/cc-safe-setup --show-core ' +
+        coreDiffs[0].name.replace(/\.sh$/, '') + c.reset);
+    }
+  }
+
+  if (same.length > 0 && differs.length > 0) {
+    console.log();
+    console.log('  ' + c.green + '✓' + c.reset + c.dim + ' ' + same.length +
+      ' other hook(s) already match.' + c.reset);
+  }
+  if (foreign.length > 0) {
+    console.log();
+    console.log('  ' + c.dim + foreign.length +
+      ' hook(s) are not shipped by this project — not checked.' + c.reset);
+  }
+  console.log();
+  // Exit code for CI: 0 = nothing differs, 1 = something differs.
+  if (differs.length > 0) process.exit(1);
+}
+
 async function main() {
   if (UNINSTALL) return uninstall();
   if (VERIFY) return verify();
@@ -5845,6 +7281,8 @@ async function main() {
   if (VALIDATE) return validateHooks();
   if (SAFE_MODE) return safeMode(!SAFE_MODE_OFF);
   if (DOCTOR) return doctor();
+  if (SHOW_CORE_IDX !== -1) return showCore(SHOW_CORE);
+  if (OUTDATED) return outdated();
   if (SIMULATE_CMD) return simulate(SIMULATE_CMD);
   if (PROTECT_PATH) return protect(PROTECT_PATH);
   if (RULES_FILE) return compileRules(RULES_FILE);
@@ -5865,6 +7303,7 @@ async function main() {
   if (TEAM) return team();
   if (PROFILE_IDX !== -1) return profile(PROFILE);
   if (ANALYZE) return analyze();
+  if (BLINDSPOTS) return blindspots();
   if (OPUS47) return opus47();
   if (SHIELD) return shield();
   if (QUICKFIX) return quickfix();
@@ -5876,6 +7315,7 @@ async function main() {
   if (DASHBOARD) return dashboard();
   if (BENCHMARK) return benchmark();
   if (SHARE) return share();
+  if (SCORECARD) return scorecard();
   if (DIFF_FILE) return diff(DIFF_FILE);
   if (LINT) return lint();
   if (CREATE_DESC) return createHook(CREATE_DESC);
@@ -5976,20 +7416,115 @@ async function main() {
   console.log(c.bold + '  Done.' + c.reset + ' ' + Object.keys(HOOKS).length + ' safety hooks installed.');
   console.log('  ' + c.dim + 'Restart Claude Code to activate.' + c.reset);
   console.log();
-  console.log('  ' + c.dim + 'Next steps:' + c.reset);
-  console.log('  ' + c.blue + '  --doctor' + c.reset + '            Verify hooks work');
-  console.log('  ' + c.blue + '  --simulate "cmd"' + c.reset + '    Test how hooks react');
-  console.log('  ' + c.blue + '  --shield' + c.reset + '            Maximum safety (recommended)');
-  console.log('  ' + c.blue + '  --opus47' + c.reset + '            Opus 4.7 crisis protection');
-  console.log();
-  console.log('  ' + c.dim + 'Free tools:' + c.reset);
-  console.log('  ' + c.blue + '  Token Checkup' + c.reset + '  https://yurukusa.github.io/cc-safe-setup/token-checkup.html');
-  console.log('  ' + c.blue + '  Token Book' + c.reset + '     https://yurukusa.github.io/cc-safe-setup/token-book.html');
-  console.log('  ' + c.dim + '  28 web tools: https://yurukusa.github.io/cc-safe-setup/hub.html' + c.reset);
-  console.log();
-  console.log('  ' + c.dim + 'Tokens disappearing too fast?' + c.reset);
-  console.log('  ' + c.blue + '  Token Book' + c.reset + '  Cut consumption in half — https://yurukusa.github.io/cc-safe-setup/token-book.html');
-  console.log('  ' + c.dim + '  Safety Guide: https://zenn.dev/yurukusa/books/6076c23b1cb18b' + c.reset);
+  // 以前は「You are now protected against:」と書いてこの5つを並べていた。
+  // 並べている危険は合っているが、「守られている」は断定しすぎで、測れる範囲では正しくない。
+  // 入れた柵の多くは命令の先頭に錨を置くので、`cd x && git push -f` の形には届かない。
+  // ここに並んでいる強制push も .env も同じ。いちばん具体的に安心させている場所だったので、
+  // 「何を狙う柵か」という事実に戻し、覆えているかは利用者自身の履歴から数えて見せる。
+  console.log('  ' + c.bold + 'What these guards are aimed at:' + c.reset);
+  console.log('  ' + c.green + '  ✓' + c.reset + ' rm -rf / git reset --hard / git clean -fd');
+  console.log('  ' + c.green + '  ✓' + c.reset + ' Force-push to main/master');
+  console.log('  ' + c.green + '  ✓' + c.reset + ' .env / credential files committed to git');
+  console.log('  ' + c.green + '  ✓' + c.reset + ' Syntax errors cascading through files');
+  console.log('  ' + c.green + '  ✓' + c.reset + ' PowerShell Remove-Item -Recurse -Force');
+  console.log();
+  const shapeDefault = await commandShapeSample();
+  if (shapeDefault) {
+    console.log('  ' + c.dim + 'Aimed at is not the same as covering. Most of these match the start of the' + c.reset);
+    console.log('  ' + c.dim + 'command string, and in your most recent sessions ' + c.reset +
+      c.bold + shapeDefault.compoundPct.toFixed(1) + '%' + c.reset + c.dim +
+      ' of ' + shapeDefault.calls.toLocaleString() + ' Bash' + c.reset);
+    console.log('  ' + c.dim + 'calls are compound (' + c.reset + 'cd … && git push …' + c.dim + '), which they do not see.' + c.reset);
+    console.log('  ' + c.dim + 'Which of yours have that gap:' + c.reset + '  npx github:yurukusa/cc-safe-setup --blindspots');
+  } else {
+    console.log('  ' + c.dim + 'Aimed at is not the same as covering. Most of these match the start of the' + c.reset);
+    console.log('  ' + c.dim + 'command string, so a command that reaches them only after a separator can' + c.reset);
+    console.log('  ' + c.dim + 'go past. Once you have some history:' + c.reset + '  npx github:yurukusa/cc-safe-setup --blindspots');
+  }
+  console.log();
+  console.log('  ' + c.dim + 'Verify:' + c.reset + '  npx github:yurukusa/cc-safe-setup --verify');
+  console.log('  ' + c.dim + 'More:' + c.reset + '    npx github:yurukusa/cc-safe-setup --shield  (maximum safety)');
+  console.log('  ' + c.dim + 'Diagnose:' + c.reset + ' https://yurukusa.github.io/cc-safe-setup/token-checkup.html');
+  console.log('  ' + c.dim + 'Risk:' + c.reset + '     https://yurukusa.github.io/cc-safe-setup/risk-assessment.html');
+  console.log('  ' + c.dim + 'Clusters:' + c.reset + ' https://yurukusa.github.io/cc-safe-setup/cluster-tracker.html  (7 open clusters, ~11,500 user reactions across 60+ issues)');
+  console.log('  ' + c.dim + 'AGENTS.md:' + c.reset + ' https://yurukusa.github.io/cc-safe-setup/agents-md-setup-generator.html  (pick your tools → exact CLAUDE.md/AGENTS.md setup; the #6235 gap, EN/日本語)');
+  console.log();
+  const daysLeft2 = daysUntilJune15();
+  const june15msg2 = daysLeft2 > 0
+    ? 'Anthropic splits programmatic billing in ' + daysLeft2 + (daysLeft2 === 1 ? ' day' : ' days') + '. claude -p invocations route to a separate credit bucket.'
+    : 'Anthropic split programmatic billing on June 15, 2026; claude -p invocations route to a separate credit bucket.';
+  console.log('  ' + c.yellow + '⚠ June 15:' + c.reset + ' ' + june15msg2);
+  console.log('  ' + c.dim + '  Free 90-sec diagnostic (refund template if needed):' + c.reset);
+  console.log('  ' + c.dim + '    https://htmlpreview.github.io/?https://gist.githubusercontent.com/yurukusa/d3a0e2403cc4078aa0183400c137d824/raw/wrong-charge-diagnostic.html' + c.reset);
+  console.log('  ' + c.dim + '  Decision framework (stay / switch / hybridize):' + c.reset);
+  console.log('  ' + c.dim + '    https://yurukusa.gumroad.com/l/claude-code-migration-playbook?utm_source=cc-safe-setup-cli&utm_medium=post-install&utm_campaign=migration-decision' + c.reset);
+  console.log();
+  // 2026-08-13: 導入直後は「自分の設定に何の守りが有って何が無いか」を見た直後で、
+  // 書面監査の意図がいちばん高い瞬間。それなのにこのブロックは監査3件に一度も触れていなかった。
+  // README には在るが深さ73〜96%の位置で、この面(全インストール者が見る)より読まれていない。
+  console.log('  ' + c.blue + 'Written audits:' + c.reset + ' the part a hook cannot check — whether your own files contradict each other');
+  console.log('  ' + c.dim + '  CLAUDE.md Audit / Token Burn Audit — $29 (¥3,980) each, one kind of file, report in 48h' + c.reset);
+  console.log('  ' + c.dim + '  Full-Surface Audit — $219 (¥29,800), CLAUDE.md x settings.json x hooks x session logs x CI, 72h' + c.reset);
+  console.log('  ' + c.dim + '  All three publish their full deliverable before you buy, each one run against my own setup' + c.reset);
+  console.log('  ' + c.dim + '  (including where it found my own numbers and my own hooks to be wrong):' + c.reset);
+  console.log('  ' + c.dim + '    https://github.com/yurukusa/cc-safe-setup/blob/main/SERVICES.md' + c.reset);
+  console.log();
+  // 2026-08-28: 「¥15,600 at list price」を数字ごと落とした。この額は
+  // 「いまの定価 × 累計の冊数」で、8/28 に事故防止本を ¥800 → ¥1,500 へ上げた時点で
+  // 旧価格の派生値として腐っていた（6冊 × ¥700 = ¥4,200 のずれ）。¥19,800 へ更新はしない。
+  // 次の値上げでも次の1冊でも同じように腐るうえ、この額は「売れた当時の値段の合計」ではないので、
+  // 社会的証明として掲げると買い手に実態より大きく見せることになる。冊数だけなら腐らない。
+  // 2026-09-25: この面(14日で clone 971回・607人が通る)が案内していた本は、
+  // 日本語の Zenn だけだった。npx を走らせる人の大半は英語圏で、同じ事故の記録の
+  // 英語版が Leanpub に7冊 在るのに1本もリンクが無かった。実測の裏づけ＝
+  // 9月の売上 ¥15,173 の100%が Leanpub の束で、Zenn は2か月 ¥0。
+  // 並べ替えの原則＝(1)いちばん役に立つ無料の物を先頭に置く
+  // (2)有料は「読む前に判断できる材料」(頁数と無料見本)だけ添えて1段 下げる。
+  // 全文＝~/ops/economics/leanpub-who-actually-paid-2026-09-25.md
+  console.log('  ' + c.blue + 'Field Manual (free):' + c.reset + ' this repository\'s documentation laid out as a path');
+  console.log('  ' + c.dim + '  The pre-flight checklist, what each guard actually refuses, how to make one fire on' + c.reset);
+  console.log('  ' + c.dim + '  purpose so you can watch it work, and what to read in the log afterwards.' + c.reset);
+  console.log('  ' + c.dim + '  124 pages, minimum price zero. Everything in it is also in this repository.' + c.reset);
+  console.log('  ' + c.dim + '    https://leanpub.com/claude-code-safety-field-manual' + c.reset);
+  console.log();
+  console.log('  ' + c.blue + 'Longer write-ups (EN):' + c.reset + ' the incident behind each hook, at length — six more titles');
+  console.log('  ' + c.dim + '  Safety Mastery 66p / Migration Playbook 251p / Token Savings 89p /' + c.reset);
+  console.log('  ' + c.dim + '  AGENTS.md Interop 49p / CLAUDE.md Under Test 86p / Claude Code Safety 68p.' + c.reset);
+  console.log('  ' + c.dim + '  Every one has a free sample you can read before deciding.' + c.reset);
+  console.log('  ' + c.dim + '    https://leanpub.com/b/cc-operators-complete  (all seven together, from $39)' + c.reset);
+  console.log();
+  console.log('  ' + c.blue + 'Japanese editions:' + c.reset + ' 13 purchases since March 2026 — https://zenn.dev/yurukusa');
+  console.log('  ' + c.dim + '  Anthropic公式ガイドにない事故防止 (97 chapters, free Chapters 1-3)' + c.reset);
+  console.log('  ' + c.dim + '    https://zenn.dev/yurukusa/books/6076c23b1cb18b' + c.reset);
+  console.log('  ' + c.dim + '  Claude Codeのトークン消費を半分にする (¥2,500, free Chapter 1)' + c.reset);
+  console.log('  ' + c.dim + '    https://zenn.dev/yurukusa/books/token-savings-guide' + c.reset);
+  // 2026-08-13: 12冊の露出と実売を突き合わせたら、いちばん高い ¥3,000 の企業パックは
+  // Qiita 234本のうち0本からしか指されておらず、この面でも名前が出ず「10 more titles」に埋もれていた。
+  // 生涯0件は市場の答えではなく、一度も機会を与えていないだけ。
+  // しかもこの画面は「自分の設定に何の守りが有るか」を見た直後＝チームへ配ってよいかを
+  // 判断している人がいる瞬間で、宛先が一致している。
+  // 実測＝~/ops/economics/exposure-vs-sales-2026-08-13.md
+  console.log('  ' + c.dim + '  Claude Code チーム/企業導入 安全パック (¥3,000, 9 chapters — for whoever has to sign off on team use)' + c.reset);
+  console.log('  ' + c.dim + '    https://zenn.dev/yurukusa/books/cc-team-safety-pack' + c.reset);
+  console.log('  ' + c.dim + '  9 more titles at the same place (Skills recipes, 800h log, AGENTS.md interop)' + c.reset);
+  console.log();
+  console.log('  ' + c.blue + 'Recurring track:' + c.reset + ' CC Safety Lab Founder (¥500/mo, Ko-fi, grandfathered)');
+  console.log('  ' + c.dim + '  Monthly digest of new failure clusters + cc-safe-setup hooks shipped that month.' + c.reset);
+  // 2026-08-13: ここは以前「June 2026: … July: …」と、配信していない号を配信済みのように書いていた。
+  // Ko-fi の投稿一覧を実測すると号は6本(04-23/04-24/05-08/05-15/05-22/08-08)で、6月と7月は落としている。
+  // tier の説明側は 2026-08-12 にそう直したのに、いちばん読まれるこの面に古い主張が残っていた。
+  console.log('  ' + c.dim + '  6 issues so far: 2026-04-23 / 04-24 / 05-08 / 05-15 / 05-22 / 08-08. June and July were missed.' + c.reset);
+  console.log('  ' + c.dim + '    https://yurukusa.github.io/cc-safe-setup/safety-lab.html#en' + c.reset);
+  console.log();
+  // 2026-07-27: Claim-Verify Handbook はいま未公開(商品ページの is_published が false)。
+  // 買えない商品を、導入直後の全利用者へ「live, $19」と案内していたので2行を落とした。
+  // URLは HTTP 200 を返すため、応答の番号だけでは死んでいると分からない。
+  console.log('  ' + c.blue + 'Sister handbook:' + c.reset + ' Sub-Agent Observability Handbook preview (full PDF pending)');
+  console.log('  ' + c.dim + '  Sub-Agent Observability Handbook (7-case sub-agent cluster + 4 defense hooks) — free preview, full PDF pending' + c.reset);
+  console.log('  ' + c.dim + '    https://gist.github.com/yurukusa/bc61438321b369dbd3765e2bd9702a80  (free Chapter 1 preview, EN)' + c.reset);
+  console.log();
+  console.log('  ' + c.dim + 'Feedback:' + c.reset + ' https://github.com/yurukusa/cc-safe-setup/discussions  (questions / patterns that worked)');
+  console.log('  ' + c.dim + 'Bug:' + c.reset + '      https://github.com/yurukusa/cc-safe-setup/issues/new/choose  (false positives / install issues)');
   console.log();
 }