cc-safe-setup 30.0.4 → 30.0.6

package/README.md

@@ -9,7 +9,7 @@ npx github:yurukusa/cc-safe-setup
 
 The command is interactive: it shows what each hook does and lets you choose which to install into your `~/.claude/settings.json` (or a project-local `.claude/settings.json`). Nothing is installed without your confirmation. MIT licensed.
 
-> **Why not `npx cc-safe-setup`?** The npm release is stuck at 29.8.0 (2026-04-20) while this repository is at 30.0.4, and the gap is not cosmetic — 29.8.0 lets twenty-five command shapes through that the current code blocks. Details, including the comparison table, are in [The npm release is behind this repository](#the-npm-release-is-behind-this-repository) below.
+> **`npx cc-safe-setup` is current again.** The npm release sat at 29.8.0 (2026-04-20) for five months because publishing was blocked on a credential; **30.0.5 was published on 2026-09-24** and `latest` points at it. Either install command now gives you the same guards. If you installed from npm before that date you have 29.8.0, which lets twenty-five command shapes through that the current code blocks — the measurement, and how to check what you have, are in [The npm release was behind this repository](#the-npm-release-was-behind-this-repository) below.
 
 Reading this in order, rather than by section: **[The Claude Code Safety Field Manual](https://leanpub.com/claude-code-safety-field-manual)** is this repository's documentation laid out as a path — the pre-flight checklist, what each guard actually refuses, how to make one fire on purpose so you can watch it work, and what to read in the log afterwards. The minimum price is zero.
 
@@ -28,7 +28,7 @@ links such as a gist or GitHub itself, or with no referrer recorded at all.)
 | The hook runs, but never on the commands you care about | Your pattern is anchored where your commands are not | [A hook can be installed, current, registered — and still never see you](#a-hook-can-be-installed-current-registered--and-still-never-see-you) |
 | You are not sure the hook does anything | You have not fired it on purpose yet | [Proving a hook fires](#proving-a-hook-fires) |
 | The hooks are installed but feel out of date | Installed copies are snapshots and do not update themselves | [Your installed hooks do not update themselves](#your-installed-hooks-do-not-update-themselves) |
-| `npx cc-safe-setup` behaves unlike this page | npm is serving an older release | [The npm release is behind this repository](#the-npm-release-is-behind-this-repository) |
+| `npx cc-safe-setup` behaves unlike this page | You installed before 2026-09-24, when npm was still serving 29.8.0 | [The npm release was behind this repository](#the-npm-release-was-behind-this-repository) |
 
 ## Install as a Claude Code plugin
 
@@ -71,9 +71,13 @@ These are the exit codes, not the intent. Read them before trusting the row abov
 Hooks stop a tool call before it runs. They are not a permission boundary — pair them with
 `permissions.deny` and keep secrets outside the repository.
 
-## The npm release is behind this repository
+## The npm release was behind this repository
 
-`npx cc-safe-setup` currently installs **29.8.0**, published 2026-04-20. This repository is at **30.0.4**. Publishing is blocked on renewing an npm credential, so npm keeps serving 29.8.0 until that is done.
+This is kept as a record, because the gap lasted five months and anyone who installed from npm in that window still has the old guards.
+
+From 2026-04-20 to 2026-09-24, `npx cc-safe-setup` installed **29.8.0** while this repository moved on: the publishing credential had expired and the account's only second factor is a hardware key, so nothing automated could replace it. That is fixed — publishing now runs through npm trusted publishing (OIDC), and **30.0.5 went out on 2026-09-24**. `npx cc-safe-setup` and `npx github:yurukusa/cc-safe-setup` now install the same code.
+
+If you installed before 2026-09-24, run `npx cc-safe-setup --outdated` to see which of your hooks differ from the current ones. The table below is what the difference was.
 
 The gap is not cosmetic. I fired twenty-two command shapes at both versions on 2026-09-03, feeding each guard the same JSON on stdin and running it with `bash` — the shell the installer names when it registers the hook. The guards shipped in 29.8.0 allow **nine** of those shapes that 30.0.4 refuses. Nothing went the other way: there is no shape 29.8.0 blocks and 30.0.4 lets through, and two harmless controls (`rm -rf node_modules`, `git push origin feature`) are allowed by both. Only `exit 2` counts as blocked here; `exit 1`, `exit 127` and a crash all let the command run.
 
@@ -518,7 +522,9 @@ Contributions are welcome. Each hook should be a single shell script with a test
 Every hook here exists because something broke first — a destroyed working tree, a credential
 read that should not have happened, an overnight cost spike. The incident behind each one, what
 the logs actually looked like, and what finally stopped it, are written up at length. Those
-write-ups are books, and they are listed in [docs/books.md](docs/books.md).
+write-ups are books, and they are listed in [docs/books.md](docs/books.md). In English there are
+seven, sold together as [Claude Code Operator's Library: Complete Edition](https://leanpub.com/b/cc-operators-complete)
+(from $39); the Field Manual linked at the top of this file is one of them and its minimum price is zero.
 
 ## License
 

package/SAFETY_CHECKLIST.md

@@ -53,9 +53,11 @@ Use this checklist before running Claude Code autonomously. Copy to your project
 | Commit without tests | verify-before-commit | `--install-example verify-before-commit` |
 | Session crash data loss | session-checkpoint | `--install-example session-checkpoint` |
 
-## Why `github:` and not the bare package name
-
-The npm entry is frozen at 29.8.0 (2026-04-20) and lets twenty-five command shapes through that the
-current code blocks — measured 2026-09-03 across twenty-two shapes, with nothing failing in
-the other direction. The table is in the README. Install from GitHub so the guards you get are
-the guards this checklist describes. The tool's own `--help` says the same thing.
+## `github:` and the bare package name now install the same thing
+
+The npm entry was frozen at 29.8.0 (2026-04-20) for five months and let twenty-five command
+shapes through that the current code blocks — measured 2026-09-03 across twenty-two shapes,
+with nothing failing in the other direction. The table is in the README. **30.0.5 was published
+on 2026-09-24**, so either install command now gives you the guards this checklist describes.
+If you installed before that date, run `npx cc-safe-setup --outdated` before you trust what you
+have.

package/action.yml

@@ -29,9 +29,9 @@ runs:
       shell: bash
       run: |
         echo "::group::Claude Code Safety Audit"
-        # Run the repository, not the npm entry. The published npm package is frozen at
-        # 29.8.0 (2026-04-20) and misses guards added since, so `npx cc-safe-setup@latest`
-        # would let this action pass a repository that the current checks refuse.
+        # Run the repository, not the npm entry. npm caught up on 2026-09-24 (30.0.5
+        # after five months on 29.8.0), but the repository is still the newest code by
+        # definition: it needs no publish step, so this action cannot fall behind it.
         npx -y github:yurukusa/cc-safe-setup --audit --json 2>/dev/null > /tmp/audit-json.txt || true
         npx -y github:yurukusa/cc-safe-setup --audit 2>&1 | tee /tmp/audit-output.txt
         echo "::endgroup::"

package/index.mjs

@@ -219,8 +219,8 @@ if (HELP) {
     npx github:yurukusa/cc-safe-setup             Install 8 safety hooks (30 sec)
     npx github:yurukusa/cc-safe-setup --shield    Maximum safety — one command
     npx github:yurukusa/cc-safe-setup --doctor    Diagnose hook problems
-    (the npm entry is frozen at 29.8.0 / 2026-04-20 and lets twenty-five
-     command shapes through that the current code blocks — install from GitHub)
+    (npm serves 30.0.6 as of 2026-09-25; it sat at 29.8.0 / 2026-04-20 for five
+     months, so run --outdated if you installed before 2026-09-24)
 
   Protect:
     --protect .env                 Block edits to a specific file
@@ -7474,11 +7474,30 @@ async function main() {
   // 旧価格の派生値として腐っていた（6冊 × ¥700 = ¥4,200 のずれ）。¥19,800 へ更新はしない。
   // 次の値上げでも次の1冊でも同じように腐るうえ、この額は「売れた当時の値段の合計」ではないので、
   // 社会的証明として掲げると買い手に実態より大きく見せることになる。冊数だけなら腐らない。
-  console.log('  ' + c.blue + 'Zenn books (JP):' + c.reset + ' Author\'s own playbooks — 13 purchases since March 2026');
-  console.log('  ' + c.dim + '  Anthropic公式ガイドにない事故防止 (best-seller, 97 chapters, buyers get every later revision free)' + c.reset);
-  console.log('  ' + c.dim + '    https://zenn.dev/yurukusa/books/6076c23b1cb18b  (free Chapters 1-3)' + c.reset);
-  console.log('  ' + c.dim + '  Claude Codeのトークン消費を半分にする (¥2,500, revenue #1)' + c.reset);
-  console.log('  ' + c.dim + '    https://zenn.dev/yurukusa/books/token-savings-guide  (free Chapter 1)' + c.reset);
+  // 2026-09-25: この面(14日で clone 971回・607人が通る)が案内していた本は、
+  // 日本語の Zenn だけだった。npx を走らせる人の大半は英語圏で、同じ事故の記録の
+  // 英語版が Leanpub に7冊 在るのに1本もリンクが無かった。実測の裏づけ＝
+  // 9月の売上 ¥15,173 の100%が Leanpub の束で、Zenn は2か月 ¥0。
+  // 並べ替えの原則＝(1)いちばん役に立つ無料の物を先頭に置く
+  // (2)有料は「読む前に判断できる材料」(頁数と無料見本)だけ添えて1段 下げる。
+  // 全文＝~/ops/economics/leanpub-who-actually-paid-2026-09-25.md
+  console.log('  ' + c.blue + 'Field Manual (free):' + c.reset + ' this repository\'s documentation laid out as a path');
+  console.log('  ' + c.dim + '  The pre-flight checklist, what each guard actually refuses, how to make one fire on' + c.reset);
+  console.log('  ' + c.dim + '  purpose so you can watch it work, and what to read in the log afterwards.' + c.reset);
+  console.log('  ' + c.dim + '  124 pages, minimum price zero. Everything in it is also in this repository.' + c.reset);
+  console.log('  ' + c.dim + '    https://leanpub.com/claude-code-safety-field-manual' + c.reset);
+  console.log();
+  console.log('  ' + c.blue + 'Longer write-ups (EN):' + c.reset + ' the incident behind each hook, at length — six more titles');
+  console.log('  ' + c.dim + '  Safety Mastery 66p / Migration Playbook 251p / Token Savings 89p /' + c.reset);
+  console.log('  ' + c.dim + '  AGENTS.md Interop 49p / CLAUDE.md Under Test 86p / Claude Code Safety 68p.' + c.reset);
+  console.log('  ' + c.dim + '  Every one has a free sample you can read before deciding.' + c.reset);
+  console.log('  ' + c.dim + '    https://leanpub.com/b/cc-operators-complete  (all seven together, from $39)' + c.reset);
+  console.log();
+  console.log('  ' + c.blue + 'Japanese editions:' + c.reset + ' 13 purchases since March 2026 — https://zenn.dev/yurukusa');
+  console.log('  ' + c.dim + '  Anthropic公式ガイドにない事故防止 (97 chapters, free Chapters 1-3)' + c.reset);
+  console.log('  ' + c.dim + '    https://zenn.dev/yurukusa/books/6076c23b1cb18b' + c.reset);
+  console.log('  ' + c.dim + '  Claude Codeのトークン消費を半分にする (¥2,500, free Chapter 1)' + c.reset);
+  console.log('  ' + c.dim + '    https://zenn.dev/yurukusa/books/token-savings-guide' + c.reset);
   // 2026-08-13: 12冊の露出と実売を突き合わせたら、いちばん高い ¥3,000 の企業パックは
   // Qiita 234本のうち0本からしか指されておらず、この面でも名前が出ず「10 more titles」に埋もれていた。
   // 生涯0件は市場の答えではなく、一度も機会を与えていないだけ。
@@ -7487,7 +7506,7 @@ async function main() {
   // 実測＝~/ops/economics/exposure-vs-sales-2026-08-13.md
   console.log('  ' + c.dim + '  Claude Code チーム/企業導入 安全パック (¥3,000, 9 chapters — for whoever has to sign off on team use)' + c.reset);
   console.log('  ' + c.dim + '    https://zenn.dev/yurukusa/books/cc-team-safety-pack' + c.reset);
-  console.log('  ' + c.dim + '  9 more titles at https://zenn.dev/yurukusa  (Skills recipes, 800h log, AGENTS.md interop)' + c.reset);
+  console.log('  ' + c.dim + '  9 more titles at the same place (Skills recipes, 800h log, AGENTS.md interop)' + c.reset);
   console.log();
   console.log('  ' + c.blue + 'Recurring track:' + c.reset + ' CC Safety Lab Founder (¥500/mo, Ko-fi, grandfathered)');
   console.log('  ' + c.dim + '  Monthly digest of new failure clusters + cc-safe-setup hooks shipped that month.' + c.reset);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safe-setup",
-  "version": "30.0.4",
+  "version": "30.0.6",
   "description": "Safety hooks for Claude Code: PreToolUse/PostToolUse/Stop guards that block destructive or irreversible operations at the tool boundary and surface silent failures. Interactive installer, plain shell scripts, no npm dependencies (the hooks read their JSON input with jq, python3 or node).",
   "main": "index.mjs",
   "bin": {
@@ -47,4 +47,4 @@
     "type": "github",
     "url": "https://github.com/sponsors/yurukusa"
   }
-}
+}