cc-safe-setup 30.0.5 → 30.0.7

package/README.md

@@ -9,7 +9,7 @@ npx github:yurukusa/cc-safe-setup
 
 The command is interactive: it shows what each hook does and lets you choose which to install into your `~/.claude/settings.json` (or a project-local `.claude/settings.json`). Nothing is installed without your confirmation. MIT licensed.
 
-> **Why not `npx cc-safe-setup`?** The npm release is stuck at 29.8.0 (2026-04-20) while this repository is at 30.0.4, and the gap is not cosmetic — 29.8.0 lets twenty-five command shapes through that the current code blocks. Details, including the comparison table, are in [The npm release is behind this repository](#the-npm-release-is-behind-this-repository) below.
+> **`npx cc-safe-setup` is current again.** The npm release sat at 29.8.0 (2026-04-20) for five months because publishing was blocked on a credential; **30.0.5 was published on 2026-09-24** and `latest` points at it. Either install command now gives you the same guards. If you installed from npm before that date you have 29.8.0, which lets twenty-five command shapes through that the current code blocks — the measurement, and how to check what you have, are in [The npm release was behind this repository](#the-npm-release-was-behind-this-repository) below.
 
 Reading this in order, rather than by section: **[The Claude Code Safety Field Manual](https://leanpub.com/claude-code-safety-field-manual)** is this repository's documentation laid out as a path — the pre-flight checklist, what each guard actually refuses, how to make one fire on purpose so you can watch it work, and what to read in the log afterwards. The minimum price is zero.
 
@@ -28,7 +28,7 @@ links such as a gist or GitHub itself, or with no referrer recorded at all.)
 | The hook runs, but never on the commands you care about | Your pattern is anchored where your commands are not | [A hook can be installed, current, registered — and still never see you](#a-hook-can-be-installed-current-registered--and-still-never-see-you) |
 | You are not sure the hook does anything | You have not fired it on purpose yet | [Proving a hook fires](#proving-a-hook-fires) |
 | The hooks are installed but feel out of date | Installed copies are snapshots and do not update themselves | [Your installed hooks do not update themselves](#your-installed-hooks-do-not-update-themselves) |
-| `npx cc-safe-setup` behaves unlike this page | npm is serving an older release | [The npm release is behind this repository](#the-npm-release-is-behind-this-repository) |
+| `npx cc-safe-setup` behaves unlike this page | You installed before 2026-09-24, when npm was still serving 29.8.0 | [The npm release was behind this repository](#the-npm-release-was-behind-this-repository) |
 
 ## Install as a Claude Code plugin
 
@@ -71,9 +71,15 @@ These are the exit codes, not the intent. Read them before trusting the row abov
 Hooks stop a tool call before it runs. They are not a permission boundary — pair them with
 `permissions.deny` and keep secrets outside the repository.
 
-## The npm release is behind this repository
+<a id="the-npm-release-is-behind-this-repository"></a>
 
-`npx cc-safe-setup` currently installs **29.8.0**, published 2026-04-20. This repository is at **30.0.4**. Publishing is blocked on renewing an npm credential, so npm keeps serving 29.8.0 until that is done.
+## The npm release was behind this repository
+
+This is kept as a record, because the gap lasted five months and anyone who installed from npm in that window still has the old guards.
+
+From 2026-04-20 to 2026-09-24, `npx cc-safe-setup` installed **29.8.0** while this repository moved on: the publishing credential had expired and the account's only second factor is a hardware key, so nothing automated could replace it. That is fixed — publishing now runs through npm trusted publishing (OIDC), and **30.0.5 went out on 2026-09-24**. `npx cc-safe-setup` and `npx github:yurukusa/cc-safe-setup` now install the same code.
+
+If you installed before 2026-09-24, run `npx cc-safe-setup --outdated` to see which of your hooks differ from the current ones. The table below is what the difference was.
 
 The gap is not cosmetic. I fired twenty-two command shapes at both versions on 2026-09-03, feeding each guard the same JSON on stdin and running it with `bash` — the shell the installer names when it registers the hook. The guards shipped in 29.8.0 allow **nine** of those shapes that 30.0.4 refuses. Nothing went the other way: there is no shape 29.8.0 blocks and 30.0.4 lets through, and two harmless controls (`rm -rf node_modules`, `git push origin feature`) are allowed by both. Only `exit 2` counts as blocked here; `exit 1`, `exit 127` and a crash all let the command run.
 

package/SAFETY_CHECKLIST.md

@@ -53,9 +53,11 @@ Use this checklist before running Claude Code autonomously. Copy to your project
 | Commit without tests | verify-before-commit | `--install-example verify-before-commit` |
 | Session crash data loss | session-checkpoint | `--install-example session-checkpoint` |
 
-## Why `github:` and not the bare package name
-
-The npm entry is frozen at 29.8.0 (2026-04-20) and lets twenty-five command shapes through that the
-current code blocks — measured 2026-09-03 across twenty-two shapes, with nothing failing in
-the other direction. The table is in the README. Install from GitHub so the guards you get are
-the guards this checklist describes. The tool's own `--help` says the same thing.
+## `github:` and the bare package name now install the same thing
+
+The npm entry was frozen at 29.8.0 (2026-04-20) for five months and let twenty-five command
+shapes through that the current code blocks — measured 2026-09-03 across twenty-two shapes,
+with nothing failing in the other direction. The table is in the README. **30.0.5 was published
+on 2026-09-24**, so either install command now gives you the guards this checklist describes.
+If you installed before that date, run `npx cc-safe-setup --outdated` before you trust what you
+have.

package/action.yml

@@ -29,9 +29,9 @@ runs:
       shell: bash
       run: |
         echo "::group::Claude Code Safety Audit"
-        # Run the repository, not the npm entry. The published npm package is frozen at
-        # 29.8.0 (2026-04-20) and misses guards added since, so `npx cc-safe-setup@latest`
-        # would let this action pass a repository that the current checks refuse.
+        # Run the repository, not the npm entry. npm caught up on 2026-09-24 (30.0.5
+        # after five months on 29.8.0), but the repository is still the newest code by
+        # definition: it needs no publish step, so this action cannot fall behind it.
         npx -y github:yurukusa/cc-safe-setup --audit --json 2>/dev/null > /tmp/audit-json.txt || true
         npx -y github:yurukusa/cc-safe-setup --audit 2>&1 | tee /tmp/audit-output.txt
         echo "::endgroup::"

package/index.mjs

@@ -219,8 +219,8 @@ if (HELP) {
     npx github:yurukusa/cc-safe-setup             Install 8 safety hooks (30 sec)
     npx github:yurukusa/cc-safe-setup --shield    Maximum safety — one command
     npx github:yurukusa/cc-safe-setup --doctor    Diagnose hook problems
-    (the npm entry is frozen at 29.8.0 / 2026-04-20 and lets twenty-five
-     command shapes through that the current code blocks — install from GitHub)
+    (npx cc-safe-setup now installs the same code; npm sat at 29.8.0 / 2026-04-20
+     for five months, so run --outdated if you installed before 2026-09-24)
 
   Protect:
     --protect .env                 Block edits to a specific file
@@ -277,9 +277,10 @@ if (HELP) {
   Find hooks: npx cc-hook-registry search <keyword>
   Test hooks: npx cc-hook-test <hook.sh>
 
+  Field Manual:  https://leanpub.com/claude-code-safety-field-manual  (this repo as a book, free)
   Token Checkup: https://yurukusa.github.io/cc-safe-setup/token-checkup.html
   Token Book:    https://yurukusa.github.io/cc-safe-setup/token-book.html
-  Safety Guide:  https://zenn.dev/yurukusa/books/6076c23b1cb18b
+  Safety Guide:  https://zenn.dev/yurukusa/books/6076c23b1cb18b  (Japanese)
 
   Hitting nested sub-agent dispatch (Task tool absent from sub-agent contexts)?
   See: https://gist.github.com/yurukusa/cf477f03f03d9f93c184f1fb7d894f96
@@ -1930,9 +1931,17 @@ async function audit() {
       // not a book link: the 100 real incidents validate the abstract risks just
       // shown and cost nothing, so the deeper path stays free-education-first.
       console.log(c.dim + '  • 100 real incidents these guards prevent:  https://yurukusa.github.io/cc-safe-setup/incidents.html' + c.reset);
-      console.log(c.dim + '  • Incident-prevention guide (Ch.3 free):  https://zenn.dev/yurukusa/books/6076c23b1cb18b' + c.reset);
     }
+    // 2026-09-25: this list had no English destination at all — an English-speaking
+    // user was sent to a Japanese book as the only "go deeper" option. The field
+    // manual is this repository's own documentation, in English, minimum price zero.
+    // The Japanese guide moves to the end and says so, so a reader can tell before
+    // clicking which language they are about to land in.
+    console.log(c.dim + '  • Everything here as a book (English, free):  https://leanpub.com/claude-code-safety-field-manual' + c.reset);
     console.log(c.dim + '  • Cut token cost (Ch.1 free):  https://yurukusa.github.io/cc-safe-setup/token-book.html' + c.reset);
+    if (score < 80) {
+      console.log(c.dim + '  • Incident-prevention guide (Japanese, Ch.3 free):  https://zenn.dev/yurukusa/books/6076c23b1cb18b' + c.reset);
+    }
   }
 
   console.log();
@@ -3220,8 +3229,9 @@ async function team() {
   // steps first (value-first, not a sales pitch). The deeper paid guides have free
   // chapters, so they read as "go deeper if this helped" rather than an upsell.
   console.log(c.bold + '  Go deeper (all free to start):' + c.reset);
+  console.log(c.dim + '  • Everything here as a book (English, free):  https://leanpub.com/claude-code-safety-field-manual' + c.reset);
   console.log(c.dim + '  • Cut token cost (Ch.1 free):  https://yurukusa.github.io/cc-safe-setup/token-book.html' + c.reset);
-  console.log(c.dim + '  • Incident-prevention guide (Ch.3 free):  https://zenn.dev/yurukusa/books/6076c23b1cb18b' + c.reset);
+  console.log(c.dim + '  • Incident-prevention guide (Japanese, Ch.3 free):  https://zenn.dev/yurukusa/books/6076c23b1cb18b' + c.reset);
   console.log();
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safe-setup",
-  "version": "30.0.5",
+  "version": "30.0.7",
   "description": "Safety hooks for Claude Code: PreToolUse/PostToolUse/Stop guards that block destructive or irreversible operations at the tool boundary and surface silent failures. Interactive installer, plain shell scripts, no npm dependencies (the hooks read their JSON input with jq, python3 or node).",
   "main": "index.mjs",
   "bin": {
@@ -47,4 +47,4 @@
     "type": "github",
     "url": "https://github.com/sponsors/yurukusa"
   }
-}
+}