cc-safe-setup 5.2.0 → 5.3.1

package/README.md

@@ -224,6 +224,7 @@ Or browse all available examples in [`examples/`](examples/):
 - **session-handoff.sh** — Auto-save git state and session info to `~/.claude/session-handoff.md` on session end
 - **diff-size-guard.sh** — Warn/block when committing too many files at once (default: warn at 10, block at 50)
 - **dependency-audit.sh** — Warn when installing packages not in manifest (npm/pip/cargo supply chain awareness)
+- **env-source-guard.sh** — Block sourcing .env files into shell environment ([#401](https://github.com/anthropics/claude-code/issues/401))
 - **symlink-guard.sh** — Detect symlink/junction traversal in rm targets ([#36339](https://github.com/anthropics/claude-code/issues/36339) [#764](https://github.com/anthropics/claude-code/issues/764))
 - **binary-file-guard.sh** — Warn when Write targets binary file types (images, archives)
 - **stale-branch-guard.sh** — Warn when working branch is far behind default

package/index.mjs

@@ -86,6 +86,8 @@ const SHARE = process.argv.includes('--share');
 const BENCHMARK = process.argv.includes('--benchmark');
 const DASHBOARD = process.argv.includes('--dashboard');
 const ISSUES = process.argv.includes('--issues');
+const COMPARE_IDX = process.argv.findIndex(a => a === '--compare');
+const COMPARE = COMPARE_IDX !== -1 ? { a: process.argv[COMPARE_IDX + 1], b: process.argv[COMPARE_IDX + 2] } : null;
 const CREATE_IDX = process.argv.findIndex(a => a === '--create');
 const CREATE_DESC = CREATE_IDX !== -1 ? process.argv.slice(CREATE_IDX + 1).join(' ') : null;
 
@@ -107,6 +109,7 @@ if (HELP) {
     npx cc-safe-setup --audit --json  Machine-readable output for CI/CD
     npx cc-safe-setup --scan       Detect tech stack, recommend hooks
     npx cc-safe-setup --learn      Learn from your block history
+    npx cc-safe-setup --compare <a> <b>  Compare two hooks side-by-side
     npx cc-safe-setup --issues        Show GitHub Issues each hook addresses
     npx cc-safe-setup --dashboard     Real-time status dashboard
     npx cc-safe-setup --benchmark     Measure hook execution time
@@ -360,6 +363,9 @@ function examples() {
       'commit-quality-gate.sh': 'Warn on vague or too-long commit messages',
       'diff-size-guard.sh': 'Warn/block on large diffs (10+ files warn, 50+ block)',
       'dependency-audit.sh': 'Warn on new package installs not in manifest',
+      'binary-file-guard.sh': 'Warn when Write targets binary file types',
+      'stale-branch-guard.sh': 'Warn when branch is far behind default',
+      'symlink-guard.sh': 'Detect symlink/junction traversal in rm targets',
       'cost-tracker.sh': 'Estimate session token cost ($1 warn, $5 alert)',
       'read-before-edit.sh': 'Warn when editing files not recently read',
     },
@@ -807,6 +813,90 @@ async function fullSetup() {
   console.log();
 }
 
+async function compare(hookA, hookB) {
+  const { spawnSync } = await import('child_process');
+  const { statSync } = await import('fs');
+
+  console.log();
+  console.log(c.bold + '  cc-safe-setup --compare' + c.reset);
+  console.log();
+
+  if (!hookA || !hookB) {
+    console.log(c.red + '  Usage: npx cc-safe-setup --compare <hook-a.sh> <hook-b.sh>' + c.reset);
+    process.exit(1);
+  }
+
+  // Resolve paths
+  const resolveHook = (h) => {
+    if (existsSync(h)) return h;
+    const inHooks = join(HOOKS_DIR, h);
+    if (existsSync(inHooks)) return inHooks;
+    const inExamples = join(__dirname, 'examples', h);
+    if (existsSync(inExamples)) return inExamples;
+    return null;
+  };
+
+  const pathA = resolveHook(hookA);
+  const pathB = resolveHook(hookB);
+
+  if (!pathA) { console.log(c.red + '  Hook A not found: ' + hookA + c.reset); process.exit(1); }
+  if (!pathB) { console.log(c.red + '  Hook B not found: ' + hookB + c.reset); process.exit(1); }
+
+  const nameA = hookA.split('/').pop();
+  const nameB = hookB.split('/').pop();
+
+  // Test cases
+  const tests = [
+    { name: 'empty input', input: '{}' },
+    { name: 'safe command', input: '{"tool_input":{"command":"echo hello"}}' },
+    { name: 'rm -rf /', input: '{"tool_input":{"command":"rm -rf /"}}' },
+    { name: 'rm -rf ~', input: '{"tool_input":{"command":"rm -rf ~"}}' },
+    { name: 'git push main', input: '{"tool_input":{"command":"git push origin main"}}' },
+    { name: 'git push --force', input: '{"tool_input":{"command":"git push --force"}}' },
+    { name: 'git add .env', input: '{"tool_input":{"command":"git add .env"}}' },
+    { name: 'git reset --hard', input: '{"tool_input":{"command":"git reset --hard"}}' },
+    { name: 'npm test', input: '{"tool_input":{"command":"npm test"}}' },
+    { name: 'cd && git log', input: '{"tool_input":{"command":"cd /tmp && git log"}}' },
+  ];
+
+  function runHook(path, input) {
+    const start = process.hrtime.bigint();
+    const result = spawnSync('bash', [path], { input, timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] });
+    const ms = Number(process.hrtime.bigint() - start) / 1_000_000;
+    return { exit: result.status ?? -1, ms, stderr: (result.stderr || Buffer.alloc(0)).toString().slice(0, 80) };
+  }
+
+  // Header
+  console.log('  ' + c.bold + 'Test'.padEnd(20) + nameA.padEnd(25) + nameB + c.reset);
+  console.log('  ' + '-'.repeat(65));
+
+  let sameCount = 0;
+  let diffCount = 0;
+
+  for (const test of tests) {
+    const a = runHook(pathA, test.input);
+    const b = runHook(pathB, test.input);
+    const same = a.exit === b.exit;
+    if (same) sameCount++; else diffCount++;
+
+    const exitA = a.exit === 0 ? c.green + 'allow' + c.reset : a.exit === 2 ? c.red + 'BLOCK' + c.reset : c.yellow + 'err' + a.exit + c.reset;
+    const exitB = b.exit === 0 ? c.green + 'allow' + c.reset : b.exit === 2 ? c.red + 'BLOCK' + c.reset : c.yellow + 'err' + b.exit + c.reset;
+    const marker = same ? ' ' : c.yellow + '≠' + c.reset;
+
+    console.log('  ' + marker + ' ' + test.name.padEnd(18) + (exitA + ' ' + a.ms.toFixed(0) + 'ms').padEnd(30) + exitB + ' ' + b.ms.toFixed(0) + 'ms');
+  }
+
+  // Size comparison
+  const sizeA = statSync(pathA).size;
+  const sizeB = statSync(pathB).size;
+
+  console.log('  ' + '-'.repeat(65));
+  console.log('  Same decisions: ' + sameCount + '/' + tests.length);
+  if (diffCount > 0) console.log('  ' + c.yellow + 'Different: ' + diffCount + c.reset);
+  console.log('  Size: ' + nameA + ' ' + sizeA + 'B vs ' + nameB + ' ' + sizeB + 'B');
+  console.log();
+}
+
 function issues() {
   // Map hooks to the GitHub Issues they address
   const ISSUE_MAP = [
@@ -2327,6 +2417,7 @@ async function main() {
   if (FULL) return fullSetup();
   if (DOCTOR) return doctor();
   if (WATCH) return watch();
+  if (COMPARE) return compare(COMPARE.a, COMPARE.b);
   if (ISSUES) return issues();
   if (DASHBOARD) return dashboard();
   if (BENCHMARK) return benchmark();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safe-setup",
-  "version": "5.2.0",
+  "version": "5.3.1",
   "description": "One command to make Claude Code safe for autonomous operation. 8 built-in + 39 examples. 23 commands including dashboard, issues, create, audit, lint, diff. 260 tests. 2,500+ daily npm downloads.",
   "main": "index.mjs",
   "bin": {