chainlesschain 0.162.125 → 0.162.126

package/src/lib/mcp-oauth.js

@@ -38,6 +38,10 @@ export const _deps = {
   now: () => Date.now(),
   // Backoff sleep seam (tests override with a no-op so the retry doesn't wait).
   sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  // Visible-warning seam (silent under vitest; tests override to assert).
+  warn: (msg) => {
+    if (!process.env.VITEST) process.stderr.write(msg);
+  },
 };
 
 /** Discovery/token requests retry ONCE after a transient error (CC 2.1.191). */
@@ -371,17 +375,56 @@ export function tokenStorePath() {
   return pathDefault.join(_deps.homedir(), ".chainlesschain", "mcp-oauth.json");
 }
 
-export function loadTokenStore() {
-  const file = tokenStorePath();
+/**
+ * Read the token store, distinguishing "absent / empty" (ok) from "exists but
+ * unreadable / corrupt" (ok:false). The distinction matters on the WRITE path:
+ * a read-modify-write that treats an unreadable store as `{}` would overwrite
+ * and silently destroy every other server's token.
+ */
+function _readStore(file) {
+  if (!_deps.fs.existsSync(file)) return { ok: true, store: {} };
   try {
-    if (!_deps.fs.existsSync(file)) return {};
     const data = JSON.parse(_deps.fs.readFileSync(file, "utf-8"));
-    return data && typeof data === "object" ? data : {};
+    return { ok: true, store: data && typeof data === "object" ? data : {} };
+  } catch (err) {
+    return { ok: false, store: {}, err };
+  }
+}
+
+const _warnedCorruptStore = new Set();
+function _warnCorruptStoreOnce(file, err, archived) {
+  if (_warnedCorruptStore.has(file)) return;
+  _warnedCorruptStore.add(file);
+  _deps.warn(
+    `⚠️  MCP OAuth token store at ${file} is unreadable (${err?.message || "parse error"}). ` +
+      `Saved MCP logins are unavailable${archived ? `; the unreadable file was preserved as ${archived}` : ""} — ` +
+      "re-run `cc mcp login <url>` for the servers you use.\n",
+  );
+}
+
+/** Move an unreadable store aside so a fresh write doesn't destroy it. Returns
+ *  the archive path, or "" when it couldn't be moved (best-effort). */
+function _archiveCorruptStore(file) {
+  if (typeof _deps.fs.renameSync !== "function") return "";
+  const ts = typeof _deps.now === "function" ? _deps.now() : Date.now();
+  const dest = `${file}.corrupt-${ts}`;
+  try {
+    _deps.fs.renameSync(file, dest);
+    return dest;
   } catch {
-    return {};
+    return "";
   }
 }
 
+export function loadTokenStore() {
+  const file = tokenStorePath();
+  const r = _readStore(file);
+  // Read callers (getStoredToken) treat an unreadable store as "no token", but
+  // the user should still know their saved logins silently vanished.
+  if (!r.ok) _warnCorruptStoreOnce(file, r.err, "");
+  return r.store;
+}
+
 export function getStoredToken(serverUrl) {
   return loadTokenStore()[serverKey(serverUrl)] || null;
 }
@@ -527,7 +570,15 @@ function withStoreLock(file, fn) {
 export function saveStoredToken(serverUrl, record) {
   const file = tokenStorePath();
   return withStoreLock(file, () => {
-    const store = loadTokenStore(); // re-read inside the lock (latest state)
+    const r = _readStore(file); // re-read inside the lock (latest state)
+    if (!r.ok) {
+      // The existing store is unreadable. Writing a fresh single-entry store
+      // here would silently destroy every other server's token — move the
+      // unreadable file aside first so it can be recovered, and surface it.
+      const archived = _archiveCorruptStore(file);
+      _warnCorruptStoreOnce(file, r.err, archived);
+    }
+    const store = r.store;
     store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
     _writeStoreSecure(file, store);
     return store[serverKey(serverUrl)];
@@ -560,13 +611,28 @@ export function isTokenExpired(record, { skewMs = 60_000 } = {}) {
 /**
  * Return a valid bearer token for a server, refreshing if expired. Returns the
  * access_token string, or null if there's no stored token / refresh failed.
+ *
+ * `forceRefresh` bypasses the local-expiry check and exchanges the refresh
+ * token unconditionally. Use it when the server REJECTED a stored token that
+ * still looked unexpired locally (mid-session 401/403 from a rotated/revoked
+ * grant): the cached access_token is known-bad, so reusing it is pointless —
+ * we either mint a fresh one or return null to signal "re-login needed".
+ *
+ * @param {string} serverUrl
+ * @param {{ forceRefresh?: boolean }} [opts]
  */
-export async function ensureValidToken(serverUrl) {
+export async function ensureValidToken(
+  serverUrl,
+  { forceRefresh = false } = {},
+) {
   const record = getStoredToken(serverUrl);
   if (!record) return null;
-  if (!isTokenExpired(record)) return record.access_token;
+  if (!forceRefresh && !isTokenExpired(record)) return record.access_token;
   if (!record.refresh_token || !record.endpoints?.token_endpoint) {
-    return record.access_token || null; // can't refresh → use what we have
+    // Can't refresh. On a forced refresh the cached token is known-rejected, so
+    // hand back null (caller should stop retrying and prompt re-login); on the
+    // proactive path keep the existing behaviour of using what we have.
+    return forceRefresh ? null : record.access_token || null;
   }
   try {
     const tok = await refreshAccessToken(
@@ -576,7 +642,7 @@ export async function ensureValidToken(serverUrl) {
     const updated = saveStoredToken(serverUrl, { ...record, ...tok });
     return updated.access_token;
   } catch {
-    return record.access_token || null;
+    return forceRefresh ? null : record.access_token || null;
   }
 }
 

package/src/lib/permission-engine.js

@@ -4,6 +4,7 @@
  */
 
 import crypto from "crypto";
+import { safeJsonParse } from "./safe-json.js";
 
 function generateId() {
   return crypto.randomUUID();
@@ -160,7 +161,9 @@ export function getRoles(db) {
     .all();
   return rows.map((r) => ({
     ...r,
-    permissions: JSON.parse(r.permissions || "[]"),
+    // `|| "[]"` only guarded null — a corrupt permissions cell still threw out
+    // of the whole role list (and could break permission checks). Skip it.
+    permissions: safeJsonParse(r.permissions, []),
     isBuiltin: r.is_builtin === 1,
   }));
 }

package/src/lib/pipeline-orchestrator.js

@@ -553,7 +553,25 @@ export function retryStage(db, pipelineId, stageIndex) {
   const pipeline = _getPipelineRow(db, pipelineId);
   if (!pipeline) throw new Error(`Pipeline not found: ${pipelineId}`);
 
-  const stage = _getStageRow(db, pipelineId, stageIndex);
+  // A retry may only re-open the CURRENT stage or an EARLIER one. A forward
+  // jump would move current_stage past the intervening stages — skipping their
+  // approval GATES (CODE_REVIEW / DEPLOY) — and let a caller (`cc pipeline retry
+  // --stage N`, user-supplied) reach a later stage without the gates that guard
+  // it. Going backward is safe: advancing from there re-runs through every gate
+  // again. Mirrors the state-machine rigor of completeStage / approveGate.
+  const idx = Number(stageIndex);
+  if (!Number.isInteger(idx) || idx < 0) {
+    throw new Error(`Invalid stage index: ${stageIndex}`);
+  }
+  if (idx > pipeline.current_stage) {
+    throw new Error(
+      `Cannot retry stage ${idx}: it is ahead of the current stage ` +
+        `(${pipeline.current_stage}) — retrying forward would skip the ` +
+        `intervening stages and their approval gates`,
+    );
+  }
+
+  const stage = _getStageRow(db, pipelineId, idx);
   if (!stage) throw new Error(`Stage ${stageIndex} not found`);
 
   const now = _now();
@@ -572,7 +590,7 @@ export function retryStage(db, pipelineId, stageIndex) {
   });
   _updatePipelineFields(db, pipelineId, {
     status: PIPELINE_STATUS.RUNNING,
-    current_stage: stageIndex,
+    current_stage: idx,
     error_message: null,
     completed_at: null,
   });

package/src/lib/project-instructions.js

@@ -33,6 +33,7 @@
 import fsDefault from "fs";
 import pathDefault from "path";
 import osDefault from "os";
+import { credentialFileReason } from "./credential-guard.js";
 
 export const DEFAULT_MAX_FILE_BYTES = 48 * 1024; // per instruction/import file
 export const DEFAULT_MAX_TOTAL_BYTES = 192 * 1024; // whole block budget
@@ -321,6 +322,18 @@ export function loadProjectInstructions(opts = {}) {
       const resolved = path.resolve(baseDir, target);
       if (visited.has(resolved) || !isFile(fs, resolved)) continue; // silent:
       // non-files are decorative @tokens (npm scopes, emails), not imports.
+      // Refuse to import a credential / secret file. `cc agent` auto-loads
+      // project memory, so a cloned/untrusted repo's cc.md must NOT be able to
+      // pull `@~/.ssh/id_rsa` / `@../.env` into the LLM-bound system prompt
+      // (mirrors the read_file/run_shell credential guard).
+      const credReason = credentialFileReason(resolved);
+      if (credReason) {
+        visited.add(resolved); // don't re-warn on a second reference
+        warnings.push(
+          `refused @import of ${resolved} — ${credReason}; project memory must not pull secrets into the prompt`,
+        );
+        continue;
+      }
       visited.add(resolved);
       queue.push({ abs: resolved, scope: "import", depth: depth + 1 });
     }

package/src/lib/repl-denials.js

@@ -0,0 +1,137 @@
+/**
+ * repl-denials — record + render the policy denials seen during an agent run,
+ * so the interactive REPL's `/permissions denials` can review what got blocked
+ * AND a headless run (`cc agent -p`) can print an end-of-run summary (Claude-
+ * Code 2.1.193 parity: "auto-mode denial reasons … /permissions recent
+ * denials"). The helpers are generic (not REPL-specific) and shared by both.
+ *
+ * A *denial* is a tool call the agent was NOT allowed to run — blocked by the
+ * shell policy, an ApprovalGate tier, a settings permission rule, or a hook. It
+ * is distinct from a tool that ran and *failed* (non-zero exit, missing file):
+ * those carry an `error` but none of the denial markers below, so they are not
+ * recorded here.
+ *
+ * Pure + dependency-free so it unit-tests without the REPL runtime.
+ */
+
+/** Keep the most recent N denials per session (bounded ring buffer). */
+export const MAX_RECENT_DENIALS = 20;
+
+/** Error-message prefixes agent-core attaches to a blocked tool call. */
+const DENIAL_PREFIX = /^\s*\[(Shell Policy|Permission|ApprovalGate|Hook)\]/;
+
+/** Map a `[Prefix]` to a short `via` label when no structured field carries one. */
+function viaFromPrefix(errStr) {
+  const m = DENIAL_PREFIX.exec(errStr);
+  if (!m) return null;
+  return (
+    {
+      "Shell Policy": "shell-policy",
+      Permission: "settings",
+      ApprovalGate: "gate",
+      Hook: "hook",
+    }[m[1]] || "policy"
+  );
+}
+
+/**
+ * Classify a tool-result as a policy denial and extract a structured record,
+ * or return null when it is not a denial. Detection prefers the structured
+ * markers agent-core attaches (`approval.decision` / `policy.decision` /
+ * `shellCommandPolicy.allowed`) and falls back to the error-message prefix.
+ *
+ * @param {object} ev  { tool, result, error, argsSummary }
+ * @returns {{tool:string,summary:string,reason:string,via:string,rule:(string|null)}|null}
+ */
+export function classifyDenial(ev = {}) {
+  const { tool, result, error, argsSummary } = ev;
+  const errStr = String(error || (result && result.error) || "").trim();
+  const approval = result && result.approval;
+  const policy = result && result.policy;
+  const shellPol = result && result.shellCommandPolicy;
+  const denied =
+    (approval && approval.decision === "deny") ||
+    (policy && policy.decision === "deny") ||
+    (shellPol && shellPol.allowed === false) ||
+    DENIAL_PREFIX.test(errStr);
+  if (!denied) return null;
+  const via =
+    (approval && approval.via) ||
+    (policy && policy.via) ||
+    (shellPol ? "shell-policy" : viaFromPrefix(errStr)) ||
+    "policy";
+  const rule = (policy && policy.rule) || (shellPol && shellPol.ruleId) || null;
+  return {
+    tool: tool || "?",
+    summary: String(
+      argsSummary || (shellPol && shellPol.normalizedCommand) || "",
+    ).slice(0, 200),
+    reason: errStr || "(denied)",
+    via,
+    rule,
+  };
+}
+
+/** Two denials are "the same" attempt when tool + command + rule + via match. */
+function sameDenial(a, b) {
+  return (
+    a &&
+    b &&
+    a.tool === b.tool &&
+    a.summary === b.summary &&
+    a.via === b.via &&
+    a.rule === b.rule
+  );
+}
+
+/**
+ * Append a denial to a bounded most-recent-last ring buffer (mutates + returns
+ * it). Drops the oldest entries beyond `max`. No-op on a bad log/record.
+ *
+ * Consecutive identical denials are COALESCED: a model that hits a policy block
+ * usually retries the same command several times, which would otherwise flood
+ * the cap and evict other distinct denials. A repeat bumps the last entry's
+ * `count` and refreshes its `at` instead of appending.
+ */
+export function recordDenial(log, record, max = MAX_RECENT_DENIALS) {
+  if (!Array.isArray(log) || !record) return log;
+  const last = log[log.length - 1];
+  if (sameDenial(last, record)) {
+    last.count = (last.count || 1) + 1;
+    if (typeof record.at === "number") last.at = record.at;
+    return log;
+  }
+  log.push(record);
+  while (log.length > max) log.shift();
+  return log;
+}
+
+/**
+ * Render the denial log most-recent-first for `/permissions denials`. Times are
+ * relative ("12s ago") when a record carries a numeric `at`; `now` is injectable
+ * for deterministic tests.
+ *
+ * @param {Array} log
+ * @param {{now?:number}} [opts]
+ * @returns {string}
+ */
+export function formatDenials(log, opts = {}) {
+  const now = typeof opts.now === "number" ? opts.now : Date.now();
+  if (!Array.isArray(log) || log.length === 0) {
+    return "  (no tool calls were denied this session)";
+  }
+  const lines = [`  Recent denials (most recent first, ${log.length}):`];
+  for (let i = log.length - 1; i >= 0; i--) {
+    const d = log[i] || {};
+    const ago =
+      typeof d.at === "number"
+        ? ` · ${Math.max(0, Math.round((now - d.at) / 1000))}s ago`
+        : "";
+    const where = d.rule ? `${d.via}:${d.rule}` : d.via || "policy";
+    const what = d.summary ? `${d.tool} ${d.summary}` : d.tool || "?";
+    const times = d.count > 1 ? ` ×${d.count}` : "";
+    lines.push(`  • ${what}${times}  [${where}${ago}]`);
+    if (d.reason) lines.push(`      ${d.reason}`);
+  }
+  return lines.join("\n");
+}

package/src/lib/safe-json.js

@@ -0,0 +1,22 @@
+/**
+ * safeJsonParse — JSON.parse that returns `fallback` instead of throwing on
+ * malformed (or null/empty) input.
+ *
+ * Use it for DB columns parsed inside a list `.map()` / loop: an unguarded
+ * `JSON.parse(row.col)` lets ONE corrupt cell throw out of the whole function,
+ * crashing the entire list load (the unguarded-JSON.parse-in-list-loop bug
+ * class — a single bad row should be skipped, not fail every other row).
+ *
+ * @param {unknown} text      the raw string (or null/undefined)
+ * @param {*} [fallback=null] returned on null/empty/parse failure
+ * @returns {*}
+ */
+export function safeJsonParse(text, fallback = null) {
+  if (text == null || text === "") return fallback;
+  try {
+    const v = JSON.parse(text);
+    return v == null ? fallback : v;
+  } catch {
+    return fallback;
+  }
+}

package/src/lib/sandbox-v2.js

@@ -4,6 +4,7 @@
  */
 
 import crypto from "crypto";
+import { safeJsonParse } from "./safe-json.js";
 import { createRequire } from "module";
 
 const _require = createRequire(import.meta.url);
@@ -429,9 +430,9 @@ export function getSandbox(db, sandboxId) {
     id: row.id,
     agentId: row.agent_id,
     status: row.status,
-    permissions: JSON.parse(row.permissions || "{}"),
-    quota: JSON.parse(row.quota || "{}"),
-    resourceUsage: JSON.parse(row.resource_usage || "{}"),
+    permissions: safeJsonParse(row.permissions, {}),
+    quota: safeJsonParse(row.quota, {}),
+    resourceUsage: safeJsonParse(row.resource_usage, {}),
     createdAt: row.created_at,
   };
 }
@@ -609,9 +610,9 @@ export function restoreFromDb(db) {
       id: row.id,
       agentId: row.agent_id,
       status: row.status || "active",
-      permissions: JSON.parse(row.permissions || "{}"),
-      quota: JSON.parse(row.quota || "{}"),
-      resourceUsage: JSON.parse(row.resource_usage || "{}"),
+      permissions: safeJsonParse(row.permissions, {}),
+      quota: safeJsonParse(row.quota, {}),
+      resourceUsage: safeJsonParse(row.resource_usage, {}),
       createdAt: row.created_at || new Date(now).toISOString(),
       policy,
       createdAtMs: row.created_at_ms || now,

package/src/lib/search-command.js

@@ -0,0 +1,65 @@
+/**
+ * search-command — build the shell command for the agent `search_files` tool
+ * with the model/user-supplied pattern SAFELY embedded.
+ *
+ * The pattern flows into execSync (a real shell), so a raw interpolation
+ * (`grep -i "${pattern}"`) is a command-injection vector: a pattern like
+ * `x" ; curl evil ; "` runs arbitrary commands — and `search_files` is
+ * read-only + NOT confirm-gated, so it would bypass the `run_shell`
+ * ApprovalGate + credential guards entirely (reachable via prompt-injection).
+ * Raw interpolation is also semantically wrong: the shell would expand `$HOME`,
+ * backticks, globs, etc. in the pattern instead of searching for them literally.
+ *
+ * Fix: quote the pattern so every shell metacharacter is inert. The emitted
+ * commands (and therefore the output format `_ingestSearchOutput` parses) are
+ * otherwise unchanged.
+ */
+
+/** POSIX single-quote: wrap in '…' and escape any embedded ' as '\''. Single
+ *  quotes neutralize EVERY shell metacharacter, so nothing inside is expanded
+ *  or can break out. */
+export function shquotePosix(s) {
+  return `'${String(s).replace(/'/g, "'\\''")}'`;
+}
+
+/**
+ * Build `{ cmd }` for a search, or `{ error }` when the pattern can't be made
+ * safe on the target platform.
+ *
+ * @param {object} a
+ * @param {string} a.pattern        the raw search pattern
+ * @param {boolean} a.isContent     content search (grep/findstr) vs filename
+ * @param {string} [a.platform=process.platform]
+ * @returns {{cmd:string}|{error:string}}
+ */
+export function buildSearchCommand({
+  pattern,
+  isContent,
+  platform = process.platform,
+}) {
+  const pat = String(pattern ?? "");
+
+  if (platform === "win32") {
+    // cmd.exe has no reliable way to escape an embedded double-quote, and the
+    // pattern is double-quoted below — so reject a literal `"` (rare in a search
+    // pattern; run_shell handles complex cases). Every OTHER metacharacter
+    // (& | < > ^ ( )) is literal INSIDE cmd double quotes, so quoting the
+    // pattern closes the injection while leaving the redirect (2>NUL) outside.
+    if (pat.includes('"')) {
+      return {
+        error: 'search pattern may not contain a double-quote (") on Windows',
+      };
+    }
+    return {
+      cmd: isContent
+        ? `findstr /s /i /n "${pat}" *`
+        : `dir /s /b "*${pat}*" 2>NUL`,
+    };
+  }
+
+  return {
+    cmd: isContent
+      ? `grep -r -l -i ${shquotePosix(pat)} . --include="*" 2>/dev/null | head -20`
+      : `find . -name ${shquotePosix(`*${pat}*`)} -type f 2>/dev/null | head -20`,
+  };
+}

package/src/lib/settings-hooks.cjs

@@ -27,6 +27,7 @@
 const path = require("node:path");
 const os = require("node:os");
 const fsDefault = require("node:fs");
+const crypto = require("node:crypto");
 const { SUGGEST_UMBRELLA } = require("./permission-rules.cjs");
 const { projectRootBase } = require("./project-root.cjs");
 
@@ -179,8 +180,140 @@ function collectHooks(hooksBlock, event, toolName) {
   return out;
 }
 
+/**
+ * Every command-hook in a parsed settings object, tagged with the event +
+ * matcher it fires under (so a fingerprint reflects WHEN it runs, not just the
+ * command string). Mirrors loadHooks' command-hook filter.
+ */
+function extractCommandHooks(data) {
+  const out = [];
+  const block =
+    data && data.hooks && typeof data.hooks === "object" ? data.hooks : null;
+  if (!block) return out;
+  for (const [event, groups] of Object.entries(block)) {
+    if (!Array.isArray(groups)) continue;
+    for (const g of groups) {
+      if (!g || typeof g !== "object" || !Array.isArray(g.hooks)) continue;
+      for (const h of g.hooks) {
+        if (h && h.type === "command" && h.command) {
+          out.push({
+            event,
+            matcher: g.matcher ?? null,
+            command: String(h.command),
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+
+/** `~/.chainlesschain/hook-trust.json` — remembered first-run acknowledgments. */
+function hookTrustStorePath() {
+  return path.join(_deps.homedir(), ".chainlesschain", "hook-trust.json");
+}
+
+function readHookTrustStore() {
+  try {
+    const f = hookTrustStorePath();
+    if (!_deps.fs.existsSync(f)) return {};
+    const parsed = JSON.parse(_deps.fs.readFileSync(f, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {}; // unreadable store → treat as nothing acknowledged
+  }
+}
+
+function writeHookTrustStore(store) {
+  try {
+    const f = hookTrustStorePath();
+    _deps.fs.mkdirSync(path.dirname(f), { recursive: true });
+    _deps.fs.writeFileSync(f, JSON.stringify(store, null, 2), "utf-8");
+    return true;
+  } catch {
+    return false; // best-effort — a failed write just re-shows the notice
+  }
+}
+
+/**
+ * First-run trust notice for project-sourced settings.json hooks (which run
+ * shell). The user's own `~/.claude/settings.json` and an explicit `--settings`
+ * file are trusted; only the project's `.claude/settings{,.local}.json` (project
+ * root + cwd) carry the cloned-repo auto-execution risk that Claude-Code 2.1.195
+ * gated ("untrusted project config must require explicit consent").
+ *
+ * Returns a one-line notice (and records an acknowledgment hash) the FIRST time
+ * a project's shell-running hooks are seen — and again only if those hooks
+ * change. Returns null when there are no project hooks, the hooks are unchanged
+ * since last acknowledged, or the notice is disabled (`CC_HOOK_TRUST_NOTICE=0`,
+ * or hooks themselves are off via `CC_SETTINGS_HOOKS=0`). Best-effort: a failed
+ * store write still returns the notice (shown again next run) rather than
+ * throwing — it must never abort agent startup.
+ *
+ * @returns {string|null}
+ */
+function projectHookTrustNotice({ cwd = process.cwd(), settingsFile } = {}) {
+  if (process.env.CC_HOOK_TRUST_NOTICE === "0") return null;
+  if (process.env.CC_SETTINGS_HOOKS === "0") return null; // hooks won't run anyway
+  const home = path.join(_deps.homedir(), ".claude", "settings.json");
+  const explicit = settingsFile ? path.resolve(cwd, settingsFile) : null;
+  const trusted = new Set([home, explicit].filter(Boolean));
+  const seen = new Set();
+  const projectFiles = settingsFiles(cwd, settingsFile).filter((f) => {
+    if (trusted.has(f) || seen.has(f)) return false;
+    seen.add(f);
+    return true;
+  });
+
+  const entries = [];
+  const contributing = [];
+  for (const f of projectFiles) {
+    let data;
+    try {
+      if (!_deps.fs.existsSync(f)) continue;
+      data = JSON.parse(_deps.fs.readFileSync(f, "utf-8"));
+    } catch {
+      continue; // malformed JSON is surfaced by loadHooks' own warn path
+    }
+    const cmds = extractCommandHooks(data);
+    if (cmds.length) {
+      entries.push(...cmds);
+      contributing.push(f);
+    }
+  }
+  if (entries.length === 0) return null;
+
+  const fingerprint = entries
+    .map((e) => `${e.event}${e.matcher ?? ""}${e.command}`)
+    .sort();
+  const hash = crypto
+    .createHash("sha256")
+    .update(JSON.stringify(fingerprint))
+    .digest("hex");
+  const key = projectRootBase(cwd, { fs: _deps.fs, path }) || cwd;
+
+  const store = readHookTrustStore();
+  if (store[key] && store[key].hash === hash) return null; // already acknowledged
+  store[key] = {
+    hash,
+    files: contributing,
+    count: entries.length,
+    at: new Date().toISOString(),
+  };
+  writeHookTrustStore(store); // best-effort acknowledgment
+
+  const fileList = contributing.map((f) => `    ${f}`).join("\n");
+  return (
+    `⚠ This project's .claude/settings.json defines ${entries.length} ` +
+    `shell-running hook(s) that auto-run on agent activity:\n${fileList}\n` +
+    `  Review them before trusting this repo. Shown once per change; ` +
+    `disable all hooks with CC_SETTINGS_HOOKS=0.`
+  );
+}
+
 module.exports = {
   loadHooks,
+  projectHookTrustNotice,
   collectHooks,
   compileMatcher,
   umbrellaFor,

package/src/lib/settings-loader.cjs

@@ -240,12 +240,16 @@ function loadSettingsConfig(opts = {}) {
 }
 
 /**
- * Read a top-level boolean setting across the layered `.claude/settings.json`
- * files (last/closest layer wins — same precedence as the permission rules).
- * Non-boolean values are ignored. Returns `undefined` when no layer sets it, so
- * a caller can distinguish "unset" from an explicit `false`.
+ * Read a boolean setting across the layered `.claude/settings.json` files
+ * (last/closest layer wins — same precedence as the permission rules). The key
+ * may be a dotted path for nested settings (e.g. `autoMode.classifyAllShell`);
+ * a plain key walks a one-element path, so existing callers are unaffected.
+ * Non-boolean values (and partial paths through a non-object) are ignored.
+ * Returns `undefined` when no layer sets it, so a caller can distinguish
+ * "unset" from an explicit `false`.
  *
- * @param {string} key  top-level settings key (e.g. "respondToBashCommands")
+ * @param {string} key  settings key or dotted path (e.g. "respondToBashCommands"
+ *                       or "autoMode.classifyAllShell")
  * @param {object} [opts]
  * @param {string} [opts.cwd=process.cwd()]
  * @param {string} [opts.settingsFile]
@@ -254,11 +258,16 @@ function loadSettingsConfig(opts = {}) {
  */
 function readBooleanSetting(key, opts = {}) {
   const cwd = opts.cwd || process.cwd();
+  const parts = String(key).split(".");
   let value;
   for (const file of settingsPaths(cwd, opts.settingsFile)) {
     const data = readSettingsFile(file, { onWarn: opts.onWarn });
-    if (data && typeof data[key] === "boolean") {
-      value = data[key]; // last (closest) layer wins
+    let node = data;
+    for (const p of parts) {
+      node = node && typeof node === "object" ? node[p] : undefined;
+    }
+    if (typeof node === "boolean") {
+      value = node; // last (closest) layer wins
     }
   }
   return value;