oh-my-customcode 1.1.54 → 1.1.56

package/templates/.claude/hooks/scripts/model-escalation-advisor.sh

@@ -12,15 +12,15 @@ command -v jq >/dev/null 2>&1 || exit 0
 input=$(cat)
 
 # Extract current task info
-agent_type=$(echo "$input" | jq -r '.tool_input.subagent_type // "unknown"')
-current_model=$(echo "$input" | jq -r '.tool_input.model // "inherit"')
+agent_type=$(printf '%s\n' "$input" | jq -r '.tool_input.subagent_type // "unknown"')
+current_model=$(printf '%s\n' "$input" | jq -r '.tool_input.model // "inherit"')
 
 # Session-scoped outcome log
 OUTCOME_FILE="/tmp/.claude-task-outcomes-${PPID}"
 
 # Skip if no history
 if [ ! -f "$OUTCOME_FILE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -107,5 +107,5 @@ if [ "$current_model" != "haiku" ] && [ "$current_model" != "inherit" ] && [ "$c
 fi
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/omcustom-auto-update.sh

@@ -12,13 +12,13 @@ input=$(cat)
 
 # Skip if explicitly disabled
 if [ "${OMCUSTOM_SKIP_AUTO_UPDATE:-}" = "true" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # Skip if /dev/tty not available (CI, Docker, non-interactive)
 if ! [ -c /dev/tty ] 2>/dev/null; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -53,7 +53,7 @@ fi
 
 # Cannot determine current version — skip
 if [ -z "$CURRENT_VERSION" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -101,14 +101,14 @@ fi
 
 # Could not determine latest version — skip
 if [ -z "$LATEST_VERSION" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # --- Step 3: Compare versions ---
 if ! version_lt "$CURRENT_VERSION" "$LATEST_VERSION"; then
   # Already up to date
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -166,5 +166,5 @@ fi
 echo "------------------------------------" >&2
 
 # Always pass through and exit 0
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/playwright-compress.sh

@@ -7,12 +7,12 @@
 set -euo pipefail
 
 input=$(cat)
-tool_output=$(echo "$input" | jq -r '.tool_output // ""')
+tool_output=$(printf '%s\n' "$input" | jq -r '.tool_output // ""')
 
 # Skip if output is small (< 3000 chars)
 output_len=${#tool_output}
 if [ "$output_len" -lt 3000 ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -22,7 +22,7 @@ refs=$(echo "$tool_output" | grep -oE 'ref="[^"]*"' | sort -u || true)
 # Summarize using Haiku via subscription auth
 summary=$(echo "$tool_output" | claude -p --model haiku "Summarize this browser page content concisely. Preserve ALL ref= attribute values exactly as they appear. Focus on: page structure, interactive elements with their ref values, visible text content, and any error messages." 2>/dev/null) || {
   # Fallback: return original on failure
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 }
 
@@ -46,5 +46,5 @@ fi
 # Return compressed output
 compressed_len=${#summary}
 savings=$(( (output_len - compressed_len) * 100 / output_len ))
-echo "$input" | jq --arg summary "$summary" --arg savings "${savings}% reduced (${output_len}→${compressed_len} chars)" \
+printf '%s\n' "$input" | jq --arg summary "$summary" --arg savings "${savings}% reduced (${output_len}→${compressed_len} chars)" \
   '.tool_output = $summary | .["updatedMCPToolOutput"] = $summary'

package/templates/.claude/hooks/scripts/plugin-cache-check.sh

@@ -12,7 +12,7 @@ input=$(cat)
 PLUGIN_CACHE="${HOME}/.claude/shared-plugins/cache"
 
 if [ ! -d "$PLUGIN_CACHE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -31,5 +31,5 @@ if [ ${#missing[@]} -gt 0 ]; then
   done
 fi
 
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/r007-r008-drift-advisor.sh

@@ -192,13 +192,26 @@ split("\n")
     # 올바르게 분리되어 0/0이었음). 이 조사에서 확정된 실제 원인은 별도 메커니즘이다:
     # tail -n 200 윈도우 안에 경계가 전혀 없을 때 $b=-1로 폴백해 슬라이딩 윈도우 전체를
     # 하나의 turn으로 병합하는 구조 — 본 수정의 승인 범위(0-tool-use 가드 1건) 밖이므로
-    # 별도 이슈로 보고한다(오케스트레이터 완료 보고 참조).
+    # 별도 이슈로 보고한다(오케스트레이터 완료 보고 참조). → #1628로 등록·수정 완료:
+    # 아래 $b 바인딩 직후의 "(#1628)" 주석 및 $wlc 포화 가드 참조.
     | [ range(0; $last + 1)
         | select( ($L[.].message.role? == "user")
                   and ( (($L[.].message.content | type) == "string")
                         or (([ $L[.].message.content[]? | select(.type? == "tool_result") ] | length) == 0) ) ) ] as $bi
     | (if ($bi | length) > 0 then $bi[-1] else -1 end) as $b
-    | [ range($b + 1; $last + 1) | $L[.] | select(.message.role? == "assistant") ] as $turn
+    # (#1628) 경계가 전혀 없는 경우($bi 비어있음)를 두 케이스로 나눈다:
+    #   (a) 윈도우가 포화($wlc >= 200 — tail -n 200이 실제로 200줄을 반환) — 윈도우 밖에
+    #       진짜 경계가 있었을 수 있다. 이 경우 $b=-1로 윈도우 전체를 하나의 turn으로
+    #       병합하면, 서로 독립적이고 각각 컴플라이언트한 여러 응답이 합쳐져 announce/
+    #       tool_use 카운트가 어긋나 R008 위양성이 5~10건대로 요동친다(#1628 실측). 판정
+    #       자체를 스킵한다(empty — 아래에서 result가 비어 exit 0으로 이어진다).
+    #   (b) 윈도우가 포화되지 않음($wlc < 200 — tail이 transcript 전체를 다 읽었다는 뜻) —
+    #       세션이 정말로 짧아 첫 턴부터 지금까지 경계가 없는 것이므로, 기존 $b=-1 폴백을
+    #       그대로 유지한다(#1625 찐빠 #3이 확정한 자율 루프 경계 대체 신호와 동일 로직).
+    | if ($bi | length) == 0 and $wlc >= 200 then empty
+      else
+      (
+      [ range($b + 1; $last + 1) | $L[.] | select(.message.role? == "assistant") ] as $turn
     | [ $turn[] | .message.content[]? | select(.type? != "thinking") ] as $blocks
     | ($turn[0].uuid? // "") as $tuuid
     | ([ $blocks[] | select(.type? == "text") ][0].text? // "") as $ftext
@@ -237,10 +250,20 @@ split("\n")
     # $nall_tools는 위 forward r008 가드에서 이미 바인딩됨 — 재바인딩하지 않고 재사용한다.
     | (if $nall_tools == 0 and $an_anchored > 0 then $an_anchored else 0 end) as $r008rev
     | [$tuuid, ($r007 | tostring), ($r008 | tostring), ($r008rev | tostring)] | @tsv
+      )
+      end
   end
 '
 
-result=$(tail -n 200 "$TRANSCRIPT_PATH" 2>/dev/null | jq -Rsr "$JQ_LAST_TURN" 2>/dev/null) || result=""
+# ── 윈도우 포화 여부 판별 (#1628) ──
+# tail -n 200이 실제로 200줄을 반환했는지(포화 — 윈도우 밖에 잘려나간 내용이 있을 수 있음)를
+# jq 호출 전에 bash에서 측정해 $wlc로 전달한다. awk는 트레일링 개행 유무와 무관하게 정확한
+# 레코드 수를 센다(wc -l은 트레일링 개행이 없는 마지막 줄을 놓칠 수 있음).
+window_content=$(tail -n 200 "$TRANSCRIPT_PATH" 2>/dev/null) || window_content=""
+window_line_count=$(printf '%s' "$window_content" | awk 'END{print NR}')
+: "${window_line_count:=0}"
+
+result=$(printf '%s' "$window_content" | jq -Rsr --argjson wlc "$window_line_count" "$JQ_LAST_TURN" 2>/dev/null) || result=""
 
 if [ -z "$result" ]; then
   exit 0

package/templates/.claude/hooks/scripts/rtk-intercept.sh

@@ -9,9 +9,9 @@ set -euo pipefail
 input=$(cat)
 
 # Only intercept Bash tool calls
-tool_name=$(echo "$input" | jq -r '.tool // empty' 2>/dev/null || echo "")
+tool_name=$(printf '%s\n' "$input" | jq -r '.tool // empty' 2>/dev/null || echo "")
 if [ "$tool_name" != "Bash" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -25,26 +25,26 @@ elif command -v rtk >/dev/null 2>&1; then
 fi
 
 if [ "$RTK_AVAILABLE" != "true" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # Extract command
-cmd=$(echo "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || echo "")
+cmd=$(printf '%s\n' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || echo "")
 if [ -z "$cmd" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # Skip if already using rtk
 if echo "$cmd" | grep -qE '^rtk\b'; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # Skip complex commands (pipes, redirections, background, subshells, semicolons with multiple commands)
 if echo "$cmd" | grep -qE '[|><&]|;\s*\w'; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -64,7 +64,7 @@ for rtk_cmd in $RTK_CMDS; do
 done
 
 if [ "$SUPPORTED" != "true" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -73,5 +73,5 @@ new_cmd="rtk $cmd"
 echo "[RTK] Intercepted: $cmd → $new_cmd" >&2
 
 # Output modified JSON
-echo "$input" | jq --arg new_cmd "$new_cmd" '.tool_input.command = $new_cmd'
+printf '%s\n' "$input" | jq --arg new_cmd "$new_cmd" '.tool_input.command = $new_cmd'
 exit 0

package/templates/.claude/hooks/scripts/rule-deletion-guard.sh

@@ -8,17 +8,17 @@ input=$(cat)
 
 # Dependency check — allow if jq missing
 if ! command -v jq &>/dev/null; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # Parse tool input
-tool=$(echo "$input" | jq -r '.tool // ""' 2>/dev/null) || { echo "$input"; exit 0; }
-cmd=$(echo "$input" | jq -r '.tool_input.command // ""' 2>/dev/null) || { echo "$input"; exit 0; }
+tool=$(printf '%s\n' "$input" | jq -r '.tool // ""' 2>/dev/null) || { printf '%s\n' "$input"; exit 0; }
+cmd=$(printf '%s\n' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null) || { printf '%s\n' "$input"; exit 0; }
 
 # Only check Bash tool
 if [ "$tool" != "Bash" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -56,5 +56,5 @@ if echo "$cmd" | grep -qE '(^|\s)(rm|git\s+rm|mv|unlink)\s' && echo "$cmd" | gre
 fi
 
 # Not a rule deletion — pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/schema-validator.sh

@@ -13,14 +13,14 @@ command -v jq >/dev/null 2>&1 || exit 0
 input=$(cat)
 
 # Extract tool info
-tool_name=$(echo "$input" | jq -r '.tool_name // "unknown"')
-tool_input=$(echo "$input" | jq -r '.tool_input // {}')
+tool_name=$(printf '%s\n' "$input" | jq -r '.tool_name // "unknown"')
+tool_input=$(printf '%s\n' "$input" | jq -r '.tool_input // {}')
 
 SCHEMA_FILE=".claude/schemas/tool-inputs.json"
 
 # Skip if schema file doesn't exist
 if [ ! -f "$SCHEMA_FILE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -28,8 +28,8 @@ warnings=()
 
 case "$tool_name" in
   "Write")
-    file_path=$(echo "$tool_input" | jq -r '.file_path // ""')
-    content=$(echo "$tool_input" | jq -r '.content // ""')
+    file_path=$(printf '%s\n' "$tool_input" | jq -r '.file_path // ""')
+    content=$(printf '%s\n' "$tool_input" | jq -r '.content // ""')
 
     if [ -z "$file_path" ]; then
       warnings+=("[Schema] Write: file_path is empty or missing")
@@ -40,9 +40,9 @@ case "$tool_name" in
     ;;
 
   "Edit")
-    file_path=$(echo "$tool_input" | jq -r '.file_path // ""')
-    old_string=$(echo "$tool_input" | jq -r '.old_string // ""')
-    new_string=$(echo "$tool_input" | jq -r '.new_string // ""')
+    file_path=$(printf '%s\n' "$tool_input" | jq -r '.file_path // ""')
+    old_string=$(printf '%s\n' "$tool_input" | jq -r '.old_string // ""')
+    new_string=$(printf '%s\n' "$tool_input" | jq -r '.new_string // ""')
 
     if [ -z "$file_path" ]; then
       warnings+=("[Schema] Edit: file_path is empty or missing")
@@ -56,7 +56,7 @@ case "$tool_name" in
     ;;
 
   "Bash")
-    command=$(echo "$tool_input" | jq -r '.command // ""')
+    command=$(printf '%s\n' "$tool_input" | jq -r '.command // ""')
 
     if [ -z "$command" ]; then
       warnings+=("[Schema] Bash: command is empty")
@@ -102,5 +102,5 @@ if [ ${#warnings[@]} -gt 0 ]; then
 fi
 
 # Always pass through (Phase 1)
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/secret-filter.sh

@@ -13,12 +13,12 @@ command -v jq >/dev/null 2>&1 || exit 0
 input=$(cat)
 
 # Extract output to scan
-tool_name=$(echo "$input" | jq -r '.tool_name // "unknown"')
-output=$(echo "$input" | jq -r '.tool_output.output // ""')
+tool_name=$(printf '%s\n' "$input" | jq -r '.tool_name // "unknown"')
+output=$(printf '%s\n' "$input" | jq -r '.tool_output.output // ""')
 
 # Skip if no output
 if [ -z "$output" ] || [ "$output" = "null" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -96,5 +96,5 @@ if [ "$detected" = true ]; then
 fi
 
 # Pass through (always)
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/session-autofix-prompt.sh

@@ -14,16 +14,16 @@ fi
 FINDINGS=$(cat "$FIXES_FILE")
 rm -f "$FIXES_FILE"
 
-ISSUE_COUNT=$(echo "$FINDINGS" | jq -r '.issue_count // 0' 2>/dev/null)
+ISSUE_COUNT=$(printf '%s\n' "$FINDINGS" | jq -r '.issue_count // 0' 2>/dev/null)
 
 if [ "$ISSUE_COUNT" -gt 0 ]; then
   echo "[Session Auto-Fix] Previous session left ${ISSUE_COUNT} issue(s):"
-  echo "$FINDINGS" | jq -r '.issues[]' 2>/dev/null | while IFS= read -r issue; do
+  printf '%s\n' "$FINDINGS" | jq -r '.issues[]' 2>/dev/null | while IFS= read -r issue; do
     type="${issue%%:*}"
     msg="${issue#*:}"
     echo "  - [${type}] ${msg}"
   done
-  FIX_COUNT=$(echo "$FINDINGS" | jq -r '.fix_count // 0' 2>/dev/null)
+  FIX_COUNT=$(printf '%s\n' "$FINDINGS" | jq -r '.fix_count // 0' 2>/dev/null)
   if [ "$FIX_COUNT" -gt 0 ]; then
     echo "Auto-fixed: ${FIX_COUNT} item(s)."
   fi

package/templates/.claude/hooks/scripts/session-autofix.sh

@@ -142,5 +142,5 @@ fi
 mkdir -p "$LOG_DIR" 2>/dev/null
 echo "{\"date\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"issue_count\":${ISSUE_COUNT},\"fix_count\":${FIX_COUNT}}" >> "${LOG_DIR}/$(date +%Y-%m-%d).jsonl" 2>/dev/null
 
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/session-env-check.sh

@@ -298,5 +298,5 @@ fi
 echo "------------------------------------" >&2
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/session-reflection.sh

@@ -15,32 +15,32 @@ input=$(cat)
 
 # ── Opt-out 체크 ──
 if [ "${OMCUSTOM_SESSION_REFLECTION:-}" = "off" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # ── jq 의존성 체크 ──
 if ! command -v jq >/dev/null 2>&1; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # ── session_id 추출 ──
-session_id=$(echo "$input" | jq -r '.session_id // empty' 2>/dev/null)
+session_id=$(printf '%s\n' "$input" | jq -r '.session_id // empty' 2>/dev/null)
 if [ -z "$session_id" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # ── Phase 2 (#1196): background_tasks / session_crons 추출 (CC v2.1.145+) ──
 # 신규 필드 미존재 시 빈 배열로 처리 (graceful degrade).
-bg_tasks_json=$(echo "$input" | jq -c '.background_tasks // []' 2>/dev/null || echo '[]')
-session_crons_json=$(echo "$input" | jq -c '.session_crons // []' 2>/dev/null || echo '[]')
-bg_tasks_count=$(echo "$bg_tasks_json" | jq 'length' 2>/dev/null || echo 0)
-session_crons_count=$(echo "$session_crons_json" | jq 'length' 2>/dev/null || echo 0)
+bg_tasks_json=$(printf '%s\n' "$input" | jq -c '.background_tasks // []' 2>/dev/null || echo '[]')
+session_crons_json=$(printf '%s\n' "$input" | jq -c '.session_crons // []' 2>/dev/null || echo '[]')
+bg_tasks_count=$(printf '%s\n' "$bg_tasks_json" | jq 'length' 2>/dev/null || echo 0)
+session_crons_count=$(printf '%s\n' "$session_crons_json" | jq 'length' 2>/dev/null || echo 0)
 
 # 미완료 백그라운드 태스크: running/pending/in_progress 상태 카운트
-bg_dangling_count=$(echo "$bg_tasks_json" | jq '[.[] | select(.status == "running" or .status == "pending" or .status == "in_progress")] | length' 2>/dev/null || echo 0)
+bg_dangling_count=$(printf '%s\n' "$bg_tasks_json" | jq '[.[] | select(.status == "running" or .status == "pending" or .status == "in_progress")] | length' 2>/dev/null || echo 0)
 
 # ── 경로 결정 (환경변수 override 지원) ──
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -50,7 +50,7 @@ TRANSCRIPT_BASE="${OMCUSTOM_TRANSCRIPT_BASE:-${HOME}/.claude/projects/-Users-san
 TRANSCRIPT_PATH="${TRANSCRIPT_BASE}/${session_id}.jsonl"
 
 if [ ! -f "$TRANSCRIPT_PATH" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -179,14 +179,14 @@ else
 fi
 
 # ── Phase 2 (#1196): background_tasks / session_crons 분석 ──
-bg_total=$(echo "$BG_TASKS_JSON" | jq 'length' 2>/dev/null || echo 0)
-cron_total=$(echo "$SESSION_CRONS_JSON" | jq 'length' 2>/dev/null || echo 0)
+bg_total=$(printf '%s\n' "$BG_TASKS_JSON" | jq 'length' 2>/dev/null || echo 0)
+cron_total=$(printf '%s\n' "$SESSION_CRONS_JSON" | jq 'length' 2>/dev/null || echo 0)
 bg_dangling_lines=""
 cron_lines=""
 
 if [ "$bg_total" -gt 0 ]; then
   # dangling 태스크 목록 (최대 5개): id + status + description (60자 truncate)
-  bg_dangling_lines=$(echo "$BG_TASKS_JSON" | jq -r '
+  bg_dangling_lines=$(printf '%s\n' "$BG_TASKS_JSON" | jq -r '
     [.[] | select(.status == "running" or .status == "pending" or .status == "in_progress")]
     | .[0:5]
     | map("  - id=\(.id // "?") status=\(.status // "?") desc=\((.description // "") | .[0:60])")
@@ -195,7 +195,7 @@ if [ "$bg_total" -gt 0 ]; then
 fi
 
 if [ "$cron_total" -gt 0 ]; then
-  cron_lines=$(echo "$SESSION_CRONS_JSON" | jq -r '
+  cron_lines=$(printf '%s\n' "$SESSION_CRONS_JSON" | jq -r '
     .[0:5]
     | map("  - id=\(.id // "?") schedule=\(.schedule // "?") prompt=\((.prompt // "") | .[0:60])")
     | join("\n")
@@ -253,5 +253,5 @@ WORKER_ERR_LOG="/tmp/.claude-reflection-err-${PPID}.log"
 disown $! 2>/dev/null || true
 
 # ── 즉시 stdin pass-through 후 exit 0 (Stop hook 체인 유지) ──
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/skill-extractor-analyzer.sh

@@ -12,7 +12,7 @@ PROPOSALS_FILE="/tmp/.claude-skill-proposals-${PPID}"
 
 # Early exit if no outcomes
 if [ ! -f "$OUTCOMES_FILE" ] || [ ! -s "$OUTCOMES_FILE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -45,5 +45,5 @@ fi
 
 # CRITICAL: Always pass through input and exit 0
 # This hook MUST NEVER block session termination
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/stale-todo-scanner.sh

@@ -78,5 +78,5 @@ fi
 echo "------------------------------------" >&2
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/stall-detection-advisor.sh

@@ -17,18 +17,18 @@ AGENT_START_FILE="/tmp/.claude-agent-starts-${PPID}"
 DURATION_FILE="/tmp/.claude-agent-durations-${PPID}"
 
 # Skip if no start records exist
-[ -f "$AGENT_START_FILE" ] || { echo "$input"; exit 0; }
+[ -f "$AGENT_START_FILE" ] || { printf '%s\n' "$input"; exit 0; }
 
 # --- 1. Extract completed agent info ---
-agent_type=$(echo "$input" | jq -r '.agent_type // "unknown"')
-model=$(echo "$input" | jq -r '.model // "inherit"')
-description=$(echo "$input" | jq -r '.description // ""' | head -c 80)
+agent_type=$(printf '%s\n' "$input" | jq -r '.agent_type // "unknown"')
+model=$(printf '%s\n' "$input" | jq -r '.model // "inherit"')
+description=$(printf '%s\n' "$input" | jq -r '.description // ""' | head -c 80)
 
 # --- 2. Calculate duration from start record ---
 start_epoch=$(grep -F "\"agent_type\":\"${agent_type}\"" "$AGENT_START_FILE" 2>/dev/null | tail -1 | jq -r '.start_epoch // "0"' 2>/dev/null || echo "0")
 
 if [ "$start_epoch" = "0" ] || [ "$start_epoch" = "null" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -56,10 +56,10 @@ if [ "$completed_count" -ge 1 ]; then
     # Check for still-running agents (in start file but not in duration file)
     if [ -f "$AGENT_START_FILE" ] && [ -s "$AGENT_START_FILE" ]; then
       while IFS= read -r line; do
-        running_agent=$(echo "$line" | jq -r '.agent_type // ""' 2>/dev/null || true)
-        running_start=$(echo "$line" | jq -r '.start_epoch // "0"' 2>/dev/null || echo "0")
-        running_desc=$(echo "$line" | jq -r '.description // ""' 2>/dev/null || true)
-        running_model=$(echo "$line" | jq -r '.model // "inherit"' 2>/dev/null || true)
+        running_agent=$(printf '%s\n' "$line" | jq -r '.agent_type // ""' 2>/dev/null || true)
+        running_start=$(printf '%s\n' "$line" | jq -r '.start_epoch // "0"' 2>/dev/null || echo "0")
+        running_desc=$(printf '%s\n' "$line" | jq -r '.description // ""' 2>/dev/null || true)
+        running_model=$(printf '%s\n' "$line" | jq -r '.model // "inherit"' 2>/dev/null || true)
 
         if [ "$running_start" = "0" ] || [ "$running_start" = "null" ]; then continue; fi
 
@@ -90,7 +90,7 @@ duration_entry=$(jq -cn \
   --arg ts "$now_epoch" \
   '{agent_type: $agent, model: $model, description: $desc, duration_seconds: ($dur | tonumber), timestamp: $ts}')
 
-echo "$duration_entry" >> "$DURATION_FILE"
+printf '%s\n' "$duration_entry" >> "$DURATION_FILE"
 
 # Remove only first consumed start entry (preserve siblings for parallel same-type agents)
 if [ -f "$AGENT_START_FILE" ]; then
@@ -108,5 +108,5 @@ if [ -f "$DURATION_FILE" ]; then
 fi
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/stop-console-audit.sh

@@ -42,5 +42,5 @@ echo "[Stop] Audit complete. Session safe to terminate." >&2
 
 # CRITICAL: Always pass through input and exit 0
 # This hook MUST NEVER block session termination
-echo "$input"
+printf '%s\n' "$input"
 exit 0