oh-my-customcode 1.1.55 → 1.1.57

package/templates/.claude/hooks/scripts/feedback-collector.sh

@@ -8,16 +8,16 @@ set -euo pipefail
 input=$(cat)
 
 # Dependencies check
-command -v jq >/dev/null 2>&1 || { echo "$input"; exit 0; }
-command -v sqlite3 >/dev/null 2>&1 || { echo "$input"; exit 0; }
+command -v jq >/dev/null 2>&1 || { printf '%s\n' "$input"; exit 0; }
+command -v sqlite3 >/dev/null 2>&1 || { printf '%s\n' "$input"; exit 0; }
 
 # PID scoping
 OUTCOMES_FILE="/tmp/.claude-task-outcomes-${PPID}"
-[ -f "$OUTCOMES_FILE" ] || { echo "$input"; exit 0; }
+[ -f "$OUTCOMES_FILE" ] || { printf '%s\n' "$input"; exit 0; }
 
 # DB path
 DB_PATH="${HOME}/.config/oh-my-customcode/eval-core.sqlite"
-[ -f "$DB_PATH" ] || { echo "$input"; exit 0; }
+[ -f "$DB_PATH" ] || { printf '%s\n' "$input"; exit 0; }
 
 # Log file for error diagnostics
 LOG_FILE="/tmp/.claude-feedback-collector-${PPID}.log"
@@ -30,8 +30,8 @@ declare -A FAILURE_COUNTS
 declare -A TOTAL_COUNTS
 
 while IFS= read -r line; do
-  agent_type=$(echo "$line" | jq -r '.agent_type // empty' 2>/dev/null) || continue
-  outcome=$(echo "$line" | jq -r '.outcome // empty' 2>/dev/null) || continue
+  agent_type=$(printf '%s\n' "$line" | jq -r '.agent_type // empty' 2>/dev/null) || continue
+  outcome=$(printf '%s\n' "$line" | jq -r '.outcome // empty' 2>/dev/null) || continue
   [ -z "$agent_type" ] && continue
 
   TOTAL_COUNTS[$agent_type]=$(( ${TOTAL_COUNTS[$agent_type]:-0} + 1 ))
@@ -88,5 +88,5 @@ fi
 
 # CRITICAL: Always pass through input and exit 0
 # This hook MUST NEVER block session termination
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/file-change-validator.sh

@@ -3,11 +3,11 @@
 # Advisory warning when files are modified outside Claude Code
 
 input=$(cat)
-file_path=$(echo "$input" | jq -r '.file_path // ""' 2>/dev/null)
-change_type=$(echo "$input" | jq -r '.change_type // "modified"' 2>/dev/null)
+file_path=$(printf '%s\n' "$input" | jq -r '.file_path // ""' 2>/dev/null)
+change_type=$(printf '%s\n' "$input" | jq -r '.change_type // "modified"' 2>/dev/null)
 
 if [ -z "$file_path" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -23,4 +23,4 @@ case "$file_path" in
     ;;
 esac
 
-echo "$input"
+printf '%s\n' "$input"

package/templates/.claude/hooks/scripts/git-delegation-guard.sh

@@ -14,8 +14,8 @@ command -v jq >/dev/null 2>&1 || exit 0
 
 input=$(cat)
 
-agent_type=$(echo "$input" | jq -r '.tool_input.subagent_type // ""')
-prompt=$(echo "$input" | jq -r '.tool_input.prompt // ""')
+agent_type=$(printf '%s\n' "$input" | jq -r '.tool_input.subagent_type // ""')
+prompt=$(printf '%s\n' "$input" | jq -r '.tool_input.prompt // ""')
 
 # R010 violation tracking file (PPID-scoped for session persistence)
 VIOLATION_FILE="/tmp/.claude-r010-violations-${PPID}"
@@ -54,4 +54,4 @@ if [ "$agent_type" != "mgr-gitnerd" ]; then
 fi
 
 # Always pass through - this hook is advisory only
-echo "$input"
+printf '%s\n' "$input"

package/templates/.claude/hooks/scripts/model-escalation-advisor.sh

@@ -12,15 +12,15 @@ command -v jq >/dev/null 2>&1 || exit 0
 input=$(cat)
 
 # Extract current task info
-agent_type=$(echo "$input" | jq -r '.tool_input.subagent_type // "unknown"')
-current_model=$(echo "$input" | jq -r '.tool_input.model // "inherit"')
+agent_type=$(printf '%s\n' "$input" | jq -r '.tool_input.subagent_type // "unknown"')
+current_model=$(printf '%s\n' "$input" | jq -r '.tool_input.model // "inherit"')
 
 # Session-scoped outcome log
 OUTCOME_FILE="/tmp/.claude-task-outcomes-${PPID}"
 
 # Skip if no history
 if [ ! -f "$OUTCOME_FILE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -107,5 +107,5 @@ if [ "$current_model" != "haiku" ] && [ "$current_model" != "inherit" ] && [ "$c
 fi
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/omcustom-auto-update.sh

@@ -12,13 +12,13 @@ input=$(cat)
 
 # Skip if explicitly disabled
 if [ "${OMCUSTOM_SKIP_AUTO_UPDATE:-}" = "true" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # Skip if /dev/tty not available (CI, Docker, non-interactive)
 if ! [ -c /dev/tty ] 2>/dev/null; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -53,7 +53,7 @@ fi
 
 # Cannot determine current version — skip
 if [ -z "$CURRENT_VERSION" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -101,14 +101,14 @@ fi
 
 # Could not determine latest version — skip
 if [ -z "$LATEST_VERSION" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # --- Step 3: Compare versions ---
 if ! version_lt "$CURRENT_VERSION" "$LATEST_VERSION"; then
   # Already up to date
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -166,5 +166,5 @@ fi
 echo "------------------------------------" >&2
 
 # Always pass through and exit 0
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/playwright-compress.sh

@@ -7,12 +7,12 @@
 set -euo pipefail
 
 input=$(cat)
-tool_output=$(echo "$input" | jq -r '.tool_output // ""')
+tool_output=$(printf '%s\n' "$input" | jq -r '.tool_output // ""')
 
 # Skip if output is small (< 3000 chars)
 output_len=${#tool_output}
 if [ "$output_len" -lt 3000 ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -22,7 +22,7 @@ refs=$(echo "$tool_output" | grep -oE 'ref="[^"]*"' | sort -u || true)
 # Summarize using Haiku via subscription auth
 summary=$(echo "$tool_output" | claude -p --model haiku "Summarize this browser page content concisely. Preserve ALL ref= attribute values exactly as they appear. Focus on: page structure, interactive elements with their ref values, visible text content, and any error messages." 2>/dev/null) || {
   # Fallback: return original on failure
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 }
 
@@ -46,5 +46,5 @@ fi
 # Return compressed output
 compressed_len=${#summary}
 savings=$(( (output_len - compressed_len) * 100 / output_len ))
-echo "$input" | jq --arg summary "$summary" --arg savings "${savings}% reduced (${output_len}→${compressed_len} chars)" \
+printf '%s\n' "$input" | jq --arg summary "$summary" --arg savings "${savings}% reduced (${output_len}→${compressed_len} chars)" \
   '.tool_output = $summary | .["updatedMCPToolOutput"] = $summary'

package/templates/.claude/hooks/scripts/plugin-cache-check.sh

@@ -12,7 +12,7 @@ input=$(cat)
 PLUGIN_CACHE="${HOME}/.claude/shared-plugins/cache"
 
 if [ ! -d "$PLUGIN_CACHE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -31,5 +31,5 @@ if [ ${#missing[@]} -gt 0 ]; then
   done
 fi
 
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/rtk-intercept.sh

@@ -9,9 +9,9 @@ set -euo pipefail
 input=$(cat)
 
 # Only intercept Bash tool calls
-tool_name=$(echo "$input" | jq -r '.tool // empty' 2>/dev/null || echo "")
+tool_name=$(printf '%s\n' "$input" | jq -r '.tool // empty' 2>/dev/null || echo "")
 if [ "$tool_name" != "Bash" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -25,26 +25,26 @@ elif command -v rtk >/dev/null 2>&1; then
 fi
 
 if [ "$RTK_AVAILABLE" != "true" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # Extract command
-cmd=$(echo "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || echo "")
+cmd=$(printf '%s\n' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || echo "")
 if [ -z "$cmd" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # Skip if already using rtk
 if echo "$cmd" | grep -qE '^rtk\b'; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # Skip complex commands (pipes, redirections, background, subshells, semicolons with multiple commands)
 if echo "$cmd" | grep -qE '[|><&]|;\s*\w'; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -64,7 +64,7 @@ for rtk_cmd in $RTK_CMDS; do
 done
 
 if [ "$SUPPORTED" != "true" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -73,5 +73,5 @@ new_cmd="rtk $cmd"
 echo "[RTK] Intercepted: $cmd → $new_cmd" >&2
 
 # Output modified JSON
-echo "$input" | jq --arg new_cmd "$new_cmd" '.tool_input.command = $new_cmd'
+printf '%s\n' "$input" | jq --arg new_cmd "$new_cmd" '.tool_input.command = $new_cmd'
 exit 0

package/templates/.claude/hooks/scripts/rule-deletion-guard.sh

@@ -8,17 +8,17 @@ input=$(cat)
 
 # Dependency check — allow if jq missing
 if ! command -v jq &>/dev/null; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # Parse tool input
-tool=$(echo "$input" | jq -r '.tool // ""' 2>/dev/null) || { echo "$input"; exit 0; }
-cmd=$(echo "$input" | jq -r '.tool_input.command // ""' 2>/dev/null) || { echo "$input"; exit 0; }
+tool=$(printf '%s\n' "$input" | jq -r '.tool // ""' 2>/dev/null) || { printf '%s\n' "$input"; exit 0; }
+cmd=$(printf '%s\n' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null) || { printf '%s\n' "$input"; exit 0; }
 
 # Only check Bash tool
 if [ "$tool" != "Bash" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -56,5 +56,5 @@ if echo "$cmd" | grep -qE '(^|\s)(rm|git\s+rm|mv|unlink)\s' && echo "$cmd" | gre
 fi
 
 # Not a rule deletion — pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/schema-validator.sh

@@ -13,14 +13,14 @@ command -v jq >/dev/null 2>&1 || exit 0
 input=$(cat)
 
 # Extract tool info
-tool_name=$(echo "$input" | jq -r '.tool_name // "unknown"')
-tool_input=$(echo "$input" | jq -r '.tool_input // {}')
+tool_name=$(printf '%s\n' "$input" | jq -r '.tool_name // "unknown"')
+tool_input=$(printf '%s\n' "$input" | jq -r '.tool_input // {}')
 
 SCHEMA_FILE=".claude/schemas/tool-inputs.json"
 
 # Skip if schema file doesn't exist
 if [ ! -f "$SCHEMA_FILE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -28,8 +28,8 @@ warnings=()
 
 case "$tool_name" in
   "Write")
-    file_path=$(echo "$tool_input" | jq -r '.file_path // ""')
-    content=$(echo "$tool_input" | jq -r '.content // ""')
+    file_path=$(printf '%s\n' "$tool_input" | jq -r '.file_path // ""')
+    content=$(printf '%s\n' "$tool_input" | jq -r '.content // ""')
 
     if [ -z "$file_path" ]; then
       warnings+=("[Schema] Write: file_path is empty or missing")
@@ -40,9 +40,9 @@ case "$tool_name" in
     ;;
 
   "Edit")
-    file_path=$(echo "$tool_input" | jq -r '.file_path // ""')
-    old_string=$(echo "$tool_input" | jq -r '.old_string // ""')
-    new_string=$(echo "$tool_input" | jq -r '.new_string // ""')
+    file_path=$(printf '%s\n' "$tool_input" | jq -r '.file_path // ""')
+    old_string=$(printf '%s\n' "$tool_input" | jq -r '.old_string // ""')
+    new_string=$(printf '%s\n' "$tool_input" | jq -r '.new_string // ""')
 
     if [ -z "$file_path" ]; then
       warnings+=("[Schema] Edit: file_path is empty or missing")
@@ -56,7 +56,7 @@ case "$tool_name" in
     ;;
 
   "Bash")
-    command=$(echo "$tool_input" | jq -r '.command // ""')
+    command=$(printf '%s\n' "$tool_input" | jq -r '.command // ""')
 
     if [ -z "$command" ]; then
       warnings+=("[Schema] Bash: command is empty")
@@ -102,5 +102,5 @@ if [ ${#warnings[@]} -gt 0 ]; then
 fi
 
 # Always pass through (Phase 1)
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/secret-filter.sh

@@ -13,12 +13,12 @@ command -v jq >/dev/null 2>&1 || exit 0
 input=$(cat)
 
 # Extract output to scan
-tool_name=$(echo "$input" | jq -r '.tool_name // "unknown"')
-output=$(echo "$input" | jq -r '.tool_output.output // ""')
+tool_name=$(printf '%s\n' "$input" | jq -r '.tool_name // "unknown"')
+output=$(printf '%s\n' "$input" | jq -r '.tool_output.output // ""')
 
 # Skip if no output
 if [ -z "$output" ] || [ "$output" = "null" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -96,5 +96,5 @@ if [ "$detected" = true ]; then
 fi
 
 # Pass through (always)
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/session-autofix-prompt.sh

@@ -14,16 +14,16 @@ fi
 FINDINGS=$(cat "$FIXES_FILE")
 rm -f "$FIXES_FILE"
 
-ISSUE_COUNT=$(echo "$FINDINGS" | jq -r '.issue_count // 0' 2>/dev/null)
+ISSUE_COUNT=$(printf '%s\n' "$FINDINGS" | jq -r '.issue_count // 0' 2>/dev/null)
 
 if [ "$ISSUE_COUNT" -gt 0 ]; then
   echo "[Session Auto-Fix] Previous session left ${ISSUE_COUNT} issue(s):"
-  echo "$FINDINGS" | jq -r '.issues[]' 2>/dev/null | while IFS= read -r issue; do
+  printf '%s\n' "$FINDINGS" | jq -r '.issues[]' 2>/dev/null | while IFS= read -r issue; do
     type="${issue%%:*}"
     msg="${issue#*:}"
     echo "  - [${type}] ${msg}"
   done
-  FIX_COUNT=$(echo "$FINDINGS" | jq -r '.fix_count // 0' 2>/dev/null)
+  FIX_COUNT=$(printf '%s\n' "$FINDINGS" | jq -r '.fix_count // 0' 2>/dev/null)
   if [ "$FIX_COUNT" -gt 0 ]; then
     echo "Auto-fixed: ${FIX_COUNT} item(s)."
   fi

package/templates/.claude/hooks/scripts/session-autofix.sh

@@ -142,5 +142,5 @@ fi
 mkdir -p "$LOG_DIR" 2>/dev/null
 echo "{\"date\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"issue_count\":${ISSUE_COUNT},\"fix_count\":${FIX_COUNT}}" >> "${LOG_DIR}/$(date +%Y-%m-%d).jsonl" 2>/dev/null
 
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/session-env-check.sh

@@ -298,5 +298,5 @@ fi
 echo "------------------------------------" >&2
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/session-reflection.sh

@@ -15,32 +15,32 @@ input=$(cat)
 
 # ── Opt-out 체크 ──
 if [ "${OMCUSTOM_SESSION_REFLECTION:-}" = "off" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # ── jq 의존성 체크 ──
 if ! command -v jq >/dev/null 2>&1; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # ── session_id 추출 ──
-session_id=$(echo "$input" | jq -r '.session_id // empty' 2>/dev/null)
+session_id=$(printf '%s\n' "$input" | jq -r '.session_id // empty' 2>/dev/null)
 if [ -z "$session_id" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # ── Phase 2 (#1196): background_tasks / session_crons 추출 (CC v2.1.145+) ──
 # 신규 필드 미존재 시 빈 배열로 처리 (graceful degrade).
-bg_tasks_json=$(echo "$input" | jq -c '.background_tasks // []' 2>/dev/null || echo '[]')
-session_crons_json=$(echo "$input" | jq -c '.session_crons // []' 2>/dev/null || echo '[]')
-bg_tasks_count=$(echo "$bg_tasks_json" | jq 'length' 2>/dev/null || echo 0)
-session_crons_count=$(echo "$session_crons_json" | jq 'length' 2>/dev/null || echo 0)
+bg_tasks_json=$(printf '%s\n' "$input" | jq -c '.background_tasks // []' 2>/dev/null || echo '[]')
+session_crons_json=$(printf '%s\n' "$input" | jq -c '.session_crons // []' 2>/dev/null || echo '[]')
+bg_tasks_count=$(printf '%s\n' "$bg_tasks_json" | jq 'length' 2>/dev/null || echo 0)
+session_crons_count=$(printf '%s\n' "$session_crons_json" | jq 'length' 2>/dev/null || echo 0)
 
 # 미완료 백그라운드 태스크: running/pending/in_progress 상태 카운트
-bg_dangling_count=$(echo "$bg_tasks_json" | jq '[.[] | select(.status == "running" or .status == "pending" or .status == "in_progress")] | length' 2>/dev/null || echo 0)
+bg_dangling_count=$(printf '%s\n' "$bg_tasks_json" | jq '[.[] | select(.status == "running" or .status == "pending" or .status == "in_progress")] | length' 2>/dev/null || echo 0)
 
 # ── 경로 결정 (환경변수 override 지원) ──
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -50,7 +50,7 @@ TRANSCRIPT_BASE="${OMCUSTOM_TRANSCRIPT_BASE:-${HOME}/.claude/projects/-Users-san
 TRANSCRIPT_PATH="${TRANSCRIPT_BASE}/${session_id}.jsonl"
 
 if [ ! -f "$TRANSCRIPT_PATH" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -179,14 +179,14 @@ else
 fi
 
 # ── Phase 2 (#1196): background_tasks / session_crons 분석 ──
-bg_total=$(echo "$BG_TASKS_JSON" | jq 'length' 2>/dev/null || echo 0)
-cron_total=$(echo "$SESSION_CRONS_JSON" | jq 'length' 2>/dev/null || echo 0)
+bg_total=$(printf '%s\n' "$BG_TASKS_JSON" | jq 'length' 2>/dev/null || echo 0)
+cron_total=$(printf '%s\n' "$SESSION_CRONS_JSON" | jq 'length' 2>/dev/null || echo 0)
 bg_dangling_lines=""
 cron_lines=""
 
 if [ "$bg_total" -gt 0 ]; then
   # dangling 태스크 목록 (최대 5개): id + status + description (60자 truncate)
-  bg_dangling_lines=$(echo "$BG_TASKS_JSON" | jq -r '
+  bg_dangling_lines=$(printf '%s\n' "$BG_TASKS_JSON" | jq -r '
     [.[] | select(.status == "running" or .status == "pending" or .status == "in_progress")]
     | .[0:5]
     | map("  - id=\(.id // "?") status=\(.status // "?") desc=\((.description // "") | .[0:60])")
@@ -195,7 +195,7 @@ if [ "$bg_total" -gt 0 ]; then
 fi
 
 if [ "$cron_total" -gt 0 ]; then
-  cron_lines=$(echo "$SESSION_CRONS_JSON" | jq -r '
+  cron_lines=$(printf '%s\n' "$SESSION_CRONS_JSON" | jq -r '
     .[0:5]
     | map("  - id=\(.id // "?") schedule=\(.schedule // "?") prompt=\((.prompt // "") | .[0:60])")
     | join("\n")
@@ -253,5 +253,5 @@ WORKER_ERR_LOG="/tmp/.claude-reflection-err-${PPID}.log"
 disown $! 2>/dev/null || true
 
 # ── 즉시 stdin pass-through 후 exit 0 (Stop hook 체인 유지) ──
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/skill-extractor-analyzer.sh

@@ -12,7 +12,7 @@ PROPOSALS_FILE="/tmp/.claude-skill-proposals-${PPID}"
 
 # Early exit if no outcomes
 if [ ! -f "$OUTCOMES_FILE" ] || [ ! -s "$OUTCOMES_FILE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -45,5 +45,5 @@ fi
 
 # CRITICAL: Always pass through input and exit 0
 # This hook MUST NEVER block session termination
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/stale-todo-scanner.sh

@@ -78,5 +78,5 @@ fi
 echo "------------------------------------" >&2
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/stall-detection-advisor.sh

@@ -17,18 +17,18 @@ AGENT_START_FILE="/tmp/.claude-agent-starts-${PPID}"
 DURATION_FILE="/tmp/.claude-agent-durations-${PPID}"
 
 # Skip if no start records exist
-[ -f "$AGENT_START_FILE" ] || { echo "$input"; exit 0; }
+[ -f "$AGENT_START_FILE" ] || { printf '%s\n' "$input"; exit 0; }
 
 # --- 1. Extract completed agent info ---
-agent_type=$(echo "$input" | jq -r '.agent_type // "unknown"')
-model=$(echo "$input" | jq -r '.model // "inherit"')
-description=$(echo "$input" | jq -r '.description // ""' | head -c 80)
+agent_type=$(printf '%s\n' "$input" | jq -r '.agent_type // "unknown"')
+model=$(printf '%s\n' "$input" | jq -r '.model // "inherit"')
+description=$(printf '%s\n' "$input" | jq -r '.description // ""' | head -c 80)
 
 # --- 2. Calculate duration from start record ---
 start_epoch=$(grep -F "\"agent_type\":\"${agent_type}\"" "$AGENT_START_FILE" 2>/dev/null | tail -1 | jq -r '.start_epoch // "0"' 2>/dev/null || echo "0")
 
 if [ "$start_epoch" = "0" ] || [ "$start_epoch" = "null" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -56,10 +56,10 @@ if [ "$completed_count" -ge 1 ]; then
     # Check for still-running agents (in start file but not in duration file)
     if [ -f "$AGENT_START_FILE" ] && [ -s "$AGENT_START_FILE" ]; then
       while IFS= read -r line; do
-        running_agent=$(echo "$line" | jq -r '.agent_type // ""' 2>/dev/null || true)
-        running_start=$(echo "$line" | jq -r '.start_epoch // "0"' 2>/dev/null || echo "0")
-        running_desc=$(echo "$line" | jq -r '.description // ""' 2>/dev/null || true)
-        running_model=$(echo "$line" | jq -r '.model // "inherit"' 2>/dev/null || true)
+        running_agent=$(printf '%s\n' "$line" | jq -r '.agent_type // ""' 2>/dev/null || true)
+        running_start=$(printf '%s\n' "$line" | jq -r '.start_epoch // "0"' 2>/dev/null || echo "0")
+        running_desc=$(printf '%s\n' "$line" | jq -r '.description // ""' 2>/dev/null || true)
+        running_model=$(printf '%s\n' "$line" | jq -r '.model // "inherit"' 2>/dev/null || true)
 
         if [ "$running_start" = "0" ] || [ "$running_start" = "null" ]; then continue; fi
 
@@ -90,7 +90,7 @@ duration_entry=$(jq -cn \
   --arg ts "$now_epoch" \
   '{agent_type: $agent, model: $model, description: $desc, duration_seconds: ($dur | tonumber), timestamp: $ts}')
 
-echo "$duration_entry" >> "$DURATION_FILE"
+printf '%s\n' "$duration_entry" >> "$DURATION_FILE"
 
 # Remove only first consumed start entry (preserve siblings for parallel same-type agents)
 if [ -f "$AGENT_START_FILE" ]; then
@@ -108,5 +108,5 @@ if [ -f "$DURATION_FILE" ]; then
 fi
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/stop-console-audit.sh

@@ -42,5 +42,5 @@ echo "[Stop] Audit complete. Session safe to terminate." >&2
 
 # CRITICAL: Always pass through input and exit 0
 # This hook MUST NEVER block session termination
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/stuck-detector.sh

@@ -203,7 +203,7 @@ entry=$(jq -cn \
   --arg readonly "$is_readonly" \
   '{timestamp: $ts, tool: $tool, path: $path, is_error: $err, error_hash: $hash, preview: $preview, readonly: $readonly}')
 
-echo "$entry" >> "$HISTORY_FILE"
+printf '%s\n' "$entry" >> "$HISTORY_FILE"
 
 # Ring buffer: keep last 100 entries
 if [ -f "$HISTORY_FILE" ]; then
@@ -218,13 +218,13 @@ fi
 
 # Only check for patterns if we have enough history
 if [ ! -f "$HISTORY_FILE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 recent_count=$(wc -l < "$HISTORY_FILE")
 if [ "$recent_count" -lt 3 ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -347,7 +347,7 @@ if [ "$hard_block" = true ]; then
   echo "  Action: Blocking this tool call to break the stuck loop." >&2
   echo "  Recovery: Step back, re-read the error, and try a fundamentally different approach." >&2
   echo "=====================================" >&2
-  echo "$input"
+  printf '%s\n' "$input"
   HOOK_END=$(date +%s%N 2>/dev/null || echo 0)
   if [ "$HOOK_START" != "0" ] && [ "$HOOK_END" != "0" ]; then
     HOOK_MS=$(( (HOOK_END - HOOK_START) / 1000000 ))
@@ -357,7 +357,7 @@ if [ "$hard_block" = true ]; then
 fi
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 HOOK_END=$(date +%s%N 2>/dev/null || echo 0)
 if [ "$HOOK_START" != "0" ] && [ "$HOOK_END" != "0" ]; then
   HOOK_MS=$(( (HOOK_END - HOOK_START) / 1000000 ))