oh-my-customcode 2.0.7 → 2.0.9

package/templates/.claude/hooks/scripts/git-delegation-guard.sh

@@ -1,7 +1,69 @@
 #!/bin/bash
-# R010 git-delegation-guard hook
-# Warns when git operations are delegated to a non-mgr-gitnerd agent via Agent/Task tool.
-# WARN only - does NOT block (exit 0, passes input through).
+# git-delegation-guard.sh — PreToolUse(Task|Agent): R010 git 위임 감지 (advisory, #1885)
+#
+# Warns when a delegation prompt to a non-mgr-gitnerd agent mentions git write keywords.
+# Advisory only: always exit 0, never blocks, never modifies tool input.
+#
+# Delivery (#1885): exit 0 + stderr never reaches the model (measured, #1775 comment
+#   6405197553). The warning is therefore emitted as ONE stdout JSON line
+#   hookSpecificOutput.additionalContext; nothing is written to stderr and the input is
+#   no longer echoed back. No warning -> no output.
+#
+# Precision (#1885): a keyword occurrence does NOT count when (case-insensitive, LC_ALL=C bytes;
+#   U+2019 is folded to `'`; `git -C <path>` / `git -c k=v` option groups are stripped first so
+#   `git -C /repo commit` is treated like `git commit`):
+#   (a) a negation token appears BEFORE it on the same line. English tokens are whole words
+#       (`-` and `_` stay inside words, so `--no-rebase`, `no-op`, `not_found` do not count):
+#       not, never, no, don't, avoid, without, forbidden, prohibited (so "do not" is covered);
+#       Korean substrings 금지, 말 것, 하지 마 (bare "않" was removed: too broad);
+#   (b) it sits in a prohibition block. Header words (word-bounded, after list/markdown markers):
+#       Forbidden, Prohibited, Do not, Don't, Never, Avoid, 금지, 하지 말 것.
+#       - colon header: a line starting with a header word whose `:` or full-width `：` ends the
+#         header phrase (at most 4 words before it). The block runs to the next blank line
+#         or the next non-prohibition label line (`Allowed: …`, `Steps:`, `**Steps**:`); a
+#         prohibition label (`Never: …`) continues it.
+#       - markdown heading (`#`..`######` + space; `#1885` is not a heading) starting with a header
+#         word (colon optional). The block covers only the FIRST paragraph or list after the
+#         heading: blank lines directly after the heading are skipped, then it runs through
+#         consecutive non-blank lines and ends at the next blank line, heading, or label line
+#         (`**Bold**` or a non-list line ending in a colon);
+#       - header colons count only when followed by whitespace/end of line (`https://x`, `10:30`
+#         do not); Korean header words need a boundary (whitespace, colon or end: `금지어` is not
+#         a header). Lines inside ``` fences never open or close blocks (fence lines themselves
+#         count as block content);
+#   (c) it is a read-only query:
+#       - `git branch` followed by --list, -l, --show-current, --contains, --all, --merged,
+#         --no-merged, -a, -r, -v or -vv, unless the same command also has -d/-D/--delete/-m/-M/
+#         -c/-C (`git branch -r -d origin/x` is a write and fires);
+#       - `git tag` followed by --list, -l, --contains, --points-at or --sort;
+#       - bare `git tag` / `git branch` used as a noun: followed by end of line, punctuation, `+`,
+#         a backtick, an opening bracket, or whitespace + a common prose word (is/the/and/...).
+#         `git branch feature-x` / `git tag v1` are creations and still fire.
+#   Keyword boundary: a keyword matches only if the next char is not [A-Za-z0-9_-] and the
+#   previous char is not [A-Za-z0-9_] (`git merge-base` does not match `git merge`; "legit
+#   commit" does not match `git commit`). Quoted `-C "/my repo"` / `-c 'k=v w'` arguments with
+#   spaces are stripped like unquoted ones.
+#   Warn only if at least one occurrence survives. The keyword set and the mgr-gitnerd
+#   exemption are unchanged. A non-string prompt is treated as empty; a missing subagent_type
+#   is shown as (unspecified).
+#
+# Measured precision: replay (8 newest main transcripts, dedup by tool_use id; subagent
+#   transcripts carry no Agent calls): old 167 -> 23 of 752 inputs; 0 clear true positives found
+#   in this repo's corpus. The hook stays model-visible (additionalContext, worded as a
+#   conditional advisory) because the base rate in installed projects differs [가설].
+#
+# Known false negatives (accepted trade-offs):
+#   - a real command after a negation word on the same line ("Do not skip this: git commit now"
+#     is read as a colon header and skipped with its block);
+#   - a real command inside a prohibition block not separated by a blank line (colon header) or
+#     placed in the first paragraph/list under a Forbidden heading;
+#   - prose "git tag"/"git branch" followed by a stop-listed word is treated as a noun.
+#   Known false positive (SOV trade-off): Korean "git commit 금지" (token after the keyword) is
+#   NOT excluded by (a) unless it sits in a block (b), so it still warns.
+#
+# State writes (violation file, threshold marker) are best-effort: failures are silent and never
+#   abort or leak to stderr. The per-session count line is emitted once, when the count is >= 3
+#   and the atomic marker dir /tmp/.claude-r010-threshold-${PPID} is created by this firing.
 #
 # PPID Scoping Convention:
 #   All session-scoped temp files MUST use $PPID (Claude Code parent PID),
@@ -14,22 +76,18 @@ command -v jq >/dev/null 2>&1 || exit 0
 
 input=$(cat)
 
-# Guard: non-object stdin (non-JSON / JSON array / empty) — swallow and exit 0
-# instead of reflecting garbage back on stdout. The sibling hooks (audit-log.sh,
-# model-escalation-advisor.sh, task-outcome-recorder.sh) all carry this guard;
-# this one did not, so a non-object payload was echoed through verbatim. (#1656 F)
+# Guard: non-object stdin (non-JSON / JSON array / empty) — swallow and exit 0. (#1656 F)
 printf '%s' "$input" | jq -e 'type=="object"' >/dev/null 2>&1 || exit 0
 
-# `?` suppresses jq's "Cannot index <type> with string" when tool_input arrives as a
-# scalar/array instead of an object (measured #1656 A: the bare form leaked a jq error to
-# stderr on every non-object tool_input). 2>/dev/null + `|| echo ""` keep the hook silent
-# and advisory-only even if jq itself fails for an unrelated reason.
-agent_type=$(printf '%s\n' "$input" | jq -r '.tool_input.subagent_type? // ""' 2>/dev/null || echo "")
-prompt=$(printf '%s\n' "$input" | jq -r '.tool_input.prompt? // ""' 2>/dev/null || echo "")
+# `?` suppresses jq errors when tool_input is a scalar/array (#1656 A).
+agent_type=$(printf '%s\n' "$input" | jq -r '(.tool_input.subagent_type? | strings) // ""' 2>/dev/null || echo "")
+prompt=$(printf '%s\n' "$input" | jq -r '(.tool_input.prompt? | strings) // ""' 2>/dev/null || echo "")
 
 # R010 violation tracking file (PPID-scoped for session persistence)
 VIOLATION_FILE="/tmp/.claude-r010-violations-${PPID}"
 
+ctx=""
+
 # Only warn when the delegated agent is NOT mgr-gitnerd
 if [ "$agent_type" != "mgr-gitnerd" ]; then
   git_keywords=(
@@ -45,23 +103,116 @@ if [ "$agent_type" != "mgr-gitnerd" ]; then
     "git cherry-pick"
     "git tag"
   )
+  kw_list=$(IFS='|'; printf '%s' "${git_keywords[*]}")
 
-  for keyword in "${git_keywords[@]}"; do
-    if echo "$prompt" | grep -qi "$keyword"; then
-      echo "[Hook] WARNING: R010 violation detected - git operation ('$keyword') delegated to '$agent_type' instead of 'mgr-gitnerd'" >&2
-      echo "[Hook] Per R010, all git operations (commit/push/branch/merge/etc.) MUST be delegated to mgr-gitnerd" >&2
+  # First keyword (in list order) with at least one surviving occurrence.
+  keyword=$(printf '%s\n' "$prompt" | LC_ALL=C awk -v kws="$kw_list" '
+    function hw(x) {
+      return (x ~ /^(forbidden|prohibited|do not|don.t|never|avoid)([^a-z0-9_]|$)/ || x ~ /^(금지|하지 말 것)([ \t:]|$|\357\274\232)/)
+    }
+    # header colon: ":" or full-width "：" followed by whitespace/end of line, at most 4 words before it
+    function colon_header(x,   i, len, ch, pre, k, tmp) {
+      len = length(x)
+      for (i = 1; i <= len; i++) {
+        ch = substr(x, i, 1)
+        if (ch == ":" && (i == len || substr(x, i + 1, 1) ~ /[ \t]/)) break
+        if (substr(x, i, 3) == "\357\274\232" && (i + 2 == len || substr(x, i + 3, 1) ~ /[ \t]/)) break
+      }
+      if (i > len) return 0
+      pre = substr(x, 1, i - 1)
+      k = split(pre, tmp, /[ \t]+/)
+      return (k <= 4)
+    }
+    BEGIN {
+      n = split(kws, K, "|")
+      inblock = 0; btype = ""; hstate = ""; infence = 0
+      neg = " (not|never|no|don.t|avoid|without|forbidden|prohibited) "
+      prose = "(is|was|are|and|or|the|a|an|to|of|in|on|at|for|with|before|after|then|that|which|when|if|as|from|by|name|names|first|output|result|state|you|we|it)"
+    }
+    {
+      l = tolower($0)
+      gsub(/\342\200\231/, "\047", l)
+      gsub(/git[ \t]+(-[cC][ \t]+([\"][^\"]*[\"]|\047[^\047]*\047|[^ \t]+)[ \t]+)+/, "git ", l)
+      isfence = (l ~ /^[ \t]*```/)
+      if (isfence) infence = !infence
+      if (l ~ /^[ \t\r]*$/) {
+        if (inblock && !infence) {
+          if (btype == "C") inblock = 0
+          else if (hstate == "body") inblock = 0
+        }
+        next
+      }
+      s = l
+      sub(/^[ \t>*#+_`-]+/, "", s)
+      sub(/^[0-9]+[.)][ \t]+/, "", s)
+      sub(/^[*_`]+/, "", s)
+      if (!isfence && !infence) {
+        if (l ~ /^[ \t]*(#|##|###|####|#####|######)[ \t]/) {
+          # heading: ends any block; a prohibition heading opens an H block (first paragraph/list only)
+          if (hw(s)) { inblock = 1; btype = "H"; hstate = "lead"; next }
+          inblock = 0; btype = ""
+        } else {
+          # a NEW colon-header line that is not itself a prohibition header ends a colon block
+          if (inblock && btype == "C" && colon_header(s) && !hw(s)) { inblock = 0; btype = "" }
+          # a label line (**Bold** or "text:") ends an H block
+          if (inblock && btype == "H" && (l ~ /^[ \t]*\*\*[^*]+\*\*[ \t]*[:：]?[ \t]*$/ || (l !~ /^[ \t]*([-*+]|[0-9]+[.)])[ \t]/ && l ~ /(:|\357\274\232)[ \t]*$/))) { inblock = 0; btype = "" }
+          if (!inblock && hw(s) && colon_header(s)) { inblock = 1; btype = "C"; next }
+        }
+      }
+      if (inblock) { if (btype == "H") hstate = "body"; next }
+      for (i = 1; i <= n; i++) {
+        kw = K[i]
+        if (kw in surv) continue
+        off = 0
+        rest = l
+        while ((p = index(rest, kw)) > 0) {
+          pos = off + p
+          pre = substr(l, 1, pos - 1)
+          post = substr(l, pos + length(kw))
+          rest = substr(l, pos + 1)
+          off = pos
+          if (post ~ /^[a-z0-9_-]/) continue
+          if (pos > 1 && substr(l, pos - 1, 1) ~ /[a-z0-9_]/) continue
+          w = pre
+          gsub(/[^a-z0-9\047_-]/, " ", w)
+          w = " " w " "
+          if (w ~ neg) continue
+          if (index(pre, "금지") || index(pre, "말 것") || index(pre, "하지 마")) continue
+          if (kw == "git branch" || kw == "git tag") {
+            cmd = post
+            sub(/[;&|].*$/, "", cmd)
+            if (kw == "git branch" && cmd ~ /(^|[ \t])(--delete|-[a-z]*[dmc][a-z]*)([ \t]|$)/) { surv[kw] = 1; break }
+            if (kw == "git branch" && post ~ /^[ \t]+(--list|-l|--show-current|--contains|--all|--merged|--no-merged|-a|-r|-v|-vv)([^a-z0-9-]|$)/) continue
+            if (kw == "git tag" && post ~ /^[ \t]+(--list|-l|--contains|--points-at|--sort)([^a-z0-9-]|$)/) continue
+            if (post ~ /^[ \t]*$/ || post ~ /^[+`.,;:)\]\047"!?|\/]/ || post ~ /^[ \t]+[(\[]/ || post ~ ("^[ \t]+" prose "([^a-z0-9_-]|$)")) continue
+          }
+          surv[kw] = 1
+          break
+        }
+      }
+    }
+    END {
+      for (i = 1; i <= n; i++) if (K[i] in surv) { print K[i]; exit }
+    }
+  ')
 
-      # Record violation for R021 promotion tracking
-      echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $keyword $agent_type" >> "$VIOLATION_FILE"
-      violation_count=$(wc -l < "$VIOLATION_FILE" 2>/dev/null | tr -d ' ')
-      if [ "$violation_count" -ge 3 ]; then
-        echo "[Hook] R010 violations: ${violation_count} this session — R021 promotion threshold reached" >&2
-      fi
+  if [ -n "$keyword" ]; then
+    if [ -n "$agent_type" ]; then shown="'$agent_type'"; else shown="(unspecified)"; fi
+    ctx="[Hook] ADVISORY: delegation prompt to $shown mentions '$keyword' — if this delegates a git operation, route it to mgr-gitnerd (R010)."
+    ctx="$ctx"$'\n'"[Hook] Per R010, all git operations (commit/push/branch/merge/etc.) MUST be delegated to mgr-gitnerd"
 
-      break
+    # Record mention for R021 promotion tracking (best-effort, silent on failure)
+    { echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) $keyword ${agent_type:-(unspecified)}" >> "$VIOLATION_FILE"; } 2>/dev/null || true
+    violation_count=$({ wc -l < "$VIOLATION_FILE" | tr -d ' '; } 2>/dev/null || true)
+    # Count line once: count >= 3 AND the atomic marker dir is created by this firing.
+    if [ "${violation_count:-0}" -ge 3 ] 2>/dev/null && { mkdir "/tmp/.claude-r010-threshold-${PPID}"; } 2>/dev/null; then
+      ctx="$ctx"$'\n'"[Hook] R010 git-keyword mentions: ${violation_count} this session (advisory telemetry; R021 promotion needs user approval)"
     fi
-  done
+  fi
+fi
+
+if [ -n "$ctx" ]; then
+  jq -cn --arg ctx "$ctx" '{hookSpecificOutput:{hookEventName:"PreToolUse",additionalContext:$ctx}}'
 fi
 
-# Always pass through - this hook is advisory only
-printf '%s\n' "$input"
+exit 0

package/templates/.claude/hooks/scripts/model-escalation-advisor.sh

@@ -7,7 +7,13 @@ command -v jq >/dev/null 2>&1 || exit 0
 # Model Escalation Advisor Hook
 # Trigger: PreToolUse, tool == "Task" || tool == "Agent"
 # Purpose: Advise model escalation when failure patterns detected
-# Protocol: stdin JSON -> process -> stdout pass-through, exit 0 always
+# Protocol: stdin JSON -> process -> exit 0 always
+# Once per session (#1885): each distinct advisory key is shown at most once, claimed atomically via a
+# per-key marker dir under /tmp/.claude-model-advisory-shown-${PPID}.d/ (parallel-hook safe).
+# De-escalation is opt-in (OMCUSTOM_MODEL_DEESCALATION=on): task-outcome-recorder.sh records every
+# SubagentStop as outcome=success (no error signal), so "N consecutive successes" only means N agents finished (#1885).
+# Channel (#1885): exit-0 stderr never reaches the model; advice is delivered via stdout JSON
+# hookSpecificOutput.additionalContext (measured CC 2.1.310, #1775). No stdin passthrough, no stderr.
 
 input=$(cat)
 
@@ -24,10 +30,25 @@ OUTCOME_FILE="/tmp/.claude-task-outcomes-${PPID}"
 
 # Skip if no history
 if [ ! -f "$OUTCOME_FILE" ]; then
-  printf '%s\n' "$input"
   exit 0
 fi
 
+ctx=""
+SHOWN_DIR="/tmp/.claude-model-advisory-shown-${PPID}.d"
+# fresh KEY: atomic claim via mkdir of a per-key marker dir (hash of KEY; no shared file, so no
+# check-then-append race and no newline pollution). Success => emit. State failures are silent;
+# if the marker dir itself is unusable we fail open (emit) rather than lose the advisory.
+fresh() {
+  { mkdir -p "$SHOWN_DIR"; } 2>/dev/null || true
+  [ -d "$SHOWN_DIR" ] || return 0
+  local h
+  h=$(printf '%s' "$1" | cksum | cut -d' ' -f1) || h=""
+  [ -n "$h" ] || return 0
+  if { mkdir "$SHOWN_DIR/$h"; } 2>/dev/null; then return 0; fi
+  return 1
+}
+add() { if [ -z "$ctx" ]; then ctx="$1"; else ctx="${ctx}"$'\n'"$1"; fi; }
+
 # Thresholds
 FAILURE_THRESHOLD=2
 CONSECUTIVE_THRESHOLD=3
@@ -85,20 +106,20 @@ if [ -n "$next_model" ]; then
     reason="${consecutive_failures} consecutive failures"
   fi
 
-  if [ "$should_advise" = true ]; then
-    echo "" >&2
-    echo "--- [Model Escalation Advisory] ---" >&2
-    echo "  Agent type: ${agent_type}" >&2
-    echo "  Current model: ${current_model}" >&2
-    echo "  ⚡ Recommended: Escalate to ${next_model}" >&2
-    echo "  Cost impact: ${cost_multiplier} per task" >&2
-    echo "  Reason: ${reason}" >&2
-    echo "------------------------------------" >&2
+  if [ "$should_advise" = true ] && fresh "esc:${agent_type}:${current_model}->${next_model}"; then
+    add ""
+    add "--- [Model Escalation Advisory] ---"
+    add "  Agent type: ${agent_type}"
+    add "  Current model: ${current_model}"
+    add "  ⚡ Recommended: Escalate to ${next_model}"
+    add "  Cost impact: ${cost_multiplier} per task"
+    add "  Reason: ${reason}"
+    add "------------------------------------"
   fi
 fi
 
 # De-escalation check
-if [ "$current_model" != "haiku" ] && [ "$current_model" != "inherit" ] && [ "$current_model" != "" ]; then
+if [ "${OMCUSTOM_MODEL_DEESCALATION:-}" = "on" ] && [ "$current_model" != "haiku" ] && [ "$current_model" != "inherit" ] && [ "$current_model" != "" ]; then
   # Same `grep -c` hygiene as above (#1656 E).
   recent_successes=$(tail -${COOLDOWN} "$OUTCOME_FILE" 2>/dev/null | grep -c '"outcome":"success"' 2>/dev/null || true)
   recent_successes=${recent_successes:-0}
@@ -111,16 +132,18 @@ if [ "$current_model" != "haiku" ] && [ "$current_model" != "inherit" ] && [ "$c
       sonnet) lower_model="haiku" ;;
     esac
 
-    if [ -n "$lower_model" ]; then
-      echo "" >&2
-      echo "--- [Model De-escalation Advisory] ---" >&2
-      echo "  ↓ Consider: ${current_model} → ${lower_model}" >&2
-      echo "  ${recent_successes} consecutive successes" >&2
-      echo "--------------------------------------" >&2
+    if [ -n "$lower_model" ] && fresh "deesc:${current_model}->${lower_model}"; then
+      add ""
+      add "--- [Model De-escalation Advisory] ---"
+      add "  ↓ Consider: ${current_model} → ${lower_model}"
+      add "  ${recent_successes} consecutive successes"
+      add "--------------------------------------"
     fi
   fi
 fi
 
-# Pass through
-printf '%s\n' "$input"
+# Emit advisory to the model (#1885); silent when nothing to advise.
+if [ -n "$ctx" ]; then
+  jq -cn --arg ctx "$ctx" '{hookSpecificOutput:{hookEventName:"PreToolUse",additionalContext:$ctx}}'
+fi
 exit 0

package/templates/.claude/hooks/scripts/omcustom-auto-update.sh

@@ -30,8 +30,20 @@ if ! [ -c /dev/tty ] 2>/dev/null; then
 fi
 
 # --- Configuration ---
-CACHE_DIR="$HOME/.oh-my-customcode"
-CACHE_FILE="${CACHE_DIR}/self-update-cache.json"
+# Cache location. Deliberate difference from the TS resolver (src/utils/home.ts
+# resolveHomeDir, which falls back to the OS/passwd home): when HOME is unset, empty or not
+# an absolute path, this hook SKIPS the cache entirely (no read, no write, no mkdir) rather
+# than resolving to "/.oh-my-customcode" or a passwd home (#1775).
+CACHE_ENABLED=true
+CACHE_DIR=""
+CACHE_FILE=""
+case "${HOME:-}" in
+  /*)
+    CACHE_DIR="$HOME/.oh-my-customcode"
+    CACHE_FILE="${CACHE_DIR}/self-update-cache.json"
+    ;;
+  *) CACHE_ENABLED=false ;;
+esac
 CACHE_MAX_AGE=3600  # 1 hour in seconds
 NPM_TIMEOUT=3       # seconds for npm view
 INPUT_TIMEOUT=10     # seconds for user prompt
@@ -69,10 +81,12 @@ LATEST_VERSION=""
 CACHE_HIT=false
 
 # Ensure cache directory exists
-mkdir -p "$CACHE_DIR" 2>/dev/null
+if [ "$CACHE_ENABLED" = true ]; then
+  mkdir -p "$CACHE_DIR" 2>/dev/null
+fi
 
 # Check cache freshness
-if [ -f "$CACHE_FILE" ]; then
+if [ "$CACHE_ENABLED" = true ] && [ -f "$CACHE_FILE" ]; then
   CACHE_TIMESTAMP=$(grep -o '"timestamp"[[:space:]]*:[[:space:]]*[0-9]*' "$CACHE_FILE" 2>/dev/null | grep -o '[0-9]*$')
   CACHED_VERSION=$(grep -o '"version"[[:space:]]*:[[:space:]]*"[^"]*"' "$CACHE_FILE" 2>/dev/null | grep -o '"[^"]*"$' | tr -d '"')
 
@@ -93,7 +107,7 @@ if [ "$CACHE_HIT" = false ]; then
     LATEST_VERSION=$(timeout "$NPM_TIMEOUT" npm view "$PACKAGE_NAME" version 2>/dev/null || echo "")
 
     # Update cache on successful fetch
-    if [ -n "$LATEST_VERSION" ]; then
+    if [ -n "$LATEST_VERSION" ] && [ "$CACHE_ENABLED" = true ]; then
       NOW=$(date +%s)
       cat > "$CACHE_FILE" << EOF
 {

package/templates/.claude/hooks/scripts/rule-deletion-guard.sh

@@ -9,7 +9,31 @@
 # destructive verb, destructive verb in a non-head position, unresolvable expansion in a target,
 # opaque constructs such as eval / sh -c / $(...) / backticks / source, parse errors, unknown cwd,
 # analyzer exceptions) -> strict legacy regex check (blocks if the pre-#1782 logic would block).
+# Opaque markers are looked for outside quoted text (#1859): markers inside a quoted string whose last
+# path component contains whitespace no longer force the fallback (the shell does not run them as a
+# command); single-quoted `$(`/backticks are likewise ignored. `$(` and backticks inside double quotes,
+# and any other quoted string (it may be the command, e.g. "eval", "/my dir/bash"), stay opaque.
+# The fallback fires only if the raw command AND its masked copy both match.
 # No python3: legacy regex check (needs jq). Neither python3 nor jq: fail-open (exit 0).
+#
+# Intended limitation (#1784): the blocked set is the one modelled above (v1.1.95, #1782: rm/unlink/
+# rmdir/shred/truncate, mv, find, xargs, git rm|mv|clean, writing redirects); the exclusion of the
+# overwrite/interpreter forms is recorded at
+# https://github.com/baekenough/oh-my-customcode/issues/1784#issuecomment-6405528206 . Content-overwrite
+# forms (cp /dev/null, tee, dd of=, sed -i, ln -sf, install, rsync --delete, tar --remove-files,
+# git checkout -- / restore / stash), interpreter one-liners (perl -e, python -c, node -e) and shell
+# aliases and git clean -f without -d run from an ancestor of a rule dir (e.g. the project root, where it can still remove untracked files inside the rule dirs; a target or cwd inside a rule dir is blocked) are NOT blocked: they are edit-class or interpreter forms whose blocking
+# would raise false positives like #1859, and git history is the recovery path.
+#
+# Residual limits accepted with the #1859 change: (a) a quoted payload that carries an opaque marker
+# and is handed to an executor the analyzer does not model (ssh, su -c, script -c, ..., or stdin piped
+# to a shell: `| bash`, `| sh`) is no longer forced to the fallback, so it is not inspected - the same
+# as such payloads without a marker always were; `env -S` / `--split-string` is likewise not parsed:
+# unwrap() sends it to the legacy regex check only; (b) the quoted-option gap predates it: `bash "-c"
+# ...` is not recognised as `-c`, because the marker pattern needs whitespace right before an unquoted
+# `-`; (c) a quoted string is treated as text
+# only when its last path component (after the final `/`) contains whitespace, so a lone quoted word
+# or path to a binary stays visible and still falls back (conservative).
 
 set -uo pipefail
 
@@ -259,6 +283,97 @@ def low(s):
     return s.lower()
 
 
+def _blank_quoted(body, double):
+    """Blank the inside of one quoted string for the OPAQUE scan (#1859).
+
+    A string whose last path component (after the final `/`) contains whitespace cannot name a shell
+    binary or `eval`/`source`, so the markers in it are not run as a command by that shell: everything
+    is blanked, except `$(` and backticks inside double quotes (the shell expands those). This does
+    not make the text safe: a payload handed to another executor (ssh, su -c, ...) is not inspected.
+    Any other string may BE the command (`"eval"`, `'sh'`, `"/my dir/bash"`), so it stays visible;
+    only the `$(`/backtick of a single-quoted one, which the shell never expands, is neutralised.
+    """
+    if not any(ch.isspace() for ch in body.rsplit('/', 1)[-1]):
+        return body if double else body.replace('$(', '_(').replace('`', '_')
+    if not double:
+        return '_' * len(body)
+    res, k = [], 0
+    while k < len(body):
+        if body.startswith('$(', k):
+            res.append('$(')
+            k += 2
+        else:
+            res.append(body[k] if body[k] == '`' else '_')
+            k += 1
+    return ''.join(res)
+
+
+def mask_quoted(s):
+    """Copy of `s` for the OPAQUE scan with non-executable quoted text blanked (#1859).
+
+    Mirrors the quote handling of lex(). When unsure (heredoc operator, unterminated quote) the rest
+    of the text is returned unmasked, so the scan is then at least as strict as on the raw command.
+    Unquoted text, comments and `$'...'` strings are never touched.
+    """
+    out, n, i = [], len(s), 0
+    wordstart = True
+    while i < n:
+        c = s[i]
+        if c in ' \t\n':
+            out.append(c)
+            i += 1
+            wordstart = True
+        elif s.startswith('<<<', i):
+            out.append('<<<')
+            i += 3
+            wordstart = True
+        elif s.startswith('<<', i):
+            return ''.join(out) + s[i:]  # heredoc body is skipped by lex(): quote state is unknowable
+        elif c in ';&|<>()':
+            out.append(c)
+            i += 1
+            wordstart = True
+        elif c == '#' and wordstart:
+            j = s.find('\n', i)
+            j = n if j < 0 else j
+            out.append(s[i:j])
+            i = j
+        elif c == '\\':
+            out.append(s[i:i + 2])
+            i += 2
+            wordstart = False
+        elif c == '$' and s.startswith("$'", i):
+            j = i + 2
+            while j < n and s[j] != "'":
+                j += 2 if s[j] == '\\' else 1
+            if j >= n:
+                return ''.join(out) + s[i:]
+            out.append(s[i:j + 1])
+            i = j + 1
+            wordstart = False
+        elif c == "'":
+            j = s.find("'", i + 1)
+            if j < 0:
+                return ''.join(out) + s[i:]
+            out.append("'" + _blank_quoted(s[i + 1:j], False) + "'")
+            i = j + 1
+            wordstart = False
+        elif c == '"':
+            j = i + 1
+            while j < n and s[j] != '"':
+                j += 2 if s[j] == '\\' and j + 1 < n and s[j + 1] in '$`"\\\n' else 1
+            if j >= n:
+                return ''.join(out) + s[i:]
+            out.append('"' + _blank_quoted(s[i + 1:j], True) + '"')
+            i = j + 1
+            wordstart = False
+        else:
+            out.append(c)
+            i += 1
+            wordstart = False
+    return ''.join(out)
+
+
 def main(d, cmd):
     start = d.get('cwd')
     if isinstance(start, str) and os.path.isdir(start):
@@ -280,7 +395,9 @@ def main(d, cmd):
             low(os.path.join(root, 'templates', '.claude', 'rules'))]
 
     cmd = cmd.replace('\r', '').replace('\\\n', '')
-    if OPAQUE.search(cmd):
+    # Fall back only when BOTH scans match: masking must never add a fallback the raw scan lacks
+    # (blanking `; | & \n` inside quotes can otherwise create an `sh ... -c` match, #1859 review F1).
+    if OPAQUE.search(cmd) and OPAQUE.search(mask_quoted(cmd)):
         return 3
     try:
         toks = lex(cmd)

package/templates/.claude/hooks/scripts/schema-validator.sh

@@ -2,8 +2,10 @@
 # Schema Validator Hook — PreToolUse input validation
 # Trigger: PreToolUse on Write, Edit, Bash
 # Purpose: Validate tool inputs against JSON Schema definitions
-# Phase 1: Advisory only (exit 0 with stderr warning)
-# Protocol: stdin JSON -> validate -> stdout pass-through
+# Phase 1: Advisory only (exit 0; warnings via stdout JSON additionalContext, #1885)
+# Protocol: stdin JSON -> validate -> exit 0
+# Channel (#1885): exit-0 stderr never reaches the model (CC 2.1.310 probe, #1775 comment 6405197553);
+#   warnings are delivered as stdout JSON hookSpecificOutput.additionalContext. No stdin passthrough.
 
 set -euo pipefail
 
@@ -29,7 +31,6 @@ SCHEMA_FILE="$ROOT/.claude/schemas/tool-inputs.json"
 
 # Skip if schema file doesn't exist
 if [ ! -f "$SCHEMA_FILE" ]; then
-  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -72,7 +73,7 @@ case "$tool_name" in
     fi
 
     # Check dangerous patterns
-    if echo "$command" | grep -qE 'rm\s+-rf\s+/[^.]'; then
+    if echo "$command" | grep -qE 'rm\s+-rf\s+["'"'"']?/["'"'"']?(\s|\*|[;&|)]|$)'; then
       warnings+=("[Schema] Bash: DANGER — recursive delete from root detected")
     fi
     if echo "$command" | grep -qE '^\s*sudo\s+'; then
@@ -102,14 +103,10 @@ case "$tool_name" in
     ;;
 esac
 
-# Output warnings (advisory only)
+# Output warnings (advisory only) via additionalContext
 if [ ${#warnings[@]} -gt 0 ]; then
-  for w in "${warnings[@]}"; do
-    echo "$w" >&2
-  done
-  echo "[Schema] Phase 1: advisory only — not blocking" >&2
+  ctx=$(printf '%s\n' "${warnings[@]}"; printf '%s' "[Schema] Phase 1: advisory only — not blocking")
+  jq -cn --arg ctx "$ctx" '{hookSpecificOutput:{hookEventName:"PreToolUse",additionalContext:$ctx}}'
 fi
 
-# Always pass through (Phase 1)
-printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/session-env-check.sh

@@ -99,7 +99,14 @@ fi
 
 # Drift Detection: compare git HEAD between sessions
 DRIFT_STATUS="not-git"
-if command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+# When HOME is unset, empty or not an absolute path, skip the session-state write entirely
+# (no mkdir, no state file; drift stays "not-git") instead of aborting under set -eu or
+# writing to "/.claude/..." (#1775; same rule as the self-update cache below).
+HOME_ABSOLUTE=false
+case "${HOME:-}" in
+  /*) HOME_ABSOLUTE=true ;;
+esac
+if [ "$HOME_ABSOLUTE" = true ] && command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
   SESSION_STATE_DIR="$HOME/.claude/session-state"
   mkdir -p "$SESSION_STATE_DIR"
 
@@ -132,8 +139,10 @@ if command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/n
 fi
 
 # --- CI Status Check ---
-# Check last CI run status if gh CLI is available
-if command -v gh &>/dev/null; then
+# Check last CI run status if gh CLI is available.
+# Skipped when HOME is not absolute (HOME_ABSOLUTE, set above): external CLIs keep state under
+# $HOME and would write it into the cwd (the project dir) instead (#1775).
+if [ "$HOME_ABSOLUTE" = true ] && command -v gh &>/dev/null; then
   ci_status=$(gh run list --limit 1 --json conclusion -q '.[0].conclusion' 2>/dev/null || echo "unknown")
   ci_name=$(gh run list --limit 1 --json name -q '.[0].name' 2>/dev/null || echo "unknown")
   if [ "$ci_status" = "failure" ]; then
@@ -179,8 +188,14 @@ fi
 # the hard-coded "latestVersion" lookup matched nothing. Read `latestVersion` first, then fall
 # back to `version`. The `"version"` pattern includes the opening quote, so it cannot
 # accidentally match the tail of `"latestVersion"`.
-CACHE_FILE="$HOME/.oh-my-customcode/self-update-cache.json"
-if [ -f "$CACHE_FILE" ]; then
+# Deliberate difference from the TS resolver (src/utils/home.ts resolveHomeDir falls back to
+# the OS/passwd home): when HOME is unset, empty or not an absolute path, skip the cache
+# entirely instead of reading "/.oh-my-customcode/..." (#1775).
+CACHE_FILE=""
+case "${HOME:-}" in
+  /*) CACHE_FILE="$HOME/.oh-my-customcode/self-update-cache.json" ;;
+esac
+if [ -n "$CACHE_FILE" ] && [ -f "$CACHE_FILE" ]; then
   CACHED_LATEST=$(json_string_field "$CACHE_FILE" "latestVersion")
   if [ -z "$CACHED_LATEST" ]; then
     CACHED_LATEST=$(json_string_field "$CACHE_FILE" "version")