cc-safe-setup

Listed on Product Hunt since April 21, 2026.

One command to make Claude Code safe for autonomous operation. 897 example hooks · 73+ Anthropic Issues addressed by hook · 218 test files · 30K+ npm downloads (cumulative) · 日本語

npx cc-safe-setup

Installs 8 safety hooks in ~10 seconds. Blocks rm -rf /, prevents pushes to main, catches secret leaks, validates syntax after every edit. Zero npm dependencies. Hooks use jq at runtime (brew install jq / apt install jq).

What's a hook? A checkpoint that runs before Claude executes a command. Like airport security, it inspects what's about to happen and blocks anything dangerous before it reaches the gate.

Doesn't Claude Code already block this? Partly, and that's worth knowing. v2.1.183 (Jun 2026) added an auto-mode guard that refuses destructive git commands (git reset --hard, git clean -fd, git stash drop, …) and terraform/pulumi/cdk destroy when it judges you didn't ask for it — a real, welcome improvement. But it is auto-mode only, scoped to git + IaC, and classifier-based (it infers intent, so it's probabilistic). cc-safe-setup's hooks are deterministic (pattern → exit 2, no inference), fire in every mode, and cover what the built-in guard doesn't: rm -rf, database wipes, secret commits, pushes to main/force-push, scope escapes, cloud/k8s teardown, runaway sub-agents, and false "done" closeouts. They compose — run both.

What problem are you solving today? — routing informed by the 6 readers who actually bought the books on the right column

Or browse the diagnostic-tool index below ↓

🏅 Safety Scorecard (NEW 2026-06-02: check the protections you have → an honest X/8 coverage card you can screenshot and share. Browser twin of npx cc-safe-setup --scorecard; the score is encoded in the URL so a shared link reproduces the exact card. No npm, nothing leaves your browser) · 🔎 Fabrication / False-Completion Self-Audit (NEW 2026-06-20: when Claude Code says "done" or "tests passed" — would your setup catch it if that were not true? 8 questions → a 0-100 score for your defenses against fabricated tool results and false completion, with the operator-side hook pattern that closes each gap. For the #33781 / #44955 / #27430 fabrication pain. Local-only) · 🔗 AGENTS.md Interop Scorecard (NEW 2026-06-03: you wrote one AGENTS.md — does every tool actually read it? Score X/6 across Claude Code / Codex / Cursor / Aider / Amp and more, screenshot and share the card. For the #6235 pain, 5,200+ reactions) · ▶ Live Demo (see hooks block rm -rf in your browser) · Incident Tracker (100 real incidents) · Cluster Exposure Diagnostic (NEW 2026-05-29: 7 questions → which of the 12 tracked failure clusters you are exposed to) · Cluster 12 Sub-Pattern Diagnostic (NEW 2026-05-29: 4 questions → which of the 4 Opus 4.7 tool-call parsing sub-patterns 12A/12B/12C/12D is hitting your session, with sub-pattern-specific recovery so misapplied /clear doesn't burn context) · Cluster 13 Extended-Thinking Wedge Diagnostic (NEW 2026-05-30: 5 questions → which of 13A/B/C/D sub-patterns is hitting you, plus detection of the /loop autonomous-run amplification reported by @LMS927369. Correct env var matrix per cnighswonger's 2.1.148 disassembly — DISABLE_INTERLEAVED_THINKING=1 does NOT actually prevent the failure) · Opus 4.8 Dual Cluster Exposure (NEW 2026-06-01: 5 questions → are you exposed to Cluster 22 fabrication and/or Cluster 23 effort-budget regression on Opus 4.8? 11 filings 5/30-5/31; both clusters resolve via /model claude-opus-4-7 per the #64153 reporter's own comparison) · Skills Audit Tool (NEW 2026-05-29: drop your session log, find which Skills never fire — author's own audit: 111 installed, 0 invoked in 10 sessions) · Safety Lab Fit Diagnostic (NEW 2026-05-29: 5 questions → should you subscribe to the ¥500/month CC Safety Lab membership, or are the free hooks here enough?) · Token Checkup (what type are you?) · Token Drain Analyzer (NEW 2026-06-08: drop your session logs → cache_read breakdown + bug-vs-context verdict, 100% in-browser) · All 28 Tools · Defense Kit (11 incidents → 11 hooks, narrative-per-incident) · Drift Matrix (14 May 2026 cases × 10 hooks, "if I saw X install Y")

  cc-safe-setup
  Make Claude Code safe for autonomous operation

  Prevents real incidents (from GitHub Issues):
  ✗ rm -rf permanently destroyed ~50 GB / 1,500 files (#49129) ← April 2026
  ✗ Auto mode approved ~/.ssh deletion, all SSH keys gone (#49554)
  ✗ ~/.git-credentials PATs deleted without confirmation (#49539)
  ✗ rm -rf deleted 3,467 files (~7 GB) without confirmation (#46058)
  ✗ rm -rf deleted entire user directory via NTFS junction (#36339)
  ✗ Remove-Item -Recurse -Force destroyed unpushed source (#37331)
  ✗ Entire Mac filesystem deleted during cleanup (#36233)
  ✗ Untested code pushed to main at 3am
  ✗ Force-push rewrote shared branch history
  ✗ API keys committed to public repos via git add .
  ✗ Syntax errors cascading through 30+ files
  ✗ Sessions losing all context with no warning
  ✗ CLAUDE.md rules silently ignored after context compaction
  ✗ Claude ran destructive DDL on production database (#46684)
  ✗ AI executed delete/kill operations on production environment (#46650)
  ✗ Subagents ignoring all CLAUDE.md rules since v2.1.84 (#40459)

  Hooks to install:

  ● Destructive Command Blocker
  ● Branch Push Protector
  ● Post-Edit Syntax Validator
  ● Context Window Monitor
  ● Bash Comment Stripper
  ● cd+git Auto-Approver
  ● Secret Leak Prevention

  Install all 8 safety hooks? [Y/n] Y

  ✓ Done. 8 safety hooks installed.

Why This Exists

A user lost 3,467 files (~7 GB) when Claude ran rm -rf on their data directory without confirmation. Another lost their entire C:\Users directory when rm -rf followed NTFS junctions. Another lost all source code when Claude ran Remove-Item -Recurse -Force * on a repo. One user's Claude ran destructive DDL on a production database when asked only to investigate. Another had Claude execute delete and kill operations on production systems. Others had untested code pushed to main at 3am. API keys got committed via git add .. Syntax errors cascaded through 30+ files before anyone noticed. And CLAUDE.md rules get silently dropped after context compaction, your instructions vanish mid-session.

Already lost files to a destructive command? Start with the File Recovery Field Guide (NEW 2026-06-01) — recovery-first by file type and OS (git reflog / git fsck for code, PhotoRec / Time Machine / Volume Shadow Copy for media and binaries), then the one PreToolUse hook that prevents a repeat. The hooks below are that prevention layer.

One user analyzed 6,852 sessions and found the Read:Edit ratio dropped from 6.6 to 2.0, Claude editing files it never read jumped from 6% to 34%. That issue has over 2,100 reactions. The read-before-edit example hook catches this pattern before damage happens.

In April 2026, $1,446 was transferred without authorization when Claude moved funds between exchange accounts. A user lost $367 and got their account suspended from a Claude-generated script. Physical coordinates were uploaded to a public website despite 17 sessions of "no PII" in CLAUDE.md. And deny rules can be bypassed with 50+ subcommands.

Claude Code ships with no safety hooks by default. This tool fixes that. (Standalone guard script for quick setup | Database protection hooks | Credential protection hooks | Fabrication detection hook | Security vulnerability hooks)

Production case study (healthcare, 2026-05-25): Effective Therapy — a trauma therapy platform serving clinical waitlist populations in Israel — installed dispatch-receipt.sh, closure-word-verify-gate.sh, and route-handler-emptiness-gate.sh after a production audit found 39 OpenClaw agents deployed, only 5 ever used, and 80+ hollow-code findings across the codebase (correct auth checks, correct routes, correct success messages, missing the line that saves data). Patient-safety context: hollow storeResearchReflection meant trauma patient input received a "Reflection saved" success message for data that was thrown away. Full case study with the 4 hollow-code patterns and the 4.7-vs-4.6 behavioral comparison: ianymu/recognition-without-arrest PR #2 (@nvst18, 2026-05-26).

Works with Auto Mode. Claude Code's Auto Mode sandboxing provides container-level isolation. cc-safe-setup adds process-level hooks as defense-in-depth, catching destructive commands even outside sandboxed environments.

Works with subagents. Since v2.1.84, subagents and teammates don't receive CLAUDE.md, your project rules are silently skipped. Hooks operate at the process level, but subagent tool calls may bypass PreToolUse hooks in some configurations. As defense-in-depth, cc-safe-setup installs hooks at the user level (~/.claude/settings.json). The subagent-claudemd-inject example hook re-injects critical rules into subagent prompts.

🚨 Opus 4.7 Crisis (April 2026)

Opus 4.7 broke auto mode's safety classifier, it was hardcoded to Opus 4.6. If you use auto mode with Opus 4.7, dangerous commands run without the built-in safety check. In 3 days: 50 GB permanently deleted, ~/.ssh wiped, git credentials destroyed, shell configs truncated to 0 bytes. Users report 4x token consumption from silent model switches.

One command to fix it:

npx cc-safe-setup --opus47

Installs 4 hooks targeting known Opus 4.7 regressions. Full details → · Emergency Defense Kit (Gist) · Safety Scanner

🚨 The June 15 Billing Cliff (May–June 2026)

Update (2026-06-22): Anthropic paused this on the day it was due. The split was scheduled for 2026-06-15, but Anthropic paused it that day — nothing changed for now; claude -p, the Agent SDK, and GitHub Actions still draw from your normal subscription limits (the-decoder, digitalapplied). It remains officially announced and could still return, so knowing your exposure is worthwhile — but treat the tools below as preparation, not a live emergency.

Anthropic announced a split of programmatic billing for 2026-06-15 (paused that day — see the note above) — under it, claude -p and SDK invocations would route to a separate credit bucket. In May 2026, financial-harm reports started landing on the tracker: €84.68 over the spending limit from confident-but-false billing claims (#61704), $80 in tokens burned on buggy code presented as working (#61728), tokens wasted on malformed tool calls after assurances they were fixed (#61086), production deployment session with sustained deception (#61699). The model cannot verify Anthropic's own billing logic from its training data. After June 15, the gap between what the model says about billing and how Anthropic actually bills widens. → Plain-English explainer (who's affected, the two pools, the two actions): Claude Code's June 15, 2026 billing change. → 20-second exposure check with a shareable card and live countdown: Are you exposed to the June 15 cliff? → Deep-dive paid guide (Japanese, ¥800) — the operator-side actions mapped to days-remaining before the cliff: Claude Code の6月15日の課金分離に備える. Operator-side defenses available today:

• NEW 2026-06-01 Free Multi-Vendor Fan-Out field guide (no install, for operators running fleets across multiple LLM vendors): Multi-Vendor Fan-Out Field Guide: dedup, claim, and reasoning-cost split across Claude Code + Codex + Gemini + Grok fleets — ~2,754-word MIT writeup articulating the three cost shapes that emerge when reasoning happens across N independent context windows with no shared substrate: (1) deduplication cost (4 vendors performing the same grep / Read / file scan from independent contexts, billed N times), (2) claim-and-judging cost (cross-vendor disagreement requires a verification path the single-vendor cost guides don't articulate), (3) reasoning-cost-vs-execution-cost split (worker-retry-with-different-params leak shape that lives at the supervisor's coordination boundary, not at any individual vendor). Origin: 5-round technical thread on #64080 with @palios-taey running a Claude Code + Codex + Gemini + Grok supervisor-coordinated fleet, who flagged the cluster as worth articulating for any other operator running the same shape. Companion 5-question fit diagnostic at Multi-Vendor Fan-Out Diagnostic — browser-only, no signup, no telemetry, scores you against the multi-vendor cluster vs the single-vendor cluster. Japanese-language preview (gist 6b9ddcd1, ~1,800 chars) for Japanese-speaking operators. The fundamental claim of the cluster: single-vendor cost guides (Token Book, ClaudeFast, EasyClaw, vendor-official docs) do not articulate the cost shape that emerges when reasoning happens across independent vendor contexts; the multi-vendor cost shape is operationally distinct and requires its own articulation. 14-day measurement window (ends 2026-06-14): independent confirmations of the worker-retry coordination leak outside @palios-taey's fleet, multi-vendor handbook reads, new multi-vendor fleet filings. The 2027-05 Safety Lab issue is targeted as lead chapter once the cluster crosses promotion thresholds.
• NEW Starter pack (recommended starting point): The 5 cc-safe-setup hooks to install today (and why) — curated entry path through this catalog's 897 example hooks. Picks the five with the highest "value per setup minute" for new operators: nested-spawn-inflight-guard (runaway subagent prevention), bash-fanout-bounded-rewriter (fan-out inside a single Bash call), cache-creation-drift-detector (token spike early warning), compact-dispatch-watchdog (silent compaction failure detection), claim-verify-audit (one-shot diagnostic of 8 known patterns). Each entry gives What it stops / Why I picked it / Install / Wire-up / Override. Covers macOS, Linux, Windows under WSL2 / Git Bash. ~1,297 words, MIT, 14 verified cited links. Names the five clusters this starter pack does NOT cover and where to read the matching field guides.
• Free 90-second diagnostic (interactive): Did Claude Code charge you wrong? — 5 questions, matches your case to filed reports, produces a refund argument template you can paste into support.anthropic.com. No signup, no telemetry, single HTML.
• Free billing-axis writeup (no install): The Model Can't Verify Its Own Billing — 4 filed cases, 9-row recognition-without-arrest cluster catalog, 4 operator-side defenses, the refund argument that lands (日本語版)
• NEW SessionStart hook — catch the "subscription at 0% but my balance is draining" misroute (2026-06-02): examples/subscription-api-billing-warner.sh — Claude Code's credential precedence puts API-key auth above an OAuth subscription, so if ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN is set, or an apiKeyHelper is configured in settings.json, every request silently bills API / purchased credits even while your Pro/Max subscription quota sits unused. This hook warns at session start when any of those three precedence sources is present, names which one, and points to /status (to confirm the active auth) plus the unset / /config / support-refund fix. The recurring money-losing pain on the tracker: #64613, #53638, #53728. Advisory only — never blocks, never reads the key value; auto-skips when ANTHROPIC_ACCOUNT_LABEL marks deliberate multi-account API use, and silences via CC_SUB_BILLING_DISABLE=1. 16 tests passing.
• Free Pro Max quota anomaly field guide (no install): Pro Max Quota Anomaly — Operator Field Guide — ten-issue cluster snapshot (#16157 / #38335 / #46917 / #45756 / #29579 / #41788 / #13585 / #23706 / #16856 / #19673, ~2,200 cumulative reactions, four version-boundary inflection points), five operator-side measurement paths (ccusage, raw JSONL inspection, claude-code-logger proxy, cc-safe-setup hook integration, Anthropic Console cross-reference) with a pattern-to-path mapping that picks the right tool per symptom. Three-axis defense hooks now shipped: cache-creation-drift-detector (PR #340), quota-anomaly-detector (PR #348), session-rate-monitor (PR #349).
• Free Safety Lab 2026-08 preview (no install): When Your Pro Max Quota Empties Faster Than It Should — symptom-to-diagnosis-to-defense walkthrough for the three independent mechanisms behind one surface, with the per-mechanism diagnostic flow and the three-hook installation recipe. Free preview of the 2026-08 chapter; full chapter ships to Safety Lab subscribers on 2026-08-01.
• Free permission matching cluster field report (no install): A 9-Month Enforcement Gap with 30+ Issues and Zero Staff Engagement — articulation of the 6th cluster tracked in this repo: seven independent failure axes (wildcard compound mismatch, dead-rule accumulation, scope hierarchy break, quote-tracking bypass, deny-rule bypass, syntax contradiction, partial bypass-mode), 25+ issues / ~804 cumulative reactions, meta-issue #30519 articulating the seven axes with 13 referenced sub-issues. 2 of 4 axis-specific hooks shipped 2026-05-27 (always-allow-pattern-suggester.sh PR #359 for Axis 2; bypass-mode-effective-verifier.sh PR #360 for Axis 7). Shipped-status update with install paths and operator checklists: Cluster 6 Defense Status Update. Also serves as the working preview for the 2026-09 Safety Lab chapter.
• Free Safety Lab 2026-05 preview (English) (no install): When cache_control Locks Up Your Claude Code Session — and How to Recover the Context — symptom-to-diagnosis-to-recovery walkthrough for the 12+ issue cluster (#55369 / #55156 / #55302 / #55283 / #55118 / #54988 / #54421 / #54314 / #53632 / #50738 / #50681 / #50010, etc.) where an empty text block with a cache_control marker permanently jams a session. Includes the field-recovery Python script (preserves context), four scenarios where the corruption surfaces, and four prevention practices. English companion to the original Japanese-language 2026-05 preview Gist. This is the 2026-05 chapter of the Safety Lab series; 2026-08 and 2026-09 previews above complete the English-side preview set.
• Free 2026-05 cluster field report (no install, comprehensive): Six Architectural Failure Modes in One Month — original (May 2026) single-Gist entry point articulating six of the seven clusters tracked here (SOH, multi-account, AGENTS.md, Pro Max quota, TUI/Terminal UX, permission matching). The narrative companion to the Cluster Tracker HTML page. Updated synthesis below covers the 7th cluster (Skills metadata).
• Free 9-Cluster Framework synthesis (no install, comprehensive): The 9-Cluster Framework: Mapping the Structural Failure Surface of Claude Code Operator Defense — updated (2026-05-28) synthesis covering all nine clusters with the ~11,590 cumulative reactions / 145+ issues snapshot, the mechanism / symptom family / defense path per cluster, three deep structural patterns (documentation-runtime divergence, validation absence, observability absence at the runtime boundary), and how-to-use guidance for four operator scenarios (incident debugging, June 15 billing-split audit, team/production setting, Opus sensitive-workload AUP cluster). 3,300 words. 2026-05-28 update: Cluster 9 (Usage Policy classifier over-trigger, 25+ open issues filed 2026-05-18 to 2026-05-27, Opus-specific, multilingual false positives) added with corresponding hook shipped same-day.
• NEW Free Cluster 8 (v2.1.150 server-side prompt injection) defense triple (no install / three shipped hooks, 2026-05-29): The v2.1.150 release added a function (named nAA in the minified source) that reads strings from the bootstrap API client_data field and the tengu_heron_brook GrowthBook feature flag and registers them as peer-level system prompt sections alongside the documented anti_verbosity / thinking_guidance / action_caution sections. Anthropic confirms this is intentional ("we run experiments on our system prompt"); the documented opt-out is CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 and DISABLE_GROWTHBOOK=1. Reference: #62061 (46+ reactions, bytecode-level evidence by @vladkens) and the v2.1.150 server-side prompt injection audit paths writeup (1,133 words, four audit paths). Defense triple shipped (3 of 4): server-side-prompt-injection-detector.sh (PR #383) — SessionStart advisory when either opt-out env var is missing; cache-residue-detector.sh (PR #453, 28 tests) — closes the gap that opt-out alone does not perform by detecting cached injection values that persist after opt-out env vars are set; and proxy-capture-suggester.sh (2026-05-29, 19 tests) — opt-in SessionStart advisory that surfaces the HTTPS proxy capture path for operators in regulated industries (SOX, HIPAA, FedRAMP, PCI-DSS, EU AI Act Article 12) who need a reconstructible audit trail of the exact system prompt sent at the time of any logged action. When enabled via CC_PROXY_CAPTURE_SUGGESTER_ENABLE=1, names four audit tools (mitmproxy with --save-stream-file, Burp Suite Community, Charles Proxy, Anthropic SDK ANTHROPIC_LOG=debug) with concrete HTTPS_PROXY bridge and SSL_CERT_FILE setup, or — when a proxy is active but ANTHROPIC_LOG_DIR is unset — a shorter audit-sink advisory. Privacy: reads only the env var names, never their values. One more audit hook in design: system-prompt-baseline-checker.sh (diffs baseline against runtime, requires proxy capture). Also serves as the working preview for the 2026-11 Safety Lab chapter.
• Free Cluster 9 (Usage Policy classifier over-trigger) field guide (no install): Claude Code's AUP False-Positive Cluster: 4 Operator-Side Paths Through It — 1,462-word writeup of the 25+ open-issue cluster (filed 2026-05-18 to 2026-05-27), with the Opus-specific signature, the multilingual / domain-independent evidence, and the four operator-side mitigation paths (Sonnet swap, session warmup, CVP application, retry-on-identical-input). First defense hook shipped 2026-05-28: aup-false-positive-helper.sh (PRs #388 and #389, 16 tests, opt-in SessionStart advisory only — never blocks). Second defense hook shipped 2026-05-29: aup-block-pattern-logger.sh — PostToolUse advisory-only hook that pairs with the helper by closing the evidence-and-trend gap. Detects five distinct AUP block patterns (cyber-safeguards, safety-guardrails, rephrase-rewind, usage-policy, usage-policy-api fallback) in tool output and appends a five-field pipe-delimited line to ~/.claude/aup-block-history.log (timestamp / model / tool / pattern kind / 120-char excerpt). Default mode shows the cumulative count for the current model on stderr so operators can build CVP evidence and notice classifier-shift over time. 23 tests covering all five patterns, pattern priority, log rotation, schema preservation, jq fallback, and never-blocks invariant. Environment toggles: CC_AUP_BLOCK_LOGGER_DISABLE, CC_AUP_BLOCK_LOGGER_QUIET, CC_AUP_BLOCK_LOG_PATH, CC_AUP_BLOCK_LOGGER_MAX_LINES. Third defense hook shipped 2026-05-30: model-swap-suggester.sh — evidence-driven SessionStart advisory that closes the loop between the helper (generic awareness) and the logger (evidence collection) by reading ~/.claude/aup-block-history.log on session start, counting Opus blocks in a configurable lookback window (default 60 minutes, threshold 3), and emitting a concrete export ANTHROPIC_MODEL=claude-sonnet-4-7 swap recommendation only when the threshold is crossed. Silent in every other path (model unset, non-Opus pinned, log missing/empty, below threshold, outside window) so it never adds noise to users who have not actually been blocked. Counts all Opus variants in the log (opus-4-7, opus-4-6, opus-4-7[1m]) toward the threshold because the cluster signature is Opus-family-wide. 25 tests covering: env toggle paths (DISABLE / QUIET), model gating (unset / Sonnet / Haiku / Opus), log states (missing / empty / Sonnet-only / mixed), threshold and window semantics (below / at / above / outside), custom env vars (THRESHOLD / WINDOW_MIN / TARGET / garbage fallback), schema robustness (unparseable timestamps skipped without crash), and never-blocks invariant across 8 paths. Environment toggles: CC_MODEL_SWAP_SUGGESTER_DISABLE, CC_MODEL_SWAP_SUGGESTER_QUIET, CC_MODEL_SWAP_SUGGESTER_THRESHOLD, CC_MODEL_SWAP_SUGGESTER_WINDOW_MIN, CC_MODEL_SWAP_SUGGESTER_TARGET, shares CC_AUP_BLOCK_LOG_PATH with the logger. Cluster 9 primary-symptom defense complete (3 of 3 hooks for the block-and-swap path). Fourth defense hook shipped 2026-05-30 (secondary-pain coverage): aup-retry-loop-guard.sh — PostToolUse hook that addresses the retry-loop context-burn pain documented in #61664 (Japanese paid user, 2026-05-23: "ブロック発生時も context/credit は消費される", "ブロック→巻き戻し→同じ処理の再実行 で context を浪費"). The first three hooks address awareness / evidence / session-start swap but do not break a retry cycle in progress within a single session. The retry-loop-guard reads ~/.claude/aup-block-history.log after each tool call, checks whether 3+ blocks (configurable) within a 5-minute window (configurable) all targeted the same tool — the single-tool restriction is the diagnostic signature distinguishing a retry loop from a general session sensitivity. When the pattern fires, emits a one-shot per-session advisory recommending either Option A (/exit + restart fresh with Sonnet pinned, safest for quota) or Option B (in-place swap, continues current session). The one-shot lock uses a session identifier resolved in order: CC_AUP_RETRY_LOOP_GUARD_SESSION_ID (explicit override), CLAUDECODE_SESSION_ID, controlling tty, PPID fallback. 26 tests covering env toggle paths, log states, threshold and window semantics, multi-tool burst rejection, custom target model, one-shot per session with different sessions firing independently, garbage env var fallback, unparseable timestamp skipping, and never-blocks invariant across 7 paths. Environment toggles: CC_AUP_RETRY_LOOP_GUARD_DISABLE, CC_AUP_RETRY_LOOP_GUARD_QUIET, CC_AUP_RETRY_LOOP_GUARD_THRESHOLD, CC_AUP_RETRY_LOOP_GUARD_WINDOW_MIN, CC_AUP_RETRY_LOOP_GUARD_TARGET, CC_AUP_RETRY_LOOP_GUARD_STATE_DIR, CC_AUP_RETRY_LOOP_GUARD_SESSION_ID, shares CC_AUP_BLOCK_LOG_PATH with the logger. Internal customer-pain research at ~/ops/customer-pain-cluster-9-secondary-pains-2026-05-30.md (7 secondary pains beyond the primary block symptom; this hook addresses axis 1). Fifth defense hook shipped 2026-05-30 (secondary-pain coverage continued): aup-large-tool-output-warner.sh — PreToolUse hook that addresses the large-security-output trigger surface documented in #61185 (filipghoulin, 2026-05-23: "A lab-review skill dispatched a sub-agent that ran cat /etc/banip/banip.blocklist on an OpenWRT router. The blocklist has ~17,000 entries. That volume of content in a single tool result, combined with the security shape of the content, appears to have flipped the classifier into a permanent block state for the whole session"). The first four hooks act on the block aftermath (awareness, evidence, swap, retry-loop break); none of them act before the offending tool call. Once the classifier fires on a large security-shaped output, the session is already wedged and /compact//clear may themselves block — so the only place to address this trigger surface is the PreToolUse boundary. Detects five command shapes that commonly produce large outputs (cat on security-shaped system paths, find recursing under security paths, journalctl/dmesg without size caps, grep -r on security paths) plus a sentinel wordlist (blocklist, denylist, banlist, iplist, iptables-save, ipset save, /etc/banip/, /etc/fail2ban/, /var/log/auth, /var/log/secure, firewall.conf) for content that would look security-shaped to the classifier regardless of how it is read. Emits a one-shot per-(session, pattern_hash) stderr advisory recommending narrower variants (head -N, tail -N, wc -l, grep -c, journalctl --since, find ... | head). Skips automatically when the command already has a size cap (head/tail/wc/-n/-quit/--since). 32 tests covering env toggle paths, non-Bash tool skip, empty/malformed input, every category and sentinel, every size-cap skip path, one-shot per-(session, pattern) semantics with different patterns and different sessions firing independently, sentinel-only path (e.g. iptables-save > /tmp/rules.txt), advisory content references (#61185, #60366, head -200 recommendation), state directory auto-create, and never-blocks invariant. Environment toggles: CC_AUP_LARGE_OUTPUT_WARNER_DISABLE, CC_AUP_LARGE_OUTPUT_WARNER_QUIET, CC_AUP_LARGE_OUTPUT_WARNER_STATE_DIR, CC_AUP_LARGE_OUTPUT_WARNER_SESSION_ID. Internal customer-pain research at ~/ops/customer-pain-cluster-9-secondary-pains-2026-05-30.md (axis 4: single tool call returning large sensitive-content volume). Cluster 9 five-hook defense surface now covers: helper (axis 0 awareness) + logger (axis 0 evidence) + suggester (axis 0 session-start swap) + retry-loop-guard (axis 1 intra-session retry cycle break) + large-tool-output-warner (axis 4 pre-call large-output prevention). Companion interactive 4-question diagnostic at cluster-9-aup-diagnostic.html outputs the highest-leverage path tailored to your model / frequency / domain / CVP status. Also serves as the working preview for the 2026-12 Safety Lab chapter.
• NEW Free 13 cost-spike patterns reference (no install, 2026-05-28): 13 Claude Code Cost-Spike Patterns: 8 from the English market + 5 from 800 hours of operations — 2,077-word integration of the 8 cost-spike patterns documented in the English-language guides (Finout's 8-pattern enumeration, ClaudeFast usage optimization, EasyClaw tokens guide) with 5 additional patterns I have not seen written up elsewhere as of 2026-05-28: CLAUDE.md hooks stderr re-injection (5K–15K tokens/turn), AGENTS.md duplicate context overlap (2K–4K/turn), Pool 2 cliff (12×–175× ratio shift on 2026-06-15), Cowork FUSE-mount context pollution (Cluster 11, Issue #62932 P1), GrowthBook A/B flag override (Cluster 10, Issue #62205). Each of the 13 patterns has symptom / mechanism / defense / citation, with the defense pinned to a specific cc-safe-setup hook where one exists. Three-tier integration (Tier 1: prevention for $8K+ single events; Tier 2: automation for 100K+ sessions; Tier 3: observation for background bloat). Free field reference; the 800-hour operational dataset and per-pattern before/after numbers are in the Japanese Token Book (¥2,500). Companion interactive 5-question diagnostic at cost-spike-pattern-diagnostic.html maps you to the 3 most-relevant patterns from the 13 with the cc-safe-setup hook install command for each. No signup, no telemetry, single HTML.
• NEW Cluster 18 candidate (`/ultrareview` crash burns credit on large PRs — 6-filing accumulation, hook shipped) (advisory hook shipped, 2026-05-29): Six independent filings within a 72-hour window where /ultrareview (cloud-side review feature, 3 free credits / day on Pro) crashes server-side with zero findings returned, yet the operator's daily credit counter is still decremented. Shared error: Review crashed before producing findings. See session logs for details. The six filings: #62696 (3rd crash burns credit, v2.1.150, anchor), #62709 (PR #7 review crashed, 0 findings), #62787 (2 consecutive crashes, 2/3 credits burned, 21 files / 84KB diff), #62876 (Find phase crash, Setup phase complete), #63117 (1 crash decrements credit, 6 files / 2,185 insertions), #63522 (same-branch 2 consecutive crashes, 2/3 credits burned). Three common structural traits: (1) Large PRs crash at a noticeably higher rate (16+ files or 1,500+ insertions over-represented); (2) Find phase is the failure point — Setup phase completes; (3) Retrying on the same branch burns a second credit for the same crash. Three operator-side defenses (the crash is server-side, no hook can prevent it): split the PR before invoking /ultrareview; do not retry on the same branch; fall back to /code-review (local, no cloud crash exposure). SessionStart advisory shipped (this PR): examples/ultrareview-large-diff-advisor.sh (22/22 tests passing) — measures current branch diff vs base and surfaces caution / elevated advisories above 6 files or 500 insertions (caution) and 16 files or 1,500 insertions (elevated). All thresholds env-overridable; opt-in QUIET/DISABLE. Token consumption impact quantified in the Token Book Ch18 — /ultrareview の停止で使用枠が消費される集積の候補と利用者の側のトークンへの影響の整理 (¥2,500, freshly added 2026-05-29): the failed cloud run plus the local re-review doubles token consumption; the June 15 traffic-pool split routes the failed cloud run through Pool 2 quietly, then double-charges across Pool 1 and Pool 2 when the operator falls back to local. English field guide (1,481 words, MIT): The /ultrareview crash that burns credit: six issues in three days and three user-side defenses. Filings count crossed the 4-filing promotion threshold; reactions count (0) has not crossed the 15-reaction threshold yet — tracked as candidate at cluster-tracker.html. Internal research document: ~/ops/customer-pain-research-ultrareview-crash-credit-2026-05-29.md. 2027-06 Safety Lab issue targeted as lead chapter once promotion criteria fully met.
• NEW Cluster 17 candidate (documented setting fields silently ignored — 4-filing accumulation, sister pattern to Cluster 7) (no install, 2026-05-29): Four independent filings within a 48-hour window where documented settings.json paths or environment variables are silently ignored at runtime — no validation error, no warning, the operator continues believing the setting is applied. Pair to Cluster 7 which articulates the same validation-pipeline-absence root cause from the opposite direction (fabricated fields silently accepted). The four filings: #63178 --model flag silently ignored in interactive mode (works in --print, v2.1.153), #63186 CLAUDE_AUTOCOMPACT_PCT_OVERRIDE in settings.json env block silently ignored at app level (propagates to subprocess only), #63479 CLAUDE_CODE_DISABLE_1M_CONTEXT=1 env var ignored, #63560 ~/.claude/settings.json top-level model field silently ignored for interactive sessions (--model flag and ANTHROPIC_MODEL env var both work). The common workaround for all four: switch to env var path via ~/.bashrc / ~/.zshrc export — the env-var path is honored where the settings.json path silently fails. Token consumption impact quantified in the Token Book Ch17 — 設定の沈黙の無視の集積と利用者の側の token への影響の整理 (¥2,500, freshly added 2026-05-29, 14,267 chars): autocompact misfire produces context bloat (+15-30% cache_creation rate), 1M-context continuation produces 1.8-2.4× token consumption vs intended 200K mode, model-misroute produces 8-15% retry rate. June 15 cliff impact: with Pool 2 overage pricing post-2026-06-15, the same silently-ignored settings produce 1.5-5.5× cost amplification vs the pre-cliff baseline (Token Book Ch17 §17.8). Filings count crossed the 4-filing promotion threshold; reactions count (0) has not crossed the 15-reaction threshold yet — tracked as candidate at cluster-tracker.html. Internal research document: ~/ops/customer-pain-research-settings-silently-ignored-2026-05-29.md (four product hypotheses including the cc-safe-setup settings-effective-state-checker.sh hook in design for June 2026). 2027-05 Safety Lab issue targeted as lead chapter once promotion criteria fully met.
• NEW Free Cluster 16 (v2.1.154+ `system` role serialized into `messages` array — promoted same-day) field guide (no install, 2026-05-29): [v2.1.154+ Serializes system Role into messages[] — A Field Guide to Cluster 16 with Operator Workaround](https://gist.github.com/yurukusa/05c120466996734f7bc2ad6d41fdedec) — ~2,786-word English-language writeup. Promoted from candidate to full cluster status at 17:30 JST after the filing count crossed the threshold within 48 hours of v2.1.154 release. Claude Code v2.1.154 onward serializes system-role entries (from SessionStart hook context, plugin context, Skill metadata, or compaction summaries) as peer entries inside the messages[] array instead of the top-level system field, producing API Error: 400 messages[1].role must be either 'user' or 'assistant', but got 'system'. Four sub-patterns: 16A custom agents via /agents (#63457, 2026-05-29, clean rollback to v2.1.153 fully resolves), 16B strict Anthropic-compatible providers (#63366 + #63469 5 reactions, has-repro, raw API body captured via OTEL_LOG_RAW_API_BODIES), 16C VS Code extension (#63473 + #63510, same defect propagates through the shared request-assembly path), 16D long-lived session context operations (#63396 Variant 1, compact/clear/model-switch produces invalid messages[0] with role system). Cross-language confirmation via #63395 (Chines