PR #257: examples: timestamp-fresh-rewrite.sh — PreToolUse hook for #60492

• Repository: yurukusa/cc-safe-setup
• Author: yurukusa
• State: open | merged: False
• Link: https://github.com/yurukusa/cc-safe-setup/pull/257

Description (problem / solution / changelog)

Adds a new PreToolUse hook (examples/timestamp-fresh-rewrite.sh) implementing the operator-side defense for anthropics/claude-code#60492 — Agent invents timestamp when writing to files. The reporter @satel-kalletuulos documented the YYYYMMDDHHMM fabrication pattern: the system prompt provides currentDate but not currentTime, and the model invents the time component when writing timestamped filenames, document headers, version history rows, or journal entries. In comment 1 the reporter refined the design ask: "The timestamp should be freshly retrieved always when timestamp is needed and inserted." This hook is the harness-level form of that requirement, shipped as an operator-side reference implementation. PreToolUse on Write/Edit/MultiEdit:

1. Scans tool_input.file_path and tool_input.content (or new_string) for YYYYMMDDHHMM-shaped substrings.
2. Computes drift between the substring's encoded time and the actual system clock (date +%s).
3. If drift > CC_TIMESTAMP_REWRITE_DRIFT minutes (default 10):
   • Substitute mode (default): rewrites the drifted value to the fresh clock value via a decision: "modify" JSON response, then emits a stderr note documenting the substitution.
   • Advisory mode (CC_TIMESTAMP_REWRITE_ADVISORY=1): emits a <system-reminder> on stderr without modifying the tool input, for older harness versions that do not honor the substitution path.
4. If drift is within tolerance: silent exit (no false positive on legitimate past/future timestamps). Substitute, do not block. The fabrication is silent on the read side. Blocking and asking the model to re-issue doubles the turn cost without addressing the underlying gap (system prompt injection covers date but not time). Substitution is deterministic, runs outside the model's metacognition, and produces the correct value the first time.

• ✅ Drifted timestamp in file_path → substituted
• ✅ Drifted timestamp in content → substituted
• ✅ In-band timestamp → silent (no false positive)
• ✅ No timestamp → silent
• ✅ Advisory mode → stderr only, no decision: "modify"
• ✅ Disable flag → fully silenced
• ✅ Empty stdin → silent (no crash)
• ✅ Malformed JSON input → silent (no crash)
• ✅ Edit tool → handles new_string
• ✅ Custom CC_TIMESTAMP_REWRITE_DRIFT → respected
• ✅ Missing tool_name → still processes
• ✅ file_path-only input → substitutes path only
• ✅ Substitution reason JSON field cites #60492
• ✅ Empty path with clean content → silent
• ✅ Stderr note accompanies substitution This is the third operator-side defense hook shipped this week against the recognition-without-arrest cluster (#60226):

1. same-correction-arrest.sh (PR #250) — same-correction repetition detector for #60506
2. closure-word-verify-gate.sh (PR #250) — completion claim gate for #60506 recommendation 4
3. evidence-claim-gate.sh (PR pending) — epistemic claim gate for #60506 recommendation 5
4. This PR — value-substitution PreToolUse hook for #60492 The four hooks operate at four different boundaries (Stop, Stop, Stop, PreToolUse) and target four different claim shapes (same-correction repetition, completion language, epistemic language, fabricated value substitution). Together they cover four of the seven supplier-side recommendations from #60506 with deterministic verdict paths that run outside the model. The hook count in examples/ advances by one (739 → 740 if PR #256 merges first; 738 → 739 if this lands first). The 30,000-install cc-safe-setup audience gains a new install option for the YYYYMMDDHHMM fabrication pattern that affects journals, changelogs, archives, and any timestamp-bearing file written by Claude Code agents. 🤖 Generated with Claude Code

Changed files

• examples/timestamp-fresh-rewrite.sh (added, +203/-0)
• tests/test-timestamp-fresh-rewrite.sh (added, +254/-0)