Function cbm_hook_script_name_safe

src/cli/cli.c:2488–2501

}

static bool cbm_hook_script_name_safe(const char *script_name) {
    if (!script_name || !script_name[0]) {
        return false;
    }
    for (const unsigned char *cursor = (const unsigned char *)script_name; *cursor; cursor++) {
        bool safe = (*cursor >= 'a' && *cursor <= 'z') || (*cursor >= 'A' && *cursor <= 'Z') ||
                    (*cursor >= '0' && *cursor <= '9') || *cursor == '-' || *cursor == '_' ||
                    *cursor == '.';
        if (!safe) {
            return false;
        }
    }
    return true;
}

/* Build the hook command string written into Claude Code's settings.json.
 * POSIX embeds a safely quoted absolute custom config path or a portable $HOME