@schalkneethling/calavera-hook-block-dangerous-commands 0.2.0-next.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Schalk Neethling
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/calavera-artifact.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://calavera.schalkneethling.com/schemas/calavera-artifact.schema.json",
+  "schemaVersion": 1,
+  "id": "hook-block-dangerous-commands",
+  "type": "hook",
+  "displayName": "Block dangerous commands",
+  "payload": "payload/block-dangerous-commands",
+  "targets": ["claude-code", "codex", "cursor", "opencode"],
+  "compatibility": {
+    "calavera": ">=2.2.0 <3"
+  }
+}

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@schalkneethling/calavera-hook-block-dangerous-commands",
+  "version": "0.2.0-next.2",
+  "description": "Block dangerous commands artifact for Calavera.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/schalkneethling/create-project-calavera.git",
+    "directory": "packages/artifacts/hook-block-dangerous-commands"
+  },
+  "files": [
+    "calavera-artifact.json",
+    "payload"
+  ],
+  "type": "module",
+  "exports": {
+    ".": "./calavera-artifact.json",
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}

package/payload/block-dangerous-commands/hook.mjs

@@ -0,0 +1,121 @@
+#!/usr/bin/env -S node
+/**
+ * block-dangerous-commands: PreToolUse hook for Bash.
+ *
+ * Reads a Claude Code hook payload from stdin, inspects tool_input.command,
+ * and blocks commands that match known-dangerous patterns.
+ *
+ * Exit 2  = block (with structured JSON on stdout)
+ * Exit 0  = allow (including on malformed input — fail open)
+ */
+const rules = [
+    {
+        id: "rm-rf",
+        test: (c) => /\brm\s+(?:-[a-zA-Z]*[rRf][a-zA-Z]*|--recursive|--force)(?:\s|$)/.test(c),
+        message: "`rm -rf` (and flag variants) is blocked. Delete specific paths with a non-recursive `rm`, or move them to a backup location.",
+    },
+    {
+        id: "git-push-force",
+        test: (c) => /\bgit\s+push\b.*\s(?:--force(?!-with-lease)\b|-f\b)/.test(c),
+        message: "`git push --force` is blocked. Use `--force-with-lease` only after coordinating with collaborators, or create a new branch.",
+    },
+    {
+        id: "git-push-protected",
+        test: (c) => /\bgit\s+push\b(?:\s+\S+)*\s+(?:origin\s+)?\+?(?:main|master|production|prod|release)(?:\s|$)/.test(c) ||
+            /\bgit\s+push\b.*(?:^|\s)\+?\S+:(?:refs\/heads\/)?(?:main|master|production|prod|release)(?:\s|$)/.test(c),
+        message: "Direct push to a protected branch (main/master/production/prod/release) is blocked. Open a pull request instead.",
+    },
+    {
+        id: "git-reset-hard",
+        test: (c) => /\bgit\s+reset\s+(?:\S+\s+)*--hard\b/.test(c),
+        message: "`git reset --hard` is blocked — it discards uncommitted work. Consider `git stash`, `git restore`, or a soft reset.",
+    },
+    {
+        id: "chmod-777",
+        test: (c) => /\bchmod\s+(?:(?:-[a-zA-Z]+|--[a-zA-Z-]+)\s+)*(?:777|[ugoa]*[+=][rwx]*w[rwx]*(?:\s|$))/.test(c) &&
+            /-R|--recursive|777/.test(c),
+        message: "`chmod 777` or recursive world-writable chmod is blocked. Grant the minimum permissions required.",
+    },
+    {
+        id: "dd-if",
+        test: (c) => /\bdd\s+if=/.test(c),
+        message: "`dd if=` is blocked — it can overwrite disks irrecoverably.",
+    },
+    {
+        id: "system-redirect",
+        test: (c) => /(?:>{1,2}\s*|tee(?:\s+-[a-zA-Z]*)?\s+)\/(?:etc|boot|usr|bin|sbin)\//.test(c),
+        message: "Writing into /etc, /boot, /usr, /bin, or /sbin is blocked. These are system directories; use a user-writable path.",
+    },
+    {
+        id: "fork-bomb",
+        test: (c) => /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/.test(c) || /\.\s*\|\s*\.\s*&/.test(c),
+        message: "Fork bomb pattern detected and blocked.",
+    },
+    {
+        id: "curl-pipe-shell",
+        test: (c) => /\b(?:curl|wget|fetch)\b[^|;]*\|\s*(?:sudo\s+)?(?:(?:\/usr\/bin\/env\s+)|(?:\/(?:usr\/)?bin\/))?(?:bash|sh|zsh|fish|ksh|dash)\b/.test(c),
+        message: "Piping remote content directly into a shell is blocked. Download the script, inspect it, then run it.",
+    },
+    {
+        id: "pkill",
+        test: (c) => /\bpkill\b/.test(c),
+        message: "`pkill` is blocked — it can terminate unrelated processes by name. Kill a specific PID instead.",
+    },
+    {
+        id: "kill-9",
+        test: (c) => /\bkill\s+(?:-[a-zA-Z]*\s+)*-9\b|\bkill\s+-s\s+(?:9|SIGKILL)\b|\bkill\s+-SIGKILL\b/.test(c),
+        message: "`kill -9` is blocked — it prevents cleanup. Try SIGTERM (default) first.",
+    },
+    {
+        id: "npm-publish",
+        test: (c) => /\bnpm\s+(?:publish|deprecate|unpublish)\b/.test(c),
+        message: "`npm publish`/`deprecate`/`unpublish` is blocked. Publishing should be done deliberately, outside of an agent session.",
+    },
+    {
+        id: "history-clear",
+        test: (c) => /\bhistory\s+-c\b/.test(c),
+        message: "`history -c` is blocked — erasing shell history hides what happened.",
+    },
+];
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8");
+}
+function deny(reason) {
+    const output = {
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "deny",
+            permissionDecisionReason: reason,
+        },
+    };
+    process.stdout.write(JSON.stringify(output));
+    process.exitCode = 2;
+}
+async function main() {
+    let payload;
+    try {
+        const raw = await readStdin();
+        if (!raw.trim()) {
+            return;
+        }
+        payload = JSON.parse(raw);
+    }
+    catch {
+        return;
+    }
+    const command = payload?.tool_input?.command;
+    if (typeof command !== "string" || command.length === 0) {
+        return;
+    }
+    for (const rule of rules) {
+        if (rule.test(command)) {
+            deny(`[${rule.id}] ${rule.message}`);
+            return;
+        }
+    }
+}
+main().catch(() => undefined);
+export {};

package/payload/block-dangerous-commands/hook.mts

@@ -0,0 +1,153 @@
+#!/usr/bin/env -S node
+
+/**
+ * block-dangerous-commands: PreToolUse hook for Bash.
+ *
+ * Reads a Claude Code hook payload from stdin, inspects tool_input.command,
+ * and blocks commands that match known-dangerous patterns.
+ *
+ * Exit 2  = block (with structured JSON on stdout)
+ * Exit 0  = allow (including on malformed input — fail open)
+ */
+
+type Rule = {
+  id: string;
+  test: (cmd: string) => boolean;
+  message: string;
+};
+
+const rules: Rule[] = [
+  {
+    id: "rm-rf",
+    test: (c) => /\brm\s+(?:-[a-zA-Z]*[rRf][a-zA-Z]*|--recursive|--force)(?:\s|$)/.test(c),
+    message:
+      "`rm -rf` (and flag variants) is blocked. Delete specific paths with a non-recursive `rm`, or move them to a backup location.",
+  },
+  {
+    id: "git-push-force",
+    test: (c) => /\bgit\s+push\b.*\s(?:--force(?!-with-lease)\b|-f\b)/.test(c),
+    message:
+      "`git push --force` is blocked. Use `--force-with-lease` only after coordinating with collaborators, or create a new branch.",
+  },
+  {
+    id: "git-push-protected",
+    test: (c) =>
+      /\bgit\s+push\b(?:\s+\S+)*\s+(?:origin\s+)?\+?(?:main|master|production|prod|release)(?:\s|$)/.test(
+        c,
+      ) ||
+      /\bgit\s+push\b.*(?:^|\s)\+?\S+:(?:refs\/heads\/)?(?:main|master|production|prod|release)(?:\s|$)/.test(
+        c,
+      ),
+    message:
+      "Direct push to a protected branch (main/master/production/prod/release) is blocked. Open a pull request instead.",
+  },
+  {
+    id: "git-reset-hard",
+    test: (c) => /\bgit\s+reset\s+(?:\S+\s+)*--hard\b/.test(c),
+    message:
+      "`git reset --hard` is blocked — it discards uncommitted work. Consider `git stash`, `git restore`, or a soft reset.",
+  },
+  {
+    id: "chmod-777",
+    test: (c) =>
+      /\bchmod\s+(?:(?:-[a-zA-Z]+|--[a-zA-Z-]+)\s+)*(?:777|[ugoa]*[+=][rwx]*w[rwx]*(?:\s|$))/.test(
+        c,
+      ) && /-R|--recursive|777/.test(c),
+    message:
+      "`chmod 777` or recursive world-writable chmod is blocked. Grant the minimum permissions required.",
+  },
+  {
+    id: "dd-if",
+    test: (c) => /\bdd\s+if=/.test(c),
+    message: "`dd if=` is blocked — it can overwrite disks irrecoverably.",
+  },
+  {
+    id: "system-redirect",
+    test: (c) => /(?:>{1,2}\s*|tee(?:\s+-[a-zA-Z]*)?\s+)\/(?:etc|boot|usr|bin|sbin)\//.test(c),
+    message:
+      "Writing into /etc, /boot, /usr, /bin, or /sbin is blocked. These are system directories; use a user-writable path.",
+  },
+  {
+    id: "fork-bomb",
+    test: (c) => /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/.test(c) || /\.\s*\|\s*\.\s*&/.test(c),
+    message: "Fork bomb pattern detected and blocked.",
+  },
+  {
+    id: "curl-pipe-shell",
+    test: (c) =>
+      /\b(?:curl|wget|fetch)\b[^|;]*\|\s*(?:sudo\s+)?(?:(?:\/usr\/bin\/env\s+)|(?:\/(?:usr\/)?bin\/))?(?:bash|sh|zsh|fish|ksh|dash)\b/.test(
+        c,
+      ),
+    message:
+      "Piping remote content directly into a shell is blocked. Download the script, inspect it, then run it.",
+  },
+  {
+    id: "pkill",
+    test: (c) => /\bpkill\b/.test(c),
+    message:
+      "`pkill` is blocked — it can terminate unrelated processes by name. Kill a specific PID instead.",
+  },
+  {
+    id: "kill-9",
+    test: (c) =>
+      /\bkill\s+(?:-[a-zA-Z]*\s+)*-9\b|\bkill\s+-s\s+(?:9|SIGKILL)\b|\bkill\s+-SIGKILL\b/.test(c),
+    message: "`kill -9` is blocked — it prevents cleanup. Try SIGTERM (default) first.",
+  },
+  {
+    id: "npm-publish",
+    test: (c) => /\bnpm\s+(?:publish|deprecate|unpublish)\b/.test(c),
+    message:
+      "`npm publish`/`deprecate`/`unpublish` is blocked. Publishing should be done deliberately, outside of an agent session.",
+  },
+  {
+    id: "history-clear",
+    test: (c) => /\bhistory\s+-c\b/.test(c),
+    message: "`history -c` is blocked — erasing shell history hides what happened.",
+  },
+];
+
+async function readStdin(): Promise<string> {
+  const chunks: Buffer[] = [];
+  for await (const chunk of process.stdin) chunks.push(chunk as Buffer);
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+function deny(reason: string): void {
+  const output = {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason,
+    },
+  };
+  process.stdout.write(JSON.stringify(output));
+  process.exitCode = 2;
+}
+
+async function main(): Promise<void> {
+  let payload: { tool_input?: { command?: string } };
+  try {
+    const raw = await readStdin();
+    if (!raw.trim()) {
+      return;
+    }
+
+    payload = JSON.parse(raw);
+  } catch {
+    return;
+  }
+
+  const command = payload?.tool_input?.command;
+  if (typeof command !== "string" || command.length === 0) {
+    return;
+  }
+
+  for (const rule of rules) {
+    if (rule.test(command)) {
+      deny(`[${rule.id}] ${rule.message}`);
+      return;
+    }
+  }
+}
+
+main().catch(() => undefined);

package/payload/block-dangerous-commands/settings-fragment.json

@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node .agents/hooks/claude-code/block-dangerous-commands.mjs"
+          }
+        ]
+      }
+    ]
+  }
+}