cc-discipline 2.2.0 → 2.3.0

package/init.sh

@@ -280,6 +280,7 @@ cp "$SCRIPT_DIR/templates/.claude/hooks/post-error-remind.sh" .claude/hooks/
 cp "$SCRIPT_DIR/templates/.claude/hooks/streak-breaker.sh" .claude/hooks/
 cp "$SCRIPT_DIR/templates/.claude/hooks/session-start.sh" .claude/hooks/
 cp "$SCRIPT_DIR/templates/.claude/hooks/phase-gate.sh" .claude/hooks/
+cp "$SCRIPT_DIR/templates/.claude/hooks/git-guard.sh" .claude/hooks/
 cp "$SCRIPT_DIR/templates/.claude/hooks/action-counter.sh" .claude/hooks/
 chmod +x .claude/hooks/*.sh
 

package/lib/doctor.sh

@@ -44,7 +44,7 @@ done
 # 3. Hooks
 echo ""
 echo "Hooks:"
-for hook in pre-edit-guard streak-breaker post-error-remind session-start phase-gate action-counter; do
+for hook in pre-edit-guard streak-breaker post-error-remind session-start phase-gate action-counter git-guard; do
     if [ -f ".claude/hooks/${hook}.sh" ]; then
         if [ -x ".claude/hooks/${hook}.sh" ]; then
             ok "${hook}.sh"
@@ -62,7 +62,7 @@ echo "Hook registration:"
 if [ -f ".claude/settings.json" ]; then
     if command -v jq &>/dev/null; then
         CONTENT=$(cat .claude/settings.json)
-        for hook in pre-edit-guard streak-breaker post-error-remind session-start phase-gate action-counter; do
+        for hook in pre-edit-guard streak-breaker post-error-remind session-start phase-gate action-counter git-guard; do
             if echo "$CONTENT" | grep -q "$hook"; then
                 ok "${hook} registered"
             else

package/lib/status.sh

@@ -51,8 +51,9 @@ HOOKS=""
 [ -f ".claude/hooks/session-start.sh" ] && HOOKS="${HOOKS}session-start "
 [ -f ".claude/hooks/phase-gate.sh" ] && HOOKS="${HOOKS}phase-gate "
 [ -f ".claude/hooks/action-counter.sh" ] && HOOKS="${HOOKS}action-counter "
+[ -f ".claude/hooks/git-guard.sh" ] && HOOKS="${HOOKS}git-guard "
 HOOK_COUNT=$(echo "$HOOKS" | wc -w | tr -d ' ')
-echo -e "${GREEN}${HOOK_COUNT}/6${NC} (${HOOKS% })"
+echo -e "${GREEN}${HOOK_COUNT}/7${NC} (${HOOKS% })"
 
 # Agents
 echo -n "Agents:   "

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-discipline",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Discipline framework for Claude Code — rules, hooks, and agents that keep AI on track",
   "bin": {
     "cc-discipline": "bin/cli.sh"

package/templates/.claude/hooks/git-guard.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+# cc-discipline: Guard against destructive git commands
+# PreToolUse on Bash — blocks git checkout/restore/reset --hard/clean -f without confirmation.
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""' 2>/dev/null)
+
+if [ "$TOOL_NAME" != "Bash" ]; then
+    exit 0
+fi
+
+CMD=$(echo "$INPUT" | jq -r '.tool_input.command // ""' 2>/dev/null)
+
+# Normalize: collapse whitespace, trim
+CMD_NORM=$(echo "$CMD" | tr '\n' ' ' | sed 's/  */ /g')
+
+BLOCKED=""
+SUGGESTION=""
+
+# git checkout . / git checkout -- <file> (discard working tree changes)
+# But allow: git checkout <branch>, git checkout -b <branch>
+if echo "$CMD_NORM" | grep -qE 'git\s+checkout\s+(\.|--\s)'; then
+    BLOCKED="git checkout (discards uncommitted changes)"
+    SUGGESTION="git stash"
+fi
+
+# git restore . / git restore <file> (without --staged)
+if echo "$CMD_NORM" | grep -qE 'git\s+restore\s' && ! echo "$CMD_NORM" | grep -qE 'git\s+restore\s+--staged'; then
+    BLOCKED="git restore (discards uncommitted changes)"
+    SUGGESTION="git stash"
+fi
+
+# git reset --hard
+if echo "$CMD_NORM" | grep -qE 'git\s+reset\s+--hard'; then
+    BLOCKED="git reset --hard (destroys all uncommitted changes)"
+    SUGGESTION="git stash && git reset"
+fi
+
+# git clean -f / -fd / -fx
+if echo "$CMD_NORM" | grep -qE 'git\s+clean\s+-[a-z]*f'; then
+    BLOCKED="git clean -f (permanently deletes untracked files)"
+    SUGGESTION="git stash --include-untracked"
+fi
+
+# git branch -D (force delete unmerged branch)
+if echo "$CMD_NORM" | grep -qE 'git\s+branch\s+-D\s'; then
+    BLOCKED="git branch -D (deletes branch even if not merged)"
+    SUGGESTION="git branch -d (safe delete, fails if not merged)"
+fi
+
+# git push --force / -f (to main/master)
+if echo "$CMD_NORM" | grep -qE 'git\s+push\s+.*(-f|--force)' && echo "$CMD_NORM" | grep -qE '(main|master)'; then
+    BLOCKED="git push --force to main/master (rewrites shared history)"
+    SUGGESTION="git push --force-with-lease"
+fi
+
+if [ -n "$BLOCKED" ]; then
+    echo "GIT GUARD: Blocked destructive command: $BLOCKED. This command can permanently destroy uncommitted work. Before running this: (1) Check git status and git diff to see what would be lost. (2) If changes should be kept, run: $SUGGESTION first. (3) If you are certain the changes should be discarded, tell the user what will be lost and ask for explicit confirmation." >&2
+    exit 2
+fi
+
+exit 0

package/templates/.claude/settings.json

@@ -39,6 +39,15 @@
           }
         ]
       },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/git-guard.sh\""
+          }
+        ]
+      },
       {
         "matcher": "ExitPlanMode",
         "hooks": [