cc-safe-setup 1.8.0 → 1.8.2

package/README.md

@@ -25,6 +25,7 @@ Installs 8 production-tested safety hooks in ~10 seconds. Zero dependencies. No
   ✗ Force-push rewriting shared branch history
   ✗ API keys committed to public repos via git add .
   ✗ Syntax errors cascading through 30+ files
+  ✗ Laravel migrate:fresh wiping production database
   ✗ Sessions losing all context with no warning
 
   Hooks to install:
@@ -137,11 +138,13 @@ Need custom hooks beyond the 8 built-in ones? See [`examples/`](examples/) for r
 - **auto-approve-build.sh** — Auto-approve npm/yarn/cargo/go/python build, test, and lint commands
 - **auto-approve-docker.sh** — Auto-approve docker build, compose, ps, logs, and other safe commands
 - **block-database-wipe.sh** — Block destructive database commands: Laravel `migrate:fresh`, Django `flush`, Rails `db:drop`, raw `DROP DATABASE` ([#37405](https://github.com/anthropics/claude-code/issues/37405) [#37439](https://github.com/anthropics/claude-code/issues/37439))
+- **auto-approve-python.sh** — Auto-approve pytest, mypy, ruff, black, isort, flake8, pylint commands
+- **auto-snapshot.sh** — Auto-save file snapshots before edits for rollback protection ([#37386](https://github.com/anthropics/claude-code/issues/37386) [#37457](https://github.com/anthropics/claude-code/issues/37457))
 
 ## Learn More
 
 - [Official Hooks Reference](https://code.claude.com/docs/en/hooks) — Claude Code hooks documentation
-- [Hooks Cookbook](https://github.com/yurukusa/claude-code-hooks/blob/main/COOKBOOK.md) — 11 ready-to-use recipes from real GitHub Issues
+- [Hooks Cookbook](https://github.com/yurukusa/claude-code-hooks/blob/main/COOKBOOK.md) — 12 ready-to-use recipes from real GitHub Issues
 - [Japanese guide (Qiita)](https://qiita.com/yurukusa/items/a9714b33f5d974e8f1e8) — この記事の日本語解説
 - [The incident that inspired this tool](https://github.com/anthropics/claude-code/issues/36339) — NTFS junction rm -rf
 

package/examples/auto-approve-python.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# auto-approve-python.sh — Auto-approve Python development commands
+#
+# Solves: Permission prompts for pytest, mypy, ruff, black, isort
+#         that slow down autonomous Python development
+#
+# Usage: Add to settings.json as a PreToolUse hook
+#
+# {
+#   "hooks": {
+#     "PreToolUse": [{
+#       "matcher": "Bash",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/auto-approve-python.sh" }]
+#     }]
+#   }
+# }
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[[ -z "$COMMAND" ]] && exit 0
+
+# Python test runners
+if echo "$COMMAND" | grep -qE '^\s*(pytest|python\s+-m\s+pytest|python\s+-m\s+unittest)(\s|$)'; then
+    jq -n '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"Python test auto-approved"}}'
+    exit 0
+fi
+
+# Linters and formatters
+if echo "$COMMAND" | grep -qE '^\s*(ruff\s+(check|format)|black\s|isort\s|flake8\s|pylint\s|mypy\s|pyright\s)'; then
+    jq -n '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"Python lint/format auto-approved"}}'
+    exit 0
+fi
+
+# Package management (read-only)
+if echo "$COMMAND" | grep -qE '^\s*(pip\s+list|pip\s+show|pip\s+freeze|pipdeptree)(\s|$)'; then
+    jq -n '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"pip read-only auto-approved"}}'
+    exit 0
+fi
+
+# Python syntax check
+if echo "$COMMAND" | grep -qE '^\s*python3?\s+-m\s+py_compile\s'; then
+    jq -n '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"Python compile check auto-approved"}}'
+    exit 0
+fi
+
+exit 0

package/examples/auto-snapshot.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# auto-snapshot.sh — Automatic file snapshots before every edit
+#
+# Solves: Claude reverting verified changes after encountering
+#         contradictory information (sycophantic capitulation)
+#         (#37386, #37457)
+#
+# How it works:
+#   - Runs as a PreToolUse hook on Edit/Write
+#   - Copies the file to ~/.claude/snapshots/ before modification
+#   - When Claude walks back correct work, diff the snapshot
+#     against the current file and restore
+#
+# Usage: Add to settings.json as a PreToolUse hook
+#
+# {
+#   "hooks": {
+#     "PreToolUse": [{
+#       "matcher": "",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/auto-snapshot.sh" }]
+#     }]
+#   }
+# }
+
+INPUT=$(cat)
+TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+
+# Only snapshot Edit and Write operations
+if [[ "$TOOL" != "Edit" && "$TOOL" != "Write" ]]; then
+    exit 0
+fi
+
+# Only snapshot existing files (Write to new files has nothing to save)
+if [[ -z "$FILE" || ! -f "$FILE" ]]; then
+    exit 0
+fi
+
+SNAP_DIR="$HOME/.claude/snapshots/$(date +%Y%m%d)"
+mkdir -p "$SNAP_DIR" 2>/dev/null
+
+# Use filename + timestamp to avoid collisions
+BASENAME=$(basename "$FILE")
+TIMESTAMP=$(date +%H%M%S)
+cp "$FILE" "$SNAP_DIR/${BASENAME}.${TIMESTAMP}" 2>/dev/null
+
+# Keep snapshots manageable — delete files older than 7 days
+find "$HOME/.claude/snapshots" -type f -mtime +7 -delete 2>/dev/null
+find "$HOME/.claude/snapshots" -type d -empty -delete 2>/dev/null
+
+exit 0

package/index.mjs

@@ -261,6 +261,8 @@ function examples() {
     'edit-guard.sh': 'Block Edit/Write to protected files (.env, credentials)',
     'enforce-tests.sh': 'Warn when source files change without test files',
     'notify-waiting.sh': 'Desktop notification when Claude waits for input',
+    'auto-approve-python.sh': 'Auto-approve pytest, mypy, ruff, black, isort commands',
+    'auto-snapshot.sh': 'Auto-save file snapshots before edits (rollback protection)',
   };
 
   console.log();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safe-setup",
-  "version": "1.8.0",
+  "version": "1.8.2",
   "description": "One command to make Claude Code safe for autonomous operation. 8 hooks: destructive blocker, branch guard, force-push protection, secret leak prevention, syntax checks, and more.",
   "main": "index.mjs",
   "bin": {