cc-safe-setup 1.9.1 → 1.9.3

package/README.md

@@ -154,7 +154,7 @@ Or browse all available examples in [`examples/`](examples/):
 ## Learn More
 
 - [Official Hooks Reference](https://code.claude.com/docs/en/hooks) — Claude Code hooks documentation
-- [Hooks Cookbook](https://github.com/yurukusa/claude-code-hooks/blob/main/COOKBOOK.md) — 13 ready-to-use recipes from real GitHub Issues
+- [Hooks Cookbook](https://github.com/yurukusa/claude-code-hooks/blob/main/COOKBOOK.md) — 14 ready-to-use recipes from real GitHub Issues
 - [Japanese guide (Qiita)](https://qiita.com/yurukusa/items/a9714b33f5d974e8f1e8) — この記事の日本語解説
 - [The incident that inspired this tool](https://github.com/anthropics/claude-code/issues/36339) — NTFS junction rm -rf
 

package/examples/README.md

@@ -15,6 +15,7 @@ Custom hooks beyond the 8 built-in ones. Copy any file to `~/.claude/hooks/` and
 | **block-database-wipe.sh** | Block destructive DB commands (Laravel, Django, Rails) | [#37405](https://github.com/anthropics/claude-code/issues/37405) |
 | **edit-guard.sh** | Block Edit/Write to protected files | [#37210](https://github.com/anthropics/claude-code/issues/37210) |
 | **enforce-tests.sh** | Warn when source changes without test changes | |
+| **git-config-guard.sh** | Block git config --global modifications | [#37201](https://github.com/anthropics/claude-code/issues/37201) |
 | **notify-waiting.sh** | Desktop notification when Claude waits for input | |
 | **protect-dotfiles.sh** | Block modifications to ~/.bashrc, ~/.aws/, ~/.ssh/ | [#37478](https://github.com/anthropics/claude-code/issues/37478) |
 | **scope-guard.sh** | Block file operations outside project directory | [#36233](https://github.com/anthropics/claude-code/issues/36233) |

package/examples/git-config-guard.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# git-config-guard.sh — Block git config --global modifications
+#
+# Solves: Claude modifying global git config (user.email, user.name)
+# without user consent (#37201)
+#
+# Usage: Add to settings.json as a PreToolUse hook
+#
+# {
+#   "hooks": {
+#     "PreToolUse": [{
+#       "matcher": "Bash",
+#       "hooks": [{ "type": "command", "command": "~/.claude/hooks/git-config-guard.sh" }]
+#     }]
+#   }
+# }
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[[ -z "$COMMAND" ]] && exit 0
+
+# Block git config --global (any subcommand)
+if echo "$COMMAND" | grep -qE '\bgit\s+config\s+--global\b'; then
+    echo "BLOCKED: git config --global is not allowed" >&2
+    echo "Use --local for project-specific config instead" >&2
+    exit 2
+fi
+
+# Block git config --system
+if echo "$COMMAND" | grep -qE '\bgit\s+config\s+--system\b'; then
+    echo "BLOCKED: git config --system is not allowed" >&2
+    exit 2
+fi
+
+exit 0

package/index.mjs

@@ -179,6 +179,23 @@ function status() {
   console.log();
   console.log('  ' + (settingsOk ? c.green + '✓' : c.red + '✗') + c.reset + ' settings.json ' + (settingsOk ? 'has hooks configured' : 'missing hook configuration'));
 
+  // Check installed examples
+  const exampleFiles = [
+    'allowlist.sh', 'auto-approve-build.sh', 'auto-approve-docker.sh',
+    'auto-approve-git-read.sh', 'auto-approve-python.sh', 'auto-approve-ssh.sh',
+    'auto-checkpoint.sh', 'auto-snapshot.sh', 'block-database-wipe.sh',
+    'edit-guard.sh', 'enforce-tests.sh', 'notify-waiting.sh',
+    'protect-dotfiles.sh', 'scope-guard.sh',
+  ];
+  const installedExamples = exampleFiles.filter(f => existsSync(join(HOOKS_DIR, f)));
+  if (installedExamples.length > 0) {
+    console.log();
+    console.log('  ' + c.bold + 'Example hooks installed:' + c.reset);
+    for (const f of installedExamples) {
+      console.log('  ' + c.green + '✓' + c.reset + ' ' + f);
+    }
+  }
+
   console.log();
   if (missing === 0) {
     console.log(c.bold + '  All ' + installed + ' hooks installed.' + c.reset);
@@ -186,6 +203,9 @@ function status() {
     console.log(c.bold + '  ' + installed + '/' + Object.keys(HOOKS).length + ' hooks installed.' + c.reset);
     console.log('  ' + c.dim + 'Run: npx cc-safe-setup' + c.reset);
   }
+  if (installedExamples.length > 0) {
+    console.log('  ' + c.dim + '+ ' + installedExamples.length + ' example hooks' + c.reset);
+  }
   console.log();
 
   // Exit code for CI: 0 = all installed, 1 = missing hooks
@@ -270,6 +290,7 @@ function examples() {
     'protect-dotfiles.sh': 'Block modifications to ~/.bashrc, ~/.aws/, ~/.ssh/',
     'scope-guard.sh': 'Block file operations outside project directory',
     'auto-checkpoint.sh': 'Auto-commit after edits for rollback protection',
+    'git-config-guard.sh': 'Block git config --global modifications',
   };
 
   console.log();
@@ -380,6 +401,8 @@ async function main() {
   console.log(c.red + '  x' + c.reset + ' Syntax errors cascading through 30+ files');
   console.log(c.red + '  x' + c.reset + ' Sessions losing all context with no warning');
   console.log(c.red + '  x' + c.reset + ' git checkout --force discarding uncommitted changes');
+  console.log(c.red + '  x' + c.reset + ' Remove-Item -Recurse -Force destroying unpushed source code');
+  console.log(c.red + '  x' + c.reset + ' prisma migrate reset / migrate:fresh wiping databases');
   console.log();
 
   console.log(c.bold + '  Hooks to install:' + c.reset);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cc-safe-setup",
-  "version": "1.9.1",
-  "description": "One command to make Claude Code safe for autonomous operation. 8 hooks: destructive blocker, branch guard, force-push protection, secret leak prevention, syntax checks, and more.",
+  "version": "1.9.3",
+  "description": "One command to make Claude Code safe for autonomous operation. 8 built-in hooks + 14 installable examples. Destructive blocker, branch guard, database wipe protection, dotfile guard, and more.",
   "main": "index.mjs",
   "bin": {
     "cc-safe-setup": "index.mjs"