cc-safe-setup 1.9.7 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/README.md +1 -0
  2. package/examples/README.md +45 -33
  3. package/examples/commit-message-check.sh +53 -0
  4. package/index.mjs +43 -29
  5. package/package.json +2 -2
package/README.md CHANGED
@@ -154,6 +154,7 @@ Or browse all available examples in [`examples/`](examples/):
154
154
  - **deploy-guard.sh** — Block deploy commands when uncommitted changes exist ([#37314](https://github.com/anthropics/claude-code/issues/37314))
155
155
  - **network-guard.sh** — Warn on suspicious network commands sending file contents ([#37420](https://github.com/anthropics/claude-code/issues/37420))
156
156
  - **test-before-push.sh** — Block `git push` when tests haven't been run ([#36970](https://github.com/anthropics/claude-code/issues/36970))
157
+ - **large-file-guard.sh** — Warn when Write tool creates files over 500KB
157
158
 
158
159
  ## Learn More
159
160
 
package/examples/README.md CHANGED
@@ -1,46 +1,58 @@
1
1
  # Example Hooks
2
2
 
3
- Custom hooks beyond the 8 built-in ones. Copy any file to `~/.claude/hooks/` and add to `settings.json`.
4
-
5
- | Hook | Purpose | Related Issue |
6
- |------|---------|---------------|
7
- | **allowlist.sh** | Block everything not explicitly approved (inverse model) | [#37471](https://github.com/anthropics/claude-code/issues/37471) |
8
- | **auto-checkpoint.sh** | Auto-commit after edits for rollback protection | [#34674](https://github.com/anthropics/claude-code/issues/34674) |
9
- | **auto-approve-build.sh** | Auto-approve npm/yarn/cargo/go build, test, lint | |
10
- | **auto-approve-docker.sh** | Auto-approve docker build, compose, ps, logs | |
11
- | **auto-approve-git-read.sh** | Auto-approve `git status/log/diff` even with `-C` flags | [#36900](https://github.com/anthropics/claude-code/issues/36900) |
12
- | **auto-approve-python.sh** | Auto-approve pytest, mypy, ruff, black, isort | |
13
- | **auto-approve-ssh.sh** | Auto-approve safe SSH commands (uptime, whoami) | |
14
- | **auto-snapshot.sh** | Save file snapshots before edits (rollback protection) | [#37386](https://github.com/anthropics/claude-code/issues/37386) |
15
- | **block-database-wipe.sh** | Block destructive DB commands (Laravel, Django, Rails) | [#37405](https://github.com/anthropics/claude-code/issues/37405) |
16
- | **deploy-guard.sh** | Block deploy when uncommitted changes exist | [#37314](https://github.com/anthropics/claude-code/issues/37314) |
17
- | **edit-guard.sh** | Block Edit/Write to protected files | [#37210](https://github.com/anthropics/claude-code/issues/37210) |
18
- | **enforce-tests.sh** | Warn when source changes without test changes | |
19
- | **git-config-guard.sh** | Block git config --global modifications | [#37201](https://github.com/anthropics/claude-code/issues/37201) |
20
- | **large-file-guard.sh** | Warn when Write creates oversized files (>500KB) | |
21
- | **network-guard.sh** | Warn on suspicious network commands (data exfiltration) | [#37420](https://github.com/anthropics/claude-code/issues/37420) |
22
- | **notify-waiting.sh** | Desktop notification when Claude waits for input | |
23
- | **protect-dotfiles.sh** | Block modifications to ~/.bashrc, ~/.aws/, ~/.ssh/ | [#37478](https://github.com/anthropics/claude-code/issues/37478) |
24
- | **scope-guard.sh** | Block file operations outside project directory | [#36233](https://github.com/anthropics/claude-code/issues/36233) |
25
- | **test-before-push.sh** | Block git push when tests haven't passed | [#36970](https://github.com/anthropics/claude-code/issues/36970) |
3
+ 19 hooks beyond the 8 built-in ones, organized by category.
26
4
 
27
5
  ## Quick Start
28
6
 
29
7
  ```bash
30
8
  # One command — copies hook, updates settings.json, makes executable
31
9
  npx cc-safe-setup --install-example block-database-wipe
10
+
11
+ # Browse all examples with categories
12
+ npx cc-safe-setup --examples
32
13
  ```
33
14
 
34
- Or manually:
15
+ ## Safety Guards
16
+
17
+ | Hook | Purpose | Issue |
18
+ |------|---------|-------|
19
+ | **allowlist.sh** | Block everything not explicitly approved | [#37471](https://github.com/anthropics/claude-code/issues/37471) |
20
+ | **block-database-wipe.sh** | Block migrate:fresh, DROP DATABASE, Prisma reset | [#37405](https://github.com/anthropics/claude-code/issues/37405) |
21
+ | **deploy-guard.sh** | Block deploy with uncommitted changes | [#37314](https://github.com/anthropics/claude-code/issues/37314) |
22
+ | **git-config-guard.sh** | Block git config --global | [#37201](https://github.com/anthropics/claude-code/issues/37201) |
23
+ | **network-guard.sh** | Warn on suspicious network commands | [#37420](https://github.com/anthropics/claude-code/issues/37420) |
24
+ | **protect-dotfiles.sh** | Block changes to ~/.bashrc, ~/.aws/, ~/.ssh/ | [#37478](https://github.com/anthropics/claude-code/issues/37478) |
25
+ | **scope-guard.sh** | Block operations outside project directory | [#36233](https://github.com/anthropics/claude-code/issues/36233) |
26
+ | **test-before-push.sh** | Block git push without tests | [#36970](https://github.com/anthropics/claude-code/issues/36970) |
27
+
28
+ ## Auto-Approve
29
+
30
+ | Hook | Purpose | Issue |
31
+ |------|---------|-------|
32
+ | **auto-approve-build.sh** | npm/yarn/cargo/go build, test, lint | |
33
+ | **auto-approve-docker.sh** | docker build, compose, ps, logs | |
34
+ | **auto-approve-git-read.sh** | git status/log/diff with -C flags | [#36900](https://github.com/anthropics/claude-code/issues/36900) |
35
+ | **auto-approve-python.sh** | pytest, mypy, ruff, black, isort | |
36
+ | **auto-approve-ssh.sh** | Safe SSH commands (uptime, whoami) | |
37
+
38
+ ## Quality
39
+
40
+ | Hook | Purpose | Issue |
41
+ |------|---------|-------|
42
+ | **commit-message-check.sh** | Warn on non-conventional commit messages | |
43
+ | **edit-guard.sh** | Block Edit/Write to protected files | [#37210](https://github.com/anthropics/claude-code/issues/37210) |
44
+ | **enforce-tests.sh** | Warn when source changes without tests | |
45
+ | **large-file-guard.sh** | Warn when Write creates files >500KB | |
35
46
 
36
- ```bash
37
- cp examples/block-database-wipe.sh ~/.claude/hooks/
38
- chmod +x ~/.claude/hooks/block-database-wipe.sh
39
- # Add to settings.json — see each file's header for the JSON config
40
- ```
47
+ ## Recovery
41
48
 
42
- ## List from CLI
49
+ | Hook | Purpose | Issue |
50
+ |------|---------|-------|
51
+ | **auto-checkpoint.sh** | Auto-commit after edits (compaction protection) | [#34674](https://github.com/anthropics/claude-code/issues/34674) |
52
+ | **auto-snapshot.sh** | Save file copies before edits | [#37386](https://github.com/anthropics/claude-code/issues/37386) |
43
53
 
44
- ```bash
45
- npx cc-safe-setup --examples
46
- ```
54
+ ## UX
55
+
56
+ | Hook | Purpose | Issue |
57
+ |------|---------|-------|
58
+ | **notify-waiting.sh** | Desktop notification when Claude waits | |
package/examples/commit-message-check.sh ADDED
@@ -0,0 +1,53 @@
1
+ #!/bin/bash
2
+ # commit-message-check.sh — Warn when commit messages don't follow conventions
3
+ #
4
+ # Checks for conventional commits format (feat:, fix:, docs:, etc.)
5
+ # and minimum message length.
6
+ #
7
+ # This is a PostToolUse hook — it checks AFTER git commit runs
8
+ # and warns if the message doesn't follow conventions.
9
+ #
10
+ # Usage: Add to settings.json as a PostToolUse hook
11
+ #
12
+ # {
13
+ # "hooks": {
14
+ # "PostToolUse": [{
15
+ # "matcher": "Bash",
16
+ # "hooks": [{ "type": "command", "command": "~/.claude/hooks/commit-message-check.sh" }]
17
+ # }]
18
+ # }
19
+ # }
20
+
21
+ INPUT=$(cat)
22
+ COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
23
+
24
+ [[ -z "$COMMAND" ]] && exit 0
25
+
26
+ # Only check after git commit
27
+ if ! echo "$COMMAND" | grep -qE '^\s*git\s+commit\b'; then
28
+ exit 0
29
+ fi
30
+
31
+ # Must be in a git repo
32
+ git rev-parse --git-dir &>/dev/null || exit 0
33
+
34
+ # Get the last commit message
35
+ MSG=$(git log -1 --pretty=%s 2>/dev/null)
36
+ [[ -z "$MSG" ]] && exit 0
37
+
38
+ # Check conventional commit format
39
+ if ! echo "$MSG" | grep -qE '^(feat|fix|docs|style|refactor|test|chore|perf|ci|build|revert)(\(.+\))?(!)?:'; then
40
+ echo "" >&2
41
+ echo "NOTE: Commit message doesn't follow conventional commits format." >&2
42
+ echo "Expected: feat|fix|docs|chore|...: description" >&2
43
+ echo "Got: $MSG" >&2
44
+ fi
45
+
46
+ # Check minimum length
47
+ if (( ${#MSG} < 10 )); then
48
+ echo "" >&2
49
+ echo "NOTE: Commit message is very short (${#MSG} chars)." >&2
50
+ echo "Consider adding more context." >&2
51
+ fi
52
+
53
+ exit 0
package/index.mjs CHANGED
@@ -79,8 +79,8 @@ if (HELP) {
79
79
  npx cc-safe-setup --verify Test each hook with sample inputs
80
80
  npx cc-safe-setup --dry-run Preview without installing
81
81
  npx cc-safe-setup --uninstall Remove all installed hooks
82
- npx cc-safe-setup --examples List available example hooks
83
- npx cc-safe-setup --install-example <name> Install a specific example hook
82
+ npx cc-safe-setup --examples List 19 example hooks (5 categories)
83
+ npx cc-safe-setup --install-example <name> Install a specific example
84
84
  npx cc-safe-setup --help Show this help
85
85
 
86
86
  Hooks installed:
@@ -185,7 +185,8 @@ function status() {
185
185
  'auto-approve-git-read.sh', 'auto-approve-python.sh', 'auto-approve-ssh.sh',
186
186
  'auto-checkpoint.sh', 'auto-snapshot.sh', 'block-database-wipe.sh',
187
187
  'deploy-guard.sh', 'edit-guard.sh', 'enforce-tests.sh', 'git-config-guard.sh',
188
- 'notify-waiting.sh', 'protect-dotfiles.sh', 'scope-guard.sh',
188
+ 'large-file-guard.sh', 'network-guard.sh', 'notify-waiting.sh',
189
+ 'protect-dotfiles.sh', 'scope-guard.sh', 'test-before-push.sh',
189
190
  ];
190
191
  const installedExamples = exampleFiles.filter(f => existsSync(join(HOOKS_DIR, f)));
191
192
  if (installedExamples.length > 0) {
@@ -275,38 +276,51 @@ async function verify() {
275
276
 
276
277
  function examples() {
277
278
  const examplesDir = join(__dirname, 'examples');
278
- const EXAMPLE_DESCRIPTIONS = {
279
- 'auto-approve-build.sh': 'Auto-approve npm/yarn/cargo/go build, test, lint commands',
280
- 'auto-approve-docker.sh': 'Auto-approve docker build, compose, ps, logs commands',
281
- 'auto-approve-git-read.sh': 'Auto-approve git status/log/diff even with -C flags',
282
- 'auto-approve-ssh.sh': 'Auto-approve safe SSH commands (uptime, whoami, etc.)',
283
- 'block-database-wipe.sh': 'Block destructive DB commands (migrate:fresh, DROP DATABASE)',
284
- 'edit-guard.sh': 'Block Edit/Write to protected files (.env, credentials)',
285
- 'enforce-tests.sh': 'Warn when source files change without test files',
286
- 'notify-waiting.sh': 'Desktop notification when Claude waits for input',
287
- 'auto-approve-python.sh': 'Auto-approve pytest, mypy, ruff, black, isort commands',
288
- 'auto-snapshot.sh': 'Auto-save file snapshots before edits (rollback protection)',
289
- 'allowlist.sh': 'Block everything not in allowlist (inverse permission model)',
290
- 'protect-dotfiles.sh': 'Block modifications to ~/.bashrc, ~/.aws/, ~/.ssh/',
291
- 'scope-guard.sh': 'Block file operations outside project directory',
292
- 'auto-checkpoint.sh': 'Auto-commit after edits for rollback protection',
293
- 'git-config-guard.sh': 'Block git config --global modifications',
294
- 'deploy-guard.sh': 'Block deploy when uncommitted changes exist',
295
- 'network-guard.sh': 'Warn on suspicious network commands (data exfiltration)',
296
- 'test-before-push.sh': 'Block git push when tests have not passed',
297
- 'large-file-guard.sh': 'Warn when Write creates files over 500KB',
279
+ const CATEGORIES = {
280
+ 'Safety Guards': {
281
+ 'allowlist.sh': 'Block everything not in allowlist (inverse permission model)',
282
+ 'block-database-wipe.sh': 'Block destructive DB commands (migrate:fresh, DROP DATABASE, Prisma)',
283
+ 'deploy-guard.sh': 'Block deploy when uncommitted changes exist',
284
+ 'network-guard.sh': 'Warn on suspicious network commands (data exfiltration)',
285
+ 'protect-dotfiles.sh': 'Block modifications to ~/.bashrc, ~/.aws/, ~/.ssh/',
286
+ 'scope-guard.sh': 'Block file operations outside project directory',
287
+ 'test-before-push.sh': 'Block git push when tests have not passed',
288
+ 'git-config-guard.sh': 'Block git config --global modifications',
289
+ },
290
+ 'Auto-Approve': {
291
+ 'auto-approve-build.sh': 'Auto-approve npm/yarn/cargo/go build, test, lint',
292
+ 'auto-approve-docker.sh': 'Auto-approve docker build, compose, ps, logs',
293
+ 'auto-approve-git-read.sh': 'Auto-approve git status/log/diff even with -C flags',
294
+ 'auto-approve-python.sh': 'Auto-approve pytest, mypy, ruff, black, isort',
295
+ 'auto-approve-ssh.sh': 'Auto-approve safe SSH commands (uptime, whoami)',
296
+ },
297
+ 'Quality': {
298
+ 'commit-message-check.sh': 'Warn on non-conventional commit messages',
299
+ 'edit-guard.sh': 'Block Edit/Write to protected files (.env, credentials)',
300
+ 'enforce-tests.sh': 'Warn when source files change without test files',
301
+ 'large-file-guard.sh': 'Warn when Write creates files over 500KB',
302
+ },
303
+ 'Recovery': {
304
+ 'auto-checkpoint.sh': 'Auto-commit after edits for rollback protection',
305
+ 'auto-snapshot.sh': 'Auto-save file snapshots before edits (rollback protection)',
306
+ },
307
+ 'UX': {
308
+ 'notify-waiting.sh': 'Desktop notification when Claude waits for input',
309
+ },
298
310
  };
299
311
 
300
312
  console.log();
301
313
  console.log(c.bold + ' cc-safe-setup --examples' + c.reset);
302
- console.log(c.dim + ' Custom hooks beyond the 8 built-in ones' + c.reset);
314
+ console.log(c.dim + ' 19 hooks beyond the 8 built-in ones' + c.reset);
303
315
  console.log();
304
316
 
305
- for (const [file, desc] of Object.entries(EXAMPLE_DESCRIPTIONS)) {
306
- const fullPath = join(examplesDir, file);
307
- const exists = existsSync(fullPath);
308
- console.log(' ' + c.green + '*' + c.reset + ' ' + c.bold + file + c.reset);
309
- console.log(' ' + c.dim + desc + c.reset);
317
+ for (const [cat, hooks] of Object.entries(CATEGORIES)) {
318
+ console.log(' ' + c.bold + c.blue + cat + c.reset);
319
+ for (const [file, desc] of Object.entries(hooks)) {
320
+ console.log(' ' + c.green + '*' + c.reset + ' ' + c.bold + file + c.reset);
321
+ console.log(' ' + c.dim + desc + c.reset);
322
+ }
323
+ console.log();
310
324
  }
311
325
 
312
326
  console.log();
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "cc-safe-setup",
3
- "version": "1.9.7",
4
- "description": "One command to make Claude Code safe for autonomous operation. 8 built-in hooks + 19 installable examples. Destructive blocker, branch guard, database wipe protection, dotfile guard, and more.",
3
+ "version": "2.0.1",
4
+ "description": "One command to make Claude Code safe for autonomous operation. 8 built-in hooks + 20 installable examples. Destructive blocker, branch guard, database wipe protection, dotfile guard, and more.",
5
5
  "main": "index.mjs",
6
6
  "bin": {
7
7
  "cc-safe-setup": "index.mjs"