cc-safe-setup 2.0.0 → 2.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/examples/README.md +45 -33
- package/examples/commit-message-check.sh +53 -0
- package/index.mjs +5 -3
- package/package.json +2 -2
package/examples/README.md
CHANGED
|
@@ -1,46 +1,58 @@
|
|
|
1
1
|
# Example Hooks
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
| Hook | Purpose | Related Issue |
|
|
6
|
-
|------|---------|---------------|
|
|
7
|
-
| **allowlist.sh** | Block everything not explicitly approved (inverse model) | [#37471](https://github.com/anthropics/claude-code/issues/37471) |
|
|
8
|
-
| **auto-checkpoint.sh** | Auto-commit after edits for rollback protection | [#34674](https://github.com/anthropics/claude-code/issues/34674) |
|
|
9
|
-
| **auto-approve-build.sh** | Auto-approve npm/yarn/cargo/go build, test, lint | |
|
|
10
|
-
| **auto-approve-docker.sh** | Auto-approve docker build, compose, ps, logs | |
|
|
11
|
-
| **auto-approve-git-read.sh** | Auto-approve `git status/log/diff` even with `-C` flags | [#36900](https://github.com/anthropics/claude-code/issues/36900) |
|
|
12
|
-
| **auto-approve-python.sh** | Auto-approve pytest, mypy, ruff, black, isort | |
|
|
13
|
-
| **auto-approve-ssh.sh** | Auto-approve safe SSH commands (uptime, whoami) | |
|
|
14
|
-
| **auto-snapshot.sh** | Save file snapshots before edits (rollback protection) | [#37386](https://github.com/anthropics/claude-code/issues/37386) |
|
|
15
|
-
| **block-database-wipe.sh** | Block destructive DB commands (Laravel, Django, Rails) | [#37405](https://github.com/anthropics/claude-code/issues/37405) |
|
|
16
|
-
| **deploy-guard.sh** | Block deploy when uncommitted changes exist | [#37314](https://github.com/anthropics/claude-code/issues/37314) |
|
|
17
|
-
| **edit-guard.sh** | Block Edit/Write to protected files | [#37210](https://github.com/anthropics/claude-code/issues/37210) |
|
|
18
|
-
| **enforce-tests.sh** | Warn when source changes without test changes | |
|
|
19
|
-
| **git-config-guard.sh** | Block git config --global modifications | [#37201](https://github.com/anthropics/claude-code/issues/37201) |
|
|
20
|
-
| **large-file-guard.sh** | Warn when Write creates oversized files (>500KB) | |
|
|
21
|
-
| **network-guard.sh** | Warn on suspicious network commands (data exfiltration) | [#37420](https://github.com/anthropics/claude-code/issues/37420) |
|
|
22
|
-
| **notify-waiting.sh** | Desktop notification when Claude waits for input | |
|
|
23
|
-
| **protect-dotfiles.sh** | Block modifications to ~/.bashrc, ~/.aws/, ~/.ssh/ | [#37478](https://github.com/anthropics/claude-code/issues/37478) |
|
|
24
|
-
| **scope-guard.sh** | Block file operations outside project directory | [#36233](https://github.com/anthropics/claude-code/issues/36233) |
|
|
25
|
-
| **test-before-push.sh** | Block git push when tests haven't passed | [#36970](https://github.com/anthropics/claude-code/issues/36970) |
|
|
3
|
+
19 hooks beyond the 8 built-in ones, organized by category.
|
|
26
4
|
|
|
27
5
|
## Quick Start
|
|
28
6
|
|
|
29
7
|
```bash
|
|
30
8
|
# One command — copies hook, updates settings.json, makes executable
|
|
31
9
|
npx cc-safe-setup --install-example block-database-wipe
|
|
10
|
+
|
|
11
|
+
# Browse all examples with categories
|
|
12
|
+
npx cc-safe-setup --examples
|
|
32
13
|
```
|
|
33
14
|
|
|
34
|
-
|
|
15
|
+
## Safety Guards
|
|
16
|
+
|
|
17
|
+
| Hook | Purpose | Issue |
|
|
18
|
+
|------|---------|-------|
|
|
19
|
+
| **allowlist.sh** | Block everything not explicitly approved | [#37471](https://github.com/anthropics/claude-code/issues/37471) |
|
|
20
|
+
| **block-database-wipe.sh** | Block migrate:fresh, DROP DATABASE, Prisma reset | [#37405](https://github.com/anthropics/claude-code/issues/37405) |
|
|
21
|
+
| **deploy-guard.sh** | Block deploy with uncommitted changes | [#37314](https://github.com/anthropics/claude-code/issues/37314) |
|
|
22
|
+
| **git-config-guard.sh** | Block git config --global | [#37201](https://github.com/anthropics/claude-code/issues/37201) |
|
|
23
|
+
| **network-guard.sh** | Warn on suspicious network commands | [#37420](https://github.com/anthropics/claude-code/issues/37420) |
|
|
24
|
+
| **protect-dotfiles.sh** | Block changes to ~/.bashrc, ~/.aws/, ~/.ssh/ | [#37478](https://github.com/anthropics/claude-code/issues/37478) |
|
|
25
|
+
| **scope-guard.sh** | Block operations outside project directory | [#36233](https://github.com/anthropics/claude-code/issues/36233) |
|
|
26
|
+
| **test-before-push.sh** | Block git push without tests | [#36970](https://github.com/anthropics/claude-code/issues/36970) |
|
|
27
|
+
|
|
28
|
+
## Auto-Approve
|
|
29
|
+
|
|
30
|
+
| Hook | Purpose | Issue |
|
|
31
|
+
|------|---------|-------|
|
|
32
|
+
| **auto-approve-build.sh** | npm/yarn/cargo/go build, test, lint | |
|
|
33
|
+
| **auto-approve-docker.sh** | docker build, compose, ps, logs | |
|
|
34
|
+
| **auto-approve-git-read.sh** | git status/log/diff with -C flags | [#36900](https://github.com/anthropics/claude-code/issues/36900) |
|
|
35
|
+
| **auto-approve-python.sh** | pytest, mypy, ruff, black, isort | |
|
|
36
|
+
| **auto-approve-ssh.sh** | Safe SSH commands (uptime, whoami) | |
|
|
37
|
+
|
|
38
|
+
## Quality
|
|
39
|
+
|
|
40
|
+
| Hook | Purpose | Issue |
|
|
41
|
+
|------|---------|-------|
|
|
42
|
+
| **commit-message-check.sh** | Warn on non-conventional commit messages | |
|
|
43
|
+
| **edit-guard.sh** | Block Edit/Write to protected files | [#37210](https://github.com/anthropics/claude-code/issues/37210) |
|
|
44
|
+
| **enforce-tests.sh** | Warn when source changes without tests | |
|
|
45
|
+
| **large-file-guard.sh** | Warn when Write creates files >500KB | |
|
|
35
46
|
|
|
36
|
-
|
|
37
|
-
cp examples/block-database-wipe.sh ~/.claude/hooks/
|
|
38
|
-
chmod +x ~/.claude/hooks/block-database-wipe.sh
|
|
39
|
-
# Add to settings.json — see each file's header for the JSON config
|
|
40
|
-
```
|
|
47
|
+
## Recovery
|
|
41
48
|
|
|
42
|
-
|
|
49
|
+
| Hook | Purpose | Issue |
|
|
50
|
+
|------|---------|-------|
|
|
51
|
+
| **auto-checkpoint.sh** | Auto-commit after edits (compaction protection) | [#34674](https://github.com/anthropics/claude-code/issues/34674) |
|
|
52
|
+
| **auto-snapshot.sh** | Save file copies before edits | [#37386](https://github.com/anthropics/claude-code/issues/37386) |
|
|
43
53
|
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
54
|
+
## UX
|
|
55
|
+
|
|
56
|
+
| Hook | Purpose | Issue |
|
|
57
|
+
|------|---------|-------|
|
|
58
|
+
| **notify-waiting.sh** | Desktop notification when Claude waits | |
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
#!/bin/bash
|
|
2
|
+
# commit-message-check.sh — Warn when commit messages don't follow conventions
|
|
3
|
+
#
|
|
4
|
+
# Checks for conventional commits format (feat:, fix:, docs:, etc.)
|
|
5
|
+
# and minimum message length.
|
|
6
|
+
#
|
|
7
|
+
# This is a PostToolUse hook — it checks AFTER git commit runs
|
|
8
|
+
# and warns if the message doesn't follow conventions.
|
|
9
|
+
#
|
|
10
|
+
# Usage: Add to settings.json as a PostToolUse hook
|
|
11
|
+
#
|
|
12
|
+
# {
|
|
13
|
+
# "hooks": {
|
|
14
|
+
# "PostToolUse": [{
|
|
15
|
+
# "matcher": "Bash",
|
|
16
|
+
# "hooks": [{ "type": "command", "command": "~/.claude/hooks/commit-message-check.sh" }]
|
|
17
|
+
# }]
|
|
18
|
+
# }
|
|
19
|
+
# }
|
|
20
|
+
|
|
21
|
+
INPUT=$(cat)
|
|
22
|
+
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
|
|
23
|
+
|
|
24
|
+
[[ -z "$COMMAND" ]] && exit 0
|
|
25
|
+
|
|
26
|
+
# Only check after git commit
|
|
27
|
+
if ! echo "$COMMAND" | grep -qE '^\s*git\s+commit\b'; then
|
|
28
|
+
exit 0
|
|
29
|
+
fi
|
|
30
|
+
|
|
31
|
+
# Must be in a git repo
|
|
32
|
+
git rev-parse --git-dir &>/dev/null || exit 0
|
|
33
|
+
|
|
34
|
+
# Get the last commit message
|
|
35
|
+
MSG=$(git log -1 --pretty=%s 2>/dev/null)
|
|
36
|
+
[[ -z "$MSG" ]] && exit 0
|
|
37
|
+
|
|
38
|
+
# Check conventional commit format
|
|
39
|
+
if ! echo "$MSG" | grep -qE '^(feat|fix|docs|style|refactor|test|chore|perf|ci|build|revert)(\(.+\))?(!)?:'; then
|
|
40
|
+
echo "" >&2
|
|
41
|
+
echo "NOTE: Commit message doesn't follow conventional commits format." >&2
|
|
42
|
+
echo "Expected: feat|fix|docs|chore|...: description" >&2
|
|
43
|
+
echo "Got: $MSG" >&2
|
|
44
|
+
fi
|
|
45
|
+
|
|
46
|
+
# Check minimum length
|
|
47
|
+
if (( ${#MSG} < 10 )); then
|
|
48
|
+
echo "" >&2
|
|
49
|
+
echo "NOTE: Commit message is very short (${#MSG} chars)." >&2
|
|
50
|
+
echo "Consider adding more context." >&2
|
|
51
|
+
fi
|
|
52
|
+
|
|
53
|
+
exit 0
|
package/index.mjs
CHANGED
|
@@ -79,8 +79,8 @@ if (HELP) {
|
|
|
79
79
|
npx cc-safe-setup --verify Test each hook with sample inputs
|
|
80
80
|
npx cc-safe-setup --dry-run Preview without installing
|
|
81
81
|
npx cc-safe-setup --uninstall Remove all installed hooks
|
|
82
|
-
npx cc-safe-setup --examples List
|
|
83
|
-
npx cc-safe-setup --install-example <name> Install a specific example
|
|
82
|
+
npx cc-safe-setup --examples List 19 example hooks (5 categories)
|
|
83
|
+
npx cc-safe-setup --install-example <name> Install a specific example
|
|
84
84
|
npx cc-safe-setup --help Show this help
|
|
85
85
|
|
|
86
86
|
Hooks installed:
|
|
@@ -185,7 +185,8 @@ function status() {
|
|
|
185
185
|
'auto-approve-git-read.sh', 'auto-approve-python.sh', 'auto-approve-ssh.sh',
|
|
186
186
|
'auto-checkpoint.sh', 'auto-snapshot.sh', 'block-database-wipe.sh',
|
|
187
187
|
'deploy-guard.sh', 'edit-guard.sh', 'enforce-tests.sh', 'git-config-guard.sh',
|
|
188
|
-
'
|
|
188
|
+
'large-file-guard.sh', 'network-guard.sh', 'notify-waiting.sh',
|
|
189
|
+
'protect-dotfiles.sh', 'scope-guard.sh', 'test-before-push.sh',
|
|
189
190
|
];
|
|
190
191
|
const installedExamples = exampleFiles.filter(f => existsSync(join(HOOKS_DIR, f)));
|
|
191
192
|
if (installedExamples.length > 0) {
|
|
@@ -294,6 +295,7 @@ function examples() {
|
|
|
294
295
|
'auto-approve-ssh.sh': 'Auto-approve safe SSH commands (uptime, whoami)',
|
|
295
296
|
},
|
|
296
297
|
'Quality': {
|
|
298
|
+
'commit-message-check.sh': 'Warn on non-conventional commit messages',
|
|
297
299
|
'edit-guard.sh': 'Block Edit/Write to protected files (.env, credentials)',
|
|
298
300
|
'enforce-tests.sh': 'Warn when source files change without test files',
|
|
299
301
|
'large-file-guard.sh': 'Warn when Write creates files over 500KB',
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cc-safe-setup",
|
|
3
|
-
"version": "2.0.
|
|
4
|
-
"description": "One command to make Claude Code safe for autonomous operation. 8 built-in hooks +
|
|
3
|
+
"version": "2.0.1",
|
|
4
|
+
"description": "One command to make Claude Code safe for autonomous operation. 8 built-in hooks + 20 installable examples. Destructive blocker, branch guard, database wipe protection, dotfile guard, and more.",
|
|
5
5
|
"main": "index.mjs",
|
|
6
6
|
"bin": {
|
|
7
7
|
"cc-safe-setup": "index.mjs"
|