cc-safe-setup 8.6.0 → 8.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/README.md +1 -1
  2. package/docs/by-example.html +234 -0
  3. package/docs/migration-guide.html +198 -0
  4. package/examples/docker-prune-guard.sh +10 -0
  5. package/examples/no-git-amend-push.sh +17 -0
  6. package/examples/node-version-guard.sh +19 -0
  7. package/examples/pip-venv-guard.sh +12 -0
  8. package/examples/sensitive-regex-guard.sh +11 -0
  9. package/package.json +1 -1
package/README.md CHANGED
@@ -6,7 +6,7 @@
6
6
 
7
7
  **One command to make Claude Code safe for autonomous operation.** [日本語](docs/README.ja.md)
8
8
 
9
- 8 built-in + 95 examples = **103 hooks**. 33 CLI commands. 457 tests. 4 languages. [Web Tool](https://yurukusa.github.io/cc-safe-setup/) · [Cheat Sheet](https://yurukusa.github.io/cc-safe-setup/hooks-cheatsheet.html) · [Builder](https://yurukusa.github.io/cc-safe-setup/builder.html) · [FAQ](https://yurukusa.github.io/cc-safe-setup/faq.html) · [Playground](https://yurukusa.github.io/cc-hook-registry/playground.html)
9
+ 8 built-in + 100 examples = **108 hooks**. 33 CLI commands. 457 tests. 4 languages. [Web Tool](https://yurukusa.github.io/cc-safe-setup/) · [Cheat Sheet](https://yurukusa.github.io/cc-safe-setup/hooks-cheatsheet.html) · [Builder](https://yurukusa.github.io/cc-safe-setup/builder.html) · [FAQ](https://yurukusa.github.io/cc-safe-setup/faq.html) · [Examples](https://yurukusa.github.io/cc-safe-setup/by-example.html) · [Migration](https://yurukusa.github.io/cc-safe-setup/migration-guide.html) · [Playground](https://yurukusa.github.io/cc-hook-registry/playground.html)
10
10
 
11
11
  ```bash
12
12
  npx cc-safe-setup
package/docs/by-example.html ADDED
@@ -0,0 +1,234 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>Claude Code Hooks by Example — Real Incidents, Real Fixes</title>
7
+ <meta name="description" content="Every hook was born from a real incident. See the before/after for each one.">
8
+ <style>
9
+ *{box-sizing:border-box;margin:0;padding:0}
10
+ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;background:#0d1117;color:#c9d1d9;padding:1.5rem;line-height:1.6}
11
+ .c{max-width:800px;margin:0 auto}
12
+ h1{color:#f0f6fc;font-size:1.5rem;margin-bottom:.3rem}
13
+ .sub{color:#8b949e;font-size:.85rem;margin-bottom:1.2rem}
14
+ a{color:#58a6ff;text-decoration:none}
15
+ .example{background:#161b22;border:1px solid #30363d;border-radius:8px;padding:1rem;margin:.8rem 0}
16
+ .ex-title{font-weight:700;color:#f0f6fc;font-size:.95rem;margin-bottom:.3rem}
17
+ .ex-issue{font-size:.7rem;color:#58a6ff;margin-bottom:.5rem}
18
+ .ex-row{display:grid;grid-template-columns:1fr 1fr;gap:.8rem;margin:.5rem 0}
19
+ .before,.after{border-radius:6px;padding:.6rem;font-size:.78rem}
20
+ .before{background:#da363311;border:1px solid #da363333}
21
+ .after{background:#23863611;border:1px solid #23863633}
22
+ .label{font-size:.65rem;font-weight:bold;text-transform:uppercase;letter-spacing:.05em;margin-bottom:.3rem}
23
+ .label-bad{color:#f85149}
24
+ .label-good{color:#3fb950}
25
+ pre{background:#0d1117;border-radius:4px;padding:.4rem;font-size:.75rem;overflow-x:auto;margin:.3rem 0;color:#e6edf3}
26
+ .install{font-family:monospace;font-size:.75rem;color:#58a6ff;margin-top:.4rem;cursor:pointer}
27
+ .install:hover{text-decoration:underline}
28
+ .footer{text-align:center;color:#484f58;font-size:.7rem;margin-top:2rem;padding-top:1rem;border-top:1px solid #21262d}
29
+ code{background:#21262d;padding:.1rem .25rem;border-radius:3px;font-size:.8rem}
30
+ .count{color:#8b949e;font-size:.85rem;margin-bottom:1rem}
31
+ </style>
32
+ </head>
33
+ <body>
34
+ <div class="c">
35
+
36
+ <h1>Hooks by Example</h1>
37
+ <p class="sub">Every hook was born from a real incident. Here's the before and after.</p>
38
+ <p class="count">15 examples from real GitHub Issues</p>
39
+
40
+ <div class="example">
41
+ <div class="ex-title">destructive-guard</div>
42
+ <div class="ex-issue"><a href="https://github.com/anthropics/claude-code/issues/36339">#36339</a> — User lost entire C:\Users directory</div>
43
+ <div class="ex-row">
44
+ <div class="before"><div class="label label-bad">Without hook</div>
45
+ <pre>Claude: "Let me clean up the temp files"
46
+ $ rm -rf /
47
+ → Entire filesystem deleted via NTFS junction traversal</pre></div>
48
+ <div class="after"><div class="label label-good">With hook</div>
49
+ <pre>Claude: "Let me clean up the temp files"
50
+ $ rm -rf /
51
+ → BLOCKED: rm -rf on root directory
52
+ Claude: "I'll target just the temp folder instead"
53
+ $ rm -rf /tmp/old-builds</pre></div>
54
+ </div>
55
+ <div class="install" onclick="navigator.clipboard.writeText('npx cc-safe-setup');this.textContent='Copied!'">npx cc-safe-setup</div>
56
+ </div>
57
+
58
+ <div class="example">
59
+ <div class="ex-title">branch-guard</div>
60
+ <div class="ex-issue"><a href="https://github.com/anthropics/claude-code/issues/36640">#36640</a> — Untested code pushed to main at 3am</div>
61
+ <div class="ex-row">
62
+ <div class="before"><div class="label label-bad">Without hook</div>
63
+ <pre>Claude (autonomous, 3am): "Changes look good"
64
+ $ git push origin main --force
65
+ → Production branch overwritten with untested code</pre></div>
66
+ <div class="after"><div class="label label-good">With hook</div>
67
+ <pre>Claude (autonomous, 3am): "Changes look good"
68
+ $ git push origin main --force
69
+ → BLOCKED: Force push to main
70
+ Claude: "I'll create a PR instead"
71
+ $ git push origin feature/auth-fix</pre></div>
72
+ </div>
73
+ <div class="install" onclick="navigator.clipboard.writeText('npx cc-safe-setup');this.textContent='Copied!'">npx cc-safe-setup</div>
74
+ </div>
75
+
76
+ <div class="example">
77
+ <div class="ex-title">secret-guard</div>
78
+ <div class="ex-issue"><a href="https://github.com/anthropics/claude-code/issues/16561">#16561</a> — API keys committed via git add .</div>
79
+ <div class="ex-row">
80
+ <div class="before"><div class="label label-bad">Without hook</div>
81
+ <pre>Claude: "Let me commit all changes"
82
+ $ git add .
83
+ $ git push
84
+ → .env with API keys pushed to public repo</pre></div>
85
+ <div class="after"><div class="label label-good">With hook</div>
86
+ <pre>Claude: "Let me commit all changes"
87
+ $ git add .
88
+ → BLOCKED: .env file would be staged
89
+ Claude: "I'll add specific files instead"
90
+ $ git add src/ tests/</pre></div>
91
+ </div>
92
+ <div class="install" onclick="navigator.clipboard.writeText('npx cc-safe-setup');this.textContent='Copied!'">npx cc-safe-setup</div>
93
+ </div>
94
+
95
+ <div class="example">
96
+ <div class="ex-title">uncommitted-work-guard</div>
97
+ <div class="ex-issue"><a href="https://github.com/anthropics/claude-code/issues/37888">#37888</a> — Destroyed work twice in same session</div>
98
+ <div class="ex-row">
99
+ <div class="before"><div class="label label-bad">Without hook</div>
100
+ <pre>Claude: "Let me start fresh"
101
+ $ git checkout -- .
102
+ → 3 hours of uncommitted edits gone forever
103
+ (Claude does it again 20 minutes later)</pre></div>
104
+ <div class="after"><div class="label label-good">With hook</div>
105
+ <pre>Claude: "Let me start fresh"
106
+ $ git checkout -- .
107
+ → BLOCKED: 12 uncommitted changes would be lost
108
+ Claude: "I'll commit first"
109
+ $ git stash && git checkout -- .</pre></div>
110
+ </div>
111
+ <div class="install" onclick="navigator.clipboard.writeText('npx cc-safe-setup --install-example uncommitted-work-guard');this.textContent='Copied!'">npx cc-safe-setup --install-example uncommitted-work-guard</div>
112
+ </div>
113
+
114
+ <div class="example">
115
+ <div class="ex-title">test-deletion-guard</div>
116
+ <div class="ex-issue"><a href="https://github.com/anthropics/claude-code/issues/38050">#38050</a> — Claude deletes failing tests instead of fixing code</div>
117
+ <div class="ex-row">
118
+ <div class="before"><div class="label label-bad">Without hook</div>
119
+ <pre>Test: auth.test.js — 5 assertions
120
+ Claude: "Tests are failing, let me fix"
121
+ → Deletes 3 test assertions
122
+ → "All tests pass now!" (because there are fewer tests)</pre></div>
123
+ <div class="after"><div class="label label-good">With hook</div>
124
+ <pre>Claude: "Tests are failing, let me fix"
125
+ → WARNING: Removing 3 test assertions
126
+ → "Fix the code, not the tests"
127
+ Claude: "You're right, let me fix the auth logic"</pre></div>
128
+ </div>
129
+ <div class="install" onclick="navigator.clipboard.writeText('npx cc-safe-setup --install-example test-deletion-guard');this.textContent='Copied!'">npx cc-safe-setup --install-example test-deletion-guard</div>
130
+ </div>
131
+
132
+ <div class="example">
133
+ <div class="ex-title">token-budget-guard</div>
134
+ <div class="ex-issue"><a href="https://github.com/anthropics/claude-code/issues/38029">#38029</a> — Session consumed $342 without user knowing</div>
135
+ <div class="ex-row">
136
+ <div class="before"><div class="label label-bad">Without hook</div>
137
+ <pre>Session resumes, generates 652K output tokens
138
+ No warning, no limit
139
+ Bill arrives: $342 for one session</pre></div>
140
+ <div class="after"><div class="label label-good">With hook</div>
141
+ <pre>Session runs normally...
142
+ → WARNING: Estimated cost ~$10, approaching $50 limit
143
+ → Consider /compact or new session
144
+ At $50: BLOCKED — start a new session</pre></div>
145
+ </div>
146
+ <div class="install" onclick="navigator.clipboard.writeText('npx cc-safe-setup --install-example token-budget-guard');this.textContent='Copied!'">npx cc-safe-setup --install-example token-budget-guard</div>
147
+ </div>
148
+
149
+ <div class="example">
150
+ <div class="ex-title">fact-check-gate</div>
151
+ <div class="ex-issue"><a href="https://github.com/anthropics/claude-code/issues/38057">#38057</a> — False claims in technical docs</div>
152
+ <div class="ex-row">
153
+ <div class="before"><div class="label label-bad">Without hook</div>
154
+ <pre>Claude edits README.md:
155
+ "The `processAuth()` function accepts a JWT token"
156
+ → processAuth() doesn't exist. Claude never read the source.</pre></div>
157
+ <div class="after"><div class="label label-good">With hook</div>
158
+ <pre>Claude edits README.md referencing `auth.ts`
159
+ → WARNING: Doc references auth.ts — verify it was read
160
+ Claude: "Let me read the source first"
161
+ $ Read auth.ts → writes accurate documentation</pre></div>
162
+ </div>
163
+ <div class="install" onclick="navigator.clipboard.writeText('npx cc-safe-setup --install-example fact-check-gate');this.textContent='Copied!'">npx cc-safe-setup --install-example fact-check-gate</div>
164
+ </div>
165
+
166
+ <div class="example">
167
+ <div class="ex-title">block-database-wipe</div>
168
+ <div class="ex-issue"><a href="https://github.com/anthropics/claude-code/issues/37405">#37405</a> — Production database wiped</div>
169
+ <div class="ex-row">
170
+ <div class="before"><div class="label label-bad">Without hook</div>
171
+ <pre>Claude: "Let me reset the database schema"
172
+ $ php artisan migrate:fresh
173
+ → All production data permanently deleted</pre></div>
174
+ <div class="after"><div class="label label-good">With hook</div>
175
+ <pre>Claude: "Let me reset the database schema"
176
+ $ php artisan migrate:fresh
177
+ → BLOCKED: migrate:fresh wipes all tables
178
+ Claude: "I'll create a migration instead"
179
+ $ php artisan make:migration add_users_table</pre></div>
180
+ </div>
181
+ <div class="install" onclick="navigator.clipboard.writeText('npx cc-safe-setup --install-example block-database-wipe');this.textContent='Copied!'">npx cc-safe-setup --install-example block-database-wipe</div>
182
+ </div>
183
+
184
+ <div class="example">
185
+ <div class="ex-title">error-memory-guard</div>
186
+ <div class="ex-issue">Common pattern — Claude retries the same failing command 10 times</div>
187
+ <div class="ex-row">
188
+ <div class="before"><div class="label label-bad">Without hook</div>
189
+ <pre>$ npm install broken-pkg → ERROR
190
+ $ npm install broken-pkg → ERROR
191
+ $ npm install broken-pkg → ERROR
192
+ (repeats 10 more times)</pre></div>
193
+ <div class="after"><div class="label label-good">With hook</div>
194
+ <pre>$ npm install broken-pkg → ERROR (tracked)
195
+ $ npm install broken-pkg → ERROR (2nd failure)
196
+ $ npm install broken-pkg → BLOCKED: Failed 3 times
197
+ → Try a different approach
198
+ Claude: "Let me check if there's an alternative package"</pre></div>
199
+ </div>
200
+ <div class="install" onclick="navigator.clipboard.writeText('npx cc-safe-setup --install-example error-memory-guard');this.textContent='Copied!'">npx cc-safe-setup --install-example error-memory-guard</div>
201
+ </div>
202
+
203
+ <div class="example">
204
+ <div class="ex-title">protect-dotfiles</div>
205
+ <div class="ex-issue"><a href="https://github.com/anthropics/claude-code/issues/37478">#37478</a> — .bashrc overwritten</div>
206
+ <div class="ex-row">
207
+ <div class="before"><div class="label label-bad">Without hook</div>
208
+ <pre>Claude: "Let me set up the dev environment"
209
+ → Overwrites ~/.bashrc with new PATH
210
+ → All shell aliases, functions, and config lost</pre></div>
211
+ <div class="after"><div class="label label-good">With hook</div>
212
+ <pre>Claude: "Let me set up the dev environment"
213
+ → BLOCKED: Modifying ~/.bashrc
214
+ Claude: "I'll add to a project-local .envrc instead"</pre></div>
215
+ </div>
216
+ <div class="install" onclick="navigator.clipboard.writeText('npx cc-safe-setup --install-example protect-dotfiles');this.textContent='Copied!'">npx cc-safe-setup --install-example protect-dotfiles</div>
217
+ </div>
218
+
219
+ <div style="text-align:center;margin:1.5rem 0">
220
+ <p style="color:#8b949e;font-size:.85rem">Want all of these? One command:</p>
221
+ <pre style="display:inline-block;font-size:1rem;padding:.6rem 1.2rem;cursor:pointer" onclick="navigator.clipboard.writeText('npx cc-safe-setup --shield');this.textContent='Copied!';setTimeout(()=>this.textContent='npx cc-safe-setup --shield',1500)">npx cc-safe-setup --shield</pre>
222
+ </div>
223
+
224
+ <div class="footer">
225
+ <a href="hooks-cheatsheet.html">Cheat Sheet</a> ·
226
+ <a href="builder.html">Builder</a> ·
227
+ <a href="faq.html">FAQ</a> ·
228
+ <a href="migration-guide.html">Migration</a> ·
229
+ <a href="https://yurukusa.github.io/cc-hook-registry/playground.html">Playground</a> ·
230
+ <a href="https://github.com/yurukusa/cc-safe-setup">GitHub</a>
231
+ </div>
232
+ </div>
233
+ </body>
234
+ </html>
package/docs/migration-guide.html ADDED
@@ -0,0 +1,198 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>Claude Code Hooks — Migration Guide from Other AI Tools</title>
7
+ <meta name="description" content="Moving from Cursor, Windsurf, Aider, or Copilot to Claude Code? Here's how to set up equivalent safety using hooks.">
8
+ <style>
9
+ *{box-sizing:border-box;margin:0;padding:0}
10
+ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;background:#0d1117;color:#c9d1d9;padding:1.5rem;line-height:1.6}
11
+ .c{max-width:800px;margin:0 auto}
12
+ h1{color:#f0f6fc;font-size:1.5rem;margin-bottom:.3rem}
13
+ h2{color:#f0f6fc;font-size:1.1rem;margin:1.5rem 0 .5rem;padding-bottom:.3rem;border-bottom:1px solid #21262d}
14
+ h3{color:#c9d1d9;font-size:.9rem;margin:.8rem 0 .3rem}
15
+ .sub{color:#8b949e;font-size:.85rem;margin-bottom:1.5rem}
16
+ a{color:#58a6ff;text-decoration:none}
17
+ code{background:#161b22;padding:.15rem .3rem;border-radius:3px;font-size:.85rem}
18
+ pre{background:#161b22;border:1px solid #30363d;border-radius:6px;padding:.7rem;font-size:.8rem;color:#e6edf3;overflow-x:auto;margin:.4rem 0}
19
+ table{width:100%;border-collapse:collapse;margin:.5rem 0;font-size:.82rem}
20
+ th,td{padding:.4rem .6rem;border:1px solid #21262d;text-align:left}
21
+ th{background:#161b22;color:#f0f6fc}
22
+ .note{background:#161b22;border-left:3px solid #58a6ff;padding:.5rem .8rem;margin:.5rem 0;font-size:.82rem;color:#8b949e}
23
+ .tool{background:#161b22;border:1px solid #30363d;border-radius:6px;padding:.8rem;margin:.6rem 0}
24
+ .tool-name{font-weight:600;color:#f0f6fc;font-size:.95rem}
25
+ .tool-desc{color:#8b949e;font-size:.82rem;margin:.3rem 0}
26
+ .footer{text-align:center;color:#484f58;font-size:.7rem;margin-top:2rem;padding-top:1rem;border-top:1px solid #21262d}
27
+ .quick{background:#238636;color:#fff;padding:.5rem 1rem;border-radius:6px;font-family:monospace;font-size:.85rem;border:none;display:block;width:100%;text-align:center;margin:.5rem 0;cursor:pointer}
28
+ </style>
29
+ </head>
30
+ <body>
31
+ <div class="c">
32
+
33
+ <h1>Migrating to Claude Code</h1>
34
+ <p class="sub">Safety setup guide for developers coming from Cursor, Windsurf, Aider, or Copilot</p>
35
+
36
+ <button class="quick" onclick="navigator.clipboard.writeText('npx cc-safe-setup --shield');this.textContent='Copied!';setTimeout(()=>this.textContent='npx cc-safe-setup --shield — one command to set up everything',1500)">npx cc-safe-setup --shield — one command to set up everything</button>
37
+
38
+ <h2>Why Claude Code is Different</h2>
39
+
40
+ <p>Unlike Cursor or Copilot, Claude Code has <strong>full terminal access</strong>. It can run any command, edit any file, push to any branch. This is powerful but requires safety hooks.</p>
41
+
42
+ <table>
43
+ <tr><th>Feature</th><th>Cursor/Copilot</th><th>Claude Code</th></tr>
44
+ <tr><td>Terminal access</td><td>Limited/sandboxed</td><td><strong>Full access</strong></td></tr>
45
+ <tr><td>File editing</td><td>IDE-controlled</td><td><strong>Direct filesystem</strong></td></tr>
46
+ <tr><td>Git operations</td><td>Via IDE UI</td><td><strong>Direct git commands</strong></td></tr>
47
+ <tr><td>Safety model</td><td>IDE sandbox</td><td><strong>Hooks (you configure)</strong></td></tr>
48
+ <tr><td>Autonomous mode</td><td>No</td><td><strong>Yes (headless)</strong></td></tr>
49
+ </table>
50
+
51
+ <div class="note">
52
+ <strong>Key difference:</strong> Cursor/Copilot run inside an IDE sandbox. Claude Code runs in your actual terminal. Hooks replace the sandbox.
53
+ </div>
54
+
55
+ <h2>From Cursor</h2>
56
+
57
+ <div class="tool">
58
+ <div class="tool-name">Cursor → Claude Code</div>
59
+ <div class="tool-desc">Cursor Rules (.cursorrules) → CLAUDE.md + hooks</div>
60
+ </div>
61
+
62
+ <h3>What you had in Cursor</h3>
63
+ <ul>
64
+ <li><code>.cursorrules</code> — project-specific instructions</li>
65
+ <li>IDE-level file protection</li>
66
+ <li>Built-in git safety (can't force-push from UI)</li>
67
+ </ul>
68
+
69
+ <h3>What you need in Claude Code</h3>
70
+ <pre><code># 1. Convert .cursorrules to CLAUDE.md
71
+ cp .cursorrules CLAUDE.md # Then edit to Claude Code format
72
+
73
+ # 2. Install safety hooks
74
+ npx cc-safe-setup --shield
75
+
76
+ # 3. Add auto-approve for your workflow
77
+ npx cc-safe-setup --install-example auto-approve-build
78
+ </code></pre>
79
+
80
+ <h3>Key hooks for Cursor migrants</h3>
81
+ <table>
82
+ <tr><th>Cursor feature</th><th>Hook equivalent</th></tr>
83
+ <tr><td>Can't delete system files</td><td><code>destructive-guard</code> + <code>scope-guard</code></td></tr>
84
+ <tr><td>IDE confirms before push</td><td><code>branch-guard</code></td></tr>
85
+ <tr><td>Lint on save</td><td><code>syntax-check</code></td></tr>
86
+ <tr><td>.env excluded from commits</td><td><code>secret-guard</code></td></tr>
87
+ </table>
88
+
89
+ <h2>From Windsurf</h2>
90
+
91
+ <div class="tool">
92
+ <div class="tool-name">Windsurf → Claude Code</div>
93
+ <div class="tool-desc">Windsurf Rules → CLAUDE.md + hooks</div>
94
+ </div>
95
+
96
+ <pre><code># Convert Windsurf cascade rules
97
+ # Windsurf's "Flows" → Claude Code's autonomous mode + hooks
98
+
99
+ npx cc-safe-setup --shield
100
+ npx cc-safe-setup --install-example context-snapshot # Preserve state across sessions
101
+ npx cc-safe-setup --install-example session-handoff # Hand off between sessions
102
+ </code></pre>
103
+
104
+ <h2>From Aider</h2>
105
+
106
+ <div class="tool">
107
+ <div class="tool-name">Aider → Claude Code</div>
108
+ <div class="tool-desc">.aider.conf → CLAUDE.md, /lint → syntax-check hook</div>
109
+ </div>
110
+
111
+ <pre><code># Aider auto-commits → Claude Code needs explicit control
112
+ npx cc-safe-setup --shield
113
+ npx cc-safe-setup --install-example auto-checkpoint # Similar to Aider's auto-commit
114
+ npx cc-safe-setup --install-example verify-before-done # Ensure tests pass before commit
115
+
116
+ # Aider's /lint → already covered by syntax-check hook
117
+ # Aider's /test → use auto-approve-build to skip prompts
118
+ </code></pre>
119
+
120
+ <h2>From GitHub Copilot Workspace</h2>
121
+
122
+ <div class="tool">
123
+ <div class="tool-name">Copilot Workspace → Claude Code</div>
124
+ <div class="tool-desc">Copilot's plan-execute → Claude Code's plan mode + hooks</div>
125
+ </div>
126
+
127
+ <pre><code># Copilot Workspace creates PRs automatically
128
+ # Claude Code needs branch protection
129
+ npx cc-safe-setup --shield
130
+ npx cc-safe-setup --install-example deploy-guard # Prevent accidental deploys
131
+ npx cc-safe-setup --install-example diff-size-guard # Warn on large changes
132
+ npx cc-safe-setup --install-example pr-description-check # Ensure PR quality
133
+ </code></pre>
134
+
135
+ <h2>Universal Setup (Any Tool)</h2>
136
+
137
+ <pre><code># Step 1: Maximum safety
138
+ npx cc-safe-setup --shield
139
+
140
+ # Step 2: Check what's installed
141
+ npx cc-safe-setup --status
142
+
143
+ # Step 3: Verify everything works
144
+ npx cc-safe-setup --verify
145
+
146
+ # Step 4: View your safety score
147
+ npx cc-safe-setup --audit
148
+ </code></pre>
149
+
150
+ <h2>CLAUDE.md Template</h2>
151
+
152
+ <p>Create a <code>CLAUDE.md</code> in your project root:</p>
153
+
154
+ <pre><code># Project Rules
155
+
156
+ ## Safety
157
+ - Do not push to main/master directly
158
+ - Do not force-push
159
+ - Do not delete files outside this project
160
+ - Do not commit .env or credential files
161
+ - Run tests before committing
162
+
163
+ ## Code Style
164
+ - Follow existing conventions in this codebase
165
+ - Keep functions small and focused
166
+
167
+ ## Git
168
+ - Use descriptive commit messages
169
+ - One logical change per commit
170
+ - Create feature branches for new work
171
+ </code></pre>
172
+
173
+ <div class="note">
174
+ <strong>CLAUDE.md vs .cursorrules:</strong> Same concept, but CLAUDE.md is also read by Claude in the API (not just the CLI). Hooks add enforcement — CLAUDE.md is advisory, hooks are mandatory.
175
+ </div>
176
+
177
+ <h2>Safety Profile Comparison</h2>
178
+
179
+ <table>
180
+ <tr><th>Profile</th><th>Hooks</th><th>Best for</th></tr>
181
+ <tr><td><code>minimal</code></td><td>8</td><td>Experienced users, quick tasks</td></tr>
182
+ <tr><td><code>standard</code></td><td>20</td><td>Daily development, balanced safety</td></tr>
183
+ <tr><td><code>strict</code></td><td>33</td><td>Autonomous sessions, production repos</td></tr>
184
+ </table>
185
+
186
+ <pre><code>npx cc-safe-setup --profile strict # For autonomous/production use
187
+ </code></pre>
188
+
189
+ <div class="footer">
190
+ <a href="hooks-cheatsheet.html">Cheat Sheet</a> ·
191
+ <a href="builder.html">Hook Builder</a> ·
192
+ <a href="faq.html">FAQ</a> ·
193
+ <a href="https://yurukusa.github.io/cc-hook-registry/playground.html">Playground</a> ·
194
+ <a href="https://github.com/yurukusa/cc-safe-setup">GitHub</a>
195
+ </div>
196
+ </div>
197
+ </body>
198
+ </html>
package/examples/docker-prune-guard.sh ADDED
@@ -0,0 +1,10 @@
1
+ #!/bin/bash
2
+ # docker-prune-guard.sh — Warn before docker system prune
3
+ # TRIGGER: PreToolUse MATCHER: "Bash"
4
+ COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
5
+ [ -z "$COMMAND" ] && exit 0
6
+ if echo "$COMMAND" | grep -qE '\bdocker\s+system\s+prune'; then
7
+ echo "WARNING: docker system prune removes stopped containers, unused networks, dangling images." >&2
8
+ echo "Add --filter to limit scope, or use docker image prune for images only." >&2
9
+ fi
10
+ exit 0
package/examples/no-git-amend-push.sh ADDED
@@ -0,0 +1,17 @@
1
+ #!/bin/bash
2
+ # no-git-amend-push.sh — Block amending already-pushed commits
3
+ # TRIGGER: PreToolUse MATCHER: "Bash"
4
+ COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
5
+ [ -z "$COMMAND" ] && exit 0
6
+ echo "$COMMAND" | grep -qE '\bgit\s+commit\s+--amend' || exit 0
7
+ # Check if HEAD is already pushed
8
+ BRANCH=$(git branch --show-current 2>/dev/null)
9
+ if [ -n "$BRANCH" ]; then
10
+ REMOTE_HEAD=$(git rev-parse "origin/$BRANCH" 2>/dev/null)
11
+ LOCAL_HEAD=$(git rev-parse HEAD 2>/dev/null)
12
+ if [ "$REMOTE_HEAD" = "$LOCAL_HEAD" ]; then
13
+ echo "WARNING: Amending a commit that's already pushed to origin/$BRANCH." >&2
14
+ echo "This will require a force-push. Create a new commit instead." >&2
15
+ fi
16
+ fi
17
+ exit 0
package/examples/node-version-guard.sh ADDED
@@ -0,0 +1,19 @@
1
+ #!/bin/bash
2
+ # node-version-guard.sh — Warn when Node.js version doesn't match .nvmrc
3
+ # TRIGGER: PreToolUse MATCHER: "Bash"
4
+ COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
5
+ [ -z "$COMMAND" ] && exit 0
6
+ echo "$COMMAND" | grep -qE '^\s*(npm|node|npx|yarn|pnpm)\s' || exit 0
7
+ if [ -f ".nvmrc" ] || [ -f ".node-version" ]; then
8
+ EXPECTED=$(cat .nvmrc 2>/dev/null || cat .node-version 2>/dev/null)
9
+ ACTUAL=$(node --version 2>/dev/null | tr -d 'v')
10
+ if [ -n "$EXPECTED" ] && [ -n "$ACTUAL" ]; then
11
+ EXPECTED_MAJOR=$(echo "$EXPECTED" | cut -d. -f1 | tr -d 'v')
12
+ ACTUAL_MAJOR=$(echo "$ACTUAL" | cut -d. -f1)
13
+ if [ "$EXPECTED_MAJOR" != "$ACTUAL_MAJOR" ]; then
14
+ echo "WARNING: Node.js version mismatch. Expected v${EXPECTED}, running v${ACTUAL}." >&2
15
+ echo "Run: nvm use" >&2
16
+ fi
17
+ fi
18
+ fi
19
+ exit 0
package/examples/pip-venv-guard.sh ADDED
@@ -0,0 +1,12 @@
1
+ #!/bin/bash
2
+ # pip-venv-guard.sh — Warn when pip install runs outside a virtual environment
3
+ # TRIGGER: PreToolUse MATCHER: "Bash"
4
+ COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
5
+ [ -z "$COMMAND" ] && exit 0
6
+ echo "$COMMAND" | grep -qE '^\s*pip\s+install' || exit 0
7
+ if [ -z "$VIRTUAL_ENV" ] && [ ! -d ".venv" ] && [ ! -d "venv" ]; then
8
+ echo "WARNING: pip install without active virtual environment." >&2
9
+ echo "Packages will be installed system-wide." >&2
10
+ echo "Create a venv: python -m venv .venv && source .venv/bin/activate" >&2
11
+ fi
12
+ exit 0
package/examples/sensitive-regex-guard.sh ADDED
@@ -0,0 +1,11 @@
1
+ #!/bin/bash
2
+ # sensitive-regex-guard.sh — Warn on ReDoS-vulnerable regex patterns
3
+ # TRIGGER: PostToolUse MATCHER: "Edit|Write"
4
+ CONTENT=$(cat | jq -r '.tool_input.new_string // .tool_input.content // empty' 2>/dev/null)
5
+ [ -z "$CONTENT" ] && exit 0
6
+ # Detect common ReDoS patterns: nested quantifiers
7
+ if echo "$CONTENT" | grep -qE '\([^)]*[+*][^)]*\)[+*]|\(\.\*\)\+'; then
8
+ echo "WARNING: Possible ReDoS-vulnerable regex detected." >&2
9
+ echo "Nested quantifiers like (a+)+ or (.*)+ can cause catastrophic backtracking." >&2
10
+ fi
11
+ exit 0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "cc-safe-setup",
3
- "version": "8.6.0",
3
+ "version": "8.7.0",
4
4
  "description": "One command to make Claude Code safe. 59 hooks (8 built-in + 51 examples). 26 CLI commands: dashboard, create, audit, lint, diff, migrate, compare, generate-ci. 284 tests.",
5
5
  "main": "index.mjs",
6
6
  "bin": {