📦 deps(thirdparty): update snapshots
This commit is contained in:
ci[bot]
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"hooks": {
|
||||
"PreToolUse": [
|
||||
{
|
||||
"matcher": "Bash",
|
||||
"hooks": [
|
||||
{
|
||||
"type": "command",
|
||||
"command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/validate-bash.ts",
|
||||
"timeout": 10
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
+123
@@ -0,0 +1,123 @@
|
||||
#!/usr/bin/env bun
|
||||
|
||||
/**
|
||||
* Pre-Tool-Use Hook: Validate bash commands before execution
|
||||
* This hook blocks dangerous bash commands and suggests safer alternatives
|
||||
*/
|
||||
|
||||
import { stderr, stdin, stdout } from "node:process";
|
||||
|
||||
/**
|
||||
* Input structure received by pre-tool-use hooks.
|
||||
*/
|
||||
interface HookInput {
|
||||
/** Current session ID */
|
||||
session_id: string;
|
||||
/** Path to conversation transcript */
|
||||
transcript_path: string;
|
||||
/** Current working directory */
|
||||
cwd: string;
|
||||
/** Name of the hook event */
|
||||
hook_event_name: string;
|
||||
/** Name of the tool being invoked */
|
||||
tool_name: string;
|
||||
/** Tool-specific input parameters */
|
||||
tool_input: {
|
||||
command?: string;
|
||||
description?: string;
|
||||
};
|
||||
}
|
||||
|
||||
// Validation rules: [regex, error message, suggested alternative]
|
||||
const VALIDATION_RULES: [RegExp, string, string][] = [
|
||||
[
|
||||
/\brm\s+-rf\s+\/(?:\s|$)/,
|
||||
"Extremely dangerous: 'rm -rf /' would delete the entire filesystem",
|
||||
"Specify the exact directory to delete, never use '/' as target",
|
||||
],
|
||||
[
|
||||
/>\s*\/dev\/sda/,
|
||||
"Dangerous: Writing directly to block device",
|
||||
"This could corrupt the disk. Verify you meant to do this.",
|
||||
],
|
||||
[
|
||||
/:()\s*{\s*:|;}\s*;/,
|
||||
"Fork bomb detected: This will crash the system",
|
||||
"Remove this malicious command",
|
||||
],
|
||||
[
|
||||
/mkfs\./,
|
||||
"Dangerous: Creating filesystem will destroy data",
|
||||
"Ensure you're targeting the correct device",
|
||||
],
|
||||
[
|
||||
/dd\s+if=.*\s+of=\/dev\//,
|
||||
"Dangerous: Writing to block device with dd",
|
||||
"Verify the target device is correct before proceeding",
|
||||
],
|
||||
];
|
||||
|
||||
// Read stdin
|
||||
const chunks: Buffer[] = [];
|
||||
for await (const chunk of stdin) {
|
||||
chunks.push(chunk);
|
||||
}
|
||||
|
||||
const input: HookInput = JSON.parse(Buffer.concat(chunks).toString());
|
||||
|
||||
// Extract command
|
||||
const command = input.tool_input?.command;
|
||||
|
||||
if (!command) {
|
||||
stderr.write("No command provided\n");
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
// Validate against rules
|
||||
const issues: string[] = [];
|
||||
|
||||
for (const [pattern, message, suggestion] of VALIDATION_RULES) {
|
||||
if (pattern.test(command)) {
|
||||
issues.push(`❌ ${message}\n Suggestion: ${suggestion}`);
|
||||
}
|
||||
}
|
||||
|
||||
// If issues found, block execution
|
||||
if (issues.length > 0) {
|
||||
stderr.write("BLOCKED: Dangerous bash command detected\n\n");
|
||||
stderr.write(`Command: ${command}\n\n`);
|
||||
stderr.write("Issues:\n");
|
||||
for (const issue of issues) {
|
||||
stderr.write(`${issue}\n\n`);
|
||||
}
|
||||
stderr.write("Please revise the command and try again.\n");
|
||||
process.exit(2); // Exit 2 = block operation and show error to Claude
|
||||
}
|
||||
|
||||
// Additional warnings (non-blocking)
|
||||
const warnings: string[] = [];
|
||||
|
||||
// Suggest rg/fd over grep/find
|
||||
if (/\b(grep|find)\b/.test(command)) {
|
||||
warnings.push(
|
||||
"⚠️ Consider using 'rg' (ripgrep) or 'fd' for faster, better search",
|
||||
);
|
||||
}
|
||||
|
||||
// Warn about sudo usage
|
||||
if (/\bsudo\b/.test(command)) {
|
||||
warnings.push("⚠️ Warning: Command uses 'sudo' (elevated privileges)");
|
||||
}
|
||||
|
||||
// Warn about curl | sh pattern
|
||||
if (/curl.*\|.*sh/.test(command) || /wget.*\|.*sh/.test(command)) {
|
||||
warnings.push("⚠️ Warning: Piping to shell is risky - verify the source");
|
||||
}
|
||||
|
||||
if (warnings.length > 0) {
|
||||
stdout.write(`${warnings.join("\n")}\n`);
|
||||
}
|
||||
|
||||
// Approve
|
||||
stdout.write(`✓ Bash command validated: ${command.slice(0, 60)}...\n`);
|
||||
process.exit(0);
|
||||
+45
@@ -0,0 +1,45 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# Post-Tool-Use Hook: Auto-format TypeScript files after Write/Edit
|
||||
# This hook runs automatically after Claude writes or edits .ts files
|
||||
|
||||
# Read hook input from stdin
|
||||
INPUT=$(cat)
|
||||
|
||||
# Extract file path from the tool input
|
||||
FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
|
||||
|
||||
# Validate file path exists
|
||||
if [[ -z "$FILE_PATH" ]]; then
|
||||
echo "No file path provided" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if file exists
|
||||
if [[ ! -f "$FILE_PATH" ]]; then
|
||||
echo "File not found: $FILE_PATH" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Format the file with biome (adjust to your formatter)
|
||||
echo "Formatting $FILE_PATH..."
|
||||
|
||||
if command -v biome &>/dev/null; then
|
||||
biome check --write "$FILE_PATH" 2>&1 || {
|
||||
echo "Warning: biome formatting failed for $FILE_PATH" >&2
|
||||
exit 0 # Non-blocking warning
|
||||
}
|
||||
echo "✓ Formatted successfully"
|
||||
elif command -v prettier &>/dev/null; then
|
||||
prettier --write "$FILE_PATH" 2>&1 || {
|
||||
echo "Warning: prettier formatting failed for $FILE_PATH" >&2
|
||||
exit 0
|
||||
}
|
||||
echo "✓ Formatted successfully"
|
||||
else
|
||||
echo "Warning: No formatter found (biome or prettier)" >&2
|
||||
exit 0
|
||||
fi
|
||||
|
||||
exit 0
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"hooks": {
|
||||
"PostToolUse": [
|
||||
{
|
||||
"matcher": "Write|Edit(*.ts)",
|
||||
"hooks": [
|
||||
{
|
||||
"type": "command",
|
||||
"command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/format.sh",
|
||||
"timeout": 30
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"hooks": {
|
||||
"PreToolUse": [
|
||||
{
|
||||
"matcher": "Write|Edit",
|
||||
"hooks": [
|
||||
{
|
||||
"type": "command",
|
||||
"command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/validate.sh",
|
||||
"timeout": 10
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
+61
@@ -0,0 +1,61 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# Pre-Tool-Use Hook: Validate file operations before they execute
|
||||
# This hook can block dangerous operations by exiting with code 2
|
||||
|
||||
# Read hook input from stdin
|
||||
INPUT=$(cat)
|
||||
|
||||
# Extract tool information
|
||||
TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name')
|
||||
FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
|
||||
|
||||
# Validate file path is not empty
|
||||
if [[ -z "$FILE_PATH" ]]; then
|
||||
echo "Error: No file path provided" >&2
|
||||
exit 2 # Exit 2 = block operation and show error to Claude
|
||||
fi
|
||||
|
||||
# Block path traversal attempts
|
||||
if echo "$FILE_PATH" | grep -q '\.\.'; then
|
||||
echo "❌ BLOCKED: Path traversal detected in: $FILE_PATH" >&2
|
||||
echo "Path traversal is not allowed for security reasons." >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
# Block sensitive file modifications
|
||||
SENSITIVE_PATTERNS=(
|
||||
"^/etc/"
|
||||
"^/root/"
|
||||
"\.env$"
|
||||
"\.env\.local$"
|
||||
"\.env\.production$"
|
||||
"credentials\.json$"
|
||||
"\.aws/credentials$"
|
||||
"\.ssh/id_"
|
||||
"package-lock\.json$"
|
||||
"bun\.lockb$"
|
||||
)
|
||||
|
||||
for pattern in "${SENSITIVE_PATTERNS[@]}"; do
|
||||
if echo "$FILE_PATH" | grep -qE "$pattern"; then
|
||||
echo "❌ BLOCKED: Attempt to modify sensitive file: $FILE_PATH" >&2
|
||||
echo "Modifying this file requires manual review." >&2
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
|
||||
# Block modifications outside project directory
|
||||
PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(pwd)}"
|
||||
REAL_FILE_PATH=$(realpath "$FILE_PATH" 2>/dev/null || echo "$FILE_PATH")
|
||||
|
||||
if [[ ! "$REAL_FILE_PATH" =~ ^"$PROJECT_DIR" ]]; then
|
||||
echo "⚠️ WARNING: File is outside project directory: $FILE_PATH" >&2
|
||||
echo "Proceeding, but please verify this is intentional." >&2
|
||||
# Exit 0 with warning - not blocking
|
||||
fi
|
||||
|
||||
# Approve operation
|
||||
echo "✓ Validation passed for: $FILE_PATH"
|
||||
exit 0
|
||||
+39
@@ -0,0 +1,39 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# User-Prompt-Submit Hook: Add context to every user prompt
|
||||
# This hook runs when the user submits a prompt, adding useful context for Claude
|
||||
|
||||
# Read hook input (not strictly needed for this hook, but good practice)
|
||||
INPUT=$(cat)
|
||||
|
||||
# Get current timestamp
|
||||
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S %Z')
|
||||
|
||||
# Get git context if in a repo
|
||||
GIT_CONTEXT=""
|
||||
if git rev-parse --git-dir >/dev/null 2>&1; then
|
||||
BRANCH=$(git branch --show-current 2>/dev/null || echo "unknown")
|
||||
GIT_CONTEXT="
|
||||
**Git Context:**
|
||||
- Branch: \`$BRANCH\`
|
||||
- Last commit: $(git log -1 --oneline 2>/dev/null || echo "No commits")"
|
||||
fi
|
||||
|
||||
# Get environment context
|
||||
NODE_VERSION=$(node --version 2>/dev/null || echo "Not installed")
|
||||
BUN_VERSION=$(bun --version 2>/dev/null || echo "Not installed")
|
||||
|
||||
# Output context that will be added to the prompt
|
||||
cat <<EOF
|
||||
|
||||
---
|
||||
**Session Context** (auto-added by hook)
|
||||
- Current time: $TIMESTAMP
|
||||
- Node.js: $NODE_VERSION
|
||||
- Bun: $BUN_VERSION$GIT_CONTEXT
|
||||
---
|
||||
|
||||
EOF
|
||||
|
||||
exit 0
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
"hooks": {
|
||||
"UserPromptSubmit": [
|
||||
{
|
||||
"matcher": "*",
|
||||
"hooks": [
|
||||
{
|
||||
"type": "command",
|
||||
"command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/add-context.sh",
|
||||
"timeout": 5
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user