Claude Code Safety Hooks

Four tested Claude Code hooks, packaged as a plugin, that stop the mistakes an agent makes when it moves fast:

Every rule has a code (git_reset_hard, pipe_to_shell, …) shown in the reason, so you can switch one off per project.

As a plugin (recommended): add this folder to a plugin marketplace you use, or point Claude Code at it, then enable youraitools-safety-hooks (the plugin's name; Claude Code reserves names starting with claude-). Hooks load from hooks/hooks.json with ${CLAUDE_PLUGIN_ROOT} paths.

Per project, without plugins: copy hooks/ to .claude/hooks/ in your repo and merge settings.example.json into .claude/settings.json. Run /hooks in Claude Code to confirm they are listed.

Requires python3 on PATH (3.9+). No packages, no network.

python3 tools/try_hooks.py                      # sample commands and files, with the decision for each
python3 tools/try_hooks.py "git push -f origin main" "rm -rf ./build"
./run_tests.sh                                  # 17 test groups, ~90 cases

{
  "allow": ["git_reset_hard", "package_publish"],
  "protected_branches": ["main", "release/*"],
  "protected_paths": ["migrations/*", "infra/prod/*"],
  "allow_paths": [".npmrc"],
  "ask_paths": ["docker-compose.prod.yml"],
  "scan_skip": ["fixtures/*"],
  "audit_log": true
}

A broken config file is ignored (the defaults stay on) and the reason goes to stderr.

PreToolUse hooks print permissionDecision: "deny" or "ask" with a reason and exit 0; anything else is silent, so Claude Code's normal permission flow applies (a hook staying silent never approves anything). The secret scan exits 2 after the write, which shows Claude the message so it fixes the file.

• Pattern-based: it catches the common destructive forms, not every possible way to delete data. Obfuscated commands (eval "$(echo cm0gLXJm | base64 -d)") get through. Keep Claude Code's permission rules on; hooks are a second layer.
• If a hook can't start (no python3), Claude Code treats it as a non-blocking error and the action goes ahead. On v2.1.295+ you can add "onFailure": "block" to each hook in hooks/hooks.json to fail closed.
• The secret scan looks for known key formats; it doesn't find passwords or custom tokens, and it runs after the write (the file on disk has the key until Claude fixes it).
• Windows: needs python3 on PATH in Git Bash; untested in PowerShell-only setups.
• Not a security audit.