Kjell Tore Guttormsen
2c89a6b580
hooks.json wired pre-write-executor.mjs to the Write tool only, so Edit and NotebookEdit reached .git/hooks/, .env, shell configs and the other protected paths unguarded. The matcher is now Write|Edit|NotebookEdit. The guard reads the target path per tool: file_path for Write and Edit (hooks reference, PreToolUse tool_input tables), notebook_path for NotebookEdit (the tool's input schema). When it cannot read a path (unparseable input, unknown tool, missing field) it now blocks instead of allowing. New tests resolve hooks.json with Claude Code's matcher semantics and run the hooks that would fire per tool: 9 failed on the old code, all pass now. The two fail-open pins in path-guard.test.mjs are flipped to fail closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
92 lines
2 KiB
JSON
92 lines
2 KiB
JSON
{
|
|
"hooks": {
|
|
"PreToolUse": [
|
|
{
|
|
"matcher": "Bash",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node",
|
|
"args": ["${CLAUDE_PLUGIN_ROOT}/hooks/scripts/pre-bash-executor.mjs"]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": "Write|Edit|NotebookEdit",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node",
|
|
"args": ["${CLAUDE_PLUGIN_ROOT}/hooks/scripts/pre-write-executor.mjs"]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"matcher": "WebSearch|WebFetch|Task",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node",
|
|
"args": ["${CLAUDE_PLUGIN_ROOT}/hooks/scripts/pre-agent-cap.mjs"]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"UserPromptSubmit": [
|
|
{
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node",
|
|
"args": ["${CLAUDE_PLUGIN_ROOT}/hooks/scripts/session-title.mjs"]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"PostToolUse": [
|
|
{
|
|
"matcher": "Bash",
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node",
|
|
"args": ["${CLAUDE_PLUGIN_ROOT}/hooks/scripts/post-bash-stats.mjs"]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"PreCompact": [
|
|
{
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node",
|
|
"args": ["${CLAUDE_PLUGIN_ROOT}/hooks/scripts/pre-compact-flush.mjs"]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"PostCompact": [
|
|
{
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node",
|
|
"args": ["${CLAUDE_PLUGIN_ROOT}/hooks/scripts/post-compact-flush.mjs"]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"Stop": [
|
|
{
|
|
"hooks": [
|
|
{
|
|
"type": "command",
|
|
"command": "node",
|
|
"args": ["${CLAUDE_PLUGIN_ROOT}/hooks/scripts/otel-export.mjs"]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|