107153d5d7
- Replace `grep -P` (Perl regex) with `sed` for JSON field extraction, as Windows Git Bash does not support `grep -P` - Replace positional arg (`$1`) with stdin JSON parsing to match the actual Claude Code hook protocol (hooks receive data via stdin, not args) - Fix JSON double-quote escaping in grep patterns that silently fails on Windows Git Bash - Remove python3 dependency for JSON parsing, making scripts portable - Add Windows Git Bash to compatibility notes in script headers Affected scripts: security-scan.sh, validate-prompt.sh, log-bash.sh, format-code.sh Co-authored-by: Bruce <binyuli1993@foxmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
52 lines
1.4 KiB
Bash
52 lines
1.4 KiB
Bash
#!/bin/bash
|
|
# Validate user prompts
|
|
# Hook: UserPromptSubmit
|
|
#
|
|
# Reads the user prompt from stdin JSON and blocks dangerous operations.
|
|
#
|
|
# Compatible with: macOS, Linux, Windows (Git Bash)
|
|
|
|
# Read JSON input from stdin (Claude Code hook protocol)
|
|
INPUT=$(cat)
|
|
|
|
# Extract the prompt text from JSON input
|
|
# Claude Code sends: {"session_id": "...", "prompt": "user's message here"}
|
|
PROMPT=$(echo "$INPUT" | sed -n 's/.*"prompt"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
|
|
|
|
if [ -z "$PROMPT" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# Check for dangerous operations
|
|
DANGEROUS_PATTERNS=(
|
|
"rm -rf /"
|
|
"delete database"
|
|
"drop database"
|
|
"format disk"
|
|
"dd if="
|
|
)
|
|
|
|
for pattern in "${DANGEROUS_PATTERNS[@]}"; do
|
|
if echo "$PROMPT" | grep -qi "$pattern"; then
|
|
printf '{"decision": "block", "reason": "Dangerous operation detected: %s"}' "$pattern"
|
|
exit 0
|
|
fi
|
|
done
|
|
|
|
# Check for production deployments
|
|
if echo "$PROMPT" | grep -qiE "(deploy|push).*production"; then
|
|
if [ ! -f ".deployment-approved" ]; then
|
|
echo '{"decision": "block", "reason": "Production deployment requires approval. Create .deployment-approved file to proceed."}'
|
|
exit 0
|
|
fi
|
|
fi
|
|
|
|
# Check for required context in certain operations
|
|
if echo "$PROMPT" | grep -qi "refactor"; then
|
|
if [ ! -d "tests" ] && [ ! -d "test" ]; then
|
|
printf '{"additionalContext": "Warning: Refactoring without tests may be risky. Consider writing tests first."}'
|
|
fi
|
|
fi
|
|
|
|
exit 0
|