Claude Code hooks: deterministic quality gates for lint, tests and safety

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/format.sh"
          }
        ]
      }
    ]
  }
}

{
  "session_id": "a1b2c3",
  "cwd": "/home/me/coolsolution-blog",
  "hook_event_name": "PreToolUse",
  "tool_name": "Bash",
  "tool_input": {
    "command": "rm -rf ./build"
  }
}

#!/usr/bin/env bash
# format and lint the file Claude just edited
set -euo pipefail

# the path arrives in the JSON on stdin, inside tool_input
file="$(jq -r '.tool_input.file_path // empty')"
[ -z "$file" ] && exit 0            # no file: nothing to do

case "$file" in
  *.ts|*.tsx|*.js|*.jsx|*.css|*.md)
    yarn prettier --write "$file"
    yarn eslint --fix "$file" || true
    ;;
esac

exit 0                               # PostToolUse can't block: carry on

#!/usr/bin/env bash
# deny destructive commands and edits to sensitive files
set -euo pipefail
input="$(cat)"                                 # the whole JSON on stdin

tool="$(jq -r '.tool_name'              <<<"$input")"
cmd="$(jq -r '.tool_input.command // empty'   <<<"$input")"
path="$(jq -r '.tool_input.file_path // empty' <<<"$input")"

deny() {
  jq -n --arg r "$1" '{
    hookSpecificOutput: {
      hookEventName: "PreToolUse",
      permissionDecision: "deny",
      permissionDecisionReason: $r
    }
  }'
  exit 0                                       # decision via stdout JSON
}

# rm -rf on unscoped globs
[[ "$tool" == "Bash" && "$cmd" =~ rm[[:space:]]+-rf.*[*/] ]] \
  && deny "destructive 'rm -rf' command blocked by the hook"

# edits to secret files
[[ "$path" == *.env || "$path" == *.dev.vars ]] \
  && deny "editing a sensitive file ($path) is not allowed"

exit 0                                         # no match: normal flow

#!/usr/bin/env bash
# Stop gate: don't close the turn with red tests
set -uo pipefail
input="$(cat)"

# avoid the loop: if the hook is already running in response to itself, exit
[ "$(jq -r '.stop_hook_active // false' <<<"$input")" = "true" ] && exit 0

if yarn test --silent >/tmp/claude-test.log 2>&1; then
  exit 0                            # green: Claude may stop
fi

# red: block the Stop and send the error back to Claude
tail -n 20 /tmp/claude-test.log >&2
jq -n '{
  decision: "block",
  reason: "yarn test is red: fix the tests before ending the turn."
}'

#!/usr/bin/env bash
# project briefing injected at every session start
set -euo pipefail

branch="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo '-')"
changed="$(git status --porcelain 2>/dev/null | awk '{print $2}' | paste -sd, -)"

ctx="Current branch: ${branch}
Changed files: ${changed:-none}"

jq -n --arg c "$ctx" '{
  hookSpecificOutput: {
    hookEventName: "SessionStart",
    additionalContext: $c
  }
}'