18 Hooks, End-to-End

#!/bin/bash
INPUT=$(cat)
CMD=$(echo "$INPUT" | python3 -c \
  "import json,sys; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" \
  2>/dev/null || echo "")

# Block rm -rf on root-level or home-directory paths
if echo "$CMD" | grep -qE 'rm\s+-[rf]+\s+(/[^/[:space:]]*[[:space:]]*$|~/[[:space:]]*$|~[[:space:]]*$)'; then
  echo "BLOCKED: rm -rf on a root-level or home path. Use a more specific path." >&2
  exit 2
fi

# Block git reset --hard with no ref (nukes working tree silently)
if echo "$CMD" | grep -qE 'git\s+reset\s+--hard\s*$'; then
  echo "BLOCKED: git reset --hard with no ref. Specify a commit ref or use git stash." >&2
  exit 2
fi

# Block git checkout -- . (discards all unstaged changes)
if echo "$CMD" | grep -qE 'git\s+checkout\s+--\s+\.'; then
  echo "BLOCKED: git checkout -- . discards all unstaged changes. Use git stash instead." >&2
  exit 2
fi

# Block git clean -f with no path scope
if echo "$CMD" | grep -qE 'git\s+clean\s+-[ffdx]+\s*$'; then
  echo "BLOCKED: git clean -f with no path scope. Add a target directory." >&2
  exit 2
fi

exit 0

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [{ "type": "command", "command": "~/.claude/hooks/destructive-guard.sh" }]
      }
    ]
  }
}

#!/bin/bash
INPUT=$(cat)
CMD=$(echo "$INPUT" | python3 -c \
  "import json,sys; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" \
  2>/dev/null || echo "")

# Check if this is a force push
if ! echo "$CMD" | grep -qE 'git\s+push.*(--force|-f)(\s|$)'; then
  exit 0
fi

# Extract target branch if present
BRANCH=$(echo "$CMD" | grep -oE '(origin|upstream)\s+[a-zA-Z0-9/_-]+' | awk '{print $2}' | head -1)

# Hard block on main/master
if echo "$BRANCH" | grep -qE '^(main|master)$'; then
  echo "BLOCKED: force push to ${BRANCH} is not allowed." >&2
  echo "If you truly need this, run the git push command manually in a terminal." >&2
  exit 2
fi

# Warn on any other branch
if [ -n "$BRANCH" ]; then
  echo "WARNING: force pushing to branch '${BRANCH}'. This rewrites remote history." >&2
  echo "Continuing — but verify with the team before doing this on shared branches." >&2
else
  echo "WARNING: force push detected without clear target branch. Allowing — verify intent." >&2
fi

exit 0

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [{ "type": "command", "command": "~/.claude/hooks/force-push-guard.sh" }]
      }
    ]
  }
}

#!/bin/bash
INPUT=$(cat)
CMD=$(echo "$INPUT" | python3 -c \
  "import json,sys; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" \
  2>/dev/null || echo "")

# Only run on git commit commands
echo "$CMD" | grep -qE 'git\s+commit' || exit 0

# Get staged Go files
STAGED_GO=$(git diff --cached --name-only 2>/dev/null | grep '\.go$' || true)
[[ -n "$STAGED_GO" ]] || exit 0

CHECKED_ROOTS=""
REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
FAILED=""

while IFS= read -r gofile; do
  DIR="$REPO_ROOT/$(dirname "$gofile")"
  MOD_ROOT="$DIR"

  # Walk up to find go.mod
  while [[ "$MOD_ROOT" != "/" && ! -f "$MOD_ROOT/go.mod" ]]; do
    MOD_ROOT=$(dirname "$MOD_ROOT")
  done
  [[ -f "$MOD_ROOT/go.mod" ]] || continue

  # Skip already-checked module roots
  echo "$CHECKED_ROOTS" | grep -qF "$MOD_ROOT" && continue
  CHECKED_ROOTS="$CHECKED_ROOTS
$MOD_ROOT"

  RESULT=$(cd "$MOD_ROOT" && go build ./... 2>&1) || true
  if [[ -n "$RESULT" ]]; then
    FAILED="$FAILED\n[$MOD_ROOT]\n$RESULT"
  fi
done <<< "$STAGED_GO"

if [[ -n "$FAILED" ]]; then
  echo "BLOCKED: go build ./... failed — fix before committing:" >&2
  echo -e "$FAILED" >&2
  exit 2
fi

exit 0

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [{ "type": "command", "command": "~/.claude/hooks/pre-commit-build-gate.sh" }]
      }
    ]
  }
}

#!/bin/bash
INPUT=$(cat)
CMD=$(echo "$INPUT" | python3 -c \
  "import json,sys; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" \
  2>/dev/null || echo "")

echo "$CMD" | grep -qE 'git\s+commit' || exit 0

REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
FAILED=""

# ── TypeScript ──
STAGED_TS=$(git diff --cached --name-only 2>/dev/null | grep -E '\.(ts|tsx)$' || true)
if [[ -n "$STAGED_TS" ]]; then
  # Find tsconfig.json searching up from the first changed file
  FIRST_DIR="$REPO_ROOT/$(dirname "$(echo "$STAGED_TS" | head -1)")"
  TSC_ROOT="$FIRST_DIR"
  while [[ "$TSC_ROOT" != "/" && ! -f "$TSC_ROOT/tsconfig.json" ]]; do
    TSC_ROOT=$(dirname "$TSC_ROOT")
  done
  if [[ -f "$TSC_ROOT/tsconfig.json" ]]; then
    TS_RESULT=$(cd "$TSC_ROOT" && npx tsc --noEmit 2>&1) || true
    if [[ -n "$TS_RESULT" ]]; then
      FAILED="$FAILED\n[TypeScript: $TSC_ROOT]\n$TS_RESULT"
    fi
  fi
fi

# ── Rust ──
STAGED_RS=$(git diff --cached --name-only 2>/dev/null | grep '\.rs$' || true)
if [[ -n "$STAGED_RS" ]]; then
  FIRST_RS_DIR="$REPO_ROOT/$(dirname "$(echo "$STAGED_RS" | head -1)")"
  CARGO_ROOT="$FIRST_RS_DIR"
  while [[ "$CARGO_ROOT" != "/" && ! -f "$CARGO_ROOT/Cargo.toml" ]]; do
    CARGO_ROOT=$(dirname "$CARGO_ROOT")
  done
  if [[ -f "$CARGO_ROOT/Cargo.toml" ]]; then
    RS_RESULT=$(cd "$CARGO_ROOT" && cargo check 2>&1) || true
    if echo "$RS_RESULT" | grep -q "^error"; then
      FAILED="$FAILED\n[Rust: $CARGO_ROOT]\n$RS_RESULT"
    fi
  fi
fi

if [[ -n "$FAILED" ]]; then
  echo "BLOCKED: compilation errors in staged files — fix before committing:" >&2
  echo -e "$FAILED" >&2
  exit 2
fi

exit 0

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          { "type": "command", "command": "~/.claude/hooks/pre-commit-build-gate.sh" },
          { "type": "command", "command": "~/.claude/hooks/pre-commit-multi-lang-gate.sh" }
        ]
      }
    ]
  }
}

#!/bin/bash
INPUT=$(cat)
CMD=$(echo "$INPUT" | python3 -c \
  "import json,sys; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" \
  2>/dev/null || echo "")

echo "$CMD" | grep -qE 'git\s+tag' || exit 0

REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
FAILED=""
WARN=""

echo "--- milestone-gate: running full quality suite ---" >&2

# ── Go ──
if find "$REPO_ROOT" -name "go.mod" -not -path "*/vendor/*" | head -1 | grep -q .; then
  while IFS= read -r modfile; do
    MOD_DIR=$(dirname "$modfile")

    BUILD=$(cd "$MOD_DIR" && go build ./... 2>&1) || true
    [[ -n "$BUILD" ]] && FAILED="$FAILED\n[go build: $MOD_DIR]\n$BUILD"

    VET=$(cd "$MOD_DIR" && go vet ./... 2>&1) || true
    [[ -n "$VET" ]] && FAILED="$FAILED\n[go vet: $MOD_DIR]\n$VET"

    if command -v golangci-lint >/dev/null 2>&1; then
      LINT=$(cd "$MOD_DIR" && golangci-lint run ./... 2>&1) || true
      [[ -n "$LINT" ]] && FAILED="$FAILED\n[golangci-lint: $MOD_DIR]\n$LINT"
    else
      WARN="$WARN\n[WARN] golangci-lint not found. Install: brew install golangci-lint"
    fi

    TEST=$(cd "$MOD_DIR" && go test ./... 2>&1) || true
    if echo "$TEST" | grep -qE '^(FAIL|---\s+FAIL)'; then
      FAILED="$FAILED\n[go test: $MOD_DIR]\n$TEST"
    fi
  done < <(find "$REPO_ROOT" -name "go.mod" -not -path "*/vendor/*")
fi

# ── TypeScript ──
if find "$REPO_ROOT" -name "tsconfig.json" -not -path "*/node_modules/*" | head -1 | grep -q .; then
  while IFS= read -r tscfg; do
    TSC_DIR=$(dirname "$tscfg")
    TSC=$(cd "$TSC_DIR" && npx tsc --noEmit 2>&1) || true
    [[ -n "$TSC" ]] && FAILED="$FAILED\n[tsc: $TSC_DIR]\n$TSC"

    if [ -f "$TSC_DIR/.eslintrc.json" ] || [ -f "$TSC_DIR/.eslintrc.js" ] || [ -f "$TSC_DIR/eslint.config.js" ]; then
      ESL=$(cd "$TSC_DIR" && npx eslint . 2>&1) || true
      if echo "$ESL" | grep -q "error"; then
        FAILED="$FAILED\n[eslint: $TSC_DIR]\n$ESL"
      fi
    fi
  done < <(find "$REPO_ROOT" -name "tsconfig.json" -not -path "*/node_modules/*")
fi

# ── Rust ──
if find "$REPO_ROOT" -name "Cargo.toml" -not -path "*/target/*" | head -1 | grep -q .; then
  CARGO_ROOT=$(find "$REPO_ROOT" -name "Cargo.toml" -not -path "*/target/*" | head -1 | xargs dirname)
  RS_CHECK=$(cd "$CARGO_ROOT" && cargo check 2>&1) || true
  echo "$RS_CHECK" | grep -q "^error" && FAILED="$FAILED\n[cargo check]\n$RS_CHECK"

  if command -v cargo-clippy >/dev/null 2>&1; then
    CLIPPY=$(cd "$CARGO_ROOT" && cargo clippy -- -D warnings 2>&1) || true
    echo "$CLIPPY" | grep -q "^error" && FAILED="$FAILED\n[clippy]\n$CLIPPY"
  else
    WARN="$WARN\n[WARN] cargo-clippy not found. Install: rustup component add clippy"
  fi

  RS_TEST=$(cd "$CARGO_ROOT" && cargo test 2>&1) || true
  echo "$RS_TEST" | grep -q "^FAILED" && FAILED="$FAILED\n[cargo test]\n$RS_TEST"
fi

# ── Python ──
if find "$REPO_ROOT" -name "*.py" -not -path "*/.venv/*" | head -1 | grep -q .; then
  if command -v ruff >/dev/null 2>&1; then
    RUFF=$(cd "$REPO_ROOT" && ruff check . 2>&1) || true
    echo "$RUFF" | grep -q "error" && FAILED="$FAILED\n[ruff]\n$RUFF"
  else
    WARN="$WARN\n[WARN] ruff not found. Install: pip install ruff"
  fi

  if command -v pytest >/dev/null 2>&1; then
    PYTEST=$(cd "$REPO_ROOT" && pytest --tb=short -q 2>&1) || true
    echo "$PYTEST" | grep -q "failed" && FAILED="$FAILED\n[pytest]\n$PYTEST"
  fi
fi

# ── Results ──
[[ -n "$WARN" ]] && echo -e "$WARN" >&2

if [[ -n "$FAILED" ]]; then
  echo "" >&2
  echo "BLOCKED: milestone-gate failed — cannot tag until all checks pass:" >&2
  echo -e "$FAILED" >&2
  exit 2
fi

echo "milestone-gate: all checks passed." >&2
exit 0

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [{ "type": "command", "command": "~/.claude/hooks/milestone-gate.sh" }]
      }
    ]
  }
}