claude-hooks

claude-hooks

Smart PreToolUse hook for Claude Code that decomposes compound bash commands (&&, ||, ;, |, $(), newlines) into individual sub-commands and checks each against the allow/deny patterns in your Claude Code settings.

Quick start

Add this to your ~/.claude/settings.json (merge with existing config):

That's it. The hook runs automatically on every Bash tool call and enforces your existing permissions.allow / permissions.deny patterns at the sub-command level.

The problem

Claude Code's built-in permission system matches commands as a whole string. A compound command like git status && rm -rf / would match an allow pattern for git status — even though it also contains rm -rf /. This hook splits compound commands apart and evaluates each piece individually, so a deny pattern on rm still fires.

Without the hook

With the hook

How it works

1. Receives the tool invocation JSON on stdin (via Claude Code's hook system)
2. Decomposes the bash command into individual sub-commands
3. Loads permission patterns from all settings layers:
   - ~/.claude/settings.json (global)
   - $CLAUDE_PROJECT_DIR/.claude/settings.json (project, committed)
   - $CLAUDE_PROJECT_DIR/.claude/settings.local.json (project, gitignored)
4. Checks each sub-command against deny patterns first, then allow patterns
5. Outputs a JSON permission decision (allow/deny) or exits silently to fall through to normal prompting

What the hook handles

Command decomposition

Compound commands are split on these operators into individual sub-commands, each checked separately:

Subshell contents ($() and backticks) are extracted recursively — nested subshells are checked too.

Normalization before matching

Before a sub-command is checked against your patterns, the hook normalizes it:

- Env var prefixes…