PreToolUseadvisorystable
PreToolUse hook that redacts 1Password references and secret-shaped values from Claude Code tool-use payloads before they execute. Unlike secret-block which denies, this hook redacts in-place and always exits 0 — it never blocks the tool call. Patterns: GitHub tokens (gho_/ghp_/ghu_/ghs_/ghr_), Bearer tokens, op:// references, OpenAI sk- keys, PEM blocks. Writes a violation record on detection.
- event
- PreToolUse
- trigger
always
Stopadvisorystable
Fires on Stop. Collects the latest commit diff and sends it to an LLM for governance review — covering rules that require semantic understanding and cannot be enforced by pattern-matching hooks. Auto-detects the cheapest model available for the current provider (Haiku for Anthropic, gpt-4o-mini for OpenAI, Gemini Flash for Google). Config override at ~/.config/ai/agentic-review.json. Non-blocking — emits GOVERNANCE-VIOLATION sentinel lines.
- event
- Stop
- trigger
always
PostToolUseadvisorystable
PostToolUse hook that records every wrapped command invocation (git, gh, etc.) to the audit log. Makes the appearance side of the audit trail reliable — absence of an audit line for an expected command is itself visible during forensic review. Records WRAPPED_CMD, WRAPPED_ARGV, WRAPPED_EXIT, and WRAPPED_DURATION.
- event
- PostToolUse
- trigger
always
PreToolUseblockingstable
Consolidated PreToolUse guard for Bash, Edit, Write, and NotebookEdit. Prevents protected-branch mutations, direct work in primary clones, non-canonical worktree creation, commit verification bypasses, and blocking secret-pattern use; it also requests confirmation for destructive GitHub CLI operations.
- event
- PreToolUse
- trigger
tool-name Bash|Edit|Write|NotebookEdit
PreToolUseblockingstable
Blocks high-blast-radius, irreversible gh CLI operations. Denies without explicit --force-i-mean-it confirmation: gh repo delete, gh release delete, gh secret delete, and gh auth logout. All other gh subcommands pass through.
- event
- PreToolUse
- trigger
tool-name Bash
PreToolUseblockingstable
Blocks destructive kubectl operations. Opt-in via command-wrappers.toml. Denies kubectl delete, kubectl drain, and kubectl cordon without the bypass env AI_ALLOW_DESTRUCTIVE_KUBECTL=1. All other kubectl subcommands pass through.
- event
- PreToolUse
- trigger
tool-name Bash
PreToolUseblockingstable
Blocks terraform destroy and terraform apply. Opt-in via command-wrappers.toml. Requires explicit bypass via AI_ALLOW_DESTRUCTIVE_TERRAFORM=1. Prevents accidental infrastructure destruction or unreviewed applies. Other tofu/terraform subcommands (plan, init, validate, output) pass through.
- event
- PreToolUse
- trigger
tool-name Bash
Stopadvisorystable
Checks the session working directory for uncommitted tracked changes and unpushed commits at Stop and SubagentStop. Emits GIT-HYGIENE-VIOLATION sentinel lines to stdout and stderr — non-blocking.
- event
- Stop
- trigger
always
PreToolUseadvisorystable
Fires when Claude Code edits a GitHub Actions workflow file. Non-blocking reminder about command injection risks, untrusted input in run: steps, and the SAFE pattern (env: with proper quoting vs direct ${{ expression }} interpolation).
- event
- PreToolUse
- trigger
tool-name Edit|Write
libraryadvisorystable
Shared Python library required by most governance hooks. Provides redaction helpers, JSON I/O, audit logging, and pattern matching utilities.
- event
- library
- trigger
library
PreToolUseadvisorystable
Appends a JSONL record to ~/.ai/audit/interactions/<YYYY-MM>.jsonl for every Claude Code hook event: SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Stop, SessionEnd, SubagentStop, PreCompact. Non-blocking.
- event
- PreToolUse
- trigger
always
PostToolUseadvisorystable
Fires on PostToolUse for Edit and Write tools. Scans the written file content for commented-out code blocks — lines that appear to be executable code hidden behind a comment marker rather than explanatory prose. Emits a DEAD-CODE-VIOLATION warning when detected. Non-blocking.
- event
- PostToolUse
- trigger
tool-name Edit|Write
PreToolUseadvisorystable
PreToolUse hook that strips --no-verify from git commit commands before they execute. Default behavior: strip silently and log the bypass attempt to the audit pipeline. The bypass can be allowed per-project via allowNoVerifyBypass=true in settings, which removes this hook from the preHooks list.
- event
- PreToolUse
- trigger
tool-name Bash
PreToolUseblockingstable
Blocks force-pushes to protected branches (default: main). Two enforcement paths: (1) PreToolUse — intercepts 'git push --force' in AI tool Bash calls; (2) wrapper mode — intercepts every git push when git is aliased to the ai binary. Blocking on the force-push path; non-blocking sentinel on the unpushed-to-protected path.
- event
- PreToolUse
- trigger
tool-name Bash
PreToolUseblockingstable
PreToolUse hook that denies Bash commands containing secret-shaped strings before they execute. Reads the canonical pattern set from hooks/patterns.json (plus patterns.local.json if present). Belt-and-suspenders alongside the secret-handling rules in Emits a JSON permissionDecision deny on detection.
- event
- PreToolUse
- trigger
tool-name Bash
git-pre-commitblockingstable
Git pre-commit hook and CI scanner that blocks commits containing secret-shaped strings. Two modes: (1) pre-commit — scans the staged diff (git diff --cached -U0) and aborts the commit on any match; (2) CI/range scan (--ci --base BASE --head HEAD) — scans the diff from BASE..HEAD for use in secret-scan.yml workflows. Reads canonical patterns from hooks/patterns.json.
- event
- git-pre-commit
- trigger
always
Stopadvisorystable
Fires on Stop/SubagentStop. Compares changed source files on the current branch against changed test files. If code files changed but no corresponding test files changed, emits a TEST-COVERAGE-VIOLATION sentinel — non-blocking.
- event
- Stop
- trigger
always
PreToolUseblockingstable
Enforces worktree-based feature development. Rule 1: blocks ‘git checkout -b’ and ‘git switch -c’ in the primary worktree — feature work must live in a linked worktree so the primary repo stays on main. Rule 2: blocks ‘git worktree add’ to non-canonical paths. Canonical paths: <repo>/.worktrees/<name>/ for single-repo work, <repo>/.claude/worktrees/<name>/ for Claude Code's native EnterWorktree tool, ~/.ai/worktrees/<name>/ for cross-repo or persistent worktrees.
- event
- PreToolUse
- trigger
tool-name Bash
Nothing matches. Clear a filter or try the global search (/).