Hooks (18)

PreToolUse hook that redacts 1Password references and secret-shaped values from Claude Code tool-use payloads before they execute. Unlike secret-block which denies, this hook redacts in-place and always exits 0 — it never blocks the tool call. Patterns: GitHub tokens (gho_/ghp_/ghu_/ghs_/ghr_), Bearer tokens, op:// references, OpenAI sk- keys, PEM blocks. Writes a violation record on detection. Implements Common.md §4 (non-overridable secret handling).

Fires on Stop. Collects the latest commit diff and sends it to an LLM for governance review — covering rules that require semantic understanding and cannot be enforced by pattern-matching hooks. Auto-detects the cheapest model available for the current provider (Haiku for Anthropic, gpt-4o-mini for OpenAI, Gemini Flash for Google). Config override at ~/.config/ai/agentic-review.json. Non-blocking — emits GOVERNANCE-VIOLATION sentinel lines.

PostToolUse hook that records every wrapped command invocation (git, gh, etc.) to the audit log. Makes the appearance side of the audit trail reliable — absence of an audit line for an expected command is itself visible during forensic review. Records WRAPPED_CMD, WRAPPED_ARGV, WRAPPED_EXIT, and WRAPPED_DURATION.

Prevents direct mutations to protected branches (main, release/*). Intercepts git commit, merge, rebase, cherry-pick, revert, am, pull, and push operations when the current HEAD is a protected branch. Requires explicit approval per Common.md §2.2.

Blocks high-blast-radius, irreversible gh CLI operations per Common.md §2.2. Denies without explicit --force-i-mean-it confirmation: gh repo delete, gh release delete, gh secret delete, and gh auth logout. All other gh subcommands pass through.

Blocks destructive kubectl operations per Common.md §2.2. Opt-in via command-wrappers.toml. Denies kubectl delete, kubectl drain, and kubectl cordon without the bypass env AI_ALLOW_DESTRUCTIVE_KUBECTL=1. All other kubectl subcommands pass through.

Blocks terraform destroy and terraform apply per Common.md §2.2. Opt-in via command-wrappers.toml. Requires explicit bypass via AI_ALLOW_DESTRUCTIVE_TERRAFORM=1. Prevents accidental infrastructure destruction or unreviewed applies. Other tofu/terraform subcommands (plan, init, validate, output) pass through.

Checks the session working directory for uncommitted tracked changes and unpushed commits at Stop and SubagentStop. Emits GIT-HYGIENE-VIOLATION sentinel lines to stdout and stderr — non-blocking.

Fires when Claude Code edits a GitHub Actions workflow file. Non-blocking reminder about command injection risks, untrusted input in run: steps, and the SAFE pattern (env: with proper quoting vs direct ${{ expression }} interpolation).

Shared Python library required by most governance hooks. Provides redaction helpers, JSON I/O, audit logging, and pattern matching utilities.

Appends a JSONL record to ~/.ai/audit/interactions/<YYYY-MM>.jsonl for every Claude Code hook event: SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Stop, SessionEnd, SubagentStop, PreCompact. Non-blocking. Implements Common.md §5.2.

Fires on PostToolUse for Edit and Write tools. Scans the written file content for commented-out code blocks — lines that appear to be executable code hidden behind a comment marker rather than explanatory prose. Emits a DEAD-CODE-VIOLATION warning when detected. Non-blocking.

PreToolUse hook that strips --no-verify from git commit commands before they execute. Per Common.md §2.2 (no skipping hooks) and the governance SPEC §10.3. Default behavior: strip silently and log the bypass attempt to the audit pipeline. The bypass can be allowed per-project via allowNoVerifyBypass=true in settings, which removes this hook from the preHooks list.

Blocks force-pushes to protected branches (default: main). Two enforcement paths: (1) PreToolUse — intercepts 'git push --force' in AI tool Bash calls; (2) wrapper mode — intercepts every git push when git is aliased to the ai binary. Blocking on the force-push path; non-blocking sentinel on the unpushed-to-protected path.

PreToolUse hook that denies Bash commands containing secret-shaped strings before they execute. Reads the canonical pattern set from hooks/patterns.json (plus patterns.local.json if present). Belt-and-suspenders alongside the secret-handling rules in Common.md §4. Emits a JSON permissionDecision deny on detection.

Git pre-commit hook and CI scanner that blocks commits containing secret-shaped strings. Two modes: (1) pre-commit — scans the staged diff (git diff --cached -U0) and aborts the commit on any match; (2) CI/range scan (--ci --base BASE --head HEAD) — scans the diff from BASE..HEAD for use in secret-scan.yml workflows. Reads canonical patterns from hooks/patterns.json.

Fires on Stop/SubagentStop. Compares changed source files on the current branch against changed test files. If code files changed but no corresponding test files changed, emits a TEST-COVERAGE-VIOLATION sentinel — non-blocking.

Enforces worktree-based feature development per Common.md §U17. Rule 1: blocks ‘git checkout -b’ and ‘git switch -c’ in the primary worktree — feature work must live in a linked worktree so the primary repo stays on main. Rule 2: blocks ‘git worktree add’ to non-canonical paths. Canonical paths: <repo>/.worktrees/<name>/ for single-repo work, <repo>/.claude/worktrees/<name>/ for Claude Code's native EnterWorktree tool, ~/.ai/worktrees/<name>/ for cross-repo or persistent worktrees.