Claude Code Hook 食譜：PreToolUse 攔截危險 bash（rm -rf／fork bomb／curl|sh）

# 目標：在 Claude Code 執行任何 Bash 指令「之前」攔截毀滅性命令
# 放到 .claude/settings.json（專案）或 ~/.claude/settings.json（全域，建議全域，全專案都保護）。
# 機制：PreToolUse hook 在工具執行前觸發；hook 從 stdin 收 JSON，
#       讀 tool_input.command 去比對危險 pattern；命中就 exit 2 → Claude Code 取消該動作。
#       這層連 --dangerously-skip-permissions 也擋得住，是真正的最後防線。

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash {{PROJECT_DIR}}/.claude/hooks/block-dangerous-commands.sh"
          }
        ]
      }
    ]
  }
}

# ---- .claude/hooks/block-dangerous-commands.sh ----
# chmod +x 後使用。命中危險 pattern：印理由到 stderr 並 exit 2（= 拒絕，AI 會看到原因）。
#!/usr/bin/env bash
set -euo pipefail

cmd=$(jq -r '.tool_input.command // empty')
[ -z "$cmd" ] && exit 0

deny() { echo "🛑 已被安全 hook 攔截：$1" >&2; echo "   指令：$cmd" >&2; exit 2; }

# 安全等級：critical（只擋毀系統）/ high（再加強推、reset --hard）/ strict（最謹慎）
SAFETY_LEVEL="{{SAFETY_LEVEL}}"   # 建議先用 high

# --- critical：任何等級都擋 ---
echo "$cmd" | grep -Eq 'rm[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*[fF]|-[a-zA-Z]*[fF][a-zA-Z]*[rR])([[:space:]]|$)' && deny "遞迴強制刪除（rm -rf）"
echo "$cmd" | grep -Eq 'rm[[:space:]]+.*[[:space:]](/|~|\$HOME|/\*)([[:space:]]|$)' && deny "對根目錄/家目錄刪除"
echo "$cmd" | grep -Eq ':\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:' && deny "fork bomb"
echo "$cmd" | grep -Eq '(curl|wget)[^|]*\|[[:space:]]*(sudo[[:space:]]+)?(ba)?sh' && deny "下載直接執行（curl|sh / wget|sh）"
echo "$cmd" | grep -Eq '(mkfs|>[[:space:]]*/dev/sd|dd[[:space:]]+if=.*of=/dev/)' && deny "直接寫入/格式化磁碟裝置"
echo "$cmd" | grep -Eq 'chmod[[:space:]]+-R[[:space:]]+777[[:space:]]+/' && deny "對根目錄 chmod 777"

# --- high：再加常見「無法復原」操作 ---
if [ "$SAFETY_LEVEL" = "high" ] || [ "$SAFETY_LEVEL" = "strict" ]; then
  echo "$cmd" | grep -Eq 'git[[:space:]]+push[[:space:]]+.*(--force|-f)([[:space:]]|$)' && deny "git 強制推送（可能覆蓋遠端歷史）"
  echo "$cmd" | grep -Eq 'git[[:space:]]+reset[[:space:]]+--hard' && deny "git reset --hard（丟棄未提交變更）"
  echo "$cmd" | grep -Eq 'git[[:space:]]+clean[[:space:]]+-[a-zA-Z]*[fd]' && deny "git clean -fd（刪除未追蹤檔案）"
fi

# --- strict：連批次刪除、sudo rm 都提醒 ---
if [ "$SAFETY_LEVEL" = "strict" ]; then
  echo "$cmd" | grep -Eq 'sudo[[:space:]]+rm' && deny "sudo rm（提權刪除）"
  echo "$cmd" | grep -Eq 'find[[:space:]]+.*-delete' && deny "find ... -delete（批次刪除）"
fi

exit 0   # 沒命中 → 放行

# 目標：在 Claude Code 執行任何 Bash 指令「之前」攔截毀滅性命令
# 放到 .claude/settings.json（專案）或 ~/.claude/settings.json（全域，建議全域，全專案都保護）。
# 機制：PreToolUse hook 在工具執行前觸發；hook 從 stdin 收 JSON，
#       讀 tool_input.command 去比對危險 pattern；命中就 exit 2 → Claude Code 取消該動作。
#       這層連 --dangerously-skip-permissions 也擋得住，是真正的最後防線。

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash {{PROJECT_DIR}}/.claude/hooks/block-dangerous-commands.sh"
          }
        ]
      }
    ]
  }
}

# ---- .claude/hooks/block-dangerous-commands.sh ----
# chmod +x 後使用。命中危險 pattern：印理由到 stderr 並 exit 2（= 拒絕，AI 會看到原因）。
#!/usr/bin/env bash
set -euo pipefail

cmd=$(jq -r '.tool_input.command // empty')
[ -z "$cmd" ] && exit 0

deny() { echo "🛑 已被安全 hook 攔截：$1" >&2; echo "   指令：$cmd" >&2; exit 2; }

# 安全等級：critical（只擋毀系統）/ high（再加強推、reset --hard）/ strict（最謹慎）
SAFETY_LEVEL="{{SAFETY_LEVEL}}"   # 建議先用 high

# --- critical：任何等級都擋 ---
echo "$cmd" | grep -Eq 'rm[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*[fF]|-[a-zA-Z]*[fF][a-zA-Z]*[rR])([[:space:]]|$)' && deny "遞迴強制刪除（rm -rf）"
echo "$cmd" | grep -Eq 'rm[[:space:]]+.*[[:space:]](/|~|\$HOME|/\*)([[:space:]]|$)' && deny "對根目錄/家目錄刪除"
echo "$cmd" | grep -Eq ':\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:' && deny "fork bomb"
echo "$cmd" | grep -Eq '(curl|wget)[^|]*\|[[:space:]]*(sudo[[:space:]]+)?(ba)?sh' && deny "下載直接執行（curl|sh / wget|sh）"
echo "$cmd" | grep -Eq '(mkfs|>[[:space:]]*/dev/sd|dd[[:space:]]+if=.*of=/dev/)' && deny "直接寫入/格式化磁碟裝置"
echo "$cmd" | grep -Eq 'chmod[[:space:]]+-R[[:space:]]+777[[:space:]]+/' && deny "對根目錄 chmod 777"

# --- high：再加常見「無法復原」操作 ---
if [ "$SAFETY_LEVEL" = "high" ] || [ "$SAFETY_LEVEL" = "strict" ]; then
  echo "$cmd" | grep -Eq 'git[[:space:]]+push[[:space:]]+.*(--force|-f)([[:space:]]|$)' && deny "git 強制推送（可能覆蓋遠端歷史）"
  echo "$cmd" | grep -Eq 'git[[:space:]]+reset[[:space:]]+--hard' && deny "git reset --hard（丟棄未提交變更）"
  echo "$cmd" | grep -Eq 'git[[:space:]]+clean[[:space:]]+-[a-zA-Z]*[fd]' && deny "git clean -fd（刪除未追蹤檔案）"
fi

# --- strict：連批次刪除、sudo rm 都提醒 ---
if [ "$SAFETY_LEVEL" = "strict" ]; then
  echo "$cmd" | grep -Eq 'sudo[[:space:]]+rm' && deny "sudo rm（提權刪除）"
  echo "$cmd" | grep -Eq 'find[[:space:]]+.*-delete' && deny "find ... -delete（批次刪除）"
fi

exit 0   # 沒命中 → 放行