Claude Code Hooks— Practical Techniques to Automate Your Dev Workflow

#!/bin/bash
# .claude/hooks/security-guard.sh
# PreToolUse hook — blocks writes to sensitive files
 
FILEPATH="$1"
 
# Sensitive file patterns
SENSITIVE_PATTERNS=(
  "*.env"
  "*.env.*"
  "*credentials*"
  "*secret*"
  "*.pem"
  "*.key"
  "*config/production*"
)
 
for pattern in "${SENSITIVE_PATTERNS[@]}"; do
  if [[ "$FILEPATH" == $pattern ]]; then
    echo "🚫 Security alert: Blocked write to sensitive file '$FILEPATH'"
    echo "Edit manually or grant explicit permission."
    exit 2  # exit 2 = block tool execution
  fi
done
 
# Check for hardcoded secrets in file content
if [ -f "$FILEPATH" ]; then
  if grep -qiE '(api[_-]?key|secret[_-]?key|password|token)\s*[:=]\s*["\x27][^\s]+' "$FILEPATH" 2>/dev/null; then
    echo "⚠️ Warning: Hardcoded credentials detected in file"
    echo "Use environment variables instead."
    exit 2
  fi
fi
 
exit 0  # All clear — allow tool execution

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit|Write",
        "hook": {
          "type": "command",
          "command": "bash .claude/hooks/security-guard.sh \"$FILEPATH\""
        }
      }
    ]
  }
}

#!/bin/bash
# .claude/hooks/post-edit-lint.sh
# PostToolUse hook — auto-lint and format after edits
 
FILEPATH="$1"
EXTENSION="${FILEPATH##*.}"
 
case "$EXTENSION" in
  ts|tsx)
    echo "🔍 TypeScript: Running ESLint..."
    npx eslint --fix "$FILEPATH" 2>&1
    echo "💅 Formatting with Prettier..."
    npx prettier --write "$FILEPATH" 2>&1
    ;;
  py)
    echo "🔍 Python: Running Ruff..."
    ruff check --fix "$FILEPATH" 2>&1
    ruff format "$FILEPATH" 2>&1
    ;;
  rs)
    echo "🔍 Rust: Running cargo fmt..."
    rustfmt "$FILEPATH" 2>&1
    ;;
  go)
    echo "🔍 Go: Running gofmt..."
    gofmt -w "$FILEPATH" 2>&1
    ;;
  *)
    echo "📝 No linter configured for .$EXTENSION files"
    ;;
esac
 
exit 0

#!/bin/bash
# .claude/hooks/auto-test.sh
# PostToolUse hook — automatically run related tests
 
FILEPATH="$1"
DIR=$(dirname "$FILEPATH")
BASENAME=$(basename "$FILEPATH" | sed 's/\.[^.]*$//')
 
# Look for test file candidates
TEST_FILES=()
for pattern in \
  "${DIR}/${BASENAME}.test.ts" \
  "${DIR}/${BASENAME}.test.tsx" \
  "${DIR}/${BASENAME}.spec.ts" \
  "${DIR}/__tests__/${BASENAME}.test.ts" \
  "tests/${BASENAME}.test.ts"; do
  if [ -f "$pattern" ]; then
    TEST_FILES+=("$pattern")
  fi
done
 
if [ ${#TEST_FILES[@]} -eq 0 ]; then
  echo "📝 No related test files found"
  exit 0
fi
 
echo "🧪 Running related tests..."
for test_file in "${TEST_FILES[@]}"; do
  echo "  → $test_file"
  npx vitest run "$test_file" --reporter=verbose 2>&1
done
 
# Don't block on test failures — let Claude see the feedback
exit 0

#!/bin/bash
# .claude/hooks/git-safety.sh
# PreToolUse hook — block dangerous Git operations
 
COMMAND="$1"
 
# Dangerous Git command patterns
DANGEROUS_PATTERNS=(
  "git push.*--force"
  "git push.*-f "
  "git reset --hard"
  "git checkout \."
  "git clean -fd"
  "git branch -D"
  "git rebase.*main"
)
 
for pattern in "${DANGEROUS_PATTERNS[@]}"; do
  if echo "$COMMAND" | grep -qE "$pattern"; then
    echo "🚫 Dangerous Git operation detected: $COMMAND"
    echo "This operation risks data loss."
    echo "Run it manually or use a safer alternative."
    exit 2
  fi
done
 
exit 0

#!/bin/bash
# .claude/hooks/notify-slack.sh
# Notification hook — send alerts via Slack Webhook
 
MESSAGE="$1"
SLACK_WEBHOOK_URL="${SLACK_WEBHOOK_URL:-}"
 
if [ -z "$SLACK_WEBHOOK_URL" ]; then
  exit 0  # Skip if webhook not configured
fi
 
# Format and send to Slack
PAYLOAD=$(cat <<EOF
{
  "text": "🤖 Claude Code Notification",
  "blocks": [
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*Notification from Claude Code:*\n${MESSAGE}"
      }
    },
    {
      "type": "context",
      "elements": [
        {
          "type": "mrkdwn",
          "text": "📁 Project: $(basename $(pwd)) | ⏰ $(date '+%Y-%m-%d %H:%M')"
        }
      ]
    }
  ]
}
EOF
)
 
curl -s -X POST "$SLACK_WEBHOOK_URL" \
  -H 'Content-type: application/json' \
  -d "$PAYLOAD" > /dev/null 2>&1
 
exit 0

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit|Write",
        "hook": {
          "type": "command",
          "command": "bash .claude/hooks/security-guard.sh \"$FILEPATH\""
        }
      },
      {
        "matcher": "Bash",
        "hook": {
          "type": "command",
          "command": "bash .claude/hooks/git-safety.sh \"$COMMAND\""
        }
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hook": {
          "type": "command",
          "command": "bash .claude/hooks/post-edit-lint.sh \"$FILEPATH\""
        }
      },
      {
        "matcher": "Edit|Write",
        "hook": {
          "type": "command",
          "command": "bash .claude/hooks/auto-test.sh \"$FILEPATH\""
        }
      }
    ],
    "Notification": [
      {
        "matcher": "",
        "hook": {
          "type": "command",
          "command": "bash .claude/hooks/notify-slack.sh \"$MESSAGE\""
        }
      }
    ],
    "Stop": [
      {
        "matcher": "",
        "hook": {
          "type": "command",
          "command": "bash .claude/hooks/on-stop.sh"
        }
      }
    ]
  }
}

#!/bin/bash
# Run heavy tasks in the background
nohup bash -c "npm run test:coverage" > /tmp/test-results.log 2>&1 &
echo "🧪 Tests running in background (results: /tmp/test-results.log)"
exit 0

#!/bin/bash
# Debug logging
LOG_FILE="/tmp/claude-hooks.log"
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Hook: $0 | Args: $@" >> "$LOG_FILE"
 
# Main logic...
 
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Hook completed: $0 | Exit: $?" >> "$LOG_FILE"

#!/bin/bash
# Adjust hook strictness based on environment
HOOK_MODE="${CLAUDE_HOOK_MODE:-strict}"
 
if [ "$HOOK_MODE" = "permissive" ]; then
  echo "📝 Permissive mode: Skipping checks"
  exit 0
fi
 
# Strict mode processing...