#!/bin/bash
# bash-safety.sh — PreToolUse / Bash
# Blocks destructive git and shell commands

COMMAND="$CLAUDE_TOOL_INPUT"

# Define blocked patterns
BLOCKED_PATTERNS=(
  "git commit"
  "git push --force"
  "git push -f"
  "git reset --hard"
  "git branch -D"
  "git branch -d -f"
  "rm -rf"
)

for pattern in "${BLOCKED_PATTERNS[@]}"; do
  if echo "$COMMAND" | grep -qi "$pattern"; then
    echo "BLOCKED: '$pattern' is not allowed."
    echo "Use GitButler for commits or ask the user first."
    exit 2
  fi
done

exit 0

#!/bin/bash
# file-protection.sh — PreToolUse / Edit + Write
# Blocks secrets, warns on sensitive config

FILE_PATH="$CLAUDE_FILE_PATH"
FILENAME=$(basename "$FILE_PATH")

# Hard block: secrets and credentials
case "$FILENAME" in
  .env|.env.*|credentials.*)
    echo "BLOCKED: Cannot edit $FILENAME"
    echo "This file may contain secrets."
    exit 2
    ;;
esac

# Soft warn: sensitive config
WARN_FILES="CLAUDE.md MEMORY.md settings.json"
if echo "$WARN_FILES" | grep -qw "$FILENAME"; then
  echo "WARNING: Editing $FILENAME — this affects Claude config."
  # Allow but warn (exit 0)
fi

exit 0

#!/bin/bash
# file-backup.sh — PreToolUse / Edit
# Backs up file before Claude edits it

FILE_PATH="$CLAUDE_FILE_PATH"
BACKUP_DIR="$HOME/.claude/backups"
mkdir -p "$BACKUP_DIR"

if [ ! -f "$FILE_PATH" ]; then
  exit 0 # New file, nothing to back up
fi

# Encode path: /foo/bar.md -> _foo_bar.md
SAFE_NAME=$(echo "$FILE_PATH" | sed 's|/|_|g')
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
cp "$FILE_PATH" "$BACKUP_DIR/${TIMESTAMP}${SAFE_NAME}"

# Keep only last 10 backups per file
ls -t "$BACKUP_DIR"/*"$SAFE_NAME" 2>/dev/null \
  | tail -n +11 \
  | xargs rm -f 2>/dev/null

exit 0

#!/bin/bash
# search-year.sh — PreToolUse / WebSearch
# Auto-appends current year to searches

QUERY="$CLAUDE_TOOL_INPUT"
CURRENT_YEAR=$(date +%Y)

# Check if a year is already in the query
if echo "$QUERY" | grep -qE "20[2-3][0-9]"; then
  exit 0 # Year present, no change needed
fi

# Append current year to the query
echo "MODIFIED_QUERY: $QUERY $CURRENT_YEAR"
exit 0

#!/bin/bash
# file-logger.sh — PostToolUse / Write + Edit
# Logs every file change to daily log

FILE_PATH="$CLAUDE_FILE_PATH"
TOOL_NAME="$CLAUDE_TOOL_NAME"
LOG_DIR="$HOME/.claude"
LOG_FILE="$LOG_DIR/changes-$(date +%Y-%m-%d).log"

TIMESTAMP=$(date +"%H:%M:%S")

echo "[$TIMESTAMP] $TOOL_NAME → $FILE_PATH" >> "$LOG_FILE"

exit 0

#!/bin/bash
# stop-notify.sh — Stop event
# Notification when Claude finishes

# Play system sound
afplay /System/Library/Sounds/Glass.aiff &

# Send macOS notification
osascript -e 'display notification "Task complete." with title "Claude Code" sound name "Glass"'

exit 0