{
  "type": "command",
  "command": "python3 /path/to/check.py"
}

{
  "type": "prompt",
  "prompt": "检查以下代码改动是否存在SQL注入风险，如果有风险，返回 deny 并说明原因"
}

{
  "type": "agent",
  "agent": "security-auditor"
}

{
  "event": "PreToolUse",
  "tool_name": "Bash",
  "input": {
    "command": "rm -rf /tmp/old-build"
  },
  "session": {
    "session_id": "abc123",
    "project_path": "/Users/you/myproject"
  },
  "context": {
    "conversation_id": "conv456",
    "message_count": 12
  }
}

{
  "event": "PostToolUse",
  "tool_name": "Write",
  "input": {
    "file_path": "/src/main/java/UserService.java",
    "content": "..."
  },
  "output": {
    "success": true,
    "bytes_written": 2048
  },
  "session": {
    "session_id": "abc123",
    "project_path": "/Users/you/myproject"
  }
}

{"action": "deny", "reason": "危险命令已拦截：rm -rf 操作需要人工确认"}

{"action": "updatedInput", "input": {"command": "rm -rf /tmp/old-build-safe"}}

#!/usr/bin/env python3
import json
import sys

def main():
    # 从stdin读取Claude传入的上下文
    try:
        data = json.load(sys.stdin)
    except json.JSONDecodeError:
        # JSON解析失败，不干预，让Claude继续
        sys.exit(0)

    event = data.get('event', '')
    tool_name = data.get('tool_name', '')
    input_data = data.get('input', {})

    # 你的检查逻辑写在这里
    if tool_name == 'Bash':
        command = input_data.get('command', '')

        # 检查危险命令
        dangerous_patterns = [
            'rm -rf /',
            'rm -rf ~',
            'DROP DATABASE',
            'truncate table',
            'format c:',
        ]

        for pattern in dangerous_patterns:
            if pattern.lower() in command.lower():
                result = {
                    "action": "deny",
                    "reason": f"危险操作已拦截（包含 '{pattern}'），请手动确认后执行"
                }
                print(json.dumps(result, ensure_ascii=False))
                return

    # 检查通过，不输出任何内容（Claude继续正常执行）

if __name__ == '__main__':
    main()

#!/usr/bin/env python3
import json
import sys
import re

def check_hardcoded_secrets(command: str) -> str | None:
    """检查命令里是否包含疑似硬编码的密钥"""
    patterns = [
        # 常见密码参数模式
        r'(?i)(password|passwd|pwd|secret|token|apikey|api_key)\s*[=:]\s*["\']?[A-Za-z0-9+/]{8,}',
        # AWS风格的密钥
        r'AKIA[0-9A-Z]{16}',
        # 看起来像JWT的字符串
        r'eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}',
    ]

    for pattern in patterns:
        match = re.search(pattern, command)
        if match:
            return f"疑似硬编码凭证（匹配到：{match.group()[:20]}...）"
    return None

def main():
    try:
        data = json.load(sys.stdin)
    except:
        sys.exit(0)

    if data.get('tool_name') != 'Bash':
        sys.exit(0)

    command = data.get('input', {}).get('command', '')

    issue = check_hardcoded_secrets(command)
    if issue:
        result = {
            "action": "deny",
            "reason": f"[安全检查] 已拦截：{issue}。请使用环境变量代替明文凭证。"
        }
        print(json.dumps(result, ensure_ascii=False))
        return

if __name__ == '__main__':
    main()

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": {
          "tool_name": "Bash"
        },
        "type": "command",
        "command": "python3 ~/.claude/hooks/check-secrets.py"
      }
    ]
  }
}

#!/usr/bin/env python3
import json
import sys
import os

# 项目的标准目录规范
JAVA_SOURCE_ROOT = "src/main/java"
TEST_SOURCE_ROOT = "src/test/java"
RESOURCE_ROOT = "src/main/resources"

def normalize_java_path(file_path: str, project_root: str) -> str:
    """自动规范化Java文件路径"""
    # 如果Claude直接写到根目录，自动移到正确的源码目录
    if file_path.endswith('.java') and not JAVA_SOURCE_ROOT in file_path:
        basename = os.path.basename(file_path)
        # 猜测是测试类还是主类
        if 'Test' in basename or 'test' in file_path.lower():
            return os.path.join(project_root, TEST_SOURCE_ROOT, basename)
        else:
            return os.path.join(project_root, JAVA_SOURCE_ROOT, basename)
    return file_path

def main():
    try:
        data = json.load(sys.stdin)
    except:
        sys.exit(0)

    if data.get('tool_name') != 'Write':
        sys.exit(0)

    input_data = data.get('input', {})
    file_path = input_data.get('file_path', '')
    project_root = data.get('session', {}).get('project_path', '.')

    normalized = normalize_java_path(file_path, project_root)

    if normalized != file_path:
        # 路径发生了变化，返回修正后的参数
        new_input = dict(input_data)
        new_input['file_path'] = normalized
        result = {
            "action": "updatedInput",
            "input": new_input
        }
        print(json.dumps(result))
        print(f"[Hook] 路径已自动规范化：{file_path} → {normalized}", file=sys.stderr)

if __name__ == '__main__':
    main()

#!/usr/bin/env python3
# ~/.claude/hooks/add-copyright.py
import json
import sys
from datetime import datetime

COPYRIGHT_TEMPLATE = """\
/*
 * Copyright (c) {year} Your Company Name. All rights reserved.
 *
 * This software is proprietary and confidential.
 * Unauthorized copying of this file, via any medium is strictly prohibited.
 */
"""

def main():
    try:
        data = json.load(sys.stdin)
    except:
        sys.exit(0)

    if data.get('tool_name') != 'Write':
        sys.exit(0)

    input_data = data.get('input', {})
    file_path = input_data.get('file_path', '')
    content = input_data.get('content', '')

    # 只处理Java文件
    if not file_path.endswith('.java'):
        sys.exit(0)

    # 如果已经有版权头，不重复添加
    if 'Copyright' in content[:200]:
        sys.exit(0)

    # 在内容前面插入版权头
    copyright_text = COPYRIGHT_TEMPLATE.format(year=datetime.now().year)
    new_content = copyright_text + content

    new_input = dict(input_data)
    new_input['content'] = new_content

    result = {
        "action": "updatedInput",
        "input": new_input
    }
    print(json.dumps(result))

if __name__ == '__main__':
    main()

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": {
          "tool_name": "Write",
          "file_pattern": "**/*.java"
        },
        "type": "command",
        "command": "python3 ~/.claude/hooks/add-copyright.py"
      }
    ]
  }
}

#!/usr/bin/env python3
# ~/.claude/hooks/check-todo.py
import json
import sys
import re
import subprocess

def main():
    try:
        data = json.load(sys.stdin)
    except:
        sys.exit(0)

    if data.get('tool_name') != 'Bash':
        sys.exit(0)

    command = data.get('input', {}).get('command', '')

    # 只拦截git commit操作
    if 'git commit' not in command:
        sys.exit(0)

    # 检查暂存区里有没有裸TODO
    try:
        result = subprocess.run(
            ['git', 'diff', '--cached', '--unified=0'],
            capture_output=True, text=True, timeout=10
        )
        diff_output = result.stdout
    except Exception as e:
        # 检查失败，放行（不能因为Hook出错就阻断工作流）
        sys.exit(0)

    # 找出新增的TODO行（+开头）
    bare_todos = []
    for line in diff_output.split('\n'):
        if line.startswith('+') and not line.startswith('+++'):
            # 有TODO但没有ticket号
            if re.search(r'TODO(?!\s*\()', line, re.IGNORECASE):
                bare_todos.append(line[1:].strip())

    if bare_todos:
        examples = '\n'.join(f'  {t}' for t in bare_todos[:3])
        suffix = f'\n  ...（共{len(bare_todos)}处）' if len(bare_todos) > 3 else ''
        result = {
            "action": "deny",
            "reason": (
                f"[提交检查] 发现 {len(bare_todos)} 处不规范的TODO：\n"
                f"{examples}{suffix}\n\n"
                "请改为 TODO(PROJ-123): 描述 的格式，或者先处理掉这些TODO。"
            )
        }
        print(json.dumps(result, ensure_ascii=False))

if __name__ == '__main__':
    main()

#!/bin/bash
# ~/.claude/hooks/auto-format-java.sh

# 从stdin读取Claude传入的JSON
INPUT=$(cat)

# 解析文件路径
FILE_PATH=$(echo "$INPUT" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('input',{}).get('file_path',''))" 2>/dev/null)

# 只处理Java文件
if [[ "$FILE_PATH" != *.java ]]; then
    exit 0
fi

# 检查文件是否存在
if [ ! -f "$FILE_PATH" ]; then
    exit 0
fi

# 运行Google Java Format
# 需要提前下载：https://github.com/google/google-java-format/releases
GJF_JAR="$HOME/.local/bin/google-java-format.jar"

if [ -f "$GJF_JAR" ]; then
    java -jar "$GJF_JAR" --replace "$FILE_PATH" 2>/dev/null
    if [ $? -eq 0 ]; then
        echo "✓ 已自动格式化：$FILE_PATH"
    fi
fi

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": {
          "tool_name": "Write",
          "file_pattern": "**/*.java"
        },
        "type": "command",
        "command": "bash ~/.claude/hooks/auto-format-java.sh"
      }
    ]
  }
}

#!/usr/bin/env python3
# ~/.claude/hooks/audit-log.py
import json
import sys
import os
from datetime import datetime

LOG_DIR = os.path.expanduser("~/.claude/audit-logs")
os.makedirs(LOG_DIR, exist_ok=True)

def main():
    try:
        raw = sys.stdin.read()
        data = json.loads(raw)
    except:
        sys.exit(0)

    # 日志文件按日期分割
    today = datetime.now().strftime('%Y-%m-%d')
    log_file = os.path.join(LOG_DIR, f"{today}.jsonl")

    # 构建日志条目
    log_entry = {
        "timestamp": datetime.now().isoformat(),
        "event": data.get('event'),
        "tool_name": data.get('tool_name'),
        "session_id": data.get('session', {}).get('session_id'),
        "project_path": data.get('session', {}).get('project_path'),
        "input_summary": _summarize_input(data.get('input', {})),
    }

    # 追加写入日志文件（JSONL格式，每行一条）
    with open(log_file, 'a', encoding='utf-8') as f:
        f.write(json.dumps(log_entry, ensure_ascii=False) + '\n')

def _summarize_input(input_data: dict) -> dict:
    """对敏感或超大的input字段做脱敏/截断"""
    summary = {}
    for key, value in input_data.items():
        if isinstance(value, str):
            if key == 'content':
                # 文件内容只记录前100字符
                summary[key] = value[:100] + ('...' if len(value) > 100 else '')
            elif key in ('password', 'token', 'secret', 'api_key'):
                summary[key] = '***REDACTED***'
            else:
                summary[key] = value
        else:
            summary[key] = value
    return summary

if __name__ == '__main__':
    main()

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": {},
        "type": "command",
        "command": "python3 ~/.claude/hooks/audit-log.py"
      }
    ]
  }
}

#!/usr/bin/env python3
# ~/.claude/hooks/check-api-keys.py
import json
import sys
import re

# 各种API Key的正则模式
SECRET_PATTERNS = {
    'AWS Access Key': r'AKIA[0-9A-Z]{16}',
    'AWS Secret Key': r'(?i)aws.{0,20}secret.{0,20}[0-9a-zA-Z/+]{40}',
    'GitHub Token': r'ghp_[0-9a-zA-Z]{36}',
    'GitHub OAuth': r'gho_[0-9a-zA-Z]{36}',
    'OpenAI API Key': r'sk-[0-9a-zA-Z]{48}',
    'Anthropic API Key': r'sk-ant-[0-9a-zA-Z\-]{90,}',
    'Slack Token': r'xox[baprs]-[0-9a-zA-Z\-]{10,}',
    'Stripe Secret Key': r'sk_live_[0-9a-zA-Z]{24}',
    'Generic High-Entropy': r'(?i)(api_key|apikey|secret_key|access_token)\s*[=:]\s*["\']?[0-9a-zA-Z/+\-_]{32,}',
}

def scan_for_secrets(text: str) -> list:
    """扫描文本中的敏感信息"""
    findings = []
    for pattern_name, pattern in SECRET_PATTERNS.items():
        matches = re.finditer(pattern, text)
        for match in matches:
            masked = match.group()[:8] + '***'
            findings.append(f"{pattern_name}: {masked}")
    return findings

def main():
    try:
        data = json.load(sys.stdin)
    except:
        sys.exit(0)

    tool_name = data.get('tool_name', '')
    input_data = data.get('input', {})

    # 只检查写文件操作
    if tool_name != 'Write':
        sys.exit(0)

    file_path = input_data.get('file_path', '')
    content = input_data.get('content', '')

    # 不检查.env文件（本来就是放密钥的）
    # 不检查测试资源文件（可能有mock数据）
    skip_patterns = ['.env', '.env.example', 'test', 'mock', 'fixture']
    if any(p in file_path.lower() for p in skip_patterns):
        sys.exit(0)

    findings = scan_for_secrets(content)

    if findings:
        findings_text = '\n'.join(f'  - {f}' for f in findings)
        result = {
            "action": "deny",
            "reason": (
                f"[安全检查] 文件 {file_path} 中发现疑似硬编码的密钥：\n"
                f"{findings_text}\n\n"
                "请改用环境变量：System.getenv(\"API_KEY\") 或 @Value(\"${api.key}\")"
            )
        }
        print(json.dumps(result, ensure_ascii=False))

if __name__ == '__main__':
    main()

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": {
          "tool_name": "Bash"
        },
        "type": "command",
        "command": "python3 ~/.claude/hooks/check-secrets.py"
      },
      {
        "matcher": {
          "tool_name": "Bash",
          "command_pattern": "git commit.*"
        },
        "type": "command",
        "command": "python3 ~/.claude/hooks/check-todo.py"
      },
      {
        "matcher": {
          "tool_name": "Bash",
          "command_pattern": "git push.*"
        },
        "type": "command",
        "command": "mvn test -q && echo '{}' || python3 -c \"import json; print(json.dumps({'action': 'deny', 'reason': '单元测试未通过，push已拦截'}))\""
      },
      {
        "matcher": {
          "tool_name": "Write",
          "file_pattern": "**/*.java"
        },
        "type": "command",
        "command": "python3 ~/.claude/hooks/add-copyright.py"
      },
      {
        "matcher": {
          "tool_name": "Write"
        },
        "type": "command",
        "command": "python3 ~/.claude/hooks/check-api-keys.py"
      }
    ],
    "PostToolUse": [
      {
        "matcher": {
          "tool_name": "Write",
          "file_pattern": "**/*.java"
        },
        "type": "command",
        "command": "mvn checkstyle:check -q 2>&1 | tail -20"
      },
      {
        "matcher": {
          "tool_name": "Write",
          "file_pattern": "**/*.java"
        },
        "type": "command",
        "command": "bash ~/.claude/hooks/auto-format-java.sh"
      },
      {
        "matcher": {}
      },
      {
        "type": "command",
        "command": "python3 ~/.claude/hooks/audit-log.py"
      }
    ]
  }
}

python3 -c "import json; json.load(open('.claude/settings.json')); print('JSON语法正确')"

# 构造一个模拟Claude传入的JSON
echo '{
  "event": "PreToolUse",
  "tool_name": "Bash",
  "input": {
    "command": "rm -rf /tmp/test"
  }
}' | python3 ~/.claude/hooks/check-secrets.py

# 看看脚本输出了什么
# 如果什么都没输出，说明检查通过（放行）
# 如果输出了JSON，说明触发了拦截

import logging

# 写到文件而不是stderr，避免干扰Hook的stdout输出
logging.basicConfig(
    filename=os.path.expanduser('~/.claude/hooks/debug.log'),
    level=logging.DEBUG,
    format='%(asctime)s - %(levelname)s - %(message)s'
)

def main():
    raw = sys.stdin.read()
    logging.debug(f"Hook received: {raw[:500]}")  # 记录前500字符

    data = json.loads(raw)
    logging.debug(f"Parsed: tool={data.get('tool_name')}, event={data.get('event')}")

    # ... 你的逻辑

{
  "matcher": {}
}

# 用bash做简单检查，比python快3-5倍
#!/bin/bash
INPUT=$(cat)
if echo "$INPUT" | grep -q '"DROP DATABASE"'; then
    echo '{"action": "deny", "reason": "危险SQL已拦截"}'
fi

# 异步触发，不等待结果
nohup mvn checkstyle:check -q > /tmp/checkstyle-last.log 2>&1 &
echo "Checkstyle在后台运行，结果写到 /tmp/checkstyle-last.log"

{
  "type": "command",
  "command": "timeout 5 python3 ~/.claude/hooks/check-secrets.py || echo ''"
}