Claude Code: prompt before git/gh write operations and PR instructions#1377
Open
labkey-martyp wants to merge 4 commits into
Open
Claude Code: prompt before git/gh write operations and PR instructions#1377labkey-martyp wants to merge 4 commits into
labkey-martyp wants to merge 4 commits into
Conversation
Add Git Branch Naming section covering develop, feature branches (snake_case label), release-targeted branches, and SNAPSHOT/release branches. Expand Pull Request Format to defer to pull_request_template.md when present and require user confirmation before creating branches or PRs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add .claude/hooks/*.log so debug-log output from the Claude Code PreToolUse hooks isn't tracked. Add a top-level __pycache__/ and *.pyc section so bytecode generated by those hooks (and any other Python under .claude/) stays out of the repo. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds permissions.ask entries so that git push/commit/reset --hard, branch -D/creation, and gh pr create/merge/close require user confirmation before executing. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
check-dangerous-commands.py now emits permissionDecision=ask for git/gh write operations (push, commit, reset --hard, branch -D, branch creation, gh pr create/merge/close). Both hook scripts gain an opt-in DEBUG log written to .claude/hooks/hooks.log. The test harness is extended to recognize ASK alongside BLOCK/ALLOW. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
labkey-martyp
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rationale
When working with the Claude Code agent, certain git and
ghcommands should be confirmed by the user. This branch makes the agent surface a confirmation prompt before any of those, instead of executing silently.Additionally, Claude creating PRs should follow our established templates and creating feature branches should follow our feature branch naming convention.
Why both a hook and
permissions.ask? Belt and suspenders — each layer covers the other's blind spots:--dangerously-skip-permissionsbypassessettings.jsonpermission rules but not the hook, so the hook still prompts in YOLO sessions.settings.jsonpermission rule, so the rule still prompts on subsequent invocations.--forcepush from plain push, catch plaingit branch <name>branch creation, and match inside compound commands. It also emits tailored confirmation messages (e.g., "git force-push detected — confirm before proceeding").settings.jsonrule needs no extra code execution — it is declarative, evaluated by the harness directly, and easy to audit or extend per project.Related Pull Requests
Changes
.claude/settings.json— newpermissions.askentries forgit push,git commit,git reset --hard,git branch -D,git checkout -b,git switch -c|-C, andgh pr create|merge|close..claude/hooks/check-dangerous-commands.py— newGIT_ASK_PATTERNSandcheck_git_for_ask(). ReturnspermissionDecision: askwith a tailored reason for the matched op..claude/hooks/check-secrets-file.py— small refactor so the blockreasonstring can also be threaded into the debug log..claude/hooks/test-hooks.py— test harness now recognizesASKas a third outcome alongsideBLOCK/ALLOW; newGIT_ASK_TESTStable exercises positive and negative cases for every new pattern.DEBUGflag that appends to.claude/hooks/hooks.log(gitignored, default off)..gitignore— exclude.claude/hooks/*.logand Python bytecode.CLAUDE.md— document git branch naming and PR conventions so future agent sessions follow them automatically.