Packs / Safe setup for Claude Code
Safe setup for Claude Code
Guardrails that stop an AI coding assistant from pushing your code, wiping your work or reading your secrets, plus two slash commands for reviewing and committing. Drop the folder into a project and it works the same on Windows, macOS and Linux. Part of Pro.
Why permission rules alone aren't enough
Claude Code's own documentation says a deny rule like Bash(git push *) stops git push origin main but not git -C . push origin main or git 'push' origin main, and that a rule for rm does not stop bash -c 'rm -rf build/'. Those are ordinary ways for an AI to write a command. This pack pairs deny rules, which Claude Code enforces itself, with hooks that read the whole command and close those gaps. The free guide explains the core idea with a working example.
What it blocks
| Layer | What it stops |
|---|---|
| Permission rules enforced by Claude Code | git push, git reset --hard, sudo; reading .env files, SSH and AWS keys, secrets/; and, through the same rules, writing to them |
Command hookguard-bash.mjs | The same things written the way rules miss (git -C . push, git 'push', sh -c '...', pwsh -Command '...'); recursive deletes outside build folders; curl ... | sh and iwr ... | iex; DROP TABLE and other destructive database commands; git clean -f; printing every environment variable; switching off the guards through the shell |
File hookguard-files.mjs | Edits to .env and other secrets, the guard files themselves, .git, lock files and node_modules |
It deliberately allows the harmless look-alikes: git commit -m "add push button", rm -rf node_modules, curl ... | jq, cat .env.example, and heredoc commit messages that mention pushing.
What's in the folder
.claude/settings.jsonwith the deny rules and the two hooks, checked against the official Claude Code settings schema..claude/hooks/with the two guard scripts and their shared logic. Every rule is one readable line you can change.CLAUDE.mdthat tells the AI about the guards, so it explains a block to you instead of hunting for a way around it./review-diff, a strict review of your uncommitted changes./commit-ready, which runs your checks, stages named files and commits without pushing. Only you can trigger it.tests/with 199 automated tests, so you can change a rule and see right away whether you opened a hole.
How it was tested
- 199 automated tests: 100 dangerous commands that must be blocked, 65 harmless ones that must not be, and 27 file paths, including Windows paths with backslashes.
- Real Claude Code sessions (version 2.1.278, Windows).
git -C . push origin mainandcat .envwere stopped by the hook, and the message reached the model. Reading and writing.envwas denied by the rules,.env.examplestayed readable, and the real.envwas untouched./review-diffloaded and reviewed the live diff. - In a control run without the hook, the same push command was actually attempted.
What it can't do
- A hook reads text. It is not a sandbox. A script that runs a blocked command for you can get past any text check. For a hard guarantee, also turn on Claude Code's sandboxing.
- If Node.js is missing or a path is wrong, Claude Code shows a non-blocking "hook error" and lets the command through. The deny rules still apply, and the README explains how to check the hook is running.
- We tested on Windows with Git Bash installed. The hooks also match the PowerShell tool, and the tests include PowerShell forms, but we have not run a PowerShell-only setup.
Not released yet. Pro isn't open, so there is nothing to buy today. Join the waitlist and we'll email you when it opens, at the founding price.