(CAT-2609) Improve reliability and coverage of Claude safety hooks

Updates the shell hooks to more robustly detect git and rm commands by handling environment variables, absolute paths, and common wrappers like sudo or xargs. Also refactors input parsing to pipe directly into JSON parsers and adds ShellCheck directives for script maintenance.

Author: david22swan

.claude/hooks/_parse_input.sh

@@ -3,12 +3,10 @@
 # Sources into each hook with: . "$(dirname "$0")/_parse_input.sh"
 # Exits 0 (allow) if no JSON parser is available.
 
-input=$(cat)
-
 if command -v jq >/dev/null 2>&1; then
-  cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || echo "")
+  cmd=$(jq -r '.tool_input.command // ""' 2>/dev/null || echo "")
 elif command -v python3 >/dev/null 2>&1; then
-  cmd=$(printf '%s' "$input" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" 2>/dev/null || echo "")
+  cmd=$(python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" 2>/dev/null || echo "")
 else
   exit 0
 fi

.claude/hooks/no-main-commits.sh

@@ -2,9 +2,10 @@
 # Project rule: never work directly on the main or master branch.
 # Blocks: git commit when current branch is main or master.
 
+# shellcheck source=/dev/null
 . "$(dirname "$0")/_parse_input.sh"
 
-if echo "$cmd" | grep -qE '(^|[;&|])[[:space:]]*git commit'; then
+if echo "$cmd" | grep -qE '(^|[;&|`(])[[:space:]]*(([[:alpha:]_][[:alnum:]_]*=[^[:space:]]*[[:space:]]+)*)([^[:space:]]*/)?git[[:space:]]+commit([[:space:]]|$|[;&|])'; then
   branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
   if [ "$branch" = "main" ] || [ "$branch" = "master" ]; then
     echo "{\"continue\":false,\"stopReason\":\"Project rule: never work directly on the $branch branch.\"}"

.claude/hooks/no-pr-merge.sh

@@ -2,6 +2,7 @@
 # Project rule: never merge a pull request.
 # Blocks: gh pr merge
 
+# shellcheck source=/dev/null
 . "$(dirname "$0")/_parse_input.sh"
 
 if echo "$cmd" | grep -qE '(^|[;&|])[[:space:]]*gh pr merge'; then

.claude/hooks/no-push.sh

@@ -2,8 +2,9 @@
 # Project rule: never push a branch without explicit instruction.
 # Blocks: git push
 
+# shellcheck source=/dev/null
 . "$(dirname "$0")/_parse_input.sh"
 
-if echo "$cmd" | grep -qE '^git push'; then
+if echo "$cmd" | grep -qE '(^|[;&|`(])[[:space:]]*(([[:alpha:]_][[:alnum:]_]*=[^[:space:]]*[[:space:]]+)*)([^[:space:]]*/)?git[[:space:]]+push([[:space:]]|$|[;&|])'; then
   echo '{"continue":false,"stopReason":"Project rule: never push a branch without explicit instruction."}'
 fi

.claude/hooks/no-rm.sh

@@ -1,10 +1,11 @@
 #!/usr/bin/env bash
 # Project rule: never delete a file without explicit permission.
-# Blocks: rm as the leading command token after a shell separator.
-# Does not cover sudo rm, /bin/rm, or find -exec rm variants.
+# Blocks: rm, sudo rm, xargs rm, /bin/rm, /usr/bin/rm (and similar absolute paths).
+# Does not cover: find -exec rm (rm as a subprocess argument, not a shell token).
 
+# shellcheck source=/dev/null
 . "$(dirname "$0")/_parse_input.sh"
 
-if echo "$cmd" | grep -qE '(^|[;&|])[[:space:]]*rm([[:space:]]|$)'; then
+if echo "$cmd" | grep -qE '(^|[;&|])[[:space:]]*(sudo[[:space:]]+|xargs[[:space:]]+)?([^[:space:]]*/)?rm([[:space:]]|$)'; then
   echo '{"continue":false,"stopReason":"Project rule: never delete a file without explicit permission."}'
 fi

CLAUDE.md

@@ -97,7 +97,8 @@ If you change template behavior, update:
 ## Project Rules
 
 - At the start of a coding session, review the repository structure and any relevant README or documentation files to understand the area you are working in.
-- Always read the files relevant to the task before suggesting or making a change.- Never merge a pull request.
+- Always read the files relevant to the task before suggesting or making a change.
+- Never merge a pull request.
 - Never work directly on the `main` or `master` branch.
 - Never push a branch without explicit instruction.
 - Never delete a file without permission — this applies even after a blanket "yes to all".