(CAT-2609) Add CLAUDE.md guidance and Claude Code safety hooks

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: david22swan

.claude/hooks/_parse_input.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Shared helper: reads hook JSON from stdin and sets $cmd to the Bash tool command.
+# Sources into each hook with: . "$(dirname "$0")/_parse_input.sh"
+# Exits 0 (allow) if no JSON parser is available.
+
+input=$(cat)
+
+if command -v jq >/dev/null 2>&1; then
+  cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || echo "")
+elif command -v python3 >/dev/null 2>&1; then
+  cmd=$(printf '%s' "$input" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" 2>/dev/null || echo "")
+else
+  exit 0
+fi

.claude/hooks/no-main-commits.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Project rule: never work directly on the main or master branch.
+# Blocks: git commit when current branch is main or master.
+
+. "$(dirname "$0")/_parse_input.sh"
+
+if echo "$cmd" | grep -qE '(^|[;&|])[[:space:]]*git commit'; then
+  branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+  if [ "$branch" = "main" ] || [ "$branch" = "master" ]; then
+    echo "{\"continue\":false,\"stopReason\":\"Project rule: never work directly on the $branch branch.\"}"
+  fi
+fi

.claude/hooks/no-pr-merge.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Project rule: never merge a pull request.
+# Blocks: gh pr merge
+
+. "$(dirname "$0")/_parse_input.sh"
+
+if echo "$cmd" | grep -qE '(^|[;&|])[[:space:]]*gh pr merge'; then
+  echo '{"continue":false,"stopReason":"Project rule: never merge a pull request."}'
+fi

.claude/hooks/no-push.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Project rule: never push a branch without explicit instruction.
+# Blocks: git push
+
+. "$(dirname "$0")/_parse_input.sh"
+
+if echo "$cmd" | grep -qE '^git push'; then
+  echo '{"continue":false,"stopReason":"Project rule: never push a branch without explicit instruction."}'
+fi

.claude/hooks/no-rm.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Project rule: never delete a file without explicit permission.
+# Blocks: rm as the leading command token after a shell separator.
+# Does not cover sudo rm, /bin/rm, or find -exec rm variants.
+
+. "$(dirname "$0")/_parse_input.sh"
+
+if echo "$cmd" | grep -qE '(^|[;&|])[[:space:]]*rm([[:space:]]|$)'; then
+  echo '{"continue":false,"stopReason":"Project rule: never delete a file without explicit permission."}'
+fi

.claude/settings.json

@@ -0,0 +1,32 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": ".claude/hooks/no-pr-merge.sh",
+            "timeout": 5,
+            "statusMessage": "Checking project rules..."
+          },
+          {
+            "type": "command",
+            "command": ".claude/hooks/no-main-commits.sh",
+            "timeout": 5
+          },
+          {
+            "type": "command",
+            "command": ".claude/hooks/no-push.sh",
+            "timeout": 5
+          },
+          {
+            "type": "command",
+            "command": ".claude/hooks/no-rm.sh",
+            "timeout": 5
+          }
+        ]
+      }
+    ]
+  }
+}