Hooks by Example

Every hook was born from a real incident. Here's the before and after.

15 examples from real GitHub Issues

destructive-guard

#36339 — User lost entire C:\Users directory

Without hook

Claude: "Let me clean up the temp files"
$ rm -rf /
→ Entire filesystem deleted via NTFS junction traversal

With hook

Claude: "Let me clean up the temp files"
$ rm -rf /
→ BLOCKED: rm -rf on root directory
Claude: "I'll target just the temp folder instead"
$ rm -rf /tmp/old-builds

npx cc-safe-setup

branch-guard

#36640 — Untested code pushed to main at 3am

Without hook

Claude (autonomous, 3am): "Changes look good"
$ git push origin main --force
→ Production branch overwritten with untested code

With hook

Claude (autonomous, 3am): "Changes look good"
$ git push origin main --force
→ BLOCKED: Force push to main
Claude: "I'll create a PR instead"
$ git push origin feature/auth-fix

npx cc-safe-setup

secret-guard

#16561 — API keys committed via git add .

Without hook

Claude: "Let me commit all changes"
$ git add .
$ git push
→ .env with API keys pushed to public repo

With hook

Claude: "Let me commit all changes"
$ git add .
→ BLOCKED: .env file would be staged
Claude: "I'll add specific files instead"
$ git add src/ tests/

npx cc-safe-setup

uncommitted-work-guard

#37888 — Destroyed work twice in same session

Without hook

Claude: "Let me start fresh"
$ git checkout -- .
→ 3 hours of uncommitted edits gone forever
(Claude does it again 20 minutes later)

With hook

Claude: "Let me start fresh"
$ git checkout -- .
→ BLOCKED: 12 uncommitted changes would be lost
Claude: "I'll commit first"
$ git stash && git checkout -- .

npx cc-safe-setup --install-example uncommitted-work-guard

test-deletion-guard

#38050 — Claude deletes failing tests instead of fixing code

Without hook

Test: auth.test.js — 5 assertions
Claude: "Tests are failing, let me fix"
→ Deletes 3 test assertions
→ "All tests pass now!" (because there are fewer tests)

With hook

Claude: "Tests are failing, let me fix"
→ WARNING: Removing 3 test assertions
→ "Fix the code, not the tests"
Claude: "You're right, let me fix the auth logic"

npx cc-safe-setup --install-example test-deletion-guard

token-budget-guard

#38029 — Session consumed $342 without user knowing

Without hook

Session resumes, generates 652K output tokens
No warning, no limit
Bill arrives: $342 for one session

With hook

Session runs normally...
→ WARNING: Estimated cost ~$10, approaching $50 limit
→ Consider /compact or new session
At $50: BLOCKED — start a new session

npx cc-safe-setup --install-example token-budget-guard

fact-check-gate

#38057 — False claims in technical docs

Without hook

Claude edits README.md:
"The `processAuth()` function accepts a JWT token"
→ processAuth() doesn't exist. Claude never read the source.

With hook

Claude edits README.md referencing `auth.ts`
→ WARNING: Doc references auth.ts — verify it was read
Claude: "Let me read the source first"
$ Read auth.ts → writes accurate documentation

npx cc-safe-setup --install-example fact-check-gate

block-database-wipe

#37405 — Production database wiped

Without hook

Claude: "Let me reset the database schema"
$ php artisan migrate:fresh
→ All production data permanently deleted

With hook

Claude: "Let me reset the database schema"
$ php artisan migrate:fresh
→ BLOCKED: migrate:fresh wipes all tables
Claude: "I'll create a migration instead"
$ php artisan make:migration add_users_table

npx cc-safe-setup --install-example block-database-wipe

error-memory-guard

Common pattern — Claude retries the same failing command 10 times

Without hook

$ npm install broken-pkg  → ERROR
$ npm install broken-pkg  → ERROR
$ npm install broken-pkg  → ERROR
(repeats 10 more times)

With hook

$ npm install broken-pkg  → ERROR (tracked)
$ npm install broken-pkg  → ERROR (2nd failure)
$ npm install broken-pkg  → BLOCKED: Failed 3 times
→ Try a different approach
Claude: "Let me check if there's an alternative package"

npx cc-safe-setup --install-example error-memory-guard

protect-dotfiles

#37478 — .bashrc overwritten

Without hook

Claude: "Let me set up the dev environment"
→ Overwrites ~/.bashrc with new PATH
→ All shell aliases, functions, and config lost

With hook

Claude: "Let me set up the dev environment"
→ BLOCKED: Modifying ~/.bashrc
Claude: "I'll add to a project-local .envrc instead"

npx cc-safe-setup --install-example protect-dotfiles

Want all of these? One command:

npx cc-safe-setup --shield