Writing Hookify Rules by basher83/lunar-claude
npx skills add https://github.com/basher83/lunar-claude --skill 'Writing Hookify Rules'Hookify 规则是带有 YAML 前置元数据的 Markdown 文件,用于定义要监视的模式以及当这些模式匹配时要显示的消息。规则存储在 .claude/hookify.{规则名称}.local.md 文件中。
---
name: rule-identifier
enabled: true
event: bash|file|stop|prompt|all
pattern: regex-pattern-here
---
Message to show Claude when this rule triggers.
Can include markdown formatting, warnings, suggestions, etc.
name (必需):规则的唯一标识符
warn-dangerous-rm、block-console-logenabled (必需):激活/停用规则的布尔值
true:规则处于活动状态广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
false:规则被禁用(不会触发)event (必需):在哪个钩子事件上触发
bash:Bash 工具命令file:Edit、Write、MultiEdit 工具stop:当代理想要停止时prompt:当用户提交提示时all:所有事件action (可选):规则匹配时要执行的操作
warn:显示消息但允许操作(默认)block:阻止操作(PreToolUse)或停止会话(Stop 事件)warnpattern (简单格式):要匹配的正则表达式模式
示例:
event: bash
pattern: rm\s+-rf
对于具有多个条件的复杂规则:
---
name: warn-env-file-edits
enabled: true
event: file
conditions:
- field: file_path
operator: regex_match
pattern: \.env$
- field: new_text
operator: contains
pattern: API_KEY
---
You're adding an API key to a .env file. Ensure this file is in .gitignore!
条件字段:
field:要检查的字段
commandfile_path、new_text、old_text、contentoperator:匹配方式
regex_match:正则表达式模式匹配contains:子字符串检查equals:精确匹配not_contains:子字符串必须不存在starts_with:前缀检查ends_with:后缀检查pattern:要匹配的模式或字符串所有条件都必须匹配,规则才会触发。
前置元数据之后的 Markdown 内容会在规则触发时显示给 Claude。
好的消息:
示例:
⚠️ **Console.log detected!**
You're adding console.log to production code.
**Why this matters:**
- Debug logs shouldn't ship to production
- Console.log can expose sensitive data
- Impacts browser performance
**Alternatives:**
- Use a proper logging library
- Remove before committing
- Use conditional debug builds
匹配 Bash 命令模式:
---
event: bash
pattern: sudo\s+|rm\s+-rf|chmod\s+777
---
Dangerous command detected!
常见模式:
rm\s+-rf、dd\s+if=、mkfssudo\s+、su\s+chmod\s+777、chown\s+root匹配 Edit/Write/MultiEdit 操作:
---
event: file
pattern: console\.log\(|eval\(|innerHTML\s*=
---
Potentially problematic code pattern detected!
在不同字段上匹配:
---
event: file
conditions:
- field: file_path
operator: regex_match
pattern: \.tsx?$
- field: new_text
operator: regex_match
pattern: console\.log\(
---
Console.log in TypeScript file!
常见模式:
console\.log\(、debugger、print\(eval\(、innerHTML\s*=、dangerouslySetInnerHTML\.env$、credentials、\.pem$node_modules/、dist/、build/匹配当代理想要停止时(完成检查):
---
event: stop
pattern: .*
---
Before stopping, verify:
- [ ] Tests were run
- [ ] Build succeeded
- [ ] Documentation updated
用于:
匹配用户提示内容(高级):
---
event: prompt
conditions:
- field: user_prompt
operator: contains
pattern: deploy to production
---
Production deployment checklist:
- [ ] Tests passing?
- [ ] Reviewed by team?
- [ ] Monitoring ready?
字面字符: 大多数字符匹配自身
rm 匹配 "rm"console.log 匹配 "console.log"特殊字符需要转义:
. (任意字符) → \. (字面点)( ) → \( \) (字面括号)[ ] → \[ \] (字面方括号)常见元字符:
\s - 空白字符(空格、制表符、换行符)\d - 数字 (0-9)\w - 单词字符 (a-z、A-Z、0-9、_). - 任意字符+ - 一个或多个* - 零个或多个? - 零个或一个| - 或示例:
rm\s+-rf Matches: rm -rf, rm -rf
console\.log\( Matches: console.log(
(eval|exec)\( Matches: eval( or exec(
chmod\s+777 Matches: chmod 777, chmod 777
API_KEY\s*= Matches: API_KEY=, API_KEY =
使用前测试正则表达式模式:
python3 -c "import re; print(re.search(r'your_pattern', 'test text'))"
或使用在线正则表达式测试器(regex101.com,选择 Python 风格)。
太宽泛:
pattern: log # Matches "log", "login", "dialog", "catalog"
更好:console\.log\(|logger\.
太具体:
pattern: rm -rf /tmp # Only matches exact path
更好:rm\s+-rf
转义问题:
"pattern" 需要双反斜杠 \\spattern: \s 按原样工作位置: 所有规则都在 .claude/ 目录中
命名: .claude/hookify.{描述性名称}.local.md
Gitignore: 将 .claude/*.local.md 添加到 .gitignore
好名字:
hookify.dangerous-rm.local.mdhookify.console-log.local.mdhookify.require-tests.local.mdhookify.sensitive-files.local.md坏名字:
hookify.rule1.local.md(描述性不强)hookify.md(缺少 .local)danger.local.md(缺少 hookify 前缀).claude/hookify.{名称}.local.md 文件.local.md 文件临时: 在前置元数据中设置 enabled: false
永久: 删除 .local.md 文件
查看 ${CLAUDE_PLUGIN_ROOT}/examples/ 获取完整示例:
dangerous-rm.local.md - 阻止危险的 rm 命令console-log-warning.local.md - 关于 console.log 的警告sensitive-files-warning.local.md - 关于编辑 .env 文件的警告最小可行规则:
---
name: my-rule
enabled: true
event: bash
pattern: dangerous_command
---
Warning message here
带条件的规则:
---
name: my-rule
enabled: true
event: file
conditions:
- field: file_path
operator: regex_match
pattern: \.ts$
- field: new_text
operator: contains
pattern: any
---
Warning message
事件类型:
bash - Bash 命令file - 文件编辑stop - 完成检查prompt - 用户输入all - 所有事件字段选项:
commandfile_path、new_text、old_text、contentuser_prompt操作符:
regex_match、contains、equals、not_contains、starts_with、ends_with每周安装量
0
仓库
GitHub 星标数
14
首次出现
1970年1月1日
安全审计
Hookify rules are markdown files with YAML frontmatter that define patterns to watch for and messages to show when those patterns match. Rules are stored in .claude/hookify.{rule-name}.local.md files.
---
name: rule-identifier
enabled: true
event: bash|file|stop|prompt|all
pattern: regex-pattern-here
---
Message to show Claude when this rule triggers.
Can include markdown formatting, warnings, suggestions, etc.
name (required): Unique identifier for the rule
warn-dangerous-rm, block-console-logenabled (required): Boolean to activate/deactivate
true: Rule is activefalse: Rule is disabled (won't trigger)event (required): Which hook event to trigger on
bash: Bash tool commandsfile: Edit, Write, MultiEdit toolsstop: When agent wants to stopprompt: When user submits a promptall: All eventsaction (optional): What to do when rule matches
warn: Show message but allow operation (default)block: Prevent operation (PreToolUse) or stop session (Stop events)warnpattern (simple format): Regex pattern to match
Example:
event: bash
pattern: rm\s+-rf
For complex rules with multiple conditions:
---
name: warn-env-file-edits
enabled: true
event: file
conditions:
- field: file_path
operator: regex_match
pattern: \.env$
- field: new_text
operator: contains
pattern: API_KEY
---
You're adding an API key to a .env file. Ensure this file is in .gitignore!
Condition fields:
field: Which field to check
commandfile_path, new_text, old_text, contentoperator: How to match
regex_match: Regex pattern matchingcontains: Substring checkequals: Exact matchAll conditions must match for rule to trigger.
The markdown content after frontmatter is shown to Claude when the rule triggers.
Good messages:
Example:
⚠️ **Console.log detected!**
You're adding console.log to production code.
**Why this matters:**
- Debug logs shouldn't ship to production
- Console.log can expose sensitive data
- Impacts browser performance
**Alternatives:**
- Use a proper logging library
- Remove before committing
- Use conditional debug builds
Match Bash command patterns:
---
event: bash
pattern: sudo\s+|rm\s+-rf|chmod\s+777
---
Dangerous command detected!
Common patterns:
rm\s+-rf, dd\s+if=, mkfssudo\s+, su\s+chmod\s+777, chown\s+rootMatch Edit/Write/MultiEdit operations:
---
event: file
pattern: console\.log\(|eval\(|innerHTML\s*=
---
Potentially problematic code pattern detected!
Match on different fields:
---
event: file
conditions:
- field: file_path
operator: regex_match
pattern: \.tsx?$
- field: new_text
operator: regex_match
pattern: console\.log\(
---
Console.log in TypeScript file!
Common patterns:
console\.log\(, debugger, print\(eval\(, innerHTML\s*=, dangerouslySetInnerHTML\.env$, credentials, \.pem$node_modules/, dist/, Match when agent wants to stop (completion checks):
---
event: stop
pattern: .*
---
Before stopping, verify:
- [ ] Tests were run
- [ ] Build succeeded
- [ ] Documentation updated
Use for:
Match user prompt content (advanced):
---
event: prompt
conditions:
- field: user_prompt
operator: contains
pattern: deploy to production
---
Production deployment checklist:
- [ ] Tests passing?
- [ ] Reviewed by team?
- [ ] Monitoring ready?
Literal characters: Most characters match themselves
rm matches "rm"console.log matches "console.log"Special characters need escaping:
. (any char) → \. (literal dot)( ) → \( \) (literal parens)[ ] → \[ \] (literal brackets)Common metacharacters:
\s - whitespace (space, tab, newline)\d - digit (0-9)\w - word character (a-z, A-Z, 0-9, _). - any character+ - one or more* - zero or more? - zero or one| - ORExamples:
rm\s+-rf Matches: rm -rf, rm -rf
console\.log\( Matches: console.log(
(eval|exec)\( Matches: eval( or exec(
chmod\s+777 Matches: chmod 777, chmod 777
API_KEY\s*= Matches: API_KEY=, API_KEY =
Test regex patterns before using:
python3 -c "import re; print(re.search(r'your_pattern', 'test text'))"
Or use online regex testers (regex101.com with Python flavor).
Too broad:
pattern: log # Matches "log", "login", "dialog", "catalog"
Better: console\.log\(|logger\.
Too specific:
pattern: rm -rf /tmp # Only matches exact path
Better: rm\s+-rf
Escaping issues:
"pattern" requires double backslashes \\spattern: \s works as-isLocation: All rules in .claude/ directory Naming: .claude/hookify.{descriptive-name}.local.md Gitignore: Add .claude/*.local.md to .gitignore
Good names:
hookify.dangerous-rm.local.mdhookify.console-log.local.mdhookify.require-tests.local.mdhookify.sensitive-files.local.mdBad names:
hookify.rule1.local.md (not descriptive)hookify.md (missing .local)danger.local.md (missing hookify prefix).claude/hookify.{name}.local.md file in project root.local.md fileTemporary: Set enabled: false in frontmatter Permanent: Delete the .local.md file
See ${CLAUDE_PLUGIN_ROOT}/examples/ for complete examples:
dangerous-rm.local.md - Block dangerous rm commandsconsole-log-warning.local.md - Warn about console.logsensitive-files-warning.local.md - Warn about editing .env filesMinimum viable rule:
---
name: my-rule
enabled: true
event: bash
pattern: dangerous_command
---
Warning message here
Rule with conditions:
---
name: my-rule
enabled: true
event: file
conditions:
- field: file_path
operator: regex_match
pattern: \.ts$
- field: new_text
operator: contains
pattern: any
---
Warning message
Event types:
bash - Bash commandsfile - File editsstop - Completion checksprompt - User inputall - All eventsField options:
commandfile_path, new_text, old_text, contentuser_promptOperators:
regex_match, contains, equals, not_contains, starts_with, ends_withWeekly Installs
0
Repository
GitHub Stars
14
First Seen
Jan 1, 1970
Security Audits
agent-browser 浏览器自动化工具 - Vercel Labs 命令行网页操作与测试
140,500 周安装
not_contains: Substring must NOT be presentstarts_with: Prefix checkends_with: Suffix checkpattern: Pattern or string to matchbuild/