repo-guard

1import type { EngineInterface, Register } from 'claude-code'
2
3// One shell segment: stops at ; & | and newlines so `git push && echo -f` is not a force push.
4const SEG = '[^;&|\\n]*'
5
6export const DANGER: ReadonlyArray<readonly [RegExp, string]> = [
7  [new RegExp(`\\bgit\\s+push\\b${SEG}\\s(--force(?!-with-lease)|-f\\b|\\+\\S)`), 'force push (use --force-with-lease, or run it yourself)'],
8  [new RegExp(`\\bgit\\s+push\\b${SEG}[\\s:](main|master)(\\s|$|[;&|])`), 'pushing straight to main/master'],
9  [new RegExp(`\\bgit\\s+reset\\b${SEG}\\s--hard\\b`), 'git reset --hard throws away uncommitted work'],
10  [new RegExp(`\\bgit\\s+clean\\b${SEG}\\s-[a-zA-Z]*f`), 'git clean -f deletes untracked files'],
11  [new RegExp(`\\bgit\\s+(checkout|restore)\\b${SEG}\\s\\.(\\s|$|[;&|])`), 'discarding every uncommitted change'],
12  [new RegExp(`\\bgit\\s+branch\\b${SEG}\\s-D\\b`), 'force-deleting a branch'],
13  [new RegExp(`\\bgit\\s+stash\\s+(drop|clear)\\b`), 'dropping stashes'],
14  [/\brm\s+-[a-zA-Z]*[rR][a-zA-Z]*\s+(\/|~|\$HOME)\/?(\s|$|\*)/, 'rm -r on / or your home directory'],
15]
16
17export function dangerOf(command: string): string | undefined {
18  return DANGER.find(([re]) => re.test(command))?.[1]
19}
20
21const EDIT_TOOLS: readonly string[] = ['Edit', 'Write', 'NotebookEdit']
22const isEditTool = (tool: string) => EDIT_TOOLS.includes(tool)
23const basename = (path: string) => path.replace(/\/+$/, '').split('/').pop() || path
24const parent = (path: string) => path.replace(/\/[^/]*\/?$/, '') || '/'
25
26let sessionRoot: string | null | undefined
27const approved = new Set<string>()
28
29/** The nearest folder above `path` holding .git, or null outside any repo. */
30async function repoRoot($: EngineInterface, path: string): Promise<string | null> {
31  for (let dir = parent(path); dir !== '/' && dir !== ''; dir = parent(dir)) {
32    if (await $.fs.exists(`${dir}/.git`)) return dir
33  }
34  return null
35}
36
37async function ownRoot($: EngineInterface): Promise<string | null> {
38  if (sessionRoot === undefined) {
39    const cwd = await $.session.cwd()
40    sessionRoot = await repoRoot($, `${cwd}/.`)
41  }
42  return sessionRoot
43}
44
45async function foreignRoot($: EngineInterface, input: unknown): Promise<string | null> {
46  const args = input as { file_path?: string; notebook_path?: string }
47  const path = args.file_path ?? args.notebook_path
48  if (typeof path !== 'string' || !path.startsWith('/')) return null
49  const root = await repoRoot($, path)
50  if (root === null || approved.has(root) || root === (await ownRoot($))) return null
51  return root
52}
53
54export const register: Register = on => {
55  on('tool.check', { tool: 'Bash' }, async ($, e, next) => {
56    const command = (e.input as { command?: string }).command ?? ''
57    const why = dangerOf(command)
58    if (why === undefined) return next(e)
59    $.ui.toast(`🛡 repo-guard blocked: ${why}`)
60    return {
61      decision: 'deny',
62      reason: `repo-guard: blocked (${why}). If it is really needed, ask the user to run it themselves.`,
63    }
64  }).catch(($, e, next) => next(e))
65
66  on('tool.check', async ($, e, next) => {
67    const verdict = await next(e)
68    if (!isEditTool(e.tool) || verdict.decision === 'deny') return verdict
69    const root = await foreignRoot($, e.input)
70    if (root === null) return verdict
71    const own = await ownRoot($)
72    return {
73      decision: 'ask',
74      reason: `repo-guard: this edits ${basename(root)}, a different repo from this session's ${own ? basename(own) : 'folder'}. Allow edits there?`,
75    }
76  }).catch(($, e, next) => next(e))
77
78  // Once an edit in another repo has gone through, stop asking for that repo.
79  on('tool.call', async ($, e, next) => {
80    const ran = await next(e)
81    if (!isEditTool(e.tool) || ran.deny !== undefined || ran.isError) return ran
82    const root = await foreignRoot($, e).catch(() => null)
83    if (root !== null) {
84      approved.add(root)
85      $.ui.toast(`🛡 Now editing another repo: ${basename(root)}`)
86    }
87    return ran
88  })
89}
90