What do I mean by "it doesn't work"? Well, claude code is really good at executing things in unusual ways when it needs to, and this is trying to parse shell to catch them.
When claude code has trouble running a bash command, it sometimes will say something like "The current environment is wonky, let's put it in a file and run that", and then use the edit tool to create 'tmp.sh' and then 'bash tmp.sh'. Which this plugin would allow, but would obviously let claude run anything.
I've also had claude reach for awk '{system(...)}', which this plugin doesn't prevent, among some others. A blacklist of "unix commands which can execute arbitrary code" is doomed to failure because there's just so many ways out there to do so.
Preventing destructive operations, like `rm -rf ~/`, is much more easily handled by running the agent in a container with only the code mounted into it, and then frequently committing changes and pushing them out of the container so that the agent can't delete its work history either.
Half-measures, like trying to parse shell commands and flags, is just going to lead to the agent hitting a wall and looping into doing weird things (leading to it being more likely to really screw things up), as opposed to something like containers or VMs which are easy to use and actually work.
I created the feature request for hooks so I could build an integrated governance capability.
I don’t quite yet think the real use cases for hooks has materialized. Through a couple more maturity phases it will. Even though it might seem paradoxical with “the models will just get better” - to which is exactly why we have to be hooked into the mech suits as they'll end up doing more involved things.
But I do pitch my initial , primitive, solution as “an early warning system” at best when used for security , but more so an actual way (opa/rego) to institute your own policies:
FWIW I think your approach is great, I had definitely thought about leveraging OPA in a mature way, I think this kind of thing is very appealing for platform engineers looking to scale AI codegen in enterprises
Ive had a lot of fun with random/creative hooks use cases: https://github.com/backnotprop/plannotator
I dont think the team meant for the hooks to work with plan mode this way (its not fully complete with approve/allow payload), but it enabled me to build an interactive UX I really wanted.
I experimented with hooks a lot over the summer, these kind of deterministic hooks that run before commit, after tool call, after edit, etc and I found they are much more effective if you are (unsurprisingly) able to craft and deliver a concise, helpful error message to the agent on the hook failure feedback. Even just giving it a good howToFix string in the error return isn’t enough, if you flood the response with too many of those at once the agent will view the task as insurmountable and start seeking workarounds instead.
LLM's do not "understand why." They do not have an "inkling."
Claiming they do is anthropomorphizing a statistical token (text) document generator algorithm.
100% - we really shouldn't anthropomorphize. But the current models are capable of being trained in a way to steer agentic behavior from reasoned token generation.
It will just as easily get around it by running it as a bash command or any number of ways.
Probably one better way to do this would be, if it detects a destructive edit, block it and switch Claude out of any autoaccept mode until the user re-engages it. If the model mostly doesn't realize there is a filter at all until it's blocked, it won't know to work around it until it's kicked the issue up to the user, who can prevent that and give it some strongly worded feedback. Just don't give it second and third tries to execute the destructive operation.
Not as good as giving it a checkpointed container to trash at its leisure though obviously.
I kept telling it to debug the problem, and that I had confirmed that database file was not the problem. It kept trying to rm the file after it noticed the code would recreate it (although with no data, just an empty db). I thought we got past this debate until I wasn't paying enough attention and it added an "rm db.sqlite" line into the Makefile and ran it, since I gave it permission to run "make" and didn't even consider it would edit the Makefile to get around my instructions.
The problem seems to come when it’s stuck in a debug death loop with full permissions.
WolfeReader•1h ago
thrdbndndn•1h ago
intev•1h ago
itemize123•1h ago
AdieuToLogic•1h ago
Skill entropy is a result of reliance on tools to perform tasks which otherwise would contribute to and/or reinforce a person's ability to master same. Without exercising one's acquired learning, skills can quickly fade.
For example, an argument can be made that spellcheckers commonly available in programs degrade people's ability to spell correctly without this assistance (such as when using pen and paper).
RogerL•1h ago
Just today Claude decided to do a git restore on me, blowing away local changes, despite having strict instructions to do nothing with git except to use it to look at history and branches.
Why jump to the conclusion that the person is so incompetent with no evidence?
intev•1h ago
joshribakoff•1h ago