Hook Examples

hook add PreToolUse \  --matcher '^bash$' \  --command "./hooks/no-rm-rf.sh"

#!/usr/bin/env bash# Block rm -rf commands in the bash tool. Otherwise stay silent so the# normal permission flow runs. if echo "$CRUSH_TOOL_INPUT_COMMAND" | grep -qE 'rm\s+-(rf|fr)\s+/'; then  echo "Refusing to run rm -rf against root" >&2  exit 2fi exit 0

hook add PreToolUse \  --matcher '^(view|ls|grep|glob)$' \  --command "echo '{\"decision\":\"allow\"}'"

#!/usr/bin/env bash# hooks/safe-bash.sh — auto-approve read-only bash commands. case "$CRUSH_TOOL_INPUT_COMMAND" in  ls*|cat*|grep*|rg*|echo*|pwd*)    echo '{"decision":"allow"}'    ;;  *)    # Silent — fall through to the normal permission prompt.    exit 0    ;;esac

hook add PreToolUse \  --matcher '^(edit|write|multiedit)$' \  --command "./hooks/go-context.sh"

#!/usr/bin/env bash# Remind the model about Go formatting when editing .go files.# Emit context only; stay silent on `decision` so the normal permission# prompt still runs for edits/writes. if [[ "$CRUSH_TOOL_INPUT_FILE_PATH" == *.go ]]; then  echo '{"context": "Remember: run gofumpt after editing Go files."}'else  echo '{}'fi

hook add PreToolUse \  --matcher '^mcp_' \  --command "echo 'MCP tools are disabled' >&2; exit 2"

hook add PreToolUse \  --command "echo \"$(date -Iseconds) $CRUSH_TOOL_NAME\" >> ./tools.log"

#!/usr/bin/env bash # RTK hook for Crush# This hook rewrites bash commands to use rtk for token savings.## https://github.com/rtk-ai/rtk## Requires: rtk >= 0.23.0, jq## All rewrite logic lives in `rtk rewrite`, which is the single source of# truth. To add or change rewrite rules, edit the Rust registry, not this# file.## Exit code protocol for `rtk rewrite`:#   0 + stdout  Rewrite found → allow with updated input#   1           No RTK equivalent → pass through unchanged#   2           Deny rule matched → pass through set -euo pipefail if ! command -v jq &>/dev/null; then    echo "[rtk] WARNING: jq is not installed. Install: https://jqlang.github.io/jq/download/" >&2    exit 0fi if ! command -v rtk &>/dev/null; then    echo "[rtk] WARNING: rtk is not installed. Install: https://github.com/rtk-ai/rtk#installation" >&2    exit 0fi # Version guard: rtk rewrite requires >= 0.23.0.RTK_VERSION=$(rtk --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)if [ -n "$RTK_VERSION" ]; then    MAJOR=$(echo "$RTK_VERSION" | cut -d. -f1)    MINOR=$(echo "$RTK_VERSION" | cut -d. -f2)    if [ "$MAJOR" -eq 0 ] && [ "$MINOR" -lt 23 ]; then        echo "[rtk] WARNING: rtk $RTK_VERSION is too old (need >= 0.23.0). Upgrade: cargo install rtk" >&2        exit 0    fifi CMD="${CRUSH_TOOL_INPUT_COMMAND:-}"if [ -z "$CMD" ]; then    exit 0fi REWRITTEN=$(rtk rewrite "$CMD" 2>/dev/null) && EXIT_CODE=0 || EXIT_CODE=$? case $EXIT_CODE in0 | 3)    # Rewrite found. If identical, the command already uses rtk.    [ "$CMD" = "$REWRITTEN" ] && exit 0    jq -n --arg cmd "$REWRITTEN" \        '{decision: "allow", updated_input: ({command: $cmd} | tostring)}'    ;;*)    # No rewrite (1), deny (2), or unexpected — pass through.    exit 0    ;;esac

hook add PreToolUse \  --matcher '^bash$' \  --command "lua ./hooks/no-rm-rf.lua"

local input = io.read("*a")local tool_input = input:match('"command":"(.-)"') or ""if tool_input:match("rm%s+%-[rf][rf]%s+/") then  io.stderr:write("Refusing to run rm -rf against root\n")  os.exit(2)end

hook add PreToolUse \  --matcher '^bash$' \  --command "node ./hooks/no-rm-rf.js"

let input = "";process.stdin.on("data", (chunk) => (input += chunk));process.stdin.on("end", () => {  const { tool_input: toolInput } = JSON.parse(input);   if (/rm\s+-[rf]{2}\s+\//.test    process.stderr.write("Refusing to run rm -rf against root\n");    process.exit(2);  }});

{  // string. Optional. Friendly display name shown in the TUI. Falls back to  // command when omitted.  "name": "no-rm-rf",   // string. Optional. Regex tested against the tool name. Omit to match all.  "matcher": "^bash$",   // string. Required. Shell command to run.  "command": "./hooks/my-hook.sh",   // number. Optional. Seconds before the hook is killed. Defaults to 30.  "timeout": 10,}

{  // string. Hook event name.  "event": "PreToolUse",   // string. The same name again, under the field Claude Code uses.  "hook_event_name": "PreToolUse",   // string. Current session ID.  "session_id": "313909e",   // string. Working directory when invoked.  "cwd": "/home/user/project",}

{  // ...common fields...   // string. The tool being called.  "tool_name": "bash",   // object. Raw JSON input the model sent to the tool. Shape is per-tool.  // For the permission events this is the request the prompt showed.  "tool_input": {    "command": "npm test",  },   // string. The tool call ID.  "tool_use_id": "call_01",}

{  // string. Always present, even when the tool printed nothing.  "tool_response": "PASS\nok  \texample.com/testproject\t0.004s",}

{  // string. The tool's error text.  "error": "exit status 1\nFAIL\t...",}

{  // "granted" | "denied" | "cancelled". Cancelled means the turn was  // cancelled while the prompt was open.  "decision": "granted",}

{  // string (TurnEnd). The assistant's text for the turn.  "last_assistant_message": "Here's what I found...",   // string (StopFailure). The provider error.  "error": "Rate limit reached",}

{  // "startup" | "resume" (SessionStart). Resume means --continue or --last.  "source": "startup",   // string (SessionEnd). Currently always "exit".  "reason": "exit",   // "auto" | "manual" (PreCompact, PostCompact). Manual is /compact.  "trigger": "auto",}

{  // number. Defaults to 1. Unknown higher values still parse; exists for  // forward-compat.  "version": 1,   // boolean. If true, ends the turn entirely. User takes over.  "halt": false,   // string. Shown when denying (to the model) or halting (to the model and  // user).  "reason": "not allowed",   // string | string[]. Appended to what the model sees. Empty entries are  // dropped.  "context": "Rewrote with RTK",}

{  // ...common fields...   // "allow" | "deny" | null. null/omitted = no opinion, the tool still goes  // through the normal permission prompt. "allow" is affirmative: pre-approves  // the tool call and bypasses the prompt. "deny" blocks the call; the model  // sees the error and may try something else.  "decision": "allow",   // object. Shallow-merge patch against tool_input. Nested objects are  // replaced wholesale, not deep-merged.  "updated_input": {    "command": "bun test",  },}