From 39430385168c58f32c6e77e28374b67b370e2b11 Mon Sep 17 00:00:00 2001
From: zackees <zachvorhies@protonmail.com>
Date: Sat, 20 Jun 2026 14:29:23 -0700
Subject: [PATCH] chore(hooks): wedge-proof commands + drop project tool_guard
 (#712 follow-up)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two changes to .claude/settings.json:

1. Removed the project-local `tool_guard.py` PreToolUse hook — the user
   confirmed they install soldr/uv guards globally, so the duplicate
   fires twice without value. `forbidden_commands.py` (pyocd/esptool
   policy) stays as the project-specific Bash gate.

2. Every hook command is now wedge-proof:
   - Prefer `${CLAUDE_PROJECT_DIR}` (the harness anchor that survives
     worktree shifts) and fall back to `git rev-parse --show-toplevel`.
   - Wrap the actual `uv run` invocation in `[ -f <script> ] && ... || exit 0`
     so a worktree without `ci/hooks/` (e.g. the `online-data` orphan
     branch's worktree, or a freshly-orphaned branch mid-setup) cannot
     fail the hook startup and freeze the shell.

This was the catch-22 that wedged the original `online-data` orphan
setup in PR #712: `git rm -rf .` removed `ci/hooks/` from the worktree;
the PreToolUse hook command then resolved `git rev-parse --show-toplevel`
to that worktree, tried `uv run ci/hooks/tool_guard.py`, and python
errored with "no such file" — blocking every subsequent Bash/Edit/Write
call. The guard above turns the "script not found" case into a no-op
instead of a block.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .claude/settings.json | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index d5ac130d..11ae34f3 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -1,11 +1,12 @@
 {
+  "_comment": "Hook commands prefer $CLAUDE_PROJECT_DIR (the harness's anchor, survives worktree shifts) and fall back to git toplevel. Every hook also guards on `[ -f <script> ]` so that working from an orphan-branch worktree (which legitimately has no ci/hooks/) cannot wedge the shell. Removing this guard re-introduces the catch-22 we hit during the online-data orphan-branch setup. `tool_guard.py` is intentionally absent here — that one is installed globally.",
   "hooks": {
     "UserPromptSubmit": [
       {
         "hooks": [
           {
             "type": "command",
-            "command": "cd \"$(git rev-parse --show-toplevel)\" && uv run --no-project --script ci/hooks/board_context.py",
+            "command": "cd \"${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}\" && { [ -f ci/hooks/board_context.py ] && uv run --no-project --script ci/hooks/board_context.py || exit 0; }",
             "timeout": 5
           }
         ]
@@ -17,12 +18,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "cd \"$(git rev-parse --show-toplevel)\" && uv run --no-project --script ci/hooks/tool_guard.py",
-            "timeout": 5
-          },
-          {
-            "type": "command",
-            "command": "cd \"$(git rev-parse --show-toplevel)\" && uv run --no-project --script ci/hooks/forbidden_commands.py",
+            "command": "cd \"${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}\" && { [ -f ci/hooks/forbidden_commands.py ] && uv run --no-project --script ci/hooks/forbidden_commands.py || exit 0; }",
             "timeout": 5
           }
         ]
@@ -32,7 +28,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "cd \"$(git rev-parse --show-toplevel)\" && uv run --no-project --script ci/hooks/crate_guard.py",
+            "command": "cd \"${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}\" && { [ -f ci/hooks/crate_guard.py ] && uv run --no-project --script ci/hooks/crate_guard.py || exit 0; }",
             "timeout": 5
           }
         ]
@@ -44,7 +40,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "cd \"$(git rev-parse --show-toplevel)\" && uv run --no-project --script ci/hooks/readme_guard.py",
+            "command": "cd \"${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}\" && { [ -f ci/hooks/readme_guard.py ] && uv run --no-project --script ci/hooks/readme_guard.py || exit 0; }",
             "timeout": 5
           }
         ]
@@ -55,7 +51,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "cd \"$(git rev-parse --show-toplevel)\" && uv run --no-project --script ci/hooks/check-on-start.py",
+            "command": "cd \"${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}\" && { [ -f ci/hooks/check-on-start.py ] && uv run --no-project --script ci/hooks/check-on-start.py || exit 0; }",
             "timeout": 10
           }
         ]
@@ -66,12 +62,12 @@
         "hooks": [
           {
             "type": "command",
-            "command": "cd \"$(git rev-parse --show-toplevel)\" && uv run --no-project --script ci/hooks/code-review-on-stop.py",
+            "command": "cd \"${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}\" && { [ -f ci/hooks/code-review-on-stop.py ] && uv run --no-project --script ci/hooks/code-review-on-stop.py || exit 0; }",
             "timeout": 10
           },
           {
             "type": "command",
-            "command": "cd \"$(git rev-parse --show-toplevel)\" && uv run --no-project --script ci/hooks/check-on-stop.py",
+            "command": "cd \"${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}\" && { [ -f ci/hooks/check-on-stop.py ] && uv run --no-project --script ci/hooks/check-on-stop.py || exit 0; }",
             "timeout": 120
           }
         ]