feat: add hook to prevent force push

Author: idoshamun

.claude/hooks/prevent-force-push.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# Prevent force push commands
+
+set -euo pipefail
+
+input_data=$(cat)
+cmd=$(echo "$input_data" | jq -r '.tool_input.command // empty')
+
+if [[ -z "$cmd" ]]; then
+  exit 0
+fi
+
+if [[ "$cmd" =~ git\ push.*(-f|--force) ]]; then
+  echo "Force push is not allowed" >&2
+  exit 2
+fi
+
+exit 0

.claude/settings.json

@@ -9,6 +9,15 @@
             "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/protect-files.sh"
           }
         ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/prevent-force-push.sh"
+          }
+        ]
       }
     ],
     "PostToolUse": [

AGENTS.md

@@ -106,4 +106,12 @@ This file provides guidance to coding agents when working with code in this repo
 
 ## Pull Requests
 
-Keep PR descriptions concise and to the point. Reviewers should not be exhausted by lengthy explanations.
+Keep PR descriptions concise and to the point. Reviewers should not be exhausted by lengthy explanations.
+
+## Claude Code Hooks
+
+Hooks are configured in `.claude/settings.json`:
+
+- **File Protection** (PreToolUse): Blocks edits to `pnpm-lock.yaml`, `src/migration/`, `.infra/Pulumi.*`, `.env`, `.git/`
+- **Prevent Force Push** (PreToolUse): Blocks `git push --force` and `git push -f`
+- **Auto-Lint** (PostToolUse): Runs `eslint --fix` on TypeScript files after edits