|
| 1 | +#!/usr/bin/env bash |
| 2 | +# validate-openspec-path.sh — Pre-execution hook (OpenSpec location guardrail) |
| 3 | +# |
| 4 | +# Claude Code invokes this hook before Bash / Write / Edit / MultiEdit tool calls. |
| 5 | +# It enforces that OpenSpec specs and changes are created PER-PACKAGE, never at |
| 6 | +# the monorepo root. OpenSpec resolves its `openspec/` directory relative to the |
| 7 | +# current working directory, so the root `openspec/` must stay off-limits. |
| 8 | +# |
| 9 | +# Input: JSON on stdin {"tool_name":"...","tool_input":{...},"cwd":"..."} |
| 10 | +# Output: exit 0 to allow, exit 2 with JSON {"error":"..."} to block. |
| 11 | +# |
| 12 | +# IMPORTANT: Do not modify, disable, or bypass this hook. |
| 13 | + |
| 14 | +set -euo pipefail |
| 15 | + |
| 16 | +INPUT="$(cat)" |
| 17 | + |
| 18 | +field() { |
| 19 | + # $1 = dotted path into the JSON (e.g. tool_input.file_path) |
| 20 | + printf '%s' "$INPUT" | python3 -c " |
| 21 | +import sys, json |
| 22 | +d = json.load(sys.stdin) |
| 23 | +cur = d |
| 24 | +for k in '''$1'''.split('.'): |
| 25 | + if isinstance(cur, dict): |
| 26 | + cur = cur.get(k, '') |
| 27 | + else: |
| 28 | + cur = '' |
| 29 | +print(cur if isinstance(cur, str) else '') |
| 30 | +" 2>/dev/null || true |
| 31 | +} |
| 32 | + |
| 33 | +TOOL_NAME="$(field tool_name)" |
| 34 | + |
| 35 | +# Resolve the repo root. Claude Code exports CLAUDE_PROJECT_DIR for hooks; fall |
| 36 | +# back to the hook's reported cwd, then to the process cwd. |
| 37 | +REPO_ROOT="${CLAUDE_PROJECT_DIR:-}" |
| 38 | +if [[ -z "$REPO_ROOT" ]]; then |
| 39 | + REPO_ROOT="$(field cwd)" |
| 40 | +fi |
| 41 | +if [[ -z "$REPO_ROOT" ]]; then |
| 42 | + REPO_ROOT="$PWD" |
| 43 | +fi |
| 44 | +REPO_ROOT="${REPO_ROOT%/}" |
| 45 | + |
| 46 | +ROOT_OPENSPEC="$REPO_ROOT/openspec" |
| 47 | + |
| 48 | +block() { |
| 49 | + printf '{"error":"BLOCKED by OpenSpec guardrail: %s Specs/changes are per-package. cd into the target package (e.g. packages/pluggableWidgets/<widget>) and run openspec there — never at the monorepo root."}\n' "$1" >&2 |
| 50 | + exit 2 |
| 51 | +} |
| 52 | + |
| 53 | +case "$TOOL_NAME" in |
| 54 | + Write|Edit|MultiEdit) |
| 55 | + FILE_PATH="$(field tool_input.file_path)" |
| 56 | + [[ -z "$FILE_PATH" ]] && exit 0 |
| 57 | + |
| 58 | + # Normalize relative paths against the repo root. |
| 59 | + case "$FILE_PATH" in |
| 60 | + /*) ABS="$FILE_PATH" ;; |
| 61 | + *) ABS="$REPO_ROOT/$FILE_PATH" ;; |
| 62 | + esac |
| 63 | + |
| 64 | + # Block writes into the ROOT openspec changes/specs trees only. |
| 65 | + case "$ABS" in |
| 66 | + "$ROOT_OPENSPEC"/changes/*|"$ROOT_OPENSPEC"/specs/*) |
| 67 | + block "cannot write '$FILE_PATH' under the root openspec/ directory." |
| 68 | + ;; |
| 69 | + esac |
| 70 | + exit 0 |
| 71 | + ;; |
| 72 | + |
| 73 | + Bash) |
| 74 | + COMMAND="$(field tool_input.command)" |
| 75 | + [[ -z "$COMMAND" ]] && exit 0 |
| 76 | + |
| 77 | + CMD_LOWER="$(printf '%s' "$COMMAND" | tr '[:upper:]' '[:lower:]')" |
| 78 | + |
| 79 | + # Only care about spec-creating openspec subcommands. |
| 80 | + if [[ "$CMD_LOWER" == *"openspec new"* \ |
| 81 | + || "$CMD_LOWER" == *"openspec init"* \ |
| 82 | + || "$CMD_LOWER" == *"openspec archive"* ]]; then |
| 83 | + # Allow it only when the command first cd's into a package directory. |
| 84 | + if [[ "$CMD_LOWER" == *"cd "*"packages/"* ]]; then |
| 85 | + exit 0 |
| 86 | + fi |
| 87 | + block "'openspec new/init/archive' must run inside a package." |
| 88 | + fi |
| 89 | + exit 0 |
| 90 | + ;; |
| 91 | + |
| 92 | + *) |
| 93 | + exit 0 |
| 94 | + ;; |
| 95 | +esac |
0 commit comments