claude-composition-hook

A Claude Code PreToolUse hook that auto-approves composed Bash commands when every segment is individually covered by your permissions.allow list.

The Problem

Claude Code's permissions.allow list works for single commands:

"Bash(git log:*)"

But composed commands like git log | grep fix don't match — Claude Code falls through to manual approval even though both git log and grep are individually allowed.

The Solution

This hook intercepts every Bash tool call, splits composed commands into segments, checks each against your allow list, and auto-approves if all segments are allowed.

Installation

npx claude-composition-hook

That's it. The command detects it's running interactively and writes the hook config to ~/.claude/settings.json automatically.

If you prefer a global install:

npm install -g claude-composition-hook
claude-composition-hook

Configuration

After running setup, add the commands you want to allow in ~/.claude/settings.json:

{
  "permissions": {
    "allow": [
      "Bash(git log:*)",
      "Bash(grep:*)",
      "Bash(find:*)"
    ]
  }
}

The hook auto-approves composed commands (e.g. git log | grep fix) when every segment matches an entry in this list.

How It Works

1. Reads the JSON payload from stdin on every Bash tool call
2. Splits the command on |, &&, ||, ; — ignoring operators inside quotes
3. Strips leading VAR=value env-var assignments from each segment
4. Loads allowed prefixes from Bash(prefix:*) entries in:
   • ~/.claude/settings.json
   • {project}/.claude/settings.json
   • {project}/.claude/settings.local.json
5. Approves if all segments match an allowed prefix; otherwise exits silently (falls through to manual approval)

Supported Operators

| Operator | Example | |----------|---------| | \| (pipe) | git log \| grep fix | | && | git fetch && git log | | \|\| | git log \|\| echo fail | | ; | echo a; echo b |

Requirements

• Node.js >=18
• Claude Code with hooks support

License

MIT