Block Project-Settings Changes Without a Reviewer Flag
Project-level settings are meant to be reviewed via a PR like any other checked-in file — this adds a second gate at the hook layer specifically for mid-session edits to that file, distinct from the general-purpose settings-change log that covers local/user settings instead.
1. Save this as the hook script
#!/usr/bin/env python3
"""ConfigChange hook — blocks a project_settings change without a
reviewer flag. Wire with matcher "project_settings"."""
import json, os, sys
data = json.load(sys.stdin)
if os.environ.get("SETTINGS_REVIEWER", "") == "":
print("BLOCKED: project .claude/settings.json is changing mid-session. "
"Set SETTINGS_REVIEWER=<name> to confirm this went through review.", file=sys.stderr)
sys.exit(2)
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/block-project-settings-without-reviewer-flag.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"ConfigChange": [
{
"matcher": "project_settings",
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/block-project-settings-without-reviewer-flag.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks