Log Local & User Settings Changes
Scoped specifically to local and user-level settings (not the project's checked-in policy file) — the layer an individual operator can change without a PR. Purely a log; it does not block the change, since those settings are meant to be editable by the person running the session.
1. Save this as the hook script
#!/usr/bin/env python3
"""ConfigChange hook — logs local/user settings changes.
Wire this with matcher "local_settings|user_settings"."""
import json, sys, datetime
from pathlib import Path
data = json.load(sys.stdin)
log_path = Path(data.get("cwd", ".")) / ".claude" / "config_change_log.jsonl"
log_path.parent.mkdir(parents=True, exist_ok=True)
entry = {
"ts": datetime.datetime.utcnow().isoformat() + "Z",
"session_id": data.get("session_id"),
"source": data.get("source"),
}
with open(log_path, "a") as f:
f.write(json.dumps(entry) + "\n")
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/log-local-user-settings-changes.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"ConfigChange": [
{
"matcher": "local_settings|user_settings",
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/log-local-user-settings-changes.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks