Record Baseline File Hashes for Compliance-Critical Files
Pairs with the FileChanged hooks above: those catch changes as they happen, but only to paths already being watched. This builds the baseline they compare against, re-hashing a configured list of compliance-critical files every time a session starts.
1. Save this as the hook script
#!/usr/bin/env python3
"""SessionStart hook — hashes compliance-critical files to a baseline
file for later comparison."""
import json, sys, hashlib
from pathlib import Path
data = json.load(sys.stdin)
cwd = Path(data.get("cwd", "."))
WATCHED = [".claude/settings.json", "COMPLIANCE_TODO.md"]
baseline_path = cwd / ".claude" / "file_hash_baseline.json"
hashes = {}
for rel in WATCHED:
p = cwd / rel
if p.exists():
hashes[rel] = hashlib.sha256(p.read_bytes()).hexdigest()
baseline_path.parent.mkdir(parents=True, exist_ok=True)
baseline_path.write_text(json.dumps(hashes, indent=2))
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/record-baseline-hashes-compliance-files.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"SessionStart": [
{
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/record-baseline-hashes-compliance-files.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks