Claude Permission Hook — Development skill for Claude Code

Claude Code Permissions Hook

Windows-native .NET 8 hook for Claude Code tool permission control. Supports deny → allow → passthrough rule evaluation with LLM-friendly debugging.

Overview

This hook provides fine-grained control over Claude Code's tool usage through regex-based pattern matching. It's designed specifically for Windows environments and handles edge cases like absolute paths (e.g., `C:\Tools\TF.exe checkout file.txt`) that Unix-based solutions can't handle.

**Key Features:**

• Regex-based pattern matching for all Claude Code tools (Bash, Read, Write, Edit, Glob, Task, WebFetch, WebSearch, TodoWrite)
• Deny rules checked FIRST (security-critical)
• LLM-friendly debugging (--validate-explain, --test, --explain)
• Fast startup (< 100ms target)
• JSON configuration (simple and maintainable)
• Windows-native (no Unix dependencies)

Building

Prerequisites

• .NET 8 SDK
• Windows 10+ (or Windows Server 2019+)

Build (Development)

dotnet build

Build (Release)

dotnet build -c Release

Output: `src/ClaudePermissionsHook/bin/Release/net10.0/ClaudePermissionsHook.exe`

Build (AOT - Optional)

AOT compilation requires Visual Studio 2022 with C++ tooling. If you don't have full VS installed, the Release build still provides excellent performance.

dotnet publish -c Release -r win-x64 --self-contained -p:PublishAot=true

**Note:** AOT may fail with `vswhere.exe not found` errors if VS C++ tools aren't installed. This is expected - the Release build works perfectly fine without AOT.

Configuration

Example configuration (examples/tf-safe-rules.json):

{
  "audit": {
    "enabled": true,
    "level": "matched"
  },
  "rules": [
    {
      "name": "Deny TF.exe checkin",
      "enabled": true,
      "decision": "deny",
      "toolName": "Bash",
      "commandRegex": ".*TF\.exe.*checkin.*",
      "reason": "Block TF.exe checkin commands"
    },
    {
      "name": "Allow safe TF.exe operations"