@dennisrongo/dsh-hooks

Configuration

Two layers, and they are additive: every matching hook from both documents runs. A checked-out repository cannot silently disable your global guard by declaring an empty list.

User layer — the dsh-hooks settings namespace, so it lives in $DSH_HOME/settings.yaml, is schema-validated, and reloads live when you edit it:

dsh-hooks:
  enabled: true
  hooks:
    PreToolUse:
      - matcher: bash
        hooks:
          - type: command
            command: node ~/.dsh/hooks/no-force-push.mjs
            timeout: 10
            failClosed: true
    PostToolUse:
      - matcher: str_replace_editor|create_file
        hooks:
          - type: command
            command: pnpm exec prettier --write "$DSH_PROJECT_DIR"

Project layer — /.dsh/hooks.json, same shape, committed with the repo:

{
  "PostToolUse": [
    { "matcher": "str_replace_editor", "hooks": [{ "type": "command", "command": "pnpm run lint --fix" }] }
  ]
}

Read on every dispatch and cached against the file's mtime+size, so an edit takes effect with no restart and no watcher held open per workspace. Set projectHooks: false to trust only your own settings.

matcher is a regular expression over the tool name — bash|str_replace_editor works. Absent, empty and * all mean every tool. An invalid pattern matches nothing and warns once: one typo must not turn into a hook that fires on every call in the session.