Read-only Claude Code PostToolUse hook that runs shfmt diff checks after Claude writes or edits shell scripts, surfacing POSIX shell, Bash, Zsh, and mksh formatting drift without rewriting files or executing scripts.
This hook runs `shfmt -d` only. It does not pass `-w`, rewrite files, run scripts, install tools, invoke Docker, or execute code from the edited file., The hook exits non-zero when shfmt prints a diff or reports a parse error. Depending on Claude Code settings, this can interrupt the workflow until a human reviews the output., Keep the hook scoped to write/edit tools. Running shfmt after every tool call can add noise and slow down shell-heavy projects., Formatting diffs are style feedback, not a security review. Pair this with ShellCheck, tests, and human review for command safety., shfmt supports POSIX shell, Bash, Zsh, and mksh syntax, but project-specific style choices may still require a team policy., Do not enable automatic rewriting until the team has agreed on shfmt style and reviewed the effect on existing scripts.
Privacy notes
shfmt diffs can include file paths, comments, commands, variable names, hostnames, internal paths, and source snippets from edited shell scripts., Hook output can be retained in Claude Code logs, terminal scrollback, screenshots, support tickets, issue comments, or AI transcripts., Avoid pasting proprietary deployment scripts, customer paths, secret variable names, generated tokens, hostnames, or production command output into public comments or prompts., Use synthetic examples when sharing shfmt findings publicly, and review diff output before exposing private repository structure.
Author
shfmt
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-04
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
78
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Complete
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
Registry metadata indicates a reviewed listing.
Done
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
6 safety and 4 privacy notes across 5 risk areas. Review closely: credentials & tokens, permissions & scopes.
5 areas
SafetyLocal filesThis hook runs `shfmt -d` only. It does not pass `-w`, rewrite files, run scripts, install tools, invoke Docker, or execute code from the edited file.
SafetyGeneralThe hook exits non-zero when shfmt prints a diff or reports a parse error. Depending on Claude Code settings, this can interrupt the workflow until a human reviews the output.
SafetyPermissions & scopesKeep the hook scoped to write/edit tools. Running shfmt after every tool call can add noise and slow down shell-heavy projects.
SafetyExecution & processesFormatting diffs are style feedback, not a security review. Pair this with ShellCheck, tests, and human review for command safety.
SafetyExecution & processesshfmt supports POSIX shell, Bash, Zsh, and mksh syntax, but project-specific style choices may still require a team policy.
SafetyExecution & processesDo not enable automatic rewriting until the team has agreed on shfmt style and reviewed the effect on existing scripts.
PrivacyLocal filesshfmt diffs can include file paths, comments, commands, variable names, hostnames, internal paths, and source snippets from edited shell scripts.
PrivacyExecution & processesHook output can be retained in Claude Code logs, terminal scrollback, screenshots, support tickets, issue comments, or AI transcripts.
PrivacyCredentials & tokensAvoid pasting proprietary deployment scripts, customer paths, secret variable names, generated tokens, hostnames, or production command output into public comments or prompts.
PrivacyGeneralUse synthetic examples when sharing shfmt findings publicly, and review diff output before exposing private repository structure.
Safety notes
This hook runs `shfmt -d` only. It does not pass `-w`, rewrite files, run scripts, install tools, invoke Docker, or execute code from the edited file.
The hook exits non-zero when shfmt prints a diff or reports a parse error. Depending on Claude Code settings, this can interrupt the workflow until a human reviews the output.
Keep the hook scoped to write/edit tools. Running shfmt after every tool call can add noise and slow down shell-heavy projects.
Formatting diffs are style feedback, not a security review. Pair this with ShellCheck, tests, and human review for command safety.
shfmt supports POSIX shell, Bash, Zsh, and mksh syntax, but project-specific style choices may still require a team policy.
Do not enable automatic rewriting until the team has agreed on shfmt style and reviewed the effect on existing scripts.
Privacy notes
shfmt diffs can include file paths, comments, commands, variable names, hostnames, internal paths, and source snippets from edited shell scripts.
Hook output can be retained in Claude Code logs, terminal scrollback, screenshots, support tickets, issue comments, or AI transcripts.
Avoid pasting proprietary deployment scripts, customer paths, secret variable names, generated tokens, hostnames, or production command output into public comments or prompts.
Use synthetic examples when sharing shfmt findings publicly, and review diff output before exposing private repository structure.
Prerequisites
Claude Code project where hooks are allowed by user or project policy.
shfmt installed locally and available on `PATH`, for example through Go install, Homebrew, a system package, or another official release path.
`jq` available on the machine to parse Claude Code hook input.
A reviewed `.claude/settings.json` or user settings hook configuration for `Write`, `Edit`, and `MultiEdit`.
Agreement that shell formatting diffs should be blocking or interrupting when shfmt reports drift.
Schema details
Install type
cli
Reading time
7 min
Difficulty score
58
Troubleshooting
Yes
Breaking changes
No
Source repository stats
Scope
Source repo
Runtime and command metadata
Trigger
PostToolUse
Script language
bash
Script body
#!/usr/bin/env bash
set -uo pipefail
input="$(cat)"
if ! command -v jq >/dev/null 2>&1; then
echo "shfmt hook skipped: jq is required to parse Claude Code hook input." >&2
exit 0
fi
tool_name="$(printf '%s' "$input" | jq -r '.tool_name // .toolName // empty')"
file_path="$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.path // .toolInput.file_path // .toolInput.path // empty')"
case "$tool_name" in
Write|Edit|MultiEdit|write|edit|multiedit) ;;
*) exit 0 ;;
esac
if [ -z "$file_path" ] || [ ! -f "$file_path" ] || [ ! -r "$file_path" ]; then
exit 0
fi
case "$file_path" in
*.sh|*.bash|*.bats|*.ksh|*.zsh) ;;
*)
first_line="$(LC_ALL=C sed -n '1p' "$file_path" 2>/dev/null || true)"
case "$first_line" in
'#!'*'/sh'*|'#!'*' bash'*|'#!'*'/bash'*|'#!'*' dash'*|'#!'*'/dash'*|'#!'*' ksh'*|'#!'*'/ksh'*|'#!'*' zsh'*|'#!'*'/zsh'*) ;;
*) exit 0 ;;
esac
;;
esac
if ! command -v shfmt >/dev/null 2>&1; then
echo "shfmt hook skipped: install shfmt to enable shell formatting checks." >&2
exit 0
fi
echo "shfmt hook: checking $file_path" >&2
shfmt -d "$file_path"
status=$?
if [ "$status" -ne 0 ]; then
echo "shfmt hook: formatting drift found. Review the diff or run shfmt intentionally before asking Claude to continue." >&2
fi
exit "$status"
This hook runs shfmt after Claude Code writes or edits a shell-like file. It is
intentionally read-only: it reports formatting diffs and parse errors, but it
does not rewrite files, run scripts, install packages, invoke Docker, or execute
commands from the edited file.
Use it when a project contains shell scripts and you want immediate feedback on
consistent shell formatting after Claude edits a file. It complements
ShellCheck-style diagnostics by focusing on formatting and parser-supported
syntax consistency rather than command-safety findings.
These sources were reviewed on 2026-06-04. The official mvdan/sh README
describes shfmt as the formatter included with the shell parser, formatter,
and interpreter project. It documents support for POSIX shell, Bash, Zsh, and
mksh, installation through go install mvdan.cc/sh/v3/cmd/shfmt@latest, package
availability across common systems, default formatting style, and Docker image
availability. This hook intentionally uses a local binary and read-only diff
mode.
Installation
Install shfmt locally through Go install, Homebrew, a system package, or
another reviewed installation path.
Confirm shfmt --help works in the same environment Claude Code uses.
Confirm jq is available.
Save the script as .claude/hooks/shfmt-shell-format-check.sh.
Make it executable.
Add the hook configuration to .claude/settings.json or user settings after
reviewing the behavior with your team.
Save this as .claude/hooks/shfmt-shell-format-check.sh and make it executable:
#!/usr/bin/env bash
set -uo pipefail
input="$(cat)"
if ! command -v jq >/dev/null 2>&1; then
echo "shfmt hook skipped: jq is required to parse Claude Code hook input." >&2
exit 0
fi
tool_name="$(printf '%s' "$input" | jq -r '.tool_name // .toolName // empty')"
file_path="$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.path // .toolInput.file_path // .toolInput.path // empty')"
case "$tool_name" in
Write|Edit|MultiEdit|write|edit|multiedit) ;;
*) exit 0 ;;
esac
if [ -z "$file_path" ] || [ ! -f "$file_path" ] || [ ! -r "$file_path" ]; then
exit 0
fi
case "$file_path" in
*.sh|*.bash|*.bats|*.ksh|*.zsh) ;;
*)
first_line="$(LC_ALL=C sed -n '1p' "$file_path" 2>/dev/null || true)"
case "$first_line" in
'#!'*'/sh'*|'#!'*' bash'*|'#!'*'/bash'*|'#!'*' dash'*|'#!'*'/dash'*|'#!'*' ksh'*|'#!'*'/ksh'*|'#!'*' zsh'*|'#!'*'/zsh'*) ;;
*) exit 0 ;;
esac
;;
esac
if ! command -v shfmt >/dev/null 2>&1; then
echo "shfmt hook skipped: install shfmt to enable shell formatting checks." >&2
exit 0
fi
echo "shfmt hook: checking $file_path" >&2
shfmt -d "$file_path"
status=$?
if [ "$status" -ne 0 ]; then
echo "shfmt hook: formatting drift found. Review the diff or run shfmt intentionally before asking Claude to continue." >&2
fi
exit "$status"
What It Checks
Shell-like file extensions such as .sh, .bash, .bats, .ksh, and .zsh.
Executable or extensionless files with common shell shebangs.
Formatting drift reported by shfmt -d.
Parse errors reported by shfmt for the supported shell dialects.
What It Does Not Do
It does not rewrite files.
It does not run shell scripts.
It does not install shfmt.
It does not invoke Docker or use shfmt container images.
It does not lint command safety, quoting, or portability beyond parser and
formatting behavior.
It does not replace ShellCheck, tests, code review, or deployment safeguards.
Troubleshooting
Hook says shfmt is missing
Install shfmt through Go install, Homebrew, a system package, or another
reviewed local installation path. Confirm command -v shfmt works in the same
shell environment Claude Code uses.
Hook does not run for an extensionless script
The script checks the first line for common shell shebangs. Confirm the file is
readable and starts with a shell shebang such as #!/usr/bin/env bash or
#!/bin/sh.
shfmt reports a diff but the team prefers the current style
Decide on team formatting policy before making the hook blocking. If the team
needs a different shfmt style, adapt the command flags deliberately and document
them next to the hook.
shfmt passes but ShellCheck still fails
That is expected. shfmt is a formatter and parser. Keep ShellCheck or another
shell static analyzer in the workflow for quoting, expansion, portability, and
command-safety diagnostics.
Duplicate Check
No existing content/hooks, content/skills, content/agents,
content/mcp, or content/tools entry in this checkout matches shfmt,
mvdan/sh, mvdan.cc/sh, or a shell formatting check hook. Open PR titles,
branch names, changed files, issue titles, issue bodies, and source URLs were
also checked before drafting this entry.
This entry is distinct from the existing ShellCheck hook and Hadolint hook.
ShellCheck reports shell diagnostics, Hadolint reports Dockerfile diagnostics,
and this hook reports shell formatting diffs through shfmt.
Editorial Disclosure
This is an independent, source-backed HeyClaude content entry submitted by
oktofeesh1. It is not sponsored by shfmt, mvdan/sh, or the project
maintainers. The hook expects a user-installed shfmt binary and does not package,
redistribute, or verify a shfmt release artifact.
Show that shfmt Shell Format Check Hook for Claude Code is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/hooks/shfmt-shell-format-check-hook)
How it compares
shfmt Shell Format Check Hook for Claude Code side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
Read-only Claude Code PostToolUse hook that runs shfmt diff checks after Claude writes or edits shell scripts, surfacing POSIX shell, Bash, Zsh, and mksh formatting drift without rewriting files or executing scripts.
Read-only Claude Code PostToolUse hook that runs ShellCheck diagnostics after Claude writes or edits shell scripts, reporting shell portability, quoting, expansion, error-handling, and command-safety issues without modifying files.
Read-only Claude Code PostToolUse hook that runs Biome's formatter, linter, and import-sorting checks on edited JavaScript, TypeScript, JSON, CSS, and GraphQL files without auto-writing changes.
✓This hook runs `shfmt -d` only. It does not pass `-w`, rewrite files, run scripts, install tools, invoke Docker, or execute code from the edited file.
The hook exits non-zero when shfmt prints a diff or reports a parse error. Depending on Claude Code settings, this can interrupt the workflow until a human reviews the output.
Keep the hook scoped to write/edit tools. Running shfmt after every tool call can add noise and slow down shell-heavy projects.
Formatting diffs are style feedback, not a security review. Pair this with ShellCheck, tests, and human review for command safety.
shfmt supports POSIX shell, Bash, Zsh, and mksh syntax, but project-specific style choices may still require a team policy.
Do not enable automatic rewriting until the team has agreed on shfmt style and reviewed the effect on existing scripts.
✓This hook runs `shellcheck --format=gcc` only. It does not add `--external-sources`, install dependencies, rewrite files, run scripts, source scripts, or execute commands from the edited file.
The hook exits non-zero when ShellCheck reports diagnostics. Depending on Claude Code settings, this can interrupt the workflow until a human reviews the output.
Keep the hook scoped to write/edit tools. Running ShellCheck after every tool call can add noise and slow down shell-heavy projects.
ShellCheck warnings are static-analysis findings, not proof that a script is safe. Review command execution, permissions, inputs, secrets, paths, and deployment context separately.
ShellCheck can follow sourced files when configured to do so. This script avoids `--external-sources` by default so it does not traverse additional project files unexpectedly.
Do not use this hook as a blanket command blocker. It is intended to surface diagnostics after Claude edits shell files, not to approve or deny arbitrary terminal commands.
✓This hook runs `biome check` without `--write`, so it reports formatter, linter, and import-sorting diagnostics but does not modify files.
Do not add `--write` or `--unsafe` until the team has reviewed the hook behavior, backup expectations, and failure mode for generated edits.
The hook exits non-zero when Biome reports diagnostics. Depending on Claude Code settings, this can interrupt the current workflow until issues are reviewed.
Use a project-pinned Biome package when possible. The script prefers `./node_modules/.bin/biome` and avoids network-install fallbacks.
Keep matchers scoped to write/edit tools. Running Biome after every tool call can add noise and slow down large projects.
✓This hook is static and read-only. It reads only non-symlinked Wrangler config files inside the current project and does not run `wrangler deploy`, `wrangler dev`, `wrangler whoami`, `wrangler secret list`, package scripts, build plugins, or network commands.
The hook exits non-zero only for parse failures or missing required top-level Worker fields such as `name` and `compatibility_date`; warnings remain advisory so the user can review them.
The TOML checks are heuristic and do not replace Wrangler's own parser or a trusted pre-deploy dry run. Use them as a fast edit-time guard, then run official Wrangler validation in a trusted repository.
Do not expand this hook into a dry-run deploy hook unless the team has reviewed local build-script execution, inherited environment variables, and output-directory cleanup.
Keep matchers scoped to config file edits. Running config checks after every tool call adds noise without improving Cloudflare safety.
Privacy notes
✓shfmt diffs can include file paths, comments, commands, variable names, hostnames, internal paths, and source snippets from edited shell scripts.
Hook output can be retained in Claude Code logs, terminal scrollback, screenshots, support tickets, issue comments, or AI transcripts.
Avoid pasting proprietary deployment scripts, customer paths, secret variable names, generated tokens, hostnames, or production command output into public comments or prompts.
Use synthetic examples when sharing shfmt findings publicly, and review diff output before exposing private repository structure.
✓ShellCheck diagnostics can include file paths, line numbers, command names, variable names, comments, and source snippets from edited shell scripts.
Hook output can be retained in Claude Code logs, terminal scrollback, screenshots, support tickets, issue comments, or AI transcripts.
Avoid pasting proprietary deployment scripts, customer paths, secret variable names, generated tokens, hostnames, or production command output into public comments or prompts.
Use synthetic examples when sharing ShellCheck findings publicly, and review diagnostics before exposing private repository structure.
✓Biome diagnostics can include file paths, rule names, code excerpts, import names, comments, and source snippets from edited files.
Claude Code hook logs, terminal scrollback, screenshots, support tickets, and AI transcripts can retain Biome diagnostics outside the repository.
Avoid pasting real customer code, private filenames, generated secrets, or proprietary source excerpts from hook output into public issue comments.
✓The hook reads `wrangler.toml`, `wrangler.json`, or `wrangler.jsonc` only inside the current project, with symlinks rejected and a 1 MiB size cap.
Wrangler config files can contain worker names, route patterns, account identifiers, resource IDs, binding names, environment names, analytics settings, and non-secret vars.
Hook output may include file paths, config key names, environment names, and secret-like variable names, so avoid pasting terminal logs into public issue comments without review.
If a Wrangler config currently contains real secrets in `vars`, the hook can reveal the key names and the surrounding configuration context. Move sensitive values to Wrangler secrets before sharing output.
Prerequisites
Claude Code project where hooks are allowed by user or project policy.
shfmt installed locally and available on `PATH`, for example through Go install, Homebrew, a system package, or another official release path.
`jq` available on the machine to parse Claude Code hook input.
A reviewed `.claude/settings.json` or user settings hook configuration for `Write`, `Edit`, and `MultiEdit`.
Claude Code project where hooks are allowed by user or project policy.
ShellCheck installed on the machine, for example through the operating system package manager or the official ShellCheck release path.
`jq` available on the machine to parse Claude Code hook input.
A reviewed `.claude/settings.json` or user settings hook configuration for `Write`, `Edit`, and `MultiEdit`.
Claude Code project where hooks are allowed by user or project policy.
Project-local Biome install, usually `pnpm add -D @biomejs/biome` or the equivalent package-manager command.
`jq` available on the machine to parse Claude Code hook input.
A reviewed `.claude/settings.json` or user settings hook configuration for `Write`, `Edit`, and `MultiEdit`.
Claude Code project where hooks are allowed by user or project policy.
Cloudflare Workers or Pages project with `wrangler.toml`, `wrangler.json`, or `wrangler.jsonc` checked into the repository.
`jq` available locally to parse Claude Code hook input.
Node.js available locally for static JSON/JSONC/TOML heuristics.