Skip to main content
hooksSource-backed

shfmt Shell Format Check Hook for Claude Code

Read-only Claude Code PostToolUse hook that runs shfmt diff checks after Claude writes or edits shell scripts, surfacing POSIX shell, Bash, Zsh, and mksh formatting drift without rewriting files or executing scripts.

by shfmt · submitted by oktofeesh1·added 2026-06-04·
Trigger:PostToolUse
Review first review before installing

Open the source and read safety notes before installing.

Citation facts

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Source URLs
https://github.com/mvdan/sh/blob/master/README.md, https://github.com/mvdan/sh, https://pkg.go.dev/mvdan.cc/sh/v3/cmd/shfmt
Brand
shfmt
Brand domain
mvdan.cc
Brand asset source
manual
Safety notes
This hook runs `shfmt -d` only. It does not pass `-w`, rewrite files, run scripts, install tools, invoke Docker, or execute code from the edited file., The hook exits non-zero when shfmt prints a diff or reports a parse error. Depending on Claude Code settings, this can interrupt the workflow until a human reviews the output., Keep the hook scoped to write/edit tools. Running shfmt after every tool call can add noise and slow down shell-heavy projects., Formatting diffs are style feedback, not a security review. Pair this with ShellCheck, tests, and human review for command safety., shfmt supports POSIX shell, Bash, Zsh, and mksh syntax, but project-specific style choices may still require a team policy., Do not enable automatic rewriting until the team has agreed on shfmt style and reviewed the effect on existing scripts.
Privacy notes
shfmt diffs can include file paths, comments, commands, variable names, hostnames, internal paths, and source snippets from edited shell scripts., Hook output can be retained in Claude Code logs, terminal scrollback, screenshots, support tickets, issue comments, or AI transcripts., Avoid pasting proprietary deployment scripts, customer paths, secret variable names, generated tokens, hostnames, or production command output into public comments or prompts., Use synthetic examples when sharing shfmt findings publicly, and review diff output before exposing private repository structure.
Author
shfmt
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-04

Decision playbook

Review trust signals before you adopt

Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.

Compare context
Selected

0

Current score

78

Baseline

Delta

No baseline selected

No major trust-signal divergence detected in the current selection.

Source and provenance checks

Complete

Confirm ownership and provenance before trusting install instructions.

  • Source link availableRequired

    Open the canonical repository and verify ownership.

    Done
  • Source provenance statusRequired

    Marked as source-backed.

    Done
  • Metadata reviewed

    Registry metadata indicates a reviewed listing.

    Done

Safety and privacy checks

Complete

Validate risk disclosures before installation or API wiring.

  • Safety notes presentRequired

    Review the listed safety guidance before running commands.

    Done
  • Privacy notes presentRequired

    Review data handling notes before connecting accounts or secrets.

    Done
  • Trust level risk gateRequired

    Trust level does not block evaluation.

    Done

Package and install checks

Needs review

Check package metadata and artifact integrity signals.

  • Install payload available

    Install or copy payload is available for review.

    Done
  • Package verification flag

    No package verification flag provided.

    Pending
  • Checksum metadata

    No checksum provided for downloaded artifact.

    Pending

Compare-driven decision checks

Needs review

Use compare context to validate trade-offs before adoption.

  • Compare tray has multiple entries

    Add at least one more entry to compare trust differences.

    Pending
  • Baseline comparison available

    No baseline peer selected yet.

    Pending
  • Diverging trust signals identified

    No major trust-signal divergence found.

    Pending

Setup at a glance

CLI install

Copy-ready — paste the snippet to get started.

Adoption plan

Balanced adoption plan

Current risk score 16/100. Use staged verification before broader rollout.

Risk 16

Pre-adoption checks

Validate source and review signals before any execution.

  • Confirm source provenanceRequired

    Source URL/provenance metadata is present.

    Done
  • Confirm metadata review state

    Listing has review metadata.

    Done
  • Verify install payload

    Install/config payload exists and can be inspected.

    Done

Security checks

Confirm safety, privacy, and package integrity signals.

  • Review safety notesRequired

    Safety notes are present.

    Done
  • Review privacy notesRequired

    Privacy notes are present.

    Done
  • Verify package integrity metadata

    No package verification/checksum metadata.

    Pending

Rollout

Adopt in controlled steps based on the selected plan.

  • Run in isolated sandbox firstRequired

    Use a constrained sandbox and observe behavior across multiple tasks.

    Pending
  • Roll out graduallyRequired

    Roll out to a small cohort before wider usage.

    Pending
  • Set monitoring and fallback

    Define rollback path and monitor errors after adoption.

    Pending

Evidence readiness

Evidence readiness matrix · balanced

Required evidence gates are covered (5/6 signals complete).

Risk 15

Source provenance

Present

Source repository/provenance is listed.

Required in this preset

Metadata review

Present

Review metadata is present.

Required in this preset

Safety notes

Present

Safety notes are present.

Required in this preset

Privacy notes

Present

Privacy notes are present.

Optional in this preset

Package integrity

Missing

Package integrity metadata is missing.

Optional in this preset

Install payload

Present

Install payload is available.

Required in this preset

Required evidence gates are covered for this preset.

Decision timeline

Decision timeline · balanced

5/6 steps complete with no blocking gaps for this preset.

Risk 14

triage

Confirm source provenanceRequired

Source/provenance metadata is available.

Done

triage

Check metadata review statusRequired

Review metadata is available.

Done

verify

Review safety notesRequired

Safety notes are available.

Done

verify

Review privacy notes

Privacy notes are available.

Done

verify

Validate package integrity metadata

Package integrity metadata is missing.

Pending

rollout

Verify install payload and commandsRequired

Install payload is available.

Done

No required blockers for this timeline preset.

Prerequisite readiness

Prerequisite readiness

5 prerequisites to line up before setup. Includes a review or approval gate.

0/5 ready
Install & runtime1Network & hosting1Review & approval1General2

Safety & privacy surface

Safety & privacy surface

6 safety and 4 privacy notes across 5 risk areas. Review closely: credentials & tokens, permissions & scopes.

5 areas
  • SafetyLocal filesThis hook runs `shfmt -d` only. It does not pass `-w`, rewrite files, run scripts, install tools, invoke Docker, or execute code from the edited file.
  • SafetyGeneralThe hook exits non-zero when shfmt prints a diff or reports a parse error. Depending on Claude Code settings, this can interrupt the workflow until a human reviews the output.
  • SafetyPermissions & scopesKeep the hook scoped to write/edit tools. Running shfmt after every tool call can add noise and slow down shell-heavy projects.
  • SafetyExecution & processesFormatting diffs are style feedback, not a security review. Pair this with ShellCheck, tests, and human review for command safety.
  • SafetyExecution & processesshfmt supports POSIX shell, Bash, Zsh, and mksh syntax, but project-specific style choices may still require a team policy.
  • SafetyExecution & processesDo not enable automatic rewriting until the team has agreed on shfmt style and reviewed the effect on existing scripts.
  • PrivacyLocal filesshfmt diffs can include file paths, comments, commands, variable names, hostnames, internal paths, and source snippets from edited shell scripts.
  • PrivacyExecution & processesHook output can be retained in Claude Code logs, terminal scrollback, screenshots, support tickets, issue comments, or AI transcripts.
  • PrivacyCredentials & tokensAvoid pasting proprietary deployment scripts, customer paths, secret variable names, generated tokens, hostnames, or production command output into public comments or prompts.
  • PrivacyGeneralUse synthetic examples when sharing shfmt findings publicly, and review diff output before exposing private repository structure.

Safety notes

  • This hook runs `shfmt -d` only. It does not pass `-w`, rewrite files, run scripts, install tools, invoke Docker, or execute code from the edited file.
  • The hook exits non-zero when shfmt prints a diff or reports a parse error. Depending on Claude Code settings, this can interrupt the workflow until a human reviews the output.
  • Keep the hook scoped to write/edit tools. Running shfmt after every tool call can add noise and slow down shell-heavy projects.
  • Formatting diffs are style feedback, not a security review. Pair this with ShellCheck, tests, and human review for command safety.
  • shfmt supports POSIX shell, Bash, Zsh, and mksh syntax, but project-specific style choices may still require a team policy.
  • Do not enable automatic rewriting until the team has agreed on shfmt style and reviewed the effect on existing scripts.

Privacy notes

  • shfmt diffs can include file paths, comments, commands, variable names, hostnames, internal paths, and source snippets from edited shell scripts.
  • Hook output can be retained in Claude Code logs, terminal scrollback, screenshots, support tickets, issue comments, or AI transcripts.
  • Avoid pasting proprietary deployment scripts, customer paths, secret variable names, generated tokens, hostnames, or production command output into public comments or prompts.
  • Use synthetic examples when sharing shfmt findings publicly, and review diff output before exposing private repository structure.

Prerequisites

  • Claude Code project where hooks are allowed by user or project policy.
  • shfmt installed locally and available on `PATH`, for example through Go install, Homebrew, a system package, or another official release path.
  • `jq` available on the machine to parse Claude Code hook input.
  • A reviewed `.claude/settings.json` or user settings hook configuration for `Write`, `Edit`, and `MultiEdit`.
  • Agreement that shell formatting diffs should be blocking or interrupting when shfmt reports drift.

Schema details

Install type
cli
Reading time
7 min
Difficulty score
58
Troubleshooting
Yes
Breaking changes
No
Source repository stats
Scope
Source repo
Runtime and command metadata
Trigger
PostToolUse
Script language
bash
Script body
#!/usr/bin/env bash
set -uo pipefail

input="$(cat)"

if ! command -v jq >/dev/null 2>&1; then
  echo "shfmt hook skipped: jq is required to parse Claude Code hook input." >&2
  exit 0
fi

tool_name="$(printf '%s' "$input" | jq -r '.tool_name // .toolName // empty')"
file_path="$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.path // .toolInput.file_path // .toolInput.path // empty')"

case "$tool_name" in
  Write|Edit|MultiEdit|write|edit|multiedit) ;;
  *) exit 0 ;;
esac

if [ -z "$file_path" ] || [ ! -f "$file_path" ] || [ ! -r "$file_path" ]; then
  exit 0
fi

case "$file_path" in
  *.sh|*.bash|*.bats|*.ksh|*.zsh) ;;
  *)
    first_line="$(LC_ALL=C sed -n '1p' "$file_path" 2>/dev/null || true)"
    case "$first_line" in
      '#!'*'/sh'*|'#!'*' bash'*|'#!'*'/bash'*|'#!'*' dash'*|'#!'*'/dash'*|'#!'*' ksh'*|'#!'*'/ksh'*|'#!'*' zsh'*|'#!'*'/zsh'*) ;;
      *) exit 0 ;;
    esac
    ;;
esac

if ! command -v shfmt >/dev/null 2>&1; then
  echo "shfmt hook skipped: install shfmt to enable shell formatting checks." >&2
  exit 0
fi

echo "shfmt hook: checking $file_path" >&2
shfmt -d "$file_path"
status=$?

if [ "$status" -ne 0 ]; then
  echo "shfmt hook: formatting drift found. Review the diff or run shfmt intentionally before asking Claude to continue." >&2
fi

exit "$status"
Full copyable content
{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "./.claude/hooks/shfmt-shell-format-check.sh"
          }
        ]
      }
    ]
  }
}

About this resource

Overview

This hook runs shfmt after Claude Code writes or edits a shell-like file. It is intentionally read-only: it reports formatting diffs and parse errors, but it does not rewrite files, run scripts, install packages, invoke Docker, or execute commands from the edited file.

Use it when a project contains shell scripts and you want immediate feedback on consistent shell formatting after Claude edits a file. It complements ShellCheck-style diagnostics by focusing on formatting and parser-supported syntax consistency rather than command-safety findings.

Source Review

These sources were reviewed on 2026-06-04. The official mvdan/sh README describes shfmt as the formatter included with the shell parser, formatter, and interpreter project. It documents support for POSIX shell, Bash, Zsh, and mksh, installation through go install mvdan.cc/sh/v3/cmd/shfmt@latest, package availability across common systems, default formatting style, and Docker image availability. This hook intentionally uses a local binary and read-only diff mode.

Installation

  1. Install shfmt locally through Go install, Homebrew, a system package, or another reviewed installation path.
  2. Confirm shfmt --help works in the same environment Claude Code uses.
  3. Confirm jq is available.
  4. Save the script as .claude/hooks/shfmt-shell-format-check.sh.
  5. Make it executable.
  6. Add the hook configuration to .claude/settings.json or user settings after reviewing the behavior with your team.

Hook Configuration

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "./.claude/hooks/shfmt-shell-format-check.sh"
          }
        ]
      }
    ]
  }
}

Hook Script

Save this as .claude/hooks/shfmt-shell-format-check.sh and make it executable:

#!/usr/bin/env bash
set -uo pipefail

input="$(cat)"

if ! command -v jq >/dev/null 2>&1; then
  echo "shfmt hook skipped: jq is required to parse Claude Code hook input." >&2
  exit 0
fi

tool_name="$(printf '%s' "$input" | jq -r '.tool_name // .toolName // empty')"
file_path="$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.path // .toolInput.file_path // .toolInput.path // empty')"

case "$tool_name" in
  Write|Edit|MultiEdit|write|edit|multiedit) ;;
  *) exit 0 ;;
esac

if [ -z "$file_path" ] || [ ! -f "$file_path" ] || [ ! -r "$file_path" ]; then
  exit 0
fi

case "$file_path" in
  *.sh|*.bash|*.bats|*.ksh|*.zsh) ;;
  *)
    first_line="$(LC_ALL=C sed -n '1p' "$file_path" 2>/dev/null || true)"
    case "$first_line" in
      '#!'*'/sh'*|'#!'*' bash'*|'#!'*'/bash'*|'#!'*' dash'*|'#!'*'/dash'*|'#!'*' ksh'*|'#!'*'/ksh'*|'#!'*' zsh'*|'#!'*'/zsh'*) ;;
      *) exit 0 ;;
    esac
    ;;
esac

if ! command -v shfmt >/dev/null 2>&1; then
  echo "shfmt hook skipped: install shfmt to enable shell formatting checks." >&2
  exit 0
fi

echo "shfmt hook: checking $file_path" >&2
shfmt -d "$file_path"
status=$?

if [ "$status" -ne 0 ]; then
  echo "shfmt hook: formatting drift found. Review the diff or run shfmt intentionally before asking Claude to continue." >&2
fi

exit "$status"

What It Checks

  • Shell-like file extensions such as .sh, .bash, .bats, .ksh, and .zsh.
  • Executable or extensionless files with common shell shebangs.
  • Formatting drift reported by shfmt -d.
  • Parse errors reported by shfmt for the supported shell dialects.

What It Does Not Do

  • It does not rewrite files.
  • It does not run shell scripts.
  • It does not install shfmt.
  • It does not invoke Docker or use shfmt container images.
  • It does not lint command safety, quoting, or portability beyond parser and formatting behavior.
  • It does not replace ShellCheck, tests, code review, or deployment safeguards.

Troubleshooting

Hook says shfmt is missing

Install shfmt through Go install, Homebrew, a system package, or another reviewed local installation path. Confirm command -v shfmt works in the same shell environment Claude Code uses.

Hook does not run for an extensionless script

The script checks the first line for common shell shebangs. Confirm the file is readable and starts with a shell shebang such as #!/usr/bin/env bash or #!/bin/sh.

shfmt reports a diff but the team prefers the current style

Decide on team formatting policy before making the hook blocking. If the team needs a different shfmt style, adapt the command flags deliberately and document them next to the hook.

shfmt passes but ShellCheck still fails

That is expected. shfmt is a formatter and parser. Keep ShellCheck or another shell static analyzer in the workflow for quoting, expansion, portability, and command-safety diagnostics.

Duplicate Check

No existing content/hooks, content/skills, content/agents, content/mcp, or content/tools entry in this checkout matches shfmt, mvdan/sh, mvdan.cc/sh, or a shell formatting check hook. Open PR titles, branch names, changed files, issue titles, issue bodies, and source URLs were also checked before drafting this entry.

This entry is distinct from the existing ShellCheck hook and Hadolint hook. ShellCheck reports shell diagnostics, Hadolint reports Dockerfile diagnostics, and this hook reports shell formatting diffs through shfmt.

Editorial Disclosure

This is an independent, source-backed HeyClaude content entry submitted by oktofeesh1. It is not sponsored by shfmt, mvdan/sh, or the project maintainers. The hook expects a user-installed shfmt binary and does not package, redistribute, or verify a shfmt release artifact.

Source citations

Add this badge to your README

Show that shfmt Shell Format Check Hook for Claude Code is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/hooks/shfmt-shell-format-check-hook.svg)](https://heyclau.de/entry/hooks/shfmt-shell-format-check-hook)

How it compares

shfmt Shell Format Check Hook for Claude Code side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

Field

Read-only Claude Code PostToolUse hook that runs shfmt diff checks after Claude writes or edits shell scripts, surfacing POSIX shell, Bash, Zsh, and mksh formatting drift without rewriting files or executing scripts.

Open dossier

Read-only Claude Code PostToolUse hook that runs ShellCheck diagnostics after Claude writes or edits shell scripts, reporting shell portability, quoting, expansion, error-handling, and command-safety issues without modifying files.

Open dossier

Read-only Claude Code PostToolUse hook that runs Biome's formatter, linter, and import-sorting checks on edited JavaScript, TypeScript, JSON, CSS, and GraphQL files without auto-writing changes.

Open dossier

Read-only Claude Code PostToolUse hook that checks edited Cloudflare Wrangler config files for required Worker fields, environment inheritance traps, secret-like vars, deprecated Workers Sites usage, and source-of-truth drift before Claude continues.

Open dossier
Next steps
Trust
Review statusReviewedMaintainer reviewedReviewedMaintainer reviewedReviewedMaintainer reviewedReviewedMaintainer reviewed
Package trustPackage not verifiedPackage not verifiedPackage not verifiedPackage not verified
Source provenanceSource-backedSource-backedSource-backedSource-backed
Submitteroktofeesh1oktofeesh1oktofeesh1oktofeesh1
Install riskReview firstReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
BrandshfmtCloudflare logoCloudflare
Categoryhookshookshookshooks
SourceSource-backedSource-backedSource-backedSource-backed
Authorshfmtoktofeesh1oktofeesh1oktofeesh1
Added2026-06-042026-06-042026-06-042026-06-04
Platforms
Harness
Source repo
Safety notesThis hook runs `shfmt -d` only. It does not pass `-w`, rewrite files, run scripts, install tools, invoke Docker, or execute code from the edited file. The hook exits non-zero when shfmt prints a diff or reports a parse error. Depending on Claude Code settings, this can interrupt the workflow until a human reviews the output. Keep the hook scoped to write/edit tools. Running shfmt after every tool call can add noise and slow down shell-heavy projects. Formatting diffs are style feedback, not a security review. Pair this with ShellCheck, tests, and human review for command safety. shfmt supports POSIX shell, Bash, Zsh, and mksh syntax, but project-specific style choices may still require a team policy. Do not enable automatic rewriting until the team has agreed on shfmt style and reviewed the effect on existing scripts.This hook runs `shellcheck --format=gcc` only. It does not add `--external-sources`, install dependencies, rewrite files, run scripts, source scripts, or execute commands from the edited file. The hook exits non-zero when ShellCheck reports diagnostics. Depending on Claude Code settings, this can interrupt the workflow until a human reviews the output. Keep the hook scoped to write/edit tools. Running ShellCheck after every tool call can add noise and slow down shell-heavy projects. ShellCheck warnings are static-analysis findings, not proof that a script is safe. Review command execution, permissions, inputs, secrets, paths, and deployment context separately. ShellCheck can follow sourced files when configured to do so. This script avoids `--external-sources` by default so it does not traverse additional project files unexpectedly. Do not use this hook as a blanket command blocker. It is intended to surface diagnostics after Claude edits shell files, not to approve or deny arbitrary terminal commands.This hook runs `biome check` without `--write`, so it reports formatter, linter, and import-sorting diagnostics but does not modify files. Do not add `--write` or `--unsafe` until the team has reviewed the hook behavior, backup expectations, and failure mode for generated edits. The hook exits non-zero when Biome reports diagnostics. Depending on Claude Code settings, this can interrupt the current workflow until issues are reviewed. Use a project-pinned Biome package when possible. The script prefers `./node_modules/.bin/biome` and avoids network-install fallbacks. Keep matchers scoped to write/edit tools. Running Biome after every tool call can add noise and slow down large projects.This hook is static and read-only. It reads only non-symlinked Wrangler config files inside the current project and does not run `wrangler deploy`, `wrangler dev`, `wrangler whoami`, `wrangler secret list`, package scripts, build plugins, or network commands. The hook exits non-zero only for parse failures or missing required top-level Worker fields such as `name` and `compatibility_date`; warnings remain advisory so the user can review them. The TOML checks are heuristic and do not replace Wrangler's own parser or a trusted pre-deploy dry run. Use them as a fast edit-time guard, then run official Wrangler validation in a trusted repository. Do not expand this hook into a dry-run deploy hook unless the team has reviewed local build-script execution, inherited environment variables, and output-directory cleanup. Keep matchers scoped to config file edits. Running config checks after every tool call adds noise without improving Cloudflare safety.
Privacy notesshfmt diffs can include file paths, comments, commands, variable names, hostnames, internal paths, and source snippets from edited shell scripts. Hook output can be retained in Claude Code logs, terminal scrollback, screenshots, support tickets, issue comments, or AI transcripts. Avoid pasting proprietary deployment scripts, customer paths, secret variable names, generated tokens, hostnames, or production command output into public comments or prompts. Use synthetic examples when sharing shfmt findings publicly, and review diff output before exposing private repository structure.ShellCheck diagnostics can include file paths, line numbers, command names, variable names, comments, and source snippets from edited shell scripts. Hook output can be retained in Claude Code logs, terminal scrollback, screenshots, support tickets, issue comments, or AI transcripts. Avoid pasting proprietary deployment scripts, customer paths, secret variable names, generated tokens, hostnames, or production command output into public comments or prompts. Use synthetic examples when sharing ShellCheck findings publicly, and review diagnostics before exposing private repository structure.Biome diagnostics can include file paths, rule names, code excerpts, import names, comments, and source snippets from edited files. Claude Code hook logs, terminal scrollback, screenshots, support tickets, and AI transcripts can retain Biome diagnostics outside the repository. Avoid pasting real customer code, private filenames, generated secrets, or proprietary source excerpts from hook output into public issue comments.The hook reads `wrangler.toml`, `wrangler.json`, or `wrangler.jsonc` only inside the current project, with symlinks rejected and a 1 MiB size cap. Wrangler config files can contain worker names, route patterns, account identifiers, resource IDs, binding names, environment names, analytics settings, and non-secret vars. Hook output may include file paths, config key names, environment names, and secret-like variable names, so avoid pasting terminal logs into public issue comments without review. If a Wrangler config currently contains real secrets in `vars`, the hook can reveal the key names and the surrounding configuration context. Move sensitive values to Wrangler secrets before sharing output.
Prerequisites
  • Claude Code project where hooks are allowed by user or project policy.
  • shfmt installed locally and available on `PATH`, for example through Go install, Homebrew, a system package, or another official release path.
  • `jq` available on the machine to parse Claude Code hook input.
  • A reviewed `.claude/settings.json` or user settings hook configuration for `Write`, `Edit`, and `MultiEdit`.
  • Claude Code project where hooks are allowed by user or project policy.
  • ShellCheck installed on the machine, for example through the operating system package manager or the official ShellCheck release path.
  • `jq` available on the machine to parse Claude Code hook input.
  • A reviewed `.claude/settings.json` or user settings hook configuration for `Write`, `Edit`, and `MultiEdit`.
  • Claude Code project where hooks are allowed by user or project policy.
  • Project-local Biome install, usually `pnpm add -D @biomejs/biome` or the equivalent package-manager command.
  • `jq` available on the machine to parse Claude Code hook input.
  • A reviewed `.claude/settings.json` or user settings hook configuration for `Write`, `Edit`, and `MultiEdit`.
  • Claude Code project where hooks are allowed by user or project policy.
  • Cloudflare Workers or Pages project with `wrangler.toml`, `wrangler.json`, or `wrangler.jsonc` checked into the repository.
  • `jq` available locally to parse Claude Code hook input.
  • Node.js available locally for static JSON/JSONC/TOML heuristics.
Install
mkdir -p .claude/hooks && touch .claude/hooks/shfmt-shell-format-check.sh && chmod +x .claude/hooks/shfmt-shell-format-check.sh
mkdir -p .claude/hooks
hook_path=.claude/hooks/shellcheck-static-analysis.sh
tmp_path="$(mktemp "${hook_path}.tmp.XXXXXX")" || exit 1
cat > "$tmp_path" <<'SHELLCHECK_STATIC_ANALYSIS_HOOK'
#!/usr/bin/env bash
set -uo pipefail

input="$(cat)"

if ! command -v jq >/dev/null 2>&1; then
  echo "ShellCheck hook skipped: jq is required to parse Claude Code hook input." >&2
  exit 0
fi

tool_name="$(printf '%s' "$input" | jq -r '.tool_name // .toolName // empty')"
file_path="$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.path // .toolInput.file_path // .toolInput.path // empty')"

case "$tool_name" in
  Write|Edit|MultiEdit|write|edit|multiedit) ;;
  *) exit 0 ;;
esac

if [ -z "$file_path" ] || [ ! -f "$file_path" ] || [ ! -r "$file_path" ]; then
  exit 0
fi

case "$file_path" in
  *.sh|*.bash|*.bats|*.ksh) ;;
  *)
    first_line="$(LC_ALL=C sed -n '1p' "$file_path" 2>/dev/null || true)"
    case "$first_line" in
      '#!'*'/sh'*|'#!'*' bash'*|'#!'*'/bash'*|'#!'*' dash'*|'#!'*'/dash'*|'#!'*' ksh'*|'#!'*'/ksh'*) ;;
      *) exit 0 ;;
    esac
    ;;
esac

if ! command -v shellcheck >/dev/null 2>&1; then
  echo "ShellCheck hook skipped: install shellcheck to enable shell diagnostics." >&2
  exit 0
fi

echo "ShellCheck hook: checking $file_path" >&2
shellcheck --format=gcc "$file_path"
status=$?

if [ "$status" -ne 0 ]; then
  echo "ShellCheck hook: diagnostics found. Review quoting, expansion, portability, and error-handling issues before asking Claude to continue." >&2
fi

exit "$status"
SHELLCHECK_STATIC_ANALYSIS_HOOK
chmod 755 "$tmp_path"
rm -f -- "$hook_path"
mv -- "$tmp_path" "$hook_path"
mkdir -p .claude/hooks && touch .claude/hooks/biome-check.sh && chmod +x .claude/hooks/biome-check.sh
mkdir -p $HOME/.claude/hooks && touch $HOME/.claude/hooks/wrangler-config-guard.sh && chmod +x $HOME/.claude/hooks/wrangler-config-guard.sh
Config
{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "./.claude/hooks/shfmt-shell-format-check.sh"
          }
        ]
      }
    ]
  }
}
{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "./.claude/hooks/shellcheck-static-analysis.sh"
          }
        ]
      }
    ]
  }
}
{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "./.claude/hooks/biome-check.sh"
          }
        ]
      }
    ]
  }
}
{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "$HOME/.claude/hooks/wrangler-config-guard.sh"
          }
        ]
      }
    ]
  }
}
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed
Open 4 picks in the interactive comparison tool

Related guides

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.