ClaudeWatch

ClaudeWatch

A Claude Code plugin that enforces command and script safety rules via a PreToolUse hook on Bash, Write, and Edit.

Claude Code's built-in permission system uses naive string matching that fails for compound commands, heredocs, and flag reordering. ClaudeWatch solves this with Python regex rules matched anywhere in the command string (or in the body of a script being written/edited) via re.search().

Rule Sets

The plugin ships these rule sets, each a standalone YAML file auto-discovered by the watchdog engine:

Rule set	File	What it guards
watch-aws	watches/watch-aws.yml	aws … delete-/remove-/deregister-/terminate-/purge-/reset-/revoke- ops, release-address, s3 rm/s3 rb (block); any other aws mutating operation (ask). Read-only get-/list-/describe-/head- ops and s3 ls are allowed. Matches through interspersed global flags (aws --profile prod ec2 …)
watch-bash	watches/watch-bash.yml	rm -rf /, curl | sh, dd of=/dev/sd*, mkfs /dev/*, shred (block); rm -rf outside cache/tmp paths, chmod 777, chown -R, shell eval of dynamic strings (ask). Applies to .sh/.bash/.zsh file content authored via Write/Edit (bash-target rules for the same primitives live in watch-files)
watch-dotnet	watches/watch-dotnet.yml	.NET decompilers (ilspycmd, ildasm, dotpeek, dnspy[ex], justdecompile), unzip/tar of .nupkg, curl/wget of .nupkg, and nuget install (ask). Nudges toward SourceLink instead of decompiling NuGet packages
watch-files	watches/watch-files.yml	rm -rf /, chmod 777, shred, mv /dev/null (block); rm -rf, recursive chmod/chown (ask). Recursive rm confined to the working directory is allowed; deletes reaching outside it still prompt
watch-git	watches/watch-git.yml	Force push and other no-recovery git ops (block); commit, push, push --delete, reset --hard, branch -D, force-with-lease, and other recoverable mutating ops (ask). Stage-only ops (add, rm, non-hard reset) are allowed
watch-installs	watches/watch-installs.yml	curl|sh, global installs, sudo pip/apt (block); npm install, yarn add, pip install, and other dependency changes (ask)
watch-node	watches/watch-node.yml	fs.rmSync at root/$HOME, child_process.exec("rm -rf /"), new Function(...) (block); fs.unlink, fs.rm({recursive:true}), exec/execSync, vm.runIn*Context, eval (ask). Applies to both node -e/bun -e/deno/tsx bash invocations and .js/.mjs/.cjs/.ts/.mts/.cts file content authored via Write/Edit
watch-pwsh	watches/watch-pwsh.yml	Format-Volume, Restart-Computer, IWR | iex (block); Remove-Item -Recurse -Force, Stop-Process -Force, Out-File to sensitive paths (ask). Applies to both pwsh -Command "..." bash invocations and .ps1/.psm1/.psd1 file content authored via Write/Edit
watch-python	watches/watch-python.yml	shutil.rmtree at root/$HOME, pickle.loads, __import__('os').system, subprocess shell=True with destructive payload (block); eval, exec, os.system, os.remove, generic shell=True (ask). Applies to both python3 -c "..." bash invocations and .py file content authored via Write/Edit
watch-ruby	watches/watch-ruby.yml	FileUtils.rm_rf at root/$HOME, Marshal.load, YAML.load on input (block); FileUtils.rm_rf, File.delete, system/exec, backtick-with-interpolation, eval, instance_eval/class_eval/module_eval (ask). Applies to both ruby -e bash invocations and .rb file content authored via Write/Edit
watch-secrets	watches/watch-secrets.yml	cat SSH keys, cloud credentials, echo secrets (block); cat dotfiles, .env files, env/printenv (ask)

Each rule set has an optional filter regex that short-circuits bash commands outside its domain. Rule sets targeting script bodies declare extensions to gate which Write/Edit payloads they evaluate. To add a new rule set, drop a YAML file in watches/. To disable one, rename it to *.yml.disabled.

Pairing with Bash permissions

Agents routinely generate one-off scripts to complete tasks — both inline (python3 -c "...", pwsh -Command "...") and as authored files (Write of a .py or .ps1). Reviewing every such invocation through a permission prompt is impractical: the script body is opaque in the prompt, and clicking "allow" doesn't reflect real consent.