Claude Code hooks that block find/sed/cat, redirect to native tools

I'll check the source repo so the paragraphs stick to real project details and avoid invented numbers.HabibiCodeCH published claude-no-bash-detour on GitHub: three Claude Code PreToolUse hooks that deny Bash patterns with a native tool equivalent—find/grep chains, sed -i style edits, and cat/head/tail file reads—and point the model at Grep, Glob, Edit, or Read instead. The project surfaced on Hacker News under Claude/Codex/Fable with two points and zero comments at listing time. The repo ships the hooks, an install.sh that writes into Claude Code settings, and an MIT license.

Mechanically, each hook is a standalone script. It reads the PreToolUse stdin JSON, inspects tool_input.command, and on a match emits hookSpecificOutput with permissionDecision set to deny plus a permissionDecisionReason that names the preferred native tool; unmatched commands pass through. deny-find-chains.sh targets find with -exec or piped grep/xargs style chains and leaves plain find, plain grep, and substring false positives alone. deny-sed-inplace.sh blocks sed -i / gsed -i / --in-place variants (including BSD empty-suffix form) but allows stdout-only sed and pipe transforms. deny-cat-head-tail.sh blocks single-file cat/head/tail and sudo cat, while leaving tail -f, multi-file cat, pipes, and redirects alone. Matching is deliberate text heuristics on the raw command string, not a shell parser; the README notes misses on obfuscated option clusters and false denials when the pattern appears only in a comment or string.

For builders running Claude Code with approval gates, the pain is concrete: CLAUDE.md nudges not to use find -exec or sed -i are suggestions only, so the model still reaches for shell one-liners, each of which can stall on a permission prompt. Native Grep/Glob/Edit/Read calls often need no such approval. A PreToolUse deny at the harness level runs before the Bash call hits the user, returns a reason the model can retry on, and once set in settings.json applies across sessions and subagents instead of re-teaching the same rule in every thread.

In the broader agent-harness market, this sits next to other Claude Code, Codex, and similar tooling that mix free-form Bash with first-party file tools. Many setups still rely on prompt policy or manual allowlists; this project treats the detour as a policy bug and fixes it with installable deny hooks rather than more prose. It does not claim to replace full command sandboxing or a real shell AST checker—only to cut a high-frequency class of avoidable Bash detours.

Install via git clone and ./install.sh (global or --project, optional single-hook names); jq is required, the installer is idempotent, backs up settings.json, and leaves existing hooks untouched. Restart Claude Code or open /hooks after install. Practical next steps: try the three hooks on a real multi-agent repo day, watch for false denies and missed forms listed in the README, and treat tighter parsing or allowlist exceptions as the natural follow-on if the heuristics get noisy.