Cómo impedir que Claude Code borre tu proyecto con hooks de seguridad

·1 views

Los agentes de programación pueden causar pérdidas graves, como ejecutar git reset --hard sobre trabajo no confirmado. Para evitarlo, el artículo propone usar hooks, scripts que Claude Code ejecuta antes o después de usar una herramienta. Un hook PreToolUse que termine con código de salida 2 cancela la acción y devuelve el mensaje de error al agente, que corrige su plan. El autor muestra un script en Python que bloquea comandos peligrosos como rm recursivo sobre directorios críticos, git push forzado, git reset --hard y la ejecución de curl o wget canalizados a un shell. Añade además un patrón similar para proteger archivos sensibles como .env o claves privadas, y explica cómo activarlo en settings.json y comprobarlo desde la consola.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Debugging Cron Trigger Failures in Node.js Scheduled Webhooks

A developer guide explains how to troubleshoot cron-triggered webhook delivery for media shipment updates in Node.js. It recommends checking the schedule configuration and public endpoint, triggering a single run manually, and reviewing run history before adjusting retry settings. The approach uses cron to enqueue work while an idempotent worker handles fan-out, since queued delivery is at-least-once. It stresses isolating one boundary at a time (schedule, endpoint, queue, subscriber) so timer failures and delivery failures are distinguished. The article also notes practical limits such as a 900-second cron execution ceiling, a 4 KB cap on retained run output, and second-level trigger jitter.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Apple's macOS removed from The Open Group's official Unix registry

A Hacker News post reported that Apple's macOS has been removed from The Open Group's official Unix registry. The item drew 158 points and 159 comments on the platform. The source article is primarily a personal essay about childhood amblyopia treatment, which uses the news as a starting point. It describes the author's experience with eye patching and a VR-based vision training app called AmblyoPunch. The article is not a detailed report on the registry change itself.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI coding tool prices unchanged in October 2026; apparent cuts reflect yearly billing

A recheck of 30 AI coding tool pricing pages on 28 October 2026 found no list price changes since mid-October reads. Four tools appeared cheaper only because their pages defaulted to yearly billing, which can make comparisons off by up to 40%. Google is shutting down Firebase Studio on 22 March 2027 and stopped selling new Gemini Code Assist Standard and Enterprise subscriptions on 9 October 2026. Windsurf has been renamed Devin Desktop, and Cursor's cheapest $8 Plus tier only offers Grok models. The comparison covers just two dated snapshots rather than a long-term price history.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS Lambda Ends Python 3.10 Support: Migrate to 3.12+ by October 2026

AWS is deprecating the Python 3.10 runtime for Lambda, with October 31, 2026 set as the deprecation date. After that point, existing functions keep running but stop receiving critical security patches and lose console editing access. Creation and update of functions on the runtime will be blocked starting July 29, 2027 and August 31, 2027, respectively. The change follows Python 3.10's own end-of-life in October 2023, after which the language stopped issuing security updates. Moving to Python 3.12 or later involves more than a version change, since removed modules, a shift to Amazon Linux 2023, and rebuilt compiled dependencies all require attention.

0 comments Read more at DEV Community