Branch Protection Guard

Pre-ToolBeginnerHook Type: pre-tool-use

Branch Protection Guard intercepts all file write, edit, and git commit operations to verify the current git branch is not in a configurable list of protected branches. If Claude attempts to modify files while on main, master, production, or any branch you specify, the hook blocks the action and suggests creating a feature branch first. This prevents accidental direct commits to critical branches and enforces your team's branching strategy.

gitbranchprotectionsafety

Hook Code

#!/bin/bash
# Branch Protection Guard Hook
# Blocks writes and commits on protected branches

# Protected branches list (customize as needed)
PROTECTED_BRANCHES="main master production staging"

# Only check write/edit/bash operations
if [[ "$TOOL_NAME" != "Edit" ]] && [[ "$TOOL_NAME" != "Write" ]] && [[ "$TOOL_NAME" != "Bash" ]]; then
  exit 0
fi

# For Bash, only check git commit/push commands
if [[ "$TOOL_NAME" == "Bash" ]]; then
  if ! echo "$TOOL_INPUT" | grep -qE "git (commit|push|merge|rebase)"; then
    exit 0
  fi
fi

# Get current branch
CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)

if [ -z "$CURRENT_BRANCH" ]; then
  exit 0  # Not in a git repo, skip
fi

for BRANCH in $PROTECTED_BRANCHES; do
  if [ "$CURRENT_BRANCH" = "$BRANCH" ]; then
    echo "BLOCKED: Cannot modify files on protected branch '$BRANCH'."
    echo "Please create a feature branch first:"
    echo "  git checkout -b feature/your-change"
    exit 1
  fi
done

exit 0

Add this hook to your Claude Code settings or .claude/settings.json to activate.

Terminal Preview

Branch Protection Guard

About Branch Protection Guard

Claude Code hooks let you run custom shell commands automatically in response to specific events during Claude's operation. Branch Protection Guard is a Pre-Tool hook at the Beginner level that automates tasks at key moments in your development workflow, reducing manual steps and enforcing consistency across your team.

Related Hooks

Pre-Commit Lint

Automatically run ESLint and Prettier checks before Claude commits code to catch style issues early.

Security Secret Scanner

Scan code changes for accidentally committed secrets, API keys, and credentials before they reach git.