v0.2.0

This is the first tagged release of the template. A copy made with "Use this template" doesn't receive later fixes, so a release is how its owner hears about one.

If your copy is older than this release, its shell guard is behind, and the guard here catches things yours lets through.

• More than one file in a delete or a move. rm -f old.log .env and mv .env backup.txt used to pass.
• More ways of pushing to main, such as git push origin HEAD:main and git -C <dir> push origin main.
• PowerShell commands. The hook's matcher named Bash only, so a PowerShell call reached no hook.
• A delete continued onto a second line, and a redirect to a quoted path with a space in it.

If you copied the template between 8 October 2026 and this release, there are two more reasons to update. That version of the guard stopped checking a command that sits behind then or do or inside braces, so if [ -f .env ]; then rm .env; fi passed. It also stopped reading at the first #, so a delete on the line below a comment passed. Both are checked again here.

Two things are known to go the other way. A copy made before 8 October has a guard that matched a delete or a push anywhere in the command text. This one reads the command each statement starts with, so it misses a few shapes the old one caught, such as a delete or a push behind timeout or eval, and a delete whose path is built by an unquoted $(...). A copy made since then has a guard that stopped reading at the first #, even one in the middle of a word. This one reads past a # that doesn't start a word, as in x#y, $# or ${x#y}, the way the shell does. Where a quote mark further on is left open, or is one the shell reads as plain text (a quote behind a backslash, an apostrophe in a here-document), it can miss a delete or a push inside quotes or behind a quoted value with a space in it, which the 8 October guard refused. The README's section on the hooks lists what the guard doesn't follow.

To update, copy .claude/hooks/check_bash_command.py from this release over your own, and take .github/workflows/ci.yml as well if your copy kept it, since it holds the test cases for everything above.

Then bring .claude/settings.json into line. Copy it across if you never edited it. If you did, change its hooks block to match this one, where the shell guard's matcher is Bash|PowerShell and both hooks start as python3 with a path anchored to the project folder.

Either way, run python3 -c "print(1)" afterwards. If it doesn't print 1, set "command" to python or py in both hook entries. A hook that can't start blocks nothing.