From 0bbfd0e13e0e516340affcf688d18238912fb1d3 Mon Sep 17 00:00:00 2001
From: bot-backend <bot-backend@gendsgn.local>
Date: Thu, 2 Jul 2026 18:15:50 +0300
Subject: [PATCH] fix(claude-hooks): strip commit-message contents before
 pattern match (false positive)

---
 scripts/claude-hooks/check-dangerous-commands.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/scripts/claude-hooks/check-dangerous-commands.py b/scripts/claude-hooks/check-dangerous-commands.py
index 47f3e5f0..fb9f7127 100644
--- a/scripts/claude-hooks/check-dangerous-commands.py
+++ b/scripts/claude-hooks/check-dangerous-commands.py
@@ -48,12 +48,27 @@ PATTERNS: list[tuple[str, str]] = [
 ]
 
 
+def strip_commit_messages(cmd: str) -> str:
+    """Вырезает содержимое -m/--message аргументов git commit.
+
+    Иначе false-positive: `git commit -m "запретили rm -rf"` блокируется из-за
+    текста сообщения. Пейлоады обёрток (powershell -c "git push --force") не
+    страдают — они не привязаны к -m.
+    """
+    return re.sub(
+        r"(\s(?:-m|--message))\s+(\"(?:[^\"\\]|\\.)*\"|'[^']*')",
+        r"\1 MSG",
+        cmd,
+    )
+
+
 def main() -> int:
     try:
         data = json.load(sys.stdin)
         if data.get("tool_name") != "Bash":
             return 0
         cmd = (data.get("tool_input") or {}).get("command") or ""
+        cmd = strip_commit_messages(cmd)
         for pattern, reason in PATTERNS:
             if re.search(pattern, cmd):
                 print(