Rulebook Guard Claude Code mod: Claude Code guardrails for git and writing

Rulebook Guard is a community mod by Hamza Zafar (hamzafer), part of his claude-code-mods collection. It is a small set of Claude Code guardrails that turn a few personal rules, the kind you keep in CLAUDE.md, into hooks that run on every tool call. The author's README describes it as his own setup, to fork and adapt, so read the rules before you adopt them.

There are four rules:

• No em dashes in prose. When Claude writes or edits a Markdown or text file, writes a commit message or PR text, or posts to Slack, each — is replaced with a comma. fast — and small becomes fast, and small. A toast tells you how many were replaced.
• New commits, not git commit --amend. The mod asks first. Claude is told to make a new commit if you say no.
• Format before git push. The mod checks the files in your unpushed commits with ruff format --check and Prettier, and asks if any would change.
• No personal info without asking. An email address or phone number going into your notes, Claude's memory files, CLAUDE.md or a commit command triggers a question.

Use any of the methods in the install block; they install from the author's own marketplace. The hooks load on the next session start or after /reload-plugins. There is no slash command and nothing to configure.

The plugin is one function-hooks module, hooks/register.ts, that registers four tool.call hooks: one each for Write, Edit and Bash, and one catch-all for the Slack tools. A hook either passes the call on unchanged, passes on a rewritten copy, or returns { deny }. This is the Bash hook's amend check, from register.ts:

const shell = bare(command) // what the shell runs, without quoted text or heredoc bodies

if (GIT_AMEND.test(shell)) {
  if (!(await allow($, 'This is `git commit --amend`. Your rule: make a new commit instead.'))) {
    return { deny: 'rulebook-guard: the user blocked `git commit --amend`. Their rule is new commits, not amend. Make a new commit instead.' }
  }
}

bare() blanks out heredoc bodies and quoted strings first, so a command that only mentions git commit --amend in an echo or a script is not held. The regex also allows git global options in between, such as git -c user.name=x -C . commit --amend. allow() calls $.ui.ask with "Block it" and "Allow once", and treats every other answer, or a failed dialog, as a no.

For a push, unformatted() finds the repo root, lists the changed files with git diff --name-only @{u}...HEAD (falling back to origin/main...HEAD) and runs the formatters on them. Private paths for the personal-info rule are ~/notes/, ~/.claude/projects/<project>/memory/ (or .claude-work) and any CLAUDE.md.

There are no /config options and no commands. To change a rule, copy the plugin and edit the constants at the top of register.ts: PROSE_FILE for which files count as prose, EMAIL and PHONE for the personal-info patterns, PRETTIER_FILE for the files sent to Prettier, SLACK_POST for the Slack tools, and isPrivatePath for the folders the personal-info rule covers. Load your copy with claude --plugin-dir <path>. To turn the mod off, run /plugin disable rulebook-guard.

We read every file the plugin can execute before running it: .claude-plugin/plugin.json, hooks/hooks.json, hooks/register.ts (181 lines, the only module) and the tests. There is no package.json, install script, binary, minified code or dynamic import. What we found:

• Gating hooks that rewrite and block. This is the point of the mod. It can change the text of a Markdown write or edit, a git commit or gh pr/gh issue command, and a Slack message, and it can deny an amend, a push or a write. It does this as described in the README. One edge: for commit and PR commands the dash replacement applies to the whole command string, not only the message.
• Runs commands ($.process.run, argv arrays, no shell): git rev-parse --show-toplevel, git diff --name-only, ruff format --check <files> from your PATH, and <repo>/node_modules/.bin/prettier --check <files>. The Prettier binary comes from the project you push from, so in a repo you do not trust, a push runs that repo's Prettier. Git and Prettier calls use a 60 second timeout.
• Reads the environment: only HOME, to find ~/notes/. It does not leave the machine.
• Personal info check: an email or phone number regex over the text being written, and over the whole git commit command, so an address in --author or -c user.email= also triggers the question. The dialog names the category, never the value.
• No network, no file writes, no daemons, no telemetry. The only file API used is an existence check for Prettier. It injects no text into prompts. The deny messages are written for Claude and say the user blocked the action.
• Needs nothing extra. ruff and Prettier are optional; if they are missing the corresponding check is skipped.
• License: MIT, copyright 2026 Hamza Zafar, LICENSE file in the repository root.

claude plugin validate reported no errors and no warnings on 2.1.307. Its notes say that the four tool.call hooks have no .catch handler, so an unexpected exception in the module would not fall back to letting the call through. It also lists a missing plugin icon, which is not a problem for use. The author's 9 tests passed on Claude Code 2.1.307.

Checked with Claude Code 2.1.307 on macOS (validate and tests). The author's marketplace lists version 0.1.2. If a rule does not seem to fire:

• Run /reload-plugins or restart so the hooks load.
• The em dash rewrite only covers Markdown and text files; a .ts or .py file is left alone on purpose.
• The push check needs an upstream branch or origin/main to compare with. If neither exists, or git diff fails, the check is skipped and the push goes through.
• Prettier is only used if node_modules/.bin/prettier exists in the repo root, and ruff must be on your PATH.
• The personal-info rule for files only covers ~/notes/, the memory folders and CLAUDE.md. A write to any other path is not checked.
• In a non-interactive run there is nobody to answer the dialog, so held actions are blocked.

To test it, ask Claude to write a short Markdown note containing an em dash. The file should contain a comma and a toast should report the replacement.