Add hooks settings.json with install-hooks target

Hooks provide:
- PostEditTool: ruff format/check on Python, terraform fmt on .tf
- PreCommit: block commits containing hardcoded secrets (AWS keys, API tokens, passwords)

Install per-project with: make install-hooks TARGET=/path/to/project
Won't overwrite existing settings.json — shows diff command instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2 files changed, 34 insertions, 1 deletions

diff --git a/Makefile b/Makefile
index 92933b7..892104a 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,7 @@ RULES_DIR := $(HOME)/.claude/rules
 SKILLS := c4-analyze c4-diagram debug add-tests respond-to-review review-pr fix-issue security-check
 RULES := $(wildcard claude-rules/*.md)
 
-.PHONY: install uninstall list
+.PHONY: install uninstall install-hooks list
 
 install:
 	@mkdir -p $(SKILLS_DIR) $(RULES_DIR)
@@ -34,6 +34,20 @@ install:
 	@echo ""
 	@echo "done"
 
+install-hooks:
+ifndef TARGET
+	$(error Usage: make install-hooks TARGET=/path/to/project)
+endif
+	@mkdir -p $(TARGET)/.claude
+	@if [ -e "$(TARGET)/.claude/settings.json" ]; then \
+		echo "  WARN  $(TARGET)/.claude/settings.json already exists — not overwriting"; \
+		echo "        Compare with: diff $(CURDIR)/hooks/settings.json $(TARGET)/.claude/settings.json"; \
+	else \
+		cp "$(CURDIR)/hooks/settings.json" "$(TARGET)/.claude/settings.json"; \
+		echo "  copy  settings.json → $(TARGET)/.claude/settings.json"; \
+	fi
+	@echo "done"
+
 uninstall:
 	@echo "Skills:"
 	@for skill in $(SKILLS); do \
diff --git a/hooks/settings.json b/hooks/settings.json
new file mode 100644
index 0000000..50fdf09
--- /dev/null
+++ b/hooks/settings.json
@@ -0,0 +1,19 @@
+{
+  "hooks": {
+    "PostEditTool": [
+      {
+        "matcher": "**/*.py",
+        "command": "ruff format $FILE && ruff check --fix $FILE"
+      },
+      {
+        "matcher": "**/*.tf",
+        "command": "terraform fmt $FILE"
+      }
+    ],
+    "PreCommit": [
+      {
+        "command": "! grep -rn --include='*.py' --include='*.ts' --include='*.tsx' --include='*.tf' --include='*.yml' --include='*.yaml' -E '(AKIA[0-9A-Z]{16}|sk-[a-zA-Z0-9]{20,}|password\\s*=\\s*[\"'\\'']{1}[^\"'\\'']+[\"'\\'']{1})' . --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=gathered"
+      }
+    ]
+  }
+}