Guard Completion of a Deploy-Tagged Task Without Sign-Off
A task queue is easy to treat as a checklist an agent can tick off itself. This blocks completion specifically for tasks whose own title or description mentions deploy/production, unless a `reviewer:` tag is present — a cheap, task-level approval gate that doesn't depend on the agent remembering to ask.
1. Save this as the hook script
#!/usr/bin/env python3
"""TaskCompleted hook — blocks completing a deploy/production-tagged task
without a reviewer tag present in its description."""
import json, re, sys
data = json.load(sys.stdin)
task = data.get("task") or {}
text = f"{task.get('title', '')} {task.get('description', '')}"
if re.search(r"(?i)\b(deploy|production)\b", text) and not re.search(r"(?i)reviewer:", text):
print("BLOCKED: this task mentions deploy/production but has no `reviewer:` "
"tag. Add one once a human has signed off.", file=sys.stderr)
sys.exit(2)
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/guard-deploy-task-completion.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"TaskCompleted": [
{
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/guard-deploy-task-completion.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks