Claude Code自动化实战：从-p模式到Hooks全攻略

# 最简单的用法：直接传入提示词
claude -p "解释 src/index.ts 的入口函数功能"

# 等价写法
claude --print "解释 src/index.ts 的入口函数功能"

# 将 git diff 传给 Claude 做代码审查
git diff HEAD~3..HEAD | claude -p "审查这些变更，列出潜在的安全问题和性能瓶颈"

# 将测试输出传给 Claude 做错误分析
npm test 2>&1 | claude -p "分析测试失败原因并给出具体修复建议"

# 将日志文件传给 Claude 做故障诊断
tail -100 /var/log/app.log | claude -p "分析最近的错误日志，判断根因"

# 将 JSON API 响应传给 Claude 做数据提取
curl -s https://api.example.com/users | claude -p "提取所有活跃用户的邮箱地址"

# 纯文本（默认，适合人类阅读）
claude -p "列出 src/ 目录下所有 API 端点" --output-format text

# JSON 格式（适合程序解析）
claude -p "列出所有 TODO 注释" --output-format json

# 流式 JSON（适合实时监控长任务）
claude -p "重构 src/auth.ts 模块" --output-format stream-json

{
  "type": "result",
  "subtype": "success",
  "cost_usd": 0.0342,
  "duration_ms": 4521,
  "duration_api_ms": 3100,
  "num_turns": 3,
  "result": "发现 7 个 TODO 注释：\n1. src/auth.ts:42 - TODO: 添加 token 过期检查..."
}

claude -p \
  --output-format json \
  --json-schema '{
    "type": "object",
    "properties": {
      "findings": {
        "type": "array",
        "items": {
          "type": "object",
          "properties": {
            "file": {"type": "string"},
            "line": {"type": "integer"},
            "severity": {"type": "string", "enum": ["low", "medium", "high"]},
            "description": {"type": "string"}
          },
          "required": ["file", "line", "severity", "description"]
        }
      },
      "summary": {"type": "string"}
    },
    "required": ["findings", "summary"]
  }' \
  "审查当前 git diff，输出所有代码质量问题"

# 提取高严重性问题
claude -p --output-format json --json-schema '...' "审查代码" | jq '.findings[] | select(.severity == "high")'

# 限制单次运行费用（美元）
claude -p "重构这个模块" --max-budget-usd 0.50

# 限制 Agent 循环轮次
claude -p "修复所有 lint 错误" --max-turns 10

# 同时限制（双重保险）
claude -p "升级依赖" --max-turns 15 --max-budget-usd 2.00

# 只允许读取和搜索（安全审查场景）
claude -p "审查代码安全性" \
  --allowedTools "Read,Glob,Grep"

# 允许执行但禁止危险命令
claude -p "运行测试并修复" \
  --allowedTools "Read,Write,Edit,Bash(npm:*),Bash(node:*)" \
  --disallowedTools "Bash(rm -rf:*)"

# 完全无限制（仅限 Docker/沙箱环境）
claude -p "全面重构" --dangerously-skip-permissions

~/.claude/settings.json          ← 全局（所有项目生效）
.claude/settings.json            ← 项目级（提交到 Git，团队共享）
.claude/settings.local.json      ← 项目本地（不提交 Git，个人定制）

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "bash .claude/hooks/protect-sensitive.sh"
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "bash .claude/hooks/auto-format.sh"
          }
        ]
      }
    ],
    "Notification": [
      {
        "matcher": "",
        "hooks": [
          {
            "type": "command",
            "command": "bash .claude/hooks/notify.sh"
          }
        ]
      }
    ]
  }
}

flowchart TD
    A[SessionStart<br/>会话启动] --> B[UserPromptSubmit<br/>用户提交Prompt]
    B --> C{Claude 决策}
    C -->|调用工具| D[PreToolUse<br/>工具执行前]
    D -->|exit 0| E[工具执行]
    D -->|exit 2| F[❌ 阻止执行]
    E --> G[PostToolUse<br/>工具执行后]
    E -->|失败| H[PostToolUseFailure<br/>执行失败]
    G --> I{还有工具调用?}
    I -->|是| D
    I -->|否| J[Stop<br/>Agent 退出]
    J -->|Stop Hook| K[可注入新 Prompt<br/>Ralph Loop]

    style F fill:#ff6b6b,color:#fff
    style D fill:#ffd93d
    style G fill:#6bcb77
    style K fill:#4d96ff,color:#fff

"matcher": "Bash"                    // 精确匹配 Bash 工具
"matcher": "Write|Edit"              // 匹配 Write 或 Edit
"matcher": "Write|Edit|MultiEdit"    // 所有文件写入操作
"matcher": "mcp__github__*"          // 匹配 GitHub MCP 工具
"matcher": ""                        // 空字符串 = 匹配所有

{
  "session_id": "abc123-def456",
  "tool_name": "Bash",
  "tool_input": {
    "command": "rm -rf /tmp/test"
  }
}

#!/bin/bash
# 读取 Hook 输入
INPUT=$(cat)
FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')

# 定义敏感文件模式
SENSITIVE_PATTERNS=(".env" "credentials" "secrets" ".pem" ".key" "id_rsa" "private")

# 检查文件路径是否匹配敏感模式
for pattern in "${SENSITIVE_PATTERNS[@]}"; do
  if [[ "$FILE_PATH" == *"$pattern"* ]]; then
    echo "🚫 安全策略：禁止修改包含 '$pattern' 的文件：$FILE_PATH" >&2
    exit 2  # 阻止操作
  fi
done

# 允许通过
echo '{}'
exit 0

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Write|Edit|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "bash .claude/hooks/protect-sensitive.sh"
          }
        ]
      }
    ]
  }
}

#!/bin/bash
INPUT=$(cat)
FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')

# 根据文件类型选择格式化工具
case "$FILE_PATH" in
  *.ts|*.tsx|*.js|*.jsx)
    npx prettier --write "$FILE_PATH" 2>/dev/null
    echo "✅ Prettier 已格式化: $FILE_PATH" >&2
    ;;
  *.py)
    python -m black "$FILE_PATH" 2>/dev/null
    echo "✅ Black 已格式化: $FILE_PATH" >&2
    ;;
  *.go)
    gofmt -w "$FILE_PATH" 2>/dev/null
    echo "✅ gofmt 已格式化: $FILE_PATH" >&2
    ;;
esac

exit 0  # 格式化不影响操作

#!/bin/bash
INPUT=$(cat)
CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty')

# 危险命令模式列表
DANGEROUS_PATTERNS=(
  "rm -rf /"
  "rm -rf ~"
  "DROP TABLE"
  "drop table"
  "git push --force"
  "chmod 777"
  "> /etc/"
  "mkfs"
  "dd if="
)

for pattern in "${DANGEROUS_PATTERNS[@]}"; do
  if echo "$CMD" | grep -qiE "$pattern"; then
    echo "🚫 危险命令被拦截: 检测到 '$pattern'" >&2
    echo "完整命令: $CMD" >&2
    exit 2
  fi
done

exit 0

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash .claude/hooks/block-dangerous.sh"
          }
        ]
      }
    ]
  }
}

{
  "hooks": {
    "Notification": [
      {
        "matcher": "",
        "hooks": [
          {
            "type": "http",
            "url": "https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK",
            "method": "POST",
            "headers": {
              "Content-Type": "application/json"
            }
          }
        ]
      }
    ]
  }
}

#!/bin/bash
# .claude/hooks/ralph-loop.sh
INPUT=$(cat)

# 检查是否已经完成
if [ -f "TASK_COMPLETE.marker" ]; then
  exit 0  # 允许退出
fi

# 检查迭代次数
ITERATIONS=$(cat .claude/iteration-count 2>/dev/null || echo "0")
if [ "$ITERATIONS" -ge 20 ]; then
  exit 0  # 安全阀：最多 20 轮
fi

# 注入新 prompt，让 Agent 继续
NEW_ITERATIONS=$((ITERATIONS + 1))
echo "$NEW_ITERATIONS" > .claude/iteration-count
echo "继续工作。当前进度: 第 ${NEW_ITERATIONS} 次迭代。" >&2
exit 2  # 阻止退出，Agent 收到 stderr 反馈后继续

---
name: security-auditor
description: 安全审计专家，检测 OWASP Top 10 漏洞
model: claude-haiku-4-5
tools:
  - Read
  - Glob
  - Grep
---

你是一位专业的安全审计员。扫描代码中的以下漏洞类型：

1. SQL 注入（未参数化的查询）
2. XSS（未转义的用户输入）
3. 硬编码密钥和凭证
4. 不安全的反序列化
5. 路径遍历

输出格式：
- 文件路径:行号
- 漏洞类型
- 严重程度（高/中/低）
- 修复建议

flowchart TB
    subgraph Fan-out["Fan-out 扇出模式"]
        FO_Parent[父 Agent] --> FO_A1[Agent 1: 安全审查]
        FO_Parent --> FO_A2[Agent 2: 性能分析]
        FO_Parent --> FO_A3[Agent 3: 风格检查]
        FO_Parent --> FO_A4[Agent 4: 可维护性]
        FO_A1 & FO_A2 & FO_A3 & FO_A4 --> FO_Synthesis[结果汇总]
    end

    subgraph Pipeline["Pipeline 管道模式"]
        PL_Explore[探索] --> PL_Design[设计]
        PL_Design --> PL_Implement[实现]
        PL_Implement --> PL_Verify[验证]
    end

    subgraph MapReduce["Map-Reduce 模式"]
        MR_Input[输入: 50个文件] --> MR_M1[Agent: 文件1-10]
        MR_Input --> MR_M2[Agent: 文件11-20]
        MR_Input --> MR_M3[Agent: 文件21-30]
        MR_Input --> MR_M4[Agent: 文件31-40]
        MR_Input --> MR_M5[Agent: 文件41-50]
        MR_M1 & MR_M2 & MR_M3 & MR_M4 & MR_M5 --> MR_Reduce[聚合去重]
    end

    style Fan-out fill:#e8f5e9
    style Pipeline fill:#e3f2fd
    style MapReduce fill:#fff3e0

name: Claude Code Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # 获取完整历史，diff 才准确

      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code

      - name: Run AI Code Review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          # 获取变更文件列表和 diff
          CHANGED_FILES=$(git diff --name-only origin/main...HEAD)
          DIFF=$(git diff origin/main...HEAD)

          # 使用 -p 模式运行审查
          claude -p "你是一位高级代码审查员。审查以下变更：

          变更文件：
          ${CHANGED_FILES}

          Diff 内容：
          ${DIFF}

          请从以下维度审查：
          1. 代码正确性（逻辑错误、边界条件）
          2. 安全漏洞（注入、XSS、信息泄露）
          3. 性能问题（N+1 查询、内存泄漏）
          4. 可维护性（命名、注释、复杂度）

          用中文输出，按严重程度排序。" \
          --output-format text \
          --allowedTools "Read,Glob,Grep" \
          --max-turns 5 \
          --max-budget-usd 1.00 \
          > review_output.md

      - name: Post Review Comment
        uses: actions/github-script@v7
        with:
          script: |
            const review = require('fs').readFileSync('review_output.md', 'utf8');
            github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `## 🤖 Claude Code Review\n\n${review}`
            });

name: Claude Auto Fix
on:
  issues:
    types: [labeled]

jobs:
  auto-fix:
    if: github.event.label.name == 'claude-fix'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      issues: write
    steps:
      - uses: actions/checkout@v4

      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code

      - name: Process Issue
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          ISSUE_TITLE: ${{ github.event.issue.title }}
          ISSUE_BODY: ${{ github.event.issue.body }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
        run: |
          # 创建修复分支
          git checkout -b "fix/issue-${ISSUE_NUMBER}"

          # 让 Claude 分析并修复
          claude -p \
            --max-turns 15 \
            --max-budget-usd 3.00 \
            --dangerously-skip-permissions \
            "GitHub Issue #${ISSUE_NUMBER}: ${ISSUE_TITLE}

          问题描述：
          ${ISSUE_BODY}

          请分析这个 Issue，定位相关代码文件，实现修复，确保代码通过测试。"

      - name: Create Pull Request
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git add -A
          git commit -m "fix: resolve #${{ github.event.issue.number }} — ${{ github.event.issue.title }}"
          git push origin "fix/issue-${{ github.event.issue.number }}"
          gh pr create \
            --title "fix: #${{ github.event.issue.number }} — ${{ github.event.issue.title }}" \
            --body "自动修复 Issue #${{ github.event.issue.number }}" \
            --label "auto-generated"

flowchart LR
    A[CI/CD 安全层级] --> B[1. 工具白名单<br/>--allowedTools]
    A --> C[2. 费用上限<br/>--max-budget-usd]
    A --> D[3. 轮次上限<br/>--max-turns]
    A --> E[4. 环境隔离<br/>Docker 容器]
    A --> F[5. 禁用遥测<br/>CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC]

    B --> G[✅ 安全的自动化]
    C --> G
    D --> G
    E --> G
    F --> G

my-project/
├── .claude/
│   ├── settings.json          # Hooks 配置
│   ├── hooks/
│   │   ├── auto-format.sh     # 自动格式化
│   │   ├── block-sensitive.sh # 敏感文件保护
│   │   └── block-dangerous.sh # 危险命令拦截
│   └── agents/
│       └── security-auditor.md
├── .github/
│   └── workflows/
│       └── claude-review.yml  # CI/CD 工作流
├── scripts/
│   └── quality-gate.sh        # 本地质量门禁脚本
└── src/
    └── ...

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Write|Edit|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "bash .claude/hooks/block-sensitive.sh"
          }
        ]
      },
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash .claude/hooks/block-dangerous.sh"
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "bash .claude/hooks/auto-format.sh"
          }
        ]
      }
    ]
  }
}

#!/bin/bash
set -euo pipefail

echo "🔍 Claude Code 质量门禁"
echo "========================"

# 获取变更文件
CHANGED_FILES=$(git diff --name-only --cached)
if [ -z "$CHANGED_FILES" ]; then
  echo "✅ 没有暂存的变更，跳过审查。"
  exit 0
fi

echo "📝 待审查文件："
echo "$CHANGED_FILES"
echo ""

# 阶段 1: 安全扫描
echo "🔒 阶段 1/3: 安全漏洞扫描..."
SECURITY_RESULT=$(echo "$CHANGED_FILES" | claude -p \
  --output-format json \
  --allowedTools "Read,Glob,Grep" \
  --max-turns 3 \
  --max-budget-usd 0.50 \
  --json-schema '{
    "type": "object",
    "properties": {
      "vulnerabilities": {
        "type": "array",
        "items": {
          "type": "object",
          "properties": {
            "file": {"type": "string"},
            "line": {"type": "integer"},
            "type": {"type": "string"},
            "severity": {"type": "string", "enum": ["low", "medium", "high", "critical"]}
          }
        }
      },
      "passed": {"type": "boolean"}
    },
    "required": ["vulnerabilities", "passed"]
  }' \
  "扫描以下文件中的安全漏洞（SQL注入、XSS、硬编码密钥等）：$(echo "$CHANGED_FILES" | tr '\n' ' ')")

PASSED=$(echo "$SECURITY_RESULT" | jq -r '.passed')
if [ "$PASSED" != "true" ]; then
  echo "❌ 安全扫描未通过！"
  echo "$SECURITY_RESULT" | jq '.vulnerabilities[]'
  exit 1
fi
echo "✅ 安全扫描通过"

# 阶段 2: 代码质量审查
echo "📐 阶段 2/3: 代码质量审查..."
DIFF=$(git diff --cached)
claude -p \
  --output-format text \
  --allowedTools "Read,Glob,Grep" \
  --max-turns 3 \
  --max-budget-usd 0.50 \
  "用简洁的中文审查以下 diff 的代码质量。只列出严重问题，忽略风格偏好：

  $DIFF" | tee .claude/review-output.md

# 阶段 3: 统计
echo ""
echo "📊 阶段 3/3: 审查统计"
echo "变更文件数: $(echo "$CHANGED_FILES" | wc -l)"
echo "审查报告: .claude/review-output.md"
echo ""
echo "✅ 质量门禁完成！"

# 在项目根目录执行
chmod +x scripts/quality-gate.sh
ln -sf ../../scripts/quality-gate.sh .git/hooks/pre-commit

flowchart TD
    A[开发者 git commit] --> B{Pre-commit Hook}
    B -->|安全扫描| C{有高危漏洞?}
    C -->|是| D[❌ 阻止 Commit]
    C -->|否| E[✅ Commit 成功]
    E --> F[git push]
    F --> G[创建 Pull Request]
    G --> H[GitHub Actions 触发]
    H --> I[Claude -p 模式审查]
    I --> J[结构化审查报告]
    J --> K[发布 PR 评论]
    K --> L[团队评审 & 合并]

    M[Claude Code 交互模式] --> N{Hooks 守卫}
    N -->|PreToolUse| O[敏感文件保护]
    N -->|PreToolUse| P[危险命令拦截]
    N -->|PostToolUse| Q[自动格式化]

    style D fill:#ff6b6b,color:#fff
    style E fill:#6bcb77,color:#fff
    style J fill:#4d96ff,color:#fff

#!/bin/bash
# batch-upgrade.sh - 批量升级多个仓库的依赖
REPOS=("api-gateway" "user-service" "payment-service" "notification-service")

for repo in "${REPOS[@]}"; do
  echo "🔄 处理仓库: $repo"
  cd "/projects/$repo"

  claude -p \
    --max-turns 15 \
    --max-budget-usd 2.00 \
    --dangerously-skip-permissions \
    "将所有 npm 依赖升级到最新的稳定版本。确保不引入 breaking changes。运行测试确认一切正常。"

  echo "✅ $repo 处理完成"
done

#!/bin/bash
# agent-loop.sh - 持续迭代直到任务完成
MAX_ITERATIONS=10
TASK_FILE="AGENT_TASK.md"

cat > "$TASK_FILE" << 'EOF'
# 任务：将所有 class 组件转换为函数组件
## 进度：0%
## 已完成：无
## 剩余：全部
EOF

for i in $(seq 1 $MAX_ITERATIONS); do
  echo "🔄 迭代 $i/$MAX_ITERATIONS"

  RESULT=$(claude -p \
    --max-turns 20 \
    --max-budget-usd 1.00 \
    "阅读 $TASK_FILE 了解任务和当前进度。
    转换下一个 class 组件为函数组件。
    更新 $TASK_FILE 中的进度。
    如果所有组件已转换完毕，在最后一行输出 TASK_COMPLETE。")

  if echo "$RESULT" | grep -q "TASK_COMPLETE"; then
    echo "✅ 任务完成！"
    break
  fi

  if echo "$RESULT" | grep -q "TASK_BLOCKED"; then
    echo "⚠️ 任务受阻，需要人工介入。"
    break
  fi
done

# 每 5 分钟检查部署状态
/loop 5m check if the deployment finished

# 动态间隔（Claude 智能选择间隔）
/loop check whether CI passed

CronCreate({
  cron: "57 8 * * 1-5",    // 工作日 8:57
  prompt: "检查未处理的 PR 并生成摘要",
  recurring: true,
  durable: true            // 持久化，重启后恢复
})

# plan 模式：只规划不执行，适合架构评审
claude -p --permission-mode plan "分析这个微服务架构的问题"

# auto 模式：自动处理大部分权限请求，适合受信任脚本
claude -p --permission-mode auto "升级依赖并运行测试"

# dontAsk 模式：不询问直接执行，仅在沙箱中使用
claude -p --permission-mode dontAsk "全面重构代码"

# bypassPermissions 模式：绕过权限检查
claude -p --permission-mode bypassPermissions "执行迁移"

# default 模式：正常交互式权限确认（默认值）
claude -p --permission-mode default "修复 bug"

{
  "permissions": {
    "allow": [
      "Bash(git:*)",
      "Bash(npm:*)",
      "Bash(npx:*)",
      "Bash(node:*)",
      "Bash(jest:*)",
      "Read",
      "Glob",
      "Grep"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(git push --force:*)",
      "Bash(curl|wget:*)"
    ]
  }
}

flowchart TD
    A[用户发起操作] --> B{1. 权限白名单<br/>permissions.allow/deny}
    B -->|deny 列表| C[❌ 直接拒绝]
    B -->|allow 列表| D{2. PreToolUse Hooks}
    B -->|未匹配| D
    D -->|exit 2| E[❌ Hook 拦截]
    D -->|exit 0| F{3. Claude 自主判断<br/>AI 安全评估}
    F -->|风险过高| G[❌ Claude 拒绝]
    F -->|安全| H[✅ 执行操作]
    D -->|exit 0 + stderr| I[⚠️ 警告但允许]
    I --> F

    style C fill:#ff6b6b,color:#fff
    style E fill:#ff6b6b,color:#fff
    style G fill:#ffd93d
    style H fill:#6bcb77,color:#fff
    style I fill:#ffd93d

# 启用调试日志
claude -p "任务描述" --debug-file ./claude-debug.log

# 查看 Hook 输入输出
CLAUDE_CODE_DEBUG_HOOKS=1 claude -p "任务描述"

# 查看工具调用链（stream-json 模式）
claude -p "任务描述" --output-format stream-json | jq '.type'