Conversation
Add a PreToolUse hook that blocks any GitHub or Jira comment posted by Claude Code whose body is missing the "via Claude Code" attribution. Covers gh pr comment, gh issue comment, gh pr review, gh api comment calls, and the Jira addCommentToJiraIssue MCP tool. Broaden the AGENTS.md attribution rule to name GitHub PRs and issues, not just Jira, and point to the hook as the enforcement mechanism. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
kimsauce
changed the title
4 tasks
Reverse the rule this ticket originally asked for. Claude Code posts through a contributor's own GitHub and Jira account, so on a comment the attribution marker was the only thing revealing that a machine wrote it, and it piled up on teammates' pull requests under a colleague's name. Comments now carry no attribution at all. Rename require-claude-attribution.sh to forbid-claude-attribution.sh and invert it: it denies a call that carries the marker rather than one that omits it. Coverage is GitHub PR, issue and review comments, Jira comments, and Slack messages. Pull request descriptions are not inspected, since a description is not a comment and the harness stamps its own line into PR bodies by default. Four things the naive inversion got wrong, all fixed here: - Match markdown-linked variants, so "Generated with [Claude Code](...)" is caught and not just the bare phrase. - Anchor the GitHub CLI guard to command position, so a command that merely mentions those subcommands is not blocked. Editing this rule's own documentation tripped the hook otherwise. - Inspect file-supplied bodies (--body-file, --input, -F field=@path, quoted or not) by reading the path off the command line. A hook never receives file contents, and anything multi-line has to go through a file, so this was the common path for real review content and it was going unchecked. - Restrict the gh api branch to writes. A read-only scan for existing attribution puts the marker in its own --jq filter, which self-denied. Also document the known gaps, which fail open rather than blocking legitimate work: a body path held in a shell variable, an unreadable path, and stdin sources such as `--input -`. AGENTS.md: rewrite both attribution bullets for the reversed rule, and add a Jira comment format bullet, since Jira comments are stored as ADF and a markdown @mention posts as literal text that notifies nobody. Verified with 22 synthetic tool-call payloads covering the deny and must-not-fire paths, plus live probes confirming the harness applies it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kimsauce
marked this pull request as ready for review
September 9, 2026 04:01
The hook had no committed test, so anyone changing it had to reconstruct the cases by hand. This adds them as a runnable script next to the hook. 31 cases split by what they protect: attribution must never reach a comment (inline bodies, chained commands, file-supplied bodies in every quoting form, Jira and Slack tools), and the hook must not block legitimate work (clean equivalents, pull request descriptions, commit trailers, doc edits, read-only scans, stdin and unreadable paths). Self-contained and portable. Paths resolve from the script location, fixtures go in a mktemp directory cleaned up on exit, and it exits non-zero on failure so it can run in CI. The marker strings are assembled at runtime so the file does not carry a bare marker that would trip the hook when edited from a shell. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
4 tasks
amee-sumo
reviewed
Sep 10, 2026
amee-sumo
left a comment
amee-sumo
left a comment
Collaborator
There was a problem hiding this comment.
Left inline comments on the Jira tool-name mismatch (blocking) and the related test-coverage gap (non-blocking). Full writeup in my top-level review comment.
…ught The hook and its matcher targeted the literal tool name mcp__atlassian__addCommentToJiraIssue. Environments whose Atlassian MCP server uses a different prefix (e.g. mcp__claude_ai_Atlassian_Rovo__) were never matched, so attribution slipped through silently. Match on the addCommentToJiraIssue suffix instead, consistent with the Slack entries. Adds prefixed deny/allow test cases to lock this in. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose of this pull request
Adds a PreToolUse hook that stops Claude Code from appending its attribution marker to comments. Claude Code posts through a contributor's own GitHub and Jira account, so on a comment that marker is the only thing revealing a machine wrote it.
.claude/hooks/forbid-claude-attribution.shdenies any call carryingvia Claude CodeorGenerated with Claude Code, including markdown-linked forms..claude/settings.jsonregisters it onBashand on the Jira and Slack comment tools.AGENTS.mdstates the rule, and adds a note that Jira comments are stored as ADF, so a markdown@mentionposts as literal text and notifies nobody..claude/hooks/forbid-claude-attribution.test.shis a runnable test matrix for the hook.Scope
Blocked: GitHub PR, issue, and review comments, Jira comments, Slack messages. Both inline bodies and file-supplied bodies are inspected, the latter by reading the path off the command line and checking the file (
--body-file,--input,-F field=@path, quoted or not).Not inspected: pull request descriptions, documentation content, and the
Co-Authored-Bycommit trailer.Testing
33 cases, covering both the paths that must deny and the paths that must not fire. Eleven of those exist to confirm the hook does not block legitimate work: pull request descriptions, commit trailers, doc edits, and read-only searches. Exits non-zero on failure, so it can run in CI. Also verified with live probes that the harness applies the hook.
No
/docscontent changed.Select the type of change
Ticket (if applicable)
https://sumologic.atlassian.net/browse/DOCS-1867
🤖 Generated with Claude Code