Cursor hooks.json generator

Run in a terminal. The scripts need jq.

mkdir -p ~/.cursor/hooks
# save each script below into that folder, then:
chmod +x ~/.cursor/hooks/guard-shell.sh ~/.cursor/hooks/protect-env.sh ~/.cursor/hooks/notify-stop.sh
command -v jq >/dev/null || echo 'Install jq first: brew install jq (macOS) or apt install jq'

Save as ~/.cursor/hooks.json. Restart Cursor if a hook doesn't run.

{
  "version": 1,
  "hooks": {
    "beforeShellExecution": [
      {
        "command": "./hooks/guard-shell.sh",
        "timeout": 5
      }
    ],
    "beforeReadFile": [
      {
        "command": "./hooks/protect-env.sh",
        "timeout": 5
      }
    ],
    "stop": [
      {
        "command": "./hooks/notify-stop.sh",
        "timeout": 10
      }
    ]
  }
}

Save as ~/.cursor/hooks/guard-shell.sh

#!/bin/bash
# guard-shell.sh: Cursor beforeShellExecution hook. Made with taskhold.com/tools/cursor-hooks.
# Reads the hook's JSON from stdin; needs jq.
# Blocks: git push --force / -f, git reset --hard, rm -rf / or ~.
input=$(cat)
cmd=$(printf '%s' "$input" | jq -r '.command // empty')
if printf '%s' "$cmd" | grep -qE '(git push.*(--force|-f( |$)))|(git reset --hard)|(rm -[a-z]*r[a-z]*f?[a-z]* +(/|~)( |$))'; then
  jq -cn --arg c "$cmd" '{permission: "deny", user_message: ("Blocked by a hook: " + $c), agent_message: "This command is blocked by a hook. Use a safer alternative or ask me to run it."}'
  exit 0
fi
echo '{"permission":"allow"}'

Save as ~/.cursor/hooks/protect-env.sh

#!/bin/bash
# protect-env.sh: Cursor beforeReadFile hook. Made with taskhold.com/tools/cursor-hooks.
# Reads the hook's JSON from stdin; needs jq.
input=$(cat)
path=$(printf '%s' "$input" | jq -r '.file_path // empty')
name=$(basename "$path")
case "$name" in
  .env|.env.*|*.pem|*.key|id_rsa|id_ed25519)
    case "$name" in .env.example|.env.sample|.env.template) echo '{"permission":"allow"}'; exit 0 ;; esac
    jq -cn --arg p "$path" '{permission: "deny", user_message: ("Kept out of the agent: " + $p)}'
    exit 0 ;;
esac
echo '{"permission":"allow"}'

Save as ~/.cursor/hooks/notify-stop.sh

#!/bin/bash
# notify-stop.sh: Cursor stop hook. Made with taskhold.com/tools/cursor-hooks.
# Reads the hook's JSON from stdin; needs jq.
input=$(cat)
status=$(printf '%s' "$input" | jq -r '.status // "completed"')
case "$status" in
  completed) msg="Agent finished" ;;
  aborted) msg="Agent stopped (aborted)" ;;
  *) msg="Agent stopped with an error" ;;
esac
{
  osascript -e "display notification \"$msg\" with title \"Cursor\"" 2>/dev/null
  { afplay /System/Library/Sounds/Glass.aiff || paplay /usr/share/sounds/freedesktop/stereo/complete.oga; } >/dev/null 2>&1 &
} || true
echo '{}'