feat: add security validation for hook execution

.changeset/hook-security-validation.md

@@ -0,0 +1,5 @@
+---
+"@fnebenfuehr/worktree-cli": minor
+---
+
+Add security validation for hook commands before execution. Blocks dangerous patterns (curl|sh, sudo, eval, unsafe rm -rf) and prompts for confirmation on unrecognized commands. Use --trust-hooks to bypass validation.

src/commands/checkout.ts

@@ -9,7 +9,7 @@ import { isValidBranchName, VALIDATION_ERRORS } from '@/utils/validation';
 
 export async function checkoutCommand(
 	branch?: string,
-	options?: { skipHooks?: boolean; verbose?: boolean }
+	options?: { skipHooks?: boolean; verbose?: boolean; trustHooks?: boolean }
 ): Promise<number> {
 	const shouldPrompt = !branch && isInteractive();
 
@@ -59,6 +59,12 @@ export async function checkoutCommand(
 				cwd: result.path,
 				skipHooks: options?.skipHooks,
 				verbose: options?.verbose,
+				trustHooks: options?.trustHooks,
+				env: {
+					worktreePath: result.path,
+					branch: result.branch,
+					mainPath: gitRoot,
+				},
 			});
 		}
 	}

src/commands/create.ts

@@ -19,7 +19,7 @@ import { isValidBranchName, VALIDATION_ERRORS } from '@/utils/validation';
 
 export async function createCommand(
 	branch?: string,
-	options?: { skipHooks?: boolean; verbose?: boolean; from?: string }
+	options?: { skipHooks?: boolean; verbose?: boolean; from?: string; trustHooks?: boolean }
 ): Promise<number> {
 	const shouldPrompt = !branch && isInteractive();
 
@@ -91,6 +91,7 @@ export async function createCommand(
 			cwd: result.path,
 			skipHooks: options?.skipHooks,
 			verbose: options?.verbose,
+			trustHooks: options?.trustHooks,
 			env: {
 				worktreePath: result.path,
 				branch: result.branch,

src/commands/remove.ts

@@ -20,7 +20,7 @@ import { tryCatch } from '@/utils/try-catch';
 
 export async function removeCommand(
 	branch?: string,
-	options?: { skipHooks?: boolean; verbose?: boolean; force?: boolean }
+	options?: { skipHooks?: boolean; verbose?: boolean; force?: boolean; trustHooks?: boolean }
 ): Promise<number> {
 	const shouldPrompt = !branch && isInteractive();
 
@@ -94,6 +94,7 @@ export async function removeCommand(
 			cwd: worktreePath,
 			skipHooks: options?.skipHooks,
 			verbose: options?.verbose,
+			trustHooks: options?.trustHooks,
 			env,
 		});
 	}
@@ -136,6 +137,7 @@ export async function removeCommand(
 			cwd: defaultBranchPath,
 			skipHooks: options?.skipHooks,
 			verbose: options?.verbose,
+			trustHooks: options?.trustHooks,
 			env,
 		});
 	}

src/index.ts

@@ -97,12 +97,14 @@ interface CommandOptions {
 	hooks?: boolean;
 	force?: boolean;
 	from?: string;
+	trustHooks?: boolean;
 }
 
 program
 	.command('create [branch]')
 	.description('Create a new git worktree and branch')
 	.option('--no-hooks', 'Skip running lifecycle hooks')
+	.option('--trust-hooks', 'Trust all hook commands without security validation')
 	.option('-f, --from <branch>', 'Base branch to create from')
 	.action((branch: string | undefined, options: CommandOptions, command) => {
 		const globalOpts = command.optsWithGlobals();
@@ -111,6 +113,7 @@ program
 				skipHooks: !options.hooks,
 				verbose: globalOpts.verbose,
 				from: options.from,
+				trustHooks: options.trustHooks,
 			})
 		)();
 	});
@@ -119,6 +122,7 @@ program
 	.command('remove [branch]')
 	.description('Remove an existing git worktree')
 	.option('--no-hooks', 'Skip running lifecycle hooks')
+	.option('--trust-hooks', 'Trust all hook commands without security validation')
 	.option('-f, --force', 'Force removal even with uncommitted changes')
 	.action((branch: string | undefined, options: CommandOptions, command) => {
 		const globalOpts = command.optsWithGlobals();
@@ -127,6 +131,7 @@ program
 				skipHooks: !options.hooks,
 				verbose: globalOpts.verbose,
 				force: options.force,
+				trustHooks: options.trustHooks,
 			})
 		)();
 	});
@@ -145,12 +150,14 @@ program
 	.command('checkout [branch]')
 	.description('Checkout a branch (switch to existing worktree or create from local/remote)')
 	.option('--no-hooks', 'Skip running lifecycle hooks')
+	.option('--trust-hooks', 'Trust all hook commands without security validation')
 	.action((branch: string | undefined, options: CommandOptions, command) => {
 		const globalOpts = command.optsWithGlobals();
 		handleCommandError(() =>
 			checkoutCommand(branch, {
 				skipHooks: !options.hooks,
 				verbose: globalOpts.verbose,
+				trustHooks: options.trustHooks,
 			})
 		)();
 	});
@@ -160,12 +167,14 @@ program
 	.command('add [branch]')
 	.description('Alias for checkout - git-like naming')
 	.option('--no-hooks', 'Skip running lifecycle hooks')
+	.option('--trust-hooks', 'Trust all hook commands without security validation')
 	.action((branch: string | undefined, options: CommandOptions, command) => {
 		const globalOpts = command.optsWithGlobals();
 		handleCommandError(() =>
 			checkoutCommand(branch, {
 				skipHooks: !options.hooks,
 				verbose: globalOpts.verbose,
+				trustHooks: options.trustHooks,
 			})
 		)();
 	});