Jeraptha
Open source under the MIT licence. View the source
A set of twelve Claude Code hooks that turn an operator's standing rulings into refusals, rewrites and loaded text, each with its own tests.
The problem
Agents read rules, agree with them, and break them an hour later, usually in a one-line reflex such as writing to /tmp. Moving each rule that kept failing out of prose and into a hook is what held. Each refusal names the command to run instead. The README states it is not a security boundary.
How it works
hooks/ is a Claude Code plugin where each rule is a small TypeScript module. Examples: worktree denies git worktree and names the wt command, identity adds an Agent: trailer to commits, no-tmp denies writes into /tmp, lane-budget denies short polling loops, rulings loads one-line rulings into the system prompt each turn. It also ships bench/, a harness that replays finished tasks from a frozen commit, gives each model the same brief, and scores runs with hidden checks.
Features
- Twelve rules: worktree, literal-word, identity, cluster, model-gate, visible-lanes, no-tmp, pr-bar, lane-budget, rulings, compact-save, worktree-reaper
- Every refusal names the replacement command
- Every rule has a test; README reports 859 of 864 plugin tests and 47 of 47 CLI tests passing at release
- no-tmp decision exposed as a CLI for Codex and Pi hooks
- Worker-model benchmark scored by hidden tests (2026-10-03 round: 6 tasks, 6 settings, 2 rounds)
How it was built
Jeraptha started on 2026-04-07 from one idea: a rule that matters should be enforced by code at the moment an AI coding agent acts, not restated in a longer prompt.
In v2.1 all seven early hooks turned out never to fire, because they were registered through a path the tool-call events did not use. They moved to the typed plugin API and were confirmed live, and proving a hook fires became a standing rule.
Five hard blocks became approval prompts, because the plugin could not see the conversation and kept refusing work the operator had already approved. Hard blocks stayed for config edits, secret exposure and rate limits.
v3.0 split the monolith into one module per rule, and v4 dropped the scoring gates so each rule simply denies, rewrites or loads text and names the command to run instead.
Claude Opus wrote most commits as a pair programmer and groups of agents reviewed each release. Rico decided to leave three fleet-specific rules out of the public release rather than ship them half-working.