Stop Claude from reading files or running bash commands on files/directories matching a grep pattern

settings.local.json

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "command": "bash .claude/scripts/validate-bash.sh"
          }
        ]
      },
      {
        "matcher": "Read",
        "hooks": [
          {
            "command": "bash .claude/scripts/validate-read.sh"
          }
        ]
      }
    ]
  },
  "permissions": {
    "allow": [],
    "deny": [],
    "ask": []
  }
}

validate-bash.sh

#!/bin/bash

COMMAND="$(cat | jq -r .tool_input.command)"
BLOCKED="node_modules|\.env|\.git/|dist/|build/"

if echo "$COMMAND" | grep -qE "$BLOCKED"; then
 echo "Error: blocked file/directory pattern" >&2
 exit 2
fi

validate-read.sh

#!/bin/bash

FILE_PATH="$(cat | jq -r .tool_input.file_path)"
BLOCKED="node_modules|\.env|\.git/|dist/|build/"

if echo "$FILE_PATH" | grep -qE "$BLOCKED"; then
 echo "Error: blocked directory pattern" >&2
 exit 2
fi