A few weeks ago, we fixed a .gitignore rule that was hiding our agent quality gate configuration from version control. Today's commit solves the opposite problem: preventing local configuration files from accidentally making it into version control in the first place.
The Problem: Local vs. Shared Configuration
Our agents use Claude Desktop with MCP (Model Context Protocol) servers. The configuration lives in .claude/settings.json and should be version-controlled—it defines which tools and quality gates are available during development.
But developers need local overrides. Maybe you're testing a new MCP server on a different port, or you want to disable a specific tool temporarily. That's what .claude/settings.local.json is for: machine-specific configuration that should never leave your laptop.
The risk? Muscle memory. When you're moving fast, it's easy to git add . without thinking. And if your local settings reference paths or ports that only exist on your machine, you've just broken the build for everyone else.
The Fix: Pre-Commit Enforcement
We added a Husky pre-commit hook that scans staged files before every commit. If it finds any file matching **/settings.local.json, the commit fails with a clear error message.
This is enforcement at the right layer. .gitignore is helpful, but it's passive—it won't stop you if you explicitly add an ignored file. Pre-commit hooks are active: they run before the commit happens and can block operations that would violate repository hygiene.
The Pattern: Managed Blocks
Here's the interesting part: this hook was synced from strug-standards PR #41. We use a "managed block" pattern—delimited sections in hook files that can be updated across all our repositories from a single source of truth.
When we discover a new class of files that should never be committed (local configs, credential files, debug dumps), we add the guard to strug-standards once. Then it propagates to every repository that syncs managed blocks. No need to remember which repos have which hooks—the automation handles consistency.
What's Next
This guard is specific to .claude/settings.local.json right now, but the pattern is universal. We're considering expanding it to catch other categories of files that should never reach version control:
• Database dumps and seed files with production data
• API keys and credential files (even if they're already in .gitignore)
• Local environment overrides (.env.local, docker-compose.override.yml)
• Debug artifacts from profiling and memory analysis
The broader goal: make it impossible to accidentally leak machine-specific configuration. Git is powerful, but pre-commit hooks give us the chance to enforce invariants before mistakes become permanent.
One less thing to worry about. One more guardrail in place.