Git Commit Hygiene

Two-Layer Defence

The hook is a backstop, not the only control. Both layers together are more robust:

Layer 1 — CLAUDE.md instructs the agent at the prompt level. Claude Code reads CLAUDE.md at startup and follows its rules. With the rule present, the agent will usually not add attribution lines in the first place.

Layer 2 — commit-msg hook enforces at the git level regardless of what the agent wrote. Even if the agent ignores CLAUDE.md or is replaced by a different tool, the hook silently strips attribution before the commit is recorded.

The combination: the agent tries not to add attribution (Layer 1), and even if it does, the hook removes it before it reaches history (Layer 2).

Disabling Attribution in Your Editor

Editor settings let you turn off attribution at the source — before it ever reaches the commit message. They don't replace the hook; they reduce the noise so the hook rarely needs to fire.

Claude Code

Claude Code writes attribution to commits via the attribution.commit setting in .claude/settings.json. Set it to an empty string to suppress the Co-Authored-By: Claude Sonnet… line.

Commit-only disable (most common):

{
  "attribution": {
    "commit": ""
  }
}

Full disable (commits and pull requests):

{
  "attribution": {
    "commit": "",
    "pr": ""
  }
}

Scope options:

• User-level: ~/.claude/settings.json — applies to all projects
• Project-level: .claude/settings.json — applies to one repo only (check this in if your team wants a shared default)

Caveat: This is a soft control. When Claude Code uses the Bash tool to run git commit directly, it may inject attribution via the shell environment rather than through the settings file. The commit-msg hook catches those cases.

Cursor

Cursor adds attribution as a Made with Cursor commit trailer (and in older versions, a Co-Authored-By: Cursor line).

To disable: open Settings (Cmd+, / Ctrl+,) → Agent → Attribution → toggle off "Add Cursor as co-author in Git commits".

Critical caveat: Cursor silently re-enables this toggle after IDE updates. Check the setting after every Cursor update — it is the most common reason attribution reappears in teams that thought they had it disabled.

Enterprise teams: Administrators can disable the setting globally from the Cursor Admin Dashboard, which prevents individual users from re-enabling it.

Why the hook still matters

Editor settings are soft controls: opt-in, easy to forget, and reset by updates. A new team member, a Cursor update, or a different AI tool entirely can reintroduce attribution without anyone noticing.

The commit-msg hook enforces the rule at the git level — it runs regardless of which editor or agent is in use, regardless of whether a setting got reset, and regardless of whether the developer knows attribution is being added. The hook is the guarantee; the editor settings reduce the day-to-day noise.

Team Distribution Options

.git/hooks/ is not tracked by git — each developer must install the hook themselves. Three practical approaches:

Option A — core.hooksPath (recommended)

Commit the hook to .githooks/ and point git at it:

mkdir -p .githooks
cp .git/hooks/commit-msg .githooks/commit-msg
git config core.hooksPath .githooks

All developers who run this command (or have it in a setup script or onboarding docs) get the hook automatically.

Option B — package.json postinstall

Runs automatically on npm install:

{
  "scripts": {
    "postinstall": "git config core.hooksPath .githooks"
  }
}

Option C — Husky

For teams already using Husky for other hooks:

npx husky add .husky/commit-msg 'sh .githooks/commit-msg $1'

Auditing Existing History

The hook prevents future attribution but does not rewrite past commits. To check whether attribution already exists in your history:

git log --all --grep="Co-Authored-By" --oneline
git log --all --grep="Co-Authored-By" --oneline | wc -l

Removing attribution from existing history requires rewriting with git filter-repo — a significant operation only appropriate when all collaborators are informed.

How the commit-msg Hook Works

Git runs hooks at specific points in the commit lifecycle. The commit-msg hook fires after you run git commit and write the message, but before git finalises the commit object. It receives one argument: the path to a temporary file containing the raw commit message.

The hook can read and modify that file, exit non-zero to abort the commit entirely, or run any shell command.

Hook execution order:

1. pre-commit — runs first; can abort if lint/tests fail
2. prepare-commit-msg — can pre-populate the message
3. commit-msg — this hook fires here — validate or rewrite the message file
4. post-commit — runs after; cannot abort; used for notifications

Pattern Reference

Every sed line in the hook targets a distinct attribution pattern:

macOS vs Linux sed

The hook uses sed -i to edit the commit message file in place. The syntax differs between BSD sed (macOS) and GNU sed (Linux):

The hook ships with sed -i '' for macOS. For cross-platform repos, use the OS-detection variant in the SKILL.md or switch to perl -i -pe which works identically on both.