PreToolUse hook
A hook mechanism provided by Claude Code that executes before permission rules are evaluated, can read the full tool input, and can forcibly block tool calls via exit codes, compensating for the shortcomings of string-matching rules.
Timeline (last 90 days)
The PreToolUse hook runs before permission rules are evaluated, can force-block a tool call via exit code 2, and this block takes precedence over allow rules.
A PreToolUse hook, once added, blocks all 22 test commands without affecting normal feature-branch pushes.
The work of fixing the hook has three steps: split the command on &&, ||, ;, |, newlines, $(...) and backticks; discard environment variable prefixes and wrappers such as env, timeout, xargs, nohup, exec and recursively descend into sh -c, eval and scripts; after skipping git global options, check flags and refspecs.
The PreToolUse hook receives JSON from stdin containing the tool name and input; exit code 0 means allow and continue the normal permission flow, exit code 2 means a hard block, and other non-zero exit codes are usually treated as errors.
This PreToolUse hook comes with 52 Vitest cases (39 that should block, 12 that should allow, plus the current-branch check).
PreToolUse and PostToolUse hooks intercept before and after tool execution respectively, and together with the Stop hook they form the policy injection points within the loop.
All Facts (6)
The PreToolUse hook runs before permission rules are evaluated, can force-block a tool call via exit code 2, and this block takes precedence over allow rules.
50%UnverifiedA PreToolUse hook, once added, blocks all 22 test commands without affecting normal feature-branch pushes.
50%UnverifiedThe work of fixing the hook has three steps: split the command on &&, ||, ;, |, newlines, $(...) and backticks; discard environment variable prefixes and wrappers such as env, timeout, xargs, nohup, exec and recursively descend into sh -c, eval and scripts; after skipping git global options, check flags and refspecs.
50%UnverifiedThe PreToolUse hook receives JSON from stdin containing the tool name and input; exit code 0 means allow and continue the normal permission flow, exit code 2 means a hard block, and other non-zero exit codes are usually treated as errors.
50%UnverifiedThis PreToolUse hook comes with 52 Vitest cases (39 that should block, 12 that should allow, plus the current-branch check).
50%UnverifiedPreToolUse and PostToolUse hooks intercept before and after tool execution respectively, and together with the Stop hook they form the policy injection points within the loop.
50%