Hook exit codes don't follow official protocol (exit 0/1/2)

[philoserf]

Problem

The official bash_command_validator_example.py in the claude-code repo documents the exit code protocol:

• Exit 0 = allow, no message to Claude
• Exit 1 = show stderr to user only (not Claude)
• Exit 2 = block the tool call, show stderr to Claude

validate-bash-commands.py exits 0 and prints to stdout — so Claude may or may not see the warnings, and the tool is never blocked. The official example uses exit 2 with file=sys.stderr to actually block bad commands.

Source

claude-code/examples/hooks/bash_command_validator_example.py and claude-code/plugins/security-guidance/hooks/security_reminder_hook.py

Fix

• validate-bash-commands.py: use sys.exit(2) with print(..., file=sys.stderr) for warnings that should reach Claude and block execution
• Review all hooks for correct exit code usage

[philoserf]

Fixed in this session. Changes:

• validate-bash-commands.py: Changed from exit 0 + stdout JSON to exit 2 + stderr — now blocks Bash calls that should use dedicated tools (Grep, Glob, Read, Edit)
• config-protection.sh: Changed from exit 0 + stderr (silently dropped) to exit 1 + stderr — warnings now properly reach the user
• prompt-injection-guard.py: Kept as-is — exit 0 + hookSpecificOutput correctly passes advisory context to Claude