Fail closed on invalid PII check responses

Author: cursoragent

scripts/check-commit-pii.js

@@ -168,6 +168,18 @@ function main() {
     console.error('')
     return 1
   }
+  if (firstLine !== 'OK') {
+    console.error('')
+    console.error('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━')
+    console.error('[pii-check] Commit blocked: invalid Claude response.')
+    console.error('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━')
+    console.error(result.output || '(empty response)')
+    console.error('')
+    console.error('Expected Claude to return exactly: OK')
+    console.error('or: BLOCK: <one short sentence describing what was found>')
+    console.error('')
+    return 1
+  }
   console.log('[pii-check] No customer references detected.')
   return 0
 }