Hook Reference

Hook reference

Hooks are the gate. A hook reads the tool call as JSON on stdin and decides with an exit code:

Exit	Meaning
0	allow the call
2	block it, and the message on stderr is shown to the agent

This is why the safety floor does not depend on the model. A rule can be ignored by a model that decides not to follow it. An exit code cannot.

Both flavours ship: .sh for macOS and Linux, .ps1 for Windows. The flavour and the settings.json registration are derived from one flag, so a mismatch is unrepresentable - a harness whose hooks are registered for the wrong flavour finds no hook, blocks nothing, and reports that it blocked. That shipped once.

Hook	Event	Matches tools	Installed
agent-history	SubagentStop	*	always
check-commit-msg	PreToolUse	Bash	always
graph-stale	PostToolUse	Edit|Write	always
guard-agent-scope	PreToolUse	Edit|Write	always
guard-agent-spawn	PreToolUse	Agent|Task	always
guard-main-commit	PreToolUse	Bash	always
guard-task-scope	PreToolUse	Edit|Write	always
protect-adr	PreToolUse	Edit|Write	always
protect-secrets	PreToolUse	Read|Edit|Write|Bash	always
rtk-rewrite	opt-in	-	needs rtk
specs-reminder	PostToolUse	Edit|Write	always

Proving they fire

python eval/guardrail_eval.py scaffolds a real harness and fires 112 payloads at it per hook flavour, 44 that must be blocked and 68 that must be allowed. Swap every agent from Opus to Haiku and the result is byte-identical.