Claude Code deny rules leak; PreToolUse hook plugs gaps

The author's decision to stop AI involvement at commit and keep push and merge human reflects how he treats a codebase handling money and personal data. His first assumption — that writing the rule in CLAUDE.md and listing it in settings.json would be enough — did not hold, because instruction files only steer what Claude tries to do and do not change what Claude Code permits.

Moving the check to a PreToolUse hook addresses the specific weakness he identified: deny rules match command strings, whereas his Python script splits commands on separators, skips prefixes like env or timeout 10, ignores git options such as -C and -c, and re-reads the insides of bash -c and $( ). He tested 22 forms that should be blocked and 7 that should pass, then deliberately broke the -C and -c handling to confirm the tests caught the gap. He also notes that without "onFailure": "block", a mis-typed script path would let every command through.

Even so, he frames the hook as not a strong boundary. The larger fix, in his view, is separating privileges — running the AI under its own OS account, or protecting branches on GitHub's side, though he notes private repositories need a paid plan for branch protection. He chose the separate OS account, and says the credential-placement and SSH work that comes with it will be covered in a follow-up.