Claude Code hooks fail open on typos; onFailure blocks

The author follows up on earlier work using a Claude Code hook to stop the tool from deleting .env or key files. That setup had a blind spot: the official hooks reference states that a path typo in settings.json means the hook never runs at all, and a broken guard hook lets everything through. In the test, Claude Code passed the command as JSON to a guard script, which exits with code 2 to block and 0 to allow; anything else counts as a non-blocking failure. A one-letter typo in the registered path produced exit status 127 (file not found), so the rm command went ahead.

The fix is a single setting, "onFailure": "block", which flips the guard from failing open to failing closed. The trade-off is deliberate: any hook failure, including a crash or timeout, blocks all Bash use until the path is corrected in settings.json and Claude Code is reopened. Because of that, the author recommends applying it only to guard hooks protecting something you would rather block than lose.

The companion ~30-line checker scans the registered commands, expands $CLAUDE_PROJECT_DIR and ~, and lists any hook file that does not exist, with exit code 1. It is a quick way to catch a misspelled path before relying on the guard, though it only tests existence, not whether the script's blocking condition is correct.