Claude Code hooks stop rm -rf, but rm -fr slips through

The test was run in a disposable folder with claude -p, the non-interactive mode, and with --dangerously-skip-permissions so that per-command approvals would not interfere; the author explicitly warns not to use that option in normal work. Even with approvals skipped, the hook returning exit code 2 stopped the command, and the error text was passed back to Claude. The author also tested the script standalone by feeding it JSON in the same shape Claude Code provides. That standalone run showed 'git push --force origin main' and 'git reset --hard HEAD~3' were stopped, while 'rm -fr build' and 'rm -r -f build' passed; the latter two were not tried in a live session.

The script depends on jq to read the command, and the author shows why the 'command -v jq' line matters. Without it, an environment missing jq would read nothing and exit 0, letting everything through — and because the exit code is 0, onFailure would not treat it as a failure. Removing jq from PATH in a real session, the version with the check blocked even 'ls build' with a 'jq is required' message, while the version without it let 'rm -rf build' delete the folder.

The onFailure setting was introduced in version 2.1.295, and in 2.1.294 a wrong script path did not stop the command. The author tested only the missing-script case and notes that the documentation also counts non-0/2 exit codes, timeouts, and unreadable JSON output as failures. The closing advice is to use permission settings for commands that must be blocked reliably, keep the hook as an early net, and confirm behavior in a dummy folder before trusting it.