Secret Block

blocking stable

PreToolUse hook that denies Bash commands containing secret-shaped strings before they execute. Reads the canonical pattern set from hooks/patterns.json (plus patterns.local.json if present). Belt-and-suspenders alongside the secret-handling rules in Common.md §4. Emits a JSON permissionDecision deny on detection.

ID hook/secret-block Version 1.0.0 Author convergent-systems-key

ai hooks run secret-block

Event PreToolUse Language python Trigger tool-name — Bash Side effects

denies tool call with explanation when secret pattern detected

linuxmacoswindows Logic is cross-platform. Wiring: use 'ai hooks run secret-block' in settings.json — the ai binary discovers Python on each OS. Pure Python regex on stdin JSON. Works on all platforms.

securitysecretsgovernancepatternsclaude-code

Attribution: convergent-systems-key.