Secret Block

blockingstable

PreToolUse hook that denies Bash commands containing secret-shaped strings before they execute. Reads the canonical pattern set from hooks/patterns.json (plus patterns.local.json if present). Belt-and-suspenders alongside the secret-handling rules in Common.md §4. Emits a JSON permissionDecision deny on detection.

ID hook/secret-blockVersion 1.0.0Author convergent-systems-key

ai hooks run secret-block

EventPreToolUseLanguagepythonTriggertool-name — BashSide effects

denies tool call with explanation when secret pattern detected

linuxmacoswindowsLogic is cross-platform. Wiring: use 'ai hooks run secret-block' in settings.json — the ai binary discovers Python on each OS. Pure Python regex on stdin JSON. Works on all platforms.

securitysecretsgovernancepatternsclaude-code

Attribution: convergent-systems-key.