A way to deny a tool call (PreToolUse hook with a refusal contract)

The hooks currently registered are PostToolUse, UserPromptSubmit, Stop, Notification and PermissionRequest. PreToolUse isn't among them, and the file hook is async: true — fire-and-forget, so it is structurally incapable of denying, not merely unconfigured. The practical consequence: even with a gate on node entry, a pause triggered in the middle of a long step is never seen. The agent read the gate on entry and keeps going for the next 20 minutes, possibly through a commit, a push or an external publish. This is a plain TOCTOU window and it cannot be closed from the instruction side. Proposal — a PreToolUse hook, synchronous, with an explicit refusal contract: a non-zero exit (or a permissionDecision: "deny" payload) blocks the call and returns the reason to the agent as a tool result. Ideally matchable by tool name, so the cost is paid only on the calls that matter (writes, commits, external publishes). Acceptance criteria 1. A hook returning "deny" prevents the tool from executing; the agent receives the reason and can react instead of crashing. 2. The hook is synchronous — the tool does not start before the decision. 3. A hook that errors or times out is treated as deny, not as allow. 4. Overhead is measurable and confined to the matched tools.

This gathers what several people told us separately. Their original messages stay private: only this rewording is public, and nobody sees who wrote what.

Discussion0

You will be told by email and in the app on every reply. Every message carries a link to stop them.