claude-forge: Hook for Claude Code

{
  "PreToolUse": [
    {
      "matcher": "Bash|PowerShell",
      "hooks": [
        {
          "type": "command",
          "command": "node \"$CLAUDE_PROJECT_DIR/.claude/forge-bin/forge-gate-hook.cjs\"",
          "timeout": 10
        }
      ],
      "_doc": "2026-09-24 (v2.7.0, WP16 + security wp9b + review wp9a): the GATE HOOK. Before every Bash or PowerShell tool call it asks forge-actiongate.cjs whether the command trips one of FIVE command hard gates (a classifier, not a proof) — destructive-delete (rm -rf, rm -r, Remove-Item -Recurse, rd /s, rimraf), kill-by-name (taskkill /IM or a non-PID /FI, Stop-Process -Name, pkill, kill $(pgrep …)), git-destructive (reset --hard, clean -f, checkout -f / . / -- <path>, restore <path>, switch -f, stash drop/clear) opaque-exec (a pipe into a shell, eval/iex, sh -c on a variable, an encoded PowerShell command) or, since 2.9.0, secret-print (printing the contents of a secret file: a .env file, a key, a credentials file or anything in secrets/, via cat/type/Get-Content, grep and friends, git show/log -p/diff/blame or find -exec; .env.example and the names-only helper forge-env-names.cjs stay allowed) — or tries to switch the gate itself off. Exit 2 = blocked with a plain NL+EN reason and Claude must ask the owner; exit 1 = not blocked but VISIBLE (gate is off, or the hook could not check the call); exit 0 = allowed. Quoted data (writer heredocs, echo/commit-message/log-event/search-tool literals) is not treated as a command, and a delete whose every target is provably inside _scratch/, node_modules/, dist/ or the temp dir passes. The owner-approved one-off off-switch is `node .claude/forge-bin/forge-config.cjs set gate-hook off --once \"<owner's words>\"` (10 minutes); the owner can also run a command himself with `!`. Timeouts in this file are SECONDS (Claude Code hook contract). The permissions.deny block keeps .env variants, keys and secrets out of Claude's Read tool; .env.example stays readable. Details and honest l