Fix git commit blocking hook to use stderr and add comprehensive tests

[nhorton]

Summary

Updated the block_bash_with_instructions.sh hook to correctly output blocking messages to stderr instead of stdout, and added comprehensive test coverage for the hook's behavior.

Key Changes

Hook Script Updates

• Output format: Changed from JSON output to stdout to plain text output to stderr, aligning with Claude Code's hook contract for exit code 2 handling
• Pattern matching: Improved the git commit regex pattern from git[[:space:]]+commit to ^[[:space:]]*git[[:space:]]+commit to:
  • Anchor matching to the start of the command (prevents false positives)
  • Allow optional leading whitespace
  • Prevent blocking commands that merely contain "git commit" as a substring

Test Suite

Added tests/shell_script_tests/test_block_bash_with_instructions.py with 323 lines of comprehensive test coverage:

• Existence & permissions: Verify script exists and is executable
• Git commit blocking: Test that git commit and variants are blocked with exit code 2
• Allowed commands: Verify git operations (status, add, diff, log) and non-git commands pass through
• Non-Bash tools: Confirm hook doesn't interfere with other tool types
• Edge cases: Handle empty input, missing commands, invalid JSON, and substring matching
• Output format: Validate correct use of stdout/stderr and exit codes

Implementation Details

• The hook now correctly implements the PreToolUse hook contract: exit code 0 allows, exit code 2 blocks with stderr message
• Pattern anchoring prevents false positives (e.g., echo 'git commit' is now allowed)
• Tests use subprocess to simulate actual hook invocation with JSON input matching Claude Code's format
• All tests verify both the exit code and message content for proper user guidance

https://claude.ai/code/session_017cJ4AjRrK9JHoP17StFk6J