PreToolUse: Block Before It Happens

How Prevention Works

• PreToolUse fires before any tool call — if the hook exits with code 1, the tool call is blocked. The AI gets the error message and must find another approach.
• **Branch protection example** — hook matches `Bash(git commit*)`, script checks current branch, blocks if it's main/master/development/develop with a clear message.
• **Why a hook instead of instructions** — instructions get forgotten in long sessions. Context windows compress. Conventions drift. Hooks are structural and can't be overridden by context loss.

Patterns to Implement

1. 1 Common PreToolUse patterns for real risks
   • › Block `git push --force` to any branch
   • › Block `rm -rf` on project directories
   • › Block MCP calls to production environments
   • › Validate file paths before write operations
2. 2 Add a branch protection hook — test it by asking the AI to commit on `main` and watch it get blocked gracefully
3. 3 List the 3 most dangerous commands for your project and write a PreToolUse matcher for each
4. 4 Keep hook scripts simple — check one thing, exit 0 (allow) or exit 1 (block with message). Complex scripts slow down every tool call.