Fail-open is the default failure mode of agent hooks
Fail-open is the default failure mode of agent hooks I'm the author of Handrail, a free, MIT-licensed hook pack for Claude Code and other agent-CLI hook systems. Handrail works with Claude Code and other agent CLIs in plain text only; it is not affiliated with, endorsed by, or a product of Anthropic. This post is about one specific design bug I keep finding in hook scripts, including early drafts of my own: they fail open. What "fail open" means here An agent-CLI hook is a small program the harness calls before (or after) a tool call — a shell command, a file write, a publish step — and asks, in effect, "should this be allowed?" The hook's job is to answer allow, ask, or deny. The interesting question isn't what the hook does when it works. It's what the harness does when the hook doesn't answer at all. Malformed JSON on stdin. An unhandled exception three lines into the script. A timeout because the hook shelled out to something slow. A config file that doesn't parse. In each of these cases, the hook process either exits with no usable decision, or crashes before it prints one. What happens next depends entirely on what the calling harness does with a hook that didn't answer — and a lot of hook scripts never think about that side of the contract, because the code path for "I don't know, so deny" is extra code nobody wrote until something forced the question. Independent write-ups on this exact gap describe it as a live, common problem across shared hook scripts, not a hypothetical (dev.to/redpa, "Your Claude Code hooks probably fail open — here's why that's dangerous," accessed 2026-09-08). The failure mode matters because of when it fires: exactly when the hook is under the most stress — weird input, a broken environment, a partial config — which correlates with exactly the moments a guardrail is most needed. The pattern: always answer, and the default answer is deny The fix isn't clever. It's structural: Wrap the whole hook body so that any uncaught error — parse