ok          fixture: pre-bash refuses printenv (rc=0)
ok          fixture: pre-bash allows ls (rc=0)
ok          fixture: pre-read refuses the age key (rc=0)
ok          fixture: post-bash masks the selftest value (rc=0)
ok          fixture: post-read masks the selftest value (rc=0)
ok          fixture: post-bash withholds when the hook cannot run (rc=0)
ok          fixture: post-read withholds when the hook cannot run (rc=0)
--- /home/kisfenyo/.claude/settings.json
+++ /home/kisfenyo/.claude/settings.json (after)
@@ -48,4 +48,52 @@
         ]
       }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 /mnt/5_hdd/felhom.eu/git/cc-secrets/ccsec/hook.py pre-bash",
+            "timeout": 15,
+            "onFailure": "block"
+          }
+        ]
+      },
+      {
+        "matcher": "Read",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 /mnt/5_hdd/felhom.eu/git/cc-secrets/ccsec/hook.py pre-read",
+            "timeout": 15,
+            "onFailure": "block"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 /mnt/5_hdd/felhom.eu/git/cc-secrets/ccsec/hook.py post-bash || printf '%s' '{\"hookSpecificOutput\": {\"hookEventName\": \"PostToolUse\", \"updatedToolOutput\": {\"stdout\": \"[output withheld: the CC secret guard failed, so this output was not shown. Run `sec doctor` to see why.]\", \"stderr\": \"\", \"interrupted\": false, \"isImage\": false}}}'",
+            "timeout": 15,
+            "onFailure": "block"
+          }
+        ]
+      },
+      {
+        "matcher": "Read",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 /mnt/5_hdd/felhom.eu/git/cc-secrets/ccsec/hook.py post-read || printf '%s' '{\"hookSpecificOutput\": {\"hookEventName\": \"PostToolUse\", \"updatedToolOutput\": {\"type\": \"text\", \"file\": {\"filePath\": \"\", \"content\": \"[output withheld: the CC secret guard failed, so this output was not shown. Run `sec doctor` to see why.]\", \"numLines\": 1, \"startLine\": 1, \"totalLines\": 1}}}}'",
+            "timeout": 15,
+            "onFailure": "block"
+          }
+        ]
+      }
     ]
   },
