Claude Code's PreToolUse hooks give you a programmatic interception point before any tool executes — write a hook that exits non-zero and the tool call is blocked. That's the theory. In practice, a reproducible proof-of-concept shared in r/ClaudeCode demonstrated that even after building comprehensive PreToolUse hooks designed to protect a .env file, the agent was still able to make its contents a