Documentation
¶
Overview ¶
Command gate is the small binary claude's PreToolUse hook invokes before every Bash tool call. It reads a JSON envelope from stdin, decides allow/block via the gate matcher, logs the decision to the shared commands.jsonl, and exits with the claude-expected code:
exit 0 = allow exit 2 = block (claude cancels the tool call)
The binary ships per-app as `<app>-gate[.exe]` (e.g. `myapp-gate` for a project initialized with `wick init myapp`).
Configuration is loaded from the shared spec at ~/.<app>/agents/gate/spec.json — the gate binary derives `<app>` from its own executable filename via gate.AppName() (strip `-gate[.exe]` suffix). No env var, no ldflag injection.
Fail-safe: if anything goes wrong (spec missing, parse failure, timeout reading stdin), we BLOCK + log. Better to refuse a real command than let an unverified one through.
Source Files