feat: add block-no-verify PreToolUse hook to prevent agents from bypassing git hooks

[tupe12334]

Summary

Adds block-no-verify@1.1.2 as a PreToolUse Bash hook in .claude/settings.json, alongside the existing attribution config.

Details

When an agent runs git commit or git push with the hook-bypass flag, it silently disables pre-commit, commit-msg, and pre-push hooks. block-no-verify reads tool_input.command from the Claude Code hook stdin payload, detects the hook-bypass flag across all git subcommands, and exits 2 to block. The existing attribution config is preserved unchanged.

Closes #97

---

Disclosure: I am the author and maintainer of block-no-verify.

[Copilot]

Pull request overview

Adds a Claude Code PreToolUse hook to block git commands that attempt to bypass repository git hooks (e.g., --no-verify), strengthening enforcement of existing quality gates for agent-driven commits/pushes.

Changes:

• Add a PreToolUse hook in .claude/settings.json for the Bash tool.
• Run npx block-no-verify@1.1.2 as the hook command while preserving existing attribution settings.

[Copilot]

This PreToolUse hook runs before every Bash tool invocation. Using npx without a non-interactive flag and without a timeout can cause the hook to hang (e.g., when npx needs to download/install the package and prompts for confirmation), effectively blocking all Bash commands. Consider running via npx --yes … / npm exec --yes … and setting an explicit timeout (and/or preinstalling the tool via the repo’s toolchain) so hook execution is bounded and reliable.

Suggested change

	"command": "npx block-no-verify@1.1.2"
	"command": "npx --yes block-no-verify@1.1.2",
	"timeoutMs": 10000