Never let the guard fail silently

The guard shipped broken on every Linux host. It used "$TMPDIR" in a case
pattern; TMPDIR is routinely unset there; set -u makes that fatal mid-script; and
the hook then emitted nothing at all — the one outcome its own header promises
cannot happen. macOS sets TMPDIR, so it passed here and failed on Linux, Alpine
and Windows.

Two fixes, and the second is the one that matters. ${TMPDIR:-/nonexistent} fixes
this instance. An EXIT trap that emits `ask` unless a decision was already
printed fixes the class: no future edit can reintroduce silence, whatever else it
gets wrong. Verified by injecting a fatal error before any decision — the guard
now asks instead of returning nothing.

Check 23 gained the case that would have caught it: the same three decisions run
again with TMPDIR, HOME, USER and LANG stripped. Reintroducing the exact defect
turns it red naming the empty output.

I also pushed the previous commit while the install matrix was red — I printed
the result and chained the commit after it instead of gating on it. The matrix
was green on re-run and CI caught the real problem, but the discipline failed
before CI did, which is the part worth recording.

verify.sh 25/25, gate-falsifiability.sh 26/26, install-matrix 17/17, all gated
before commit this time.

Author: itsvedantkumar

.claude/verify.sh

@@ -841,6 +841,18 @@ if command -v jq >/dev/null; then
   g_want 'npm test'                      allow
   g_want 'git push origin feature-x'     allow
   g_want 'git commit -m "wip"'           allow
+  # The same decisions with a hostile environment. This is the case that would have caught the
+  # guard shipping broken on every Linux host: it used "$TMPDIR" in a case pattern, TMPDIR is
+  # routinely unset there, set -u made that fatal, and the hook emitted nothing at all. macOS
+  # sets TMPDIR, so it passed locally and failed on three platforms in CI.
+  for probe in 'rm -rf /:deny' 'rm -rf /etc/nginx:ask' 'rm -rf node_modules:allow'; do
+    pc=${probe%:*}; pw=${probe##*:}
+    pd=$(printf '{"tool_input":{"command":%s}}' "$(jq -Rn --arg c "$pc" '$c')" \
+         | env -u TMPDIR -u HOME -u USER -u LANG bash claude/hooks/guard-destructive.sh 2>/dev/null \
+         | jq -r '.hookSpecificOutput.permissionDecision' 2>/dev/null)
+    [ "$pd" = "$pw" ] || errs="$errs\nwith a stripped environment, '$pc' -> ${pd:-<no output>}, expected $pw"
+  done
+
   # Unparseable or absent input must never reach allow. A guard that opens on malformed input
   # has inverted its own purpose, and malformed input is exactly what an attacker sends.
   for bad in 'not json' ''; do

claude/hooks/guard-destructive.sh

@@ -26,11 +26,28 @@
 
 set -uo pipefail
 
+# Anything that reaches the end of this script without having emitted a decision has crashed,
+# and a crash must not be silence. This shipped broken on every Linux host for exactly that
+# reason: `"$TMPDIR"*` in a case pattern, TMPDIR routinely unset there, set -u turns that into
+# a fatal error mid-script, and the hook produced no output at all — the one outcome the header
+# above promises cannot happen. macOS sets TMPDIR, so it passed locally and failed on three
+# platforms in CI.
+#
+# The trap is the structural fix rather than the one-line one: no future edit can reintroduce
+# silence, whatever it gets wrong.
+_guard_emitted=0
+_guard_trap() {
+  [ "$_guard_emitted" = 1 ] && return 0
+  printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"[guard] the guard itself failed while inspecting this command. Approve only if you know what it does."}}\n'
+}
+trap _guard_trap EXIT
+
 emit() { # <allow|ask|deny> <reason>
+  _guard_emitted=1
   printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"%s","permissionDecisionReason":"%s"}}\n' "$1" "$2"
   exit 0
 }
-allow() { printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}\n'; exit 0; }
+allow() { _guard_emitted=1; printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}\n'; exit 0; }
 
 payload=$(cat 2>/dev/null || true)
 [ -n "$payload" ] || emit ask "[guard] no tool payload to inspect — approve only if you know what this does"
@@ -119,7 +136,7 @@ case "$CMD" in
         node_modules|dist|build|target|coverage|.next|.turbo|.cache|.venv|__pycache__|.pytest_cache) continue ;;
         */node_modules|*/node_modules/*|*/dist|*/dist/*|*/build|*/build/*|*/target|*/target/*) continue ;;
         */coverage|*/coverage/*|*.next|*.next/*|*.turbo|*.turbo/*|*.cache|*.cache/*) continue ;;
-        */__pycache__|*/__pycache__/*|*.venv|*.venv/*|/tmp/*|"$TMPDIR"*) continue ;;
+        */__pycache__|*/__pycache__/*|*.venv|*.venv/*|/tmp/*|"${TMPDIR:-/nonexistent}"*) continue ;;
       esac
       _unsafe=1
     done