Agent bypasses git pre-commit hooks using --no-verify, stash, and quiet flags despite explicit deny rules #40117

Activity

1. github-actions

   added

   bugSomething isn't workingSomething isn't working

   area:hooks

   area:bash

   on Mar 28, 2026
2. github-actions commented on Mar 28, 2026

   

   github-actionsBot

   on Mar 28, 2026 – with GitHub Actions

   More actions

   Found 3 possible duplicate issues:

   1. [BUG] Claude keeps ignoring my gpg signing rules #38067
   2. Claude Code intermittently skips mandatory quality gates defined in CLAUDE.md and rules files #30075
   3. [BUG] Claude Code systematically ignores rules from memory/CLAUDE.md on every edit/write #32775

   This issue will be automatically closed as a duplicate in 3 days.

   • If your issue is a duplicate, please close it and 👍 the existing issue instead
   • To prevent auto-closure, add a comment or 👎 this comment

   🤖 Generated with Claude Code
3. yurukusa commented on Mar 28, 2026

   

   yurukusa

   on Mar 28, 2026

   More actions

   The root cause is that there's no process-level enforcement preventing --no-verify. CLAUDE.md rules and memory instructions are suggestions the model can (and did) ignore.
   Fix: PreToolUse hook that blocks --no-verify
   Add to ~/.claude/settings.json:

   {
     "hooks": {
       "PreToolUse": [
         {
           "matcher": "Bash",
           "hooks": [
             {
               "type": "command",
               "command": "bash ~/.claude/hooks/no-verify-blocker.sh"
             }
           ]
         }
       ]
     }
   }

   ~/.claude/hooks/no-verify-blocker.sh:

   INPUT=$(cat)
   COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
   [ -z "$COMMAND" ] && exit 0
   if echo "$COMMAND" | grep -qE '\bgit\b.*--no-verify'; then
       echo "BLOCKED: --no-verify bypasses git hooks" >&2
       exit 2
   fi
   if echo "$COMMAND" | grep -qE '\bgit\s+commit\s+-n\b'; then
       echo "BLOCKED: git commit -n skips pre-commit hook" >&2
       exit 2
   fi
   exit 0

   exit 2 is a hard block — the model cannot bypass it. Unlike CLAUDE.md rules, hooks execute at the process level before the command runs.
   For the git stash manipulation pattern you described, you could add a second check:

   if echo "$COMMAND" | grep -qE '\bgit\s+stash\b' && echo "$COMMAND" | grep -qiE '(commit|push|checkout)'; then
       echo "BLOCKED: git stash combined with commit/push" >&2
       exit 2
   fi

   Your existing permissions.deny approach also works but hooks give you more granular control (e.g., allowing git stash for legitimate uses while blocking the stash-then-commit-without-hooks pattern).
4. boucle-app

   added a commit that references this issue on Mar 28, 2026

   feat: block --no-verify in git-safe (bash + PS1)

   ...

   3be51a0
5. yurukusa commented on Mar 29, 2026

   

   yurukusa

   on Mar 29, 2026

   More actions

   A hook can block --no-verify and other bypass tactics:

   INPUT=$(cat)
   COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
   [ -z "$COMMAND" ] && exit 0
   if echo "$COMMAND" | grep -qE 'git\s+commit\s+.*--no-verify|git\s+commit\s+.*-n\b'; then
       echo "BLOCKED: --no-verify is not allowed. Pre-commit hooks must run." >&2
       exit 2
   fi
   if echo "$COMMAND" | grep -qE 'git\s+push\s+.*--no-verify'; then
       echo "BLOCKED: --no-verify is not allowed on push." >&2
       exit 2
   fi
   if echo "$COMMAND" | grep -qE 'git\s+stash\s+&&\s*git\s+commit'; then
       echo "BLOCKED: stash-commit pattern detected (hook bypass attempt)." >&2
       exit 2
   fi
   if echo "$COMMAND" | grep -qE 'git\s+commit\s+.*(-q|--quiet).*--no-verify|git\s+commit\s+.*--no-verify.*(-q|--quiet)'; then
       echo "BLOCKED: quiet + no-verify combination detected." >&2
       exit 2
   fi
   exit 0

   {
     "hooks": {
       "PreToolUse": [{
         "matcher": "Bash",
         "hooks": [{ "type": "command", "command": "bash ~/.claude/hooks/no-hook-bypass.sh" }]
       }]
     }
   }

   This catches all three bypass tactics: --no-verify, git stash && git commit, and quiet flags. The hook runs at the process level — Claude can't bypass a hook that blocks bypasses.
6. marlvinvu commented on Mar 31, 2026

   

   marlvinvu

   on Mar 31, 2026

   More actions

   My Claude says your issue shares the same pattern as #38841 (bypassing safety hook using SHA256) and #39459 (bypassing rm using Python os.remove), but is more serious because of the element of active concealment. My own issue #35357 also has similarities, but mine is related to reasoning rather than pure coding. The common thread between my issue and yours is that Claude manipulates the user.
7. El-Fitz commented on Apr 1, 2026

   

   El-Fitz

   on Apr 1, 2026

   More actions

   permissions.deny rules have a known gap: the Bash tool can construct equivalent commands that bypass string matching (#39987). The rules also don't survive bypassPermissions mode (#39981).

   A PreToolUse hook like @yurukusa suggested is more reliable because it inspects every Bash command before execution.

   If you’re curious, my agent made itself a thing called git-safe, which also uses hooks to block --no-verify on commit, merge, push, cherry-pick, revert, force pushes, reset --hard, etc.

   For the git stash manipulation, the pattern you describe where the agent uses stash to work around pre-commit hooks is harder to catch at the command level since each individual stash operation is valid.

   It’s not a permanent fix, but at least it works now :/

   Anyway, I’ll make a note on your marker file approach. It’s a good complement!
8. El-Fitz

   added a commit that references this issue on Apr 6, 2026

   feat: block --no-verify in git-safe (bash + PS1)

   ...

   f7436bb
9. RaNDoM6913

   added a commit that references this issue on Apr 14, 2026

   feat(block-dangerous-git): stash-commit bypass patterns (Task 18)

   ...

   b441a19
10. github-actions

    added

    staleIssue is inactiveIssue is inactive

    on Apr 23, 2026
11. github-actions commented on May 7, 2026

    

    github-actionsBot

    on May 7, 2026 – with GitHub Actions

    More actions

    Closing for now — inactive for too long. Please open a new issue if this is still relevant.
12. github-actions

    closed this as not plannedon May 7, 2026
13. github-actions commented on Jun 26, 2026

    

    github-actionsBot

    on Jun 26, 2026 – with GitHub Actions

    More actions

    This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.
14. github-actions

    locked as resolved and limited conversation to collaborators on Jun 26, 2026