fix(security): SecurityValidator schema mismatch + fail-closed

[christauff]

Summary

Fixes three security vulnerabilities in SecurityValidator.hook.ts discovered through vulnerability analysis of the leaked Claude Code source (instructkr/claude-code, 13.8k+ stars, accidentally published via npm source maps on 2026-03-31).

1. decision: 'ask' Zod Schema Mismatch (Critical)

The hook outputs {"decision": "ask"} for confirm-level operations (force push, recursive delete, cloud ops, database ops, confirmWrite paths). However, Claude Code's Zod validation schema at types/hooks.ts:64 only accepts z.enum(['approve', 'block']) for the top-level decision field. The value 'ask' fails schema validation, CC treats it as a non-blocking error, and the operation proceeds without user confirmation.

Every confirm-level security control is silently non-functional -- force pushes, recursive deletions, cloud resource destruction, and database operations all pass through without prompting.

Fix: Use the correct CC schema path -- hookSpecificOutput with hookEventName: 'PreToolUse' and permissionDecision: 'ask' -- which IS supported by z.enum(['allow', 'deny', 'ask']) in PermissionRule.ts:26.

2. Fail-Open to Fail-Closed on All Error Paths

Five error paths returned {"continue": true} (fail-open), allowing operations to proceed when the security validator encountered errors:

• Missing patterns.yaml: now returns hardcoded deny rules
• YAML parse error: now returns hardcoded deny rules
• Stdin JSON parse failure: now process.exit(2)
• Unhandled exception: now process.exit(2)
• Stdin timeout: now process.exit(2)

CC's hook execution model treats exit code 2 as blocking (operation denied), while all other non-zero exit codes are non-blocking errors (operation allowed). This makes process.exit(2) the correct fail-closed behavior.

3. Updated Doc Header

Reflects the new fail-closed security model.

Discovery Context

These vulnerabilities were identified by analyzing how Claude Code processes hook output -- specifically the Zod schema validation in types/hooks.ts and the exit code handling in utils/hooks.ts:2647-2697. Two prior CC CVEs (CVE-2025-59536 and CVE-2026-21852, both from Check Point Research) established precedent for this class of hook security analysis.

Test Plan

• Verify safe operations (ls, cat) still return {"continue": true} (allow)
• Verify blocked operations still exit(2) (block)
• Verify confirm operations (git push --force) now output valid hookSpecificOutput JSON
• Verify malformed stdin causes exit(2) (fail-closed) instead of {"continue": true}
• Verify missing patterns.yaml returns hardcoded deny rules (not empty permissive config)

Generated with Claude Code