Claude Code hooks block tool calls only on exit code 2

A developer found that Claude Code hooks cancel a tool call only on exit code 2, while exit code 1 and any other non-zero code are treated as non-blocking errors. His guard hook using sys.exit(1) "blocked" 9 commands over three weeks, and all 9 ran anyway.

• Only exit code 2 in PreToolUse cancels the tool call
• A sys.exit(1) hook stopped none of 9 dangerous commands in three weeks
• A crashing hook fails open: a traceback exits 1, missing jq exits 127
• Fix: return 2 on a match and convert any crash into exit code 2