test: flag project hook helpers whose pre-bash exits 1 on [BLOCKED] #428

Why

Ruflo's pre-bash hook helper (.claude/helpers/hook-handler.cjs) prints [BLOCKED] Dangerous command detected but exits 1, which Claude Code treats as a non-blocking error; only exit 2 blocks. That is what every @claude-flow/cli release from 3.5.19 through 3.51.0 does. 3.51.1 (published 2026-10-02) exits 2. A project's copy of the helper, written by an older ruflo init, keeps the old behaviour. Reproduced during the #319 triage (A61-16), using ruflo's own helper in a scratch install.

ak's own OpenCode template already blocks on the [BLOCKED] text, so only the Claude Code hook path is exposed.

In scope

An ak audit hooks diagnostic for a project's .claude/helpers/hook-handler.cjs whose pre-bash path exits 1 after printing [BLOCKED], with the step that fixes it. The diagnostic names ruflo 3.51.1 as the first release that blocks.

Out of scope

Editing ruflo's helper, or posting upstream. Raising the Ruflo support floor, which is decided separately.

Acceptance criteria

• The diagnostic fires on a helper that exits 1 after [BLOCKED] and not on one that exits 2
• ak audit hooks names the first ruflo release that blocks (3.51.1)
• Tests run the real helper from a fixture, not a hand-written stand-in

Dependencies

Blocked by: none

Blocks: none

Plan

• Release: 4.0.0-beta.1
• Size: size:S · Workstream: ws:remediation
• Epic: feat: project-scope P1, project layout and ak init (epic) #296
• Card: P1-10 in the card inventory
• Sources: A61-16 (chore: triage D01, D10 and the [BLOCKED] hook exit-code finding #319) triage; ruflo @claude-flow/cli 3.51.1

Verification

• node scripts/run-tests.mjs focus (new hook-audit tests)