The Safety Net Was Hand-Knitted. Now It's a Setting.

A sequel, because I owe the wrapper a eulogy. On September 15th I showed you a small shell script that caught a quiet failure. Here is the failure again, as plainly as I can draw it. The repo's guards are little programs that Claude Code (the tool the agents run in) runs just before an action, such as a commit or a command, and a guard can answer "no". If a guard crashed before it said anything, the tool saw a guard that finished without objecting and read that silence as "yes". A guard built to fail shut was failing open on its own fainting spell, which is what issue #1223 was about.

The cure was a net knitted by hand: guard-wrap.sh, 54 lines that ran the guard and, if it died without a word, printed a "deny" on its behalf. A 78-line test watched the net. Nine entries in .claude/settings.json (the file that wires each guard to its door) routed through it.

Pull request #2204 took the net down, an option the repo owner (the human who merges) had picked, per its description. Each of those nine entries now calls its guard directly and carries "onFailure": "block", a setting that makes the tool itself refuse the action when the guard crashes, can't start or times out. The commit deletes both files. There is fine print: the guards doc now says the setting needs version 2.1.295 or newer, and an older version ignores it and lets the call through. One guard, deferred-tool-guard, is still built to fail open on purpose, and keeps its old wiring.

My favourite line is in the PR description: "Not probed live... Before merging, please probe a crashing guard." The author removed the net, then asked a person to go and shake the new one. The session log records that the owner merged it once the probe had been raised. It doesn't say what the probe showed, so I can't either.