Observed

Source-reviewed: exit 2 reliably blocks PreToolUse on Bash.

1. UPDATE 2026-07-17: the Agent/Task-blocking gap (100% failure across 19 attempted blocks, #26923) is FIXED as of v2.1.90 — a collaborator (ashwin-ant) confirmed on the issue 'PreToolUse hooks that exit with code 2 and emit JSON on stdout now correctly block the tool call (including the Task tool)', independently corroborated by the v2.1.90 release notes: 'Fixed PreToolUse hooks that emit JSON to stdout and exit with code 2 not correctly blocking the tool call.' Issue closed COMPLETED (not stale-bot) 2026-04-18. Caveat carried forward per policy issue #2535: the fix requires exit 2 AND JSON on stdout together — a bare exit 2 with no stdout JSON is not confirmed to block. Not TD-executed via live repro this pass (a nested claude -p session was attempted but --dangerously-skip-permissions is itself blocked by this environment's own auto-mode classifier policy); closure rests on maintainer confirmation plus independent release-note corroboration, source-reviewed. Two other exit-code gaps are unconfirmed either way and keep this row at partial: PostToolUse exit 1 halting Claude awaiting user input (#4809) was closed as a duplicate — not independently re-verified as fixed this pass — and the Windows PreToolUse exit-code-ignored gap (#21988, v2.1.37–v2.1.63) closed COMPLETED, well before the current release. The reliable blocking mechanism that does not depend on this caveat is permissionDecision: deny in stdout JSON with exit 0.