{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "bash",
        "hooks": [
          { "type": "command", "command": "echo 'bash is disabled by codex policy in this session' >&2; exit 2" }
        ]
      }
    ]
  }
}