fix(hooks): don't say Blocked on PostToolUse additionalContext

[Deveshu04]

Description

Part of #669 (point 3).

On Claude Code and OpenCode, a PostToolUse deny is sent as additionalContext. The tool has already run and the model has already seen its output, but the message said:

Blocked Bash by failproofai because: AWS access key ID detected in tool output, ...

Nothing was blocked. It now says:

Flagged Bash output by failproofai because: AWS access key ID detected in tool output, ...

Codex and Copilot keep "Blocked", since there the reason does replace the tool result.

Tests: updated the two unit tests and the e2e helper that check this text, and the 7 matching rows in unconfigured-golden.json. I diffed every evaluator and handler corpus case before and after the change: only the Claude and OpenCode PostToolUse deny outputs changed, and only in this text.

Actual redaction through updatedToolOutput (points 1 and 2 of #669) will be a separate PR.

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation

Checklist

• npm run lint passes
• npx tsc --noEmit passes
• npm run test:run passes for the affected files. I ran them on Windows: the only failures are path-related and fail on main in the same way.
• npm run build succeeds. The Next.js build fails on Windows on main too, so I'm relying on CI for this one.

[github-actions]

Thanks @Deveshu04 for your contribution to Failproof AI! 🙌

We'd love to discuss your PR and welcome you to our community.

Discord: https://discord.befailproof.ai/
Reddit: https://www.reddit.com/r/failproofai/

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: aef0bf75-ed82-4b64-979d-68984f360375

📥 Commits

Reviewing files that changed from the base of the PR and between 4fb46aa and 1eb8f7d.

📒 Files selected for processing (5)

• CHANGELOG.md
• __tests__/e2e/helpers/hook-runner.ts
• __tests__/fixtures/two-tier/unconfigured-golden.json
• __tests__/hooks/policy-evaluator.test.ts
• src/hooks/policy-evaluator.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

Generic PostToolUse denial context now says the tool output was flagged rather than claiming the call was blocked. The evaluator builds a shared reason-attribution phrase. Tests, fixtures, and the changelog use the updated wording.

Changes: PostToolUse wording

Layer / File(s)	Summary
Flagged-output message and coverage src/hooks/policy-evaluator.ts, __tests__/e2e/helpers/hook-runner.ts, __tests__/hooks/policy-evaluator.test.ts, __tests__/fixtures/two-tier/unconfigured-golden.json, CHANGELOG.md	The evaluator uses flagged-output wording for generic PostToolUse denials and selects a shared reason-attribution phrase. Assertions and fixture expectations change from “Blocked” to “Flagged.” The changelog records the update.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: chhhee10

Merge Risk: ⚪ Minimal · up to 1eb8f

This changes the wording of the PostToolUse deny message so it no longer claims the call was blocked. No functional or operational risk was identified, so it is ready to merge.

Pre-merge checks · 4 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (2 skipped: 2 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the main change: PostToolUse additionalContext no longer says "Blocked" when the tool output was already seen.
Description check		The description is complete and follows the repository template. It explains the change, identifies the bug-fix type, documents test results, and explains why the build checklist item remains unchecke…

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit reads the tool output with care,
“Flagged,” says the message, now clear and fair.
The tests hop along to the wording anew,
The changelog notes what the evaluator will do.
Then the rabbit bounds off beneath the moonlight.}

_{Comment @coderabbitai help to get the list of available commands.}