This hook runs on the PreToolUse event, specifically on Write tool calls. It uses a lightweight condition to check the write target.

When the destination file matches the .env pattern, the write is denied right away, preventing credentials from being overwritten or leaked by mistake.

When to use

When you keep secrets in .env files and want to protect them.
When several contributors use the agent and the overwrite risk is real.

How to use

After installing, any attempt to write to .env is blocked automatically. Edit those files manually when you need to.