diff --git a/cmd/guard-workflow/main.go b/cmd/guard-workflow/main.go
new file mode 100644
index 00000000..ab51804b
--- /dev/null
+++ b/cmd/guard-workflow/main.go
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Tony Burns
+
+// Command guard-workflow judges hook commands for the four gh-family skills.
+package main
+
+import "os"
+
+func main() {
+	os.Exit(Run(os.Args[1:], streams{in: os.Stdin, out: os.Stdout, err: os.Stderr}))
+}
diff --git a/cmd/guard-workflow/run.go b/cmd/guard-workflow/run.go
new file mode 100644
index 00000000..3b738a91
--- /dev/null
+++ b/cmd/guard-workflow/run.go
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Tony Burns
+
+package main
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/tbhb-dev/devtools/internal/guard"
+	"github.com/tbhb-dev/devtools/internal/hookio"
+)
+
+const exitBlocked = 2
+
+type streams struct {
+	in  io.Reader
+	out io.Writer
+	err io.Writer
+}
+
+// Run returns the hook exit status, and an allowed call writes to neither stream.
+func Run(args []string, s streams) int {
+	if len(args) != 1 {
+		return usage(s.err)
+	}
+	skill := args[0]
+	switch skill {
+	case "pr", "merge-pr", "watch-pr", "fix-pr":
+	default:
+		return usage(s.err)
+	}
+	payload, err := hookio.DecodeStrict(s.in)
+	if err != nil {
+		return 0
+	}
+	reason := guard.Reason(skill, payload.ToolInput.Command)
+	if reason == "" {
+		return 0
+	}
+	if blockErr := hookio.Block(s.err, skill, reason); blockErr != nil {
+		fmt.Fprintln(s.err, "guard-workflow:", blockErr)
+	}
+	return exitBlocked
+}
+
+func usage(w io.Writer) int {
+	fmt.Fprintln(w, "usage: guard-workflow <pr|merge-pr|watch-pr|fix-pr>")
+	return exitBlocked
+}
diff --git a/cmd/guard-workflow/run_test.go b/cmd/guard-workflow/run_test.go
new file mode 100644
index 00000000..5cdf942f
--- /dev/null
+++ b/cmd/guard-workflow/run_test.go
@@ -0,0 +1,193 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Tony Burns
+
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type commandCase struct {
+	ac, skill, command string
+	blocked            bool
+	entry              string
+}
+
+func commandCases() []commandCase {
+	cases := make([]commandCase, 0, 138)
+	for _, skill := range []string{"pr", "merge-pr"} {
+		entry := "create-pr.sh"
+		if skill == "merge-pr" {
+			entry = "squash-merge.sh"
+		}
+		for _, verb := range []string{"list", "view", "diff", "status", "checks"} {
+			cases = append(cases, commandCase{"AC1", skill, "gh pr " + verb, false, ""})
+		}
+		for _, verb := range []string{"create", "edit", "ready", "merge", "close", "comment", "future-verb"} {
+			cases = append(cases, commandCase{"AC2", skill, "gh pr " + verb + " 1", true, entry})
+		}
+		cases = append(cases,
+			commandCase{"AC2", skill, "gh pr view 1; gh pr merge 1", false, ""},
+			commandCase{"AC2", skill, "gh pr merge 1; gh pr view 1", true, entry},
+			commandCase{"AC4", skill, `echo "gh pr merge 1"`, false, ""},
+			commandCase{"AC4", skill, "cat <<'EOF'\ngh pr merge 1\nEOF", true, entry},
+			commandCase{"AC4", skill, `echo "; gh pr merge 1"`, true, entry},
+		)
+	}
+	cases = append(cases,
+		commandCase{"AC5", "watch-pr", "gh pr checks 1", false, ""},
+		commandCase{"AC5", "watch-pr", "gh pr checks 1 --watch", true, "watch-checks.sh"},
+		commandCase{"AC5", "watch-pr", "gh pr checks 1 --fail-fast", true, "watch-checks.sh"},
+		commandCase{"AC5", "watch-pr", "gh run watch 1", true, "watch-checks.sh"},
+		commandCase{"AC5", "fix-pr", "gh pr checks 1", false, ""},
+		commandCase{"AC5", "fix-pr", "gh pr checks 1 --watch", true, "watch-pr skill"},
+		commandCase{"AC5", "fix-pr", "gh pr checks 1 --fail-fast", true, "watch-pr skill"},
+		commandCase{"AC5", "fix-pr", "gh run watch 1", false, ""},
+		commandCase{"AC6", "fix-pr", "gh run view 1 --log", true, "diagnose.sh"},
+		commandCase{"AC6", "fix-pr", "gh run view 1 --log-failed", true, "diagnose.sh"},
+		commandCase{"AC6", "fix-pr", "gh run view 1 --job 2 --log", false, ""},
+		commandCase{"AC6", "fix-pr", "gh run view 1 --log-failed --job=2", false, ""},
+		commandCase{"AC6", "fix-pr", "gh run view 1", false, ""},
+		commandCase{"AC6", "fix-pr", "gh run view 1 --logging", false, ""},
+		commandCase{"AC7", "fix-pr", "git push --force origin HEAD", true, "--force-with-lease"},
+		commandCase{"AC7", "fix-pr", "git push -f", true, "--force-with-lease"},
+		commandCase{"AC7", "fix-pr", "git push --force-with-lease", false, ""},
+		commandCase{"AC7", "fix-pr", "git push --force --force-with-lease", false, ""},
+		commandCase{"AC7", "fix-pr", "git push --forceful", false, ""},
+		commandCase{"AC7", "fix-pr", "git push -foo", false, ""},
+		commandCase{"AC4", "watch-pr", `gh pr checks 1; echo "--watch"`, true, "watch-checks.sh"},
+		commandCase{"AC4", "fix-pr", "gh pr checks 1\ncat <<EOF\n--fail-fast\nEOF", true, "watch-pr skill"},
+		commandCase{"AC4", "fix-pr", "gh run view 1\ncat <<EOF\n--log\nEOF", true, "diagnose.sh"},
+		commandCase{"AC4", "fix-pr", `gh run view 1 --log; echo "--job"`, false, ""},
+		commandCase{"AC4", "fix-pr", "git push\ncat <<EOF\n--force\nEOF", true, "--force-with-lease"},
+		commandCase{"AC4", "fix-pr", `git push -f; echo "--force-with-lease"`, false, ""},
+		commandCase{"AC4", "fix-pr", `gh run view 1; echo "--log"`, false, ""},
+		commandCase{"AC4", "fix-pr", `gh run view 1; echo "--log-failed"`, true, "diagnose.sh"},
+		commandCase{"AC4", "fix-pr", `git push; echo "--force"`, false, ""},
+		commandCase{"AC4", "fix-pr", `git push; echo "--force "`, true, "--force-with-lease"},
+		commandCase{"AC4", "fix-pr", "gh run view 1 --log ; git push -f ; gh pr checks --watch", true, "diagnose.sh"},
+		commandCase{"AC4", "fix-pr", "git push -f ; gh pr checks --watch", true, "--force-with-lease"},
+	)
+	for _, call := range []struct{ skill, command string }{
+		{"pr", "gh pr merge 1"},
+		{"merge-pr", "gh pr merge 1"},
+		{"watch-pr", "gh run watch 1"},
+		{"fix-pr", "git push -f"},
+		{"fix-pr", "gh run view 1 --log"},
+		{"fix-pr", "gh pr checks --watch"},
+	} {
+		for _, prefix := range []string{"", " \t", "; ", "& ", "| ", "( ", "&& ", "|| ", "\n", "\r\v\f"} {
+			cases = append(cases, commandCase{"AC4", call.skill, prefix + call.command, true, ""})
+		}
+		cases = append(cases,
+			commandCase{"AC4", call.skill, "echo " + call.command, false, ""},
+			commandCase{"AC4", call.skill, "echo \"text\n" + call.command + " \"", true, ""},
+		)
+	}
+	return cases
+}
+
+type result struct {
+	code           int
+	stdout, stderr string
+}
+
+func execute(input string, args ...string) result {
+	var out, errOut bytes.Buffer
+	code := Run(args, streams{in: strings.NewReader(input), out: &out, err: &errOut})
+	return result{code, out.String(), errOut.String()}
+}
+
+func payload(t *testing.T, tool, command string) string {
+	t.Helper()
+	data, err := json.Marshal(map[string]any{
+		"tool_name": tool, "tool_input": map[string]string{"command": command},
+	})
+	require.NoError(t, err)
+	return string(data)
+}
+
+func TestAcceptance(t *testing.T) {
+	t.Parallel()
+	for _, tc := range commandCases() {
+		t.Run(tc.ac+"/"+tc.skill+"/"+tc.command, func(t *testing.T) {
+			t.Parallel()
+			input := payload(t, "Bash", tc.command)
+			got := execute(input, tc.skill)
+			assert.Empty(t, got.stdout)
+			if !tc.blocked {
+				assert.Equal(t, result{}, got)
+				return
+			}
+			assert.Equal(t, 2, got.code)
+			header := "Blocked by the " + tc.skill + " skill guard.\n\n"
+			assert.True(t, strings.HasPrefix(got.stderr, header))
+			assert.NotEmpty(t, strings.TrimSpace(strings.TrimPrefix(got.stderr, header)))
+			assert.True(t, strings.HasSuffix(got.stderr, "\n"))
+			assert.Contains(t, got.stderr, tc.entry)
+			if tc.skill == "pr" {
+				assert.NotContains(t, got.stderr, "squash-merge.sh")
+			}
+		})
+	}
+}
+
+func TestAC3Parity(t *testing.T) {
+	t.Parallel()
+	for _, tc := range commandCases() {
+		input := payload(t, "Bash", tc.command)
+		pr, merge := execute(input, "pr"), execute(input, "merge-pr")
+		assert.Equal(t, pr.code, merge.code, tc.command)
+		if merge.code != 0 {
+			assert.Contains(t, merge.stderr, "squash-merge.sh")
+			assert.Contains(t, pr.stderr, "create-pr.sh")
+			assert.NotContains(t, pr.stderr, "squash-merge.sh")
+		}
+	}
+}
+
+func TestAC8Payloads(t *testing.T) {
+	t.Parallel()
+	for _, skill := range []string{"pr", "merge-pr", "watch-pr", "fix-pr"} {
+		for _, input := range []string{
+			"", "{", "null", "not json", "{}", `{"tool_input":{}}`,
+			`{"tool_input":{"command":""}}`, `{"tool_input":{"command":null}}`,
+			`{"tool_input":{"command":"gh pr merge 1"}}x`,
+		} {
+			assert.Equal(t, result{}, execute(input, skill), "%s: %s", skill, input)
+		}
+		command := "gh pr merge 1; gh pr checks --watch"
+		bash := execute(payload(t, "Bash", command), skill)
+		assert.Equal(t, 2, bash.code)
+		for _, tool := range []string{"Write", "", "Other"} {
+			assert.Equal(t, bash, execute(payload(t, tool, command), skill))
+		}
+	}
+}
+
+func TestAC10Determinism(t *testing.T) {
+	t.Parallel()
+	for _, tc := range commandCases() {
+		input := payload(t, "Bash", tc.command)
+		want := execute(input, tc.skill)
+		for range 3 {
+			assert.Equal(t, want, execute(input, tc.skill), "%s: %s", tc.skill, tc.command)
+		}
+	}
+}
+
+func TestUsage(t *testing.T) {
+	t.Parallel()
+	for _, args := range [][]string{nil, {"unknown"}, {"pr", "extra"}} {
+		got := execute("", args...)
+		assert.Equal(t, 2, got.code)
+		assert.Empty(t, got.stdout)
+		assert.Contains(t, got.stderr, "usage: guard-workflow")
+	}
+}
diff --git a/cmd/guard-workflow/shell_parity_test.go b/cmd/guard-workflow/shell_parity_test.go
new file mode 100644
index 00000000..7c19732e
--- /dev/null
+++ b/cmd/guard-workflow/shell_parity_test.go
@@ -0,0 +1,91 @@
+//go:build darwin || linux
+
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Tony Burns
+
+package main
+
+import (
+	"bytes"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The portable tables run on every platform. Where the frozen scripts
+// run natively, also compare their actual protocol with the built binary.
+func TestAC9FrozenShell(t *testing.T) {
+	t.Parallel()
+	binary := filepath.Join(t.TempDir(), "guard-workflow")
+	goTool, err := exec.LookPath("go")
+	require.NoError(t, err)
+	build := exec.CommandContext(t.Context(), goTool, "build", "-o", binary, ".")
+	output, err := build.CombinedOutput()
+	require.NoError(t, err, "%s", output)
+	bash, err := exec.LookPath("bash")
+	require.NoError(t, err)
+	scripts := map[string]string{
+		"pr": "guard-gh.sh", "merge-pr": "guard-merge.sh",
+		"watch-pr": "guard-watch.sh", "fix-pr": "guard-fix.sh",
+	}
+	for _, tc := range commandCases() {
+		t.Run(tc.ac+"/"+tc.skill+"/"+tc.command, func(t *testing.T) {
+			t.Parallel()
+			input := payload(t, "Bash", tc.command)
+			script := filepath.Join("..", "..", "packages", "agents", "source", "skills",
+				tc.skill, "claude", "scripts", scripts[tc.skill])
+			want := processResult(t, input, bash, script)
+			got := processResult(t, input, binary, tc.skill)
+			assert.Equal(t, want, got)
+			assert.Empty(t, got.stdout)
+			if tc.blocked {
+				assert.Equal(t, 2, want.code)
+			} else {
+				assert.Equal(t, result{}, want)
+			}
+		})
+	}
+}
+
+// Covers payloads with text after the first JSON value, which the shell guard rejects.
+func TestAC8TrailingInputFrozenShell(t *testing.T) {
+	t.Parallel()
+	binary := filepath.Join(t.TempDir(), "guard-workflow")
+	goTool, err := exec.LookPath("go")
+	require.NoError(t, err)
+	build := exec.CommandContext(t.Context(), goTool, "build", "-o", binary, ".")
+	output, err := build.CombinedOutput()
+	require.NoError(t, err, "%s", output)
+	bash, err := exec.LookPath("bash")
+	require.NoError(t, err)
+	scripts := map[string]string{
+		"pr": "guard-gh.sh", "merge-pr": "guard-merge.sh",
+		"watch-pr": "guard-watch.sh", "fix-pr": "guard-fix.sh",
+	}
+	for skill, name := range scripts {
+		input := payload(t, "Bash", "gh pr merge 1; gh pr checks --watch") + "x"
+		script := filepath.Join("..", "..", "packages", "agents", "source", "skills",
+			skill, "claude", "scripts", name)
+		assert.NotEqual(t, 2, processResult(t, input, bash, script).code, skill)
+		assert.Equal(t, result{}, processResult(t, input, binary, skill), skill)
+		assert.Equal(t, result{}, execute(input, skill), skill)
+	}
+}
+
+func processResult(t *testing.T, input, binary string, args ...string) result {
+	t.Helper()
+	var out, errOut bytes.Buffer
+	command := exec.CommandContext(t.Context(), binary, args...)
+	command.Stdin, command.Stdout, command.Stderr = strings.NewReader(input), &out, &errOut
+	var code int
+	if err := command.Run(); err != nil {
+		var exitErr *exec.ExitError
+		require.ErrorAs(t, err, &exitErr)
+		code = exitErr.ExitCode()
+	}
+	return result{code, out.String(), errOut.String()}
+}
diff --git a/internal/guard/guard.go b/internal/guard/guard.go
new file mode 100644
index 00000000..28c8e839
--- /dev/null
+++ b/internal/guard/guard.go
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Tony Burns
+
+package guard
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// Shell whitespace under the shells' LC_ALL=C includes vertical tab, which
+// Go's [[:space:]] omits. These expressions intentionally skip parsing
+// quoting or heredocs, and the flag expressions inspect the entire text.
+const (
+	space   = `[ \t\r\n\v\f]`
+	atStart = `(^|[;&|(\n])` + space + `*`
+)
+
+// Reason returns an empty string to allow the command, or the frozen
+// shell guard's denial reason. It ignores the tool name.
+func Reason(skill, command string) string {
+	switch skill {
+	case "pr", "merge-pr":
+		match := regexp.MustCompile(atStart + `gh` + space + `+pr` + space + `+([a-z-]+)`).FindStringSubmatch(command)
+		if match == nil {
+			return ""
+		}
+		// Only the first matching verb is judged, including in a compound call.
+		verb := match[2]
+		switch verb {
+		case "list", "view", "diff", "status", "checks":
+			return ""
+		}
+		if skill == "pr" {
+			return fmt.Sprintf(publishReason, verb)
+		}
+		return fmt.Sprintf(mergeReason, verb)
+	case "watch-pr":
+		if watchingChecks(command) {
+			return watchChecksReason
+		}
+		if call(command, `gh`+space+`+run`+space+`+watch`) {
+			return watchRunReason
+		}
+	case "fix-pr":
+		return fixReason(command)
+	}
+	return ""
+}
+
+func call(command, expression string) bool {
+	return regexp.MustCompile(atStart + expression).MatchString(command)
+}
+
+func watchingChecks(command string) bool {
+	return call(command, `gh`+space+`+pr`+space+`+checks`) &&
+		(strings.Contains(command, "--watch") || strings.Contains(command, "--fail-fast"))
+}
+
+func fixReason(command string) string {
+	if call(command, `gh`+space+`+run`+space+`+view`) &&
+		regexp.MustCompile(`--log-failed|--log(`+space+`|$)`).MatchString(command) &&
+		!strings.Contains(command, "--job") {
+		return diagnoseReason
+	}
+	if call(command, `git`+space+`+push`) &&
+		regexp.MustCompile(`--force(`+space+`|$)|`+space+`-f(`+space+`|$)`).MatchString(command) &&
+		!strings.Contains(command, "--force-with-lease") {
+		return forceReason
+	}
+	if watchingChecks(command) {
+		return fixWatchReason
+	}
+	return ""
+}
diff --git a/internal/guard/imports_test.go b/internal/guard/imports_test.go
new file mode 100644
index 00000000..2ce75aaa
--- /dev/null
+++ b/internal/guard/imports_test.go
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Tony Burns
+
+package guard_test
+
+import (
+	"go/parser"
+	"go/token"
+	"os"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAC10Imports(t *testing.T) {
+	t.Parallel()
+	entries, err := os.ReadDir(".")
+	require.NoError(t, err)
+	var inspected int
+	for _, entry := range entries {
+		name := entry.Name()
+		if !strings.HasSuffix(name, ".go") || strings.HasSuffix(name, "_test.go") {
+			continue
+		}
+		inspected++
+		file, parseErr := parser.ParseFile(token.NewFileSet(), name, nil, parser.ImportsOnly)
+		require.NoError(t, parseErr)
+		for _, spec := range file.Imports {
+			path, unquoteErr := strconv.Unquote(spec.Path.Value)
+			require.NoError(t, unquoteErr)
+			assert.Contains(t, []string{"fmt", "regexp", "strings"}, path, "%s imports %s", name, path)
+		}
+	}
+	assert.Positive(t, inspected)
+}
diff --git a/internal/guard/reasons.go b/internal/guard/reasons.go
new file mode 100644
index 00000000..1604cd2a
--- /dev/null
+++ b/internal/guard/reasons.go
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Tony Burns
+
+package guard
+
+// Keep the shell guards' reason bytes intact for the later caller flip.
+const readingNote = "\n\nReading stays open: gh pr list, view, diff, status, and checks all run\nwithout asking."
+
+const publishReason = "`gh pr %s` changes the pull request, and this workflow keeps every\n" + `such change behind one entry point:
+
+` + "  " + `bash .claude/skills/pr/scripts/create-pr.sh
+
+That script validates the description against the template, checks that
+the review stamp covers the exact bytes on disk and the branch as it
+stands, resolves the labels and every issue reference before anything is
+published, and updates the open pull request when one already exists.` + readingNote
+
+const mergeReason = "`gh pr %s` changes the pull request, and merging runs through one\n" + `entry point:
+
+` + "  " + `bash .claude/skills/merge-pr/scripts/squash-merge.sh [--confirmed] <number>
+
+That script checks that the message names this pull request, that the
+independent review cleared the exact bytes on disk at the head about to
+merge, that the message passes the commit-msg gates, that the pull
+request is open, ready, mergeable, and green, and that somebody
+confirmed the merge. It then merges pinned to the reviewed head,
+removes the drafts, and deletes the branch.
+
+Calling gh directly writes a message onto the default branch that
+nothing reviewed, and nothing lints a squash commit afterwards.` + readingNote
+
+const watchChecksReason = `This skill wraps the watch so each check becomes one event rather than
+one turn:
+
+` + "  " + `Monitor({
+` + "    " + `command: "bash .claude/skills/watch-pr/scripts/watch-checks.sh <number>",
+` + "    " + `description: "checks on pull request <number>",
+` + "    " + `timeout_ms: 1800000,
+` + "    " + `persistent: false,
+` + "  " + `})
+
+The script emits PASS, SKIP, and FAIL lines as they settle, then exits.
+A single 'gh pr checks' without --watch is fine for a one-off look.`
+
+const watchRunReason = `Watching a run directly reports a workflow rather than the pull request,
+and it blocks a turn to do it. Use the skill's watcher instead:
+
+` + "  " + `bash .claude/skills/watch-pr/scripts/watch-checks.sh <number>`
+
+const diagnoseReason = `Sweeping the failing steps is what the skill's own diagnosis does, in one
+call, with the reproducing task named beside each failure:
+
+` + "  " + `bash .claude/skills/fix-pr/scripts/diagnose.sh <number>
+
+Run that first. Once you need more than the tail it printed, a single
+job's full log stays available:
+
+` + "  " + `gh run view <run-id> --job <job-id> --log`
+
+const forceReason = `A bare force push overwrites whatever the remote has, including commits
+this worktree never saw. Use the lease instead:
+
+` + "  " + `git push --force-with-lease origin HEAD
+
+It refuses when the remote moved since your last fetch, which is exactly
+the case a bare --force would destroy.`
+
+const fixWatchReason = `Waiting on checks belongs to the watch-pr skill, which streams each result
+as an event rather than blocking a turn. Invoke that skill instead.`
diff --git a/internal/hookio/hookio.go b/internal/hookio/hookio.go
index fa08cb65..af6a18de 100644
--- a/internal/hookio/hookio.go
+++ b/internal/hookio/hookio.go
@@ -27,9 +27,10 @@ const preToolUse = "PreToolUse"
 var ErrNoReason = errors.New("hookio: refusing to deny without a reason")
 
 // ToolInput holds the fields of the tool call under inspection. The set is
-// the union across Write and Edit; a field absent from the incoming payload
+// the union across Write, Edit and Bash; a field absent from the incoming payload
 // decodes to its zero value.
 type ToolInput struct {
+	Command    string `json:"command"`
 	FilePath   string `json:"file_path"`
 	Content    string `json:"content"`
 	OldString  string `json:"old_string"`
@@ -48,15 +49,36 @@ type Payload struct {
 // stays testable without touching the filesystem.
 type ReadFileFunc func(string) ([]byte, error)
 
-// Decode reads one JSON payload.
+// Decode reads one JSON payload and ignores anything after it.
 func Decode(r io.Reader) (Payload, error) {
-	var p Payload
-	if err := json.NewDecoder(r).Decode(&p); err != nil {
-		return Payload{}, fmt.Errorf("hookio: decoding payload: %w", err)
+	p, _, err := decode(r)
+	return p, err
+}
+
+// DecodeStrict reads one JSON payload and rejects text after it that isn't
+// JSON. The frozen shell guards parse the whole input, so text after the first
+// value makes the payload unreadable there and must here too.
+func DecodeStrict(r io.Reader) (Payload, error) {
+	p, decoder, err := decode(r)
+	if err != nil {
+		return Payload{}, err
+	}
+	var trailing json.RawMessage
+	if trailErr := decoder.Decode(&trailing); trailErr != nil && !errors.Is(trailErr, io.EOF) {
+		return Payload{}, fmt.Errorf("hookio: decoding trailing input: %w", trailErr)
 	}
 	return p, nil
 }
 
+func decode(r io.Reader) (Payload, *json.Decoder, error) {
+	var p Payload
+	decoder := json.NewDecoder(r)
+	if err := decoder.Decode(&p); err != nil {
+		return Payload{}, nil, fmt.Errorf("hookio: decoding payload: %w", err)
+	}
+	return p, decoder, nil
+}
+
 // Resolve recovers the file content the tool call would produce.
 //
 // Write supplies the whole document, which doesn't need reconstruction.
@@ -123,3 +145,14 @@ func Deny(w io.Writer, reason string) error {
 	}
 	return nil
 }
+
+// Block writes the shell skill guards' stderr protocol. The caller exits 2.
+func Block(w io.Writer, skill, reason string) error {
+	if strings.TrimSpace(reason) == "" {
+		return ErrNoReason
+	}
+	if _, err := fmt.Fprintf(w, "Blocked by the %s skill guard.\n\n%s\n", skill, reason); err != nil {
+		return fmt.Errorf("hookio: writing block: %w", err)
+	}
+	return nil
+}
diff --git a/internal/hookio/hookio_test.go b/internal/hookio/hookio_test.go
index 18c2f167..e245f20e 100644
--- a/internal/hookio/hookio_test.go
+++ b/internal/hookio/hookio_test.go
@@ -173,3 +173,33 @@ func TestDeny(t *testing.T) {
 		assert.Empty(t, buf.String())
 	})
 }
+
+func TestDecodeCommand(t *testing.T) {
+	t.Parallel()
+	p, err := hookio.Decode(strings.NewReader(`{"tool_name":"Bash","tool_input":{"command":"gh pr view 1"}}`))
+	require.NoError(t, err)
+	assert.Equal(t, "gh pr view 1", p.ToolInput.Command)
+}
+
+func TestDecodeStrictTrailingInput(t *testing.T) {
+	t.Parallel()
+	first := `{"tool_name":"Bash","tool_input":{"command":"gh pr merge 1"}}`
+	for _, trailing := range []string{"x", "{", "}", "garbage text"} {
+		_, err := hookio.DecodeStrict(strings.NewReader(first + trailing))
+		require.Error(t, err, trailing)
+		_, err = hookio.Decode(strings.NewReader(first + trailing))
+		require.NoError(t, err, trailing)
+	}
+	_, err := hookio.DecodeStrict(strings.NewReader(first + "\n"))
+	require.NoError(t, err)
+}
+
+func TestBlock(t *testing.T) {
+	t.Parallel()
+	var out bytes.Buffer
+	require.NoError(t, hookio.Block(&out, "pr", "Use the entry point."))
+	assert.Equal(t, "Blocked by the pr skill guard.\n\nUse the entry point.\n", out.String())
+	out.Reset()
+	require.ErrorIs(t, hookio.Block(&out, "pr", " \n"), hookio.ErrNoReason)
+	assert.Empty(t, out.String())
+}