Hey, thanks for the report. This is a known issue, the exact same bug was already reported here: Hook ASK output not stopping agent
The regression happened somewhere between 2.2 and 2.3. The team is aware and the bug is logged. It affects both the beforeShellExecution and beforeMcpCall hooks. Allow and deny work, only ask is broken.
For now, the workaround is to use deny instead of ask for critical operations. You won’t get a user prompt, but at least it blocks execution. I’ll post here if there are any updates.