diff --git a/.claude/hooks/guard-write.sh b/.claude/hooks/guard-write.sh
new file mode 100755
index 0000000..40af5e9
--- /dev/null
+++ b/.claude/hooks/guard-write.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+# PreToolUse hook for Write/Edit/MultiEdit - enforces RFC 0038 worktree protection
+
+# Extract file_path directly with jq (recommended pattern - avoids cat hanging)
+FILE_PATH=$(jq -r '.tool_input.file_path // empty')
+
+# If no file_path, allow (shouldn't happen for Write/Edit)
+if [ -z "$FILE_PATH" ]; then
+    exit 0
+fi
+
+# Call blue guard with the extracted path
+# Use full path to target/release binary and close stdin
+/Users/ericg/letemcook/blue/target/release/blue guard --path="$FILE_PATH" </dev/null
diff --git a/.claude/settings.json b/.claude/settings.json
index 7442a5d..453969e 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "blue guard --path=\"$TOOL_INPUT:file_path\""
+            "command": ".claude/hooks/guard-write.sh"
           }
         ]
       }