diff --git a/git/hooks/pre-commit b/git/hooks/pre-commit
index 745b7ef..877b9ad 100755
--- a/git/hooks/pre-commit
+++ b/git/hooks/pre-commit
@@ -26,7 +26,10 @@ if echo "$added_lines" | grep -qE "(console\.log|debugger|binding\.pry|TODO:|FIX
     echo -e "${YELLOW}Warning: Found debugging keywords or TODOs in added lines:${NC}"
     echo "$added_lines" | grep -nE "(console\.log|debugger|binding\.pry|TODO:|FIXME:|XXX:)" || true
     echo
-    if [ -t 0 ] || [ -e /dev/tty ]; then
+    # Probe by OPENING /dev/tty, not testing existence — on macOS /dev/tty always
+    # exists ([ -e ] passes) but open() fails with ENXIO when there is no controlling
+    # terminal (agent harnesses, CI), which used to kill the read and block the commit.
+    if ( : < /dev/tty ) 2>/dev/null; then
         printf "Continue anyway? (y/n) "
         read -n 1 -r REPLY < /dev/tty
         echo
@@ -56,7 +59,9 @@ if echo "$added_lines" | grep -qE "(password|secret|token|api_key)[[:space:]]*=[
     echo "$added_lines" | grep -nE "(password|secret|token|api_key)[[:space:]]*=[[:space:]]*[\"'][^\"']+[\"']" || true
     echo "Please review your changes carefully."
     echo
-    if [ -t 0 ] || [ -e /dev/tty ]; then
+    # Same open()-probe as above. Note the deliberate asymmetry: secrets BLOCK when
+    # non-interactive (fail closed); debug keywords proceed with a warning.
+    if ( : < /dev/tty ) 2>/dev/null; then
         printf "Continue anyway? (y/n) "
         read -n 1 -r REPLY < /dev/tty
         echo