diff --git a/inventory/inventory-graph.json b/inventory/inventory-graph.json
index 4ac1d3f17..aa87ec643 100644
--- a/inventory/inventory-graph.json
+++ b/inventory/inventory-graph.json
@@ -5,15 +5,15 @@
   "provenance": {
     "base": "05c800f40d1ad53b42a78609d2667ef4f726808b",
     "planningHead": "0a91273e61dbbd47eb0af4c02844409251e08398",
-    "head": "403a40ca4cd080ae6fe1bcd7cf04f1e1a17e4d73",
-    "sourceSha256": "0d6eea19f36011c47bd0dadcebba72d306cfd21789c871f79aeb8125de950751",
+    "head": "6b621aa7c92b28f3ba34e1e87fda64736652a65b",
+    "sourceSha256": "afa8403bc6e809c8ed9019276c6f8d6a399f787ef865b8cef6bf8f8c6a74d0ae",
     "generatedAt": null,
     "generator": "scripts/generate-inventory-graph.mjs"
   },
   "base": "05c800f40d1ad53b42a78609d2667ef4f726808b",
   "planningHead": "0a91273e61dbbd47eb0af4c02844409251e08398",
-  "head": "403a40ca4cd080ae6fe1bcd7cf04f1e1a17e4d73",
-  "sourceSha256": "0d6eea19f36011c47bd0dadcebba72d306cfd21789c871f79aeb8125de950751",
+  "head": "6b621aa7c92b28f3ba34e1e87fda64736652a65b",
+  "sourceSha256": "afa8403bc6e809c8ed9019276c6f8d6a399f787ef865b8cef6bf8f8c6a74d0ae",
   "counts": {
     "public": {
       "skills": 35,
@@ -76776,5 +76776,5 @@
     }
   },
   "inventorySha256": "f5ea9ebf29ba491f17b39431660e07f71eb3d78399d481c1c2b00fc34cf2ab50",
-  "manifestSha256": "8e308f82d0de9d9051f498a6c049e856e000da8df3919cf3b050bcb4b1db7409"
+  "manifestSha256": "3525afe90a6efd681ea4d89261fdb6c97f0fdd605f56c97e19e872525b8fbe72"
 }
diff --git a/src/hooks/__tests__/pre-tool-use-template-source-ext.test.ts b/src/hooks/__tests__/pre-tool-use-template-source-ext.test.ts
index a2153cd66..32d64437f 100644
--- a/src/hooks/__tests__/pre-tool-use-template-source-ext.test.ts
+++ b/src/hooks/__tests__/pre-tool-use-template-source-ext.test.ts
@@ -396,6 +396,7 @@ describe('pre-tool-use template source extension detection', () => {
       ['invalid printf option produces no stdout program', "printf -x 'rm src/app.ts' | bash", false],
       ['echo -E does not expand escapes into a stdin program', "echo -E 'true\\nrm src/app.ts' | bash", false],
       ['invalid plus option after -c is not a program', "bash -c +z 'rm src/app.ts'", false],
+      ['plus-D after -c dumps strings and does not run the command', "bash -c +D 'rm src/app.ts'", false],
       ['named coprocess writing only a log', 'coproc worker bash verify.sh > results.log', false],
     ] as const)('stays quiet: %s', (_label, command, expectedWarning) => {
       expect(hasDelegationNotice(runPreToolUseHook(command))).toBe(expectedWarning);
diff --git a/templates/hooks/pre-tool-use.mjs b/templates/hooks/pre-tool-use.mjs
index b23ba3946..adb7f064b 100644
--- a/templates/hooks/pre-tool-use.mjs
+++ b/templates/hooks/pre-tool-use.mjs
@@ -1438,7 +1438,8 @@ function checkSegment(segment, directory) {
             if (!shellArgs[codeIndex + 1]) return true;
             codeIndex += 2; continue;
           }
-          if (/^[+-][abefhkmnptuvxBCEHPTcilsD]+$/.test(value) || /^(?:--norc|--noprofile|--posix|--restricted|--verbose|--debugger)$/.test(value)) {
+          if (/^[+-]D$/.test(value) || /^(?:--dump-strings|--dump-po-strings)$/.test(value)) return false;
+          if (/^[+-][abefhkmnptuvxBCEHPTcils]+$/.test(value) || /^(?:--norc|--noprofile|--posix|--restricted|--verbose|--debugger)$/.test(value)) {
             codeIndex += 1; continue;
           }
           if (value.startsWith('-') || value.startsWith('+')) return false;