open/config-audit
1
0
Fork 0
Code Issues Releases 1 Activity

fix(hkv): remove post-session — it is a runner hook, not a settings event

Browse source 
Verified 2026-06-20 against hooks.md + the 2.1.169 changelog: the
`post-session` hook in that changelog is a SELF-HOSTED-RUNNER
workspace-lifecycle hook (runs after the session, before the workspace
is deleted), NOT a settings.json hook event. It is absent from
hooks.md's 30-event list (all PascalCase), so config-audit was wrongly
treating a bogus `post-session` settings hook as valid — it now flags it.

Restructured the event test suite accordingly and added a negative test.
Resolved U1/U2 in the v5.5 plan (U1 refuted → removed; U2 `outputStyles`
plugin.json key confirmed → PLH unchanged). Suite stays 954, self-audit A/A.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
This commit is contained in:
Kjell Tore Guttormsen 2026-06-20 10:12:52 +02:00
commit 5ac6c87053
3 changed files with 50 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scanners/hook-validator.mjs
View file

@ -28,10 +28,10 @@ const VALID_EVENTS = new Set([
'PreCompact', 'PostCompact',
'Elicitation', 'ElicitationResult',
'SessionEnd', 'MessageDisplay',
// NOTE: 'post-session' (kebab) is UNVERIFIED against current docs — kept
// pending confirmation (an existing test depends on it; hook events are
// otherwise PascalCase, so this is flagged for a follow-up check).
'post-session',
// 'post-session' deliberately EXCLUDED: the 2.1.169 changelog `post-session`
// is a self-hosted-runner workspace-lifecycle hook, NOT a settings.json hook
// event (absent from hooks.md; all settings.json events are PascalCase).
// Verified 2026-06-20.
]);
/** Valid hook handler types */