fix(hook-validator): recognize MessageDisplay + post-session events

Clears false positives where valid CC hook events were flagged as
"Unknown hook event" (gap matrix, Batch 1).

VALID_EVENTS += MessageDisplay (CC 2.1.152), post-session (CC 2.1.169,
kebab-case, distinct from SessionEnd). 26 -> 28; recommendation string
updated to match.

knowledge/hook-events-reference.md count stays for the Batch 3 knowledge
refresh. Tests: hermetic runtime temp-fixture; 15/15 HKV green.

Ref: docs/cc-2.1.x-gap-matrix.md

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

scanners/hook-validator.mjs

@@ -27,6 +27,8 @@ const VALID_EVENTS = new Set([
   'PreCompact', 'PostCompact',
   'Elicitation', 'ElicitationResult',
   'SessionEnd',
+  // CC 2.1.152 (MessageDisplay), 2.1.169 (post-session, kebab — distinct from SessionEnd)
+  'MessageDisplay', 'post-session',
 ]);
 
 /** Valid hook handler types */
@@ -134,7 +136,7 @@ async function validateHooksObject(hooks, file, findings, baseDir) {
         description: `${file.relPath}: "${event}" is not a valid hook event. This hook will never fire.`,
         file: file.absPath,
         evidence: event,
-        recommendation: `Valid events: ${[...VALID_EVENTS].slice(0, 8).join(', ')}... (26 total)`,
+        recommendation: `Valid events: ${[...VALID_EVENTS].slice(0, 8).join(', ')}... (28 total)`,
         autoFixable: false,
       }));
       continue;

tests/scanners/hook-validator.test.mjs

@@ -1,7 +1,9 @@
-import { describe, it, beforeEach } from 'node:test';
+import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { resolve } from 'node:path';
+import { resolve, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
 import { resetCounter } from '../../scanners/lib/output.mjs';
 import { discoverConfigFiles } from '../../scanners/lib/file-discovery.mjs';
 import { scan } from '../../scanners/hook-validator.mjs';
@@ -99,6 +101,53 @@ describe('HKV scanner — verbose hook output (v5 M5)', () => {
   });
 });
 
+describe('HKV scanner — CC 2.1.152/2.1.169 hook events (Batch 1 false-positive fix)', () => {
+  // The pre-write path-guard blocks committing settings.json/hooks.json, so
+  // this suite materializes a hermetic temp fixture at runtime.
+  let tmpRoot;
+  let result;
+
+  const NEW_EVENTS = ['MessageDisplay', 'post-session'];
+
+  beforeEach(async () => {
+    resetCounter();
+    tmpRoot = await mkdtemp(join(tmpdir(), 'ca-hkv-events-'));
+    await mkdir(join(tmpRoot, '.claude'), { recursive: true });
+    const settings = {
+      hooks: {
+        // 'echo …' commands skip the script-existence check (extractScriptPath
+        // only resolves bash/node/sh), isolating the event-name validation.
+        MessageDisplay: [{ hooks: [{ type: 'command', command: 'echo display' }] }],
+        'post-session': [{ hooks: [{ type: 'command', command: 'echo bye' }] }],
+      },
+    };
+    await writeFile(
+      join(tmpRoot, '.claude', 'settings.json'),
+      JSON.stringify(settings, null, 2) + '\n',
+      'utf8',
+    );
+    const discovery = await discoverConfigFiles(tmpRoot);
+    result = await scan(tmpRoot, discovery);
+  });
+
+  afterEach(async () => {
+    if (tmpRoot) await rm(tmpRoot, { recursive: true, force: true });
+  });
+
+  for (const event of NEW_EVENTS) {
+    it(`does NOT flag "${event}" as an unknown hook event`, () => {
+      const unknown = result.findings.find(f =>
+        f.title === 'Unknown hook event' && f.evidence === event);
+      assert.equal(unknown, undefined, `${event} should be in VALID_EVENTS`);
+    });
+  }
+
+  it('produces zero findings for a valid MessageDisplay + post-session config', () => {
+    assert.equal(result.findings.length, 0,
+      `expected clean scan; got: ${result.findings.map(f => `${f.title}:${f.evidence || ''}`).join(' | ')}`);
+  });
+});
+
 describe('HKV scanner — empty project', () => {
   let result;
   beforeEach(async () => {