open/config-audit
1
0
Fork 0
Code Issues Releases 1 Activity

fix(hkv,rul): add 3 verified hook events; correct globs-rule wording

Browse source 
HKV: add Setup, UserPromptExpansion, PostToolBatch to VALID_EVENTS,
verified live against code.claude.com/docs/en/hooks.md (2026-06-19). A
valid hook using one of these was wrongly flagged "will never fire" — a
user could delete a working hook. Made the "(N total)" hint dynamic so
it can't drift again. Flagged the unverified kebab 'post-session' in a
comment (an existing test depends on it; follow-up check needed).

RUL: reword the globs finding. Only `paths:` is documented; whether CC
ever read `globs` is unverified, so the old "deprecated/legacy" framing
overclaimed (Verifiseringsplikt). New wording steers to the documented
`paths:` field. Updated the coupled fix-engine title match and the
humanizer entry (which also carried the "field was renamed" overclaim).

Suite 950 -> 954 (badge bumped). self-audit A/A, scanner count 13. No
version bump — these land in the pending v5.4.1 patch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
This commit is contained in:
Kjell Tore Guttormsen 2026-06-20 09:56:00 +02:00
commit b6a62d7699
7 changed files with 84 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scanners/hook-validator.mjs
View file

@ -13,11 +13,12 @@ import { resolve, dirname } from 'node:path';
const SCANNER = 'HKV';
/** All valid hook events (as of June 2026) */
/** All valid hook events — verified against code.claude.com/docs/en/hooks.md (2026-06-19) */
const VALID_EVENTS = new Set([
'SessionStart', 'InstructionsLoaded', 'UserPromptSubmit',
'SessionStart', 'Setup', 'InstructionsLoaded',
'UserPromptSubmit', 'UserPromptExpansion',
'PreToolUse', 'PermissionRequest', 'PermissionDenied',
'PostToolUse', 'PostToolUseFailure',
'PostToolUse', 'PostToolUseFailure', 'PostToolBatch',
'SubagentStart', 'SubagentStop',
'TaskCreated', 'TaskCompleted',
'Stop', 'StopFailure',
@ -26,9 +27,11 @@ const VALID_EVENTS = new Set([
'WorktreeCreate', 'WorktreeRemove',
'PreCompact', 'PostCompact',
'Elicitation', 'ElicitationResult',
'SessionEnd',
// CC 2.1.152 (MessageDisplay), 2.1.169 (post-session, kebab — distinct from SessionEnd)
'MessageDisplay', 'post-session',
'SessionEnd', 'MessageDisplay',
// NOTE: 'post-session' (kebab) is UNVERIFIED against current docs — kept
// pending confirmation (an existing test depends on it; hook events are
// otherwise PascalCase, so this is flagged for a follow-up check).
'post-session',
]);
/** Valid hook handler types */
@ -136,7 +139,7 @@ async function validateHooksObject(hooks, file, findings, baseDir) {
description: `${file.relPath}: "${event}" is not a valid hook event. This hook will never fire.`,
file: file.absPath,
evidence: event,
recommendation: `Valid events: ${[...VALID_EVENTS].slice(0, 8).join(', ')}... (28 total)`,
recommendation: `Valid events: ${[...VALID_EVENTS].slice(0, 8).join(', ')}... (${VALID_EVENTS.size} total)`,
autoFixable: false,
}));
continue;