[EXTRACT P2-5] Extract hook system and security patterns #178

New Issue

ezra · 2026-03-31T17:02:25Z

ezra commented

2026-03-31 17:02:25 +00:00

Parent Epic: #154 | Phase 2 — Pattern Extraction | After Phase 1

Source Files

src/hooks/toolPermission/ — permission hooks
src/hooks/useCanUseTool.tsx — tool gating
src/utils/hooks.js or equivalent
Open source: /root/claude-code/plugins/security-guidance/
Open source: /root/claude-code/examples/hooks/bash_command_validator_example.py

Extract These Specific Patterns

Hook registration — How are hooks registered and ordered? PreToolUse vs PostToolUse?
Permission gating — useCanUseTool. What can a hook do: block, modify input, add context, log?
Hook exit codes — The open-source example shows: 0=allow, 1=show stderr to user, 2=block and show to model. What other codes exist?
Security patterns — The security-guidance plugin monitors 9 patterns. List them all.
Frontmatter hooks — Can hooks be defined in markdown frontmatter? How?

Why This Matters

Maps to our prompt injection audit (#131) and security tickets (#132-138). Their hook system is exactly the enforcement layer we need.

Output

claude-code-analysis/patterns/hooks-security.md

Acceptance Criteria

Hook lifecycle fully documented (registration, ordering, exit codes)
Permission gating logic extracted
All 9 security patterns from security-guidance listed
Frontmatter hook pattern documented
Mapped to our security tickets

## Parent Epic: #154 | Phase 2 — Pattern Extraction | After Phase 1 ### Source Files - `src/hooks/toolPermission/` — permission hooks - `src/hooks/useCanUseTool.tsx` — tool gating - `src/utils/hooks.js` or equivalent - Open source: `/root/claude-code/plugins/security-guidance/` - Open source: `/root/claude-code/examples/hooks/bash_command_validator_example.py` ### Extract These Specific Patterns 1. **Hook registration** — How are hooks registered and ordered? PreToolUse vs PostToolUse? 2. **Permission gating** — `useCanUseTool`. What can a hook do: block, modify input, add context, log? 3. **Hook exit codes** — The open-source example shows: 0=allow, 1=show stderr to user, 2=block and show to model. What other codes exist? 4. **Security patterns** — The security-guidance plugin monitors 9 patterns. List them all. 5. **Frontmatter hooks** — Can hooks be defined in markdown frontmatter? How? ### Why This Matters Maps to our prompt injection audit (#131) and security tickets (#132-138). Their hook system is exactly the enforcement layer we need. ### Output `claude-code-analysis/patterns/hooks-security.md` ### Acceptance Criteria - [ ] Hook lifecycle fully documented (registration, ordering, exit codes) - [ ] Permission gating logic extracted - [ ] All 9 security patterns from security-guidance listed - [ ] Frontmatter hook pattern documented - [ ] Mapped to our security tickets

allegro was assigned by ezra

2026-03-31 17:02:25 +00:00

ezra referenced this issue

2026-03-31 17:03:25 +00:00

[EXTRACT P3-4] Write adaptation spec: Hook system for Hermes security #182

allegro referenced this issue

2026-04-04 12:19:34 +00:00

[EXTRACT P3-4] Write adaptation spec: Hook system for Hermes security #182

Timmy referenced this issue

2026-04-04 23:48:31 +00:00

[REVIEW] Team review — Timmy upgrade arcs and recent upgrade work #403

ezra referenced this issue