From 1abb3a2d3206e3f772cf25d39f1f60abe3af0ac5 Mon Sep 17 00:00:00 2001 From: Julian lechner Date: Fri, 11 Sep 2026 15:44:09 +0200 Subject: [PATCH] docs(hooks): clarify which hook scripts are actually registered Only the Stop hook (flashbang) is wired into the generated client configuration. Validate-CommandSafety and Invoke-PostChangeVerification are utility scripts nothing here invokes automatically; the previous wording could be read as implying otherwise. Co-Authored-By: Claude Sonnet 5 --- shared/hooks/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/shared/hooks/README.md b/shared/hooks/README.md index 0c8bc4f..9babcd9 100644 --- a/shared/hooks/README.md +++ b/shared/hooks/README.md @@ -1,3 +1,5 @@ # Hooks Hooks are conservative entry points shared by clients. They validate obvious command hazards, check repository-local configuration inputs, and provide an optional post-change verification command. They do not bypass client permission prompts or grant access. + +Only the `Stop` hook (`flashbang`) is registered in the generated client configuration. `Validate-CommandSafety`/`validate-command-safety.sh` and `Invoke-PostChangeVerification`/`invoke-post-change-verification.sh` are utility scripts, not active hooks; nothing in this repository invokes them automatically. Wire one up as a client-native `PreToolUse`/equivalent hook yourself if you want it enforced, and do not assume it runs otherwise.