19 Audit Nags in One Night: Making a Claude Code Stop Hook Detect Unattended Sessions

说明与用途

通过在 Stop 钩子中检查 entrypoint 并限制触发次数，消除了 Claude Code 自动化运行中的不必要审核提示，保留了对人工用户的提醒。

问题

Claude Code’s Stop hook nagged unattended automated runs, producing log noise and blocking CLI pipelines.

结果

Audit nags stopped appearing in unattended runs, pipeline executed cleanly, and human‑facing alerts remained limited to at most two per session.

工作流

• Register Stop hook in ~/.claude/settings.json
• Create PostToolUse hook to set flag when a file‑modifying tool runs
• In Stop hook, if flag absent, exit 0
• If flag present, read first 15 lines of transcript to check entrypoint
• If entrypoint is "sdk-cli", delete flag and exit 0 (unattended session)
• Otherwise, check prompted counter file; if ≥2, delete flag and exit 0 (cap reached)
• If counter <2, check for audit marker in assistant text; if present, exit 0
• If marker absent, increment counter, delete flag, exit 2 to block and notify

证据

The hook itself decides whether a human or launchd opened this session.

来源

On the morning of 2026-07-12, I opened the logs and found 19 audit nags stacked up overnight.

来源