Five hooks I never wrote ran in every Claude Code session

Описание и применение

Автор обнаружил, что хуки из всех уровней настроек объединяются, а не заменяют друг друга, и что пользовательские плагины могут запускать свои хуки до первого запроса, влияя на контекст сессии.

Задача

Hook entries merge across settings levels instead of replacing each other, so a session runs the union of your settings, the repo's, your plugins' and your administrator's.

Результат

The experiment confirmed that hooks from all settings levels merge, not override, and that user-installed plugin hooks can run before any user prompt, affecting session context and behavior.

Рабочий процесс

• 1. Create a throwaway git repo with .claude/settings.json declaring four hooks.
• 2. Run Claude Code 2.1.317 headless four times, logging each hook invocation to a file.
• 3. Observe that nine hooks fired: the four declared in the repo and five from user-installed plugins.
• 4. Note that the plugin hooks ran before the first user prompt in every session.
• 5. Recognize that the repository does not describe the full set of hooks that will run.
• 6. Understand that hooks merge across settings levels and that the union is shown only in the read‑only /hooks browser.
• 7. Identify the gap that read‑only /hooks cannot disable individual hooks; only blanket switches or managed settings can control them.
• 8. Recommend logging every hook invocation, running /hooks after installing a plugin, reading .claude/ before scripting, and using permissions for hard boundaries.

Доказательства

Hook entries merge across settings levels instead of replacing each other, so a session runs the union of your settings, the repo's, your plugins' and your administrator's.

Источник

The log also showed five hooks I had not written, firing before my first prompt in every single run.

Источник

Hook entries merge across settings levels rather than replacing each other: user, project, and local settings add their own hooks without removing managed ones.

Источник