Five hooks I never wrote ran in every Claude Code session

说明与用途

作者发现所有设置层级的钩子会合并而不是覆盖，且用户安装的插件钩子可能在首次提示前运行，影响会话上下文。

问题

Hook entries merge across settings levels instead of replacing each other, so a session runs the union of your settings, the repo's, your plugins' and your administrator's.

结果

The experiment confirmed that hooks from all settings levels merge, not override, and that user-installed plugin hooks can run before any user prompt, affecting session context and behavior.

工作流

• 1. Create a throwaway git repo with .claude/settings.json declaring four hooks.
• 2. Run Claude Code 2.1.317 headless four times, logging each hook invocation to a file.
• 3. Observe that nine hooks fired: the four declared in the repo and five from user-installed plugins.
• 4. Note that the plugin hooks ran before the first user prompt in every session.
• 5. Recognize that the repository does not describe the full set of hooks that will run.
• 6. Understand that hooks merge across settings levels and that the union is shown only in the read‑only /hooks browser.
• 7. Identify the gap that read‑only /hooks cannot disable individual hooks; only blanket switches or managed settings can control them.
• 8. Recommend logging every hook invocation, running /hooks after installing a plugin, reading .claude/ before scripting, and using permissions for hard boundaries.

证据

Hook entries merge across settings levels instead of replacing each other, so a session runs the union of your settings, the repo's, your plugins' and your administrator's.

来源

The log also showed five hooks I had not written, firing before my first prompt in every single run.

来源

Hook entries merge across settings levels rather than replacing each other: user, project, and local settings add their own hooks without removing managed ones.

来源