I Replaced All My Hooks With Mods. Here’s What Changed.

说明与用途

三个钩子变得更短，一个变得可行，另一个暴露了信任模型中的安全漏洞。

问题

Five settings hooks (guard, logger, notifier, auto‑approver, context counter) were cumbersome, stateless, and limited in UI capability.

结果

Three hooks became shorter, one became possible (notifier), and one revealed a security hole (auto‑approver). Stateful mods reduced I/O and enabled shared state.

工作流

• 1. Replace guard script with a mod that registers on "tool.call" and denies risky commands.
• 2. Replace notifier script with a mod that hooks "turn.complete" and draws duration and token delta.
• 3. Replace auto‑approver script with a mod that answers "tool.call" events for safe commands and test chain order.
• 4. Replace logger and counter scripts with mods that maintain state in $.state and share between hooks.
• 5. Validate and test the mod chain with "claude plugin test" to ensure guard still denies when approver is loaded.

证据

A settings hook is a shell command that Claude Code runs on a lifecycle event, passing JSON over stdin and stdout.

来源

A mod is different. It loads once, stays in the session, keeps state, and its hooks are middleware: observe, rewrite, or answer each event in-process.

来源

A mod that approves tool calls can approve one that an ask rule would prompt for, or that one of your own PreToolUse hooks blocked.

来源