HookLint 0.1.2

HookLint is a read-only, zero-dependency linter for Codex and Claude Code hook configuration. It detects configuration that is invalid, silently ignored, skipped by one harness, sensitive to the launch directory, or declared more than once. It reads repository-local settings, Codex hook configuration, plugin hook manifests, and hook entries referenced by plugin manifests without executing commands, prompts, scripts, MCP tools, HTTP handlers, or hook URLs. Reports omit handler bodies, commands, prompts, URLs, headers, environment values, and absolute target paths. HookLint makes no network requests and writes only an explicitly requested private mode-0600 report file.

Tags security software-development static-analysis javascript nodejs cli developers artificial-intelligence claude-code codex hooks
License MITL
State stable

Homepage Download

Recent Releases

0.1.224 Jul 2026 20:57 security: Version 0.1.2 adds bounded strict-UTF-8 no-follow reads, repository-containment and opened-handle validation, bounded and sanitized reports without absolute target paths, and scanning of every inline manifest hook entry. It also preserves private exclusive-create mode-0600 report files, writes complete reports before --check returns status 1, and rejects symlinks, non-regular files, oversized configuration, and structural limits instead of presenting partial coverage as complete.