Skip to content

fix(fp-check): remove top-level Stop hook to stop firing on unrelated sessions (#143)#165

Open
remiforall wants to merge 1 commit into
trailofbits:mainfrom
remiforall:fix/fp-check-remove-stop-hook
Open

fix(fp-check): remove top-level Stop hook to stop firing on unrelated sessions (#143)#165
remiforall wants to merge 1 commit into
trailofbits:mainfrom
remiforall:fix/fp-check-remove-stop-hook

Conversation

@remiforall
Copy link
Copy Markdown

Summary

Closes #143.

The Stop hook in plugins/fp-check/hooks/hooks.json is registered with "matcher": "*", so it fires on every Claude Code session stop — including sessions that have nothing to do with fp-check verification. This burns a full 30-second LLM turn on every unrelated stop and pollutes the parent context with stop-feedback blocks.

The hook's own fallback rule ("If the conversation is not about fp-check verification at all, return 'approve'") does not prevent the issue: the hook still fires, the model still runs, the turn is still consumed — just to discover that it should no-op.

Fix

Removes the top-level Stop hook entirely (option 3 of three workarounds discussed in #143).

The companion SubagentStop hook stays. It is the right place to enforce structured-output completeness, because it only matches actual fp-check subagents (data-flow-analyzer, exploitability-verifier, poc-builder) and never fires on unrelated sessions. Verification rigor is preserved at the level where it is actionable.

Impact

  • Verification rigor: unchanged. SubagentStop continues to enforce phase-output completeness on every fp-check subagent.
  • Unrelated sessions: no longer pay the cost of a full LLM turn at every Stop.
  • Plugin version bumped from 1.0.0 to 1.0.1 (per repo CLAUDE.md guidance: substantive change to hook behavior).

Validation

$ python3 .github/scripts/validate_codex_skills.py
Validated 73 plugin skills against 74 Codex entries successfully.

CODEOWNERS unchanged (/plugins/fp-check/ @ahpaleus @dguido).

Test plan

… sessions

The Stop hook in plugins/fp-check/hooks/hooks.json was registered with
matcher "*", so it fired on every Claude Code session stop — including
sessions that had nothing to do with fp-check verification. This burned
a full 30-second LLM turn on every unrelated stop and polluted the
parent context with stop-feedback blocks.

The hook's own fallback rule ("if the conversation is not about
fp-check verification at all, return 'approve'") did not prevent the
issue: the hook still fired, the model still ran, the turn was still
consumed — just to discover that it should no-op.

The companion SubagentStop hook stays. It is the right place to enforce
structured-output completeness, because it only matches actual fp-check
subagents (data-flow-analyzer, exploitability-verifier, poc-builder)
and never fires on unrelated sessions. Verification rigor is preserved
at the level where it is actionable.

Closes trailofbits#143.
Copy link
Copy Markdown

@claude claude Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

@CLAassistant
Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fp-check Stop hook with matcher "*" fires on every unrelated session, causing forced LLM turns

2 participants