managing-hooks

Hooks intercept and manage automated actions at lifecycle points like PreToolUse, PostToolUse, SessionStart, and SessionEnd. Create a hook by specifying the event type, a matcher pattern, and actions to execute—such as blocking tool calls, modifying inputs, or logging events—then validate the configuration against security requirements before deployment.

Claude Code supports nine event types: PreToolUse and PostToolUse for tool execution, SessionStart and SessionEnd for lifecycle, Stop and SubagentStop for agent control, UserPromptSubmit for prompts, Notification for alerts, and PreCompact for context management. Each event type enables governance at different workflow stages.

Debug hook activation by analyzing event timing, matcher patterns, and action execution flow. Use comprehensive logging and validation checks to confirm hooks trigger at the expected lifecycle points, verify matcher conditions are met, and trace exit-code semantics to identify why hooks may skip or fail silently.

Enforce input validation, standardized JSON outputs, and exit-code semantics. Apply security checklists to validate hook configurations, enforce policy governance across tool-based, lifecycle, agent, and context events, and audit hooks that merge configurations from user, project, and plugin sources to prevent unauthorized or malicious actions.

No. Each event type (PreToolUse, PostToolUse, SessionStart, SessionEnd, Stop, SubagentStop, UserPromptSubmit, Notification, PreCompact) requires its own hook configuration. You can merge configurations from user, project, and plugin sources, but matchers and actions must align with the specific event type's semantics and available parameters.

Analyze existing hooks for performance, reliability, and security gaps, then update patterns and actions to meet new requirements. Validate updated configurations against security and policy checklists, test across relevant event types, and redeploy to enforce the revised governance rules.