SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Developer Builds Stop Hook to Skip Audit Nags During Unattended Claude Code Sessions

0
·2 views

A developer using Claude Code's autonomous setup discovered that audit notification hooks designed for interactive sessions were also firing during unattended automated runs, generating 19 stacked error logs overnight on July 12, 2026. The Stop hook — a shell script that checks whether Claude performed a self-audit after modifying files — was blocking CLI runs launched via launchd with an exit 2 error, degrading pipeline execution. The root cause was that Claude Code uses a single Stop hook primitive for both human-facing and machine-facing sessions, with no built-in distinction between the two contexts. The developer identified that the session transcript file contains an 'entrypoint' field — 'cli' for interactive use and 'sdk-cli' for Agent SDK runs — which the hook itself can read to determine whether a human is present. By parsing this field from the transcript at runtime, the hook can silently skip audit nags during unattended automation while still enforcing them in interactive sessions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Client-Side Validation Improves UX But Cannot Replace Server-Side Security

Client-side validation in browsers enhances user experience by providing instant feedback, but it cannot be considered a security control since users can bypass it using tools like curl, Postman, or browser developer tools. Every piece of incoming data — including form fields, cookies, headers, and API payloads — must be independently validated on the server, which should treat all client input as untrusted by default. Developers are advised to use strict allow-list validation where possible, as it is more reliable than attempting to sanitize arbitrary input after the fact. Server-side validation also works alongside other security measures such as parameterized queries, output encoding, authentication, and rate limiting, none of which can be replaced by it alone. The core principle is straightforward: client-side validation protects usability, while server-side validation protects the application.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Chrome DevTools Protocol sessions share active tab, causing automation jobs to read wrong pages

A developer discovered that multiple scheduled automation jobs sharing a single Chrome instance via the DevTools Protocol can silently read each other's pages without any errors or exceptions. The root cause is that named client sessions do not correspond to specific browser tabs — instead, every read targets whichever tab is currently active in the browser. When two jobs overlap, the last one to navigate claims the active tab for all sessions, causing other jobs to receive valid but incorrect page data. Two fixes exist: each job must explicitly re-assert its target tab before every command, or jobs must acquire an exclusive lock on the debugging port to prevent concurrent browser access. Both approaches have trade-offs, as the re-assertion method requires discipline across every command, while serialisation introduces idle wait time and lock-recovery complexity.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Fort Card lets developers issue scoped, capped API credentials instead of raw keys

Fort Card is an open-source tool that applies a credit-card-like model to API key management, addressing the security risk of sharing unrestricted API keys with AI agents. Instead of exposing a master key, the system stores it inside a Cloudflare Worker called a lockbox, which is the only component that ever handles the plaintext credential. Agents receive a 'card' that is restricted to a specific host, limited to a set number of uses, and can be frozen instantly if needed. When an agent makes a request, the lockbox injects the real key server-side and returns only the response, so the agent never sees the underlying credential. The project is released under the MIT license and can be self-hosted via GitHub, with an optional hosted version available at $8 per month.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

SQL Query Across 2.9M Charity Pairs Exposes Limits of Spelling-Based Name Matching

Researchers at tamiz.pro ran a vector similarity analysis across 2,889,151 pairwise combinations drawn from a registry of roughly 1,700 charitable organizations to compare spelling-based and meaning-based matching methods. Traditional fuzzy matching tools like Levenshtein distance and Jaro-Winkler scoring measure character-level differences between strings, but fail to detect when two differently spelled names refer to the same entity. By contrast, sentence-transformer embeddings — specifically the all-MiniLM-L6-v2 model — placed semantically related charity names in the same region of vector space regardless of how different they looked in text. For example, 'Doctors Without Borders' and 'Médecins Sans Frontières' scored low on lexical similarity yet ranked as near-identical in semantic space. The experiment highlights a fundamental gap between edit-distance algorithms and embedding-based approaches when matching real-world organization names across languages and jurisdictions.

0 comments Read more at DEV Community