Crashes started appearing once this tool was added

[ahundt]

Great tool! useful status info, however it appears to be some crashes since I installed this on macos, here is the trace, it particularly happened when multiple parallel subtasks were running so I'm guessing it is a threading issue that could be resolved with simple mutex or file locks immediately, and could be done in a more advanced way with a better multi-process locking system to ensure different components don't run simultaneously (though it could also be another kind of bug):

``
TypeError: Cannot read properties of undefined (reading 'message')
at file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:2475:798
at Array.filter ()
at Object.renderToolUseProgressMessage (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:2475:763)
at Object.renderToolUseRejectedMessage (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:2475:2309)
at F_B (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:2417:2561)
at RM (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:65:19859)
at Tv (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:67:42847)
at Rv (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:67:38368)
at YS (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:67:38296)
at lM (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:67:38150)

ERROR Cannot read properties of undefined (reading 'message')

file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:2475:798

• (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:2475:798)

• at Array.filter (<anonymous>)
  

-Object.renderToolUseProgressMessage
(file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:2475:763)

-Object.renderToolUseRejectedMessage (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:2475:230
9)

• F_B (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:2417:2561)
• RM (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:65:19859)
• Tv (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:67:42847)
• Rv (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:67:38368)
• YS (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:67:38296)
• lM (file:///opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/cli.js:67:38150)

[coygeek]

This is an excellent bug report with a clear stack trace and a helpful hypothesis. The issue likely stems from a race condition within the claude-code tool itself when handling concurrent hook executions, especially when tools are rejected. While we can't patch claude-code directly, we can make your hook scripts more robust to prevent triggering this behavior.

The solution involves two key improvements you suggested:

1. Introduce file locking: To prevent race conditions when multiple hooks write to the same log file simultaneously.
2. Use a more robust IPC mechanism: Switch from using stderr and exit codes to structured JSON output for blocking tools, which is less likely to cause parsing issues in claude-code under high load.

Here are the changes to apply across your hook scripts. I will modify the hooks in both the root .claude directory and the apps/demo-cc-agent/.claude directory for consistency.

1. pre_tool_use.py

This script will be updated to use file locking for logging and JSON output for blocking dangerous commands.

File: .claude/hooks/pre_tool_use.py and apps/demo-cc-agent/.claude/hooks/pre_tool_use.py

#!/usr/bin/env -S uv run --script
# /// script
# requires-python = ">=3.8"
# dependencies = [
#     "filelock",
# ]
# ///

import json
import sys
import re
from pathlib import Path
from utils.constants import ensure_session_log_dir
from filelock import FileLock, Timeout

def is_dangerous_rm_command(command):
    """
    Comprehensive detection of dangerous rm commands.
    Matches various forms of rm -rf and similar destructive patterns.
    """
    # Normalize command by removing extra spaces and converting to lowercase
    normalized = ' '.join(command.lower().split())
    
    # Pattern 1: Standard rm -rf variations
    patterns = [
        r'\brm\s+.*-[a-z]*r[a-z]*f',  # rm -rf, rm -fr, rm -Rf, etc.
        r'\brm\s+.*-[a-z]*f[a-z]*r',  # rm -fr variations
        r'\brm\s+--recursive\s+--force',  # rm --recursive --force
        r'\brm\s+--force\s+--recursive',  # rm --force --recursive
        r'\brm\s+-r\s+.*-f',  # rm -r ... -f
        r'\brm\s+-f\s+.*-r',  # rm -f ... -r
    ]
    
    # Check for dangerous patterns
    for pattern in patterns:
        if re.search(pattern, normalized):
            return True
    
    # Pattern 2: Check for rm with recursive flag targeting dangerous paths
    dangerous_paths = [
        r'/',           # Root directory
        r'/\*',         # Root with wildcard
        r'~',           # Home directory
        r'~/',          # Home directory path
        r'\$HOME',      # Home environment variable
        r'\.\.',        # Parent directory references
        r'\*',          # Wildcards in general rm -rf context
        r'\.',          # Current directory
        r'\.\s*$',      # Current directory at end of command
    ]
    
    if re.search(r'\brm\s+.*-[a-z]*r', normalized):  # If rm has recursive flag
        for path in dangerous_paths:
            if re.search(path, normalized):
                return True
    
    return False

def is_env_file_access(tool_name, tool_input):
    """
    Check if any tool is trying to access .env files containing sensitive data.
    """
    if tool_name in ['Read', 'Edit', 'MultiEdit', 'Write', 'Bash']:
        # Check file paths for file-based tools
        if tool_name in ['Read', 'Edit', 'MultiEdit', 'Write']:
            file_path = tool_input.get('file_path', '')
            if '.env' in file_path and not file_path.endswith('.env.sample'):
                return True
        
        # Check bash commands for .env file access
        elif tool_name == 'Bash':
            command = tool_input.get('command', '')
            # Pattern to detect .env file access (but allow .env.sample)
            env_patterns = [
                r'\b\.env\b(?!\.sample)',  # .env but not .env.sample
                r'cat\s+.*\.env\b(?!\.sample)',  # cat .env
                r'echo\s+.*>\s*\.env\b(?!\.sample)',  # echo > .env
                r'touch\s+.*\.env\b(?!\.sample)',  # touch .env
                r'cp\s+.*\.env\b(?!\.sample)',  # cp .env
                r'mv\s+.*\.env\b(?!\.sample)',  # mv .env
            ]
            
            for pattern in env_patterns:
                if re.search(pattern, command):
                    return True
    
    return False

def main():
    try:
        # Read JSON input from stdin
        input_data = json.load(sys.stdin)
        
        tool_name = input_data.get('tool_name', '')
        tool_input = input_data.get('tool_input', {})
        
        # Check for .env file access (blocks access to sensitive environment files)
        if is_env_file_access(tool_name, tool_input):
            print(json.dumps({
                "decision": "block",
                "reason": "BLOCKED: Access to .env files is prohibited. Use .env.sample for templates."
            }))
            sys.exit(0)  # Exit 0 for JSON output
        
        # Check for dangerous rm -rf commands
        if tool_name == 'Bash':
            command = tool_input.get('command', '')
            
            # Block rm -rf commands with comprehensive pattern matching
            if is_dangerous_rm_command(command):
                print(json.dumps({
                    "decision": "block",
                    "reason": "BLOCKED: Dangerous rm command detected and prevented."
                }))
                sys.exit(0)  # Exit 0 for JSON output
        
        # Extract session_id
        session_id = input_data.get('session_id', 'unknown')
        
        # Atomically append to log file
        log_dir = ensure_session_log_dir(session_id)
        log_path = log_dir / 'pre_tool_use.json'
        lock_path = log_path.with_suffix('.lock')
        lock = FileLock(lock_path, timeout=5)

        try:
            with lock:
                log_data = []
                if log_path.exists() and log_path.stat().st_size > 0:
                    try:
                        with open(log_path, 'r') as f:
                            log_data = json.load(f)
                    except (json.JSONDecodeError, ValueError):
                        log_data = [] # Reset if corrupt
                
                log_data.append(input_data)
                
                with open(log_path, 'w') as f:
                    json.dump(log_data, f, indent=2)
        except Timeout:
            print(f"Warning: Could not acquire lock for {log_path}", file=sys.stderr)
            pass # Fail silently to not block Claude

        sys.exit(0)
        
    except json.JSONDecodeError:
        # Gracefully handle JSON decode errors
        sys.exit(0)
    except Exception:
        # Handle any other errors gracefully
        sys.exit(0)

if __name__ == '__main__':
    main()

2. user_prompt_submit.py

This script is updated to use file locking and to use JSON output for validation blocking.

File: .claude/hooks/user_prompt_submit.py and apps/demo-cc-agent/.claude/hooks/user_prompt_submit.py

#!/usr/bin/env -S uv run --script
# /// script
# requires-python = ">=3.11"
# dependencies = [
#     "python-dotenv",
#     "filelock",
# ]
# ///

import argparse
import json
import os
import sys
from pathlib import Path
from datetime import datetime
from utils.constants import ensure_session_log_dir
from filelock import FileLock, Timeout

try:
    from dotenv import load_dotenv
    load_dotenv()
except ImportError:
    pass  # dotenv is optional


def log_user_prompt(session_id, input_data):
    """Log user prompt to session directory."""
    # Ensure session log directory exists
    log_dir = ensure_session_log_dir(session_id)
    log_file = log_dir / 'user_prompt_submit.json'
    lock_path = log_file.with_suffix('.lock')
    lock = FileLock(lock_path, timeout=5)

    try:
        with lock:
            log_data = []
            if log_file.exists() and log_file.stat().st_size > 0:
                try:
                    with open(log_file, 'r') as f:
                        log_data = json.load(f)
                except (json.JSONDecodeError, ValueError):
                    log_data = []
            
            # Append the entire input data
            log_data.append(input_data)
            
            # Write back to file with formatting
            with open(log_file, 'w') as f:
                json.dump(log_data, f, indent=2)
    except Timeout:
        print(f"Warning: Could not acquire lock for {log_file}", file=sys.stderr)
        pass


def validate_prompt(prompt):
    """
    Validate the user prompt for security or policy violations.
    Returns tuple (is_valid, reason).
    """
    # Example validation rules (customize as needed)
    blocked_patterns = [
        # Add any patterns you want to block
        # Example: ('rm -rf /', 'Dangerous command detected'),
    ]
    
    prompt_lower = prompt.lower()
    
    for pattern, reason in blocked_patterns:
        if pattern.lower() in prompt_lower:
            return False, reason
    
    return True, None


def main():
    try:
        # Parse command line arguments
        parser = argparse.ArgumentParser()
        parser.add_argument('--validate', action='store_true', 
                          help='Enable prompt validation')
        parser.add_argument('--log-only', action='store_true',
                          help='Only log prompts, no validation or blocking')
        args = parser.parse_args()
        
        # Read JSON input from stdin
        input_data = json.loads(sys.stdin.read())
        
        # Extract session_id and prompt
        session_id = input_data.get('session_id', 'unknown')
        prompt = input_data.get('prompt', '')
        
        # Log the user prompt
        log_user_prompt(session_id, input_data)
        
        # Validate prompt if requested and not in log-only mode
        if args.validate and not args.log_only:
            is_valid, reason = validate_prompt(prompt)
            if not is_valid:
                # Use JSON output to block the prompt
                print(json.dumps({
                    "decision": "block",
                    "reason": f"Prompt blocked: {reason}"
                }))
                sys.exit(0)
        
        # Add context information (optional)
        # You can print additional context that will be added to the prompt
        # Example: print(f"Current time: {datetime.now()}")
        
        # Success - prompt will be processed
        sys.exit(0)
        
    except json.JSONDecodeError:
        # Handle JSON decode errors gracefully
        sys.exit(0)
    except Exception:
        # Handle any other errors gracefully
        sys.exit(0)


if __name__ == '__main__':
    main()

3. Update Remaining Hook Scripts for File Locking

The following scripts also write logs and should be updated to use file locks to prevent data corruption from concurrent writes.

Files to update:

• .claude/hooks/notification.py & apps/demo-cc-agent/.claude/hooks/notification.py
• .claude/hooks/post_tool_use.py & apps/demo-cc-agent/.claude/hooks/post_tool_use.py
• .claude/hooks/stop.py & apps/demo-cc-agent/.claude/hooks/stop.py
• .claude/hooks/subagent_stop.py & apps/demo-cc-agent/.claude/hooks/subagent_stop.py

For each of these files, apply the following two changes:

1. Add filelock dependency to the header:

   # /// script
   # requires-python = ">=3.11" # or >=3.8
   # dependencies = [
   #     "python-dotenv",
   #     "filelock", # Add this line
   # ]
   # ///

2. Replace the logging logic with the new file-locking version. For example, in post_tool_use.py:

   • Add from filelock import FileLock, Timeout to the imports.
   • Replace the block that reads/writes the log file with this:

     # Atomically append to log file
     log_dir = ensure_session_log_dir(session_id)
     log_path = log_dir / 'post_tool_use.json' # Change the filename for each script
     lock_path = log_path.with_suffix('.lock')
     lock = FileLock(lock_path, timeout=5)
     
     try:
         with lock:
             log_data = []
             if log_path.exists() and log_path.stat().st_size > 0:
                 try:
                     with open(log_path, 'r') as f:
                         log_data = json.load(f)
                 except (json.JSONDecodeError, ValueError):
                     log_data = []
             
             log_data.append(input_data)
             
             with open(log_path, 'w') as f:
                 json.dump(log_data, f, indent=2)
     except Timeout:
         print(f"Warning: Could not acquire lock for {log_path}", file=sys.stderr)
         pass

   Remember to change post_tool_use.json to the correct log filename in each script (notification.json, stop.json, etc.).

These changes fortify your hooks against concurrency issues and use a more stable method for communicating with the claude-code CLI. This should resolve the crashes you've been seeing.

[Kirchlive]

For me, it blocked the entire installation process. I had to completely disable the hooks in the settings.json to get the tool to work.