Verify-after-edit hooks

Signalint 1.2.1 provides hook event adapters for runtime IDs claude, cursor, codex, and vscode. The launcher parses a host event, checks relevant paths, and emits runtime-shaped decision JSON. These are source-verified emitters, not proof that every installed host recognizes the generated configuration. Confirm your host’s current hook API and active config path.

Preview first

Use the locally installed package’s signalint binary, not an unrelated package named signalint:

npx --no-install signalint hooks preview --runtime claude
npx --no-install signalint hooks preview --runtime cursor

The following project-relative targets are generated:

Runtime ID	Emitted target	Post-edit / stop event names
claude	.claude/config.json	PostToolUse / Stop
cursor	.cursor/hooks.json	afterFileEdit / stop
codex	.codex/hooks.json	PostToolUse / Stop
vscode	.vscode/hooks.json	postToolUse / stop

Preview writes nothing. Back up existing configuration and inspect the generated command before installing:

npx --no-install signalint hooks install --runtime claude --confirm

TTY installation requires confirmation. Non-TTY installation does not require --confirm in this implementation; do not treat the flag as an enforced permission gate in automation.

Merge behavior varies: Cursor and VS Code replace the targeted hook entries while retaining unrelated keys. Claude and Codex use their adapter-specific merge shapes. An existing hook on the same event can be replaced; “merge” does not mean all existing commands are preserved. Malformed config can yield a fresh preview template while actual installation refuses it.

Run a captured event

cat event.json | npx --no-install signalint hooks run --runtime claude

Or pass an event explicitly:

npx --no-install signalint hooks run --runtime claude --payload '{"hook_event_name":"PostToolUse","tool_input":{"file_path":"src/main.ts"}}'

Only JavaScript/TypeScript variants and JSON/JSONC files are relevant to the hook path filter. README, lockfiles and other extensions are skipped. Unsafe paths are refused by the hook path normalization layer.

The launcher communicates the decision through JSON, normally returning exit code 0. Do not use its process exit code as a lint-success or merge gate. The host must understand and honor the emitted response.

Post-edit versus stop

• Post-edit: Calls checkFilesWithStats with its default engine selection, not the configured file-check wrapper. It does not consistently honor signalint.config.json engine/ignore/timeout settings. With no relevant files it reports a clean approval without running an engine.
• Stop: Uses the configured project checker. Default stop blocking threshold is priority 1; --fail-on-priority N can change the policy threshold.
• Post-edit is advisory by default. A host owns follow-up, permissions and stop/retry behavior; Signalint does not start a second autonomous repair loop.

Important 1.2.1 policy limits

The current threshold implementation examines only returned flat remaining records, not grouped clusters. A set of priority-1 grouped errors can therefore produce status: issues_found with an approve action. Likewise, a stop check with all engines disabled can be approved as clean.

Engine errors can produce an error decision, but this does not eliminate those coverage gaps. Codex and VS Code stop formatters can request continuation/retry for a non-clean status even when the shared policy action is approve; runtime behavior is not uniform.

Use the explicit CLI check and inspect status/engine coverage for required validation. Do not rely on hooks alone to certify a clean project. See CLI exit behavior and known limitations.

Source: src/hooks/.