@fyeeme/pi-hooks 1.0.4 → 1.0.5

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [1.0.5] - 2026-09-16
+
+### Fixed
+
+- A bare exit code 2 with no parseable JSON on stdout is no longer treated as a deny: it is logged as a suspected broken hook command and the tool call proceeds. A crash or misconfiguration (e.g. `python3` exiting 2 for "can't open file") previously hard-blocked every tool call for the rest of the session. Structured JSON denies (`permissionDecision: "deny"`, or exit 2 carrying a deny payload) are unchanged.
+
 ## [1.0.4] - 2026-09-12
 
 ### Added

package/README.md

@@ -136,7 +136,8 @@ Commands may return JSON on stdout, or control flow via exit codes:
 ```
 
 - exit code **0** with `additionalContext` → context injected.
-- exit code **2** (PreToolUse) → tool call blocked (`terminate: true`); reason fed to the model. `terminate` skips the follow-up LLM call only when the denied call is in an all-terminating batch (pi >= 0.84.1, #7715); in a multi-tool batch the block always applies but the agent may continue.
+- exit code **2** (PreToolUse) **with a JSON deny payload** (`permissionDecision: "deny"`) → tool call blocked (`terminate: true`); reason fed to the model. `terminate` skips the follow-up LLM call only when the denied call is in an all-terminating batch (pi >= 0.84.1, #7715); in a multi-tool batch the block always applies but the agent may continue.
+- exit code **2** without parseable JSON (e.g. a broken command like `python3` failing to open a script) → treated as a crash, not a deny: warning on stderr, tool call proceeds. This keeps a misconfigured hook from hard-blocking every tool call.
 - exit code **2** (Stop) → ignored (pi cannot block exit).
 - other non-zero → logged, execution continues.
 - non-JSON stdout → logged as a warning, ignored.

package/index.ts

@@ -284,6 +284,18 @@ export function parseHookOutput(command: string, stdout: string, exitCode: numbe
 		}
 	}
 
+	// A bare exit code 2 with no parseable stdout is indistinguishable from a
+	// broken hook command (e.g. `python3` exits 2 for "can't open file"), and
+	// taking it as a deny hard-blocks EVERY tool call for the rest of the
+	// session. Treat the unstructured case as a suspected crash instead: warn
+	// and allow. A structured JSON deny still blocks, whatever the exit code.
+	if (exitCode === 2 && output === null) {
+		console.error(
+			`[hooks] exit 2 without a JSON deny payload from ${command} — likely a broken command, not a deny; allowing the call`,
+		);
+		return { context: null, block: null };
+	}
+
 	const context = output?.hookSpecificOutput?.additionalContext ?? null;
 	const deny = exitCode === 2 || output?.hookSpecificOutput?.permissionDecision === "deny";
 	const reason =

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fyeeme/pi-hooks",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Claude Code-compatible hooks runner for pi. Reads hooks config (priority: ~/.pi/agent/hooks.json, then project .pi/hooks.json) and maps SessionStart, PreToolUse, and Stop events to pi lifecycle events.",
   "type": "module",
   "license": "MIT",