Hooks & safety
Every lifecycle event in Claude Code and Codex calls one frozen command. All logic lives behind it in a small, stdlib-only Python package.
Updated
One entry point
Both agents run python3 bin/honey hook --agent claude (or codex) on each event. The command strings are frozen: Codex trusts each hook entry by hash, so keeping them fixed means updates don't silently invalidate your trust. The package is Python 3.9-compatible and uses only the standard library.
What runs, and when
| Event | What honey does |
|---|---|
| Session start | Injects the always-on rules, your mode, the indicator and the learned brief (≤1.5 KB). |
| Prompt submit | Handles modes, remember: rules and task scope; records bounded, redacted signals for RSI. |
| Before a tool call | The guard inspects shell commands for catastrophic or risky operations. |
| After a tool call | The secret scan checks newly written text for keys and tokens. |
| Stop | The receipt gate asks for the Checks run line after a turn that edited files. |
| Session end | Starts reflection in the background when the session had signal. |
The guard
The guard tokenizes shell commands — respecting quotes and operators — and inspects the real command and arguments. Dangerous words used as data pass, while real destructive commands are caught, including ones hidden behind bash -lc, git global options or pipes like xargs rm -rf.
Recoverable-but-risky commands (git history, cloud resources) are asked about; catastrophic ones are denied. Under bypass permissions, or on Codex, every hit is a deny. The guard stays on even when you say honey off.
Secret scan
After writes, only the new text is scanned — so old fixtures don't re-fire forever. It looks for Anthropic and OpenAI keys, private keys, AWS access keys, GitHub, Slack and Stripe live tokens, and hard-coded secrets.
Receipt gate
After a turn that edited files, the stop hook asks once for the receipt line — Checks run: … Skipped: … Risk: …. Question and answer turns are never nagged, and honest “not yet verified” reports are allowed.