fix(hooks): stop invalid-JSON PreToolUse/Stop hook errors (hotfix)

Three hooks emitted output that failed Claude Code's hook JSON validation
("Hook JSON output validation failed — (root): Invalid input"):

- subagent-stop-universal.sh: a stale `cat <<EOF` leaked the literal text
  ": # FIXED: bare JSON decision approve removed" to stdout. SubagentStop
  approves on a clean exit 0 with empty stdout, so the heredoc is removed.
- stop-slop-hook.sh: `trap 'echo {...}' ERR EXIT` plus early-return branches
  that exited without clearing the trap emitted `{"continue": true}` TWICE
  ("Extra data"). Rewritten so success = clean exit 0, advisories to stderr.
- action-report-tracker.sh: same trap double-emit in the missing-library
  early branch. Clear the trap before the early echo.

Adds scripts/validate-hooks-settings.py: validates every settings source is
parseable JSON, that each hook command resolves to an existing executable,
and that each hook (run with cwd in-repo AND out-of-repo) returns stdout that
is empty or valid hook JSON per tests/HOOK_FORMAT_REFERENCE.md.

Note: the related stale context-mode `latest/` path was a duplicate in the
global ~/.claude/settings.json (not versioned); removed separately.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: alfredolopez80

.claude/hooks/action-report-tracker.sh

@@ -20,7 +20,8 @@ trap 'echo "{\"continue\": true}"' ERR EXIT
 # Load report generator library
 REPORT_GENERATOR=".claude/lib/action-report-generator.sh"
 if [[ ! -f "$REPORT_GENERATOR" ]]; then
-    echo "{\"continue\": true}"
+    trap - ERR EXIT  # clear trap first so it does not emit a SECOND JSON object
+    echo '{"continue": true}'
     exit 0
 fi
 

.claude/hooks/stop-slop-hook.sh

@@ -1,61 +1,55 @@
-#!/bin/bash
-umask 077
 #!/usr/bin/env bash
+umask 077
 # Stop-Slop Hook - Detects AI writing patterns
-# VERSION: 1.0.2
-# Purpose: Detect filler phrases and AI writing patterns in prose
+# VERSION: 1.1.0
+# Purpose: Detect filler phrases / AI writing patterns in prose (advisory only).
 #
-# FIX v1.0.2: LOW-003 - Added consistent error handling with JSON output
-# FIX v1.0.1: HIGH-001 - Fixed ReDoS vulnerability using -F flag for fixed string matching
-
-set -euo pipefail
-
-# LOW-003 FIX: Error trap ensures valid JSON output on failure
-trap 'echo "{\"continue\": true}"' ERR EXIT
+# Output contract (see tests/HOOK_FORMAT_REFERENCE.md):
+#   - This hook never blocks. "Allow" == clean exit 0 with EMPTY stdout, which
+#     is valid for Stop AND PostToolUse/PreToolUse events.
+#   - Any advisory message goes to STDERR, never stdout (stdout must be JSON or
+#     empty, otherwise CC reports "(root): Invalid input").
+#
+# FIX v1.1.0: removed the `trap ... ERR EXIT` double-emit bug (early-return
+#   branches exited without clearing the EXIT trap, printing a 2nd JSON object →
+#   "Hook JSON output validation failed — (root): Invalid input"). Success is now
+#   a clean exit 0 with no stdout, so there is nothing to duplicate.
 
-readonly VERSION="1.0.0"
+set -uo pipefail
 
-# Read stdin
-INPUT=$(head -c 100000)
+# Read stdin (length-limited per SEC-111). Never fail the hook on read issues.
+INPUT=$(head -c 100000 || true)
 
-# Parse input
-FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null || true)
 
-if [[ -z "$FILE_PATH" ]] || [[ ! -f "$FILE_PATH" ]]; then
-    echo '{"continue": true}'
+# No file to inspect (e.g. Stop event, or non-file tool) → allow.
+if [[ -z "$FILE_PATH" || ! -f "$FILE_PATH" ]]; then
     exit 0
 fi
 
-# Check for common AI filler phrases
-if [[ -f "$FILE_PATH" ]]; then
-    FILLER_PHRASES=(
-        "Certainly!"
-        "It is important to note"
-        "It's worth noting"
-        "It's important to remember"
-        "Please note"
-        "Keep in mind"
-        "It should be noted"
-        "It's worth mentioning"
-    )
-
-    FINDINGS=0
-    for phrase in "${FILLER_PHRASES[@]}"; do
-        # HIGH-001 FIX: Use -F for fixed string matching (prevents ReDoS via regex injection)
-        if grep -qiF -- "$phrase" "$FILE_PATH"; then
-            FINDINGS=$((FINDINGS + 1))
-        fi
-    done
-
-    if [[ $FINDINGS -gt 0 ]]; then
-        echo "⚠️  Stop-Slop: Found $FINDINGS filler phrases"
-        # LOW-003 FIX: Clear trap before normal exit to prevent duplicate JSON
-        trap - ERR EXIT
-        echo '{"continue": true}'
-        exit 0
+FILLER_PHRASES=(
+    "Certainly!"
+    "It is important to note"
+    "It's worth noting"
+    "It's important to remember"
+    "Please note"
+    "Keep in mind"
+    "It should be noted"
+    "It's worth mentioning"
+)
+
+findings=0
+for phrase in "${FILLER_PHRASES[@]}"; do
+    # -F fixed-string match (prevents ReDoS via regex injection — HIGH-001)
+    if grep -qiF -- "$phrase" "$FILE_PATH" 2>/dev/null; then
+        findings=$((findings + 1))
     fi
+done
+
+if [[ "$findings" -gt 0 ]]; then
+    # Advisory only — to STDERR so stdout stays empty/valid.
+    echo "⚠️  Stop-Slop: found $findings filler phrase pattern(s) in $FILE_PATH" >&2
 fi
 
-# LOW-003 FIX: Clear trap and output success
-trap - ERR EXIT
-echo '{"continue": true}'
+# Allow: clean exit 0, empty stdout.
+exit 0

.claude/hooks/subagent-stop-universal.sh

@@ -116,7 +116,7 @@ fi
 # ============================================
 
 log "APPROVE: Subagent ${agent_id} (${agent_type}) can stop"
-cat <<EOF
-: # FIXED: bare JSON decision approve removed
-EOF
+# SubagentStop: a clean exit 0 with EMPTY stdout means "approve stop".
+# Emitting any non-JSON text (or {"decision":"approve"}) triggers
+# "Hook JSON output validation failed — (root): Invalid input".
 exit 0