ReadonlyblockExit code a hook process uses to block/deny a tool call (Claude Code: 2).
Readonlydenydecision / permissionDecision values that mean "deny" the tool call.
ReadonlyeventEnv vars a synthesized hook event carries beyond the JSON on stdin (Claude Code passes the event on stdin only; Codex adds session_id/cwd/PLUGIN_ROOT/…).
Optional ReadonlymatcherHow a tool matcher is written in the emitted hooks block — "exact" (Claude
Code: the tool name / A|B alternation) or "regex" (Codex: an anchored
regex ^(A|B)$). Optional (additive, non-breaking) — absent ⇒ "exact".
Used by compileHookProgram when rendering the settings block.
ReadonlynameStable identifier, e.g. "claude-code".
HookProtocol — the hook-wire PORT (transport axis). How a harness signals that a hook blocked/denied a tool call: the block exit code, the decision values that mean "deny", and the env vars a synthesized event carries. The research (research/harness-landscape.md) found Claude Code and Codex hooks are nearly identical at the wire level (both: JSON on stdin,
permissionDecision: "deny"/decision: "block"/ exit 2) — so this descriptor is deliberately thin, and the fact that a second harness needs almost the same values IS the finding. What varies more (config format JSON-vs-TOML, the plugin-root token, the event names) lives in PluginLayout / HarnessDialect, not here.The Claude Code implementation is
claudeCodeHookProtocolinsrc/adapters/claude-code/hook-protocol.ts.