Log CLAUDE.md & Rules-File Load Events
A model-risk review of a regulated session often needs to prove exactly what guidance was in effect when the agent acted — not just what files exist in the repo today, but which ones were actually loaded, and whether a nested or path-glob-matched rule file quietly applied.
1. Save this as the hook script
#!/usr/bin/env python3
"""InstructionsLoaded hook — logs every CLAUDE.md/rules-file load event."""
import json, sys, datetime
from pathlib import Path
data = json.load(sys.stdin)
log_path = Path(data.get("cwd", ".")) / ".claude" / "instructions_loaded.jsonl"
log_path.parent.mkdir(parents=True, exist_ok=True)
entry = {
"ts": datetime.datetime.utcnow().isoformat() + "Z",
"session_id": data.get("session_id"),
"file_path": data.get("file_path"),
"load_reason": data.get("load_reason"),
}
with open(log_path, "a") as f:
f.write(json.dumps(entry) + "\n")
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/log-instructions-loaded.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"InstructionsLoaded": [
{
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/log-instructions-loaded.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks