Warn on an External Directory Added Mid-Session
Adding a second directory mid-session widens what the agent can read and write without necessarily being obvious from the transcript alone — this surfaces it explicitly, including how it was added (slash command vs. SDK call), so it doesn't pass unnoticed in a long session.
1. Save this as the hook script
#!/usr/bin/env python3
"""DirectoryAdded hook — warns when a directory is added mid-session."""
import json, sys
data = json.load(sys.stdin)
print(f"NOTICE: directory '{data.get('directory_path')}' was added mid-session "
f"via {data.get('how_added')}. Confirm this expansion of scope was intentional.", file=sys.stderr)
sys.exit(1)
Save to a path inside your project, e.g. .claude/hooks/warn-external-directory-added.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"DirectoryAdded": [
{
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/warn-external-directory-added.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks