Hookify treats enabled: no as enabled

Resolved 💬 1 comment Opened May 7, 2026 by parasol-aser Closed Jun 4, 2026

Summary

Hookify rule files use YAML-style frontmatter, but the hand-rolled parser only converted true and false to booleans. Other common YAML boolean spellings such as no, off, and 0 were left as non-empty strings. Because load_rules() checks if rule.enabled:, a rule with enabled: no was still loaded and enforced.

Impact

A project-local .claude/hookify.*.local.md rule can appear disabled to a YAML-aware reader while still running. This is narrow in scope because it requires Hookify to be installed/enabled and the user to open/use a project containing the misleading rule, but it can unexpectedly activate warn or block rules.

Reproduction

PYTHONPATH=plugins python3 - <<'PY'
from hookify.core.config_loader import extract_frontmatter, Rule
fm, msg = extract_frontmatter("---\nname: r\nenabled: no\nevent: bash\npattern: rm -rf\n---\nmsg\n")
r = Rule.from_dict(fm, msg)
print(repr(fm["enabled"]), bool(r.enabled))
PY

Before the fix this printed:

'no' True

Expected behavior: enabled: no should parse as False and the rule should not load.

Suggested fix

Parse the enabled frontmatter field as a strict boolean, accepting common YAML spellings (true/false, yes/no, on/off, 1/0) case-insensitively, and reject invalid values instead of allowing truthy strings.

View original on GitHub ↗

This issue has 1 comment on GitHub. Read the full discussion on GitHub ↗