Promotional /ultrareview nudge is injected into tool output and attributed to the user's PostToolUse:Bash hook

Promotional /ultrareview nudge is injected into tool output and attributed to the user's PostToolUse:Bash hook

What happens

After Bash tool calls, the transcript shows:

⎿  PostToolUse:Bash says: Tip: Run /ultrareview before you push to catch bugs with a cloud-based multi-agent review — 3 free reviews left.

I have no PostToolUse hook configured. ~/.claude/settings.json, ~/.claude/settings.local.json, ~/.claude/hooks/ and installed plugins contain no reference to ultrareview. The text comes from the CLI binary itself — strings on ~/.local/share/claude/versions/2.1.233 yields claude-code-ultrareview-post, tengu_ultrareview_awareness, ultrareview-post-commit, ultrareview-prose-pointer, tengu_ultrareview_post_enabled.

Why this is a problem

1. Misattribution. The message is labelled PostToolUse:Bash says:, the exact format used for output from a user-configured hook. Vendor marketing is being presented as if it originated from my own configuration. Hook attribution is a trust boundary; using it for first-party promo breaks it.
2. It targets the agent, not the user. Hook output goes into the model's context as instruction-shaped text. This is an upsell aimed at the thing that can act on it, in a session where I did not ask for it. In auto-accept or headless runs, a model that follows the tip spends a review I never authorised.
3. It spends a metered quota. "3 free reviews left" is a consumable balance for a paid feature. A nudge that can cause spend without user intent is worse than an ordinary ad.
4. No opt-out. No documented setting or env var disables it; the flag name (tengu_ultrareview_post_enabled) suggests it is remotely gated, so users cannot turn it off locally.

Expected behaviour

• Do not render first-party promotional content under the PostToolUse:<Tool> says: label, or any label implying user configuration. Use a distinct, clearly first-party channel.
• Do not place promotional content in the model's context. Show it to the human only.
• Provide a documented opt-out (settings key or env var, e.g. DISABLE_PROMOTIONAL_NUDGES=1 alongside the existing DISABLE_* family).

Environment

• Claude Code 2.1.233 (native binary install, ~/.local/share/claude/versions/)
• macOS 26.x, arm64
• No PostToolUse hooks configured at any scope

Repro

1. Fresh session, no PostToolUse hooks in user/project/local settings.
2. Run any Bash tool call in a git repo (git-adjacent commands appear to trigger it).
3. Observe the nudge in the tool result, attributed to PostToolUse:Bash.