AI 도구 매일 노트 — 해고된 개발자의 기록

For months I believed my Claude Code setup was fine. Hooks, agents, rules, automations. Everything looked healthy, because nothing threw errors. Then I audited the whole thing for the first time since building it. Roughly half of it was either dead or faking it. The worst find: a security hook that had never run. Not once. Since the day I installed it. The security hook that never fired I wrote a hook to stop secrets (API keys, tokens) from leaking into tool output. The code checked a field called tool_result . The actual field in the payload is named tool_response . One word. The match never succeeded, so the hook silently did nothing on every single call, for months. No error, no warning. A guard that never fires looks exactly like a guard with nothing to catch. Fixing the typo would not have been enough, though. The hook ran after the tool executed. By the time it could mask anything, the model had already read the output, secret included. Post-hoc masking is too late by des...