fix(hooks): Codex rejects the hook output we ship — v4.7.3

[kevintseng]

Reported from a live Codex session against installed 4.7.1, and confirmed present in the v4.7.2 tag before touching anything.

PostToolUse hook returned unsupported suppressOutput
hook returned invalid post-tool-use JSON output
hook returned invalid stop hook JSON output

What happens

post-commit.js (PostToolUse/Bash) and session-summary.js (Stop) each ended with:

console.log(JSON.stringify({ suppressOutput: true }));

That is valid Claude Code hook output. Codex validates hook output per event against its own schema and rejects the field — so a Codex user gets an error after every Bash command and at the end of every turn, with the capture having already succeeded. The memory is written and the error appears anyway.

The fix

Both hooks now print nothing.

Not a compromise — the field was never doing any work. Neither hook writes anything else to stdout, so there was no output to suppress; it announced an intent that silence already expresses. Empty stdout with exit 0 is the "no opinion" signal in both contracts, and is exactly what this repo's own validateHookOutput classifies as kind: 'empty'.

Claude Code behaviour is unchanged: a hook that prints nothing and one that asks for its output to be hidden look identical to the user.

A conclusion of mine this overturns

I had told KT that this class of error was not memesh's, on the strength of a structural proof that session-summary.js emits only well-formed JSON. That proof is correct and answers the wrong question. JSON a host can parse is not JSON a host accepts. I checked validity and reported compatibility.

Two bad tests, caught before landing

The source scan tripped on my own comments. It searched for the string suppressOutput, and the hooks now carry a comment explaining why the field is absent. Comments are stripped before scanning — a check that cannot tell an explanation from an emission would forbid documenting the decision.

The first runtime test passed with the bug reinstated. Its payload was synthetic, and this hook turns such a payload away at one of six gates long before the line that used to print — every early return was already silent, so the assertion covered nothing. It now builds a real git repository, makes a real commit, and feeds the hook the hash git actually produced, with a guard asserting git's output still matches the hook's own regex. It also asserts the database was written, so silence cannot quietly become "did nothing".

And the audit caught a third. C1 flagged expect(offenders).toEqual([]) as an emptiness assertion with no size pin — correctly: it passes identically whether the scan read every hook and none offended, or read no hooks because the path was wrong. The file count is pinned first now.

Evidence

node scripts/run-tests-isolated.mjs     exit=0   189 files, 2595 tests
npm run verify:release                  exit=0   all detectors new=0
npm run build                           exit=0
check-version-coherence                 exit=0   8 anchors at 4.7.3

Break-tests, each restored byte-identical:

Mutation	Result
bug reinstated in post-commit.js	exit=1 — 2 failed: the real-commit runtime case and the source scan
scan path misspelled	exit=1 — ENOENT on the source-scan case

Release

Bumped to 4.7.3 in this PR. 4.7.1 and 4.7.2 are both affected for anyone running MeMesh as a Codex plugin, so this wants shipping rather than waiting.