PreToolUse:Bash hook error: `npx block-no-verify` fails with EBADDEVENGINES in pnpm-only projects

[wiput1999]

Problem

The block-no-verify PreToolUse hook (hooks/hooks.json:4-15) runs npx block-no-verify@1.1.2 directly. In projects where package.json declares devEngines.packageManager.name = "pnpm" with onFail: "error", npm (invoked by npx) aborts before ever launching block-no-verify:

npm error code EBADDEVENGINES
npm error EBADDEVENGINES Invalid name "pnpm" does not match "npm" for "packageManager"
npm error EBADDEVENGINES {
npm error EBADDEVENGINES   current: { name: 'npm', version: '11.6.2' },
npm error EBADDEVENGINES   required: { name: 'pnpm', onFail: 'error' }
npm error EBADDEVENGINES }

This surfaces as PreToolUse:Bash hook error — Failed with non-blocking status code on every single Bash tool call throughout the session.

Two separate bugs

1. npx inherits the project's devEngines check

npx runs from the project cwd, so npm reads the local package.json and enforces devEngines. Any project using pnpm (or yarn) with devEngines.packageManager.onFail: "error" will trigger this.

Suggested fix: Run from a neutral cwd:

"command": "(cd \"$HOME\" && npx -y block-no-verify@1.1.2)"

2. Hook bypasses run-with-flags.js — cannot be disabled via ECC_DISABLED_HOOKS

The hook has "id": "pre:bash:block-no-verify" (added in 1.10.0), but unlike every other PreToolUse hook, it runs the command directly instead of routing through scripts/hooks/run-with-flags.js. This means ECC_DISABLED_HOOKS=pre:bash:block-no-verify has no effect — the isHookEnabled() check never runs.

Suggested fix: Wrap the hook through run-with-flags.js like the others:

{
  "matcher": "Bash",
  "hooks": [
    {
      "type": "command",
      "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/run-with-flags.js\" \"pre:bash:block-no-verify\" \"scripts/hooks/block-no-verify-wrapper.js\" \"standard,strict\""
    }
  ],
  "description": "Block git hook-bypass flag to protect pre-commit, commit-msg, and pre-push hooks from being skipped",
  "id": "pre:bash:block-no-verify"
}

Reproduction

1. Create a project with package.json containing:

   {
     "devEngines": {
       "packageManager": { "name": "pnpm", "onFail": "error" }
     },
     "packageManager": "pnpm@10.33.0"
   }

2. Install ECC plugin (1.10.0)
3. Run any Bash tool call — observe PreToolUse:Bash hook error on every invocation
4. Set ECC_DISABLED_HOOKS=pre:bash:block-no-verify — observe no change (bug #2)

Question for maintainers

Is there a recommended workaround for affected users in the meantime? The only option I found is manually patching the cached hooks/hooks.json, which gets overwritten on plugin update. If there's an env var, config option, or other mechanism I'm missing, please let me know.

Environment

• macOS Darwin 25.3.0
• Node 24.x, npm 11.6.2, pnpm 10.33.0
• Claude Code with ECC 1.10.0

Related

• Add block-no-verify to prevent AI agents from skipping git hooks #648 — Original request that added block-no-verify (used npx directly)
• Plugin hooks cannot be individually disabled & fire unconditionally #248 — Hook disable mechanism (the fix that block-no-verify was missed by)