Having given the JSON more than two seconds of thought, I have a very different suggestion:
{
"function_hooks": {
"version": 1,
"source_file": "./whatever.ts",
"language": "TypeScript",
"hash": "sha256:abcd..."
}
}
The point here is that there's a world adjacent to but not actually contained within Claude Code in which not everything blindly trusts everything else, and maybe it's time to start remembering some lessons from the 90's on. For example:
- Don't sniff content types and preferably don't infer them from filenames either.
- Don't trust your subresource to arrive intact. Pin those hashes and verify them!
- Leave some room for extensibility.
- Maybe don't require everyone to mix their code with the security policy that controls edits to that code? I realize that anyone cursed with GitHub Actions is forced to violate this rule in the most outrageous ways imaginable, but that doesn't mean that Claude Code needs to follow suit forever. Once there's subresource integrity, the actual subresource can be put somewhere else where it belongs better. If there's "source_file", in the future there can be "source_url" and such without trying to infer it from the formatting of the string.
(I've involved absolutely no AI in the preparation of this comment. I make plenty of use of AI, but I like my brain to stay exercised, and I like to think that I remain MUCH better at this kind of thing than even the best current models.)