Warn and Log Session Fork Events
A forked session carries over everything the parent had — including whatever trust decisions were already made — which is exactly the kind of inherited state a reviewer should know happened. This can't block the fork (SessionStart has no blocking support) but logs and surfaces it.
1. Save this as the hook script
#!/usr/bin/env python3
"""SessionStart hook — logs and warns on a forked session.
Wire with matcher "fork"."""
import json, sys, datetime
from pathlib import Path
data = json.load(sys.stdin)
log_path = Path(data.get("cwd", ".")) / ".claude" / "audit.log"
log_path.parent.mkdir(parents=True, exist_ok=True)
entry = {"ts": datetime.datetime.utcnow().isoformat() + "Z", "event": "session_fork",
"session_id": data.get("session_id")}
with open(log_path, "a") as f:
f.write(json.dumps(entry) + "\n")
print("NOTICE: this session was forked and inherits the parent's full "
"context and permission state.", file=sys.stderr)
sys.exit(1)
Save to a path inside your project, e.g. .claude/hooks/warn-log-session-fork-events.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"SessionStart": [
{
"matcher": "fork",
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/warn-log-session-fork-events.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks