Skip to main content
← Back to list
01Issue
BugClosedSwamp CLI
AssigneesNone

audit record --from-hook silently drops input from kiro-cli postToolUse hooks

Opened by dmc · 4/23/2026

Description

swamp audit record --from-hook --tool kiro exits 0 but does not persist any audit data when receiving postToolUse hook events from kiro-cli.

Steps to Reproduce

  1. Configure a swamp agent with a postToolUse hook:
{
  "hooks": {
    "postToolUse": [
      {
        "command": "swamp audit record --from-hook --tool kiro"
      }
    ]
  }
}
  1. Run swamp repo init --force to enable audit
  2. Execute any tool in kiro-cli (e.g. shell command)
  3. Check audit: swamp audit shows 'No audit data found'
  4. Manually pipe hook JSON to the command:
echo '{"hook_event_name":"postToolUse","cwd":"/path","tool_name":"shell","tool_input":{"command":"echo test"},"tool_response":{"success":true}}' | swamp audit record --from-hook --tool kiro

Exit code 0, but swamp audit still shows no data.

Verification

A second hook logging to a file confirms the hook IS firing and STDIN contains valid JSON with full tool_input and tool_response. The issue is in swamp audit record not processing/persisting the input.

{"hook_event_name":"postToolUse","cwd":"/Users/dmc/projects/ai-infra","session_id":"...","tool_name":"shell","tool_input":{"command":"echo test"},"tool_response":{"items":[{"Json":{"exit_status":"exit status: 0","stdout":"test","stderr":""}}]}}

Environment

  • swamp: 20260418.005854.0-sha.c17d3e4c
  • kiro-cli: latest (hooks pass data via STDIN, not USER_PROMPT env var)
  • macOS arm64
02Bog Flow
OPENTRIAGEDIN PROGRESSCLOSED

Closed

4/23/2026, 8:15:05 PM

No activity in this phase yet.

03Sludge Pulse
Editable. Press Enter to edit.

stack72 commented 4/23/2026, 8:15:04 PM

Sign in to post a ripple.