`.factory/hooks.json` is silently never read at project scope (documented primary location)

[Roderick-Clemente]

Summary

At project scope, hook declarations in .factory/hooks.json are silently never read. The documentation lists this as the primary project-scope hook location, but a PreToolUse hook registered there never fires. The same declaration works only when moved into the hooks key of .factory/settings.json. There is no warning or error in either case — the run proceeds unguarded at exit 0.

This is a security-relevant failure: a hook is a policy control (test-lock, path guard, etc.). An operator following the docs will believe a control is installed when it is not.

Environment

• droid 0.186.0, macOS (darwin 24.6.0), droid exec mode

Reproduction

Register an identical matcher: "*" canary PreToolUse hook (writes one line per invocation) in each location, run one trivial tool call (droid exec 'run: ls'), count invocations:

Config location	Canary invocations
.factory/hooks.json (project, documented primary)	0
~/.factory/hooks.json (user scope)	0
.factory/hooks/hooks.json (documented legacy)	0
.factory/settings.json, hooks key	1

All four tested with valid JSON (python3 -m json.tool exit 0), absolute script paths, and the documented PreToolUse event.

Expected

.factory/hooks.json is read and its hooks fire — or, at minimum, an unread/misconfigured hook file produces a diagnostic rather than silently doing nothing.

Actual

Only .factory/settings.json (hooks key) fires. The documented primary is silently ignored. The failure is indistinguishable from success at the exit code.

Note

Plugin-shipped hooks (hooks/hooks.json inside a plugin) DO fire — so the filename works in one context and is silently ignored in another, which compounds the confusion.

[Roderick-Clemente]

Cross-version data point: this is a regression, not longstanding

Re-tested on droid 0.180.0 (macOS): the same .factory/hooks.json project-scope canary fires — 1 invocation on a trivial Execute call. On 0.186.0 the identical setup is silent (0 invocations), as reported above.

So the behavior changed 0.180.0 (works) → 0.186.0 (silently unread) — a regression introduced between those releases, not longstanding behavior. Same JSON, same absolute paths, same PreToolUse event; only the CLI version differs.

Flagging the direction because it narrows where to look: whatever changed the project-scope hook loader between 0.180 and 0.186 dropped .factory/hooks.json from the read path while keeping the settings.json hooks key and plugin-shipped hooks/hooks.json working.