Hook file paths may expand a new ${CLAUDE_PLUGIN_DATA} placeholder, and nothing else.
The hooks system now recognizes a hook type: "script" distinct from existing command hooks, with dedicated path anchoring supporting ${CLAUDE_PROJECT_DIR}, ${CLAUDE_PLUGIN_ROOT}, and the new ${CLAUDE_PLUGIN_DATA} substitution plus ~-expansion, and a description formatter for it. However, the function that actually executes a script hook throws unconditionally at the point of use, from both the main hook-execution path (where hooks are matched by type) and a second call site, so script hooks do not actually run yet.
Hook config validation was also updated to explicitly whitelist ${CLAUDE_PROJECT_DIR}, ${CLAUDE_PLUGIN_ROOT}, and the new ${CLAUDE_PLUGIN_DATA} as the only expandable placeholders allowed in a hook's file field; any other $-expansion, backtick, or %NAME% pattern is flagged as invalid.