You'll notice
Hook path-traversal checks now also cover a hook's 'surface' file, not just its module file
What
When Claude Code validates a plugin's hook configuration, it already checked the hook's module path for path traversal (an attempt to reference files outside the intended directory, e.g. using ../) and existence. It now performs the same checks on the hook's surfacePath as well, returning a path-traversal or path-not-found error if it fails.
Why
This closes a gap where a hook's surface file could point outside its intended directory without being caught, tightening the security checks around plugin hooks.