fix(plugin-dev): validator scripts abort on first finding due to set -e - #66416

@ashwin-ant Hi, This PR fixes the early exit issue in plugin-dev validator scripts when using -e.
The changes have been reviewed and approved by @stevei101, but I still need a maintainer's approval for the workflow and merge to proceed.
Could someone please take a look when you get a chance?
Thanks a lot!

Independently verified this on main (f173a69), bash 5.3, jq 1.8.1. I applied the three-line change to fresh copies of the three scripts — diff against the base reproduces this PR's hunks exactly — and ran both versions over a 17-case fixture set. Summary: the fix works, and it also uncovers a second bug that set -e was hiding.

The fix works

Format is exit / error-lines / warning-lines / final-summary-printed.

The three controls are the point: base and patched are byte-identical on every input with no -e trigger, and differ on all 11 that have one.

Two cases are worth spelling out because they're worse than "stops early":

hook-linter.sh silently skips files. Linting three scripts where the second has an error:

$ bash hook-linter.sh warn-only.sh err1.sh err2.sh
...
❌ Found 1 error(s) and 3 warning(s)     <- err1.sh
$ echo $?
1

err2.sh is never opened, and N script(s) had errors never prints. Both versions exit 1, so a caller cannot distinguish "linted everything, found errors" from "gave up at the first one". Note this file needs an error-producing target to reproduce — its 11 in-function increments are harmless, since check_script is called as if ! check_script "$script", which suppresses set -e inside the function. The live one is the single top-level ((total_errors++)) on line 142. I first tested with a warnings-only fixture and wrongly concluded this file was unaffected.

validate-agent.sh fails valid files with no message. An agent that merely omits the optional tools: key prints four green checks and then vanishes — no error, no warning, no summary, exit 1 — because that optional-field extraction propagates a non-zero status. After the change: ✅ All checks passed!, exit 0.

What the fix uncovers: the schema validator can't read the plugin format

This isn't a regression — set -e was hiding it. validate-hook-schema.sh expects a bare event map, but a plugin's hooks.json wraps events under a hooks key alongside a description string. On main the run dies at the first jq failure with exit 5 and no verdict. With this PR applied it runs to completion and reports a large number of false errors.

All five hooks.json files shipped in this repo, via the command hook-development/SKILL.md step 6 tells authors to run:

Five of five — that's every hooks.json in the repo, not a sample.

The mechanism is exact. The validator iterates jq -r 'keys[]', so $event takes the values description and hooks. Then hook_count=$(jq -r ".\"$event\" | length" ...) — and jq's length on a string is its character count. So for $event = description the loop for ((i=0; i<hook_count; i++)) runs once per character of the description, each pass emitting ❌ description[i]: Missing 'matcher' field. That gives:

false_errors == (.description | length) + (.hooks | length)

I tested that as a prediction rather than a description. Manipulating description length across 0/1/5/20/65/200 with events held at 1, and event count across 1–5 with description held at 10, plus the type cases jq treats specially — a description of null (length 0), of [1..7] (length 7), absent entirely, and the number 300 (numeric length is absolute value, so it predicts 301 errors). Twenty observations including the five real manifests: 20/20 exact, slope 1.000, intercept 0.000, zero residual, over a range of 1 to 301 errors. On unpatched main the same twenty inputs are flat at exit 5 with zero errors, so the dose-response appears only once -e is gone.

The error count of an Anthropic plugin is literally the length of its description string.

Why these are false rather than a real finding: the same SKILL.md prescribes this shape at line ~79 — "hooks field is required wrapper containing actual hook events… This is the plugin-specific format" — and then at line 707 tells the author to check it with a script that can't parse it. Either all five shipped plugins are malformed or the validator is, and the five match the documented shape.

Where that leaves the PR

set -e was converting a wrong answer into a crash. Removing it is right — exit 1 is the script's own documented failure code, and the output is now legible enough to diagnose instead of an unexplained exit 5. But the PR body's reasoning that "all fatal paths already use explicit exit 1" doesn't hold on this input: the jq failure is fatal to the run's meaning and nothing catches it. So this change is necessary but not sufficient — validate-hook-schema.sh also needs a root-structure guard that detects the wrapper form (and either descends into .hooks or reports one clear error), otherwise merging this turns a silent abort into 57–97 wrong errors on every official plugin.

Two other pre-existing gaps this change doesn't touch, for completeness: a hooks.json whose root is [], {}, or a bare scalar like 5 still reports ✅ All checks passed! and exits 0. The scalar case prints two raw jq errors and still claims success — the root iteration sits in a for word list, where the substitution's failure was never examined even with -e on.