Summary
The Vercel plugin's PreToolUse hook (hooks/pretooluse-skill-inject.mjs) matches on file basename alone (README*, package.json, tsconfig.json, etc.) without checking whether the current project is actually a Vercel/Next.js project. The result: in a non-Vercel project (e.g. a Bun CLI, a generic Node tool, a Rust binary that happens to have a README.md), every Write/Edit on a matching filename triggers a MANDATORY: Your training data for these libraries is OUTDATED injection that tells the agent to invoke Skill(bootstrap) / Skill(next-upgrade) / Skill(nextjs) — irrelevant to the project at hand.
Steps to reproduce
- Create a non-Vercel project:
mkdir my-cli && cd my-cli && git init && bun init -y
- In a Claude Code session,
Write a README.md (or package.json, or tsconfig.json)
- Observe the PreToolUse hook injecting Vercel/Next.js skill guidance even though the project has no
vercel.json, no next.config.*, no @vercel/* dependency, no next dependency
Expected
The hook should run the same project-type detection that session-start-profiler.mjs already does (looks for vercel.json, next.config.{js,ts,mjs,mts}, @vercel/* / next in package.json deps) and early-exit when none match.
Concretely
A guard like the one in session-start-profiler.mjs:profileProject() applied at the top of pretooluse-skill-inject.mjs before any basename matching would solve it. Same detection logic, just lifted into the per-file hook.
Impact
Every file write in a non-Vercel project triggers a MANDATORY instruction the agent must explicitly override. For a multi-file scaffold (e.g. spinning up a new repo) that's 5-15 false-positive prompts per session, adding tokens and noise. Acknowledging each one in narration is a poor user experience.
Context
Plugin version: 0.32.4 (current as of 2026-05-27)
Observed on: macOS, Claude Code with claude-plugins-official marketplace.
Filed by an end user via Claude Code after the false-positive fired on every file of a Bun CLI scaffold. Happy to PR if useful.
Summary
The Vercel plugin's
PreToolUsehook (hooks/pretooluse-skill-inject.mjs) matches on file basename alone (README*,package.json,tsconfig.json, etc.) without checking whether the current project is actually a Vercel/Next.js project. The result: in a non-Vercel project (e.g. a Bun CLI, a generic Node tool, a Rust binary that happens to have aREADME.md), everyWrite/Editon a matching filename triggers aMANDATORY: Your training data for these libraries is OUTDATEDinjection that tells the agent to invokeSkill(bootstrap)/Skill(next-upgrade)/Skill(nextjs)— irrelevant to the project at hand.Steps to reproduce
mkdir my-cli && cd my-cli && git init && bun init -yWriteaREADME.md(orpackage.json, ortsconfig.json)vercel.json, nonext.config.*, no@vercel/*dependency, nonextdependencyExpected
The hook should run the same project-type detection that
session-start-profiler.mjsalready does (looks forvercel.json,next.config.{js,ts,mjs,mts},@vercel/*/nextinpackage.jsondeps) and early-exit when none match.Concretely
A guard like the one in
session-start-profiler.mjs:profileProject()applied at the top ofpretooluse-skill-inject.mjsbefore any basename matching would solve it. Same detection logic, just lifted into the per-file hook.Impact
Every file write in a non-Vercel project triggers a
MANDATORYinstruction the agent must explicitly override. For a multi-file scaffold (e.g. spinning up a new repo) that's 5-15 false-positive prompts per session, adding tokens and noise. Acknowledging each one in narration is a poor user experience.Context
Plugin version: 0.32.4 (current as of 2026-05-27)
Observed on: macOS, Claude Code with
claude-plugins-officialmarketplace.Filed by an end user via Claude Code after the false-positive fired on every file of a Bun CLI scaffold. Happy to PR if useful.