LLM Dark Patterns Hooks
A suite of single-purpose Claude Code hooks that suppress LLM dark-pattern defaults — sycophancy, paternalism, false-success, permission-loops, training-cutoff confidence, and compaction amnesia — at the textual boundary, so power-user operators can actually work.
This repo is the umbrella for a series of small hook repos, umbrella-only
legacy hooks that still live here, and the research-grade closeout physics
engine in
waitdeadai/agent-closeout-bench.
Each public standalone hook remains separately installable. The
physics-backed lane uses one reproducible engine with per-category rule packs,
fixtures, and decision JSON.
That does not collapse every hook into one generic detector. Each hook maps to
its own category engine; the shared Rust binary is packaging for reproducible
hashing, safe regex compilation, fixture testing, telemetry discipline, and
paper-grade evaluation.
The shared architecture is out-of-band textual enforcement at Claude Code hook
boundaries. The judge is deterministic code, not another LLM call. That means
the model cannot modify the hook's code path from inside its closeout text; it
does not mean the system is impossible to bypass, misconfigure, or evade by
paraphrase.
What's shipped (as of 2026-05-13)
| Phase | Surface | Status |
|---|
| Phase 1 — Locale loader + English pack | lib/packs.sh, packs/locale/en.txt | ✓ ships |
| Phase 2 — Spanish + Polish locale packs | packs/locale/{es,pl}.txt | ✓ ships |
| Phase 3 — Evidence binary allowlist (devops/k8s/cloud/database/system) | packs/evidence/binaries.txt (9 sections, 200+ binaries) | ✓ ships |
| Phase 4 — Destructive command surface packs (filesystem, container, git-protected, config-overwrite, cloud-prod, database, service) | packs/destructive/*.txt (7 surfaces, 56 patterns) | ✓ ships |
| Phase 5 — Bypass hardening (clause-local negation, evidence proximity + action-verb) | hooks/no-vibes.sh | ✓ ships |
| Phase 6 — Physics-backed closeout adapters | agentcloseout-physics v0.2, per-category rule packs, Claude Code wrappers, PreToolUse tamper guard | ✓ ships in AgentCloseoutBench |
Operators with a non-English session, a non-app-dev toolchain, or a load-bearing destructive surface (kubectl, terraform, redis FLUSHALL, force-push to main) can extend coverage without forking by dropping a .txt into ${XDG_CONFIG_HOME:-$HOME/.config}/llm-dark-patterns/packs/<subdir>/<name>.txt. See ROADMAP.md for the architecture spec.
Why this exists
LLM "dark patterns" is now an academically-recognized category:
