fix(hook-message-injector): add validation to prevent empty message injection and improve logging

- Add content validation in injectHookMessage() to prevent empty hook content injection
- Add logging to claude-code-hooks and keyword-detector for better debugging
- Document timing issues in empty-message-sanitizer comments
- Update README with improved setup instructions

🤖 Generated with assistance of [OhMyOpenCode](https://github.com/code-yeongyu/oh-my-opencode)

src/hooks/claude-code-hooks/index.ts

@@ -111,6 +111,7 @@ export function createClaudeCodeHooksHook(ctx: PluginInput, config: PluginConfig
 
         if (result.messages.length > 0) {
           const hookContent = result.messages.join("\n\n")
+          log(`[claude-code-hooks] Injecting ${result.messages.length} hook messages`, { sessionID: input.sessionID, contentLength: hookContent.length })
           const message = output.message as {
             agent?: string
             model?: { modelID?: string; providerID?: string }

src/hooks/empty-message-sanitizer/index.ts

@@ -8,6 +8,12 @@ interface MessageWithParts {
 }
 
 type MessagesTransformHook = {
+// NOTE: This sanitizer runs on experimental.chat.messages.transform hook,
+// which executes AFTER chat.message hooks. Filesystem-injected messages
+// from hooks like claude-code-hooks and keyword-detector may bypass this
+// sanitizer if they inject empty content. Validation should be done at
+// injection time in injectHookMessage().
+
   "experimental.chat.messages.transform"?: (
     input: Record<string, never>,
     output: { messages: MessageWithParts[] }

src/hooks/keyword-detector/index.ts

@@ -43,6 +43,7 @@ export function createKeywordDetectorHook() {
       }
 
       const context = messages.join("\n")
+      log(`[keyword-detector] Injecting context for ${messages.length} keywords`, { sessionID: input.sessionID, contextLength: context.length })
       const success = injectHookMessage(input.sessionID, context, {
         agent: message.agent,
         model: message.model,