fix: add centralized appendToOutput helper for null-safe output writes in after-hooks

[uyu423]

Summary

• Add a centralized appendToOutput() helper to Prevent silent "undefinedstring" data corruption when MCP tools return undefined as output.output, complementing the TypeError crash fix in fix: guard output.output in tool after-hooks for MCP tools #1756 when MCP tools return undefined as output.output
• Complements fix: guard output.output in tool after-hooks for MCP tools #1756 (READ guards) by covering all remaining WRITE operations (output.output +=) across 13 hook files
• Includes 8 unit tests for the helper covering string, null, undefined, object, and sequential append scenarios

Changes

Problem

#1756 fixed READ operations (.toLowerCase()) on output.output with ?? "" guards in 3 files, but WRITE operations (output.output += text) remained unguarded across 13 hook files. When MCP tools (Atlassian, Exa, Chrome DevTools, grep.app, etc.) return undefined instead of a string for output.output, these writes cause:

• TypeError: undefined is not an object — crashes the entire tool execution pipeline
• "undefinedSome reminder text" — silent data corruption when JS coerces undefined + string

Solution

New helper (src/hooks/hook-output-guard.ts):

export function appendToOutput(output: { output: string }, text: string): void {
    if (output.output == null) {
        output.output = text   // initialize from null/undefined
        return
    }
    if (typeof output.output === "string") {
        output.output += text  // normal append
    }
    // non-string (object/array) → leave untouched to preserve structured responses
}

Design decisions:

• == null (loose equality) catches both null and undefined in one check
• Non-string values (objects, arrays) are left untouched to prevent corrupting structured MCP responses
• Initializes from null/undefined rather than silently skipping, so context injections are preserved

13 hook files updated — all output.output += ... and output.output = `${output.output}...` patterns replaced with appendToOutput() calls:

File	Change
agent-usage-reminder/hook.ts	+= REMINDER_MESSAGE → appendToOutput
category-skill-reminder/hook.ts	+= reminderMessage → appendToOutput
claude-code-hooks/.../tool-execute-after-handler.ts	template literal concat → appendToOutput (2 sites)
comment-checker/cli-runner.ts	+= result.message → appendToOutput (2 sites)
context-window-monitor.ts	+= CONTEXT_REMINDER → appendToOutput
delegate-task-retry/hook.ts	+= guidance → appendToOutput + READ guard ?? ""
directory-agents-injector/injector.ts	+= directory context → appendToOutput
directory-readme-injector/injector.ts	+= README content → appendToOutput
edit-error-recovery/hook.ts	+= EDIT_ERROR_REMINDER → appendToOutput
interactive-bash-session/hook.ts	+= reminder → appendToOutput
interactive-bash-session/interactive-bash-session-hook.ts	+= reminderToAppend → appendToOutput
rules-injector/injector.ts	+= rule content → appendToOutput
task-reminder/hook.ts	+= REMINDER_MESSAGE → appendToOutput

Testing

bun run typecheck   # passes
bun run build       # passes
bun test src/hooks/hook-output-guard.test.ts  # 8 pass, 0 fail

Test cases cover:

• Normal string append
• Empty string append
• undefined → initializes with text (core MCP bug scenario)
• null → initializes with text
• Non-string object → preserved (no corruption)
• Number → preserved
• Multiple sequential appends
• Multiple appends starting from undefined

Related Issues

Complements #1756 (d5fd918) — that PR guards READ operations, this PR guards WRITE operations.
Related to #1720 (original MCP tool output crash report).

---

Summary by cubic

Adds a centralized appendToOutput helper to make after-hook output writes null-safe, preventing crashes and "undefinedstring" corruption when MCP tools return undefined. Replaces ad-hoc string concatenation across hooks and adds tests.

• Bug Fixes
  • Introduced appendToOutput: initializes on null/undefined, appends to strings, leaves non-strings untouched.
  • Replaced output.output concatenations with the helper across 13 hooks; added a read guard in delegate-task-retry.
  • Added 8 unit tests; typecheck and build pass.

^{Written for commit 4b21310. Summary will update on new commits.}

[github-actions]

All contributors have signed the CLA. Thank you! ✅
_{Posted by the CLA Assistant Lite bot.}

[uyu423]

I have read the CLA Document and I hereby sign the CLA

[uyu423]

recheck

[cubic-dev-ai]

No issues found across 15 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Auto-approved: Refactoring PR: safely replaces direct string concatenation with a new appendToOutput helper across 13 hooks. The helper handles null/undefined MCP tool outputs (common crash source) and preserves 1}