@akira-tl/forgerelay 0.1.0 → 0.2.0

package/dist/server.js

@@ -15,6 +15,7 @@ import * as z from "zod/v4";
 import { applyPatch } from "./apply-patch.js";
 import { isArtifactDownloadSupportedPlatform, registerArtifactTools, } from "./artifact-tools.js";
 import { loadConfig } from "./config.js";
+import { attachHookReports, HookRunner, runToolWithHooks } from "./hooks.js";
 import { buildServerInstructions, buildToolDescriptions, toolNames, } from "./mcp/server-instructions.js";
 import { createOpenAIIncomingArtifactAdapter, } from "./incoming-artifacts.js";
 import { logEvent, requestIp, requestPath, commandPreview, sessionIdPrefix, } from "./logger.js";
@@ -33,6 +34,7 @@ import { formatLocalAgentProviderAvailabilitySummary, getLocalAgentProviderAvail
 // MCP clients can reconnect without closing the previous transport. Bound stale
 // session retention so abandoned MCP servers do not accumulate for the life of the process.
 const MCP_SESSION_IDLE_TIMEOUT_MS = 24 * 60 * 60 * 1_000;
+const FORGERELAY_VERSION = readForgeRelayVersion();
 const MCP_SESSION_CLEANUP_INTERVAL_MS = 5 * 60 * 1_000;
 const WORKSPACE_APP_URI = "ui://forgerelay/workspace-app.html";
 const WORKSPACE_APP_MANIFEST_ENTRY = "workspace-app.html";
@@ -313,6 +315,13 @@ function processOutputSchema() {
         outputTruncated: z.boolean(),
     });
 }
+function readForgeRelayVersion() {
+    const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
+        throw new Error("Unable to read ForgeRelay package version.");
+    }
+    return packageJson.version;
+}
 function processToolResponse(tool, workspaceId, snapshot, summary) {
     const result = processResult(snapshot);
     const content = [textBlock(result)];
@@ -338,7 +347,18 @@ function processToolResponse(tool, workspaceId, snapshot, summary) {
         },
     };
 }
-function registerCodexProcessTools(server, config, workspaces, processSessions) {
+function workspaceHookInvocation(workspace) {
+    return {
+        workspaceId: workspace.id,
+        workspaceRoot: workspace.root,
+        workspaceMode: workspace.mode,
+        sourceRoot: workspace.sourceRoot,
+    };
+}
+function toolResultIsError(result) {
+    return typeof result === "object" && result !== null && result.isError === true;
+}
+function registerCodexProcessTools(server, config, workspaces, processSessions, hooks) {
     registerAppTool(server, "exec_command", {
         title: "Execute command",
         description: "Run a command inside an open workspace. Returns its result when it exits during the yield window, otherwise returns a sessionId for write_stdin. Use this for file inspection, tests, builds, package scripts, and long-running processes. Call open_workspace first and pass workspaceId.",
@@ -374,35 +394,42 @@ function registerCodexProcessTools(server, config, workspaces, processSessions)
         ...toolWidgetDescriptorMeta(config, "shell"),
         annotations: SHELL_TOOL_ANNOTATIONS,
     }, async ({ workspaceId, cmd, tty, columns, rows, workingDirectory, yieldTimeMs, maxOutputTokens }) => {
-        const startedAt = performance.now();
         const workspace = workspaces.getWorkspace(workspaceId);
-        const cwd = workspaces.resolveWorkingDirectory(workspace, workingDirectory);
-        const snapshot = await processSessions.start({
-            workspaceId,
-            command: cmd,
-            cwd,
-            workspaceRoot: workspace.root,
-            tty,
-            columns,
-            rows,
-            yieldTimeMs,
-            maxOutputTokens,
-        });
-        logToolCall(config, {
+        return runToolWithHooks(hooks, {
             tool: "exec_command",
-            workspaceId,
-            workingDirectory: workingDirectory ?? ".",
-            command: cmd,
-            commandLength: cmd.length,
-            success: true,
-            durationMs: Math.round(performance.now() - startedAt),
-        });
-        return processToolResponse("exec_command", workspaceId, snapshot, {
-            command: cmd,
-            workingDirectory: workingDirectory ?? ".",
-            running: snapshot.running,
-            exitCode: snapshot.exitCode,
-            wallTimeMs: snapshot.wallTimeMs,
+            invocation: workspaceHookInvocation(workspace),
+            payload: { command: cmd, workingDirectory: workingDirectory ?? "." },
+            operation: async () => {
+                const startedAt = performance.now();
+                const cwd = workspaces.resolveWorkingDirectory(workspace, workingDirectory);
+                const snapshot = await processSessions.start({
+                    workspaceId,
+                    command: cmd,
+                    cwd,
+                    workspaceRoot: workspace.root,
+                    tty,
+                    columns,
+                    rows,
+                    yieldTimeMs,
+                    maxOutputTokens,
+                });
+                logToolCall(config, {
+                    tool: "exec_command",
+                    workspaceId,
+                    workingDirectory: workingDirectory ?? ".",
+                    command: cmd,
+                    commandLength: cmd.length,
+                    success: true,
+                    durationMs: Math.round(performance.now() - startedAt),
+                });
+                return processToolResponse("exec_command", workspaceId, snapshot, {
+                    command: cmd,
+                    workingDirectory: workingDirectory ?? ".",
+                    running: snapshot.running,
+                    exitCode: snapshot.exitCode,
+                    wallTimeMs: snapshot.wallTimeMs,
+                });
+            },
         });
     });
     registerAppTool(server, "write_stdin", {
@@ -433,38 +460,51 @@ function registerCodexProcessTools(server, config, workspaces, processSessions)
         ...toolWidgetDescriptorMeta(config, "shell"),
         annotations: SHELL_TOOL_ANNOTATIONS,
     }, async ({ workspaceId, sessionId, chars, columns, rows, yieldTimeMs, maxOutputTokens }) => {
-        const startedAt = performance.now();
-        workspaces.getWorkspace(workspaceId);
-        const snapshot = await processSessions.write({
-            workspaceId,
-            sessionId,
-            chars,
-            columns,
-            rows,
-            yieldTimeMs,
-            maxOutputTokens,
-        });
-        logToolCall(config, {
+        const workspace = workspaces.getWorkspace(workspaceId);
+        return runToolWithHooks(hooks, {
             tool: "write_stdin",
-            workspaceId,
-            success: true,
-            durationMs: Math.round(performance.now() - startedAt),
-        });
-        return processToolResponse("write_stdin", workspaceId, snapshot, {
-            sessionId,
-            charactersWritten: chars?.length ?? 0,
-            running: snapshot.running,
-            exitCode: snapshot.exitCode,
-            wallTimeMs: snapshot.wallTimeMs,
+            invocation: workspaceHookInvocation(workspace),
+            payload: {
+                sessionId,
+                charactersWritten: chars?.length ?? 0,
+                columns,
+                rows,
+            },
+            operation: async () => {
+                const startedAt = performance.now();
+                const snapshot = await processSessions.write({
+                    workspaceId,
+                    sessionId,
+                    chars,
+                    columns,
+                    rows,
+                    yieldTimeMs,
+                    maxOutputTokens,
+                });
+                logToolCall(config, {
+                    tool: "write_stdin",
+                    workspaceId,
+                    success: true,
+                    durationMs: Math.round(performance.now() - startedAt),
+                });
+                return processToolResponse("write_stdin", workspaceId, snapshot, {
+                    sessionId,
+                    charactersWritten: chars?.length ?? 0,
+                    running: snapshot.running,
+                    exitCode: snapshot.exitCode,
+                    wallTimeMs: snapshot.wallTimeMs,
+                });
+            },
         });
     });
 }
 export function createMcpServer(config, workspaces, reviewCheckpoints, processSessions, localAgentProviders, incomingArtifactAdapters) {
     const toolDescriptions = buildToolDescriptions(config);
+    const hooks = new HookRunner(config.hooks, config.logging);
     const server = new McpServer({
         name: "forgerelay",
         title: "ForgeRelay",
-        version: "0.1.0",
+        version: FORGERELAY_VERSION,
         description: "Secure local coding workspace for MCP clients. Provides workspace-scoped file, search, edit, write, and shell tools.",
     }, {
         instructions: buildServerInstructions(config, {
@@ -559,7 +599,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         },
     }, async ({ path, mode, baseRef, newWorktree }, { _meta }) => {
         const startedAt = performance.now();
-        const { workspace, agentsFiles, availableAgentsFiles, workspaceReused, includeBootstrapContext, } = await workspaces.openWorkspace({ path, mode, baseRef, newWorktree }, { conversationScopeId: openAiConversationScopeId(_meta) });
+        const { workspace, agentsFiles, availableAgentsFiles, hookReports, workspaceReused, includeBootstrapContext, } = await workspaces.openWorkspace({ path, mode, baseRef, newWorktree }, { conversationScopeId: openAiConversationScopeId(_meta) });
         const knownWorktrees = await workspaces.listKnownWorktrees(workspace);
         if (config.widgets === "changes") {
             await reviewCheckpoints.initializeWorkspace({
@@ -657,7 +697,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             success: true,
             durationMs: Math.round(performance.now() - startedAt),
         });
-        return {
+        return attachHookReports({
             content: resultContent,
             _meta: {
                 tool: "open_workspace",
@@ -706,7 +746,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                     : {}),
                 instruction,
             },
-        };
+        }, hookReports);
     });
     registerAppTool(server, toolNames.closeWorktree, {
         title: "Close worktree",
@@ -733,38 +773,47 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         _meta: {},
         annotations: WRITE_TOOL_ANNOTATIONS,
     }, async ({ workspaceId, commitMessage }) => {
-        const startedAt = performance.now();
-        const closed = await workspaces.closeWorktree(workspaceId, commitMessage);
-        const result = [
-            `Closed managed worktree ${workspaceId}.`,
-            `Merged ${closed.branch} into ${closed.targetBranch} by fast-forward.`,
-            `Source checkout: ${closed.sourceRoot}`,
-            `Commit: ${closed.commitSha}`,
-            closed.cleanupWarning
-                ? `Cleanup warning: ${closed.cleanupWarning}`
-                : "The worktree directory and managed branch were removed.",
-        ].join("\n");
-        logToolCall(config, {
+        const workspace = workspaces.getWorkspace(workspaceId);
+        return runToolWithHooks(hooks, {
             tool: toolNames.closeWorktree,
-            workspaceId,
-            path: closed.sourceRoot,
-            success: true,
-            durationMs: Math.round(performance.now() - startedAt),
-        });
-        return {
-            content: [{ type: "text", text: result }],
-            structuredContent: {
-                result,
-                workspaceId,
-                sourceRoot: closed.sourceRoot,
-                branch: closed.branch,
-                targetBranch: closed.targetBranch,
-                commitSha: closed.commitSha,
-                mergedSha: closed.mergedSha,
-                committed: closed.committed,
-                cleanupWarning: closed.cleanupWarning,
+            invocation: workspaceHookInvocation(workspace),
+            payload: { commitMessage },
+            afterCwd: (response) => response.structuredContent.sourceRoot,
+            operation: async () => {
+                const startedAt = performance.now();
+                const closed = await workspaces.closeWorktree(workspaceId, commitMessage);
+                const result = [
+                    `Closed managed worktree ${workspaceId}.`,
+                    `Merged ${closed.branch} into ${closed.targetBranch} by fast-forward.`,
+                    `Source checkout: ${closed.sourceRoot}`,
+                    `Commit: ${closed.commitSha}`,
+                    closed.cleanupWarning
+                        ? `Cleanup warning: ${closed.cleanupWarning}`
+                        : "The worktree directory and managed branch were removed.",
+                ].join("\n");
+                logToolCall(config, {
+                    tool: toolNames.closeWorktree,
+                    workspaceId,
+                    path: closed.sourceRoot,
+                    success: true,
+                    durationMs: Math.round(performance.now() - startedAt),
+                });
+                return attachHookReports({
+                    content: [{ type: "text", text: result }],
+                    structuredContent: {
+                        result,
+                        workspaceId,
+                        sourceRoot: closed.sourceRoot,
+                        branch: closed.branch,
+                        targetBranch: closed.targetBranch,
+                        commitSha: closed.commitSha,
+                        mergedSha: closed.mergedSha,
+                        committed: closed.committed,
+                        cleanupWarning: closed.cleanupWarning,
+                    },
+                }, closed.hookReports);
             },
-        };
+        });
     });
     registerAppTool(server, toolNames.read, {
         title: "Read file",
@@ -795,50 +844,58 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         ...toolWidgetDescriptorMeta(config, "read"),
         annotations: { readOnlyHint: true },
     }, async ({ workspaceId, ...input }) => {
-        const startedAt = performance.now();
         const workspace = workspaces.getWorkspace(workspaceId);
-        const readPath = workspaces.resolveReadPath(workspace, input.path);
-        const response = await readFileTool({ ...input, path: readPath.absolutePath }, {
-            cwd: workspace.root,
-            root: workspace.root,
-            readRoots: readPath.readRoots,
-        });
-        if (response.isError) {
-            logFailedToolResponse(config, {
-                tool: toolNames.read,
-                workspaceId,
-                path: input.path,
-            }, response.content, startedAt);
-            return response;
-        }
-        workspaces.markReadPathLoaded(workspace, readPath);
-        const summary = {
-            ...textSummary(response.content),
-            offset: input.offset ?? 1,
-            limited: input.limit !== undefined,
-        };
-        logToolCall(config, {
+        return runToolWithHooks(hooks, {
             tool: toolNames.read,
-            workspaceId,
-            path: input.path,
-            success: true,
-            durationMs: Math.round(performance.now() - startedAt),
-        });
-        return {
-            ...response,
-            _meta: {
-                tool: toolNames.read,
-                card: {
+            invocation: workspaceHookInvocation(workspace),
+            payload: { path: input.path, offset: input.offset, limit: input.limit },
+            isFailure: toolResultIsError,
+            operation: async () => {
+                const startedAt = performance.now();
+                const readPath = workspaces.resolveReadPath(workspace, input.path);
+                const response = await readFileTool({ ...input, path: readPath.absolutePath }, {
+                    cwd: workspace.root,
+                    root: workspace.root,
+                    readRoots: readPath.readRoots,
+                });
+                if (response.isError) {
+                    logFailedToolResponse(config, {
+                        tool: toolNames.read,
+                        workspaceId,
+                        path: input.path,
+                    }, response.content, startedAt);
+                    return response;
+                }
+                workspaces.markReadPathLoaded(workspace, readPath);
+                const summary = {
+                    ...textSummary(response.content),
+                    offset: input.offset ?? 1,
+                    limited: input.limit !== undefined,
+                };
+                logToolCall(config, {
+                    tool: toolNames.read,
                     workspaceId,
                     path: input.path,
-                    summary,
-                    payload: { content: response.content },
-                },
-            },
-            structuredContent: {
-                result: contentText(response.content),
+                    success: true,
+                    durationMs: Math.round(performance.now() - startedAt),
+                });
+                return {
+                    ...response,
+                    _meta: {
+                        tool: toolNames.read,
+                        card: {
+                            workspaceId,
+                            path: input.path,
+                            summary,
+                            payload: { content: response.content },
+                        },
+                    },
+                    structuredContent: {
+                        result: contentText(response.content),
+                    },
+                };
             },
-        };
+        });
     });
     if (config.toolMode !== "codex") {
         registerAppTool(server, toolNames.write, {
@@ -857,53 +914,62 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             ...toolWidgetDescriptorMeta(config, "write"),
             annotations: WRITE_TOOL_ANNOTATIONS,
         }, async ({ workspaceId, ...input }) => {
-            const startedAt = performance.now();
             const workspace = workspaces.getWorkspace(workspaceId);
-            workspaces.resolvePath(workspace, input.path);
-            const response = await writeFileTool(input, {
-                cwd: workspace.root,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.write,
-                    workspaceId,
-                    path: input.path,
-                }, response.content, startedAt);
-                return response;
-            }
-            const patch = newFilePatch(input.path, input.content);
-            const stats = countDiffStats(patch);
-            const summary = {
-                ...stats,
-                lines: contentLineCount(input.content),
-                characters: input.content.length,
-            };
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.write,
-                workspaceId,
-                path: input.path,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                ...response,
-                _meta: {
-                    tool: toolNames.write,
-                    card: {
+                invocation: workspaceHookInvocation(workspace),
+                payload: { path: input.path },
+                isFailure: toolResultIsError,
+                changedPaths: (result) => toolResultIsError(result) ? [] : [input.path],
+                operation: async () => {
+                    const startedAt = performance.now();
+                    workspaces.resolvePath(workspace, input.path);
+                    const response = await writeFileTool(input, {
+                        cwd: workspace.root,
+                        root: workspace.root,
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.write,
+                            workspaceId,
+                            path: input.path,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const patch = newFilePatch(input.path, input.content);
+                    const stats = countDiffStats(patch);
+                    const summary = {
+                        ...stats,
+                        lines: contentLineCount(input.content),
+                        characters: input.content.length,
+                    };
+                    logToolCall(config, {
+                        tool: toolNames.write,
                         workspaceId,
                         path: input.path,
-                        summary,
-                        payload: {
-                            content: response.content,
-                            patch,
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        ...response,
+                        _meta: {
+                            tool: toolNames.write,
+                            card: {
+                                workspaceId,
+                                path: input.path,
+                                summary,
+                                payload: {
+                                    content: response.content,
+                                    patch,
+                                },
+                            },
                         },
-                    },
-                },
-                structuredContent: {
-                    result: contentText(response.content),
+                        structuredContent: {
+                            result: contentText(response.content),
+                        },
+                    };
                 },
-            };
+            });
         });
         registerAppTool(server, toolNames.edit, {
             title: "Edit file",
@@ -930,54 +996,63 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             ...toolWidgetDescriptorMeta(config, "edit"),
             annotations: EDIT_TOOL_ANNOTATIONS,
         }, async ({ workspaceId, ...input }) => {
-            const startedAt = performance.now();
             const workspace = workspaces.getWorkspace(workspaceId);
-            workspaces.resolvePath(workspace, input.path);
-            const response = await editFileTool(input, {
-                cwd: workspace.root,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.edit,
-                    workspaceId,
-                    path: input.path,
-                }, response.content, startedAt);
-                return response;
-            }
-            const stats = countDiffStats(response.details?.patch ?? response.details?.diff);
-            const summary = {
-                ...stats,
-                editCount: input.edits.length,
-            };
-            const editResultText = `Edited ${input.path} (+${stats.additions} -${stats.removals}).`;
-            const editContent = [textBlock(editResultText)];
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.edit,
-                workspaceId,
-                path: input.path,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                content: editContent,
-                _meta: {
-                    tool: toolNames.edit,
-                    card: {
+                invocation: workspaceHookInvocation(workspace),
+                payload: { path: input.path, editCount: input.edits.length },
+                isFailure: toolResultIsError,
+                changedPaths: (result) => toolResultIsError(result) ? [] : [input.path],
+                operation: async () => {
+                    const startedAt = performance.now();
+                    workspaces.resolvePath(workspace, input.path);
+                    const response = await editFileTool(input, {
+                        cwd: workspace.root,
+                        root: workspace.root,
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.edit,
+                            workspaceId,
+                            path: input.path,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const stats = countDiffStats(response.details?.patch ?? response.details?.diff);
+                    const summary = {
+                        ...stats,
+                        editCount: input.edits.length,
+                    };
+                    const editResultText = `Edited ${input.path} (+${stats.additions} -${stats.removals}).`;
+                    const editContent = [textBlock(editResultText)];
+                    logToolCall(config, {
+                        tool: toolNames.edit,
                         workspaceId,
                         path: input.path,
-                        summary,
-                        payload: {
-                            diff: response.details?.diff,
-                            patch: response.details?.patch,
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        content: editContent,
+                        _meta: {
+                            tool: toolNames.edit,
+                            card: {
+                                workspaceId,
+                                path: input.path,
+                                summary,
+                                payload: {
+                                    diff: response.details?.diff,
+                                    patch: response.details?.patch,
+                                },
+                            },
                         },
-                    },
-                },
-                structuredContent: {
-                    status: "applied",
-                    result: contentText(editContent),
+                        structuredContent: {
+                            status: "applied",
+                            result: contentText(editContent),
+                        },
+                    };
                 },
-            };
+            });
         });
     }
     if (config.toolMode === "codex") {
@@ -1004,44 +1079,53 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             ...toolWidgetDescriptorMeta(config, "edit"),
             annotations: EDIT_TOOL_ANNOTATIONS,
         }, async ({ workspaceId, patch }) => {
-            const startedAt = performance.now();
             const workspace = workspaces.getWorkspace(workspaceId);
-            const applied = await applyPatch(workspace.root, patch);
-            const paths = applied.files.map((file) => file.path).join(", ");
-            const result = `Applied patch to ${applied.files.length} file(s): ${paths}`;
-            const content = [textBlock(result)];
-            const displayPath = applied.files.length === 1
-                ? applied.files[0]?.path
-                : `${applied.files.length} files`;
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: "apply_patch",
-                workspaceId,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                content,
-                _meta: {
-                    tool: "apply_patch",
-                    card: {
+                invocation: workspaceHookInvocation(workspace),
+                payload: { patchBytes: Buffer.byteLength(patch) },
+                changedPaths: (response) => Array.from(new Set(response.structuredContent.files.flatMap((file) => [file.previousPath, file.path])
+                    .filter((path) => Boolean(path)))),
+                operation: async () => {
+                    const startedAt = performance.now();
+                    const applied = await applyPatch(workspace.root, patch);
+                    const paths = applied.files.map((file) => file.path).join(", ");
+                    const result = `Applied patch to ${applied.files.length} file(s): ${paths}`;
+                    const content = [textBlock(result)];
+                    const displayPath = applied.files.length === 1
+                        ? applied.files[0]?.path
+                        : `${applied.files.length} files`;
+                    logToolCall(config, {
+                        tool: "apply_patch",
                         workspaceId,
-                        path: displayPath,
-                        summary: {
-                            files: applied.files.length,
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        content,
+                        _meta: {
+                            tool: "apply_patch",
+                            card: {
+                                workspaceId,
+                                path: displayPath,
+                                summary: {
+                                    files: applied.files.length,
+                                    additions: applied.additions,
+                                    removals: applied.removals,
+                                },
+                                files: applied.files,
+                                payload: { patch: applied.patch },
+                            },
+                        },
+                        structuredContent: {
+                            result,
                             additions: applied.additions,
                             removals: applied.removals,
+                            files: applied.files,
                         },
-                        files: applied.files,
-                        payload: { patch: applied.patch },
-                    },
+                    };
                 },
-                structuredContent: {
-                    result,
-                    additions: applied.additions,
-                    removals: applied.removals,
-                    files: applied.files,
-                },
-            };
+            });
         });
     }
     if (config.widgets === "changes") {
@@ -1057,37 +1141,43 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             ...toolWidgetDescriptorMeta(config, "show_changes"),
             annotations: { readOnlyHint: true },
         }, async ({ workspaceId }) => {
-            const startedAt = performance.now();
             const workspace = workspaces.getWorkspace(workspaceId);
-            const review = await reviewCheckpoints.reviewChanges({
-                workspaceId,
-                root: workspace.root,
-                markReviewed: true,
-            });
-            const content = [textBlock(review.result)];
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: "show_changes",
-                workspaceId,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                content,
-                _meta: {
-                    tool: "show_changes",
-                    card: {
+                invocation: workspaceHookInvocation(workspace),
+                operation: async () => {
+                    const startedAt = performance.now();
+                    const review = await reviewCheckpoints.reviewChanges({
+                        workspaceId,
+                        root: workspace.root,
+                        markReviewed: true,
+                    });
+                    const content = [textBlock(review.result)];
+                    logToolCall(config, {
+                        tool: "show_changes",
                         workspaceId,
-                        summary: review.summary,
-                        files: review.files,
-                        payload: {
-                            patch: review.patch,
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        content,
+                        _meta: {
+                            tool: "show_changes",
+                            card: {
+                                workspaceId,
+                                summary: review.summary,
+                                files: review.files,
+                                payload: {
+                                    patch: review.patch,
+                                },
+                            },
                         },
-                    },
-                },
-                structuredContent: {
-                    result: contentText(content),
+                        structuredContent: {
+                            result: contentText(content),
+                        },
+                    };
                 },
-            };
+            });
         });
     }
     if (config.toolMode === "full") {
@@ -1109,49 +1199,57 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             ...toolWidgetDescriptorMeta(config, "search"),
             annotations: { readOnlyHint: true },
         }, async ({ workspaceId, ...input }) => {
-            const startedAt = performance.now();
             const workspace = workspaces.getWorkspace(workspaceId);
-            if (input.path)
-                workspaces.resolvePath(workspace, input.path);
-            const response = await grepFilesTool(input, {
-                cwd: workspace.root,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.grep,
-                    workspaceId,
-                    path: input.path,
-                }, response.content, startedAt);
-                return response;
-            }
-            const summary = {
-                pattern: input.pattern,
-                scope: input.path ?? ".",
-                ...textSummary(response.content),
-            };
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.grep,
-                workspaceId,
-                path: input.path,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                ...response,
-                _meta: {
-                    tool: toolNames.grep,
-                    card: {
+                invocation: workspaceHookInvocation(workspace),
+                payload: { pattern: input.pattern, path: input.path, include: input.include },
+                isFailure: toolResultIsError,
+                operation: async () => {
+                    const startedAt = performance.now();
+                    if (input.path)
+                        workspaces.resolvePath(workspace, input.path);
+                    const response = await grepFilesTool(input, {
+                        cwd: workspace.root,
+                        root: workspace.root,
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.grep,
+                            workspaceId,
+                            path: input.path,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const summary = {
+                        pattern: input.pattern,
+                        scope: input.path ?? ".",
+                        ...textSummary(response.content),
+                    };
+                    logToolCall(config, {
+                        tool: toolNames.grep,
                         workspaceId,
                         path: input.path,
-                        summary,
-                        payload: { content: response.content },
-                    },
-                },
-                structuredContent: {
-                    result: contentText(response.content),
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        ...response,
+                        _meta: {
+                            tool: toolNames.grep,
+                            card: {
+                                workspaceId,
+                                path: input.path,
+                                summary,
+                                payload: { content: response.content },
+                            },
+                        },
+                        structuredContent: {
+                            result: contentText(response.content),
+                        },
+                    };
                 },
-            };
+            });
         });
         registerAppTool(server, toolNames.glob, {
             title: "Glob",
@@ -1170,49 +1268,57 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             ...toolWidgetDescriptorMeta(config, "search"),
             annotations: { readOnlyHint: true },
         }, async ({ workspaceId, ...input }) => {
-            const startedAt = performance.now();
             const workspace = workspaces.getWorkspace(workspaceId);
-            if (input.path)
-                workspaces.resolvePath(workspace, input.path);
-            const response = await findFilesTool(input, {
-                cwd: workspace.root,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.glob,
-                    workspaceId,
-                    path: input.path,
-                }, response.content, startedAt);
-                return response;
-            }
-            const summary = {
-                pattern: input.pattern,
-                scope: input.path ?? ".",
-                ...textSummary(response.content),
-            };
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.glob,
-                workspaceId,
-                path: input.path,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                ...response,
-                _meta: {
-                    tool: toolNames.glob,
-                    card: {
+                invocation: workspaceHookInvocation(workspace),
+                payload: { pattern: input.pattern, path: input.path },
+                isFailure: toolResultIsError,
+                operation: async () => {
+                    const startedAt = performance.now();
+                    if (input.path)
+                        workspaces.resolvePath(workspace, input.path);
+                    const response = await findFilesTool(input, {
+                        cwd: workspace.root,
+                        root: workspace.root,
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.glob,
+                            workspaceId,
+                            path: input.path,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const summary = {
+                        pattern: input.pattern,
+                        scope: input.path ?? ".",
+                        ...textSummary(response.content),
+                    };
+                    logToolCall(config, {
+                        tool: toolNames.glob,
                         workspaceId,
                         path: input.path,
-                        summary,
-                        payload: { content: response.content },
-                    },
-                },
-                structuredContent: {
-                    result: contentText(response.content),
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        ...response,
+                        _meta: {
+                            tool: toolNames.glob,
+                            card: {
+                                workspaceId,
+                                path: input.path,
+                                summary,
+                                payload: { content: response.content },
+                            },
+                        },
+                        structuredContent: {
+                            result: contentText(response.content),
+                        },
+                    };
                 },
-            };
+            });
         });
         registerAppTool(server, toolNames.ls, {
             title: "Ls",
@@ -1229,44 +1335,52 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             ...toolWidgetDescriptorMeta(config, "directory"),
             annotations: { readOnlyHint: true },
         }, async ({ workspaceId, ...input }) => {
-            const startedAt = performance.now();
             const workspace = workspaces.getWorkspace(workspaceId);
-            workspaces.resolvePath(workspace, input.path);
-            const response = await listDirectoryTool(input, {
-                cwd: workspace.root,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.ls,
-                    workspaceId,
-                    path: input.path,
-                }, response.content, startedAt);
-                return response;
-            }
-            const summary = textSummary(response.content);
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.ls,
-                workspaceId,
-                path: input.path,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                ...response,
-                _meta: {
-                    tool: toolNames.ls,
-                    card: {
+                invocation: workspaceHookInvocation(workspace),
+                payload: { path: input.path },
+                isFailure: toolResultIsError,
+                operation: async () => {
+                    const startedAt = performance.now();
+                    workspaces.resolvePath(workspace, input.path);
+                    const response = await listDirectoryTool(input, {
+                        cwd: workspace.root,
+                        root: workspace.root,
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.ls,
+                            workspaceId,
+                            path: input.path,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const summary = textSummary(response.content);
+                    logToolCall(config, {
+                        tool: toolNames.ls,
                         workspaceId,
                         path: input.path,
-                        summary,
-                        payload: { content: response.content },
-                    },
-                },
-                structuredContent: {
-                    result: contentText(response.content),
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        ...response,
+                        _meta: {
+                            tool: toolNames.ls,
+                            card: {
+                                workspaceId,
+                                path: input.path,
+                                summary,
+                                payload: { content: response.content },
+                            },
+                        },
+                        structuredContent: {
+                            result: contentText(response.content),
+                        },
+                    };
                 },
-            };
+            });
         });
     }
     if (config.toolMode !== "codex") {
@@ -1295,61 +1409,74 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             ...toolWidgetDescriptorMeta(config, "shell"),
             annotations: SHELL_TOOL_ANNOTATIONS,
         }, async ({ workspaceId, workingDirectory, ...input }) => {
-            const startedAt = performance.now();
             const workspace = workspaces.getWorkspace(workspaceId);
-            const cwd = workspaces.resolveWorkingDirectory(workspace, workingDirectory);
-            const response = await runShellTool(input, {
-                cwd,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.shell,
-                    workspaceId,
-                    workingDirectory: workingDirectory ?? ".",
-                    command: input.command,
-                    commandLength: input.command.length,
-                }, response.content, startedAt);
-                return response;
-            }
-            const summary = {
-                command: input.command,
-                workingDirectory: workingDirectory ?? ".",
-                ...textSummary(response.content),
-            };
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.shell,
-                workspaceId,
-                workingDirectory: workingDirectory ?? ".",
-                command: input.command,
-                commandLength: input.command.length,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                ...response,
-                _meta: {
-                    tool: toolNames.shell,
-                    card: {
-                        workspaceId,
-                        path: workingDirectory,
-                        summary,
-                        payload: { content: response.content },
-                    },
+                invocation: workspaceHookInvocation(workspace),
+                payload: {
+                    command: input.command,
+                    workingDirectory: workingDirectory ?? ".",
+                    timeoutSeconds: input.timeout,
                 },
-                structuredContent: {
-                    result: contentText(response.content),
+                isFailure: toolResultIsError,
+                operation: async () => {
+                    const startedAt = performance.now();
+                    const cwd = workspaces.resolveWorkingDirectory(workspace, workingDirectory);
+                    const response = await runShellTool(input, {
+                        cwd,
+                        root: workspace.root,
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.shell,
+                            workspaceId,
+                            workingDirectory: workingDirectory ?? ".",
+                            command: input.command,
+                            commandLength: input.command.length,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const summary = {
+                        command: input.command,
+                        workingDirectory: workingDirectory ?? ".",
+                        ...textSummary(response.content),
+                    };
+                    logToolCall(config, {
+                        tool: toolNames.shell,
+                        workspaceId,
+                        workingDirectory: workingDirectory ?? ".",
+                        command: input.command,
+                        commandLength: input.command.length,
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        ...response,
+                        _meta: {
+                            tool: toolNames.shell,
+                            card: {
+                                workspaceId,
+                                path: workingDirectory,
+                                summary,
+                                payload: { content: response.content },
+                            },
+                        },
+                        structuredContent: {
+                            result: contentText(response.content),
+                        },
+                    };
                 },
-            };
+            });
         });
     }
     if (config.toolMode === "codex") {
-        registerCodexProcessTools(server, config, workspaces, processSessions);
+        registerCodexProcessTools(server, config, workspaces, processSessions, hooks);
     }
     if (config.artifactsEnabled && isArtifactDownloadSupportedPlatform()) {
         registerArtifactTools(server, {
             config,
             workspaces,
+            hooks,
             incomingArtifactAdapters,
         });
     }