@akira-tl/forgerelay 0.1.1 → 0.2.1

package/dist/server.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { access, realpath } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
@@ -15,9 +16,10 @@ import * as z from "zod/v4";
 import { applyPatch } from "./apply-patch.js";
 import { isArtifactDownloadSupportedPlatform, registerArtifactTools, } from "./artifact-tools.js";
 import { loadConfig } from "./config.js";
+import { attachHookReports, HookRunner, runToolWithHooks } from "./hooks.js";
 import { buildServerInstructions, buildToolDescriptions, toolNames, } from "./mcp/server-instructions.js";
 import { createOpenAIIncomingArtifactAdapter, } from "./incoming-artifacts.js";
-import { logEvent, requestIp, requestPath, commandPreview, sessionIdPrefix, } from "./logger.js";
+import { logEvent, requestIp, requestPath, commandPreview, sessionIdPrefix, workspaceLogLabel, } from "./logger.js";
 import { editFileTool, findFilesTool, grepFilesTool, listDirectoryTool, readFileTool, runShellTool, writeFileTool, } from "./pi-tools.js";
 import { SingleUserOAuthProvider } from "./oauth-provider.js";
 import { McpSessionRegistry, } from "./mcp-sessions.js";
@@ -33,6 +35,7 @@ import { formatLocalAgentProviderAvailabilitySummary, getLocalAgentProviderAvail
 // MCP clients can reconnect without closing the previous transport. Bound stale
 // session retention so abandoned MCP servers do not accumulate for the life of the process.
 const MCP_SESSION_IDLE_TIMEOUT_MS = 24 * 60 * 60 * 1_000;
+const FORGERELAY_VERSION = readForgeRelayVersion();
 const MCP_SESSION_CLEANUP_INTERVAL_MS = 5 * 60 * 1_000;
 const WORKSPACE_APP_URI = "ui://forgerelay/workspace-app.html";
 const WORKSPACE_APP_MANIFEST_ENTRY = "workspace-app.html";
@@ -76,6 +79,13 @@ function toolWidgetDescriptorMeta(config, kind) {
         },
     };
 }
+function workspaceLogContext(workspace, sessionId) {
+    return {
+        workspaceId: workspace.id,
+        workspace: workspaceLogLabel(workspace.root, workspace.id),
+        session: sessionIdPrefix(sessionId),
+    };
+}
 function formatVisibleAgent(agent) {
     const model = agent.model ? `, model ${agent.model}` : "";
     const thinking = agent.thinking ? `, thinking ${agent.thinking}` : "";
@@ -313,6 +323,13 @@ function processOutputSchema() {
         outputTruncated: z.boolean(),
     });
 }
+function readForgeRelayVersion() {
+    const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    if (typeof packageJson.version !== "string" || packageJson.version.length === 0) {
+        throw new Error("Unable to read ForgeRelay package version.");
+    }
+    return packageJson.version;
+}
 function processToolResponse(tool, workspaceId, snapshot, summary) {
     const result = processResult(snapshot);
     const content = [textBlock(result)];
@@ -338,7 +355,18 @@ function processToolResponse(tool, workspaceId, snapshot, summary) {
         },
     };
 }
-function registerCodexProcessTools(server, config, workspaces, processSessions) {
+function workspaceHookInvocation(workspace) {
+    return {
+        workspaceId: workspace.id,
+        workspaceRoot: workspace.root,
+        workspaceMode: workspace.mode,
+        sourceRoot: workspace.sourceRoot,
+    };
+}
+function toolResultIsError(result) {
+    return typeof result === "object" && result !== null && result.isError === true;
+}
+function registerCodexProcessTools(server, config, workspaces, processSessions, hooks) {
     registerAppTool(server, "exec_command", {
         title: "Execute command",
         description: "Run a command inside an open workspace. Returns its result when it exits during the yield window, otherwise returns a sessionId for write_stdin. Use this for file inspection, tests, builds, package scripts, and long-running processes. Call open_workspace first and pass workspaceId.",
@@ -373,36 +401,46 @@ function registerCodexProcessTools(server, config, workspaces, processSessions)
         outputSchema: processOutputSchema(),
         ...toolWidgetDescriptorMeta(config, "shell"),
         annotations: SHELL_TOOL_ANNOTATIONS,
-    }, async ({ workspaceId, cmd, tty, columns, rows, workingDirectory, yieldTimeMs, maxOutputTokens }) => {
-        const startedAt = performance.now();
+    }, async ({ workspaceId, cmd, tty, columns, rows, workingDirectory, yieldTimeMs, maxOutputTokens }, extra) => {
         const workspace = workspaces.getWorkspace(workspaceId);
-        const cwd = workspaces.resolveWorkingDirectory(workspace, workingDirectory);
-        const snapshot = await processSessions.start({
-            workspaceId,
-            command: cmd,
-            cwd,
-            workspaceRoot: workspace.root,
-            tty,
-            columns,
-            rows,
-            yieldTimeMs,
-            maxOutputTokens,
-        });
-        logToolCall(config, {
+        return runToolWithHooks(hooks, {
             tool: "exec_command",
-            workspaceId,
-            workingDirectory: workingDirectory ?? ".",
-            command: cmd,
-            commandLength: cmd.length,
-            success: true,
-            durationMs: Math.round(performance.now() - startedAt),
-        });
-        return processToolResponse("exec_command", workspaceId, snapshot, {
-            command: cmd,
-            workingDirectory: workingDirectory ?? ".",
-            running: snapshot.running,
-            exitCode: snapshot.exitCode,
-            wallTimeMs: snapshot.wallTimeMs,
+            invocation: workspaceHookInvocation(workspace),
+            payload: { command: cmd, workingDirectory: workingDirectory ?? "." },
+            operation: async () => {
+                const startedAt = performance.now();
+                const cwd = workspaces.resolveWorkingDirectory(workspace, workingDirectory);
+                const snapshot = await processSessions.start({
+                    workspaceId,
+                    command: cmd,
+                    cwd,
+                    workspaceRoot: workspace.root,
+                    tty,
+                    columns,
+                    rows,
+                    yieldTimeMs,
+                    maxOutputTokens,
+                });
+                logToolCall(config, {
+                    tool: "exec_command",
+                    ...workspaceLogContext(workspace, extra.sessionId),
+                    workingDirectory: workingDirectory ?? ".",
+                    command: cmd,
+                    commandLength: cmd.length,
+                    exitCode: snapshot.exitCode,
+                    running: snapshot.running,
+                    processSessionId: snapshot.sessionId,
+                    success: snapshot.running || snapshot.exitCode === 0,
+                    durationMs: Math.round(performance.now() - startedAt),
+                });
+                return processToolResponse("exec_command", workspaceId, snapshot, {
+                    command: cmd,
+                    workingDirectory: workingDirectory ?? ".",
+                    running: snapshot.running,
+                    exitCode: snapshot.exitCode,
+                    wallTimeMs: snapshot.wallTimeMs,
+                });
+            },
         });
     });
     registerAppTool(server, "write_stdin", {
@@ -432,39 +470,55 @@ function registerCodexProcessTools(server, config, workspaces, processSessions)
         outputSchema: processOutputSchema(),
         ...toolWidgetDescriptorMeta(config, "shell"),
         annotations: SHELL_TOOL_ANNOTATIONS,
-    }, async ({ workspaceId, sessionId, chars, columns, rows, yieldTimeMs, maxOutputTokens }) => {
-        const startedAt = performance.now();
-        workspaces.getWorkspace(workspaceId);
-        const snapshot = await processSessions.write({
-            workspaceId,
-            sessionId,
-            chars,
-            columns,
-            rows,
-            yieldTimeMs,
-            maxOutputTokens,
-        });
-        logToolCall(config, {
+    }, async ({ workspaceId, sessionId, chars, columns, rows, yieldTimeMs, maxOutputTokens }, extra) => {
+        const workspace = workspaces.getWorkspace(workspaceId);
+        return runToolWithHooks(hooks, {
             tool: "write_stdin",
-            workspaceId,
-            success: true,
-            durationMs: Math.round(performance.now() - startedAt),
-        });
-        return processToolResponse("write_stdin", workspaceId, snapshot, {
-            sessionId,
-            charactersWritten: chars?.length ?? 0,
-            running: snapshot.running,
-            exitCode: snapshot.exitCode,
-            wallTimeMs: snapshot.wallTimeMs,
+            invocation: workspaceHookInvocation(workspace),
+            payload: {
+                sessionId,
+                charactersWritten: chars?.length ?? 0,
+                columns,
+                rows,
+            },
+            operation: async () => {
+                const startedAt = performance.now();
+                const snapshot = await processSessions.write({
+                    workspaceId,
+                    sessionId,
+                    chars,
+                    columns,
+                    rows,
+                    yieldTimeMs,
+                    maxOutputTokens,
+                });
+                logToolCall(config, {
+                    tool: "write_stdin",
+                    ...workspaceLogContext(workspace, extra.sessionId),
+                    exitCode: snapshot.exitCode,
+                    running: snapshot.running,
+                    processSessionId: snapshot.sessionId,
+                    success: snapshot.running || snapshot.exitCode === 0,
+                    durationMs: Math.round(performance.now() - startedAt),
+                });
+                return processToolResponse("write_stdin", workspaceId, snapshot, {
+                    sessionId,
+                    charactersWritten: chars?.length ?? 0,
+                    running: snapshot.running,
+                    exitCode: snapshot.exitCode,
+                    wallTimeMs: snapshot.wallTimeMs,
+                });
+            },
         });
     });
 }
 export function createMcpServer(config, workspaces, reviewCheckpoints, processSessions, localAgentProviders, incomingArtifactAdapters) {
     const toolDescriptions = buildToolDescriptions(config);
+    const hooks = new HookRunner(config.hooks, config.logging);
     const server = new McpServer({
         name: "forgerelay",
         title: "ForgeRelay",
-        version: "0.1.0",
+        version: FORGERELAY_VERSION,
         description: "Secure local coding workspace for MCP clients. Provides workspace-scoped file, search, edit, write, and shell tools.",
     }, {
         instructions: buildServerInstructions(config, {
@@ -557,9 +611,9 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             idempotentHint: false,
             openWorldHint: false,
         },
-    }, async ({ path, mode, baseRef, newWorktree }, { _meta }) => {
+    }, async ({ path, mode, baseRef, newWorktree }, { _meta, sessionId }) => {
         const startedAt = performance.now();
-        const { workspace, agentsFiles, availableAgentsFiles, workspaceReused, includeBootstrapContext, } = await workspaces.openWorkspace({ path, mode, baseRef, newWorktree }, { conversationScopeId: openAiConversationScopeId(_meta) });
+        const { workspace, agentsFiles, availableAgentsFiles, hookReports, workspaceReused, includeBootstrapContext, } = await workspaces.openWorkspace({ path, mode, baseRef, newWorktree }, { conversationScopeId: openAiConversationScopeId(_meta) });
         const knownWorktrees = await workspaces.listKnownWorktrees(workspace);
         if (config.widgets === "changes") {
             await reviewCheckpoints.initializeWorkspace({
@@ -652,12 +706,12 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         ];
         logToolCall(config, {
             tool: "open_workspace",
-            workspaceId: workspace.id,
+            ...workspaceLogContext(workspace, sessionId),
             path: workspace.root,
             success: true,
             durationMs: Math.round(performance.now() - startedAt),
         });
-        return {
+        return attachHookReports({
             content: resultContent,
             _meta: {
                 tool: "open_workspace",
@@ -706,7 +760,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                     : {}),
                 instruction,
             },
-        };
+        }, hookReports);
     });
     registerAppTool(server, toolNames.closeWorktree, {
         title: "Close worktree",
@@ -732,39 +786,48 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         }),
         _meta: {},
         annotations: WRITE_TOOL_ANNOTATIONS,
-    }, async ({ workspaceId, commitMessage }) => {
-        const startedAt = performance.now();
-        const closed = await workspaces.closeWorktree(workspaceId, commitMessage);
-        const result = [
-            `Closed managed worktree ${workspaceId}.`,
-            `Merged ${closed.branch} into ${closed.targetBranch} by fast-forward.`,
-            `Source checkout: ${closed.sourceRoot}`,
-            `Commit: ${closed.commitSha}`,
-            closed.cleanupWarning
-                ? `Cleanup warning: ${closed.cleanupWarning}`
-                : "The worktree directory and managed branch were removed.",
-        ].join("\n");
-        logToolCall(config, {
+    }, async ({ workspaceId, commitMessage }, extra) => {
+        const workspace = workspaces.getWorkspace(workspaceId);
+        return runToolWithHooks(hooks, {
             tool: toolNames.closeWorktree,
-            workspaceId,
-            path: closed.sourceRoot,
-            success: true,
-            durationMs: Math.round(performance.now() - startedAt),
-        });
-        return {
-            content: [{ type: "text", text: result }],
-            structuredContent: {
-                result,
-                workspaceId,
-                sourceRoot: closed.sourceRoot,
-                branch: closed.branch,
-                targetBranch: closed.targetBranch,
-                commitSha: closed.commitSha,
-                mergedSha: closed.mergedSha,
-                committed: closed.committed,
-                cleanupWarning: closed.cleanupWarning,
+            invocation: workspaceHookInvocation(workspace),
+            payload: { commitMessage },
+            afterCwd: (response) => response.structuredContent.sourceRoot,
+            operation: async () => {
+                const startedAt = performance.now();
+                const closed = await workspaces.closeWorktree(workspaceId, commitMessage);
+                const result = [
+                    `Closed managed worktree ${workspaceId}.`,
+                    `Merged ${closed.branch} into ${closed.targetBranch} by fast-forward.`,
+                    `Source checkout: ${closed.sourceRoot}`,
+                    `Commit: ${closed.commitSha}`,
+                    closed.cleanupWarning
+                        ? `Cleanup warning: ${closed.cleanupWarning}`
+                        : "The worktree directory and managed branch were removed.",
+                ].join("\n");
+                logToolCall(config, {
+                    tool: toolNames.closeWorktree,
+                    ...workspaceLogContext(workspace, extra.sessionId),
+                    path: closed.sourceRoot,
+                    success: true,
+                    durationMs: Math.round(performance.now() - startedAt),
+                });
+                return attachHookReports({
+                    content: [{ type: "text", text: result }],
+                    structuredContent: {
+                        result,
+                        workspaceId,
+                        sourceRoot: closed.sourceRoot,
+                        branch: closed.branch,
+                        targetBranch: closed.targetBranch,
+                        commitSha: closed.commitSha,
+                        mergedSha: closed.mergedSha,
+                        committed: closed.committed,
+                        cleanupWarning: closed.cleanupWarning,
+                    },
+                }, closed.hookReports);
             },
-        };
+        });
     });
     registerAppTool(server, toolNames.read, {
         title: "Read file",
@@ -776,8 +839,8 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             path: z
                 .string()
                 .describe(config.skillsEnabled
-                ? "File path to read, relative to the workspace root. May also be an advertised skill path from open_workspace skills."
-                : "File path to read, relative to the workspace root."),
+                ? "File path to read, relative to the workspace root or absolute inside the OS temp directory. May also be an advertised skill path from open_workspace skills."
+                : "File path to read, relative to the workspace root or absolute inside the OS temp directory."),
             offset: z
                 .number()
                 .int()
@@ -794,51 +857,59 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         outputSchema: resultOutputSchema(),
         ...toolWidgetDescriptorMeta(config, "read"),
         annotations: { readOnlyHint: true },
-    }, async ({ workspaceId, ...input }) => {
-        const startedAt = performance.now();
+    }, async ({ workspaceId, ...input }, extra) => {
         const workspace = workspaces.getWorkspace(workspaceId);
-        const readPath = workspaces.resolveReadPath(workspace, input.path);
-        const response = await readFileTool({ ...input, path: readPath.absolutePath }, {
-            cwd: workspace.root,
-            root: workspace.root,
-            readRoots: readPath.readRoots,
-        });
-        if (response.isError) {
-            logFailedToolResponse(config, {
-                tool: toolNames.read,
-                workspaceId,
-                path: input.path,
-            }, response.content, startedAt);
-            return response;
-        }
-        workspaces.markReadPathLoaded(workspace, readPath);
-        const summary = {
-            ...textSummary(response.content),
-            offset: input.offset ?? 1,
-            limited: input.limit !== undefined,
-        };
-        logToolCall(config, {
+        return runToolWithHooks(hooks, {
             tool: toolNames.read,
-            workspaceId,
-            path: input.path,
-            success: true,
-            durationMs: Math.round(performance.now() - startedAt),
-        });
-        return {
-            ...response,
-            _meta: {
-                tool: toolNames.read,
-                card: {
-                    workspaceId,
+            invocation: workspaceHookInvocation(workspace),
+            payload: { path: input.path, offset: input.offset, limit: input.limit },
+            isFailure: toolResultIsError,
+            operation: async () => {
+                const startedAt = performance.now();
+                const readPath = workspaces.resolveReadPath(workspace, input.path);
+                const response = await readFileTool({ ...input, path: readPath.absolutePath }, {
+                    cwd: workspace.root,
+                    root: workspace.root,
+                    readRoots: readPath.readRoots,
+                });
+                if (response.isError) {
+                    logFailedToolResponse(config, {
+                        tool: toolNames.read,
+                        ...workspaceLogContext(workspace, extra.sessionId),
+                        path: input.path,
+                    }, response.content, startedAt);
+                    return response;
+                }
+                workspaces.markReadPathLoaded(workspace, readPath);
+                const summary = {
+                    ...textSummary(response.content),
+                    offset: input.offset ?? 1,
+                    limited: input.limit !== undefined,
+                };
+                logToolCall(config, {
+                    tool: toolNames.read,
+                    ...workspaceLogContext(workspace, extra.sessionId),
                     path: input.path,
-                    summary,
-                    payload: { content: response.content },
-                },
-            },
-            structuredContent: {
-                result: contentText(response.content),
+                    success: true,
+                    durationMs: Math.round(performance.now() - startedAt),
+                });
+                return {
+                    ...response,
+                    _meta: {
+                        tool: toolNames.read,
+                        card: {
+                            workspaceId,
+                            path: input.path,
+                            summary,
+                            payload: { content: response.content },
+                        },
+                    },
+                    structuredContent: {
+                        result: contentText(response.content),
+                    },
+                };
             },
-        };
+        });
     });
     if (config.toolMode !== "codex") {
         registerAppTool(server, toolNames.write, {
@@ -850,60 +921,69 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                     .describe("Workspace identifier returned by open_workspace."),
                 path: z
                     .string()
-                    .describe("File path to write, relative to the workspace root."),
+                    .describe("File path to write, relative to the workspace root or absolute inside the OS temp directory."),
                 content: z.string().describe("Complete new file content."),
             },
             outputSchema: resultOutputSchema(),
             ...toolWidgetDescriptorMeta(config, "write"),
             annotations: WRITE_TOOL_ANNOTATIONS,
-        }, async ({ workspaceId, ...input }) => {
-            const startedAt = performance.now();
+        }, async ({ workspaceId, ...input }, extra) => {
             const workspace = workspaces.getWorkspace(workspaceId);
-            workspaces.resolvePath(workspace, input.path);
-            const response = await writeFileTool(input, {
-                cwd: workspace.root,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.write,
-                    workspaceId,
-                    path: input.path,
-                }, response.content, startedAt);
-                return response;
-            }
-            const patch = newFilePatch(input.path, input.content);
-            const stats = countDiffStats(patch);
-            const summary = {
-                ...stats,
-                lines: contentLineCount(input.content),
-                characters: input.content.length,
-            };
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.write,
-                workspaceId,
-                path: input.path,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                ...response,
-                _meta: {
-                    tool: toolNames.write,
-                    card: {
-                        workspaceId,
+                invocation: workspaceHookInvocation(workspace),
+                payload: { path: input.path },
+                isFailure: toolResultIsError,
+                changedPaths: (result) => toolResultIsError(result) ? [] : [input.path],
+                operation: async () => {
+                    const startedAt = performance.now();
+                    const response = await writeFileTool(input, {
+                        cwd: workspace.root,
+                        root: workspace.root,
+                        fileRoots: workspaces.fileToolRoots(workspace),
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.write,
+                            ...workspaceLogContext(workspace, extra.sessionId),
+                            path: input.path,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const patch = newFilePatch(input.path, input.content);
+                    const stats = countDiffStats(patch);
+                    const summary = {
+                        ...stats,
+                        lines: contentLineCount(input.content),
+                        characters: input.content.length,
+                    };
+                    logToolCall(config, {
+                        tool: toolNames.write,
+                        ...workspaceLogContext(workspace, extra.sessionId),
                         path: input.path,
-                        summary,
-                        payload: {
-                            content: response.content,
-                            patch,
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        ...response,
+                        _meta: {
+                            tool: toolNames.write,
+                            card: {
+                                workspaceId,
+                                path: input.path,
+                                summary,
+                                payload: {
+                                    content: response.content,
+                                    patch,
+                                },
+                            },
                         },
-                    },
-                },
-                structuredContent: {
-                    result: contentText(response.content),
+                        structuredContent: {
+                            result: contentText(response.content),
+                        },
+                    };
                 },
-            };
+            });
         });
         registerAppTool(server, toolNames.edit, {
             title: "Edit file",
@@ -914,7 +994,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                     .describe("Workspace identifier returned by open_workspace."),
                 path: z
                     .string()
-                    .describe("File path to edit, relative to the workspace root."),
+                    .describe("File path to edit, relative to the workspace root or absolute inside the OS temp directory."),
                 edits: z
                     .array(z.object({
                     oldText: z
@@ -929,55 +1009,64 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             }),
             ...toolWidgetDescriptorMeta(config, "edit"),
             annotations: EDIT_TOOL_ANNOTATIONS,
-        }, async ({ workspaceId, ...input }) => {
-            const startedAt = performance.now();
+        }, async ({ workspaceId, ...input }, extra) => {
             const workspace = workspaces.getWorkspace(workspaceId);
-            workspaces.resolvePath(workspace, input.path);
-            const response = await editFileTool(input, {
-                cwd: workspace.root,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.edit,
-                    workspaceId,
-                    path: input.path,
-                }, response.content, startedAt);
-                return response;
-            }
-            const stats = countDiffStats(response.details?.patch ?? response.details?.diff);
-            const summary = {
-                ...stats,
-                editCount: input.edits.length,
-            };
-            const editResultText = `Edited ${input.path} (+${stats.additions} -${stats.removals}).`;
-            const editContent = [textBlock(editResultText)];
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.edit,
-                workspaceId,
-                path: input.path,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                content: editContent,
-                _meta: {
-                    tool: toolNames.edit,
-                    card: {
-                        workspaceId,
+                invocation: workspaceHookInvocation(workspace),
+                payload: { path: input.path, editCount: input.edits.length },
+                isFailure: toolResultIsError,
+                changedPaths: (result) => toolResultIsError(result) ? [] : [input.path],
+                operation: async () => {
+                    const startedAt = performance.now();
+                    const response = await editFileTool(input, {
+                        cwd: workspace.root,
+                        root: workspace.root,
+                        fileRoots: workspaces.fileToolRoots(workspace),
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.edit,
+                            ...workspaceLogContext(workspace, extra.sessionId),
+                            path: input.path,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const stats = countDiffStats(response.details?.patch ?? response.details?.diff);
+                    const summary = {
+                        ...stats,
+                        editCount: input.edits.length,
+                    };
+                    const editResultText = `Edited ${input.path} (+${stats.additions} -${stats.removals}).`;
+                    const editContent = [textBlock(editResultText)];
+                    logToolCall(config, {
+                        tool: toolNames.edit,
+                        ...workspaceLogContext(workspace, extra.sessionId),
                         path: input.path,
-                        summary,
-                        payload: {
-                            diff: response.details?.diff,
-                            patch: response.details?.patch,
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        content: editContent,
+                        _meta: {
+                            tool: toolNames.edit,
+                            card: {
+                                workspaceId,
+                                path: input.path,
+                                summary,
+                                payload: {
+                                    diff: response.details?.diff,
+                                    patch: response.details?.patch,
+                                },
+                            },
                         },
-                    },
-                },
-                structuredContent: {
-                    status: "applied",
-                    result: contentText(editContent),
+                        structuredContent: {
+                            status: "applied",
+                            result: contentText(editContent),
+                        },
+                    };
                 },
-            };
+            });
         });
     }
     if (config.toolMode === "codex") {
@@ -1003,45 +1092,55 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             }),
             ...toolWidgetDescriptorMeta(config, "edit"),
             annotations: EDIT_TOOL_ANNOTATIONS,
-        }, async ({ workspaceId, patch }) => {
-            const startedAt = performance.now();
+        }, async ({ workspaceId, patch }, extra) => {
             const workspace = workspaces.getWorkspace(workspaceId);
-            const applied = await applyPatch(workspace.root, patch);
-            const paths = applied.files.map((file) => file.path).join(", ");
-            const result = `Applied patch to ${applied.files.length} file(s): ${paths}`;
-            const content = [textBlock(result)];
-            const displayPath = applied.files.length === 1
-                ? applied.files[0]?.path
-                : `${applied.files.length} files`;
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: "apply_patch",
-                workspaceId,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                content,
-                _meta: {
-                    tool: "apply_patch",
-                    card: {
-                        workspaceId,
+                invocation: workspaceHookInvocation(workspace),
+                payload: { patchBytes: Buffer.byteLength(patch) },
+                changedPaths: (response) => Array.from(new Set(response.structuredContent.files.flatMap((file) => [file.previousPath, file.path])
+                    .filter((path) => Boolean(path)))),
+                operation: async () => {
+                    const startedAt = performance.now();
+                    const applied = await applyPatch(workspace.root, patch, [tmpdir()]);
+                    const paths = applied.files.map((file) => file.path).join(", ");
+                    const result = `Applied patch to ${applied.files.length} file(s): ${paths}`;
+                    const content = [textBlock(result)];
+                    const displayPath = applied.files.length === 1
+                        ? applied.files[0]?.path
+                        : `${applied.files.length} files`;
+                    logToolCall(config, {
+                        tool: "apply_patch",
+                        ...workspaceLogContext(workspace, extra.sessionId),
                         path: displayPath,
-                        summary: {
-                            files: applied.files.length,
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        content,
+                        _meta: {
+                            tool: "apply_patch",
+                            card: {
+                                workspaceId,
+                                path: displayPath,
+                                summary: {
+                                    files: applied.files.length,
+                                    additions: applied.additions,
+                                    removals: applied.removals,
+                                },
+                                files: applied.files,
+                                payload: { patch: applied.patch },
+                            },
+                        },
+                        structuredContent: {
+                            result,
                             additions: applied.additions,
                             removals: applied.removals,
+                            files: applied.files,
                         },
-                        files: applied.files,
-                        payload: { patch: applied.patch },
-                    },
-                },
-                structuredContent: {
-                    result,
-                    additions: applied.additions,
-                    removals: applied.removals,
-                    files: applied.files,
+                    };
                 },
-            };
+            });
         });
     }
     if (config.widgets === "changes") {
@@ -1056,44 +1155,50 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             outputSchema: resultOutputSchema(),
             ...toolWidgetDescriptorMeta(config, "show_changes"),
             annotations: { readOnlyHint: true },
-        }, async ({ workspaceId }) => {
-            const startedAt = performance.now();
+        }, async ({ workspaceId }, extra) => {
             const workspace = workspaces.getWorkspace(workspaceId);
-            const review = await reviewCheckpoints.reviewChanges({
-                workspaceId,
-                root: workspace.root,
-                markReviewed: true,
-            });
-            const content = [textBlock(review.result)];
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: "show_changes",
-                workspaceId,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                content,
-                _meta: {
-                    tool: "show_changes",
-                    card: {
+                invocation: workspaceHookInvocation(workspace),
+                operation: async () => {
+                    const startedAt = performance.now();
+                    const review = await reviewCheckpoints.reviewChanges({
                         workspaceId,
-                        summary: review.summary,
-                        files: review.files,
-                        payload: {
-                            patch: review.patch,
+                        root: workspace.root,
+                        markReviewed: true,
+                    });
+                    const content = [textBlock(review.result)];
+                    logToolCall(config, {
+                        tool: "show_changes",
+                        ...workspaceLogContext(workspace, extra.sessionId),
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        content,
+                        _meta: {
+                            tool: "show_changes",
+                            card: {
+                                workspaceId,
+                                summary: review.summary,
+                                files: review.files,
+                                payload: {
+                                    patch: review.patch,
+                                },
+                            },
                         },
-                    },
-                },
-                structuredContent: {
-                    result: contentText(content),
+                        structuredContent: {
+                            result: contentText(content),
+                        },
+                    };
                 },
-            };
+            });
         });
     }
     if (config.toolMode === "full") {
         registerAppTool(server, toolNames.grep, {
             title: "Grep",
-            description: "Search file contents inside an open workspace. Use this before broad reads when looking for symbols, text, or usage sites. Respects project ignore rules. Call open_workspace first and pass workspaceId.",
+            description: "Search file contents inside an open workspace or the OS temp directory. Use this before broad reads when looking for symbols, text, or usage sites. Respects project ignore rules. Call open_workspace first and pass workspaceId.",
             inputSchema: {
                 workspaceId: z
                     .string()
@@ -1102,60 +1207,67 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                 path: z
                     .string()
                     .optional()
-                    .describe("Optional path or glob scope relative to the workspace root."),
+                    .describe("Optional path or glob scope relative to the workspace root, or an absolute path inside the OS temp directory."),
                 include: z.string().optional().describe("Optional include glob."),
             },
             outputSchema: resultOutputSchema(),
             ...toolWidgetDescriptorMeta(config, "search"),
             annotations: { readOnlyHint: true },
-        }, async ({ workspaceId, ...input }) => {
-            const startedAt = performance.now();
+        }, async ({ workspaceId, ...input }, extra) => {
             const workspace = workspaces.getWorkspace(workspaceId);
-            if (input.path)
-                workspaces.resolvePath(workspace, input.path);
-            const response = await grepFilesTool(input, {
-                cwd: workspace.root,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.grep,
-                    workspaceId,
-                    path: input.path,
-                }, response.content, startedAt);
-                return response;
-            }
-            const summary = {
-                pattern: input.pattern,
-                scope: input.path ?? ".",
-                ...textSummary(response.content),
-            };
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.grep,
-                workspaceId,
-                path: input.path,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                ...response,
-                _meta: {
-                    tool: toolNames.grep,
-                    card: {
-                        workspaceId,
+                invocation: workspaceHookInvocation(workspace),
+                payload: { pattern: input.pattern, path: input.path, include: input.include },
+                isFailure: toolResultIsError,
+                operation: async () => {
+                    const startedAt = performance.now();
+                    const response = await grepFilesTool(input, {
+                        cwd: workspace.root,
+                        root: workspace.root,
+                        fileRoots: workspaces.fileToolRoots(workspace),
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.grep,
+                            ...workspaceLogContext(workspace, extra.sessionId),
+                            path: input.path,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const summary = {
+                        pattern: input.pattern,
+                        scope: input.path ?? ".",
+                        ...textSummary(response.content),
+                    };
+                    logToolCall(config, {
+                        tool: toolNames.grep,
+                        ...workspaceLogContext(workspace, extra.sessionId),
                         path: input.path,
-                        summary,
-                        payload: { content: response.content },
-                    },
-                },
-                structuredContent: {
-                    result: contentText(response.content),
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        ...response,
+                        _meta: {
+                            tool: toolNames.grep,
+                            card: {
+                                workspaceId,
+                                path: input.path,
+                                summary,
+                                payload: { content: response.content },
+                            },
+                        },
+                        structuredContent: {
+                            result: contentText(response.content),
+                        },
+                    };
                 },
-            };
+            });
         });
         registerAppTool(server, toolNames.glob, {
             title: "Glob",
-            description: "Find files by glob pattern inside an open workspace. Use this to discover filenames or narrow file sets before reading. Respects project ignore rules. Call open_workspace first and pass workspaceId.",
+            description: "Find files by glob pattern inside an open workspace or the OS temp directory. Use this to discover filenames or narrow file sets before reading. Respects project ignore rules. Call open_workspace first and pass workspaceId.",
             inputSchema: {
                 workspaceId: z
                     .string()
@@ -1164,109 +1276,124 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                 path: z
                     .string()
                     .optional()
-                    .describe("Optional path scope relative to the workspace root."),
+                    .describe("Optional path scope relative to the workspace root, or an absolute path inside the OS temp directory."),
             },
             outputSchema: resultOutputSchema(),
             ...toolWidgetDescriptorMeta(config, "search"),
             annotations: { readOnlyHint: true },
-        }, async ({ workspaceId, ...input }) => {
-            const startedAt = performance.now();
+        }, async ({ workspaceId, ...input }, extra) => {
             const workspace = workspaces.getWorkspace(workspaceId);
-            if (input.path)
-                workspaces.resolvePath(workspace, input.path);
-            const response = await findFilesTool(input, {
-                cwd: workspace.root,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.glob,
-                    workspaceId,
-                    path: input.path,
-                }, response.content, startedAt);
-                return response;
-            }
-            const summary = {
-                pattern: input.pattern,
-                scope: input.path ?? ".",
-                ...textSummary(response.content),
-            };
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.glob,
-                workspaceId,
-                path: input.path,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                ...response,
-                _meta: {
-                    tool: toolNames.glob,
-                    card: {
-                        workspaceId,
+                invocation: workspaceHookInvocation(workspace),
+                payload: { pattern: input.pattern, path: input.path },
+                isFailure: toolResultIsError,
+                operation: async () => {
+                    const startedAt = performance.now();
+                    const response = await findFilesTool(input, {
+                        cwd: workspace.root,
+                        root: workspace.root,
+                        fileRoots: workspaces.fileToolRoots(workspace),
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.glob,
+                            ...workspaceLogContext(workspace, extra.sessionId),
+                            path: input.path,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const summary = {
+                        pattern: input.pattern,
+                        scope: input.path ?? ".",
+                        ...textSummary(response.content),
+                    };
+                    logToolCall(config, {
+                        tool: toolNames.glob,
+                        ...workspaceLogContext(workspace, extra.sessionId),
                         path: input.path,
-                        summary,
-                        payload: { content: response.content },
-                    },
-                },
-                structuredContent: {
-                    result: contentText(response.content),
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        ...response,
+                        _meta: {
+                            tool: toolNames.glob,
+                            card: {
+                                workspaceId,
+                                path: input.path,
+                                summary,
+                                payload: { content: response.content },
+                            },
+                        },
+                        structuredContent: {
+                            result: contentText(response.content),
+                        },
+                    };
                 },
-            };
+            });
         });
         registerAppTool(server, toolNames.ls, {
             title: "Ls",
-            description: "List a directory inside an open workspace. Use this for directory inspection before reading files. Call open_workspace first and pass workspaceId.",
+            description: "List a directory inside an open workspace or the OS temp directory. Use this for directory inspection before reading files. Call open_workspace first and pass workspaceId.",
             inputSchema: {
                 workspaceId: z
                     .string()
                     .describe("Workspace identifier returned by open_workspace."),
                 path: z
                     .string()
-                    .describe("Directory path to list, relative to the workspace root."),
+                    .describe("Directory path to list, relative to the workspace root or absolute inside the OS temp directory."),
             },
             outputSchema: resultOutputSchema(),
             ...toolWidgetDescriptorMeta(config, "directory"),
             annotations: { readOnlyHint: true },
-        }, async ({ workspaceId, ...input }) => {
-            const startedAt = performance.now();
+        }, async ({ workspaceId, ...input }, extra) => {
             const workspace = workspaces.getWorkspace(workspaceId);
-            workspaces.resolvePath(workspace, input.path);
-            const response = await listDirectoryTool(input, {
-                cwd: workspace.root,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.ls,
-                    workspaceId,
-                    path: input.path,
-                }, response.content, startedAt);
-                return response;
-            }
-            const summary = textSummary(response.content);
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.ls,
-                workspaceId,
-                path: input.path,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                ...response,
-                _meta: {
-                    tool: toolNames.ls,
-                    card: {
-                        workspaceId,
+                invocation: workspaceHookInvocation(workspace),
+                payload: { path: input.path },
+                isFailure: toolResultIsError,
+                operation: async () => {
+                    const startedAt = performance.now();
+                    const response = await listDirectoryTool(input, {
+                        cwd: workspace.root,
+                        root: workspace.root,
+                        fileRoots: workspaces.fileToolRoots(workspace),
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.ls,
+                            ...workspaceLogContext(workspace, extra.sessionId),
+                            path: input.path,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const summary = textSummary(response.content);
+                    logToolCall(config, {
+                        tool: toolNames.ls,
+                        ...workspaceLogContext(workspace, extra.sessionId),
                         path: input.path,
-                        summary,
-                        payload: { content: response.content },
-                    },
-                },
-                structuredContent: {
-                    result: contentText(response.content),
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        ...response,
+                        _meta: {
+                            tool: toolNames.ls,
+                            card: {
+                                workspaceId,
+                                path: input.path,
+                                summary,
+                                payload: { content: response.content },
+                            },
+                        },
+                        structuredContent: {
+                            result: contentText(response.content),
+                        },
+                    };
                 },
-            };
+            });
         });
     }
     if (config.toolMode !== "codex") {
@@ -1294,62 +1421,75 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             outputSchema: resultOutputSchema(),
             ...toolWidgetDescriptorMeta(config, "shell"),
             annotations: SHELL_TOOL_ANNOTATIONS,
-        }, async ({ workspaceId, workingDirectory, ...input }) => {
-            const startedAt = performance.now();
+        }, async ({ workspaceId, workingDirectory, ...input }, extra) => {
             const workspace = workspaces.getWorkspace(workspaceId);
-            const cwd = workspaces.resolveWorkingDirectory(workspace, workingDirectory);
-            const response = await runShellTool(input, {
-                cwd,
-                root: workspace.root,
-            });
-            if (response.isError) {
-                logFailedToolResponse(config, {
-                    tool: toolNames.shell,
-                    workspaceId,
-                    workingDirectory: workingDirectory ?? ".",
-                    command: input.command,
-                    commandLength: input.command.length,
-                }, response.content, startedAt);
-                return response;
-            }
-            const summary = {
-                command: input.command,
-                workingDirectory: workingDirectory ?? ".",
-                ...textSummary(response.content),
-            };
-            logToolCall(config, {
+            return runToolWithHooks(hooks, {
                 tool: toolNames.shell,
-                workspaceId,
-                workingDirectory: workingDirectory ?? ".",
-                command: input.command,
-                commandLength: input.command.length,
-                success: true,
-                durationMs: Math.round(performance.now() - startedAt),
-            });
-            return {
-                ...response,
-                _meta: {
-                    tool: toolNames.shell,
-                    card: {
-                        workspaceId,
-                        path: workingDirectory,
-                        summary,
-                        payload: { content: response.content },
-                    },
+                invocation: workspaceHookInvocation(workspace),
+                payload: {
+                    command: input.command,
+                    workingDirectory: workingDirectory ?? ".",
+                    timeoutSeconds: input.timeout,
                 },
-                structuredContent: {
-                    result: contentText(response.content),
+                isFailure: toolResultIsError,
+                operation: async () => {
+                    const startedAt = performance.now();
+                    const cwd = workspaces.resolveWorkingDirectory(workspace, workingDirectory);
+                    const response = await runShellTool(input, {
+                        cwd,
+                        root: workspace.root,
+                    });
+                    if (response.isError) {
+                        logFailedToolResponse(config, {
+                            tool: toolNames.shell,
+                            ...workspaceLogContext(workspace, extra.sessionId),
+                            workingDirectory: workingDirectory ?? ".",
+                            command: input.command,
+                            commandLength: input.command.length,
+                        }, response.content, startedAt);
+                        return response;
+                    }
+                    const summary = {
+                        command: input.command,
+                        workingDirectory: workingDirectory ?? ".",
+                        ...textSummary(response.content),
+                    };
+                    logToolCall(config, {
+                        tool: toolNames.shell,
+                        ...workspaceLogContext(workspace, extra.sessionId),
+                        workingDirectory: workingDirectory ?? ".",
+                        command: input.command,
+                        commandLength: input.command.length,
+                        success: true,
+                        durationMs: Math.round(performance.now() - startedAt),
+                    });
+                    return {
+                        ...response,
+                        _meta: {
+                            tool: toolNames.shell,
+                            card: {
+                                workspaceId,
+                                path: workingDirectory,
+                                summary,
+                                payload: { content: response.content },
+                            },
+                        },
+                        structuredContent: {
+                            result: contentText(response.content),
+                        },
+                    };
                 },
-            };
+            });
         });
     }
     if (config.toolMode === "codex") {
-        registerCodexProcessTools(server, config, workspaces, processSessions);
+        registerCodexProcessTools(server, config, workspaces, processSessions, hooks);
     }
     if (config.artifactsEnabled && isArtifactDownloadSupportedPlatform()) {
         registerArtifactTools(server, {
             config,
             workspaces,
+            hooks,
             incomingArtifactAdapters,
         });
     }