@namzu/sdk 62.14.0 → 63.0.0

package/src/plugin/shell-hook.ts

@@ -22,7 +22,10 @@
  * `permission_mode`. The Namzu names stay, so no existing script changes.
  * The same facts go out as
  * same facts as `NAMZU_HOOK_EVENT`, `NAMZU_SESSION_ID`, `NAMZU_TURN_ID`,
- * `NAMZU_TOOL_NAME` and, when the input names a file, `NAMZU_TOOL_PATH`.
+ * `NAMZU_TOOL_NAME` and, when the input names a file, `NAMZU_TOOL_PATH`;
+ * `NAMZU_PROJECT_DIR` is the folder the session was started for.
+ * `session_start` also sends `source` (`startup` or `resume`) and `session_end`
+ * `reason` (`exit` or `replaced`).
  *
  * `session_start` and `session_end` run outside any turn, so they carry no
  * `turn_id` on stdin and no `NAMZU_TURN_ID` in the environment — not even
@@ -32,8 +35,8 @@
  * Its answer is the exit code and, on exit `0`, an optional JSON object on
  * stdout. The exit codes:
  *
- * - `0` — carry on. On `user_prompt_submit`, plain (non-JSON) stdout becomes
- *   context for the model.
+ * - `0` — carry on. On `user_prompt_submit`, `subagent_start` and
+ *   `session_start`, plain (non-JSON) stdout becomes context for the model.
  * - `2` — **block**, read per event: before a tool (`pre_tool_use`) the call is
  *   skipped and the model is told why, with the hook's stderr as the reason;
  *   on `user_prompt_submit` the turn ends; on `turn_end` and `subagent_stop`
@@ -68,7 +71,9 @@
  *   `permissionDecisionReason`, `updatedInput` and `additionalContext` for
  *   `pre_tool_use`; `additionalContext` for `user_prompt_submit`,
  *   `post_tool_use`, `post_tool_use_failure`, `turn_end`, `subagent_stop`,
- *   `session_start`, `notification`; and for `permission_request` a `decision`
+ *   `session_start` (context for the whole session), `notification`;
+ *   `updatedToolOutput` for `post_tool_use` (the text the model reads instead
+ *   of the tool's result); and for `permission_request` a `decision`
  *   `{ behavior: "allow" }` or `{ behavior: "deny", message, interrupt }`.
  *
  * ## What a hook may decide, and what it may not
@@ -106,6 +111,7 @@ import {
 	SKILL_TOOL_NAME_ALIASES,
 	permissionPatternToRegExpSource,
 } from '../authorization/skill-grant.js'
+import { withSessionChildMarker } from '../process/session-child.js'
 import { spawnHostShell } from '../tools/command-shell.js'
 import type { PluginId } from '../types/ids/index.js'
 import type {
@@ -122,6 +128,7 @@ import { RENAMED_PLUGIN_HOOK_EVENTS } from '../types/plugin/index.js'
 import { asPluginId } from '../utils/id.js'
 import { NOOP_LOGGER } from '../utils/log/create-logger.js'
 import type { Logger } from '../utils/logger.js'
+import { boundHookReplacement } from './hook-context.js'
 import type { PluginLifecycleManager } from './lifecycle.js'
 import { postHookJson } from './shell-hook-http.js'
 
@@ -180,8 +187,10 @@ interface ShellHookEntryBase {
 	 * What this applies to. On a tool event (and `permission_request`) the tool
 	 * name; on `notification` the notification type. `*` or absent matches
 	 * everything; a list of names (`a|b`, `a,b`, each optionally ending in `*`
-	 * as a prefix) matches those; anything else is a regular expression tested
-	 * against the name.
+	 * as a prefix) matches those without regard to case, and on a tool event
+	 * also by the names skills write (`Bash`, `Edit`); anything else is a
+	 * regular expression tested against the name (and, on a tool event, the
+	 * names skills write for that tool).
 	 */
 	readonly matcher?: string
 	/** Deadline in milliseconds; default `DEFAULT_SHELL_HOOK_TIMEOUT_MS`, capped at `MAX_SHELL_HOOK_TIMEOUT_MS`. */
@@ -201,10 +210,19 @@ interface ShellHookEntryBase {
 	 * What the hook's own failure does: it could not start, it timed out, it
 	 * exited with a code other than `0` or `2`, or it printed JSON that is not
 	 * valid. `continue` (the default) reports it and lets the action go ahead;
-	 * `block` counts it as exit `2`, so the action the event guards is refused.
+	 * `block` counts it as exit `2`, so the action the event guards is refused;
+	 * on `post_tool_use` and `post_tool_use_failure`, where the call has already
+	 * run, it withholds the result from the model instead (set it on a hook that
+	 * redacts).
 	 * Not read on a `prompt` hook or an `async` command.
 	 */
 	readonly onFailure?: ShellHookOnFailure
+	/**
+	 * Where the entry was declared, as a label a host shows (a file's path).
+	 * It has no effect on how the hook runs, and two entries that differ only
+	 * here are the same entry.
+	 */
+	readonly source?: string
 }
 
 /** One shell command at one event. */
@@ -268,6 +286,51 @@ export const MAX_SHELL_HOOK_TIMEOUT_MS = 10 * 60_000
 /** Captured output bound per stream. */
 const MAX_CAPTURE_BYTES = 64 * 1024
 
+/**
+ * How a skill writes each name in `SKILL_TOOL_NAME_ALIASES` (the alias table
+ * is keyed lower-case). A regular-expression matcher is also tested against
+ * these, so `^(Edit|Write)$` written for those names still fires.
+ */
+const WRITTEN_TOOL_NAMES: Readonly<Record<string, string>> = Object.freeze({
+	read: 'Read',
+	write: 'Write',
+	edit: 'Edit',
+	multiedit: 'MultiEdit',
+	bash: 'Bash',
+	grep: 'Grep',
+	glob: 'Glob',
+	ls: 'LS',
+	webfetch: 'WebFetch',
+	websearch: 'WebSearch',
+	skill: 'Skill',
+	askuserquestion: 'AskUserQuestion',
+	task: 'Task',
+	agent: 'Agent',
+	lsp: 'LSP',
+	toolsearch: 'ToolSearch',
+	bashoutput: 'BashOutput',
+	taskoutput: 'TaskOutput',
+	killshell: 'KillShell',
+	killbash: 'KillBash',
+	taskstop: 'TaskStop',
+	taskcreate: 'TaskCreate',
+	taskupdate: 'TaskUpdate',
+	tasklist: 'TaskList',
+})
+
+/** The names a skill writes for the tool called `toolName` here. */
+function writtenNamesFor(toolName: string): string[] {
+	const lower = toolName.toLowerCase()
+	const names: string[] = []
+	for (const [written, tool] of Object.entries(SKILL_TOOL_NAME_ALIASES)) {
+		if (tool !== lower) continue
+		names.push(written)
+		const spelled = WRITTEN_TOOL_NAMES[written]
+		if (spelled !== undefined) names.push(spelled)
+	}
+	return names
+}
+
 /**
  * `matcher` against a name (a tool's, or a notification's type).
  *
@@ -275,25 +338,55 @@ const MAX_CAPTURE_BYTES = 64 * 1024
  * matches exactly, each part optionally ending in `*` as a prefix (the
  * spelling this adapter has always taken). Anything else is a regular
  * expression, tested unanchored against the name; one that does not compile
- * matches nothing. Case-sensitive, because tool names are. A matcher on an
- * event that has no name (`turn_start`) matches nothing unless it is `*`.
+ * matches nothing. A matcher on an event that has no name (`turn_start`)
+ * matches nothing unless it is `*`.
+ *
+ * Names in a list compare without regard to case. With `tool: true` (the
+ * event's name is a tool: the tool events and `permission_request`) they also
+ * take the names skills write, the way an entry's `if` does: `Bash` matches
+ * the tool `bash`, `MultiEdit` matches `edit`, and a prefix such as `Web*`
+ * matches `web_fetch` by its written name too. Where the name is not a tool
+ * (a notification's type, an agent's name, a session's `source` or `reason`)
+ * no tool alias applies, since those words are not tool names; case is still
+ * ignored there, because a guard that silently never runs over a capital
+ * letter is worse than one that also runs for a name differing only in case.
+ *
+ * A list part ending in `.*` is also tried as a regular expression.
+ *
+ * A regular expression is tested, case-sensitively as written, against the
+ * real name and, with `tool: true`, against each name skills write for that
+ * tool, so one written for those names still fires. It never matches less
+ * than it did against the real name alone.
  */
 export function shellHookMatches(
 	matcher: string | undefined,
 	toolName: string | undefined,
+	options: { readonly tool?: boolean } = {},
 ): boolean {
 	if (matcher === undefined || matcher.trim() === '' || matcher.trim() === '*') return true
 	if (toolName === undefined) return false
+	const tool = options.tool === true
 	const parts = matcher.split(/[|,]/).map((part) => part.trim())
 	if (parts.every((part) => /^[A-Za-z0-9_.:-]+\*?$/.test(part))) {
-		return parts.some((candidate) =>
-			candidate.endsWith('*')
-				? toolName.startsWith(candidate.slice(0, -1))
-				: toolName === candidate,
-		)
+		const subject = toolName.toLowerCase()
+		const listed = parts.some((candidate) => {
+			const prefix = candidate.endsWith('*')
+			const written = (prefix ? candidate.slice(0, -1) : candidate).toLowerCase()
+			const spellings = [written]
+			if (tool) {
+				const alias = SKILL_TOOL_NAME_ALIASES[written]
+				if (alias !== undefined) spellings.push(alias)
+			}
+			return spellings.some((name) => (prefix ? subject.startsWith(name) : subject === name))
+		})
+		// `Bash.*` reads as the prefix `bash.` above, which no tool has. A part
+		// ending in `.*` is also a regular expression, so it is tried as one.
+		if (listed || !matcher.includes('.*')) return listed
 	}
 	try {
-		return new RegExp(matcher).test(toolName)
+		const expression = new RegExp(matcher)
+		if (expression.test(toolName)) return true
+		return tool && writtenNamesFor(toolName).some((name) => expression.test(name))
 	} catch {
 		return false
 	}
@@ -310,6 +403,7 @@ export function shellHookIfMatches(
 	filter: string | undefined,
 	toolName: string | undefined,
 	toolInput: unknown,
+	pathFilter?: ShellHookPathFilter,
 ): boolean {
 	if (filter === undefined || filter.trim() === '') return true
 	if (toolName === undefined) return true
@@ -317,10 +411,17 @@ export function shellHookIfMatches(
 	if (!shape) return true
 	const written = (shape[1] ?? '').toLowerCase()
 	const tool = SKILL_TOOL_NAME_ALIASES[written] ?? written
-	if (tool !== toolName.toLowerCase()) return false
 	const specifier = shape[2]?.trim()
-	if (specifier === undefined || specifier === '' || specifier.replaceAll('*', '') === '')
-		return true
+	const hasPattern =
+		specifier !== undefined && specifier !== '' && specifier.replaceAll('*', '') !== ''
+	// A path pattern is the permission rules' own: the host that has them says
+	// whether this call's path is named. It decides for the tools it knows.
+	if (hasPattern && pathFilter !== undefined) {
+		const answer = pathFilter(tool, specifier, toolName, toolInput)
+		if (answer !== undefined) return answer
+	}
+	if (tool !== toolName.toLowerCase()) return false
+	if (!hasPattern) return true
 	if (tool !== 'bash') return true
 	const line =
 		toolInput !== null && typeof toolInput === 'object'
@@ -344,12 +445,28 @@ export function shellHookIfMatches(
 	}
 }
 
+/**
+ * A host's reading of a path pattern in a hook's `if`: whether the call's path
+ * is named by `pattern` the way the host's permission rules read it. `tool` is
+ * the filter's tool (`edit`, `read`), `callTool` the tool being called.
+ * `undefined` means the host does not read this tool's paths, and the
+ * filter is then read as it is for any other tool.
+ */
+export type ShellHookPathFilter = (
+	tool: string,
+	pattern: string,
+	callTool: string,
+	toolInput: unknown,
+) => boolean | undefined
+
 /** What one hook run came back with, before it is mapped to a verdict. */
 export interface ShellHookOutcome {
 	readonly exitCode: number | null
 	readonly timedOut: boolean
 	readonly stdout: string
 	readonly stderr: string
+	/** Set when the hook printed more on stdout than is kept (`MAX_CAPTURE_BYTES`). */
+	readonly stdoutTruncated?: boolean
 	/** Set when the process could not be started at all. */
 	readonly spawnError?: string
 }
@@ -361,6 +478,12 @@ export interface ShellHookInput {
 	readonly sessionId: string
 	/** The turn the hook fired in. Absent on `session_start` and `session_end`. */
 	readonly turnId?: string
+	/** Why the session started, on `session_start`. Sent as `source`. */
+	readonly sessionSource?: string
+	/** Why the session closed, on `session_end`. Sent as `reason`. */
+	readonly endReason?: string
+	/** The folder the session was started for. Sent as `NAMZU_PROJECT_DIR`; absent, `cwd`. */
+	readonly projectDir?: string
 	/** The delegating session, on `subagent_start` and `subagent_stop`. */
 	readonly parentSessionId?: string
 	/** The parent turn whose tool call spawned the child, on `subagent_start` and `subagent_stop`. */
@@ -402,6 +525,7 @@ export function shellHookPayload(input: ShellHookInput): string {
 		...(input.transcriptPath !== undefined ? { transcript_path: input.transcriptPath } : {}),
 		...(input.permissionMode !== undefined ? { permission_mode: input.permissionMode } : {}),
 		...(input.turnId !== undefined ? { turn_id: input.turnId } : {}),
+		...(input.sessionSource !== undefined ? { source: input.sessionSource } : {}),
 		...(input.parentSessionId !== undefined ? { parent_session_id: input.parentSessionId } : {}),
 		...(input.parentTurnId !== undefined ? { parent_turn_id: input.parentTurnId } : {}),
 		...(input.agentType !== undefined
@@ -428,7 +552,11 @@ export function shellHookPayload(input: ShellHookInput): string {
 					})),
 				}
 			: {}),
-		...(input.reason !== undefined ? { reason: input.reason } : {}),
+		...(input.reason !== undefined
+			? { reason: input.reason }
+			: input.endReason !== undefined
+				? { reason: input.endReason }
+				: {}),
 		...(input.event === 'turn_failure' && input.error !== undefined ? { error: input.error } : {}),
 		...(input.notification !== undefined
 			? {
@@ -462,6 +590,7 @@ export function runShellHook(
 				...inherited,
 				NAMZU_HOOK_EVENT: input.event,
 				NAMZU_SESSION_ID: input.sessionId,
+				NAMZU_PROJECT_DIR: input.projectDir ?? input.cwd,
 				...(input.turnId !== undefined ? { NAMZU_TURN_ID: input.turnId } : {}),
 				...(input.toolName !== undefined ? { NAMZU_TOOL_NAME: input.toolName } : {}),
 				...(toolPath !== undefined ? { NAMZU_TOOL_PATH: toolPath } : {}),
@@ -478,7 +607,7 @@ export function runShellHook(
 					? // The exec form: no shell reads `command` or any argument.
 						spawn(entry.command, [...entry.args], {
 							cwd: input.cwd,
-							env,
+							env: withSessionChildMarker(env),
 							stdio: ['pipe', 'pipe', 'pipe'],
 							detached,
 						})
@@ -506,17 +635,24 @@ export function runShellHook(
 		}
 		let stdout = ''
 		let stderr = ''
+		let stdoutTruncated = false
 		let timedOut = false
 		let settled = false
-		const capture = (current: string, chunk: Buffer): string =>
-			current.length >= MAX_CAPTURE_BYTES
-				? current
-				: (current + chunk.toString('utf8')).slice(0, MAX_CAPTURE_BYTES)
+		const capture = (current: string, chunk: Buffer): { text: string; cut: boolean } => {
+			if (current.length >= MAX_CAPTURE_BYTES) return { text: current, cut: chunk.length > 0 }
+			const joined = current + chunk.toString('utf8')
+			return {
+				text: joined.slice(0, MAX_CAPTURE_BYTES),
+				cut: joined.length > MAX_CAPTURE_BYTES,
+			}
+		}
 		child.stdout?.on('data', (chunk: Buffer) => {
-			stdout = capture(stdout, chunk)
+			const next = capture(stdout, chunk)
+			stdout = next.text
+			if (next.cut) stdoutTruncated = true
 		})
 		child.stderr?.on('data', (chunk: Buffer) => {
-			stderr = capture(stderr, chunk)
+			stderr = capture(stderr, chunk).text
 		})
 		const finish = (outcome: ShellHookOutcome) => {
 			if (settled) return
@@ -549,11 +685,18 @@ export function runShellHook(
 				timedOut,
 				stdout,
 				stderr,
+				...(stdoutTruncated ? { stdoutTruncated } : {}),
 				spawnError: error.message,
 			})
 		})
 		child.on('close', (code) => {
-			finish({ exitCode: code, timedOut, stdout, stderr })
+			finish({
+				exitCode: code,
+				timedOut,
+				stdout,
+				stderr,
+				...(stdoutTruncated ? { stdoutTruncated } : {}),
+			})
 		})
 		child.on('exit', () => {
 			// After a kill, a survivor that still holds the pipes must not hold
@@ -609,6 +752,8 @@ interface ShellHookReading {
 	context?: string
 	halt?: { reason: string }
 	notice?: string
+	/** Text that replaces a tool's result, on `post_tool_use`. */
+	replacement?: string
 	/** The hook asked for its stdout to stay out of the debug log. */
 	suppressOutput?: boolean
 	/** Why the JSON was set aside, when it was. */
@@ -727,6 +872,12 @@ function readShellHookJson(event: ShellHookEvent, stdout: string): ShellHookRead
 			reading.updatedInput = specific.updatedInput
 		}
 	}
+	if (event === 'post_tool_use' && specific.updatedToolOutput !== undefined) {
+		if (typeof specific.updatedToolOutput !== 'string') {
+			return { invalid: 'hookSpecificOutput: `updatedToolOutput` must be a string' }
+		}
+		reading.replacement = boundHookReplacement(specific.updatedToolOutput)
+	}
 	if (event === 'permission_request') {
 		const decision = specific.decision
 		if (!isRecord(decision)) {
@@ -764,15 +915,30 @@ export function shellHookVerdict(
 	}
 	// A failure of the hook itself is "carry on" unless the entry asked for
 	// it to count as a refusal, which is exit 2 with the failure as the reason.
-	const failed = (reason: string): PluginHookResult =>
-		entry.onFailure === 'block' && entry.type !== 'prompt' && !isAsyncShellHook(entry)
-			? shellHookVerdict(
-					event,
-					{ ...entry, onFailure: 'continue' },
-					{ exitCode: 2, timedOut: false, stdout: '', stderr: `hook failed: ${reason}` },
-					log,
-				)
-			: { action: 'continue' }
+	const failed = (reason: string, shown: string = reason): PluginHookResult => {
+		if (entry.onFailure !== 'block' || entry.type === 'prompt' || isAsyncShellHook(entry)) {
+			return { action: 'continue' }
+		}
+		// The call has run and a refusal cannot undo it, but the hook may have
+		// been the one thing keeping something out of the result (a redaction),
+		// so a failed guard withholds the result instead of passing it on. The
+		// kernel marks the record as it does for any replaced result.
+		if (event === 'post_tool_use' || event === 'post_tool_use_failure') {
+			const line = `A hook guarding this result failed, so the result is not shown (${shown}). The tool call itself has already run.`
+			return {
+				action: 'replace',
+				output: line,
+				content: [{ type: 'text', text: line }],
+				disclose: true,
+			}
+		}
+		return shellHookVerdict(
+			event,
+			{ ...entry, onFailure: 'continue' },
+			{ exitCode: 2, timedOut: false, stdout: '', stderr: `hook failed: ${reason}` },
+			log,
+		)
+	}
 	if (outcome.spawnError !== undefined) {
 		log.warn('hook could not start', {
 			...attrs,
@@ -821,12 +987,20 @@ export function shellHookVerdict(
 
 	// Exit 0.
 	const text = outcome.stdout.trim()
-	const reading = readShellHookJson(event, outcome.stdout)
+	const reading: ShellHookReading | undefined =
+		outcome.stdoutTruncated === true && text.startsWith('{')
+			? {
+					invalid: `answer is too large: the hook printed more than the ${MAX_CAPTURE_BYTES} characters of stdout that are read`,
+				}
+			: readShellHookJson(event, outcome.stdout)
 	if (reading === undefined) {
 		// On the prompt event, what the hook printed is context for the
 		// model — the branch, the time, a ticket. Everywhere else stdout is
 		// the operator's to read and the model's business not at all.
-		if ((event === 'user_prompt_submit' || event === 'subagent_start') && text.length > 0)
+		if (
+			(event === 'user_prompt_submit' || event === 'subagent_start' || event === 'session_start') &&
+			text.length > 0
+		)
 			return { action: 'annotate', text }
 		return { action: 'continue' }
 	}
@@ -835,7 +1009,9 @@ export function shellHookVerdict(
 			...attrs,
 			'namzu.hook.problem': reading.invalid,
 		})
-		return failed(reading.invalid)
+		// The parser's own detail can quote a piece of the answer; the line the
+		// model reads keeps only the lead.
+		return failed(reading.invalid, reading.invalid.split(' (')[0])
 	}
 	if (!reading.suppressOutput) {
 		log.debug('hook output', {
@@ -884,11 +1060,34 @@ export function shellHookVerdict(
 			const context = [reading.block, reading.context].filter(Boolean).join('\n')
 			return context.length > 0 ? { action: 'annotate', text: context } : { action: 'continue' }
 		}
+		case 'session_start': {
+			// Nothing here can be refused. What the hook said for the model becomes
+			// the session's context; a stop request and a warning still count.
+			return reading.context !== undefined
+				? { action: 'annotate', text: reading.context }
+				: {
+						action: 'continue',
+						...(reading.halt ? { halt: reading.halt } : {}),
+						...(reading.notice ? { notice: reading.notice } : {}),
+					}
+		}
 		case 'post_tool_use':
 		case 'post_tool_use_failure': {
 			// The call has run, so a "block" cannot undo it: its reason is what the
 			// model is told about the result.
 			const context = [reading.block, reading.context].filter(Boolean).join('\n')
+			// A replacement is the hook's text in place of the tool's: the record
+			// says so beside it (the kernel adds the mark).
+			if (reading.replacement !== undefined) {
+				return {
+					action: 'replace',
+					output: reading.replacement,
+					disclose: true,
+					...(context.length > 0 ? { context } : {}),
+					...(reading.halt ? { halt: reading.halt } : {}),
+					...(reading.notice ? { notice: reading.notice } : {}),
+				}
+			}
 			return {
 				action: 'continue',
 				...(context.length > 0 ? { context } : {}),
@@ -985,6 +1184,28 @@ export interface ShellHookOptions {
 	readonly transcriptPath?: (sessionId: string) => string | undefined
 	/** The permission mode in force now, sent as `permission_mode`. Called at each run. */
 	readonly permissionMode?: () => string | undefined
+	/**
+	 * The folder the session was started for, sent to every command as
+	 * `NAMZU_PROJECT_DIR`. Absent, `cwd`.
+	 */
+	readonly projectDir?: string
+	/** How a path pattern in an entry's `if` is read. Absent, such a filter runs the hook. */
+	readonly pathFilter?: ShellHookPathFilter
+	/**
+	 * A deadline, in milliseconds, for entries of an event that set no
+	 * `timeoutMs` of their own (an entry's own is honoured as written, up to
+	 * the cap). Absent, or an event not listed, the ordinary default applies.
+	 */
+	readonly defaultTimeoutMs?: { readonly [event in ShellHookEvent]?: number }
+	/**
+	 * Called when a hook of this adapter ran out its deadline and was ended.
+	 * `hook` is the command, URL or prompt text the entry names.
+	 */
+	readonly onTimeout?: (info: {
+		readonly event: ShellHookEvent
+		readonly hook: string
+		readonly timeoutMs: number
+	}) => void
 }
 
 /** The deadline for `prompt` hooks when they name none. */
@@ -1086,10 +1307,19 @@ function readJudgement(reply: string): { ok: boolean; reason: string } | undefin
 /** One entry as a hook definition the lifecycle manager accepts. */
 export function createShellHook(
 	event: ShellHookEvent,
-	entry: ShellHookHandler,
+	configured: ShellHookHandler,
 	options: ShellHookOptions,
 ): PluginHookDefinition {
 	const log = options.log ?? NOOP_LOGGER
+	const eventDefault = options.defaultTimeoutMs?.[event]
+	const entry: ShellHookHandler =
+		configured.timeoutMs === undefined && eventDefault !== undefined
+			? { ...configured, timeoutMs: eventDefault }
+			: configured
+	const reportTimeout = (timedOut: boolean): void => {
+		if (!timedOut) return
+		options.onTimeout?.({ event, hook: describeShellHook(entry), timeoutMs: hookTimeout(entry) })
+	}
 	// `once` is per definition, and a definition is per session: the manager
 	// is built for one session and its hooks are attached to it.
 	let spent = false
@@ -1101,14 +1331,26 @@ export function createShellHook(
 		handler: async (context: PluginHookContext) => {
 			if (spent) return { action: 'continue' }
 			// A notification is matched on its type; every other event on the tool.
+			const namesATool = !(
+				event === 'notification' ||
+				event === 'subagent_start' ||
+				event === 'subagent_stop' ||
+				event === 'session_start' ||
+				event === 'session_end'
+			)
 			const subject =
 				event === 'notification'
 					? context.notification?.type
 					: event === 'subagent_start' || event === 'subagent_stop'
 						? context.agentType
-						: context.toolName
-			if (!shellHookMatches(entry.matcher, subject)) return { action: 'continue' }
-			if (!shellHookIfMatches(entry.if, context.toolName, context.toolInput)) {
+						: event === 'session_start'
+							? context.source
+							: event === 'session_end'
+								? context.endReason
+								: context.toolName
+			if (!shellHookMatches(entry.matcher, subject, { tool: namesATool }))
+				return { action: 'continue' }
+			if (!shellHookIfMatches(entry.if, context.toolName, context.toolInput, options.pathFilter)) {
 				return { action: 'continue' }
 			}
 			if (entry.once === true) spent = true
@@ -1117,7 +1359,10 @@ export function createShellHook(
 			const hookInput: ShellHookInput = {
 				event,
 				cwd: options.cwd,
+				...(options.projectDir !== undefined ? { projectDir: options.projectDir } : {}),
 				sessionId: String(context.sessionId),
+				...(context.source !== undefined ? { sessionSource: context.source } : {}),
+				...(context.endReason !== undefined ? { endReason: context.endReason } : {}),
 				...(context.turnId !== undefined ? { turnId: String(context.turnId) } : {}),
 				...(context.parentSessionId !== undefined
 					? { parentSessionId: String(context.parentSessionId) }
@@ -1158,6 +1403,7 @@ export function createShellHook(
 					timeoutMs: hookTimeout(entry),
 					...(context.signal !== undefined ? { signal: context.signal } : {}),
 				})
+				reportTimeout(response.timedOut)
 				const ok = response.status !== null && response.status >= 200 && response.status < 300
 				return shellHookVerdict(
 					event,
@@ -1186,6 +1432,7 @@ export function createShellHook(
 				return { action: 'continue' }
 			}
 			const outcome = await runShellHook(entry, hookInput, context.signal)
+			reportTimeout(outcome.timedOut)
 			return shellHookVerdict(event, entry, outcome, log)
 		},
 	} as PluginHookDefinition

package/src/process/session-child.ts

@@ -0,0 +1,38 @@
+import { readEnvironmentEntry, setEnvironmentEntry } from '../utils/process-environment.js'
+
+/**
+ * The name of the variable the kernel puts into the environment of every process it starts on a
+ * session's behalf: a command the model ran, a hook, a tool server, a delegated or background run's
+ * command, a terminal a session opened.
+ *
+ * It says one thing: this process, or one of its ancestors, was started by a running session, not by a
+ * person at their own terminal. `namzu send` reads it and refuses, because a message to another session
+ * is a person's, and a command a model ran is not a person.
+ *
+ * It is a marker and not a lock. Any process of the same account can start another with a cleaner
+ * environment (`env -i`), so the kernel does not rely on it alone: the command-line permission layer
+ * refuses the same command before it runs, and the receiving terminal checks the sender's process
+ * ancestry. What a process of the same account can do after hiding both is the account boundary's to
+ * hold, not this marker's.
+ */
+export const SESSION_CHILD_ENV = 'NAMZU_STARTED_BY_SESSION'
+
+/** A copy of `env` that carries the marker. Everywhere the kernel builds a child's environment ends here. */
+export function withSessionChildMarker<T extends Readonly<Record<string, string | undefined>>>(
+	env: T,
+	platform: NodeJS.Platform = process.platform,
+): Record<string, string | undefined> {
+	const out: Record<string, string> = {}
+	for (const [name, value] of Object.entries(env)) if (value !== undefined) out[name] = value
+	setEnvironmentEntry(out, SESSION_CHILD_ENV, '1', platform)
+	return out
+}
+
+/** Whether `env` carries the marker: this process was started, directly or not, by a running session. */
+export function startedBySession(
+	env: Readonly<Record<string, string | undefined>> = process.env,
+	platform: NodeJS.Platform = process.platform,
+): boolean {
+	const found = readEnvironmentEntry(env, SESSION_CHILD_ENV, platform)
+	return found !== undefined && found[1] !== '' && found[1] !== '0'
+}