jinzd-ai-cli 0.4.211 → 0.4.212

package/dist/{hub-INUJND2G.js → hub-JWSV4MKC.js}

@@ -154,7 +154,7 @@ ${content}`);
   }
 }
 async function runTaskMode(config, providers, configManager, topic) {
-  const { TaskOrchestrator } = await import("./task-orchestrator-OV4O25MX.js");
+  const { TaskOrchestrator } = await import("./task-orchestrator-AL2E642M.js");
   const orchestrator = new TaskOrchestrator(config, providers, configManager);
   let interrupted = false;
   const onSigint = () => {

package/dist/index.js

@@ -15,7 +15,7 @@ import {
   scanProject,
   sessionHasMeaningfulContent,
   setupProxy
-} from "./chunk-C3OU2OPF.js";
+} from "./chunk-HW2ALWQJ.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt
@@ -27,23 +27,28 @@ import {
   cleanupRejectedTeeFile,
   estimateTokens,
   formatPermissionProfileWarning,
+  getPendingHookTrust,
   googleSearchContext,
   initTheme,
   isInterrupted,
   lastResponseStore,
+  listHooks,
   renderDiff,
   requestInterrupt,
   resetInterrupt,
   rlInternal,
+  runLifecycleHooks,
   setContextWindow,
   setMaxOutputCap,
   spawnAgentContext,
   theme,
-  undoStack
-} from "./chunk-ZOPYREL5.js";
+  trustHook,
+  undoStack,
+  untrustHook
+} from "./chunk-N5LB3PPL.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-6NS6643Y.js";
+import "./chunk-HX6N6QEY.js";
 import {
   SessionManager,
   getContentText
@@ -60,7 +65,7 @@ import {
   getConfigDirUsage,
   listRecentCrashes,
   writeCrashLog
-} from "./chunk-BE6ERF7M.js";
+} from "./chunk-LU6FBJQ5.js";
 import {
   ProviderRegistry
 } from "./chunk-QMXC327F.js";
@@ -69,7 +74,7 @@ import {
   getTopFailingTools,
   getTopUsedTools,
   installFlushOnExit
-} from "./chunk-JBWA73GK.js";
+} from "./chunk-IFZX26K7.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -91,7 +96,7 @@ import {
 } from "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-UOROWTGG.js";
+} from "./chunk-NYCBOVNF.js";
 import {
   AuthError,
   ProviderError,
@@ -117,7 +122,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-E5XCM4A6.js";
+} from "./chunk-GBBVCZ4W.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -934,6 +939,7 @@ function createDefaultCommands() {
               ["/config [set|get|show]", "Config wizard / get / set / show all"],
               ["/profile [show|set|clear]", "View or edit your identity"],
               ["/security [status|scan|on|off]", "Sensitive-data redaction"],
+              ["/hooks [list|trust|untrust]", "Lifecycle hooks and project hook trust"],
               ["/doctor", "Health check (API keys, config, MCP, crashes, tool stats)"],
               ["/bug [--copy]", "Generate bug report template"],
               ["/about", "About ai-cli & author info"],
@@ -1356,6 +1362,7 @@ No commands match "${filter}".
         console.log(`  Ctx Win  : ${ctxStr}`);
         console.log("  PermProf : " + (ctx.config.get("defaultPermissionProfile") ?? "legacy"));
         console.log("  Network  : " + (ctx.config.get("networkPolicy")?.enabled ?? false ? "on" : "off"));
+        console.log("  Hooks    : " + getPendingHookTrust(ctx.config.get("hooks") ?? void 0, ctx.config.getConfigDir()).length + " pending trust");
         console.log(`  Messages : ${session?.messages.length ?? 0}`);
         console.log(`  Session  : ${session?.id.slice(0, 8) ?? "none"}`);
         if (layers.length > 0) {
@@ -1649,7 +1656,7 @@ No tools match "${filter}".
           const { join: join5 } = await import("path");
           const { existsSync: existsSync5 } = await import("fs");
           const { getGitRoot: getGitRoot2 } = await import("./git-context-EXOEHQSF.js");
-          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-AWTIQIWG.js");
+          const { MCP_PROJECT_CONFIG_NAME: MCP_PROJECT_CONFIG_NAME2 } = await import("./constants-KDWG4KR4.js");
           const { approveProject, hashMcpFile } = await import("./project-trust-NKYHL3VZ.js");
           const cwd = process.cwd();
           const projectRoot = getGitRoot2(cwd) ?? cwd;
@@ -2708,7 +2715,7 @@ ${hint}` : "")
       usage: "/test [command|filter]",
       async execute(args, ctx) {
         try {
-          const { executeTests } = await import("./run-tests-3MHWUF43.js");
+          const { executeTests } = await import("./run-tests-H4Q2PRX6.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -3287,6 +3294,71 @@ Summary: ${fileMap.size} file(s) \u2014 ${newFiles} new, ${modifiedFiles} modifi
         }
       }
     },
+    {
+      name: "hooks",
+      description: "Manage lifecycle hooks and project hook trust",
+      usage: "/hooks [list|inspect <id>|trust <id>|untrust <id>|disable]",
+      execute(args, ctx) {
+        const sub = (args[0] || "list").toLowerCase();
+        const hooks = listHooks(ctx.config.get("hooks") ?? void 0, ctx.config.getConfigDir());
+        const findHook = (id) => hooks.find((h) => h.id === id || h.hash.startsWith(id ?? ""));
+        if (sub === "list") {
+          console.log(theme.heading("  Hooks"));
+          if (hooks.length === 0) {
+            console.log(theme.dim("    No hooks configured."));
+          } else {
+            for (const h of hooks) {
+              const trust = h.disabled ? theme.dim("disabled") : h.trusted ? theme.success("trusted") : theme.warning("pending");
+              console.log(`    ${h.id.padEnd(18)} ${h.source.padEnd(7)} ${trust} ${h.hash.slice(0, 12)} ${theme.dim(h.command.slice(0, 80))}`);
+            }
+          }
+          console.log();
+          return;
+        }
+        if (sub === "inspect") {
+          const h = findHook(args[1]);
+          if (!h) {
+            console.log(theme.warning("  Hook not found. Use /hooks list."));
+            return;
+          }
+          console.log(theme.heading("  Hook"));
+          console.log(`    id      : ${h.id}`);
+          console.log(`    event   : ${h.event}`);
+          console.log(`    source  : ${h.source}`);
+          console.log(`    hash    : ${h.hash}`);
+          console.log(`    trusted : ${h.trusted ? "yes" : "no"}`);
+          console.log(`    disabled: ${h.disabled ? "yes" : "no"}`);
+          console.log(`    command : ${h.command}`);
+          console.log();
+          return;
+        }
+        if (sub === "trust" || sub === "untrust") {
+          const h = findHook(args[1]);
+          if (!h) {
+            console.log(theme.warning("  Hook not found. Use /hooks list."));
+            return;
+          }
+          if (sub === "trust") {
+            trustHook(ctx.config.getConfigDir(), h);
+            console.log(theme.success(`  \u2713 trusted ${h.id} (${h.hash.slice(0, 12)})`));
+          } else {
+            untrustHook(ctx.config.getConfigDir(), h);
+            console.log(theme.success(`  \u2713 untrusted ${h.id}`));
+          }
+          console.log();
+          return;
+        }
+        if (sub === "disable") {
+          const cfg = ctx.config.get("hooks") ?? {};
+          ctx.config.set("hooks", { ...cfg, enabled: false });
+          console.log(theme.success("  \u2713 hooks disabled in user config"));
+          console.log();
+          return;
+        }
+        console.log(theme.warning("  Usage: /hooks [list|inspect <id>|trust <id>|untrust <id>|disable]"));
+        console.log();
+      }
+    },
     {
       name: "security",
       description: "Sensitive-data redaction \u2014 status, scan sessions, toggle on/off",
@@ -3306,6 +3378,7 @@ Summary: ${fileMap.size} file(s) \u2014 ${newFiles} new, ${modifiedFiles} modifi
           console.log(`    mode         : ${security.mode}`);
           console.log("    profile      : " + (ctx.config.get("defaultPermissionProfile") ?? "legacy"));
           console.log("    network      : " + (ctx.config.get("networkPolicy")?.enabled ?? false ? "on" : "off"));
+          console.log("    hooks        : " + getPendingHookTrust(ctx.config.get("hooks") ?? void 0, ctx.config.getConfigDir()).length + " pending trust");
           console.log(`    patterns     : ${DEFAULT_PATTERNS.length} built-in + ${security.customPatterns?.length ?? 0} custom`);
           console.log(`    last save    : ${ctx.sessions.lastRedactionHits} hit(s) redacted`);
           console.log();
@@ -4465,6 +4538,7 @@ var Repl = class {
     const permissionProfiles = this.config.get("permissionProfiles") ?? {};
     this.toolExecutor.setConfig({
       hookConfig: this.config.get("hooks") ?? void 0,
+      hookConfigDir: this.config.getConfigDir(),
       permissionRules: this.config.get("permissionRules") ?? [],
       defaultPermission: this.config.get("defaultPermission") ?? "confirm",
       permissionProfileName,
@@ -4473,6 +4547,11 @@ var Repl = class {
       workspaceRoot: process.cwd(),
       networkPolicy: this.config.get("networkPolicy")
     });
+    const pendingHooks = getPendingHookTrust(this.config.get("hooks") ?? void 0, this.config.getConfigDir());
+    if (pendingHooks.length > 0) {
+      process.stderr.write(theme.warning("  \u26A0 " + pendingHooks.length + " project hook(s) require trust. Run /hooks list and /hooks trust <id>.\n"));
+    }
+    runLifecycleHooks(this.config.get("hooks") ?? void 0, "SessionStart", { source: "repl" }, { configDir: this.config.getConfigDir() });
     if (this.config.get("alwaysYolo") === true) {
       this.toolExecutor.sessionAutoApprove = true;
     }
@@ -4944,6 +5023,21 @@ ${skillContent}`);
       );
       return false;
     }
+    const preDecisions = runLifecycleHooks(
+      this.config.get("hooks") ?? void 0,
+      "PreCompact",
+      { sessionId: session.id, messageCount: session.messages.length, instruction },
+      { configDir: this.config.getConfigDir(), onSummary: (msg) => process.stdout.write(theme.dim("  [hook] " + msg) + "\n") }
+    );
+    const preDeny = preDecisions.find((d) => d.action === "deny");
+    if (preDeny) {
+      process.stdout.write(theme.warning("  \u26A0 Compact blocked by hook: " + (preDeny.reason ?? "PreCompact denied") + "\n"));
+      return false;
+    }
+    for (const d of preDecisions) {
+      const warnings = [d.warning, ...d.warnings ?? []].filter(Boolean);
+      for (const w of warnings) process.stdout.write(theme.warning("  \u26A0 Hook warning: " + w + "\n"));
+    }
     const provider = this.providers.get(this.currentProvider);
     const modelParams = this.getModelParams();
     const spinner = this.renderer.showSpinner("Compacting session...");
@@ -5005,6 +5099,12 @@ ${response.content.trim()}
       const tokensBefore = ctxWindow > 0 ? this.estimateConversationTokens() : 0;
       const removedCount = session.compact(summaryMsg, ackMsg, COMPACT_KEEP_LAST);
       const afterCount = session.messages.length;
+      runLifecycleHooks(
+        this.config.get("hooks") ?? void 0,
+        "PostCompact",
+        { sessionId: session.id, beforeCount, afterCount, removedCount, keepLast: COMPACT_KEEP_LAST, instruction },
+        { configDir: this.config.getConfigDir(), onSummary: (msg) => process.stdout.write(theme.dim("  [hook] " + msg) + "\n") }
+      );
       const tokensAfter = ctxWindow > 0 ? this.estimateConversationTokens() : 0;
       const pctBefore = ctxWindow > 0 ? Math.round(tokensBefore / ctxWindow * 100) : 0;
       const pctAfter = ctxWindow > 0 ? Math.round(tokensAfter / ctxWindow * 100) : 0;
@@ -5440,8 +5540,32 @@ Session '${this.resumeSessionId}' not found.
       });
     });
   }
+  runUserPromptHooks(sessionId, userInput) {
+    const promptDecisions = runLifecycleHooks(
+      this.config.get("hooks") ?? void 0,
+      "UserPromptSubmit",
+      { sessionId, prompt: userInput },
+      { configDir: this.config.getConfigDir(), onSummary: (msg) => process.stdout.write(theme.dim("  [hook] " + msg) + "\n") }
+    );
+    const promptDeny = promptDecisions.find((d) => d.action === "deny");
+    if (promptDeny) {
+      process.stdout.write(theme.warning("  \u26A0 Prompt blocked by hook: " + (promptDeny.reason ?? "UserPromptSubmit denied") + "\n"));
+      return false;
+    }
+    for (const d of promptDecisions) {
+      const warnings = [d.warning, ...d.warnings ?? []].filter(Boolean);
+      for (const w of warnings) process.stdout.write(theme.warning("  \u26A0 Hook warning: " + w + "\n"));
+    }
+    const secretHits = scanString(userInput, { customRegexes: [] });
+    if (secretHits.length > 0) {
+      const kinds = [...new Set(secretHits.map((h) => h.kind))].join(", ");
+      process.stdout.write(theme.warning("  \u26A0 Possible secret in prompt (" + kinds + "). It will be sent unless you interrupt now.\n"));
+    }
+    return true;
+  }
   async handleChat(userInput) {
     const session = this.sessions.current;
+    if (!this.runUserPromptHooks(session.id, userInput)) return;
     const { parts, hasImage, refs } = parseAtReferences(userInput, process.cwd());
     for (const ref of refs) {
       if (ref.type === "notfound") {
@@ -6906,6 +7030,7 @@ Tip: You can continue the conversation by asking the AI to proceed.`
     void this.shutdownAsync();
   }
   async shutdownAsync() {
+    runLifecycleHooks(this.config.get("hooks") ?? void 0, "Stop", { sessionId: this.sessions.current?.id }, { configDir: this.config.getConfigDir() });
     this.running = false;
     const sessionId = this.sessions.current?.id;
     if (sessionId) {
@@ -7020,7 +7145,7 @@ program.command("web").description("Start Web UI server with browser-based chat
     console.error("Error: Invalid port number. Must be between 1 and 65535.");
     process.exit(1);
   }
-  const { startWebServer } = await import("./server-BTSKOPQI.js");
+  const { startWebServer } = await import("./server-VNCN7AY5.js");
   await startWebServer({ port, host: options.host });
 });
 program.command("user [action] [username]").description("Manage Web UI users (list | create <name> | delete <name> | reset-password <name> | logout-all <name> | migrate <name>)").action(async (action, username) => {
@@ -7187,16 +7312,16 @@ program.command("sessions").description("List recent conversation sessions").opt
   console.log(footer + "\n");
 });
 program.command("usage").description("Show token + cost usage grouped by provider/model (cross-session)").option("--days <n>", "Only the last N days (inclusive of today)").option("--month <ym>", "Only a specific month, format YYYY-MM (e.g. 2026-06)").option("--json", "Output as JSON (for scripting)").action(async (options) => {
-  const { runUsageCli } = await import("./usage-T2P6FTE7.js");
+  const { runUsageCli } = await import("./usage-LB6REWPO.js");
   await runUsageCli(options);
 });
 program.command("doctor").description("Health check: API keys, config, MCP, recent crashes, tool usage, disk usage").option("--json", "Output as JSON (for scripting)").option("--reset-stats", "Reset accumulated tool usage statistics").action(async (options) => {
-  const { runDoctorCli } = await import("./doctor-cli-SSI6ETFT.js");
+  const { runDoctorCli } = await import("./doctor-cli-TJTWIW7U.js");
   await runDoctorCli({ json: !!options.json, resetStats: !!options.resetStats });
 });
 program.command("batch <action> [arg] [arg2]").description("Anthropic Message Batches: submit | list | status <id> | results <id> [out] | cancel <id>").option("--dry-run", "Parse and validate input without submitting (submit only)").action(async (action, arg, arg2, options) => {
   try {
-    const batch = await import("./batch-DE4RXKZD.js");
+    const batch = await import("./batch-WIKFEOAZ.js");
     switch (action) {
       case "submit":
         if (!arg) {
@@ -7239,7 +7364,7 @@ program.command("batch <action> [arg] [arg2]").description("Anthropic Message Ba
   }
 });
 program.command("mcp-serve").description("Start an MCP server over STDIO, exposing aicli's built-in tools to Claude Desktop / Cursor / other MCP clients").option("--allow-destructive", "Allow bash / run_interactive / task_create (always destructive in MCP mode)").option("--allow-outside-cwd", "Allow tool path arguments to escape the sandbox root \u2014 disabled by default").option("--tools <list>", "Comma-separated whitelist of tools to expose (default: all eligible tools)").option("--cwd <path>", "Working directory AND sandbox root (default: current directory)").action(async (options) => {
-  const { startMcpServer } = await import("./server-7USZJJAH.js");
+  const { startMcpServer } = await import("./server-OFKGDRYI.js");
   await startMcpServer({
     allowDestructive: !!options.allowDestructive,
     allowOutsideCwd: !!options.allowOutsideCwd,
@@ -7248,7 +7373,7 @@ program.command("mcp-serve").description("Start an MCP server over STDIO, exposi
   });
 });
 program.command("ci").description("Headless PR review (code + security) \u2014 reads git/gh diff, optionally posts to PR. Designed for GitHub Actions.").option("--pr <num>", "PR number; diff fetched via `gh pr diff <num>`", (v) => parseInt(v, 10)).option("--base <ref>", "Base ref for `git diff <ref>...HEAD` (ignored when --pr set)").option("--post", "Post review as a PR comment (requires gh CLI + GH_TOKEN, needs --pr)").option("--no-update", "Always create a new comment instead of updating the previous aicli review").option("--skip-code", "Skip the code review section").option("--skip-security", "Skip the security review section").option("--detailed", "Use the detailed code-review prompt").option("--max-diff <n>", "Max diff chars sent to the model (default 30000)", (v) => parseInt(v, 10)).option("--provider <id>", "Override provider (default: config.defaultProvider)").option("--model <id>", "Override model").option("--dry-run", "Print result to stdout instead of posting (overrides --post)").action(async (options) => {
-  const { runCi } = await import("./ci-XMUEX526.js");
+  const { runCi } = await import("./ci-X3LNUFZV.js");
   const result = await runCi({
     pr: options.pr,
     base: options.base,
@@ -7394,7 +7519,7 @@ program.command("hub [topic]").description("Start multi-agent hub (discuss / bra
     }),
     config.get("customProviders")
   );
-  const { startHub } = await import("./hub-INUJND2G.js");
+  const { startHub } = await import("./hub-JWSV4MKC.js");
   await startHub(
     {
       topic: topic ?? "",

package/dist/{run-tests-PACN4UYX.js → run-tests-D7YBY4XB.js}

@@ -1,7 +1,7 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-ZY2N2N6T.js";
+} from "./chunk-KE4B3NOQ.js";
 export {
   executeTests,
   runTestsTool

package/dist/{run-tests-3MHWUF43.js → run-tests-H4Q2PRX6.js}

@@ -2,8 +2,8 @@
 import {
   executeTests,
   runTestsTool
-} from "./chunk-6NS6643Y.js";
-import "./chunk-E5XCM4A6.js";
+} from "./chunk-HX6N6QEY.js";
+import "./chunk-GBBVCZ4W.js";
 export {
   executeTests,
   runTestsTool

package/dist/{server-7USZJJAH.js → server-OFKGDRYI.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   ToolRegistry
-} from "./chunk-ZOPYREL5.js";
+} from "./chunk-N5LB3PPL.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-6NS6643Y.js";
+import "./chunk-HX6N6QEY.js";
 import {
   runTool
-} from "./chunk-JBWA73GK.js";
+} from "./chunk-IFZX26K7.js";
 import {
   getDangerLevel,
   schemaToJsonSchema
@@ -15,7 +15,7 @@ import {
 import "./chunk-TZQHYZKT.js";
 import {
   VERSION
-} from "./chunk-E5XCM4A6.js";
+} from "./chunk-GBBVCZ4W.js";
 import "./chunk-4BKXL7SM.js";
 import "./chunk-TB4W4Y4T.js";
 import "./chunk-KHYD3WXE.js";

package/dist/{server-BTSKOPQI.js → server-VNCN7AY5.js}

@@ -24,7 +24,7 @@ import {
   scanDirTree,
   scanProject,
   setupProxy
-} from "./chunk-C3OU2OPF.js";
+} from "./chunk-HW2ALWQJ.js";
 import {
   buildReviewPrompt,
   buildSecurityReviewPrompt
@@ -38,10 +38,12 @@ import {
   cleanupRejectedTeeFile,
   estimateTokens,
   formatPermissionProfileWarning,
+  getPendingHookTrust,
   googleSearchContext,
   groupCallsByPhase,
   renderDiff,
   runHook,
+  runLifecycleHooks,
   runSafePhases,
   runWithSessionKey,
   setContextWindow,
@@ -49,10 +51,10 @@ import {
   spawnAgentContext,
   truncateOutput,
   undoStack
-} from "./chunk-ZOPYREL5.js";
+} from "./chunk-N5LB3PPL.js";
 import "./chunk-T2NL5ZIA.js";
 import "./chunk-BXP6YZ2P.js";
-import "./chunk-6NS6643Y.js";
+import "./chunk-HX6N6QEY.js";
 import {
   SessionManager,
   getContentText
@@ -66,7 +68,7 @@ import {
 } from "./chunk-QMXC327F.js";
 import {
   runTool
-} from "./chunk-JBWA73GK.js";
+} from "./chunk-IFZX26K7.js";
 import {
   CONTENT_ONLY_STREAM_REMINDER,
   TEE_FINAL_USER_NUDGE,
@@ -85,7 +87,7 @@ import {
 } from "./chunk-XPBEJB27.js";
 import {
   ConfigManager
-} from "./chunk-UOROWTGG.js";
+} from "./chunk-NYCBOVNF.js";
 import "./chunk-TZQHYZKT.js";
 import {
   AGENTIC_BEHAVIOR_GUIDELINE,
@@ -104,7 +106,7 @@ import {
   SKILLS_DIR_NAME,
   VERSION,
   buildUserIdentityPrompt
-} from "./chunk-E5XCM4A6.js";
+} from "./chunk-GBBVCZ4W.js";
 import {
   formatGitContextForPrompt,
   getGitContext,
@@ -113,7 +115,9 @@ import {
 import "./chunk-4BKXL7SM.js";
 import "./chunk-TB4W4Y4T.js";
 import "./chunk-KHYD3WXE.js";
-import "./chunk-SLSWPBK3.js";
+import {
+  scanString
+} from "./chunk-SLSWPBK3.js";
 import "./chunk-K3CF65QH.js";
 import "./chunk-CKH4KQ4E.js";
 import {
@@ -147,6 +151,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
   allowedPermissionProfiles = [];
   workspaceRoot = process.cwd();
   networkPolicy;
+  hookConfigDir = process.cwd();
   /** Pending confirm promises keyed by requestId */
   pendingConfirms = /* @__PURE__ */ new Map();
   /** Pending batch confirm promises */
@@ -186,6 +191,7 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
     if (opts.allowedPermissionProfiles) this.allowedPermissionProfiles = opts.allowedPermissionProfiles;
     if (opts.workspaceRoot) this.workspaceRoot = opts.workspaceRoot;
     if (opts.networkPolicy) this.networkPolicy = opts.networkPolicy;
+    if (opts.hookConfigDir) this.hookConfigDir = opts.hookConfigDir;
   }
   /** Clear M7 timeout timer for a requestId */
   clearPendingTimer(requestId) {
@@ -234,7 +240,6 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
   }
   sendToolCallStart(call) {
     const dangerLevel = getDangerLevel(call.name, call.arguments);
-    let toolCallStarted = false;
     const startTime = Date.now();
     this.toolStartTimes.set(call.id, startTime);
     const msg = {
@@ -349,6 +354,26 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       dangerLevel,
       args: JSON.stringify(call.arguments).slice(0, 200)
     });
+    const preToolDecisions = runLifecycleHooks(
+      this.hookConfig,
+      "PreToolUse",
+      { tool: call.name, dangerLevel, args: call.arguments },
+      { configDir: this.hookConfigDir, onSummary: (message) => this.send({ type: "info", message: `[hook] ${message}` }) }
+    );
+    const preDeny = preToolDecisions.find((d) => d.action === "deny");
+    if (preDeny) {
+      const result = {
+        callId: call.id,
+        content: `[Hook denied] ${preDeny.reason ?? `PreToolUse blocked ${call.name}`}. Do not retry without asking.`,
+        isError: true
+      };
+      this.sendToolCallResult(call, result.content, true);
+      return result;
+    }
+    for (const d of preToolDecisions) {
+      const warnings = [d.warning, ...d.warnings ?? []].filter(Boolean);
+      for (const warning of warnings) this.send({ type: "info", message: `[hook] ${warning}` });
+    }
     const permission = checkPermissionWithProfile(
       call.name,
       call.arguments,
@@ -364,6 +389,14 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       }
     );
     const networkPermission = checkNetworkPolicy(call.name, call.arguments, this.networkPolicy);
+    if (networkPermission?.action === "confirm" || permission.action === "confirm") {
+      runLifecycleHooks(
+        this.hookConfig,
+        "PermissionRequest",
+        { tool: call.name, dangerLevel, args: call.arguments, reason: networkPermission?.reason ?? permission.reason },
+        { configDir: this.hookConfigDir, onSummary: (message) => this.send({ type: "info", message: "[hook] " + message }) }
+      );
+    }
     if (networkPermission?.action === "deny") {
       const reason = networkPermission.reason ? ` (${networkPermission.reason})` : "";
       return {
@@ -387,11 +420,13 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
         const content = truncateOutput(rawContent, call.name);
         this.sendToolCallResult(call, rawContent, false);
         runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
         return { callId: call.id, content, isError: false };
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         this.sendToolCallResult(call, message, true);
         runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
         return { callId: call.id, content: message, isError: true };
       }
     }
@@ -412,11 +447,13 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
         const content = truncateOutput(rawContent, call.name);
         this.sendToolCallResult(call, rawContent, false);
         runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
         return { callId: call.id, content, isError: false };
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         this.sendToolCallResult(call, message, true);
         runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+        runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
         return { callId: call.id, content: message, isError: true };
       }
     }
@@ -434,11 +471,13 @@ var ToolExecutorWeb = class _ToolExecutorWeb {
       const content = truncateOutput(rawContent, call.name);
       this.sendToolCallResult(call, rawContent, false);
       runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "ok" });
+      runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "ok" }, { configDir: this.hookConfigDir });
       return { callId: call.id, content, isError: false };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       this.sendToolCallResult(call, message, true);
       runHook(this.hookConfig?.postToolExecution, { tool: call.name, status: "error" });
+      runLifecycleHooks(this.hookConfig, "PostToolUse", { tool: call.name, status: "error", error: message }, { configDir: this.hookConfigDir });
       return { callId: call.id, content: message, isError: true };
     }
   }
@@ -681,6 +720,7 @@ var SessionHandler = class {
     const permissionProfiles = this.config.get("permissionProfiles") ?? {};
     this.toolExecutor.setConfig({
       hookConfig: hooks,
+      hookConfigDir: this.config.getConfigDir(),
       permissionRules,
       defaultPermission,
       permissionProfileName,
@@ -693,6 +733,11 @@ var SessionHandler = class {
     if (permissionProfileWarning) {
       this.send({ type: "info", message: permissionProfileWarning });
     }
+    const pendingHooks = getPendingHookTrust(hooks, this.config.getConfigDir());
+    if (pendingHooks.length > 0) {
+      this.send({ type: "info", message: `${pendingHooks.length} project hook(s) require trust. Use /hooks list and /hooks trust <id>.` });
+    }
+    runLifecycleHooks(hooks, "SessionStart", { source: "web" }, { configDir: this.config.getConfigDir() });
     this.sendStatus();
     askUserContext.rl = null;
     askUserContext.prompting = false;
@@ -801,6 +846,7 @@ var SessionHandler = class {
     }
   }
   onDisconnect() {
+    runLifecycleHooks(this.config.get("hooks") ?? void 0, "Stop", { sessionId: this.sessions.current?.id }, { configDir: this.config.getConfigDir() });
     this.toolExecutor.cancelAll();
     if (this.abortController) this.abortController.abort();
     for (const resolve3 of this.pendingAskUser.values()) resolve3(null);
@@ -978,6 +1024,26 @@ var SessionHandler = class {
     try {
       this.ensureSession();
       const session = this.sessions.current;
+      const promptDecisions = runLifecycleHooks(
+        this.config.get("hooks") ?? void 0,
+        "UserPromptSubmit",
+        { sessionId: session.id, prompt: content },
+        { configDir: this.config.getConfigDir(), onSummary: (message) => this.send({ type: "info", message: "[hook] " + message }) }
+      );
+      const promptDeny = promptDecisions.find((d) => d.action === "deny");
+      if (promptDeny) {
+        this.send({ type: "error", message: "Prompt blocked by hook: " + (promptDeny.reason ?? "UserPromptSubmit denied") });
+        return;
+      }
+      for (const d of promptDecisions) {
+        const warnings = [d.warning, ...d.warnings ?? []].filter(Boolean);
+        for (const warning of warnings) this.send({ type: "info", message: "[hook] " + warning });
+      }
+      const secretHits = scanString(content, { customRegexes: [] });
+      if (secretHits.length > 0) {
+        const kinds = [...new Set(secretHits.map((h) => h.kind))].join(", ");
+        this.send({ type: "info", message: "Possible secret in prompt (" + kinds + ")." });
+      }
       const ALLOWED_IMAGE_MIMES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/gif", "image/webp", "image/svg+xml"]);
       const MAX_IMAGE_SIZE = 10 * 1024 * 1024;
       let msgContent;
@@ -2533,7 +2599,7 @@ ${undoResults.map((r) => `  \u2022 ${r}`).join("\n")}` });
       case "test": {
         this.send({ type: "info", message: "\u{1F9EA} Running tests..." });
         try {
-          const { executeTests } = await import("./run-tests-3MHWUF43.js");
+          const { executeTests } = await import("./run-tests-H4Q2PRX6.js");
           const argStr = args.join(" ").trim();
           let testArgs = {};
           if (argStr) {
@@ -2883,6 +2949,21 @@ Add .md files to create commands.` });
       this.send({ type: "info", message: "Not enough messages to compact." });
       return;
     }
+    const preDecisions = runLifecycleHooks(
+      this.config.get("hooks") ?? void 0,
+      "PreCompact",
+      { sessionId: session.id, messageCount: session.messages.length, instruction },
+      { configDir: this.config.getConfigDir(), onSummary: (message) => this.send({ type: "info", message: "[hook] " + message }) }
+    );
+    const preDeny = preDecisions.find((d) => d.action === "deny");
+    if (preDeny) {
+      this.send({ type: "error", message: "Compact blocked by hook: " + (preDeny.reason ?? "PreCompact denied") });
+      return;
+    }
+    for (const d of preDecisions) {
+      const warnings = [d.warning, ...d.warnings ?? []].filter(Boolean);
+      for (const warning of warnings) this.send({ type: "info", message: "[hook] " + warning });
+    }
     const provider = this.providers.get(this.currentProvider);
     if (!provider) return;
     this.send({ type: "info", message: "Compacting conversation..." });
@@ -2902,7 +2983,15 @@ Add .md files to create commands.` });
       });
       const summaryMsg = { role: "user", content: "[Conversation summary]", timestamp: /* @__PURE__ */ new Date() };
       const ackMsg = { role: "assistant", content: response.content, timestamp: /* @__PURE__ */ new Date() };
-      session.compact(summaryMsg, ackMsg, keepLast);
+      const beforeCount = session.messages.length;
+      const removedCount = session.compact(summaryMsg, ackMsg, keepLast);
+      const afterCount = session.messages.length;
+      runLifecycleHooks(
+        this.config.get("hooks") ?? void 0,
+        "PostCompact",
+        { sessionId: session.id, beforeCount, afterCount, removedCount, keepLast, instruction },
+        { configDir: this.config.getConfigDir(), onSummary: (message) => this.send({ type: "info", message: "[hook] " + message }) }
+      );
       this.send({ type: "info", message: `Compacted: removed ${toSummarize.length} messages, kept last ${keepLast}.` });
       this.sendStatus();
     } catch (err) {