one-code-extension 0.4.1 → 0.6.0

package/extensions/hooks/index.ts

@@ -15,7 +15,7 @@
  *
  * A hook can block anything, loaders included (tool_search/skill/
  * structured_output) — full CC fidelity, the user's config is the user's
- * choice; see docs/findings.md for the foot-gun note. A hook can never
+ * choice; see working-docs/findings.md for the foot-gun note. A hook can never
  * pre-approve: "allow" is informational and the permission gate still runs.
  *
  * pi's emitToolCall has no try/catch around handlers, so every hook dispatch
@@ -26,11 +26,17 @@
  * never as a message of its own: PreToolUse context is queued as a one-shot on
  * the reminder channel, so it lands INSIDE the tool result it belongs to,
  * persisted, at no extra turn; PostToolUse context is appended to the result
- * the same way; prompt/session/compaction context is returned from
- * `before_agent_start` as a custom message right AFTER the user's prompt. Until
+ * the same way; prompt, session and compaction context is a one-shot too,
+ * persisted as a `one-code:pending` entry when the hook answers, so it rides
+ * the next request whatever opens it (a prompt, a notification, the
+ * continuation after a mid-turn compaction) and counts as delivered only when
+ * that request's reply stays on the branch (lib/ledger/fold.ts). Until
  * 2026-09-05 each was a custom steer (one extra LLM turn per hook per tool,
  * pi draining one steer per call) and prompt context landed BEFORE the prompt
- * (STEERING-REVIEW-2026-09-05 M6).
+ * (STEERING-REVIEW-2026-09-05 M6); until 2026-10-21 prompt, session and
+ * compaction context was a `before_agent_start` message, taken off its queue
+ * before the request went out and held until a run started (round 3,
+ * R3-M14).
  *
  * Subagents: the tool hooks also run for a child's tool calls, through the
  * bridge published on `SUBAGENT_HOOK_CHANNEL` (subagent-bridge.ts): the child
@@ -38,12 +44,16 @@
  * (settings, consent, logging) and a payload naming the child.
  */
 
+import { randomUUID } from "node:crypto";
+import { contentText } from "@earendil-works/pi-ai";
 import { getAgentDir, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { RunOutcomeLatch } from "../lib/interrupt.ts";
+import { SESSION_WORK_CHANNEL, type SessionWorkQuery } from "../lib/session-work.ts";
 import { claudeConfigDir } from "../lib/paths.ts";
 import { defaultDiscoverRoots } from "../lib/plugins.ts";
 import { appendHookLog, formatDebugLine, hooksDebugEnabled, hooksLogPath } from "./debug.ts";
 import { runHookCommand } from "./executor.ts";
+import { PRECOMPACT_INSTRUCTIONS_CHANNEL, type PreCompactInstructions } from "./compaction.ts";
 import { changedSince, FORMATTER_NOTICE, type FileSnapshot, fileToolTarget, snapshotFile } from "./formatter-notice.ts";
 import { matcherApplies, ccToolName, toolMatchCandidates, ccToolInput, nativeToolInput } from "./matcher.ts";
 import { loadPluginHooks } from "./plugin-hooks.ts";
@@ -52,13 +62,18 @@ import {
 	type CcHookEvent,
 	type HookOutcome,
 	type HookStdinPayload,
+	cancelledOutcome,
 	interpretHookResult,
 } from "./protocol.ts";
 import { type HookCommand, type HooksSource, loadHookSettings } from "./settings.ts";
 import { persistIfLarge, sessionResultsDir } from "../lib/persisted-output.ts";
-import { REMINDER_CHANNEL, wrapReminder } from "../lib/reminders.ts";
+import { REMINDER_CHANNEL, type ReminderPayload, wrapReminder } from "../lib/reminders.ts";
 import { type ChildHookCall, type ChildHookResult, type HookBridge, SUBAGENT_HOOK_CHANNEL, type SubagentHookPayload } from "./subagent-bridge.ts";
 import { projectHooksApproved } from "./trust.ts";
+import { PromptContextRouter } from "./prompt-context.ts";
+import { SKILL_INVOCATION_TYPE, type SkillInvocationDetails } from "../skill/invoke.ts";
+import { consentDialog } from "../lib/consent-dialogs.ts";
+import { followWorkCwd } from "../lib/worktree-channel.ts";
 
 /** Claude Code's `hook_additional_context` attachment text (utils/messages.ts). */
 export function hookContextText(event: CcHookEvent, text: string): string {
@@ -74,11 +89,13 @@ export function hookContextText(event: CcHookEvent, text: string): string {
  * convention) and the model gets a preview plus the path — nothing is cut away.
  */
 const HOOK_MODEL_TEXT_CAP = 20_000;
-// A monotonic counter, not Date.now(), so two hooks finishing in the same
-// millisecond do not persist to the same file and clobber each other (review M2).
-let hookPersistSeq = 0;
+// A random id, never a counter: the results directory is shared by every
+// session of the project, and a counter restarts with each process and each
+// /reload, so a later hook overwrote a file an earlier transcript points to
+// (design.md section 14). Two hooks finishing in the same millisecond still get
+// two files (review M2).
 function capHookText(text: string, ctx: HookDispatchCtx, label: string): string {
-	return persistIfLarge(text, { dir: sessionResultsDir(ctx), id: `hook-${label}-${hookPersistSeq++}`, maxBytes: HOOK_MODEL_TEXT_CAP });
+	return persistIfLarge(text, { dir: sessionResultsDir(ctx), id: `hook-${label}-${randomUUID()}`, maxBytes: HOOK_MODEL_TEXT_CAP });
 }
 
 interface MatchedHook {
@@ -95,15 +112,31 @@ interface HookDispatchCtx {
 	cwd: string;
 	hasUI: boolean;
 	sessionManager: { getSessionId(): string; getSessionFile(): string | undefined; getSessionDir?(): string | undefined };
-	ui: { confirm(title: string, message: string): Promise<boolean | undefined>; notify(message: string, type: "info"): void };
+	ui: { confirm(title: string, message: string, options?: { signal?: AbortSignal }): Promise<boolean | undefined>; notify(message: string, type: "info"): void };
+	signal?: AbortSignal;
 	/** Set on the shutdown snapshot: no consent prompt, no notices — the session is gone. */
 	sessionEnded?: true;
 }
 
+/** Claude Code's default cap on consecutive Stop-hook continuations in one user turn. */
+const MAX_STOP_CONTINUATIONS = 8;
+
+/** The customType of the Stop hook's continuation message. */
+const STOP_CONTINUATION_TYPE = "one-code:hook-stop";
+
+/** Whether a `before_agent_start` opens the Stop hook's own continuation run (pi 1.2.0 fires it for custom runs). */
+function isStopContinuation(event: unknown): boolean {
+	const run = event as { messageType?: string; message?: { customType?: string } };
+	return run.messageType === "custom" && run.message?.customType === STOP_CONTINUATION_TYPE;
+}
+
 export default function hooksExtension(pi: ExtensionAPI) {
-	let stopHookActive = false;
-	/** Context from UserPromptSubmit / SessionStart / PostCompact hooks, delivered with the next prompt. */
-	let pendingPromptContext: Array<{ event: CcHookEvent; text: string }> = [];
+	const workCwd = followWorkCwd(pi.events);
+	let stopHookBlocks = 0;
+	/** Prompt, session and compaction hook context, as a one-shot the next request carries (lib/reminders.ts). */
+	const deliverContext = (event: CcHookEvent, text: string) => pi.events.emit(REMINDER_CHANNEL, { text: hookContextText(event, text), placement: "last-append" });
+	/** UserPromptSubmit context, held until pi delivers its prompt (prompt-context.ts). */
+	const promptContext = new PromptContextRouter();
 	/** The last context seen, for bridged child calls (dispatched parent-side). */
 	let lastCtx: ExtensionContext | undefined;
 	/**
@@ -116,6 +149,8 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	let sessionStartPending: Promise<void> | undefined;
 	/** Bumped on every session_start; a superseded dispatch checks it before writing context. */
 	let sessionGen = 0;
+	/** Covers startup hooks and other dispatches that have no active turn signal. */
+	let sessionAbort = new AbortController();
 
 	const notify = (ctx: HookDispatchCtx, message: string) => {
 		if (ctx.sessionEnded) return; // session gone; nowhere to show it
@@ -131,7 +166,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	): Promise<MatchedHook[]> => {
 		const claudeDir = claudeConfigDir();
 		const loaded = loadHookSettings(claudeDir, ctx.cwd);
-		const pluginSources = loadPluginHooks(defaultDiscoverRoots(getAgentDir(), ctx.cwd), loaded.diagnostics);
+		const pluginSources = loaded.disabled ? [] : loadPluginHooks(defaultDiscoverRoots(getAgentDir(), ctx.cwd), loaded.diagnostics);
 		if (hooksDebugEnabled()) {
 			for (const diagnostic of loaded.diagnostics) process.stderr.write(`[hooks] ${diagnostic}\n`);
 		}
@@ -143,7 +178,8 @@ export default function hooksExtension(pi: ExtensionAPI) {
 			projectAllowed = await projectHooksApproved(ctx.cwd, projectSources, {
 				hasUI: ctx.hasUI,
 				noPrompt: ctx.sessionEnded,
-				confirm: (title, message) => ctx.ui.confirm(title, message),
+				signal: ctx.signal,
+				confirm: (title, message) => consentDialog(pi.events, (signal) => ctx.ui.confirm(title, message, { signal: signal && ctx.signal ? AbortSignal.any([signal, ctx.signal]) : signal ?? ctx.signal })),
 				notify: (message) => notify(ctx, message),
 			});
 		}
@@ -168,7 +204,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	const basePayload = (ctx: HookDispatchCtx, event: CcHookEvent): HookStdinPayload => ({
 		session_id: ctx.sessionManager.getSessionId(),
 		transcript_path: ctx.sessionManager.getSessionFile() ?? "",
-		cwd: ctx.cwd,
+		cwd: workCwd(ctx.cwd),
 		hook_event_name: event,
 	});
 
@@ -181,20 +217,27 @@ export default function hooksExtension(pi: ExtensionAPI) {
 		ctx: HookDispatchCtx,
 		event: CcHookEvent,
 		matchValue: { candidates?: string[]; ignoreMatcher?: boolean },
-		payload: HookStdinPayload,
+		payloadOrFactory: HookStdinPayload | (() => Promise<HookStdinPayload | undefined>),
 		/** Runs once, only when hooks will actually run — the point where a caller can snapshot state the hooks may change. */
 		willRun?: () => void,
 	): Promise<HookOutcome> => {
 		const merged: HookOutcome = {};
+		const signal = ctx.sessionEnded ? ctx.signal : ctx.signal ? AbortSignal.any([ctx.signal, sessionAbort.signal]) : sessionAbort.signal;
 		try {
-			const hooks = await collectHooks(ctx, event, matchValue);
-			if (hooks.length === 0) return merged;
+			const hooks = await collectHooks({ ...ctx, signal }, event, matchValue);
+			const payload = typeof payloadOrFactory === "function" ? await payloadOrFactory() : payloadOrFactory;
+			if (!payload || hooks.length === 0) return merged;
+			// Cancelled before the hooks ran: the gating events block, as a mid-run cancel does.
+			if (signal?.aborted) return cancelledOutcome(event);
 			willRun?.();
 			const stdin = JSON.stringify(payload);
-			const outcomes = await Promise.all(
+			const outcomes = await Promise.allSettled(
 				hooks.map(async ({ source, hook }) => {
 					const run = await runHookCommand(hook.command, stdin, {
-						cwd: ctx.cwd,
+						// The calling session's worktree or child's directory; settings,
+						// consent and CLAUDE_PROJECT_DIR still belong to the parent project.
+						cwd: payload.cwd,
+						signal,
 						timeoutSeconds: hook.timeout,
 						shell: hook.shell,
 						projectDir: ctx.cwd,
@@ -221,7 +264,16 @@ export default function hooksExtension(pi: ExtensionAPI) {
 					return outcome;
 				}),
 			);
-			for (const outcome of outcomes) {
+			if (signal?.aborted) return cancelledOutcome(event);
+			for (const result of outcomes) {
+				// One broken response must not erase another hook's deny or let the
+				// tool run while the other hooks are still deciding.
+				if (result.status === "rejected") {
+					if (hooksDebugEnabled()) process.stderr.write(`[hooks] hook error (${event}): ${String(result.reason)}\n`);
+					continue;
+				}
+				const outcome = result.value;
+				if (outcome.preventContinuation) merged.preventContinuation = true;
 				// A block reason becomes model-facing text (the tool result, or a
 				// Stop follow-up), so it is bounded like the other hook texts —
 				// stderr on an exit-2 hook is easily a full stack trace (review M2).
@@ -291,7 +343,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
 		// to it: this extension awaits the hook and loads before file-tracker, so
 		// the tracker records the hook's version as the model's own write
 		// (formatter-notice.ts, review M1). Snapshot only when hooks will run.
-		const target = event.isError ? undefined : fileToolTarget(event.toolName, event.input, ctx.cwd);
+		const target = event.isError ? undefined : fileToolTarget(event.toolName, event.input, payload.cwd);
 		let before: FileSnapshot | undefined;
 		const outcome = await dispatch(ctx, "PostToolUse", { candidates: toolMatchCandidates(event.toolName) }, payload, () => {
 			if (target) before = snapshotFile(target);
@@ -305,47 +357,98 @@ export default function hooksExtension(pi: ExtensionAPI) {
 				[outcome.additionalContext && wrapReminder(hookContextText("PostToolUse", outcome.additionalContext)), formatterNotice]
 					.filter(Boolean)
 					.join("\n") || undefined,
-		});
+		}, event.toolName);
 		if (!content) return undefined;
 		return { content, isError: event.isError };
 	});
 
-	/** Await the backgrounded SessionStart dispatch once, if one is pending. */
+	/**
+	 * Await the backgrounded SessionStart dispatch, if one is pending. Every
+	 * caller awaits the same dispatch, and it is forgotten only once it settles:
+	 * a notification opening the first turn and a prompt typed meanwhile both
+	 * wait for it, rather than the second returning at once.
+	 */
 	const drainSessionStart = async () => {
-		if (!sessionStartPending) return;
 		const pending = sessionStartPending;
-		sessionStartPending = undefined;
+		if (!pending) return;
 		try {
 			await pending;
 		} catch {
 			// dispatch already reports its own failures; never block the turn on one.
 		}
+		if (sessionStartPending === pending) sessionStartPending = undefined;
 	};
 
 	// ---- UserPromptSubmit ---------------------------------------------------
 	pi.on("input", async (event, ctx) => {
+		// A new idle prompt means an earlier idle one was delivered or never will
+		// be (an extension after this one handled it): its context is stale. An
+		// extension's prompt (a command's sendUserMessage) counts too, or its
+		// message would take that context as its own.
+		if (!event.streamingBehavior) promptContext.dropIdle();
 		if (event.source === "extension") return undefined;
-		stopHookActive = false;
+		// Set for a message queued mid-turn (pi 0.86+ fires `input` for
+		// steer/followUp). The Stop latch is reset in before_agent_start, where a
+		// turn really starts: pi re-checks streaming after these handlers, so a
+		// queued message whose turn ended during the hook opens a new turn.
+		const gen = sessionGen;
 		// Drain the backgrounded SessionStart dispatch before this prompt's own
 		// UserPromptSubmit context, so their order in the first turn is unchanged
 		// (SessionStart context precedes UserPromptSubmit). before_agent_start is
 		// the backstop for turns with no input event (one-shot, programmatic).
 		await drainSessionStart();
+		if (gen !== sessionGen) return { action: "handled" as const };
 		const payload: HookStdinPayload = { ...basePayload(ctx, "UserPromptSubmit"), prompt: event.text };
 		const outcome = await dispatch(ctx, "UserPromptSubmit", { ignoreMatcher: true }, payload);
+		if (gen !== sessionGen) return { action: "handled" as const };
 		if (outcome.block) {
 			notify(ctx, `Prompt blocked by UserPromptSubmit hook: ${outcome.block.reason}`);
 			return { action: "handled" as const };
 		}
-		if (outcome.additionalContext) pendingPromptContext.push({ event: "UserPromptSubmit", text: outcome.additionalContext });
+		// The context waits for pi to deliver this prompt (message_start below),
+		// queued mid-turn or not, so it rides the prompt's own request and never a
+		// run a notification opens first. A queued message is held without
+		// context too, so its delivery never takes an idle prompt's.
+		const text = outcome.additionalContext ? hookContextText("UserPromptSubmit", outcome.additionalContext) : undefined;
+		if (event.streamingBehavior) promptContext.holdQueued(event.text, text);
+		else if (text) promptContext.holdIdle(event.text, text);
 		return undefined;
 	});
 
-	// Prompt/session/compaction hook context rides the turn it belongs to as a
-	// custom message pi appends right AFTER the user's prompt (the
-	// before_agent_start `message` return). An idle `sendMessage` from here
-	// landed it BEFORE the prompt (pi appends first, then adds the user message).
-	pi.on("before_agent_start", async (_event, ctx) => {
+	// pi awaits this before the request that carries the delivered message, so a
+	// one-shot emitted here is pinned to that message: after the prompt, as the
+	// before_agent_start message is for a prompt that opens a turn.
+	pi.on("message_start", async (event) => {
+		const gen = sessionGen;
+		const message = event.message;
+		// Pinned to its prompt: when that prompt's request fails, the next prompt's
+		// request resends it with its own context, not with this one's.
+		const emit = (text: string) => pi.events.emit(REMINDER_CHANNEL, { text, placement: "last-append", promptTimestamp: message.timestamp } satisfies ReminderPayload);
+		if (message.role === "user") {
+			if (promptContext.isEmpty) return;
+			// A queued message delivers as typed, so an exact match is its own; the
+			// idle prompt's message may carry its expansion instead.
+			const text = promptContext.release(contentText(message.content, ""));
+			if (text) emit(text);
+			return;
+		}
+		if (message.role !== "custom") return;
+		// A background completion that opens the first turn skips
+		// before_agent_start: the SessionStart context must be pending before its
+		// request is rendered.
+		await drainSessionStart();
+		// A `/skill:` command the skill extension took over arrives as its hidden
+		// message, carrying the typed text: that prompt's context rides it.
+		if (message.customType !== SKILL_INVOCATION_TYPE || promptContext.isEmpty) return;
+		const input = (message.details as Partial<SkillInvocationDetails> | undefined)?.input;
+		const queued = typeof input === "string" ? promptContext.release(input, true) : undefined;
+		if (gen === sessionGen && queued) emit(queued);
+	});
+
+	// The first turn waits for the backgrounded SessionStart dispatch, so its
+	// context is pending before the request is rendered.
+	pi.on("before_agent_start", async (event, ctx) => {
+		const gen = sessionGen;
 		lastCtx = ctx;
 		// The SessionStart dispatch runs in the background from session_start; the
 		// first turn must wait for it so its additionalContext is present (and, on
@@ -353,35 +456,37 @@ export default function hooksExtension(pi: ExtensionAPI) {
 		// The `input` handler usually drained it already; this is the backstop for
 		// turns with no input event.
 		await drainSessionStart();
-		if (pendingPromptContext.length === 0) return;
-		const texts = pendingPromptContext;
-		pendingPromptContext = [];
-		return {
-			message: {
-				customType: "one-code:hook-context",
-				content: texts.map(({ event, text }) => wrapReminder(hookContextText(event, text))).join("\n"),
-				display: false,
-			},
-		};
+		if (gen !== sessionGen) return;
+		// Every run that opens lands here (on pi 1.2.0 also one an extension
+		// opened; a queued delivery does not). Only the Stop hook's own
+		// continuation keeps the cap counting: a notification or scheduled run
+		// starts a fresh turn, as a prompt does.
+		if (!isStopContinuation(event)) stopHookBlocks = 0;
 	});
 
 	// ---- SessionStart / SessionEnd -----------------------------------------
 	const dispatchSessionStart = async (ctx: ExtensionContext, source: string, gen: number) => {
-		const payload: HookStdinPayload = { ...basePayload(ctx, "SessionStart"), source };
-		const outcome = await dispatch(ctx, "SessionStart", { candidates: [source] }, payload);
+		// Reserve project-hook consent synchronously, before MCP and external
+		// imports enqueue their dialogs. Only defer the payload: worktree's later
+		// synchronous session_start handler must restore cwd before we capture it.
+		const outcome = await dispatch(ctx, "SessionStart", { candidates: [source] }, async () => {
+			await new Promise<void>((resolve) => setImmediate(resolve));
+			return gen === sessionGen ? { ...basePayload(ctx, "SessionStart"), source } : undefined;
+		});
 		// A later session_start (rapid /clear, resume) may have superseded this one
 		// while its hook ran; discard the stale result instead of pushing it into
-		// the new session's context (`pendingPromptContext` is shared and reset).
-		if (gen === sessionGen && outcome.additionalContext) {
-			pendingPromptContext.push({ event: "SessionStart", text: outcome.additionalContext });
-		}
+		// the new session's context.
+		if (gen === sessionGen && outcome.additionalContext) deliverContext("SessionStart", outcome.additionalContext);
 	};
 
 	pi.on("session_start", (event, ctx) => {
+		sessionAbort.abort();
+		sessionAbort = new AbortController();
 		lastCtx = ctx;
 		const gen = ++sessionGen;
-		pendingPromptContext = [];
+		promptContext.clear();
 		sessionStartPending = undefined;
+		stopHookBlocks = 0;
 		// Publish the child hook bridge (subagent-bridge.ts). The closures read
 		// live parent state per call, so once per session start is enough.
 		pi.events.emit(SUBAGENT_HOOK_CHANNEL, { bridge: childHookBridge } satisfies SubagentHookPayload);
@@ -410,9 +515,21 @@ export default function hooksExtension(pi: ExtensionAPI) {
 		agent_id: call.sessionId,
 		agent_type: call.agentType,
 	});
+	/**
+	 * The parent's settings/consent context with the CHILD's run signal. A
+	 * background child outlives the parent's turn, so Esc in the parent must
+	 * not skip a child's deny hook; stopping the child must cancel its hooks.
+	 */
+	const childDispatchCtx = (ctx: ExtensionContext, call: ChildHookCall): HookDispatchCtx => ({
+		cwd: ctx.cwd,
+		hasUI: ctx.hasUI,
+		sessionManager: ctx.sessionManager,
+		ui: ctx.ui,
+		signal: call.signal,
+	});
 	const childHookBridge: HookBridge = {
 		async preToolUse(call) {
-			const ctx = lastCtx;
+			const ctx = lastCtx && childDispatchCtx(lastCtx, call);
 			if (!ctx) return {};
 			const outcome = await dispatch(ctx, "PreToolUse", { candidates: toolMatchCandidates(call.toolName) }, childPayload(call, "PreToolUse"));
 			return {
@@ -422,7 +539,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
 			};
 		},
 		async postToolUse(result: ChildHookResult) {
-			const ctx = lastCtx;
+			const ctx = lastCtx && childDispatchCtx(lastCtx, result);
 			if (!ctx) return {};
 			const payload: HookStdinPayload = {
 				...childPayload(result, "PostToolUse"),
@@ -449,6 +566,9 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	};
 
 	pi.on("session_shutdown", (event, ctx) => {
+		// Also cancels a queued SessionStart before its deferred dispatch touches a disposed context.
+		sessionGen += 1;
+		sessionAbort.abort();
 		// A reload re-runs the extensions but keeps the conversation (pi's
 		// AgentSession.reload): not a session end, Claude Code has no such event.
 		if (event.reason === "reload") return;
@@ -492,19 +612,40 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	});
 
 	pi.on("agent_settled", async (_event, ctx) => {
+		const gen = sessionGen;
+		// A queued message pi never delivered as typed (expanded, or taken over by
+		// an extension) keeps no context for a later, unrelated prompt; an idle
+		// prompt that opened no run of its own (one handled after this extension)
+		// keeps none either.
+		promptContext.clear();
 		// CC skips Stop when the turn ended on an API error (a blocking hook would
 		// spiral: error → block → retry → error) or on a user interrupt (its query
 		// loop returns on the abort signal before the stop-hook step). An empty latch
 		// means no run ended in this turn, which is not a response to stop on either.
 		if (stopOutcome.take() !== "ok") return;
-		const payload: HookStdinPayload = { ...basePayload(ctx, "Stop"), stop_hook_active: stopHookActive };
+		// Claude Code's two lists of what will wake the session later, filled by the
+		// background extension (lib/session-work.ts); empty arrays when none.
+		const work: SessionWorkQuery = { crons: [], tasks: [] };
+		pi.events.emit(SESSION_WORK_CHANNEL, work);
+		const payload: HookStdinPayload = {
+			...basePayload(ctx, "Stop"),
+			stop_hook_active: stopHookBlocks > 0,
+			background_tasks: work.tasks,
+			session_crons: work.crons,
+		};
 		const outcome = await dispatch(ctx, "Stop", { ignoreMatcher: true }, payload);
-		if (!outcome.block) return;
-		stopHookActive = true;
+		if (gen !== sessionGen || outcome.preventContinuation || !outcome.block) return;
+		// Claude Code limits repeated Stop blocks to eight continuations. A hook
+		// that ignores stop_hook_active must not run up an unbounded model loop.
+		if (stopHookBlocks >= MAX_STOP_CONTINUATIONS) {
+			notify(ctx, `Stop hook continuation limit reached (${MAX_STOP_CONTINUATIONS}); ending the turn.`);
+			return;
+		}
+		stopHookBlocks += 1;
 		try {
 			pi.sendMessage(
 				{
-					customType: "one-code:hook-stop",
+					customType: STOP_CONTINUATION_TYPE,
 					content: `Stop hook blocked stopping: ${outcome.block.reason}`,
 					display: false,
 				},
@@ -533,10 +674,19 @@ export default function hooksExtension(pi: ExtensionAPI) {
 			notify(ctx, `Compaction cancelled by PreCompact hook: ${outcome.block.reason}`);
 			return { cancel: true };
 		}
+		// These instructions belong to the summarizer, not the next user turn.
+		// The signal keeps them scoped to this attempt if compaction is cancelled.
+		if (outcome.additionalContext) {
+			pi.events.emit(PRECOMPACT_INSTRUCTIONS_CHANNEL, {
+				signal: event.signal,
+				instructions: outcome.additionalContext,
+			} satisfies PreCompactInstructions);
+		}
 		return undefined;
 	});
 
 	pi.on("session_compact", async (event, ctx) => {
+		const gen = sessionGen;
 		const trigger = compactTrigger(event);
 		const payload: HookStdinPayload = {
 			...basePayload(ctx, "PostCompact"),
@@ -544,7 +694,8 @@ export default function hooksExtension(pi: ExtensionAPI) {
 			compact_summary: event.compactionEntry.summary,
 		};
 		const outcome = await dispatch(ctx, "PostCompact", { candidates: [trigger] }, payload);
-		if (outcome.additionalContext) pendingPromptContext.push({ event: "PostCompact", text: outcome.additionalContext });
+		if (gen !== sessionGen) return;
+		if (outcome.additionalContext) deliverContext("PostCompact", outcome.additionalContext);
 		// CC fires SessionStart(source: "compact") after compaction. Awaited inline
 		// (not backgrounded), so the current generation is still in force.
 		await dispatchSessionStart(ctx, "compact", sessionGen);

package/extensions/hooks/matcher.ts

@@ -38,6 +38,9 @@ const CC_CANONICAL: Record<string, string> = {
 	task_stop: "TaskStop",
 	monitor: "Monitor",
 	schedule_wakeup: "ScheduleWakeup",
+	cron_create: "CronCreate",
+	cron_list: "CronList",
+	cron_delete: "CronDelete",
 	send_message: "SendMessage",
 	enter_worktree: "EnterWorktree",
 	exit_worktree: "ExitWorktree",

package/extensions/hooks/prompt-context.ts

@@ -0,0 +1,59 @@
+/**
+ * Which delivered message takes a UserPromptSubmit hook's context. Pure (no pi
+ * imports).
+ *
+ * A message queued mid-turn delivers as typed, so the user message with its
+ * text is its own (lib/queued-delivery.ts). A prompt typed while idle is
+ * expanded by pi after the input handlers (a prompt template, a `/skill:` no
+ * extension took), and a later handler may transform it, so its message
+ * rarely carries the typed text. It is the next prompt pi delivers, though:
+ * the first user message no queued message claims takes it.
+ *
+ * A queued message is held even when its hook added no context, so its
+ * delivery claims nothing instead of taking an idle prompt's context.
+ */
+
+import { QueuedDelivery } from "../lib/queued-delivery.ts";
+
+export class PromptContextRouter {
+	/** Context per queued message; null marks one whose hook added none. */
+	private readonly queued = new QueuedDelivery<string | null>();
+	private idle: Array<{ text: string; payload: string }> = [];
+
+	/** A message queued mid-turn, with its hook's context or none. */
+	holdQueued(text: string, payload: string | undefined): void {
+		this.queued.hold(text, payload ?? null);
+	}
+
+	/** A prompt typed while idle and its hook's context. */
+	holdIdle(text: string, payload: string): void {
+		this.idle.push({ text, payload });
+	}
+
+	/** A new idle prompt: an earlier idle one was delivered or never will be, so its context is stale. */
+	dropIdle(): void {
+		this.idle = [];
+	}
+
+	get isEmpty(): boolean {
+		return this.queued.isEmpty && this.idle.length === 0;
+	}
+
+	/**
+	 * The context for a delivered user message with this text: a queued message
+	 * typed so claims its own (none, when its hook added none); else the idle
+	 * prompt typed so; else, unless `exact`, the oldest idle prompt. Released once.
+	 */
+	release(text: string, exact = false): string | undefined {
+		const queued = this.queued.release(text);
+		if (queued !== undefined) return queued ?? undefined;
+		const at = this.idle.findIndex((entry) => entry.text === text);
+		const index = at === -1 && !exact && this.idle.length > 0 ? 0 : at;
+		return index === -1 ? undefined : this.idle.splice(index, 1)[0].payload;
+	}
+
+	clear(): void {
+		this.queued.clear();
+		this.idle = [];
+	}
+}