feat(core): run session start hooks

[taltas]

Stack

This is 3 of 4 in the Zoo Code hooks MVP stack. Review and merge from the bottom upward. Do not merge this PR until #1154 is merged.

Position	Pull request	Base	Scope
1	#1153	main	Hook contracts and policies
2	#1154	fm/zoo-hooks-contracts	Global settings and Hooks panel
3 (this PR)	#1156	fm/zoo-hooks-settings	Runner and sessionStart integration
4	#1155	fm/zoo-hooks-session-start	preToolUse, E2E, and documentation

Summary

Implement the bounded extension-host hook runner and integrate sessionStart hooks into new and resumed tasks with durable, localized chat lifecycle rows.

Scope

• Spawn configured executables directly with explicit argv, never through a shell command string.
• Enforce a 10-second timeout, bounded stdout/stderr capture, and process-tree termination on timeout or task cancellation.
• Persist stable hook lifecycle rows and repair stale running rows when history is reopened.
• Run matching sessionStart hooks for new tasks and resumed task history, then add successful output to model context.
• Suppress structured hook lifecycle rows in the CLI while preserving extension-host behavior.
• Render localized hook status cards in the webview chat UI.
• Test success, nonzero exit, timeout, output truncation, cancellation, persistence, reopen behavior, model visibility, and CLI handling.

Runtime Flow

sequenceDiagram
    participant T as Task
    participant R as HookRunner
    participant P as Child process tree
    participant H as Task history
    participant M as Model context
    T->>H: Persist running hook row
    T->>R: Run sessionStart invocation
    R->>P: Spawn executable plus argv
    alt Success within limits
        P-->>R: Exit 0 plus bounded output
        R-->>T: Succeeded result
        T->>H: Finalize row
        T->>M: Add stdout context
    else Timeout or cancellation
        R->>P: Terminate process tree
        R-->>T: Terminal failure result
        T->>H: Finalize row
    end

Loading

Tests

• src/core/hooks/__tests__/HookRunner.spec.ts
• src/core/task/__tests__/Task.persistence.spec.ts
• webview-ui/src/components/chat/__tests__/HookRow.spec.tsx
• apps/cli/src/agent/__tests__/output-manager.hooks.test.ts
• apps/cli/src/ui/hooks/__tests__/useMessageHandlers.hooks.test.ts
• Full stack validation at the top branch: pnpm test (437 files passed, 7,356 tests passed, 39 skipped).
• Full stack validation at the top branch: pnpm check-types, pnpm lint, and pnpm build passed.
• Full stack VS Code smoke validation: USE_MOCK=true TEST_FILE=hooks.test pnpm --filter @roo-code/vscode-e2e test:run passed, including session-start model visibility/history reopen and root/child process cancellation.

Risks

• Local executables are trusted user configuration and run with extension-host permissions. Direct spawning avoids shell interpolation but does not sandbox the executable itself.
• Process-tree termination differs by platform; focused runner tests and real VS Code E2E exercise root and child cleanup.
• Hook output is intentionally bounded before persistence and model insertion to protect memory, history size, and context usage.
• Session-start ordering affects model context. Tests cover both new-task and resumed-history paths.

Review Notes

• The unique diff is against fm/zoo-hooks-settings, not main.
• Additive commits 5ffe21f76 and 762a3fc08 propagate the settings CI fixes and type session-hook test doubles; all original published commits remain reachable.
• Additive follow-up ca4fae6b1 uses native taskkill.exe tree termination on Windows, normalizes missing absolute executables, and keeps POSIX mode assertions platform-specific.
• Additive follow-up 9c2adfb4c resolves taskkill.exe through %SystemRoot%\\System32, avoiding PATH ambiguity and Knip's unlisted-binary finding.
• Additive follow-up 784938134 injects the platform for deterministic Linux coverage of Windows termination; focused HookRunner.ts line coverage is 90.74%.
• Additive cleanup 75322a7d2 removes a redundant rejected-promise fallback because execa already uses reject: false.
• preToolUse gating is intentionally deferred to the top PR.
• No changeset is included, per repository guidance.
• Merge order is #1153 -> #1154 -> #1156 -> #1155.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 56d42009-a940-4455-8765-b8aab4553ce7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 41 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/core/hooks/HookRunner.ts	80.50%	9 Missing and 14 partials ⚠️
src/core/task/Task.ts	81.15%	5 Missing and 8 partials ⚠️
webview-ui/src/components/chat/HookRow.tsx	78.57%	0 Missing and 3 partials ⚠️
apps/cli/src/ui/hooks/useMessageHandlers.ts	50.00%	1 Missing ⚠️
webview-ui/src/components/chat/ChatRow.tsx	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!