Add Session Hooks support (PreToolUse, PostToolUse, UserPromptSubmitted, etc.)

[PureWeen]

Summary

The SDK provides 6 hook types that allow customizing session behavior at key lifecycle points. PolyPilot does not use any of them.

SDK Hooks

Hook	Input	Output	Purpose
OnPreToolUse	ToolName, ToolArgs, Cwd	PermissionDecision, ModifiedArgs, AdditionalContext	Block/modify tool calls before execution
OnPostToolUse	ToolName, ToolArgs, ToolResult	ModifiedResult, AdditionalContext	Filter/transform tool output after execution
OnUserPromptSubmitted	Prompt, Cwd	ModifiedPrompt, AdditionalContext	Rewrite prompts, inject context
OnSessionStart	Cwd, Source, InitialPrompt	AdditionalContext, ModifiedConfig	Custom initialization
OnSessionEnd	Reason, FinalMessage, Error	CleanupActions, SessionSummary	Custom cleanup
OnErrorOccurred	Error, ErrorContext, Recoverable	ErrorHandling, RetryCount	Custom error recovery

Hook Events

• HookStartEvent — hook invocation began (includes HookType, Input)
• HookEndEvent — hook invocation completed (includes Output, Success, Error)

Proposed Implementation

1. Hook configuration UI per session or per group (multi-agent preset)
2. PreToolUse: Configurable tool approval policies (e.g., "always block rm -rf", "require approval for write operations")
3. PostToolUse: Output filtering (e.g., redact secrets, collapse verbose output)
4. UserPromptSubmitted: Auto-inject context like repo conventions, current task, or team decisions
5. Hook activity log: Show when hooks fire and what they modified (via HookStart/HookEnd events)

Value

Power-user feature for customizing agent behavior. Enterprise users especially want tool approval policies and output filtering.

Priority: 🔴 HIGH

[Keesan12]

The HookStart/HookEnd events are worth exposing in the activity log, but I would redact and summarize by default.

PreToolUse and UserPromptSubmitted can carry sensitive prompt, args, and cwd data. A useful log row could show hook type, matcher, decision, modified yes/no, duration, error, and redacted input hash. Then users can answer "which hook changed this run?" without dumping prompt or tool payloads into the UI.

For enterprise approval policies, I would also keep the raw permission decision machine-readable: allow, deny, require_approval, modify. Display strings are useful, but typed decisions are what let retry/resume behavior stay predictable.