feat(hooks): attach non-blocking hook failures to the tool result - #245

Fixes #241

What and why

A PreToolUse hook that exits 1 currently deny-blocks the call, and a PostToolUse failure is a TUI error event only. The model never sees the failure, so it cannot fix a broken hook and hits the same silent miss on every call.

Non-blocking hook failures (non-zero other than exit 2, timeout, crash after start) now attach a short, session-deduplicated notice to that tool call's result: hook name, exit code, and a stderr excerpt capped at HOOK_REASON_MAX_CHARS (300, tail). Identical repeats collapse. Spawn and a missing or non-regular script file still deny (unrunnable), which is #173, not this issue.

How

• HookOutcome splits failed (hook started, non-blocking) from unrunnable (never started, still deny).
• createHookRunner reports failed notices without blocking, collapses identical messages for the session, and still fail-closes spawn. A directory or unreadable path is unrunnable before spawn (bash would exec a directory and exit 126).
• runLoop records every tool-phase row through recordToolResult. A json output with notices becomes text whose prefix is JSON.stringify(value) (the same bytes the clean path puts on the wire) plus a Hook notices: block. Leftover PreToolUse notices also ride along when a later hook or the permission gate denies the call.

Rejected: wrapping the result in a new output type, a missing-script stderr heuristic (#236), and treating bash exit 127 as "never ran".

Verification

• bun run typecheck
• bun test apps/cli/tests/hooks/run.test.ts apps/cli/tests/hooks/gate.test.ts apps/cli/tests/loop/loop.tools.test.ts apps/cli/tests/loop/parallelReadEvents.test.ts apps/cli/tests/loop/loop.pathDenial.test.ts apps/cli/tests/imageParts.test.ts (148 pass, 5 skip)
• bun run build, and ran the resulting binary (seri 0.1.3)
• Exercised the change by hand (say how, below)

Negative control: PreToolUse exit 1 used to set block; the new test expects the tool to run and the tool-result to contain the stderr once, then collapse the repeat. A later hook block or a read-only gate deny still carries the leftover notice.

Cross-platform impact

• Touches file paths, file I/O, process spawning, signals, or shell invocation
• If ticked: verified on both a POSIX shell and PowerShell

Linux live-bash hook tests pass. PowerShell live tests are describe.skip here. CI covers Windows.

Windows build on an earlier SHA died after every test passed: Bun 1.4.0 segfault at process teardown. That is the same class Ubuntu already splits the suite for. This branch runs that split on Windows too.

Blast Radius

Hook runner plus the loop's tool-result rows. Path denials still skip PreToolUse. Containment denials are unchanged. Subagents share the same runner, so collapse is drive-wide: a child never sees a notice the parent already delivered, and a compacted row does not re-arm it. Parallel reads still attach PreToolUse notices without painting a false in-flight throw. A dropped image next to a notice text part still keeps the "dropped image" placeholder.

Notes for the reviewer

• Covers PreToolUse and PostToolUse only. Stop/SubagentStop stay unadded.
• Leaves PreToolUse hooks must fail closed when they cannot spawn (missing session cwd is not a silent skip) #173 fail-closed spawn. Does not add a stderr missing-script heuristic (A blocking hook exit code must not be turned into non-blocking because of what its stderr says #236).
• Timeout and crash-after-start stay non-blocking, matching the issue.