use std::io::Read as _;
use std::process::{Command, Stdio};
use std::sync::Once;
use std::time::{Duration, Instant};
use supercode_harness::{HookDecision, PreToolOutcome};
pub const DEFAULT_HOOK_TIMEOUT_MS: u64 = 10_000;
#[derive(Debug, Default, Clone, PartialEq, Eq, serde::Deserialize, serde::Serialize)]
pub struct HooksFileConfig {
#[serde(default, skip_serializing_if = "Option::is_none")]
pub pre_tool: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub post_tool: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub session_start: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub session_end: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub stop: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub user_prompt_submit: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub notification: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub subagent_start: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub subagent_stop: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub pre_compact: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub post_compact: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub timeout_ms: Option<u64>,
}
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum HookEvent {
PreTool,
PostTool,
SessionStart,
SessionEnd,
Stop,
UserPromptSubmit,
Notification,
#[allow(dead_code)]
SubagentStart,
#[allow(dead_code)]
SubagentStop,
#[allow(dead_code)]
PreCompact,
#[allow(dead_code)]
PostCompact,
}
impl HookEvent {
pub fn as_str(self) -> &'static str {
match self {
HookEvent::PreTool => "pre_tool",
HookEvent::PostTool => "post_tool",
HookEvent::SessionStart => "session_start",
HookEvent::SessionEnd => "session_end",
HookEvent::Stop => "stop",
HookEvent::UserPromptSubmit => "user_prompt_submit",
HookEvent::Notification => "notification",
HookEvent::SubagentStart => "subagent_start",
HookEvent::SubagentStop => "subagent_stop",
HookEvent::PreCompact => "pre_compact",
HookEvent::PostCompact => "post_compact",
}
}
pub fn is_veto_capable(self) -> bool {
matches!(self, HookEvent::PreTool | HookEvent::Stop)
}
}
#[derive(Debug, Default, Clone, PartialEq, Eq)]
pub struct HookSet {
pub pre_tool: Option<String>,
pub post_tool: Option<String>,
pub session_start: Option<String>,
pub session_end: Option<String>,
pub stop: Option<String>,
pub user_prompt_submit: Option<String>,
pub notification: Option<String>,
pub subagent_start: Option<String>,
pub subagent_stop: Option<String>,
pub pre_compact: Option<String>,
pub post_compact: Option<String>,
pub timeout_ms: u64,
}
static WARN_SUBAGENT_START: Once = Once::new();
static WARN_SUBAGENT_STOP: Once = Once::new();
static WARN_PRE_COMPACT: Once = Once::new();
static WARN_POST_COMPACT: Once = Once::new();
fn warn_once_if_deferred(once: &Once, event: HookEvent, configured: bool) {
if configured {
once.call_once(|| {
eprintln!(
"warning: [hooks] {} is registered but is not yet emitted in this build (no-op)",
event.as_str()
);
});
}
}
impl HookSet {
pub fn resolve(fc: &HooksFileConfig) -> HookSet {
let env =
|name: &str| -> Option<String> { std::env::var(name).ok().filter(|v| !v.is_empty()) };
let hs = HookSet {
pre_tool: env("SUPERCODE_HOOK_PRE_TOOL").or_else(|| fc.pre_tool.clone()),
post_tool: env("SUPERCODE_HOOK_POST_TOOL").or_else(|| fc.post_tool.clone()),
session_start: env("SUPERCODE_HOOK_SESSION_START").or_else(|| fc.session_start.clone()),
session_end: env("SUPERCODE_HOOK_SESSION_END").or_else(|| fc.session_end.clone()),
stop: env("SUPERCODE_HOOK_STOP").or_else(|| fc.stop.clone()),
user_prompt_submit: env("SUPERCODE_HOOK_USER_PROMPT_SUBMIT")
.or_else(|| fc.user_prompt_submit.clone()),
notification: env("SUPERCODE_HOOK_NOTIFICATION").or_else(|| fc.notification.clone()),
subagent_start: env("SUPERCODE_HOOK_SUBAGENT_START")
.or_else(|| fc.subagent_start.clone()),
subagent_stop: env("SUPERCODE_HOOK_SUBAGENT_STOP").or_else(|| fc.subagent_stop.clone()),
pre_compact: env("SUPERCODE_HOOK_PRE_COMPACT").or_else(|| fc.pre_compact.clone()),
post_compact: env("SUPERCODE_HOOK_POST_COMPACT").or_else(|| fc.post_compact.clone()),
timeout_ms: env("SUPERCODE_HOOK_TIMEOUT_MS")
.and_then(|v| v.parse().ok())
.or(fc.timeout_ms)
.unwrap_or(DEFAULT_HOOK_TIMEOUT_MS),
};
warn_once_if_deferred(
&WARN_SUBAGENT_START,
HookEvent::SubagentStart,
hs.subagent_start.is_some(),
);
warn_once_if_deferred(
&WARN_SUBAGENT_STOP,
HookEvent::SubagentStop,
hs.subagent_stop.is_some(),
);
warn_once_if_deferred(
&WARN_PRE_COMPACT,
HookEvent::PreCompact,
hs.pre_compact.is_some(),
);
warn_once_if_deferred(
&WARN_POST_COMPACT,
HookEvent::PostCompact,
hs.post_compact.is_some(),
);
hs
}
pub fn configured_count(&self) -> usize {
[
&self.pre_tool,
&self.post_tool,
&self.session_start,
&self.session_end,
&self.stop,
&self.user_prompt_submit,
&self.notification,
&self.subagent_start,
&self.subagent_stop,
&self.pre_compact,
&self.post_compact,
]
.iter()
.filter(|c| c.is_some())
.count()
}
pub fn is_empty(&self) -> bool {
self.pre_tool.is_none()
&& self.post_tool.is_none()
&& self.session_start.is_none()
&& self.session_end.is_none()
&& self.stop.is_none()
&& self.user_prompt_submit.is_none()
&& self.notification.is_none()
&& self.subagent_start.is_none()
&& self.subagent_stop.is_none()
&& self.pre_compact.is_none()
&& self.post_compact.is_none()
}
fn command_for(&self, event: HookEvent) -> Option<&str> {
match event {
HookEvent::PreTool => self.pre_tool.as_deref(),
HookEvent::PostTool => self.post_tool.as_deref(),
HookEvent::SessionStart => self.session_start.as_deref(),
HookEvent::SessionEnd => self.session_end.as_deref(),
HookEvent::Stop => self.stop.as_deref(),
HookEvent::UserPromptSubmit => self.user_prompt_submit.as_deref(),
HookEvent::Notification => self.notification.as_deref(),
HookEvent::SubagentStart => self.subagent_start.as_deref(),
HookEvent::SubagentStop => self.subagent_stop.as_deref(),
HookEvent::PreCompact => self.pre_compact.as_deref(),
HookEvent::PostCompact => self.post_compact.as_deref(),
}
}
}
#[derive(Debug, Default)]
struct HookOutcome {
timed_out: bool,
exit_code: Option<i32>,
stdout: String,
stderr: String,
spawn_error: Option<String>,
}
impl HookOutcome {
fn failed(&self, event: HookEvent) -> bool {
self.spawn_error.is_some()
|| self.timed_out
|| matches!(
self.exit_code,
Some(c) if c != 0 && !event.is_veto_capable()
)
}
}
fn run_hook(
event: HookEvent,
command: &str,
timeout_ms: u64,
extra_env: &[(&str, String)],
) -> HookOutcome {
let mut cmd = Command::new("sh");
cmd.arg("-c").arg(command);
cmd.env("SUPERCODE_HOOK_EVENT", event.as_str());
for (k, v) in extra_env {
cmd.env(k, v);
}
cmd.stdin(Stdio::null());
cmd.stdout(Stdio::piped());
cmd.stderr(Stdio::piped());
#[cfg(unix)]
{
use std::os::unix::process::CommandExt;
cmd.process_group(0);
}
#[cfg(windows)]
let job = HookJob::create();
#[cfg(windows)]
if job.is_some() {
use std::os::windows::process::CommandExt;
cmd.creation_flags(windows_sys::Win32::System::Threading::CREATE_SUSPENDED);
}
let mut child = match cmd.spawn() {
Ok(c) => c,
Err(e) => {
return HookOutcome {
spawn_error: Some(e.to_string()),
..Default::default()
}
}
};
#[cfg(windows)]
let job = match job {
Some(job) => match job.attach_and_resume(&child) {
Ok(true) => Some(job),
Ok(false) => None,
Err(e) => {
let _ = child.kill();
let _ = child.wait();
return HookOutcome {
spawn_error: Some(e.to_string()),
..Default::default()
};
}
},
None => None,
};
let stdout_pipe = child.stdout.take();
let stderr_pipe = child.stderr.take();
let stdout_handle = stdout_pipe.map(|mut p| {
std::thread::spawn(move || {
let mut s = String::new();
let _ = p.read_to_string(&mut s);
s
})
});
let stderr_handle = stderr_pipe.map(|mut p| {
std::thread::spawn(move || {
let mut s = String::new();
let _ = p.read_to_string(&mut s);
s
})
});
let deadline = Instant::now() + Duration::from_millis(timeout_ms);
let mut timed_out = false;
let status = loop {
match child.try_wait() {
Ok(Some(status)) => break Some(status),
Ok(None) => {
if Instant::now() >= deadline {
timed_out = true;
#[cfg(windows)]
if let Some(job) = &job {
job.terminate();
}
kill_process_tree(&mut child);
let _ = child.wait();
break None;
}
std::thread::sleep(Duration::from_millis(15));
}
Err(_) => break None,
}
};
HookOutcome {
timed_out,
exit_code: status.and_then(|s| s.code()),
stdout: stdout_handle
.and_then(|h| h.join().ok())
.unwrap_or_default(),
stderr: stderr_handle
.and_then(|h| h.join().ok())
.unwrap_or_default(),
spawn_error: None,
}
}
#[cfg(unix)]
fn kill_process_tree(child: &mut std::process::Child) {
unsafe {
libc::kill(-(child.id() as libc::pid_t), libc::SIGKILL);
}
let _ = child.kill(); }
#[cfg(not(unix))]
fn kill_process_tree(child: &mut std::process::Child) {
let _ = child.kill();
}
#[cfg(windows)]
struct HookJob(windows_sys::Win32::Foundation::HANDLE);
#[cfg(windows)]
impl HookJob {
fn create() -> Option<Self> {
use windows_sys::Win32::System::JobObjects::CreateJobObjectW;
let job = unsafe { CreateJobObjectW(std::ptr::null(), std::ptr::null()) };
(!job.is_null()).then_some(Self(job))
}
fn attach_and_resume(&self, child: &std::process::Child) -> std::io::Result<bool> {
use std::os::windows::io::AsRawHandle;
use windows_sys::Win32::Foundation::{CloseHandle, INVALID_HANDLE_VALUE};
use windows_sys::Win32::System::Diagnostics::ToolHelp::{
CreateToolhelp32Snapshot, Thread32First, Thread32Next, TH32CS_SNAPTHREAD, THREADENTRY32,
};
use windows_sys::Win32::System::JobObjects::AssignProcessToJobObject;
use windows_sys::Win32::System::Threading::{
OpenThread, ResumeThread, THREAD_SUSPEND_RESUME,
};
let attached =
unsafe { AssignProcessToJobObject(self.0, child.as_raw_handle().cast()) } != 0;
let snapshot = unsafe { CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0) };
if snapshot == INVALID_HANDLE_VALUE {
return Err(std::io::Error::last_os_error());
}
let result = (|| {
let mut entry: THREADENTRY32 = unsafe { std::mem::zeroed() };
entry.dwSize = std::mem::size_of::<THREADENTRY32>() as u32;
let mut has_entry = unsafe { Thread32First(snapshot, &mut entry) } != 0;
while has_entry {
if entry.th32OwnerProcessID == child.id() {
let thread =
unsafe { OpenThread(THREAD_SUSPEND_RESUME, 0, entry.th32ThreadID) };
if thread.is_null() {
return Err(std::io::Error::last_os_error());
}
let resumed = unsafe { ResumeThread(thread) };
unsafe { CloseHandle(thread) };
if resumed == u32::MAX {
return Err(std::io::Error::last_os_error());
}
return Ok(());
}
has_entry = unsafe { Thread32Next(snapshot, &mut entry) } != 0;
}
Err(std::io::Error::new(
std::io::ErrorKind::NotFound,
"suspended hook's primary thread was not found",
))
})();
unsafe { CloseHandle(snapshot) };
result.map(|()| attached)
}
fn terminate(&self) {
use windows_sys::Win32::System::JobObjects::TerminateJobObject;
unsafe { TerminateJobObject(self.0, 1) };
}
}
#[cfg(windows)]
impl Drop for HookJob {
fn drop(&mut self) {
unsafe { windows_sys::Win32::Foundation::CloseHandle(self.0) };
}
}
fn report(event: HookEvent, outcome: &HookOutcome, quiet: bool) {
if let Some(err) = &outcome.spawn_error {
eprintln!("[hook:{}] failed to start: {err}", event.as_str());
return;
}
let failed = outcome.failed(event);
if !quiet || failed {
let out = outcome.stdout.trim();
if !out.is_empty() {
eprintln!("[hook:{}] {out}", event.as_str());
}
let err = outcome.stderr.trim();
if !err.is_empty() {
eprintln!("[hook:{}] stderr: {err}", event.as_str());
}
}
if outcome.timed_out {
eprintln!("[hook:{}] timed out and was killed", event.as_str());
} else if let Some(code) = outcome.exit_code {
if code != 0 && !event.is_veto_capable() {
eprintln!("[hook:{}] exited {code}", event.as_str());
}
}
}
pub fn fire_observational(
hooks: &HookSet,
event: HookEvent,
extra_env: &[(&str, String)],
quiet: bool,
) {
let Some(command) = hooks.command_for(event) else {
return;
};
let outcome = run_hook(event, command, hooks.timeout_ms, extra_env);
report(event, &outcome, quiet);
}
pub fn fire_user_prompt_submit(
hooks: &HookSet,
prompt: &str,
cwd: &std::path::Path,
session_name: Option<&str>,
quiet: bool,
) {
if hooks.user_prompt_submit.is_none() {
return;
}
let mut extra = vec![
("SUPERCODE_HOOK_CWD", cwd.to_string_lossy().into_owned()),
(
"SUPERCODE_HOOK_PROMPT",
prompt.chars().take(8_000).collect::<String>(),
),
];
if let Some(name) = session_name {
extra.push(("SUPERCODE_HOOK_SESSION", name.to_string()));
}
fire_observational(hooks, HookEvent::UserPromptSubmit, &extra, quiet);
}
pub fn fire_notification(
hooks: &HookSet,
model: &str,
elapsed_secs: u64,
summary: &str,
quiet: bool,
) {
if hooks.notification.is_none() {
return;
}
let extra: [(&str, String); 4] = [
(
"SUPERCODE_HOOK_NOTIFICATION_KIND",
"agent_completed".to_string(),
),
("SUPERCODE_HOOK_MODEL", model.to_string()),
("SUPERCODE_HOOK_ELAPSED_SECS", elapsed_secs.to_string()),
(
"SUPERCODE_HOOK_SUMMARY",
summary.chars().take(2_000).collect::<String>(),
),
];
fire_observational(hooks, HookEvent::Notification, &extra, quiet);
}
pub fn fire_pre_tool(hooks: &HookSet, extra_env: &[(&str, String)], quiet: bool) -> PreToolOutcome {
let Some(command) = hooks.pre_tool.as_ref() else {
return PreToolOutcome::pass();
};
let outcome = run_hook(HookEvent::PreTool, command, hooks.timeout_ms, extra_env);
report(HookEvent::PreTool, &outcome, quiet);
let result = if let Some(err) = &outcome.spawn_error {
PreToolOutcome::deny(format!("pre_tool hook failed to start: {err}"))
} else if outcome.timed_out {
PreToolOutcome::deny(format!(
"pre_tool hook timed out after {}ms",
hooks.timeout_ms
))
} else {
match outcome.exit_code {
Some(0) => parse_pre_tool_stdout(outcome.stdout.trim()),
Some(code) => {
let text = outcome.stdout.trim();
PreToolOutcome::deny(if text.is_empty() {
format!("pre_tool hook denied (exit {code})")
} else {
text.to_string()
})
}
None => PreToolOutcome::deny("pre_tool hook exited abnormally (no exit code)"),
}
};
if result.decision == HookDecision::Deny {
let r = result
.reason
.clone()
.unwrap_or_else(|| "denied".to_string());
eprintln!("[hook:pre_tool] denied: {r}");
}
result
}
fn parse_pre_tool_stdout(stdout: &str) -> PreToolOutcome {
let Ok(value) = serde_json::from_str::<serde_json::Value>(stdout) else {
return PreToolOutcome::pass();
};
let Some(obj) = value.as_object() else {
return PreToolOutcome::pass();
};
let specific = obj.get("hookSpecificOutput").and_then(|v| v.as_object());
let field = |name: &str, alt: &str| -> Option<serde_json::Value> {
specific
.and_then(|o| o.get(name))
.or_else(|| obj.get(name))
.or_else(|| specific.and_then(|o| o.get(alt)))
.or_else(|| obj.get(alt))
.cloned()
};
let decision = match field("permissionDecision", "decision")
.as_ref()
.and_then(|v| v.as_str())
.map(str::to_ascii_lowercase)
.as_deref()
{
Some("allow") => HookDecision::Allow,
Some("ask") => HookDecision::Ask,
Some("deny") => HookDecision::Deny,
_ => HookDecision::Pass,
};
PreToolOutcome {
decision,
reason: field("permissionDecisionReason", "reason")
.as_ref()
.and_then(|v| v.as_str())
.map(str::to_string),
updated_args: field("updatedInput", "updated_args").filter(serde_json::Value::is_object),
}
}
pub fn fire_stop(hooks: &HookSet, final_content: &str, quiet: bool) -> Option<String> {
let command = hooks.stop.as_ref()?;
let extra_env: [(&str, String); 1] = [(
"SUPERCODE_HOOK_STOP_CONTENT",
final_content.chars().take(8_000).collect::<String>(),
)];
let outcome = run_hook(HookEvent::Stop, command, hooks.timeout_ms, &extra_env);
report(HookEvent::Stop, &outcome, quiet);
if outcome.spawn_error.is_some() || outcome.timed_out {
return None;
}
match outcome.exit_code {
Some(0) | None => None,
Some(code) => {
let text = outcome.stdout.trim();
let reason = if text.is_empty() {
format!("stop hook vetoed (exit {code})")
} else {
text.to_string()
};
eprintln!("[hook:stop] vetoed termination: {reason}");
Some(reason)
}
}
}
pub fn load_hook_set(cwd: &std::path::Path) -> HookSet {
HookSet::resolve(&crate::userconfig::load(cwd).hooks)
}
pub fn session_env(
cwd: &std::path::Path,
session_name: Option<&str>,
) -> Vec<(&'static str, String)> {
let mut v = vec![("SUPERCODE_HOOK_CWD", cwd.to_string_lossy().into_owned())];
if let Some(name) = session_name {
v.push(("SUPERCODE_HOOK_SESSION", name.to_string()));
}
v
}