feat: add agent lifecycle hooks (Claude Code-compatible config)

[tlongwell-block]

Description

Adds a hooks system for agent lifecycle events (session start, prompt submit, tool use,
compaction, stop) that executes user-configured actions via MCP tools. Hooks can block
prompt submission or tool execution, and PostCompact hooks can inject additional context
back into the conversation after compaction.

The motivating use case: PostCompact hooks that re-inject project context after
auto-compaction, so long sessions don't lose critical knowledge when history is
summarized.

Configuration

Hooks are configured under a top-level hooks key in:

• Project: .goose/settings.json (preferred) or .claude/settings.json
• Global: ~/.config/goose/hooks.json

Global and project configs are merged by appending project hooks after global hooks
for the same event. If both .goose/ and .claude/ project configs exist, .goose/
takes precedence (with a warning logged).

{
  "hooks": {
    "PostCompact": [
      {
        "hooks": [{
          "type": "command",
          "command": "cat PROJECT_CONTEXT.md"
        }]
      },
      {
        "hooks": [{
          "type": "mcp_tool",
          "tool": "load",
          "arguments": { "source": "my-project-skill" }
        }]
      }
    ],
    "PreToolUse": [{
      "matcher": "Bash(rm -rf*)",
      "hooks": [{
        "type": "command",
        "command": "./guard.sh"
      }]
    }]
  }
}

Action types

• command — runs a shell command via the developer__shell MCP tool. Hook
  invocation JSON is piped to stdin. To block a blockable event, exit with code 2,
  or exit 0 and print {"decision":"block"} as the sole stdout. To inject context,
  exit 0 and print {"additionalContext":"..."}. Non-JSON stdout from exit-0
  commands is surfaced as additional context (capped at 32KB, UTF-8 safe).
• mcp_tool — calls any MCP tool directly with static arguments from config.

Both support an optional timeout field (default: 600 seconds).

Matchers

Matchers are optional per-hook-config filters:

• Bash or Bash(pattern) — Claude Code-style; maps to developer__shell
  with optional glob matching against the command string (full glob syntax via the
  glob crate: *, ?, [...]).
• Plain string — exact match against the goose tool name
  (e.g., "developer__shell", "slack__post_message").
• "auto" / "manual" — for PreCompact/PostCompact, matches the compaction trigger.

Events wired in this PR (8 of 16)

Event	Blocks enforced	Notes
SessionStart	no	Fires once per session (first user message)
UserPromptSubmit	yes	If blocked, returns a short message and stops
PreToolUse	yes	Fires for both pre-approved and approval-required tools. If blocked, tool call is not dispatched
PostToolUse	no	Fires after successful tool call
PostToolUseFailure	no	Fires after failed tool call
PreCompact	no	Fires before compaction (auto-recovery and /compact)
PostCompact	no	If additionalContext returned, injected as agent-only message
Stop	no	Fires before reply ends; block not currently enforced

Remaining events are defined but not yet fired: PermissionRequest, Notification,
SubagentStart, SubagentStop, SessionEnd, TeammateIdle, TaskCompleted, ConfigChange.

Design

• MCP-only execution — all hooks route through ExtensionManager.dispatch_tool_call(),
  the same path the agent uses for normal tool calls. No subprocess spawning in goose core.
• Fail-open — hook errors (timeouts, parse failures, tool failures) log warnings and
  continue. A misconfigured hook should never crash a session.
• Cancellation-aware — hooks receive the parent session's CancellationToken, so
  cancelling a session properly cancels any running hooks.
• Forward-compatible config — unknown event names in settings.json are warned and
  skipped, not parse errors. Configs from newer Claude Code versions won't break goose.
• Project hooks require opt-in — hooks from .goose/settings.json or .claude/settings.json
  in the working directory are ignored by default. Users must set "allow_project_hooks": true
  in their global ~/.config/goose/hooks.json to enable them. This prevents malicious repos
  from auto-executing shell commands via hook configs.

~800 LOC new module (hooks/), ~250 LOC integration across agent.rs,
execute_commands.rs, and tool_execution.rs.

Known limitations (v1)

• Exit codes from command hooks are captured via a stdout marker (GOOSE_HOOK_EXIT:<code>)
  appended to command execution, because developer__shell returns combined output as text
  without exit code metadata. Follow-up to add exit code metadata to the shell tool result
  will remove this workaround.
• mcp_tool hooks receive static arguments from config, not the hook invocation context.
  Command hooks receive the full invocation JSON on stdin.
• additional_context from hook results is only consumed by PostCompact today. Other events
  ignore returned context (the hook still fires and can block, but context injection is
  PostCompact-only for now).
• PermissionRequest event is defined but not yet fired. Goose has an approval UX, but wiring
  the hook requires design decisions about what blocking means in that context (auto-deny?
  skip the prompt?). Deferred to follow-up.
• No tests in this PR — follow-up.