feat(events): interception seams — the typed-Decision surface for hooks

Reshape the agent's interception surface so every seam returns a small, typed
Decision union, and the set covers the hook points a CC/Codex bridge (and a
native plugin) needs. "Native hooks" are not a package — a native hook is just a
cordis plugin on these canonical events; the bridges (a later PR) only translate
an external protocol onto the same surface.

dsh-agent:
- NEW agent/session-start(agent, source) emit (once before turn 1; SessionStartSource
  startup|resume|clear|compact) — a pure notification, seeds context via inject().
- NEW agent/prompt-submit waterfall → PromptDecision (allow, optionally rewriting the
  prompt or attaching additionalContext, or block).
- RESHAPE agent/turn-continuation boolean → ContinuationDecision ({action:'stop'} |
  {action:'continue', reason?}; a continue reason is recorded as next-step steering).
- New HookContext envelope (required source — inject() would mislabel a missing one).

dsh-tools: split the single tools/execute waterfall into tools/pre-execute
(PreToolDecision allow/deny/ask gate) and tools/post-execute (PostToolDecision
accept/block, optionally replacing content or attaching additionalContext). Core
dispatch sits between as plain code; the tool body keeps its inner try/catch so a
thrown tool still reaches post-execute as an isError. ToolExecutionResult gains
additionalContext (ferried to the loop's per-step buffer). Input rewrite is
deliberately NOT offered (a proposed RFC designs it consistently).

dsh-session: new `rejected` TurnEndReason — a turn whose whole prompt batch was
blocked by prompt-submit.

agent-loop firing points: session-start emitted at create (source threaded —
startup for create/fork, resume for resume()); prompt-submit per drained message
with the always-open-turn rule (a fully-blocked batch is a zero-step rejected
turn); the continuation reshape; post-tool additionalContext buffered and appended
after all tool/results (adjacency). ACP codec maps rejected→cancelled.

A worked native-plugin example (interception.spec.ts) proves all four seams compose
end-to-end through the real loop with NO hook/* events (those belong to the bridge
lib). All existing tools/execute + turn-continuation tests migrated. The
tool-subagent abort test now aborts after a microtask so it still exercises the
live onAbort bridge (execute() awaits pre-execute before the body runs).

RFCs: implemented/feature/2026-06-30-interception-seams.md (the reshape) +
proposed/feature/2026-06-30-pre-tool-input-rewrite.md (the deferred rewrite design).

packages/core/tools/README.md

@@ -1,6 +1,6 @@
 # dsh-tools
 
-Tool registry and execution waterfall. Tool plugins register their schemas and executors; the agent loop executes calls through the `tools/execute` waterfall.
+Tool registry and execution pipeline. Tool plugins register their schemas and executors; the agent loop executes each call through `tools/pre-execute` (the allow/deny gate) → core dispatch → `tools/post-execute` (inspect/replace the result, attach context).
 
 ## Service: `ToolRegistry` (ctx key: `tools`)
 
@@ -9,7 +9,7 @@ Tool registry and execution waterfall. Tool plugins register their schemas and e
 - `ctx.tools.register(definition: ToolDefinition): () => void` Register a tool. Disposed with the calling fiber.
 - `ctx.tools.get(name: string): ToolDefinition | undefined`
 - `ctx.tools.schemas(): ToolSchema[]` Schemas of all registered tools (without the `execute` functions).
-- `ctx.tools.execute(exec: ToolExecution): Promise<ToolExecutionResult>` Execute one tool call through the `tools/execute` waterfall.
+- `ctx.tools.execute(exec: ToolExecution): Promise<ToolExecutionResult>` Execute one tool call through the `tools/pre-execute` → dispatch → `tools/post-execute` pipeline.
 
 ### Injected services
 
@@ -19,20 +19,23 @@ Tool registry and execution waterfall. Tool plugins register their schemas and e
 
 | Event | Mode | Purpose |
 |---|---|---|
-| `tools/execute` | waterfall | Wrap/veto tool execution (sandbox, permission, hooks, plan mode) |
+| `tools/pre-execute` | waterfall | Allow/deny gate BEFORE a tool runs (sandbox, permission, hooks); returns `PreToolDecision` |
+| `tools/post-execute` | waterfall | Inspect/replace the result AFTER a tool runs, attach context; returns `PostToolDecision` |
 | `tools/change` | emit | A tool was registered or unregistered |
 
 ### Key types
 
 - `ToolDefinition` — `ToolSchema` + `execute(args, exec): Promise<ContentBlock[]>`, plus optional `presentCall(args)` / `presentResult(args, result)` for tool-owned UI presentation (see below).
 - `ToolExecution` — one pending tool call: `{ callId, name, arguments, agent?, signal? }`.
-- `ToolExecutionResult` — outcome: `{ callId, content, isError, error? }`. On failure with a `HarnessError`, `error: { name, code }` carries the structured failure class alongside the model-facing text (the loop forwards it onto the `tool/result` session event for retry/sandbox plugins and replay).
+- `ToolExecutionResult` — outcome: `{ callId, content, isError, error?, additionalContext? }`. On failure with a `HarnessError`, `error: { name, code }` carries the structured failure class alongside the model-facing text (the loop forwards it onto the `tool/result` session event for retry/sandbox plugins and replay). `additionalContext` (a `HookContext`) ferries any `tools/post-execute` context up to the loop, which buffers it and appends it as a `context/message` after all `tool/result`s in the step.
+- `PreToolDecision` — `{kind:'allow'}` | `{kind:'deny', reason}` | `{kind:'ask', reason?}`. Input rewrite (changing `arguments`) is deliberately NOT offered (it would desync the pre-execution audit/history/UI from what ran — its own proposed RFC); `ask` degrades to `deny` until the permission system lands.
+- `PostToolDecision` — `{kind:'accept', content?, additionalContext?}` (keep the call successful, optionally replacing the model-facing content) | `{kind:'block', feedback, additionalContext?}` (turn it into an `isError` whose content is the corrective feedback). Output replacement is clean because `tool/result` is logged AFTER `execute()` returns.
 - `ToolCallPresentation` / `ToolResultPresentation` — provider-neutral shapes a tool returns from `presentCall` / `presentResult` to own how a UI renders ITS calls (see "Tool-owned UI presentation").
 
 ### Extension points
 
 - Tool plugins call `ctx.tools.register()` — schemas flow into the assembly automatically.
-- The `tools/execute` waterfall is the single seam for sandbox, permission, hooks, and plan-mode plugins to wrap or veto a call. Listeners receive `(exec, next)`: call `next()` to proceed, or return a result without calling `next()` to short-circuit (veto).
+- `tools/pre-execute` is the allow/deny gate (sandbox, permission, hooks): listeners receive `(exec, next)` and call `next()` to delegate to the default (allow) or return a `PreToolDecision` to short-circuit; a `deny`/`ask` skips dispatch and yields an `isError` result. `tools/post-execute` is the inspect/transform seam: `(exec, result, next)` → a `PostToolDecision` that can replace content, block with feedback, or attach `additionalContext`. Core dispatch sits between them as plain code; the tool body keeps its own try/catch so a thrown tool still reaches `post-execute` as an `isError`. Both follow the typed-Decision idiom shared with the `agent/*` interception seams (see [`dsh-agent`](../agent/README.md)).
 - MCP servers: one plugin per server, discover tools, call `ctx.tools.register()` with the server's schemas.
 
 ### Typed tool parameter schemas

packages/core/tools/src/index.ts

@@ -1,8 +1,9 @@
 /**
- * Tool registry and execution waterfall. Plugins register tools; the registry
+ * Tool registry and execution pipeline. Plugins register tools; the registry
  * feeds schemas into the system prompt, and `execute()` dispatches each call
- * through the `tools/execute` waterfall for sandbox, permission, and hook
- * plugins to wrap or veto.
+ * through `tools/pre-execute` (the allow/deny gate) → core dispatch →
+ * `tools/post-execute` (inspect/replace the result, attach context) for
+ * sandbox, permission, and hook plugins to gate or transform a call.
  *
  * @module @deepseek-ai/dsh-tools
  */
@@ -10,7 +11,7 @@
 import { Context, Service } from 'cordis'
 import type { CallId, ContentBlock, ToolSchema } from '@deepseek-ai/dsh-llm'
 import { HarnessError } from '@deepseek-ai/dsh-llm'
-import type { Agent } from '@deepseek-ai/dsh-agent'
+import type { Agent, HookContext } from '@deepseek-ai/dsh-agent'
 import type {} from '@deepseek-ai/dsh-system-prompt'
 
 export {
@@ -33,14 +34,31 @@ declare module 'cordis' {
 
   interface Events {
     /**
-     * Waterfall around every tool execution — the single seam where sandbox,
-     * permission, hook, and plan-mode plugins wrap or veto a call. Listeners
-     * receive `(exec, next)`: call `next()` to proceed (possibly around your
-     * own logic), or return a {@link ToolExecutionResult} without calling
-     * `next()` to short-circuit (veto).
+     * Waterfall BEFORE a tool runs — the gate where sandbox, permission, and
+     * hook plugins allow or deny a call (Claude Code's `PreToolUse`). Listeners
+     * receive `(exec, next)`: call `next()` to delegate to the default (allow),
+     * or return a {@link PreToolDecision} without calling `next()` to
+     * short-circuit. A `deny` skips dispatch and yields an `isError` result; the
+     * tool body never runs. Input rewrite is deliberately NOT offered here (see
+     * {@link PreToolDecision}); `ask` degrades to deny until the permission
+     * system lands (`FIXME(permissions)`).
      * @mode waterfall
      */
-    'tools/execute'(this: ToolRegistry, exec: ToolExecution, next: () => Promise<ToolExecutionResult>): Promise<ToolExecutionResult>
+    'tools/pre-execute'(this: ToolRegistry, exec: ToolExecution, next: () => Promise<PreToolDecision>): Promise<PreToolDecision>
+    /**
+     * Waterfall AFTER a tool runs — where hook plugins inspect the result and
+     * accept it (optionally REPLACING the model-facing content, and/or attaching
+     * `additionalContext` for the next request) or block it with corrective
+     * `feedback` (Claude Code's `PostToolUse`). Listeners receive
+     * `(exec, result, next)`: call `next()` to delegate to the default (accept
+     * unchanged), or return a {@link PostToolDecision} to override. The core tool
+     * dispatch sits between the two waterfalls as plain code, all inside
+     * `execute`'s outer try/catch (and the tool body keeps its own inner
+     * try/catch, so a thrown tool still reaches `post-execute` as an `isError`
+     * result).
+     * @mode waterfall
+     */
+    'tools/post-execute'(this: ToolRegistry, exec: ToolExecution, result: ToolExecutionResult, next: () => Promise<PostToolDecision>): Promise<PostToolDecision>
     /**
      * A tool was registered or unregistered (the available tool set changed).
      * @mode emit
@@ -247,8 +265,54 @@ export interface ToolExecutionResult {
    * text in `content` is always present; this is extra structure for code.
    */
   error?: ToolErrorInfo
+  /**
+   * Extra model-facing context a `tools/post-execute` listener attached for the
+   * NEXT request (Claude Code's PostToolUse `additionalContext`). It is NOT part
+   * of this call's `content` — `content`/`feedback` shape the tool RESULT, but
+   * `additionalContext` is a SEPARATE `context/message`. A step can carry
+   * multiple tool calls, so the loop BUFFERS every call's `additionalContext`
+   * and appends them only AFTER all `tool/result`s for the step, keeping
+   * tool-call/result adjacency intact. Carried on the result purely to ferry it
+   * from `execute()` up to the loop's per-step buffer.
+   */
+  additionalContext?: HookContext
 }
 
+/**
+ * The decision a `tools/pre-execute` listener returns for one pending call.
+ * Maps onto Claude Code's `PreToolUse` `permissionDecision`.
+ *
+ * - `allow` proceeds to dispatch. (Input rewrite — changing `exec.arguments` —
+ *   is deliberately NOT offered: `tool/call` and `assistant/message` are logged
+ *   BEFORE execution and live consumers, e.g. the ACP bridge and `dsh-tool-bash`
+ *   presentation, read the pre-execution arguments, so an execution-only rewrite
+ *   would desync the UI from what RAN. That consistency redesign is its own
+ *   `proposed` RFC; `TODO(pre-tool-input-rewrite)` anchors it at the call site.)
+ * - `deny` skips dispatch; the loop records an `isError` result carrying `reason`.
+ * - `ask` is the permission-prompt intent; until the permission system exists it
+ *   degrades to `deny` (`FIXME(permissions)`).
+ */
+export type PreToolDecision =
+  | { kind: 'allow' }
+  | { kind: 'deny'; reason: string }
+  | { kind: 'ask'; reason?: string }
+
+/**
+ * The decision a `tools/post-execute` listener returns for one finished call.
+ * Maps onto Claude Code's `PostToolUse` decision.
+ *
+ * - `accept` keeps the call successful; optional `content` REPLACES the
+ *   model-facing result (clean: `tool/result` is logged AFTER `execute()`
+ *   returns, so a replaced result is the single source of truth for both derived
+ *   history and UI). Optional `additionalContext` rides to the next request.
+ * - `block` turns the call into an `isError` result whose content is the
+ *   corrective `feedback` (the model is told the call was rejected and why),
+ *   optionally also attaching `additionalContext`.
+ */
+export type PostToolDecision =
+  | { kind: 'accept'; content?: ContentBlock[]; additionalContext?: HookContext }
+  | { kind: 'block'; feedback: ContentBlock[]; additionalContext?: HookContext }
+
 /**
  * Best-effort human-readable message from an arbitrary thrown value: Error
  * instances use `.message`; non-Error objects with a string `message`
@@ -336,31 +400,90 @@ export class ToolRegistry extends Service {
   }
 
   /**
-   * Execute one tool call through the `tools/execute` waterfall. If the tool is
-   * not registered, the result is an `isError` carrying a `UNKNOWN_TOOL`
-   * structured error. If the tool or a waterfall listener throws, the error is
-   * caught and returned as an `isError` result so the loop records a failed tool
-   * call instead of failing the whole turn; a thrown {@link HarnessError}
+   * Execute one tool call through the `tools/pre-execute` → dispatch →
+   * `tools/post-execute` pipeline. The two waterfalls are the gate (allow/deny)
+   * and the inspect/transform seam; core dispatch sits between them as plain
+   * code. The whole thing is wrapped in one outer try/catch so a throwing
+   * listener (in either waterfall) becomes an `isError` result instead of
+   * failing the turn; the tool body ALSO keeps its own inner try/catch, so a
+   * thrown tool becomes an `isError` result that `post-execute` listeners can
+   * still inspect. If the tool is not registered, the result is an `isError`
+   * carrying a `UNKNOWN_TOOL` structured error. A thrown {@link HarnessError}
    * surfaces its `{ name, code }` on the result.
    */
   async execute(exec: ToolExecution): Promise<ToolExecutionResult> {
     try {
-      return await this.ctx.waterfall(this, 'tools/execute', exec, async (): Promise<ToolExecutionResult> => {
-        try {
-          const tool = this.store.get(exec.name)
-          // Unknown tool routes through the same catch as a tool-thrown error, so
-          // both failure classes get structured `{ name, code }` from one path.
-          if (!tool) throw new ToolNotFoundError(exec.name)
-          const content = await tool.execute(exec.arguments, exec)
-          return { callId: exec.callId, content, isError: false }
-        } catch (error: unknown) {
-          return toolErrorResult(exec.callId, error)
+      // --- Gate: tools/pre-execute. A deny (or an ask, which degrades to deny
+      // until the permission system lands) skips dispatch entirely. ---
+      const decision = await this.ctx.waterfall(
+        this, 'tools/pre-execute', exec,
+        () => Promise.resolve<PreToolDecision>({ kind: 'allow' }),
+      )
+      if (decision.kind !== 'allow') {
+        // deny → isError. ask has no permission UI yet, so degrade to deny
+        // (FIXME(permissions)): a forthcoming permission system turns `ask` into
+        // a real prompt; today it is the conservative "not allowed".
+        const reason = decision.kind === 'deny'
+          ? decision.reason
+          : decision.reason ?? `tool "${exec.name}" requires approval (not yet supported)`
+        const denied: ToolExecutionResult = {
+          callId: exec.callId,
+          content: [{ type: 'text', text: `Error: ${reason}` }],
+          isError: true,
         }
-      })
+        return await this.postExecute(exec, denied)
+      }
+
+      // --- Core dispatch (plain code between the waterfalls). The tool body's
+      // own try/catch turns a throw into an isError result so post-execute can
+      // inspect it; an unknown tool routes through the same catch. ---
+      let result: ToolExecutionResult
+      try {
+        const tool = this.store.get(exec.name)
+        if (!tool) throw new ToolNotFoundError(exec.name)
+        const content = await tool.execute(exec.arguments, exec)
+        result = { callId: exec.callId, content, isError: false }
+      } catch (error: unknown) {
+        result = toolErrorResult(exec.callId, error)
+      }
+
+      return await this.postExecute(exec, result)
     } catch (error: unknown) {
+      // Outer backstop: a throwing pre/post-execute listener (or the waterfall
+      // machinery) becomes an isError result, never a turn failure.
       return toolErrorResult(exec.callId, error)
     }
   }
+
+  /**
+   * Run the `tools/post-execute` waterfall over a dispatched `result` and apply
+   * its {@link PostToolDecision}: `accept` keeps the call successful (replacing
+   * `content` when given), `block` turns it into an `isError` whose content is
+   * the corrective `feedback`. Either decision may attach `additionalContext`,
+   * which is ferried on the returned result for the loop's per-step buffer.
+   * Runs inside `execute`'s outer try/catch (a throwing listener → isError).
+   */
+  private async postExecute(exec: ToolExecution, result: ToolExecutionResult): Promise<ToolExecutionResult> {
+    const decision = await this.ctx.waterfall(
+      this, 'tools/post-execute', exec, result,
+      () => Promise.resolve<PostToolDecision>({ kind: 'accept' }),
+    )
+    const additionalContext = decision.additionalContext
+    if (decision.kind === 'block') {
+      return {
+        callId: result.callId,
+        content: decision.feedback,
+        isError: true,
+        ...additionalContext ? { additionalContext } : {},
+      }
+    }
+    // accept: replace content if supplied, preserve the dispatched isError/error.
+    return {
+      ...result,
+      ...decision.content ? { content: decision.content } : {},
+      ...additionalContext ? { additionalContext } : {},
+    }
+  }
 }
 
 function toolErrorResult(callId: ToolExecution['callId'], error: unknown): ToolExecutionResult {

packages/core/tools/tests/tools.spec.ts

@@ -4,7 +4,7 @@ import { CallId, HarnessError } from '@deepseek-ai/dsh-llm'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry, {
   defineTool, schemaSpecToJsonSchema, validateArgs, ToolArgsError, ToolNotFoundError,
-  type InferArgs, type SchemaSpec, type ToolExecutionResult,
+  type InferArgs, type SchemaSpec, type PreToolDecision, type PostToolDecision,
 } from '@deepseek-ai/dsh-tools'
 
 async function setup() {
@@ -112,53 +112,123 @@ describe('ToolRegistry', () => {
     expect(err.message).toBe('unknown tool "ghost"')
   })
 
-  it('lets tools/execute waterfall listeners veto a call (permission pattern)', async () => {
+  it('lets a tools/pre-execute listener deny a call (permission pattern)', async () => {
     const ctx = await setup()
     ctx.tools.register(echoTool)
 
-    ctx.on('tools/execute', async (exec, next): Promise<ToolExecutionResult> => {
-      if (exec.name === 'echo') {
-        return {
-          callId: exec.callId,
-          content: [{ type: 'text', text: 'denied by policy' }],
-          isError: true,
-        }
-      }
+    ctx.on('tools/pre-execute', async (exec, next): Promise<PreToolDecision> => {
+      if (exec.name === 'echo') return { kind: 'deny', reason: 'denied by policy' }
       return next()
     })
 
     const result = await ctx.tools.execute({ callId: CallId('c1'), name: 'echo', arguments: { text: 'hi' } })
     expect(result.isError).toBe(true)
-    expect(result.content[0]).toMatchObject({ text: 'denied by policy' })
+    expect(result.content[0]).toMatchObject({ text: 'Error: denied by policy' })
   })
 
-  it('composes multiple tools/execute listeners (sandbox-wrap pattern)', async () => {
+  it('an ask decision degrades to deny until the permission system lands', async () => {
+    const ctx = await setup()
+    ctx.tools.register(echoTool)
+
+    ctx.on('tools/pre-execute', async (_exec, _next): Promise<PreToolDecision> =>
+      ({ kind: 'ask', reason: 'needs approval' }))
+
+    const result = await ctx.tools.execute({ callId: CallId('c1'), name: 'echo', arguments: { text: 'hi' } })
+    expect(result.isError).toBe(true)
+    expect(result.content[0]).toMatchObject({ text: 'Error: needs approval' })
+  })
+
+  it('an ask decision with no reason degrades to deny with a default message', async () => {
+    const ctx = await setup()
+    ctx.tools.register(echoTool)
+
+    ctx.on('tools/pre-execute', async (_exec, _next): Promise<PreToolDecision> => ({ kind: 'ask' }))
+
+    const result = await ctx.tools.execute({ callId: CallId('c1'), name: 'echo', arguments: { text: 'hi' } })
+    expect(result.isError).toBe(true)
+    expect(result.content[0]).toMatchObject({ text: 'Error: tool "echo" requires approval (not yet supported)' })
+  })
+
+  it('a tools/post-execute listener can replace the result content (accept) ', async () => {
+    const ctx = await setup()
+    ctx.tools.register(echoTool)
+
+    ctx.on('tools/post-execute', async (_exec, _result, _next): Promise<PostToolDecision> =>
+      ({ kind: 'accept', content: [{ type: 'text', text: 'rewritten' }] }))
+
+    const result = await ctx.tools.execute({ callId: CallId('c1'), name: 'echo', arguments: { text: 'hi' } })
+    expect(result.isError).toBe(false)
+    expect(result.content[0]).toMatchObject({ text: 'rewritten' })
+  })
+
+  it('a tools/post-execute block turns the call into an isError with corrective feedback', async () => {
+    const ctx = await setup()
+    ctx.tools.register(echoTool)
+
+    ctx.on('tools/post-execute', async (_exec, _result, _next): Promise<PostToolDecision> =>
+      ({ kind: 'block', feedback: [{ type: 'text', text: 'output rejected: try again' }] }))
+
+    const result = await ctx.tools.execute({ callId: CallId('c1'), name: 'echo', arguments: { text: 'hi' } })
+    expect(result.isError).toBe(true)
+    expect(result.content[0]).toMatchObject({ text: 'output rejected: try again' })
+  })
+
+  it('a block decision can ALSO attach additionalContext', async () => {
+    const ctx = await setup()
+    ctx.tools.register(echoTool)
+
+    ctx.on('tools/post-execute', async (_exec, _result, _next): Promise<PostToolDecision> =>
+      ({
+        kind: 'block',
+        feedback: [{ type: 'text', text: 'rejected' }],
+        additionalContext: { content: [{ type: 'text', text: 'why it was rejected' }], source: { kind: 'plugin', plugin: 'test' } },
+      }))
+
+    const result = await ctx.tools.execute({ callId: CallId('c1'), name: 'echo', arguments: { text: 'hi' } })
+    expect(result.isError).toBe(true)
+    expect(result.content[0]).toMatchObject({ text: 'rejected' })
+    expect(result.additionalContext).toMatchObject({ content: [{ text: 'why it was rejected' }], source: { kind: 'plugin', plugin: 'test' } })
+  })
+
+  it('a post-execute additionalContext rides on the result for the loop to buffer', async () => {
+    const ctx = await setup()
+    ctx.tools.register(echoTool)
+
+    ctx.on('tools/post-execute', async (_exec, _result, _next): Promise<PostToolDecision> =>
+      ({ kind: 'accept', additionalContext: { content: [{ type: 'text', text: 'fyi' }], source: { kind: 'plugin', plugin: 'test' } } }))
+
+    const result = await ctx.tools.execute({ callId: CallId('c1'), name: 'echo', arguments: { text: 'hi' } })
+    expect(result.additionalContext).toMatchObject({ content: [{ text: 'fyi' }], source: { kind: 'plugin', plugin: 'test' } })
+  })
+
+  it('composes pre + post waterfalls around dispatch (sandbox-wrap pattern)', async () => {
     const ctx = await setup()
     ctx.tools.register(echoTool)
 
     const order: string[] = []
-    ctx.on('tools/execute', async (_exec, next) => {
-      order.push('first:before')
-      const result = await next()
-      order.push('first:after')
-      return result
+    ctx.on('tools/pre-execute', async (_exec, next) => {
+      order.push('pre:before')
+      const decision = await next()
+      order.push('pre:after')
+      return decision
     })
-    ctx.on('tools/execute', async (_exec, next) => {
-      order.push('second:before')
-      const result = await next()
-      order.push('second:after')
-      return result
+    ctx.on('tools/post-execute', async (_exec, _result, next) => {
+      order.push('post:before')
+      const decision = await next()
+      order.push('post:after')
+      return decision
     })
 
     const result = await ctx.tools.execute({ callId: CallId('c1'), name: 'echo', arguments: { text: 'x' } })
     expect(result.isError).toBe(false)
-    expect(order).toEqual(['first:before', 'second:before', 'second:after', 'first:after'])
+    // pre runs fully (gate) before dispatch, then post runs over the result.
+    expect(order).toEqual(['pre:before', 'pre:after', 'post:before', 'post:after'])
   })
 
-  it('returns an isError result when a tools/execute listener throws', async () => {
+  it('returns an isError result when a tools/pre-execute listener throws', async () => {
     const ctx = await setup()
     ctx.tools.register(echoTool)
-    ctx.on('tools/execute', async () => {
+    ctx.on('tools/pre-execute', async () => {
       throw new Error('permission hook broke')
     })
 
@@ -171,10 +241,26 @@ describe('ToolRegistry', () => {
     })
   })
 
-  it('preserves structured error info when a tools/execute listener throws HarnessError', async () => {
+  it('returns an isError result when a tools/post-execute listener throws', async () => {
     const ctx = await setup()
     ctx.tools.register(echoTool)
-    ctx.on('tools/execute', async () => {
+    ctx.on('tools/post-execute', async () => {
+      throw new Error('post hook broke')
+    })
+
+    const result = await ctx.tools.execute({ callId: CallId('c1'), name: 'echo', arguments: { text: 'hi' } })
+
+    expect(result).toEqual({
+      callId: CallId('c1'),
+      content: [{ type: 'text', text: 'Error: post hook broke' }],
+      isError: true,
+    })
+  })
+
+  it('preserves structured error info when a tools/pre-execute listener throws HarnessError', async () => {
+    const ctx = await setup()
+    ctx.tools.register(echoTool)
+    ctx.on('tools/pre-execute', async () => {
       throw new HarnessError('denied', 'DENIED')
     })