feat(events): interception seams — the typed-Decision surface for hooks

Reshape the agent's interception surface so every seam returns a small, typed
Decision union, and the set covers the hook points a CC/Codex bridge (and a
native plugin) needs. "Native hooks" are not a package — a native hook is just a
cordis plugin on these canonical events; the bridges (a later PR) only translate
an external protocol onto the same surface.

dsh-agent:
- NEW agent/session-start(agent, source) emit (once before turn 1; SessionStartSource
  startup|resume|clear|compact) — a pure notification, seeds context via inject().
- NEW agent/prompt-submit waterfall → PromptDecision (allow, optionally rewriting the
  prompt or attaching additionalContext, or block).
- RESHAPE agent/turn-continuation boolean → ContinuationDecision ({action:'stop'} |
  {action:'continue', reason?}; a continue reason is recorded as next-step steering).
- New HookContext envelope (required source — inject() would mislabel a missing one).

dsh-tools: split the single tools/execute waterfall into tools/pre-execute
(PreToolDecision allow/deny/ask gate) and tools/post-execute (PostToolDecision
accept/block, optionally replacing content or attaching additionalContext). Core
dispatch sits between as plain code; the tool body keeps its inner try/catch so a
thrown tool still reaches post-execute as an isError. ToolExecutionResult gains
additionalContext (ferried to the loop's per-step buffer). Input rewrite is
deliberately NOT offered (a proposed RFC designs it consistently).

dsh-session: new `rejected` TurnEndReason — a turn whose whole prompt batch was
blocked by prompt-submit.

agent-loop firing points: session-start emitted at create (source threaded —
startup for create/fork, resume for resume()); prompt-submit per drained message
with the always-open-turn rule (a fully-blocked batch is a zero-step rejected
turn); the continuation reshape; post-tool additionalContext buffered and appended
after all tool/results (adjacency). ACP codec maps rejected→cancelled.

A worked native-plugin example (interception.spec.ts) proves all four seams compose
end-to-end through the real loop with NO hook/* events (those belong to the bridge
lib). All existing tools/execute + turn-continuation tests migrated. The
tool-subagent abort test now aborts after a microtask so it still exercises the
live onAbort bridge (execute() awaits pre-execute before the body runs).

RFCs: implemented/feature/2026-06-30-interception-seams.md (the reshape) +
proposed/feature/2026-06-30-pre-tool-input-rewrite.md (the deferred rewrite design).

packages/ui/acp/src/codec.ts

@@ -34,6 +34,10 @@ import type { ContentBlock as AcpContentBlock, StopReason } from '@agentclientpr
  *                 for any non-bridge caller / property test.)
  * - `disposed`  → `cancelled` (the agent was torn down mid-turn — closest to a
  *                 cancellation from the client's perspective)
+ * - `rejected`  → `cancelled` (the prompt was blocked by an `agent/prompt-submit`
+ *                 hook before any step ran — ACP has no "rejected" reason, and a
+ *                 blocked prompt is, from the client's view, the prompt not being
+ *                 carried out; `cancelled` is the closest legal wire reason)
  */
 export function turnEndToStopReason(reason: TurnEndReason): StopReason {
   switch (reason.kind) {
@@ -45,6 +49,8 @@ export function turnEndToStopReason(reason: TurnEndReason): StopReason {
       return 'cancelled'
     case 'disposed':
       return 'cancelled'
+    case 'rejected':
+      return 'cancelled'
     case 'error':
       return 'end_turn'
     // Merge-extensible: an unknown future TurnEndReason kind still has to

packages/ui/acp/tests/codec.spec.ts

@@ -16,6 +16,7 @@ describe('turnEndToStopReason', () => {
     expect(turnEndToStopReason({ kind: 'max-tokens' })).toBe('max_tokens')
     expect(turnEndToStopReason({ kind: 'aborted', reason: 'x' })).toBe('cancelled')
     expect(turnEndToStopReason({ kind: 'disposed' })).toBe('cancelled')
+    expect(turnEndToStopReason({ kind: 'rejected', reason: 'blocked by hook' })).toBe('cancelled')
     expect(turnEndToStopReason({ kind: 'error', step: 1, message: 'boom' })).toBe('end_turn')
   })