#115 Session hooks: under bypassPermissions, the protected hook tells and asks nothing

The Maintainer runs sessions on autopilot, under bypassPermissions. The 2026-10-16 check found that the protected hook's ask prompts even then, so a session stopped for a person at each push and at each edit to the Factory's own files. The Maintainer chose to have the hook tell the session instead (decision 0019).

What changes

• tools/hooks/protected.py: under permission_mode exactly bypassPermissions, the hook prints hookSpecificOutput.additionalContext with the same codes and reasons, and no permissionDecision. In every other mode, or with no mode, it asks as before. That includes a reading it could not finish.
• docs/decisions/0019-…: the decision, and its limit stated plainly. Under bypass, a session could change the hooks' own files or the base the Stop hook compares with, and no one is asked. CI, which checks out afresh, and the rulesets still hold. The hooks that run are the main checkout's.
• AGENTS.md: one line says so.
• tests/test_hooks.py: test_under_bypass_permissions_the_hook_tells_the_session_and_asks_nothing.

Unchanged: identity.py and its refusals, and the Stop hooks.

Reviewed by a fresh-context Claude review and a security pass. The security pass's one high finding is the limit above. Keeping the ask for the hooks' own files was weighed and not taken: a push writes the remote branch a stop compares with, so the prompts would stay. It is recorded in 0019. make verify passes on a git archive export.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • In sessions using the exact bypassPermissions mode, protected commands and edits can proceed without approval prompts. The session receives context explaining why an action might otherwise require approval, including when information needed for a check is unavailable.
• Behavior Changes
  • In other permission modes, approval prompts remain unchanged. In bypass mode, clean edits produce no additional message.