feat(hooks): dsh-hook-protocol — shared Claude Code / Codex hook wire-protocol core

The two hook bridges (dsh-hooks-claude, dsh-hooks-codex) would otherwise duplicate
the bulk of the protocol — Codex deliberately reimplements a SUBSET of the Claude
Code protocol (same hooks.json shape, exit-code/stdout contract, command-hook
model). This library holds the genuinely-identical primitives; each bridge owns
only what differs (per-event stdin payload, env/substitution, decision mapping).

New packages/hooks/ group; hook-protocol is a LIBRARY (no plugin, registers/injects
nothing):
- matcher: matchesMatcher(pattern, query, mode) — the one dialect axis collapsed to
  a mode param (claude = literal-or-regex with pipe alternation; codex = always
  unanchored regex). Match-all on absent/''/'*'; invalid regex matches nothing.
- codec: parseHookOutput(exit, stdout, stderr) → dialect-neutral HookOutput. Exit 0
  → lenient JSON; exit 2 → blocking error (stderr = reason, surfaced as
  decision:'block'); other → non-blocking. Parses the CC superset
  (continue/stopReason/decision/hookSpecificOutput.{permissionDecision,
  additionalContext,updatedInput}/systemMessage); permissionDecision overrides the
  legacy top-level decision.
- runner: runHook(bash, hook, opts, now) — runs a command hook via ctx.bash (stdin
  payload + trusted-plugin env), honors timeoutSec, never throws (executor reject →
  non-blocking-error HookOutput). Injected clock for testable durations.
- merge: mergeHookOutputs — most-restrictive fold (deny>ask>allow, sticky stop,
  block reasons joined, context/system-messages accumulated).
- hook/* session events (declaration-merged into SessionEventMap, log-only like
  compact/*) + appendHookInvoked/appendHookResult helpers.

updatedInput is parsed but NOT honored (deferred pre-tool-input-rewrite RFC); a
bridge logs+warns. 47 unit tests at per-file 100% (matcher per-mode, codec per
exit-code/field, runner plumbing w/ stub executor, merge precedence, hook/*
helpers). RFC: implemented/feature/2026-06-30-hook-protocol-lib.md.

packages/hooks/hook-protocol/src/matcher.ts

@@ -0,0 +1,49 @@
+/**
+ * The matcher primitive shared by both hook dialects: decide whether a matcher
+ * pattern selects a given query (a tool name, a session source, …).
+ *
+ * The two dialects differ ONLY in how a non-empty pattern is interpreted, so
+ * that single axis is the {@link MatcherMode} parameter:
+ * - `claude`: a pattern of purely `[A-Za-z0-9_|]+` is a LITERAL (pipe =
+ *   exact-match alternation, e.g. `Edit|Write`); anything else is a regex.
+ * - `codex`: every pattern is an unanchored regex (no literal fast path).
+ *
+ * Both treat an absent / empty / `'*'` pattern as match-all, and both treat an
+ * invalid regex as a non-match (the bridge logs it; a broken matcher must not
+ * throw into the loop).
+ *
+ * @module @deepseek-ai/dsh-hook-protocol/matcher
+ */
+
+import type { MatcherMode } from './types.ts'
+
+/** True for an absent / empty / `'*'` pattern — the match-all sentinels. */
+function isMatchAll(matcher: string | undefined): boolean {
+  return matcher === undefined || matcher === '' || matcher === '*'
+}
+
+/** A Claude-literal pattern is purely word chars + `|` (the regex-vs-literal discriminator). */
+const CLAUDE_LITERAL = /^[A-Za-z0-9_|]+$/
+
+/**
+ * Whether `matcher` selects `query` under the given dialect {@link MatcherMode}.
+ * Match-all sentinels (absent/`''`/`'*'`) always match. A `claude` literal
+ * pattern exact-matches the query (splitting `|` into alternatives); every other
+ * `claude` pattern and ALL `codex` patterns are tested as an unanchored regex.
+ * An invalid regex matches nothing (never throws).
+ */
+export function matchesMatcher(matcher: string | undefined, query: string, mode: MatcherMode): boolean {
+  if (isMatchAll(matcher)) return true
+  // matcher is a non-empty string past the match-all guard.
+  const pattern = matcher as string
+  if (mode === 'claude' && CLAUDE_LITERAL.test(pattern)) {
+    return pattern.split('|').includes(query)
+  }
+  try {
+    return new RegExp(pattern).test(query)
+  } catch {
+    // Invalid regex: a broken matcher selects nothing rather than throwing into
+    // the agent loop. The bridge is responsible for surfacing the bad config.
+    return false
+  }
+}