[johnmatthewtennant]

Why

Plugins can add agent tools, but cannot require an acknowledgement before an agent uses shell or file tools. A reply-first plugin needs a live enforcement point without replacing the session whenever its setting changes.

What

Add agents.registerToolHook with plugin-scoped pre-tool decisions and completion observations. Claude uses SDK hook callbacks. Codex uses authenticated host MCP transports, one per thread start or resume, with trust limited to the bridge’s exact definition. Transport cleanup covers conversations, standalone wakes, compaction, background chat naming and process shutdown. Codex completion observations cover Buzz dynamic tools; Claude also observes native tool completions.

A separate reply-first plugin blocks work while a delivered mention awaits a successful public reply in its conversation. The policy and its live setting belong to that plugin. Existing sessions need a one-time restart after installing the bridge. Codex’s native hook transport fails open on transport errors, so this remains a conversational guardrail.

Validation

With fixture model responses, the actual Claude binary blocks shell work, keeps blocking after a failed send, and unlocks after a successful send. The actual Codex binary blocks shell work until a successful send. Single-use HTTP transport fixtures verify independent thread startup and resume while preserving reply-first enforcement. Runtime regressions cover overlapping conversations, background naming, interrupted wakes, compaction and shutdown during transport allocation. Standalone watch and timer tools consult policies with empty mention and destination snapshots, including denial and successful or failed Buzz completion events.

The installed host plus external reply-first plugin has not been exercised end to end.