feat(hooks): allow hooks to answer tool approvals

[rullerzhou-afk]

Related Issue

Closes #1326

Problem

PermissionRequest hooks can observe a native tool approval but cannot answer it. PreToolUse can deny a call, but an allow result only means that the hook does not object, so manual mode still opens the native approval UI. External approval surfaces therefore cannot approve a request without creating a second prompt.

What changed

• Add an opt-in experimental PermissionDecisionRequest hook for ordinary tool approvals in both agent-core implementations.
• Bind every structured response to the exact permission_request_id; decisions are per request and are not persisted as reusable rules.
• Aggregate matching hooks conservatively: any valid deny wins, while allow requires every matching hook to return a valid allow for the current request.
• Fall back to the existing native approval flow on no match, malformed output, mismatched IDs, hook errors, non-decision exits, or timeouts. Cancellation remains cancellation.
• Keep custom-continuation approvals, including plan review, on the native flow.
• Expose the experimental config/environment flag and plugin contract, add telemetry attribution, bilingual documentation, tests, and a CLI changeset.

UI compatibility

A hook decision is resolved before the existing session approval broker is called. It therefore does not create a pending interaction for the TUI, Kimi Web, or Kimi Code for VS Code to render. When hooks produce no valid decision, the unchanged broker path creates the normal native approval request.

Verification

• 248 focused @moonshot-ai/agent-core tests passed.
• 402 focused @moonshot-ai/agent-core-v2 tests passed.
• 7 Klient contract tests passed.
• TypeScript checks passed for agent-core, agent-core-v2, Klient, and Klient examples.
• Real Kimi Code CLI TUI smoke test in manual mode: one Bash request was hook-approved without opening the native panel.
• Real Kimi Web smoke test in manual mode: one Bash request was hook-approved without a web approval dialog or stale pending state.
• VitePress built both documentation locales successfully.
• oxlint --type-aware completed with 0 errors.
• git diff --check passed.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove my feature works.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update. The current main branch does not contain the skill's required docs/scripts/sync-changelog.mjs; the mirrored English/Chinese hook docs were reviewed directly and the VitePress build passes.

[changeset-bot]

🦋 Changeset detected

Latest commit: c4dbb52

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@moonshot-ai/kimi-code	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR