PreToolUse hook stdout is not appended to context (0.29.0)

PreToolUse hook stdout is not appended to context (0.29.0)

Summary

On 0.29.0, a PreToolUse hook that exits 0 with text on stdout runs successfully (side effects observable), but its stdout never reaches the model context. The documented behavior — "stdout content (if any) may be appended to context" — does not hold for PreToolUse, while the same mechanism works for UserPromptSubmit in the same session.

This blocks a class of safety hooks that want to attach a warning/reminder to specific tool calls (e.g., marking web content as untrusted right before a FetchURL call).

Expected behavior (docs)

https://www.kimi.com/code/docs/en/kimi-code-cli/customization/hooks.html — Return Values: exit code 0 = "Normal exit, allow; stdout content (if any) may be appended to context".

Actual behavior

• The hook executes: a file-written side effect (taint marker) is produced with correct session/tool data.
• The hook prints the reminder to stdout before exit 0 (verified by running the same script manually with the same stdin payload — stdout present).
• The reminder text never appears in the session wire (agents/main/wire.jsonl grep = 0 hits), and the model shows no awareness of it.
• In the same session, a UserPromptSubmit hook's stdout is injected as a <hook_result hook_event="UserPromptSubmit"> user message (present in wire).

Observed in headless (kimi -p) sessions; #2070 makes interactive-window verification impossible for us at the moment, so headless is our authoritative channel.

Reproduction

1. ~/.kimi-code/config.toml:

[[hooks]]
event = "PreToolUse"
matcher = "FetchURL|WebSearch"
command = "node /path/to/remind.mjs"
timeout = 5

2. remind.mjs: reads stdin payload; if tool_name is FetchURL/WebSearch, writes a marker file to disk, then console.log("UNTRUSTED-CONTENT-MARKER") and process.exit(0).

3. New headless session: kimi -p "FetchURL https://example.com and tell me the title".

4. Results:

   • Marker file exists → hook executed with correct payload.
   • agents/main/wire.jsonl contains zero occurrences of UNTRUSTED-CONTENT-MARKER.
   • Control: a UserPromptSubmit hook with identical stdout approach does appear in wire as a hook_result user message.

Environment

• kimi-code 0.29.0 (Windows 10, Git Bash)
• Config has 4 hooks total (2×UserPromptSubmit, 1×PreToolUse matcher=FetchURL|WebSearch, 1×PreToolUse matcher=Bash); all fire correctly as far as execution is concerned — only PreToolUse stdout delivery is absent.

Ask

• Confirm whether PreToolUse stdout delivery is unimplemented, gated, or a bug.
• If unimplemented: please consider it — safety hooks that annotate untrusted tool results (web pages, search snippets) before the model sees them are a key defense layer against indirect prompt injection, and currently only UserPromptSubmit (wrong timing) can deliver text into context.

Reproduce the issue with ~/.kimi-code/config.toml, remind.mjs, and a headless kimi -p session, then compare the PreToolUse and UserPromptSubmit entries in agents/main/wire.jsonl. Trace the hook-result delivery path and confirm whether PreToolUse stdout reaches the model context; done means the marker appears in the wire output without breaking hook execution.