Greptile Summary

This PR closes two security gaps in dispatchAgentHook: (1) value.name was used verbatim in CronJob metadata and system-event text, allowing a hook caller to inject System: prefixes or bracketed tags; (2) non-delivery and error enqueueSystemEvent calls were missing trusted: false, unlike the already-fixed dispatchWakeHook path. The fix applies sanitizeInboundSystemTags to the name before it is reused and adds the missing trust flag, with focused regression tests for both paths.

Confidence Score: 5/5

Safe to merge — narrowly scoped security fix consistent with existing patterns, well-tested, no regressions expected.

Both changes (sanitization and trust-flag) are correct, minimal, and aligned with the already-fixed dispatchWakeHook path. sanitizeInboundSystemTags handles the relevant injection patterns; trusted?: boolean is a valid SystemEventOptions field; value.name is always a non-null string by the time it reaches dispatchAgentHook. Tests cover the two new behaviors and use vi.waitFor appropriately for the async IIFE. No unresolved P0/P1 findings.

No files require special attention.

_{Reviews (2): Last reviewed commit: "fix(hooks): sanitize agent hook system e..." | Re-trigger Greptile}

@codex review

@greptile review

Codex Review: Didn't find any major issues. You're on a roll.