Summary

Fixes #2723 — a gateway authz-confinement gap. The /hooks/agent and
/hooks/<mapping> paths validated the requested session key against
hooks.allowedSessionKeyPrefixes, then rebound it to the target agent
(agent:main:* → agent:hooks:*) via normalizeHookDispatchSessionKey and
dispatched without re-checking the rebound key. An authenticated hook caller
could therefore rebind a turn into a session namespace it was never authorized
for: e.g. with allowlist ["hook:", "agent:main:"], a request for
sessionKey: "agent:main:..." + agentId: hooks passed the pre-rebind check,
then rebound to agent:hooks:... (which matches neither prefix) and dispatched.

Fix

• Add resolveHookDispatchSessionKey (src/gateway/hooks.ts): rebinds the
  session key to the target agent, then re-validates the rebound key against
  allowedSessionKeyPrefixes. Returns the existing {ok,value}|{ok,error}
  result shape used by resolveHookSessionKey.
• Gate both ingress paths in createHooksRequestHandler
  (src/gateway/server-http.ts) on it — reject 400 with the existing
  getHookSessionKeyPrefixError message when the rebound key violates the
  allowlist. Single security chokepoint; dispatchAgentHook has no other
  production invoker.

Behavior change

This tightens behavior: post-rebind requests whose rebound key violates the
prefix allowlist now return 400 instead of being accepted. Requests are
unaffected when no allowlist is configured, or when the rebound key still
matches an allowed prefix.

Tests

• Restored the two covering integration tests that were removed during the
  CI-green test-remediation pass (the documented deferral lived in
  src/gateway/server.hooks.test.ts, not hooks.test.ts as the issue text
  states): agent-path + mapping-path "rejects rebinding into a disallowed
  namespace" — both assert 400 + "sessionKey must start with one of" +
  cronIsolatedRun not called. Confirmed RED before the fix, GREEN after.
• Added a unit test for resolveHookDispatchSessionKey in hooks.test.ts
  (blocked + allowed cases).
• The idempotency replay-cache tests in the same removed hunk are intentionally
  out of scope (net-new feature, separate BACKLOG item) and left unrestored;
  the BACKLOG comment documenting them is preserved.

Verification

• pnpm test:gateway — 1557 pass / 9 skip / 0 fail (full gateway suite, no regressions)
• pnpm check — format + typecheck + lint + css-drift all clean
• Fork-integrity gates (throwing-stub-callers, zombie-imports, stub-debt, obsolescence) all pass

Acceptance criteria

• Post-rebind requests whose rebound session key violates the prefix allowlist are rejected.
• The documented server.hooks.test.ts cases are restored and pass.

🤖 Generated with Claude Code