Feature Request: tool.execute.before hook with cancel capability

[soultaster]

Background

The current plugin API only provides tool.execute.after. This allows post-execution detection but not pre-execution blocking. As demonstrated by AgentSpec (ICSE 2026), AWS Strands, and CommBank Policy Engine, true guardrails require intervention before tool execution.

Request

Add plugin hook tool.execute.before:

• Signature: (input: ToolInput) => Promise<{ cancel?: string } | void>
• When cancel string is returned, abort tool execution and relay the message to the agent

Use Cases

• Repeated failure prevention: block 4th execution after 3 failures of the same command pattern
• Safety policies: block file operations outside allowed directories
• Self-improvement: pre-emptively block commands known to fail based on learned patterns

[github-actions]

This issue doesn't fully meet our contributing guidelines.

What needs to be fixed:

• Feature request titles must start with [FEATURE]: (e.g. [FEATURE]: tool.execute.before hook with cancel capability)
• The feature request template requires checking the verification checkbox confirming the feature hasn't been suggested before

Please edit this issue to address the above within 2 hours, or it will be automatically closed.

---

This issue might be a duplicate of existing issues. Please check:

• tool.execute.before cannot replace missing tool call arguments #20013: tool.execute.before already exists — this issue references it and covers related hook behavior
• Tool use cannot be prevented early in a session #6862: Tool use cannot be prevented early in a session — about tool.execute.before not blocking tool execution correctly
• Native Claude Code hooks compatibility (PreToolUse, PostToolUse, Stop) #12472: Native Claude Code hooks compatibility (PreToolUse/PostToolUse) — covers pre-tool-use blocking/cancel capability
• [FEATURE]: Add messageID to tool.execute.before/after hook payloads #15933: Add messageID to tool.execute.before/after hook payloads — implies the hook already exists; the cancel return value may already be supported or partially implemented

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

This issue has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new issue that follows our issue templates.