Hooks can see where a prompt came from and whether it queues, and cannot fake either.
The origin and wait fields plus forgery rules exist only under the JavaScript plugin hooks rollout, whose in-build fallback is off.
What's wrong with this entry?
Plugin hooks that see a prompt submission now receive two extra fields: origin, saying where the prompt came from, and wait, saying whether it queues behind the turn in progress. New rules reject any hook answer that invents an origin the engine did not set, changes the one it was given, or sets or changes wait. This whole surface exists only when the JavaScript plugin hooks rollout is enabled, and its in-build fallback is off.
- The existing rule against a hook rewriting the prompt text still applies alongside the two new ones.
- Controlled by
tengu_plugin_hooks_modules, which falls back to false in this build, so it is off unless server configuration turns it on.
a wait the engine did not set (whether the prompt waits its turn is the user's; a hook carries it as received)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.221
Review-origin remote sessions skip some disk persistence
Both mention origin
-
v2.1.229
Artifact links can resolve against a configured host
Both mention origin