Session and plugin hooks are checked against a second restricted mode

What

Hooks are commands or scripts that run automatically at set points while Claude Code works. Session hooks come from the current session and plugin hooks come from installed plugins. The check that decides whether they may run changed:

• The check now considers a second mode alongside the one it already used.
• A session hook (sessionHook) is allowed only when a further condition holds and, if the new mode is active, its configuration passes a separate check.
• A plugin hook (pluginHook) is checked against a separate allow-list of plugin names when the new mode is active, and against the existing list otherwise.
• The loader for hook modules now tags each loaded module with a judgedUnder value, taken from the request when given and otherwise worked out from the module.
• The per-turn gate for hook modules gains a failure message for when the policy has not been read yet.

Why

Which hooks run can change under managed or restricted setups, such as those an organisation applies. If a plugin or session hook stops running, check whether such a mode applies and whether the plugin is on the allow-list it uses.