build_hooks_config
Configure pre- and post-execution hooks for sandbox-native tools (code_execution, file operations). Pre-hooks allow or deny tool calls; post-hooks run after execution.
Instructions
Build a hooks.json config for sandbox-native tool interception (code_execution, read/write/list/delete_file).
Hooks only fire for sandbox-native tools, never for function calling or mcp_server tools. Mount the result at target ".agents/hooks.json" via build_environment_config's inline sources so the sandbox picks it up automatically.
Args: pre_tool_execution: List of {"matcher": "<RE2 regex, e.g. 'code_execution' or '.*_file'>", "hooks": [{"type": "command"|"http", "command"|"url": "...", "timeout": 10}]}. A "command" hook receives the tool call as JSON on stdin and must print {"decision": "allow"} or {"decision": "deny", "reason": "..."} to stdout. post_tool_execution: Same matcher/hooks shape; runs after execution, cannot block, output ignored. group_name: Top-level key grouping this hook set. enabled: Whether this group is active.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| enabled | No | ||
| group_name | No | default | |
| pre_tool_execution | No | ||
| post_tool_execution | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |