vigiles API reference
    Preparing search index...

    Interface HookRunResult

    interface HookRunResult {
        blocked: boolean;
        decision: "approve" | "block" | "allow" | "deny" | "ask" | undefined;
        egress: readonly EgressAttempt[];
        egressDropped?: { bytes: number; packets: number };
        exitCode: number;
        filesWritten: readonly string[];
        json: HookOutput | null;
        stderr: string;
        stdout: string;
    }
    Index

    Properties

    blocked decision egress egressDropped? exitCode filesWritten json stderr stdout

    Properties

    blocked: boolean

    Normalized decision: a deny/block via exit 2, decision:"block", or permissionDecision:"deny" all set blocked = true.

    decision: "approve" | "block" | "allow" | "deny" | "ask" | undefined

    The decision the hook expressed, preferring the structured permissionDecision ("allow"|"deny"|"ask") then legacy decision ("approve"|"block"), else undefined.

    egress: readonly EgressAttempt[]

    Network egress the hook attempted. With RunHookOptions.recordEgress: every (blocked) attempt the proxy saw. With RunHookOptions.egress: the allowlisted hosts that were actually reached (allowed: true, with packet counts). Empty otherwise.

    egressDropped?: { bytes: number; packets: number }

    Allowlisted-egress mode only: the aggregate off-allowlist traffic the packet-layer wall dropped. packets === 0 means the hook stayed entirely within the allowlist. Undefined when RunHookOptions.egress was unset.

    exitCode: number
    filesWritten: readonly string[]

    Files the hook wrote to its work dir (relative paths), recorded on confined runs — what a hook touched on disk. Empty on a direct (unconfined) run. Assert over it with assertNoWrite / assertWroteOnly.

    json: HookOutput | null

    Parsed stdout JSON if the hook emitted a JSON decision, else null.

    stderr: string
    stdout: string

    Settings

    Member Visibility

    On This Page

    Properties