Include environment hooks in thread hook listings (#56553)

## Why

Listing hooks by working directory alone omits hooks supplied by a thread's selected execution environments, including hooks that can block a turn.

## What changed

- Add `threadId` to `hooks/list` to return a loaded thread's current hook inventory, including selected, ready environments. Reject requests that also specify `cwds`.
- Expose `environmentId` in hook metadata and have the TUI hooks browser query the current thread and label environment-owned hooks. Keep working-directory lookup for startup review.
- Represent environment hook source paths with `PathUri` and use `LegacyAppPathString` in hook run summaries to preserve native path conventions.

## Testing

Add coverage for listing a blocking environment hook and removing it after environment failure, delivering prompt input and reporting exit status in PowerShell and Bash, and running `PreToolUse` hooks only on the command's owning executor. Extend remote network tests to verify that environment hooks use the command's network policy while retaining their filesystem access.

GitOrigin-RevId: 97229e22793df51f4bd502c1f9e19f0c52fb2305

codex-rs/app-server-protocol/src/protocol/common.rs

@@ -2447,7 +2447,7 @@ mod tests {
 
         let hooks_list = ClientRequest::HooksList {
             request_id: request_id(),
-            params: v2::HooksListParams { cwds: Vec::new() },
+            params: v2::HooksListParams::default(),
         };
         assert_eq!(
             hooks_list.serialization_scope(),

codex-rs/app-server-protocol/src/protocol/v2/hook.rs

@@ -11,7 +11,7 @@ use codex_protocol::protocol::HookRunSummary as CoreHookRunSummary;
 use codex_protocol::protocol::HookScope as CoreHookScope;
 use codex_protocol::protocol::HookSource as CoreHookSource;
 use codex_protocol::protocol::HookTrustStatus as CoreHookTrustStatus;
-use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_path_uri::LegacyAppPathString;
 use serde::Deserialize;
 use serde::Serialize;
 
@@ -106,7 +106,7 @@ pub struct HookRunSummary {
     pub handler_type: HookHandlerType,
     pub execution_mode: HookExecutionMode,
     pub scope: HookScope,
-    pub source_path: AbsolutePathBuf,
+    pub source_path: LegacyAppPathString,
     #[serde(default = "default_hook_source")]
     pub source: HookSource,
     pub display_order: i64,

codex-rs/app-server-protocol/src/protocol/v2/plugin.rs

@@ -47,13 +47,16 @@ pub struct SkillsExtraRootsSetParams {
 #[ts(export_to = "v2/")]
 pub struct SkillsExtraRootsSetResponse {}
 
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]
 pub struct HooksListParams {
-    /// When empty, defaults to the current session working directory.
+    /// Working directories to inspect when no thread is specified. An empty list uses the session cwd.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub cwds: Vec<PathBuf>,
+    /// List a loaded thread's hooks, including its selected environments. Omit `cwds` in this mode.
+    #[ts(optional = nullable)]
+    pub thread_id: Option<String>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
@@ -597,6 +600,8 @@ pub struct HookMetadata {
     pub source_path: AbsolutePathBuf,
     pub source: HookSource,
     pub plugin_id: Option<String>,
+    /// The owning execution environment, if this hook came from its requirements.
+    pub environment_id: Option<String>,
     pub display_order: i64,
     pub enabled: bool,
     pub is_managed: bool,