restore hook/result durationMs — review keeps wall-clock audit timing durable

Reverses item 3 of the tighten-hook-protocol-contract RFC per review:
a persistence log is written for future readers, and hook wall-clock
runtime is audit signal (which hook made a turn slow). runHook keeps
its injected now clock and RunHookResult wrapper, the bridges pass the
measured duration through HookResultRecord, the snapshot normalizer
keeps its replay scrub, and the hook fixtures carry the field again.
The RFC records the reversal; the other three prunes stand.

packages/hooks/hook-protocol/src/events.ts

@@ -49,6 +49,8 @@ export interface HookResultRecord {
    * {@link DEFAULT_STDERR_SUMMARY_MAX_CHARS} is the reference default.
    */
   stderrSummaryMaxChars: number
+  /** Wall-clock duration of the run (from `runHook`) — durable audit timing. */
+  durationMs: number
 }
 
 /**
@@ -100,5 +102,6 @@ export function appendHookResult(session: Session, record: HookResultRecord): vo
     decision: output.decision ?? (output.continue === false ? 'stop' : 'pass'),
     ...output.exitCode !== undefined ? { exitCode: output.exitCode } : {},
     ...stderrSummary !== undefined ? { stderrSummary } : {},
+    durationMs: record.durationMs,
   })
 }

packages/hooks/hook-protocol/src/index.ts

@@ -33,7 +33,7 @@ export type {
 export { matchesMatcher } from './matcher.ts'
 export { parseHookOutput } from './codec.ts'
 export { DEFAULT_HOOK_TIMEOUT_MS, runHook } from './runner.ts'
-export type { RunHookOptions } from './runner.ts'
+export type { RunHookOptions, RunHookResult } from './runner.ts'
 export { mergeHookOutputs } from './merge.ts'
 export type { MergedDecision, MergedHookOutcome } from './merge.ts'
 export { appendHookInvoked, appendHookResult, DEFAULT_STDERR_SUMMARY_MAX_CHARS, summarizeStderr } from './events.ts'

packages/hooks/hook-protocol/src/runner.ts

@@ -53,6 +53,13 @@ export interface RunHookOptions {
   expectedEventName?: string
 }
 
+/** The {@link HookOutput} plus the wall-clock duration of the run (for `hook/result`). */
+export interface RunHookResult {
+  output: HookOutput
+  /** Wall-clock duration of the run, from `now` — durable on the `hook/result` event. */
+  durationMs: number
+}
+
 /**
  * Run `hook` via `bash` with `options.payload` serialized to its stdin, then
  * decode the result into a {@link HookOutput}. The hook's configured
@@ -61,13 +68,16 @@ export interface RunHookOptions {
  * credential scrub (the trusted-plugin path). NEVER throws: an infrastructure
  * failure (the executor rejecting) is surfaced as a {@link HookOutput} with
  * `exitCode: undefined`, so the caller's merge logic treats it as a
- * non-blocking error rather than crashing the turn.
+ * non-blocking error rather than crashing the turn. `now` is injected for
+ * testable durations.
  */
 export async function runHook(
   bash: BashExecutor,
   hook: CommandHook,
   options: RunHookOptions,
-): Promise<HookOutput> {
+  now: () => number,
+): Promise<RunHookResult> {
+  const started = now()
   const timeoutMs = hook.timeoutSec !== undefined ? hook.timeoutSec * 1000 : options.defaultTimeoutMs
   const stdin = JSON.stringify(options.payload) + (options.trailingNewline ? '\n' : '')
 
@@ -86,12 +96,18 @@ export async function runHook(
     // protocol's exit-code contract is numeric, so a signal death maps to
     // `undefined` (a non-blocking error — no clean exit code to act on).
     const exitCode = result.exitCode ?? undefined
-    return parseHookOutput(exitCode, result.stdout.text, result.stderr.text, options.expectedEventName)
+    return {
+      output: parseHookOutput(exitCode, result.stdout.text, result.stderr.text, options.expectedEventName),
+      durationMs: now() - started,
+    }
   } catch (error: unknown) {
     // The executor rejects only on infrastructure faults (unusable workdir,
     // missing shell). A hook that cannot run is a non-blocking error: no exit
     // code, the failure on stderr for the record. The turn proceeds.
     const message = error instanceof Error ? error.message : String(error)
-    return parseHookOutput(undefined, '', message)
+    return {
+      output: parseHookOutput(undefined, '', message),
+      durationMs: now() - started,
+    }
   }
 }

packages/hooks/hook-protocol/src/types.ts

@@ -39,8 +39,9 @@ declare module '@deepseek-ai/dsh-session' {
      * (`approve`/`allow`/`block`/`deny`/`ask`), else `'stop'` when it asked to
      * halt via `continue:false`, else `'pass'`. `exitCode` is the process exit
      * (absent if it never ran), `stderrSummary` the trimmed stderr truncated to
-     * 500 characters (the block reason source on exit 2). `turn` matches the
-     * `hook/invoked`.
+     * the bridge's configured cap (the block reason source on exit 2),
+     * `durationMs` the wall-clock runtime (audit timing; snapshot replay
+     * normalizes it). `turn` matches the `hook/invoked`.
      * @mode emit
      */
     'hook/result': {
@@ -50,6 +51,7 @@ declare module '@deepseek-ai/dsh-session' {
       decision: string
       exitCode?: number
       stderrSummary?: string
+      durationMs: number
     }
   }
 }