Let bots manage their hooks, with the user confirming what widens them

Bots get list_hooks, pause_hook and delete_hook, which act directly since
they only take away. A new hook, or a new name, brief or filter, or
switching a paused one back on, goes through propose_hook: it stores a
hook_proposals row and puts a [hook-proposal:ID] card in the reply, which
the user it was proposed to confirms or rejects. The card is read from
what Confirm saves, with the bot's reason labelled as its own; confirming
checks everything again and saves through the Hooks modal's helpers. A
new hook's URL is shown on the card once, to the user only, never in the
outcome the bot is told. What calls a hook, its computers and its signing
are never proposed. Only chat replies propose, and a hook call's own run
gets no hook tools, so a caller's payload can't reach them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/utils/describe-bot-hook.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, test } from "bun:test";
+import describeBotHook from "./describe-bot-hook";
+
+describe("describeBotHook", () => {
+    test("names a URL hook without any of its token", () => {
+        const text = describeBotHook({
+            hook: {
+                id: 3,
+                title: "GitHub pushes",
+                source: "url",
+                token_prefix: "hk_secretprefix",
+                has_signing_secret: 1,
+                enabled: 1,
+                run_count: 2,
+                last_called_at: Date.UTC(2026, 9, 25, 9, 0),
+                workspace_name: "Launch",
+            },
+        });
+
+        expect(text).toBe(
+            `#3 "GitHub pushes", called at its URL (signed calls only), in the workspace Launch, on, 2 runs so far, last called 2026-10-25T09:00:00.000Z`,
+        );
+        expect(text).not.toContain("hk_secretprefix");
+    });
+
+    test("names a paused notification hook with its filter and last error", () => {
+        expect(
+            describeBotHook({
+                hook: {
+                    id: 4,
+                    title: "Slack mentions",
+                    source: "browser_notifications",
+                    watch_computer_id: 2,
+                    watch_computer_name: "Main",
+                    watch_filter: "slack",
+                    computer_id: 2,
+                    enabled: 0,
+                    run_count: 1,
+                    last_error: "Timed out",
+                },
+            }),
+        ).toBe(
+            `#4 "Slack mentions", called by browser notifications on computer 2 (Main), only those containing "slack", in your own chat, on computer 2, paused, 1 run so far, never called, last error: Timed out`,
+        );
+    });
+});