A killed PreToolUse command hook makes the CLI ALLOW the gated tool (fail-open for permission-decision hooks)

Summary

A PreToolUse command hook that is killed by the CLI's hook timeout (~10 minutes observed for hooks with no explicit timeout configured) results in the gated tool call being allowed. For hooks that implement a permission decision (hookSpecificOutput.permissionDecision: "deny" protocol), this is a fail-OPEN: the exact case where the hook could not finish deciding is treated as consent.

Repro sketch

1. Register a PreToolUse hook on a consequential tool that blocks waiting for an out-of-band approval (e.g. polls a file for a user's decision) longer than the hook kill window.
2. Call the tool; leave the approval unanswered.
3. At ~10 minutes the CLI kills the hook process — and then executes the tool as if the hook had allowed it.

We hit this in production-like usage: an approval card for a "publish site publicly" tool sat unanswered, the hook was killed at ~10 minutes, and the publish executed without consent.

Expected

For a killed/timed-out PreToolUse hook, a conservative default — deny, or at minimum falling through to the normal permission prompt — rather than allow. Alternatively (or additionally): make the kill window configurable/documented for PreToolUse, and surface a distinct signal so wrappers can distinguish "hook allowed" from "hook died".

We've since moved our approvals inside the MCP tools (fail-closed by ordering), so this isn't blocking us — filing because the killed-hook⇒allow default seems footgun-shaped for anyone using PreToolUse hooks as permission gates.