Authenticate /hook/*, and make every hook a command hook

/hook/record and /hook/approve accepted anything that reached the port. That is
not "loopback only": `tailscale serve` proxies tailnet traffic to 127.0.0.1, so
anyone who could reach the tunnel could forge timeline events and answer
approval prompts. Both endpoints now require a 32-byte secret from
$GLANCE_HOME/hook.secret (0600, created once, never rotated so nothing in
flight is 403'd mid-session), compared in constant time before the body is
read, as an x-glance-hook header or a ?k= parameter. Requests carrying
x-forwarded-* are refused outright: a local hook process never sends them and a
tunnelled caller always does. The check applies to /hook/* only, so the
dashboard is unaffected.

While wiring that up: the 13 passive `type: "http"` hooks could never have
worked. Grok Build's http runner rejects every scheme but https, then resolves
the host and blocks private/link-local/CGNAT addresses (validate_hook_url +
is_blocked_ip), so neither loopback-over-http nor *.ts.net (100.64/10) can be a
hook target - and it sends no header but Content-Type, so such a hook could not
authenticate anyway. They were failing validation silently on every event. All
of them are now command hooks running bin/glance-record.mjs, which costs a Node
start and can present the secret.

hooks.json is generated from hooks/hooks.template.json by scripts/gen-hooks.mjs
(npm run build, glance sync-hooks). It creates the secret, derives the approval
hook's timeout from approval.timeoutMs instead of hand-copying 125, and refuses
to write a hook that cannot fire: bad type, non-positive timeout, non-https
http URL, missing bin/ script, or a leftover placeholder. A template that
embeds the token makes the output 0600 with a warning.

Fail-open is unchanged: a missing, stale or rejected secret degrades to "no
telemetry", and glance-approve.mjs still allows on every error path. glance
status warns when the on-disk secret no longer matches the daemon's.

Validated with the e2e suite (190 checks, including no-token/wrong-token/
same-length-token 403s, ?k= acceptance, x-forwarded-* refusal, and the
recorder's fail-open paths) and a clean npm run build.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

bin/glance

@@ -10,7 +10,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import {
   PLUGIN_ROOT,
   baseUrl,
@@ -124,6 +124,12 @@ switch (cmd) {
     console.log(`  watchers      : ${s.watchers}`);
     console.log(`  sessions      : ${s.sessions}`);
     console.log(`  events kept   : ${s.events}`);
+    if (s.hookAuthOk === false) {
+      console.log(
+        "\n  ! hook auth mismatch: $GLANCE_HOME/hook.secret no longer matches what the daemon" +
+          "\n    loaded, so events are being dropped. Restart it: glance stop && glance up",
+      );
+    }
     if (s.devices === 0) console.log("\nNo device enrolled yet. Run: glance enroll");
     break;
   }
@@ -200,22 +206,19 @@ switch (cmd) {
   }
 
   case "sync-hooks": {
-    const file = path.join(PLUGIN_ROOT, "hooks", "hooks.json");
-    const doc = JSON.parse(fs.readFileSync(file, "utf8"));
-    let changed = 0;
-    for (const groups of Object.values(doc.hooks ?? {})) {
-      for (const group of groups) {
-        for (const h of group.hooks ?? []) {
-          if (h.type === "http" && typeof h.url === "string") {
-            const next = h.url.replace(/127\.0\.0\.1:\d+/, `127.0.0.1:${cfg.port}`);
-            if (next !== h.url) changed++;
-            h.url = next;
-          }
-        }
-      }
+    // hooks.json is generated, not edited: regenerate it from hooks/hooks.template.json.
+    // The port is not baked into it any more — the hook scripts read config.json themselves —
+    // so the thing this actually refreshes is the approval gate's timeout, plus the hook
+    // secret if it has gone missing.
+    const { status } = spawnSync(
+      process.execPath,
+      [path.join(PLUGIN_ROOT, "scripts", "gen-hooks.mjs")],
+      { stdio: "inherit" },
+    );
+    if (status !== 0) process.exit(status ?? 1);
+    if (await isDaemonUp(cfg)) {
+      console.log("restart the daemon to pick up config changes: glance stop && glance up");
     }
-    fs.writeFileSync(file, JSON.stringify(doc, null, 2) + "\n");
-    console.log(`rewrote ${changed} hook url(s) to port ${cfg.port}`);
     break;
   }
 
@@ -241,7 +244,7 @@ switch (cmd) {
   glance devices                list enrolled devices
   glance revoke <id-prefix>     revoke a device
   glance approval <off|risky|all>   remote approval policy
-  glance sync-hooks             rewrite hook urls after a port change
+  glance sync-hooks             regenerate hooks/hooks.json from the template
   glance logs                   tail the daemon log
 `);
 }