Summary

Add beforeDeliver and afterDeliver lifecycle hooks to the outbound message delivery path, allowing user scripts to suppress, filter, or audit replies before they reach a channel.

Problem

All outbound replies (from cron jobs, agent sessions, subagents) flow through the delivery layer with no interception point. There is no way to suppress a reply based on content, log outbound messages to an audit trail, or transform delivery targets without modifying core code.

Acceptance criteria

• beforeDeliver hook fires before any reply is sent to a channel; returning { abort: true } suppresses delivery
• afterDeliver hook fires after successful or failed delivery with status, channel, and duration context
• Both hooks are configurable via openclaw.json under a hooks.delivery (or shared hooks) section
• Hook entries support filter.workflow (cron, agent, subagent) to target specific sources
• Hook failures are logged but never crash delivery
• Unit tests cover: suppress, pass-through, filter by workflow, hook error isolation

Implementation plan

1. Identify the shared delivery dispatch point (likely src/cron/delivery.ts + agent reply path in src/agents/subagent-announce-dispatch.ts)
2. Add DeliveryHooksConfig type to src/config/types.hooks.ts (or extend shared hook types)
3. Wire beforeDeliver check before channel send; wire afterDeliver after send completes
4. Re-use runCronHooks / loadHookEntries from src/cron/hooks.ts (already workflow-agnostic)
5. Add config schema entry and Zod validation
6. Add unit tests

Files affected

• src/cron/hooks.ts (reuse — no changes expected)
• src/config/types.hooks.ts (add DeliveryHooksConfig)
• src/config/zod-schema.ts (add Zod schema for delivery hooks)
• src/cron/delivery.ts (wire beforeDeliver)
• src/agents/subagent-announce-dispatch.ts (wire beforeDeliver for agent replies)
• src/cron/hooks.test.ts or new src/delivery/hooks.test.ts (tests)

Additional notes

• beforeDeliver is hook point 7 in the original cron hooks plan (cron-lifecycle-hooks.md) — it was deferred from the cron PR intentionally
• Highest leverage of the four planned hook workflows: all outbound messages share one delivery path
• ctx.workflow distinguishes source so a single global hook can target cron-only or agent-only delivery