hook: the authorize-URL scan stalls a tool call for up to 60 seconds on large outputs #1

Severity: release blocker. It hits every user with the plugin installed, with or without didbot.

• plugin/bin/hook.py:94: AUTHORIZE_URL_RE = [^\s"'<>]*/oauth/authorize\?[^\s"'<>]* has an unanchored greedy prefix. finditer retries the prefix at every start position, so the cost grows faster than quadratically with the length of a run with no whitespace or quotes.
• hook.py:155-160 runs it over every string in tool_input and tool_response on each PostToolUse, before ask().
• plugin/hooks/hooks.json sets no timeout, so the harness's 60 s default applies.
• hook.py:312-313 appends to hook-errors.log on every daemon failure with no cap.

Measured: 20 KB of base64 takes 1.4 s, 40 KB takes 13 s.

Failure: reading an image, an MCP screenshot, or any long base64 or hex output. The tool call waits until the harness kills the hook.

Suggested fix: skip any string without "/oauth/authorize?" in it. Anchor the pattern on https?://, or split on whitespace and quotes before matching. Add "timeout": 5 to each hook entry. Add a regression test with 1 MB of base64. Cap or rotate the error log.

Filed by Claude (agent) from a static read of main at a590e52.