Webhook notifications for review events

[wesm]

Problem

The hook system fires shell commands on review events, which works for local scripts but is clunky for posting to Slack, Discord, or Teams. Users end up writing wrapper scripts that just curl a webhook URL. That boilerplate should be built in.

Proposal

Add a webhook hook type alongside the existing command and beads types. When a matching event fires, HookRunner POSTs the event as JSON to the configured URL.

Config

[[hooks]]
event = "review.completed"
type = "webhook"
url = "https://hooks.slack.com/services/T.../B.../xxx"

[[hooks]]
event = "review.failed"
type = "webhook"
url = "https://discord.com/api/webhooks/..."

Per-repo .roborev.toml hooks work the same way, same as shell hooks today.

Payload

The Event struct already has JSON tags and contains everything needed:

{
  "type": "review.completed",
  "ts": "2026-02-25T14:30:00Z",
  "job_id": 42,
  "repo": "/Users/wesm/code/roborev",
  "repo_name": "roborev",
  "sha": "abc123def456",
  "agent": "claude-code",
  "verdict": "F",
  "findings": "..."
}

POST with Content-Type: application/json. No transformation or adapter layer per service — the payload is generic JSON. Users can use Slack/Discord's built-in webhook formatting or put a simple proxy in front if they want richer formatting.

Implementation

• Add URL string field to config.HookConfig
• In handleEvent(), when hook.Type == "webhook", call a new postWebhook() method instead of runHook()
• postWebhook() marshals the Event to JSON, POSTs to the URL with a short timeout (5s), logs errors
• Runs async via hr.wg.Add(1); go hr.postWebhook(...) — same pattern as shell hooks
• No retries on failure — log and move on, same as shell hook errors today

What changes

• config.HookConfig gains a URL field
• HookRunner.handleEvent() dispatches to postWebhook for webhook type
• New postWebhook() method (~20 lines)

What doesn't change

• Shell hooks and beads hooks unchanged
• Event matching (matchEvent) unchanged — webhooks use the same event patterns (review.*, review.failed, etc.)
• HookRunner lifecycle (Start/Stop/WaitUntilIdle) unchanged

Non-goals

• No per-service adapters (Slack Block Kit, Discord embeds, etc.) — just raw JSON POST
• No auth headers or signing — URL contains the secret (standard for Slack/Discord webhooks)
• No retry/backoff — matches existing shell hook error handling (log and continue)

[mariusvniekerk]

May as well support headers. the complexity needed for it is minimal.