@miphamai/cli 0.81.7 → 0.81.9

package/src/config/keys-manager.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs'
 import { join, dirname } from 'node:path'
 import { homedir } from 'node:os'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 import { saveProviderApiKey } from './loader'
 
 const MIPHAM_HOME = join(homedir(), '.mipham')
@@ -31,7 +32,13 @@ function loadKeys(): KeysData {
   if (!existsSync(KEYS_FILE)) return {}
   try {
     const raw = readFileSync(KEYS_FILE, 'utf-8')
-    return JSON.parse(raw) as KeysData
+    const parsed: unknown = JSON.parse(raw)
+    // Valid JSON is not necessarily a key map. `null` throws straight out of
+    // `Object.entries` in `list()` — i.e. on the startup path, not in some corner
+    // — and an array or a scalar yields entries with none of the fields, which
+    // reads as "not expired" instead of as corrupt.
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return {}
+    return parsed as KeysData
   } catch {
     return {}
   }
@@ -39,14 +46,12 @@ function loadKeys(): KeysData {
 
 function saveKeys(data: KeysData): void {
   mkdirSync(dirname(KEYS_FILE), { recursive: true })
-  const tmp = KEYS_FILE + '.tmp'
-  writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 })
-  writeFileSync(KEYS_FILE, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 })
-  try {
-    chmodSync(KEYS_FILE, 0o600)
-  } catch {
-    // chmod on Windows is a no-op
-  }
+  // 从前这里「转了一半」：先写一个固定名的 `.tmp`，**然后不 rename、直接再写一遍
+  // 目标**。留在磁盘上的 `.tmp` 是废物，目标仍然非原子 —— 并发 `/keys rotate` 撞进
+  // 同一个临时名，或写到一半被打断，`loadKeys` 把不可解析的 JSON 吞成 `{}`
+  // （见上面的 catch）⇒ 全部轮换元数据静默消失。atomicWriteFileSync 自己写唯一名
+  // 临时文件再 rename，两者一起解决。
+  atomicWriteFileSync(KEYS_FILE, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 })
 }
 
 function daysSince(iso: string): number {

package/src/config/loader.ts

@@ -65,10 +65,21 @@ function mergeProviders(
   const merged = [...baseProviders]
 
   for (const op of overrideProviders) {
+    // This array comes straight out of hand-written YAML: an entry can be
+    // `null`, or a bare scalar (iterating `providers: nope` yields its
+    // characters). Neither is a provider config, and neither should reach the
+    // field reads below.
+    if (!op || typeof op !== 'object') continue
+
+    // A non-string `apiKey` (a number, a list, a nested map) is not a secret.
+    // It reads as "no key" — the same invariant getProviderApiKey enforces —
+    // rather than reaching a `.startsWith` and taking the whole CLI down.
+    const apiKey = typeof op.apiKey === 'string' ? op.apiKey : undefined
+
     const idx = merged.findIndex((bp) => bp.id === op.id)
     if (idx === -1) {
       // Provider not in defaults — add it wholesale (custom provider)
-      merged.push(op)
+      merged.push(apiKey === undefined ? op : { ...op, apiKey })
       continue
     }
 
@@ -82,7 +93,7 @@ function mergeProviders(
       // sent, so only trusted (user-level) config may override it. Untrusted
       // (project-level) config cannot redirect a built-in provider's traffic.
       baseUrl: allowBaseUrlOverride ? (op.baseUrl ?? base.baseUrl) : base.baseUrl,
-      apiKey: op.apiKey ?? base.apiKey,
+      apiKey: apiKey ?? base.apiKey,
       models: op.models?.length ? op.models : base.models,
       status: op.status ?? base.status,
     }
@@ -91,16 +102,44 @@ function mergeProviders(
   return merged
 }
 
+/**
+ * Merge `override` into `base`, recursing into plain objects so that a source
+ * setting one branch of an object does not drop the other source's siblings
+ * (`features.mcp` must not wipe `features.context`).
+ *
+ * Arrays and scalars replace: a project's `skills.paths` must not append to the
+ * user's list. Objects are rebuilt with spread rather than assignment — a parsed
+ * `__proto__` key is then copied as an ordinary own property instead of
+ * mutating the result's prototype.
+ */
+function mergeObjects<T extends Record<string, unknown>>(base: T, override: T): T {
+  let merged: Record<string, unknown> = { ...base }
+  for (const [key, value] of Object.entries(override)) {
+    const existing = (base as Record<string, unknown>)[key]
+    merged = {
+      ...merged,
+      [key]:
+        isPlainObject(value) && isPlainObject(existing) ? mergeObjects(existing, value) : value,
+    }
+  }
+  return merged as T
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
 function mergeConfig(
   base: MiphamConfig,
   override: Partial<MiphamConfig>,
   allowBaseUrlOverride: boolean,
 ): MiphamConfig {
-  const merged: MiphamConfig = { ...base, ...override }
+  const merged = mergeObjects(
+    base as unknown as Record<string, unknown>,
+    override as Record<string, unknown>,
+  ) as unknown as MiphamConfig
   if (override.providers) {
     merged.providers = mergeProviders(base.providers, override.providers, allowBaseUrlOverride)
-  } else {
-    merged.providers = base.providers
   }
   return merged
 }
@@ -182,31 +221,19 @@ function loadMcpJson(cwd: string): McpServerConfig[] {
     try {
       if (!existsSync(path)) continue
       const raw = readFileSync(path, 'utf-8')
+      // Every McpServerConfig field is optional here (the name comes from the
+      // key), so a field added to the type is accepted without touching this.
       const parsed = JSON.parse(raw) as {
-        mcpServers?: Record<
-          string,
-          {
-            command?: string
-            args?: string[]
-            url?: string
-            headers?: Record<string, string>
-            env?: Record<string, string>
-          }
-        >
+        mcpServers?: Record<string, Partial<McpServerConfig>>
       }
 
       if (parsed.mcpServers) {
         for (const [name, cfg] of Object.entries(parsed.mcpServers)) {
           // Avoid duplicates by name
           if (servers.some((s) => s.name === name)) continue
-          servers.push({
-            name,
-            command: cfg.command,
-            args: cfg.args || [],
-            url: cfg.url,
-            headers: cfg.headers,
-            env: cfg.env,
-          })
+          // Spread the whole entry rather than re-listing fields: hand-rebuilding
+          // the object silently dropped request_timeout_ms and auth.
+          servers.push({ ...cfg, name, args: cfg.args || [] })
         }
       }
     } catch {
@@ -224,20 +251,57 @@ function loadMcpJson(cwd: string): McpServerConfig[] {
 export interface SettingsJson {
   hooks: SettingsHooks
   permissions: { allow: string[]; deny: string[] }
+  /**
+   * Present (and `true`) only when the project-level file really did declare
+   * hooks and they were withheld because the caller did not vouch for the
+   * workspace. Absent in every other case — including "the file has no hooks",
+   * so a caller announcing the skip cannot announce one that never happened.
+   */
+  projectHooksSkipped?: true
+  /**
+   * The subset of `hooks` that came from the project-level file — the entries
+   * the workspace-trust gate governs. Absent unless the caller vouched for the
+   * workspace *and* that file really declared hooks.
+   *
+   * Needed because `hooks` is provenance-free once merged: project and user
+   * entries sit in one bucket, yet only one of the two is gated. A caller that
+   * lists the merged form therefore cannot say which entries will run.
+   */
+  projectHooks?: SettingsHooks
 }
 
 /**
  * Load `settings.json` — project-level `.mipham/settings.json` then user-level
  * `~/.mipham/settings.json`. Mirrors the Claude Code convention (hooks additive,
  * permissions merged), so users can migrate their Claude settings unchanged.
+ *
+ * `includeProjectHooks` defaults to **false**, because the project-level file is
+ * repository-controlled and its `hooks` are shell commands this process will
+ * spawn — reading them is an act of trust, not a default. Callers that have
+ * established trust (or that only *display* the configured list) opt in
+ * explicitly. The flag gates hooks only: `permissions` still merge from both
+ * levels, since that question is answered by the mode ceiling, not by trust.
  */
-export function loadSettingsJson(cwd: string = process.cwd()): SettingsJson {
+export function loadSettingsJson(
+  cwd: string = process.cwd(),
+  options: { includeProjectHooks?: boolean } = {},
+): SettingsJson {
   const hooks: SettingsHooks = {}
   const permissions = { allow: [] as string[], deny: [] as string[] }
+  let projectHooksSkipped = false
+  // The project file's entries, kept out of the merge so provenance survives it.
+  const projectHooks: SettingsHooks = {}
+
+  const searchPaths: Array<{ path: string; readHooks: boolean; isProject?: boolean }> = [
+    {
+      path: join(cwd, '.mipham', 'settings.json'),
+      readHooks: options.includeProjectHooks ?? false,
+      isProject: true,
+    },
+    { path: join(MIPHAM_HOME, 'settings.json'), readHooks: true },
+  ]
 
-  const searchPaths = [join(cwd, '.mipham', 'settings.json'), join(MIPHAM_HOME, 'settings.json')]
-
-  for (const path of searchPaths) {
+  for (const { path, readHooks, isProject } of searchPaths) {
     try {
       if (!existsSync(path)) continue
       const raw = readFileSync(path, 'utf-8')
@@ -246,11 +310,27 @@ export function loadSettingsJson(cwd: string = process.cwd()): SettingsJson {
         permissions?: { allow?: unknown; deny?: unknown }
       }
 
-      if (parsed.hooks && typeof parsed.hooks === 'object') {
+      if (!readHooks) {
+        // "Was anything actually withheld?" is answered from the same parse that
+        // would have read it, so the skip notice cannot outrun the fact.
+        const declared = Object.values(parsed.hooks ?? {}).some(
+          (entries) => Array.isArray(entries) && entries.length > 0,
+        )
+        if (declared) projectHooksSkipped = true
+      }
+
+      if (readHooks && parsed.hooks && typeof parsed.hooks === 'object') {
         for (const [eventName, entries] of Object.entries(parsed.hooks)) {
           if (!Array.isArray(entries)) continue
           const bucket = (hooks as Record<string, unknown[]>)[eventName]
           ;(hooks as Record<string, unknown[]>)[eventName] = [...(bucket ?? []), ...entries]
+          if (isProject) {
+            const pBucket = (projectHooks as Record<string, unknown[]>)[eventName]
+            ;(projectHooks as Record<string, unknown[]>)[eventName] = [
+              ...(pBucket ?? []),
+              ...entries,
+            ]
+          }
         }
       }
 
@@ -268,7 +348,16 @@ export function loadSettingsJson(cwd: string = process.cwd()): SettingsJson {
     }
   }
 
-  return { hooks, permissions }
+  // Keys added only when they have something to say: `toEqual` distinguishes
+  // `false` from absent, and "no project hooks" must stay indistinguishable from
+  // "nothing to report" — an empty marker would let a caller tag user hooks as
+  // gated on the strength of a file with nothing in it.
+  const result: SettingsJson = { hooks, permissions }
+  if (projectHooksSkipped) result.projectHooksSkipped = true
+  if (Object.values(projectHooks).some((entries) => Array.isArray(entries) && entries.length > 0)) {
+    result.projectHooks = projectHooks
+  }
+  return result
 }
 
 /** Which settings.json a permission rule is persisted to. */
@@ -478,44 +567,90 @@ export function loadInferenceHookConfig(): InferenceHookConfig {
 }
 
 /**
- * Load credential masking configuration from the same config sources.
- * Merges project-level over user-level. Returns defaults if no section present.
+ * Overlay one config file's `credential_masking` section onto `merged`.
+ *
+ * A malformed file leaves `merged` untouched — so a config that cannot be read
+ * costs you the *overrides*, never the masking itself (the defaults are on).
+ *
+ * `allowLoosening` is the same split as `baseUrl` in `mergeProviders`: the
+ * user's own `~/.mipham/config.yml` is trusted and may set anything, while a
+ * **project** file is whatever the repo you cloned shipped. Project level may
+ * only tighten — switch masking on and add rules, never switch it off or drop a
+ * rule. Otherwise one line in a cloned repo silently takes away a control the
+ * user already had (`enabled: false`), or `files: [...]` replaces the defaults
+ * wholesale and the SSH private-key rule stops being masked.
  */
-export function loadCredentialMaskingConfig(cwd: string = process.cwd()): CredentialMaskingConfig {
-  const configPath = join(cwd, '.mipham', 'config.yml')
-  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
-
-  let merged = { ...DEFAULT_CREDENTIAL_MASKING_CONFIG }
-
-  const paths = [userConfigPath, configPath] // project wins (loaded last)
-  for (const path of paths) {
-    try {
-      if (!existsSync(path)) continue
-      const raw = readFileSync(path, 'utf-8')
-      const parsed = parseYaml(raw) as Record<string, unknown>
-      const section = parsed.credential_masking as Partial<CredentialMaskingConfig> | undefined
-      if (section) {
-        merged = {
-          enabled: section.enabled ?? merged.enabled,
-          files: section.files ?? merged.files,
-          output_scrubbing: {
-            enabled: section.output_scrubbing?.enabled ?? merged.output_scrubbing.enabled,
-            patterns: section.output_scrubbing?.patterns ?? merged.output_scrubbing.patterns,
-          },
-          env_filter: {
-            enabled: section.env_filter?.enabled ?? merged.env_filter.enabled,
-            patterns: section.env_filter?.patterns ?? merged.env_filter.patterns,
-          },
-        }
-      }
-    } catch {
-      // Silently skip malformed configs
+function mergeCredentialMaskingFile(
+  merged: CredentialMaskingConfig,
+  path: string,
+  allowLoosening: boolean,
+): CredentialMaskingConfig {
+  try {
+    if (!existsSync(path)) return merged
+    const raw = readFileSync(path, 'utf-8')
+    const parsed = parseYaml(raw) as Record<string, unknown>
+    const section = parsed.credential_masking as Partial<CredentialMaskingConfig> | undefined
+    if (!section) return merged
+
+    // Tightening can only ever turn a switch on, never off.
+    const flag = (next: boolean | undefined, cur: boolean): boolean =>
+      allowLoosening ? (next ?? cur) : cur || (next ?? false)
+
+    // Tightening adds rules instead of replacing them. Earlier rules stay in
+    // front because `matchCredentialFile` returns the **first** match — so a
+    // project cannot weaken a path's mode by adding a second rule for it.
+    const rules = <T>(next: T[] | undefined, cur: T[]): T[] =>
+      allowLoosening ? (next ?? cur) : [...cur, ...(next ?? [])]
+
+    return {
+      enabled: flag(section.enabled, merged.enabled),
+      files: rules(section.files, merged.files),
+      output_scrubbing: {
+        enabled: flag(section.output_scrubbing?.enabled, merged.output_scrubbing.enabled),
+        patterns: rules(section.output_scrubbing?.patterns, merged.output_scrubbing.patterns),
+      },
+      env_filter: {
+        enabled: flag(section.env_filter?.enabled, merged.env_filter.enabled),
+        patterns: rules(section.env_filter?.patterns, merged.env_filter.patterns),
+      },
     }
+  } catch {
+    // Silently skip malformed configs
+    return merged
   }
+}
 
+/**
+ * Load credential masking configuration from the same config sources.
+ * Returns defaults if no section present.
+ *
+ * User level first (trusted, may loosen), then project level (tighten only).
+ */
+export function loadCredentialMaskingConfig(cwd: string = process.cwd()): CredentialMaskingConfig {
+  let merged = { ...DEFAULT_CREDENTIAL_MASKING_CONFIG }
+  merged = mergeCredentialMaskingFile(merged, join(MIPHAM_HOME, 'config.yml'), true)
+  merged = mergeCredentialMaskingFile(merged, join(cwd, '.mipham', 'config.yml'), false)
   return merged
 }
 
+/**
+ * User-level masking policy only (`~/.mipham/config.yml`), without any project
+ * section.
+ *
+ * The tool registry is one instance per daemon process, while sessions carry
+ * different cwds (`createToolRegistry()` in `daemon/server.ts` is memoized) —
+ * so a project's section cannot be applied to it without leaking one project's
+ * policy into another session. User level is the only scope that is true for
+ * every session the registry serves.
+ */
+export function loadUserCredentialMaskingConfig(): CredentialMaskingConfig {
+  return mergeCredentialMaskingFile(
+    { ...DEFAULT_CREDENTIAL_MASKING_CONFIG },
+    join(MIPHAM_HOME, 'config.yml'),
+    true,
+  )
+}
+
 /**
  * Load background agent configuration from config sources.
  */
@@ -588,11 +723,15 @@ export function loadCrossSessionConfig(cwd: string = process.cwd()): CrossSessio
  */
 function decryptProviderApiKeys(providers: ProviderConfig[] | undefined): void {
   if (!providers) return
-  const needsKey = providers.some((p) => p.apiKey.startsWith(ENC_PREFIX))
-  if (!needsKey) return
+  // Same invariant as getProviderApiKey: only a string can carry the `enc:v1:`
+  // prefix, so a malformed entry counts as "no key" instead of throwing on
+  // `.startsWith` and taking the whole CLI down at startup.
+  const isEncrypted = (p: ProviderConfig | null): boolean =>
+    !!p && typeof p.apiKey === 'string' && p.apiKey.startsWith(ENC_PREFIX)
+  if (!providers.some(isEncrypted)) return
   const key = getCredentialKey(MIPHAM_HOME)
   for (const p of providers) {
-    if (!p.apiKey.startsWith(ENC_PREFIX)) continue
+    if (!isEncrypted(p)) continue
     try {
       p.apiKey = decryptApiKey(p.apiKey, key)
     } catch (err: unknown) {

package/src/config/preferences.ts

@@ -5,9 +5,10 @@
  * NOT for config.yml settings — those belong in the YAML config system.
  * NOT for secrets — this file is plain JSON, not encrypted.
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
+import { readFileSync, existsSync, mkdirSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
+import { atomicWriteFileSync } from '../shared/atomic-write'
 
 const PREFS_PATH = join(homedir(), '.mipham', 'preferences.json')
 
@@ -27,7 +28,9 @@ function writePrefs(prefs: Record<string, string>): void {
   try {
     const dir = join(homedir(), '.mipham')
     if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 })
-    writeFileSync(PREFS_PATH, JSON.stringify(prefs, null, 2), { mode: 0o600, encoding: 'utf-8' })
+    // 原子写：裸 writeFileSync 原地截断，崩在写中途就留下一份不可解析的文件，
+    // 而 readPrefs 把不可解析吞成「空」⇒ **全部**偏好静默消失（不是丢一项）。
+    atomicWriteFileSync(PREFS_PATH, JSON.stringify(prefs, null, 2), { mode: 0o600 })
   } catch {
     // best-effort; never crash because preferences failed to save
   }

package/src/core/credential-masker/output-scrub.ts

@@ -11,6 +11,16 @@ import { SecurityGate } from '../../security/gate'
 const TOKEN_REDACTION_PATTERN =
   /\b(?:ghp_|gho_|ghs_|ghu_|ghr_|github_pat_|glpat-|gldt-|glrt-|gloas-)[A-Za-z0-9_-]{8,}/g
 
+/**
+ * Credentials embedded in a URL's userinfo — `scheme://user:password@host`.
+ *
+ * Nothing in the *name* gives this away: `DATABASE_URL` holds no secret word,
+ * so a name-based pattern cannot see it (and masking every `*_URL` would take
+ * out every non-secret endpoint too). The shape is the only reliable tell.
+ * Redacts the password and keeps user + host, or the line stops being readable.
+ */
+const URL_USERINFO_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]+)@/gi
+
 /**
  * Scrub credential patterns from stdout/stderr output.
  * Uses the configured output_scrubbing patterns to detect and replace
@@ -24,6 +34,9 @@ export function maskOutput(output: string, config: CredentialMaskingConfig): str
   // Redact bare secret tokens by prefix (always on, independent of config patterns).
   masked = masked.replace(TOKEN_REDACTION_PATTERN, CREDENTIAL_SENTINEL)
 
+  // Redact URL-embedded passwords — also shape-based, also always on.
+  masked = masked.replace(URL_USERINFO_PATTERN, `$1$2:${CREDENTIAL_SENTINEL}@`)
+
   // Redact bare sk-/sk-ant-/JWT tokens — wire the SecurityGate credential-leak
   // detection into the output path (defense-in-depth beyond the config patterns).
   masked = SecurityGate.redactCredentialLeak(masked)
@@ -34,8 +47,9 @@ export function maskOutput(output: string, config: CredentialMaskingConfig): str
       const clean = pattern.replace(/^\(\?i\)/, '')
       const regex = new RegExp(clean, 'gim')
       masked = masked.replace(regex, (match) => {
-        // Replace everything after the separator (= or :)
-        return match.replace(/\s*[:=]\s*\S+/, `=${CREDENTIAL_SENTINEL}`)
+        // Replace everything after the separator (= or :), swallowing the quote
+        // a JSON-shaped hit puts in front of it (`"apiKey": "…"`).
+        return match.replace(/\s*["']?\s*[:=]\s*["']?\S+/, `=${CREDENTIAL_SENTINEL}`)
       })
     } catch {
       // Invalid regex — skip

package/src/core/cron-poller.ts

@@ -9,9 +9,22 @@ import { computeNextFire } from './cron'
 import type { CronJob } from '../tools/scheduling/cron'
 import { readAllJobs, writeJob, deleteJobFile } from '../tools/scheduling/cron'
 
-/** Jobs whose nextFire is at or before `now`. Pure — separated for tests. */
-export function findDueJobs(jobs: CronJob[], now: Date): CronJob[] {
-  return jobs.filter((j) => new Date(j.nextFire).getTime() <= now.getTime())
+/**
+ * Whether a job belongs to `cwd`.
+ *
+ * A job with no `cwd` is from a file written before jobs carried one; it matches
+ * anywhere so an existing user's schedule keeps firing instead of going silent.
+ * `cwd === undefined` means the caller did not ask for scoping at all (the pure
+ * helpers' existing callers), so nothing is filtered.
+ */
+function matchesCwd(job: CronJob, cwd?: string): boolean {
+  if (job.cwd === undefined || cwd === undefined) return true
+  return job.cwd === cwd
+}
+
+/** Jobs whose nextFire is at or before `now` — and which belong to `cwd`. */
+export function findDueJobs(jobs: CronJob[], now: Date, cwd?: string): CronJob[] {
+  return jobs.filter((j) => new Date(j.nextFire).getTime() <= now.getTime() && matchesCwd(j, cwd))
 }
 
 /** Next state after firing a due job: recurring advances; one-shot → null (delete). */
@@ -24,9 +37,20 @@ export function advanceJob(job: CronJob, now: Date): CronJob | null {
   }
 }
 
-/** Read due jobs, enqueue their prompts, and advance/delete. Returns fired count. */
-export function checkCronJobs(enqueue: (prompt: string) => void, now = new Date()): number {
-  const due = findDueJobs(readAllJobs(), now)
+/**
+ * Read due jobs, enqueue their prompts, and advance/delete. Returns fired count.
+ *
+ * `cwd` defaults to the process's working directory — the same source
+ * `ToolContext.cwd` comes from — because the enqueued prompt lands in *this*
+ * session and is executed here. Without the filter, a schedule created in one
+ * project would be run by whatever session happened to be open in another.
+ */
+export function checkCronJobs(
+  enqueue: (prompt: string) => void,
+  now = new Date(),
+  cwd = process.cwd(),
+): number {
+  const due = findDueJobs(readAllJobs(), now, cwd)
   for (const job of due) {
     enqueue(job.prompt)
     const next = advanceJob(job, now)

package/src/core/engine.ts

@@ -256,11 +256,16 @@ export class QueryEngine {
           }
 
           if (policy === 'ask') {
-            // Mark as awaiting approval — the model should verify with the user before acting
+            // Mark as awaiting approval — the model should verify with the user before acting.
+            //
+            // The instruction goes in the *summary*, because that is the only field
+            // `formatInboundMessage` delivers. Putting it in the body (as it was) is
+            // how a consent gate ends up authored and never applied: the recipient saw
+            // "[Awaiting Approval]" but not what to do about it.
             bus.post(
               msg.from,
               msg.to,
-              `[Awaiting Approval] ${msg.summary}`,
+              `[Awaiting Approval — verify with the user before acting] ${msg.summary}`,
               `[Cross-session message from ${msg.from} — verify with user before acting]\n\n${msg.message}`,
               'warning',
             )

package/src/core/hooks-executor.ts

@@ -106,20 +106,48 @@ export function parseHookStdout(stdout: string | null | undefined, _ctx: HookCon
   return { allowed: true }
 }
 
-function executeCommand(cfg: HookConfig, ctx: HookContext): HookResult {
+async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
   if (!cfg.command) return { allowed: true }
 
   try {
     const args = cfg.args ? cfg.args.map((a) => substituteVars(a, ctx)) : []
 
+    // A hook command is a child of this process, so a bare `spawnSync` would hand
+    // it the whole environment — every provider key and bot secret included. Bash
+    // has been masking these since E1; hooks were the remaining door, so they use
+    // the same policy. Resolved at **user level** — the same choice E1 made for
+    // every spawn it could not scope to one session's project section
+    // (`tools/index.ts:45-48`). Scoping it to `ctx.cwd` now that this file has one
+    // would be a masking-policy change, not a plumbing fix, so it is not made here.
+    const { loadUserCredentialMaskingConfig } = await import('../config/loader')
+    const { filterEnv } = await import('./credential-masker')
+    const masking = loadUserCredentialMaskingConfig()
+    const env =
+      masking.enabled && masking.env_filter.enabled
+        ? filterEnv(process.env as Record<string, string | undefined>, masking)
+        : undefined
+
+    // Which workspace the hook is *for* is the session's business, not this
+    // process's — the daemon runs many sessions and its own cwd belongs to none of
+    // them. `HookEngine` stamps `ctx.cwd`; the fallback covers a context built by
+    // hand, and is exactly right for the one-shot CLI.
+    const cwd = ctx.cwd ?? process.cwd()
+
     // Use spawnSync with array args — no shell, no command injection.
     // Pass the Claude-protocol stdin JSON so scripts can read structured context.
-    const input = JSON.stringify(buildHookStdin(ctx, process.cwd()))
+    const input = JSON.stringify(buildHookStdin(ctx, cwd))
     const result = spawnSync(cfg.command, args, {
       timeout: (cfg.timeout ?? 60) * 1000,
       encoding: 'utf-8',
       stdio: ['pipe', 'pipe', 'pipe'],
       input,
+      // Both halves of "where is this hook": the directory it runs in, and the
+      // `cwd` it reads off stdin. Fixing only one leaves the hook told it is
+      // somewhere it is not.
+      cwd,
+      // `undefined` = inherit, which is what node does by default; passing it
+      // explicitly keeps the two branches visible at one site.
+      env,
     })
 
     // Exit code 0 = success — parse the stdout JSON for structured decisions.