@miphamai/cli 0.81.8 → 0.81.9

package/src/config/loader.ts

@@ -65,10 +65,21 @@ function mergeProviders(
   const merged = [...baseProviders]
 
   for (const op of overrideProviders) {
+    // This array comes straight out of hand-written YAML: an entry can be
+    // `null`, or a bare scalar (iterating `providers: nope` yields its
+    // characters). Neither is a provider config, and neither should reach the
+    // field reads below.
+    if (!op || typeof op !== 'object') continue
+
+    // A non-string `apiKey` (a number, a list, a nested map) is not a secret.
+    // It reads as "no key" — the same invariant getProviderApiKey enforces —
+    // rather than reaching a `.startsWith` and taking the whole CLI down.
+    const apiKey = typeof op.apiKey === 'string' ? op.apiKey : undefined
+
     const idx = merged.findIndex((bp) => bp.id === op.id)
     if (idx === -1) {
       // Provider not in defaults — add it wholesale (custom provider)
-      merged.push(op)
+      merged.push(apiKey === undefined ? op : { ...op, apiKey })
       continue
     }
 
@@ -82,7 +93,7 @@ function mergeProviders(
       // sent, so only trusted (user-level) config may override it. Untrusted
       // (project-level) config cannot redirect a built-in provider's traffic.
       baseUrl: allowBaseUrlOverride ? (op.baseUrl ?? base.baseUrl) : base.baseUrl,
-      apiKey: op.apiKey ?? base.apiKey,
+      apiKey: apiKey ?? base.apiKey,
       models: op.models?.length ? op.models : base.models,
       status: op.status ?? base.status,
     }
@@ -91,16 +102,44 @@ function mergeProviders(
   return merged
 }
 
+/**
+ * Merge `override` into `base`, recursing into plain objects so that a source
+ * setting one branch of an object does not drop the other source's siblings
+ * (`features.mcp` must not wipe `features.context`).
+ *
+ * Arrays and scalars replace: a project's `skills.paths` must not append to the
+ * user's list. Objects are rebuilt with spread rather than assignment — a parsed
+ * `__proto__` key is then copied as an ordinary own property instead of
+ * mutating the result's prototype.
+ */
+function mergeObjects<T extends Record<string, unknown>>(base: T, override: T): T {
+  let merged: Record<string, unknown> = { ...base }
+  for (const [key, value] of Object.entries(override)) {
+    const existing = (base as Record<string, unknown>)[key]
+    merged = {
+      ...merged,
+      [key]:
+        isPlainObject(value) && isPlainObject(existing) ? mergeObjects(existing, value) : value,
+    }
+  }
+  return merged as T
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
 function mergeConfig(
   base: MiphamConfig,
   override: Partial<MiphamConfig>,
   allowBaseUrlOverride: boolean,
 ): MiphamConfig {
-  const merged: MiphamConfig = { ...base, ...override }
+  const merged = mergeObjects(
+    base as unknown as Record<string, unknown>,
+    override as Record<string, unknown>,
+  ) as unknown as MiphamConfig
   if (override.providers) {
     merged.providers = mergeProviders(base.providers, override.providers, allowBaseUrlOverride)
-  } else {
-    merged.providers = base.providers
   }
   return merged
 }
@@ -182,31 +221,19 @@ function loadMcpJson(cwd: string): McpServerConfig[] {
     try {
       if (!existsSync(path)) continue
       const raw = readFileSync(path, 'utf-8')
+      // Every McpServerConfig field is optional here (the name comes from the
+      // key), so a field added to the type is accepted without touching this.
       const parsed = JSON.parse(raw) as {
-        mcpServers?: Record<
-          string,
-          {
-            command?: string
-            args?: string[]
-            url?: string
-            headers?: Record<string, string>
-            env?: Record<string, string>
-          }
-        >
+        mcpServers?: Record<string, Partial<McpServerConfig>>
       }
 
       if (parsed.mcpServers) {
         for (const [name, cfg] of Object.entries(parsed.mcpServers)) {
           // Avoid duplicates by name
           if (servers.some((s) => s.name === name)) continue
-          servers.push({
-            name,
-            command: cfg.command,
-            args: cfg.args || [],
-            url: cfg.url,
-            headers: cfg.headers,
-            env: cfg.env,
-          })
+          // Spread the whole entry rather than re-listing fields: hand-rebuilding
+          // the object silently dropped request_timeout_ms and auth.
+          servers.push({ ...cfg, name, args: cfg.args || [] })
         }
       }
     } catch {
@@ -224,20 +251,57 @@ function loadMcpJson(cwd: string): McpServerConfig[] {
 export interface SettingsJson {
   hooks: SettingsHooks
   permissions: { allow: string[]; deny: string[] }
+  /**
+   * Present (and `true`) only when the project-level file really did declare
+   * hooks and they were withheld because the caller did not vouch for the
+   * workspace. Absent in every other case — including "the file has no hooks",
+   * so a caller announcing the skip cannot announce one that never happened.
+   */
+  projectHooksSkipped?: true
+  /**
+   * The subset of `hooks` that came from the project-level file — the entries
+   * the workspace-trust gate governs. Absent unless the caller vouched for the
+   * workspace *and* that file really declared hooks.
+   *
+   * Needed because `hooks` is provenance-free once merged: project and user
+   * entries sit in one bucket, yet only one of the two is gated. A caller that
+   * lists the merged form therefore cannot say which entries will run.
+   */
+  projectHooks?: SettingsHooks
 }
 
 /**
  * Load `settings.json` — project-level `.mipham/settings.json` then user-level
  * `~/.mipham/settings.json`. Mirrors the Claude Code convention (hooks additive,
  * permissions merged), so users can migrate their Claude settings unchanged.
+ *
+ * `includeProjectHooks` defaults to **false**, because the project-level file is
+ * repository-controlled and its `hooks` are shell commands this process will
+ * spawn — reading them is an act of trust, not a default. Callers that have
+ * established trust (or that only *display* the configured list) opt in
+ * explicitly. The flag gates hooks only: `permissions` still merge from both
+ * levels, since that question is answered by the mode ceiling, not by trust.
  */
-export function loadSettingsJson(cwd: string = process.cwd()): SettingsJson {
+export function loadSettingsJson(
+  cwd: string = process.cwd(),
+  options: { includeProjectHooks?: boolean } = {},
+): SettingsJson {
   const hooks: SettingsHooks = {}
   const permissions = { allow: [] as string[], deny: [] as string[] }
+  let projectHooksSkipped = false
+  // The project file's entries, kept out of the merge so provenance survives it.
+  const projectHooks: SettingsHooks = {}
+
+  const searchPaths: Array<{ path: string; readHooks: boolean; isProject?: boolean }> = [
+    {
+      path: join(cwd, '.mipham', 'settings.json'),
+      readHooks: options.includeProjectHooks ?? false,
+      isProject: true,
+    },
+    { path: join(MIPHAM_HOME, 'settings.json'), readHooks: true },
+  ]
 
-  const searchPaths = [join(cwd, '.mipham', 'settings.json'), join(MIPHAM_HOME, 'settings.json')]
-
-  for (const path of searchPaths) {
+  for (const { path, readHooks, isProject } of searchPaths) {
     try {
       if (!existsSync(path)) continue
       const raw = readFileSync(path, 'utf-8')
@@ -246,11 +310,27 @@ export function loadSettingsJson(cwd: string = process.cwd()): SettingsJson {
         permissions?: { allow?: unknown; deny?: unknown }
       }
 
-      if (parsed.hooks && typeof parsed.hooks === 'object') {
+      if (!readHooks) {
+        // "Was anything actually withheld?" is answered from the same parse that
+        // would have read it, so the skip notice cannot outrun the fact.
+        const declared = Object.values(parsed.hooks ?? {}).some(
+          (entries) => Array.isArray(entries) && entries.length > 0,
+        )
+        if (declared) projectHooksSkipped = true
+      }
+
+      if (readHooks && parsed.hooks && typeof parsed.hooks === 'object') {
         for (const [eventName, entries] of Object.entries(parsed.hooks)) {
           if (!Array.isArray(entries)) continue
           const bucket = (hooks as Record<string, unknown[]>)[eventName]
           ;(hooks as Record<string, unknown[]>)[eventName] = [...(bucket ?? []), ...entries]
+          if (isProject) {
+            const pBucket = (projectHooks as Record<string, unknown[]>)[eventName]
+            ;(projectHooks as Record<string, unknown[]>)[eventName] = [
+              ...(pBucket ?? []),
+              ...entries,
+            ]
+          }
         }
       }
 
@@ -268,7 +348,16 @@ export function loadSettingsJson(cwd: string = process.cwd()): SettingsJson {
     }
   }
 
-  return { hooks, permissions }
+  // Keys added only when they have something to say: `toEqual` distinguishes
+  // `false` from absent, and "no project hooks" must stay indistinguishable from
+  // "nothing to report" — an empty marker would let a caller tag user hooks as
+  // gated on the strength of a file with nothing in it.
+  const result: SettingsJson = { hooks, permissions }
+  if (projectHooksSkipped) result.projectHooksSkipped = true
+  if (Object.values(projectHooks).some((entries) => Array.isArray(entries) && entries.length > 0)) {
+    result.projectHooks = projectHooks
+  }
+  return result
 }
 
 /** Which settings.json a permission rule is persisted to. */
@@ -478,44 +567,90 @@ export function loadInferenceHookConfig(): InferenceHookConfig {
 }
 
 /**
- * Load credential masking configuration from the same config sources.
- * Merges project-level over user-level. Returns defaults if no section present.
+ * Overlay one config file's `credential_masking` section onto `merged`.
+ *
+ * A malformed file leaves `merged` untouched — so a config that cannot be read
+ * costs you the *overrides*, never the masking itself (the defaults are on).
+ *
+ * `allowLoosening` is the same split as `baseUrl` in `mergeProviders`: the
+ * user's own `~/.mipham/config.yml` is trusted and may set anything, while a
+ * **project** file is whatever the repo you cloned shipped. Project level may
+ * only tighten — switch masking on and add rules, never switch it off or drop a
+ * rule. Otherwise one line in a cloned repo silently takes away a control the
+ * user already had (`enabled: false`), or `files: [...]` replaces the defaults
+ * wholesale and the SSH private-key rule stops being masked.
  */
-export function loadCredentialMaskingConfig(cwd: string = process.cwd()): CredentialMaskingConfig {
-  const configPath = join(cwd, '.mipham', 'config.yml')
-  const userConfigPath = join(MIPHAM_HOME, 'config.yml')
-
-  let merged = { ...DEFAULT_CREDENTIAL_MASKING_CONFIG }
-
-  const paths = [userConfigPath, configPath] // project wins (loaded last)
-  for (const path of paths) {
-    try {
-      if (!existsSync(path)) continue
-      const raw = readFileSync(path, 'utf-8')
-      const parsed = parseYaml(raw) as Record<string, unknown>
-      const section = parsed.credential_masking as Partial<CredentialMaskingConfig> | undefined
-      if (section) {
-        merged = {
-          enabled: section.enabled ?? merged.enabled,
-          files: section.files ?? merged.files,
-          output_scrubbing: {
-            enabled: section.output_scrubbing?.enabled ?? merged.output_scrubbing.enabled,
-            patterns: section.output_scrubbing?.patterns ?? merged.output_scrubbing.patterns,
-          },
-          env_filter: {
-            enabled: section.env_filter?.enabled ?? merged.env_filter.enabled,
-            patterns: section.env_filter?.patterns ?? merged.env_filter.patterns,
-          },
-        }
-      }
-    } catch {
-      // Silently skip malformed configs
+function mergeCredentialMaskingFile(
+  merged: CredentialMaskingConfig,
+  path: string,
+  allowLoosening: boolean,
+): CredentialMaskingConfig {
+  try {
+    if (!existsSync(path)) return merged
+    const raw = readFileSync(path, 'utf-8')
+    const parsed = parseYaml(raw) as Record<string, unknown>
+    const section = parsed.credential_masking as Partial<CredentialMaskingConfig> | undefined
+    if (!section) return merged
+
+    // Tightening can only ever turn a switch on, never off.
+    const flag = (next: boolean | undefined, cur: boolean): boolean =>
+      allowLoosening ? (next ?? cur) : cur || (next ?? false)
+
+    // Tightening adds rules instead of replacing them. Earlier rules stay in
+    // front because `matchCredentialFile` returns the **first** match — so a
+    // project cannot weaken a path's mode by adding a second rule for it.
+    const rules = <T>(next: T[] | undefined, cur: T[]): T[] =>
+      allowLoosening ? (next ?? cur) : [...cur, ...(next ?? [])]
+
+    return {
+      enabled: flag(section.enabled, merged.enabled),
+      files: rules(section.files, merged.files),
+      output_scrubbing: {
+        enabled: flag(section.output_scrubbing?.enabled, merged.output_scrubbing.enabled),
+        patterns: rules(section.output_scrubbing?.patterns, merged.output_scrubbing.patterns),
+      },
+      env_filter: {
+        enabled: flag(section.env_filter?.enabled, merged.env_filter.enabled),
+        patterns: rules(section.env_filter?.patterns, merged.env_filter.patterns),
+      },
     }
+  } catch {
+    // Silently skip malformed configs
+    return merged
   }
+}
 
+/**
+ * Load credential masking configuration from the same config sources.
+ * Returns defaults if no section present.
+ *
+ * User level first (trusted, may loosen), then project level (tighten only).
+ */
+export function loadCredentialMaskingConfig(cwd: string = process.cwd()): CredentialMaskingConfig {
+  let merged = { ...DEFAULT_CREDENTIAL_MASKING_CONFIG }
+  merged = mergeCredentialMaskingFile(merged, join(MIPHAM_HOME, 'config.yml'), true)
+  merged = mergeCredentialMaskingFile(merged, join(cwd, '.mipham', 'config.yml'), false)
   return merged
 }
 
+/**
+ * User-level masking policy only (`~/.mipham/config.yml`), without any project
+ * section.
+ *
+ * The tool registry is one instance per daemon process, while sessions carry
+ * different cwds (`createToolRegistry()` in `daemon/server.ts` is memoized) —
+ * so a project's section cannot be applied to it without leaking one project's
+ * policy into another session. User level is the only scope that is true for
+ * every session the registry serves.
+ */
+export function loadUserCredentialMaskingConfig(): CredentialMaskingConfig {
+  return mergeCredentialMaskingFile(
+    { ...DEFAULT_CREDENTIAL_MASKING_CONFIG },
+    join(MIPHAM_HOME, 'config.yml'),
+    true,
+  )
+}
+
 /**
  * Load background agent configuration from config sources.
  */
@@ -588,11 +723,15 @@ export function loadCrossSessionConfig(cwd: string = process.cwd()): CrossSessio
  */
 function decryptProviderApiKeys(providers: ProviderConfig[] | undefined): void {
   if (!providers) return
-  const needsKey = providers.some((p) => p.apiKey.startsWith(ENC_PREFIX))
-  if (!needsKey) return
+  // Same invariant as getProviderApiKey: only a string can carry the `enc:v1:`
+  // prefix, so a malformed entry counts as "no key" instead of throwing on
+  // `.startsWith` and taking the whole CLI down at startup.
+  const isEncrypted = (p: ProviderConfig | null): boolean =>
+    !!p && typeof p.apiKey === 'string' && p.apiKey.startsWith(ENC_PREFIX)
+  if (!providers.some(isEncrypted)) return
   const key = getCredentialKey(MIPHAM_HOME)
   for (const p of providers) {
-    if (!p.apiKey.startsWith(ENC_PREFIX)) continue
+    if (!isEncrypted(p)) continue
     try {
       p.apiKey = decryptApiKey(p.apiKey, key)
     } catch (err: unknown) {

package/src/core/credential-masker/output-scrub.ts

@@ -11,6 +11,16 @@ import { SecurityGate } from '../../security/gate'
 const TOKEN_REDACTION_PATTERN =
   /\b(?:ghp_|gho_|ghs_|ghu_|ghr_|github_pat_|glpat-|gldt-|glrt-|gloas-)[A-Za-z0-9_-]{8,}/g
 
+/**
+ * Credentials embedded in a URL's userinfo — `scheme://user:password@host`.
+ *
+ * Nothing in the *name* gives this away: `DATABASE_URL` holds no secret word,
+ * so a name-based pattern cannot see it (and masking every `*_URL` would take
+ * out every non-secret endpoint too). The shape is the only reliable tell.
+ * Redacts the password and keeps user + host, or the line stops being readable.
+ */
+const URL_USERINFO_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]+)@/gi
+
 /**
  * Scrub credential patterns from stdout/stderr output.
  * Uses the configured output_scrubbing patterns to detect and replace
@@ -24,6 +34,9 @@ export function maskOutput(output: string, config: CredentialMaskingConfig): str
   // Redact bare secret tokens by prefix (always on, independent of config patterns).
   masked = masked.replace(TOKEN_REDACTION_PATTERN, CREDENTIAL_SENTINEL)
 
+  // Redact URL-embedded passwords — also shape-based, also always on.
+  masked = masked.replace(URL_USERINFO_PATTERN, `$1$2:${CREDENTIAL_SENTINEL}@`)
+
   // Redact bare sk-/sk-ant-/JWT tokens — wire the SecurityGate credential-leak
   // detection into the output path (defense-in-depth beyond the config patterns).
   masked = SecurityGate.redactCredentialLeak(masked)
@@ -34,8 +47,9 @@ export function maskOutput(output: string, config: CredentialMaskingConfig): str
       const clean = pattern.replace(/^\(\?i\)/, '')
       const regex = new RegExp(clean, 'gim')
       masked = masked.replace(regex, (match) => {
-        // Replace everything after the separator (= or :)
-        return match.replace(/\s*[:=]\s*\S+/, `=${CREDENTIAL_SENTINEL}`)
+        // Replace everything after the separator (= or :), swallowing the quote
+        // a JSON-shaped hit puts in front of it (`"apiKey": "…"`).
+        return match.replace(/\s*["']?\s*[:=]\s*["']?\S+/, `=${CREDENTIAL_SENTINEL}`)
       })
     } catch {
       // Invalid regex — skip

package/src/core/engine.ts

@@ -256,11 +256,16 @@ export class QueryEngine {
           }
 
           if (policy === 'ask') {
-            // Mark as awaiting approval — the model should verify with the user before acting
+            // Mark as awaiting approval — the model should verify with the user before acting.
+            //
+            // The instruction goes in the *summary*, because that is the only field
+            // `formatInboundMessage` delivers. Putting it in the body (as it was) is
+            // how a consent gate ends up authored and never applied: the recipient saw
+            // "[Awaiting Approval]" but not what to do about it.
             bus.post(
               msg.from,
               msg.to,
-              `[Awaiting Approval] ${msg.summary}`,
+              `[Awaiting Approval — verify with the user before acting] ${msg.summary}`,
               `[Cross-session message from ${msg.from} — verify with user before acting]\n\n${msg.message}`,
               'warning',
             )

package/src/core/hooks-executor.ts

@@ -106,20 +106,48 @@ export function parseHookStdout(stdout: string | null | undefined, _ctx: HookCon
   return { allowed: true }
 }
 
-function executeCommand(cfg: HookConfig, ctx: HookContext): HookResult {
+async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
   if (!cfg.command) return { allowed: true }
 
   try {
     const args = cfg.args ? cfg.args.map((a) => substituteVars(a, ctx)) : []
 
+    // A hook command is a child of this process, so a bare `spawnSync` would hand
+    // it the whole environment — every provider key and bot secret included. Bash
+    // has been masking these since E1; hooks were the remaining door, so they use
+    // the same policy. Resolved at **user level** — the same choice E1 made for
+    // every spawn it could not scope to one session's project section
+    // (`tools/index.ts:45-48`). Scoping it to `ctx.cwd` now that this file has one
+    // would be a masking-policy change, not a plumbing fix, so it is not made here.
+    const { loadUserCredentialMaskingConfig } = await import('../config/loader')
+    const { filterEnv } = await import('./credential-masker')
+    const masking = loadUserCredentialMaskingConfig()
+    const env =
+      masking.enabled && masking.env_filter.enabled
+        ? filterEnv(process.env as Record<string, string | undefined>, masking)
+        : undefined
+
+    // Which workspace the hook is *for* is the session's business, not this
+    // process's — the daemon runs many sessions and its own cwd belongs to none of
+    // them. `HookEngine` stamps `ctx.cwd`; the fallback covers a context built by
+    // hand, and is exactly right for the one-shot CLI.
+    const cwd = ctx.cwd ?? process.cwd()
+
     // Use spawnSync with array args — no shell, no command injection.
     // Pass the Claude-protocol stdin JSON so scripts can read structured context.
-    const input = JSON.stringify(buildHookStdin(ctx, process.cwd()))
+    const input = JSON.stringify(buildHookStdin(ctx, cwd))
     const result = spawnSync(cfg.command, args, {
       timeout: (cfg.timeout ?? 60) * 1000,
       encoding: 'utf-8',
       stdio: ['pipe', 'pipe', 'pipe'],
       input,
+      // Both halves of "where is this hook": the directory it runs in, and the
+      // `cwd` it reads off stdin. Fixing only one leaves the hook told it is
+      // somewhere it is not.
+      cwd,
+      // `undefined` = inherit, which is what node does by default; passing it
+      // explicitly keeps the two branches visible at one site.
+      env,
     })
 
     // Exit code 0 = success — parse the stdout JSON for structured decisions.

package/src/core/hooks.ts

@@ -48,6 +48,18 @@ export class HookEngine {
   /** Health tracking per hook key (event[:toolName]) */
   private health = new Map<string, HookHealth>()
 
+  /**
+   * The workspace this engine's hooks run *for*.
+   *
+   * Settled at construction because one engine belongs to one session, not to one
+   * hook. The default is exactly right for the one-shot CLI, whose process cwd
+   * *is* the session cwd — but the daemon serves many sessions from one process,
+   * so it must pass the session's cwd. Left to the executor's own
+   * `process.cwd()`, every daemon hook would run in — and be told it is in — the
+   * directory the daemon happened to be started from.
+   */
+  constructor(private readonly cwd: string = process.cwd()) {}
+
   register(hook: HookDefinition): void {
     this.hooks.push(hook)
   }
@@ -98,7 +110,12 @@ export class HookEngine {
 
   async executeStop(sessionId: string): Promise<HookResult> {
     const ctx: HookContext = { event: 'Stop', sessionId }
-    return this.runHooks('Stop', undefined, ctx)
+    const result = await this.runHooks('Stop', undefined, ctx)
+
+    // A blocking Stop hook arrives as a deny (exit code 2, `decision: block`, or
+    // `continue: false`), but the engine's Stop path reads `decision`. Derive it
+    // here rather than at each producer so every form reaches "do not stop yet".
+    return result.allowed ? result : { ...result, decision: 'block' }
   }
 
   async executeUserPromptSubmit(prompt: string, sessionId: string): Promise<HookResult> {
@@ -134,9 +151,12 @@ export class HookEngine {
     const ctx: HookContext = {
       event: 'SubagentStart',
       sessionId,
+      // The agent type plays the role a tool name plays for PreToolUse: it is
+      // what a settings.json `matcher` selects on.
+      toolName: agentType,
       toolInput: { agentType, description },
     }
-    return this.runHooks('SubagentStart', undefined, ctx)
+    return this.runHooks('SubagentStart', agentType, ctx)
   }
 
   async executeSubagentStop(
@@ -149,10 +169,12 @@ export class HookEngine {
     const ctx: HookContext = {
       event: 'SubagentStop',
       sessionId,
+      // Matcher target — see executeSubagentStart.
+      toolName: agentType,
       toolInput: { agentType, description, success },
       toolResult: result ? { success, content: result.slice(0, 2000) } : undefined,
     }
-    return this.runHooks('SubagentStop', undefined, ctx)
+    return this.runHooks('SubagentStop', agentType, ctx)
   }
 
   async executePostToolUseFailure(
@@ -268,15 +290,40 @@ export class HookEngine {
 
   // ── Core execution ──
 
+  /**
+   * Does a hook's `matcher` select this invocation?
+   *
+   * No matcher means every invocation of the event. Otherwise the stored matcher
+   * is a regex — `loadHookConfigs` compiles it as one — tested against the name
+   * this event filters on: the tool name for tool events, the agent type for the
+   * subagent events. Events that carry no such name (Stop, SessionStart, …) are
+   * not filtered here.
+   */
+  private matchesMatcher(matcher: string | undefined, name: string | undefined): boolean {
+    if (!matcher || !name) return true
+    try {
+      return new RegExp(matcher).test(name)
+    } catch {
+      // An uncompilable pattern cannot get this far through loadHookConfigs,
+      // which compiles every matcher when it loads. Keep such a hook running
+      // rather than dropping it silently.
+      return true
+    }
+  }
+
   private async runHooks(
     event: HookEvent,
     toolName: string | undefined,
     ctx: HookContext,
   ): Promise<HookResult> {
     const matching = this.hooks.filter(
-      (h) => h.event === event && (!toolName || !h.toolName || h.toolName === toolName),
+      (h) => h.event === event && this.matchesMatcher(h.toolName, toolName),
     )
 
+    // Stamped here rather than at each `executeX`: the cwd is a property of the
+    // engine, and every context this engine hands out needs it.
+    ctx.cwd = this.cwd
+
     const result: HookResult = { allowed: true }
 
     for (const hook of matching) {

package/src/core/paths.ts

@@ -7,8 +7,9 @@
  * 突然失去隔离保护（隔离度只许增不许减）。
  */
 
+import { realpathSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { basename, dirname, join } from 'node:path'
 import { MIPHAM_DIR } from '../shared/constants.ts'
 
 /** 只读兼容目录名。 */
@@ -33,6 +34,48 @@ export function worktreeRoots(cwd: string): string[] {
   return [worktreeRoot(cwd), join(cwd, LEGACY_CLAUDE_DIR, 'worktrees')]
 }
 
+/**
+ * 规范化 worktree 路径，两侧都过一遍才谈得上比较。
+ *
+ * 叶子不存在是常态（工作树已被删、或路径是模型编出来的），此时 `realpathSync`
+ * 会抛 —— 那就只规范父目录、最后一段按原样留着，否则「叶子没了」会被误读成
+ * 「拼法不同」（明明同一个路径，却因为 P 的拼法与 git 打印的不同而判成不在）。
+ */
+function canonicalWorktreePath(path: string): string {
+  const trimmed = path.endsWith('/') && path !== '/' ? path.slice(0, -1) : path
+  try {
+    return realpathSync(trimmed)
+  } catch {
+    try {
+      return join(realpathSync(dirname(trimmed)), basename(trimmed))
+    } catch {
+      return trimmed
+    }
+  }
+}
+
+/**
+ * `git worktree list --porcelain` 里是否**确实**列出了 `target` 这个工作树。
+ *
+ * 不能用 `output.includes(target)`：那是子串判定，本机实测（真 git，建出 `w1`
+ * 与 `w10`）它错在三个方向 ——
+ *   - `.../w1` 命中 **`.../w10` 那一行**（前缀当成同一个）⇒ 不存在被判成存在。
+ *     EnterWorktree 那侧因此连 `w1` 都建不出来：明明没有，它报 already exists；
+ *   - 带尾斜杠的 `.../w1/` 一行都不命中 ⇒ 存在被判成 not found；
+ *   - git 打印 **realpath 拼法**（`mktemp -d /tmp/x` 建的在 porcelain 里是
+ *     `/private/tmp/x/...`）⇒ 别名拼法一头都命中不了，而 EnterWorktree 的成功
+ *     文案里印的正是它自己算出来的那个拼法，模型照抄回来必然吃 not found。
+ *
+ * 判据是**相等**（名字比对），不是包含 —— 工作树列表里列的就是工作树根。
+ */
+export function listsWorktree(output: string, target: string): boolean {
+  const want = canonicalWorktreePath(target)
+  return output
+    .split('\n')
+    .filter((line) => line.startsWith('worktree '))
+    .some((line) => canonicalWorktreePath(line.slice('worktree '.length).trim()) === want)
+}
+
 /**
  * 在 `cwd` 中定位 worktree 标记，返回项目根与命中的标记。
  * 不在任何 worktree 内时返回 null。