@miphamai/cli 0.85.3 → 0.85.5

package/src/plugin/plugin-validator.ts

@@ -1,5 +1,6 @@
-import { readFileSync, existsSync } from 'node:fs'
+import { readFileSync, existsSync, readdirSync } from 'node:fs'
 import { join } from 'node:path'
+import { toMcpServerConfig } from './claude-plugin'
 
 export interface PluginManifest {
   name: string
@@ -16,12 +17,43 @@ export type PluginFormat = 'mipham' | 'claude'
 export interface PluginValidation {
   valid: boolean
   errors: string[]
+  /**
+   * Findings that do not block installation.
+   *
+   * The split is the point: a declaration we would silently drop is a defect in one
+   * part of one plugin, and refusing to install the whole thing over it would make
+   * the validator an obstacle rather than a report. What it must not do is stay
+   * quiet — a dropped declaration that nothing mentions is indistinguishable from
+   * one that worked.
+   */
+  warnings: string[]
   manifest?: PluginManifest
   format: PluginFormat
   /** Resolved manifest path (empty when no manifest found). */
   manifestPath: string
 }
 
+/**
+ * Whether `loadPlugins` will hand this declaration to the MCP client.
+ *
+ * Lives here so the check and the loader read one rule: `plugin-loader.ts` calls
+ * this at its guard, and the MCP checks below call it to decide what to report. It
+ * requires a `name` because that is the key the client connects under, and one
+ * transport or the other — `McpServerConfig` makes `command` and `url` mutually
+ * exclusive, so demanding a `command` is what used to drop every remote server.
+ */
+export function isLoadableMcpConfig(cfg: {
+  name?: unknown
+  command?: unknown
+  url?: unknown
+}): boolean {
+  return (
+    typeof cfg.name === 'string' &&
+    cfg.name.length > 0 &&
+    (typeof cfg.command === 'string' || typeof cfg.url === 'string')
+  )
+}
+
 /**
  * Resolve a plugin's manifest. Mipham plugins use `plugin.json` at the plugin
  * root; Claude marketplace plugins use `.claude-plugin/plugin.json`.
@@ -39,12 +71,144 @@ export function detectPluginFormat(dir: string): PluginFormat {
   return resolveManifestPath(dir)?.format ?? 'mipham'
 }
 
+/**
+ * `${user_config.*}` is Claude Code's placeholder for a value it prompts the user
+ * for at install time. This loader has no such step: `expandPluginRoot` substitutes
+ * `${CLAUDE_PLUGIN_ROOT}` and nothing else, so the reference reaches the server as
+ * literal text. Every reference is reported — "declared" and "undeclared" are not a
+ * useful split here, because neither one resolves.
+ */
+const USER_CONFIG_RE = /\$\{user_config\.([A-Za-z0-9_.-]+)\}/g
+
+function userConfigKeys(texts: string[]): string[] {
+  const keys: string[] = []
+  const seen = new Set<string>()
+  for (const text of texts) {
+    for (const m of text.matchAll(USER_CONFIG_RE)) {
+      const key = m[1]!
+      if (seen.has(key)) continue
+      seen.add(key)
+      keys.push(key)
+    }
+  }
+  return keys
+}
+
+/** Hosts for which a cleartext URL stays on the machine, so there is nothing in transit. */
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1', '[::1]'])
+
+function cleartextWarning(server: string, url: string): string | null {
+  if (!/^http:\/\//i.test(url)) return null
+  let host: string
+  try {
+    host = new URL(url).hostname
+  } catch {
+    return null // an unparseable URL is not the finding this check is for
+  }
+  if (LOOPBACK_HOSTS.has(host)) return null
+  return `MCP server "${server}" uses a cleartext http:// URL (${url}) — it is readable in transit`
+}
+
+const DROPPED = 'declares neither command nor url and would be skipped at load'
+
+function describe(err: unknown): string {
+  return err instanceof Error ? err.message : String(err)
+}
+
+/** Check the Claude-format sources: `.mcp.json` at the root, plus inline `mcpServers`. */
+function checkClaudeMcp(
+  dir: string,
+  manifest: PluginManifest,
+  texts: string[],
+  warnings: string[],
+): void {
+  const inspect = (label: string, servers: unknown): void => {
+    if (!servers || typeof servers !== 'object') return
+    for (const [name, entry] of Object.entries(servers as Record<string, unknown>)) {
+      const raw = (entry ?? {}) as Record<string, unknown>
+      if (toMcpServerConfig(name, raw) === null) {
+        warnings.push(`${label}: MCP server "${name}" ${DROPPED}`)
+        continue
+      }
+      if (typeof raw.url === 'string') {
+        const cleartext = cleartextWarning(name, raw.url)
+        if (cleartext) warnings.push(`${label}: ${cleartext}`)
+      }
+    }
+  }
+
+  const mcpJsonPath = join(dir, '.mcp.json')
+  if (existsSync(mcpJsonPath)) {
+    const text = readFileSync(mcpJsonPath, 'utf-8')
+    texts.push(text)
+    try {
+      inspect('`.mcp.json`', (JSON.parse(text) as { mcpServers?: unknown }).mcpServers)
+    } catch (err) {
+      warnings.push(`\`.mcp.json\` could not be parsed and is skipped at load: ${describe(err)}`)
+    }
+  }
+
+  const inline = manifest.mcpServers
+  if (typeof inline === 'string') {
+    // The manifest type admits a string here, and the loader's `collect` returns
+    // early on anything that is not an object — so this form is declared and read
+    // by nothing.
+    warnings.push('`mcpServers` is a string; this loader only reads an object and ignores it')
+  } else {
+    inspect('manifest `mcpServers`', inline)
+  }
+}
+
+/** Check the Mipham-format source: `mcp-servers/*.json` at the plugin root. */
+function checkMiphamMcp(dir: string, texts: string[], warnings: string[]): void {
+  const mcpDir = join(dir, 'mcp-servers')
+  if (!existsSync(mcpDir)) return
+
+  let entries: string[]
+  try {
+    entries = readdirSync(mcpDir)
+  } catch {
+    return
+  }
+
+  for (const entry of entries) {
+    if (!entry.endsWith('.json')) continue
+    const label = `\`mcp-servers/${entry}\``
+    let text: string
+    try {
+      text = readFileSync(join(mcpDir, entry), 'utf-8')
+    } catch (err) {
+      warnings.push(`${label} could not be read and is skipped at load: ${describe(err)}`)
+      continue
+    }
+    texts.push(text)
+
+    let cfg: Record<string, unknown>
+    try {
+      cfg = JSON.parse(text) as Record<string, unknown>
+    } catch (err) {
+      warnings.push(`${label} could not be parsed and is skipped at load: ${describe(err)}`)
+      continue
+    }
+
+    if (!isLoadableMcpConfig(cfg ?? {})) {
+      warnings.push(`${label}: MCP server "${String(cfg?.name ?? entry)}" ${DROPPED}`)
+      continue
+    }
+    if (typeof cfg.url === 'string') {
+      const cleartext = cleartextWarning(String(cfg.name), cfg.url)
+      if (cleartext) warnings.push(`${label}: ${cleartext}`)
+    }
+  }
+}
+
 export function validatePlugin(dir: string): PluginValidation {
   const resolved = resolveManifestPath(dir)
   if (!resolved) {
     return {
       valid: false,
       errors: ['No plugin manifest found (expected plugin.json or .claude-plugin/plugin.json)'],
+      warnings: [],
       format: 'mipham',
       manifestPath: '',
     }
@@ -69,9 +233,26 @@ export function validatePlugin(dir: string): PluginValidation {
       }
     }
 
+    const warnings: string[] = []
+    // Every text read on the way to a declaration, so a `${user_config.*}` inside an
+    // `args` array or a header value is caught wherever it appears.
+    const texts: string[] = [raw]
+    if (resolved.format === 'claude') {
+      checkClaudeMcp(dir, manifest, texts, warnings)
+    } else {
+      checkMiphamMcp(dir, texts, warnings)
+    }
+    for (const key of userConfigKeys(texts)) {
+      warnings.push(
+        `\`\${user_config.${key}}\` is passed through literally — this loader has no user-config ` +
+          `step, so the server receives the text itself`,
+      )
+    }
+
     return {
       valid: errors.length === 0,
       errors,
+      warnings,
       manifest,
       format: resolved.format,
       manifestPath: resolved.path,
@@ -81,6 +262,7 @@ export function validatePlugin(dir: string): PluginValidation {
     return {
       valid: false,
       errors: [`Failed to read ${label}: ${String(err)}`],
+      warnings: [],
       format: resolved.format,
       manifestPath: resolved.path,
     }

package/src/providers/anthropic.ts

@@ -78,6 +78,15 @@ export class AnthropicProvider implements ProviderInstance {
     // off at the output ceiling rather than ended by the model.
     let truncated = false
 
+    // Whether this stream reached `message_stop`. A stream that runs out without
+    // one was cut — a proxy or gateway closing the connection cleanly looks
+    // exactly like a finished response otherwise.
+    let sawTerminalEvent = false
+
+    // Tool blocks already emitted. A replayed event is the same call, not a
+    // second one; emitting it twice makes the engine run the tool twice.
+    const emittedToolIds = new Set<string>()
+
     const messages = this.convertMessages(req.messages)
     this.markPrefixCacheBreakpoint(messages)
 
@@ -223,21 +232,27 @@ export class AnthropicProvider implements ProviderInstance {
               // 要在这里丢弃，就得把 `tool_use` 缓冲到 `message_stop` 再发 ——
               // 那是一次行为变更，不属本次范围。
               if (currentToolId && currentToolName && accumulatedToolInput) {
-                let parsedInput: Record<string, unknown> = {}
-                try {
-                  parsedInput = JSON.parse(accumulatedToolInput)
-                } catch {
-                  parsedInput = { _raw: accumulatedToolInput }
-                }
-
-                yield {
-                  type: 'tool_use',
-                  toolUse: {
+                // A replayed block carries the id it was first sent with, so the
+                // id is what tells a second call apart from the same call twice.
+                if (!emittedToolIds.has(currentToolId)) {
+                  emittedToolIds.add(currentToolId)
+
+                  let parsedInput: Record<string, unknown> = {}
+                  try {
+                    parsedInput = JSON.parse(accumulatedToolInput)
+                  } catch {
+                    parsedInput = { _raw: accumulatedToolInput }
+                  }
+
+                  yield {
                     type: 'tool_use',
-                    id: currentToolId,
-                    name: currentToolName,
-                    input: parsedInput,
-                  },
+                    toolUse: {
+                      type: 'tool_use',
+                      id: currentToolId,
+                      name: currentToolName,
+                      input: parsedInput,
+                    },
+                  }
                 }
 
                 // Reset accumulator
@@ -272,6 +287,7 @@ export class AnthropicProvider implements ProviderInstance {
             }
 
             case 'message_stop': {
+              sawTerminalEvent = true
               yield truncated ? { type: 'stop', truncated: true } : { type: 'stop' }
               return
             }
@@ -287,7 +303,12 @@ export class AnthropicProvider implements ProviderInstance {
       }
     }
 
-    yield { type: 'stop' }
+    // The stream ran out without `message_stop`. Whatever stopped it, the turn is
+    // incomplete — and this is the only place that knows, because a cleanly
+    // closed connection and a finished response are otherwise the same stream.
+    if (!sawTerminalEvent) truncated = true
+
+    yield truncated ? { type: 'stop', truncated: true } : { type: 'stop' }
   }
 
   async listModels(): Promise<ModelInfo[]> {

package/src/providers/fetch-utils.ts

@@ -16,6 +16,58 @@ export interface FetchWithRetryOptions {
 
 const RETRYABLE_STATUSES = new Set([429, 500, 502, 503, 504])
 
+/**
+ * Upper bound on a server-supplied `Retry-After`, in ms.
+ *
+ * The header is a *request*, not a contract: a 5xx answering `Retry-After: 3600`
+ * used to park the CLI in `sleep` for a full hour with nothing on screen. The
+ * user cannot cancel what they cannot see, so the wait is capped and the reason
+ * is left in the comment rather than the terminal.
+ */
+export const RETRY_AFTER_MAX_MS = 60_000
+
+/**
+ * Lower bound on a server-supplied `Retry-After`, in ms.
+ *
+ * `Retry-After: 0` is a real thing servers send, and honouring it literally
+ * means retrying the instant the previous attempt failed — a hammering loop
+ * dressed up as politeness. Any present-but-tiny value lands here instead.
+ */
+const RETRY_AFTER_MIN_MS = 1_000
+
+/**
+ * Delay before the next retry attempt.
+ *
+ * `Retry-After` is honoured when it is parseable, clamped to
+ * `[RETRY_AFTER_MIN_MS, RETRY_AFTER_MAX_MS]`, and **ignored in favour of
+ * exponential backoff when it is not** — an unparseable header must not become
+ * `sleep(NaN)`, which `setTimeout` reads as 0 (the same back-to-back retry as
+ * `Retry-After: 0`, but silent).
+ *
+ * Accepts both RFC 9110 forms: delta-seconds and an HTTP-date.
+ */
+export function retryDelayMs(
+  retryAfter: string | null,
+  attempt: number,
+  baseDelay: number,
+): number {
+  const backoff = baseDelay * Math.pow(2, attempt)
+  if (retryAfter === null) return backoff
+
+  const header = retryAfter.trim()
+  const seconds = parseInt(header, 10)
+  let requested: number
+  if (!Number.isNaN(seconds)) {
+    requested = seconds * 1000
+  } else {
+    const at = Date.parse(header)
+    if (Number.isNaN(at)) return backoff // unparseable → backoff, never a zero sleep
+    requested = at - Date.now()
+  }
+
+  return Math.min(Math.max(requested, RETRY_AFTER_MIN_MS), RETRY_AFTER_MAX_MS)
+}
+
 function isRetryableError(err: unknown): boolean {
   if (err instanceof DOMException && err.name === 'AbortError') return false
   return true
@@ -51,11 +103,7 @@ export async function fetchWithRetry(
 
       // 429 / 5xx → retry
       if (RETRYABLE_STATUSES.has(response.status) && attempt < maxRetries) {
-        const retryAfter = response.headers.get('Retry-After')
-        const delay = retryAfter
-          ? parseInt(retryAfter, 10) * 1000
-          : baseDelay * Math.pow(2, attempt)
-        await sleep(delay)
+        await sleep(retryDelayMs(response.headers.get('Retry-After'), attempt, baseDelay))
         continue
       }
 

package/src/security/dangerous-rm.ts

@@ -0,0 +1,192 @@
+/**
+ * Recursive `rm` whose target cannot be read off the command text.
+ *
+ * `rm -rf node_modules` names what it deletes. `rm -rf "$(pwd)"` does not — the
+ * target is produced at run time, so no allow rule, no mode and no reviewer can
+ * see how far the deletion reaches.
+ *
+ * This is deliberately **not** a blocklist of dangerous paths. Those already
+ * exist (`tools/exec/bash.ts` BLOCKED_PATTERNS refuses `/`, `~`, `*`, `.` and
+ * absolute paths). What is left uncovered is the case where the *path is not in
+ * the text at all* — and that case is invisible to every string-matching guard,
+ * which is why it has to be recognised structurally instead.
+ *
+ * Judged on every command line inside the input, via the same `flattenCommand`
+ * the deny-rule path uses: reading one normalization while the deny rules read
+ * another is how a guard fires on one spelling and not on its twin.
+ */
+
+import { flattenCommand } from '../core/permission-rules'
+
+export type DangerousRmKind =
+  /** The target is led by command-substitution output: `rm -rf "$(pwd)"`. */
+  | 'substitution'
+  /** A variable plus one top-level directory name: `rm -rf $ROOT/usr`. */
+  | 'variable-top-level'
+  /** The target is anchored to a working-directory variable: `rm -rf $PWD`. */
+  | 'cwd-derived'
+  /** Nothing but backslashes: `rm -rf \`. */
+  | 'backslash-only'
+
+export interface DangerousRm {
+  kind: DangerousRmKind
+  /** The offending target, with its surrounding quotes stripped. */
+  target: string
+}
+
+/**
+ * Variables whose value is the directory the shell is in.
+ *
+ * The danger is not an unknown value — it is that the value is *movable*: an
+ * earlier segment of the same command line (`cd /tmp && …`) decides it, so the
+ * target is anchored to whatever directory the command happens to reach.
+ */
+const CWD_VARS = new Set(['PWD', 'OLDPWD'])
+
+/**
+ * Directory names that sit at the filesystem root.
+ *
+ * These are what make an empty variable dangerous. If `$VAR` is unset, the shell
+ * drops it and `rm -rf $VAR/usr` runs as `rm -rf /usr` — the variable does not
+ * fail loudly, it *disappears*, and what is left behind is an absolute path to a
+ * system directory. `$VAR/node_modules` collapsing to `/node_modules` is not in
+ * that class, so the directory name is what decides, not the variable.
+ */
+const TOP_LEVEL_DIRS = new Set([
+  'bin',
+  'boot',
+  'dev',
+  'etc',
+  'home',
+  'lib',
+  'lib64',
+  'opt',
+  'proc',
+  'root',
+  'run',
+  'sbin',
+  'srv',
+  'sys',
+  'tmp',
+  'usr',
+  'var',
+])
+
+/** Strip one layer of matching quotes — `"$(pwd)"` and `$(pwd)` are one target. */
+function stripQuotes(s: string): string {
+  if (s.length < 2) return s
+  const first = s[0]
+  const last = s[s.length - 1]
+  if ((first === '"' && last === '"') || (first === "'" && last === "'")) return s.slice(1, -1)
+  return s
+}
+
+/**
+ * Split an argument region into operands, keeping a quoted run or a `$(…)`
+ * substitution whole.
+ *
+ * Plain whitespace splitting is not enough here, and it fails in the direction
+ * that matters: `rm -rf "$(git rev-parse --show-toplevel)"` tokenizes to
+ * `['"$(git', 'rev-parse', '--show-toplevel)"']`, so the target never reads as a
+ * substitution at all. The cases this guard exists to catch are exactly the ones
+ * that contain spaces.
+ */
+function splitOperands(args: string): string[] {
+  const out: string[] = []
+  let cur = ''
+  let quote: string | null = null
+  let depth = 0
+
+  for (let i = 0; i < args.length; i++) {
+    const ch = args[i]!
+
+    if (quote) {
+      cur += ch
+      if (ch === quote) quote = null
+      continue
+    }
+    if (ch === '"' || ch === "'" || ch === '`') {
+      quote = ch
+      cur += ch
+      continue
+    }
+    if (ch === '$' && args[i + 1] === '(') {
+      depth++
+      cur += '$('
+      i++
+      continue
+    }
+    if (depth > 0) {
+      if (ch === ')') depth--
+      cur += ch
+      continue
+    }
+    if (/\s/.test(ch)) {
+      if (cur) out.push(cur)
+      cur = ''
+      continue
+    }
+    cur += ch
+  }
+
+  if (cur) out.push(cur)
+  return out
+}
+
+/**
+ * True for an `rm` invocation carrying a recursive flag.
+ *
+ * Force (`-f`) is deliberately not required: `rm -r "$(pwd)"` deletes just as
+ * much as `rm -rf "$(pwd)"` and asks fewer questions on the way in.
+ */
+function isRecursiveRm(tokens: string[]): boolean {
+  if (tokens[0] !== 'rm') return false
+  return tokens.slice(1).some((t) => {
+    if (t === '--recursive') return true
+    // A combined cluster (`-rf`, `-fr`, `-r`). A `--flag` long form is not one.
+    return /^-[A-Za-z]+$/.test(t) && t.includes('r')
+  })
+}
+
+/** Which enumerated shape (if any) this target has. */
+function classifyTarget(raw: string): DangerousRmKind | null {
+  const target = stripQuotes(raw)
+
+  if (/^\\+$/.test(target)) return 'backslash-only'
+
+  // Led by command-substitution output. A substitution *anywhere* in the target
+  // is not enough to judge, but a target that starts with one is anchored to a
+  // value decided at run time — including the prefix form, where the suffix only
+  // narrows an unknown directory to a named entry inside it.
+  const sub = target.match(/^(\$\([^)]*\)|`[^`]*`)(\/.*)?$/)
+  if (sub) return 'substitution'
+
+  const m = target.match(/^\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?(\/\S*)?$/)
+  if (!m) return null
+  const name = m[1]!
+  const rest = m[2]
+  if (CWD_VARS.has(name)) return 'cwd-derived'
+
+  // A variable followed by exactly one more segment, and that segment is a
+  // filesystem-root directory name. Deeper paths are a named subdirectory, which
+  // is the ordinary case this must not refuse.
+  if (rest) {
+    const segments = rest.split('/').filter(Boolean)
+    if (segments.length === 1 && TOP_LEVEL_DIRS.has(segments[0]!)) return 'variable-top-level'
+  }
+  return null
+}
+
+/** Return the first unbounded recursive-`rm` target in `command`, or `null`. */
+export function detectDangerousRm(command: string): DangerousRm | null {
+  for (const segment of flattenCommand(command)) {
+    const tokens = splitOperands(segment)
+    if (!isRecursiveRm(tokens)) continue
+    for (const token of tokens.slice(1)) {
+      if (token.startsWith('-')) continue
+      const kind = classifyTarget(token)
+      if (kind) return { kind, target: stripQuotes(token) }
+    }
+  }
+  return null
+}

package/src/shared/constants.ts

@@ -95,6 +95,24 @@ export const DEFAULT_PROVIDERS: ProviderConfig[] = [
         vision: true,
         status: 'active',
       },
+      {
+        id: 'claude-fable-5-1',
+        name: 'Claude Fable 5.1',
+        providerId: 'anthropic',
+        contextWindow: 1_000_000,
+        maxOutput: 128_000,
+        vision: true,
+        status: 'active',
+      },
+      {
+        id: 'claude-opus-5-5',
+        name: 'Claude Opus 5.5',
+        providerId: 'anthropic',
+        contextWindow: 1_000_000,
+        maxOutput: 128_000,
+        vision: true,
+        status: 'active',
+      },
     ],
   },
   {

package/src/shared/deleted-cwd.ts

@@ -1,6 +1,6 @@
 /**
  * Detection and messaging for the "current working directory was deleted"
- * startup failure.
+ * failure — at startup, and mid-session.
  *
  * `process.cwd()` throws `ENOENT` when the directory the process was launched
  * from no longer exists (e.g. a removed git worktree). The CLI entry checks
@@ -8,6 +8,8 @@
  * error surface as a raw crash dump (matches Claude Code 2.1.239).
  */
 
+import { existsSync } from 'node:fs'
+
 /** True when `err` is the ENOENT thrown by `process.cwd()` on a deleted cwd. */
 export function isDeletedCwdError(err: unknown): boolean {
   if (!(err instanceof Error)) return false
@@ -24,3 +26,46 @@ export function deletedCwdMessage(): string {
     `Change to a valid directory and run \`mipham\` again.`
   )
 }
+
+/**
+ * `dir` (default `process.cwd()`) if it still exists, otherwise `null`.
+ *
+ * The launch-time check above covers a directory that was already gone when the
+ * process started. A directory deleted *while* the session runs reaches the same
+ * state, and neither runtime reports it on its own:
+ *
+ * - Node throws `ENOENT` from `process.cwd()` — but from inside whatever call
+ *   site happens to touch it first, so the message names the wrong thing;
+ * - Bun does not throw at all. It keeps returning the path it cached at startup,
+ *   so the deleted directory arrives as an ordinary string and only fails later,
+ *   at the first syscall that uses it (`spawn /bin/sh ENOENT` blames the shell).
+ *
+ * Asking the filesystem makes both runtimes agree, and lets the caller decide
+ * what to say. An error that is not this one is not swallowed.
+ */
+export function resolveExistingCwd(dir?: string): string | null {
+  let target: string
+  try {
+    target = dir ?? process.cwd()
+  } catch (err) {
+    if (isDeletedCwdError(err)) return null
+    throw err
+  }
+  return existsSync(target) ? target : null
+}
+
+/**
+ * Guidance for a session whose working directory was deleted while it ran.
+ *
+ * `deletedCwdMessage` is read before there is a session — it tells the reader to
+ * launch the CLI. This one is read from inside a running session, by the model
+ * and the operator, so it says what is broken now and what to do instead.
+ */
+export function deletedCwdSessionMessage(): string {
+  return (
+    `The working directory for this session no longer exists — it was deleted ` +
+    `while the session was running.\n` +
+    `Tools that need a directory cannot run until the session is restarted from ` +
+    `a directory that exists.`
+  )
+}

package/src/shared/package-info.ts

@@ -9,7 +9,7 @@
 export const PACKAGE_NAME = '@miphamai/cli' as const
 
 /** 当前发布版本 */
-export const PACKAGE_VERSION = '0.85.3' as const
+export const PACKAGE_VERSION = '0.85.5' as const
 
 /** npm install 全局安装命令 */
 export const NPM_INSTALL_COMMAND = `npm install -g ${PACKAGE_NAME}` as const

package/src/shared/types.ts

@@ -278,6 +278,14 @@ export interface HookConfig {
 export interface HookDefinition {
   event: HookEvent
   toolName?: string
+  /**
+   * Who declared this hook, when it was not the operator — a plugin name, today.
+   *
+   * The operator is no longer the only author of the hooks that fire, and without
+   * this the engine cannot tell them apart: a failure message names only a command,
+   * health is tracked per key, and removal has nothing to scope to.
+   */
+  source?: string
   handler: (context: HookContext) => Promise<HookResult>
 }