@miphamai/cli 0.85.4 → 0.85.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.85.4",
+  "version": "0.85.5",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/agent-view/agents-standalone.tsx

@@ -0,0 +1,42 @@
+/**
+ * `mipham agents` 独立面板 —— 从 `index.tsx` 里抽出来的那段 JSX，好让它可测。
+ *
+ * 抽取的理由是**可测性**：`index.tsx` 是进程入口（`render` + `waitUntilExit`），
+ * 它里面传下去的东西在测试里够不着；而这条路上的 Enter 落点曾经整个缺席
+ * —— 页脚广告 attach，落点是 `() => {}`。
+ */
+
+import React, { useState } from 'react'
+
+import { AgentSessionView } from './session-view'
+import { AgentViewDashboard } from './dashboard'
+import type { AgentViewManager } from './agent-view-manager'
+
+interface AgentsStandaloneProps {
+  manager: AgentViewManager
+  onExit: () => void
+}
+
+export function AgentsStandalone({ manager, onExit }: AgentsStandaloneProps) {
+  // 与 `app.tsx` 同形：attach 把会话交给只读视图，视图里的 Esc 再交还列表。
+  // 页脚无条件印着「Enter attach」—— 它必须有个落点，否则按键有反应而世界不变。
+  const [attachedSessionId, setAttachedSessionId] = useState<string | null>(null)
+
+  if (attachedSessionId) {
+    return (
+      <AgentSessionView
+        manager={manager}
+        sessionId={attachedSessionId}
+        onDetach={() => setAttachedSessionId(null)}
+      />
+    )
+  }
+
+  return (
+    <AgentViewDashboard
+      manager={manager}
+      onAttach={(session) => setAttachedSessionId(session.id)}
+      onExit={onExit}
+    />
+  )
+}

package/src/core/context.ts

@@ -8,6 +8,7 @@ import {
   deriveMessages,
   assertModelVisible,
   isAssertModelVisibleDebug,
+  closeInterruptedToolCalls,
 } from './session-log'
 
 export type Summarizer = (messages: Message[], heading: string) => Promise<string>
@@ -45,6 +46,12 @@ export class ContextManager {
    * `index.tsx` 把它接到 live `PermissionSystem.getMode()` 上，于是切一次档，下一次请求就变。
    */
   private permissionContextSource: (() => string) | null = null
+  /**
+   * 系统提示里的 **MCP instructions 段**同样是读时派生的，理由比权限段更硬：
+   * MCP server 是**启动后异步连上**的，而提示在 `setSystemPrompt()` 那一刻就建好了。
+   * 组装时烘进去的话，本次会话里后连上的 server 永远进不了提示 —— 用户只能重启。
+   */
+  private mcpInstructionsSource: (() => string) | null = null
   private estimatedTokens = 0
   private checkpoints: Checkpoint[] = []
   private checkpointCounter = 0
@@ -79,6 +86,12 @@ export class ContextManager {
   /** 从已持久化的日志恢复：设 log 为源，messages 为投影（不重复写通）。 */
   restoreLog(log: SessionLog): void {
     this.log = log
+    // 盘上那份历史可能以一条**没有结果**的调用收尾（写盘写到一半被打断，末尾那行半截
+    // 结果被 `open()` 静默丢掉 —— 引擎自己的日志顺序到不了这个形状，见下面那个函数的
+    // 注释）。挂着 `tool_calls` 却没有结果回应的请求会被 provider 整条拒收，用户看到的
+    // 是「恢复之后第一句话就报协议错」。恢复的这一刻把它补**进日志**（不是补进投影，
+    // 否则「模型看得见的必须已记录」这条不变量当场破），见 `closeInterruptedToolCalls`。
+    closeInterruptedToolCalls(log)
     this.messages = deriveMessages(log.events())
     this.reEstimateTokens()
   }
@@ -138,14 +151,28 @@ export class ContextManager {
   }
 
   /**
-   * 存储的提示 + 读时派生的权限段。
+   * 接线点（`index.tsx`）：把已连 MCP server 自带的 `instructions` 接到提示上。
    *
-   * 段尾追加（而非插回原来的中段位置）是刻意的：只切档时**前缀保持不变**，
-   * 提供方的 prefix cache 仍能命中到权限段之前的部分。
+   * 传 `null` 撤销。空串（无 server / 都没写 instructions）不产生空段。
+   */
+  setMcpInstructionsSource(fn: (() => string) | null): void {
+    this.mcpInstructionsSource = fn
+  }
+
+  /**
+   * 存储的提示 + 读时派生的段（权限 / MCP instructions）。
+   *
+   * 段尾追加（而非插回原来的中段位置）是刻意的：只切档、只连一个新 server 时
+   * **前缀保持不变**，提供方的 prefix cache 仍能命中到这些段之前的部分。
    */
   private composedSystemPrompt(): string {
-    const block = this.permissionContextSource?.() ?? ''
-    return block ? `${this.systemPrompt}\n\n---\n\n${block}` : this.systemPrompt
+    const blocks = [
+      this.permissionContextSource?.() ?? '',
+      this.mcpInstructionsSource?.() ?? '',
+    ].filter((b) => b !== '')
+    return blocks.length > 0
+      ? [this.systemPrompt, ...blocks].join('\n\n---\n\n')
+      : this.systemPrompt
   }
 
   getSystemPrompt(): string {
@@ -170,6 +197,30 @@ export class ContextManager {
     this.checkCompression()
   }
 
+  /**
+   * 注入一段**模型可见的上下文**（规则块 / compact 前后的 hook 提示 / stop hook 交回的话 /
+   * 后台 agent 的来件）。
+   *
+   * 为什么不复用 addMessage：那会把注入记成 `user/message`，在日志里与**用户真说过的话**
+   * 完全同形 —— 事后翻 session log 分不出哪一句是用户敲的、哪一句是我们塞进去的。记成
+   * `context/inject`（带 `source`）就带得出来源；而 `deriveMessages` 仍把它还原成同一个
+   * user 消息，所以**投影逐字节不变**，「model-visible means logged」照样成立。
+   */
+  injectContext(source: string, text: string): void {
+    this.messages.push({ role: 'user', content: text })
+    this.estimatedTokens += this.estimateTokens(text)
+
+    if (this.log) {
+      this.log.append({ type: 'context/inject', at: Date.now(), source, text })
+    }
+
+    if (this.log && isAssertModelVisibleDebug()) {
+      assertModelVisible(this.log.events(), this.messages)
+    }
+
+    this.checkCompression()
+  }
+
   /** 记录工具执行结果（全量 ToolResult 含 success/error）到日志，并写投影消息（不重复走 messageToEvents 拆分）。 */
   addToolResult(toolUseId: string, result: ToolResult): void {
     const content = result.success ? result.content : result.error || result.content

package/src/core/engine.ts

@@ -43,6 +43,7 @@ import { buildRequest, sendInferenceCheck, isInferenceHookEnabled } from './infe
 import { getFileInboxTransport } from '../agent/cross-session/file-inbox'
 import { registerWakeupHandler } from '../tools/scheduling/schedule-wakeup'
 import { accumulateGraftSavings } from '../shared/graft-savings'
+import { deletedCwdSessionMessage, resolveExistingCwd } from '../shared/deleted-cwd'
 import {
   getMessageBus,
   formatInboundMessage,
@@ -60,6 +61,18 @@ const bundles: Record<string, TranslationMap> = {
 }
 const t = createT(bundles['en-US'] || (enUS as TranslationMap), enUS as TranslationMap)
 
+/**
+ * Tool-calling rounds one **turn** may spend, however it spends them. 20 was too
+ * low for real multi-step tasks — the model hit "max turns" and dropped pending
+ * tools mid-task. 100 stays bounded.
+ *
+ * A budget for the turn, not for one loop: a blocking Stop hook buys another round
+ * out of the same pool. The earlier shape re-granted a fresh 100 per loop
+ * invocation, so the cap bounded no turn at all — a hook that always asked for more
+ * kept the turn running until the process died.
+ */
+const MAX_TOOL_TURNS = 100
+
 /**
  * Drop inbound messages whose timestamp is older than the dialog-expiry TTL.
  * A stale message's approval dialog is no longer relevant, so it's discarded
@@ -296,7 +309,7 @@ export class QueryEngine {
     let injected = 0
     for (const recipient of recipients) {
       for (const msg of bus.poll(recipient)) {
-        this.context.addMessage({ role: 'user', content: formatInboundMessage(msg) })
+        this.context.injectContext(`agent:${msg.from}`, formatInboundMessage(msg))
         injected++
       }
       bus.markAllRead(recipient)
@@ -389,7 +402,7 @@ export class QueryEngine {
     const files = Array.from(this.touchedFiles)
     const block = this.rulesLoader.buildContextBlock(files)
     if (!block) return
-    this.context.addMessage({ role: 'user', content: block })
+    this.context.injectContext('rules', block)
     this.touchedFiles.clear()
   }
 
@@ -789,14 +802,15 @@ export class QueryEngine {
       yield chunk
     }
 
-    // If tools were executed, recursively continue the conversation
+    // If tools were executed, recursively continue the conversation — with what
+    // is left of the turn's budget after the round just spent here.
     if (toolUses.length > 0) {
-      yield* this.continueWithTools(signal)
+      yield* this.continueWithTools(signal, MAX_TOOL_TURNS - 1)
       return
     }
 
     // Fire Stop hooks when AI finishes with no tool calls
-    yield* this.checkStopHook(signal)
+    yield* this.checkStopHook(signal, MAX_TOOL_TURNS - 1)
 
     // Final drain of task notifications
     for (const chunk of this.drainTaskNotifications()) {
@@ -883,17 +897,17 @@ export class QueryEngine {
     }
   }
 
-  private async *continueWithTools(signal?: AbortSignal): AsyncGenerator<StreamChunk> {
-    // Tool-calling round cap. 20 was too low for real multi-step tasks — the model
-    // hit "max turns" and dropped pending tools mid-task. 100 stays bounded.
-    const MAX_TURNS = 100
+  private async *continueWithTools(
+    signal?: AbortSignal,
+    roundsLeft: number = MAX_TOOL_TURNS,
+  ): AsyncGenerator<StreamChunk> {
     // Task-level stall guard: a turn that produces no text or tool result for
     // this long is considered stalled and stopped (prevents ~40-min idle spins).
     const TURN_TIMEOUT_MS = 15 * 60 * 1000
     let lastActivity = Date.now()
     const toolDefs = this.getToolDefinitions()
 
-    for (let turn = 0; turn < MAX_TURNS; turn++) {
+    for (let turn = 0; turn < roundsLeft; turn++) {
       if (Date.now() - lastActivity > TURN_TIMEOUT_MS) {
         yield {
           type: 'warning',
@@ -1008,11 +1022,11 @@ export class QueryEngine {
       }
 
       // Safety: when max turns reached with pending tools, ask model to summarize
-      if (turn === MAX_TURNS - 1 && toolUses.length > 0) {
+      if (turn === roundsLeft - 1 && toolUses.length > 0) {
         this.context.addMessage({
           role: 'user',
           content: t('errors.max_tool_turns_warning', {
-            max: String(MAX_TURNS),
+            max: String(MAX_TOOL_TURNS),
             pending: String(toolUses.length),
           }),
         })
@@ -1033,7 +1047,7 @@ export class QueryEngine {
         } catch {
           yield {
             type: 'error',
-            error: t('errors.max_tool_turns', { max: String(MAX_TURNS) }),
+            error: t('errors.max_tool_turns', { max: String(MAX_TOOL_TURNS) }),
           }
         }
         return
@@ -1041,7 +1055,7 @@ export class QueryEngine {
 
       // No more tool calls — fire Stop hook and potentially continue
       if (toolUses.length === 0) {
-        yield* this.checkStopHook(signal)
+        yield* this.checkStopHook(signal, roundsLeft - turn - 1)
         return
       }
 
@@ -1228,8 +1242,24 @@ export class QueryEngine {
     }
 
     try {
+      // Every tool is handed the session's working directory, and that directory
+      // can be deleted while the session runs. Nothing upstream notices: Node
+      // throws from whichever call site touches it first, Bun keeps handing back
+      // the path it cached at startup, and the tool then fails at its first
+      // syscall naming whatever it touched (`spawn /bin/sh ENOENT` blames the
+      // shell). Refuse here, where the reason is still known.
+      const cwd = resolveExistingCwd()
+      if (!cwd) {
+        // Both fields carry the message on purpose: a failed result is projected
+        // as `error || content` (the two tool-result loops and the context log all
+        // read it that way), so guidance parked in `content` alone would be
+        // dropped exactly when it is needed.
+        const reason = deletedCwdSessionMessage()
+        return { success: false, content: reason, error: reason }
+      }
+
       const result = await tool.execute(effectiveParams, {
-        cwd: process.cwd(),
+        cwd,
         sessionId: this.sessionId,
         provider: this.registry.getActive().config.id,
         model: this.registry.getActiveModel(),
@@ -1373,9 +1403,21 @@ export class QueryEngine {
     this.llm = llm
   }
 
-  /** 统一 chat 出口：优先走注入的 Llm 缝，否则回退 registry。 */
+  /**
+   * 统一 chat 出口：优先走注入的 Llm 缝，否则回退 registry。
+   *
+   * 被截断的一轮在这里点名。`truncated` 只有 provider 能判（被上限截断、连接
+   * 被干净地关掉、正常写完，在字节流上是同一个形状），而这里是**每一处消费
+   * chat 流的地方都必经的唯一出口** —— 转发的循环有两个（`process` 与
+   * `continueWithTools`），各自补一次正是「两条渲染路径只接一条」的老毛病。
+   */
   private async *llmChat(req: ChatRequest): AsyncGenerator<StreamChunk> {
-    yield* (this.llm ?? this.registry).chat(req)
+    for await (const chunk of (this.llm ?? this.registry).chat(req)) {
+      if (chunk.type === 'stop' && chunk.truncated) {
+        yield { type: 'warning', content: t('errors.turn_truncated') }
+      }
+      yield chunk
+    }
   }
 
   /**
@@ -1494,13 +1536,15 @@ export class QueryEngine {
         : t('errors.tool_denied_classifier', { name, reason })
     }
 
-    const { reason, rulePattern } = this.permission.explainDenial(tool, params)
+    const { reason, rulePattern, target } = this.permission.explainDenial(tool, params)
     const mode = this.permission.getMode()
     switch (reason) {
       case 'deny-rule':
         return t('errors.tool_denied_deny_rule', { name, pattern: rulePattern ?? '?' })
       case 'ask-rule':
         return t('errors.tool_denied_ask_rule', { name, pattern: rulePattern ?? '?' })
+      case 'dangerous-rm':
+        return t('errors.tool_denied_dangerous_rm', { name, target: target ?? '?' })
       default:
         // mode-baseline / tool-default / legacy-rule / system-default — a mode
         // switch (or /permissions) resolves it.
@@ -1685,10 +1729,10 @@ export class QueryEngine {
     if (this.hookEngine) {
       const preResult = await this.hookEngine.executePreCompact(this.sessionId)
       if (preResult.additionalContext) {
-        this.context.addMessage({
-          role: 'user',
-          content: `[Pre-compact context]: ${preResult.additionalContext}`,
-        })
+        this.context.injectContext(
+          'pre-compact',
+          `[Pre-compact context]: ${preResult.additionalContext}`,
+        )
       }
     }
 
@@ -1697,29 +1741,46 @@ export class QueryEngine {
     if (this.hookEngine) {
       const postResult = await this.hookEngine.executePostCompact(this.sessionId)
       if (postResult.additionalContext) {
-        this.context.addMessage({
-          role: 'user',
-          content: `[Post-compact context]: ${postResult.additionalContext}`,
-        })
+        this.context.injectContext(
+          'post-compact',
+          `[Post-compact context]: ${postResult.additionalContext}`,
+        )
       }
     }
   }
 
   /** Fire Stop hook. If blocked, feed the reason back to the AI and continue. */
-  private async *checkStopHook(signal?: AbortSignal): AsyncGenerator<StreamChunk> {
+  private async *checkStopHook(
+    signal?: AbortSignal,
+    roundsLeft: number = MAX_TOOL_TURNS,
+  ): AsyncGenerator<StreamChunk> {
     if (!this.hookEngine) return
 
     const stopResult = await this.hookEngine.executeStop(this.sessionId)
-    if (stopResult.decision === 'block') {
-      // Feed the block reason back to the AI and continue
-      this.context.addMessage({
-        role: 'user',
-        content: t('system.context.stop_blocked', {
+    if (stopResult.decision !== 'block') return
+
+    // A block asks for more work, and more work means another round — which the
+    // turn may have none of left. Saying so is the point: a hook quietly ignored
+    // is worse than one told it has been overruled.
+    if (roundsLeft <= 0) {
+      yield {
+        type: 'warning',
+        content: t('errors.stop_hook_budget_spent', {
+          max: String(MAX_TOOL_TURNS),
           reason: stopResult.reason || 'Continue working.',
         }),
-      })
-      yield* this.continueWithTools(signal)
+      }
+      return
     }
+
+    // Feed the block reason back to the AI and continue
+    this.context.injectContext(
+      'stop-hook',
+      t('system.context.stop_blocked', {
+        reason: stopResult.reason || 'Continue working.',
+      }),
+    )
+    yield* this.continueWithTools(signal, roundsLeft)
   }
 }
 

package/src/core/hooks-executor.ts

@@ -1,4 +1,6 @@
 import { spawnSync } from 'node:child_process'
+import { McpClient } from '../mcp/client'
+import type { ToolCallResult } from '../mcp/types'
 import type { HookConfig, HookContext, HookResult } from '../shared/index.ts'
 
 /**
@@ -7,13 +9,17 @@ import type { HookConfig, HookContext, HookResult } from '../shared/index.ts'
  * Supported types:
  * - command: Execute a shell command. Exit code 0 = allow, 2 = block with stderr as reason.
  * - http: POST to a URL, response body becomes additionalContext.
- * - mcp_tool: Call an MCP tool (delegates to MCP client -- stub for now).
+ * - mcp_tool: Call the MCP tool the hook names; its answer is read as the hook's.
  * - code: No-op (handled inline by the handler function directly).
  */
-export async function executeHook(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
+export async function executeHook(
+  cfg: HookConfig,
+  ctx: HookContext,
+  source?: string,
+): Promise<HookResult> {
   switch (cfg.type) {
     case 'command':
-      return executeCommand(cfg, ctx)
+      return executeCommand(cfg, ctx, source)
     case 'http':
       return executeHttp(cfg, ctx)
     case 'mcp_tool':
@@ -155,7 +161,26 @@ function spawnFailureCause(
   return null
 }
 
-async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
+/**
+ * The handle a failure message points the operator at: the command, and — when the
+ * hook came from a plugin rather than from the operator's own settings — who
+ * declared it.
+ *
+ * The command alone does not answer "which plugin do I look at". A plugin hook is
+ * typically `sh`, `node`, or a path under the plugin's root; none of those is a
+ * name the operator can search for. Two arguments rather than a pre-joined string
+ * because the parentheses and the `from` clause have to stay one decision: a
+ * caller that built half the label would be free to print `from "undefined"`.
+ */
+function failingLabel(command: string | undefined, source?: string): string {
+  return `(${command})${source ? ` from "${source}"` : ''}`
+}
+
+async function executeCommand(
+  cfg: HookConfig,
+  ctx: HookContext,
+  source?: string,
+): Promise<HookResult> {
   if (!cfg.command) return { allowed: true }
 
   try {
@@ -220,14 +245,14 @@ async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookRe
     if (failure) {
       return {
         allowed: true,
-        additionalContext: `Hook error (${cfg.command}): ${failure}`,
+        additionalContext: `Hook error ${failingLabel(cfg.command, source)}: ${failure}`,
       }
     }
 
     // Other non-zero exit: don't block, log the error as context
     return {
       allowed: true,
-      additionalContext: `Hook warning (${cfg.command}): ${stderr.trim()}`,
+      additionalContext: `Hook warning ${failingLabel(cfg.command, source)}: ${stderr.trim()}`,
     }
   } catch (err) {
     // Only reached when `spawnSync` itself throws — masking-policy load, env
@@ -237,7 +262,7 @@ async function executeCommand(cfg: HookConfig, ctx: HookContext): Promise<HookRe
 
     return {
       allowed: true,
-      additionalContext: `Hook error (${cfg.command}): ${message}`,
+      additionalContext: `Hook error ${failingLabel(cfg.command, source)}: ${message}`,
     }
   }
 }
@@ -282,8 +307,60 @@ async function executeHttp(cfg: HookConfig, ctx: HookContext): Promise<HookResul
   }
 }
 
-async function executeMcpTool(_cfg: HookConfig, _ctx: HookContext): Promise<HookResult> {
-  // Stub: MCP tool hook execution requires MCP client integration.
-  // For now, return allow to not block execution.
-  return { allowed: true }
+/**
+ * An `mcp_tool` hook: call the tool the hook names, and read its answer as the
+ * hook's own.
+ *
+ * The answer is read by the same contract a command hook's stdout follows — a
+ * structured decision decides, plain prose is context — so a tool that guards a
+ * tool call can block it the way a script would. An `isError` result is *not* a
+ * decision: it means the call did not speak, and an unreachable server reports
+ * the same way, so its message is reported rather than read as a verdict.
+ */
+async function executeMcpTool(cfg: HookConfig, ctx: HookContext): Promise<HookResult> {
+  if (!cfg.mcpServer || !cfg.mcpTool) return { allowed: true }
+
+  const client = McpClient.getInstance()
+
+  // Startup connects servers without blocking; this hook can arrive first.
+  if (!(await client.waitUntilReady(cfg.mcpServer))) {
+    return {
+      allowed: true,
+      additionalContext: `MCP hook (${cfg.mcpServer}/${cfg.mcpTool}): server "${cfg.mcpServer}" was still connecting — the tool was not called.`,
+    }
+  }
+
+  const result = await client.callTool(cfg.mcpServer, cfg.mcpTool, {
+    event: ctx.event,
+    toolName: ctx.toolName,
+    toolInput: ctx.toolInput,
+    sessionId: ctx.sessionId,
+  })
+  const body = mcpResultText(result)
+
+  if (result.isError) {
+    return {
+      allowed: true,
+      additionalContext: `MCP hook error (${cfg.mcpServer}/${cfg.mcpTool}): ${body.slice(0, 2000)}`,
+    }
+  }
+
+  const parsed = parseHookStdout(body, ctx)
+  const decided =
+    !parsed.allowed ||
+    parsed.additionalContext !== undefined ||
+    parsed.permissionDecision !== undefined ||
+    parsed.modifiedInput !== undefined
+
+  // Nothing in the hook contract matched, so the tool answered in prose: that
+  // answer is the context this hook contributes, not a silent no-op.
+  return decided ? parsed : { allowed: true, additionalContext: body.slice(0, 2000) || undefined }
+}
+
+/** The text an MCP tool call returned; non-text parts carry no message for a hook. */
+function mcpResultText(result: ToolCallResult): string {
+  return result.content
+    .map((part) => part.text ?? '')
+    .filter(Boolean)
+    .join('\n')
 }

package/src/core/hooks.ts

@@ -70,6 +70,18 @@ export class HookEngine {
     )
   }
 
+  /**
+   * Remove every hook a given source declared, and nothing else.
+   *
+   * `unregister(event)` matches on the event alone, so a caller that wanted to undo
+   * its own registrations took down every hook on those events — the operator's own
+   * from settings, and other plugins'. Scoping by source is the only removal that
+   * answers the question the caller is actually asking.
+   */
+  unregisterSource(source: string): void {
+    this.hooks = this.hooks.filter((h) => h.source !== source)
+  }
+
   // ── Existing event executors ──
 
   async executePreToolUse(
@@ -217,9 +229,21 @@ export class HookEngine {
 
   // ── Health & Resilience ──
 
-  /** Get a hook health key for tracking. */
+  /**
+   * Get a hook health key for tracking.
+   *
+   * Health is per hook, and the key is what says which hook. It was the event (plus
+   * the tool name), which is a *class* of hooks rather than one of them: two hooks
+   * on the same event shared one failure counter and one disabled flag, so five
+   * failures from a plugin's broken hook could auto-disable an unrelated hook that
+   * had never failed. The source is what makes the key name one hook.
+   *
+   * A hook with no source keeps the string it has always had — `/hooks enable`
+   * takes these keys, and a key for a hook that has no plugin must not renumber.
+   */
   private healthKey(hook: HookDefinition): string {
-    return hook.toolName ? `${hook.event}:${hook.toolName}` : hook.event
+    const base = hook.toolName ? `${hook.event}:${hook.toolName}` : hook.event
+    return hook.source ? `${hook.source}:${base}` : base
   }
 
   /** Check if a hook should be skipped due to repeated failures. */