Merge branch 'main' into affaan/integrate-reviewed-followups-20260928

hooks/hooks.json

@@ -70,7 +70,7 @@
         ]
       },
       {
-        "matcher": ".*",
+        "matcher": "^mcp__",
         "hooks": [
           {
             "type": "command",
@@ -145,7 +145,7 @@
     ],
     "PostToolUseFailure": [
       {
-        "matcher": ".*",
+        "matcher": "^mcp__",
         "hooks": [
           {
             "type": "command",

hooks/hooks.metadata.json

@@ -40,7 +40,7 @@
       {
         "id": "pre:mcp-health-check",
         "description": "Check MCP server health before MCP tool execution and block unhealthy MCP calls",
-        "fingerprint": "922686364d01"
+        "fingerprint": "a68881c27a83"
       },
       {
         "id": "pre:edit-write:gateguard-fact-force",
@@ -83,7 +83,7 @@
       {
         "id": "post:mcp-health-check",
         "description": "Track failed MCP tool calls, mark unhealthy servers, and attempt reconnect",
-        "fingerprint": "9e25549c1229"
+        "fingerprint": "edbf5346288f"
       },
       {
         "id": "post:skill:track",

tests/hooks/hooks.test.js

@@ -2748,6 +2748,31 @@ async function runTests() {
     passed++;
   else failed++;
 
+  if (
+    test('MCP health-check hooks use anchored ^mcp__ matcher (no wildcard spawns)', () => {
+      const hooksPath = path.join(__dirname, '..', '..', 'hooks', 'hooks.json');
+      const hooks = readHooksConfig(hooksPath);
+
+      const preMcp = hooks.hooks.PreToolUse.filter(entry => JSON.stringify(entry).includes('pre:mcp-health-check'));
+      assert.strictEqual(preMcp.length, 1, 'Should define exactly one PreToolUse mcp-health-check entry');
+      assert.strictEqual(
+        preMcp[0].matcher,
+        '^mcp__',
+        `PreToolUse mcp-health-check matcher must be anchored '^mcp__' so it only spawns on genuine MCP tool names (got ${preMcp[0].matcher})`
+      );
+
+      const postMcp = hooks.hooks.PostToolUseFailure.filter(entry => JSON.stringify(entry).includes('post:mcp-health-check'));
+      assert.strictEqual(postMcp.length, 1, 'Should define exactly one PostToolUseFailure mcp-health-check entry');
+      assert.strictEqual(
+        postMcp[0].matcher,
+        '^mcp__',
+        `PostToolUseFailure mcp-health-check matcher must be anchored '^mcp__' so it only spawns on genuine MCP tool failures (got ${postMcp[0].matcher})`
+      );
+    })
+  )
+    passed++;
+  else failed++;
+
   if (
     test('hooks.json gives PowerShell dedicated GateGuard and governance routes', () => {
       const hooksPath = path.join(__dirname, '..', '..', 'hooks', 'hooks.json');