[Bug] 工作区 hooks 信任门失效(0.16.5,Windows)

提交前确认 · Pre-submission checklist

• 我已搜索过现有 issue，确认这不是重复 / I searched existing issues and confirmed this isn't a duplicate.
• 我已阅读 CONTRIBUTING.md / I've read CONTRIBUTING.md.

问题类别 · Category

工具调用 / MCP · Tool use / MCP

涉及的 Agent 框架 · Agent framework

ZCode Agent（自研）

严重程度 · Severity

影响体验 · Major (功能可用但体验受损 / works but degraded)

复现频率 · Reproducibility

必现 · Always

问题描述 · Description

问题一:hooks 信任已授予并落盘,解析层仍判定 pending,hooks 永不执行

• 授予后,信任模块认为已满足:后续所有会话启动均不再创建
  workspace_hook.review_request_created(授予前该请求会周期性重建)。
• 解析模块认为未信任:adapters.config 持续输出
  config.project_hooks.pending_trust("pending workspace trust and remain
  blocked"),每次工具调用都触发,跨多个会话、跨客户端重启不消失。
• 启动日志 bootstrap.app.startup.plugins.completed 的 hookCount 恒为 0,
  全天日志无任何 hook 执行记录。
• 关键排除项:配置文件在授予前后未做任何修改(文件 mtime 早于授予时刻),
  排除配置换代/内容漂移;即同一份未变配置,授予路径判"已信任"、解析路径判
  "未信任",两个子系统对信任存储的查找/比对结果不一致。
• 行为验证:预期应由 PreToolUse 钩子拦截的操作未被拦截(钩子确实未运行)。

复现步骤 · Steps to reproduce

1. 工作区 .zcode/config.json 配置 hooks.enabled: true 与两个 PreToolUse
   process 钩子(matcher 分别为 Bash 与 WebSearch|WebFetch),每个钩子
   enabled: true。
2. 新会话出现「N 个工作区 Hook 待审核」横幅 → 打开审核面板,逐字段与配置文件
   核对一致 → 对两个钩子分别点击「信任」。
3. 日志出现两次 workspace_hook.trust_selected(generation 1、2 各一条,
   每条 grantedRecordCount: 1);信任存储
   ~/.zcode/security/workspace-hook-trust-v1.json 中正确写入两条记录:
   decision 均为 "trusted",workspaceIdentity、hookDeclarationDigest、
   bundleDigestAtGrant、matcherIndexAtGrant 等字段齐全。
4. 之后新开会话(含完全重启客户端后):hookCount 始终为 0,hooks 从不执行;
   但也不再出现审核横幅、不再创建 review_request。

期望表现 · Expected behavior

期望

1. 信任授予后,解析层应消费 ~/.zcode/security/workspace-hook-trust-v1.json
   中的记录并放行 hooks。
2. 若解析时摘要校验不匹配,请给出具体诊断(哪个 digest 不匹配、期望值与实际
   值各是什么),而不是无限期 pending 且无任何用户可见提示。
3. 建议提供手动重置/重新触发工作区 hook 信任审核的途径(命令或设置项),
   便于用户在异常状态下自救。

实际表现 · Actual behavior

永不执行对应hooks

ZCode 版本 · ZCode version

0.16.5

设备 / 系统 / 浏览器 · Device / OS / Browser

Windows

截图 / 录屏 / 日志 · Screenshots / Recordings / Logs

附件:关键日志节选(已脱敏;时间戳为 UTC)

日志文件:~/.zcode/cli/log/zcode-2026-09-05.jsonl(按天滚动)

统计概览:当日 15 次客户端/会话启动,hookCount 全部为 0;
config.project_hooks.pending_trust 告警共 143 条;信任门事件 10 条(全景见下)。

A. 信任门事件全景——授予前审核请求周期性重建(3 轮超时),授予后彻底停止:

{"ts":"...T11:50:50Z","event":"workspace_hook.review_request_created","session":"sess_E","generation":1,"requestItemCount":2,"requestEnabledCount":2,"workspaceIdentityDigest":"575af6bd53f6","bundleDigest":"b7846984ba5b"}
{"ts":"...T12:00:50Z","event":"workspace_hook.review_timeout","session":"sess_E","generation":1,"reasonCode":"workspace_hooks_interaction_timeout"}
{"ts":"...T12:06:58Z","event":"workspace_hook.review_request_created","session":"sess_E","generation":2,"requestItemCount":2,"requestEnabledCount":2}
{"ts":"...T12:16:58Z","event":"workspace_hook.review_timeout","session":"sess_E","generation":2,"reasonCode":"workspace_hooks_interaction_timeout"}
{"ts":"...T13:00:25Z","event":"workspace_hook.review_request_created","session":"sess_E","generation":3,"requestItemCount":2,"requestEnabledCount":2}
{"ts":"...T13:10:25Z","event":"workspace_hook.review_timeout","session":"sess_E","generation":3,"reasonCode":"workspace_hooks_interaction_timeout"}
{"ts":"...T14:02:33Z","event":"workspace_hook.review_request_created","session":"sess_E","generation":1,"requestItemCount":2,"requestEnabledCount":2} ← 用户打开审核面板
{"ts":"...T14:02:36Z","event":"workspace_hook.trust_selected","session":"sess_E","generation":1,"grantedRecordCount":1,"requestEnabledCount":2,"appVersionAtGrant":"0.16.5"} ← 点击信任 hook 1
{"ts":"...T14:02:36Z","event":"workspace_hook.review_request_created","session":"sess_E","generation":2,"requestItemCount":2,"requestEnabledCount":2} ← 面板随即为 hook 2 发起新请求
{"ts":"...T14:02:38Z","event":"workspace_hook.trust_selected","session":"sess_E","generation":2,"grantedRecordCount":1,"requestEnabledCount":2} ← 点击信任 hook 2
（此后直到当天结束:review_request_created 零新增 —— 信任模块已认为"全部授予"）

B. 启动解析 hookCount(节选;当日 15 次启动全部 hookCount=0):

{"ts":"...T11:50:21Z","event":"bootstrap.app.startup.plugins.completed","session":"sess_E","enabledPluginCount":5,"hookCount":0,"pluginCount":8} ← 授予前
{"ts":"...T14:02:30Z","event":"bootstrap.app.startup.plugins.completed","session":"sess_E","enabledPluginCount":5,"hookCount":0,"pluginCount":8} ← 授予同分钟
{"ts":"...T14:22:25Z","event":"bootstrap.app.startup.plugins.completed","session":"sess_F","enabledPluginCount":5,"hookCount":0,"pluginCount":8} ← 授予后 20 分钟
{"ts":"...T15:08:48Z","event":"bootstrap.app.startup.plugins.completed","session":"sess_I","enabledPluginCount":5,"hookCount":0,"pluginCount":8} ← 完全重启客户端后
{"ts":"...T15:35:23Z","event":"bootstrap.app.startup.plugins.completed","session":"sess_K","enabledPluginCount":5,"hookCount":0,"pluginCount":8} ← 重启后再次启动

C. 解析层持续判定 pending(143 条中首末各 2 条;最后一条在重启+授予之后约 2 小时):

{"ts":"...T07:02:29Z","event":"config.project_hooks.pending_trust","configScope":"project","diagnosticCode":"config_project_hooks_pending_trust"}
{"ts":"...T08:01:00Z","event":"config.project_hooks.pending_trust","configScope":"project","diagnosticCode":"config_project_hooks_pending_trust"}
{"ts":"...T15:59:51Z","event":"config.project_hooks.pending_trust","configScope":"project","diagnosticCode":"config_project_hooks_pending_trust"}
{"ts":"...T15:59:51Z","event":"config.project_hooks.pending_trust","configScope":"project","diagnosticCode":"config_project_hooks_pending_trust"}

配套磁盘证据(与日志互相印证):
~/.zcode/security/workspace-hook-trust-v1.json 内有且仅有两条记录,均为
decision="trusted"、bundleDigestAtGrant 与日志中的 bundleDigest 一致
(分别对应授予时刻 T14:02:36Z / T14:02:38Z)。

Start with ~/.zcode/security/workspace-hook-trust-v1.json and the startup/config log events, comparing trusted records such as digests and matcher indexes with the parser path that emits config.project_hooks.pending_trust. Done means granted hooks load and execute across new sessions and restarts, while any digest mismatch reports its expected and actual values.