fix: address PR #4180 review - security, typing, and test coverage

- Apply mcp_env_allowlist to plugin hooks: intersect HTTP allowedEnvVars
  with MCP allowlist, set command allowedEnvVars to full MCP allowlist
- Scrub process.env in executeHookCommand when allowedEnvVars provided
- Add PluginHooksState class with per-directory Map storage
- Add PluginHooksConfig interface for typed boundary layer
- Pass directory context through hook-config-handler
- Add 16 tests across 4 files (40 assertions) covering allowlist
  filtering, env scrubbing, directory isolation, and edge cases
- Remove unnecessary 'as' type assertions, use discriminated union
  narrowing instead

src/plugin-handlers/config-handler.ts

@@ -31,7 +31,7 @@ export function createConfigHandler(deps: ConfigHandlerDeps) {
 
     const pluginComponents = await loadPluginComponents({ pluginConfig });
 
-    applyHookConfig({ pluginComponents });
+    applyHookConfig({ pluginComponents, ctx });
 
     const agentResult = await applyAgentConfig({
       config,

src/plugin-handlers/hook-config-handler.test.ts

@@ -0,0 +1,83 @@
+const { afterEach, beforeEach, describe, expect, mock, test } = require("bun:test")
+
+const mockSetPluginHooksConfigs = mock(() => {})
+
+mock.module("../hooks/claude-code-hooks/config", () => ({
+  setPluginHooksConfigs: mockSetPluginHooksConfigs,
+}))
+
+const { applyHookConfig } = await import("./hook-config-handler")
+
+describe("applyHookConfig", () => {
+  beforeEach(() => {
+    mockSetPluginHooksConfigs.mockClear()
+  })
+
+  afterEach(() => {
+    mockSetPluginHooksConfigs.mockClear()
+  })
+
+  test("#given ctx.directory #when applyHookConfig called #then setPluginHooksConfigs receives ctx.directory", () => {
+    // given
+    const testDirectory = "/test/dir"
+    const pluginComponents = {
+      commands: {},
+      skills: {},
+      agents: {},
+      mcpServers: {},
+      hooksConfigs: [
+        {
+          hooks: {
+            Stop: [
+              {
+                matcher: "*",
+                hooks: [{ type: "command", command: "echo test" }],
+              },
+            ],
+          },
+        },
+      ],
+      plugins: [{ name: "test-plugin", version: "1.0.0" }],
+      errors: [],
+    }
+
+    // when
+    applyHookConfig({
+      pluginComponents,
+      ctx: { directory: testDirectory },
+    })
+
+    // then
+    expect(mockSetPluginHooksConfigs).toHaveBeenCalledTimes(1)
+    expect(mockSetPluginHooksConfigs).toHaveBeenCalledWith(
+      testDirectory,
+      pluginComponents.hooksConfigs,
+    )
+  })
+
+  test("#given empty hooksConfigs #when applyHookConfig called #then setPluginHooksConfigs still called with empty array", () => {
+    // given
+    const testDirectory = "/another/dir"
+    const pluginComponents = {
+      commands: {},
+      skills: {},
+      agents: {},
+      mcpServers: {},
+      hooksConfigs: [],
+      plugins: [],
+      errors: [],
+    }
+
+    // when
+    applyHookConfig({
+      pluginComponents,
+      ctx: { directory: testDirectory },
+    })
+
+    // then
+    expect(mockSetPluginHooksConfigs).toHaveBeenCalledTimes(1)
+    expect(mockSetPluginHooksConfigs).toHaveBeenCalledWith(testDirectory, [])
+  })
+})
+
+export {}

src/plugin-handlers/hook-config-handler.ts

@@ -4,8 +4,9 @@ import { log } from "../shared"
 
 export function applyHookConfig(params: {
   pluginComponents: PluginComponents;
+  ctx: { directory: string };
 }): void {
-  const { pluginComponents } = params
+  const { pluginComponents, ctx } = params
 
   if (pluginComponents.hooksConfigs.length > 0) {
     log("[hook-config-handler] Merging plugin hooks configs", {
@@ -14,5 +15,5 @@ export function applyHookConfig(params: {
     })
   }
 
-  setPluginHooksConfigs(pluginComponents.hooksConfigs)
+  setPluginHooksConfigs(ctx.directory, pluginComponents.hooksConfigs)
 }

src/plugin-handlers/plugin-components-loader.ts

@@ -1,5 +1,6 @@
 import type { OhMyOpenCodeConfig } from "../config";
 import { loadAllPluginComponents } from "../features/claude-code-plugin-loader";
+import type { PluginHooksConfig } from "../hooks/claude-code-hooks/types";
 import { addConfigLoadError, log } from "../shared";
 
 export type PluginComponents = {
@@ -7,7 +8,7 @@ export type PluginComponents = {
   skills: Record<string, unknown>;
   agents: Record<string, unknown>;
   mcpServers: Record<string, unknown>;
-  hooksConfigs: Array<{ hooks?: Record<string, unknown> }>;
+  hooksConfigs: PluginHooksConfig[];
   plugins: Array<{ name: string; version: string }>;
   errors: Array<{ pluginKey: string; installPath: string; error: string }>;
 };