fix: scope PreToolUse hooks to their own tools

[HadiHassan22]

Description

Fixes #154.

check-vgv-cli.sh never read its stdin payload. It ran check_vgv_cli and emitted a
deny/allow decision for whatever tool invoked it, trusting the hooks.json matcher to
scope it. On a host where that matcher does not select correctly, a Dart tool-version check
denied unrelated MCP tool calls — reported from a TypeScript/Next.js project with no Dart in it.
The inverse is worse: when the CLI is present, the same blind path returned allow, silently
auto-approving unrelated MCP calls and bypassing the permission prompt.

What changed

Both PreToolUse hooks now confirm from the payload that the call is their business.
A matcher is a filter, not a guarantee, so each hook checks tool_name itself and exits 0 when
the tool is not its own.

block-cli-workarounds.sh had the same fault with a narrower trigger. It filtered on
.tool_input.command — a field name rather than the caller's identity — so any MCP tool carrying
a command argument was inspected and could be denied:

# before
$ echo '{"tool_name":"MCP:run_terminal_cmd","tool_input":{"command":"flutter test"}}' | bash hooks/scripts/block-cli-workarounds.sh
{"hookSpecificOutput":{"permissionDecision":"deny", ...}}

# after — stands aside

It now scopes on tool_name instead, accepting the shell tool under either name hosts give it.
When a host sends no tool_name at all it falls through to the command check, so enforcement is
never silently dropped.

The CLI lookup is fixed too, and this half is host-independent. very_good installs to
~/.pub-cache/bin, which an interactive shell adds to PATH but a hook subprocess does not
necessarily inherit — it is not in /etc/paths. A present CLI was reported missing, producing
both a spurious deny on genuine Very Good CLI calls and a false warning at every session start.
Resolution now falls back to $PUB_CACHE/bin.

A pub-cache fallback alone is not enough: the installed very_good is a sh shim that execs
dart, so a PATH without dart makes the check inconclusive rather than negative.

$ env -i HOME=$HOME PATH=/usr/bin:/bin:/usr/sbin:/sbin ~/.pub-cache/bin/very_good --version
~/.pub-cache/bin/very_good: line 8: dart: command not found   (exit 127)

check_vgv_cli now returns unverifiable for that case, and every caller handles it:

• check-vgv-cli.sh stands aside instead of denying a genuine Very Good CLI call on an
  inconclusive check, so normal permission handling applies.
• warn-missing-mcp.sh warns that the CLI was found but cannot run because dart is not on
  the PATH hooks inherit. It no longer claims the CLI is not installed, and no longer goes
  silent either.
• block-cli-workarounds.sh denies with the same PATH message instead of redirecting to the
  MCP tool. The MCP server starts through the same very_good shim, so that redirect would
  have been a dead end.

A genuinely absent CLI still denies and still warns, unchanged.

Tests

Adds hooks/scripts/check-vgv-cli_test.sh (14 cases) and hooks/scripts/warn-missing-mcp_test.sh
(12 cases), plus tool-scoping and deny-reason cases in block-cli-workarounds_test.sh. Every case
runs against a stubbed very_good on a PATH containing nothing else, so results do not depend
on what is installed on the machine running them. Both new suites are registered in the
Script Tests CI job. All four suites pass: 18, 40, 14, 12.

The block-cli-workarounds_test.sh helpers used to grep for the permissionDecision key rather
than read its value, and discarded the hook's exit status, so an inverted guard or a crashing
hook still passed. The helpers now read the decision with jq and treat a non-zero exit as its
own outcome; flipping deny to allow in vgv-cli-common.sh now fails 18 of 40 cases, and a
hook that exits 2 fails all of them. The same exit handling is applied in check-vgv-cli_test.sh.

Scope

This does not add Cursor support (#48), and deliberately does not touch the matcher — making
mcp__.*very-good-cli__.* match another host's naming is that issue's business. The change is
that the scripts no longer depend on the matcher being correct, plus a PATH fix that affects
Claude Code identically. #126 workstream 4 factors these hooks for multi-host adaptation; scoping
on tool_name is a prerequisite for it.

One cspell word (Anson) was added: it is pre-existing in ci.yaml and this PR touches that
file, which brings it into the spell check's changed-file set.

Known limitation, not addressed here

Cursor's preToolUse payload carries no server segment — a Very Good CLI test call arrives as
MCP:test, indistinguishable from any other server's test. The guard therefore stands aside for
genuine Very Good CLI calls on that host, so the auto-approve is lost there. That is fail-safe: no
false denials, and the tools still work through normal permission handling. Restoring it needs
either matching bare tool names (create, test, ...), which collide across MCP servers, or
Cursor's beforeMCPExecution event. Called out in #154 as a follow-up rather than widened here.

Type of Change

• New feature (feat)
• Bug fix (fix)
• Code refactor (refactor)
• Documentation (docs)
• CI change (ci)
• Chore (chore)

🤖 Generated with Claude Code

[ryzizub]

@HadiHassan22 do you have bandwith to continue this fix?

[HadiHassan22]

@HadiHassan22 do you have bandwith to continue this fix?

@ryzizub yes i'll look at your feedback and update the PR hopefully between today and tomorrow. Thanks for the review.