Summary

• add tool-scoped plugin hook registrations for zero-overhead per-tool interception
• add the fork-guard bundled plugin to block risky exec-driven fork writes like git push and gh pr create
• cover the new hook scoping and fork-guard behavior with regression tests

Why

OpenClaw already had global before_tool_call / after_tool_call hooks, but no narrow way for a plugin to intercept only one tool without paying dispatch overhead across every call. That made policy plugins like fork hygiene guards awkward and broader than they needed to be.

This PR adds opt-in tool scoping to the existing hook system, then uses it to implement a focused fork-guard plugin that inspects exec commands before they run and blocks pushes / PR creation when the current diff matches configured sensitive patterns.

Testing

🤖 AI-assisted

• pnpm vitest run src/plugins/hooks.test.ts src/agents/pi-tools.before-tool-call.test.ts extensions/fork-guard/src/config.test.ts extensions/fork-guard/src/index.test.ts
• pnpm --dir extensions/fork-guard exec tsc --noEmit