@akanjs/devkit 3.1.1-rc.9 → 3.1.2-rc.0

package/codeAgent/tools/akanCodePlugins.test.ts

@@ -1,11 +1,13 @@
-import { describe, expect, spyOn, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, spyOn, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
 import path from "node:path";
 import { codeAgentPresets } from "akanjs/common";
 import { makeCliTempWorkspace, tempRoots, writeText } from "../../testHelpers";
 import { CodeAgent, type CodeAgentOptions } from "../agent/CodeAgent";
 import { SubagentPool } from "../agent/SubagentPool";
+import { WorkspaceTrust } from "../agent/WorkspaceTrust";
 import { DevLogFeedback } from "../feedback/DevLogFeedback";
-import { PreviewView } from "../feedback/PreviewView";
 import { TurnFeedback, type TurnFeedbackSource } from "../feedback/TurnFeedback";
 import { AkanCodePlugins } from "./AkanCodePlugins";
 import { AkanEditScope } from "./AkanEditScope";
@@ -20,6 +22,26 @@ import { WebToolPack } from "./WebToolPack";
 const track = tempRoots();
 const tempRoot = async () => track(await makeCliTempWorkspace()).root;
 
+let codeHome: string;
+let realCodeHome: string | undefined;
+
+beforeAll(() => {
+  realCodeHome = process.env.AKAN_CODE_HOME;
+  codeHome = mkdtempSync(path.join(tmpdir(), "akan-code-home-"));
+  process.env.AKAN_CODE_HOME = codeHome;
+});
+
+afterAll(() => {
+  if (realCodeHome === undefined) delete process.env.AKAN_CODE_HOME;
+  else process.env.AKAN_CODE_HOME = realCodeHome;
+  rmSync(codeHome, { recursive: true, force: true });
+});
+
+const approved = (root: string) => {
+  WorkspaceTrust.approve(root, WorkspaceTrust.pending(root), false);
+  return root;
+};
+
 type ToolExecute = (
   id: string,
   params: never,
@@ -111,38 +133,18 @@ describe("TurnFeedback", () => {
 });
 
 describe("AkanVerifier.summarize", () => {
-  const scope = { paths: ["apps/a/x.ts"], apps: ["a"], libs: [], needsSync: false, touchesTsx: false };
+  test("passes the verify report through untouched", () => {
+    const output =
+      "verify fail · a · lint ok · typecheck 1 error · 4.1s\napps/a/x.ts:1:7 TS2322 Type 'string' is not assignable to type 'number'.";
+    expect(AkanVerifier.summarize({ command: "akan verify", ok: false, exitCode: 1, output })).toBe(output);
+  });
 
-  test("names the failing step and keeps only its tail", () => {
+  test("keeps only the tail of a crash that never reached the report", () => {
     const output = [...Array(100).keys()].map((n) => `line ${n}`).join("\n");
-    const text = AkanVerifier.summarize(
-      {
-        ok: false,
-        scope,
-        steps: [
-          { command: "akan lint a", ok: true, exitCode: 0, output: "" },
-          { command: "akan typecheck a", ok: false, exitCode: 1, output },
-        ],
-      },
-      { tailLines: 5 },
-    );
-    expect(text).toContain("Verification failed: akan typecheck a");
-    expect(text).toContain("Passed: akan lint a");
+    const text = AkanVerifier.summarize({ command: "akan verify", ok: false, exitCode: 1, output });
+    expect(text).toStartWith("akan verify exited 1 before reporting:");
     expect(text).toContain("line 99");
-    expect(text).not.toContain("line 10\n");
-  });
-
-  test("says so plainly when everything passed", () => {
-    const text = AkanVerifier.summarize({
-      ok: true,
-      scope,
-      steps: [{ command: "akan lint a", ok: true, exitCode: 0, output: "" }],
-    });
-    expect(text).toContain("Verification passed");
-  });
-
-  test("an untouched workspace is not a failure", () => {
-    expect(AkanVerifier.summarize({ ok: true, scope, steps: [] })).toContain("nothing to verify");
+    expect(text).not.toContain("line 79\n");
   });
 });
 
@@ -153,9 +155,11 @@ describe("AkanEditScope", () => {
     const baseline = await AkanEditScope.baseline(root);
     await writeText(path.join(root, "apps", "demo", "lib", "post", "post.service.ts"), "export {};\n");
     await writeText(path.join(root, "libs", "shared", "ui", "Card.tsx"), "export const Card = () => null;\n");
+    await writeText(path.join(root, "pkgs", "@akanjs", "cli", "index.ts"), "export {};\n");
     const scope = await AkanEditScope.since(root, baseline);
     expect(scope.apps).toEqual(["demo"]);
     expect(scope.libs).toEqual(["shared"]);
+    expect(scope.pkgs).toEqual(["@akanjs/cli"]);
     expect(scope.needsSync).toBe(true);
     expect(scope.touchesTsx).toBe(true);
   });
@@ -165,7 +169,7 @@ describe("AkanEditScope", () => {
     await Bun.spawn(["git", "init", "-q"], { cwd: root, stdout: "ignore", stderr: "ignore" }).exited;
     const baseline = await AkanEditScope.baseline(root);
     const scope = await AkanEditScope.since(root, baseline);
-    expect(scope).toEqual({ paths: [], apps: [], libs: [], needsSync: false, touchesTsx: false });
+    expect(scope).toEqual({ paths: [], apps: [], libs: [], pkgs: [], needsSync: false, touchesTsx: false });
   });
 });
 
@@ -243,33 +247,6 @@ describe("AkanEnvKeys", () => {
   });
 });
 
-describe("PreviewView", () => {
-  test("reports whether this Bun build can drive a headless page at all", () => {
-    expect(typeof PreviewView.available).toBe("boolean");
-  });
-
-  test.skipIf(!PreviewView.available)(
-    "finds an empty body and a console error on a real page",
-    async () => {
-      const server = Bun.serve({
-        port: 0,
-        fetch: () =>
-          new Response('<!doctype html><html><body></body><script>console.error("boom")</script></html>', {
-            headers: { "content-type": "text/html" },
-          }),
-      });
-      try {
-        const probe = await PreviewView.probe(`http://localhost:${server.port}/`);
-        expect(probe.pageErrors.join(" ")).toContain("rendered empty");
-        expect(probe.consoleErrors.join(" ")).toContain("boom");
-      } finally {
-        server.stop(true);
-      }
-    },
-    30_000,
-  );
-});
-
 describe("SubagentPool", () => {
   const workspace = { workspaceRoot: "/tmp/akan" } as never;
 
@@ -519,6 +496,54 @@ describe("SubagentPool", () => {
     }
   });
 
+  test("a child runs on the model its parent runs on when the task starts", async () => {
+    const { opened, spy } = openFakeAgents([]);
+    let current = { provider: "deepseek", id: "deepseek-v4-pro" };
+    try {
+      const root = SubagentPool.extensionFor({
+        workspace,
+        cwd: "/tmp/akan",
+        parent: budgeted(1_000),
+        model: () => current,
+        depth: 0,
+      });
+      await runTask(root, "c1");
+      current = { provider: "openai", id: "gpt-5.5" };
+      await runTask(root, "c2");
+      expect(opened.map((options) => options.model)).toEqual([
+        { provider: "deepseek", id: "deepseek-v4-pro" },
+        { provider: "openai", id: "gpt-5.5" },
+      ]);
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
+  test("the plugins hand their pool the owning agent's model", async () => {
+    const { opened, spy } = openFakeAgents([]);
+    try {
+      const plugins = await AkanCodePlugins.build({
+        workspace,
+        cwd: "/tmp/akan",
+        profile: budgeted(1_000),
+        apps: [],
+        canSeeImages: false,
+        model: () => ({ provider: "deepseek", id: "deepseek-v4-pro" }),
+        depth: 0,
+        currentSessionId: () => "",
+        mailbox: () => undefined,
+      });
+      await runTask(
+        plugins.extensions.find((extension) => extension.name === "akan-subagent"),
+        "c1",
+      );
+      expect(opened[0]?.model).toEqual({ provider: "deepseek", id: "deepseek-v4-pro" });
+      plugins.dispose();
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
   test("a child keeps no session and cannot ask a human", () => {
     const child = SubagentPool.childOf(codeAgentPresets.local("/tmp/akan"), "explore");
     expect(child.session).toEqual({ store: "memory", crossSession: false });
@@ -552,8 +577,20 @@ for await (const line of console) {
     return root;
   };
 
-  test("connects a declared stdio server, lists its tools and calls one", async () => {
+  test("a server the repo declares is not started until it is approved", async () => {
     const root = await withServer();
+    const notices: string[] = [];
+    const pack = await McpToolPack.connect({
+      workspaceRoot: root,
+      profile: codeAgentPresets.local(root),
+      onNotice: (message) => notices.push(message),
+    });
+    expect(pack).toBeUndefined();
+    expect(notices.join(" ")).toContain("not approved: echo");
+  });
+
+  test("connects a declared stdio server, lists its tools and calls one", async () => {
+    const root = approved(await withServer());
     const pack = await McpToolPack.connect({ workspaceRoot: root, profile: codeAgentPresets.local(root) });
     expect(pack).toBeDefined();
     try {
@@ -580,6 +617,7 @@ for await (const line of console) {
       path.join(root, ".akan", "code", "mcp.json"),
       JSON.stringify({ mcpServers: { broken: { command: "/nonexistent/binary" } } }),
     );
+    approved(root);
     const notices: string[] = [];
     const pack = await McpToolPack.connect({
       workspaceRoot: root,
@@ -654,6 +692,38 @@ describe("WebToolPack", () => {
     }
   });
 
+  test("follows a redirect only to a host the profile reaches without asking", async () => {
+    const server: ReturnType<typeof Bun.serve> = Bun.serve({
+      port: 0,
+      fetch: (request): Response => {
+        const { pathname } = new URL(request.url);
+        if (pathname === "/out") return Response.redirect("https://outside.example/page", 302);
+        if (pathname === "/in") return Response.redirect(`http://localhost:${server.port}/final`, 302);
+        if (pathname === "/loopback") return Response.redirect(`http://127.0.0.1:${server.port}/final`, 302);
+        return new Response("<p>final page</p>");
+      },
+    });
+    try {
+      const profile = codeAgentPresets.local(root);
+      const read = async (pack: WebToolPack, path: string) =>
+        await toolsOf(pack.extension()).get("web_fetch")?.("1", {
+          url: `http://localhost:${server.port}${path}`,
+        } as never);
+
+      const local = new WebToolPack({ profile });
+      expect((await read(local, "/in"))?.content[0]?.text).toContain("final page");
+      const out = await read(local, "/out");
+      expect(out?.isError).toBe(true);
+      expect(out?.content[0]?.text).toContain("Redirected to https://outside.example/page");
+
+      const narrowed = new WebToolPack({ profile: { ...profile, network: { allowHosts: ["localhost"] } } });
+      expect((await read(narrowed, "/in"))?.content[0]?.text).toContain("final page");
+      expect((await read(narrowed, "/loopback"))?.content[0]?.text).toContain(`Redirected to http://127.0.0.1:`);
+    } finally {
+      server.stop(true);
+    }
+  });
+
   test("reads a long page a window at a time, continuing from the snapshot it first read", async () => {
     let hits = 0;
     const server = Bun.serve({

package/codeAgent/tools/mcpOAuth.test.ts

@@ -239,7 +239,7 @@ describe("MCP sign-in", () => {
     expect(auth.resource).toBe(provider.mcpUrl);
     expect(provider.registrations).toHaveLength(1);
     expect(provider.registrations[0]?.redirect_uris?.[0]).toBe(auth.redirectUri);
-    expect(McpTokenStore.read("fake")?.accessToken).toBe("access-1");
+    expect(McpTokenStore.read(refOf())?.accessToken).toBe("access-1");
   });
 
   test("the token is what makes the server publish its tools", async () => {
@@ -270,23 +270,23 @@ describe("MCP sign-in", () => {
 
   test("an expired token is refreshed without anybody being asked", async () => {
     const auth = await McpSignIn.run(refOf(), { open: browser });
-    McpTokenStore.write("fake", { ...auth, expiresAt: Date.now() - 1 });
+    McpTokenStore.write(refOf(), { ...auth, expiresAt: Date.now() - 1 });
     expect(await McpSignIn.token(refOf())).toBe("access-refreshed-2");
-    expect(McpTokenStore.read("fake")?.refreshToken).toBe("refresh-2");
+    expect(McpTokenStore.read(refOf())?.refreshToken).toBe("refresh-2");
   });
 
   test("a refreshed token the server gave no lifetime is kept until refused, not refreshed on every connect", async () => {
     const auth = await McpSignIn.run(refOf(), { open: browser });
-    McpTokenStore.write("fake", { ...auth, expiresAt: Date.now() - 1 });
+    McpTokenStore.write(refOf(), { ...auth, expiresAt: Date.now() - 1 });
     provider.refreshExpiresIn = undefined;
     expect(await McpSignIn.token(refOf())).toBe("access-refreshed-2");
     expect(await McpSignIn.token(refOf())).toBe("access-refreshed-2");
-    expect(McpTokenStore.read("fake")?.expiresAt).toBeUndefined();
+    expect(McpTokenStore.read(refOf())?.expiresAt).toBeUndefined();
   });
 
   test("a refresh the server refuses reports no token rather than throwing", async () => {
     const auth = await McpSignIn.run(refOf(), { open: browser });
-    McpTokenStore.write("fake", { ...auth, expiresAt: Date.now() - 1 });
+    McpTokenStore.write(refOf(), { ...auth, expiresAt: Date.now() - 1 });
     provider.refreshable = false;
     const notices: string[] = [];
     expect(await McpSignIn.token(refOf(), (message) => notices.push(message))).toBeUndefined();
@@ -308,7 +308,7 @@ describe("MCP sign-in", () => {
     try {
       expect(pack?.status[0]).toMatchObject({ auth: "authorized" });
       expect(pack?.toolNames).toEqual(["mcp__fake__search"]);
-      expect(McpTokenStore.read("fake")).toMatchObject({
+      expect(McpTokenStore.read(refOf())).toMatchObject({
         accessToken: "access-refreshed-1",
         refreshToken: "refresh-2",
       });
@@ -365,7 +365,7 @@ describe("MCP sign-in", () => {
       expect((await search(pack)).content[0]?.text).toBe("found");
       expect(provider.refreshes).toBe(1);
       expect(provider.calls).toEqual([{ token: "access-refreshed-1", session: "session-2" }]);
-      expect(McpTokenStore.read("fake")).toMatchObject({
+      expect(McpTokenStore.read(refOf())).toMatchObject({
         accessToken: "access-refreshed-1",
         refreshToken: "refresh-2",
       });
@@ -405,7 +405,7 @@ describe("MCP sign-in", () => {
 
   test("a session connecting with an expired token while a call is refused shares one refresh with it", async () => {
     const auth = await McpSignIn.run(refOf(), { open: browser });
-    McpTokenStore.write("fake", { ...auth, expiresAt: Date.now() - 1 });
+    McpTokenStore.write(refOf(), { ...auth, expiresAt: Date.now() - 1 });
     provider.refreshDelayMs = 50;
     const tokens = await Promise.all([McpSignIn.token(refOf()), McpSignIn.retryToken(refOf(), auth.accessToken)]);
     expect(tokens).toEqual(["access-refreshed-2", "access-refreshed-2"]);
@@ -495,9 +495,23 @@ describe("MCP sign-in", () => {
 
   test("signing out forgets the token and leaves nothing behind", async () => {
     await McpSignIn.run(refOf(), { open: browser });
-    expect(McpTokenStore.clear("fake")).toBe(true);
-    expect(McpTokenStore.read("fake")).toBeUndefined();
-    expect(McpTokenStore.clear("fake")).toBe(false);
+    expect(McpTokenStore.clear(refOf())).toBe(true);
+    expect(McpTokenStore.read(refOf())).toBeUndefined();
+    expect(McpTokenStore.clear(refOf())).toBe(false);
+  });
+
+  test("signing out of a renamed server forgets the token its origin still hands it", async () => {
+    await McpSignIn.run(refOf(), { open: browser });
+    expect(McpTokenStore.read(refOf({ name: "renamed" }))?.accessToken).toBe("access-1");
+    expect(McpTokenStore.clear(refOf({ name: "renamed" }))).toBe(true);
+    expect(McpTokenStore.read(refOf({ name: "renamed" }))).toBeUndefined();
+    expect(McpTokenStore.names()).toEqual([]);
+  });
+
+  test("signing out by the name alone forgets a token whose server is no longer declared", async () => {
+    await McpSignIn.run(refOf(), { open: browser });
+    expect(McpTokenStore.clear({ name: "fake" })).toBe(true);
+    expect(McpTokenStore.read(refOf())).toBeUndefined();
   });
 });
 
@@ -514,10 +528,32 @@ describe("the token file", () => {
     expect(statSync(McpTokenStore.file()).mode & 0o777).toBe(0o600);
   });
 
+  test("a token is found by the server's origin, so the same name at another url gets none", async () => {
+    await McpSignIn.run(refOf(), { open: browser });
+    expect(await McpSignIn.token(refOf({ url: "http://127.0.0.1:9/mcp" }))).toBeUndefined();
+    expect(await McpSignIn.token(refOf({ name: "renamed" }))).toBe("access-1");
+    expect(McpTokenStore.names()).toEqual(["fake"]);
+  });
+
+  test("a file an older build keyed by name keeps its tokens at the origin they were minted for", async () => {
+    const auth = await McpSignIn.run(refOf(), { open: browser });
+    await Bun.write(
+      McpTokenStore.file(),
+      JSON.stringify({ servers: { fake: auth, broken: { ...auth, resource: "" } } }),
+    );
+    expect(McpTokenStore.read(refOf())?.accessToken).toBe("access-1");
+    expect(McpTokenStore.read(refOf({ url: "https://elsewhere.example/mcp" }))).toBeUndefined();
+    expect(McpTokenStore.names()).toEqual(["fake"]);
+    McpTokenStore.write(refOf(), { ...auth, accessToken: "access-rewritten" });
+    const saved = (await Bun.file(McpTokenStore.file()).json()) as { servers?: unknown; tokens: object };
+    expect(saved.servers).toBeUndefined();
+    expect(Object.keys(saved.tokens)).toEqual([`${provider.origin} ${provider.origin}`]);
+  });
+
   test("a corrupt file costs the sign-ins and not the session", async () => {
     await McpSignIn.run(refOf(), { open: browser });
     await Bun.write(McpTokenStore.file(), "{ not json");
-    expect(McpTokenStore.read("fake")).toBeUndefined();
+    expect(McpTokenStore.read(refOf())).toBeUndefined();
     expect(McpTokenStore.names()).toEqual([]);
   });
 });
@@ -582,7 +618,7 @@ process.exit(0);
     });
     await taken.promise;
     const retried = McpSignIn.retryToken(refOf(), auth.accessToken);
-    McpTokenStore.write("fake", { ...auth, accessToken: "access-elsewhere", refreshToken: "refresh-elsewhere" });
+    McpTokenStore.write(refOf(), { ...auth, accessToken: "access-elsewhere", refreshToken: "refresh-elsewhere" });
     released.resolve();
     await elsewhere;
     expect(await retried).toBe("access-elsewhere");

package/codeAgent/tools/mcpServerConfig.test.ts

@@ -1,8 +1,19 @@
 import { afterEach, beforeAll, describe, expect, test } from "bun:test";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  truncateSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { akanCodePaths } from "../agent/akanCodePaths";
+import { WorkspaceTrust } from "../agent/WorkspaceTrust";
 import { McpServerConfig, type McpServerScope } from "./McpServerConfig";
 
 const roots: string[] = [];
@@ -210,3 +221,121 @@ describe("MCP server config", () => {
     expect(McpServerConfig.targetOf({ name: "a", transport: "http", url: "https://x" })).toBe("https://x");
   });
 });
+
+describe("workspace trust", () => {
+  const extension = (root: string, name: string, body: string) => {
+    const file = path.join(akanCodePaths.extensionsDir(root), name);
+    mkdirSync(path.dirname(file), { recursive: true });
+    writeFileSync(file, body);
+  };
+
+  afterEach(() => {
+    rmSync(akanCodePaths.trustFile(), { force: true });
+  });
+
+  test("a repo with no servers or extensions of its own needs no approval", () => {
+    const root = workspace();
+    McpServerConfig.add(root, "home", ["https://home.example/mcp"], "global");
+    expect(WorkspaceTrust.pending(root)).toEqual([]);
+    expect(WorkspaceTrust.isTrusted(root, "mcp")).toBe(true);
+  });
+
+  test("the repo's servers and extensions wait for approval, and a remembered one stays approved", () => {
+    const root = workspace(JSON.stringify({ mcpServers: { tool: { command: "node", args: ["x.js"] } } }));
+    extension(root, "hello.ts", "export default () => {};");
+    expect(WorkspaceTrust.pending(root).map((item) => item.kind)).toEqual(["mcp", "extensions"]);
+    expect(WorkspaceTrust.pending(root)[0]?.lines).toEqual(["tool: node x.js"]);
+    WorkspaceTrust.approve(root, WorkspaceTrust.pending(root), true);
+    expect(WorkspaceTrust.pending(root)).toEqual([]);
+    expect(Object.keys(JSON.parse(readFileSync(akanCodePaths.trustFile(), "utf8")).workspaces)).toHaveLength(1);
+  });
+
+  test.skipIf(process.platform === "win32")("the trust file is readable only by its owner", () => {
+    const root = workspace(JSON.stringify({ mcpServers: { tool: { command: "node" } } }));
+    WorkspaceTrust.approve(root, WorkspaceTrust.pending(root), true);
+    expect(statSync(akanCodePaths.trustFile()).mode & 0o777).toBe(0o600);
+  });
+
+  test("a change to what was approved is asked about again", () => {
+    const root = workspace(JSON.stringify({ mcpServers: { tool: { command: "node", args: ["x.js"] } } }));
+    extension(root, "hello.ts", "export default () => {};");
+    WorkspaceTrust.approve(root, WorkspaceTrust.pending(root), true);
+    writeFileSync(
+      McpServerConfig.file(root),
+      JSON.stringify({ mcpServers: { tool: { command: "node", args: ["y.js"] } } }),
+    );
+    extension(root, "nested/more.ts", "export default () => {};");
+    expect(WorkspaceTrust.pending(root).map((item) => item.kind)).toEqual(["mcp", "extensions"]);
+    expect(WorkspaceTrust.isTrusted(root, "mcp")).toBe(false);
+  });
+
+  test("an approval that is not remembered lasts only for this process", () => {
+    const root = workspace(JSON.stringify({ mcpServers: { tool: { command: "node" } } }));
+    WorkspaceTrust.approve(root, WorkspaceTrust.pending(root), false);
+    expect(WorkspaceTrust.isTrusted(root, "mcp")).toBe(true);
+    expect(existsSync(akanCodePaths.trustFile())).toBe(false);
+  });
+
+  test("an edit made through akan code keeps the approval the content had", () => {
+    const root = workspace(JSON.stringify({ mcpServers: { tool: { command: "node" } } }));
+    WorkspaceTrust.approve(root, WorkspaceTrust.pending(root), true);
+    WorkspaceTrust.carry(root, "mcp", () =>
+      McpServerConfig.add(root, "more", ["https://more.example/mcp"], "workspace"),
+    );
+    expect(WorkspaceTrust.isTrusted(root, "mcp")).toBe(true);
+    const untrusted = workspace(JSON.stringify({ mcpServers: { tool: { command: "node" } } }));
+    WorkspaceTrust.carry(untrusted, "mcp", () => McpServerConfig.add(untrusted, "more", ["x"], "workspace"));
+    expect(WorkspaceTrust.isTrusted(untrusted, "mcp")).toBe(false);
+  });
+
+  test("a link that stays in the extensions folder is followed and checked", () => {
+    const root = workspace();
+    extension(root, "real/index.ts", "export default () => {};");
+    symlinkSync(
+      path.join(akanCodePaths.extensionsDir(root), "real"),
+      path.join(akanCodePaths.extensionsDir(root), "alias"),
+    );
+    const [item] = WorkspaceTrust.pending(root);
+    expect(item?.lines).toEqual(["alias/index.ts"]);
+    expect(item?.hash).not.toBe("");
+    WorkspaceTrust.approve(root, [item as NonNullable<typeof item>], true);
+    extension(root, "real/index.ts", "export default () => 1;");
+    expect(WorkspaceTrust.isTrusted(root, "extensions")).toBe(false);
+  });
+
+  test("a link out of the extensions folder is not followed, and an approval of that folder is never remembered", () => {
+    const root = workspace();
+    const outside = workspace();
+    writeFileSync(path.join(outside, "secret-notes.ts"), "export default () => {};");
+    extension(root, "hello.ts", "export default () => {};");
+    symlinkSync(outside, path.join(akanCodePaths.extensionsDir(root), "linked"));
+    const [item] = WorkspaceTrust.pending(root);
+    expect(item?.hash).toBe("");
+    expect(item?.lines[0]).toContain("linked links out of the folder");
+    expect(item?.lines.join("\n")).not.toContain("secret-notes");
+    WorkspaceTrust.approve(root, [item as NonNullable<typeof item>], true);
+    expect(existsSync(akanCodePaths.trustFile())).toBe(false);
+  });
+
+  test("an extensions folder past the file or byte cap is not checked, and its approval is never remembered", () => {
+    const many = workspace();
+    const modules = path.join(akanCodePaths.extensionsDir(many), "node_modules", "dep");
+    mkdirSync(modules, { recursive: true });
+    for (let index = 0; index <= 10_000; index++) writeFileSync(path.join(modules, `f${index}.js`), "");
+    const large = workspace();
+    extension(large, "big.js", "");
+    truncateSync(path.join(akanCodePaths.extensionsDir(large), "big.js"), 64 * 1024 * 1024 + 1);
+    for (const root of [many, large]) {
+      const [item] = WorkspaceTrust.pending(root);
+      expect(item?.hash).toBe("");
+      expect(item?.lines[0]).toContain("too many to check");
+      WorkspaceTrust.approve(root, [item as NonNullable<typeof item>], true);
+    }
+    expect(existsSync(akanCodePaths.trustFile())).toBe(false);
+  });
+
+  test("a disabled server needs no approval", () => {
+    const root = workspace(JSON.stringify({ mcpServers: { tool: { command: "node", disabled: true } } }));
+    expect(WorkspaceTrust.pending(root)).toEqual([]);
+  });
+});

package/commandDecorators/command.ts

@@ -436,7 +436,10 @@ export const runCommands = async (...commands: CommandCls[]) => {
           reportFailure = async (failure) =>
             await onFailure?.(failure, { usage: false, given: givenOptionsOf(allArgMetas, opt) });
           const commandArgs = [] as unknown[];
-          if (targetMeta.targetOption.runsOnWorkspaceRoot) await assertCurrentDirectoryIsWorkspaceRoot();
+          if (targetMeta.targetOption.runsOnWorkspaceRoot) {
+            await assertCurrentDirectoryIsWorkspaceRoot();
+            WorkspaceExecutor.defaultCloneToLocalEnv(process.cwd());
+          }
           const workspace = WorkspaceExecutor.fromRoot();
           const commandContext: CommandContext = { values: {} };
           for (const argMeta of allArgMetas) {

package/commandDecorators/workspaceVersionCheck.test.ts

@@ -23,14 +23,24 @@ describe("WorkspaceVersionCheck", () => {
     expect(WorkspaceVersionCheck.warning("3.1.1-rc.5", argv("sync", "demo"), await makeWorkspace({}))).toBeNull();
   });
 
-  test("names both versions and the matching CLI with the same arguments", async () => {
+  test("names both versions and the matching CLI with the same arguments, quoted for the shell it runs in", async () => {
     const root = await makeWorkspace({ akanjs: "3.1.0-rc.6" });
-
-    const warning = WorkspaceVersionCheck.warning("3.1.0", argv("sync", "demo", "--title", "it's"), root);
-
-    expect(warning).toContain("@akanjs/cli 3.1.0, but this workspace has akanjs 3.1.0-rc.6");
-    expect(warning).toContain(`Run the matching CLI: bunx -p @akanjs/cli@3.1.0-rc.6 akan sync demo --title 'it'\\''s'`);
-    expect(warning).toEndWith("together: akan update");
+    const platform = Object.getOwnPropertyDescriptor(process, "platform");
+    const warningOn = (os: NodeJS.Platform) => {
+      Object.defineProperty(process, "platform", { value: os });
+      return WorkspaceVersionCheck.warning("3.1.0", argv("sync", "demo", "--title", "it's"), root);
+    };
+    try {
+      const posix = warningOn("linux");
+      expect(posix).toContain("@akanjs/cli 3.1.0, but this workspace has akanjs 3.1.0-rc.6");
+      expect(posix).toContain(`Run the matching CLI: bunx -p @akanjs/cli@3.1.0-rc.6 akan sync demo --title 'it'\\''s'`);
+      expect(posix).toEndWith("together: akan update");
+      expect(warningOn("win32")).toContain(
+        `Run the matching CLI: bunx -p @akanjs/cli@3.1.0-rc.6 akan sync demo --title "it's"`,
+      );
+    } finally {
+      if (platform) Object.defineProperty(process, "platform", platform);
+    }
   });
 
   test("offers akan update with the CLI's prerelease tag only when the CLI is the newer one", async () => {

package/commandDecorators/workspaceVersionCheck.ts

@@ -45,6 +45,9 @@ export class WorkspaceVersionCheck {
   }
 
   static #quote(arg: string) {
-    return /^[\w@%+=:,./-]+$/.test(arg) ? arg : `'${arg.replaceAll("'", `'\\''`)}'`;
+    if (/^[\w@%+=:,./-]+$/.test(arg)) return arg;
+    //? cmd and PowerShell take neither single quotes nor '\'' as POSIX shells do.
+    if (process.platform === "win32") return `"${arg.replaceAll('"', '\\"')}"`;
+    return `'${arg.replaceAll("'", `'\\''`)}'`;
   }
 }