@gajae-code/coding-agent 0.16.1 → 0.16.4

package/src/defaults/gjc/extensions/grok-cli-vendor/src/provider/register.ts

@@ -7,7 +7,12 @@ import { Effort } from '@gajae-code/ai/model-thinking';
 import type { OAuthCredentials, OAuthLoginCallbacks } from '@gajae-code/ai/utils/oauth/types';
 import { loginXai, refreshXaiToken, XAI_OAUTH_SCOPE } from '@gajae-code/ai/utils/oauth/xai';
 import type { ExtensionAPI, ProviderConfig } from '@gajae-code/coding-agent';
-import { type GrokCliModelConfig, resolveModels } from '../models/catalog.js';
+import {
+  type GrokCliModelConfig,
+  getMaxReasoningEffort,
+  resolveModels,
+  supportsReasoningEffort,
+} from '../models/catalog.js';
 import { sanitizePayload } from '../payload/sanitize.js';
 import { getBaseUrl, isGrokBuildBaseUrlOverrideIgnored } from '../shared/base-url.js';
 import { streamGrokCli } from './stream.js';
@@ -38,7 +43,7 @@ export default function registerGrokCli(api: ExtensionAPI) {
       thinking: m.reasoning
         ? {
             minLevel: Effort.Low,
-            maxLevel: m.maxReasoningEffort ?? Effort.XHigh,
+            maxLevel: getMaxReasoningEffort(m.id) ?? Effort.XHigh,
             mode: 'effort',
           }
         : undefined,
@@ -46,6 +51,12 @@ export default function registerGrokCli(api: ExtensionAPI) {
       cost: m.cost,
       contextWindow: m.contextWindow,
       maxTokens: m.maxTokens,
+      // cli-chat-proxy is not a generic audited OpenAI origin. Carry only the
+      // catalog's model-scoped evidence into core reasoning request gating.
+      compat:
+        m.reasoning && supportsReasoningEffort(m.id)
+          ? { supportsReasoningEffort: true }
+          : undefined,
     })),
     oauth: {
       name: 'Grok Build',

package/src/discovery/builtin.ts

@@ -321,7 +321,9 @@ registerProvider<SystemPrompt>(systemPromptCapability.id, {
 // Skills
 async function loadSkills(ctx: LoadContext): Promise<LoadResult<Skill>> {
 	// Walk up from cwd finding .gjc/skills/ in ancestors (closest first)
-	const ancestors = getAncestorDirs(ctx.cwd, ctx.repoRoot ?? ctx.home);
+	const ancestors = getAncestorDirs(ctx.cwd, ctx.repoRoot ?? ctx.home).filter(
+		({ dir }) => path.resolve(dir) !== path.resolve(ctx.home),
+	);
 	const projectScans = ancestors.flatMap(({ dir }) =>
 		getProjectConfigDirs().map(projectConfigDir =>
 			scanSkillsFromDir(ctx, {
@@ -334,14 +336,21 @@ async function loadSkills(ctx: LoadContext): Promise<LoadResult<Skill>> {
 	);
 
 	// User-level scan from the active agent-directory profile.
-	const userScans = [
+	const userSkillDirs = [
+		...new Set([
+			path.join(resolveUserAgentDir(ctx), "skills"),
+			path.join(ctx.home, PATHS.userBase, "skills"),
+			path.join(ctx.home, ".gjc", "skills"),
+		]),
+	];
+	const userScans = userSkillDirs.map(dir =>
 		scanSkillsFromDir(ctx, {
-			dir: path.join(resolveUserAgentDir(ctx), "skills"),
+			dir,
 			providerId: PROVIDER_ID,
 			level: "user",
 			requireDescription: true,
 		}),
-	];
+	);
 
 	const results = await Promise.all([...projectScans, ...userScans]);
 

package/src/discovery/claude-plugins.ts

@@ -17,6 +17,7 @@ import { rootContainsGjcManifest } from "../extensibility/gjc-plugins";
 import {
 	type ClaudePluginRoot,
 	createSourceMeta,
+	invalidateClaudePluginRoots,
 	listClaudePluginRoots,
 	loadFilesFromDir,
 	scanSkillsFromDir,
@@ -95,12 +96,15 @@ async function resolvePluginDir(
 async function listNonGjcPluginRoots(
 	home: string,
 	cwd: string,
+	allowedLevels: ReadonlySet<"user" | "project"> = new Set(["user", "project"]),
 ): Promise<{ roots: ClaudePluginRoot[]; warnings: string[] }> {
+	await invalidateClaudePluginRoots(home, cwd);
 	const { roots, warnings } = await listClaudePluginRoots(home, cwd);
 	const filteredRoots: ClaudePluginRoot[] = [];
-	const filteredWarnings = [...warnings];
+	const filteredWarnings = allowedLevels.size === 2 ? [...warnings] : [];
 
 	for (const root of roots) {
+		if (!allowedLevels.has(root.scope)) continue;
 		if (await rootContainsGjcManifest(root.path)) {
 			filteredWarnings.push(`[claude-plugins] Skipping gajae-code plugin root (binding-only): ${root.path}`);
 			continue;
@@ -115,11 +119,14 @@ async function listNonGjcPluginRoots(
 // Skills
 // =============================================================================
 
-async function loadSkills(ctx: LoadContext): Promise<LoadResult<Skill>> {
+export async function loadMarketplaceSkills(
+	ctx: LoadContext,
+	allowedLevels: ReadonlySet<"user" | "project"> = new Set(["user", "project"]),
+): Promise<LoadResult<Skill>> {
 	const items: Skill[] = [];
 	const warnings: string[] = [];
 
-	const { roots, warnings: rootWarnings } = await listNonGjcPluginRoots(ctx.home, ctx.cwd);
+	const { roots, warnings: rootWarnings } = await listNonGjcPluginRoots(ctx.home, ctx.cwd, allowedLevels);
 	warnings.push(...rootWarnings);
 
 	const results = await Promise.all(
@@ -129,6 +136,7 @@ async function loadSkills(ctx: LoadContext): Promise<LoadResult<Skill>> {
 				dir: skillsDir,
 				providerId: PROVIDER_ID,
 				level: root.scope,
+				requireDescription: true,
 			});
 			return { root, result, warning };
 		}),
@@ -371,7 +379,7 @@ registerProvider<Skill>(skillCapability.id, {
 	displayName: DISPLAY_NAME,
 	description: "Load skills from GJC marketplace plugins",
 	priority: PRIORITY,
-	load: loadSkills,
+	load: loadMarketplaceSkills,
 });
 
 registerProvider<SlashCommand>(slashCommandCapability.id, {

package/src/discovery/helpers.ts

@@ -852,6 +852,14 @@ export async function resolveOrDefaultProjectRegistryPath(cwd: string): Promise<
 
 const pluginRootsCache = new Map<string, { roots: ClaudePluginRoot[]; warnings: string[] }>();
 
+/** Invalidate the exact user/project registry pair and their resolved-root cache entry. */
+export async function invalidateClaudePluginRoots(home: string, cwd?: string): Promise<void> {
+	const resolvedProjectPath = cwd ? await resolveActiveProjectRegistryPath(cwd) : null;
+	invalidateFsCache(path.join(getPluginsDir(home), "installed_plugins.json"));
+	if (resolvedProjectPath) invalidateFsCache(resolvedProjectPath);
+	pluginRootsCache.delete(`${home}:${resolvedProjectPath ?? ""}`);
+}
+
 /**
  * List installed GJC plugin roots from the GJC plugin registry and, when present,
  * the nearest project-scoped registry resolved from `cwd`.
@@ -885,7 +893,7 @@ export async function listClaudePluginRoots(
 				if (!Array.isArray(entries) || entries.length === 0) continue;
 
 				const atIndex = pluginId.lastIndexOf("@");
-				if (atIndex === -1) {
+				if (atIndex <= 0 || atIndex === pluginId.length - 1) {
 					warnings.push(`Invalid plugin ID format (missing @marketplace): ${pluginId}`);
 					continue;
 				}
@@ -927,7 +935,7 @@ export async function listClaudePluginRoots(
 				for (const [pluginId, entries] of Object.entries(projectRegistry.plugins)) {
 					if (!Array.isArray(entries) || entries.length === 0) continue;
 					const atIndex = pluginId.lastIndexOf("@");
-					if (atIndex === -1) {
+					if (atIndex <= 0 || atIndex === pluginId.length - 1) {
 						warnings.push(`Invalid plugin ID format (missing @marketplace): ${pluginId}`);
 						continue;
 					}

package/src/extensibility/gjc-plugins/compiler.ts

@@ -1,8 +1,10 @@
 import { createHash } from "node:crypto";
+import * as nodeFs from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { parseFrontmatter, pathIsWithin } from "@gajae-code/utils";
-import { readSchemaDeclaration, schemaHash } from "./metadata";
+import { classifyStdioInvocation } from "./mcp-policy";
+import { canonicalizeJsonSchema, extractDeclaredToolSchema, schemaHash } from "./metadata";
 import { resolveWithinRoot } from "./paths";
 import { parseManifest, parseSubskillFrontmatter } from "./schema";
 import {
@@ -10,6 +12,7 @@ import {
 	type GjcPluginAppendixManifestEntry,
 	GjcPluginLoadError,
 	type GjcPluginMcpManifestEntry,
+	type JsonSchema202012,
 	type NormalizedAgentAppendixSurface,
 	type NormalizedAppendixSurface,
 	type NormalizedGjcPluginBundle,
@@ -22,6 +25,101 @@ import {
 } from "./types";
 import { validateBinding } from "./validation";
 
+const PLUGIN_FILE_MAX_BYTES = 16 * 1024 * 1024;
+const PLUGIN_MANIFEST_MAX_BYTES = PLUGIN_FILE_MAX_BYTES;
+const PLUGIN_FILE_OPEN_FLAGS =
+	nodeFs.constants.O_RDONLY | (process.platform === "win32" ? 0 : (nodeFs.constants.O_NOFOLLOW ?? 0));
+
+interface FileIdentity {
+	dev: bigint;
+	ino: bigint;
+}
+
+interface FileAuthority {
+	path: string;
+	realPath: string;
+	identity: FileIdentity;
+}
+
+interface ManifestSnapshot {
+	bytes: Buffer;
+	json: unknown;
+}
+
+function sameIdentity(left: FileIdentity, right: FileIdentity): boolean {
+	return left.dev === right.dev && left.ino === right.ino;
+}
+
+function errorCode(error: unknown): string | undefined {
+	return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string"
+		? error.code
+		: undefined;
+}
+
+function tooLarge(rel: string, maxBytes: number): GjcPluginLoadError {
+	return new GjcPluginLoadError("security_policy", `GJC plugin file exceeds ${maxBytes} bytes: ${rel}`);
+}
+
+async function readBoundedFile(file: FileAuthority, rel: string, maxBytes: number): Promise<Buffer> {
+	let handle: fs.FileHandle;
+	try {
+		handle = await fs.open(file.path, PLUGIN_FILE_OPEN_FLAGS);
+	} catch (error) {
+		if (errorCode(error) === "ELOOP") {
+			throw new GjcPluginLoadError("security_policy", `GJC plugin path became a symlink before opening: ${rel}`, {
+				cause: error instanceof Error ? error : undefined,
+			});
+		}
+		throw error;
+	}
+	try {
+		const before = await handle.stat({ bigint: true });
+		if (!before.isFile()) {
+			throw new GjcPluginLoadError("security_policy", `GJC plugin path is not a regular file: ${rel}`);
+		}
+		if (!sameIdentity(file.identity, before)) {
+			throw new GjcPluginLoadError("security_policy", `GJC plugin file changed before opening: ${rel}`);
+		}
+		const [settledRealPath, settledPath] = await Promise.all([
+			fs.realpath(file.path),
+			fs.lstat(file.path, { bigint: true }),
+		]);
+		if (
+			settledRealPath !== file.realPath ||
+			settledPath.isSymbolicLink() ||
+			!settledPath.isFile() ||
+			!sameIdentity(settledPath, before)
+		) {
+			throw new GjcPluginLoadError("security_policy", `GJC plugin file changed before reading: ${rel}`);
+		}
+		if (before.size > BigInt(maxBytes)) throw tooLarge(rel, maxBytes);
+		const chunks: Buffer[] = [];
+		let offset = 0;
+		for (;;) {
+			const remaining = maxBytes + 1 - offset;
+			if (remaining <= 0) throw tooLarge(rel, maxBytes);
+			const chunk = Buffer.allocUnsafe(Math.min(1024 * 1024, remaining));
+			const { bytesRead } = await handle.read(chunk, 0, chunk.byteLength, offset);
+			if (bytesRead === 0) break;
+			chunks.push(chunk.subarray(0, bytesRead));
+			offset += bytesRead;
+		}
+		const after = await handle.stat({ bigint: true });
+		if (
+			!sameIdentity(before, after) ||
+			before.size !== after.size ||
+			before.mtimeNs !== after.mtimeNs ||
+			before.ctimeNs !== after.ctimeNs ||
+			BigInt(offset) !== after.size
+		) {
+			throw new GjcPluginLoadError("security_policy", `GJC plugin file changed while reading: ${rel}`);
+		}
+		return Buffer.concat(chunks, offset);
+	} finally {
+		await handle.close();
+	}
+}
+
 function sha256(bytes: Buffer | string): string {
 	return createHash("sha256").update(bytes).digest("hex");
 }
@@ -43,17 +141,19 @@ export const surfaceIds = {
 		`subskill-tool:${parent}:${phase}:${activationArg}:${relativePath}`,
 } as const;
 
-async function readManifestJson(filePath: string): Promise<unknown> {
-	let text: string;
+async function readManifestSnapshot(pluginRoot: string, filePath: string): Promise<ManifestSnapshot> {
+	let bytes: Buffer;
 	try {
-		text = await fs.readFile(filePath, "utf8");
+		const file = await resolveDeclaredFile(pluginRoot, GJC_PLUGIN_MANIFEST_FILENAME);
+		bytes = await readBoundedFile(file, GJC_PLUGIN_MANIFEST_FILENAME, PLUGIN_MANIFEST_MAX_BYTES);
 	} catch (error) {
+		if (error instanceof GjcPluginLoadError && error.code !== "missing_file") throw error;
 		throw new GjcPluginLoadError("missing_file", `Missing GJC plugin manifest at ${filePath}`, {
 			cause: error instanceof Error ? error : undefined,
 		});
 	}
 	try {
-		return JSON.parse(text) as unknown;
+		return { bytes, json: JSON.parse(bytes.toString("utf8")) as unknown };
 	} catch (error) {
 		throw new GjcPluginLoadError("invalid_manifest", `Invalid GJC plugin manifest JSON at ${filePath}`, {
 			cause: error instanceof Error ? error : undefined,
@@ -61,37 +161,64 @@ async function readManifestJson(filePath: string): Promise<unknown> {
 	}
 }
 
+async function resolveDeclaredDirectory(pluginRoot: string, rel: string): Promise<string> {
+	const resolved = resolveWithinRoot(pluginRoot, rel || ".");
+	let stat: Awaited<ReturnType<typeof fs.lstat>>;
+	try {
+		stat = await fs.lstat(resolved);
+	} catch (error) {
+		throw new GjcPluginLoadError("missing_file", `Missing GJC plugin directory at ${resolved}`, {
+			cause: error instanceof Error ? error : undefined,
+		});
+	}
+	if (!stat.isDirectory()) {
+		throw new GjcPluginLoadError("security_policy", `GJC plugin cwd must be a real directory: ${rel || "."}`);
+	}
+	const [realRoot, real] = await Promise.all([fs.realpath(pluginRoot), fs.realpath(resolved)]);
+	if (real !== realRoot && !pathIsWithin(realRoot, real)) {
+		throw new GjcPluginLoadError("security_policy", `GJC plugin cwd escapes root via symlink: ${rel || "."}`);
+	}
+	return resolved;
+}
+
 /**
  * Resolve a declared relative path, rejecting lexical escapes AND symlink
  * escapes out of the plugin root. Never imports the file.
  */
-async function resolveDeclaredFile(pluginRoot: string, rel: string): Promise<string> {
+async function resolveDeclaredFile(pluginRoot: string, rel: string): Promise<FileAuthority> {
 	const resolved = resolveWithinRoot(pluginRoot, rel);
-	let real: string;
+	let realRoot: string;
+	let realPath: string;
+	let stat: nodeFs.BigIntStats;
 	try {
-		real = await fs.realpath(resolved);
+		realRoot = await fs.realpath(pluginRoot);
+		realPath = await fs.realpath(resolved);
+		stat = await fs.lstat(resolved, { bigint: true });
 	} catch (error) {
 		throw new GjcPluginLoadError("missing_file", `Missing GJC plugin file at ${resolved}`, {
 			cause: error instanceof Error ? error : undefined,
 		});
 	}
-	const realRoot = await fs.realpath(pluginRoot);
-	if (!pathIsWithin(realRoot, real)) {
+	if (!pathIsWithin(realRoot, realPath)) {
 		throw new GjcPluginLoadError("security_policy", `GJC plugin file escapes root via symlink: ${rel}`);
 	}
-	return resolved;
+	if (stat.isSymbolicLink() || !stat.isFile()) {
+		throw new GjcPluginLoadError("security_policy", `GJC plugin path must be a real file: ${rel}`);
+	}
+	return { path: resolved, realPath, identity: stat };
 }
 
 async function hashFile(
-	absPath: string,
+	file: FileAuthority,
 	rel: string,
 	declaredSha?: string,
-): Promise<{ sha256: string; bytes: number }> {
+): Promise<{ sha256: string; bytes: number; content: Buffer }> {
 	let buf: Buffer;
 	try {
-		buf = await fs.readFile(absPath);
+		buf = await readBoundedFile(file, rel, PLUGIN_FILE_MAX_BYTES);
 	} catch (error) {
-		throw new GjcPluginLoadError("missing_file", `Missing GJC plugin file at ${absPath}`, {
+		if (error instanceof GjcPluginLoadError) throw error;
+		throw new GjcPluginLoadError("missing_file", `Missing GJC plugin file at ${file.path}`, {
 			cause: error instanceof Error ? error : undefined,
 		});
 	}
@@ -99,7 +226,38 @@ async function hashFile(
 	if (declaredSha !== undefined && declaredSha.toLowerCase() !== digest) {
 		throw new GjcPluginLoadError("hash_mismatch", `GJC plugin file hash mismatch for ${rel}`);
 	}
-	return { sha256: digest, bytes: buf.byteLength };
+	return { sha256: digest, bytes: buf.byteLength, content: buf };
+}
+
+function schemaFromSnapshots(
+	declaration: unknown,
+	sourceBytes: Buffer,
+	schemaFile?: { relativePath: string; bytes: Buffer },
+): JsonSchema202012 {
+	if (schemaFile !== undefined) {
+		try {
+			return canonicalizeJsonSchema(JSON.parse(schemaFile.bytes.toString("utf8")) as unknown);
+		} catch (error) {
+			if (error instanceof GjcPluginLoadError) throw error;
+			throw new GjcPluginLoadError(
+				"invalid_schema",
+				`Invalid JSON Schema declaration at ${schemaFile.relativePath}`,
+				{
+					cause: error instanceof Error ? error : undefined,
+				},
+			);
+		}
+	}
+	if (declaration !== undefined) return canonicalizeJsonSchema(declaration);
+	try {
+		return extractDeclaredToolSchema(sourceBytes.toString("utf8"));
+	} catch (error) {
+		if (error instanceof GjcPluginLoadError) throw error;
+		throw new GjcPluginLoadError(
+			"invalid_schema",
+			`Tool parameters schema is not statically readable: ${error instanceof Error ? error.message : String(error)}`,
+		);
+	}
 }
 
 function mcpConfigHash(entry: GjcPluginMcpManifestEntry): string {
@@ -141,8 +299,8 @@ async function compileAppendix(
 		return { contentHash: digest, bytes: Buffer.byteLength(content), content };
 	}
 	const rel = entry.path as string;
-	const abs = await resolveDeclaredFile(pluginRoot, rel);
-	const { sha256: digest, bytes } = await hashFile(abs, rel, entry.sha256);
+	const file = await resolveDeclaredFile(pluginRoot, rel);
+	const { sha256: digest, bytes } = await hashFile(file, rel, entry.sha256);
 	if (bytes === 0) {
 		throw new GjcPluginLoadError("invalid_appendix", `Invalid GJC plugin ${field}: file is empty`);
 	}
@@ -158,40 +316,34 @@ async function compileAppendix(
 export async function compileGjcPluginBundle(root: string): Promise<NormalizedGjcPluginBundle> {
 	const pluginRoot = path.resolve(root);
 	const manifestPath = path.join(pluginRoot, GJC_PLUGIN_MANIFEST_FILENAME);
-	const manifest = parseManifest(await readManifestJson(manifestPath), manifestPath);
+	const manifestSnapshot = await readManifestSnapshot(pluginRoot, manifestPath);
+	const manifest = parseManifest(manifestSnapshot.json, manifestPath);
 
 	const files = new Map<string, { sha256: string; bytes: number }>();
 	const manifestSubskillTools = manifest.tools.filter(tool => tool.surface === "subskill");
 	const manifestSubskillFiles = new Map<string, { name: string; sha256: string }>();
 	for (const tool of manifestSubskillTools) {
-		const abs = await resolveDeclaredFile(pluginRoot, tool.path);
-		const { sha256: digest, bytes } = await hashFile(abs, tool.path, tool.sha256);
+		const file = await resolveDeclaredFile(pluginRoot, tool.path);
+		const { sha256: digest, bytes } = await hashFile(file, tool.path, tool.sha256);
 		files.set(tool.path, { sha256: digest, bytes });
 		manifestSubskillFiles.set(tool.path, { name: tool.name, sha256: digest });
 	}
 
 	const subskills: NormalizedSubskillSurface[] = [];
 	for (const rel of manifest.subskills) {
-		const abs = await resolveDeclaredFile(pluginRoot, rel);
-		const { sha256: digest, bytes } = await hashFile(abs, rel);
+		const file = await resolveDeclaredFile(pluginRoot, rel);
+		const { sha256: digest, bytes, content: contentBytes } = await hashFile(file, rel);
 		files.set(rel, { sha256: digest, bytes });
-		let content: string;
-		try {
-			content = await fs.readFile(abs, "utf8");
-		} catch (error) {
-			throw new GjcPluginLoadError("missing_file", `Missing GJC sub-skill file at ${abs}`, {
-				cause: error instanceof Error ? error : undefined,
-			});
-		}
+		const content = contentBytes.toString("utf8");
 		let parsed: { frontmatter: Record<string, unknown>; body: string };
 		try {
-			parsed = parseFrontmatter(content, { source: abs, level: "fatal" });
+			parsed = parseFrontmatter(content, { source: file.path, level: "fatal" });
 		} catch (error) {
-			throw new GjcPluginLoadError("invalid_frontmatter", `Invalid GJC sub-skill frontmatter at ${abs}`, {
+			throw new GjcPluginLoadError("invalid_frontmatter", `Invalid GJC sub-skill frontmatter at ${file.path}`, {
 				cause: error instanceof Error ? error : undefined,
 			});
 		}
-		const fm = parseSubskillFrontmatter(parsed.frontmatter, abs);
+		const fm = parseSubskillFrontmatter(parsed.frontmatter, file.path);
 		validateBinding(fm);
 		// Subskill-scoped frontmatter tools are hashed for copy-ownership and
 		// escape checks (the loader resolves these at runtime).
@@ -212,8 +364,8 @@ export async function compileGjcPluginBundle(root: string): Promise<NormalizedGj
 		}
 		for (const toolRel of fmToolPaths) {
 			if (toolRel.trim().length === 0) continue;
-			const toolAbs = await resolveDeclaredFile(pluginRoot, toolRel);
-			const { sha256: toolDigest, bytes: toolBytes } = await hashFile(toolAbs, toolRel);
+			const toolFile = await resolveDeclaredFile(pluginRoot, toolRel);
+			const { sha256: toolDigest, bytes: toolBytes } = await hashFile(toolFile, toolRel);
 			files.set(toolRel, { sha256: toolDigest, bytes: toolBytes });
 			const extensionId = surfaceIds.subskillTool(fm.binds_to, fm.phase, fm.activation_arg, toolRel);
 			if (seenToolRefs.has(extensionId)) continue;
@@ -238,18 +390,18 @@ export async function compileGjcPluginBundle(root: string): Promise<NormalizedGj
 	// surface; legacy string shorthand stays subskill-scoped (loader-handled).
 	const tools: NormalizedToolSurface[] = [];
 	for (const tool of manifest.tools) {
-		const abs = await resolveDeclaredFile(pluginRoot, tool.path);
-		const { sha256: digest, bytes } = await hashFile(abs, tool.path, tool.sha256);
+		const file = await resolveDeclaredFile(pluginRoot, tool.path);
+		const { sha256: digest, bytes, content: sourceBytes } = await hashFile(file, tool.path, tool.sha256);
 		files.set(tool.path, { sha256: digest, bytes });
 		if (tool.surface !== "always-on") continue;
-		let schemaPath: string | undefined;
+		let schemaFileSnapshot: { relativePath: string; bytes: Buffer } | undefined;
 		if (tool.schemaPath !== undefined) {
-			const schemaAbs = await resolveDeclaredFile(pluginRoot, tool.schemaPath);
-			const schemaFile = await hashFile(schemaAbs, tool.schemaPath);
-			files.set(tool.schemaPath, schemaFile);
-			schemaPath = tool.schemaPath;
+			const schemaFile = await resolveDeclaredFile(pluginRoot, tool.schemaPath);
+			const { sha256: schemaDigest, bytes: schemaBytes, content } = await hashFile(schemaFile, tool.schemaPath);
+			files.set(tool.schemaPath, { sha256: schemaDigest, bytes: schemaBytes });
+			schemaFileSnapshot = { relativePath: tool.schemaPath, bytes: content };
 		}
-		const schema = await readSchemaDeclaration(pluginRoot, abs, tool.schema, schemaPath);
+		const schema = schemaFromSnapshots(tool.schema, sourceBytes, schemaFileSnapshot);
 		tools.push({
 			extensionId: surfaceIds.tool(tool.name),
 			name: tool.name,
@@ -267,8 +419,8 @@ export async function compileGjcPluginBundle(root: string): Promise<NormalizedGj
 	for (const hook of manifest.hooks) {
 		// Path safety first: resolve/hash before semantic checks so traversal and
 		// missing-file failures take precedence over contract validation.
-		const abs = await resolveDeclaredFile(pluginRoot, hook.path);
-		const { sha256: digest, bytes } = await hashFile(abs, hook.path, hook.sha256);
+		const file = await resolveDeclaredFile(pluginRoot, hook.path);
+		const { sha256: digest, bytes } = await hashFile(file, hook.path, hook.sha256);
 		files.set(hook.path, { sha256: digest, bytes });
 		// Minimal compile-time hook contract: tool_call hooks must name a target
 		// and a before/after phase so the constrained runner (M3/M4) can bind them.
@@ -320,17 +472,15 @@ export async function compileGjcPluginBundle(root: string): Promise<NormalizedGj
 				`GJC plugin MCP "${entry.name}": ${entry.transport} requires a url`,
 			);
 		}
-		// Hash bundled stdio script args (relative file paths) so the registry owns
-		// their copied-file boundary. Path/security failures must propagate, not be
-		// swallowed, so traversal/symlink-escape/missing bundled files fail compile.
-		for (const arg of entry.args ?? []) {
-			// Skip flags (e.g. "--port", "-v"); only treat clearly path-like args as
-			// bundled files subject to root confinement.
-			if (arg.startsWith("-")) continue;
-			if (!arg.startsWith(".") && !arg.includes("/")) continue;
-			const abs = await resolveDeclaredFile(pluginRoot, arg);
-			const { sha256: digest, bytes } = await hashFile(abs, arg, undefined);
-			files.set(arg, { sha256: digest, bytes });
+		// Derive ownership from the same cwd-aware bare Node/Bun grammar used at runtime.
+		if (entry.transport === "stdio") {
+			const invocation = classifyStdioInvocation(entry, { pluginRoot });
+			await resolveDeclaredDirectory(pluginRoot, path.relative(pluginRoot, invocation.cwd));
+			for (const relativePath of new Set(invocation.ownedRelativePaths)) {
+				const file = await resolveDeclaredFile(pluginRoot, relativePath);
+				const { sha256: digest, bytes } = await hashFile(file, relativePath, undefined);
+				files.set(relativePath, { sha256: digest, bytes });
+			}
 		}
 		mcps.push({
 			extensionId: surfaceIds.mcp(entry.name),
@@ -377,7 +527,7 @@ export async function compileGjcPluginBundle(root: string): Promise<NormalizedGj
 		agentAppendices,
 	};
 
-	const manifestBytes = await fs.readFile(manifestPath);
+	const manifestBytes = manifestSnapshot.bytes;
 	const manifestHash = sha256(manifestBytes);
 
 	const copiedFiles = [...files.entries()]

package/src/extensibility/gjc-plugins/installer.ts

@@ -5,7 +5,8 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { gunzipSync } from "node:zlib";
 import { compileGjcPluginBundle } from "./compiler";
-import { gjcPluginProjectRoot, gjcPluginUserRoot } from "./paths";
+import { classifyStdioInvocation } from "./mcp-policy";
+import { gjcPluginInstallRoot, gjcPluginProjectRoot, gjcPluginSafeDirectoryName, gjcPluginUserRoot } from "./paths";
 import { readRegistry, sortRegistryEntries, withRegistryLock, writeRegistryUnlocked } from "./registry";
 import {
 	GJC_PLUGIN_MANIFEST_FILENAME,
@@ -64,14 +65,6 @@ function scopeRoot(scope: GjcPluginScope, cwd: string): string {
 	return scope === "user" ? gjcPluginUserRoot() : gjcPluginProjectRoot(cwd);
 }
 
-function safeDirSegment(name: string): string {
-	const seg = name.replace(/[^a-zA-Z0-9._-]/g, "-").replace(/^-+|-+$/g, "");
-	if (!seg || seg === "." || seg === "..") {
-		throw new GjcPluginLoadError("invalid_manifest", `GJC plugin name is not a safe directory segment: ${name}`);
-	}
-	return seg;
-}
-
 async function isDirectory(p: string): Promise<boolean> {
 	try {
 		return (await fs.stat(p)).isDirectory();
@@ -392,6 +385,14 @@ function sha256(buf: Buffer): string {
  * copied, so the installed tree equals the validated set.
  */
 async function copyValidatedFiles(bundle: NormalizedGjcPluginBundle, stagingDir: string): Promise<void> {
+	const cwdPaths = new Set(
+		bundle.surfaces.mcps.flatMap(surface => {
+			if (surface.transport !== "stdio") return [];
+			const invocation = classifyStdioInvocation(surface.config, { pluginRoot: bundle.root });
+			return [path.relative(bundle.root, invocation.cwd)];
+		}),
+	);
+	for (const cwdPath of cwdPaths) await fs.mkdir(path.join(stagingDir, cwdPath), { recursive: true });
 	for (const file of bundle.files) {
 		const src = path.join(bundle.root, file.relativePath);
 		const lst = await fs.lstat(src);
@@ -438,9 +439,9 @@ export async function runGjcBundleTransaction(
 		// lock roots or sweep installation remnants.
 		const bundle = await compileGjcPluginBundle(resolved.dir);
 		validateInstallPlan(bundle, []);
-		const dirName = safeDirSegment(bundle.name);
+		const dirName = gjcPluginSafeDirectoryName(bundle.name);
 		const root = scopeRoot(options.scope, options.cwd);
-		const finalDir = path.join(root, dirName);
+		const finalDir = gjcPluginInstallRoot(options.scope, options.cwd, bundle.name);
 
 		// Lock-free refusal preflight. Acquiring a scope lock creates the scope
 		// root and mutates directory metadata, so a create-only refusal must be
@@ -578,7 +579,7 @@ export function candidateRegistryEntry(
 	source: GjcPluginRegistrySource,
 	now: string,
 ): GjcPluginRegistryEntry {
-	const finalDir = path.join(scopeRoot(scope, cwd), safeDirSegment(bundle.name));
+	const finalDir = gjcPluginInstallRoot(scope, cwd, bundle.name);
 	return bundleToRegistryEntry(bundle, finalDir, scope, source, now);
 }