@miphamai/cli 0.50.0 → 0.51.0

package/bin/mipham.ts

@@ -530,9 +530,6 @@ async function runAgentCLI(): Promise<boolean> {
   if (args[0] !== 'agents' && args[0] !== 'agent') return false
 
   const { getPort, getDaemonStatus } = await import('../src/daemon/index')
-  const { join } = await import('node:path')
-  const { readFileSync, existsSync } = await import('node:fs')
-  const { homedir } = await import('node:os')
 
   // Check if daemon is running
   const status = getDaemonStatus()
@@ -542,11 +539,6 @@ async function runAgentCLI(): Promise<boolean> {
   }
 
   const port = getPort()
-  const tokenPath = join(homedir(), '.mipham', 'daemon.token')
-  let token = ''
-  if (existsSync(tokenPath)) {
-    token = readFileSync(tokenPath, 'utf-8').trim()
-  }
 
   const baseUrl = `http://127.0.0.1:${port}`
 
@@ -1020,7 +1012,7 @@ async function runTokenCLI(): Promise<boolean> {
   if (args[0] !== 'token') return false
 
   const { join } = await import('node:path')
-  const { readFileSync, existsSync } = await import('node:fs')
+  const { existsSync } = await import('node:fs')
   const { homedir } = await import('node:os')
   const { rotateToken, listTokens } = await import('../src/daemon/auth')
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/skills/standard/web-access/references/cdp-api.md

@@ -3,9 +3,10 @@
 ## 基础信息
 
 - 地址：`http://localhost:3456`
-- 启动：`node ~/.claude/skills/web-access/scripts/cdp-proxy.mjs &`
+- 启动：`node ~/.mipham/skills/web-access/scripts/cdp-proxy.mjs &`
 - 启动后持续运行，不建议主动停止（重启需 Chrome 重新授权）
 - 强制停止：`pkill -f cdp-proxy.mjs`
+- 鉴权：除 `/health` 外，所有端点要求请求头 `X-CDP-Token`，值 = `~/.mipham/skills/web-access/.cdp-token` 的内容（下方示例省略此头）
 
 ## API 端点
 

package/skills/standard/web-access/scripts/cdp-proxy.mjs

@@ -4,11 +4,12 @@
 // Node.js 22+（使用原生 WebSocket）
 
 import http from 'node:http'
-import { URL } from 'node:url'
+import { URL, fileURLToPath } from 'node:url'
 import fs from 'node:fs'
 import path from 'node:path'
 import os from 'node:os'
 import net from 'node:net'
+import crypto from 'node:crypto'
 
 const PORT = parseInt(process.env.CDP_PROXY_PORT || '3456')
 let ws = null
@@ -19,6 +20,56 @@ const managedTabs = new Map() // targetId -> { lastAccessed: number }
 const TAB_IDLE_TIMEOUT = parseInt(process.env.CDP_TAB_IDLE_TIMEOUT || '900000') // 15 min default
 const CLEANUP_INTERVAL = 60000 // sweep every 60s
 
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const TOKEN_FILE = path.join(ROOT, '.cdp-token')
+
+// --- 共享密钥鉴权 ---
+// 防御浏览器 CSRF 到 localhost：恶意网页能 fetch 127.0.0.1:3456，但读不到本文件。
+let authToken = null
+function readToken() {
+  try {
+    const t = fs.readFileSync(TOKEN_FILE, 'utf-8').trim()
+    if (t) return t
+  } catch {
+    /* 尚未生成 */
+  }
+  return null
+}
+function ensureToken() {
+  const existing = readToken()
+  if (existing) {
+    authToken = existing
+    return existing
+  }
+  authToken = crypto.randomBytes(32).toString('hex')
+  try {
+    fs.writeFileSync(TOKEN_FILE, authToken, { mode: 0o600 })
+  } catch {
+    /* 无写权限时仅内存持有，进程存活期内仍可鉴权 */
+  }
+  return authToken
+}
+
+// --- 窄 SSRF 防护 ---
+// 本工具用途即访问组织内网（SSO 后台/内部系统），故不做私有网段全量屏蔽；
+// 仅挡云元数据端点与非 http(s)/about 协议。完整 rebinding 防护见 src/security/url.ts。
+function validateNavUrl(rawUrl) {
+  let u
+  try {
+    u = new URL(rawUrl)
+  } catch {
+    return { ok: false, reason: 'invalid URL' }
+  }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:' && u.protocol !== 'about:') {
+    return { ok: false, reason: `unsupported protocol: ${u.protocol}` }
+  }
+  const host = u.hostname.toLowerCase()
+  if (host === '169.254.169.254' || host === 'metadata.google.internal') {
+    return { ok: false, reason: 'blocked: cloud metadata endpoint' }
+  }
+  return { ok: true }
+}
+
 // --- WebSocket 兼容层 ---
 let WS
 if (typeof globalThis.WebSocket !== 'undefined') {
@@ -378,6 +429,14 @@ const server = http.createServer(async (req, res) => {
       return
     }
 
+    // 鉴权：非 /health 端点要求 X-CDP-Token（防浏览器 CSRF 到 localhost）
+    const provided = req.headers['x-cdp-token'] || ''
+    if (!authToken || provided !== authToken) {
+      res.statusCode = 401
+      res.end(JSON.stringify({ error: 'unauthorized: missing or invalid X-CDP-Token' }))
+      return
+    }
+
     await connect()
 
     // GET /targets - 列出所有页面
@@ -390,6 +449,12 @@ const server = http.createServer(async (req, res) => {
     // GET /new?url=xxx - 创建新后台 tab
     else if (pathname === '/new') {
       const targetUrl = q.url || 'about:blank'
+      const check = validateNavUrl(targetUrl)
+      if (!check.ok) {
+        res.statusCode = 400
+        res.end(JSON.stringify({ error: check.reason }))
+        return
+      }
       const resp = await sendCDP('Target.createTarget', { url: targetUrl, background: true })
       const targetId = resp.result.targetId
       managedTabs.set(targetId, { lastAccessed: Date.now() })
@@ -417,6 +482,12 @@ const server = http.createServer(async (req, res) => {
 
     // GET /navigate?target=xxx&url=yyy - 导航（自动等待加载）
     else if (pathname === '/navigate') {
+      const check = validateNavUrl(q.url || '')
+      if (!check.ok) {
+        res.statusCode = 400
+        res.end(JSON.stringify({ error: check.reason }))
+        return
+      }
       const sid = await ensureSession(q.target)
       const resp = await sendCDP('Page.navigate', { url: q.url }, sid)
 
@@ -723,6 +794,9 @@ async function main() {
     process.exit(1)
   }
 
+  // 只有成功绑定端口的实例才生成/复用 token（避免多实例竞态）
+  ensureToken()
+
   server.listen(PORT, '127.0.0.1', () => {
     console.log(`[CDP Proxy] 运行在 http://localhost:${PORT}`)
     // 启动时尝试连接 Chrome（非阻塞）

package/skills/standard/web-access/scripts/check-deps.mjs

@@ -11,6 +11,7 @@ import { fileURLToPath } from 'node:url'
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
 const PROXY_SCRIPT = path.join(ROOT, 'scripts', 'cdp-proxy.mjs')
 const PROXY_PORT = Number(process.env.CDP_PROXY_PORT || 3456)
+const TOKEN_FILE = path.join(ROOT, '.cdp-token')
 
 // --- Node.js 版本检查 ---
 
@@ -81,7 +82,7 @@ async function detectChromePort() {
       if (port > 0 && port < 65536 && (await checkPort(port))) {
         return port
       }
-    } catch (_) {}
+    } catch {}
   }
   // 回退：探测常见端口
   for (const port of [9222, 9229, 9333]) {
@@ -94,8 +95,22 @@ async function detectChromePort() {
 
 // --- CDP Proxy 启动与等待 ---
 
+function readToken() {
+  try {
+    const t = fs.readFileSync(TOKEN_FILE, 'utf8').trim()
+    if (t) return t
+  } catch {
+    /* proxy 尚未生成 token */
+  }
+  return null
+}
+
 function httpGetJson(url, timeoutMs = 3000) {
-  return fetch(url, { signal: AbortSignal.timeout(timeoutMs) })
+  const token = readToken()
+  return fetch(url, {
+    signal: AbortSignal.timeout(timeoutMs),
+    headers: token ? { 'X-CDP-Token': token } : {},
+  })
     .then(async (res) => {
       try {
         return JSON.parse(await res.text())

package/skills/standard/web-access.SKILL.md

@@ -44,7 +44,14 @@ node ~/.mipham/skills/web-access/scripts/check-deps.mjs
 
 通过 CDP Proxy 直连用户日常 Chrome，天然携带登录态。**不主动操作用户已有 tab**，所有操作在自己创建的后台 tab 中进行，任务结束关闭自建 tab（保留用户原 tab）。
 
-Proxy（`scripts/cdp-proxy.mjs`）由 `check-deps.mjs` 自动拉起并常驻。Proxy API（curl 调 `http://localhost:3456/...`）：
+Proxy（`scripts/cdp-proxy.mjs`）由 `check-deps.mjs` 自动拉起并常驻。Proxy 首次启动生成共享密钥 `~/.mipham/skills/web-access/.cdp-token`（0600），除 `/health` 外所有端点都要求请求头 `X-CDP-Token`。先取 token 再调 API：
+
+```bash
+TOKEN=$(cat ~/.mipham/skills/web-access/.cdp-token)
+curl -H "X-CDP-Token: $TOKEN" http://localhost:3456/targets
+```
+
+端点列表：
 
 | 端点                                       | 用途                                                                     |
 | ------------------------------------------ | ------------------------------------------------------------------------ |
@@ -122,8 +129,8 @@ Sources:
 - 不主动操作用户已有 tab；任务结束关闭自建 tab。
 - 不提交凭据（除非用户显式批准）。
 - 尊重 robots.txt 与速率限制；不抓 PII。
-- proxy 仅绑 127.0.0.1，不暴露外网；端口 3456 无鉴权，依赖本机信任边界，勿在共享/多用户主机运行。
-- ⚠️ proxy 不做 URL SSRF 校验（照搬上游，与 computer-use/Playwright 同类）：避免驱动 Chrome 访问本机内部服务/内网地址。
+- proxy 仅绑 127.0.0.1，不暴露外网；除 `/health` 外所有端点要求 `X-CDP-Token` 共享密钥（`~/.mipham/skills/web-access/.cdp-token`，0600），防浏览器 CSRF 到 localhost。勿在共享/多用户主机运行。
+- URL 过窄 SSRF 校验：拒绝非 http(s)/about 协议与云元数据端点（`169.254.169.254` / `metadata.google.internal`）。⚠️ 私有网段（10.x / 172.16 / 192.168 / localhost）**有意放行**——本工具用途即访问组织内网（SSO 后台/内部系统），与 web-fetch 的完整 SSRF 屏蔽不同。
 
 ## 何时不用本 skill
 

package/src/commands/project.ts

@@ -1015,7 +1015,7 @@ const securityCmd: CommandHandler = async () => {
   return { content: lines.join('\n') }
 }
 
-const trustCmd: CommandHandler = (ctx) => {
+const trustCmd: CommandHandler = (_ctx) => {
   const trust = getWorkspaceTrust()
   const cwd = process.cwd()
   const trusted = trust.listTrusted()

package/src/config/defaults.ts

@@ -16,6 +16,11 @@ export const DEFAULT_CONFIG: MiphamConfig = {
   // Org 级权限限制（可选）：forbiddenModes 禁指定模式 / maxAllowedMode 封顶层级；
   // 请求被禁模式时 fail-closed 降级（如 forbiddenModes:['bypassPermissions']）。
   // permissionRestrictions: { forbiddenModes: ['bypassPermissions'] },
+  // 用户自定义权限规则（可选）：allow/deny 接入运行时 PermissionSystem。
+  // mask 与 deny 互补、勿重叠（重叠则 deny 先触发、mask 轮不到 → 白做）：
+  //   - mask（credential_masking，默认开启）管「可读但含机密」：.env / .ssh/id_* / *.pem / *.key…
+  //   - deny 管「根本不该碰」且未被 mask 覆盖的文件：.git-credentials / .npmrc / .kube/config…
+  // permissionRules: { deny: ['Read(**/.git-credentials)', 'Read(**/.npmrc)'] },
   providers: DEFAULT_PROVIDERS,
   marketplace: {
     strictKnownMarketplaces: [],

package/src/core/auto-memory.ts

@@ -13,7 +13,7 @@
 
 import { MemoryManager, type MemoryEntry } from './memory/memory-manager.js'
 import type { PatternAnalyzer, Pattern } from '../agent/pattern-analyzer.js'
-import type { ExperienceRuleEngine, ToolRule } from './rule-engine.js'
+import type { ExperienceRuleEngine } from './rule-engine.js'
 import type { EffectivenessTracker } from '../agent/effectiveness-tracker.js'
 import type { ErrorSignatureDB } from './error-signature-db.js'
 import type { CrsiProvenanceBridge } from '../agent/crsi-provenance-bridge.js'
@@ -152,7 +152,7 @@ export class AutoMemoryEngine {
     modelId: string
     turnDurationMs: number
   }): TurnReflection {
-    const { sessionId, userMessage, assistantContent, toolCalls, modelProvider, modelId } = params
+    const { sessionId, userMessage, assistantContent, toolCalls } = params
 
     // 1. Categorize tool calls
     const successes: string[] = []
@@ -345,7 +345,7 @@ export class AutoMemoryEngine {
    * Only insights that are auto-applicable and have sufficient evidence
    * (≥ CRSI_RULE_THRESHOLD similar failures) are converted to rules.
    */
-  private feedCrsiPipeline(reflection: TurnReflection): void {
+  private feedCrsiPipeline(_reflection: TurnReflection): void {
     if (!this.ruleEngine || !this.patternAnalyzer) return
 
     // Count failures by category across ALL reflections (not just this one)

package/src/core/constitution-loader.ts

@@ -167,7 +167,6 @@ export class ConstitutionLoader {
     const result: MiphamConstitution = { version: '0.0.0', last_modified: '', principles: [] }
     let currentPrinciple: Partial<ConstitutionalPrinciple> | null = null
     let inPrinciples = false
-    let inList = false
 
     for (const line of lines) {
       const trimmed = line.trim()
@@ -188,7 +187,6 @@ export class ConstitutionLoader {
 
       // List items in principles
       if (inPrinciples && trimmed === '- id:') {
-        inList = true
         continue
       }
 

package/src/core/context.ts

@@ -186,7 +186,6 @@ export class ContextManager {
   }
 
   async compact(heading: string): Promise<{ before: number; after: number }> {
-    const beforeMsgs = this.messages.length
     const beforeTokens = this.estimatedTokens
 
     if (this.messages.length <= 30) {

package/src/core/credential-masker/index.ts

@@ -5,6 +5,7 @@ export { MaskingPipeline, getPipeline, maskContent } from './pipeline'
 export { matchCredentialFile, matchPath, globToRegex } from './matcher'
 export { filterEnv } from './env-filter'
 export { maskOutput } from './output-scrub'
+export { maskSearchOutput, maskGlobOutput } from './search'
 
 // Strategies
 export { FullMaskingStrategy } from './strategies/full'

package/src/core/credential-masker/matcher.ts

@@ -65,13 +65,16 @@ export function matchPath(filePath: string, pattern: string): boolean {
 }
 
 /**
- * Convert a glob pattern to a RegExp.
- * - ** → .* (matches any path segments)
- * - *  → [^/]* (matches within a single segment)
- * - ?  → . (single char)
- * - All other special regex chars are escaped.
+ * Translate a glob pattern to an un-anchored RegExp source (no `^` or `$`).
+ * This is the shared path-glob core, reused by both credential-file matching
+ * (full-path anchored via `globToRegex`) and `.mipham/rules/` path scoping
+ * (suffix anchored in RulesLoader). Semantics:
+ * - ** → .*     (matches any number of path segments, crosses `/`)
+ * - *  → [^/]*  (matches within a single segment, does not cross `/`)
+ * - ?  → .      (single char)
+ * - regex specials are escaped (treated literally)
  */
-export function globToRegex(pattern: string): RegExp {
+export function globToRegexSource(pattern: string): string {
   let regexStr = ''
   let i = 0
   while (i < pattern.length) {
@@ -102,5 +105,13 @@ export function globToRegex(pattern: string): RegExp {
     }
     i++
   }
-  return new RegExp('^' + regexStr + '$')
+  return regexStr
+}
+
+/**
+ * Convert a glob pattern to a full-path-anchored RegExp (see `globToRegexSource`
+ * for the `*`/`**`/`?` translation and escaping rules).
+ */
+export function globToRegex(pattern: string): RegExp {
+  return new RegExp('^' + globToRegexSource(pattern) + '$')
 }

package/src/core/credential-masker/search.ts

@@ -0,0 +1,73 @@
+import type { CredentialMaskingConfig } from '../../shared/index.ts'
+import { matchCredentialFile } from './matcher'
+import { CREDENTIAL_SENTINEL } from './types'
+
+/**
+ * Mask grep/search output: any match line that belongs to a credential file
+ * (e.g. `.env`, `.aws/credentials`) has its content replaced with the
+ * credential sentinel, so Grep can't leak secrets that Read would mask.
+ *
+ * `format` disambiguates the two shapes the Grep tool emits — each invocation
+ * produces exactly one, so there is no cross-format ambiguity to guess at:
+ *   - 'heading'  (ripgrep `--heading`): file path on its own line, then `N:content` lines
+ *   - 'filename' (plain grep `-rn`):    `path:N:content` on a single line
+ *
+ * NOTE: the sensitive file's *path* stays visible — only its match content is
+ * masked. That's intentional for grep (a targeted search where the model already
+ * named the path); the secret is the content, not the location. Contrast
+ * `maskGlobOutput`, which hides the path entirely (enumeration's leak is existence).
+ */
+export function maskSearchOutput(
+  stdout: string,
+  config?: CredentialMaskingConfig,
+  format: 'heading' | 'filename' = 'heading',
+): string {
+  if (!config?.enabled) return stdout
+  const out: string[] = []
+  let currentMasked = false
+
+  for (const line of stdout.split('\n')) {
+    if (format === 'filename') {
+      const m = line.match(/^(.+?):(\d+):(.*)$/)
+      if (m) {
+        out.push(
+          matchCredentialFile(m[1]!, config) ? `${m[1]}:${m[2]}:${CREDENTIAL_SENTINEL}` : line,
+        )
+      } else {
+        out.push(line)
+      }
+      continue
+    }
+
+    // 'heading' format: match lines are `N:content`; everything non-empty else is a file heading.
+    const m = line.match(/^(\d+):(.*)$/)
+    if (m) {
+      out.push(currentMasked ? `${m[1]}:${CREDENTIAL_SENTINEL}` : line)
+      continue
+    }
+    if (line.trim() === '') {
+      out.push(line) // blank separator — pass through, keep current file
+      continue
+    }
+    currentMasked = !!matchCredentialFile(line, config)
+    out.push(line)
+  }
+
+  return out.join('\n')
+}
+
+/**
+ * Mask a glob file listing: sensitive file paths are replaced with the
+ * credential sentinel so file enumeration can't reveal their existence.
+ *
+ * NOTE: unlike `maskSearchOutput` (which keeps the searched path visible and
+ * masks only content), glob hides the whole path — here the leak is the file's
+ * *existence*, not its content.
+ */
+export function maskGlobOutput(paths: string, config?: CredentialMaskingConfig): string {
+  if (!config?.enabled) return paths
+  return paths
+    .split('\n')
+    .map((p) => (matchCredentialFile(p, config) ? CREDENTIAL_SENTINEL : p))
+    .join('\n')
+}

package/src/core/credential-masker.ts

@@ -13,6 +13,7 @@ export { matchCredentialFile } from './credential-masker/matcher'
 export { maskContent } from './credential-masker/pipeline'
 export { maskOutput } from './credential-masker/output-scrub'
 export { filterEnv } from './credential-masker/env-filter'
+export { maskSearchOutput, maskGlobOutput } from './credential-masker/search'
 
 import { CREDENTIAL_SENTINEL } from './credential-masker/types'
 

package/src/core/crsi-sandbox.ts

@@ -84,7 +84,6 @@ export interface CrsiSessionReport {
 // ── Constants ──
 
 const WORKTREE_PREFIX = 'crsi-sandbox-'
-const MAX_WORKTREE_AGE_MS = 30 * 60 * 1000 // 30 minutes
 const TEST_TIMEOUT_MS = 120_000 // 2 minutes
 const REPORT_DIR = join(homedir(), '.mipham', 'crsi-sandbox')
 

package/src/core/dream-engine.ts

@@ -469,7 +469,6 @@ export class DreamEngine {
       const lines = match[1]!.split('\n')
       const fm: Record<string, unknown> = {}
       let currentNested: Record<string, unknown> | null = null
-      let nestedKey = ''
       for (const line of lines) {
         // Handle nested YAML (e.g. "metadata:\n  type: feedback")
         const nested = line.match(/^  (\w[\w\s]*?):\s*(.+)$/)
@@ -485,7 +484,6 @@ export class DreamEngine {
           if (val === '') {
             // Empty value → start nested block
             currentNested = {}
-            nestedKey = key
             fm[key] = currentNested
           } else {
             currentNested = null

package/src/core/memory/memory-loader.ts

@@ -1,7 +1,9 @@
+import { join } from 'node:path'
+import { homedir } from 'node:os'
 import { MemoryManager } from './memory-manager'
 import type { MemoryManager as MemoryManagerType } from './memory-manager'
 
-const MEMORY_DIR = `${process.env.HOME || '~'}/.mipham/memory`
+const MEMORY_DIR = join(homedir(), '.mipham', 'memory')
 
 let instance: MemoryManagerType | null = null
 

package/src/core/permission-rules.ts

@@ -1,14 +1,16 @@
 import type { PermissionRuleEntry } from '../shared/index.ts'
+import { matchPath } from './credential-masker/matcher'
 
-/**
- * Match a Bash(command_pattern) rule against an actual tool call.
- *
- * Pattern formats:
- *   "Bash"              → matches any Bash call
- *   "Bash(git:*)"       → matches "git status", "git diff --cached", etc.
- *   "Bash(npm test:*)"  → matches "npm test -- --coverage"
- *   "Write(/etc/*)"     → matches Write to /etc/passwd, /etc/hosts, etc.
- */
+// Match a tool(parameter) rule against an actual tool call.
+//
+// Pattern formats:
+//   "Bash"              → matches any Bash call
+//   "Bash(git:*)"       → matches "git status", "git diff --cached", etc.
+//   "Bash(npm test:*)"  → matches "npm test -- --coverage"
+//   "Write(/etc/*)"     → matches Write to /etc/passwd, /etc/hosts, etc.
+//   "Read(**/.ssh/*)"   → matches Read of any path under .ssh
+//   "Grep(**/vendor)"   → matches Grep rooted under a vendor directory
+//   "Glob(**/.ssh)"     → matches Glob rooted under a .ssh directory
 export function matchBashRule(
   pattern: string,
   toolName: string,
@@ -31,10 +33,19 @@ export function matchBashRule(
     return wildcardMatch(subPattern!, cmd.trim())
   }
 
-  // For Write/Edit: match against the file_path
-  if (baseTool === 'Write' || baseTool === 'Edit') {
+  // For Write/Edit/Read: match against the file_path with path-glob semantics.
+  // Use matchPath (NOT wildcardMatch): wildcardMatch is tuned for Bash commands
+  // (`:` → colon-or-whitespace, `*` → `.*`), which is wrong for filesystem
+  // paths — `*` would cross `/` and Windows drive letters like `C:\` get mangled.
+  if (baseTool === 'Write' || baseTool === 'Edit' || baseTool === 'Read') {
     const path = String(toolInput.file_path || '')
-    return wildcardMatch(subPattern!, path)
+    return matchPath(path, subPattern!)
+  }
+
+  // For Grep/Glob: match against the base search path (a directory)
+  if (baseTool === 'Grep' || baseTool === 'Glob') {
+    const path = String(toolInput.path || '')
+    return matchPath(path, subPattern!)
   }
 
   return false

package/src/core/rules-loader.ts

@@ -19,6 +19,7 @@
 
 import { readdirSync, readFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
+import { globToRegexSource } from './credential-masker/matcher'
 
 interface RuleFile {
   name: string
@@ -117,18 +118,15 @@ export class RulesLoader {
   }
 
   /**
-   * Simple glob matching. Supports **, *, and exact file matching.
-   * Returns true if file matches pattern.
+   * Glob matching for path-scoped rules. Reuses the shared path-glob core
+   * (globToRegexSource) so `*`/`**`/`?` semantics match credential-file
+   * matching. Anchoring differs: rules match by *suffix* (a rule `*.ts`
+   * applies to any file ending in `.ts`), not full path.
    */
   private matchPath(file: string, pattern: string): boolean {
-    // Convert glob pattern to regex
-    let regexStr = pattern
-      .replace(/\./g, '\\.')
-      .replace(/\*\*/g, '<<GLOBSTAR>>')
-      .replace(/\*/g, '[^/]*')
-      .replace(/<<GLOBSTAR>>/g, '.*')
-
-    // If pattern doesn't start with ** or *, anchor to be a suffix match
+    let regexStr = globToRegexSource(pattern)
+
+    // If pattern doesn't start with ** or *, anchor to a suffix match
     if (!pattern.startsWith('**') && !pattern.startsWith('*')) {
       regexStr = regexStr + '$'
     }

package/src/daemon/database.ts

@@ -289,7 +289,6 @@ export class DaemonDatabase {
     }
 
     vals.push(id)
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     this.db.run(`UPDATE goals SET ${sets.join(', ')} WHERE id = ?`, vals as any)
   }
 

package/src/daemon/feishu/adapter.ts

@@ -28,7 +28,8 @@ export function createFeishuAdapter(config: FeishuConfig, deps: FeishuAdapterDep
       if (!allowed.has(msg.openId)) return
       if (!deps.rateLimiter.check(`feishu:${msg.openId}`).allowed) return
 
-      const session = deps.sm.getOrCreateByFeishuOpenId(
+      const session = deps.sm.getOrCreateByExternalUser(
+        'feishu',
         msg.openId,
         deps.cwd,
         deps.provider,