@mxalbert/context-mode 2.0.2 → 2.0.4

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Claude Code plugins by Mert Koseoğlu",
-    "version": "2.0.2"
+    "version": "2.0.4"
   },
   "plugins": [
     {
       "name": "context-mode",
       "source": "./",
       "description": "Claude Code MCP plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-      "version": "2.0.2",
+      "version": "2.0.4",
       "author": {
         "name": "Mert Koseoğlu"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-mode",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "MCP server that saves 98% of your context window with session continuity. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and automatic state restore across compactions.",
   "author": {
     "name": "Mert Koseoğlu",

package/.openclaw-plugin/openclaw.plugin.json

@@ -3,7 +3,7 @@
   "name": "Context Mode",
   "kind": "tool",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "sandbox": {
     "mode": "permissive",
     "filesystem_access": "full",

package/.openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mxalbert/context-mode",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "OpenClaw plugin that saves 98% of your context window. Sandboxed code execution in 11 languages, FTS5 knowledge base with BM25 ranking, and intent-driven search.",
   "author": {
     "name": "Mert Koseoğlu",

package/README.md

@@ -1208,7 +1208,7 @@ Indexed content persists in a per-project SQLite database at `~/.context-mode/co
 - **Cache hit (within TTL):** Returns a cache hint (~0.3KB) instead of re-fetching (48KB+). Model proceeds to `ctx_search`.
 - **Cache miss (TTL expired):** Re-fetches silently. No user action needed.
 - **`ttl: 0`** or **`force: true`:** Bypasses cache and re-fetches regardless of freshness.
-- **14-day cleanup:** Content databases and sources older than 14 days are removed on startup.
+- **14-day cleanup:** Sources older than 14 days are removed from the knowledge base on startup. Content DB files themselves are never auto-deleted — an open-but-idle store is indistinguishable from an abandoned one by timestamps alone, and deleting a live store's files causes unrecoverable I/O errors. Use `ctx_purge` to reclaim disk space.
 
 This means `--continue` sessions preserve indexed docs across restarts. No re-fetching, no wasted context tokens.
 

package/build/adapters/opencode/plugin.d.ts

@@ -49,8 +49,9 @@
  *   - No routing file auto-write (avoid dirtying project trees)
  *   - Session cleanup happens at plugin init (no SessionStart)
  */
-import { type PluginGlobalState } from "./index.js";
-import { type PluginClient, type V2SetupContext } from "./v2.js";
+import { SessionDB } from "../../session/db.js";
+import { AdapterPlatformType, OpenCodeAdapter, type PluginGlobalState } from "./index.js";
+import { type PluginClient, type PluginClientAppLogBodyExtra, type V2SetupContext } from "./v2.js";
 type PluginContext = {
     client: PluginClient;
     directory: string;
@@ -192,6 +193,63 @@ export declare function __resetPluginStateForTests(): void;
 export declare function __getPluginGlobalState(): PluginGlobalState;
 /** Test-only: close the cached fd and clear the sink cache so each test gets a fresh sink. */
 export declare function __resetPluginLogSinkForTests(): void;
+type EmitLevel = "info" | "warn" | "error";
+/**
+ * Per-plugin-process state shared by the v1 `server()` path and the v2
+ * `setup()` path. Both flavors bridge to the SAME handler functions built
+ * over this runtime — logic is never duplicated across flavors.
+ */
+interface PluginRuntime {
+    ctx: PluginContext;
+    platform: AdapterPlatformType;
+    adapter: OpenCodeAdapter;
+    projectDir: string;
+    db: SessionDB;
+    routing: {
+        routePreToolUse: (...args: unknown[]) => any;
+        /** v2-native availability signal (hooks/core/routing.mjs) — optional: older routing copies lack it. */
+        setContextModeToolsAvailable?: (available: boolean) => void;
+        /**
+         * v2 permission-evaluate routing (hooks/core/routing.mjs) — optional:
+         * older routing copies lack it, and the permission bridge no-ops (fail
+         * open, host decision untouched) when absent.
+         */
+        routePermissionEvaluate?: (action: unknown, resources: unknown, projectDir: unknown, platform: unknown) => {
+            effect: "allow" | "deny" | "ask";
+            message?: string;
+        } | null;
+    };
+    routingBlock: string;
+    autoInjectionMod: {
+        buildAutoInjection: (events: unknown) => string;
+    };
+    captureAgentsMd: (sessionId: string) => void;
+    buildNativeTools: () => Promise<Record<string, NativeToolDefinition>>;
+    logger: (message?: string, extra?: PluginClientAppLogBodyExtra) => Promise<void>;
+    safeLog: (message?: string, extra?: PluginClientAppLogBodyExtra) => Promise<void>;
+    logHookError: (hookName: string, err: unknown, sessionId?: string) => void;
+    logOnce: (key: string, message: string, level?: EmitLevel) => void;
+    /**
+     * Liveness gate for v2-registered callbacks (defense-in-depth). Set to
+     * true by teardownV2 BEFORE any dispose / claim release: hosts whose
+     * registration calls succeed but return NO dispose handle cannot be fully
+     * unregistered, so their stale callbacks are neutralized instead — every
+     * v2 entry point below checks this flag and no-ops (no throw, no DB touch)
+     * once the runtime is torn down. The v1 path never tears a runtime down.
+     */
+    closed: boolean;
+}
+/**
+ * The v2 permission-evaluate bridge handler. Extracted (and exported) so the
+ * behavioral contracts are unit-testable: malformed events and a routing
+ * throw must leave the host decision untouched (fail-open), and a torn-down
+ * runtime must no-op (liveness gate). `route` is pre-bound to the runtime's
+ * projectDir/platform by the caller.
+ */
+export declare function createV2PermissionEvaluateHandler(rt: Pick<PluginRuntime, "closed" | "logHookError">, route: (action: string, resources: string[]) => {
+    effect: "allow" | "deny" | "ask";
+    message?: string;
+} | null): (event: unknown) => Promise<undefined>;
 /**
  * Plugin factory. Called once when a v1 host (KiloCode/OpenCode ≤ v1) loads
  * the plugin. Returns an object mapping hook event names to async handler

package/build/adapters/opencode/plugin.js

@@ -1283,6 +1283,85 @@ async function registerEventBusV2(ctx, rt, handlers) {
         dispose: hostDispose ? chainDisposes([abortDispose, hostDispose]) : abortDispose,
     };
 }
+/**
+ * OPTIONAL: register the v2 permission "evaluate" hook — the surface that
+ * restores true ask/confirmation semantics on OpenCode v2 (verified against
+ * opencode2 beta-19135 live probe; see .research/opencode-v2-permission-hooks.md).
+ *
+ * The host asserts every core-tool action (shell, read, …) through its
+ * permission system before execution and lets the hook MUTATE the decision
+ * (event.effect / event.message). The bridge routes the event through the
+ * shared routing engine's routePermissionEvaluate and applies its verdict:
+ *
+ *   - deny → effect "deny" — blocked with the policy reason (normally
+ *     pre-empted by the execute.before throw which fires earlier —
+ *     this is defense-in-depth for assert paths execute.before cannot see)
+ *   - ask  → effect "ask" — an interactive confirmation in TUI runs,
+ *     restoring the user's ask intent even when host allow rules would
+ *     auto-approve; under `--auto` the host auto-approves the ask too
+ *     (explicit opt-in, verified live)
+ *   - allow → effect "allow" — skips the host's default-ask prompt for
+ *     commands the user's own GLOBAL permission rules pre-approve
+ *   - null → untouched — the host decision (its rules / default ask / --auto)
+ *     stays exactly as computed
+ *
+ * Plugin-registered tools (the ctx_* tools themselves) are NOT
+ * permission-evaluated (empirically verified — see
+ * .research/opencode-v2-empirical-test-results.md), so their gating stays in
+ * tool.execute.before; this hook only covers host core-tool actions, with
+ * zero overlap or double-handling: execute.before keeps deny/modify/context,
+ * and its Stage-1 ask already falls through (opencode is not in
+ * ASK_CAPABLE_PLATFORMS), so the ask decision is expressed HERE, once.
+ *
+ * Fail-open: a routing throw leaves the event untouched (mirrors the
+ * execute.before catch — a routing failure must never brick tool calls).
+ */
+async function registerPermissionHookV2(ctx, rt) {
+    const permissionHook = ctx?.permission && typeof ctx.permission.hook === "function" ? ctx.permission.hook : undefined;
+    if (!permissionHook || !ctx?.permission)
+        return { ok: false };
+    const routePermissionEvaluate = rt.routing.routePermissionEvaluate;
+    const handler = createV2PermissionEvaluateHandler(rt, (action, resources) => {
+        if (typeof routePermissionEvaluate !== "function")
+            return null; // older routing copy — no-op
+        return routePermissionEvaluate(action, resources, rt.projectDir, rt.platform);
+    });
+    return tryRegister(permissionHook, ctx.permission, "evaluate", handler);
+}
+/**
+ * The v2 permission-evaluate bridge handler. Extracted (and exported) so the
+ * behavioral contracts are unit-testable: malformed events and a routing
+ * throw must leave the host decision untouched (fail-open), and a torn-down
+ * runtime must no-op (liveness gate). `route` is pre-bound to the runtime's
+ * projectDir/platform by the caller.
+ */
+export function createV2PermissionEvaluateHandler(rt, route) {
+    return async (event) => {
+        if (rt.closed)
+            return undefined; // torn down — silent no-op
+        const ev = (event ?? {});
+        const action = typeof ev.action === "string" ? ev.action : "";
+        const resources = Array.isArray(ev.resources)
+            ? ev.resources.filter((r) => typeof r === "string")
+            : [];
+        if (!action || resources.length === 0)
+            return undefined;
+        let routed = null;
+        try {
+            routed = route(action, resources);
+        }
+        catch (err) {
+            rt.logHookError("v2.permission.evaluate", err, v2SessionIdOf(ev));
+            return undefined; // fail-open — host decision untouched
+        }
+        if (!routed)
+            return undefined;
+        ev.effect = routed.effect;
+        if (typeof routed.message === "string")
+            ev.message = routed.message;
+        return undefined; // mutation is the contract — the return value is ignored
+    };
+}
 /**
  * MANDATORY: register the native ctx_* tools via ctx.tool.transform(editor)
  * (verified v2 API). The ToolEditor receives one ToolInfo per ctx_* tool:
@@ -1591,7 +1670,16 @@ async function setupV2(ctx) {
             missingMessage: "context-mode v2: event bus unavailable (no ctx.event.subscribe) — per-turn token/cost capture inactive",
         });
         disposes.push(...eventBus.disposes);
-        rt.logOnce("v2-setup-complete", `context-mode v2 setup complete: native tools via ctx.tool.transform; tool hooks via ${toolRegs.via}; session context: ${sessionContext.status}; prompt capture: ${promptCapture.status}; event bus: ${eventBus.status}`, "info");
+        // Optional: permission "evaluate" hook — true ask/allow security
+        // semantics on permission-evaluated actions (see registerPermissionHookV2).
+        const permissionHook = await attemptOptionalV2(activeRt, {
+            surfacePresent: typeof ctx?.permission?.hook === "function",
+            register: () => registerPermissionHookV2(ctx, activeRt),
+            logKeyMissing: "v2-permission-hook-missing",
+            missingMessage: "context-mode v2: permission evaluate hook unavailable (no ctx.permission.hook) — ask/allow security semantics inactive; deny enforcement stays on tool.execute.before",
+        });
+        disposes.push(...permissionHook.disposes);
+        rt.logOnce("v2-setup-complete", `context-mode v2 setup complete: native tools via ctx.tool.transform; tool hooks via ${toolRegs.via}; session context: ${sessionContext.status}; prompt capture: ${promptCapture.status}; event bus: ${eventBus.status}; permission hook: ${permissionHook.status}`, "info");
         return async () => {
             // Cleanup: unregister everything registered, close the runtime DB
             // handle, then release the activation claim so a reload can re-claim.

package/build/adapters/opencode/v2.d.ts

@@ -87,6 +87,17 @@ export type V2SetupContext = {
             signal?: AbortSignal;
         }) => unknown;
     };
+    /**
+     * v2 permission domain (verified against opencode2 beta-19135 live probe:
+     * ctx.permission.hook("evaluate", cb) fires for every core-tool permission
+     * assert with a MUTABLE event { action, resources, source?, effect, message? }
+     * — hook mutations of effect/message win the decision). Optional: older v2
+     * builds and all v1 hosts lack the surface; the plugin degrades to the
+     * execute.before throw-based behavior there.
+     */
+    permission?: {
+        hook?: (name: string, cb: (event: unknown) => unknown) => unknown;
+    };
 };
 /**
  * Convert a Zod (v3-classic) schema into a JSON-Schema object — the shared

package/build/cli.js

@@ -452,7 +452,7 @@ function defaultSourceForPath(absPath) {
 }
 function assertReadAllowed(path, projectDir) {
     const denyGlobs = readToolDenyPatterns("Read", projectDir);
-    const denied = evaluateFilePath(path, denyGlobs, process.platform === "win32", projectDir);
+    const denied = evaluateFilePath(path, denyGlobs, undefined, projectDir);
     if (denied.denied) {
         throw new Error(`Read denied by policy: ${path}`);
     }
@@ -488,7 +488,7 @@ async function indexCommand(argv) {
                     followSymlinks: boolFlag(parsed.flags, "follow-symlinks"),
                     perFileDeny: (filePath) => {
                         try {
-                            return evaluateFilePath(filePath, denyGlobs, process.platform === "win32", projectDir).denied;
+                            return evaluateFilePath(filePath, denyGlobs, undefined, projectDir).denied;
                         }
                         catch {
                             return false;

package/build/security.d.ts

@@ -87,6 +87,18 @@ export declare function readToolDenyPatterns(toolName: string, projectDir?: stri
  * needs an out-of-project read expresses it once, in the host config, e.g.
  * `"permissions": { "allow": ["Read(/var/log/**)"] }`, and both the host and
  * context-mode honor it.
+ *
+ * Settings-source anchor (`/{path}`): per Claude Code's documented permission
+ * semantics, a rule glob with a SINGLE leading slash is NOT rooted at the
+ * filesystem root — it is anchored at the directory of the settings file that
+ * declared it. Project/local settings (`.claude/settings.json`,
+ * `.claude/settings.local.json`) therefore anchor at the primary working
+ * directory (`projectDir`), while user settings (`~/.claude/settings.json`),
+ * adapter-global settings, and a custom `--settings <file>` anchor at that
+ * settings file's own directory. Each such glob is emitted as a settings-source
+ * RESOLVED twin in addition to the literal glob — the change is additive: no
+ * existing literal match is removed, so the README's `Read(/var/log/**)`
+ * filesystem-root escape hatch keeps working as a literal absolute rule.
  */
 export declare function readToolPermissionPatterns(toolName: string, kind: "deny" | "allow", projectDir?: string, globalSettingsPath?: string): string[][];
 interface CommandDecision {
@@ -123,16 +135,36 @@ export declare function evaluateCommandDenyOnly(command: string, policies: Secur
  * Normalizes backslashes to forward slashes before matching so that
  * Windows paths work with Unix-style glob patterns.
  *
- * When `projectRoot` is supplied, the path is also matched in its
- * fully-resolved absolute form **and** — when the file exists — in
- * its canonical form (`fs.realpathSync`). This prevents two classes
- * of bypass:
- *
- *   1. `..` traversal: a relative path like `../../.ssh/id_rsa` no
- *      longer evades absolute-path deny rules.
- *   2. Symlink escape: a project-local path whose realpath points
- *      outside the project (e.g. `safe.log -> ~/.ssh/id_rsa`) no
- *      longer evades absolute-path deny rules.
+ * Rule and file path anchors are expanded before matching:
+ *   - A leading `~` / `~/` in EITHER the rule glob or the file path is
+ *     expanded to the user's home directory (Claude Code's `~/path`
+ *     anchor). `~user/...` is left untouched.
+ *   - A rule glob beginning with `//` is treated as "absolute from the
+ *     filesystem root" and has the leading double slash collapsed to one,
+ *     matching the absolute candidates this module produces. The literal
+ *     double-slash form is preserved as an additional variant so Windows UNC
+ *     rules (e.g. `//server/share/**`) still match UNC candidates, which
+ *     normalize to `//server/share/...`.
+ *
+ * Symlink resolution is mirrored on both sides. For each rule glob the
+ * matcher tests its literal variant AND a best-effort `realpathSync`'d
+ * variant (only the static prefix, before the first glob segment, is
+ * canonicalized). Against those it tests every file candidate: the raw
+ * input, the tilde-expanded input, the path resolved against `projectRoot`
+ * (or `process.cwd()` when no project root is supplied), and — when the
+ * file exists — its canonical form. A deny match therefore fires if ANY
+ * literal/canonical rule variant matches ANY literal/lexical/canonical file
+ * candidate, closing the CVE-2025-59829 symlink deny-bypass class.
+ *
+ * Anchoring the resolved candidate to `projectRoot` (falling back to cwd)
+ * means absolute deny rules still match relative `..` traversal even when
+ * the caller does not know the project root.
+ *
+ * Conversely, a RELATIVE rule glob (no leading `/`, `//`, or `~`) is anchored
+ * to the current directory at match time — `projectRoot` when supplied, else
+ * `process.cwd()` — per the host's "relative to current directory" semantics.
+ * The literal glob is kept as well, so both a relative access path and an
+ * absolute one are matched.
  *
  * realpath is best-effort: if the file does not exist yet (ENOENT)
  * or the syscall fails for any reason, the lexical resolved form is
@@ -163,6 +195,8 @@ export declare function evaluateFilePath(filePath: string, denyGlobs: string[][]
  *
  * A path equal to the project root itself counts as inside. Comparison is
  * case-insensitive on Windows/macOS to match those filesystems' semantics.
+ * A leading `~` in `filePath` is expanded to the user's home directory for
+ * consistency with `evaluateFilePath`.
  *
  * Returns `true` when `projectRoot` is falsy (no boundary to enforce) so the
  * caller's fail-open posture is preserved when the root cannot be resolved.

package/build/security.js

@@ -1,5 +1,6 @@
 import { readFileSync, realpathSync } from "node:fs";
-import { relative, resolve, sep } from "node:path";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { resolveAdapterGlobalSettingsPaths } from "./util/claude-config.js";
 // ==============================================================================
 // Pattern Parsing
@@ -380,10 +381,22 @@ export function readToolDenyPatterns(toolName, projectDir, globalSettingsPath) {
  * needs an out-of-project read expresses it once, in the host config, e.g.
  * `"permissions": { "allow": ["Read(/var/log/**)"] }`, and both the host and
  * context-mode honor it.
+ *
+ * Settings-source anchor (`/{path}`): per Claude Code's documented permission
+ * semantics, a rule glob with a SINGLE leading slash is NOT rooted at the
+ * filesystem root — it is anchored at the directory of the settings file that
+ * declared it. Project/local settings (`.claude/settings.json`,
+ * `.claude/settings.local.json`) therefore anchor at the primary working
+ * directory (`projectDir`), while user settings (`~/.claude/settings.json`),
+ * adapter-global settings, and a custom `--settings <file>` anchor at that
+ * settings file's own directory. Each such glob is emitted as a settings-source
+ * RESOLVED twin in addition to the literal glob — the change is additive: no
+ * existing literal match is removed, so the README's `Read(/var/log/**)`
+ * filesystem-root escape hatch keeps working as a literal absolute rule.
  */
 export function readToolPermissionPatterns(toolName, kind, projectDir, globalSettingsPath) {
     const result = [];
-    const extractGlobs = (path) => {
+    const extractGlobs = (path, baseDir) => {
         let raw;
         try {
             raw = readFileSync(path, "utf-8");
@@ -408,15 +421,22 @@ export function readToolPermissionPatterns(toolName, kind, projectDir, globalSet
             const tp = parseToolPattern(entry);
             if (tp && tp.tool === toolName) {
                 globs.push(tp.glob);
+                // `/{path}` settings-source anchor: emit the settings-file-relative
+                // resolved twin alongside the literal glob (additive — the literal
+                // stays so filesystem-root rules like `Read(/var/log/**)` keep
+                // working). `//path` is the filesystem-root anchor and gets no twin.
+                if (baseDir && tp.glob.startsWith("/") && !tp.glob.startsWith("//")) {
+                    globs.push(resolve(baseDir, "." + tp.glob));
+                }
             }
         }
         return globs;
     };
     if (projectDir) {
-        const localGlobs = extractGlobs(resolve(projectDir, ".claude", "settings.local.json"));
+        const localGlobs = extractGlobs(resolve(projectDir, ".claude", "settings.local.json"), projectDir);
         if (localGlobs !== null)
             result.push(localGlobs);
-        const sharedGlobs = extractGlobs(resolve(projectDir, ".claude", "settings.json"));
+        const sharedGlobs = extractGlobs(resolve(projectDir, ".claude", "settings.json"), projectDir);
         if (sharedGlobs !== null)
             result.push(sharedGlobs);
     }
@@ -428,7 +448,7 @@ export function readToolPermissionPatterns(toolName, kind, projectDir, globalSet
         ? [globalSettingsPath]
         : resolveAdapterGlobalSettingsPaths();
     for (const globalPath of globalPaths) {
-        const globalGlobs = extractGlobs(globalPath);
+        const globalGlobs = extractGlobs(globalPath, dirname(globalPath));
         if (globalGlobs !== null)
             result.push(globalGlobs);
     }
@@ -510,22 +530,88 @@ export function evaluateCommandDenyOnly(command, policies, caseInsensitive = pro
 // ==============================================================================
 // File Path Evaluation
 // ==============================================================================
+/**
+ * Expand a leading `~` / `~/` (or `~\` on Windows) to the user's home
+ * directory, mirroring Claude Code's documented `~/path` rule anchor.
+ * `~user/...` is intentionally left unchanged (needs a passwd lookup that is
+ * not portable). Returns the input unchanged when there is nothing to expand.
+ */
+function expandHomeTilde(path) {
+    if (path === "~")
+        return homedir();
+    if (path.startsWith("~/") || path.startsWith("~\\"))
+        return homedir() + path.slice(1);
+    return path;
+}
+/**
+ * Claude Code's `//path` rule anchor means "absolute from the filesystem
+ * root". Collapse the leading double slash to one so the pattern can match
+ * the absolute candidates this module produces (`path.resolve` never emits a
+ * leading `//`). Patterns without the anchor are returned unchanged.
+ */
+function normalizeRuleAnchor(glob) {
+    return glob.startsWith("//") ? glob.slice(1) : glob;
+}
+/**
+ * Best-effort symlink-resolved twin of a permission glob. Only the longest
+ * static prefix (path segments before the first `*`/`?` segment) is passed
+ * through `realpathSync`; glob segments are re-appended untouched. Returns
+ * null when there is no static prefix or it does not exist, so callers can
+ * simply fall back to the literal pattern.
+ */
+function canonicalizeGlob(glob) {
+    const segments = glob.split(/[\\/]/);
+    let cut = segments.findIndex((s) => s.includes("*") || s.includes("?"));
+    if (cut === -1)
+        cut = segments.length;
+    if (cut === 0)
+        return null;
+    const prefix = segments.slice(0, cut).join(sep);
+    if (prefix.length === 0)
+        return null;
+    try {
+        return [realpathSync(prefix), ...segments.slice(cut)].join(sep);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Check if a file path should be denied based on deny globs.
  *
  * Normalizes backslashes to forward slashes before matching so that
  * Windows paths work with Unix-style glob patterns.
  *
- * When `projectRoot` is supplied, the path is also matched in its
- * fully-resolved absolute form **and** — when the file exists — in
- * its canonical form (`fs.realpathSync`). This prevents two classes
- * of bypass:
+ * Rule and file path anchors are expanded before matching:
+ *   - A leading `~` / `~/` in EITHER the rule glob or the file path is
+ *     expanded to the user's home directory (Claude Code's `~/path`
+ *     anchor). `~user/...` is left untouched.
+ *   - A rule glob beginning with `//` is treated as "absolute from the
+ *     filesystem root" and has the leading double slash collapsed to one,
+ *     matching the absolute candidates this module produces. The literal
+ *     double-slash form is preserved as an additional variant so Windows UNC
+ *     rules (e.g. `//server/share/**`) still match UNC candidates, which
+ *     normalize to `//server/share/...`.
+ *
+ * Symlink resolution is mirrored on both sides. For each rule glob the
+ * matcher tests its literal variant AND a best-effort `realpathSync`'d
+ * variant (only the static prefix, before the first glob segment, is
+ * canonicalized). Against those it tests every file candidate: the raw
+ * input, the tilde-expanded input, the path resolved against `projectRoot`
+ * (or `process.cwd()` when no project root is supplied), and — when the
+ * file exists — its canonical form. A deny match therefore fires if ANY
+ * literal/canonical rule variant matches ANY literal/lexical/canonical file
+ * candidate, closing the CVE-2025-59829 symlink deny-bypass class.
+ *
+ * Anchoring the resolved candidate to `projectRoot` (falling back to cwd)
+ * means absolute deny rules still match relative `..` traversal even when
+ * the caller does not know the project root.
  *
- *   1. `..` traversal: a relative path like `../../.ssh/id_rsa` no
- *      longer evades absolute-path deny rules.
- *   2. Symlink escape: a project-local path whose realpath points
- *      outside the project (e.g. `safe.log -> ~/.ssh/id_rsa`) no
- *      longer evades absolute-path deny rules.
+ * Conversely, a RELATIVE rule glob (no leading `/`, `//`, or `~`) is anchored
+ * to the current directory at match time — `projectRoot` when supplied, else
+ * `process.cwd()` — per the host's "relative to current directory" semantics.
+ * The literal glob is kept as well, so both a relative access path and an
+ * absolute one are matched.
  *
  * realpath is best-effort: if the file does not exist yet (ENOENT)
  * or the syscall fails for any reason, the lexical resolved form is
@@ -534,32 +620,59 @@ export function evaluateCommandDenyOnly(command, policies, caseInsensitive = pro
  */
 export function evaluateFilePath(filePath, denyGlobs, caseInsensitive = process.platform === "win32" || process.platform === "darwin", projectRoot) {
     const toForward = (path) => path.replace(/\\/g, "/");
-    // Match against the raw input, the lexically-resolved absolute path,
-    // and the canonical (symlink-resolved) path when the file exists.
-    // Deduplicated so absolute inputs and paths that don't cross symlinks
-    // don't pay the matching cost multiple times.
+    // File-side candidates: raw, tilde-expanded, anchored-resolved, canonical.
     const candidates = new Set();
     candidates.add(toForward(filePath));
-    if (projectRoot) {
-        const lexical = resolve(projectRoot, filePath);
-        candidates.add(toForward(lexical));
-        try {
-            candidates.add(toForward(realpathSync(lexical)));
-        }
-        catch {
-            // File does not exist yet, or realpath failed — rely on lexical form.
-        }
+    const expandedFilePath = expandHomeTilde(filePath);
+    if (expandedFilePath !== filePath) {
+        candidates.add(toForward(expandedFilePath));
+    }
+    const lexical = resolve(projectRoot ?? process.cwd(), expandedFilePath);
+    candidates.add(toForward(lexical));
+    try {
+        candidates.add(toForward(realpathSync(lexical)));
+    }
+    catch {
+        // File does not exist yet, or realpath failed — rely on lexical form.
     }
     for (const globs of denyGlobs) {
         for (const glob of globs) {
+            // Rule-side variants: the literal glob (`//` intact, so Windows UNC
+            // rules still match UNC candidates), its `//`-collapsed root-absolute
+            // anchor form, the `~`-expanded form of each, and a best-effort
+            // symlink-resolved twin of every variant. Matching all of them against
+            // every candidate keeps both sides symmetric.
+            const anchors = new Set();
+            anchors.add(glob);
+            anchors.add(normalizeRuleAnchor(glob));
+            const expandedGlob = expandHomeTilde(glob);
+            if (expandedGlob !== glob) {
+                anchors.add(expandedGlob);
+                anchors.add(normalizeRuleAnchor(expandedGlob));
+            }
+            // Match-time cwd anchor for relative rules (host: "relative to current
+            // directory"). `**/...` rules already reached absolute candidates; bare
+            // `secret/**`, `.env`, `credentials*` did not without this twin.
+            if (!isAbsolute(glob) && !glob.startsWith("~")) {
+                anchors.add(resolve(projectRoot ?? process.cwd(), glob));
+            }
+            const variants = new Set();
+            for (const variant of anchors) {
+                variants.add(variant);
+                const canonical = canonicalizeGlob(variant);
+                if (canonical !== null)
+                    variants.add(canonical);
+            }
             // Normalize the glob's path separators the same way candidates were
             // normalized — otherwise a Windows absolute deny rule like
             // `Read(C:\Users\...\secret.env)` parses with literal backslashes that
             // never match a forward-slash candidate.
-            const regex = fileGlobToRegex(toForward(glob), caseInsensitive);
-            for (const candidate of candidates) {
-                if (regex.test(candidate)) {
-                    return { denied: true, matchedPattern: glob };
+            for (const variant of variants) {
+                const regex = fileGlobToRegex(toForward(variant), caseInsensitive);
+                for (const candidate of candidates) {
+                    if (regex.test(candidate)) {
+                        return { denied: true, matchedPattern: glob };
+                    }
                 }
             }
         }
@@ -589,6 +702,8 @@ export function evaluateFilePath(filePath, denyGlobs, caseInsensitive = process.
  *
  * A path equal to the project root itself counts as inside. Comparison is
  * case-insensitive on Windows/macOS to match those filesystems' semantics.
+ * A leading `~` in `filePath` is expanded to the user's home directory for
+ * consistency with `evaluateFilePath`.
  *
  * Returns `true` when `projectRoot` is falsy (no boundary to enforce) so the
  * caller's fail-open posture is preserved when the root cannot be resolved.
@@ -597,7 +712,7 @@ export function isPathInsideProject(filePath, projectRoot, caseInsensitive = pro
     if (!projectRoot)
         return true;
     const root = resolve(projectRoot);
-    const lexical = resolve(projectRoot, filePath);
+    const lexical = resolve(projectRoot, expandHomeTilde(filePath));
     const within = (root, candidate) => {
         let a = root;
         let b = candidate;