@nexrall/code-core 1.4.76 → 1.4.78

package/dist/mcp/manager.js

@@ -41,6 +41,7 @@ const client_1 = require("./client");
 const httpClient_1 = require("./httpClient");
 const sseClient_1 = require("./sseClient");
 const index_1 = require("../plugins/index");
+const resolve_1 = require("../plugins/resolve");
 const stats_1 = require("./stats");
 // ─── McpManager ───────────────────────────────────────────────────────────────
 class McpManager {
@@ -119,7 +120,8 @@ class McpManager {
         // Plugins first, then user, then project — later assignments override, so
         // a user/project server definition beats a plugin's same-name one.
         try {
-            Object.assign(merged.mcpServers, (0, index_1.pluginMcpServers)(workDir));
+            // resolvePluginMcpServers = pluginMcpServers + `${user_config.KEY}` substitution (S24).
+            Object.assign(merged.mcpServers, (0, resolve_1.resolvePluginMcpServers)(workDir));
         }
         catch {
             /* plugin scan is best-effort */
@@ -196,23 +198,6 @@ class McpManager {
         }
         return tools;
     }
-    /**
-     * Execute an MCP tool call. Returns null if this tool is not an MCP tool.
-     *
-     * `abortSignal` is optional and best-effort: the underlying transports (stdio
-     * JSON-RPC / HTTP / SSE) have no cancellation message in this client, so an
-     * abort here does NOT stop the server from finishing its work — it only stops
-     * THIS CALL from making the caller wait for it. Before this was added, Ctrl+C
-     * during an MCP tool call was silently swallowed: loop.ts set
-     * `abortSignal.aborted = true` but nothing downstream of `options.mcpManager
-     * .callTool(name, input)` ever looked at it, so the user's only way out was
-     * to wait out the full 60s MCP_TOOL_TIMEOUT_MS (or however long the server
-     * actually took). Racing the same abortSignal the 60s timeout already races
-     * against makes Ctrl+C return control immediately instead of up to a minute
-     * later — matching how the `bash` tool already behaves (its own 200ms abort
-     * poll in executor.ts), just without the ability to also kill a remote
-     * server's in-flight work the way `bash` can kill a local child process.
-     */
     async callTool(prefixedName, input, abortSignal) {
         const serverName = this._toolMap.get(prefixedName);
         if (!serverName)
@@ -222,48 +207,70 @@ class McpManager {
             return null;
         // Strip the server prefix to get the real tool name
         const toolName = prefixedName.slice(serverName.length + 2);
-        // Enforce a timeout — a hung MCP server would otherwise block the agent loop forever.
+        // One attempt's full race — a fresh timeout, abort poll and stat pairing per try,
+        // because a promise cannot be awaited twice and S25e's retry below builds new ones.
         const MCP_TOOL_TIMEOUT_MS = 60000;
-        const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`MCP tool "${prefixedName}" timed out after ${MCP_TOOL_TIMEOUT_MS / 1000}s`)), MCP_TOOL_TIMEOUT_MS));
-        // Timing covers the whole path the user waits on (server round-trip AND the
-        // race against the 60s timeout / abort), which is what "how long did that take"
-        // means from the outside. The tool name recorded is the PREFIXED one, so the
-        // stats of two servers with a same-named tool never merge.
-        const startedAt = Date.now();
-        this.stats.begin();
-        const timed = (p) => p.then((v) => {
-            this.stats.ok(prefixedName, Date.now() - startedAt);
-            return v;
-        }, (e) => {
-            this.stats.fail(prefixedName, Date.now() - startedAt, e.message || String(e));
-            throw e;
-        });
-        // A 401 mid-CALL is different from one at connect: the server is already up and
-        // some tools work — record it so /mcp flips to needs-auth (with the missing
-        // scope) and let the enriched message reach the caller (the model sees WHY).
-        const trackAuth = (p) => p.catch((err) => {
-            if (err instanceof httpClient_1.McpOAuthRequiredError)
-                this._needsAuth.set(serverName, err.wwwAuthenticate);
-            throw err;
-        });
-        const racers = [timed(client.callTool(toolName, input)), timed(timeoutPromise)];
-        if (abortSignal) {
-            let pollId;
-            const abortPromise = new Promise((_, reject) => {
-                pollId = setInterval(() => {
-                    if (abortSignal.aborted) {
-                        clearInterval(pollId);
-                        reject(Object.assign(new Error('Aborted'), { name: 'AbortError' }));
-                    }
-                }, 100);
+        const once = () => {
+            const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`MCP tool "${prefixedName}" timed out after ${MCP_TOOL_TIMEOUT_MS / 1000}s`)), MCP_TOOL_TIMEOUT_MS));
+            // Timing covers the whole path the user waits on (server round-trip AND the
+            // race against the 60s timeout / abort), which is what "how long did that take"
+            // means from the outside. The tool name recorded is the PREFIXED one, so the
+            // stats of two servers with a same-named tool never merge.
+            const startedAt = Date.now();
+            this.stats.begin();
+            const timed = (p) => p.then((v) => {
+                this.stats.ok(prefixedName, Date.now() - startedAt);
+                return v;
+            }, (e) => {
+                this.stats.fail(prefixedName, Date.now() - startedAt, e.message || String(e));
+                throw e;
+            });
+            // A 401 mid-CALL is different from one at connect: the server is already up and
+            // some tools work — record it so /mcp flips to needs-auth (with the missing
+            // scope) and let the enriched message reach the caller (the model sees WHY).
+            const trackAuth = (p) => p.catch((err) => {
+                if (err instanceof httpClient_1.McpOAuthRequiredError)
+                    this._needsAuth.set(serverName, err.wwwAuthenticate);
+                throw err;
             });
-            racers.push(timed(abortPromise));
-            // Clearing the poll on whichever branch wins avoids leaving a live interval
-            // (and the closure it holds) running for the rest of the process lifetime —
-            // the same leak-prevention pattern client.ts uses for its own abort poll.
-            return trackAuth(Promise.race(racers).finally(() => clearInterval(pollId)));
+            const racers = [timed(client.callTool(toolName, input)), timed(timeoutPromise)];
+            if (abortSignal) {
+                let pollId;
+                const abortPromise = new Promise((_, reject) => {
+                    pollId = setInterval(() => {
+                        if (abortSignal.aborted) {
+                            clearInterval(pollId);
+                            reject(Object.assign(new Error('Aborted'), { name: 'AbortError' }));
+                        }
+                    }, 100);
+                });
+                racers.push(timed(abortPromise));
+                // Clearing the poll on whichever branch wins avoids leaving a live interval
+                // (and the closure it holds) running for the rest of the process lifetime —
+                // the same leak-prevention pattern client.ts uses for its own abort poll.
+                return trackAuth(Promise.race(racers).finally(() => clearInterval(pollId)));
+            }
+            return trackAuth(Promise.race(racers));
+        };
+        try {
+            return await once();
+        }
+        catch (err) {
+            const hook = this.onAuthRequired;
+            if (!hook || !(err instanceof httpClient_1.McpOAuthRequiredError))
+                throw err;
+            let retry;
+            try {
+                retry = await hook(serverName, err.missingScope ?? '');
+            }
+            catch {
+                retry = false; // a broken host hook must not mask the OAuth error
+            }
+            if (!retry)
+                throw err;
+            // The host re-authorized (fresh tokens are in): one retry, no loop.
+            return await once();
         }
-        return trackAuth(Promise.race(racers));
     }
     /** Resources across connected, enabled servers. One server failing never hides the others. */
     async listResources(server) {

package/dist/permissions/destructiveTokens.d.ts

@@ -32,4 +32,5 @@ export interface TokenMatch {
 /** Split `src` into simple commands, each a list of unquoted words. */
 export declare function tokenize(src: string): string[][];
 export declare function classifyTokens(tokens: string[], recurse: (command: string) => TokenMatch | null, rawSql: (command: string) => TokenMatch | null): TokenMatch | null;
+export declare function unwrappedViews(command: string): string[];
 //# sourceMappingURL=destructiveTokens.d.ts.map

package/dist/permissions/destructiveTokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"destructiveTokens.d.ts","sourceRoot":"","sources":["../../src/permissions/destructiveTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CA6DhD;AAsVD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,EAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,GAC7C,UAAU,GAAG,IAAI,CA+HnB"}
+{"version":3,"file":"destructiveTokens.d.ts","sourceRoot":"","sources":["../../src/permissions/destructiveTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CA6DhD;AAsVD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,EAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,GAC7C,UAAU,GAAG,IAAI,CA+HnB;AAyBD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAKxD"}

package/dist/permissions/destructiveTokens.js

@@ -23,6 +23,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.tokenize = tokenize;
 exports.classifyTokens = classifyTokens;
+exports.unwrappedViews = unwrappedViews;
 const hit = (category, reason) => ({ category, reason });
 /** Split `src` into simple commands, each a list of unquoted words. */
 function tokenize(src) {
@@ -552,4 +553,96 @@ function classifyTokens(tokens, recurse, rawSql) {
     }
     return null;
 }
+// ─── Every spelling of the command, for the permission-rule matcher ─────────
+//
+// A deny/ask rule must not be skippable by dressing the command up. Claude Code
+// fixed exactly this class (2.1.288/289): "a deny or ask rule … missing a
+// command behind an environment variable prefix with an expanded value (e.g.
+// `TZ="$HOME" rm -rf build`)" and "a bare variable assignment came before the
+// command". The destructive guard has always seen through these (tokenize +
+// classifyTokens above); the RULE matcher had not, so `permissions.deny:
+// ["Bash(rm:*)"]` silently did nothing against `FOO=bar rm -rf build`.
+//
+// unwrappedViews returns every "command actually run" spelling hiding in one
+// command line, using this module's tokenizer and the same wrapper tables as
+// classifyTokens, so anything the guard can see, a rule can see too:
+//
+//   'FOO=bar sudo rm -rf build'  → 'sudo rm -rf build', 'rm -rf build'
+//   'cd /tmp && FOO=1 rm -rf x'  → 'cd /tmp', 'rm -rf x'
+//   'echo $(rm -rf build)'       → 'echo $', 'rm -rf build'
+//
+// Deliberately NOT unwrapped (same as classifyTokens's guard scope):
+// ssh / docker exec / kubectl exec — reaching into those needs the remote or
+// container branch, tracked separately.
+//
+// Order: most literal first (wrappers still attached), then each peeled form.
+function unwrappedViews(command) {
+    if (typeof command !== 'string' || command.length === 0)
+        return [];
+    const out = new Set();
+    collectViews(command, out, 0);
+    return [...out];
+}
+/** Flags of a peelable wrapper that consume a following value (mirror of classifyTokens). */
+const WRAPPER_VALUE_FLAGS = {
+    sudo: new Set(['-u', '-g', '-h', '-p', '-C', '-D', '-R', '-T', '-U']),
+    doas: new Set(['-u', '-g', '-h', '-p', '-C', '-D', '-R', '-T', '-U']),
+    env: new Set(['-u', '-C', '-S']),
+    nice: new Set(['-n']),
+    ionice: new Set(['-c', '-n', '-p']),
+    command: new Set(),
+    builtin: new Set(),
+    nohup: new Set(),
+    exec: new Set(),
+    time: new Set(),
+    setsid: new Set(),
+    caffeinate: new Set(),
+    stdbuf: new Set(),
+    unbuffer: new Set(),
+};
+/** `command -v rm` (or `-V`, `-pv`) only PRINTS where rm is — never peel it into `rm`. */
+const LOOKUP_FLAG = /^-p?[vV]+$/;
+function collectViews(src, out, depth) {
+    if (depth > 3)
+        return;
+    for (const tokens of tokenize(src)) {
+        let t = tokens;
+        for (let guard = 0; guard < 12; guard++) {
+            while (t.length && (ENV_ASSIGN.test(t[0]) || CONTROL_WORDS.has(t[0])))
+                t = t.slice(1);
+            if (t.length === 0)
+                break;
+            out.add(t.join(' '));
+            const bin = base(t[0]);
+            const args = t.slice(1);
+            // bash -c "…" / eval "…" carry the command as a STRING — read it too.
+            if (SHELLS.has(bin)) {
+                const i = args.findIndex((a) => /^-[A-Za-z]*c[A-Za-z]*$/.test(a));
+                if (i >= 0 && args[i + 1] !== undefined)
+                    collectViews(args[i + 1], out, depth + 1);
+                break;
+            }
+            if (bin === 'eval') {
+                collectViews(args.join(' '), out, depth + 1);
+                break;
+            }
+            if (bin === 'timeout') {
+                t = dropOpts(args, new Set(['-s', '-k'])).slice(1); // timeout DURATION cmd
+                continue;
+            }
+            if (bin === 'xargs') {
+                t = dropOpts(args, new Set(['-I', '-n', '-P', '-L', '-s', '-d', '-E', '-a', '-J']));
+                continue;
+            }
+            if ((bin === 'command' || bin === 'builtin') && args.some((a) => LOOKUP_FLAG.test(a)))
+                break;
+            const valueFlags = WRAPPER_VALUE_FLAGS[bin];
+            if (valueFlags) {
+                t = dropOpts(args, valueFlags);
+                continue;
+            }
+            break;
+        }
+    }
+}
 //# sourceMappingURL=destructiveTokens.js.map

package/dist/permissions/rules.d.ts

@@ -15,6 +15,18 @@ export declare function setSessionRules(r: Partial<PermissionRules>): void;
 export declare function setSessionSettings(obj: Record<string, unknown> | null): void;
 export declare function getSessionSettings(): Record<string, unknown> | null;
 export declare function loadSettings(workDir: string): MergedSettings;
+/**
+ * S25b: the raw object of every settings tier, in precedence order (managed →
+ * user → project → local → `--settings` session settings). For resolvers where
+ * the STRICTEST value must win regardless of tier — `maxEffortLevel` (a cap can
+ * only be tightened by a lower-precedence file, never loosened), and anything
+ * with the same one-way semantics added later. `loadSettings().raw` cannot serve
+ * those: it merges with LAST-wins, which is the opposite direction.
+ */
+export declare function settingsTiersRaw(workDir: string): Array<{
+    tier: string;
+    raw: Record<string, unknown>;
+}>;
 /** The first ALLOW rule that matches this call, or null. S20's classifier gate
  * reads this to tell a NARROW pre-approval (wins, no review) from a BROAD one
  * (suspended while the classifier is on — see isBroadAllowRule). */

package/dist/permissions/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAQ5C;AAsBD,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAEjE;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAE5E;AACD,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAEnE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CA8B5D;AAqJD;;oEAEoE;AACpE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAEf;AAYD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOtD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AA0BA,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,eAAe,CAAC;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAQ5C;AAsBD,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAEjE;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAE5E;AACD,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAEnE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CA8B5D;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAcvG;AAsMD;;oEAEoE;AACpE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAEf;AAYD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOtD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,IAAI,CAK3B"}

package/dist/permissions/rules.js

@@ -38,12 +38,15 @@ exports.setSessionRules = setSessionRules;
 exports.setSessionSettings = setSessionSettings;
 exports.getSessionSettings = getSessionSettings;
 exports.loadSettings = loadSettings;
+exports.settingsTiersRaw = settingsTiersRaw;
 exports.matchedAllowRule = matchedAllowRule;
 exports.isBroadAllowRule = isBroadAllowRule;
 exports.evaluatePermission = evaluatePermission;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+const modePolicy_1 = require("./modePolicy");
+const destructiveTokens_1 = require("./destructiveTokens");
 function managedSettingsPath() {
     // Tests (and a sandboxed doctor run) point this at a fixture. Checked first so it
     // can never be shadowed by a real machine-level file.
@@ -120,6 +123,31 @@ function loadSettings(workDir) {
     merged.deny.push(...sessionRules.deny);
     return { permissions: merged, raw };
 }
+/**
+ * S25b: the raw object of every settings tier, in precedence order (managed →
+ * user → project → local → `--settings` session settings). For resolvers where
+ * the STRICTEST value must win regardless of tier — `maxEffortLevel` (a cap can
+ * only be tightened by a lower-precedence file, never loosened), and anything
+ * with the same one-way semantics added later. `loadSettings().raw` cannot serve
+ * those: it merges with LAST-wins, which is the opposite direction.
+ */
+function settingsTiersRaw(workDir) {
+    const files = [
+        ['managed', managedSettingsPath()],
+        ['user', path.join(os.homedir(), '.nexrall', 'settings.json')],
+        ['project', path.join(workDir, '.nexrall', 'settings.json')],
+        ['local', path.join(workDir, '.nexrall', 'settings.local.json')],
+    ];
+    const out = [];
+    for (const [tier, file] of files) {
+        const obj = readJson(file);
+        if (obj)
+            out.push({ tier, raw: obj });
+    }
+    if (sessionSettings)
+        out.push({ tier: 'session', raw: sessionSettings });
+    return out;
+}
 // ─── Rule matching ──────────────────────────────────────────────────────────
 function parseRule(rule) {
     const m = /^([A-Za-z0-9_]+)\((.*)\)$/.exec(rule.trim());
@@ -180,8 +208,21 @@ function matchPattern(pattern, value) {
     }
     return value === pattern;
 }
-/** Map a tool's input to the string(s) a rule pattern should match against. */
-function matchValues(tool, input, workDir) {
+/** The command line of a bash-family call: `command`, falling back to the `cmd`
+ * alias every other reader accepts (destructive guard, CLI handler). */
+function bashCommand(input) {
+    const v = input.command ?? input.cmd;
+    return typeof v === 'string' ? v : '';
+}
+/** Map a tool's input to the string(s) a rule pattern should match against.
+ *
+ * S25f: deny/ask matching ALSO sees a path's real identity behind symlinks —
+ * Claude Code 2.1.289 fixed exactly this class ("Read deny rules not applying
+ * to files @-mentioned, changed, or selected in the IDE through a symlink").
+ * The allow path skips those views (`followSymlinks: false`): an exception
+ * stays as NARROW as it was written — the same asymmetry the unwrapped bash
+ * views in destructiveTokens use. */
+function matchValues(tool, input, workDir, followSymlinks = false) {
     const str = (v) => (typeof v === 'string' ? v : '');
     const vals = [];
     const pushPath = (p) => {
@@ -192,10 +233,36 @@ function matchValues(tool, input, workDir) {
             vals.push(path.relative(workDir, p));
         else
             vals.push(path.resolve(workDir, p));
+        if (!followSymlinks)
+            return;
+        const abs = path.resolve(workDir, p);
+        try {
+            const real = fs.realpathSync(abs);
+            if (real !== abs)
+                vals.push(real, path.relative(workDir, real));
+        }
+        catch {
+            // A path being CREATED through a symlinked directory: resolve the parent.
+            try {
+                const realDir = fs.realpathSync(path.dirname(abs));
+                const realAbs = path.join(realDir, path.basename(abs));
+                vals.push(realAbs, path.relative(workDir, realAbs));
+            }
+            catch {
+                /* neither exists: nothing to resolve */
+            }
+        }
     };
     switch (tool) {
+        // The whole bash family, matching modePolicy.BASH_TOOLS: the executor emits
+        // `bash`, and run_command / execute_command are the same tool accepted
+        // everywhere else (destructive guard, CLI handler). A `Bash(…)` rule must
+        // not silently skip a call that arrives under one of those names — the
+        // "looks configured and isn't" failure class the task rules had.
         case 'bash':
-            vals.push(str(input.command));
+        case 'run_command':
+        case 'execute_command':
+            vals.push(bashCommand(input));
             break;
         case 'move_file':
             pushPath(str(input.source));
@@ -241,7 +308,7 @@ function ruleMatches(rule, tool, input, workDir, opts) {
         Read: ['read_file', 'list_directory', 'search_files', 'glob', 'notebook_read'],
         Edit: ['edit_file', 'multi_edit', 'write_file', 'notebook_edit'],
         Write: ['write_file', 'write_docx', 'write_xlsx', 'write_pptx'],
-        Bash: ['bash'],
+        Bash: ['bash', 'run_command', 'execute_command'],
         WebFetch: ['fetch_url'],
         Image: ['generate_image', 'stock_photo'],
     };
@@ -255,15 +322,30 @@ function ruleMatches(rule, tool, input, workDir, opts) {
     // "Bash(npm run test:*)" allow rule straight past the user prompt.
     // Deny rules stay aggressive (they SHOULD match chained commands), and a
     // bare "Bash" allow (pattern === null) is an explicit "allow everything".
-    if (opts?.forAllow && tool === 'bash' && pattern !== null && pattern !== '' && pattern !== '*') {
-        const cmd = typeof input.command === 'string' ? input.command : '';
+    if (opts?.forAllow && modePolicy_1.BASH_TOOLS.has(tool) && pattern !== null && pattern !== '' && pattern !== '*') {
+        const cmd = bashCommand(input);
         // newline / ; / && / || / | / trailing & / command-substitution / backtick
         if (/[\r\n;`]|&&|\|\||\||&\s*$|\$\(/.test(cmd))
             return false;
     }
     if (pattern === null || pattern === '' || pattern === '*')
         return true;
-    return matchValues(tool, input, workDir).some((v) => matchPattern(pattern, v));
+    if (matchValues(tool, input, workDir, !opts?.forAllow).some((v) => matchPattern(pattern, v)))
+        return true;
+    // Deny / ask rules must also see the command BEHIND a costume: env
+    // assignments (`TZ="$HOME" rm -rf build` — Claude Code's own fix class,
+    // 2.1.288/289), wrappers (`sudo`, `env`, `nice`, `timeout`, `xargs`, shell
+    // `-c`, `eval`), compound separators (`;` `&&` `||` `|`) and `$(…)` /
+    // backtick bodies. The destructive guard has always read these spellings
+    // (destructiveTokens); a user's deny rule must not be the one thing a
+    // prefix can skip.
+    //
+    // ALLOW deliberately stays exact — an exception is only as WIDE as it was
+    // written, and env vars can execute code (NODE_OPTIONS, LD_PRELOAD…), so
+    // `FOO=x npm run test` must not ride `Bash(npm run test:*)` without asking.
+    if (opts?.forAllow || !modePolicy_1.BASH_TOOLS.has(tool))
+        return false;
+    return (0, destructiveTokens_1.unwrappedViews)(bashCommand(input)).some((v) => matchPattern(pattern, v));
 }
 /** The first ALLOW rule that matches this call, or null. S20's classifier gate
  * reads this to tell a NARROW pre-approval (wins, no review) from a BROAD one

package/dist/plugins/configStore.d.ts

@@ -0,0 +1,43 @@
+import { type UserConfigOption } from './userConfig';
+type SecretMap = Record<string, Record<string, unknown>>;
+/** The whole secrets file ({} when absent/unreadable/malformed). */
+export declare function readPluginSecrets(): SecretMap;
+/**
+ * `pluginConfigs` from every settings tier, merged per plugin per key
+ * (last tier wins — the same direction loadSettings uses for `raw`).
+ */
+export declare function pluginConfigsFromSettings(workDir: string): Record<string, Record<string, unknown>>;
+export interface ResolvedPluginConfig {
+    /** key → effective value (valid sources only, default included). */
+    values: Record<string, unknown>;
+    /** key → where the value came from. */
+    sources: Record<string, 'secret' | 'settings' | 'default'>;
+    /** required options with no value anywhere (not even a default). */
+    missing: string[];
+    /** Values that failed validation, with their source — reported, not used. */
+    invalid: Array<{
+        key: string;
+        source: 'secret' | 'settings';
+        error: string;
+    }>;
+}
+/** Resolve every declared option to its effective value. Pure reads. */
+export declare function resolvePluginConfig(workDir: string, pluginName: string, options: UserConfigOption[]): ResolvedPluginConfig;
+export interface SavePluginConfigResult {
+    ok: boolean;
+    /** Nothing was written when this is non-empty. */
+    errors: string[];
+    /** Paths actually written. */
+    wroteSettings?: string;
+    wroteSecrets?: boolean;
+}
+/**
+ * Validate + save values. Unknown keys are errors (a typo must not create a
+ * silent no-op entry), as are values that fail their option's validation. The
+ * two halves land in different stores (see the file header).
+ */
+export declare function savePluginConfig(workDir: string, pluginName: string, options: UserConfigOption[], values: Record<string, unknown>, opts?: {
+    scope?: 'user' | 'project';
+}): SavePluginConfigResult;
+export {};
+//# sourceMappingURL=configStore.d.ts.map

package/dist/plugins/configStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configStore.d.ts","sourceRoot":"","sources":["../../src/plugins/configStore.ts"],"names":[],"mappings":"AA2BA,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAmD9E,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzD,oEAAoE;AACpE,wBAAgB,iBAAiB,IAAI,SAAS,CAQ7C;AAgBD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAWlG;AAED,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC;IAC3D,oEAAoE;IACpE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6EAA6E;IAC7E,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,EAAE,GAC1B,oBAAoB,CA+BtB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,kDAAkD;IAClD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,EAAE,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GACxC,sBAAsB,CAkDxB"}