@nexrall/code-core 1.4.77 → 1.4.78

package/dist/agent/effortCap.d.ts

@@ -0,0 +1,24 @@
+/** Canonical ladder, low → high. A resolved cap normalizes to one of these. */
+export declare const EFFORT_CAP_LEVELS: readonly ["low", "medium", "high", "xhigh", "max"];
+export type EffortCapLevel = (typeof EFFORT_CAP_LEVELS)[number];
+/** Canonical rank of an effort token, or null when it is not on the ladder. */
+export declare function effortRank(level: string): number | null;
+export interface EffortCapResolution {
+    /** The effective cap (canonical name), or null when no tier sets a valid one. */
+    cap: EffortCapLevel | null;
+    /** Which tier supplied the deciding (strictest) value. Null when cap is null. */
+    tier: string | null;
+    /** Tier values that were ignored because they are not on the ladder. */
+    ignored: Array<{
+        tier: string;
+        value: string;
+    }>;
+}
+/**
+ * Resolve the effective `maxEffortLevel` across the settings tiers. A value the
+ * ladder does not know is IGNORED and reported (`ignored`) rather than guessed
+ * at — a typo must not silently disable the cap, but it must not silently clamp
+ * to the wrong level either; the caller surfaces it in one line.
+ */
+export declare function resolveMaxEffortCap(workDir: string): EffortCapResolution;
+//# sourceMappingURL=effortCap.d.ts.map

package/dist/agent/effortCap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effortCap.d.ts","sourceRoot":"","sources":["../../src/agent/effortCap.ts"],"names":[],"mappings":"AAeA,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,oDAAqD,CAAC;AACpF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAgBhE,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIvD;AAED,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IAC3B,iFAAiF;IACjF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,wEAAwE;IACxE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,CAexE"}

package/dist/agent/effortCap.js

@@ -0,0 +1,66 @@
+"use strict";
+// S25b — `maxEffortLevel`: a CAP on the thinking-effort level (Claude Code W37
+// parity — "caps the effort level on every provider… users can still pick a
+// lower level"). The cap is read from every settings tier, and the STRICTEST
+// value wins: a cap can only be TIGHTENED, never loosened, by a lower-precedence
+// file — a cloned repo's `.nexrall/settings.json` cannot raise the ceiling the
+// user or an admin set.
+//
+// One ladder for every provider: each model scale (anthropic low…ultra,
+// deepseek low/high/max, qwen thinking off/on, glm low/high/max, openai
+// low/medium/high) resolves onto the canonical ranks below, so a single cap
+// value means the same thing on every model. The CLI half that walks a model's
+// own wire scale lives in packages/cli/src/effortCap.ts.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EFFORT_CAP_LEVELS = void 0;
+exports.effortRank = effortRank;
+exports.resolveMaxEffortCap = resolveMaxEffortCap;
+const rules_1 = require("../permissions/rules");
+/** Canonical ladder, low → high. A resolved cap normalizes to one of these. */
+exports.EFFORT_CAP_LEVELS = ['low', 'medium', 'high', 'xhigh', 'max'];
+/** Wire/UI tokens (aliases included) → canonical rank. `extra`/`ultra` are this
+ * codebase's legacy anthropic UI labels (extra→xhigh, ultra→max, translated
+ * server-side by routes/code.js's EFFORT_MAP); the rest are the real wire values
+ * across the provider styles. */
+const EFFORT_RANK = {
+    low: 0,
+    medium: 1,
+    high: 2,
+    extra: 3,
+    xhigh: 3,
+    max: 4,
+    ultra: 4,
+};
+/** Canonical rank of an effort token, or null when it is not on the ladder. */
+function effortRank(level) {
+    if (typeof level !== 'string')
+        return null;
+    const r = EFFORT_RANK[level.trim().toLowerCase()];
+    return r === undefined ? null : r;
+}
+/**
+ * Resolve the effective `maxEffortLevel` across the settings tiers. A value the
+ * ladder does not know is IGNORED and reported (`ignored`) rather than guessed
+ * at — a typo must not silently disable the cap, but it must not silently clamp
+ * to the wrong level either; the caller surfaces it in one line.
+ */
+function resolveMaxEffortCap(workDir) {
+    let best = null;
+    const ignored = [];
+    for (const { tier, raw } of (0, rules_1.settingsTiersRaw)(workDir)) {
+        const v = raw.maxEffortLevel;
+        if (v === undefined)
+            continue;
+        const rank = typeof v === 'string' ? effortRank(v) : null;
+        if (rank === null) {
+            ignored.push({ tier, value: typeof v === 'string' ? v : (JSON.stringify(v) ?? 'null') });
+            continue;
+        }
+        if (!best || rank < best.rank)
+            best = { rank, tier };
+    }
+    if (!best)
+        return { cap: null, tier: null, ignored };
+    return { cap: exports.EFFORT_CAP_LEVELS[best.rank], tier: best.tier, ignored };
+}
+//# sourceMappingURL=effortCap.js.map

package/dist/agent/hooks.d.ts

@@ -36,7 +36,15 @@ export interface HookDef {
      */
     asyncRewake?: boolean;
     /**
-     * Run the hook once per session — after its first SUCCESSFUL run (exit 0) it is
+     * S24: the plugin's resolved userConfig as environment variables
+     * (NEXRALL_PLUGIN_OPTION_<KEY> — baked in by resolvePluginHooks). A shell-form
+     * hook reads a value from here because `${user_config.*}` is rejected inside
+     * a shell-form command (the substituted value would be re-parsed by the
+     * shell; validate.ts reports the reference).
+     */
+    pluginOptions?: Record<string, string>;
+    /**
+     * `once`: run the hook once per session — after its first SUCCESSFUL run (exit 0) it is
      * skipped; a failure, exit 2 or a timeout leaves it armed. Claude Code only honours
      * this in skill frontmatter; Nexrall honours it wherever the hook is declared.
      */
@@ -56,7 +64,7 @@ export interface HookDef {
     input?: Record<string, unknown>;
     /**
      * Which plugin this handler came from (stamped by the loader when it merges a
-     * plugin's hooks.json — see pluginHooks in ../plugins/index). Its processes are
+     * plugin's hooks.json — see resolvePluginHooks in ../plugins/resolve). Its processes are
      * then started with NEXRALL_PLUGIN_DATA pointing at that plugin's OWN persistent
      * data directory, the one place it may keep files across plugin updates.
      */

package/dist/agent/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/agent/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA0C,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGjH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAUlE,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AACD,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACzB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC1C,uHAAuH;IACvH,gBAAgB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC9C,yFAAyF;IACzF,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACxC,iIAAiI;IACjI,iBAAiB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC1C,2GAA2G;IAC3G,kBAAkB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAChD,8GAA8G;IAC9G,aAAa,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC3C,0DAA0D;IAC1D,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC,8GAA8G;IAC9G,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAChD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC,kIAAkI;IAClI,gBAAgB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC9C,sHAAsH;IACtH,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC5C,gEAAgE;IAChE,eAAe,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC7C,yDAAyD;IACzD,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACxC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC5C,4GAA4G;IAC5G,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC1C,6DAA6D;IAC7D,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC5C,gDAAgD;IAChD,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC5C,gIAAgI;IAChI,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACnC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC3C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;CAChD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,WAAW,CAQjF;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAiCtD;AAmCD,2GAA2G;AAC3G,MAAM,MAAM,aAAa,GACrB,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,GACZ,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,gBAAgB,GAChB,OAAO,CAAC;AAgCZ,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAgBD,MAAM,WAAW,YAAY;IAC3B,qFAAqF;IACrF,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAEjE;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAEzF;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,IAAI,YAAY,EAAE,CAEpD;AAED,kFAAkF;AAClF,wBAAgB,aAAa,IAAI,YAAY,EAAE,CAK9C;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,CAEjE;AAeD,+EAA+E;AAC/E,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAuBD,wFAAwF;AACxF,MAAM,MAAM,aAAa,GAAG,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3B,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAGnD,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAE/D;AAQD,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;IAC1C,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,WAAW,CAAC;CAC7C;AAID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAEzF;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAkgBD,0FAA0F;AAC1F,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GACZ;IAAE,EAAE,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsBzF;AAuJD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,WAAW,CAErE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAa3F;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ5G;AA0BD,wBAAsB,YAAY,CAChC,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,EAChC,KAAK,EAAE,YAAY,GAAG,aAAa,EACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,UAAU,EACnB,QAAQ,CAAC,EAAE,WAAW,GACrB,OAAO,CAAC,WAAW,CAAC,CAmFtB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,EAC3B,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,QAAQ,CAAC,EAAE,WAAW,EACtB,KAAK,SAAS,GACb,OAAO,CAAC,IAAI,CAAC,CA4Bf;AA8CD,wFAAwF;AACxF,UAAU,WAAW;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,SAAS,EAC7C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,WAAW,GACrB,OAAO,CAAC,WAAW,CAAC,CA+EtB;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,SAAK,GACb,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB/D;AAWD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAChE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAwBD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,SAAK,GACb,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA4CnC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,iBAAiB,EACzB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACvE,OAAO,CAAC,iBAAiB,CAAC,CAuD5B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,mGAAmG;AACnG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,SAAsB,GAAG,IAAI,CAUxG;AAED,iHAAiH;AACjH,uFAAuF;AACvF,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC,CAcf"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/agent/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA0C,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGjH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAUlE,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AACD,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACzB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC1C,uHAAuH;IACvH,gBAAgB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC9C,yFAAyF;IACzF,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACxC,iIAAiI;IACjI,iBAAiB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC/C,+EAA+E;IAC/E,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC1C,2GAA2G;IAC3G,kBAAkB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAChD,8GAA8G;IAC9G,aAAa,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC3C,0DAA0D;IAC1D,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC,8GAA8G;IAC9G,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAChD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC,kIAAkI;IAClI,gBAAgB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC9C,sHAAsH;IACtH,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC5C,gEAAgE;IAChE,eAAe,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC7C,yDAAyD;IACzD,UAAU,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACxC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC5C,4GAA4G;IAC5G,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC1C,6DAA6D;IAC7D,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC5C,gDAAgD;IAChD,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC5C,gIAAgI;IAChI,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACnC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IAC3C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC;CAChD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,WAAW,CAQjF;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAiCtD;AAmCD,2GAA2G;AAC3G,MAAM,MAAM,aAAa,GACrB,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,GACZ,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,gBAAgB,GAChB,OAAO,CAAC;AAgCZ,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAgBD,MAAM,WAAW,YAAY;IAC3B,qFAAqF;IACrF,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAEjE;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAEzF;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,IAAI,YAAY,EAAE,CAEpD;AAED,kFAAkF;AAClF,wBAAgB,aAAa,IAAI,YAAY,EAAE,CAK9C;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,CAEjE;AAeD,+EAA+E;AAC/E,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAuBD,wFAAwF;AACxF,MAAM,MAAM,aAAa,GAAG,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3B,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAGnD,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAE/D;AAQD,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;IAC1C,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,WAAW,CAAC;CAC7C;AAID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAEzF;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAwgBD,0FAA0F;AAC1F,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GACZ;IAAE,EAAE,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsBzF;AAuJD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,WAAW,CAErE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAa3F;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ5G;AA0BD,wBAAsB,YAAY,CAChC,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,EAChC,KAAK,EAAE,YAAY,GAAG,aAAa,EACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,UAAU,EACnB,QAAQ,CAAC,EAAE,WAAW,GACrB,OAAO,CAAC,WAAW,CAAC,CAmFtB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,EAC3B,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,QAAQ,CAAC,EAAE,WAAW,EACtB,KAAK,SAAS,GACb,OAAO,CAAC,IAAI,CAAC,CA4Bf;AA8CD,wFAAwF;AACxF,UAAU,WAAW;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,SAAS,EAC7C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,WAAW,GACrB,OAAO,CAAC,WAAW,CAAC,CA+EtB;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,SAAK,GACb,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB/D;AAWD,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAChE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAwBD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,SAAK,GACb,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA4CnC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,iBAAiB,EACzB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACvE,OAAO,CAAC,iBAAiB,CAAC,CAuD5B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,aAAa,EACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,mGAAmG;AACnG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,SAAsB,GAAG,IAAI,CAUxG;AAED,iHAAiH;AACjH,uFAAuF;AACvF,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/agent/hooks.js

@@ -63,7 +63,7 @@ const client_1 = require("../api/client");
 const executor_1 = require("../tools/executor");
 const agentTypes_1 = require("./agentTypes");
 const rules_1 = require("../permissions/rules");
-const index_1 = require("../plugins/index");
+const resolve_1 = require("../plugins/resolve");
 const data_1 = require("../plugins/data");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -99,7 +99,7 @@ function loadHooks(workDir) {
         fromSettings = base;
     }
     // Merge plugin-provided hooks AFTER the project's own (project hooks run first).
-    const fromPlugins = (0, index_1.pluginHooks)(workDir);
+    const fromPlugins = (0, resolve_1.resolvePluginHooks)(workDir);
     const merged = { ...fromSettings };
     for (const phase of Object.keys(fromPlugins)) {
         const extra = fromPlugins[phase];
@@ -666,7 +666,13 @@ async function runHookHandler(hook, payload, opts) {
     // forgot would silently break the plugin's only place to keep state. HTTP and model
     // handlers ignore the variable; passing it costs nothing.
     const env = hook.plugin
-        ? { ...(opts.env ?? process.env), NEXRALL_PLUGIN_DATA: (0, data_1.ensurePluginDataDir)(hook.plugin) }
+        ? {
+            ...(opts.env ?? process.env),
+            NEXRALL_PLUGIN_DATA: (0, data_1.ensurePluginDataDir)(hook.plugin),
+            // S24: the plugin's resolved userConfig rides in as env vars for EVERY
+            // handler of that plugin (mcp_tool/http handlers simply ignore them).
+            ...(hook.pluginOptions ?? {}),
+        }
         : opts.env;
     return runWithHookEvents(hook, opts.event ?? 'hook', (onData) => {
         if (hook.type === 'http')

package/dist/agent/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/agent/skills.ts"],"names":[],"mappings":"AA2EA,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAC;IACrE,0IAA0I;IAC1I,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kHAAkH;IAClH,sBAAsB,EAAE,OAAO,CAAC;IAChC,iGAAiG;IACjG,aAAa,EAAE,OAAO,CAAC;IACvB,2GAA2G;IAC3G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8GAA8G;IAC9G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,0JAA0J;IAC1J,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAsSD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,KAAK,EAAO,GAClB;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,CAwB/C;AAED,kKAAkK;AAClK,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,EAAE,CAEnD;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAG1E;AAED,6GAA6G;AAC7G,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAE5D;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAE5D;AAED,oHAAoH;AACpH,wBAAgB,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAIvD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAYpD;AAwCD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,IAAI,EACpB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAC/C,MAAM,IAAI,CA2EZ;AAsBD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,yDAA0D,CAAC;AAE9F;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAoBrG;AAED,yGAAyG;AACzG,qBAAa,kBAAkB;IAIjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;gBAEzB,OAAO,EAAE,MAAM;IAE5C;;;;OAIG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE;IAUlD,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,EAAE;CA4CnC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CA4BlF;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAcpF"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/agent/skills.ts"],"names":[],"mappings":"AA4EA,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAC;IACrE,0IAA0I;IAC1I,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kHAAkH;IAClH,sBAAsB,EAAE,OAAO,CAAC;IAChC,iGAAiG;IACjG,aAAa,EAAE,OAAO,CAAC;IACvB,2GAA2G;IAC3G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8GAA8G;IAC9G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,0JAA0J;IAC1J,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAsSD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,KAAK,EAAO,GAClB;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,CAwB/C;AAED,kKAAkK;AAClK,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,EAAE,CAEnD;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAG1E;AAED,6GAA6G;AAC7G,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAE5D;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAE5D;AAED,oHAAoH;AACpH,wBAAgB,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAIvD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAYpD;AAwCD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,IAAI,EACpB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAC/C,MAAM,IAAI,CA2EZ;AAsBD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,yDAA0D,CAAC;AAE9F;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAoBrG;AAED,yGAAyG;AACzG,qBAAa,kBAAkB;IAIjB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;gBAEzB,OAAO,EAAE,MAAM;IAE5C;;;;OAIG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE;IAUlD,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,EAAE;CA4CnC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CA4BlF;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAyBpF"}

package/dist/agent/skills.js

@@ -50,6 +50,7 @@ const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const child_process_1 = require("child_process");
 const index_1 = require("../plugins/index");
+const resolve_1 = require("../plugins/resolve");
 const loader_1 = require("../commands/loader");
 const frontmatter_1 = require("../util/frontmatter");
 const agentTypes_1 = require("./agentTypes");
@@ -730,7 +731,19 @@ function resolveNestedSkill(workDir, ref) {
  * guidance without loading them into context up front.
  */
 function expandSkill(skill, argString, workDir) {
-    const expanded = (0, loader_1.expandBody)(skill.body, argString, workDir);
+    let expanded = (0, loader_1.expandBody)(skill.body, argString, workDir);
+    // S24: a PLUGIN skill's body may embed ${user_config.KEY} references — that is
+    // how a skill targets the value the user configured for its plugin. Only
+    // NON-sensitive values are substituted here: a sensitive reference stays the
+    // literal token, so a token never rides a skill into model context (the
+    // command/agent can still read it from NEXRALL_PLUGIN_OPTION_<KEY> in its own
+    // processes). Flat plugin commands have no `dir` and cannot be attributed to
+    // one plugin — they are skipped.
+    if (skill.source === 'plugin' && skill.dir) {
+        const cfg = (0, resolve_1.pluginConfigForSkillDir)(workDir, skill.dir);
+        if (cfg)
+            expanded = (0, resolve_1.substituteSkillBody)(expanded, cfg);
+    }
     if (!skill.dir)
         return expanded;
     let siblings = [];

package/dist/index.d.ts

@@ -27,6 +27,7 @@ export * from './mcp/stats';
 export * from './checkpoint/manager';
 export * from './commands/loader';
 export * from './agent/agentTypes';
+export * from './agent/effortCap';
 export * from './agent/planMode';
 export * from './agent/agentRegistry';
 export * from './agent/backgroundAgents';
@@ -40,6 +41,10 @@ export * from './plugins/installer';
 export * from './plugins/sources';
 export * from './plugins/data';
 export * from './plugins/eval';
+export * from './plugins/userConfig';
+export * from './plugins/configStore';
+export * from './plugins/validate';
+export * from './plugins/resolve';
 export * from './agent/trust';
 export * from './agent/crossProcessLock';
 export * from './agent/worktree';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -43,6 +43,7 @@ __exportStar(require("./mcp/stats"), exports);
 __exportStar(require("./checkpoint/manager"), exports);
 __exportStar(require("./commands/loader"), exports);
 __exportStar(require("./agent/agentTypes"), exports);
+__exportStar(require("./agent/effortCap"), exports);
 __exportStar(require("./agent/planMode"), exports);
 __exportStar(require("./agent/agentRegistry"), exports);
 __exportStar(require("./agent/backgroundAgents"), exports);
@@ -56,6 +57,10 @@ __exportStar(require("./plugins/installer"), exports);
 __exportStar(require("./plugins/sources"), exports);
 __exportStar(require("./plugins/data"), exports);
 __exportStar(require("./plugins/eval"), exports);
+__exportStar(require("./plugins/userConfig"), exports);
+__exportStar(require("./plugins/configStore"), exports);
+__exportStar(require("./plugins/validate"), exports);
+__exportStar(require("./plugins/resolve"), exports);
 __exportStar(require("./agent/trust"), exports);
 __exportStar(require("./agent/crossProcessLock"), exports);
 __exportStar(require("./agent/worktree"), exports);

package/dist/mcp/manager.d.ts

@@ -71,6 +71,14 @@ export declare class McpManager {
      * poll in executor.ts), just without the ability to also kill a remote
      * server's in-flight work the way `bash` can kill a local child process.
      */
+    /**
+     * S25e (Claude Code 2.1.288 parity): a mid-call 401/insufficient_scope already flips
+     * the server to needs-auth (see trackAuth below); when the HOST can ask a user, it may
+     * re-authorize on the spot and request ONE retry of the same call. Unset = no retry
+     * (headless runs), so the enriched error still reaches the caller. A hook that throws
+     * is treated as "no retry" — the original OAuth error must stay the thing the model sees.
+     */
+    onAuthRequired?: (serverName: string, missingScope: string) => Promise<boolean>;
     callTool(prefixedName: string, input: Record<string, unknown>, abortSignal?: {
         aborted: boolean;
     }): Promise<string | null>;

package/dist/mcp/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/mcp/manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAa,eAAe,EAAE,iBAAiB,EAAgB,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAItD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAGD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE;QACZ,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAID,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAmC;IAEnD,OAAO,CAAC,QAAQ,CAA6B;IAI7C,OAAO,CAAC,YAAY,CAAkC;IAEtD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,OAAO,CAA6B;IAE5C,OAAO,CAAC,UAAU,CAA6B;IAG/C,OAAO,CAAC,SAAS,CAAqB;IACtC,wFAAwF;IACxF,QAAQ,CAAC,KAAK,YAAmB;IAGjC,OAAO,CAAC,mBAAmB,CAAsC;IAEjE;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI;IAKlE;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAe1B,mFAAmF;IACnF,OAAO,CAAC,eAAe;IAOvB,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,UAAU;IAMzB,oGAAoG;IACpG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS;IAgC7C,mFAAmF;IAC7E,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAkClD,sEAAsE;IACtE,iBAAiB,IAAI,aAAa,EAAE;IAkBpC;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkEzB,8FAA8F;IACxF,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAStF,kGAAkG;IAC5F,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBhE;;;;;OAKG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAUtD,wFAAwF;IAClF,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IASlF;;;;;;;OAOG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAyCrF,uDAAuD;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIhC,IAAI,WAAW,IAAI,MAAM,EAAE,CAE1B;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;;;OAOG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAM7B,OAAO,CAAC,MAAM,CAAC,WAAW;IAK1B,6FAA6F;IAC7F,SAAS,IAAI,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;QACpC,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAC3B,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,qGAAqG;QACrG,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,8EAA8E;QAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,sFAAsF;QACtF,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;IA4DF,uFAAuF;IACvF,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAInC,wFAAwF;IACxF,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAIlC;;;;OAIG;IACH,kBAAkB,IAAI,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAQrE,uEAAuE;IACvE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIjC;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAO9B;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuBlD,yFAAyF;IACzF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAOjC,kFAAkF;IAClF,OAAO,CAAC,WAAW;IAoBnB,+CAA+C;IAC/C,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM;IAMrE,OAAO,CAAC,MAAM,CAAC,cAAc;IAa7B,OAAO,CAAC,MAAM,CAAC,eAAe;IAK9B,iEAAiE;IACjE,MAAM,CAAC,SAAS,CACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,KAAK,GAAE,SAAS,GAAG,MAAkB,GACpC,IAAI;IAOP;;;;;;OAMG;IACH,MAAM,CAAC,iBAAiB,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EACjB,KAAK,GAAE,SAAS,GAAG,MAAkB,GACpC,MAAM;IAYT,4FAA4F;IAC5F,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM;IAazF,+FAA+F;IAC/F,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAqB3D,aAAa,IAAI,IAAI;CAUtB"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/mcp/manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAa,eAAe,EAAE,iBAAiB,EAAgB,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAKtD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAGD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE;QACZ,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAID,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAmC;IAEnD,OAAO,CAAC,QAAQ,CAA6B;IAI7C,OAAO,CAAC,YAAY,CAAkC;IAEtD,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,OAAO,CAA6B;IAE5C,OAAO,CAAC,UAAU,CAA6B;IAG/C,OAAO,CAAC,SAAS,CAAqB;IACtC,wFAAwF;IACxF,QAAQ,CAAC,KAAK,YAAmB;IAGjC,OAAO,CAAC,mBAAmB,CAAsC;IAEjE;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI;IAKlE;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAe1B,mFAAmF;IACnF,OAAO,CAAC,eAAe;IAOvB,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,UAAU;IAMzB,oGAAoG;IACpG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS;IAiC7C,mFAAmF;IAC7E,UAAU,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAkClD,sEAAsE;IACtE,iBAAiB,IAAI,aAAa,EAAE;IAkBpC;;;;;;;;;;;;;;;;OAgBG;IACH;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1E,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GACjC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAqFzB,8FAA8F;IACxF,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAStF,kGAAkG;IAC5F,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBhE;;;;;OAKG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAUtD,wFAAwF;IAClF,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IASlF;;;;;;;OAOG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAyCrF,uDAAuD;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIhC,IAAI,WAAW,IAAI,MAAM,EAAE,CAE1B;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;;;OAOG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAM7B,OAAO,CAAC,MAAM,CAAC,WAAW;IAK1B,6FAA6F;IAC7F,SAAS,IAAI,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;QACpC,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAC3B,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,qGAAqG;QACrG,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,8EAA8E;QAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,sFAAsF;QACtF,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC;IA4DF,uFAAuF;IACvF,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAInC,wFAAwF;IACxF,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAIlC;;;;OAIG;IACH,kBAAkB,IAAI,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAQrE,uEAAuE;IACvE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIjC;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAO9B;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuBlD,yFAAyF;IACzF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAOjC,kFAAkF;IAClF,OAAO,CAAC,WAAW;IAoBnB,+CAA+C;IAC/C,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM;IAMrE,OAAO,CAAC,MAAM,CAAC,cAAc;IAa7B,OAAO,CAAC,MAAM,CAAC,eAAe;IAK9B,iEAAiE;IACjE,MAAM,CAAC,SAAS,CACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,KAAK,GAAE,SAAS,GAAG,MAAkB,GACpC,IAAI;IAOP;;;;;;OAMG;IACH,MAAM,CAAC,iBAAiB,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EACjB,KAAK,GAAE,SAAS,GAAG,MAAkB,GACpC,MAAM;IAYT,4FAA4F;IAC5F,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM;IAazF,+FAA+F;IAC/F,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAqB3D,aAAa,IAAI,IAAI;CAUtB"}

package/dist/mcp/manager.js

@@ -41,6 +41,7 @@ const client_1 = require("./client");
 const httpClient_1 = require("./httpClient");
 const sseClient_1 = require("./sseClient");
 const index_1 = require("../plugins/index");
+const resolve_1 = require("../plugins/resolve");
 const stats_1 = require("./stats");
 // ─── McpManager ───────────────────────────────────────────────────────────────
 class McpManager {
@@ -119,7 +120,8 @@ class McpManager {
         // Plugins first, then user, then project — later assignments override, so
         // a user/project server definition beats a plugin's same-name one.
         try {
-            Object.assign(merged.mcpServers, (0, index_1.pluginMcpServers)(workDir));
+            // resolvePluginMcpServers = pluginMcpServers + `${user_config.KEY}` substitution (S24).
+            Object.assign(merged.mcpServers, (0, resolve_1.resolvePluginMcpServers)(workDir));
         }
         catch {
             /* plugin scan is best-effort */
@@ -196,23 +198,6 @@ class McpManager {
         }
         return tools;
     }
-    /**
-     * Execute an MCP tool call. Returns null if this tool is not an MCP tool.
-     *
-     * `abortSignal` is optional and best-effort: the underlying transports (stdio
-     * JSON-RPC / HTTP / SSE) have no cancellation message in this client, so an
-     * abort here does NOT stop the server from finishing its work — it only stops
-     * THIS CALL from making the caller wait for it. Before this was added, Ctrl+C
-     * during an MCP tool call was silently swallowed: loop.ts set
-     * `abortSignal.aborted = true` but nothing downstream of `options.mcpManager
-     * .callTool(name, input)` ever looked at it, so the user's only way out was
-     * to wait out the full 60s MCP_TOOL_TIMEOUT_MS (or however long the server
-     * actually took). Racing the same abortSignal the 60s timeout already races
-     * against makes Ctrl+C return control immediately instead of up to a minute
-     * later — matching how the `bash` tool already behaves (its own 200ms abort
-     * poll in executor.ts), just without the ability to also kill a remote
-     * server's in-flight work the way `bash` can kill a local child process.
-     */
     async callTool(prefixedName, input, abortSignal) {
         const serverName = this._toolMap.get(prefixedName);
         if (!serverName)
@@ -222,48 +207,70 @@ class McpManager {
             return null;
         // Strip the server prefix to get the real tool name
         const toolName = prefixedName.slice(serverName.length + 2);
-        // Enforce a timeout — a hung MCP server would otherwise block the agent loop forever.
+        // One attempt's full race — a fresh timeout, abort poll and stat pairing per try,
+        // because a promise cannot be awaited twice and S25e's retry below builds new ones.
         const MCP_TOOL_TIMEOUT_MS = 60000;
-        const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`MCP tool "${prefixedName}" timed out after ${MCP_TOOL_TIMEOUT_MS / 1000}s`)), MCP_TOOL_TIMEOUT_MS));
-        // Timing covers the whole path the user waits on (server round-trip AND the
-        // race against the 60s timeout / abort), which is what "how long did that take"
-        // means from the outside. The tool name recorded is the PREFIXED one, so the
-        // stats of two servers with a same-named tool never merge.
-        const startedAt = Date.now();
-        this.stats.begin();
-        const timed = (p) => p.then((v) => {
-            this.stats.ok(prefixedName, Date.now() - startedAt);
-            return v;
-        }, (e) => {
-            this.stats.fail(prefixedName, Date.now() - startedAt, e.message || String(e));
-            throw e;
-        });
-        // A 401 mid-CALL is different from one at connect: the server is already up and
-        // some tools work — record it so /mcp flips to needs-auth (with the missing
-        // scope) and let the enriched message reach the caller (the model sees WHY).
-        const trackAuth = (p) => p.catch((err) => {
-            if (err instanceof httpClient_1.McpOAuthRequiredError)
-                this._needsAuth.set(serverName, err.wwwAuthenticate);
-            throw err;
-        });
-        const racers = [timed(client.callTool(toolName, input)), timed(timeoutPromise)];
-        if (abortSignal) {
-            let pollId;
-            const abortPromise = new Promise((_, reject) => {
-                pollId = setInterval(() => {
-                    if (abortSignal.aborted) {
-                        clearInterval(pollId);
-                        reject(Object.assign(new Error('Aborted'), { name: 'AbortError' }));
-                    }
-                }, 100);
+        const once = () => {
+            const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`MCP tool "${prefixedName}" timed out after ${MCP_TOOL_TIMEOUT_MS / 1000}s`)), MCP_TOOL_TIMEOUT_MS));
+            // Timing covers the whole path the user waits on (server round-trip AND the
+            // race against the 60s timeout / abort), which is what "how long did that take"
+            // means from the outside. The tool name recorded is the PREFIXED one, so the
+            // stats of two servers with a same-named tool never merge.
+            const startedAt = Date.now();
+            this.stats.begin();
+            const timed = (p) => p.then((v) => {
+                this.stats.ok(prefixedName, Date.now() - startedAt);
+                return v;
+            }, (e) => {
+                this.stats.fail(prefixedName, Date.now() - startedAt, e.message || String(e));
+                throw e;
+            });
+            // A 401 mid-CALL is different from one at connect: the server is already up and
+            // some tools work — record it so /mcp flips to needs-auth (with the missing
+            // scope) and let the enriched message reach the caller (the model sees WHY).
+            const trackAuth = (p) => p.catch((err) => {
+                if (err instanceof httpClient_1.McpOAuthRequiredError)
+                    this._needsAuth.set(serverName, err.wwwAuthenticate);
+                throw err;
             });
-            racers.push(timed(abortPromise));
-            // Clearing the poll on whichever branch wins avoids leaving a live interval
-            // (and the closure it holds) running for the rest of the process lifetime —
-            // the same leak-prevention pattern client.ts uses for its own abort poll.
-            return trackAuth(Promise.race(racers).finally(() => clearInterval(pollId)));
+            const racers = [timed(client.callTool(toolName, input)), timed(timeoutPromise)];
+            if (abortSignal) {
+                let pollId;
+                const abortPromise = new Promise((_, reject) => {
+                    pollId = setInterval(() => {
+                        if (abortSignal.aborted) {
+                            clearInterval(pollId);
+                            reject(Object.assign(new Error('Aborted'), { name: 'AbortError' }));
+                        }
+                    }, 100);
+                });
+                racers.push(timed(abortPromise));
+                // Clearing the poll on whichever branch wins avoids leaving a live interval
+                // (and the closure it holds) running for the rest of the process lifetime —
+                // the same leak-prevention pattern client.ts uses for its own abort poll.
+                return trackAuth(Promise.race(racers).finally(() => clearInterval(pollId)));
+            }
+            return trackAuth(Promise.race(racers));
+        };
+        try {
+            return await once();
+        }
+        catch (err) {
+            const hook = this.onAuthRequired;
+            if (!hook || !(err instanceof httpClient_1.McpOAuthRequiredError))
+                throw err;
+            let retry;
+            try {
+                retry = await hook(serverName, err.missingScope ?? '');
+            }
+            catch {
+                retry = false; // a broken host hook must not mask the OAuth error
+            }
+            if (!retry)
+                throw err;
+            // The host re-authorized (fresh tokens are in): one retry, no loop.
+            return await once();
         }
-        return trackAuth(Promise.race(racers));
     }
     /** Resources across connected, enabled servers. One server failing never hides the others. */
     async listResources(server) {

package/dist/permissions/destructiveTokens.d.ts

@@ -32,4 +32,5 @@ export interface TokenMatch {
 /** Split `src` into simple commands, each a list of unquoted words. */
 export declare function tokenize(src: string): string[][];
 export declare function classifyTokens(tokens: string[], recurse: (command: string) => TokenMatch | null, rawSql: (command: string) => TokenMatch | null): TokenMatch | null;
+export declare function unwrappedViews(command: string): string[];
 //# sourceMappingURL=destructiveTokens.d.ts.map

package/dist/permissions/destructiveTokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"destructiveTokens.d.ts","sourceRoot":"","sources":["../../src/permissions/destructiveTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CA6DhD;AAsVD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,EAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,GAC7C,UAAU,GAAG,IAAI,CA+HnB"}
+{"version":3,"file":"destructiveTokens.d.ts","sourceRoot":"","sources":["../../src/permissions/destructiveTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CA6DhD;AAsVD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,EAC/C,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,GAC7C,UAAU,GAAG,IAAI,CA+HnB;AAyBD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAKxD"}

package/dist/permissions/destructiveTokens.js

@@ -23,6 +23,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.tokenize = tokenize;
 exports.classifyTokens = classifyTokens;
+exports.unwrappedViews = unwrappedViews;
 const hit = (category, reason) => ({ category, reason });
 /** Split `src` into simple commands, each a list of unquoted words. */
 function tokenize(src) {
@@ -552,4 +553,96 @@ function classifyTokens(tokens, recurse, rawSql) {
     }
     return null;
 }
+// ─── Every spelling of the command, for the permission-rule matcher ─────────
+//
+// A deny/ask rule must not be skippable by dressing the command up. Claude Code
+// fixed exactly this class (2.1.288/289): "a deny or ask rule … missing a
+// command behind an environment variable prefix with an expanded value (e.g.
+// `TZ="$HOME" rm -rf build`)" and "a bare variable assignment came before the
+// command". The destructive guard has always seen through these (tokenize +
+// classifyTokens above); the RULE matcher had not, so `permissions.deny:
+// ["Bash(rm:*)"]` silently did nothing against `FOO=bar rm -rf build`.
+//
+// unwrappedViews returns every "command actually run" spelling hiding in one
+// command line, using this module's tokenizer and the same wrapper tables as
+// classifyTokens, so anything the guard can see, a rule can see too:
+//
+//   'FOO=bar sudo rm -rf build'  → 'sudo rm -rf build', 'rm -rf build'
+//   'cd /tmp && FOO=1 rm -rf x'  → 'cd /tmp', 'rm -rf x'
+//   'echo $(rm -rf build)'       → 'echo $', 'rm -rf build'
+//
+// Deliberately NOT unwrapped (same as classifyTokens's guard scope):
+// ssh / docker exec / kubectl exec — reaching into those needs the remote or
+// container branch, tracked separately.
+//
+// Order: most literal first (wrappers still attached), then each peeled form.
+function unwrappedViews(command) {
+    if (typeof command !== 'string' || command.length === 0)
+        return [];
+    const out = new Set();
+    collectViews(command, out, 0);
+    return [...out];
+}
+/** Flags of a peelable wrapper that consume a following value (mirror of classifyTokens). */
+const WRAPPER_VALUE_FLAGS = {
+    sudo: new Set(['-u', '-g', '-h', '-p', '-C', '-D', '-R', '-T', '-U']),
+    doas: new Set(['-u', '-g', '-h', '-p', '-C', '-D', '-R', '-T', '-U']),
+    env: new Set(['-u', '-C', '-S']),
+    nice: new Set(['-n']),
+    ionice: new Set(['-c', '-n', '-p']),
+    command: new Set(),
+    builtin: new Set(),
+    nohup: new Set(),
+    exec: new Set(),
+    time: new Set(),
+    setsid: new Set(),
+    caffeinate: new Set(),
+    stdbuf: new Set(),
+    unbuffer: new Set(),
+};
+/** `command -v rm` (or `-V`, `-pv`) only PRINTS where rm is — never peel it into `rm`. */
+const LOOKUP_FLAG = /^-p?[vV]+$/;
+function collectViews(src, out, depth) {
+    if (depth > 3)
+        return;
+    for (const tokens of tokenize(src)) {
+        let t = tokens;
+        for (let guard = 0; guard < 12; guard++) {
+            while (t.length && (ENV_ASSIGN.test(t[0]) || CONTROL_WORDS.has(t[0])))
+                t = t.slice(1);
+            if (t.length === 0)
+                break;
+            out.add(t.join(' '));
+            const bin = base(t[0]);
+            const args = t.slice(1);
+            // bash -c "…" / eval "…" carry the command as a STRING — read it too.
+            if (SHELLS.has(bin)) {
+                const i = args.findIndex((a) => /^-[A-Za-z]*c[A-Za-z]*$/.test(a));
+                if (i >= 0 && args[i + 1] !== undefined)
+                    collectViews(args[i + 1], out, depth + 1);
+                break;
+            }
+            if (bin === 'eval') {
+                collectViews(args.join(' '), out, depth + 1);
+                break;
+            }
+            if (bin === 'timeout') {
+                t = dropOpts(args, new Set(['-s', '-k'])).slice(1); // timeout DURATION cmd
+                continue;
+            }
+            if (bin === 'xargs') {
+                t = dropOpts(args, new Set(['-I', '-n', '-P', '-L', '-s', '-d', '-E', '-a', '-J']));
+                continue;
+            }
+            if ((bin === 'command' || bin === 'builtin') && args.some((a) => LOOKUP_FLAG.test(a)))
+                break;
+            const valueFlags = WRAPPER_VALUE_FLAGS[bin];
+            if (valueFlags) {
+                t = dropOpts(args, valueFlags);
+                continue;
+            }
+            break;
+        }
+    }
+}
 //# sourceMappingURL=destructiveTokens.js.map

package/dist/permissions/rules.d.ts

@@ -15,6 +15,18 @@ export declare function setSessionRules(r: Partial<PermissionRules>): void;
 export declare function setSessionSettings(obj: Record<string, unknown> | null): void;
 export declare function getSessionSettings(): Record<string, unknown> | null;
 export declare function loadSettings(workDir: string): MergedSettings;
+/**
+ * S25b: the raw object of every settings tier, in precedence order (managed →
+ * user → project → local → `--settings` session settings). For resolvers where
+ * the STRICTEST value must win regardless of tier — `maxEffortLevel` (a cap can
+ * only be tightened by a lower-precedence file, never loosened), and anything
+ * with the same one-way semantics added later. `loadSettings().raw` cannot serve
+ * those: it merges with LAST-wins, which is the opposite direction.
+ */
+export declare function settingsTiersRaw(workDir: string): Array<{
+    tier: string;
+    raw: Record<string, unknown>;
+}>;
 /** The first ALLOW rule that matches this call, or null. S20's classifier gate
  * reads this to tell a NARROW pre-approval (wins, no review) from a BROAD one
  * (suspended while the classifier is on — see isBroadAllowRule). */