agentplugged 1.0.1 → 1.0.3

package/dist/agent-commands.js

@@ -14500,6 +14500,10 @@ retrospective, an installation and a validation point never wait for it.
    scope: \`guard.creator_action\` \`scope_widen\`) or a decision of the architecture contradicted, and
    lets the write through in doubt. Reading, and writes in other tools, stay governed by the
    permission rules alone: \`read_secrets\` is always denied, whatever the session.
+5. A write the engine refused is never redone by another path: not by a terminal command
+   (\`sed -i\`, a redirection \`>\`, \`Set-Content\`, \`Out-File\`, a copy, a script), not by another tool.
+   The agent stops, tells the coordinator which file it needs and why, and the coordinator offers
+   the creator to widen the scope (\`guard.creator_action\` \`scope_widen\`) in one gesture.
 `;
 }
 /** The folder layout and the seven rules: in the short constitution and in the reference alike. */
@@ -17783,6 +17787,21 @@ function claudeActionRules(action, mainBranch) {
 	push(rules, patternsOf(action, mainBranch).flatMap(claudeRules));
 	return rules;
 }
+/**
+* The rules as Claude Code's settings hold them. A backslash right before the closing parenthesis
+* escapes it there, so such a rule is written with that one backslash doubled (the others are
+* read literally). Claude Code's `PowerShell` tool has its own rules: each `Bash(x)` rule gets
+* its `PowerShell(x)` twin, or a command would pass by being run through the other shell.
+*/
+function claudeCommandRules(rules) {
+	const out = [];
+	for (const rule of rules) {
+		const escaped = rule.endsWith("\\)") && !rule.endsWith("\\\\)") ? `${rule.slice(0, -1)}\\)` : rule;
+		push(out, [escaped]);
+		if (escaped.startsWith("Bash(")) push(out, [`PowerShell${escaped.slice(4)}`]);
+	}
+	return out;
+}
 /** The Claude Code rule that allows all the tools of the `agentplugged` MCP server. */
 const ENGINE_MCP_RULE = "mcp__agentplugged";
 /**
@@ -18991,13 +19010,22 @@ const WRITE_TOOLS = [
 		text: "new_source"
 	}
 ];
+/** The two tools that run a shell command in Claude Code: both carry it in `tool_input.command`. */
+const SHELL_MATCHER = "Bash|PowerShell";
+/**
+* The `if` conditions of a hook on the shell tools: each `Bash(x)` condition and its
+* `PowerShell(x)` twin, as a condition matches the calls of one tool only.
+*/
+function shellConditions(conditions) {
+	return conditions.flatMap((condition) => [condition, `PowerShell${condition.slice(4)}`]);
+}
 /** The hooks `sync` writes for Claude Code, from the rules in force. */
 function claudeTrustHooks(rules, mainBranch) {
 	const session = hookValue("session_id");
 	const pre = [];
-	const conditions = rules.install_dependency === "deny" ? [] : claudeActionRules("install_dependency", mainBranch).filter((entry) => entry.startsWith("Bash("));
+	const conditions = rules.install_dependency === "deny" ? [] : shellConditions(claudeActionRules("install_dependency", mainBranch).filter((entry) => entry.startsWith("Bash(")));
 	if (conditions.length > 0) pre.push({
-		matcher: "Bash",
+		matcher: SHELL_MATCHER,
 		hooks: conditions.map((condition) => handler("check_action", {
 			action: "install_dependency",
 			command: hookValue("tool_input.command"),
@@ -19032,9 +19060,9 @@ function claudeTrustHooks(rules, mainBranch) {
 			})]
 		},
 		{
-			matcher: "Bash",
-			hooks: NETWORK_COMMANDS.map((condition) => handler("record_external_read", {
-				tool: "Bash",
+			matcher: SHELL_MATCHER,
+			hooks: shellConditions(NETWORK_COMMANDS).map((condition) => handler("record_external_read", {
+				tool: condition.startsWith("PowerShell(") ? "PowerShell" : "Bash",
 				source: hookValue("tool_input.command"),
 				session
 			}, condition))
@@ -19775,9 +19803,9 @@ const syncCommand = defineCommand({
 			flavor: claudeFlavor(loaded.config.permissions?.mode),
 			current: claudeSettings
 		}, has("claude-code") ? {
-			deny: claudeWritable(unique([...denyRules(permissionInputs), ...claudeRules.deny])),
-			allow: claudeWritable(claudeRules.allow),
-			ask: claudeWritable(claudeRules.ask)
+			deny: claudeCommandRules(unique([...denyRules(permissionInputs), ...claudeRules.deny])),
+			allow: claudeCommandRules(claudeRules.allow),
+			ask: claudeCommandRules(claudeRules.ask)
 		} : {}, {
 			deny: manifest.permissions,
 			...previousLists[CLAUDE_SETTINGS_PATH]
@@ -19809,7 +19837,7 @@ const syncCommand = defineCommand({
 				count: owned.allow.length
 			});
 		}
-		const conflicts = [...has("claude-code") ? allowConflicts(CLAUDE_SETTINGS_PATH, claudeSettings?.value, claudeRules.allow, {
+		const conflicts = [...has("claude-code") ? allowConflicts(CLAUDE_SETTINGS_PATH, claudeSettings?.value, claudeCommandRules(claudeRules.allow), {
 			deny: manifest.permissions,
 			...previousLists[CLAUDE_SETTINGS_PATH]
 		}) : [], ...has("cursor") ? allowConflicts(CURSOR_CLI_PATH, cursorSettings?.value, cursorRules.allow, { deny: previousCursor }) : []];
@@ -19878,14 +19906,6 @@ const CODEX_HOME_DENY = [
 function unique(rules) {
 	return [...new Set(rules)];
 }
-/**
-* The rules Claude Code's settings can hold: a backslash before the closing parenthesis escapes it
-* there, so such a rule would be malformed (the `C:/` spelling of the same root stays). The
-* engine's own guards keep them: they read the rules themselves.
-*/
-function claudeWritable(rules) {
-	return rules.filter((rule) => !rule.endsWith("\\)"));
-}
 /** The tool a generated path belongs to, for the summary. */
 function groupOf(path) {
 	if (path.startsWith(".claude/") || path === "CLAUDE.md") return "claude-code";
@@ -31012,7 +31032,7 @@ function readSource(tool, raw) {
 	const toolName = truncate(cleanText(tool), 200) || "unknown";
 	const given = cleanText(raw ?? "");
 	const usable = given !== "" && !given.includes("${");
-	if (usable && toolName === "Bash") return {
+	if (usable && (toolName === "Bash" || toolName === "PowerShell")) return {
 		tool: toolName,
 		source: truncate(hostOf$1(given, true) ?? commandName(given), 200)
 	};

package/dist/main.js

@@ -6447,6 +6447,415 @@ var NodeFolderReader = class {
 		return new NodeWorkspaceFiles(path);
 	}
 };
+/**
+* The helper's script: compiles the C#, says it is ready (or why it cannot be), then answers one
+* JSON line per request line until its input closes. Constrained language mode forbids `Add-Type`,
+* which is said before trying.
+*/
+const HELPER_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$out = [Console]::Out
+try {
+  $mode = [string]$ExecutionContext.SessionState.LanguageMode
+  if ($mode -ne 'FullLanguage') { throw ('PowerShell is in ' + $mode + ' mode, which forbids compiling code') }
+  Add-Type -ReferencedAssemblies 'System.Web.Extensions' -TypeDefinition @'
+${String.raw`
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Collections.Generic;
+using System.Web.Script.Serialization;
+
+public static class ApCredentials {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  struct CREDENTIAL {
+    public uint Flags;
+    public uint Type;
+    public string TargetName;
+    public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public uint CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public uint Persist;
+    public uint AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias;
+    public string UserName;
+  }
+
+  [DllImport("advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
+  static extern bool CredRead(string target, uint type, uint flags, out IntPtr credential);
+  [DllImport("advapi32.dll", EntryPoint = "CredWriteW", CharSet = CharSet.Unicode, SetLastError = true)]
+  static extern bool CredWrite(ref CREDENTIAL credential, uint flags);
+  [DllImport("advapi32.dll", EntryPoint = "CredDeleteW", CharSet = CharSet.Unicode, SetLastError = true)]
+  static extern bool CredDelete(string target, uint type, uint flags);
+  [DllImport("advapi32.dll", EntryPoint = "CredEnumerateW", CharSet = CharSet.Unicode, SetLastError = true)]
+  static extern bool CredEnumerate(string filter, uint flags, out uint count, out IntPtr credentials);
+  [DllImport("advapi32.dll", EntryPoint = "CredFree")]
+  static extern void CredFree(IntPtr buffer);
+
+  const uint Generic = 1;
+  const uint PersistEnterprise = 3;
+  const int NotFound = 1168;
+
+  static string Text(string b64) {
+    return b64 == null ? null : Encoding.UTF8.GetString(Convert.FromBase64String(b64));
+  }
+  static string B64(string text) {
+    return Convert.ToBase64String(Encoding.UTF8.GetBytes(text == null ? "" : text));
+  }
+  public static string Failure(int code, string message) {
+    return "{\"ok\":false,\"code\":" + code + ",\"message\":\"" + B64(message) + "\"}";
+  }
+  static string Win32Failure(int code) {
+    string message;
+    try { message = new System.ComponentModel.Win32Exception(code).Message; } catch (Exception) { message = ""; }
+    return Failure(code, message);
+  }
+
+  // One request line in, one answer line out. The line is parsed here, not by a cmdlet, so that
+  // PowerShell module logging (when a policy turns it on) never records a secret.
+  public static string HandleLine(string line) {
+    int id = 0;
+    try {
+      Dictionary<string, object> request =
+        (Dictionary<string, object>)new JavaScriptSerializer().DeserializeObject(line);
+      id = Convert.ToInt32(request["id"]);
+      string answer = Handle(Field(request, "op"), Field(request, "target"), Field(request, "user"), Field(request, "secret"));
+      return "{\"id\":" + id + "," + answer.Substring(1);
+    } catch (Exception) {
+      return "{\"id\":" + id + "," + Failure(0, "the credential helper could not read a request").Substring(1);
+    }
+  }
+  static string Field(Dictionary<string, object> request, string name) {
+    object value;
+    return request.TryGetValue(name, out value) && value != null ? value.ToString() : "";
+  }
+
+  public static string Handle(string op, string targetB64, string userB64, string secretB64) {
+    try {
+      string target = Text(targetB64);
+      if (op == "read") return Read(target);
+      if (op == "write") return Write(target, Text(userB64), Convert.FromBase64String(secretB64));
+      if (op == "delete") return Delete(target);
+      if (op == "list") return List(target);
+      return Failure(0, "unknown operation");
+    } catch (Exception) {
+      return Failure(0, "the credential helper failed");
+    }
+  }
+
+  static string Read(string target) {
+    IntPtr pointer;
+    if (!CredRead(target, Generic, 0, out pointer)) {
+      int error = Marshal.GetLastWin32Error();
+      return error == NotFound ? "{\"ok\":true,\"found\":false}" : Win32Failure(error);
+    }
+    try {
+      CREDENTIAL credential = (CREDENTIAL)Marshal.PtrToStructure(pointer, typeof(CREDENTIAL));
+      byte[] blob = new byte[credential.CredentialBlobSize];
+      if (blob.Length > 0) Marshal.Copy(credential.CredentialBlob, blob, 0, blob.Length);
+      string answer = "{\"ok\":true,\"found\":true,\"secret\":\"" + Convert.ToBase64String(blob) + "\"}";
+      Array.Clear(blob, 0, blob.Length);
+      return answer;
+    } finally {
+      CredFree(pointer);
+    }
+  }
+
+  static string Write(string target, string user, byte[] blob) {
+    IntPtr memory = Marshal.AllocHGlobal(blob.Length == 0 ? 1 : blob.Length);
+    try {
+      if (blob.Length > 0) Marshal.Copy(blob, 0, memory, blob.Length);
+      CREDENTIAL credential = new CREDENTIAL();
+      credential.Type = Generic;
+      credential.TargetName = target;
+      credential.CredentialBlobSize = (uint)blob.Length;
+      credential.CredentialBlob = memory;
+      credential.Persist = PersistEnterprise;
+      credential.UserName = user;
+      if (!CredWrite(ref credential, 0)) return Win32Failure(Marshal.GetLastWin32Error());
+      return "{\"ok\":true}";
+    } finally {
+      byte[] zeros = new byte[blob.Length];
+      if (zeros.Length > 0) Marshal.Copy(zeros, 0, memory, zeros.Length);
+      Marshal.FreeHGlobal(memory);
+      Array.Clear(blob, 0, blob.Length);
+    }
+  }
+
+  static string Delete(string target) {
+    if (CredDelete(target, Generic, 0)) return "{\"ok\":true,\"found\":true}";
+    int error = Marshal.GetLastWin32Error();
+    return error == NotFound ? "{\"ok\":true,\"found\":false}" : Win32Failure(error);
+  }
+
+  // The accounts of a service: every generic credential whose target is "<user>.<service>".
+  static string List(string service) {
+    uint count;
+    IntPtr array;
+    if (!CredEnumerate(null, 0, out count, out array)) {
+      int error = Marshal.GetLastWin32Error();
+      return error == NotFound ? "{\"ok\":true,\"users\":[]}" : Win32Failure(error);
+    }
+    try {
+      List<string> users = new List<string>();
+      for (int index = 0; index < count; index++) {
+        IntPtr pointer = Marshal.ReadIntPtr(array, index * IntPtr.Size);
+        CREDENTIAL credential = (CREDENTIAL)Marshal.PtrToStructure(pointer, typeof(CREDENTIAL));
+        if (credential.Type == Generic && credential.UserName != null
+            && credential.TargetName == credential.UserName + "." + service) {
+          users.Add("\"" + B64(credential.UserName) + "\"");
+        }
+      }
+      return "{\"ok\":true,\"users\":[" + string.Join(",", users.ToArray()) + "]}";
+    } finally {
+      CredFree(array);
+    }
+  }
+}
+`}
+'@
+  $out.WriteLine('{"ready":true}')
+} catch {
+  # Constrained language mode forbids method calls: the reason goes out as plain ASCII text,
+  # through a cmdlet.
+  $reason = ([string]$_) -replace '[^ -~]', ' ' -replace '["\\\\]', ' '
+  Write-Output ('{"ready":false,"message":"' + $reason + '"}')
+  exit 0
+}
+while ($null -ne ($line = [Console]::In.ReadLine())) {
+  if ($line.Trim().Length -eq 0) { continue }
+  $out.WriteLine([ApCredentials]::HandleLine($line))
+}
+`;
+/** Windows PowerShell 5.1 by its full path: never a `powershell` found on the PATH. */
+function windowsPowerShellPath() {
+	const root = process.env.SystemRoot ?? process.env.windir;
+	if (root === void 0) return void 0;
+	const path = join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+	return existsSync(path) ? path : void 0;
+}
+/** The helper cannot be used on this machine (no PowerShell, constrained language, a crash...). */
+var PowerShellUnavailableError = class extends Error {
+	name = "PowerShellUnavailableError";
+};
+const decode = (text) => Buffer.from(text ?? "", "base64").toString("utf8");
+/** One running helper process. */
+var Session = class Session {
+	#child;
+	#pending = /* @__PURE__ */ new Map();
+	#nextId = 1;
+	#buffer = "";
+	#alive = true;
+	#onReady;
+	constructor(child) {
+		this.#child = child;
+		child.stdout?.setEncoding("utf8");
+		child.stdout?.on("data", (chunk) => this.#receive(chunk));
+		child.stdin?.on("error", () => {});
+		child.on("error", () => this.#end("PowerShell could not be started"));
+		child.on("close", () => this.#end("the PowerShell credential helper stopped"));
+	}
+	/** Starts a helper and waits until it is ready, or says why it cannot be. */
+	static start(powershell, startupTimeoutMs) {
+		const script = Buffer.from(HELPER_SCRIPT, "utf16le").toString("base64");
+		const child = spawn(powershell, [
+			"-NoLogo",
+			"-NoProfile",
+			"-NonInteractive",
+			"-EncodedCommand",
+			script
+		], {
+			stdio: [
+				"pipe",
+				"pipe",
+				"ignore"
+			],
+			windowsHide: true
+		});
+		const session = new Session(child);
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				session.close();
+				reject(new PowerShellUnavailableError("PowerShell did not answer in time"));
+			}, startupTimeoutMs);
+			session.#onReady = (answer) => {
+				clearTimeout(timer);
+				if (answer.ready === true) {
+					session.#idle();
+					resolve(session);
+				} else {
+					session.close();
+					reject(new PowerShellUnavailableError(answer.message || "PowerShell refused"));
+				}
+			};
+			child.once("error", (error) => {
+				clearTimeout(timer);
+				reject(new PowerShellUnavailableError(error.message));
+			});
+			child.once("close", () => {
+				clearTimeout(timer);
+				reject(new PowerShellUnavailableError("PowerShell stopped before it was ready"));
+			});
+		});
+	}
+	get alive() {
+		return this.#alive;
+	}
+	/** Stops the helper; its input closing also ends it if the kill fails. */
+	close() {
+		this.#alive = false;
+		this.#child.stdin?.end();
+		this.#child.kill();
+	}
+	/** Sends one request and waits for its answer (a failure of the Credential Manager is thrown). */
+	request(fields, timeoutMs) {
+		if (!this.#alive) return Promise.reject(/* @__PURE__ */ new Error("the PowerShell credential helper is not running"));
+		const id = this.#nextId;
+		this.#nextId += 1;
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				this.#pending.delete(id);
+				this.close();
+				reject(/* @__PURE__ */ new Error("the PowerShell credential helper did not answer in time"));
+			}, timeoutMs);
+			this.#pending.set(id, {
+				resolve,
+				reject,
+				timer
+			});
+			this.#busy();
+			const line = JSON.stringify({
+				id,
+				op: fields.op,
+				target: Buffer.from(fields.target, "utf8").toString("base64"),
+				user: Buffer.from(fields.user ?? "", "utf8").toString("base64"),
+				secret: fields.secret
+			});
+			this.#child.stdin?.write(`${line}\n`);
+		});
+	}
+	#receive(chunk) {
+		this.#buffer += chunk;
+		for (let end = this.#buffer.indexOf("\n"); end >= 0; end = this.#buffer.indexOf("\n")) {
+			const line = this.#buffer.slice(0, end).trim();
+			this.#buffer = this.#buffer.slice(end + 1);
+			if (line === "") continue;
+			let answer;
+			try {
+				answer = JSON.parse(line);
+			} catch {
+				continue;
+			}
+			if (answer.ready !== void 0) this.#onReady?.(answer);
+			else if (answer.id !== void 0) {
+				const pending = this.#pending.get(answer.id);
+				if (pending === void 0) continue;
+				this.#pending.delete(answer.id);
+				clearTimeout(pending.timer);
+				pending.resolve(answer);
+				if (this.#pending.size === 0) this.#idle();
+			}
+		}
+	}
+	#end(reason) {
+		this.#alive = false;
+		for (const pending of this.#pending.values()) {
+			clearTimeout(pending.timer);
+			pending.reject(new Error(reason));
+		}
+		this.#pending.clear();
+	}
+	/** While a request is in flight, Node must wait for the answer. */
+	#busy() {
+		for (const handle of this.#handles()) handle.ref?.();
+	}
+	/** With nothing in flight, the helper never keeps Node from exiting. */
+	#idle() {
+		for (const handle of this.#handles()) handle.unref?.();
+	}
+	#handles() {
+		return [
+			this.#child,
+			this.#child.stdin,
+			this.#child.stdout
+		];
+	}
+};
+const STARTUP_TIMEOUT_MS = 3e4;
+const REQUEST_TIMEOUT_MS = 3e4;
+/** `CredentialBackend` through a PowerShell helper, started on the first request. */
+var PowerShellCredentials = class PowerShellCredentials {
+	#powershell;
+	#session;
+	constructor(powershell) {
+		this.#powershell = powershell;
+	}
+	/**
+	* Starts the helper now. Rejects with `PowerShellUnavailableError` when PowerShell is absent, in
+	* constrained language mode, or otherwise unable to compile the helper.
+	*/
+	static async open(options = {}) {
+		const powershell = options.powershell ?? windowsPowerShellPath();
+		if (powershell === void 0) throw new PowerShellUnavailableError("Windows PowerShell was not found");
+		const backend = new PowerShellCredentials(powershell);
+		await backend.#ensure();
+		return backend;
+	}
+	/** The running helper; a new one when the last stopped. */
+	async #ensure() {
+		for (let attempt = 0; attempt < 2; attempt += 1) {
+			this.#session ??= Session.start(this.#powershell, STARTUP_TIMEOUT_MS).catch((error) => {
+				this.#session = void 0;
+				throw error;
+			});
+			const pending = this.#session;
+			const session = await pending;
+			if (session.alive) return session;
+			if (this.#session === pending) this.#session = void 0;
+		}
+		throw new Error("the PowerShell credential helper keeps stopping");
+	}
+	async #ask(fields) {
+		const answer = await (await this.#ensure()).request(fields, REQUEST_TIMEOUT_MS);
+		if (answer.ok !== true) {
+			const message = decode(answer.message) || "the Credential Manager refused";
+			throw new Error(`Windows Credential Manager failed: ${message} (Windows error code ${answer.code ?? 0})`);
+		}
+		return answer;
+	}
+	async read(service, account) {
+		const answer = await this.#ask({
+			op: "read",
+			target: `${account}.${service}`,
+			user: account
+		});
+		if (answer.found !== true) return void 0;
+		return Buffer.from(answer.secret ?? "", "base64").toString("utf16le");
+	}
+	async write(service, account, secret) {
+		await this.#ask({
+			op: "write",
+			target: `${account}.${service}`,
+			user: account,
+			secret: Buffer.from(secret, "utf16le").toString("base64")
+		});
+	}
+	async remove(service, account) {
+		return (await this.#ask({
+			op: "delete",
+			target: `${account}.${service}`,
+			user: account
+		})).found === true;
+	}
+	async accounts(service) {
+		return ((await this.#ask({
+			op: "list",
+			target: service
+		})).users ?? []).map(decode);
+	}
+};
 //#endregion
 //#region ../../packages/adapters-git/dist/node-key-store.js
 /**
@@ -6509,6 +6918,78 @@ function explainKeychainError(error, platform = process.platform) {
 	if (platform !== "linux" || !/secret.?service|d-?bus|platform secure storage/i.test(message)) return error;
 	return new Error(`the Secret Service of this Linux session could not be used: start one and unlock its default keyring (GNOME Keyring, KWallet or KeePassXC; on a machine without a desktop, gnome-keyring-daemon --unlock in a dbus-run-session), then run the command again. The system said: ${message}`, { cause: error });
 }
+/** What Windows says when it refuses a file under Smart App Control or an application control policy. */
+const BLOCKED_BY_POLICY = /application control|blocked this file|smart app control|signing level|code integrity|contr.le d.application|bloqu. ce fichier|error 4551|0x800711c7/i;
+/** The message of `error` and of the errors under its `cause`, outermost first. */
+function messageChain(error) {
+	const messages = [];
+	let current = error;
+	for (let depth = 0; depth < 20 && current !== void 0 && current !== null; depth += 1) {
+		messages.push(current instanceof Error ? current.message : String(current));
+		current = current instanceof Error ? current.cause : void 0;
+	}
+	return messages;
+}
+/**
+* The error for a keychain that cannot be reached at all: `native` is why `@napi-rs/keyring` did
+* not load and, on Windows, `powershell` why the PowerShell helper could not be used. Says what
+* blocks, in plain words: the generic "npm has a bug" of the module's loader never stands alone,
+* and a Windows policy blocking the module is named, with the file.
+*/
+function unavailableKeychainError(native, powershell) {
+	const real = messageChain(native).filter((message) => !/cannot find native binding|npm has a bug/i.test(message));
+	const blocked = real.find((message) => BLOCKED_BY_POLICY.test(message));
+	const file = blocked === void 0 ? void 0 : /[A-Za-z]:\\[^\r\n"']*?\.node/.exec(blocked)?.[0];
+	const viaPowerShell = powershell === void 0 ? "" : ` The keys could not be reached through Windows PowerShell either (${messageChain(powershell)[0]}).`;
+	if (blocked !== void 0) {
+		const said = blocked.split(/\r?\n/).find((line) => line.trim() !== "") ?? blocked;
+		return new Error(`Windows blocked the system keychain module${file === void 0 ? "" : ` (${file})`}: Smart App Control or an application control policy refuses this unsigned file ("${said.trim()}").${viaPowerShell} Turn off Smart App Control (Windows Security, App & browser control) or allow this file in your application control policy, make sure Windows PowerShell can run in full language mode, then run the command again.`, { cause: native });
+	}
+	const why = real.length > 0 ? real.join("; ") : "Node gave no further reason";
+	return new Error(`the system keychain module could not be loaded: ${why}.${viaPowerShell}`, { cause: native });
+}
+/** The keychain through `@napi-rs/keyring`. */
+async function nativeBackend() {
+	const { AsyncEntry, findCredentialsAsync } = await load().catch((error) => {
+		throw unavailableKeychainError(error);
+	});
+	const entry = (service, account) => new AsyncEntry(service, account, KEYCHAIN_ENTRY_OPTIONS);
+	return {
+		read: async (service, account) => await entry(service, account).getPassword() ?? void 0,
+		write: (service, account, secret) => entry(service, account).setPassword(secret),
+		remove: (service, account) => entry(service, account).deleteCredential(),
+		accounts: async (service) => (await findCredentialsAsync(service)).map((found) => found.account)
+	};
+}
+let system;
+/**
+* The system keychain of this machine. On Windows, the PowerShell helper first (no native module
+* to load, which Smart App Control may refuse), then `@napi-rs/keyring` when PowerShell cannot be
+* used; elsewhere `@napi-rs/keyring`. Chosen once per process, kept once it works.
+*/
+function systemCredentials() {
+	system ??= (async () => {
+		let powershell;
+		if (process.platform === "win32") try {
+			return await PowerShellCredentials.open();
+		} catch (error) {
+			powershell = error;
+		}
+		try {
+			return await nativeBackend();
+		} catch (error) {
+			throw powershell === void 0 ? error : unavailableKeychainError(nativeCause(error), powershell);
+		}
+	})().catch((error) => {
+		system = void 0;
+		throw error;
+	});
+	return system;
+}
+/** The error `@napi-rs/keyring` failed with, under the explained one `nativeBackend` throws. */
+function nativeCause(error) {
+	return error instanceof Error && error.cause !== void 0 ? error.cause : error;
+}
 /** `operation`, its failure explained by `explainKeychainError`. */
 async function explained(operation) {
 	try {
@@ -6519,8 +7000,9 @@ async function explained(operation) {
 }
 /**
 * `KeyStore` in the system keychain (Windows Credential Manager, macOS Keychain, the Secret
-* Service on Linux), through `@napi-rs/keyring`. Tests pass their own service name
-* and delete their entries afterwards: the machine's real entries are never touched.
+* Service on Linux): through a PowerShell helper on Windows (`systemCredentials`) and
+* `@napi-rs/keyring` elsewhere, or when PowerShell cannot be used. Tests pass their own service
+* name and delete their entries afterwards: the machine's real entries are never touched.
 */
 var NodeKeyStore = class {
 	service;
@@ -6533,11 +7015,13 @@ var NodeKeyStore = class {
 	* answering empty under concurrent access: elsewhere, none (no wait added to a first `init`).
 	*/
 	settleDelays;
+	#engine;
 	constructor(options = {}) {
 		this.service = options.service ?? "agentplugged";
 		this.account = options.account ?? "machine";
 		this.humanAccount = options.humanAccount ?? "human";
 		this.presenceAccount = options.presenceAccount ?? "human-presence";
+		this.#engine = options.engine ?? "system";
 		this.settleDelays = options.settleDelays ?? (process.platform === "win32" ? KEYCHAIN_SETTLE_DELAYS_MS : []);
 	}
 	/** Waits `settleDelays[attempt]`; false once they are all spent. */
@@ -6547,21 +7031,17 @@ var NodeKeyStore = class {
 		await setTimeout$1(delay);
 		return true;
 	}
-	/** The entry of `account`; on Linux, in the Secret Service only (`KEYCHAIN_ENTRY_OPTIONS`). */
-	async #entry(account) {
-		const { AsyncEntry } = await load();
-		return new AsyncEntry(this.service, account, KEYCHAIN_ENTRY_OPTIONS);
+	#backend() {
+		return this.#engine === "native" ? nativeBackend() : systemCredentials();
 	}
 	#read(account) {
-		return explained(async () => {
-			return await (await this.#entry(account)).getPassword() ?? void 0;
-		});
+		return explained(async () => (await this.#backend()).read(this.service, account));
 	}
 	/** A full keychain gives `KEYCHAIN_FULL`; any other failure is thrown, explained. */
 	async #write(account, value) {
-		const entry = await explained(() => this.#entry(account));
+		const backend = await explained(() => this.#backend());
 		try {
-			await entry.setPassword(value);
+			await backend.write(this.service, account, value);
 		} catch (error) {
 			if (isKeychainFullError(error)) throw keychainFull(error instanceof Error ? error.message : String(error));
 			throw explainKeychainError(error);
@@ -6596,7 +7076,7 @@ var NodeKeyStore = class {
 	}
 	/** Deletes the machine key's entry; true when there was one. */
 	deleteMachineSecret() {
-		return explained(async () => (await this.#entry(this.account)).deleteCredential());
+		return explained(async () => (await this.#backend()).remove(this.service, this.account));
 	}
 	/**
 	* Deletes the entries of this service, product keys included (tests: a service of their own).
@@ -6606,13 +7086,14 @@ var NodeKeyStore = class {
 	async deleteAll() {
 		if (this.service === "agentplugged") throw new Error(`deleteAll refuses the real keychain service ${KEYCHAIN_SERVICE}`);
 		let deleted = false;
-		const products = await load().then(({ findCredentialsAsync }) => findCredentialsAsync(this.service)).then((found) => found.map((entry) => entry.account).filter((name) => name.startsWith(PRODUCT_ACCOUNT))).catch(() => []);
+		const backend = await explained(() => this.#backend());
+		const products = await backend.accounts(this.service).then((found) => found.filter((name) => name.startsWith(PRODUCT_ACCOUNT))).catch(() => []);
 		for (const account of [
 			this.account,
 			this.humanAccount,
 			this.presenceAccount,
 			...products
-		]) deleted = await (await this.#entry(account)).deleteCredential() || deleted;
+		]) deleted = await backend.remove(this.service, account) || deleted;
 		return deleted;
 	}
 };

package/dist/method/agents/noah/references/conduct.md

@@ -59,6 +59,7 @@ back, and the decisions to take.
   other tool under his id (`ROLE_FORBIDDEN`): he never opens a checkpoint (an end of phase
   included), never starts or delivers a story, never submits a result in another agent's place.
   He never reports under another agent's id.
+- When a developer reports a write the engine refused, Noah never lets it be redone by another path (a terminal command, a redirection, a copy): he proposes to the creator to widen the scope (`guard.creator_action` `scope_widen`), in one gesture.
 - Decisions belong to the creator: the scope, the options of a checkpoint, an approval, a new
   agent, and every point they kept for themselves. Noah recommends; the creator decides. The points
   they did not keep are decided by the agent responsible, never by Noah (`checkpoint.decide` is not

package/dist/method/doctor.yaml

@@ -454,10 +454,12 @@ checks:
       - steps:
           en:
             - "On Linux, install and unlock a secret service (GNOME Keyring or KWallet), then run: npx agentplugged doctor"
-            - "On Windows or macOS, the system keychain is part of the system: restart the session and try again."
+            - "On Windows, if the message says Smart App Control or an application control policy blocked a file: turn off Smart App Control (Windows Security, App & browser control) or allow that file in your policy, check that Windows PowerShell is not in constrained language mode, then run: npx agentplugged doctor"
+            - "On Windows or macOS otherwise, the system keychain is part of the system: restart the session and try again."
           fr:
             - "Sous Linux, installe et déverrouille un service de secrets (GNOME Keyring ou KWallet), puis lance : npx agentplugged doctor"
-            - "Sous Windows ou macOS, le trousseau fait partie du système : redémarre la session et réessaie."
+            - "Sous Windows, si le message dit que Smart App Control ou une stratégie de contrôle des applications a bloqué un fichier : désactive Smart App Control (Sécurité Windows, Contrôle des applications et du navigateur) ou autorise ce fichier, vérifie que Windows PowerShell n'est pas en mode de langage restreint, puis lance : npx agentplugged doctor"
+            - "Sous Windows ou macOS sinon, le trousseau fait partie du système : redémarre la session et réessaie."
 
   - id: presence
     group: keys
@@ -1027,3 +1029,17 @@ signatures:
       en: "A write failed for lack of room"
       fr: "Une écriture a échoué faute de place"
     read: [disk.space]
+  - id: keychain-blocked
+    when:
+      output:
+        - "smart app control"
+        - "application control policy"
+        - "blocked the system keychain module"
+        - "stratégie de contrôle d'application"
+    say:
+      en: "Windows refused to load the keychain's module (Smart App Control or an application control policy)"
+      fr: "Windows a refusé de charger le module du trousseau (Smart App Control ou une stratégie de contrôle des applications)"
+    read: [keychain]
+    assumed:
+      en: "The message names the blocked file; whether turning off Smart App Control or adding an allow rule is right for this machine is your call, I only checked that the keychain does not answer"
+      fr: "Le message nomme le fichier bloqué ; désactiver Smart App Control ou ajouter une règle d'autorisation, c'est à toi de décider pour cette machine, je n'ai vérifié que le fait que le trousseau ne répond pas"

package/dist/product-root.js

@@ -16803,7 +16803,8 @@ function alreadyRecorded(listing, read, session) {
 * source is a `${…}`), or for an absent source: when in doubt, the read counts.
 */
 function isLocalShellCommand(tool, source) {
-	if (tool.trim() !== "Bash" || source === void 0) return false;
+	const shell = tool.trim();
+	if (shell !== "Bash" && shell !== "PowerShell" || source === void 0) return false;
 	const command = source.trim();
 	if (command === "" || /^\$\{[^}]*\}$/.test(command) || /^https?:\/\//i.test(command)) return false;
 	return !isNetworkCommand(command);
@@ -17101,9 +17102,14 @@ const FILE_EXTENSIONS = "ts|tsx|js|jsx|mjs|cjs|json|jsonc|md|mdx|yaml|yml|toml|p
 const CODE_SPAN = /`([^`\n]{1,200})`/g;
 const BARE_PATH = new RegExp(`(?<![\\w@./:~-])((?:\\./)?[\\w@.-]+(?:/[\\w@.*-]+)*\\.(?:${FILE_EXTENSIONS}))(?![\\w/-])`, "g");
 const BARE_FOLDER = /(?<![\w@./:~-])((?:\.\/)?[\w@.-]+(?:\/[\w@.*-]+)+\/)(?![\w])/g;
+const TEMPLATE_SEGMENT = /^(?:<[A-Za-z_][\w-]*>|\{[A-Za-z_][\w-]*\}|\[[A-Za-z_][\w-]*\]|:[A-Za-z_][\w-]*)$/;
 /** A token read as a path of the project, or undefined (a URL, an absolute path, a word). */
 function pathOf$1(token) {
 	let text = token.trim().replaceAll("\\", "/").replace(/^\{project-root\}\//, "").replace(/^\.\//, "");
+	if (text.includes("/")) {
+		if (TEMPLATE_SEGMENT.test(text.split("/")[0] ?? "")) return void 0;
+		text = text.split("/").map((part) => TEMPLATE_SEGMENT.test(part) ? "*" : part).join("/");
+	}
 	text = text.replace(/[:#][\w,-]*$/, "");
 	if (text === "" || text.length > 200) return void 0;
 	if (/^(?:[a-z][a-z0-9+.-]*:|\/|~|[A-Za-z]:)/.test(text) || text.includes("//")) return void 0;
@@ -18353,7 +18359,7 @@ async function judge(context, index, request, root) {
 		kind: "refuse",
 		rule: "scope",
 		story: owner.id,
-		message: `AgentPlugged refused this write: rule scope, story ${owner.id} does not name ${oneLine(relative, 120)}. If it is needed, ask the creator to widen the scope (guard.creator_action scope_widen {story: "${owner.id}", paths: ["${oneLine(relative, 120)}"]}); otherwise leave that file alone. Nothing was written.`
+		message: `AgentPlugged refused this write: rule scope, story ${owner.id} does not name ${oneLine(relative, 120)}. If it is needed, ask the creator to widen the scope (guard.creator_action scope_widen {story: "${owner.id}", paths: ["${oneLine(relative, 120)}"]}); otherwise leave that file alone: do not write it by another tool or command (sed -i, a redirection, Set-Content, a copy, a script), and tell the coordinator which file you need and why. Nothing was written.`
 	};
 	if (request.text !== void 0 && index.decisions !== void 0) {
 		const broken = decisionViolation(index.decisions.guards, relative, request.text);
@@ -18363,7 +18369,7 @@ async function judge(context, index, request, root) {
 			story: owner.id,
 			decision: broken.decision,
 			detail: broken.detail,
-			message: `AgentPlugged refused this write: decision ${broken.decision} of the architecture forbids it (${oneLine(broken.detail, 120)}). Follow the decision, or ask the creator to change it first. Nothing was written.`
+			message: `AgentPlugged refused this write: decision ${broken.decision} of the architecture forbids it (${oneLine(broken.detail, 120)}). Follow the decision, or ask the creator to change it first; do not write the file by another tool or command. Nothing was written.`
 		};
 	}
 	if (placed === void 0) return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentplugged",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Install the AgentPlugged method in a repository and make its agents callable from Claude Code, Codex, Antigravity/Gemini CLI and Cursor.",
   "releaseSummary": "The engine updates itself: your session moves to a newer version between two calls, with nothing to reconnect.",
   "license": "FSL-1.1-MIT",
@@ -47,14 +47,14 @@
     "koffi": "~3.3.2"
   },
   "devDependencies": {
-    "@agentplugged/adapters-git": "1.0.1",
-    "@agentplugged/adapters-tools": "1.0.1",
-    "@agentplugged/core": "1.0.1",
-    "@agentplugged/crypto": "1.0.1",
-    "@agentplugged/i18n": "1.0.1",
-    "@agentplugged/mcp": "1.0.1",
+    "@agentplugged/adapters-git": "1.0.3",
+    "@agentplugged/adapters-tools": "1.0.3",
+    "@agentplugged/core": "1.0.3",
+    "@agentplugged/crypto": "1.0.3",
+    "@agentplugged/i18n": "1.0.3",
+    "@agentplugged/mcp": "1.0.3",
     "@agentplugged/method": "0.0.0",
-    "@agentplugged/protocol": "1.0.1",
+    "@agentplugged/protocol": "1.0.3",
     "@biomejs/biome": "~2.5.15",
     "@modelcontextprotocol/client": "~2.3.0",
     "@types/node": "^24.19.1",