agentplugged 1.0.2 → 1.0.4

package/dist/agent-commands.js

@@ -14500,6 +14500,10 @@ retrospective, an installation and a validation point never wait for it.
    scope: \`guard.creator_action\` \`scope_widen\`) or a decision of the architecture contradicted, and
    lets the write through in doubt. Reading, and writes in other tools, stay governed by the
    permission rules alone: \`read_secrets\` is always denied, whatever the session.
+5. A write the engine refused is never redone by another path: not by a terminal command
+   (\`sed -i\`, a redirection \`>\`, \`Set-Content\`, \`Out-File\`, a copy, a script), not by another tool.
+   The agent stops, tells the coordinator which file it needs and why, and the coordinator offers
+   the creator to widen the scope (\`guard.creator_action\` \`scope_widen\`) in one gesture.
 `;
 }
 /** The folder layout and the seven rules: in the short constitution and in the reference alike. */
@@ -17783,6 +17787,21 @@ function claudeActionRules(action, mainBranch) {
 	push(rules, patternsOf(action, mainBranch).flatMap(claudeRules));
 	return rules;
 }
+/**
+* The rules as Claude Code's settings hold them. A backslash right before the closing parenthesis
+* escapes it there, so such a rule is written with that one backslash doubled (the others are
+* read literally). Claude Code's `PowerShell` tool has its own rules: each `Bash(x)` rule gets
+* its `PowerShell(x)` twin, or a command would pass by being run through the other shell.
+*/
+function claudeCommandRules(rules) {
+	const out = [];
+	for (const rule of rules) {
+		const escaped = rule.endsWith("\\)") && !rule.endsWith("\\\\)") ? `${rule.slice(0, -1)}\\)` : rule;
+		push(out, [escaped]);
+		if (escaped.startsWith("Bash(")) push(out, [`PowerShell${escaped.slice(4)}`]);
+	}
+	return out;
+}
 /** The Claude Code rule that allows all the tools of the `agentplugged` MCP server. */
 const ENGINE_MCP_RULE = "mcp__agentplugged";
 /**
@@ -18991,13 +19010,22 @@ const WRITE_TOOLS = [
 		text: "new_source"
 	}
 ];
+/** The two tools that run a shell command in Claude Code: both carry it in `tool_input.command`. */
+const SHELL_MATCHER = "Bash|PowerShell";
+/**
+* The `if` conditions of a hook on the shell tools: each `Bash(x)` condition and its
+* `PowerShell(x)` twin, as a condition matches the calls of one tool only.
+*/
+function shellConditions(conditions) {
+	return conditions.flatMap((condition) => [condition, `PowerShell${condition.slice(4)}`]);
+}
 /** The hooks `sync` writes for Claude Code, from the rules in force. */
 function claudeTrustHooks(rules, mainBranch) {
 	const session = hookValue("session_id");
 	const pre = [];
-	const conditions = rules.install_dependency === "deny" ? [] : claudeActionRules("install_dependency", mainBranch).filter((entry) => entry.startsWith("Bash("));
+	const conditions = rules.install_dependency === "deny" ? [] : shellConditions(claudeActionRules("install_dependency", mainBranch).filter((entry) => entry.startsWith("Bash(")));
 	if (conditions.length > 0) pre.push({
-		matcher: "Bash",
+		matcher: SHELL_MATCHER,
 		hooks: conditions.map((condition) => handler("check_action", {
 			action: "install_dependency",
 			command: hookValue("tool_input.command"),
@@ -19032,9 +19060,9 @@ function claudeTrustHooks(rules, mainBranch) {
 			})]
 		},
 		{
-			matcher: "Bash",
-			hooks: NETWORK_COMMANDS.map((condition) => handler("record_external_read", {
-				tool: "Bash",
+			matcher: SHELL_MATCHER,
+			hooks: shellConditions(NETWORK_COMMANDS).map((condition) => handler("record_external_read", {
+				tool: condition.startsWith("PowerShell(") ? "PowerShell" : "Bash",
 				source: hookValue("tool_input.command"),
 				session
 			}, condition))
@@ -19775,9 +19803,9 @@ const syncCommand = defineCommand({
 			flavor: claudeFlavor(loaded.config.permissions?.mode),
 			current: claudeSettings
 		}, has("claude-code") ? {
-			deny: claudeWritable(unique([...denyRules(permissionInputs), ...claudeRules.deny])),
-			allow: claudeWritable(claudeRules.allow),
-			ask: claudeWritable(claudeRules.ask)
+			deny: claudeCommandRules(unique([...denyRules(permissionInputs), ...claudeRules.deny])),
+			allow: claudeCommandRules(claudeRules.allow),
+			ask: claudeCommandRules(claudeRules.ask)
 		} : {}, {
 			deny: manifest.permissions,
 			...previousLists[CLAUDE_SETTINGS_PATH]
@@ -19809,7 +19837,7 @@ const syncCommand = defineCommand({
 				count: owned.allow.length
 			});
 		}
-		const conflicts = [...has("claude-code") ? allowConflicts(CLAUDE_SETTINGS_PATH, claudeSettings?.value, claudeRules.allow, {
+		const conflicts = [...has("claude-code") ? allowConflicts(CLAUDE_SETTINGS_PATH, claudeSettings?.value, claudeCommandRules(claudeRules.allow), {
 			deny: manifest.permissions,
 			...previousLists[CLAUDE_SETTINGS_PATH]
 		}) : [], ...has("cursor") ? allowConflicts(CURSOR_CLI_PATH, cursorSettings?.value, cursorRules.allow, { deny: previousCursor }) : []];
@@ -19878,14 +19906,6 @@ const CODEX_HOME_DENY = [
 function unique(rules) {
 	return [...new Set(rules)];
 }
-/**
-* The rules Claude Code's settings can hold: a backslash before the closing parenthesis escapes it
-* there, so such a rule would be malformed (the `C:/` spelling of the same root stays). The
-* engine's own guards keep them: they read the rules themselves.
-*/
-function claudeWritable(rules) {
-	return rules.filter((rule) => !rule.endsWith("\\)"));
-}
 /** The tool a generated path belongs to, for the summary. */
 function groupOf(path) {
 	if (path.startsWith(".claude/") || path === "CLAUDE.md") return "claude-code";
@@ -20015,6 +20035,17 @@ function compareSemver(a, b) {
 	}
 	return 0;
 }
+/** The engine version `method.yaml` pins in the repository's main working folder, if readable. */
+async function mainCheckoutPin(files) {
+	try {
+		const text = await files.readMainCheckoutText?.(METHOD_CONFIG_PATH);
+		if (text === void 0) return void 0;
+		const version = parseDocument(text).toJS()?.engine_version;
+		return SemverSchema.safeParse(version).success ? version : void 0;
+	} catch {
+		return;
+	}
+}
 /**
 * Checks, before anything is written, that the running engine may work on this product:
 * a `format_version` newer than the engine knows stops with `UPGRADE_REQUIRED`, an older one with
@@ -20057,6 +20088,11 @@ async function checkEngine(files, options) {
 		overridden: false,
 		older: false
 	};
+	if (!options.upgrade && !options.engineAny && compareSemver(options.engineVersion, pinned) > 0 && await mainCheckoutPin(files) === options.engineVersion) return {
+		pinned,
+		overridden: false,
+		older: false
+	};
 	const details = {
 		path: METHOD_CONFIG_PATH,
 		pinned,
@@ -31012,7 +31048,7 @@ function readSource(tool, raw) {
 	const toolName = truncate(cleanText(tool), 200) || "unknown";
 	const given = cleanText(raw ?? "");
 	const usable = given !== "" && !given.includes("${");
-	if (usable && toolName === "Bash") return {
+	if (usable && (toolName === "Bash" || toolName === "PowerShell")) return {
 		tool: toolName,
 		source: truncate(hostOf$1(given, true) ?? commandName(given), 200)
 	};

package/dist/main.js

@@ -6299,6 +6299,28 @@ var NodeWorkspaceFiles = class {
 	async readBytes(path) {
 		return new Uint8Array(await readFile(this.resolve(path)));
 	}
+	async readMainCheckoutText(path) {
+		try {
+			const target = this.resolve(path);
+			for (let top = this.root;; top = dirname(top)) {
+				const marker = join(top, ".git");
+				const info = await stat(marker).catch(() => void 0);
+				if (info?.isDirectory() === true) return void 0;
+				if (info?.isFile() === true) {
+					const named = /^gitdir:\s*(.+?)\s*$/m.exec(await readFile(marker, "utf8"))?.[1];
+					if (named === void 0) return void 0;
+					const own = resolve(top, named);
+					const common = resolve(own, (await readFile(join(own, "commondir"), "utf8")).trim());
+					if (basename(common) !== ".git") return void 0;
+					const main = join(dirname(common), relative(top, this.root));
+					return await readFile(join(main, relative(this.root, target)), "utf8");
+				}
+				if (dirname(top) === top) return void 0;
+			}
+		} catch {
+			return;
+		}
+	}
 	/**
 	* Writes to a temporary file next to the target, then renames it over the target. A symbolic
 	* link is followed, so the real file is replaced and the creator's link is kept.

package/dist/method/agents/noah/references/conduct.md

@@ -59,6 +59,7 @@ back, and the decisions to take.
   other tool under his id (`ROLE_FORBIDDEN`): he never opens a checkpoint (an end of phase
   included), never starts or delivers a story, never submits a result in another agent's place.
   He never reports under another agent's id.
+- When a developer reports a write the engine refused, Noah never lets it be redone by another path (a terminal command, a redirection, a copy): he proposes to the creator to widen the scope (`guard.creator_action` `scope_widen`), in one gesture.
 - Decisions belong to the creator: the scope, the options of a checkpoint, an approval, a new
   agent, and every point they kept for themselves. Noah recommends; the creator decides. The points
   they did not keep are decided by the agent responsible, never by Noah (`checkpoint.decide` is not

package/dist/product-root.js

@@ -16803,7 +16803,8 @@ function alreadyRecorded(listing, read, session) {
 * source is a `${…}`), or for an absent source: when in doubt, the read counts.
 */
 function isLocalShellCommand(tool, source) {
-	if (tool.trim() !== "Bash" || source === void 0) return false;
+	const shell = tool.trim();
+	if (shell !== "Bash" && shell !== "PowerShell" || source === void 0) return false;
 	const command = source.trim();
 	if (command === "" || /^\$\{[^}]*\}$/.test(command) || /^https?:\/\//i.test(command)) return false;
 	return !isNetworkCommand(command);
@@ -17101,9 +17102,14 @@ const FILE_EXTENSIONS = "ts|tsx|js|jsx|mjs|cjs|json|jsonc|md|mdx|yaml|yml|toml|p
 const CODE_SPAN = /`([^`\n]{1,200})`/g;
 const BARE_PATH = new RegExp(`(?<![\\w@./:~-])((?:\\./)?[\\w@.-]+(?:/[\\w@.*-]+)*\\.(?:${FILE_EXTENSIONS}))(?![\\w/-])`, "g");
 const BARE_FOLDER = /(?<![\w@./:~-])((?:\.\/)?[\w@.-]+(?:\/[\w@.*-]+)+\/)(?![\w])/g;
+const TEMPLATE_SEGMENT = /^(?:<[A-Za-z_][\w-]*>|\{[A-Za-z_][\w-]*\}|\[[A-Za-z_][\w-]*\]|:[A-Za-z_][\w-]*)$/;
 /** A token read as a path of the project, or undefined (a URL, an absolute path, a word). */
 function pathOf$1(token) {
 	let text = token.trim().replaceAll("\\", "/").replace(/^\{project-root\}\//, "").replace(/^\.\//, "");
+	if (text.includes("/")) {
+		if (TEMPLATE_SEGMENT.test(text.split("/")[0] ?? "")) return void 0;
+		text = text.split("/").map((part) => TEMPLATE_SEGMENT.test(part) ? "*" : part).join("/");
+	}
 	text = text.replace(/[:#][\w,-]*$/, "");
 	if (text === "" || text.length > 200) return void 0;
 	if (/^(?:[a-z][a-z0-9+.-]*:|\/|~|[A-Za-z]:)/.test(text) || text.includes("//")) return void 0;
@@ -18353,7 +18359,7 @@ async function judge(context, index, request, root) {
 		kind: "refuse",
 		rule: "scope",
 		story: owner.id,
-		message: `AgentPlugged refused this write: rule scope, story ${owner.id} does not name ${oneLine(relative, 120)}. If it is needed, ask the creator to widen the scope (guard.creator_action scope_widen {story: "${owner.id}", paths: ["${oneLine(relative, 120)}"]}); otherwise leave that file alone. Nothing was written.`
+		message: `AgentPlugged refused this write: rule scope, story ${owner.id} does not name ${oneLine(relative, 120)}. If it is needed, ask the creator to widen the scope (guard.creator_action scope_widen {story: "${owner.id}", paths: ["${oneLine(relative, 120)}"]}); otherwise leave that file alone: do not write it by another tool or command (sed -i, a redirection, Set-Content, a copy, a script), and tell the coordinator which file you need and why. Nothing was written.`
 	};
 	if (request.text !== void 0 && index.decisions !== void 0) {
 		const broken = decisionViolation(index.decisions.guards, relative, request.text);
@@ -18363,7 +18369,7 @@ async function judge(context, index, request, root) {
 			story: owner.id,
 			decision: broken.decision,
 			detail: broken.detail,
-			message: `AgentPlugged refused this write: decision ${broken.decision} of the architecture forbids it (${oneLine(broken.detail, 120)}). Follow the decision, or ask the creator to change it first. Nothing was written.`
+			message: `AgentPlugged refused this write: decision ${broken.decision} of the architecture forbids it (${oneLine(broken.detail, 120)}). Follow the decision, or ask the creator to change it first; do not write the file by another tool or command. Nothing was written.`
 		};
 	}
 	if (placed === void 0) return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentplugged",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Install the AgentPlugged method in a repository and make its agents callable from Claude Code, Codex, Antigravity/Gemini CLI and Cursor.",
   "releaseSummary": "The engine updates itself: your session moves to a newer version between two calls, with nothing to reconnect.",
   "license": "FSL-1.1-MIT",
@@ -47,14 +47,14 @@
     "koffi": "~3.3.2"
   },
   "devDependencies": {
-    "@agentplugged/adapters-git": "1.0.2",
-    "@agentplugged/adapters-tools": "1.0.2",
-    "@agentplugged/core": "1.0.2",
-    "@agentplugged/crypto": "1.0.2",
-    "@agentplugged/i18n": "1.0.2",
-    "@agentplugged/mcp": "1.0.2",
+    "@agentplugged/adapters-git": "1.0.4",
+    "@agentplugged/adapters-tools": "1.0.4",
+    "@agentplugged/core": "1.0.4",
+    "@agentplugged/crypto": "1.0.4",
+    "@agentplugged/i18n": "1.0.4",
+    "@agentplugged/mcp": "1.0.4",
     "@agentplugged/method": "0.0.0",
-    "@agentplugged/protocol": "1.0.2",
+    "@agentplugged/protocol": "1.0.4",
     "@biomejs/biome": "~2.5.15",
     "@modelcontextprotocol/client": "~2.3.0",
     "@types/node": "^24.19.1",