coding-friend-cli 1.40.2 → 1.40.4

package/dist/{chunk-CZW36H3D.js → chunk-BQ4E66ZV.js}

@@ -11,7 +11,7 @@ import {
   askScope,
   formatScopeLabel,
   injectBackChoice
-} from "./chunk-Z5XTSF7L.js";
+} from "./chunk-XLB2UAKL.js";
 import {
   getLibPath
 } from "./chunk-TN3Y75WG.js";

package/dist/{chunk-KT5RLAFH.js → chunk-DVWCO7K4.js}

@@ -2,20 +2,20 @@ import {
   checkMemoryMcpHealth,
   printHealthSection,
   warnStaleMcpJson
-} from "./chunk-TFF47F7P.js";
+} from "./chunk-HEVK3OYL.js";
 import {
   loadConfig,
   resolveMemoryDir
-} from "./chunk-CGZNFAOB.js";
+} from "./chunk-ZEOWTLWI.js";
 import {
   getMemoryMcpStatus,
   isMemoryMcpRegistered,
   memoryConfigMenu,
   registerMemoryMcp
-} from "./chunk-CZW36H3D.js";
+} from "./chunk-BQ4E66ZV.js";
 import {
   showConfigHint
-} from "./chunk-Z5XTSF7L.js";
+} from "./chunk-XLB2UAKL.js";
 import {
   getLibPath
 } from "./chunk-TN3Y75WG.js";

package/dist/{chunk-TFF47F7P.js → chunk-HEVK3OYL.js}

@@ -1,6 +1,6 @@
 import {
   isMemoryMcpRegistered
-} from "./chunk-CZW36H3D.js";
+} from "./chunk-BQ4E66ZV.js";
 import {
   readJson
 } from "./chunk-5UVDWG5L.js";

package/dist/{chunk-4FQACYCV.js → chunk-LZPCZAGZ.js}

@@ -9,7 +9,7 @@ import {
   isMemoryMcpRegistered,
   registerMemoryMcp,
   removeMemoryMcpEntry
-} from "./chunk-CZW36H3D.js";
+} from "./chunk-BQ4E66ZV.js";
 import {
   isPluginInstalled
 } from "./chunk-SUYE5S2W.js";
@@ -33,7 +33,7 @@ import {
 import {
   resolveHostFlags,
   resolveScope
-} from "./chunk-Z5XTSF7L.js";
+} from "./chunk-XLB2UAKL.js";
 import {
   detectHostsAvailable
 } from "./chunk-OBCNHQFA.js";
@@ -55,7 +55,7 @@ import {
 } from "./chunk-NREZK463.js";
 
 // src/commands/update.ts
-import { readFileSync } from "fs";
+import { lstatSync, readFileSync } from "fs";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 import chalk from "chalk";
@@ -78,6 +78,31 @@ function getCliVersion() {
 function getLatestCliVersion() {
   return run("npm", ["view", "coding-friend-cli", "version"]);
 }
+function shouldUpdateCli(requested) {
+  if (!requested) return false;
+  if (isCliGlobalLinked()) {
+    log.info(
+      "CLI is npm-linked to a local repo \u2014 skipping CLI update. Build it there instead (`npm run dev`)."
+    );
+    return false;
+  }
+  return true;
+}
+function isCliGlobalLinked() {
+  const prefix = run("npm", ["prefix", "-g"]);
+  if (!prefix) return false;
+  const modules = "node_modules";
+  return [
+    join(prefix.trim(), "lib", modules, "coding-friend-cli"),
+    join(prefix.trim(), modules, "coding-friend-cli")
+  ].some((p) => {
+    try {
+      return lstatSync(p).isSymbolicLink();
+    } catch {
+      return false;
+    }
+  });
+}
 function getLatestVersion() {
   let tag = null;
   tag = run("gh", [
@@ -191,7 +216,6 @@ async function updateCommand(opts) {
 }
 async function updateClaudeCommand(opts, mode) {
   const updateAll = !opts.cli && !opts.plugin && !opts.statusline;
-  const doCli = (updateAll || !!opts.cli) && !mode?.skipCli;
   const doPlugin = updateAll || !!opts.plugin;
   const doStatusline = updateAll || !!opts.statusline;
   const hasScopeFlag = !!(opts.user || opts.global || opts.project || opts.local);
@@ -205,6 +229,7 @@ async function updateClaudeCommand(opts, mode) {
     printBanner("\u2728 Coding Friend Update \u2728");
     console.log();
   }
+  const doCli = shouldUpdateCli((updateAll || !!opts.cli) && !mode?.skipCli);
   const currentVersion = getInstalledVersion();
   const latestVersion = getLatestVersion();
   const statuslineVersion = getStatuslineVersion();
@@ -323,7 +348,7 @@ async function updateClaudeCommand(opts, mode) {
   }
   let refreshMemoryAfterUpdate = null;
   if (doCli) {
-    ({ refreshMemoryAfterUpdate } = await import("./memory-KNKGLCVG.js"));
+    ({ refreshMemoryAfterUpdate } = await import("./memory-NAFLQ6NN.js"));
     if (!latestCliVersion) {
       log.warn("Cannot check latest CLI version from npm.");
     } else {
@@ -383,12 +408,12 @@ async function updateClaudeCommand(opts, mode) {
 }
 async function updateCodexCommand(opts, mode) {
   const updateAll = !opts.cli && !opts.plugin && !opts.statusline;
-  const doCli = (updateAll || !!opts.cli) && !mode?.skipCli;
   const doPlugin = updateAll || !!opts.plugin;
   if (!mode?.skipBanner) {
     printBanner("\u2728 Coding Friend Codex Update \u2728");
     console.log();
   }
+  const doCli = shouldUpdateCli((updateAll || !!opts.cli) && !mode?.skipCli);
   if (doPlugin) {
     const beforeVersion = getCodexInstalledVersion();
     console.log(
@@ -484,13 +509,13 @@ function ompUpdateScopes(opts) {
 }
 async function updateOmpCommand(opts, mode) {
   const updateAll = !opts.cli && !opts.plugin && !opts.statusline;
-  const doCli = (updateAll || !!opts.cli) && !mode?.skipCli;
   const doPlugin = updateAll || !!opts.plugin;
   const scopes = ompUpdateScopes(opts);
   if (!mode?.skipBanner) {
     printBanner("\u2728 Coding Friend omp Update \u2728");
     console.log();
   }
+  const doCli = shouldUpdateCli((updateAll || !!opts.cli) && !mode?.skipCli);
   if (doPlugin) {
     const cliVersion = getCliVersion();
     console.log(`  CLI         ${cliVersion}`);
@@ -554,12 +579,12 @@ function restoreAgyExtraMcpServers(previous) {
 }
 async function updateAgyCommand(opts, mode) {
   const updateAll = !opts.cli && !opts.plugin && !opts.statusline;
-  const doCli = (updateAll || !!opts.cli) && !mode?.skipCli;
   const doPlugin = updateAll || !!opts.plugin;
   if (!mode?.skipBanner) {
     printBanner("\u2728 Coding Friend Antigravity Update (beta) \u2728");
     console.log();
   }
+  const doCli = shouldUpdateCli((updateAll || !!opts.cli) && !mode?.skipCli);
   if (doPlugin) {
     try {
       const previousMcp = readAgyMcpConfig();
@@ -617,6 +642,7 @@ export {
   semverCompare,
   getCliVersion,
   getLatestCliVersion,
+  isCliGlobalLinked,
   getLatestVersion,
   updateCommand
 };

package/dist/{chunk-KG6HYBGD.js → chunk-SKEWZ2ET.js}

@@ -6,10 +6,13 @@ import {
   claudeLocalSettingsPath,
   claudeProjectSettingsPath,
   claudeSettingsPath,
+  knownMarketplacesPath,
   pluginCachePath
 } from "./chunk-IYBIIRH4.js";
 
 // src/lib/permissions.ts
+import { join } from "path";
+var MARKETPLACE_NAME = "coding-friend-marketplace";
 var STATIC_RULES = [
   // Core Utilities (hooks & infrastructure)
   {
@@ -90,6 +93,37 @@ var STATIC_RULES = [
     category: "Core Utilities",
     recommended: true
   },
+  // The cf-review scope snapshot lives under /tmp/coding-friend/review/<run-id>/.
+  // Only the main agent writes it (gather-diff.sh --snapshot-dir); reviewer
+  // subagents read it. Without these rules a background reviewer can stall for
+  // hours on a write-permission prompt nobody sees.
+  // Read/Edit/Write need a DOUBLE leading slash: a single "/" anchors at the
+  // settings source dir, not the filesystem root. Bash rules take the literal
+  // command text, so mkdir keeps one slash.
+  {
+    rule: "Bash(mkdir -p /tmp/coding-friend/review/*)",
+    description: "[write] Create the review scope snapshot dir \xB7 Used by: /cf-review gather-diff --snapshot-dir",
+    category: "Core Utilities",
+    recommended: true
+  },
+  {
+    rule: "Read(//tmp/coding-friend/review/**)",
+    description: "[read-only] Read the review scope snapshot \xB7 Used by: /cf-review reviewer agents",
+    category: "Core Utilities",
+    recommended: true
+  },
+  {
+    rule: "Edit(//tmp/coding-friend/review/**)",
+    description: "[modify] Update the review scope snapshot \xB7 Used by: /cf-review main agent",
+    category: "Core Utilities",
+    recommended: true
+  },
+  {
+    rule: "Write(//tmp/coding-friend/review/**)",
+    description: "[write] Write the review scope snapshot \xB7 Used by: /cf-review main agent",
+    category: "Core Utilities",
+    recommended: true
+  },
   // Git Operations
   {
     rule: "Bash(git status *)",
@@ -260,7 +294,14 @@ var STATIC_RULES = [
     recommended: true
   }
 ];
-function buildPluginScriptRules() {
+function resolveMarketplacePluginRoot() {
+  const data = readJson(
+    knownMarketplacesPath()
+  );
+  const installLocation = data?.[MARKETPLACE_NAME]?.installLocation;
+  return installLocation ? join(installLocation, "plugin") : null;
+}
+function buildPluginScriptRules(marketplaceRoot = resolveMarketplacePluginRoot()) {
   const absBase = pluginCachePath();
   const readBase = process.env.CLAUDE_CONFIG_DIR?.trim() ? absBase : "~/.claude/plugins/cache/coding-friend-marketplace/coding-friend";
   return [
@@ -287,11 +328,35 @@ function buildPluginScriptRules() {
       description: "[read-only] Read user global config \xB7 Used by: session-init hook, /cf-learn",
       category: "Plugin Scripts",
       recommended: true
-    }
+    },
+    // Skills and hooks self-reference via ${CLAUDE_PLUGIN_ROOT}, which points at
+    // the marketplace's install location — the repo itself in dev mode, the
+    // clone under ~/.claude/plugins/marketplaces/ otherwise. Neither is the
+    // versioned cache above, so those paths need their own rules.
+    ...marketplaceRoot ? [
+      {
+        rule: `Bash(bash ${marketplaceRoot}/*)`,
+        description: "[execute] Run plugin scripts from the marketplace root (unquoted) \xB7 Used by: all skills",
+        category: "Plugin Scripts",
+        recommended: true
+      },
+      {
+        rule: `Bash(bash "${marketplaceRoot}/*)`,
+        description: "[execute] Run plugin scripts from the marketplace root (quoted) \xB7 Used by: all skills",
+        category: "Plugin Scripts",
+        recommended: true
+      },
+      {
+        rule: `Read(${marketplaceRoot}/**)`,
+        description: "[read-only] Read plugin files from the marketplace root \xB7 Used by: hooks, agents",
+        category: "Plugin Scripts",
+        recommended: true
+      }
+    ] : []
   ];
 }
-function getAllRules() {
-  return [...STATIC_RULES, ...buildPluginScriptRules()];
+function getAllRules(marketplaceRoot) {
+  return [...STATIC_RULES, ...buildPluginScriptRules(marketplaceRoot)];
 }
 var PERMISSION_RULES = getAllRules();
 var DANGEROUS_RULE_PATTERNS = [
@@ -423,12 +488,15 @@ function extractTag(description) {
   const match = description.match(/^(\[[^\]]+\])/);
   return match ? match[1] : null;
 }
-var OLD_PLUGIN_PATH_PATTERN = "/.claude/plugins/cache/coding-friend-marketplace/coding-friend/";
+var OLD_PLUGIN_PATH_PATTERNS = [
+  "/.claude/plugins/cache/coding-friend-marketplace/coding-friend/",
+  `/.claude/plugins/marketplaces/${MARKETPLACE_NAME}/plugin/`
+];
 function cleanupStalePluginRules(settingsPath) {
   const existing = getExistingRules(settingsPath);
   const currentRules = new Set(getAllRules().map((r) => r.rule));
   const stale = existing.filter(
-    (r) => r.includes(OLD_PLUGIN_PATH_PATTERN) && !currentRules.has(r)
+    (r) => OLD_PLUGIN_PATH_PATTERNS.some((p) => r.includes(p)) && !currentRules.has(r)
   );
   if (stale.length === 0) return 0;
   applyPermissions(settingsPath, [], stale);

package/dist/{chunk-Z5XTSF7L.js → chunk-XLB2UAKL.js}

@@ -16,10 +16,42 @@ import {
 } from "./chunk-NREZK463.js";
 
 // src/lib/prompt-utils.ts
-import { select, Separator } from "@inquirer/prompts";
+import { checkbox, confirm, input, select, Separator } from "@inquirer/prompts";
 import { existsSync } from "fs";
+import { emitKeypressEvents } from "readline";
 import chalk from "chalk";
 var BACK = "__back__";
+var BackError = class extends Error {
+  constructor() {
+    super("back");
+    this.name = "BackError";
+  }
+};
+var escArmed = false;
+function setEscArmed(armed) {
+  escArmed = armed;
+}
+async function withEsc(run2) {
+  if (!escArmed) return run2();
+  const controller = new AbortController();
+  const onKey = (_str, key) => {
+    if (key?.name === "escape") controller.abort();
+  };
+  emitKeypressEvents(process.stdin);
+  process.stdin.on("keypress", onKey);
+  try {
+    return await run2({ signal: controller.signal });
+  } catch (err) {
+    if (err?.name === "AbortPromptError") throw new BackError();
+    throw err;
+  } finally {
+    process.stdin.off("keypress", onKey);
+  }
+}
+var escSelect = (config) => withEsc((ctx) => select(config, ctx));
+var escInput = (config) => withEsc((ctx) => input(config, ctx));
+var escConfirm = (config) => withEsc((ctx) => confirm(config, ctx));
+var escCheckbox = (config) => withEsc((ctx) => checkbox(config, ctx));
 function injectBackChoice(choices, label = "Back") {
   return [
     ...choices,
@@ -28,7 +60,7 @@ function injectBackChoice(choices, label = "Back") {
   ];
 }
 async function askScope(label = "Save to:") {
-  return select({
+  return escSelect({
     message: label,
     choices: [
       { name: "This project only", value: "local" },
@@ -185,6 +217,12 @@ function applyDocsDirChange(newValue, oldValue, scope, subfolders = []) {
 
 export {
   BACK,
+  BackError,
+  setEscArmed,
+  escSelect,
+  escInput,
+  escConfirm,
+  escCheckbox,
   injectBackChoice,
   askScope,
   resolveScope,

package/dist/{chunk-CGZNFAOB.js → chunk-ZEOWTLWI.js}

@@ -102,7 +102,13 @@ var MemoryConfigSchema = z.object({
 });
 var ReviewConfigSchema = z.strictObject({
   withCodex: z.boolean().optional(),
-  maxRounds: z.number().int().min(1).optional()
+  maxRounds: z.number().int().min(1).optional(),
+  // Both timeouts are whole positive seconds: zero, negative and fractional
+  // values cannot be enforced as a deadline, so they are rejected here rather
+  // than coerced somewhere downstream. Deliberately NOT offered in the
+  // interactive `cf config` review menu — they are file-only settings.
+  agentTimeout: z.number().int().min(1).optional(),
+  nativeTimeout: z.number().int().min(1).optional()
 });
 var ConfigSchema = z.strictObject({
   language: z.string().optional(),

package/dist/{clean-S57BNTWM.js → clean-VD6CFY4C.js}

@@ -1,7 +1,7 @@
 import {
   loadConfig,
   resolveMemoryDir
-} from "./chunk-CGZNFAOB.js";
+} from "./chunk-ZEOWTLWI.js";
 import "./chunk-ITI7MXLA.js";
 import "./chunk-5UVDWG5L.js";
 import "./chunk-EVGXUDX4.js";

package/dist/{config-A4JIINZK.js → config-7LMHDOGW.js}

@@ -2,13 +2,13 @@ import {
   afterAutoApproveEnabled,
   getAllRules,
   getExistingRules
-} from "./chunk-KG6HYBGD.js";
+} from "./chunk-SKEWZ2ET.js";
 import {
   listMdFilesRecursive
 } from "./chunk-2DTXVMPQ.js";
 import {
   resolveLearnDir
-} from "./chunk-CGZNFAOB.js";
+} from "./chunk-ZEOWTLWI.js";
 import {
   findStatuslineHookPath,
   getCurrentAccountEmail,
@@ -36,7 +36,7 @@ import {
 } from "./chunk-667NMPN4.js";
 import {
   memoryConfigMenu
-} from "./chunk-CZW36H3D.js";
+} from "./chunk-BQ4E66ZV.js";
 import "./chunk-KCBMCHSA.js";
 import {
   BACK,
@@ -47,7 +47,7 @@ import {
   getScopeLabel,
   injectBackChoice,
   showConfigHint
-} from "./chunk-Z5XTSF7L.js";
+} from "./chunk-XLB2UAKL.js";
 import "./chunk-TN3Y75WG.js";
 import "./chunk-OBCNHQFA.js";
 import {
@@ -802,7 +802,7 @@ async function editPermissions() {
     )
   });
   if (choice === BACK) return;
-  const { permissionCommand } = await import("./permission-DDBMBFJV.js");
+  const { permissionCommand } = await import("./permission-TORAVB2Y.js");
   switch (choice) {
     case "interactive":
       await permissionCommand({});

package/dist/{dev-E3EHPMHE.js → dev-GCVXE5TW.js}

@@ -1,5 +1,6 @@
 import {
-  ensureStatusline
+  ensureStatusline,
+  getInstalledVersion
 } from "./chunk-FK4SXIF7.js";
 import "./chunk-ITI7MXLA.js";
 import {
@@ -242,22 +243,9 @@ async function devSyncCommand() {
     );
     return;
   }
-  const cacheBase = pluginCachePath();
-  let cacheVersionDir = null;
-  if (existsSync(cacheBase)) {
-    const versions = readdirSync(cacheBase).filter(
-      (v) => statSync(join(cacheBase, v)).isDirectory()
-    );
-    if (versions.length > 0) {
-      cacheVersionDir = join(
-        cacheBase,
-        versions.sort((a, b) => {
-          return statSync(join(cacheBase, b)).mtimeMs - statSync(join(cacheBase, a)).mtimeMs;
-        })[0]
-      );
-    }
-  }
-  if (!cacheVersionDir) {
+  const installedVersion = getInstalledVersion();
+  const cacheVersionDir = installedVersion ? join(pluginCachePath(), installedVersion) : null;
+  if (!cacheVersionDir || !existsSync(cacheVersionDir)) {
     log.error(
       "No cached plugin version found. Run `cf dev off && cf dev on` first."
     );

package/dist/{disable-DCGVIHKG.js → disable-CN6GAG4I.js}

@@ -14,7 +14,7 @@ import {
 import {
   resolveHostFlags,
   resolveScope
-} from "./chunk-Z5XTSF7L.js";
+} from "./chunk-XLB2UAKL.js";
 import "./chunk-TN3Y75WG.js";
 import "./chunk-OBCNHQFA.js";
 import "./chunk-5UVDWG5L.js";

package/dist/{enable-YYWJDOYB.js → enable-MRLKTJRB.js}

@@ -14,7 +14,7 @@ import {
 import {
   resolveHostFlags,
   resolveScope
-} from "./chunk-Z5XTSF7L.js";
+} from "./chunk-XLB2UAKL.js";
 import "./chunk-TN3Y75WG.js";
 import "./chunk-OBCNHQFA.js";
 import "./chunk-5UVDWG5L.js";

package/dist/{host-7XKH5HLB.js → host-KGUAFN4Y.js}

@@ -1,6 +1,6 @@
 import {
   resolveLearnDir
-} from "./chunk-CGZNFAOB.js";
+} from "./chunk-ZEOWTLWI.js";
 import "./chunk-ITI7MXLA.js";
 import {
   getLibPath