glm-coding-router 1.1.0 → 1.1.2

package/README.md

@@ -135,7 +135,14 @@ dependency inspection, and preliminary review:
 glm-review "Inspect this repository"
 ```
 
-Runs with `--tools Read,Glob,Grep` — it cannot edit files or run commands.
+Runs with `--tools Read,Glob,Grep --strict-mcp-config` — it cannot edit files or run
+commands.
+
+The second flag is part of the guarantee, not a detail: `--tools` restricts only Claude
+Code's **built-in** tools, so without it a review session would also inherit whatever MCP
+servers you have registered — including this project's own, whose `glm_worker` tool writes
+files. `glm-worker` and `glm-router benchmark` are isolated the same way. Interactive
+sessions (`glm-chat`, `glm-fast`) are not: your servers are yours.
 
 ## Profiles
 

package/dist/bin/glm-review.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { STRICT_MCP_ARGS } from "../core/agent-args.js";
 import { loadConfig } from "../core/config.js";
 import { locateClaude } from "../core/claude.js";
 import { createGlmEnv } from "../core/env.js";
@@ -11,8 +12,24 @@ import { spawnAgent } from "../core/process.js";
 import { resolveZaiApiKey } from "../core/zai-key.js";
 /** Read-only review surface (spec §17) — no Edit, Write, or Bash. */
 export const REVIEW_TOOLS = "Read,Glob,Grep";
+/**
+ * Build the child arguments (spec §17, specs/review-mcp-isolation.md).
+ *
+ * `--tools` alone does not make this read-only: it restricts the built-in set,
+ * while MCP tools from the user's config are additive — with our own server
+ * registered, a review could call `glm_worker` and write files. STRICT_MCP_ARGS
+ * is what actually holds the guarantee.
+ */
 export function buildReviewArgs(prompt, config) {
-    return ["-p", prompt, "--max-turns", String(config.review.maxTurns), "--tools", REVIEW_TOOLS];
+    return [
+        "-p",
+        prompt,
+        "--max-turns",
+        String(config.review.maxTurns),
+        "--tools",
+        REVIEW_TOOLS,
+        ...STRICT_MCP_ARGS,
+    ];
 }
 /**
  * glm-review (spec §17): read-only worker for exploration, call-graph

package/dist/bin/glm-worker.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { STRICT_MCP_ARGS } from "../core/agent-args.js";
 import { loadConfig } from "../core/config.js";
 import { locateClaude } from "../core/claude.js";
 import { createGlmEnv } from "../core/env.js";
@@ -21,6 +22,10 @@ export const WORKER_TOOLS_NO_BASH = "Read,Glob,Grep,Edit,Write";
  * `--allowedTools` every Bash call comes back "This command requires
  * approval". When the allowlist is empty we drop Bash from `--tools` entirely
  * rather than advertising a tool the worker can never use.
+ *
+ * STRICT_MCP_ARGS keeps the user's MCP servers out of the child
+ * (specs/review-mcp-isolation.md): write is expected here, undeclared
+ * recursion into `glm_delegate` and its own turn budget is not.
  */
 export function buildWorkerArgs(prompt, config) {
     const allowedBash = config.worker.allowedBash;
@@ -33,6 +38,8 @@ export function buildWorkerArgs(prompt, config) {
         "acceptEdits",
         "--tools",
         allowedBash.length > 0 ? WORKER_TOOLS : WORKER_TOOLS_NO_BASH,
+        // Before --allowedTools: its values are variadic and must stay last.
+        ...STRICT_MCP_ARGS,
     ];
     if (allowedBash.length > 0) {
         args.push("--allowedTools", ...allowedBash.map((pattern) => `Bash(${pattern})`));

package/dist/commands/benchmark.js

@@ -10,6 +10,7 @@ import { locateClaude } from "../core/claude.js";
 import { createGlmEnv } from "../core/env.js";
 import { Errors } from "../core/errors.js";
 import { configDir } from "../core/paths.js";
+import { STRICT_MCP_ARGS } from "../core/agent-args.js";
 import { spawnAgentCapture } from "../core/process.js";
 import { resolveZaiApiKey } from "../core/zai-key.js";
 import { BENCHMARK_TASKS, benchmarkTaskById } from "../templates/benchmark-tasks.js";
@@ -126,6 +127,9 @@ async function runTask(task, run, ctx) {
             "acceptEdits",
             "--tools",
             WORKER_TOOLS,
+            // A benchmark is only comparable if the tool surface is fixed
+            // (specs/review-mcp-isolation.md).
+            ...STRICT_MCP_ARGS,
             "--output-format",
             "json",
         ];

package/dist/commands/status.js

@@ -51,6 +51,8 @@ export function statusCommand(options, deps = {}) {
         });
         return 0;
     }
+    /** Every status row pads its label to this column (spec §41). */
+    const LABEL_WIDTH = 16;
     const lines = [
         `GLM Coding Router v${version}`,
         "",
@@ -63,7 +65,7 @@ export function statusCommand(options, deps = {}) {
     ];
     for (const row of skillState) {
         const enabled = row.homeDetected && row.installed;
-        lines.push(`${row.agent} skill     ${enabled ? "enabled" : "disabled"}`);
+        lines.push(`${`${row.agent} skill`.padEnd(LABEL_WIDTH)}${enabled ? "enabled" : "disabled"}`);
     }
     lines.push("", `Main model      ${config.models.main}`, `Fast model      ${config.models.fast}`);
     process.stdout.write(lines.join("\n") + "\n");

package/dist/commands/usage.js

@@ -9,7 +9,7 @@ import { emitJson } from "./context.js";
 /** Z.ai monitor API used by their own dashboard (specs/usage.md). */
 const ZAI_QUOTA_URL = "https://api.z.ai/api/monitor/usage/quota/limit";
 /** Window labels for the observed enum values (specs/usage.md); unknown values stay generic. */
-function describeWindow(limit) {
+export function describeWindow(limit) {
     if (limit.unit === 3 && typeof limit.number === "number") {
         return `${limit.number}-hour window`;
     }

package/dist/core/agent-args.js

@@ -0,0 +1,20 @@
+/**
+ * Arguments shared by every headless agent we spawn
+ * (specs/review-mcp-isolation.md).
+ */
+/**
+ * Keep the user's MCP servers out of the children we construct.
+ *
+ * `--tools` only restricts Claude Code's **built-in** set, so MCP tools
+ * registered at user/project scope are additive and survive it. With our own
+ * server registered (`glm-router mcp install`), that handed every `glm-review`
+ * session an `mcp__glm-coding-router__glm_worker` — write access and recursion
+ * from a surface documented as read-only.
+ *
+ * `--strict-mcp-config` uses only the servers given by `--mcp-config`. We pass
+ * none, so the set is empty and the child's tool surface is exactly the one we
+ * asked for. Security setting: not configurable, not overridable by a profile.
+ * Interactive sessions (`glm-chat`, `glm-fast`) are deliberately excluded —
+ * the user's own servers are theirs.
+ */
+export const STRICT_MCP_ARGS = ["--strict-mcp-config"];

package/dist/core/user-env.js

@@ -168,14 +168,16 @@ export function describeShellExport(name, deps = {}) {
     const env = deps.env ?? process.env;
     const home = deps.home ?? env.HOME ?? "~";
     const exists = deps.exists ?? ((file) => fs.existsSync(file));
-    const shell = path.basename(env.SHELL ?? "bash");
+    const shell = path.posix.basename(env.SHELL ?? "bash");
     const candidates = shell === "zsh"
         ? [".zshrc", ".zprofile", ".profile"]
         : shell === "fish"
             ? [".config/fish/config.fish"]
             : [".bashrc", ".bash_profile", ".profile"];
-    const found = candidates.find((rel) => exists(path.join(home, rel)));
-    const profile = path.join(home, found ?? candidates[0]);
+    // POSIX paths by definition: this guidance only ever names a shell rc file,
+    // so it must not pick up Windows separators when the process runs on win32.
+    const found = candidates.find((rel) => exists(path.posix.join(home, rel)));
+    const profile = path.posix.join(home, found ?? candidates[0]);
     const line = shell === "fish" ? `set -gx ${name} <your-key>` : `export ${name}="<your-key>"`;
     return { line, profile };
 }

package/dist/mcp/server.js

@@ -11,7 +11,7 @@ import { applyProfile } from "../core/profile.js";
 import { version } from "../core/version.js";
 import { createDelegateWorktree, delegateBranch, removeDelegateWorktree, rollbackDelegateBranch, validateDelegateName, } from "../core/worktree.js";
 import { resolveZaiApiKey } from "../core/zai-key.js";
-import { aggregateLocalUsage, fetchZaiQuota } from "../commands/usage.js";
+import { aggregateLocalUsage, describeWindow, fetchZaiQuota } from "../commands/usage.js";
 const PROMPT_PROPERTY = { type: "string", description: "The task prompt for the GLM agent." };
 export const MCP_TOOLS = [
     {
@@ -138,7 +138,7 @@ async function usage(deps) {
         lines.push(`Z.ai Coding Plan${quota.level ? ` (level: ${quota.level})` : ""}`);
         for (const limit of quota.limits ?? []) {
             const resets = typeof limit.nextResetTime === "number" ? ` — resets ${new Date(limit.nextResetTime).toISOString()}` : "";
-            lines.push(`  ${String(limit.number ?? "?")}x unit ${String(limit.unit ?? "?")}: ${String(limit.currentValue ?? "?")} / ${String(limit.usage ?? "?")} credits (${String(limit.percentage ?? "?")}%)${resets}`);
+            lines.push(`  ${describeWindow(limit).padEnd(15)} ${String(limit.currentValue ?? "?")} / ${String(limit.usage ?? "?")} credits (${String(limit.percentage ?? "?")}%)${resets}`);
         }
     }
     catch (error) {

package/package.json

@@ -1,48 +1,48 @@
-{
-  "name": "glm-coding-router",
-  "version": "1.1.0",
-  "description": "GLM Coding Plan workers for Claude Code and Codex",
-  "type": "module",
-  "license": "MIT",
-  "author": "hieu9721",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/hieu9721/GLM-coding-router.git"
-  },
-  "bin": {
-    "glm-router": "./dist/cli.js",
-    "glm-chat": "./dist/bin/glm-chat.js",
-    "glm-worker": "./dist/bin/glm-worker.js",
-    "glm-review": "./dist/bin/glm-review.js",
-    "glm-fast": "./dist/bin/glm-fast.js",
-    "glm-mcp": "./dist/bin/glm-mcp.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "dev": "tsx src/cli.ts",
-    "build": "tsc",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "lint": "eslint src tests",
-    "prepublishOnly": "npm run build && npm test"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "dependencies": {
-    "commander": "^15.0.0",
-    "prompts": "^2.4.2",
-    "zod": "^4.6.5"
-  },
-  "devDependencies": {
-    "@types/node": "^22.20.3",
-    "@types/prompts": "^2.4.9",
-    "eslint": "^9.39.5",
-    "tsx": "^4.23.13",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.70.0",
-    "vitest": "^5.0.1"
-  }
-}
+{
+  "name": "glm-coding-router",
+  "version": "1.1.2",
+  "description": "GLM Coding Plan workers for Claude Code and Codex",
+  "type": "module",
+  "license": "MIT",
+  "author": "hieu9721",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hieu9721/GLM-coding-router.git"
+  },
+  "bin": {
+    "glm-router": "./dist/cli.js",
+    "glm-chat": "./dist/bin/glm-chat.js",
+    "glm-worker": "./dist/bin/glm-worker.js",
+    "glm-review": "./dist/bin/glm-review.js",
+    "glm-fast": "./dist/bin/glm-fast.js",
+    "glm-mcp": "./dist/bin/glm-mcp.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "dev": "tsx src/cli.ts",
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint src tests",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "commander": "^15.0.0",
+    "prompts": "^2.4.2",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.3",
+    "@types/prompts": "^2.4.9",
+    "eslint": "^9.39.5",
+    "tsx": "^4.23.13",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.70.0",
+    "vitest": "^5.0.1"
+  }
+}