pi-code 1.0.61 → 1.0.63

package/extensions/internal/command-file.ts

@@ -18,6 +18,8 @@ import * as path from 'node:path'
 
 import { parseFrontmatter } from '@earendil-works/pi-coding-agent'
 
+import { CLAUDE_TOOL_MAP } from './claude-tool-names.js'
+
 /** The pi file tools a Claude path rule can govern. */
 export type PathRuleTool = 'read' | 'edit' | 'write'
 
@@ -27,6 +29,12 @@ export interface ParsedCommand {
   allowedTools?: string[]
   /** Claude `Bash(...)` specifiers, present only when every bash grant is scoped. */
   bashRules?: string[]
+  /** Claude `WebFetch(domain:...)` specifiers, on the same unscoped-wins rule. */
+  domainRules?: string[]
+  /** Claude `Agent(...)`/`Task(...)` agent names, on the same unscoped-wins rule. */
+  agentRules?: string[]
+  /** Claude `Skill(...)` name patterns, on the same unscoped-wins rule. */
+  skillRules?: string[]
   /** Claude path rules per pi file tool, from Read(...)/Edit(...)/Write(...) grants. */
   pathRules?: Partial<Record<PathRuleTool, string[]>>
   /** Names from the `arguments:` frontmatter list, mapped to positions in order. */
@@ -58,34 +66,6 @@ export interface DiscoveredCommand {
   plugin?: { root: string; dataDir: string; userConfig?: Record<string, string> }
 }
 
-/** Claude tool names are PascalCase and do not all exist in pi: `Glob` is pi's
- * `find`. Lowercasing alone left `glob` in the list, and since pi has no tool by
- * that name the grant was silently dropped when the list was intersected with the
- * active tools. Shared with the subagent's own frontmatter parsing. */
-const CLAUDE_TOOL_MAP: Record<string, string> = {
-  read: 'read',
-  write: 'write',
-  edit: 'edit',
-  bash: 'bash',
-  grep: 'grep',
-  glob: 'find',
-  ls: 'ls',
-  // Claude's names for the tools this package registers itself. Without these a
-  // perfectly ordinary `allowed-tools: WebFetch, WebSearch` matched no pi tool and
-  // the intersection left the turn with nothing.
-  webfetch: 'web_fetch',
-  websearch: 'web_search',
-  todowrite: 'todo',
-  todoread: 'todo',
-  task: 'subagent',
-  askuserquestion: 'question',
-  exitplanmode: 'plan_mode_complete',
-  // Claude's name for the tool this package registers so the model can run user slash
-  // commands; without it `allowed-tools: SlashCommand` matched nothing and the grant
-  // could neither keep nor drop the tool.
-  slashcommand: 'slash_command',
-}
-
 /**
  * The pi tool name for one grant entry, scope and all: `Bash(git add:*)` is `bash`.
  * Keeping the scope in the name matched nothing when the list was intersected with
@@ -135,6 +115,14 @@ export interface ToolGrants {
   /** Claude `Bash(...)` specifiers, present only when every bash grant is scoped:
    * an unscoped `Bash` entry is the wider grant and wins over its scoped siblings. */
   bashRules?: string[]
+  /** Claude `WebFetch(domain:host)` specifiers, same unscoped-wins rule as bash.
+   * Dropping them granted unrestricted web_fetch to a command that asked for one host. */
+  domainRules?: string[]
+  /** Claude `Agent(AgentName)` names from `Agent(...)` or the legacy `Task(...)`,
+   * same unscoped-wins rule. Dropping them granted the whole subagent tool. */
+  agentRules?: string[]
+  /** Claude `Skill(name)` / `Skill(name *)` specifiers, same unscoped-wins rule. */
+  skillRules?: string[]
   /** Claude path rules per pi file tool, absent for a tool with an unscoped grant.
    * Edit scopes govern writes too, as Claude documents; Write scopes are honored
    * rather than Claude's accept-and-warn-then-ignore, which would fail open here. */
@@ -150,18 +138,32 @@ const PATH_RULE_TOOLS: Record<string, Array<PathRuleTool>> = {
   write: ['write'],
 }
 
+/** pi tools whose Claude specifier is a scalar argument scope rather than a path
+ * rule: `Bash(cmd)`, `WebFetch(domain:host)` and `Agent(AgentName)`. One list, so a
+ * tool cannot be granted a scope here and quietly miss the unscoped-wins rule. */
+const ARG_RULE_TOOLS = ['bash', 'web_fetch', 'subagent', 'slash_command'] as const
+type ArgRuleTool = (typeof ARG_RULE_TOOLS)[number]
+
+const isArgRuleTool = (name: string): name is ArgRuleTool => (ARG_RULE_TOOLS as readonly string[]).includes(name)
+
 /** The tools, scopes, and path rules accumulated while scanning one grant list. */
 interface GrantAccumulator {
   tools: string[]
   scopedEntries: string[]
-  bashRules: string[]
-  bashUnscoped: boolean
+  argScopes: Record<ArgRuleTool, string[]>
+  argUnscoped: Set<ArgRuleTool>
   pathScopes: Record<PathRuleTool, string[]>
   pathUnscoped: Set<PathRuleTool>
 }
 
 function createGrantAccumulator(): GrantAccumulator {
-  return { tools: [], scopedEntries: [], bashRules: [], bashUnscoped: false, pathScopes: { read: [], edit: [], write: [] }, pathUnscoped: new Set() }
+  return { tools: [], scopedEntries: [], argScopes: { bash: [], web_fetch: [], subagent: [], slash_command: [] }, argUnscoped: new Set(), pathScopes: { read: [], edit: [], write: [] }, pathUnscoped: new Set() }
+}
+
+/** The scopes for one argument-ruled tool, or undefined when it has none or when an
+ * unscoped grant for it makes it wide. The wider grant wins, as it does for bash. */
+function argRules(acc: GrantAccumulator, tool: ArgRuleTool): string[] | undefined {
+  return !acc.argUnscoped.has(tool) && acc.argScopes[tool].length > 0 ? acc.argScopes[tool] : undefined
 }
 
 /** Coerce a raw grant value to its string entries: a YAML list stays a list, a
@@ -186,7 +188,7 @@ function addGrantEntry(acc: GrantAccumulator, item: string): void {
   if (!acc.tools.includes(name)) acc.tools.push(name)
   const open = entry.indexOf('(')
   if (open === -1) {
-    if (name === 'bash') acc.bashUnscoped = true
+    if (isArgRuleTool(name)) acc.argUnscoped.add(name)
     for (const tool of PATH_RULE_TOOLS[name] ?? []) acc.pathUnscoped.add(tool)
     return
   }
@@ -195,7 +197,7 @@ function addGrantEntry(acc: GrantAccumulator, item: string): void {
   // An empty specifier (`Bash()`, `Read()`) matches nothing and must not read as
   // the unscoped grant it explicitly is not: it is recorded so the tool stays
   // restricted, and the matchers treat an empty rule as matching no input.
-  if (name === 'bash') acc.bashRules.push(scope)
+  if (isArgRuleTool(name)) acc.argScopes[name].push(scope)
   for (const tool of PATH_RULE_TOOLS[name] ?? []) acc.pathScopes[tool].push(scope)
 }
 
@@ -217,10 +219,14 @@ function buildPathRules(acc: GrantAccumulator): ToolGrants['pathRules'] {
  *
  * Claude scopes a grant to arguments: `Bash(git add:*)` allows exactly those commands.
  * pi's active-tool list is per tool, with no argument dimension, so the base tool is
- * granted and the scope is kept: commands.ts enforces bash scopes at tool_call time,
- * and the subagent's frontmatter parsing rejects a scoped grant it cannot express.
- * A scope on any other tool is dropped, which widens that grant; bash is the one
- * whose widening reaches everything, so it is the one enforced.
+ * granted and the scope is kept for commands.ts to enforce at tool_call time. Every
+ * specifier Claude documents for an allow rule is kept: `Bash(cmd)`, the Read/Edit
+ * path rules, `WebFetch(domain:host)` and `Agent(AgentName)`. The subagent's own
+ * frontmatter parsing still rejects a scoped grant outright, since it has no
+ * call-time seam to enforce one in.
+ *
+ * Claude's `Tool(param:value)` form is not among them: the permissions reference
+ * confines it to deny and ask rules, and `allowed-tools` is an allow surface.
  */
 export function parseToolGrants(raw: unknown): ToolGrants | undefined {
   const items = coerceGrantItems(raw)
@@ -230,7 +236,10 @@ export function parseToolGrants(raw: unknown): ToolGrants | undefined {
   return {
     tools: acc.tools,
     scopedEntries: acc.scopedEntries,
-    bashRules: !acc.bashUnscoped && acc.bashRules.length > 0 ? acc.bashRules : undefined,
+    bashRules: argRules(acc, 'bash'),
+    domainRules: argRules(acc, 'web_fetch'),
+    agentRules: argRules(acc, 'subagent'),
+    skillRules: argRules(acc, 'slash_command'),
     pathRules: buildPathRules(acc),
   }
 }
@@ -293,6 +302,9 @@ export function parseCommandFile(content: string): ParsedCommand {
     argumentHint: hint(frontmatter['argument-hint']) || undefined,
     allowedTools: grants?.tools,
     bashRules: grants?.bashRules,
+    domainRules: grants?.domainRules,
+    agentRules: grants?.agentRules,
+    skillRules: grants?.skillRules,
     pathRules: grants?.pathRules,
     argumentNames: parseArgumentNames(frontmatter.arguments),
     // A scope on a disallow entry only denies more than asked, so the drop is safe.

package/extensions/internal/mcp-oauth.ts

@@ -18,6 +18,7 @@ import * as path from 'node:path'
 import { getAgentDir } from '@earendil-works/pi-coding-agent'
 import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js'
 import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js'
+import { errorMessage } from './values.js'
 
 interface StoredAuth {
   client?: OAuthClientInformationMixed
@@ -71,6 +72,14 @@ function storeFileFor(serverName: string, endpoint?: string): string {
   return path.join(getAgentDir(), 'mcp-oauth', `${safe}-${digest}.json`)
 }
 
+/** MCP_OAUTH_CALLBACK_PORT parsed, or undefined when unset or not a plain integer. */
+function envCallbackPort(): number | undefined {
+  const raw = process.env.MCP_OAUTH_CALLBACK_PORT
+  if (raw === undefined || raw.trim() === '') return undefined
+  const parsed = Number(raw)
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : undefined
+}
+
 export class FileOAuthProvider implements OAuthClientProvider {
   private readonly storePath: string
   private readonly data: StoredAuth
@@ -105,10 +114,20 @@ export class FileOAuthProvider implements OAuthClientProvider {
     fs.writeFileSync(this.storePath, JSON.stringify(this.data), { mode: 0o600 })
   }
 
+  /** The configured callbackPort alone, absent when only a remembered port exists.
+   * The caller needs the two apart: a configured port is a hard requirement. Falls
+   * back to MCP_OAUTH_CALLBACK_PORT, Claude's "alternative to --callback-port when
+   * adding an MCP server with pre-configured credentials"; pi-code has no `mcp add`
+   * command, so the env var applies as a default for any server naming no port of
+   * its own rather than only ones added that way. */
+  configuredRedirectPort(): number | undefined {
+    return this.oauth?.callbackPort ?? envCallbackPort()
+  }
+
   /** The configured callbackPort (Claude: for pre-registered redirect URIs), else
    * the port a prior login registered, so a re-login can bind the same one. */
   savedRedirectPort(): number | undefined {
-    return this.oauth?.callbackPort ?? this.data.redirectPort
+    return this.oauth?.callbackPort ?? envCallbackPort() ?? this.data.redirectPort
   }
 
   /** Record the loopback port the callback server actually bound; the redirect
@@ -193,13 +212,19 @@ export class FileOAuthProvider implements OAuthClientProvider {
 /** A one-shot loopback listener for the authorization redirect. Loopback redirect
  * URIs are the RFC 8252 pattern for native apps. A preferred port (from a prior
  * login) is tried first so a re-login keeps the registered redirect_uri; if it is
- * taken, an ephemeral port is used. */
-export async function startCallbackServer(preferredPort?: number): Promise<{ server: http.Server; port: number }> {
+ * taken, an ephemeral port is used.
+ *
+ * `portRequired` marks the port as configured rather than remembered. A configured
+ * `oauth.callbackPort` names the redirect_uri the IdP has registered, so quietly
+ * binding a different one sends the user to an opaque redirect_uri mismatch at the
+ * IdP; the bind failure is reported here instead, where it can name the real cause. */
+export async function startCallbackServer(preferredPort?: number, portRequired = false): Promise<{ server: http.Server; port: number }> {
   const server = http.createServer()
   const listen = (port: number, host: string): Promise<void> => new Promise((resolve, reject) => server.listen(port, host, resolve).once('error', reject))
   try {
     await listen(preferredPort ?? 0, '127.0.0.1')
-  } catch {
+  } catch (error) {
+    if (portRequired) throw new Error(`oauth.callbackPort ${preferredPort} is in use, so the registered redirect URI cannot be served: free that port or change oauth.callbackPort (${errorMessage(error)})`)
     await listen(0, '127.0.0.1')
   }
   const port = (server.address() as { port: number }).port

package/extensions/internal/path-rules.ts

@@ -96,10 +96,29 @@ function bracketEnd(pattern: string, start: number): number {
 
 /** A bracket expression body as a regex character class, escaping regex-relevant
  * characters while keeping `-` ranges; a leading `!` (or `^`) negates. */
-function bracketClass(body: string): string {
+function bracketClass(body: string): string | null {
   const negated = body.startsWith('!') || body.startsWith('^')
   const members = (negated ? body.slice(1) : body).replace(/[\\\]^]/g, (ch) => `\\${ch}`)
-  return `[${negated ? '^' : ''}${members}]`
+  const source = `[${negated ? '^' : ''}${members}]`
+  // A range whose endpoints descend, `["- ]` for instance, is not a character class
+  // JavaScript will build: RegExp throws "Range out of order in character class". The
+  // `-` cannot simply be escaped, since `[a-z]` is the whole point of the syntax, so the
+  // class is validated by construction and an unbuildable one is treated exactly as an
+  // unterminated `[` already is: the pattern is invalid and matches nothing. Without
+  // this the throw escaped compileGlobs, which does not catch, and took the permission
+  // check that called it with it.
+  return isBuildableClass(source) ? source : null
+}
+
+/** Whether JavaScript will build this character class. Asking RegExp is the only
+ * faithful test: the invalid forms are its rules, not ones worth re-deriving here. */
+function isBuildableClass(source: string): boolean {
+  try {
+    new RegExp(source)
+    return true
+  } catch {
+    return false
+  }
 }
 
 /** A `*` run starting at `i`: a double star followed by a slash spans whole
@@ -114,39 +133,33 @@ function translateStar(pattern: string, i: number): { source: string; next: numb
   return { source: '[^/]*', next: i + 1 }
 }
 
+/** The regex source for the construct at `i` and the index after it, or null when the
+ * pattern is invalid there and so matches nothing. */
+function translateAt(pattern: string, i: number): { source: string; next: number } | null {
+  const ch = pattern[i]
+  // Claude: to match a literal bracket, escape it; the escape consumes both chars.
+  if (ch === '\\' && (pattern[i + 1] === '[' || pattern[i + 1] === ']')) return { source: escapeRegExp(pattern[i + 1]), next: i + 2 }
+  // Claude: `[` starts a bracket expression such as `[abc]`; a `[` that cannot be read
+  // as one, or a body that is not a buildable class, makes the pattern invalid.
+  if (ch === '[') {
+    const end = bracketEnd(pattern, i)
+    if (end === -1) return null
+    const cls = bracketClass(pattern.slice(i + 1, end))
+    return cls === null ? null : { source: cls, next: end + 1 }
+  }
+  if (ch === '*') return translateStar(pattern, i)
+  if (ch === '?') return { source: '[^/]', next: i + 1 }
+  return { source: escapeRegExp(ch), next: i + 1 }
+}
+
 function translateGlob(pattern: string): string | null {
   let out = ''
   let i = 0
   while (i < pattern.length) {
-    const ch = pattern[i]
-    // Claude: to match a literal bracket, escape it; the escape consumes both chars.
-    if (ch === '\\' && (pattern[i + 1] === '[' || pattern[i + 1] === ']')) {
-      out += escapeRegExp(pattern[i + 1])
-      i += 2
-      continue
-    }
-    // Claude: `[` starts a bracket expression such as `[abc]`; a `[` that cannot be
-    // read as one makes the pattern invalid, matching nothing.
-    if (ch === '[') {
-      const end = bracketEnd(pattern, i)
-      if (end === -1) return null
-      out += bracketClass(pattern.slice(i + 1, end))
-      i = end + 1
-      continue
-    }
-    if (ch === '*') {
-      const star = translateStar(pattern, i)
-      out += star.source
-      i = star.next
-      continue
-    }
-    if (ch === '?') {
-      out += '[^/]'
-      i += 1
-      continue
-    }
-    out += escapeRegExp(ch)
-    i += 1
+    const step = translateAt(pattern, i)
+    if (step === null) return null
+    out += step.source
+    i = step.next
   }
   return out
 }
@@ -243,6 +256,23 @@ const toPosix = (target: string): string => {
   return withSlashes.replace(/^\/?[A-Za-z]:\//, '/')
 }
 
+/**
+ * Drop a drive from a RESOLVED rule so it can meet a target that toPosix has already
+ * stripped. Claude documents `//path` as an absolute path from the filesystem root,
+ * and on Windows its own example names the drive as the first segment (`//c/` then a
+ * recursive glob), where `c` is the drive; that resolved to `/c/...` while every target
+ * resolved to `/...`, so the rule could never match anything.
+ *
+ * Windows only, and that is the whole point of the flag: on POSIX `/c/foo` is an
+ * ordinary absolute path and stripping its first segment would widen the rule to
+ * everything under the root. Exported and platform-parameterized rather than reading
+ * process.platform inline, so both branches are assertable from either host.
+ */
+export function stripRuleDrive(rule: string, windows: boolean): string {
+  if (!windows) return rule
+  return rule.replace(/^([A-Za-z]):\//, '/').replace(/^\/[A-Za-z]\//, '/')
+}
+
 export function matchesPathRules(filePath: string, rules: string[], anchors: PathAnchors): boolean {
   const target = toPosix(path.resolve(anchors.cwd, filePath))
   return rules.some((rule) => {
@@ -250,7 +280,7 @@ export function matchesPathRules(filePath: string, rules: string[], anchors: Pat
     // An empty specifier (`Read()`) matches nothing, so the tool stays blocked
     // rather than falling open, mirroring `Bash()`.
     if (trimmed === '') return false
-    const resolved = toPosix(resolveRule(trimmed, anchors))
+    const resolved = stripRuleDrive(toPosix(resolveRule(trimmed, anchors)), path.sep === '\\')
     return new RegExp(`^${globToRegExpSource(resolved)}$`).test(target)
   })
 }

package/extensions/internal/plugins.ts

@@ -215,6 +215,17 @@ export function installedPlugins(home: string, extraSettingsFiles: string[] = []
   return plugins
 }
 
+/** The plugins a managed `enabledPlugins` entry force-enables. Claude exempts their
+ * hooks from `allowManagedHooksOnly`: an administrator who turned a plugin on meant its
+ * hooks to run. Keys are matched the way pluginEnabled matches them, by the qualified
+ * `name@marketplace` or the bare directory name, so the two cannot drift apart. */
+export function managedForceEnabled(plugins: InstalledPlugin[]): InstalledPlugin[] {
+  const managedEntry = readManagedSettings().enabledPlugins
+  if (managedEntry === null || typeof managedEntry !== 'object') return []
+  const entries = managedEntry as Record<string, unknown>
+  return plugins.filter((plugin) => Object.entries(entries).some(([key, value]) => value === true && (key === plugin.name || key.startsWith(`${plugin.name}@`))))
+}
+
 /** The plugin's effective enablement per Claude's precedence: a managed
  * enabledPlugins entry force-enables or blocks, then the user's setting, then the
  * manifest's defaultEnabled, which defaults to true ("starts in an enabled state

package/extensions/internal/scope-rules.ts

@@ -0,0 +1,117 @@
+/**
+ * Claude's argument scopes for the two tools whose specifier is neither a bash
+ * command nor a file path: `WebFetch(domain:host)` and `Agent(AgentName)`.
+ *
+ * pi's active-tool set has no argument dimension, so commands.ts grants the base
+ * tool and checks each call here, the way it already does for `Bash(...)` scopes.
+ * Both matchers fail closed: a scope this module cannot interpret matches nothing
+ * rather than reading as the unscoped grant the author did not write.
+ *
+ * Claude's parameter form `Tool(param:value)` is deliberately absent. The
+ * permissions reference restricts it to deny and ask rules ("An allow rule for one
+ * parameter value wouldn't establish that the call is safe overall, so allow rules
+ * continue to use each tool's own specifier syntax"), and every scope reaching this
+ * module comes from an allow surface: a command's `allowed-tools`.
+ */
+
+/** Regex specials except `*`, which carries the rule's own wildcard meaning. */
+const escapeExceptStar = (text: string): string => text.replaceAll(/[.+?^${}()|[\]\\]/g, String.raw`\$&`)
+
+/** A hostname pattern segment: `*` matches any text that does not cross a dot. */
+const hostPattern = (pattern: string): string => escapeExceptStar(pattern).replaceAll('*', '[^.]*')
+
+/** Lowercased, with the trailing `.` the reference strips from both sides removed. */
+const canonicalHost = (host: string): string => host.trim().toLowerCase().replace(/\.$/, '')
+
+/** The hostname of a fetch target, or '' when the url does not parse. */
+function hostnameOf(url: string): string {
+  try {
+    return canonicalHost(new URL(url).hostname)
+  } catch {
+    return ''
+  }
+}
+
+/** The host pattern of one `domain:` scope, or undefined for any other spelling.
+ * WebFetch has exactly one documented specifier syntax, so an unrecognized scope is
+ * not a wider grant, it is a rule that matches nothing. */
+function domainPattern(rule: string): string | undefined {
+  const trimmed = rule.trim()
+  const colon = trimmed.indexOf(':')
+  if (colon === -1 || trimmed.slice(0, colon).trim().toLowerCase() !== 'domain') return undefined
+  const pattern = canonicalHost(trimmed.slice(colon + 1))
+  return pattern === '' ? undefined : pattern
+}
+
+function matchesDomainRule(host: string, rule: string): boolean {
+  const pattern = domainPattern(rule)
+  if (pattern === undefined) return false
+  if (pattern === '*') return true
+  // A leading `*.` is the one wildcard that crosses dots: it stands for one or more
+  // whole labels, so it covers `a.b.example.com` while leaving the apex unmatched.
+  if (pattern.startsWith('*.')) return new RegExp(String.raw`^(?:[^.]+\.)+${hostPattern(pattern.slice(2))}$`).test(host)
+  return new RegExp(`^${hostPattern(pattern)}$`).test(host)
+}
+
+/**
+ * Claude: "WebFetch rules use a `domain:` prefix and match against the hostname of
+ * the requested URL. Matching is case-insensitive, supports `*` wildcards, and strips
+ * a trailing `.` from both the rule and the hostname."
+ */
+export function matchesDomainRules(url: string, rules: string[]): boolean {
+  const host = hostnameOf(url)
+  if (host === '') return false
+  return rules.some((rule) => matchesDomainRule(host, rule))
+}
+
+/**
+ * Claude: "Permission syntax: `Skill(name)` for exact match, `Skill(name *)` for
+ * prefix match with any arguments."
+ *
+ * The invocation is the skill name and its arguments as one string, the shape pi's
+ * `slash_command` tool takes; a leading `/` is optional there, so it is stripped
+ * before matching. Only the two documented forms are interpreted. A rule spelled any
+ * other way, `commit:*` included, matches nothing rather than widening the grant.
+ */
+export function matchesSkillRules(invocation: string, rules: string[]): boolean {
+  const call = invocation.trim().replace(/^\//, '').trim()
+  if (call === '') return false
+  return rules.some((raw) => {
+    const rule = raw.trim()
+    if (rule === '') return false
+    if (!rule.endsWith(' *')) return rule === call
+    // The space before the trailing `*` is part of the rule, so `review-pr *` covers
+    // `review-pr` and `review-pr 123` but never the longer name `review-pretend`.
+    const prefix = rule.slice(0, -2).trimEnd()
+    return prefix !== '' && (call === prefix || call.startsWith(`${prefix} `))
+  })
+}
+
+/** The `agent` of one call or task entry, when it has one. */
+const agentNameOf = (value: unknown): string | undefined => {
+  const record = value !== null && typeof value === 'object' ? (value as Record<string, unknown>) : undefined
+  return typeof record?.agent === 'string' ? record.agent : undefined
+}
+
+/** Every agent name one subagent call names, across all three modes: `agent` for
+ * single, and the `agent` of each entry in `tasks` (parallel) or `chain` (sequential).
+ * One collector, so a rule checked against single mode cannot be quietly skipped for
+ * the two modes that carry their names in an array. */
+export function agentNamesIn(input: unknown): string[] {
+  const raw = input !== null && typeof input === 'object' ? (input as Record<string, unknown>) : {}
+  const listed = ['tasks', 'chain'].flatMap((key) => (Array.isArray(raw[key]) ? (raw[key] as unknown[]) : []))
+  return [input, ...listed].map(agentNameOf).filter((name): name is string => name !== undefined)
+}
+
+/**
+ * Claude: "Use `Agent(AgentName)` rules to control which subagents Claude can use."
+ *
+ * Every agent the call names must match, not just the first. A subagent call carries
+ * names in `agent`, `tasks[].agent` and `chain[].agent`; gating one field would let
+ * parallel or chain mode route around the rule. A call naming no agent cannot be
+ * checked against the scope, so it fails closed too.
+ */
+export function matchesAgentRules(names: string[], rules: string[]): boolean {
+  if (names.length === 0) return false
+  return names.every((name) => rules.some((rule) => rule.trim() !== '' && rule.trim() === name.trim()))
+}

package/extensions/internal/shell-resolve.ts

@@ -37,11 +37,22 @@ const isFile = (file: string): boolean => {
  * Windows spellings on win32, where powershell.exe ships with the OS. */
 const powershellCandidates = (platform: string): string[] => (platform === 'win32' ? ['pwsh', 'pwsh.exe', 'powershell.exe'] : ['pwsh'])
 
-/** First PowerShell binary found on PATH, or undefined when none is installed. */
-export function resolvePowershellBinary(platform: string = process.platform, env: Record<string, string | undefined> = process.env): string | undefined {
-  const dirs = (env.PATH ?? '').split(path.delimiter).filter(Boolean)
+/** First PowerShell binary found on PATH, or undefined when none is installed.
+ *
+ * A PATH entry that is the launch directory, or project tooling below it, is skipped
+ * for the same reason resolveGitBash skips one: a repository that ships `pwsh.exe`
+ * must not become the shell its own hooks and spans run through. Go made this the
+ * default in 1.19 (`os/exec` refuses a program resolved "relative to the current
+ * directory", returning ErrDot), and Windows offers NoDefaultCurrentDirectoryInExePath
+ * for it; node honors neither (nodejs/node#46264), so the check belongs here. */
+export function resolvePowershellBinary(platform: string = process.platform, env: Record<string, string | undefined> = process.env, cwd: string = process.cwd()): string | undefined {
+  // `env.Path` as well as `env.PATH`, matching resolveGitBash: process.env is
+  // case-insensitive on Windows, but an env object handed in by a caller or a test is
+  // whatever spelling it was built with, and the two resolvers must read it alike.
+  const dirs = (env.PATH ?? env.Path ?? '').split(path.delimiter).filter(Boolean)
   for (const candidate of powershellCandidates(platform)) {
     for (const dir of dirs) {
+      if (isProjectTooling(dir, cwd)) continue
       const full = path.join(dir, candidate)
       try {
         fs.accessSync(full, fs.constants.X_OK)
@@ -111,11 +122,11 @@ const powershellShell = (file: string): ResolvedShell => ({
  */
 export function resolveShell(preferred: string | undefined, platform: string = process.platform, env: Record<string, string | undefined> = process.env, cwd: string = process.cwd(), installRoots?: string[]): ResolvedShell | undefined {
   if (preferred === 'powershell') {
-    const powershell = resolvePowershellBinary(platform, env)
+    const powershell = resolvePowershellBinary(platform, env, cwd)
     if (powershell) return powershellShell(powershell)
   }
   const bash = bashBinary(platform, env, cwd, installRoots)
   if (bash) return bashShell(bash)
-  const powershell = resolvePowershellBinary(platform, env)
+  const powershell = resolvePowershellBinary(platform, env, cwd)
   return powershell ? powershellShell(powershell) : undefined
 }

package/extensions/internal/web-transport.ts

@@ -52,6 +52,13 @@ export function httpFetch(url: URL, opts: TransportOptions): Promise<Response> {
           // (204/205/304) and for status 0. That throw fires here, off the Promise
           // executor, so without this guard it escapes as an uncaughtException and pi
           // exits. Give those statuses a null body; reject anything else that throws.
+          //
+          // The catch below has no test and cannot get one through this function: the
+          // only two throw sources are the null-body statuses, which the line under this
+          // comment handles, and a status outside 200-599, which never reaches this
+          // callback at all (node routes 1xx to the `information` event and rejects a
+          // malformed status line in the parser). It stays as depth, not dead code, but
+          // do not chase its coverage with a test that reaches it some other way.
           const body = NULL_BODY_STATUSES.has(status) ? null : (Readable.toWeb(res) as ReadableStream<Uint8Array>)
           resolve(new Response(body, { status, headers }))
         } catch (err) {

package/extensions/mcp/config.ts

@@ -27,6 +27,8 @@ export interface StdioServerConfig {
   baseName?: string
   /** Root of the plugin that supplied this server; exported as CLAUDE_PLUGIN_ROOT. */
   pluginRoot?: string
+  /** ${CLAUDE_PLUGIN_DATA} for a plugin's server, exported alongside the root. */
+  pluginDataDir?: string
   /** Loaded from the project scope, whose helpers run credential-stripped. */
   projectScope?: boolean
 }
@@ -52,6 +54,8 @@ export interface HttpServerConfig {
   baseName?: string
   /** Root of the plugin that supplied this server; exported as CLAUDE_PLUGIN_ROOT. */
   pluginRoot?: string
+  /** ${CLAUDE_PLUGIN_DATA} for a plugin's server, exported alongside the root. */
+  pluginDataDir?: string
   /** Loaded from the project scope, whose helpers run credential-stripped. */
   projectScope?: boolean
 }
@@ -225,7 +229,7 @@ export function loadPluginServers(plugins: InstalledPlugin[], projectDir?: strin
       // plugin:<plugin-name>:<server-name>", which is what an mcp_tool hook names and what
       // keeps a same-named user server from replacing a plugin's. The tool alias keeps its
       // own flat spelling, mcp__plugin_<plugin>_<server>__<tool>.
-      if (substituted) servers[`plugin:${plugin.name}:${name}`] = { ...substituted, aliasPrefix: `mcp__plugin_${fold(plugin.name)}_${fold(name)}__`, baseName: name, pluginRoot: plugin.root }
+      if (substituted) servers[`plugin:${plugin.name}:${name}`] = { ...substituted, aliasPrefix: `mcp__plugin_${fold(plugin.name)}_${fold(name)}__`, baseName: name, pluginRoot: plugin.root, pluginDataDir: plugin.dataDir }
     }
   }
   return servers