Filter untrusted agent frontmatter

Author: SqlRush

docs/cc-100-roadmap.md

@@ -191,7 +191,7 @@ M8 补充：新增基础 slash command parser/executor，按官方 `/command arg
 
 M8 补充：本地 prompt skill 的 slash 调用和 `Skill` tool 现在都会生成 `command_permissions` attachment，按官方 `allowed-tools` 解析 comma/space 分隔且保留括号内模式；conversation runner 会在当前 turn 内把这些 `PermissionSourceCommand` allow rules 合并进 engine permission decider，让 skill frontmatter 授权的后续工具调用可在同一轮放行，并继续保留 model override attachment metadata。完整权限 UI 展示、SDK event surface、forked/MCP/plugin/bundled skill 权限继承仍未完成。
 
-M8 补充：skill frontmatter 标量兼容继续补齐，`allowed_tools`/`argument_hint`/`disable_model_invocation`/`user_invocable`/`when-to-use` 等相邻字段会映射到 canonical command metadata；`model: inherit` 不再误触发模型覆盖，`context: fork`、`agent`、`effort` 会保留在 command contract 中，为后续 forked skill/agent 执行接线提供 metadata。
+M8 补充：skill frontmatter 标量兼容继续补齐，`allowed_tools`/`argument_hint`/`disable_model_invocation`/`user_invocable`/`when-to-use` 等相邻字段会映射到 canonical command metadata；`model: inherit` 不再误触发模型覆盖，`context: fork`、`agent`、`effort` 会保留在 command contract 中，为后续 forked skill/agent 执行接线提供 metadata；当 policy 锁定 `agents` surface 时，非可信来源 prompt command 的这些 agent metadata 会在 registry 层清除，plugin/bundled/admin 来源保留。
 
 M8 补充：project legacy `.claude/commands/**/*.md` 和 user legacy `${CLAUDE_CONFIG_DIR}/commands/**/*.md` 现在会加载为 `commands_DEPRECATED` prompt command，并支持目录式 `SKILL.md` 命名空间（例如 `team/deploy/SKILL.md` -> `team:deploy`）、普通 markdown 命名空间、frontmatter metadata、SkillTool 可见性过滤和 prompt expansion；目录式 legacy command 会保留 base directory 前缀和 `${CLAUDE_SKILL_DIR}` 替换，并把对应 skill root 纳入工具内部只读 allowlist。完整 managed/remote commands、plugin command shell expansion、local/local-jsx 执行仍未完成。
 
@@ -1436,7 +1436,7 @@ M7 补充：terminal input parser 和 configurable keybinding name parser 现在
 - plugin manifest、marketplace、install/cache/update。
 - plugin hooks/agents/MCP，其中本地 plugin 同步工具 hook 已接入，剩余完整 plugin agent/MCP 与 hook UI/policy parity。
 
-当前状态：已完成项目 skill discovery、目录式 `SKILL.md` prompt metadata loading、project legacy `.claude/commands` prompt command loading、command registry metadata/lookup/filter、部分内置 slash command aliases/metadata、prompt expansion、基础 `Skill` tool inline 调用、本地项目 prompt skill 的基础 slash 调用接入、本地 prompt skill 的 command permissions attachment/current-turn 权限继承，本地 plugin command/skill/agent/MCP server/output style/hook 的 manifest discovery，本地 plugin 同步工具 hook 执行，headless `/help`/`/skills` 列表与单项详情，output style 系统提示注入，以及 `/clear` 基础 local command no-query 路径；仍缺 bundled/MCP/remote skills、forked skill/agent 执行、完整 local/local-jsx 实际执行、TUI `/help`/`/skills` 面板、权限 UI/SDK 展示、plugin marketplace/cache/update、skill prompt shell injection 和完整 agents/MCP/output-style UI 接线。
+当前状态：已完成项目 skill discovery、目录式 `SKILL.md` prompt metadata loading、project legacy `.claude/commands` prompt command loading、command registry metadata/lookup/filter、agent-metadata strict plugin-only policy filtering、部分内置 slash command aliases/metadata、prompt expansion、基础 `Skill` tool inline 调用、本地项目 prompt skill 的基础 slash 调用接入、本地 prompt skill 的 command permissions attachment/current-turn 权限继承，本地 plugin command/skill/agent/MCP server/output style/hook 的 manifest discovery，本地 plugin 同步工具 hook 执行，headless `/help`/`/skills` 列表与单项详情，output style 系统提示注入，以及 `/clear` 基础 local command no-query 路径；仍缺 bundled/MCP/remote skills、forked skill/agent 执行、完整 local/local-jsx 实际执行、TUI `/help`/`/skills` 面板、权限 UI/SDK 展示、plugin marketplace/cache/update、skill prompt shell injection 和完整 agents/MCP/output-style UI 接线。
 
 ### M9: MCP Platform
 

docs/claude-code-go-rewrite-plan.md

@@ -140,7 +140,7 @@ test/parity/                 # golden tests against TS/official behavior
 - 本轮补充：`/cost` 本地命令现在会在 runner 带有 `SessionPath` 时从当前 session transcript 回填历史 usage，并按 message UUID/ID 与内存 history 去重，避免 resume 或新进程场景丢失/重复计算历史 cost。
 - 本轮补充：Anthropic CLI/env client 初始化现在支持 `ANTHROPIC_CUSTOM_HEADERS` 和 `CLAUDE_CODE_CUSTOM_HEADERS`，可用 JSON object 或 `Header: value`/`Header=value` 行格式注入 gateway/proxy 静态请求头；配置错误会在初始化阶段报错，避免静默遗漏代理必需 header。
 - 本轮补充：settings loader 现在会按官方优先级读取 managed policy：macOS MDM plist / Windows HKLM 优先，其次平台 managed file `managed-settings.json` 与 `managed-settings.d/*.json` drop-ins，最后 Windows HKCU；policy settings 已纳入 runner merged settings、headless model/fastMode 解析、permission engine policy source、MCP policy 和 `/config` 可见文件列表；`allowManagedPermissionRulesOnly` 会剥离非 policy permission rules。
-- 本轮补充：`strictPluginOnlyCustomization` 已开始按 policy settings 生效，当前覆盖已实现的 `skills`、`mcp` 和 `hooks` surfaces：锁定后 user/project/local skills 与 legacy commands 不加载，manual MCP server sources 不加载但 plugin/admin policy 仍保留，settings hooks 只保留 policy hooks 且 plugin hooks 继续运行。agents 与更深 frontmatter/runtime edge cases 仍按缺口追踪。
+- 本轮补充：`strictPluginOnlyCustomization` 已开始按 policy settings 生效，当前覆盖已实现的 `skills`、`mcp`、`hooks` 和 agent-metadata surfaces：锁定后 user/project/local skills 与 legacy commands 不加载，manual MCP server sources 不加载但 plugin/admin policy 仍保留，settings hooks 只保留 policy hooks 且 plugin hooks 继续运行；`agents` 锁定时非 plugin/bundled/admin prompt command 的 `agent`、`context: fork` 和 `effort` frontmatter metadata 会被清除。完整 forked agent runtime/UI edge cases 仍按缺口追踪。
 - 本轮补充：settings 文件读取现在有 path-keyed cache，按 size/mode/mtime 指纹复用内容并提供 `ResetSettingsCache`；新增 settings change detector，可对 settings 文件快照区分 created/modified/deleted，并在检测到变化时清空 settings 文件缓存。完整 watcher、remote managed refresh 和 app-state 同步仍按缺口追踪。
 - 本轮补充：新增 settings JSON Schema generation，`SettingsJSONSchema()` 会从 `contracts.Settings` 反射生成 draft 2020-12 schema，补强 `$schema` const、permission mode enum、`strictPluginOnlyCustomization` union 和 login method enum；`/config show schema` 现在可展示 schema ID、draft、字段数和生成大小，完整 Zod message parity 仍按缺口追踪。
 - 本轮补充：settings validation 现在覆盖官方 marketplace source union 的基础语义，适用于 `extraKnownMarketplaces[].source`、`strictKnownMarketplaces[]` 和 `blockedMarketplaces[]`：校验 source discriminator、各 source 类型必填字段、URL source 绝对 URL、headers string record、github/git sparsePaths string array、settings-source plugins array、settings-source name 安全/保留名，并继续覆盖 inline marketplace key/name 一致性。运行时 marketplace source allow/block enforcement 仍按缺口追踪。
@@ -292,7 +292,7 @@ test/parity/                 # golden tests against TS/official behavior
 - 本轮补充：新增基础 `Skill` tool wrapper 并注册到默认内置工具集，可调用本地项目 prompt skill、兼容官方 `skill`/`args` 与相邻别名，并把 prompt expansion 产生的 meta user message 通过 `ToolResult.NewMessages` 交给 conversation runner；runner 现在会把这些新消息写入 transcript 并追加到下一轮模型请求。forked/remote/MCP/plugin skills、shell injection、slash/local command UI wiring 仍未宣称完成。
 - 本轮补充：新增基础 slash command parser/executor，支持官方 `/command args` 和 `/mcp:tool (MCP) args` 解析；conversation runner 现在会在请求模型前展开本地项目 prompt skill slash command，生成 command metadata user message 和 meta prompt message，保留 transcript parent chain，并支持 skill `model` 覆盖本轮请求。local/local-jsx 目前只返回未实现输出且不会误发模型，command permissions attachment、forked/MCP/plugin/bundled slash command 和 UI wiring 仍未宣称完成。
 - 本轮补充：本地 prompt skill slash command 和 `Skill` tool 现在都会生成 `command_permissions` attachment，解析 `allowed-tools` 的 comma/space 分隔形式并保留括号内 tool pattern；Runner 会在当前 turn 内把 attachment 转成 `PermissionSourceCommand` allow rules 合并进 engine permission decider，让 skill 授权的后续工具调用可在同一轮通过。完整权限 UI/SDK 展示、forked/MCP/plugin/bundled skill 权限继承仍未宣称完成。
-- 本轮补充：skill frontmatter 标量兼容继续补齐，`allowed_tools`/`argument_hint`/`disable_model_invocation`/`user_invocable`/`when-to-use` 等相邻字段会映射到 canonical command metadata；`model: inherit` 不再误触发模型覆盖，`context: fork`、`agent`、`effort` 会保留在 command contract 中，为后续 forked skill/agent 执行接线提供 metadata。
+- 本轮补充：skill frontmatter 标量兼容继续补齐，`allowed_tools`/`argument_hint`/`disable_model_invocation`/`user_invocable`/`when-to-use` 等相邻字段会映射到 canonical command metadata；`model: inherit` 不再误触发模型覆盖，`context: fork`、`agent`、`effort` 会保留在 command contract 中，为后续 forked skill/agent 执行接线提供 metadata；当 policy 锁定 `agents` surface 时，非可信来源 prompt command 的这些 agent metadata 会在 registry 层清除，plugin/bundled/admin 来源保留。
 - 本轮补充：project legacy `.claude/commands/**/*.md` 现在会加载为 `commands_DEPRECATED` prompt command，覆盖普通 markdown 命名空间、目录式 `SKILL.md` 命名空间、frontmatter metadata、SkillTool 可见性过滤和 prompt expansion；目录式 legacy command 保留 base directory 前缀和 `${CLAUDE_SKILL_DIR}` 替换。完整 user/managed commands、plugin commands、local/local-jsx 执行仍未宣称完成。
 - 本轮补充：现有 Go 内置 slash command metadata 继续贴近官方源快照，补齐 `config`/`resume`/`clear` 的 aliases（`settings`、`continue`、`reset`、`new`），以及 `mcp`/`resume`/`model` 的 argument hint、`mcp`/`status`/`model` 的 immediate 标记和部分官方描述；大量内置 command 的真实 local/local-jsx UI 执行仍未宣称完成。
 - 本轮补充：slash command 现在有基础 local command result 抽象，`/clear` 不再落入 unsupported 分支，会生成 local text result、保留 command metadata message，并且不会请求模型；完整 REPL conversation reset、local command text/compact/skip 全语义、`/cost`/`/status`/`/compact` 和 local-jsx UI 执行仍未宣称完成。

docs/first-second-parity-audit.md

@@ -89,7 +89,7 @@ Anthropic API 和 conversation：
 - A basic `Skill` tool wrapper is now registered with the default built-in tool set. It can invoke local project prompt skills through the command registry, returns the official-style `Launching skill: ...` result plus structured command metadata, and passes expanded meta user messages through `ToolResult.NewMessages`; the conversation runner now appends those new messages to transcripts and subsequent model requests.
 - Basic slash prompt command invocation is now wired for local project prompt skills: `/skill args` is parsed before the model request, converted into official-shaped command metadata plus expanded meta prompt messages, appended to transcript parent chains, and can override the turn model from skill frontmatter.
 - Local prompt-skill slash commands and the `Skill` tool now emit `command_permissions` attachments, parse `allowed-tools` into command-scoped permission rules, and merge those rules into the engine permission decider for the current turn so authorized follow-up tool calls can pass without leaking into later turns.
-- Settings schema coverage was expanded for major Claude Code settings keys: auth helpers, model allowlists/overrides, MCP policy, hooks policy, worktree, shell, output style, language, thinking/effort, plugins, remote, spinner, sandbox, and related flags. Settings parsing now also coerces `env` values to strings, filters invalid permission rules into warnings, validates key permission fields, applies WebSearch/WebFetch-specific permission-rule validation, validates marketplace source union basics across `extraKnownMarketplaces`, `strictKnownMarketplaces`, and `blockedMarketplaces` including settings-source map key/source name consistency, loads managed policy from macOS MDM plist / Windows HKLM, platform `managed-settings.json`, sorted `managed-settings.d/*.json` drop-ins, and Windows HKCU fallback, honors `allowManagedPermissionRulesOnly` for permission-rule merging, enforces `strictPluginOnlyCustomization` for the implemented `skills`, `mcp`, and `hooks` surfaces so user/project/local customizations are skipped while plugin/admin sources remain, includes a path-keyed settings file cache plus a snapshot-based settings change detector that classifies created/modified/deleted settings files and resets cached reads on change, and now generates a JSON Schema from `contracts.Settings` with `/config show schema` summary visibility.
+- Settings schema coverage was expanded for major Claude Code settings keys: auth helpers, model allowlists/overrides, MCP policy, hooks policy, worktree, shell, output style, language, thinking/effort, plugins, remote, spinner, sandbox, and related flags. Settings parsing now also coerces `env` values to strings, filters invalid permission rules into warnings, validates key permission fields, applies WebSearch/WebFetch-specific permission-rule validation, validates marketplace source union basics across `extraKnownMarketplaces`, `strictKnownMarketplaces`, and `blockedMarketplaces` including settings-source map key/source name consistency, loads managed policy from macOS MDM plist / Windows HKLM, platform `managed-settings.json`, sorted `managed-settings.d/*.json` drop-ins, and Windows HKCU fallback, honors `allowManagedPermissionRulesOnly` for permission-rule merging, enforces `strictPluginOnlyCustomization` for the implemented `skills`, `mcp`, and `hooks` surfaces so user/project/local customizations are skipped while plugin/admin sources remain, strips untrusted prompt-command `agent`/`context: fork`/`effort` metadata when the `agents` surface is policy-locked while preserving plugin/bundled/admin sources, includes a path-keyed settings file cache plus a snapshot-based settings change detector that classifies created/modified/deleted settings files and resets cached reads on change, and now generates a JSON Schema from `contracts.Settings` with `/config show schema` summary visibility.
 - Model registry now uses current Claude model IDs and aliases from the source snapshot, including Sonnet 4.6, Opus 4.6, Haiku 4.5, canonical-name rendering, and `[1m]` context variants.
 - OAuth support now includes production OAuth config, scope parsing, Claude.ai scope detection, auth URL construction, PKCE verifier/challenge, state generation, and expiry checks.
 - Session/history support now includes CC-compatible prompt history references, pasted text/image placeholder parsing, paste-cache hashing and retrieval, `history.jsonl` append/load, current-session-first up-arrow ordering, ctrl+r-style deduped timestamped history, `CLAUDE_CODE_SKIP_PROMPT_HISTORY`, remote session event pagination helpers, lenient transcript loading, legacy progress parent-bridge recovery, compact-boundary pruning, snip removal/relink replay, metadata entry collection, leaf UUID calculation, conversation-chain reconstruction, orphaned parallel tool-result recovery, content-replacement record loading/reconstruction, tombstone metadata delete/relink replay, and tombstone-style transcript message removal with a size guard.
@@ -108,7 +108,7 @@ The following items remain incomplete and must not be treated as done:
 - Full tool execution parity gaps that remain: complete hook runtime policy beyond the current settings command hook path, MCP elicitation, complete SDK control event surface beyond current progress NDJSON, mid-call cancellation for concrete tools, background task behavior, telemetry, schema-not-sent hints, and concrete tool-specific semantics.
 - Complete Anthropic API parity gaps that remain: dynamic beta-header latching for any remaining provider-specific feature gates beyond prompt-cache/cache-editing/strict-output/1M-context requests, ant-only dump gating and remote `/issue` submission integration beyond the current local context summary, full official cost tracker/session restore lifecycle beyond current transcript usage restore, post-handshake streaming failure semantics, deeper gateway/proxy auth and routing behavior beyond static custom headers, first-party/Bedrock/Vertex/Foundry client setup, deeper OAuth account/profile lifecycle beyond request-time refresh retry, fast-mode retry/cooldown semantics, persistent unattended retry heartbeats, full prompt-cache editing lifecycle, and provider-specific cache behavior.
 - Full conversation/query loop: stop hooks, compact/auto-compact, token budget escalation, resume, SDK JSON/NDJSON control events, status updates, rate-limit handling, model switch breadcrumbs, side questions.
-- Full settings parity gaps that remain: complete Zod-equivalent validation messages, remote managed-settings loading and refresh, remaining plugin-only customization enforcement for agents and deeper frontmatter/runtime edge cases, runtime marketplace source allow/block enforcement through marketplace install/load flows, and full live reload/app-state sync.
+- Full settings parity gaps that remain: complete Zod-equivalent validation messages, remote managed-settings loading and refresh, remaining forked agent/frontmatter execution and UI edge cases beyond current policy metadata filtering, runtime marketplace source allow/block enforcement through marketplace install/load flows, and full live reload/app-state sync.
 - Full session/history parity gaps that remain: large-file optimized transcript loading, preserved-segment edge cases beyond current relink/prune support, content-replacement feature-flag/runtime override and inherited subagent gap-fill details, complete async prompt-history lifecycle parity beyond current lock/buffer/undo paths, full pasted-image processing/runtime integration beyond current prompt image-cache/image-block/metadata path, remaining remote-history edge cases, sidechain/subagent transcript layout, and all session metadata entry types.
 
 ## Current Verification