fix: finish plugin consent and configured MCP reconnect

Persist explicit plugin suggestion dismissals and explain matched triggers.
Use keyboard/mouse confirmation controls with the existing content-bound
trust and automation-delete tokens. Reconnect an authenticated configured MCP
server by exact name without replacing credentials or restarting siblings.
Preserve native Windows paths during deny-policy expansion. Repair changed
composer fixtures, isolate the retry-policy mock from loopback timing, and
allow the lifecycle mock to settle under loaded CI. Sync 0.9.13 release notes.

Validation on staged tree 596772e:
- npm test: 521 passed, 0 failed (66 wrapper + 9 SDK + 446 web).
- npm run check:web: passed; cargo fmt --all --check: passed.
- Prior full Rust run: 15,398 passed, 2 timing failures, 21 skipped.
  Those two fixture repairs are included here; the full rerun and hosted CI
  are pending. MCP reconnect and all confirmation acceptance tests passed
  in the prior run. Four unchanged lifecycle repetitions passed separately.
No release or final installed-artifact qualification is claimed.

Author: CodeWhale Bot

CHANGELOG.md

@@ -7,7 +7,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.9.13] - 2026-09-11
+## [0.9.13] - 2026-09-12
 
 Codewhale v0.9.13 addresses integrity issues in 0.9.12:
 multiline paste is one paste again, truncated tool arguments can no longer execute, strict
@@ -26,9 +26,28 @@ reconnect.
   cannot resurrect the broken binding (#6102).
 - Permission checks distinguish literal heredoc data from executable commands,
   including substitutions and shell stdin (#6098).
-- Compaction durably saves original history and the model-written handoff before
-  replacing context; pressure metadata shows estimated tokens and the actual
-  configured trigger (#5620). Session artifact publication uses confined handles.
+- Automatic compaction runs quietly from live context pressure, preserving the
+  current task and recent tool exchanges while keeping the system/tool prefix
+  stable. Original history and the handoff are saved before context replacement;
+  failed or canceled compaction retains the conversation (#5620, #6047).
+- Custom and gateway providers can override context limits for each exact model,
+  so switching models also switches the meter and compaction budget (#6108).
+- Plugin suggestions explain their matching term and remember explicit dismissals
+  across restarts. Generic words and repository-host domains no longer trigger
+  unrelated installation prompts (#6031).
+- Plugin trust and automation deletion have keyboard and mouse confirmation
+  controls bound to the exact reviewed content; users can still copy the command
+  and changed content requires a fresh review (#6039).
+- The model-facing MCP start tool can reconnect an existing configured name after
+  login without changing its credential key or restarting healthy siblings (#6030).
+- Missed automation occurrences coalesce without overlapping a running job;
+  restart reconciles durable receipts without replaying accepted work. Damaged
+  neighboring records are isolated while preserving their original bytes.
+- The bundled first-party marketplace lists the actual plugin bundles and uses
+  the existing install, review, trust and update paths. A read-only connection
+  check verifies catalog and skill mirrors on changes and weekly.
+- Windows deny checks preserve native path separators while retaining the
+  conservative POSIX scan for shell wrappers and substitutions.
 - The config example agrees with the telemetry disclosure: usage analytics are
   optional and enabled by default; local diagnostics do not require telemetry (#6011).
 

crates/execpolicy/src/shell_expand.rs

@@ -56,18 +56,32 @@ const SHELL_NAMES: &[&str] = &[
 ///
 /// Results contain word-split commands, substitutions and wrapper payloads.
 /// Literal data, including quoted heredoc bodies, is not treated as code.
+/// Windows scans retain native path separators as well as POSIX candidates.
 pub fn expanded_commands(command: &str) -> Vec<String> {
+    expanded_commands_for_platform(command, cfg!(windows))
+}
+
+fn expanded_commands_for_platform(command: &str, windows: bool) -> Vec<String> {
     let mut expander = Expander {
         out: Vec::new(),
         seen: HashSet::new(),
+        literal_backslashes: windows,
     };
+    // Native Windows shells preserve path separators. Also retain the POSIX
+    // interpretation for Bash/WSL commands. Both passes use the same bounded,
+    // heredoc-aware parser and only contribute deny targets, never grants.
     expander.expand(command, 0);
+    if windows {
+        expander.literal_backslashes = false;
+        expander.expand(command, 0);
+    }
     expander.out
 }
 
 struct Expander {
     out: Vec<String>,
     seen: HashSet<String>,
+    literal_backslashes: bool,
 }
 
 impl Expander {
@@ -126,6 +140,11 @@ impl Expander {
                 // A backslash outside quotes escapes exactly one character,
                 // including an operator: `echo a\;b` is one word, not two
                 // commands. A backslash-newline is a line continuation.
+                '\\' if self.literal_backslashes => {
+                    word.push('\\');
+                    started = true;
+                    i += 1;
+                }
                 '\\' => {
                     if i + 1 < n {
                         if chars[i + 1] != '\n' {
@@ -156,6 +175,10 @@ impl Expander {
                     i += 1;
                     while i < n && chars[i] != '"' {
                         match chars[i] {
+                            '\\' if self.literal_backslashes => {
+                                word.push('\\');
+                                i += 1;
+                            }
                             '\\' if i + 1 < n => {
                                 word.push(chars[i + 1]);
                                 i += 2;
@@ -705,7 +728,46 @@ mod tests {
     use super::*;
 
     fn expand(command: &str) -> Vec<String> {
-        expanded_commands(command)
+        // Exercise the POSIX grammar consistently on every test host.
+        expanded_commands_for_platform(command, false)
+    }
+
+    #[test]
+    fn windows_scan_retains_native_paths_and_posix_deny_candidates() {
+        for (command, expected) in [
+            (
+                r"C:\Windows\System32\cat.exe ~/.ssh/id_rsa",
+                r"C:\Windows\System32\cat.exe ~/.ssh/id_rsa",
+            ),
+            (r"del /f c:\users\x\file", r"del /f c:\users\x\file"),
+            (
+                r"echo safe & xcopy /e /y c:\src d:\dst",
+                r"xcopy /e /y c:\src d:\dst",
+            ),
+            (
+                r#""C:\Program Files\cat.exe" "c:\path with spaces\file""#,
+                r"C:\Program Files\cat.exe c:\path with spaces\file",
+            ),
+            (r"del relative\file", r"del relative\file"),
+            (
+                r"\\server\share\cat.exe file",
+                r"\\server\share\cat.exe file",
+            ),
+            (r"bash -c 'rm -rf \/'", "rm -rf /"),
+        ] {
+            let targets = expanded_commands_for_platform(command, true);
+            assert!(
+                targets.iter().any(|target| target == expected),
+                "missing {expected:?} from {targets:?}"
+            );
+            assert!(targets.len() <= MAX_COMMANDS);
+        }
+        let targets =
+            expanded_commands_for_platform("cat <<'EOF'\ndel c:\\users\\x\\file\nEOF", true);
+        assert!(
+            !targets.iter().any(|target| target.starts_with("del ")),
+            "literal heredoc data must stay inert: {targets:?}"
+        );
     }
 
     fn contains(command: &str, expected: &str) -> bool {

crates/localization/locales/ca.json

@@ -484,6 +484,8 @@
   "PluginCtaInstallPrompt": "Instal·lar el connector {name}?",
   "PluginCtaReview": "Revisa",
   "PluginCtaDismiss": "Descarta",
+  "PluginCtaDismissSaveFailed": "Ocult durant aquesta sessió; no s'ha pogut desar la preferència del connector.",
+  "PluginSuggestionReason": "Coincideix amb «{trigger}»",
   "CmdPluginBundleDetail": "{name}\n========================================\nID: {id}\nVersió: {version}\nFont: {origin} ({scope})\nEstat: {state}\nConfiança: {trust}\nComponents: {inventory}\nPermisos sol·licitats: {permissions}\nServidors MCP: {mcp}\nNo compatible/inactiu: {unsupported}\nHash de contingut: {content_hash}\nHash de capacitats: {capability_hash}\nRuta: {path}",
   "CmdPluginBundleDiagnosticsHeader": "Diagnòstics de plugins ({count}):",
   "CmdPluginBundleMutationSuccess": "Paquet de plugins '{name}': {action}.",
@@ -2211,5 +2213,6 @@
   "ApprovalNeverPostureBlocked": "S'ha bloquejat '{tool}': aquesta sessió no permet eines que requereixen aprovació.",
   "NotificationWebApproved": "Aprovat al web.",
   "NotificationWebDenied": "Denegat al web.",
-  "NotificationInputSubmitFailed": "No s'ha pogut enviar la resposta: {error}. Torna-ho a provar."
+  "NotificationInputSubmitFailed": "No s'ha pogut enviar la resposta: {error}. Torna-ho a provar.",
+  "PagerActionConfirm": "Confirma"
 }

crates/localization/locales/de.json

@@ -484,6 +484,8 @@
   "PluginCtaInstallPrompt": "{name}-Plugin installieren?",
   "PluginCtaReview": "Prüfen",
   "PluginCtaDismiss": "Verwerfen",
+  "PluginCtaDismissSaveFailed": "Für diese Sitzung ausgeblendet; die Plugin-Einstellung konnte nicht gespeichert werden.",
+  "PluginSuggestionReason": "Treffer für „{trigger}“",
   "CmdPluginBundleDetail": "{name}\n========================================\nID: {id}\nVersion: {version}\nQuelle: {origin} ({scope})\nStatus: {state}\nVertrauen: {trust}\nKomponenten: {inventory}\nAngeforderte Berechtigungen: {permissions}\nMCP-Server: {mcp}\nNicht unterstützt/inaktiv: {unsupported}\nInhalts-Hash: {content_hash}\nFähigkeits-Hash: {capability_hash}\nPfad: {path}",
   "CmdPluginBundleDiagnosticsHeader": "Plugin-Diagnose ({count}):",
   "CmdPluginBundleMutationSuccess": "Plugin-Bundle '{name}': {action}.",
@@ -2211,5 +2213,6 @@
   "ApprovalNeverPostureBlocked": "'{tool}' wurde blockiert: Diese Sitzung erlaubt keine Tools, die eine Genehmigung erfordern.",
   "NotificationWebApproved": "Im Web genehmigt.",
   "NotificationWebDenied": "Im Web abgelehnt.",
-  "NotificationInputSubmitFailed": "Deine Antwort konnte nicht gesendet werden: {error}. Versuche es erneut."
+  "NotificationInputSubmitFailed": "Deine Antwort konnte nicht gesendet werden: {error}. Versuche es erneut.",
+  "PagerActionConfirm": "Bestätigen"
 }

crates/localization/locales/en.json

@@ -487,6 +487,8 @@
   "PluginCtaInstallPrompt": "Install {name} plugin?",
   "PluginCtaReview": "Review",
   "PluginCtaDismiss": "Dismiss",
+  "PluginCtaDismissSaveFailed": "Hidden for this session; could not save the plugin preference.",
+  "PluginSuggestionReason": "Matched “{trigger}”",
   "CmdPluginBundleDetail": "{name}\n========================================\nID: {id}\nVersion: {version}\nSource: {origin} ({scope})\nState: {state}\nTrust: {trust}\nComponents: {inventory}\nRequested permissions: {permissions}\nMCP servers: {mcp}\nUnsupported/inactive: {unsupported}\nContent hash: {content_hash}\nCapability hash: {capability_hash}\nPath: {path}",
   "CmdPluginBundleDiagnosticsHeader": "Plugin diagnostics ({count}):",
   "CmdPluginBundleMutationSuccess": "Plugin bundle '{name}': {action}.",
@@ -2211,5 +2213,6 @@
   "ApprovalNeverPostureBlocked": "Blocked '{tool}': this session does not allow tools that require approval.",
   "NotificationWebApproved": "Approved on the web.",
   "NotificationWebDenied": "Denied on the web.",
-  "NotificationInputSubmitFailed": "Could not submit your answer: {error}. Try again."
+  "NotificationInputSubmitFailed": "Could not submit your answer: {error}. Try again.",
+  "PagerActionConfirm": "Confirm"
 }

crates/localization/locales/es-419.json

@@ -487,6 +487,8 @@
   "PluginCtaInstallPrompt": "¿Instalar el plugin {name}?",
   "PluginCtaReview": "Revisar",
   "PluginCtaDismiss": "Descartar",
+  "PluginCtaDismissSaveFailed": "Oculto durante esta sesión; no se pudo guardar la preferencia del complemento.",
+  "PluginSuggestionReason": "Coincide con «{trigger}»",
   "CmdPluginBundleDetail": "{name}\n========================================\nID: {id}\nVersión: {version}\nFuente: {origin} ({scope})\nEstado: {state}\nConfianza: {trust}\nComponentes: {inventory}\nPermisos solicitados: {permissions}\nServidores MCP: {mcp}\nNo compatible/inactivo: {unsupported}\nHash de contenido: {content_hash}\nHash de capacidades: {capability_hash}\nRuta: {path}",
   "CmdPluginBundleDiagnosticsHeader": "Diagnósticos de plugins ({count}):",
   "CmdPluginBundleMutationSuccess": "Paquete de plugin '{name}': {action}.",
@@ -2211,5 +2213,6 @@
   "ApprovalNeverPostureBlocked": "Se bloqueó '{tool}': esta sesión no permite herramientas que requieren aprobación.",
   "NotificationWebApproved": "Aprobado en la web.",
   "NotificationWebDenied": "Rechazado en la web.",
-  "NotificationInputSubmitFailed": "No se pudo enviar tu respuesta: {error}. Inténtalo de nuevo."
+  "NotificationInputSubmitFailed": "No se pudo enviar tu respuesta: {error}. Inténtalo de nuevo.",
+  "PagerActionConfirm": "Confirmar"
 }

crates/localization/locales/fr.json

@@ -484,6 +484,8 @@
   "PluginCtaInstallPrompt": "Installer le plugin {name} ?",
   "PluginCtaReview": "Examiner",
   "PluginCtaDismiss": "Ignorer",
+  "PluginCtaDismissSaveFailed": "Masqué pour cette session ; impossible d’enregistrer la préférence du plugin.",
+  "PluginSuggestionReason": "Correspond à « {trigger} »",
   "CmdPluginBundleDetail": "{name}\n========================================\nID : {id}\nVersion : {version}\nSource : {origin} ({scope})\nÉtat : {state}\nConfiance : {trust}\nComposants : {inventory}\nPermissions demandées : {permissions}\nServeurs MCP : {mcp}\nNon pris en charge/inactif : {unsupported}\nHash du contenu : {content_hash}\nHash des capacités : {capability_hash}\nChemin : {path}",
   "CmdPluginBundleDiagnosticsHeader": "Diagnostics des plugins ({count}) :",
   "CmdPluginBundleMutationSuccess": "Bundle de plugins '{name}' : {action}.",
@@ -2211,5 +2213,6 @@
   "ApprovalNeverPostureBlocked": "« {tool} » a été bloqué : cette session n'autorise pas les outils qui nécessitent une approbation.",
   "NotificationWebApproved": "Approuvé sur le Web.",
   "NotificationWebDenied": "Refusé sur le Web.",
-  "NotificationInputSubmitFailed": "Impossible d'envoyer votre réponse : {error}. Réessayez."
+  "NotificationInputSubmitFailed": "Impossible d'envoyer votre réponse : {error}. Réessayez.",
+  "PagerActionConfirm": "Confirmer"
 }

crates/localization/locales/hi.json

@@ -484,6 +484,8 @@
   "PluginCtaInstallPrompt": "{name} प्लगइन इंस्टॉल करें?",
   "PluginCtaReview": "समीक्षा",
   "PluginCtaDismiss": "बंद करें",
+  "PluginCtaDismissSaveFailed": "इस सत्र के लिए छिपाया गया; प्लगइन की प्राथमिकता सहेजी नहीं जा सकी।",
+  "PluginSuggestionReason": "“{trigger}” से मेल खाता है",
   "CmdPluginBundleDetail": "{name}\n========================================\nID: {id}\nसंस्करण: {version}\nस्रोत: {origin} ({scope})\nस्थिति: {state}\nट्रस्ट: {trust}\nघटक: {inventory}\nअनुरोधित अनुमतियाँ: {permissions}\nMCP सर्वर: {mcp}\nअसमर्थित/निष्क्रिय: {unsupported}\nकंटेंट हैश: {content_hash}\nक्षमता हैश: {capability_hash}\nपथ: {path}",
   "CmdPluginBundleDiagnosticsHeader": "प्लगिन डायग्नोस्टिक्स ({count}):",
   "CmdPluginBundleMutationSuccess": "प्लगिन बंडल '{name}': {action}।",
@@ -2211,5 +2213,6 @@
   "ApprovalNeverPostureBlocked": "'{tool}' को ब्लॉक किया गया: इस सत्र में मंज़ूरी की ज़रूरत वाले टूल की अनुमति नहीं है।",
   "NotificationWebApproved": "वेब पर मंज़ूरी दी गई।",
   "NotificationWebDenied": "वेब पर अस्वीकार किया गया।",
-  "NotificationInputSubmitFailed": "आपका जवाब भेजा नहीं जा सका: {error}। फिर से कोशिश करें।"
+  "NotificationInputSubmitFailed": "आपका जवाब भेजा नहीं जा सका: {error}। फिर से कोशिश करें।",
+  "PagerActionConfirm": "पुष्टि करें"
 }

crates/localization/locales/id.json

@@ -484,6 +484,8 @@
   "PluginCtaInstallPrompt": "Pasang plugin {name}?",
   "PluginCtaReview": "Tinjau",
   "PluginCtaDismiss": "Tutup",
+  "PluginCtaDismissSaveFailed": "Disembunyikan untuk sesi ini; preferensi plugin tidak dapat disimpan.",
+  "PluginSuggestionReason": "Cocok dengan “{trigger}”",
   "CmdPluginBundleDetail": "{name}\n========================================\nID: {id}\nVersi: {version}\nSumber: {origin} ({scope})\nStatus: {state}\nKepercayaan: {trust}\nKomponen: {inventory}\nIzin yang diminta: {permissions}\nServer MCP: {mcp}\nTidak didukung/nonaktif: {unsupported}\nHash konten: {content_hash}\nHash kapabilitas: {capability_hash}\nJalur: {path}",
   "CmdPluginBundleDiagnosticsHeader": "Diagnostik plugin ({count}):",
   "CmdPluginBundleMutationSuccess": "Bundel plugin '{name}': {action}.",
@@ -2211,5 +2213,6 @@
   "ApprovalNeverPostureBlocked": "'{tool}' diblokir: sesi ini tidak mengizinkan alat yang memerlukan persetujuan.",
   "NotificationWebApproved": "Disetujui di web.",
   "NotificationWebDenied": "Ditolak di web.",
-  "NotificationInputSubmitFailed": "Jawaban Anda tidak dapat dikirim: {error}. Coba lagi."
+  "NotificationInputSubmitFailed": "Jawaban Anda tidak dapat dikirim: {error}. Coba lagi.",
+  "PagerActionConfirm": "Konfirmasi"
 }

crates/localization/locales/ja.json

@@ -487,6 +487,8 @@
   "PluginCtaInstallPrompt": "{name} プラグインをインストールしますか？",
   "PluginCtaReview": "確認",
   "PluginCtaDismiss": "閉じる",
+  "PluginCtaDismissSaveFailed": "このセッションでは非表示にしました。プラグインの設定を保存できませんでした。",
+  "PluginSuggestionReason": "「{trigger}」に一致",
   "CmdPluginBundleDetail": "{name}\n========================================\nID: {id}\nバージョン: {version}\n出所: {origin} ({scope})\n状態: {state}\n信頼: {trust}\nコンポーネント: {inventory}\n要求権限: {permissions}\nMCP サーバー: {mcp}\n未対応/無効: {unsupported}\nコンテンツハッシュ: {content_hash}\n権限ハッシュ: {capability_hash}\nパス: {path}",
   "CmdPluginBundleDiagnosticsHeader": "プラグイン診断 ({count}):",
   "CmdPluginBundleMutationSuccess": "プラグインバンドル '{name}': {action}。",
@@ -2211,5 +2213,6 @@
   "ApprovalNeverPostureBlocked": "「{tool}」をブロックしました。このセッションでは承認が必要なツールは許可されていません。",
   "NotificationWebApproved": "ウェブで承認されました。",
   "NotificationWebDenied": "ウェブで拒否されました。",
-  "NotificationInputSubmitFailed": "回答を送信できませんでした：{error}。もう一度お試しください。"
+  "NotificationInputSubmitFailed": "回答を送信できませんでした：{error}。もう一度お試しください。",
+  "PagerActionConfirm": "確認"
 }