feats: permissions hooks mcp_rt plugins

[suluyana]

No description provided.

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive plugin compatibility layer, a dual-layer permission control system (SafetyGuard and PermissionEnforcer), and an MCP runtime management system with ToolManager synchronization. It also integrates lifecycle hooks into the agent execution loop and replaces the legacy WorkspacePolicyKernel with a lightweight WorkspaceContext. The review feedback highlights several critical issues and optimization opportunities: ensuring proper initialization of PluginRuntime with existing runtimes, handling commit SHAs during Git clone operations, avoiding zombie processes by awaiting process termination on timeout, casting extracted tool arguments to strings to prevent type errors during wildcard matching, supporting 'v'-prefixed semver strings, and optimizing recursive variable expansion to eliminate redundant disk I/O.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The PluginRuntime is initialized without passing the existing _skill_runtime or mcp_runtime. If prepare_skills runs before prepare_tools, the plugin runtime's skill synchronization will be skipped because self.skill_runtime is still None when start_sync is called. Pass skill_runtime=self._skill_runtime and mcp_runtime=self.mcp_runtime to ensure proper synchronization.

        self._plugin_runtime = PluginRuntime(
            skill_runtime=self._skill_runtime,
            mcp_runtime=self.mcp_runtime,
        )

[gemini-code-assist]

If ref is a commit SHA (e.g., a 40-character hex string), git clone --branch will fail because Git does not support cloning a specific commit hash directly via the --branch option. Check if ref is a commit SHA first, and if so, clone without --branch and perform a git checkout afterward.

    is_sha = ref and bool(re.match(r'^[0-9a-f]{7,40}$', ref, re.IGNORECASE))
    if ref and not is_sha:
        clone_cmd.extend(['--branch', ref])
    clone_cmd.extend([f'https://github.com/{repo}.git', str(clone_dir)])
    subprocess.run(clone_cmd, check=True, capture_output=True, text=True)
    if is_sha:
        subprocess.run(['git', '-C', str(clone_dir), 'fetch', 'origin', ref], check=False)
        subprocess.run(['git', '-C', str(clone_dir), 'checkout', ref], check=True, capture_output=True)

[gemini-code-assist]

When a hook execution times out, proc.kill() is called to terminate the subprocess. However, proc.kill() does not wait for the process to terminate or reap the zombie process. You must call await proc.wait() after killing the process to prevent accumulating zombie processes and leaking system resources.

Suggested change

	except asyncio.TimeoutError:
	if proc is not None:
	proc.kill()
	except asyncio.TimeoutError:
	if proc is not None:
	try:
	proc.kill()
	await proc.wait()
	except ProcessLookupError:
	pass

[gemini-code-assist]

If tool_args contains non-string values (such as lists or dictionaries) for keys like path, command, or query, _extract_content will return those raw objects. This causes fnmatch.fnmatch to raise a TypeError during matching, crashing the entire tool execution. Cast the extracted value to str to ensure robustness.

    val = None
    if tool_name.endswith(f'{TOOL_SPLITER}shell_executor'):
        val = tool_args.get('command')
    elif tool_name.endswith(f'{TOOL_SPLITER}write_file'):
        val = tool_args.get('path')
    elif tool_name.endswith(f'{TOOL_SPLITER}read_file'):
        val = tool_args.get('path')
    elif tool_name.endswith(f'{TOOL_SPLITER}edit_file'):
        val = tool_args.get('path')
    elif tool_name.endswith(f'{TOOL_SPLITER}grep'):
        val = tool_args.get('pattern')
    elif tool_name.endswith(f'{TOOL_SPLITER}glob'):
        val = tool_args.get('pattern')
    else:
        for key in ('path', 'command', 'query', 'url', 'pattern'):
            if key in tool_args:
                val = tool_args[key]
                break
    return str(val) if val is not None else None

[gemini-code-assist]

The _parse_version function fails to parse version strings prefixed with a leading 'v' or 'V' (e.g., v1.2.3), which is a very common format in semver. Strip the leading 'v' or 'V' before matching against _VERSION_RE to ensure robust version parsing.

Suggested change

	def _parse_version(value: str) -> tuple[int, int, int] | None:
	match = _VERSION_RE.match(str(value).strip())
	if not match:
	val = str(value).strip().lstrip('vV')
	match = _VERSION_RE.match(val)
	if not match:
	return None

[gemini-code-assist]

The _expand_vars function recursively calls itself on lists and dictionaries, and loads the user configuration from disk (_load_user_config(plugin_data_dir)) on every single string evaluation. This causes massive, redundant disk I/O. Load the user configuration once at the start of the expansion process and pass it down through the recursive calls.

def _expand_vars(
    value: Any,
    plugin_root: Path,
    plugin_data_dir: Path,
    project_path: Path,
    user_config: dict[str, Any] | None = None,
) -> Any:
    if isinstance(value, str):
        expanded = (
            value
            .replace('${MS_AGENT_PLUGIN_ROOT}', str(plugin_root))
            .replace('${CLAUDE_PLUGIN_ROOT}', str(plugin_root))
            .replace('${MS_AGENT_PLUGIN_DATA}', str(plugin_data_dir))
            .replace('${CLAUDE_PLUGIN_DATA}', str(plugin_data_dir))
            .replace('${MS_AGENT_PROJECT_DIR}', str(project_path))
            .replace('${CLAUDE_PROJECT_DIR}', str(project_path))
        )
        if user_config is None:
            user_config = _load_user_config(plugin_data_dir)
        for key, item in user_config.items():
            expanded = expanded.replace(f'${{user_config.{key}}}', str(item))
            expanded = expanded.replace(
                f'${{CLAUDE_PLUGIN_OPTION_{key.upper()}}}', str(item))
        return expanded
    if isinstance(value, list):
        return [
            _expand_vars(item, plugin_root, plugin_data_dir, project_path, user_config)
            for item in value
        ]
    if isinstance(value, dict):
        return {
            key: _expand_vars(item, plugin_root, plugin_data_dir, project_path, user_config)
            for key, item in value.items()
        }
    return value