From 324b4ac9a0445123abbfe9927f878822b2870672 Mon Sep 17 00:00:00 2001
From: Jarek Potiuk <potiuk@apache.org>
Date: Sat, 10 Oct 2026 09:16:42 +0100
Subject: [PATCH 1/2] fix(adversarial-review): name a fixed path in the sandbox
 exclusion, not a versioned glob

The adversarial-review sandbox exclusion matched the tool as
~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review.
The `*` stood for the plugin version, but it also matches spaces, so once
a command was approved it ran outside the sandbox even with extra `uv`
options spliced in at that position (`--with <any package>`, a second
`--from`). This is the gap #1406 closed for vetted-ops.

The magpie-adversarial-review plugin now ships a SessionStart hook that
points ~/.claude/magpie/adversarial-review at the installed version each
session, and the exclusion, the Claude Code command, the shared pre-PR
block and every skill that runs the tool name that fixed path. The
existing Edit(~/.claude/magpie/**) deny covers it. The Codex, Gemini and
Copilot commands keep resolving the installed version, since only Claude
Code runs the hook and only its exclusion is a permission rule.

sandbox-lint now rejects a `*` before the end of any
sandbox.excludedCommands entry; #1406 only checked permissions.allow.
isolated-setup-update and -verify report the old exclusion as a must-fix.

Generated-by: Claude Opus 5
---
 .claude/settings.json                         |  2 +-
 docs/setup/secure-agent-setup.md              | 13 ++++--
 .../.claude-plugin/plugin.json                | 15 +++++-
 .../fix-workflow/pre-pr-adversarial-review.md |  6 +--
 .../skills/code-review/adversarial.md         |  6 +--
 .../skills/announce-draft/SKILL.md            |  8 ++--
 .../skills/audit-report/SKILL.md              |  8 ++--
 .../skills/prepare/automated-signing.md       |  6 +--
 .../skills/prepare/post.md                    |  6 +--
 .../skills/prepare/prep.md                    |  6 +--
 .../pre-pr-adversarial-review.md              |  6 +--
 .../magpie-security/skills/issue-fix/SKILL.md |  8 ++--
 .../skills/issue-import-from-pr/SKILL.md      |  8 ++--
 .../skills/issue-import-from-scan/SKILL.md    |  8 ++--
 .../skills/model-prepare/SKILL.md             |  8 ++--
 .../skills/model-verify/SKILL.md              |  8 ++--
 .../skills/isolated-setup-install/SKILL.md    | 12 +++--
 .../skills/isolated-setup-update/SKILL.md     |  6 ++-
 .../conditional-checks.md                     |  8 +++-
 .../skills/override-upstream/SKILL.md         |  8 ++--
 plugins/magpie-setup/skills/setup/config.md   |  6 +--
 .../setup_preflight/isolated_fingerprint.py   |  2 +-
 plugins/magpie-setup/skills/setup/verify.md   |  4 +-
 .../magpie-setup/skills/upstream-fix/SKILL.md |  8 ++--
 tools/adversarial-review/README.md            |  4 +-
 .../commands/adversarial-review.md            |  8 ++--
 .../hooks/link-stable-path.sh                 | 39 ++++++++++++++++
 .../src/adversarial_review/commands.py        | 46 +++++++++++++------
 .../adversarial-review/tests/test_commands.py | 37 +++++++++++----
 tools/dev/blocks/pre-pr-adversarial-review.md |  6 +--
 tools/dev/check-family-plugins.py             | 23 +++++++++-
 tools/sandbox-lint/expected.json              |  2 +-
 .../sandbox-lint/src/sandbox_lint/__init__.py | 12 +++++
 tools/sandbox-lint/tests/test_validator.py    | 18 ++++++++
 .../specs/agent-isolation-sandbox.md          |  9 ++--
 .../specs/marketplace-distribution.md         |  8 ++--
 36 files changed, 278 insertions(+), 110 deletions(-)
 create mode 100755 tools/adversarial-review/hooks/link-stable-path.sh

diff --git a/.claude/settings.json b/.claude/settings.json
index 54d23de5e..b8bbae2ee 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -7,7 +7,7 @@
       "uv run --project ~/.claude/magpie/vetted-ops vetted-op-read *",
       "uv run --project ~/.claude/magpie/vetted-ops vetted-op-tracker *",
       "uvx --from ~/.claude/magpie/vetted-ops vetted-op-read *",
-      "uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review adversarial-review *",
+      "uvx --from ~/.claude/magpie/adversarial-review adversarial-review *",
       "uvx --from ~/.claude/magpie/vetted-ops vetted-op-tracker *",
       "~/.claude/scripts/magpie-run-evals.sh *"
     ],
diff --git a/docs/setup/secure-agent-setup.md b/docs/setup/secure-agent-setup.md
index ef2cda401..55f97f1fe 100644
--- a/docs/setup/secure-agent-setup.md
+++ b/docs/setup/secure-agent-setup.md
@@ -507,13 +507,18 @@ below, annotated.
     // and their runner refuses any gh call outside repos/<tracker>/. It keeps
     // its `ask` below. Never exclude `vetted-op`: that runs the whole write
     // catalogue unsandboxed.
+    // The adversarial-review tool runs the reviewer CLIs, which need network
+    // and their own credentials. Like the vetted-ops entries, it names the
+    // fixed link its plugin's SessionStart hook maintains, never a `*` where
+    // the plugin version sits: that would also match `uv` options spliced in
+    // at that position and run them unsandboxed.
     "excludedCommands": [
       "gh *",
       "uv run --project ~/.claude/magpie/vetted-ops vetted-op-read *",
       "uvx --from ~/.claude/magpie/vetted-ops vetted-op-read *",
       "uv run --project ~/.claude/magpie/vetted-ops vetted-op-tracker *",
       "uvx --from ~/.claude/magpie/vetted-ops vetted-op-tracker *",
-      "uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review adversarial-review *"
+      "uvx --from ~/.claude/magpie/adversarial-review adversarial-review *"
     ],
     // The `lychee` link-check hook runs in OFFLINE mode (`offline =
     // true` in `.lychee.toml`): it validates only local cross-file and
@@ -3400,12 +3405,14 @@ below and report ✓ done / ✗ missing / ⚠ partial, with the evidence
 14. **Adversarial-review exclusion**, if the
     `magpie-adversarial-review` plugin is installed (n/a otherwise).
     `sandbox.excludedCommands` contains
-    `"uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review adversarial-review *"`,
+    `"uvx --from ~/.claude/magpie/adversarial-review adversarial-review *"`,
     `permissions.deny` contains
     `Edit(~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/**)`,
     and **no** `permissions.allow` entry covers the tool. A missing
     exclusion is ⚠ (every reviewer reports `unavailable` from inside
-    the sandbox); a missing deny is ✗ (the exclusion runs that code
+    the sandbox); the older `magpie-adversarial-review/*/tools/adversarial-review`
+    exclusion is ✗ (its `*` also matches options spliced in where the version
+    sits); a missing deny is ✗ (the exclusion runs that code
     unsandboxed); an `allow` is ✗ (each run sends the change to other
     model providers and must keep its prompt).
 15. **Working directories under the read block**, if
diff --git a/plugins/magpie-adversarial-review/.claude-plugin/plugin.json b/plugins/magpie-adversarial-review/.claude-plugin/plugin.json
index 2e25bbb62..97317eefd 100644
--- a/plugins/magpie-adversarial-review/.claude-plugin/plugin.json
+++ b/plugins/magpie-adversarial-review/.claude-plugin/plugin.json
@@ -8,5 +8,18 @@
   },
   "homepage": "https://magpie.apache.org/",
   "repository": "https://github.com/apache/magpie",
-  "license": "Apache-2.0"
+  "license": "Apache-2.0",
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/tools/adversarial-review/hooks/link-stable-path.sh\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
 }
diff --git a/plugins/magpie-issue/skills/fix-workflow/pre-pr-adversarial-review.md b/plugins/magpie-issue/skills/fix-workflow/pre-pr-adversarial-review.md
index ae4f95689..f3da97963 100644
--- a/plugins/magpie-issue/skills/fix-workflow/pre-pr-adversarial-review.md
+++ b/plugins/magpie-issue/skills/fix-workflow/pre-pr-adversarial-review.md
@@ -52,11 +52,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-pr-management/skills/code-review/adversarial.md b/plugins/magpie-pr-management/skills/code-review/adversarial.md
index 5d5a9591a..f41ea600c 100644
--- a/plugins/magpie-pr-management/skills/code-review/adversarial.md
+++ b/plugins/magpie-pr-management/skills/code-review/adversarial.md
@@ -85,11 +85,11 @@ The agent runs the reviewers itself, at Step 5 of
    exclusion matches:
 
    ```bash
-   uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --reviewers <list> --target pr:<N> --repo <upstream> --project-root <repo-root> --repo-dir <empty-temp-dir>
+   uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --reviewers <list> --target pr:<N> --repo <upstream> --project-root <repo-root> --repo-dir <empty-temp-dir>
    ```
 
-   `<version>` is the newest directory under
-   `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. Omit
+   The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+   at the start of every session. Omit
    `--reviewers` when the list came from `adversarial-review.md`.
 
 - **What leaves the machine.** The PR's diff, title and body go to each
diff --git a/plugins/magpie-release-management/skills/announce-draft/SKILL.md b/plugins/magpie-release-management/skills/announce-draft/SKILL.md
index 2654581f1..a9f1e928a 100644
--- a/plugins/magpie-release-management/skills/announce-draft/SKILL.md
+++ b/plugins/magpie-release-management/skills/announce-draft/SKILL.md
@@ -18,7 +18,7 @@ argument-hint: "<version> [--planning-issue <url>]"
 capability: capability:resolve
 surface_hash: sha256:edffafcd9d9948ab
 license: Apache-2.0
-measured_tokens: 6825
+measured_tokens: 6809
 ---
 
 <!-- SPDX-License-Identifier: Apache-2.0
@@ -418,11 +418,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-release-management/skills/audit-report/SKILL.md b/plugins/magpie-release-management/skills/audit-report/SKILL.md
index 18f3dfb96..c71c5e5c8 100644
--- a/plugins/magpie-release-management/skills/audit-report/SKILL.md
+++ b/plugins/magpie-release-management/skills/audit-report/SKILL.md
@@ -23,7 +23,7 @@ argument-hint: "<version> [--planning-issue <url>]"
 capability: capability:stats
 surface_hash: sha256:576d71b04f203cd8
 license: Apache-2.0
-measured_tokens: 6673
+measured_tokens: 6657
 ---
 
 <!-- SPDX-License-Identifier: Apache-2.0
@@ -418,11 +418,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-release-management/skills/prepare/automated-signing.md b/plugins/magpie-release-management/skills/prepare/automated-signing.md
index 3504ce928..9cb96813a 100644
--- a/plugins/magpie-release-management/skills/prepare/automated-signing.md
+++ b/plugins/magpie-release-management/skills/prepare/automated-signing.md
@@ -103,11 +103,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-release-management/skills/prepare/post.md b/plugins/magpie-release-management/skills/prepare/post.md
index a79fcaa99..3c1e31de4 100644
--- a/plugins/magpie-release-management/skills/prepare/post.md
+++ b/plugins/magpie-release-management/skills/prepare/post.md
@@ -74,11 +74,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-release-management/skills/prepare/prep.md b/plugins/magpie-release-management/skills/prepare/prep.md
index 10ee6439c..ddb18a4ad 100644
--- a/plugins/magpie-release-management/skills/prepare/prep.md
+++ b/plugins/magpie-release-management/skills/prepare/prep.md
@@ -202,11 +202,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-repo-health/skills/audit-finding-fix/pre-pr-adversarial-review.md b/plugins/magpie-repo-health/skills/audit-finding-fix/pre-pr-adversarial-review.md
index 5c129f1ec..c8a83f4b6 100644
--- a/plugins/magpie-repo-health/skills/audit-finding-fix/pre-pr-adversarial-review.md
+++ b/plugins/magpie-repo-health/skills/audit-finding-fix/pre-pr-adversarial-review.md
@@ -52,11 +52,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-security/skills/issue-fix/SKILL.md b/plugins/magpie-security/skills/issue-fix/SKILL.md
index 48f9fbc67..925e36605 100644
--- a/plugins/magpie-security/skills/issue-fix/SKILL.md
+++ b/plugins/magpie-security/skills/issue-fix/SKILL.md
@@ -22,7 +22,7 @@ capability:
   - capability:resolve
 surface_hash: sha256:9884ef304a3fad88
 license: Apache-2.0
-measured_tokens: 6080
+measured_tokens: 6064
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -315,11 +315,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md b/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md
index a21f8df2a..9d1482d5d 100644
--- a/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md
+++ b/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md
@@ -20,7 +20,7 @@ argument-hint: "[pr-number] [repo:owner/name]"
 capability: capability:intake
 surface_hash: sha256:4a4f2d125526784d
 license: Apache-2.0
-measured_tokens: 8063
+measured_tokens: 8047
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -479,11 +479,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-security/skills/issue-import-from-scan/SKILL.md b/plugins/magpie-security/skills/issue-import-from-scan/SKILL.md
index ae54d7bcf..a7953cf07 100644
--- a/plugins/magpie-security/skills/issue-import-from-scan/SKILL.md
+++ b/plugins/magpie-security/skills/issue-import-from-scan/SKILL.md
@@ -19,7 +19,7 @@ argument-hint: "[scan-source ...]  (one or more GitHub issues and/or report fold
 capability: capability:intake
 surface_hash: sha256:3aa895ba2115c1d9
 license: Apache-2.0
-measured_tokens: 5578
+measured_tokens: 5563
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -326,11 +326,11 @@ Accept per-finding or bulk grammar (`all` / `NN,MM` / `bucket:<name>` / `skip` /
      reviewer reports `unavailable`:
 
      ```bash
-     uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+     uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
      ```
 
-     `<version>` is the newest directory under
-     `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+     The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+     at the start of every session. The body
      file must sit in the checkout or a temporary directory; the tool refuses any
      other path. For a patch someone else proposed, replace `--base … --body-file
      …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-security/skills/model-prepare/SKILL.md b/plugins/magpie-security/skills/model-prepare/SKILL.md
index f6cad46dc..3af81a85e 100644
--- a/plugins/magpie-security/skills/model-prepare/SKILL.md
+++ b/plugins/magpie-security/skills/model-prepare/SKILL.md
@@ -19,7 +19,7 @@ argument-hint: "[repo-or-project]"
 capability: capability:authoring
 surface_hash: sha256:db4f1e33c6b3fab3
 license: Apache-2.0
-measured_tokens: 4647
+measured_tokens: 4631
 ---
 
 # Security model prepare
@@ -285,11 +285,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-security/skills/model-verify/SKILL.md b/plugins/magpie-security/skills/model-verify/SKILL.md
index 690770598..9b497b0ec 100644
--- a/plugins/magpie-security/skills/model-verify/SKILL.md
+++ b/plugins/magpie-security/skills/model-verify/SKILL.md
@@ -22,7 +22,7 @@ argument-hint: "[repo-or-model-path]"
 capability: capability:review
 surface_hash: sha256:03ecb6b8514583b2
 license: Apache-2.0
-measured_tokens: 5584
+measured_tokens: 5569
 ---
 
 # Security model verify
@@ -342,11 +342,11 @@ security-relevant build flags), §1.19 the machine-readable companions.
    reviewer reports `unavailable`:
 
    ```bash
-   uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+   uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
    ```
 
-   `<version>` is the newest directory under
-   `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+   The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+   at the start of every session. The body
    file must sit in the checkout or a temporary directory; the tool refuses any
    other path. For a patch someone else proposed, replace `--base … --body-file
    …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-setup/skills/isolated-setup-install/SKILL.md b/plugins/magpie-setup/skills/isolated-setup-install/SKILL.md
index d816e8da6..d26d4e7f3 100644
--- a/plugins/magpie-setup/skills/isolated-setup-install/SKILL.md
+++ b/plugins/magpie-setup/skills/isolated-setup-install/SKILL.md
@@ -17,7 +17,7 @@ when_to_use: >-
 capability: capability:platform
 surface_hash: sha256:3f90b1ffdaa6e9ea
 license: Apache-2.0
-measured_tokens: 5726
+measured_tokens: 5787
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -320,19 +320,23 @@ is not, skip this step and say so.
 The reviewer CLIs it runs (`codex`, `copilot`, `gemini`, `grok`, `claude`)
 need network access and read their own credentials (`~/.codex`,
 `~/.copilot`, `~/.gemini`, `~/.grok`, `~/.claude`), which this sandbox denies. The tool therefore
-runs outside it, through one exclusion that names the installed plugin:
+runs outside it, through one exclusion. It names `~/.claude/magpie/adversarial-review`,
+a link the plugin's `SessionStart` hook points at the installed version every
+session, never a `*` where the version sits: that would also match `uv`
+options spliced in at that position, and run them outside the sandbox.
 
 ```jsonc
 "sandbox": {
   "excludedCommands": [
-    "uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review adversarial-review *"
+    "uvx --from ~/.claude/magpie/adversarial-review adversarial-review *"
   ]
 },
 "permissions": {
   "deny": [
     // the tool runs unsandboxed, so the code it runs must not be editable
     // by the agent that calls it
-    "Edit(~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/**)"
+    "Edit(~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/**)",
+    "Edit(~/.claude/magpie/**)"
   ]
 }
 ```
diff --git a/plugins/magpie-setup/skills/isolated-setup-update/SKILL.md b/plugins/magpie-setup/skills/isolated-setup-update/SKILL.md
index 390d99786..adedb359c 100644
--- a/plugins/magpie-setup/skills/isolated-setup-update/SKILL.md
+++ b/plugins/magpie-setup/skills/isolated-setup-update/SKILL.md
@@ -18,7 +18,7 @@ when_to_use: >-
 capability: capability:platform
 surface_hash: sha256:1f327e069312dad2
 license: Apache-2.0
-measured_tokens: 5314
+measured_tokens: 5455
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -214,6 +214,10 @@ The `*` also matches spaces, so it approves, and runs unsandboxed, a command wit
 Report each one as a must-fix and propose the replacement, which names the fixed path the plugin's `SessionStart` hook maintains: `~/.claude/magpie/vetted-ops`.
 Check the user-scope settings and any agent definition whose `tools:` list carries the rule, not only the project's `.claude/settings.json`.
 
+**The adversarial-review exclusion has the same must-fix.**
+A `sandbox.excludedCommands` entry spelled `uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review adversarial-review *` is the pre-fixed-path form: once the command is approved, a run with `uv` options spliced in where the version sits goes outside the sandbox.
+Report it as a must-fix whenever the `magpie-adversarial-review` plugin is installed, and propose `uvx --from ~/.claude/magpie/adversarial-review adversarial-review *`, the fixed path that plugin's `SessionStart` hook maintains.
+
 ## When the pre-flight proposes this skill
 
 Every skill's pre-flight proposes this one when the isolated setup is used on this machine, for one of two reasons:
diff --git a/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md b/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
index 1a6ed8170..cd8416890 100644
--- a/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
+++ b/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
@@ -331,12 +331,16 @@ reading this file; read the section for a check whose condition holds.
     When it is:
 
     - **14a — the exclusion.** `sandbox.excludedCommands` contains
-      `uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review adversarial-review *`.
+      `uvx --from ~/.claude/magpie/adversarial-review adversarial-review *`.
+      The older form with `magpie-adversarial-review/*/tools/adversarial-review`
+      in place of that path is ✗: its `*` also matches options spliced in where
+      the version sits, and those run outside the sandbox once approved.
       Missing is ⚠, not ✗: nothing unsafe happens, but every run stays
       sandboxed, where the reviewer CLIs cannot read their credentials,
       and every reviewer reports `unavailable`.
     - **14b — the plugin cache is not agent-writable.** `permissions.deny`
-      contains `Edit(~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/**)`.
+      contains `Edit(~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/**)`
+      and `Edit(~/.claude/magpie/**)`, which covers the link the exclusion names.
       Missing is ✗: the exclusion runs that code outside the sandbox.
     - **14c — no `allow`.** No `permissions.allow` entry matches the tool's
       invocation. One is ✗: each run sends the change to other model
diff --git a/plugins/magpie-setup/skills/override-upstream/SKILL.md b/plugins/magpie-setup/skills/override-upstream/SKILL.md
index f343669a8..b6de71af3 100644
--- a/plugins/magpie-setup/skills/override-upstream/SKILL.md
+++ b/plugins/magpie-setup/skills/override-upstream/SKILL.md
@@ -16,7 +16,7 @@ argument-hint: "[skill-name]"
 capability: capability:platform
 surface_hash: sha256:6aa9dd2488726450
 license: Apache-2.0
-measured_tokens: 4573
+measured_tokens: 4558
 ---
 
 <!-- SPDX-License-Identifier: Apache-2.0
@@ -225,11 +225,11 @@ In `<framework-clone>`:
    reviewer reports `unavailable`:
 
    ```bash
-   uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+   uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
    ```
 
-   `<version>` is the newest directory under
-   `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+   The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+   at the start of every session. The body
    file must sit in the checkout or a temporary directory; the tool refuses any
    other path. For a patch someone else proposed, replace `--base … --body-file
    …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/plugins/magpie-setup/skills/setup/config.md b/plugins/magpie-setup/skills/setup/config.md
index 6fd95c06c..735df8271 100644
--- a/plugins/magpie-setup/skills/setup/config.md
+++ b/plugins/magpie-setup/skills/setup/config.md
@@ -299,11 +299,11 @@ interviewed). A plain run mentions it in the recap instead.
    exclusion matches:
 
    ```bash
-   uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review detect
+   uvx --from ~/.claude/magpie/adversarial-review adversarial-review detect
    ```
 
-   `<version>` is the newest directory under
-   `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. Report
+   The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+   at the start of every session. Report
    each backend: available or not, with the reason, and which one is `self` —
    the model this harness runs, which is never used as its own reviewer.
    `detect` makes no model call, so a CLI that is installed but logged out
diff --git a/plugins/magpie-setup/skills/setup/setup_preflight/isolated_fingerprint.py b/plugins/magpie-setup/skills/setup/setup_preflight/isolated_fingerprint.py
index c139c23c0..c3fb29c56 100644
--- a/plugins/magpie-setup/skills/setup/setup_preflight/isolated_fingerprint.py
+++ b/plugins/magpie-setup/skills/setup/setup_preflight/isolated_fingerprint.py
@@ -21,4 +21,4 @@
 for installs that do not carry the framework source (see `isolated.py`).
 """
 
-FRAMEWORK_FINGERPRINT = "sha256:ff481b500c640dd1"
+FRAMEWORK_FINGERPRINT = "sha256:b4204930bc9aaec0"
diff --git a/plugins/magpie-setup/skills/setup/verify.md b/plugins/magpie-setup/skills/setup/verify.md
index 04965b984..18152c830 100644
--- a/plugins/magpie-setup/skills/setup/verify.md
+++ b/plugins/magpie-setup/skills/setup/verify.md
@@ -912,8 +912,8 @@ See [the Grok verification contract](../../../../docs/adapters/grok.md#verify).
 
 When `adversarial-review.md` resolves (the personal layer first, then
 `.apache-magpie-overrides/`), run the tool's `detect` in its one-line form —
-`uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review detect`,
-unquoted with a literal `~`, `<version>` the newest installed — and compare
+`uvx --from ~/.claude/magpie/adversarial-review adversarial-review detect`,
+unquoted with a literal `~` — and compare
 it with the configured `reviewers`.
 
 - ✓ when every configured reviewer is available, or is `self` (skipped
diff --git a/plugins/magpie-setup/skills/upstream-fix/SKILL.md b/plugins/magpie-setup/skills/upstream-fix/SKILL.md
index f2ceb79c0..d99470a25 100644
--- a/plugins/magpie-setup/skills/upstream-fix/SKILL.md
+++ b/plugins/magpie-setup/skills/upstream-fix/SKILL.md
@@ -19,7 +19,7 @@ argument-hint: "[quirk description]"
 capability: capability:platform
 surface_hash: sha256:ac2752440081dd6c
 license: Apache-2.0
-measured_tokens: 5303
+measured_tokens: 5288
 ---
 
 <!-- SPDX-License-Identifier: Apache-2.0
@@ -244,11 +244,11 @@ Do this **once per quirk**, in `<framework-clone>`:
    reviewer reports `unavailable`:
 
    ```bash
-   uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+   uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
    ```
 
-   `<version>` is the newest directory under
-   `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+   The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+   at the start of every session. The body
    file must sit in the checkout or a temporary directory; the tool refuses any
    other path. For a patch someone else proposed, replace `--base … --body-file
    …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/tools/adversarial-review/README.md b/tools/adversarial-review/README.md
index b6c376a4f..9bbbbd9f0 100644
--- a/tools/adversarial-review/README.md
+++ b/tools/adversarial-review/README.md
@@ -47,7 +47,9 @@ uvx --from <plugin>/tools/adversarial-review adversarial-review run --base origi
 uvx --from <plugin>/tools/adversarial-review adversarial-review run --target pr:123 --repo owner/name
 ```
 
-`<plugin>` is the installed `magpie-adversarial-review` plugin, for example `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>`.
+`<plugin>/tools/adversarial-review` is `~/.claude/magpie/adversarial-review` in Claude Code: the plugin's `SessionStart` hook ([`hooks/link-stable-path.sh`](hooks/link-stable-path.sh)) points that path at the installed version every session, so the sandbox exclusion names a fixed path instead of a wildcard where the version sits.
+A `*` there would also match spaces, letting a command with extra `uv` options spliced in at that position (`--with <any package>`, a second `--from`) run outside the sandbox.
+Other harnesses use the installed plugin directory, for example `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review`.
 
 `run` reads the reviewer list from `adversarial-review.md` (`.apache-magpie-local/` first, then `.apache-magpie-overrides/`, under `--project-root`), or from `--reviewers codex,copilot`.
 The model running the harness is skipped; `--self none` turns that off.
diff --git a/tools/adversarial-review/commands/adversarial-review.md b/tools/adversarial-review/commands/adversarial-review.md
index 9bb6b9443..7b81cdcd5 100644
--- a/tools/adversarial-review/commands/adversarial-review.md
+++ b/tools/adversarial-review/commands/adversarial-review.md
@@ -8,12 +8,12 @@ argument-hint: [branch | pr:<number> | diff:<path>]
 Run an adversarial review of a change by other models, with Apache Magpie's adversarial-review tool.
 
 1. Work out the target: `$ARGUMENTS` if it is not empty (`branch`, `pr:<number>` or `diff:<path>`), otherwise `branch`.
-2. Run exactly this command, as one line with nothing chained to it, replacing <version> and <target>:
+2. Run exactly this command, as one line with nothing chained to it, replacing <target>:
 
-   uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --target <target>
+   uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --target <target>
 
-   `<version>` is the last path component of `${CLAUDE_PLUGIN_ROOT}`. Type the path exactly
-   as shown, unquoted and with a literal `~`: that is the form the sandbox exclusion matches.
+   Type the path exactly as shown, unquoted and with a literal `~`: that is the form
+   the sandbox exclusion matches.
    For `branch`, add `--base <ref>` when the base is not `origin/main`, and
    `--title "<PR title>" --body-file <file>` when a PR title and body exist.
 3. Show each reviewer's status and reason, then the findings, most severe first,
diff --git a/tools/adversarial-review/hooks/link-stable-path.sh b/tools/adversarial-review/hooks/link-stable-path.sh
new file mode 100755
index 000000000..689f056a7
--- /dev/null
+++ b/tools/adversarial-review/hooks/link-stable-path.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# Session-start hook for the magpie-adversarial-review plugin.
+#
+# Points the fixed path ~/.claude/magpie/adversarial-review at the tool inside the
+# installed plugin version. The sandbox exclusion for `adversarial-review` names
+# that fixed path, so it needs no wildcard where the plugin version sits. A `*`
+# there also matches spaces: a command with extra `uv` options spliced in at that
+# position (`--with <any package>`, a second `--from`) would run outside the
+# sandbox once approved.
+#
+# Runs every session, so a marketplace upgrade moves the link without anyone
+# re-pointing it. It only ever replaces a symlink; a real file or directory at
+# the path is left alone and reported.
+set -euo pipefail
+
+# Drain any event JSON delivered on stdin (unused).
+cat >/dev/null 2>&1 || true
+
+root="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}"
+[ -n "$root" ] || exit 0
+target="$root/tools/adversarial-review"
+[ -d "$target" ] || exit 0
+
+link_dir="$HOME/.claude/magpie"
+link="$link_dir/adversarial-review"
+
+if [ -e "$link" ] && [ ! -L "$link" ]; then
+  echo "magpie-adversarial-review: $link exists and is not a symlink; not replacing it" >&2
+  exit 0
+fi
+if [ -L "$link" ] && [ "$(readlink "$link")" = "$target" ]; then
+  exit 0
+fi
+
+mkdir -p "$link_dir"
+ln -sfn "$target" "$link"
diff --git a/tools/adversarial-review/src/adversarial_review/commands.py b/tools/adversarial-review/src/adversarial_review/commands.py
index 38088f005..3b229939a 100644
--- a/tools/adversarial-review/src/adversarial_review/commands.py
+++ b/tools/adversarial-review/src/adversarial_review/commands.py
@@ -23,13 +23,15 @@
 invocation and present the report. The reviewer list is never written into a
 command; the tool reads the configured one, and skips the harness's own model.
 
-The invocation is always spelled
-`uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review …`,
-unquoted and with a literal `~`: that is the exact form the sandbox exclusion
-names, and a quoted or expanded path would silently stay sandboxed, where the
-reviewer CLIs cannot read their credentials. No command bakes a version in —
-Claude Code's reads it from `${CLAUDE_PLUGIN_ROOT}`, the others resolve the
-newest installed one at run time — so a plugin upgrade leaves every command valid.
+Claude Code's invocation is always spelled
+`uvx --from ~/.claude/magpie/adversarial-review …`, unquoted and with a literal
+`~`: that is the exact form the sandbox exclusion names, and a quoted or
+expanded path would silently stay sandboxed, where the reviewer CLIs cannot read
+their credentials. The path is a link the plugin's SessionStart hook points at
+the installed version, so the exclusion needs no wildcard where the version
+sits; a `*` there would also match options spliced in at that position. The
+other harnesses resolve the newest installed version at run time. No command
+bakes a version in, so a plugin upgrade leaves every command valid.
 """
 
 from __future__ import annotations
@@ -38,6 +40,7 @@
 
 HARNESSES = ("claude", "codex", "gemini", "copilot")
 PLUGIN_DIR = "~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review"
+STABLE_PATH = "~/.claude/magpie/adversarial-review"
 DESCRIPTION = "Adversarial review of this change by other models (Apache Magpie)"
 _FRONTMATTER = (
     "---\n"
@@ -52,7 +55,7 @@
 Run an adversarial review of a change by other models, with Apache Magpie's adversarial-review tool.
 
 1. Work out the target: `{args}` if it is not empty (`branch`, `pr:<number>` or `diff:<path>`), otherwise `branch`.
-2. Run exactly this command, as one line with nothing chained to it, replacing <version> and <target>:
+2. Run exactly this command, as one line with nothing chained to it, replacing {placeholders}:
 
    {invocation} --target <target>
 
@@ -66,8 +69,8 @@
 """
 
 _CLAUDE_VERSION = (
-    "`<version>` is the last path component of `${{CLAUDE_PLUGIN_ROOT}}`. Type the path exactly\n"
-    "   as shown, unquoted and with a literal `~`: that is the form the sandbox exclusion matches."
+    "Type the path exactly as shown, unquoted and with a literal `~`: that is the form\n"
+    "   the sandbox exclusion matches."
 )
 _OTHER_VERSION = (
     "`<version>` is the newest directory under `{plugin_dir}/`. The tool needs network\n"
@@ -80,6 +83,10 @@ def _invocation(plugin_dir: str) -> str:
     return f"uvx --from {plugin_dir}/<version>/tools/adversarial-review adversarial-review run"
 
 
+def _stable_invocation() -> str:
+    return f"uvx --from {STABLE_PATH} adversarial-review run"
+
+
 def render(harness: str, plugin_dir: str = PLUGIN_DIR) -> tuple[str, str]:
     """(path, content). The path is plugin-relative for Claude Code (the plugin ships it)
     and under the user's home for the others — never inside a repository.
@@ -87,14 +94,27 @@ def render(harness: str, plugin_dir: str = PLUGIN_DIR) -> tuple[str, str]:
     other = _OTHER_VERSION.format(plugin_dir=plugin_dir)
     if harness == "claude":
         body = _STEPS.format(
-            args="$ARGUMENTS", invocation=_invocation(PLUGIN_DIR), version_rule=_CLAUDE_VERSION.format()
+            args="$ARGUMENTS",
+            placeholders="<target>",
+            invocation=_stable_invocation(),
+            version_rule=_CLAUDE_VERSION.format(),
         )
         return "commands/adversarial-review.md", _FRONTMATTER + body
     if harness == "codex":
-        body = _STEPS.format(args="$ARGUMENTS", invocation=_invocation(plugin_dir), version_rule=other)
+        body = _STEPS.format(
+            args="$ARGUMENTS",
+            placeholders="<version> and <target>",
+            invocation=_invocation(plugin_dir),
+            version_rule=other,
+        )
         return "~/.codex/prompts/magpie-adversarial-review.md", _FRONTMATTER + body
     if harness == "gemini":
-        body = _STEPS.format(args="{{args}}", invocation=_invocation(plugin_dir), version_rule=other)
+        body = _STEPS.format(
+            args="{{args}}",
+            placeholders="<version> and <target>",
+            invocation=_invocation(plugin_dir),
+            version_rule=other,
+        )
         return (
             "~/.gemini/commands/magpie-adversarial-review.toml",
             f"description = {json.dumps(DESCRIPTION)}\nprompt = '''\n{body}'''\n",
diff --git a/tools/adversarial-review/tests/test_commands.py b/tools/adversarial-review/tests/test_commands.py
index c9cdd4db3..dcec5853a 100644
--- a/tools/adversarial-review/tests/test_commands.py
+++ b/tools/adversarial-review/tests/test_commands.py
@@ -26,7 +26,7 @@
 import pytest
 
 from adversarial_review import main
-from adversarial_review.commands import HARNESSES, PLUGIN_DIR, render
+from adversarial_review.commands import HARNESSES, PLUGIN_DIR, STABLE_PATH, render
 
 REPO = Path(__file__).resolve().parents[3]
 SHIPPED = Path(__file__).resolve().parents[1] / "commands" / "adversarial-review.md"
@@ -40,11 +40,13 @@ def test_harness_set():
     assert list(HARNESSES) == ["claude", "codex", "gemini", "copilot"]
 
 
-def test_claude_command_reads_the_version_from_the_plugin_root():
+def test_claude_command_runs_the_tool_from_the_stable_path():
     path, content = render("claude")
     assert path == "commands/adversarial-review.md"
     assert content.startswith("---\n# SPDX-License-Identifier: Apache-2.0\n")
-    assert "$ARGUMENTS" in content and "${CLAUDE_PLUGIN_ROOT}" in content
+    assert "$ARGUMENTS" in content
+    assert f"uvx --from {STABLE_PATH} adversarial-review run" in content
+    assert "<version>" not in content
     assert "unquoted and with a literal `~`" in content
 
 
@@ -79,19 +81,36 @@ def test_no_command_bakes_in_a_version_or_quotes_the_path():
     matches the sandbox exclusion."""
     for harness in HARNESSES:
         line = _invocation_line(render(harness)[1])
-        assert "/<version>/" in line
+        if harness == "claude":
+            assert line.startswith(f"uvx --from {STABLE_PATH} adversarial-review run")
+        else:
+            assert "/<version>/" in line
         assert '"' not in line.split(" adversarial-review run")[0]
 
 
-@pytest.mark.parametrize("harness", HARNESSES)
-def test_the_invocation_matches_the_sandbox_exclusion(harness):
+def _exclusion_pattern() -> str:
     excluded = json.loads((REPO / "tools" / "sandbox-lint" / "expected.json").read_text())["sandbox"][
         "excludedCommands"
     ]
     [pattern] = [p for p in excluded if "adversarial-review" in p]
-    line = _invocation_line(render(harness)[1]).replace("<version>", "0.2.0.dev202609240000")
-    line = re.sub(r"<target>", "branch", line)
-    assert fnmatch.fnmatchcase(line, pattern), (line, pattern)
+    return pattern
+
+
+def test_the_claude_invocation_matches_the_sandbox_exclusion():
+    """The exclusion is a Claude Code setting; the other harnesses ask to leave
+    their own sandbox instead."""
+    line = re.sub(r"<target>", "branch", _invocation_line(render("claude")[1]))
+    assert fnmatch.fnmatchcase(line, _exclusion_pattern()), line
+
+
+def test_the_sandbox_exclusion_has_no_wildcard_before_the_tool_name():
+    """A `*` where the plugin version sits also matches spaces, so it would let a
+    command with extra uv options spliced in there run outside the sandbox."""
+    pattern = _exclusion_pattern()
+    assert pattern.startswith(f"uvx --from {STABLE_PATH} adversarial-review ")
+    assert "*" not in pattern[:-1]
+    spliced = f"uvx --from {STABLE_PATH} --with evil --from /tmp/x adversarial-review run --target branch"
+    assert not fnmatch.fnmatchcase(spliced, pattern)
 
 
 @pytest.mark.parametrize("harness", ["claude", "codex", "gemini"])
diff --git a/tools/dev/blocks/pre-pr-adversarial-review.md b/tools/dev/blocks/pre-pr-adversarial-review.md
index 6f9e8cb2b..96c04ddb8 100644
--- a/tools/dev/blocks/pre-pr-adversarial-review.md
+++ b/tools/dev/blocks/pre-pr-adversarial-review.md
@@ -46,11 +46,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with
diff --git a/tools/dev/check-family-plugins.py b/tools/dev/check-family-plugins.py
index 221690cc4..456bf78b6 100644
--- a/tools/dev/check-family-plugins.py
+++ b/tools/dev/check-family-plugins.py
@@ -239,6 +239,7 @@
 # network and their own credentials), so like vetted-ops it has to run from the
 # installed plugin tree, where the agent calling it cannot rewrite it.
 ADVERSARIAL_REVIEW_ENTRY = "tools/adversarial-review/src/adversarial_review/cli.py"
+ADVERSARIAL_REVIEW_LINK_HOOK = "tools/adversarial-review/hooks/link-stable-path.sh"
 SUBSTRATE_PLUGINS: dict[str, dict] = {
     "magpie-agent-guard": {
         "description": (
@@ -312,7 +313,27 @@
             "tools/adversarial-review": "adversarial-review",
             "commands/adversarial-review.md": "adversarial-review/commands/adversarial-review.md",
         },
-        "must_resolve": (ADVERSARIAL_REVIEW_ENTRY, "commands/adversarial-review.md"),
+        # The entry point, the published command, and the hook that keeps the
+        # fixed path the sandbox exclusion names (~/.claude/magpie/adversarial-review)
+        # on this version.
+        "must_resolve": (
+            ADVERSARIAL_REVIEW_ENTRY,
+            "commands/adversarial-review.md",
+            ADVERSARIAL_REVIEW_LINK_HOOK,
+        ),
+        "hooks": {
+            "SessionStart": [
+                {
+                    "hooks": [
+                        {
+                            "type": "command",
+                            "command": f'bash "${{CLAUDE_PLUGIN_ROOT}}/{ADVERSARIAL_REVIEW_LINK_HOOK}"',
+                            "timeout": 10,
+                        }
+                    ],
+                }
+            ]
+        },
     },
 }
 
diff --git a/tools/sandbox-lint/expected.json b/tools/sandbox-lint/expected.json
index 4e24f9c6a..063f73eea 100644
--- a/tools/sandbox-lint/expected.json
+++ b/tools/sandbox-lint/expected.json
@@ -8,7 +8,7 @@
       "uvx --from ~/.claude/magpie/vetted-ops vetted-op-read *",
       "uv run --project ~/.claude/magpie/vetted-ops vetted-op-tracker *",
       "uvx --from ~/.claude/magpie/vetted-ops vetted-op-tracker *",
-      "uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review adversarial-review *",
+      "uvx --from ~/.claude/magpie/adversarial-review adversarial-review *",
       "~/.claude/scripts/magpie-run-evals.sh *"
     ],
     "filesystem": {
diff --git a/tools/sandbox-lint/src/sandbox_lint/__init__.py b/tools/sandbox-lint/src/sandbox_lint/__init__.py
index 1c116058e..79273ae2e 100644
--- a/tools/sandbox-lint/src/sandbox_lint/__init__.py
+++ b/tools/sandbox-lint/src/sandbox_lint/__init__.py
@@ -233,6 +233,18 @@ def check_invariants(settings: dict[str, Any], project_root: Path | None = None)
     if sandbox.get("enabled") is not True:
         errors.append("sandbox.enabled: must be true")
 
+    # Same matching as a Bash allow rule (see `permissions.allow` below): a `*`
+    # before the end also matches options spliced in at that position, and an
+    # excluded command runs outside the sandbox once approved (the
+    # adversarial-review exclusion once globbed the plugin version this way).
+    for entry in sandbox.get("excludedCommands", []) or []:
+        if isinstance(entry, str) and "*" in entry[:-1]:
+            errors.append(
+                f"sandbox.excludedCommands: {entry!r} has a '*' before the end of the command, "
+                "so any options inserted at that position also run outside the sandbox; "
+                "name the exact value there and use '*' only at the end"
+            )
+
     fs = sandbox.get("filesystem")
     if not isinstance(fs, dict):
         errors.append("sandbox.filesystem: missing or not an object")
diff --git a/tools/sandbox-lint/tests/test_validator.py b/tools/sandbox-lint/tests/test_validator.py
index 76d02ffc6..7303c76cf 100644
--- a/tools/sandbox-lint/tests/test_validator.py
+++ b/tools/sandbox-lint/tests/test_validator.py
@@ -189,6 +189,24 @@ def test_mid_rule_wildcard_in_allow_is_an_invariant_error(baseline: dict[str, An
     assert any(rule in e for e in errors), errors
 
 
+def test_mid_entry_wildcard_in_excluded_commands_is_an_invariant_error(
+    baseline: dict[str, Any],
+) -> None:
+    weakened = copy.deepcopy(baseline)
+    entry = (
+        "uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*"
+        "/tools/adversarial-review adversarial-review *"
+    )
+    weakened["sandbox"]["excludedCommands"].append(entry)
+    errors = check_invariants(weakened)
+    assert any(entry in e for e in errors), errors
+
+
+def test_adversarial_review_exclusion_names_the_stable_path(baseline: dict[str, Any]) -> None:
+    entries = [e for e in baseline["sandbox"]["excludedCommands"] if "adversarial-review" in e]
+    assert entries == ["uvx --from ~/.claude/magpie/adversarial-review adversarial-review *"]
+
+
 def test_catch_all_gh_ask_rule_is_an_invariant_error(baseline: dict[str, Any]) -> None:
     weakened = copy.deepcopy(baseline)
     weakened["permissions"]["ask"].append("Bash(gh *)")
diff --git a/tools/spec-loop/specs/agent-isolation-sandbox.md b/tools/spec-loop/specs/agent-isolation-sandbox.md
index 1031385b9..2a974d63e 100644
--- a/tools/spec-loop/specs/agent-isolation-sandbox.md
+++ b/tools/spec-loop/specs/agent-isolation-sandbox.md
@@ -297,10 +297,13 @@ The reference model is four layers, layered:
      `excludedCommands` and `ask`, and its tests assert the tracker
      dispatcher is excluded and asked but not allowed, and that
      `vetted-op` is never excluded.
-   - the adversarial-review tool, in its single-line installed-plugin
-     form (`uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review adversarial-review *`),
+   - the adversarial-review tool, in its single-line form
+     (`uvx --from ~/.claude/magpie/adversarial-review adversarial-review *`),
      because the reviewer CLIs need network and their own credentials
-     (#1371). The plugin cache is `Edit`-denied, and there is
+     (#1371). The path is the fixed link its plugin's `SessionStart` hook
+     maintains, never a `*` where the version sits, which would also match
+     `uv` options spliced in there; sandbox-lint rejects a `*` before the end
+     of any excluded command. The plugin cache and the link are `Edit`-denied, and there is
      deliberately no `allow` rule, so every run keeps its prompt.
      Install Step R wires it; verify check 14 checks the exclusion, the
      deny and the absence of an allow.
diff --git a/tools/spec-loop/specs/marketplace-distribution.md b/tools/spec-loop/specs/marketplace-distribution.md
index a4883069e..0dbc76f43 100644
--- a/tools/spec-loop/specs/marketplace-distribution.md
+++ b/tools/spec-loop/specs/marketplace-distribution.md
@@ -147,9 +147,11 @@ adopter-facing page.
   Each inherits the shared manifest metadata, declares no `skills`, exposes
   its `tools/<name>` through a symlink whose entry point must resolve, and
   declares hook wiring only where it has a hook: agent-guard's `PreToolUse`,
-  and vetted-ops' `SessionStart` hook (`tools/vetted-ops/hooks/link-stable-path.sh`,
-  #1406), which points the fixed path `~/.claude/magpie/vetted-ops` at the
-  installed version each session so permission rules never name a versioned
+  and the `SessionStart` hooks of vetted-ops (`tools/vetted-ops/hooks/link-stable-path.sh`,
+  #1406) and adversarial-review (`tools/adversarial-review/hooks/link-stable-path.sh`),
+  which point the fixed paths `~/.claude/magpie/vetted-ops` and
+  `~/.claude/magpie/adversarial-review` at the installed version each session
+  so permission rules and sandbox exclusions never name a versioned
   plugin-cache glob. `magpie-adversarial-review` additionally publishes a
   `commands/adversarial-review.md` link to the command file generated into
   `tools/adversarial-review/commands/`, which Claude Code exposes as

From 6a55c98a237d4ea586a7eee16afe1dcf2a3d159f Mon Sep 17 00:00:00 2001
From: Jarek Potiuk <potiuk@apache.org>
Date: Sat, 10 Oct 2026 09:38:10 +0100
Subject: [PATCH 2/2] fix(setup): verify the adversarial-review link resolves
 into the plugin

The sandbox exclusion now names ~/.claude/magpie/adversarial-review, so
what that path points at is what runs outside the sandbox. A broken link
leaves every review sandboxed, with every reviewer reporting unavailable;
a real file or directory there, or a link elsewhere, would run that code
unsandboxed, and the SessionStart hook refuses to replace anything that
is not a symlink. Check 14d reports the first as a warning and the second
as a failure.

Generated-by: Claude Opus 5
---
 docs/setup/secure-agent-setup.md                         | 4 +++-
 .../skills/isolated-setup-verify/conditional-checks.md   | 9 +++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/docs/setup/secure-agent-setup.md b/docs/setup/secure-agent-setup.md
index 55f97f1fe..cda6660a4 100644
--- a/docs/setup/secure-agent-setup.md
+++ b/docs/setup/secure-agent-setup.md
@@ -3413,7 +3413,9 @@ below and report ✓ done / ✗ missing / ⚠ partial, with the evidence
     the sandbox); the older `magpie-adversarial-review/*/tools/adversarial-review`
     exclusion is ✗ (its `*` also matches options spliced in where the version
     sits); a missing deny is ✗ (the exclusion runs that code
-    unsandboxed); an `allow` is ✗ (each run sends the change to other
+    unsandboxed); a broken `~/.claude/magpie/adversarial-review` link is ⚠
+    (reviews stay sandboxed), and a real file or directory there, or a link
+    outside the plugin cache, is ✗ (the exclusion would run it unsandboxed); an `allow` is ✗ (each run sends the change to other
     model providers and must keep its prompt).
 15. **Working directories under the read block**, if
     `permissions.blockReadsOutsideWorkingDirectories` is on in any
diff --git a/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md b/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
index cd8416890..e5075fc4e 100644
--- a/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
+++ b/plugins/magpie-setup/skills/isolated-setup-verify/conditional-checks.md
@@ -345,3 +345,12 @@ reading this file; read the section for a check whose condition holds.
     - **14c — no `allow`.** No `permissions.allow` entry matches the tool's
       invocation. One is ✗: each run sends the change to other model
       providers and must keep its prompt.
+    - **14d — the link resolves into the plugin.**
+      `~/.claude/magpie/adversarial-review` is a symlink to
+      `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review`,
+      and that directory exists. A broken link is ⚠: the exclusion matches
+      nothing that runs, so reviews stay sandboxed and every reviewer reports
+      `unavailable`; a new session lets the plugin's `SessionStart` hook
+      re-point it. A real file or directory at the path, or a link anywhere
+      else, is ✗: the exclusion would run that code outside the sandbox, and
+      the hook refuses to replace anything that is not a symlink.