fix(adversarial-review): name a fixed path in the sandbox exclusion, not a versioned glob

.claude/settings.json

@@ -7,7 +7,7 @@
       "uv run --project ~/.claude/magpie/vetted-ops vetted-op-read *",
       "uv run --project ~/.claude/magpie/vetted-ops vetted-op-tracker *",
       "uvx --from ~/.claude/magpie/vetted-ops vetted-op-read *",
-      "uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review adversarial-review *",
+      "uvx --from ~/.claude/magpie/adversarial-review adversarial-review *",
       "uvx --from ~/.claude/magpie/vetted-ops vetted-op-tracker *",
       "~/.claude/scripts/magpie-run-evals.sh *"
     ],

docs/setup/secure-agent-setup.md

@@ -507,13 +507,18 @@ below, annotated.
     // and their runner refuses any gh call outside repos/<tracker>/. It keeps
     // its `ask` below. Never exclude `vetted-op`: that runs the whole write
     // catalogue unsandboxed.
+    // The adversarial-review tool runs the reviewer CLIs, which need network
+    // and their own credentials. Like the vetted-ops entries, it names the
+    // fixed link its plugin's SessionStart hook maintains, never a `*` where
+    // the plugin version sits: that would also match `uv` options spliced in
+    // at that position and run them unsandboxed.
     "excludedCommands": [
       "gh *",
       "uv run --project ~/.claude/magpie/vetted-ops vetted-op-read *",
       "uvx --from ~/.claude/magpie/vetted-ops vetted-op-read *",
       "uv run --project ~/.claude/magpie/vetted-ops vetted-op-tracker *",
       "uvx --from ~/.claude/magpie/vetted-ops vetted-op-tracker *",
-      "uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review adversarial-review *"
+      "uvx --from ~/.claude/magpie/adversarial-review adversarial-review *"
     ],
     // The `lychee` link-check hook runs in OFFLINE mode (`offline =
     // true` in `.lychee.toml`): it validates only local cross-file and
@@ -3400,13 +3405,17 @@ below and report ✓ done / ✗ missing / ⚠ partial, with the evidence
 14. **Adversarial-review exclusion**, if the
     `magpie-adversarial-review` plugin is installed (n/a otherwise).
     `sandbox.excludedCommands` contains
-    `"uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review adversarial-review *"`,
+    `"uvx --from ~/.claude/magpie/adversarial-review adversarial-review *"`,
     `permissions.deny` contains
     `Edit(~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/**)`,
     and **no** `permissions.allow` entry covers the tool. A missing
     exclusion is ⚠ (every reviewer reports `unavailable` from inside
-    the sandbox); a missing deny is ✗ (the exclusion runs that code
-    unsandboxed); an `allow` is ✗ (each run sends the change to other
+    the sandbox); the older `magpie-adversarial-review/*/tools/adversarial-review`
+    exclusion is ✗ (its `*` also matches options spliced in where the version
+    sits); a missing deny is ✗ (the exclusion runs that code
+    unsandboxed); a broken `~/.claude/magpie/adversarial-review` link is ⚠
+    (reviews stay sandboxed), and a real file or directory there, or a link
+    outside the plugin cache, is ✗ (the exclusion would run it unsandboxed); an `allow` is ✗ (each run sends the change to other
     model providers and must keep its prompt).
 15. **Working directories under the read block**, if
     `permissions.blockReadsOutsideWorkingDirectories` is on in any

plugins/magpie-adversarial-review/.claude-plugin/plugin.json

@@ -8,5 +8,18 @@
   },
   "homepage": "https://magpie.apache.org/",
   "repository": "https://github.com/apache/magpie",
-  "license": "Apache-2.0"
+  "license": "Apache-2.0",
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/tools/adversarial-review/hooks/link-stable-path.sh\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
 }

plugins/magpie-issue/skills/fix-workflow/pre-pr-adversarial-review.md

@@ -52,11 +52,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with

plugins/magpie-pr-management/skills/code-review/adversarial.md

@@ -85,11 +85,11 @@ The agent runs the reviewers itself, at Step 5 of
    exclusion matches:
 
    ```bash
-   uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --reviewers <list> --target pr:<N> --repo <upstream> --project-root <repo-root> --repo-dir <empty-temp-dir>
+   uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --reviewers <list> --target pr:<N> --repo <upstream> --project-root <repo-root> --repo-dir <empty-temp-dir>
    ```
 
-   `<version>` is the newest directory under
-   `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. Omit
+   The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+   at the start of every session. Omit
    `--reviewers` when the list came from `adversarial-review.md`.
 
 - **What leaves the machine.** The PR's diff, title and body go to each

plugins/magpie-release-management/skills/announce-draft/SKILL.md

@@ -18,7 +18,7 @@ argument-hint: "<version> [--planning-issue <url>]"
 capability: capability:resolve
 surface_hash: sha256:edffafcd9d9948ab
 license: Apache-2.0
-measured_tokens: 6825
+measured_tokens: 6809
 ---
 
 <!-- SPDX-License-Identifier: Apache-2.0
@@ -418,11 +418,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with

plugins/magpie-release-management/skills/audit-report/SKILL.md

@@ -23,7 +23,7 @@ argument-hint: "<version> [--planning-issue <url>]"
 capability: capability:stats
 surface_hash: sha256:576d71b04f203cd8
 license: Apache-2.0
-measured_tokens: 6673
+measured_tokens: 6657
 ---
 
 <!-- SPDX-License-Identifier: Apache-2.0
@@ -418,11 +418,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with

plugins/magpie-release-management/skills/prepare/automated-signing.md

@@ -103,11 +103,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with

plugins/magpie-release-management/skills/prepare/post.md

@@ -74,11 +74,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with

plugins/magpie-release-management/skills/prepare/prep.md

@@ -202,11 +202,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with

plugins/magpie-repo-health/skills/audit-finding-fix/pre-pr-adversarial-review.md

@@ -52,11 +52,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with

plugins/magpie-security/skills/issue-fix/SKILL.md

@@ -22,7 +22,7 @@ capability:
   - capability:resolve
 surface_hash: sha256:9884ef304a3fad88
 license: Apache-2.0
-measured_tokens: 6080
+measured_tokens: 6064
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -315,11 +315,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with

plugins/magpie-security/skills/issue-import-from-pr/SKILL.md

@@ -20,7 +20,7 @@ argument-hint: "[pr-number] [repo:owner/name]"
 capability: capability:intake
 surface_hash: sha256:4a4f2d125526784d
 license: Apache-2.0
-measured_tokens: 8063
+measured_tokens: 8047
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -479,11 +479,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with

plugins/magpie-security/skills/issue-import-from-scan/SKILL.md

@@ -19,7 +19,7 @@ argument-hint: "[scan-source ...]  (one or more GitHub issues and/or report fold
 capability: capability:intake
 surface_hash: sha256:3aa895ba2115c1d9
 license: Apache-2.0
-measured_tokens: 5578
+measured_tokens: 5563
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -326,11 +326,11 @@ Accept per-finding or bulk grammar (`all` / `NN,MM` / `bucket:<name>` / `skip` /
      reviewer reports `unavailable`:
 
      ```bash
-     uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+     uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
      ```
 
-     `<version>` is the newest directory under
-     `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+     The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+     at the start of every session. The body
      file must sit in the checkout or a temporary directory; the tool refuses any
      other path. For a patch someone else proposed, replace `--base … --body-file
      …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with

plugins/magpie-security/skills/model-prepare/SKILL.md

@@ -19,7 +19,7 @@ argument-hint: "[repo-or-project]"
 capability: capability:authoring
 surface_hash: sha256:db4f1e33c6b3fab3
 license: Apache-2.0
-measured_tokens: 4647
+measured_tokens: 4631
 ---
 
 # Security model prepare
@@ -285,11 +285,11 @@ exclusion matches; a quoted or expanded path stays sandboxed and every
 reviewer reports `unavailable`:
 
 ```bash
-uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
 ```
 
-`<version>` is the newest directory under
-`~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+at the start of every session. The body
 file must sit in the checkout or a temporary directory; the tool refuses any
 other path. For a patch someone else proposed, replace `--base … --body-file
 …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with

plugins/magpie-security/skills/model-verify/SKILL.md

@@ -22,7 +22,7 @@ argument-hint: "[repo-or-model-path]"
 capability: capability:review
 surface_hash: sha256:03ecb6b8514583b2
 license: Apache-2.0
-measured_tokens: 5584
+measured_tokens: 5569
 ---
 
 # Security model verify
@@ -342,11 +342,11 @@ security-relevant build flags), §1.19 the machine-readable companions.
    reviewer reports `unavailable`:
 
    ```bash
-   uvx --from ~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/<version>/tools/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
+   uvx --from ~/.claude/magpie/adversarial-review adversarial-review run --project-root <adopter-repo> --repo-dir <checkout-being-pushed> --base <pr-base-ref> --title "<pr-title>" --body-file <pr-body-file>
    ```
 
-   `<version>` is the newest directory under
-   `~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/`. The body
+   The plugin points `~/.claude/magpie/adversarial-review` at its installed version
+   at the start of every session. The body
    file must sit in the checkout or a temporary directory; the tool refuses any
    other path. For a patch someone else proposed, replace `--base … --body-file
    …` with `--target pr:<number> --repo <owner/name>`; for a diff file, with