@@ -53,9 +53,11 @@ function glob(pattern: string, strict: boolean) {
   // The strict group refuses a flag in any argument position *and* refuses an
   // argument that still contains a shell expansion after unquoting. `cat $FILE`
   // executes against a path the matcher never saw, and `$(echo -rf) /` can expand
-  // to flags, so neither may inherit a saved `cat *` grant.
+  // to flags, so neither may inherit a saved `cat *` grant. Pathname globs
+  // (`*`, `?`, `[`) are expansions too: `cat */../../etc/passwd` must not match a
+  // saved literal grant as if the glob were an ordinary argument.
   if (escaped.endsWith(" .*"))
-    escaped = escaped.slice(0, -3) + (strict ? "( (?!-)[^\\s$`(){}]*)*" : "( .*)?")
+    escaped = escaped.slice(0, -3) + (strict ? "( (?!-)[^\\s$`(){}*?\\[\\]]*)*" : "( .*)?")
 
   const expression = new RegExp("^" + escaped + "$", process.platform === "win32" ? "si" : "s")
   if (compiled.size >= 512) {
@@ -79,5 +81,10 @@ export function match(input: string, pattern: string) {
  * flag-bearing or expansion-bearing invocations.
  */
 export function matchStrict(input: string, pattern: string) {
-  return glob(unquote(pattern), true).test(unquote(input).replaceAll("\\", "/"))
+  // Shell grants are stored as `"<literal prefix> *"` and must be unquoted so a
+  // quoted flag (`rm "-rf" /`) cannot masquerade as a literal argument. File-path
+  // patterns (external_directory globs, read/write paths) are not shell text, so
+  // match them verbatim — unquoting could collapse distinct filenames.
+  const shell = pattern.endsWith(" *")
+  return glob(shell ? unquote(pattern) : pattern, true).test((shell ? unquote(input) : input).replaceAll("\\", "/"))
 }
@@ -49,4 +49,20 @@ describe("Wildcard.match", () => {
     expect(Wildcard.matchStrict("git push origin main", "git push *")).toBe(true)
     expect(Wildcard.matchStrict("chmod 777 /etc", "chmod *")).toBe(true)
   })
+
+  test("matchStrict refuses pathname globs from inheriting a literal grant", () => {
+    expect(Wildcard.matchStrict("cat */../../../../etc/passwd", "cat *")).toBe(false)
+    expect(Wildcard.matchStrict("cat ?/etc/passwd", "cat *")).toBe(false)
+    expect(Wildcard.matchStrict("cat [a]/etc/passwd", "cat *")).toBe(false)
+    expect(Wildcard.matchStrict("cat a*/../../etc/passwd", "cat *")).toBe(false)
+    expect(Wildcard.matchStrict("rm *", "rm *")).toBe(false)
+    expect(Wildcard.matchStrict("cat foo.txt", "cat *")).toBe(true)
+    expect(Wildcard.matchStrict("rm file.txt", "rm *")).toBe(true)
+  })
+
+  test("matchStrict treats file-path patterns verbatim", () => {
+    expect(Wildcard.matchStrict("src/foo.ts", "src/*")).toBe(true)
+    expect(Wildcard.matchStrict('my"file.txt', "myfile.txt")).toBe(false)
+    expect(Wildcard.matchStrict("myfile.txt", "myfile.txt")).toBe(true)
+  })
 })
@@ -47,13 +47,25 @@ export function defs(client: Client, timeout?: number) {
 
 export function convertTool(mcpTool: MCPToolDef, client: Client, timeout?: number, server?: string): Tool {
   const bounded = boundSchema(mcpTool.inputSchema)
-  const schema = bounded === BOUNDED ? {} : (bounded as JSONSchema7)
+  // A non-object input schema never reaches here (the MCP SDK zod schema requires an
+  // object), but guard anyway so a malformed or null tool cannot throw a `TypeError`.
+  const schema = typeof bounded === "object" && bounded !== null ? (bounded as JSONSchema7) : {}
+  const properties = (schema.properties ?? {}) as NonNullable<JSONSchema7["properties"]>
+  // Pruning can drop a property while its `required` entry survives, and the root
+  // sets `additionalProperties: false`; the result is a schema no instance can
+  // satisfy, silently making the tool permanently uncallable. Restrict `required`
+  // to keys that still exist, dropping the keyword entirely when none survive.
+  const required = Array.isArray(schema.required)
+    ? schema.required.filter((key): key is string => typeof key === "string" && Object.hasOwn(properties, key))
+    : undefined
   const inputSchema: JSONSchema7 = {
     ...schema,
     type: "object",
-    properties: (schema.properties ?? {}) as JSONSchema7["properties"],
+    properties,
     additionalProperties: false,
   }
+  if (required && required.length > 0) inputSchema.required = required
+  else delete inputSchema.required
 
   return dynamicTool({
     description: describeTool(mcpTool.description, server),
@@ -186,13 +198,25 @@ function boundSchema(
   seen.add(value)
   counter.nodes++
   if (Array.isArray(value)) {
-    return value.flatMap((item) => {
-      const bounded = boundSchema(item, depth + 1, seen, counter)
-      return bounded === BOUNDED ? [] : [bounded]
+    const bounded = value.flatMap((item) => {
+      const child = boundSchema(item, depth + 1, seen, counter)
+      return child === BOUNDED ? [] : [child]
     })
+    // `anyOf`/`oneOf`/`allOf`/`enum` must be non-empty when present. If every member
+    // of a non-empty source array was pruned, return BOUNDED so the *parent* drops
+    // the keyword instead of emitting `[]`, which ajv 2020-12 rejects (`minItems`)
+    // and providers surface as a whole-manifest rejection. A genuinely empty source
+    // array (e.g. `required: []`) is preserved verbatim.
+    if (value.length > 0 && bounded.length === 0) return BOUNDED
+    return bounded
   }
   return Object.fromEntries(
     Object.entries(value).flatMap(([key, item]) => {
+      // Draft-07 tuple form (`items: [a, b]`) is invalid under 2020-12, where `items`
+      // must be a single schema. Normalize conservatively to an unconstrained schema
+      // instead of re-expressing positional constraints; the input was already
+      // non-2020-12, and the bounded output must not be.
+      if (key === "items" && Array.isArray(item)) return [[key, {}]]
       const bounded = boundSchema(item, depth + 1, seen, counter)
       return bounded === BOUNDED ? [] : [[key, bounded]]
     }),
 
@@ -20,7 +20,7 @@ import { ConfigMCPV1 } from "@opencode-ai/core/v1/config/mcp"
 import { NamedError } from "@opencode-ai/core/util/error"
 import { InstallationVersion } from "@opencode-ai/core/installation/version"
 import { withTimeout } from "@/util/timeout"
-import { sanitizePluginEnv } from "@/util/plugin-env"
+import { sanitizePluginEnv, userPluginEnvAllowlist } from "@/util/plugin-env"
 import { FSUtil } from "@opencode-ai/core/fs-util"
 import { McpOAuthPendingProvider, McpOAuthProvider, OAUTH_CALLBACK_PATH } from "./oauth-provider"
 import { McpOAuthCallback } from "./oauth-callback"
@@ -380,6 +380,12 @@ const layer = Layer.effect(
           status: { status: "failed" as const, error: `MCP server cwd escapes the workspace: ${cwd}` },
         }
       }
+      const sanitized = sanitizePluginEnv(mcp.environment ?? {}, userPluginEnvAllowlist())
+      if (sanitized.dropped.length > 0)
+        yield* Effect.logWarning("mcp.environment dropped variables not on the allowlist", {
+          key,
+          keys: sanitized.dropped,
+        })
       const transport = new StdioClientTransport({
         stderr: "pipe",
         command: cmd,
@@ -388,7 +394,7 @@ const layer = Layer.effect(
         env: {
           ...process.env,
           ...(cmd === "opencode" ? { BUN_BE_BUN: "1" } : {}),
-          ...sanitizePluginEnv(mcp.environment ?? {}),
+          ...sanitized.env,
         },
       })
 
 
@@ -29,21 +29,31 @@ export const assertExternalDirectoryEffect = Effect.fn("Tool.assertExternalDirec
   const resolved = FSUtil.resolveExisting(full)
   if (containsPath(full, ins) && containsPath(resolved, ins)) return false
 
-  // Prompt and persist the glob on the *resolved* target, not the lexical path.
-  // The approval cache matches request patterns against the saved glob, so keying
-  // it lexically would let a later symlink swap (`vendor -> /etc`) reuse a `vendor/*`
-  // grant on `/etc/*` without re-prompting.
+  // The persisted `always` grant is keyed on the *resolved* target: keying it
+  // lexically would let a later symlink swap (`vendor -> /etc`) reuse a
+  // `vendor/*` grant on `/etc/*` without re-prompting. The request `patterns`
+  // stay on the user-visible lexical path so a pre-approved config rule written
+  // against an alias/symlink path (macOS `/tmp` -> `/private/tmp`, vendored
+  // worktree aliases) still matches. `Permission.ask` requires *every* pattern to
+  // be allowed, so adding the resolved form here would force a prompt even when
+  // the lexical rule is allowed; the resolved target is surfaced through
+  // `metadata` instead. Trade-off: an interactively-approved symlink alias
+  // re-prompts on each call (its cached grant is the resolved path), which is the
+  // conservative direction.
   const kind = options?.kind ?? "file"
-  const dir = kind === "directory" ? resolved : path.dirname(resolved)
-  const glob =
+  const targetDir = (p: string) => (kind === "directory" ? p : path.dirname(p))
+  const toGlob = (p: string) =>
     process.platform === "win32"
-      ? FSUtil.normalizePathPattern(path.join(dir, "*"))
-      : path.join(dir, "*").replaceAll("\\", "/")
+      ? FSUtil.normalizePathPattern(path.join(p, "*"))
+      : path.join(p, "*").replaceAll("\\", "/")
+  const dir = targetDir(resolved)
+  const resolvedGlob = toGlob(dir)
+  const lexicalGlob = toGlob(targetDir(full))
 
   yield* ctx.ask({
     permission: "external_directory",
-    patterns: [glob],
-    always: [glob],
+    patterns: [lexicalGlob],
+    always: [resolvedGlob],
     metadata: {
       filepath: resolved,
       parentDir: dir,
 
@@ -179,6 +179,10 @@ function provider(text: string) {
 function dynamic(text: string, ps: boolean) {
   if (text.startsWith("(") || text.startsWith("@(")) return true
   if (text.includes("$(") || text.includes("${") || text.includes("`")) return true
+  // Pathname expansion is a shell expansion too: the argument the matcher sees
+  // (`cat *`) is not the path the shell executes (`cat /etc/passwd`), so a glob
+  // must never inherit a literal `always` grant.
+  if (/[?*[]/.test(text)) return true
   if (ps) return /\$(?!env:)/i.test(text)
   return text.includes("$")
 }
@@ -190,6 +194,14 @@ function prefix(text: string) {
   return text.slice(0, match.index)
 }
 
+function globAnchor(text: string) {
+  // A leading glob has no literal prefix to resolve. Keep one placeholder segment
+  // per glob metacharacter (so a trailing `..` traversal still cancels correctly),
+  // then drop the final, glob-selected segment. `*` anchors at cwd; `*/../..`
+  // anchors at the directory the traversal reaches, so it is still scanned.
+  return path.dirname(text.replace(/[*?[\]]/g, "_"))
+}
+
 function pathArgs(list: Part[], ps: boolean, cmd = false) {
   if (!ps) {
     return list
@@ -373,8 +385,13 @@ export const ShellTool = Tool.define(
 
     const argPath = Effect.fn("ShellTool.argPath")(function* (arg: string, cwd: string, ps: boolean, shell: string) {
       const text = ps ? expand(arg, cwd, shell) : home(unquote(arg))
-      const file = text && prefix(text)
-      if (!file || dynamic(file, ps)) return
+      if (!text) return
+      const file = prefix(text)
+      // A glob at position 0 has no literal prefix, but the shell still expands it
+      // relative to cwd and it can traverse out of the worktree (`*/../../etc`).
+      // Resolve the reachable directory so the external_directory scan still runs.
+      if (!file) return yield* resolvePath(globAnchor(text), cwd, shell)
+      if (dynamic(file, ps)) return
       const next = ps ? provider(file) : file
       if (!next) return
       return yield* resolvePath(next, cwd, shell)
@@ -432,9 +449,14 @@ export const ShellTool = Tool.define(
         { cwd, sessionID: ctx.sessionID, callID: ctx.callID },
         { env: {} },
       )
+      const sanitized = sanitizePluginEnv(extra.env)
+      if (sanitized.dropped.length > 0)
+        yield* Effect.logWarning("dropped plugin shell.env variables not on the allowlist", {
+          keys: sanitized.dropped,
+        })
       return {
         ...process.env,
-        ...sanitizePluginEnv(extra.env),
+        ...sanitized.env,
       }
     })
 
 
@@ -46,16 +46,44 @@ const ALLOWED_KEYS = new Set([
 ])
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/
 
-export function sanitizePluginEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
-  return Object.fromEntries(
+// Escape hatch for user-authored `mcp.environment` entries that the built-in
+// allowlist does not cover (`PYTHONPATH`, `VIRTUAL_ENV`, `AWS_PROFILE`, ...).
+// It is read from the parent process environment only, never from the env being
+// sanitized, so an untrusted plugin or MCP server cannot widen its own allowlist.
+const USER_ALLOWLIST_ENV = "OPENCODE_PLUGIN_ENV_ALLOW"
+
+export function userPluginEnvAllowlist(env: NodeJS.ProcessEnv = process.env) {
+  return new Set(
+    (env[USER_ALLOWLIST_ENV] ?? "")
+      .split(",")
+      .map((name) => name.trim().toUpperCase())
+      .filter((name) => ENV_NAME.test(name)),
+  )
+}
+
+export function sanitizePluginEnv(
+  env: NodeJS.ProcessEnv,
+  allow?: ReadonlySet<string>,
+): { env: NodeJS.ProcessEnv; dropped: string[] } {
+  const dropped: string[] = []
+  const kept = Object.fromEntries(
     Object.entries(env).filter(([key]) => {
-      if (!ENV_NAME.test(key)) return false
-      const upper = key.toUpperCase()
-      if (ALLOWED_PREFIXES.some((prefix) => upper.startsWith(prefix))) return true
-      if (ALLOWED_KEYS.has(upper)) return true
-      return ALLOWED_SUFFIXES.some((suffix) => upper.endsWith(suffix))
+      if (allowed(key, allow)) return true
+      // Names only, so a dropped credential value is never written to logs.
+      dropped.push(key)
+      return false
     }),
   )
+  return { env: kept, dropped }
+}
+
+function allowed(key: string, allow?: ReadonlySet<string>) {
+  if (!ENV_NAME.test(key)) return false
+  const upper = key.toUpperCase()
+  if (allow?.has(upper)) return true
+  if (ALLOWED_PREFIXES.some((prefix) => upper.startsWith(prefix))) return true
+  if (ALLOWED_KEYS.has(upper)) return true
+  return ALLOWED_SUFFIXES.some((suffix) => upper.endsWith(suffix))
 }
 
 export * as PluginEnv from "./plugin-env"