Fix CodeRabbit review issues and switch to domain changelog headings

- Remove dead `if not LOG_FILE` guard in redirect-builtin-agents.py
- Fix git global flag handling in stash/config index resolution
- Add multi-target extraction for rm/touch/mkdir/chmod/chown commands
- Switch CLAUDE.md changelog guidelines to domain headings
- Restructure [Unreleased] changelog to domain headings, fix test counts
- Add 12 new tests (289 total): global-flag stash tests, multi-target tests

Author: AnExiledDev

.devcontainer/CHANGELOG.md

@@ -513,8 +513,9 @@ def check_git_readonly(command: str) -> str | None:
                 # Resolve git global flags to find the real subcommand
                 # e.g. git -C /path --no-pager log -> subcommand is "log"
                 sub = None
+                sub_idx = 0
                 skip_next = False
-                for w in words[1:]:
+                for idx, w in enumerate(words[1:], start=1):
                     if skip_next:
                         skip_next = False
                         continue
@@ -524,6 +525,7 @@ def check_git_readonly(command: str) -> str | None:
                     if w.startswith("-"):
                         continue
                     sub = w
+                    sub_idx = idx
                     break
 
                 if sub is None:
@@ -545,18 +547,18 @@ def check_git_readonly(command: str) -> str | None:
                             "-l",
                             "--get-regexp",
                         }
-                        if not (set(words[2:]) & safe_flags):
+                        if not (set(words[sub_idx + 1 :]) & safe_flags):
                             return "Blocked: 'git config' is only allowed with --get or --list"
 
                     elif sub == "stash":
                         # Only allow "stash list" and "stash show"
-                        if len(words) <= 2:
+                        if len(words) <= sub_idx + 1:
                             return "Blocked: bare 'git stash' (equivalent to push) is not allowed in read-only mode"
-                        if words[2] not in ("list", "show"):
-                            return f"Blocked: 'git stash {words[2]}' is not allowed in read-only mode"
+                        if words[sub_idx + 1] not in ("list", "show"):
+                            return f"Blocked: 'git stash {words[sub_idx + 1]}' is not allowed in read-only mode"
 
                     else:
-                        for w in words[2:]:
+                        for w in words[sub_idx + 1 :]:
                             if w in restricted:
                                 return f"Blocked: 'git {sub} {w}' is not allowed in read-only mode"
 

.devcontainer/plugins/devs-marketplace/plugins/agent-system/scripts/guard-readonly-bash.py

@@ -42,9 +42,7 @@
 
 
 def log(message: str) -> None:
-    """Append a timestamped log entry if logging is enabled."""
-    if not LOG_FILE:
-        return
+    """Append a timestamped log entry."""
     try:
         with open(LOG_FILE, "a") as f:
             ts = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S")

.devcontainer/plugins/devs-marketplace/plugins/agent-system/scripts/redirect-builtin-agents.py

@@ -10,6 +10,7 @@
 
 import json
 import re
+import shlex
 import sys
 
 # Same patterns as guard-protected.py
@@ -86,6 +87,59 @@
 ]
 
 
+# Commands where all trailing non-flag arguments are file targets
+_MULTI_TARGET_CMDS = frozenset({"rm", "touch", "mkdir"})
+# Commands where the first non-flag arg is NOT a file (mode/owner), rest are
+_SKIP_FIRST_ARG_CMDS = frozenset({"chmod", "chown"})
+
+
+def _extract_multi_targets(command: str) -> list[str]:
+    """Extract all file targets from commands that accept multiple operands."""
+    try:
+        tokens = shlex.split(command)
+    except ValueError:
+        return []
+    if not tokens:
+        return []
+
+    # Handle prefixes like sudo, env, etc.
+    prefixes = {"sudo", "env", "nohup", "nice", "command"}
+    i = 0
+    while i < len(tokens) and tokens[i] in prefixes:
+        i += 1
+        # Skip sudo flags like -u root
+        if i > 0 and tokens[i - 1] == "sudo":
+            while i < len(tokens) and tokens[i].startswith("-"):
+                i += 1
+                if i < len(tokens) and not tokens[i].startswith("-"):
+                    i += 1  # skip flag argument
+        # Skip env VAR=val
+        if i > 0 and tokens[i - 1] == "env":
+            while i < len(tokens) and "=" in tokens[i]:
+                i += 1
+    if i >= len(tokens):
+        return []
+    cmd = tokens[i]
+
+    if cmd not in _MULTI_TARGET_CMDS and cmd not in _SKIP_FIRST_ARG_CMDS:
+        return []
+
+    # Collect non-flag arguments
+    args = []
+    j = i + 1
+    while j < len(tokens):
+        if tokens[j].startswith("-"):
+            j += 1
+            continue
+        args.append(tokens[j])
+        j += 1
+
+    if cmd in _SKIP_FIRST_ARG_CMDS and args:
+        args = args[1:]  # First arg is mode/owner, not a file
+
+    return args
+
+
 def extract_write_targets(command: str) -> list[str]:
     """Extract file paths that the command writes to."""
     targets = []
@@ -94,6 +148,10 @@ def extract_write_targets(command: str) -> list[str]:
             target = match.group(1).strip("'\"")
             if target:
                 targets.append(target)
+    # Supplement with multi-target extraction for commands like rm, touch, chmod
+    for target in _extract_multi_targets(command):
+        if target not in targets:
+            targets.append(target)
     return targets
 
 

.devcontainer/plugins/devs-marketplace/plugins/protected-files-guard/scripts/guard-protected-bash.py

@@ -18,8 +18,7 @@ See `.devcontainer/CLAUDE.md` for full devcontainer documentation.
 Every change MUST have a corresponding entry in `.devcontainer/CHANGELOG.md`.
 
 - New features, enhancements, fixes, and removals each get their own bullet
-- Group related changes under the appropriate `### Added`, `### Changed`, `### Fixed`, or `### Removed` heading
-- Use sub-headings (`####`) to organize by area (e.g., Workspace Scope Guard, Features, Configuration)
+- Group related changes under domain headings (`###`) by area (e.g., `### Security`, `### Agent System`, `### Documentation`, `### Configuration`)
 - If an unreleased version section doesn't exist, add changes to the current version's section
 - Write entries from the user's perspective — what changed, not how it was implemented
 

CLAUDE.md

@@ -262,6 +262,5 @@ def test_exception_causes_exit_code_2(self):
             text=True,
         )
         assert result.returncode == 2, (
-            f"Expected exit code 2, got {result.returncode}. "
-            f"stderr: {result.stderr}"
+            f"Expected exit code 2, got {result.returncode}. stderr: {result.stderr}"
         )

tests/plugins/test_guard_protected.py

@@ -284,9 +284,59 @@ def test_extended_pattern_blocks_protected_file(self, command, expected_target):
         targets = guard_protected_bash.extract_write_targets(command)
         assert expected_target in targets
         is_protected, message = guard_protected_bash.check_path(expected_target)
-        assert is_protected is True, (
-            f"Expected '{expected_target}' to be protected"
+        assert is_protected is True, f"Expected '{expected_target}' to be protected"
+        assert message != ""
+
+
+# ---------------------------------------------------------------------------
+# Multi-target extraction
+# ---------------------------------------------------------------------------
+
+
+class TestMultiTargetExtraction:
+    """Commands with multiple file operands should check all targets."""
+
+    @pytest.mark.parametrize(
+        "command, expected_target",
+        [
+            ("rm safe.txt .env", ".env"),
+            ("touch a.txt .secrets", ".secrets"),
+            ("chmod 644 safe.txt .env", ".env"),
+            ("rm -rf safe/ .env", ".env"),
+            ("mkdir safe_dir .ssh/keys", ".ssh/keys"),
+        ],
+        ids=[
+            "rm-multi-catches-env",
+            "touch-multi-catches-secrets",
+            "chmod-multi-catches-env",
+            "rm-rf-multi-catches-env",
+            "mkdir-multi-catches-ssh",
+        ],
+    )
+    def test_multi_target_extracts_protected(self, command, expected_target):
+        targets = guard_protected_bash.extract_write_targets(command)
+        assert expected_target in targets, (
+            f"Expected '{expected_target}' in extracted targets {targets}"
         )
+
+    @pytest.mark.parametrize(
+        "command, expected_target",
+        [
+            ("rm safe.txt .env", ".env"),
+            ("touch a.txt .secrets", ".secrets"),
+            ("chmod 644 safe.txt .env", ".env"),
+        ],
+        ids=[
+            "rm-blocks-env",
+            "touch-blocks-secrets",
+            "chmod-blocks-env",
+        ],
+    )
+    def test_multi_target_blocks_protected(self, command, expected_target):
+        targets = guard_protected_bash.extract_write_targets(command)
+        assert expected_target in targets
+        is_protected, message = guard_protected_bash.check_path(expected_target)
+        assert is_protected is True
         assert message != ""
 
 
@@ -324,6 +374,5 @@ def test_exception_causes_exit_code_2(self):
             text=True,
         )
         assert result.returncode == 2, (
-            f"Expected exit code 2, got {result.returncode}. "
-            f"stderr: {result.stderr}"
+            f"Expected exit code 2, got {result.returncode}. stderr: {result.stderr}"
         )

tests/plugins/test_guard_protected_bash.py

@@ -324,3 +324,28 @@ class TestGitReadonlyAllowed:
     )
     def test_readonly_commands_allowed(self, cmd: str) -> None:
         assert_allowed(guard_readonly_bash.check_git_readonly(cmd), cmd)
+
+
+# ---------------------------------------------------------------------------
+# 10. check_git_readonly - global flags with stash subcommand
+# ---------------------------------------------------------------------------
+
+
+class TestGitReadonlyGlobalFlagsStash:
+    """Ensure git global flags (-C, etc.) don't break stash sub-action detection."""
+
+    def test_stash_list_with_global_flag_allowed(self) -> None:
+        cmd = "git -C /some/path stash list"
+        assert_allowed(guard_readonly_bash.check_git_readonly(cmd), cmd)
+
+    def test_stash_show_with_global_flag_allowed(self) -> None:
+        cmd = "git -C /some/path stash show"
+        assert_allowed(guard_readonly_bash.check_git_readonly(cmd), cmd)
+
+    def test_stash_push_with_global_flag_blocked(self) -> None:
+        cmd = "git -C /some/path stash push"
+        assert_blocked(guard_readonly_bash.check_git_readonly(cmd), cmd)
+
+    def test_stash_drop_with_global_flag_blocked(self) -> None:
+        cmd = "git -C /some/path stash drop"
+        assert_blocked(guard_readonly_bash.check_git_readonly(cmd), cmd)