@agfpd/iapeer 0.4.72 → 0.4.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.72",
+  "version": "0.4.73",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/launch/adapters/claude.ts

@@ -277,11 +277,15 @@ export const claudeAdapter: RuntimeAdapter = {
    *
    *   - '--dangerously-skip-permissions'  claude-start.sh:318, spawner.ts:776 —
    *     headless peer has no interactive owner to grant per-tool permission.
-   *   - '--disallowedTools','AskUserQuestion'  claude-start.sh:313/316,
-   *     spawner.ts:777 — AskUserQuestion would render in a TUI no headless peer
-   *     owner watches; the question goes "into the void". Default is the literal
-   *     'AskUserQuestion'; the per-peer override (PEER_DISALLOWED_TOOLS empty =
-   *     allow all) is install-time launch.env, not this path.
+   *   - '--disallowedTools', <list>  claude-start.sh:313/316, spawner.ts:777 —
+   *     AskUserQuestion would render in a TUI no headless peer owner watches; the
+   *     question goes "into the void", so it is disallowed by DEFAULT. The value is
+   *     an OPT-IN per-peer override via spec.disallowedTools (launch.env
+   *     PEER_DISALLOWED_TOOLS, merged in buildLaunchInvocation): UNDEFINED (the
+   *     fleet default) → the literal 'AskUserQuestion'; an EXPLICIT empty string →
+   *     the flag is OMITTED (allow all — e.g. to re-enable AskUserQuestion for a
+   *     throwaway peer); a non-empty value → that verbatim list. Only an explicitly
+   *     set env key changes behavior — the whole existing fleet is byte-identical.
    *   - '--add-dir','/'  grants the file/edit/bash tools access OUTSIDE cwd (the
    *     CLI equivalent of settings `permissions.additionalDirectories`). A peer
    *     reads/writes its memory vault (often an iCloud Obsidian dir) and ~/.iapeer,
@@ -314,11 +318,14 @@ export const claudeAdapter: RuntimeAdapter = {
     // active as a fail-SAFE backstop, and the separately-installed PreToolUse hook is
     // the primary interceptor (it fires regardless of mode — verified live 2.1.201).
     const gated = spec.approvalMode === 'gated'
+    // Opt-in disallowedTools (docs/17 — real-modal acceptance / general per-peer control). UNDEFINED →
+    // the hardcoded default 'AskUserQuestion' (fleet unchanged); explicit '' → omit the flag (allow all);
+    // a value → that verbatim list. A blank/whitespace value collapses to "omit" (the re-enable case).
+    const disallowed = (spec.disallowedTools === undefined ? 'AskUserQuestion' : spec.disallowedTools).trim()
     return [
       cfg.claudeBin,
       ...(gated ? ['--permission-mode', 'default'] : ['--dangerously-skip-permissions']),
-      '--disallowedTools',
-      'AskUserQuestion',
+      ...(disallowed ? ['--disallowedTools', disallowed] : []),
       '--add-dir',
       '/',
       ...(spec.systemPromptFile ? ['--system-prompt-file', spec.systemPromptFile] : []),

package/src/launch/invocation.ts

@@ -34,10 +34,15 @@ export function buildLaunchInvocation(
 ): LaunchInvocation {
   const env = cfg.env ?? process.env
   const launchEnv = readLaunchEnv(spec.cwd, spec.runtime)
-  const specWithArgs: LaunchSpec =
-    launchEnv.startArgs.length > 0
-      ? { ...spec, extraArgs: [...(spec.extraArgs ?? []), ...launchEnv.startArgs] }
-      : spec
+  const specWithArgs: LaunchSpec = {
+    ...spec,
+    ...(launchEnv.startArgs.length > 0 ? { extraArgs: [...(spec.extraArgs ?? []), ...launchEnv.startArgs] } : {}),
+    // launch.env PEER_DISALLOWED_TOOLS opt-in — an explicit spec.disallowedTools (caller override) wins;
+    // else the launch.env value (undefined = key absent → adapter default, fleet unchanged).
+    ...(spec.disallowedTools === undefined && launchEnv.disallowedTools !== undefined
+      ? { disallowedTools: launchEnv.disallowedTools }
+      : {}),
+  }
   const argv = adapter.buildArgv(specWithArgs, cfg)
   const childEnv: NodeJS.ProcessEnv = {
     ...env,

package/src/launch/types.ts

@@ -159,6 +159,11 @@ export interface LaunchSpec {
   resumeRef?: string
   /** Free-form extra CLI args (PEER_START_ARGS). */
   extraArgs?: string[]
+  /** claude `--disallowedTools` value (opt-in per-peer override via launch.env `PEER_DISALLOWED_TOOLS`).
+   *  UNDEFINED (the default for the whole fleet) → the adapter's hardcoded default (`AskUserQuestion`);
+   *  an EXPLICIT empty string → the flag is OMITTED (allow all — e.g. re-enable AskUserQuestion); a
+   *  non-empty value → that verbatim list. Only claude's buildArgv consumes it (codex has no such flag). */
+  disallowedTools?: string
   /** Peer intelligence (artificial/natural/absent). Used to enforce an adapter's
    *  intelligence gate at launch (telegram allows natural|absent). Optional: a doctrine-
    *  less throwaway may omit it, but an adapter that declares allowedIntelligences

package/src/storage/index.ts

@@ -215,6 +215,11 @@ export function peerLaunchEnvPath(cwd: string, runtime: Runtime): string {
 export interface LaunchEnv {
   /** Tokens from PEER_START_ARGS, appended AFTER the adapter's base argv flags. */
   startArgs: string[]
+  /** claude `--disallowedTools` override from PEER_DISALLOWED_TOOLS. UNDEFINED = the key was ABSENT
+   *  (→ the adapter default is used, the whole fleet unchanged); a string (incl. '') = the key was
+   *  PRESENT (opt-in: '' omits the flag, a value sets it). The absent-vs-empty distinction is the
+   *  opt-in gate — only an explicitly-present key changes behavior. */
+  disallowedTools?: string
   /** Other KEY=VALUE assignments — extra child-process env for the peer session. */
   env: Record<string, string>
 }
@@ -255,8 +260,15 @@ export function readLaunchEnv(cwd: string, runtime: Runtime): LaunchEnv {
   }
   const startArgsRaw = (env.PEER_START_ARGS ?? '').trim()
   delete env.PEER_START_ARGS // consumed as argv, not propagated as a child env var
+  // PEER_DISALLOWED_TOOLS — a LAUNCH DIRECTIVE (claude --disallowedTools), not a child env var. Preserve
+  // the ABSENT (undefined → default) vs PRESENT-EMPTY ('' → omit the flag) distinction: an unset key must
+  // leave the whole fleet on the hardcoded default. Consumed out of the child env like PEER_START_ARGS.
+  const hasDisallowed = Object.prototype.hasOwnProperty.call(env, 'PEER_DISALLOWED_TOOLS')
+  const disallowedTools = hasDisallowed ? env.PEER_DISALLOWED_TOOLS : undefined
+  delete env.PEER_DISALLOWED_TOOLS
   return {
     startArgs: startArgsRaw ? startArgsRaw.split(/\s+/) : [],
+    ...(disallowedTools !== undefined ? { disallowedTools } : {}),
     env,
   }
 }