@cargo-ai/cli 1.0.94 → 1.0.96

package/build/commands/ai/chat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/chat.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAGxC,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAyI7E"}
+{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/chat.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAGxC,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAyI7E"}

package/build/commands/ai/chat.js

@@ -1,3 +1,4 @@
+import { AiUtils } from "@cargo-ai/types";
 import { handleApiCall, outputJson, parseJson } from "../runHandler.js";
 export function registerChatCommands(parent, getApi) {
     const chat = parent
@@ -41,7 +42,7 @@ export function registerChatCommands(parent, getApi) {
         .option("--name <name>", "Chat name (string)")
         .option("--agent-uuid <uuid>", "Agent UUID to associate with (string)")
         .option("--release-uuid <uuid>", "Release UUID to pin to (string)")
-        .option("--harness-slug <slug>", "Coding-agent runtime. Currently only claudeCode. When omitted, later turns use the agent's pinned release, if any.")
+        .option("--harness-slug <slug>", `Coding-agent runtime: ${AiUtils.harnessSlugs.join(", ")}. When omitted, later turns use the agent's pinned release, if any.`)
         .option("--repository <json>", "Git workspace for a coding harness (JSON object: connectorUuid, repository as owner/name, defaultBranch, rootDirectory, env)")
         .addHelpText("after", `
 Examples:

package/build/commands/ai/message.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/message.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAoCxC,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAmTN"}
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/message.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAoCxC,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAmTN"}

package/build/commands/ai/message.js

@@ -1,3 +1,4 @@
+import { AiUtils } from "@cargo-ai/types";
 import { parseBooleanOption } from "../../utils/booleanOption.js";
 import { loadCompiledAgent, resolveCompiledAgentFromState, } from "../../utils/loadCompiledAgent.js";
 import { ExitCodes, failWith, handleApiCall, info, outputJson, parseJson, pollUntilFinished, } from "../runHandler.js";
@@ -27,7 +28,7 @@ export function registerMessageCommands(parent, getApi) {
         .option("--integration-slug <slug>", "Integration slug (string)")
         .option("--connector-uuid <uuid>", "Connector UUID (string)")
         .option("--language-model-slug <slug>", "Language model slug (string)")
-        .option("--harness-slug <slug>", "Coding-agent runtime. Currently only claudeCode. When omitted, later turns use the agent's pinned release, if any.")
+        .option("--harness-slug <slug>", `Coding-agent runtime: ${AiUtils.harnessSlugs.join(", ")}. When omitted, later turns use the agent's pinned release, if any.`)
         .option("--repository <json>", "Git workspace for a coding harness (JSON object: connectorUuid, repository as owner/name, defaultBranch, rootDirectory, env)")
         .option("--output <json>", 'Output format for the assistant message (JSON object, e.g. \'{"type":"text"}\' or \'{"type":"jsonSchema","jsonSchema":{...}}\'). Defaults to text when omitted.')
         .option("--wait-until-finished [true|false]", "Poll the assistant message until finished before returning (defaults to true when passed bare)", parseBooleanOption)

package/build/commands/ai/release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/release.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAIxC,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CA0VN"}
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../../src/commands/ai/release.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAIxC,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAoVN"}

package/build/commands/ai/release.js

@@ -1,3 +1,4 @@
+import { AiUtils } from "@cargo-ai/types";
 import { parseBooleanOption } from "../../utils/booleanOption.js";
 import { handleApiCall, outputJson, parseJson } from "../runHandler.js";
 export function registerReleaseCommands(parent, getApi) {
@@ -63,7 +64,7 @@ export function registerReleaseCommands(parent, getApi) {
         .option("--integration-slug <slug>", "LLM integration slug (string)")
         .option("--connector-uuid <uuid>", "Connector UUID (string)")
         .option("--language-model-slug <slug>", "Language model slug (string)")
-        .option("--harness-slug <slug>", "Coding-agent runtime. Currently only claudeCode.")
+        .option("--harness-slug <slug>", `Coding-agent runtime: ${AiUtils.harnessSlugs.join(", ")}.`)
         .option("--repository <json>", "Git workspace for a coding harness (JSON object: connectorUuid, repository as owner/name, defaultBranch, rootDirectory, env)")
         .option("--actions <json>", "Actions configuration (JSON array of action objects)")
         .option("--mcp-clients <json>", "MCP clients configuration (JSON array of MCP client objects)")
@@ -126,9 +127,9 @@ Set "isReadOnly": false on a model resource to grant the agent write tools (inse
         .command("deploy-draft")
         .description("Deploy the draft release to production")
         .requiredOption("--agent-uuid <uuid>", "Agent UUID (string, required)")
-        .option("--integration-slug <slug>", "LLM integration slug (string). Unused when --harness-slug is set.")
-        .option("--language-model-slug <slug>", "Language model slug (string). Unused when --harness-slug is set.")
-        .option("--harness-slug <slug>", "Coding-agent runtime. Currently only claudeCode. When set, --integration-slug and --language-model-slug are unused.")
+        .option("--integration-slug <slug>", "LLM integration slug (string)")
+        .option("--language-model-slug <slug>", "Language model slug (string)")
+        .option("--harness-slug <slug>", `Coding-agent runtime: ${AiUtils.harnessSlugs.join(", ")}.`)
         .option("--repository <json>", "Git workspace for a coding harness (JSON object: connectorUuid, repository as owner/name, defaultBranch, rootDirectory, env)")
         .option("--version <version>", "Semver release version, e.g. 1.0.0 (string, auto-incremented if omitted)")
         .requiredOption("--actions <json>", "Actions configuration (JSON array of action objects, required)")
@@ -152,12 +153,12 @@ Examples:
 
   $ cargo-ai ai release deploy-draft --agent-uuid <uuid> \\
       --harness-slug claudeCode \\
+      --integration-slug anthropic --language-model-slug claude-sonnet-5 \\
       --repository '{"connectorUuid":"<github-uuid>","repository":"acme/app"}' \\
       --actions '[]' --mcp-clients '[]' --resources '[]' \\
       --capabilities '[]' --suggested-actions '[]'
 
-A tool-loop agent needs --integration-slug and --language-model-slug. A
---harness-slug claudeCode agent does not — those flags are unused.`)
+`)
         .action(async (opts) => {
         const api = getApi();
         const result = await handleApiCall(() => api.ai.release.deployDraft({

package/build/commands/ask/harness/approvals.d.ts

@@ -0,0 +1,7 @@
+export declare function isAutoApproved(toolName: string, options?: {
+    unattended?: boolean;
+}): boolean;
+export declare const DENIED_TOOL_REASON = "Spawning a subagent is not available in this session. Do the work in this turn instead, asking for each tool you need.";
+/** Exported for tests. */
+export declare function isAlwaysDenied(toolName: string): boolean;
+//# sourceMappingURL=approvals.d.ts.map

package/build/commands/ask/harness/approvals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/approvals.ts"],"names":[],"mappings":"AA0CA,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACjC,OAAO,CA2BT;AAqBD,eAAO,MAAM,kBAAkB,2HAC2F,CAAC;AAE3H,0BAA0B;AAC1B,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/build/commands/ask/harness/approvals.js

@@ -0,0 +1,81 @@
+import { CARGO_MCP_SERVER_NAME } from "./mcp.js";
+import { CARGO_AGENT_MCP_NAME_PREFIX } from "./release.js";
+/**
+ * Claude Code's own bookkeeping. `allow-reads` classifies these as edits
+ * because they call a write-shaped tool, but they touch nothing outside the
+ * session — prompting for a todo-list update is noise, and Claude Code
+ * rewrites its list on every step of any multi-step task.
+ */
+const AUTO_APPROVED_TOOL_NAMES = new Set([
+    "TodoWrite",
+    "EnterPlanMode",
+    "ExitPlanMode",
+    "TaskCreate",
+    "TaskUpdate",
+    "TaskStop",
+]);
+/**
+ * Cargo's MCP tools run unattended in an interactive session, `execute_action`
+ * included: a turn can spend credits and write to a connected system on its
+ * own. That is the deliberate trade for a chat that answers without being
+ * nursed, and it is defensible only because this server reaches the workspace
+ * with the user's own credentials — it can do nothing they could not do from
+ * the CLI. `--print` is the exception: there is nobody to approve, so mutating
+ * workspace tools are denied there.
+ *
+ * Only this server's tools. Claude Code names them `mcp__<server>__<tool>`,
+ * and matching the bare `mcp__` was safe only while Ask owned the config
+ * directory: `CLAUDE_CONFIG_DIR` reinstates the user's own MCP servers, whose
+ * tools write and shell out with none of the above reasoning behind them.
+ * Those go through approval like anything else that touches the machine.
+ *
+ * Built from the mount key so renaming the server cannot silently widen this.
+ */
+const CARGO_MCP_TOOL_PREFIX = `mcp__${CARGO_MCP_SERVER_NAME}__`;
+const CARGO_AGENT_MCP_TOOL_PREFIX = `mcp__${CARGO_AGENT_MCP_NAME_PREFIX}`;
+const CARGO_EXECUTE_ACTION_TOOL = `${CARGO_MCP_TOOL_PREFIX}execute_action`;
+const CARGO_EXECUTE_ACTION_BATCH_TOOL = `${CARGO_MCP_TOOL_PREFIX}execute_action_batch`;
+export function isAutoApproved(toolName, options) {
+    const unattended = options === undefined ? false : options.unattended === true;
+    if (unattended === true) {
+        if (toolName === CARGO_EXECUTE_ACTION_TOOL) {
+            return false;
+        }
+        if (toolName === CARGO_EXECUTE_ACTION_BATCH_TOOL) {
+            return false;
+        }
+        if (toolName.startsWith(CARGO_AGENT_MCP_TOOL_PREFIX) === true) {
+            return false;
+        }
+    }
+    if (toolName.startsWith(CARGO_MCP_TOOL_PREFIX) === true) {
+        return true;
+    }
+    if (toolName.startsWith(CARGO_AGENT_MCP_TOOL_PREFIX) === true) {
+        return true;
+    }
+    return AUTO_APPROVED_TOOL_NAMES.has(toolName);
+}
+/**
+ * `Agent` spawns a subagent to run a task of its own, and approving one is a
+ * different kind of decision from approving a `Bash`: the subagent runs its
+ * own tools, can be asked for with `mode: "bypassPermissions"`, and whether
+ * its calls come back here for individual approval is not something we control
+ * or currently know.
+ *
+ * The refusal that actually stops it is in `claudeConfig.ts`, as a deny rule
+ * in Claude Code's own settings — this never fired, because the approval
+ * request it waits for is never sent. The bridge writes `ask` rules only for
+ * the tools in its `NATIVE_TOOL_KINDS` map, the subagent tools are not in it,
+ * and so `allow-reads` left them running unattended.
+ *
+ * Kept as the second line: a user who points `CLAUDE_CONFIG_DIR` at their own
+ * Claude Code config gets no deny rule written for them, and a future bridge
+ * that does surface the approval should find an answer waiting.
+ */
+const DENIED_TOOL_NAMES = new Set(["Agent", "Task"]);
+export const DENIED_TOOL_REASON = "Spawning a subagent is not available in this session. Do the work in this turn instead, asking for each tool you need.";
+/** Exported for tests. */
+export function isAlwaysDenied(toolName) {
+    return DENIED_TOOL_NAMES.has(toolName);
+}

package/build/commands/ask/harness/artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/artifacts.ts"],"names":[],"mappings":"AAwBA,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI,CAGzE"}

package/build/commands/ask/harness/askUserQuestion.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Claude Code's `AskUserQuestion` — a structured multiple-choice prompt.
+ *
+ * The native picker cannot run here: `allow-reads` classifies it as readonly,
+ * so Claude Code starts it without asking us, then waits on a UI this session
+ * does not have. The native tool is withheld for that reason, via session
+ * `disallowedTools` — not a settings.json deny of the same name, which would
+ * also disable this host replacement. This session implements the tool as a
+ * host tool: the questions are shown in Ask's own picker, and the answers are
+ * the tool result.
+ *
+ * The input schema has to name `questions`. The Claude Code bridge turns host
+ * tool schemas into a Zod object shape; an empty shape strips every argument,
+ * and the picker sees `{}`.
+ */
+import { jsonSchema } from "ai";
+export declare const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
+export declare const ASK_USER_QUESTION_DENIED_REASON = "Nobody is at the terminal to answer. Ask in your reply text instead.";
+export declare const ASK_USER_QUESTION_MISSING_INPUT_REASON = "AskUserQuestion requires `questions`: an array of 1\u20134 items, each with `question`, `header`, `options` (each `{ label, description }`), and `multiSelect`. Call it again with those fields filled in.";
+type AskUserQuestionHostTool = {
+    description: string;
+    inputSchema: ReturnType<typeof jsonSchema>;
+    execute: (data: unknown) => Promise<unknown>;
+};
+export type AskUserQuestionAsk = (input: unknown) => Promise<Record<string, string> | undefined>;
+type BuiltinToolFiltering = {
+    mode: "allow" | "deny";
+    toolNames: string[];
+};
+/**
+ * Withhold Claude Code's native `AskUserQuestion` without dropping a host tool
+ * of the same name.
+ *
+ * HarnessAgent `inactiveTools` cannot do this: it also filters the user tool
+ * out of `toolSpecs`, so the replacement is never registered. A settings.json
+ * deny of `AskUserQuestion` matches the host tool too. Merging a deny into the
+ * session's builtin filtering becomes `disallowedTools` for the native tool
+ * only; host `execute` still runs.
+ */
+export declare function denyNativeAskUserQuestion(existing: BuiltinToolFiltering | undefined): BuiltinToolFiltering;
+/**
+ * Host-side `AskUserQuestion`. Same name as the builtin so the model keeps
+ * calling it; HarnessAgent runs `execute` on the host instead of Claude Code.
+ */
+export declare function buildAskUserQuestionHostTool(getAsk: () => AskUserQuestionAsk | undefined): Record<string, AskUserQuestionHostTool>;
+export type AskUserQuestionOption = {
+    label: string;
+    description: string | undefined;
+};
+export type AskUserQuestionItem = {
+    question: string;
+    header: string | undefined;
+    options: AskUserQuestionOption[];
+    multiSelect: boolean;
+};
+/**
+ * Pull the questions out of a tool input, whether the bridge sent a JSON
+ * string or the parsed object.
+ */
+export declare function readAskUserQuestions(toolInput: unknown): AskUserQuestionItem[] | undefined;
+/** First question, for the spinner — not the whole JSON payload. */
+export declare function summarizeAskUserQuestion(toolInput: unknown): string | undefined;
+/**
+ * Told to the model as the denial reason so it can continue with the answers
+ * rather than asking again.
+ */
+export declare function formatAskUserQuestionAnswers(answers: Record<string, string>): string;
+export {};
+//# sourceMappingURL=askUserQuestion.d.ts.map

package/build/commands/ask/harness/askUserQuestion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"askUserQuestion.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/askUserQuestion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAoB,MAAM,IAAI,CAAC;AAElD,eAAO,MAAM,2BAA2B,oBAAoB,CAAC;AAE7D,eAAO,MAAM,+BAA+B,yEAC4B,CAAC;AAEzE,eAAO,MAAM,sCAAsC,+MACsJ,CAAC;AA4C1M,KAAK,uBAAuB,GAAG;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAC/B,KAAK,EAAE,OAAO,KACX,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC;AAEjD,KAAK,oBAAoB,GAAG;IAC1B,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,GACzC,oBAAoB,CAsBtB;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,kBAAkB,GAAG,SAAS,GAC3C,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CA2BzC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,OAAO,GACjB,mBAAmB,EAAE,GAAG,SAAS,CA0BnC;AAED,oEAAoE;AACpE,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,OAAO,GACjB,MAAM,GAAG,SAAS,CAkBpB;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAER"}

package/build/commands/ask/harness/askUserQuestion.js

@@ -0,0 +1,218 @@
+/**
+ * Claude Code's `AskUserQuestion` — a structured multiple-choice prompt.
+ *
+ * The native picker cannot run here: `allow-reads` classifies it as readonly,
+ * so Claude Code starts it without asking us, then waits on a UI this session
+ * does not have. The native tool is withheld for that reason, via session
+ * `disallowedTools` — not a settings.json deny of the same name, which would
+ * also disable this host replacement. This session implements the tool as a
+ * host tool: the questions are shown in Ask's own picker, and the answers are
+ * the tool result.
+ *
+ * The input schema has to name `questions`. The Claude Code bridge turns host
+ * tool schemas into a Zod object shape; an empty shape strips every argument,
+ * and the picker sees `{}`.
+ */
+import { jsonSchema } from "ai";
+export const ASK_USER_QUESTION_TOOL_NAME = "AskUserQuestion";
+export const ASK_USER_QUESTION_DENIED_REASON = "Nobody is at the terminal to answer. Ask in your reply text instead.";
+export const ASK_USER_QUESTION_MISSING_INPUT_REASON = "AskUserQuestion requires `questions`: an array of 1–4 items, each with `question`, `header`, `options` (each `{ label, description }`), and `multiSelect`. Call it again with those fields filled in.";
+const ASK_USER_QUESTION_JSON_SCHEMA = {
+    type: "object",
+    properties: {
+        questions: {
+            type: "array",
+            description: "1–4 multiple-choice questions to present to the user in this terminal.",
+            items: {
+                type: "object",
+                properties: {
+                    question: {
+                        type: "string",
+                        description: "The question to ask.",
+                    },
+                    header: {
+                        type: "string",
+                        description: "Short label shown above the question.",
+                    },
+                    options: {
+                        type: "array",
+                        items: {
+                            type: "object",
+                            properties: {
+                                label: { type: "string" },
+                                description: { type: "string" },
+                                preview: { type: "string" },
+                            },
+                            required: ["label", "description"],
+                        },
+                    },
+                    multiSelect: {
+                        type: "boolean",
+                        description: "Whether the user may pick more than one option.",
+                    },
+                },
+                required: ["question", "header", "options", "multiSelect"],
+            },
+        },
+    },
+    required: ["questions"],
+};
+/**
+ * Withhold Claude Code's native `AskUserQuestion` without dropping a host tool
+ * of the same name.
+ *
+ * HarnessAgent `inactiveTools` cannot do this: it also filters the user tool
+ * out of `toolSpecs`, so the replacement is never registered. A settings.json
+ * deny of `AskUserQuestion` matches the host tool too. Merging a deny into the
+ * session's builtin filtering becomes `disallowedTools` for the native tool
+ * only; host `execute` still runs.
+ */
+export function denyNativeAskUserQuestion(existing) {
+    if (existing === undefined) {
+        return { mode: "deny", toolNames: [ASK_USER_QUESTION_TOOL_NAME] };
+    }
+    if (existing.mode === "deny") {
+        if (existing.toolNames.includes(ASK_USER_QUESTION_TOOL_NAME) === true) {
+            return existing;
+        }
+        return {
+            mode: "deny",
+            toolNames: [...existing.toolNames, ASK_USER_QUESTION_TOOL_NAME],
+        };
+    }
+    return {
+        mode: "allow",
+        toolNames: existing.toolNames.filter((name) => name !== ASK_USER_QUESTION_TOOL_NAME),
+    };
+}
+/**
+ * Host-side `AskUserQuestion`. Same name as the builtin so the model keeps
+ * calling it; HarnessAgent runs `execute` on the host instead of Claude Code.
+ */
+export function buildAskUserQuestionHostTool(getAsk) {
+    return {
+        [ASK_USER_QUESTION_TOOL_NAME]: {
+            description: "Ask the user multiple-choice questions via a structured UI. This session presents the options in the terminal and returns their answers.",
+            inputSchema: jsonSchema(ASK_USER_QUESTION_JSON_SCHEMA),
+            execute: async (data) => {
+                const ask = getAsk();
+                if (ask === undefined) {
+                    return { error: ASK_USER_QUESTION_DENIED_REASON };
+                }
+                if (readAskUserQuestions(data) === undefined) {
+                    return { error: ASK_USER_QUESTION_MISSING_INPUT_REASON };
+                }
+                const answers = await ask(data);
+                if (answers === undefined || Object.keys(answers).length === 0) {
+                    return { error: ASK_USER_QUESTION_DENIED_REASON };
+                }
+                return { answers };
+            },
+        },
+    };
+}
+/**
+ * Pull the questions out of a tool input, whether the bridge sent a JSON
+ * string or the parsed object.
+ */
+export function readAskUserQuestions(toolInput) {
+    const record = asRecord(toolInput);
+    if (record === undefined) {
+        return undefined;
+    }
+    const rawQuestions = record["questions"];
+    if (Array.isArray(rawQuestions) === false || rawQuestions.length === 0) {
+        return undefined;
+    }
+    const questions = [];
+    for (const rawQuestion of rawQuestions) {
+        const parsed = readQuestion(rawQuestion);
+        if (parsed === undefined) {
+            return undefined;
+        }
+        questions.push(parsed);
+    }
+    return questions;
+}
+/** First question, for the spinner — not the whole JSON payload. */
+export function summarizeAskUserQuestion(toolInput) {
+    const questions = readAskUserQuestions(toolInput);
+    if (questions === undefined) {
+        return undefined;
+    }
+    const first = questions[0];
+    if (first === undefined) {
+        return undefined;
+    }
+    if (questions.length === 1) {
+        return first.question;
+    }
+    return `${first.question} (+${String(questions.length - 1)} more)`;
+}
+/**
+ * Told to the model as the denial reason so it can continue with the answers
+ * rather than asking again.
+ */
+export function formatAskUserQuestionAnswers(answers) {
+    return `The user answered: ${JSON.stringify(answers)}. Continue with these answers. Do not call AskUserQuestion again for these questions.`;
+}
+function readQuestion(raw) {
+    const record = asRecord(raw);
+    if (record === undefined) {
+        return undefined;
+    }
+    const question = record["question"];
+    const rawOptions = record["options"];
+    if (typeof question !== "string" || question.length === 0) {
+        return undefined;
+    }
+    if (Array.isArray(rawOptions) === false || rawOptions.length === 0) {
+        return undefined;
+    }
+    const options = [];
+    for (const rawOption of rawOptions) {
+        const parsed = readOption(rawOption);
+        if (parsed === undefined) {
+            return undefined;
+        }
+        options.push(parsed);
+    }
+    const header = record["header"];
+    return {
+        question,
+        header: typeof header === "string" ? header : undefined,
+        options,
+        multiSelect: record["multiSelect"] === true,
+    };
+}
+function readOption(raw) {
+    const record = asRecord(raw);
+    if (record === undefined) {
+        return undefined;
+    }
+    const label = record["label"];
+    const description = record["description"];
+    if (typeof label !== "string" || label.length === 0) {
+        return undefined;
+    }
+    return {
+        label,
+        description: typeof description === "string" ? description : undefined,
+    };
+}
+function asRecord(value) {
+    if (typeof value === "string") {
+        try {
+            const parsed = JSON.parse(value);
+            return typeof parsed === "object" && parsed !== null
+                ? parsed
+                : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return typeof value === "object" && value !== null
+        ? value
+        : undefined;
+}

package/build/commands/ask/harness/claudeConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeConfig.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/claudeConfig.ts"],"names":[],"mappings":"AAyCA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C"}

package/build/commands/ask/{claudeConfig.js → harness/claudeConfig.js}

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir } from "@cargo-ai/cdk/cli";
+import { ASK_USER_QUESTION_TOOL_NAME } from "./askUserQuestion.js";
 /**
  * Tools that spawn a subagent, refused at source.
  *
@@ -22,6 +23,16 @@ import { getConfigDir } from "@cargo-ai/cdk/cli";
  * Code versions and a rule for a tool that does not exist costs nothing.
  */
 const SUBAGENT_TOOL_NAMES = ["Agent", "Task"];
+/**
+ * Native `AskUserQuestion` used to live on this list. A deny-by-name rule
+ * matches the host replacement of the same name, so model calls came back
+ * disabled instead of reaching host `execute`. Native withholding is now
+ * session `disallowedTools` — see `denyNativeAskUserQuestion`. Names here
+ * are stripped from an existing deny array so a previous Ask run cannot
+ * keep the collision around.
+ */
+const SETTINGS_DENIED_TOOL_NAMES = SUBAGENT_TOOL_NAMES;
+const SETTINGS_UNDENIED_TOOL_NAMES = [ASK_USER_QUESTION_TOOL_NAME];
 /**
  * The Claude Agent SDK loads every filesystem settings source it can find when
  * `settingSources` is omitted, and the harness bridge omits it. A local turn
@@ -52,24 +63,23 @@ export function askClaudeConfigDir() {
     }
     const dir = join(getConfigDir(), "ask-claude-config");
     mkdirSync(dir, { recursive: true });
-    denySubagentTools(dir);
+    denySettingsTools(dir);
     return dir;
 }
 /**
- * Add the subagent deny rules to the settings file in Ask's own config
- * directory, keeping whatever else is in there.
+ * Add the deny rules to the settings file in Ask's own config directory,
+ * keeping whatever else is in there.
  *
  * Merged rather than written whole, because Claude Code keeps its own state
  * under this directory.
  *
  * A failure here is reported rather than swallowed. There is no second line of
- * defence to fall back on: the approval-time refusal in `isAlwaysDenied` is
- * never reached, which is the whole reason this exists — so a settings file
- * that could not be written means subagents run unattended, and the user is
- * the only one who can tell whether that matters. Reported, not thrown: it
- * must not fail the question they just asked.
+ * defence to fall back on for tools `allow-reads` never asks about — so a
+ * settings file that could not be written means those tools run unattended,
+ * and the user is the only one who can tell whether that matters. Reported,
+ * not thrown: it must not fail the question they just asked.
  */
-function denySubagentTools(dir) {
+function denySettingsTools(dir) {
     const path = join(dir, "settings.json");
     try {
         const existing = existsSync(path)
@@ -84,16 +94,21 @@ function denySubagentTools(dir) {
             : {};
         const denyValue = permissions["deny"];
         const deny = Array.isArray(denyValue) ? denyValue : [];
-        const missing = SUBAGENT_TOOL_NAMES.filter((name) => deny.includes(name) === false);
-        if (missing.length === 0) {
+        const kept = deny.filter((name) => {
+            return typeof name === "string"
+                ? SETTINGS_UNDENIED_TOOL_NAMES.includes(name) === false
+                : true;
+        });
+        const missing = SETTINGS_DENIED_TOOL_NAMES.filter((name) => kept.includes(name) === false);
+        if (missing.length === 0 && kept.length === deny.length) {
             return;
         }
         writeFileSync(path, `${JSON.stringify({
             ...settings,
-            permissions: { ...permissions, deny: [...deny, ...missing] },
+            permissions: { ...permissions, deny: [...kept, ...missing] },
         }, null, 2)}\n`);
     }
     catch (error) {
-        process.stderr.write(`Could not write ${path}, so subagent tools are not withheld from this session: ${error instanceof Error ? error.message : "unknown error"}\n`);
+        process.stderr.write(`Could not write ${path}, so Agent and Task are not withheld from this session: ${error instanceof Error ? error.message : "unknown error"}\n`);
     }
 }

package/build/commands/ask/harness/create.d.ts

@@ -0,0 +1,59 @@
+import type { Ai } from "@cargo-ai/api";
+import type { Api } from "../../../api.js";
+import { type LocalStreamOptions } from "./turn.js";
+export type LocalHarness = {
+    streamPrompt: (question: string, options?: LocalStreamOptions) => Promise<string>;
+    /**
+     * When a turn last reached Anthropic, or undefined if none has. The proxy
+     * token re-arms on every call it makes, so this — not the mint time — is
+     * what its real expiry runs from.
+     */
+    proxyLastUsedAtMs: () => number | undefined;
+    /** Stops Claude Code and its bridge; the session is not resumable. */
+    close: () => Promise<void>;
+};
+export declare function createLocalHarness(input: {
+    api: Api;
+    /**
+     * Cargo API origin (`config.baseUrl`). The Anthropic proxy is mounted on
+     * the API as `/sandbox/anthropic` — same host the backend uses via
+     * `config.app.url` (which is the API URL, not the web app).
+     */
+    apiBaseUrl: string;
+    dir: string;
+    chatUuid: string;
+    agentUuid?: string;
+    /**
+     * Deployed release of the selected agent. Applied the way `/stream` applies
+     * a harness agent's release: prompt, actions, resources, MCP, capabilities.
+     * Does not change the local harness or --dir.
+     */
+    release?: Ai.Release;
+    proxyToken: string;
+    /**
+     * Connector the mint picked for this session, plus the integration and
+     * model it resolved. Sent with ingest so usage is attributed to the same
+     * provider the proxy spent against — not reconstructed from the harness slug.
+     */
+    connectorUuid: string;
+    integrationSlug: string;
+    languageModelSlug: string;
+    /**
+     * Earlier turns of this chat, from `loadChatHistoryPreamble`. The session is
+     * always new, so this is the only thing that carries a `--continue` chat
+     * across CLI runs.
+     */
+    history?: string;
+    /**
+     * The id the caller claimed the chat with. Sent with the ingest so recording
+     * a turn releases this session's claim and not one taken after it.
+     */
+    turnOwnerId?: string;
+    /**
+     * Interactive Ask can run host tools and custom agent MCP unattended.
+     * `--print` cannot: nobody is there to approve, and host tools never
+     * prompt under `allow-reads`.
+     */
+    allowWorkspaceMutations: boolean;
+}): Promise<LocalHarness>;
+//# sourceMappingURL=create.d.ts.map

package/build/commands/ask/harness/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../src/commands/ask/harness/create.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAuB3C,OAAO,EAGL,KAAK,kBAAkB,EAKxB,MAAM,WAAW,CAAC;AAGnB,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE,CACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,kBAAkB,KACzB,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC5C,sEAAsE;IACtE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAcF,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,uBAAuB,EAAE,OAAO,CAAC;CAClC,GAAG,OAAO,CAAC,YAAY,CAAC,CAsUxB"}