@dtlabs/ai-toolkit 0.16.5 → 0.16.6

package/CHANGELOG.md

@@ -1,4 +1,12 @@
 ## 0.1.4 (2026-07-21)
+## [0.16.6](https://github.com/dtlab-tech/ai-toolkit/compare/v0.16.5...v0.16.6) (2026-10-06)
+
+
+### Bug Fixes
+
+* **task-executor:** drop --permission-prompts, it doesn't exist ([903dea5](https://github.com/dtlab-tech/ai-toolkit/commit/903dea58fba475e3bf5caa83a41723977f6d742e))
+* **task-executor:** drop --permission-prompts, it doesn't exist ([9c49c78](https://github.com/dtlab-tech/ai-toolkit/commit/9c49c789f385e88763d606d70bdfd9653e37a948))
+
 ## [0.16.5](https://github.com/dtlab-tech/ai-toolkit/compare/v0.16.4...v0.16.5) (2026-10-05)
 
 

package/docs/task-executor-cli.md

@@ -58,16 +58,21 @@ on any platform other than `win32` (see "Platform qualification" below), before
 other validation.
 
 **Permission bypass.** Every real implementation/review worker this loop dispatches is spawned
-with `--permission-mode auto --permission-prompts none` appended to its CLI args
-(`EXECUTOR_PERMISSION_BYPASS_ARGS` in `lib/task-executor/index.js`). A non-interactive `--print`
-invocation has no TTY to answer a permission prompt, so without this every Write/Edit/mkdir tool
-call is denied by default, regardless of task content — confirmed against a real run where every
-BE/FE task failed verification because its expected files/directories were never created. This
-restores exactly the invocation Tech-Spec OQ-01's pre-Gate-1 spike validated ("Percorso C") and
-Gate 1 was approved against; it had gone missing from the actual `dispatchTaskAttempt`/`runReview`
-implementation. The mode is deliberately unscoped within the task's own `--project` directory —
-the executor's job is letting a developer agent write anywhere under that project, so (unlike
-pm-phase1/2's read-only-text workers) a narrower allowlist is not an option here.
+with `--permission-mode auto` appended to its CLI args (`EXECUTOR_PERMISSION_BYPASS_ARGS` in
+`lib/task-executor/index.js`). A non-interactive `--print` invocation has no TTY to answer a
+permission prompt, so without this every Write/Edit/mkdir tool call is denied by default,
+regardless of task content — confirmed against a real run where every BE/FE task failed
+verification because its expected files/directories were never created. `auto` alone was then
+independently confirmed sufficient (a live dispatch created all of its task's expected
+directories and files). An earlier version of this fix also appended `--permission-prompts
+none`, citing Tech-Spec OQ-01's pre-Gate-1 spike note as having validated that exact pair —
+reproduced directly against the real, installed CLI (v2.1.220): `--permission-prompts` is not a
+recognized flag at all (`claude --help` lists no such option; passing it exits 1 with `error:
+unknown option '--permission-prompts'` before any model/API call), so that spike note is stale or
+was never run against the real executable as claimed. The mode is deliberately unscoped within
+the task's own `--project` directory — the executor's job is letting a developer agent write
+anywhere under that project, so (unlike pm-phase1/2's read-only-text workers) a narrower
+allowlist is not an option here.
 
 ### `status`
 

package/lib/task-executor/index.js

@@ -74,28 +74,40 @@ function _buildProcessTag(runId, taskId, attemptNumber) {
 // the tagged "worker" under test, per this task's own testing constraint.
 const DEFAULT_TAGGED_PROCESS_EXE_BASENAME = 'claude.exe';
 
-// Permission-bypass flags required for every real (non-test-fixture) worker
-// spawn — implementation AND review alike. Without them, a non-interactive
+// Permission-bypass flag required for every real (non-test-fixture) worker
+// spawn — implementation AND review alike. Without it, a non-interactive
 // `--print` invocation has no TTY to answer a permission prompt, so every
-// Write/Edit/mkdir tool call is denied by default: this was validated
-// (Tech-Spec OQ-01, "Percorso C", resolved 2026-09-18, pre-Gate-1 spike) as
-// `--permission-mode auto --permission-prompts none` — "Exit 0 confirmed
-// with structured JSON output and full usage data" — and is NOT a new or
-// speculative flag choice, it restores exactly what Gate 1 was approved
-// against (see internal_docs/features/FTR-018-deterministic-task-execution-
-// checkpoints-and-resume/history/pre-consolidation-2026-09-20-*.md). It was
-// missing from dispatchTaskAttempt's/runReview's actual baseSpawnArgs/
-// spawnArgs literals — every real implementation/review dispatch was
-// therefore guaranteed to have every write denied, regardless of task
-// content (confirmed against a real blocked run: INFRA-TASK-INFRA-01's own
-// post-dispatch verification found none of its expected directories had
-// been created). `--permission-mode auto` is deliberately broad (unscoped
-// within the spawned cwd) — the executor's whole job is letting a developer
-// agent write anywhere under the task's project, so a narrower scoped
-// allowlist is not an option here the way it was for pm-phase1/2's
-// read-only-text workers (see lib/workflow-control.js's own doc comment on
-// why THAT subsystem sidesteps Write entirely instead).
-const EXECUTOR_PERMISSION_BYPASS_ARGS = ['--permission-mode', 'auto', '--permission-prompts', 'none'];
+// Write/Edit/mkdir tool call is denied by default: confirmed against a real
+// blocked run (INFRA-TASK-INFRA-01's own post-dispatch verification found
+// none of its expected directories had been created) before this constant
+// existed at all. `--permission-mode auto` is a real, documented choice on
+// the installed CLI (`claude --help`: "(choices: \"acceptEdits\", \"auto\",
+// \"bypassPermissions\", \"manual\", \"dontAsk\", \"plan\")") and is
+// deliberately broad (unscoped within the spawned cwd) — the executor's
+// whole job is letting a developer agent write anywhere under the task's
+// project, so a narrower scoped allowlist is not an option here the way it
+// was for pm-phase1/2's read-only-text workers (see
+// lib/workflow-control.js's own doc comment on why THAT subsystem sidesteps
+// Write entirely instead).
+//
+// CORRECTION: an earlier version of this constant also appended
+// `--permission-prompts none`, citing Tech-Spec OQ-01's pre-Gate-1 spike
+// note ("Percorso C", resolved 2026-09-18) as having validated that exact
+// pair. Reproduced directly against the real, currently-installed CLI
+// (v2.1.220): `--permission-prompts` is NOT a recognized flag at all —
+// `claude --print --permission-mode auto --permission-prompts none` fails
+// immediately with `error: unknown option '--permission-prompts'` (exit 1,
+// commander.js argv validation, before any model/API call). Every dispatch
+// would have failed closed again, just with a different symptom (an argv
+// crash instead of a denied Write) — so the historical spike note is either
+// stale against a since-changed CLI surface or was never run against the
+// real executable as literally claimed (this Tech-Spec history already
+// contains one prior instance of an overclaimed, later-audited-away result —
+// see FTR-018-Gate1-Review-Actions.md's own "Correction (2026-09-22)"). Only
+// `--permission-mode auto` is carried forward; it alone was independently
+// confirmed sufficient (a live dispatch created all of its task's expected
+// directories and files).
+const EXECUTOR_PERMISSION_BYPASS_ARGS = ['--permission-mode', 'auto'];
 
 // Real, positive-evidence-only liveness query for a tagged process, using
 // the exact E-02-qualified Win32_Process/CIM technique proven in the Gate-1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dtlabs/ai-toolkit",
-  "version": "0.16.5",
+  "version": "0.16.6",
   "description": "AI Toolkit — reusable agents and procedures for developers to build AI-powered applications.",
   "files": [
     "docs/",