@falkenslab/agent-kit 0.17.0 → 0.19.0

package/dist/core/externalExtensions.js

@@ -0,0 +1,340 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { cp, mkdtemp, readdir, readFile, rm, stat, writeFile, mkdir } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { getLanguage } from "./messages/index.js";
+import { truncate } from "./toolLabels.js";
+import { agentKitVersion } from "./version.js";
+import { outsideArchive } from "./packaged.js";
+export const LOCK_FILE = "extensions.lock.json";
+/** A scope's lock: its extensions by name. */
+export async function readLock(scopeDir) {
+    try {
+        return JSON.parse(await readFile(path.join(scopeDir, LOCK_FILE), "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return {};
+        throw error;
+    }
+}
+async function writeLock(scopeDir, lock) {
+    await mkdir(scopeDir, { recursive: true });
+    const sorted = Object.fromEntries(Object.keys(lock).sort().map((name) => [name, lock[name]]));
+    await writeFile(path.join(scopeDir, LOCK_FILE), `${JSON.stringify(sorted, null, 2)}\n`, "utf8");
+}
+/** Reads an extension's manifest, checking what the kit needs from it. */
+export async function readExternalManifest(dir) {
+    const file = path.join(dir, ".claude-plugin", "plugin.json");
+    let raw;
+    try {
+        raw = JSON.parse(await readFile(file, "utf8"));
+    }
+    catch {
+        throw new Error(`${dir} isn't an extension: it has no readable .claude-plugin/plugin.json.`);
+    }
+    const name = raw.name;
+    if (typeof name !== "string" || !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(name))
+        throw new Error(`${file}: "name" must be kebab-case.`);
+    const kit = (raw["agent-kit"] ?? {});
+    const text = (key) => (typeof raw[key] === "string" ? { [key]: raw[key] } : {});
+    const author = raw.author;
+    // `repository` may be a URL or `{ url }`, as in package.json.
+    const repository = typeof raw.repository === "string" ? raw.repository : raw.repository?.url;
+    return {
+        name,
+        description: typeof raw.description === "string" ? raw.description : "",
+        ...text("version"),
+        ...(author && typeof author === "object" && typeof author.name === "string"
+            ? { author: { name: author.name, ...(author.email ? { email: author.email } : {}), ...(author.url ? { url: author.url } : {}) } }
+            : {}),
+        ...text("homepage"),
+        ...(typeof repository === "string" ? { repository } : {}),
+        ...text("license"),
+        ...(Array.isArray(raw.keywords) ? { keywords: raw.keywords.filter((keyword) => typeof keyword === "string") } : {}),
+        provides: kit.provides ?? [],
+        requires: kit.requires ?? [],
+        ...(kit.kit ? { kit: kit.kit } : {}),
+        servers: await pluginServers(dir, raw),
+        readOnlyTools: kit.readOnlyTools ?? [],
+        labels: kit.labels ?? {},
+        ...(kit.help ? { help: kit.help } : {}),
+    };
+}
+/**
+ * A plugin's MCP servers, where Claude Code looks for them: `mcpServers` in `plugin.json` (inline,
+ * or a path to a JSON file), else `.mcp.json` at its root, with or without the `mcpServers` key.
+ */
+async function pluginServers(dir, raw) {
+    const read = async (file) => {
+        try {
+            return JSON.parse(await readFile(path.join(dir, file), "utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw new Error(`${file} can't be read as JSON.`, { cause: error });
+        }
+    };
+    let declared = raw.mcpServers;
+    if (typeof declared === "string")
+        declared = await read(declared);
+    if (declared === undefined)
+        declared = await read(".mcp.json");
+    if (declared && typeof declared === "object" && "mcpServers" in declared)
+        declared = declared.mcpServers;
+    if (declared === undefined || declared === null)
+        return {};
+    if (typeof declared !== "object")
+        throw new Error("its MCP servers aren't a JSON object.");
+    const servers = {};
+    for (const [name, server] of Object.entries(declared)) {
+        if (!server || typeof server.command !== "string")
+            throw new Error(`its MCP server "${name}" has no command.`);
+        servers[name] = { command: server.command, ...(Array.isArray(server.args) ? { args: server.args.map(String) } : {}), ...(server.env ? { env: server.env } : {}) };
+    }
+    return servers;
+}
+/** `${CLAUDE_PLUGIN_ROOT}` (the extension's folder) and `${VAR}` (the agent's variable) in a server's values. */
+function expand(value, root) {
+    return value.replace(/\$\{(\w+)\}/g, (_, name) => (name === "CLAUDE_PLUGIN_ROOT" ? root : (process.env[name] ?? "")));
+}
+/**
+ * Why one of an extension's servers can't run through the launcher (only Node, its script
+ * first, inside the extension), or how the kit starts it.
+ */
+function serverLaunch(name, server, root) {
+    if (!/^node(\.exe)?$/i.test(path.basename(server.command)))
+        return `runs its server "${name}" with "${server.command}": only Node servers can be installed`;
+    const [script, ...args] = (server.args ?? []).map((arg) => expand(arg, root));
+    if (!script)
+        return `gives its server "${name}" no script to run`;
+    const entry = path.resolve(root, script);
+    if (path.relative(root, entry).startsWith(".."))
+        return `runs its server "${name}" from outside its folder (${script})`;
+    return { entry, args, env: Object.fromEntries(Object.entries(server.env ?? {}).map(([key, value]) => [key, expand(String(value), root)])) };
+}
+/** Why an extension's servers can't run, or nothing: each must be Node, with its script there. */
+async function serversProblem(manifest, root) {
+    for (const [name, server] of Object.entries(manifest.servers)) {
+        const launch = serverLaunch(name, server, root);
+        if (typeof launch === "string")
+            return launch;
+        if (!(await stat(launch.entry).catch(() => null))?.isFile())
+            return `has no script at ${path.relative(root, launch.entry)} for its server "${name}"`;
+    }
+    return undefined;
+}
+/** SHA-256 over an extension's files (their paths and contents, in order), `.git` aside. */
+export async function hashExtension(dir) {
+    const hash = createHash("sha256");
+    async function walk(relative) {
+        const entries = (await readdir(path.join(dir, relative), { withFileTypes: true })).filter((entry) => entry.name !== ".git");
+        for (const entry of entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))) {
+            const child = relative ? `${relative}/${entry.name}` : entry.name;
+            if (entry.isDirectory())
+                await walk(child);
+            else if (entry.isFile())
+                hash.update(`${child}\0`).update(await readFile(path.join(dir, child))).update("\0");
+        }
+    }
+    await walk("");
+    return hash.digest("hex");
+}
+/**
+ * Whether `version` (x.y.z) is in `range`: comparators separated by spaces, all of which must
+ * hold (`>=0.19.0 <0.21.0`, `=0.19.2`, `0.19.2`).
+ */
+export function inKitRange(version, range) {
+    const parse = (text) => text.split("-")[0].split(".").map((part) => Number(part) || 0);
+    const compare = (a, b) => {
+        for (let i = 0; i < 3; i++)
+            if ((a[i] ?? 0) !== (b[i] ?? 0))
+                return (a[i] ?? 0) - (b[i] ?? 0);
+        return 0;
+    };
+    const current = parse(version);
+    return range
+        .trim()
+        .split(/\s+/)
+        .every((comparator) => {
+        const match = /^(>=|<=|>|<|=)?\s*v?(\d+(?:\.\d+){0,2})$/.exec(comparator);
+        if (!match)
+            return false;
+        const order = compare(current, parse(match[2]));
+        switch (match[1]) {
+            case ">=":
+                return order >= 0;
+            case "<=":
+                return order <= 0;
+            case ">":
+                return order > 0;
+            case "<":
+                return order < 0;
+            default:
+                return order === 0;
+        }
+    });
+}
+/** Every extension installed in the scopes, the project's first. */
+export async function listInstalled(dirs) {
+    const installed = [];
+    for (const scope of ["project", "agent"]) {
+        const scopeDir = dirs[scope];
+        if (!scopeDir)
+            continue;
+        for (const [name, lock] of Object.entries(await readLock(scopeDir))) {
+            const dir = path.join(scopeDir, name);
+            const manifest = await readExternalManifest(dir).catch(() => undefined);
+            installed.push({ name, scope, dir, lock, shadowed: installed.some((other) => other.name === name), ...(manifest ? { manifest } : {}) });
+        }
+    }
+    return installed;
+}
+/** The launcher that starts an external extension's server with a clean environment. */
+export function extensionLauncherPath() {
+    // Node runs it as another process: outside the archive when packaged (#42).
+    return outsideArchive(path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "assets", "extension-launcher.mjs"));
+}
+/** Its tools' chat labels in the kit's language, from its manifest: `{field}` takes the input; for each of its servers. */
+function manifestToolLabels(manifest) {
+    const language = getLanguage();
+    const fill = (template, input) => template.replace(/\{(\w+)\}/g, (_, field) => (input[field] === undefined ? "" : truncate(String(input[field]), 60)));
+    return Object.fromEntries(Object.entries(manifest.labels).flatMap(([tool, byLanguage]) => {
+        const texts = byLanguage[language] ?? byLanguage.en;
+        if (!texts)
+            return [];
+        const label = { label: (input) => fill(texts.label, input), ...(texts.phrase ? { phrase: texts.phrase } : {}) };
+        return Object.keys(manifest.servers).map((server) => [`mcp__${server}__${tool}`, label]);
+    }));
+}
+/** The extension an installed one makes: its servers started through the launcher, its rules from its manifest. */
+function externalExtension(installed, manifest) {
+    return {
+        name: manifest.name,
+        plugin: installed.dir,
+        external: true,
+        async contribute() {
+            const servers = {};
+            for (const [name, server] of Object.entries(manifest.servers)) {
+                const launch = serverLaunch(name, server, installed.dir);
+                if (typeof launch === "string")
+                    continue; // checked when it loaded
+                // Its `env` reaches it (the SDK merges it with the agent's); the launcher removes the rest.
+                // Inside Electron, process.execPath is the app itself: ELECTRON_RUN_AS_NODE makes it run
+                // the launcher as Node (the launcher removes it, with the rest, once it runs).
+                const env = process.versions.electron ? { ...launch.env, ELECTRON_RUN_AS_NODE: "1" } : launch.env;
+                servers[name] = { type: "stdio", command: process.execPath, args: [extensionLauncherPath(), launch.entry, JSON.stringify(Object.keys(launch.env)), ...launch.args], env };
+            }
+            return {
+                mcpServers: servers,
+                readOnlyTools: Object.keys(manifest.servers).flatMap((server) => manifest.readOnlyTools.map((tool) => `mcp__${server}__${tool}`)),
+                toolLabels: manifestToolLabels(manifest),
+                ...(manifest.help ? { helpLines: [manifest.help] } : {}),
+            };
+        },
+    };
+}
+/** The installed extensions a session runs with, and those it can't (with why). Disabled ones are neither. */
+export async function loadExternalExtensions(dirs) {
+    const extensions = [];
+    const off = [];
+    for (const installed of await listInstalled(dirs)) {
+        if (installed.shadowed || !installed.lock.enabled)
+            continue;
+        const reason = await problem(installed);
+        if (typeof reason === "string")
+            off.push({ name: installed.name, reason });
+        else
+            extensions.push(externalExtension(installed, reason));
+    }
+    return { extensions, off };
+}
+/** Why an installed extension can't load, or its manifest when it can. */
+async function problem(installed) {
+    let manifest;
+    try {
+        if ((await hashExtension(installed.dir)) !== installed.lock.sha256)
+            return "has files that changed since it was installed: install it again to trust them";
+        manifest = await readExternalManifest(installed.dir);
+    }
+    catch (error) {
+        return `can't be read (${error instanceof Error ? error.message : String(error)})`;
+    }
+    if (manifest.name !== installed.name)
+        return `is installed as "${installed.name}" but its manifest says "${manifest.name}"`;
+    if (manifest.kit && !inKitRange(agentKitVersion(), manifest.kit))
+        return `works with agent-kit ${manifest.kit}, and this agent runs ${agentKitVersion()}`;
+    return (await serversProblem(manifest, installed.dir)) ?? manifest;
+}
+const exec = promisify(execFile);
+/** Whether `source` names a git repository rather than a folder. */
+export function isGitSource(source) {
+    return /^(https?:\/\/|git@|ssh:\/\/|git:\/\/|file:\/\/|github:)/.test(source) || /\.git(#.*)?$/.test(source);
+}
+/**
+ * Installs an extension into a scope from a folder or a git repository (`url#ref`, and `subdir`
+ * for one inside it): copies its files (never runs a script), checks its manifest, and locks it,
+ * enabled. An extension with the same name in that scope is replaced.
+ */
+export async function addExtension(source, scopeDir, options = {}) {
+    let from = path.resolve(source);
+    let commit;
+    let clone;
+    if (isGitSource(source)) {
+        const [url, ref] = source.replace(/^github:/, "https://github.com/").split("#");
+        clone = await mkdtemp(path.join(os.tmpdir(), "agent-kit-extension-"));
+        await exec("git", ["clone", "--depth", "1", ...(ref ? ["--branch", ref] : []), url, clone]);
+        commit = (await exec("git", ["-C", clone, "rev-parse", "HEAD"])).stdout.trim();
+        from = clone;
+    }
+    try {
+        if (options.subdir)
+            from = path.join(from, options.subdir);
+        const manifest = await readExternalManifest(from);
+        const servers = await serversProblem(manifest, from);
+        if (servers)
+            throw new Error(`${manifest.name} can't be installed: it ${servers}.`);
+        const target = path.join(scopeDir, manifest.name);
+        const lock = await readLock(scopeDir);
+        const replaced = Boolean(lock[manifest.name]);
+        await rm(target, { recursive: true, force: true });
+        await mkdir(scopeDir, { recursive: true });
+        await cp(from, target, { recursive: true, filter: (file) => path.basename(file) !== ".git" });
+        lock[manifest.name] = {
+            source: isGitSource(source) ? `${source}${options.subdir ? ` (${options.subdir})` : ""}` : from,
+            ...(commit ? { commit } : {}),
+            sha256: await hashExtension(target),
+            enabled: true,
+            installed: new Date().toISOString(),
+        };
+        await writeLock(scopeDir, lock);
+        return { name: manifest.name, replaced, ...(commit ? { commit } : {}) };
+    }
+    finally {
+        if (clone)
+            await rm(clone, { recursive: true, force: true });
+    }
+}
+/** Removes an extension from a scope (its files and its lock entry); false when it wasn't there. */
+export async function removeExtension(scopeDir, name) {
+    const lock = await readLock(scopeDir);
+    if (!lock[name])
+        return false;
+    delete lock[name];
+    await rm(path.join(scopeDir, name), { recursive: true, force: true });
+    await writeLock(scopeDir, lock);
+    return true;
+}
+/** Enables or disables an installed extension in a scope; false when it isn't there. */
+export async function setExtensionEnabled(scopeDir, name, enabled) {
+    const lock = await readLock(scopeDir);
+    if (!lock[name])
+        return false;
+    lock[name] = { ...lock[name], enabled };
+    await writeLock(scopeDir, lock);
+    return true;
+}

package/dist/core/hooks/fileScopeGate.d.ts

@@ -24,17 +24,32 @@ export interface FileScope {
         dir: string;
         instead: string;
     }[];
+    /**
+     * With it, `Read` and `Glob` are only allowed inside these (an allow-list, like
+     * `writableDirs` and `searchableDirs`), plus `alsoReadable` and the tool results under
+     * `toolResultsRoot`; `deniedPaths` still wins. Without it, they reach any path but the
+     * denied ones: any file the user can read, `~/.ssh` included.
+     */
+    readableDirs?: string[];
+    /** Readable too with `readableDirs`, but not named in a denial: the run folder, the plugin roots. */
+    alsoReadable?: string[];
+    /**
+     * The CLI's folder for this project (`~/.claude/projects/<project>`): with `readableDirs`,
+     * its sessions' `tool-results/` folders, where the SDK leaves large tool outputs for the
+     * agent to `Read`, are readable; nothing else in it.
+     */
+    toolResultsRoot?: string;
 }
 /** Whether `candidate` is `base` itself or somewhere inside it (case-insensitive on Windows, like path.relative). */
 export declare function isWithin(base: string, candidate: string): boolean;
 /**
  * The reason to deny `toolName` with `input` under `scope`, or `undefined` to let it
- * through. Tools other than Read/Write/Edit/Grep are never judged here, and a call
+ * through. Tools other than Read/Write/Edit/Grep/Glob are never judged here, and a call
  * without a path is left for the tool itself to reject.
  */
 export declare function checkFileScope(scope: FileScope, toolName: string, input: Record<string, unknown>): string | undefined;
 /**
- * PreToolUse hook enforcing `scope` on Read/Write/Edit/Grep, for the main agent and its
+ * PreToolUse hook enforcing `scope` on Read/Write/Edit/Grep/Glob, for the main agent and its
  * subagents alike. Bash, when a subagent has it, is not covered: it can reach any path,
  * which is why Bash-granting features stay opt-in.
  */

package/dist/core/hooks/fileScopeGate.js

@@ -5,11 +5,33 @@ export function isWithin(base, candidate) {
     return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
 }
 function describeDirs(scope, dirs) {
-    return dirs.map((dir) => `${path.relative(scope.projectDir, dir) || "."}/`).join(", ");
+    return dirs.map((dir) => (isWithin(scope.projectDir, dir) ? `${path.relative(scope.projectDir, dir) || "."}/` : `${dir}/`)).join(", ");
+}
+/** Where a `Glob` really starts: its path plus the pattern's fixed folders ("sources/**" starts in sources/). */
+function globStart(scope, input) {
+    const target = typeof input.path === "string" && input.path !== "" ? path.resolve(scope.projectDir, input.path) : scope.projectDir;
+    const pattern = typeof input.pattern === "string" ? input.pattern : "";
+    return path.resolve(target, pattern.replace(/[^/\\]*[*?[{].*$/, ""));
+}
+/** Whether `target` is readable under a scope with `readableDirs`. */
+function isReadable(scope, target) {
+    const dirs = [...(scope.readableDirs ?? []), ...(scope.alsoReadable ?? [])].map((dir) => path.resolve(scope.projectDir, dir));
+    if (dirs.some((dir) => isWithin(dir, target)))
+        return true;
+    if (!scope.toolResultsRoot || !isWithin(scope.toolResultsRoot, target))
+        return false;
+    // <root>/<session>/tool-results/…, and nothing else of the CLI's (transcripts, other files).
+    return path.relative(scope.toolResultsRoot, target).split(path.sep)[1] === "tool-results";
+}
+/** The denial for reading or listing outside `readableDirs`. */
+function notReadable(scope, shown, tool) {
+    const dirs = scope.readableDirs ?? [];
+    const what = tool === "Glob" ? `Glob can't list "${String(shown)}": listing` : `"${String(shown)}" can't be read: reading`;
+    return `${what} is only allowed inside ${dirs.length ? `${describeDirs(scope, dirs)} and ` : ""}your own plugins and run folder.`;
 }
 /**
  * The reason to deny `toolName` with `input` under `scope`, or `undefined` to let it
- * through. Tools other than Read/Write/Edit/Grep are never judged here, and a call
+ * through. Tools other than Read/Write/Edit/Grep/Glob are never judged here, and a call
  * without a path is left for the tool itself to reject.
  */
 export function checkFileScope(scope, toolName, input) {
@@ -26,19 +48,32 @@ export function checkFileScope(scope, toolName, input) {
             return viaTools(input.file_path, only);
     }
     if (toolName === "Grep" || toolName === "Glob") {
-        const target = resolve(input.path) ?? scope.projectDir;
-        const pattern = typeof input.pattern === "string" ? input.pattern : "";
-        // Where a search really starts: Grep's path, Glob's path plus the pattern's fixed folders
-        // ("sources/**" starts in sources/). From above the folder it would reach into it.
-        const start = toolName === "Glob" ? path.resolve(target, pattern.replace(/[^/\\]*[*?[{].*$/, "")) : target;
+        // Where a search really starts: Grep's path, Glob's path plus the pattern's fixed folders.
+        // From above the folder it would reach into it.
+        const start = toolName === "Glob" ? globStart(scope, input) : (resolve(input.path) ?? scope.projectDir);
         const only = toolOnly(start) ?? toolOnlyDirs.find(({ dir }) => isWithin(start, dir));
         if (only)
-            return viaTools(input.path ?? pattern, only);
+            return viaTools(input.path ?? input.pattern ?? "", only);
     }
     switch (toolName) {
         case "Read": {
             const target = resolve(input.file_path);
-            return target && isDenied(target) ? `"${input.file_path}" is off limits: it can't be read.` : undefined;
+            if (!target)
+                return undefined;
+            if (isDenied(target))
+                return `"${input.file_path}" is off limits: it can't be read.`;
+            return scope.readableDirs && !isReadable(scope, target) ? notReadable(scope, input.file_path, "Read") : undefined;
+        }
+        case "Glob": {
+            const start = globStart(scope, input);
+            const shown = input.path ?? input.pattern;
+            if (isDenied(start))
+                return `"${String(shown)}" is off limits: it can't be listed.`;
+            if (!scope.readableDirs)
+                return undefined;
+            // ".." in the pattern ("**/../../x") would climb out of where the search starts.
+            const climbs = typeof input.pattern === "string" && input.pattern.split(/[/\\]/).includes("..");
+            return climbs || !isReadable(scope, start) ? notReadable(scope, shown, "Glob") : undefined;
         }
         case "Write":
         case "Edit": {
@@ -66,7 +101,7 @@ export function checkFileScope(scope, toolName, input) {
     }
 }
 /**
- * PreToolUse hook enforcing `scope` on Read/Write/Edit/Grep, for the main agent and its
+ * PreToolUse hook enforcing `scope` on Read/Write/Edit/Grep/Glob, for the main agent and its
  * subagents alike. Bash, when a subagent has it, is not covered: it can reach any path,
  * which is why Bash-granting features stay opt-in.
  */

package/dist/core/hooks/planGate.d.ts

@@ -7,6 +7,8 @@ export interface PlanScope {
     isPlanFile?(filePath: string): boolean;
     /** Whether one of the agent's own MCP tools only reads. */
     isReadOnlyTool?(toolName: string, input: Record<string, unknown>): boolean;
+    /** The enabled extensions' MCP tools that only read (`mcp__<server>__<tool>`). */
+    readOnlyTools?: readonly string[];
 }
 /**
  * The reason to deny `toolName` with `input` in plan mode, or `undefined` to let it through.

package/dist/core/hooks/planGate.js

@@ -3,15 +3,6 @@ import path from "node:path";
 const READING_TOOLS = new Set(["Read", "Glob", "Grep", "WebFetch", "WebSearch", "Skill", "Agent", "TodoWrite"]);
 /** The kit's own MCP servers whose tools only ask a human (approvals, manual intervention) or only read (the date and time). */
 const ASKING_SERVERS = ["mcp__approvals__", "mcp__manualLogin__", "mcp__time__"];
-/** The kit's own MCP tools that only read, on servers that also have tools that write. */
-const READING_KIT_TOOLS = new Set([
-    "mcp__sourceFiles__list_sources",
-    "mcp__sourceFiles__extract_text",
-    "mcp__knowledge__knowledge_index",
-    "mcp__knowledge__knowledge_search",
-    "mcp__knowledge__knowledge_read",
-    "mcp__knowledge__knowledge_check",
-]);
 /** Why a call is denied in plan mode, and what the model should do instead. */
 const denial = "Plan mode: nothing can be changed until the user leaves plan mode. Keep reading and researching, then present the plan; the user switches out of plan mode when they want it carried out.";
 /**
@@ -22,7 +13,7 @@ const denial = "Plan mode: nothing can be changed until the user leaves plan mod
 export function checkPlanScope(scope, toolName, input) {
     if (READING_TOOLS.has(toolName))
         return undefined;
-    if (ASKING_SERVERS.some((prefix) => toolName.startsWith(prefix)) || READING_KIT_TOOLS.has(toolName))
+    if (ASKING_SERVERS.some((prefix) => toolName.startsWith(prefix)) || scope.readOnlyTools?.includes(toolName))
         return undefined;
     if (toolName === "Write" || toolName === "Edit") {
         const target = typeof input.file_path === "string" && input.file_path !== "" ? path.resolve(scope.projectDir, input.file_path) : undefined;

package/dist/core/hooks/stepGate.d.ts

@@ -8,4 +8,4 @@ import type { HookCallback } from "@anthropic-ai/claude-agent-sdk";
  * session.ts's `ModeControl`): the hook stays registered and, while inactive, gives no
  * decision at all, so the tool call goes on exactly as if the hook weren't there.
  */
-export declare function createStepGate(runDir: string, isActive?: () => boolean): HookCallback;
+export declare function createStepGate(runDir: string, isActive?: () => boolean, selfAskingTools?: readonly string[]): HookCallback;

package/dist/core/hooks/stepGate.js

@@ -1,7 +1,7 @@
 import { askForDecision } from "./humanInput.js";
 import { t } from "../messages/index.js";
 const SELF_ASKING_SERVERS = ["mcp__approvals__", "mcp__manualLogin__"];
-const SELF_ASKING_TOOLS = new Set(["mcp__sourceFiles__request_file", "mcp__sourceFiles__retire_source", "mcp__knowledge__knowledge_retire", "TodoWrite"]);
+const SELF_ASKING_TOOLS = new Set(["TodoWrite"]);
 /**
  * PreToolUse hook for "interactive" mode: pauses before every action and asks for
  * confirmation (by keyboard or by file, see humanInput.ts), like reviewing a plan step
@@ -11,14 +11,14 @@ const SELF_ASKING_TOOLS = new Set(["mcp__sourceFiles__request_file", "mcp__sourc
  * session.ts's `ModeControl`): the hook stays registered and, while inactive, gives no
  * decision at all, so the tool call goes on exactly as if the hook weren't there.
  */
-export function createStepGate(runDir, isActive = () => true) {
+export function createStepGate(runDir, isActive = () => true, selfAskingTools = []) {
     return async (input) => {
         if (!isActive())
             return {};
         const pre = input;
         // A tool that asks the person itself (an approval, a question, the plan, a file, retiring
         // a source) or only keeps the task list isn't asked about first: that would be asking to ask.
-        if (SELF_ASKING_SERVERS.some((prefix) => pre.tool_name.startsWith(prefix)) || SELF_ASKING_TOOLS.has(pre.tool_name))
+        if (SELF_ASKING_SERVERS.some((prefix) => pre.tool_name.startsWith(prefix)) || SELF_ASKING_TOOLS.has(pre.tool_name) || selfAskingTools.includes(pre.tool_name))
             return {};
         const answer = await askForDecision(runDir, {
             title: t().proposedAction,

package/dist/core/language.js

@@ -56,5 +56,5 @@ export function detectLanguage(option) {
  */
 export function replyLanguageInstruction(language) {
     const name = LANGUAGE_NAMES[language];
-    return `Language: reply in ${name}, whatever language these instructions, your skills or the human's name are in. Switch to another language only when the human's message is clearly written in it; a greeting, a slash command or a single word doesn't count.`;
+    return `Language: use ${name} both to reply and for everything you keep (knowledge base pages, preferences, notes, the log), whatever language these instructions, your skills, your sources or the human's name are in. Switch both to another language only when the human's message is clearly written in it; a greeting, a slash command or a single word doesn't count.`;
 }

package/dist/core/messages/de.js

@@ -22,6 +22,17 @@ export const de = {
     resumeHint: "↑/↓ wählen · Enter fortsetzen · Esc abbrechen",
     resumeQuestion: "Nummer des Gesprächs, das fortgesetzt werden soll (Enter zum Abbrechen): ",
     noEarlierRuns: "(keine früheren Gespräche zum Fortsetzen)",
+    commandResume: "Ein früheres Gespräch wählen und fortsetzen",
+    commandPlan: "In den Planmodus und zurück",
+    commandExtensions: "Was läuft, was aus ist und warum; eine ein- oder ausschalten",
+    extensionsRunning: (names) => `Aktiv: ${names}`,
+    extensionsNone: "(keine Erweiterungen)",
+    extensionOff: (name, reason) => `${name} ist aus: ${reason}`,
+    extensionsInstalled: "Installiert:",
+    extensionToggled: (name, enabled) => `(${name} ${enabled ? "aktiviert" : "deaktiviert"}: die Sitzung wird mit derselben Unterhaltung neu geöffnet)`,
+    extensionNotInstalled: (name) => `(${name} ist nicht installiert: /extensions listet sie auf)`,
+    extensionsUsage: "(Verwendung: /extensions, /extensions enable <Name>, /extensions disable <Name>)",
+    extensionsCantReopen: "(dieser Chat kann seine Sitzung nicht neu öffnen: im Terminal aktivieren oder deaktivieren und neu starten)",
     currentRun: "(dieses)",
     resumed: (date) => `(Gespräch vom ${date} fortgesetzt)`,
     suggestionKey: "Tab",
@@ -72,7 +83,7 @@ export const de = {
     planCommentQuestion: "Was soll sich ändern? (Enter zum Überspringen): ",
     retireLines: (source, why, reason, replacedBy, folder) => [
         `Quelle: ${source}`,
-        why === "wrong" ? "Warum: sie ist falsch; ihre Zusammenfassung wird zurückgezogen" : "Warum: sie wird ersetzt; ihre Zusammenfassung wird als ersetzt markiert",
+        why === "wrong" ? "Warum: sie ist falsch" : "Warum: eine bessere ersetzt sie",
         `Grund: ${reason}`,
         ...(replacedBy ? [`Ersetzt durch: ${replacedBy}`] : []),
         `Sie wird nach ${folder}.agent-kit/retired/ verschoben, nicht gelöscht.`,
@@ -91,22 +102,6 @@ export const de = {
         Task: ["hat {n} Subagenten gestartet", "hat {n} Subagenten gestartet"],
         mcp__time__current_time: ["Uhrzeit abgefragt", "Uhrzeit {n}-mal abgefragt"],
         mcp__time__date_math: ["Daten berechnet", "Daten {n}-mal berechnet"],
-        mcp__sourceFiles__list_sources: ["Quellen geprüft", "Quellen {n}-mal geprüft"],
-        mcp__sourceFiles__extract_text: ["{n} Dokument gelesen", "{n} Dokumente gelesen"],
-        mcp__sourceFiles__save_to_sources: ["{n} Quelle gespeichert", "{n} Quellen gespeichert"],
-        mcp__sourceFiles__download_to_sources: ["{n} Quelle heruntergeladen", "{n} Quellen heruntergeladen"],
-        mcp__sourceFiles__request_file: ["um {n} Datei gebeten", "um {n} Dateien gebeten"],
-        mcp__sourceFiles__retire_source: ["{n} Quelle zurückgezogen", "{n} Quellen zurückgezogen"],
-        mcp__knowledge__knowledge_index: ["Index gelesen", "Index {n}-mal gelesen"],
-        mcp__knowledge__knowledge_search: ["Wissensbasis durchsucht", "Wissensbasis {n}-mal durchsucht"],
-        mcp__knowledge__knowledge_read: ["{n} Seite gelesen", "{n} Seiten gelesen"],
-        mcp__knowledge__knowledge_create: ["{n} Seite angelegt", "{n} Seiten angelegt"],
-        mcp__knowledge__knowledge_edit: ["{n} Seite bearbeitet", "{n} Seiten bearbeitet"],
-        mcp__knowledge__knowledge_rewrite: ["{n} Seite neu geschrieben", "{n} Seiten neu geschrieben"],
-        mcp__knowledge__knowledge_supersede: ["{n} Seite ersetzt", "{n} Seiten ersetzt"],
-        mcp__knowledge__knowledge_retire: ["{n} Seite zurückgezogen", "{n} Seiten zurückgezogen"],
-        mcp__knowledge__knowledge_log: ["Protokoll aktualisiert", "Protokoll {n}-mal aktualisiert"],
-        mcp__knowledge__knowledge_check: ["Wissensbasis geprüft", "Wissensbasis {n}-mal geprüft"],
         mcp__approvals__ask_human: ["{n} Frage gestellt", "{n} Fragen gestellt"],
         mcp__approvals__present_plan: ["Plan vorgelegt", "Plan {n}-mal vorgelegt"],
     },
@@ -120,7 +115,6 @@ export const de = {
     labels: {
         askingApproval: (summary) => `Bittet um menschliche Genehmigung: ${summary}`,
         waitingManual: "Wartet auf einen manuellen Eingriff",
-        savingToSources: (destination) => `Speichert ${destination} in den Quellen`,
         checkingTime: "Datum und Uhrzeit abfragen",
         calculatingDates: "Daten berechnen",
         reading: (file) => `Liest ${file}`,
@@ -139,21 +133,6 @@ export const de = {
         applyingSkill: (skill) => `Wendet den Skill "${skill}" an`,
         aSkill: "einen Skill",
         updatingTasks: "Aufgabenliste aktualisieren",
-        listingSources: "Quellen prüfen",
-        extractingText: (source) => `${source} lesen`,
-        downloading: (url) => `${url} in die Quellen herunterladen`,
-        requestingFile: (description) => `Um eine Datei bitten: ${description}`,
-        retiringSource: (source) => `Quelle ${source} zurückziehen`,
-        knowledgeIndex: "Index der Wissensbasis lesen",
-        knowledgeSearch: (query) => `Wissensbasis nach "${query}" durchsuchen`,
-        knowledgeRead: (page) => `${page} lesen`,
-        knowledgeCreate: (page) => `${page} anlegen`,
-        knowledgeEdit: (page) => `${page} bearbeiten`,
-        knowledgeRewrite: (page) => `${page} neu schreiben`,
-        knowledgeSupersede: (page) => `${page} als ersetzt markieren`,
-        knowledgeRetire: (page) => `${page} zurückziehen`,
-        knowledgeLog: "Protokoll der Wissensbasis aktualisieren",
-        knowledgeCheck: "Wissensbasis prüfen",
         askingHuman: (question) => `Frage: ${question}`,
         presentingPlan: "Plan vorlegen",
     },