@falkenslab/agent-kit 0.25.0 → 0.27.0

package/dist/core/messages/de.js

@@ -35,7 +35,7 @@ export const de = {
     extensionSwitched: (name, enabled) => `(${name} ${enabled ? "aktiviert" : "deaktiviert"}, in derselben Sitzung)`,
     extensionToggled: (name, enabled) => `(${name} ${enabled ? "aktiviert" : "deaktiviert"}: die Sitzung wird mit derselben Unterhaltung neu geöffnet)`,
     extensionNotInstalled: (name) => `(${name} ist nicht installiert: /extensions listet sie auf)`,
-    extensionsUsage: "(Verwendung: /extensions, enable|disable <Name>, config <Name> [Schlüssel=Wert…], search [Wörter], install <Name>, update [Name], remove <Name> [--delete-data], reload, trust, sign-in <Name> [Rückruf-URL], sign-out <Name>)",
+    extensionsUsage: "(Verwendung: /extensions, enable|disable <Name>, config <Name> [Schlüssel=Wert… | confirm=on|off|reset], search [Wörter], install <Name>, update [Name], remove <Name> [--delete-data], reload, trust, sign-in <Name> [Rückruf-URL], sign-out <Name>)",
     extensionsCantReopen: "(dieser Chat kann seine Sitzung nicht neu öffnen: im Terminal aktivieren oder deaktivieren und neu starten)",
     extensionOptions: (name) => `Optionen von ${name}:`,
     extensionNoOptions: (name) => `(${name} hat keine Optionen)`,
@@ -60,6 +60,15 @@ export const de = {
     extensionAlreadySignedIn: (name) => `(${name} ist bereits angemeldet)`,
     extensionSignInUnavailable: (name) => `(bei ${name} kann man sich hier nicht anmelden: sie läuft nicht in dieser Sitzung, hat keinen entfernten Server, oder das SDK dieses Agenten kann es nicht)`,
     extensionSignedOut: (name) => `(bei ${name} abgemeldet: sie bittet dich, dich erneut anzumelden)`,
+    remoteCallTitle: (destination) => `Das an ${destination} senden? Es verlässt diesen Computer`,
+    guidedTitle: (extension) => `${extension} das tun lassen?`,
+    confirmAnswers: { yes: "Ja", session: "Ja, für diese Sitzung", always: "Ja, immer", no: "Nein", never: "Nein, nie" },
+    extensionConfirmOn: (name) => `Im geführten Modus fragen die Werkzeuge von ${name}, die etwas ändern, zuerst (confirm=off führt sie ohne Nachfrage aus):`,
+    extensionConfirmOff: (name) => `Im geführten Modus laufen die Werkzeuge von ${name} ohne Nachfrage (confirm=on fragt wieder).`,
+    confirmKept: (tool, answer) => `  ${tool}: ${answer === "always" ? "immer ja" : "nie"}`,
+    confirmNoneKept: "  (keine gespeicherten Antworten; confirm=reset vergisst sie)",
+    connectorsAllowed: (names) => `claude.ai-Connectoren: ${names}`,
+    connectorsMissing: (names) => `Nicht in deinem claude.ai-Konto: ${names} (verbinde ihn auf claude.ai und öffne die Sitzung neu)`,
     extensionInstalled: (name) => `(${name} installiert: in einem neuen Gespräch da, oder sofort mit /extensions reload, ohne dieses zu verlieren)`,
     extensionUpdated: (name, from, to) => `(${name} aktualisiert, ${from} → ${to}: in einem neuen Gespräch da, oder sofort mit /extensions reload)`,
     extensionsUpToDate: "(alle Erweiterungen aus einem Marketplace sind aktuell)",

package/dist/core/messages/en.d.ts

@@ -82,6 +82,28 @@ export interface Messages {
     extensionAlreadySignedIn(name: string): string;
     extensionSignInUnavailable(name: string): string;
     extensionSignedOut(name: string): string;
+    /** Before a call to a remote MCP server, when the agent asks first (#70): where it goes. */
+    remoteCallTitle(destination: string): string;
+    /** Guided mode's question before an installed extension's tool that changes things (#74): its title. */
+    guidedTitle(extension: string): string;
+    /** Its answers (#76): this call, this session, always, no, never. */
+    confirmAnswers: {
+        yes: string;
+        session: string;
+        always: string;
+        no: string;
+        never: string;
+    };
+    /** In /extensions config: whether its tools ask in guided mode, before the answers kept. */
+    extensionConfirmOn(name: string): string;
+    extensionConfirmOff(name: string): string;
+    /** A kept answer about one of its tools. */
+    confirmKept(tool: string, answer: "always" | "never"): string;
+    confirmNoneKept: string;
+    /** In /extensions: the claude.ai connectors let in (#70). */
+    connectorsAllowed(names: string): string;
+    /** In /extensions: connectors the agent asked for that the account hasn't. */
+    connectorsMissing(names: string): string;
     extensionUpdated(name: string, from: string, to: string): string;
     extensionsUpToDate: string;
     extensionRemoved(name: string, withData: boolean): string;

package/dist/core/messages/en.js

@@ -34,7 +34,7 @@ export const en = {
     extensionSwitched: (name, enabled) => `(${name} ${enabled ? "enabled" : "disabled"}, in this same session)`,
     extensionToggled: (name, enabled) => `(${name} ${enabled ? "enabled" : "disabled"}: the session reopens, with the same conversation)`,
     extensionNotInstalled: (name) => `(${name} isn't installed: /extensions lists them)`,
-    extensionsUsage: "(usage: /extensions, enable|disable <name>, config <name> [key=value…], search [words], install <name>, update [name], remove <name> [--delete-data], reload, trust, sign-in <name> [callback URL], sign-out <name>)",
+    extensionsUsage: "(usage: /extensions, enable|disable <name>, config <name> [key=value… | confirm=on|off|reset], search [words], install <name>, update [name], remove <name> [--delete-data], reload, trust, sign-in <name> [callback URL], sign-out <name>)",
     extensionsCantReopen: "(this chat can't reopen its session: enable or disable it from the terminal, and start again)",
     extensionOptions: (name) => `${name}'s options:`,
     extensionNoOptions: (name) => `(${name} has no options)`,
@@ -60,6 +60,15 @@ export const en = {
     extensionAlreadySignedIn: (name) => `(${name} is already signed in)`,
     extensionSignInUnavailable: (name) => `(${name} can't be signed in to here: it isn't running in this session, has no remote server, or this agent's SDK can't sign in)`,
     extensionSignedOut: (name) => `(signed out of ${name}: it will ask you to sign in again)`,
+    remoteCallTitle: (destination) => `Send this to ${destination}? It leaves this computer`,
+    guidedTitle: (extension) => `Let ${extension} do this?`,
+    confirmAnswers: { yes: "Yes", session: "Yes, for this session", always: "Yes, always", no: "No", never: "No, never" },
+    extensionConfirmOn: (name) => `In guided mode, ${name}'s tools that change things ask first (confirm=off runs them without asking):`,
+    extensionConfirmOff: (name) => `In guided mode, ${name}'s tools run without asking (confirm=on asks again).`,
+    confirmKept: (tool, answer) => `  ${tool}: ${answer === "always" ? "always yes" : "never"}`,
+    confirmNoneKept: "  (no kept answers; confirm=reset forgets them)",
+    connectorsAllowed: (names) => `claude.ai connectors: ${names}`,
+    connectorsMissing: (names) => `Not in your claude.ai account: ${names} (connect it on claude.ai, then reopen the session)`,
     extensionUpdated: (name, from, to) => `(${name} updated, ${from} → ${to}: it's there in a new conversation, or now with /extensions reload)`,
     extensionsUpToDate: "(every extension from a marketplace is up to date)",
     extensionRemoved: (name, withData) => `(${name} removed${withData ? ", with its data" : "; its data is kept for a reinstall"})`,

package/dist/core/messages/es.js

@@ -35,7 +35,7 @@ export const es = {
     extensionSwitched: (name, enabled) => `(${name} ${enabled ? "activada" : "desactivada"}, en esta misma sesión)`,
     extensionToggled: (name, enabled) => `(${name} ${enabled ? "activada" : "desactivada"}: la sesión se reabre, con la misma conversación)`,
     extensionNotInstalled: (name) => `(${name} no está instalada: /extensions las lista)`,
-    extensionsUsage: "(uso: /extensions, enable|disable <nombre>, config <nombre> [clave=valor…], search [palabras], install <nombre>, update [nombre], remove <nombre> [--delete-data], reload, trust, sign-in <nombre> [URL de vuelta], sign-out <nombre>)",
+    extensionsUsage: "(uso: /extensions, enable|disable <nombre>, config <nombre> [clave=valor… | confirm=on|off|reset], search [palabras], install <nombre>, update [nombre], remove <nombre> [--delete-data], reload, trust, sign-in <nombre> [URL de vuelta], sign-out <nombre>)",
     extensionsCantReopen: "(este chat no puede reabrir su sesión: actívala o desactívala desde la terminal y vuelve a empezar)",
     extensionOptions: (name) => `Opciones de ${name}:`,
     extensionNoOptions: (name) => `(${name} no tiene opciones)`,
@@ -60,6 +60,15 @@ export const es = {
     extensionAlreadySignedIn: (name) => `(${name} ya tiene la sesión iniciada)`,
     extensionSignInUnavailable: (name) => `(no se puede iniciar sesión en ${name} aquí: no se ejecuta en esta sesión, no tiene servidor remoto, o el SDK de este agente no sabe hacerlo)`,
     extensionSignedOut: (name) => `(sesión cerrada en ${name}: te pedirá que vuelvas a iniciarla)`,
+    remoteCallTitle: (destination) => `¿Enviar esto a ${destination}? Sale de este ordenador`,
+    guidedTitle: (extension) => `¿Dejas que ${extension} haga esto?`,
+    confirmAnswers: { yes: "Sí", session: "Sí, en esta sesión", always: "Sí, siempre", no: "No", never: "No, nunca" },
+    extensionConfirmOn: (name) => `En modo guiado, las herramientas de ${name} que cambian cosas preguntan antes (confirm=off las ejecuta sin preguntar):`,
+    extensionConfirmOff: (name) => `En modo guiado, las herramientas de ${name} se ejecutan sin preguntar (confirm=on vuelve a preguntar).`,
+    confirmKept: (tool, answer) => `  ${tool}: ${answer === "always" ? "siempre sí" : "nunca"}`,
+    confirmNoneKept: "  (ninguna respuesta guardada; confirm=reset las olvida)",
+    connectorsAllowed: (names) => `Conectores de claude.ai: ${names}`,
+    connectorsMissing: (names) => `No están en tu cuenta de claude.ai: ${names} (conéctalo en claude.ai y vuelve a abrir la sesión)`,
     extensionInstalled: (name) => `(${name} instalada: está en una conversación nueva, o ya con /extensions reload, sin perder esta)`,
     extensionUpdated: (name, from, to) => `(${name} actualizada, ${from} → ${to}: está en una conversación nueva, o ya con /extensions reload)`,
     extensionsUpToDate: "(todas las extensiones de un marketplace están al día)",

package/dist/core/messages/fr.js

@@ -35,7 +35,7 @@ export const fr = {
     extensionSwitched: (name, enabled) => `(${name} ${enabled ? "activée" : "désactivée"}, dans cette même session)`,
     extensionToggled: (name, enabled) => `(${name} ${enabled ? "activée" : "désactivée"} : la session se rouvre, avec la même conversation)`,
     extensionNotInstalled: (name) => `(${name} n'est pas installée : /extensions les liste)`,
-    extensionsUsage: "(usage : /extensions, enable|disable <nom>, config <nom> [clé=valeur…], search [mots], install <nom>, update [nom], remove <nom> [--delete-data], reload, trust, sign-in <nom> [URL de retour], sign-out <nom>)",
+    extensionsUsage: "(usage : /extensions, enable|disable <nom>, config <nom> [clé=valeur… | confirm=on|off|reset], search [mots], install <nom>, update [nom], remove <nom> [--delete-data], reload, trust, sign-in <nom> [URL de retour], sign-out <nom>)",
     extensionsCantReopen: "(ce chat ne peut pas rouvrir sa session : activez-la ou désactivez-la depuis le terminal, puis recommencez)",
     extensionOptions: (name) => `Options de ${name} :`,
     extensionNoOptions: (name) => `(${name} n'a pas d'options)`,
@@ -60,6 +60,15 @@ export const fr = {
     extensionAlreadySignedIn: (name) => `(${name} est déjà connectée)`,
     extensionSignInUnavailable: (name) => `(impossible de se connecter à ${name} ici : elle ne tourne pas dans cette session, n'a pas de serveur distant, ou le SDK de cet agent ne sait pas le faire)`,
     extensionSignedOut: (name) => `(déconnecté de ${name} : elle vous demandera de vous reconnecter)`,
+    remoteCallTitle: (destination) => `Envoyer ceci à ${destination} ? Cela quitte cet ordinateur`,
+    guidedTitle: (extension) => `Laisser ${extension} faire ceci ?`,
+    confirmAnswers: { yes: "Oui", session: "Oui, pour cette session", always: "Oui, toujours", no: "Non", never: "Non, jamais" },
+    extensionConfirmOn: (name) => `En mode guidé, les outils de ${name} qui modifient des choses demandent d'abord (confirm=off les exécute sans demander) :`,
+    extensionConfirmOff: (name) => `En mode guidé, les outils de ${name} s'exécutent sans demander (confirm=on demande à nouveau).`,
+    confirmKept: (tool, answer) => `  ${tool} : ${answer === "always" ? "toujours oui" : "jamais"}`,
+    confirmNoneKept: "  (aucune réponse gardée ; confirm=reset les oublie)",
+    connectorsAllowed: (names) => `Connecteurs claude.ai : ${names}`,
+    connectorsMissing: (names) => `Absents de votre compte claude.ai : ${names} (connectez-le sur claude.ai, puis rouvrez la session)`,
     extensionInstalled: (name) => `(${name} installée : elle est là dans une nouvelle conversation, ou dès maintenant avec /extensions reload, en gardant celle-ci)`,
     extensionUpdated: (name, from, to) => `(${name} mise à jour, ${from} → ${to} : elle est là dans une nouvelle conversation, ou dès maintenant avec /extensions reload)`,
     extensionsUpToDate: "(toutes les extensions d'un marketplace sont à jour)",

package/dist/core/readOnlyHints.d.ts

@@ -1,13 +1,19 @@
 import type { McpServerStatus } from "@anthropic-ai/claude-agent-sdk";
+/** What an MCP tool's own server says about it: `readOnlyHint`, `destructiveHint`. */
+export type ToolHint = "readOnly" | "destructive";
 /**
- * Plan mode's read-only tools from the MCP servers themselves (#53): for an installed extension
- * whose manifest lists no `readOnlyTools`, a tool its server marks `readOnlyHint` only reads.
+ * What the MCP servers themselves say about their tools (#53, #76): for an installed extension
+ * whose manifest lists no `readOnlyTools` (plan mode, guided mode) or no `confirmTools` (guided
+ * mode), a tool its server marks `readOnlyHint` only reads, and one it marks `destructiveHint`
+ * always asks.
  *
- * Asked when plan mode meets the call, not once at start: a server is `pending` for seconds after
+ * Asked when a gate meets the call, not once at start: a server is `pending` for seconds after
  * the session starts, and one turned off and on again (liveExtensions.ts) may come back with
  * other tools. The SDK's `mcpServerStatus()` gives each connected server's tools with
- * `annotations.readOnly`, set exactly when the server says `readOnlyHint: true` (confirmed
- * empirically: `readOnlyHint: false` and no hint both leave it out; the names are the short ones).
- * Anything else — not connected, not asked in time, no hint — is no: plan mode denies.
+ * `annotations.readOnly` (and `destructive`), set exactly when the server says the hint is `true`
+ * (confirmed empirically for `readOnlyHint`: `false` and no hint both leave it out; the names are
+ * the short ones). Anything else — not connected, not asked in time, no hint — is no.
  */
+export declare function createToolHints(servers: readonly string[], status: () => (() => Promise<McpServerStatus[]>) | undefined, hint: ToolHint): (toolName: string) => Promise<boolean>;
+/** Plan mode's read-only tools from the servers themselves: `createToolHints()` for `readOnlyHint`. */
 export declare function createReadOnlyHints(servers: readonly string[], status: () => (() => Promise<McpServerStatus[]>) | undefined): (toolName: string) => Promise<boolean>;

package/dist/core/readOnlyHints.js

@@ -1,15 +1,17 @@
 /**
- * Plan mode's read-only tools from the MCP servers themselves (#53): for an installed extension
- * whose manifest lists no `readOnlyTools`, a tool its server marks `readOnlyHint` only reads.
+ * What the MCP servers themselves say about their tools (#53, #76): for an installed extension
+ * whose manifest lists no `readOnlyTools` (plan mode, guided mode) or no `confirmTools` (guided
+ * mode), a tool its server marks `readOnlyHint` only reads, and one it marks `destructiveHint`
+ * always asks.
  *
- * Asked when plan mode meets the call, not once at start: a server is `pending` for seconds after
+ * Asked when a gate meets the call, not once at start: a server is `pending` for seconds after
  * the session starts, and one turned off and on again (liveExtensions.ts) may come back with
  * other tools. The SDK's `mcpServerStatus()` gives each connected server's tools with
- * `annotations.readOnly`, set exactly when the server says `readOnlyHint: true` (confirmed
- * empirically: `readOnlyHint: false` and no hint both leave it out; the names are the short ones).
- * Anything else — not connected, not asked in time, no hint — is no: plan mode denies.
+ * `annotations.readOnly` (and `destructive`), set exactly when the server says the hint is `true`
+ * (confirmed empirically for `readOnlyHint`: `false` and no hint both leave it out; the names are
+ * the short ones). Anything else — not connected, not asked in time, no hint — is no.
  */
-export function createReadOnlyHints(servers, status) {
+export function createToolHints(servers, status, hint) {
     return async (toolName) => {
         const server = servers.find((name) => toolName.startsWith(`mcp__${name}__`));
         const read = status();
@@ -18,9 +20,13 @@ export function createReadOnlyHints(servers, status) {
         const tool = toolName.slice(`mcp__${server}__`.length);
         const statuses = await within(read(), []);
         const found = statuses.find((entry) => entry.name === server && entry.status === "connected");
-        return found?.tools?.some((entry) => entry.name === tool && entry.annotations?.readOnly === true) ?? false;
+        return found?.tools?.some((entry) => entry.name === tool && entry.annotations?.[hint] === true) ?? false;
     };
 }
+/** Plan mode's read-only tools from the servers themselves: `createToolHints()` for `readOnlyHint`. */
+export function createReadOnlyHints(servers, status) {
+    return createToolHints(servers, status, "readOnly");
+}
 // A call to the session made from a hook, before a tool runs: never let it hold the tool up.
 const TIMEOUT_MS = 3000;
 const within = (promise, fallback) => Promise.race([promise.catch(() => fallback), new Promise((resolve) => setTimeout(() => resolve(fallback), TIMEOUT_MS).unref())]);

package/dist/core/runner.js

@@ -35,6 +35,29 @@ function signInControls(result) {
         ...(clear ? { mcpClearAuth: (server) => clear(server) } : {}),
     };
 }
+/**
+ * Turns back on the servers the CLI saved as switched off in an earlier session (#75):
+ * `toggleMcpServer(name, false)` is saved in the Claude Code config of the session's folder
+ * (`~/.claude.json`, `disabledMcpServers`), not only in the session (confirmed empirically, CLI
+ * 2.1.300), so a server the kit passes again would start disabled. The kit passes only what it
+ * wants running, so one of them that starts disabled is turned on, which also removes the saved
+ * entry. Only while the session's servers start: switching one off later in the session is the
+ * live switch's (liveExtensions.ts).
+ */
+async function restoreSavedSwitches(result, options) {
+    const passed = new Set(Object.keys(options.mcpServers ?? {}));
+    if (!passed.size)
+        return;
+    for (let attempt = 0; attempt < 30; attempt++) {
+        const status = (await result.mcpServerStatus().catch(() => [])).filter((server) => passed.has(server.name));
+        for (const server of status)
+            if (server.status === "disabled")
+                await result.toggleMcpServer(server.name, true).catch(() => undefined);
+        if (status.length && !status.some((server) => server.status === "pending" || server.status === "disabled"))
+            return;
+        await new Promise((resolve) => setTimeout(resolve, 500));
+    }
+}
 /**
  * Thin wrapper around the SDK's own `query()`: same two-argument shape (a plain string
  * for a one-shot run, or an `AsyncIterable<SDKUserMessage>` — see `createInputQueue()` —
@@ -56,6 +79,7 @@ export function runQuery(prompt, options) {
         mcpServerStatus: () => result.mcpServerStatus(),
         ...signInControls(result),
     });
+    void restoreSavedSwitches(result, options);
     // The main agent's tool calls by id, to name the results that come back for them.
     const toolNames = new Map();
     async function* generateEvents() {

package/dist/core/session.d.ts

@@ -77,6 +77,11 @@ export interface ExtensionsStatus {
     sessionTools?: () => readonly string[];
     /** Its MCP servers as they are now (empty until it has started): which remote ones need signing in (#61). */
     serverStatus?: () => Promise<McpServerStatus[]>;
+    /** The claude.ai connectors let in (#70), and the ones asked for that the account hasn't; none when the agent asks for none. */
+    connectors?: {
+        allowed: string[];
+        missing: string[];
+    };
 }
 /**
  * The CLI's folder for a project, where it keeps each session's transcript and large tool

package/dist/core/session.js

@@ -8,6 +8,9 @@ import { createSubagentTypeGate } from "./hooks/subagentTypeGate.js";
 import { createSubagentForegroundGate } from "./hooks/subagentForegroundGate.js";
 import { createFileScopeGate } from "./hooks/fileScopeGate.js";
 import { createPlanGate } from "./hooks/planGate.js";
+import { createRemoteGate } from "./hooks/remoteGate.js";
+import { createGuidedGate } from "./hooks/guidedGate.js";
+import { chooseConnectors, discoverConnectors, serverToolPrefix } from "./claudeAiConnectors.js";
 import { createHumanApprovalServer } from "./tools/humanApproval.js";
 import { createManualLoginServer } from "./tools/manualLogin.js";
 import { createTimeServer } from "./tools/time.js";
@@ -17,7 +20,7 @@ import { aboutExtension, describeCapability, extensionsPromptSection, resolveExt
 import { allowAnyMcpTool } from "./mcpPermissions.js";
 import { pluginAgents } from "./pluginAgents.js";
 import { outsideArchive, unpackedClaudeExecutable } from "./packaged.js";
-import { listInstalled, loadExternalExtensions, scopePrivateDir } from "./externalExtensions.js";
+import { listInstalled, loadExternalExtensions, readLock, scopePrivateDir } from "./externalExtensions.js";
 import { replyLanguageInstruction } from "./language.js";
 import { chooseLanguage } from "./messages/index.js";
 import { createRunStore } from "./runs.js";
@@ -25,7 +28,7 @@ import { createSessionView, registerSessionView } from "./sessionFacts.js";
 import { createExtensionAuth, createExtensionRestart, createExtensionSwitch, mountPlugin } from "./liveExtensions.js";
 import { secretsDir } from "./extensionOptions.js";
 import { createElicitationHandler } from "./elicitation.js";
-import { createReadOnlyHints } from "./readOnlyHints.js";
+import { createReadOnlyHints, createToolHints } from "./readOnlyHints.js";
 import { agentKitVersion } from "./version.js";
 /**
  * Builds the `options` object passed to the Agent SDK's `query()` — everything about
@@ -179,6 +182,28 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
     const readOnlyTools = fromExtensions((contribution) => contribution.readOnlyTools);
     // Those whose manifest lists none: their servers say, asked while the session runs (#53).
     const readOnlyHintServers = fromExtensions((contribution) => contribution.readOnlyHintServers);
+    const readOnlyHinted = readOnlyHintServers.length ? createReadOnlyHints(readOnlyHintServers, () => late.view?.controls().mcpServerStatus) : undefined;
+    // Guided mode's gate for the installed extensions' tools that change things (#74, #76): whose
+    // they are, which always ask (the manifest's list and the agent's, else the servers' hints),
+    // and those the person said never to, kept in the lock: out of the session altogether.
+    const gateSpec = spec.extensionGate ?? {};
+    const guardedExtensions = gateSpec.enabled === false
+        ? []
+        : resolved.active.flatMap(({ extension }, index) => {
+            const installed = installedDirs.get(extension.name);
+            if (!installed)
+                return [];
+            const servers = Object.keys(added[index]?.mcpServers ?? {});
+            const own = (gateSpec.confirmTools?.[extension.name] ?? []).flatMap((tool) => servers.map((server) => `mcp__${server}__${tool}`));
+            return [{ name: extension.name, scopeDir: installed.scopeDir, servers, confirmTools: [...(added[index]?.confirmTools ?? []), ...own] }];
+        });
+    const neverTools = (await Promise.all(guardedExtensions.map(async (extension) => {
+        const confirm = (await readLock(extension.scopeDir).catch(() => ({})))[extension.name]?.confirm;
+        if (confirm?.off)
+            return [];
+        const never = Object.entries(confirm?.tools ?? {}).filter(([, answer]) => answer === "never");
+        return never.flatMap(([tool]) => extension.servers.map((server) => `mcp__${server}__${tool}`));
+    }))).flat();
     // What no file tool may touch: the agent's denied paths and the SDK's own credentials.
     // And the installed extensions' sensitive option values (#55), in each scope's .secrets/.
     const deniedPaths = [
@@ -191,6 +216,19 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
     ];
     const transcriptPath = path.join(runDir, "transcript.jsonl");
     const transcriptLogger = createTranscriptLogger(transcriptPath, config.secrets ?? []);
+    const guidedGate = guardedExtensions.length
+        ? createGuidedGate({
+            runDir,
+            mode: () => modeControl.mode,
+            extensions: guardedExtensions,
+            isReadOnly: async (tool) => readOnlyTools.includes(tool) || ((await readOnlyHinted?.(tool)) ?? false),
+            isDestructive: createToolHints(fromExtensions((contribution) => contribution.confirmHintServers), () => late.view?.controls().mcpServerStatus, "destructive"),
+            ...(gateSpec.autonomous ? { autonomous: gateSpec.autonomous } : {}),
+            // The session's labels, built below: read when a call is asked about.
+            labels: () => toolLabels,
+            record: (decision) => transcriptLogger.note("guided_decision", { ...decision }),
+        })
+        : undefined;
     const promptSections = [
         spec.buildSystemPrompt(config),
         // What's on and what isn't, then the extensions' own sections.
@@ -200,6 +238,12 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
     ];
     // Packaged, the SDK would look for its CLI binary inside the archive, and hang (#42).
     const claudeExecutable = unpackedClaudeExecutable();
+    // The claude.ai connectors the agent lets in (#70): the account asked which it has, the rest
+    // denied by name (a session setting, never the person's config). None asked, none looked for.
+    const connectors = config.claudeAiConnectors?.length
+        ? chooseConnectors(await discoverConnectors(config.projectDir, claudeExecutable ? { pathToClaudeCodeExecutable: claudeExecutable } : {}), config.claudeAiConnectors)
+        : undefined;
+    const allowedConnectors = connectors?.allowed ?? [];
     const sdkOptions = {
         ...(claudeExecutable ? { pathToClaudeCodeExecutable: claudeExecutable } : {}),
         systemPrompt: withReplyLine(promptSections.join("\n\n")),
@@ -220,7 +264,8 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
             autoCompactEnabled: options.autoCompactEnabled ?? true,
             autoMemoryEnabled: false,
             includeGitInstructions: false,
-            disableClaudeAiConnectors: true,
+            disableClaudeAiConnectors: !allowedConnectors.length,
+            ...(allowedConnectors.length && connectors.denied.length ? { deniedMcpServers: connectors.denied.map((serverName) => ({ serverName })) } : {}),
             // An installed extension's plugin may carry hooks: none run (ADR-025). The kit's own,
             // passed in `hooks`, still do (confirmed empirically).
             ...(externalPlugins.size ? { disableAllHooks: true } : {}),
@@ -246,7 +291,8 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
         // mcpPermissions.ts for why a fixed allowedTools wildcard can't cover a server whose
         // name isn't known ahead of time.
         canUseTool: allowAnyMcpTool,
-        disallowedTools: spec.disallowedTools ?? [],
+        // And the extensions' tools the person said never to (#76).
+        disallowedTools: [...(spec.disallowedTools ?? []), ...neverTools],
         // TodoWrite (todos.ts) only exists with CLAUDE_CODE_ENABLE_TASKS=0: by default the CLI
         // offers its TaskCreate/TaskUpdate/TaskList/TaskGet tools instead, and drops TodoWrite from
         // the session even when `tools` names it (confirmed empirically). `env` replaces the
@@ -279,7 +325,7 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
         ...(subagentDefinitions ? { agents: subagentDefinitions } : {}),
         mcpServers: {
             ...spec.buildMcpServers(config, runDir),
-            ...(includeApprovalTool ? { approvals: createHumanApprovalServer(runDir, spec.humanApprovalTexts, { modeControl }) } : {}),
+            ...(includeApprovalTool ? { approvals: createHumanApprovalServer(runDir, spec.humanApprovalTexts, { modeControl, ...(guidedGate ? { onApproval: guidedGate.approvalAnswered } : {}) }) } : {}),
             ...(manualInterventionTexts ? { manualLogin: createManualLoginServer(runDir, manualInterventionTexts) } : {}),
             // The extensions' tools (the knowledge base's, the sources').
             ...Object.assign({}, ...added.map((contribution) => contribution.mcpServers ?? {})),
@@ -292,6 +338,20 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
         hooks: {
             PreToolUse: [
                 { hooks: [transcriptLogger.preToolUse] },
+                // Remote servers (#70): connectors not chosen are blocked; the rest as `remoteServers` says.
+                {
+                    hooks: [
+                        createRemoteGate({
+                            runDir,
+                            policy: config.remoteServers ?? "allow",
+                            destination: (tool) => remoteDestinations.find(([prefix]) => tool.startsWith(prefix))?.[1],
+                            allowedConnectors: allowedConnectors.map(serverToolPrefix),
+                            canAsk: () => modeControl.mode !== "autonomous",
+                        }),
+                    ],
+                },
+                // Guided mode asks before an installed extension's tool that changes things (#74, #76).
+                ...(guidedGate ? [{ hooks: [guidedGate.preToolUse] }] : []),
                 ...(fileTools.length || toolOnlyDirs.length
                     ? [{ hooks: [createFileScopeGate({
                                     projectDir: config.projectDir,
@@ -323,7 +383,7 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
                                 createPlanGate({
                                     projectDir: config.projectDir,
                                     readOnlyTools,
-                                    ...(readOnlyHintServers.length ? { isReadOnlyHinted: createReadOnlyHints(readOnlyHintServers, () => late.view?.controls().mcpServerStatus) } : {}),
+                                    ...(readOnlyHinted ? { isReadOnlyHinted: readOnlyHinted } : {}),
                                     ...(spec.planMode?.isPlanFile ? { isPlanFile: (filePath) => spec.planMode.isPlanFile(filePath, config) } : {}),
                                     ...(spec.planMode?.isReadOnlyTool ? { isReadOnlyTool: spec.planMode.isReadOnlyTool } : {}),
                                 }, () => modeControl.mode === "plan"),
@@ -340,8 +400,28 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
                     : []),
             ],
             PostToolUse: [{ hooks: [transcriptLogger.postToolUse] }],
+            // The person's message ends a batch they approved (guided mode, #74).
+            ...(guidedGate ? { UserPromptSubmit: [{ hooks: [guidedGate.userPromptSubmit] }] } : {}),
         },
     };
+    // Where each remote server's calls go (#70), for the remote gate: an http/sse server's host
+    // (an installed extension's, the agent's own), or the claude.ai connector itself.
+    const remoteDestinations = [
+        ...Object.entries(sdkOptions.mcpServers ?? {}).flatMap(([name, server]) => {
+            const remote = server;
+            if ((remote.type !== "http" && remote.type !== "sse") || !remote.url)
+                return [];
+            let host = remote.url;
+            try {
+                host = new URL(remote.url).host;
+            }
+            catch {
+                // Not a URL the kit can read: the address as given.
+            }
+            return [[serverToolPrefix(name), host]];
+        }),
+        ...allowedConnectors.map((name) => [serverToolPrefix(name), name]),
+    ];
     // The extensions' own hooks (the memory hears the person's messages), after the kit's.
     for (const contribution of added) {
         for (const [event, matchers] of Object.entries(contribution.hooks ?? {})) {
@@ -360,6 +440,7 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
         sessionTools: () => late.view?.controls().tools ?? [],
         serverStatus: async () => (await late.view?.controls().mcpServerStatus?.().catch(() => [])) ?? [],
         inactive: resolved.inactive,
+        ...(connectors ? { connectors: { allowed: connectors.allowed, missing: connectors.missing } } : {}),
     };
     // What the session is, for the extensions that ask (sessionFacts.ts, #43).
     const viewBase = {
@@ -378,6 +459,7 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
             })),
             // Its own list: /extensions' status has another, and the live switch changes both.
             inactive: [...resolved.inactive],
+            ...(connectors ? { connectors: { allowed: connectors.allowed, missing: connectors.missing } } : {}),
         },
         subagents: Object.entries(allAgents).map(([name, agent]) => ({ name, description: agent.description })),
         skills: sdkOptions.skills === "all" ? await pluginSkills(pluginRoots) : [...(sdkOptions.skills ?? [])],

package/dist/core/sessionFacts.d.ts

@@ -37,6 +37,11 @@ export interface SessionFacts {
             name: string;
             reason: string;
         }[];
+        /** The claude.ai connectors let in (#70), and the ones asked for that the account hasn't. */
+        connectors?: {
+            allowed: string[];
+            missing: string[];
+        };
     };
     /** The subagents it can delegate to. */
     subagents: {
@@ -93,6 +98,7 @@ export type StaticSessionFacts = Omit<SessionFacts, "mode" | "switchableModes" |
             servers: string[];
         })[];
         inactive: SessionFacts["extensions"]["inactive"];
+        connectors?: SessionFacts["extensions"]["connectors"];
     };
 };
 export interface SessionView {

package/dist/core/sessionFacts.js

@@ -26,6 +26,7 @@ export function createSessionView(base, modeControl) {
                         tools: tools.length ? tools.filter((tool) => servers.some((server) => tool.startsWith(`mcp__${server}__`))) : servers.map((server) => `mcp__${server}__*`),
                     })),
                     inactive: base.extensions.inactive,
+                    ...(base.extensions.connectors ? { connectors: base.extensions.connectors } : {}),
                 },
                 tools,
                 skills: live.skills ?? base.skills,

package/dist/core/tools/humanApproval.d.ts

@@ -10,10 +10,12 @@ export declare const DEFAULT_HUMAN_APPROVAL_TEXTS: HumanApprovalTexts;
 /**
  * The tools that ask the person, in every mode but autonomous: `request_human_approval`
  * (right before an action that publishes something visible to others and that's hard to
- * undo), `ask_human` (a choice between options, in a panel, within the turn) and, when the
+ * undo; approved, guided mode lets the calls that follow through until the person's next
+ * message, see hooks/guidedGate.ts), `ask_human` (a choice between options, in a panel, within the turn) and, when the
  * session can be in plan mode (`modeControl`), `present_plan`, the kit's own way out of plan
  * mode (ADR-023): the person runs the plan, keeps planning or cancels.
  */
 export declare function createHumanApprovalServer(runDir: string, texts?: HumanApprovalTexts, options?: {
-    modeControl?: ModeControl;
+    modeControl?: ModeControl; /** Each approval's answer: guided mode's batch (#74). */
+    onApproval?: (approved: boolean) => void;
 }): import("@anthropic-ai/claude-agent-sdk").McpSdkServerConfigWithInstance;

package/dist/core/tools/humanApproval.js

@@ -16,7 +16,8 @@ const ok = (text) => ({ content: [{ type: "text", text }] });
 /**
  * The tools that ask the person, in every mode but autonomous: `request_human_approval`
  * (right before an action that publishes something visible to others and that's hard to
- * undo), `ask_human` (a choice between options, in a panel, within the turn) and, when the
+ * undo; approved, guided mode lets the calls that follow through until the person's next
+ * message, see hooks/guidedGate.ts), `ask_human` (a choice between options, in a panel, within the turn) and, when the
  * session can be in plan mode (`modeControl`), `present_plan`, the kit's own way out of plan
  * mode (ADR-023): the person runs the plan, keeps planning or cancels.
  */
@@ -29,6 +30,7 @@ export function createHumanApprovalServer(runDir, texts = DEFAULT_HUMAN_APPROVAL
             lines: [t().summaryLine(args.summary)],
         });
         const approved = APPROVED_ANSWERS.has(answer);
+        options.onApproval?.(approved);
         return {
             content: [{ type: "text", text: approved ? texts.approved : texts.rejected }],
         };

package/dist/extensions/awareness/tools.js

@@ -27,6 +27,12 @@ export function describeSession(facts) {
     });
     const inactive = facts.extensions.inactive.map(({ name, reason }) => `- **${name}** is off: it ${reason}.`);
     sections.push(`## Extensions\n\n${[...active, ...inactive].join("\n") || "None."}`);
+    // The claude.ai connectors let in (#70): the account's integrations, not installed extensions.
+    const connectors = facts.extensions.connectors;
+    if (connectors && (connectors.allowed.length || connectors.missing.length)) {
+        const missing = connectors.missing.length ? ` Asked for but not in the person's claude.ai account: ${connectors.missing.join(", ")} (they connect it on claude.ai, then the session opens again).` : "";
+        sections.push(`## claude.ai connectors\n\n${connectors.allowed.length ? `${connectors.allowed.join(", ")}: their tools are the person's claude.ai integrations; what you send them leaves the computer.` : "None of the ones asked for."}${missing}`);
+    }
     if (facts.subagents.length)
         sections.push(`## Subagents you can delegate to\n\n${facts.subagents.map(({ name, description }) => `- **${name}**: ${description}`).join("\n")}`);
     const own = facts.tools.filter((tool) => !tool.startsWith("mcp__"));

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export { createPromptLoader } from "./core/promptTemplate.js";
 export { resolveClaudeAuth, type ClaudeAuthConfig } from "./core/claudeAuth.js";
 export { ensureClaudeAuth } from "./tui/claudeAuth.js";
 export { createFriendlyToolLabel, truncate, truncatePath, withToolLabels, withToolPhrases, type ToolDescriber, type ToolLabel, type ToolLabels, } from "./core/toolLabels.js";
-export type { Mode, BaseSessionConfig, AgentSpec, AgentIdentity, PlanModeSpec } from "./core/agentSpec.js";
+export type { Mode, BaseSessionConfig, AgentSpec, AgentIdentity, PlanModeSpec, ExtensionGateSpec } from "./core/agentSpec.js";
 export { buildSessionOptions, createInputQueue, createDeferred, createModeControl, togglePlanMode, type ModeControl, type ExtensionsStatus } from "./core/session.js";
 export { runQuery, type AgentEvent, type AgentRun, type SessionUsage, type ContextUsage } from "./core/runner.js";
 export type { McpAuthentication, SessionFacts } from "./core/sessionFacts.js";
@@ -17,7 +17,7 @@ export { knowledge, type KnowledgeOptions } from "./extensions/knowledge/index.j
 export { memory, type MemoryOptions } from "./extensions/memory/index.js";
 export { describeCapability, readExtensionManifest, type AboutExtension, type CapabilityText, type DescribedCapability, type Extension, type ExtensionCapability, type ExtensionContext, type ExtensionContribution, type ExtensionManifest, type FolderOption, type UnavailableCapability, } from "./core/extensions.js";
 export { checkRequirements, type ExtensionRequirement, type RequirementCheck } from "./core/extensionRequirements.js";
-export { addExtension, codeStoreDir, installTarget, scopePrivateDir, extensionDataDir, extensionOptionStates, setExtensionOptions, removeExtension, setExtensionEnabled, listInstalled, readExternalManifest, type ExtensionAuthor, type ExtensionDirs, type ExtensionScope, type ExternalManifest, type ExternalToolLabel, type PluginServer, type LocalServer, type RemoteServer, isRemoteServer, remoteHosts, remoteServerName, type InstalledExtension, type LockEntry, type ExtensionOptionState, } from "./core/externalExtensions.js";
+export { addExtension, codeStoreDir, installTarget, scopePrivateDir, extensionDataDir, extensionOptionStates, setExtensionOptions, removeExtension, setExtensionEnabled, setExtensionConfirm, listInstalled, readExternalManifest, type ExtensionAuthor, type ExtensionDirs, type ExtensionScope, type ExternalManifest, type ExternalToolLabel, type PluginServer, type LocalServer, type RemoteServer, isRemoteServer, remoteHosts, remoteServerName, type InstalledExtension, type LockEntry, type ExtensionOptionState, type ExtensionConfirm, type ToolConfirmation, } from "./core/externalExtensions.js";
 export type { ExtensionOption, OptionValue } from "./core/extensionOptions.js";
 export type { ExtensionAuth, ExtensionRestart, ExtensionSwitch, SignIn } from "./core/liveExtensions.js";
 export { packageCacheDir, type CachedPackage } from "./core/npxPackages.js";
@@ -41,6 +41,7 @@ export { createSubagentTypeGate } from "./core/hooks/subagentTypeGate.js";
 export { createSubagentForegroundGate } from "./core/hooks/subagentForegroundGate.js";
 export { createFileScopeGate, checkFileScope, type FileScope } from "./core/hooks/fileScopeGate.js";
 export { createPlanGate, checkPlanScope, type PlanScope } from "./core/hooks/planGate.js";
+export { createGuidedGate, type GuardedExtension, type GuidedDecision, type GuidedGate } from "./core/hooks/guidedGate.js";
 export { askForDecision, askForManualIntervention, askForChoice, askForText, type ChoiceAnswer } from "./core/hooks/humanInput.js";
 export { setInteractionPort, getInteractionPort, type InteractionPort, type ApprovalPrompt, type ChoiceSettings } from "./core/interaction.js";
 export { formFields, type FormAnswer, type FormField, type FormRequest } from "./core/elicitation.js";

package/dist/index.js

@@ -17,7 +17,7 @@ export { knowledge } from "./extensions/knowledge/index.js";
 export { memory } from "./extensions/memory/index.js";
 export { describeCapability, readExtensionManifest, } from "./core/extensions.js";
 export { checkRequirements } from "./core/extensionRequirements.js";
-export { addExtension, codeStoreDir, installTarget, scopePrivateDir, extensionDataDir, extensionOptionStates, setExtensionOptions, removeExtension, setExtensionEnabled, listInstalled, readExternalManifest, isRemoteServer, remoteHosts, remoteServerName, } from "./core/externalExtensions.js";
+export { addExtension, codeStoreDir, installTarget, scopePrivateDir, extensionDataDir, extensionOptionStates, setExtensionOptions, removeExtension, setExtensionEnabled, setExtensionConfirm, listInstalled, readExternalManifest, isRemoteServer, remoteHosts, remoteServerName, } from "./core/externalExtensions.js";
 export { packageCacheDir } from "./core/npxPackages.js";
 export { addMarketplace, findPlugin, inspectMarketplace, installFromMarketplace, listMarketplaces, readMarketplaceManifest, removeMarketplace, resolvePluginSource, updateMarketplace, } from "./core/marketplaces.js";
 export { extensionCatalog, installExtension, restoreExtensions, updateExtension } from "./core/extensionCatalog.js";
@@ -40,6 +40,7 @@ export { createSubagentTypeGate } from "./core/hooks/subagentTypeGate.js";
 export { createSubagentForegroundGate } from "./core/hooks/subagentForegroundGate.js";
 export { createFileScopeGate, checkFileScope } from "./core/hooks/fileScopeGate.js";
 export { createPlanGate, checkPlanScope } from "./core/hooks/planGate.js";
+export { createGuidedGate } from "./core/hooks/guidedGate.js";
 export { askForDecision, askForManualIntervention, askForChoice, askForText } from "./core/hooks/humanInput.js";
 export { setInteractionPort, getInteractionPort } from "./core/interaction.js";
 export { formFields } from "./core/elicitation.js";

package/dist/tui/extensionCommand.d.ts

@@ -12,7 +12,7 @@ export { chatExtensionsCommand, describe } from "../chat/extensions.js";
  * - `extension add <folder> --link [--project]`: registered where it is, to develop it (not copied, its files not checked)
  * - `extension remove <name> [--project | --agent] [--yes | --keep-data]`: asks before deleting its data folder
  * - `extension enable|disable <name> [--project | --agent]`
- * - `extension config <name> [key=value… | key… | --unset key…] [--project | --agent]`: its options; `key` alone asks for it (without echo when it's a secret)
+ * - `extension config <name> [key=value… | key… | --unset key… | confirm=on|off|reset] [--project | --agent]`: its options; `key` alone asks for it (without echo when it's a secret); `confirm=` what guided mode asks about its tools (#74, #76)
  * - `extension update [name] [--yes]`: one installed from a marketplace (or all that have a newer version there) to the version it offers now, its data and options kept
  * - `extension restore [--trust]`: gets the code a workspace's lock lists and this computer lacks (#57); `--trust` trusts it too
  * - `extension trust [name…]`: lets a workspace's extensions run, as their code is now