@geravant/sinain 1.23.3 → 1.23.5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@geravant/sinain",
-  "version": "1.23.3",
-  "description": "Ambient intelligence that sees what you see, hears what you hear, and acts on your behalf",
+  "version": "1.23.5",
+  "description": "Context OS — captures what you see and hear, distills it into a private knowledge graph for AI-powered work",
   "type": "module",
   "bin": {
     "sinain": "./cli.js",

package/sinain-agent/agents.example.json

@@ -53,10 +53,10 @@
   "agentMaxTurns": 8,
   "spawnMaxTurns": 25,
 
-  "allowedTools": "mcp__sinain",
+  "allowedTools": "mcp__sinain ToolSearch",
   "escAllowedTools": "${allowedTools} Bash(git:*) Edit Write Read Glob Grep LS",
   "spawnAllowedTools": "${allowedTools} Bash(git:*) Edit Write Read Glob Grep LS",
-  "autoApproveTools": "Read Glob Grep Ls Cat mcp__sinain*",
+  "autoApproveTools": "Read Glob Grep Ls Cat Edit Write MultiEdit NotebookEdit WebFetch WebSearch TaskCreate TaskUpdate TaskGet TaskList TaskOutput TaskStop LSP Skill Monitor BashOutput KillBash mcp__sinain* ToolSearch",
 
   "analyzer": {
     "debounceMs": 6000,

package/sinain-agent/run.sh

@@ -259,6 +259,12 @@ invoke_agent() {
           # still routes each call to the overlay for user Allow/Deny. Widen the
           # whitelist so the hook can do its job. Override via SINAIN_SPAWN_ALLOWED_TOOLS.
           local spawn_allowed="${SINAIN_SPAWN_ALLOWED_TOOLS:-${ALLOWED_TOOLS} Bash(git:*) Edit Write Read Glob Grep LS}"
+          # ToolSearch is a built-in Claude Code uses to load deferred MCP tool
+          # schemas. Without it pre-approved, every escalation that needs an
+          # un-cached sinain_* tool triggers a permission prompt — Test Mac
+          # hit this on overlay-v1.24.5 (~4 prompts per 7min). Always include
+          # regardless of agents.json content (defense-in-depth).
+          spawn_allowed="$spawn_allowed ToolSearch"
           if [ "$quiet" = "true" ]; then
             "$bin" \
               --mcp-config "$MCP_CONFIG" \
@@ -278,6 +284,9 @@ invoke_agent() {
         else
           # Escalation path. Override via SINAIN_ESC_ALLOWED_TOOLS.
           local esc_allowed="${SINAIN_ESC_ALLOWED_TOOLS:-${ALLOWED_TOOLS} Bash(git:*) Edit Write Read Glob Grep LS}"
+          # See spawn_allowed comment above — ToolSearch must be pre-approved
+          # or every escalation triggers a permission prompt.
+          esc_allowed="$esc_allowed ToolSearch"
           if [ "$quiet" = "true" ]; then
             "$bin" \
               --mcp-config "$MCP_CONFIG" \

package/sinain-core/src/config.ts

@@ -291,7 +291,15 @@ export function loadConfig(): CoreConfig {
   const autoApproveRaw = fromCfgStr(
     agentsCfg?.autoApproveTools,
     "SINAIN_AUTO_APPROVE_TOOLS",
-    "Read Glob Grep Ls Cat mcp__sinain* ToolSearch",
+    // Default auto-approve covers the Claude Code core tools the escalation
+    // flow realistically uses without prompting. Bash is intentionally NOT
+    // included — users wanting scoped shell commands without prompts should
+    // add patterns like "Bash(git:*) Bash(npm:*)" to agents.json.
+    "Read Glob Grep Ls Cat Edit Write MultiEdit NotebookEdit " +
+    "WebFetch WebSearch " +
+    "TaskCreate TaskUpdate TaskGet TaskList TaskOutput TaskStop " +
+    "LSP Skill Monitor BashOutput KillBash " +
+    "mcp__sinain* ToolSearch",
   );
   const permissionsConfig = {
     autoApproveTools: autoApproveRaw.split(/\s+/).filter((t) => t.length > 0),