@hyperdrive.bot/fleet-server 0.3.99

package/dist/server/server/agent/providers/claude/task-notification-tool-call.js

@@ -0,0 +1,292 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+const TASK_NOTIFICATION_MARKER = "<task-notification>";
+const TAG_NAME_PATTERN = /[.*+?^${}()|[\]\\]/g;
+const OptionalNonEmptyTrimmedStringSchema = z.preprocess((value) => (typeof value === "string" ? value.trim() : value), z.string().min(1).optional());
+const TaskNotificationEnvelopeSchema = z.object({
+    messageId: z.string().nullable(),
+    taskId: z.string().nullable(),
+    status: z.string().nullable(),
+    summary: z.string().nullable(),
+    outputFile: z.string().nullable(),
+    rawText: z.string().nullable(),
+});
+const TaskNotificationUserContentBlockSchema = z
+    .object({
+    text: z.string().optional(),
+    input: z.string().optional(),
+})
+    .passthrough();
+const TaskNotificationUserContentSchema = z.union([
+    z.string(),
+    z.array(TaskNotificationUserContentBlockSchema),
+]);
+const TaskNotificationHistoryRecordSchema = z
+    .object({
+    type: z.string().optional(),
+    subtype: z.string().optional(),
+    uuid: z.string().optional(),
+    message_id: z.string().optional(),
+    task_id: z.string().optional(),
+    status: z.string().optional(),
+    summary: z.string().optional(),
+    output_file: z.string().optional(),
+    content: z.string().optional(),
+})
+    .passthrough();
+const MapTaskNotificationUserContentToToolCallInputSchema = z.object({
+    content: z.unknown(),
+    messageId: z.string().optional().nullable(),
+});
+function toNonEmptyString(value) {
+    const parsed = OptionalNonEmptyTrimmedStringSchema.safeParse(value);
+    if (!parsed.success) {
+        return null;
+    }
+    return parsed.data ?? null;
+}
+function collectUserContentParts(content) {
+    if (typeof content === "string") {
+        const normalized = toNonEmptyString(content);
+        return normalized ? [normalized] : [];
+    }
+    const parts = [];
+    for (const block of content) {
+        const text = toNonEmptyString(block.text);
+        if (text) {
+            parts.push(text);
+        }
+        const input = toNonEmptyString(block.input);
+        if (input) {
+            parts.push(input);
+        }
+    }
+    return parts;
+}
+function extractUserContentText(content) {
+    const parsedContent = TaskNotificationUserContentSchema.safeParse(content);
+    if (!parsedContent.success) {
+        return null;
+    }
+    const parts = collectUserContentParts(parsedContent.data);
+    if (parts.length === 0) {
+        return null;
+    }
+    return parts.join("\n\n");
+}
+function readTaskNotificationTagValue(input) {
+    const escapedTagName = input.tagName.replace(TAG_NAME_PATTERN, "\\$&");
+    const pattern = new RegExp(`<${escapedTagName}>\\s*([\\s\\S]*?)\\s*</${escapedTagName}>`, "i");
+    const match = input.text.match(pattern);
+    if (!match) {
+        return null;
+    }
+    return toNonEmptyString(match[1]);
+}
+function parseTaskNotificationFromUserContent(input) {
+    const parsedInput = MapTaskNotificationUserContentToToolCallInputSchema.safeParse(input);
+    if (!parsedInput.success) {
+        return null;
+    }
+    const rawText = extractUserContentText(parsedInput.data.content);
+    if (!rawText || !rawText.includes(TASK_NOTIFICATION_MARKER)) {
+        return null;
+    }
+    return TaskNotificationEnvelopeSchema.parse({
+        messageId: toNonEmptyString(parsedInput.data.messageId),
+        taskId: readTaskNotificationTagValue({ text: rawText, tagName: "task-id" }),
+        status: readTaskNotificationTagValue({ text: rawText, tagName: "status" }),
+        summary: readTaskNotificationTagValue({ text: rawText, tagName: "summary" }),
+        outputFile: readTaskNotificationTagValue({ text: rawText, tagName: "output-file" }) ??
+            readTaskNotificationTagValue({ text: rawText, tagName: "output_file" }),
+        rawText,
+    });
+}
+function parseTaskNotificationFromSystemRecord(record) {
+    const parsedRecord = TaskNotificationHistoryRecordSchema.safeParse(record);
+    if (!parsedRecord.success) {
+        return null;
+    }
+    const systemRecord = parsedRecord.data;
+    const isSystemTaskNotification = systemRecord.type === "system" && systemRecord.subtype === "task_notification";
+    const isQueueOperation = systemRecord.type === "queue-operation";
+    if (!isSystemTaskNotification && !isQueueOperation) {
+        return null;
+    }
+    const rawText = toNonEmptyString(systemRecord.content);
+    return TaskNotificationEnvelopeSchema.parse({
+        messageId: toNonEmptyString(systemRecord.uuid) ?? toNonEmptyString(systemRecord.message_id),
+        taskId: toNonEmptyString(systemRecord.task_id) ??
+            (rawText ? readTaskNotificationTagValue({ text: rawText, tagName: "task-id" }) : null),
+        status: toNonEmptyString(systemRecord.status) ??
+            (rawText ? readTaskNotificationTagValue({ text: rawText, tagName: "status" }) : null),
+        summary: toNonEmptyString(systemRecord.summary) ??
+            (rawText ? readTaskNotificationTagValue({ text: rawText, tagName: "summary" }) : null),
+        outputFile: toNonEmptyString(systemRecord.output_file) ??
+            (rawText
+                ? (readTaskNotificationTagValue({ text: rawText, tagName: "output-file" }) ??
+                    readTaskNotificationTagValue({ text: rawText, tagName: "output_file" }))
+                : null),
+        rawText,
+    });
+}
+/**
+ * Project a system task_notification record down to its background-task
+ * lifecycle ({ taskId, status }) — used to expire a tracked background shell
+ * when its terminal notification arrives. Returns null when there's no task id.
+ */
+export function extractTaskNotificationLifecycleFromSystemRecord(record) {
+    const envelope = parseTaskNotificationFromSystemRecord(record);
+    if (!envelope?.taskId) {
+        return null;
+    }
+    return { taskId: envelope.taskId, status: envelope.status };
+}
+/** Same as above for a task_notification that arrives as user-message content. */
+export function extractTaskNotificationLifecycleFromUserContent(input) {
+    const envelope = parseTaskNotificationFromUserContent(input);
+    if (!envelope?.taskId) {
+        return null;
+    }
+    return { taskId: envelope.taskId, status: envelope.status };
+}
+function normalizeTaskNotificationCallIdSegment(segment) {
+    const normalized = segment.trim().replace(/[^a-zA-Z0-9._:-]+/g, "_");
+    return normalized.length > 0 ? normalized : null;
+}
+function buildTaskNotificationCallId(envelope) {
+    const messageSegment = envelope.messageId
+        ? normalizeTaskNotificationCallIdSegment(envelope.messageId)
+        : null;
+    if (messageSegment) {
+        return `task_notification_${messageSegment}`;
+    }
+    const taskSegment = envelope.taskId
+        ? normalizeTaskNotificationCallIdSegment(envelope.taskId)
+        : null;
+    if (taskSegment) {
+        return `task_notification_${taskSegment}`;
+    }
+    const seed = [envelope.status, envelope.summary, envelope.outputFile, envelope.rawText]
+        .filter((value) => typeof value === "string")
+        .join("|") || "task_notification";
+    const digest = createHash("sha1").update(seed).digest("hex").slice(0, 12);
+    return `task_notification_${digest}`;
+}
+function buildTaskNotificationLabel(envelope) {
+    if (envelope.summary) {
+        return envelope.summary;
+    }
+    if (envelope.status) {
+        return `Background task ${envelope.status.toLowerCase()}`;
+    }
+    return "Background task notification";
+}
+function buildTaskNotificationStatus(input) {
+    const normalizedStatus = input.status?.toLowerCase() ?? null;
+    if (normalizedStatus === "failed" || normalizedStatus === "error") {
+        return {
+            status: "failed",
+            error: { message: input.summary ?? "Background task failed" },
+        };
+    }
+    if (normalizedStatus === "canceled" || normalizedStatus === "cancelled") {
+        return { status: "canceled", error: null };
+    }
+    return { status: "completed", error: null };
+}
+function toTaskNotificationToolCall(envelope) {
+    const lifecycle = buildTaskNotificationStatus({
+        status: envelope.status,
+        summary: envelope.summary,
+    });
+    const label = buildTaskNotificationLabel(envelope);
+    const detailText = envelope.rawText ?? envelope.summary ?? undefined;
+    const metadata = {
+        synthetic: true,
+        source: "claude_task_notification",
+        ...(envelope.taskId ? { taskId: envelope.taskId } : {}),
+        ...(envelope.status ? { status: envelope.status } : {}),
+        ...(envelope.outputFile ? { outputFile: envelope.outputFile } : {}),
+    };
+    const base = {
+        type: "tool_call",
+        callId: buildTaskNotificationCallId(envelope),
+        name: "task_notification",
+        detail: {
+            type: "plain_text",
+            label,
+            icon: "wrench",
+            ...(detailText ? { text: detailText } : {}),
+        },
+        metadata,
+    };
+    if (lifecycle.status === "failed") {
+        return {
+            ...base,
+            status: "failed",
+            error: lifecycle.error,
+        };
+    }
+    if (lifecycle.status === "canceled") {
+        return {
+            ...base,
+            status: "canceled",
+            error: null,
+        };
+    }
+    return {
+        ...base,
+        status: "completed",
+        error: null,
+    };
+}
+export function isTaskNotificationUserContent(content) {
+    const rawText = extractUserContentText(content);
+    if (!rawText) {
+        return false;
+    }
+    return rawText.includes(TASK_NOTIFICATION_MARKER);
+}
+export function mapTaskNotificationUserContentToToolCall(input) {
+    const parsed = parseTaskNotificationFromUserContent(input);
+    if (!parsed) {
+        return null;
+    }
+    return toTaskNotificationToolCall(parsed);
+}
+export function mapTaskNotificationSystemRecordToToolCall(record) {
+    const parsed = parseTaskNotificationFromSystemRecord(record);
+    if (!parsed) {
+        return null;
+    }
+    return toTaskNotificationToolCall(parsed);
+}
+export function coerceTaskNotificationHistoryRecordToSystemMessage(record) {
+    const parsed = parseTaskNotificationFromSystemRecord(record);
+    if (!parsed) {
+        return null;
+    }
+    const normalizedStatus = parsed.status?.toLowerCase() ?? null;
+    let status;
+    if (normalizedStatus === "failed" || normalizedStatus === "error") {
+        status = "failed";
+    }
+    else if (normalizedStatus === "canceled" || normalizedStatus === "cancelled") {
+        status = "stopped";
+    }
+    else {
+        status = "completed";
+    }
+    return {
+        type: "system",
+        subtype: "task_notification",
+        ...(parsed.messageId ? { uuid: parsed.messageId } : {}),
+        ...(parsed.taskId ? { task_id: parsed.taskId } : {}),
+        status,
+        ...(parsed.summary ? { summary: parsed.summary } : {}),
+        ...(parsed.outputFile ? { output_file: parsed.outputFile } : {}),
+        ...(parsed.rawText ? { content: parsed.rawText } : {}),
+    };
+}
+//# sourceMappingURL=task-notification-tool-call.js.map

package/dist/server/server/agent/providers/claude/test-rewind-claude-sdk.d.ts

@@ -0,0 +1,24 @@
+import type { ClaudeRewindSdk } from "./rewind.js";
+export declare class FakeClaudeSdk implements ClaudeRewindSdk {
+    readonly recordedForks: Array<{
+        upToMessageId: string;
+    }>;
+    readonly recordedFileRewinds: Array<{
+        userMessageId: string;
+    }>;
+    private nextSessionId;
+    setNextSessionId(sessionId: string): void;
+    forkSession(_sessionId: string, options: {
+        upToMessageId: string;
+    }): Promise<{
+        sessionId: string;
+    }>;
+    createQuery(): {
+        rewindFiles: (userMessageId: string, options?: {
+            dryRun?: boolean;
+        }) => Promise<{
+            canRewind: boolean;
+        }>;
+    };
+}
+//# sourceMappingURL=test-rewind-claude-sdk.d.ts.map

package/dist/server/server/agent/providers/claude/test-rewind-claude-sdk.js

@@ -0,0 +1,23 @@
+export class FakeClaudeSdk {
+    constructor() {
+        this.recordedForks = [];
+        this.recordedFileRewinds = [];
+        this.nextSessionId = "forked-session-1";
+    }
+    setNextSessionId(sessionId) {
+        this.nextSessionId = sessionId;
+    }
+    async forkSession(_sessionId, options) {
+        this.recordedForks.push({ upToMessageId: options.upToMessageId });
+        return { sessionId: this.nextSessionId };
+    }
+    createQuery() {
+        return {
+            rewindFiles: async (userMessageId) => {
+                this.recordedFileRewinds.push({ userMessageId });
+                return { canRewind: true };
+            },
+        };
+    }
+}
+//# sourceMappingURL=test-rewind-claude-sdk.js.map

package/dist/server/server/agent/providers/claude/tool-allowlist-guard.d.ts

@@ -0,0 +1,41 @@
+import { type ToolAllowRule } from "./tool-allowlist.js";
+/**
+ * Materializes the PTY-transport half of tool-allowlist enforcement: a
+ * `PreToolUse` hook script plus the `--settings` file that registers it.
+ *
+ * The SDK transport enforces the same allowlist in-process (an `options.hooks`
+ * callback). The PTY transport spawns a real `claude` terminal, so its gate has
+ * to be a command on disk.
+ *
+ * SINGLE SOURCE OF TRUTH: the guard script is generated by serializing the very
+ * functions the in-process path calls (`Function.prototype.toString()`), so the
+ * two transports cannot drift into enforcing different rules. `tool-allowlist-guard.test.ts`
+ * executes the generated script over the same fixture table that exercises
+ * `isToolAllowed()` to keep that guarantee honest. Neither the tsc build nor tsx
+ * minifies, so the emitted bodies are valid, type-free JS in dev and in dist.
+ */
+export interface GuardArtifacts {
+    /** Directory holding both generated files. Delete it on session teardown. */
+    readonly dir: string;
+    /** Path passed to `claude --settings`. */
+    readonly settingsPath: string;
+    /** Path of the generated hook script. */
+    readonly guardPath: string;
+}
+/** The standalone `PreToolUse` hook script, with the rules baked in. */
+export declare function buildGuardScript(rules: readonly ToolAllowRule[]): string;
+/** The `--settings` payload that registers the guard for every tool call. */
+export declare function buildGuardSettings(nodeBinary: string, guardPath: string): string;
+/**
+ * Write the guard script + settings file for a session. Returns null when the
+ * allowlist is empty, i.e. no allowlist was configured and nothing is enforced.
+ */
+export declare function writeGuardArtifacts(options: {
+    readonly rules: readonly ToolAllowRule[];
+    readonly sessionId: string;
+    readonly baseDir: string;
+    readonly nodeBinary?: string;
+}): GuardArtifacts | null;
+/** Best-effort teardown for `writeGuardArtifacts`. */
+export declare function removeGuardArtifacts(artifacts: GuardArtifacts | null | undefined): void;
+//# sourceMappingURL=tool-allowlist-guard.d.ts.map

package/dist/server/server/agent/providers/claude/tool-allowlist-guard.js

@@ -0,0 +1,95 @@
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import * as path from "node:path";
+import { SPECIFIER_SOURCES, escapeLiteral, isToolAllowed, readSpecifierValue, specifierMatches, } from "./tool-allowlist.js";
+/** Quote a path for a POSIX/`sh -c` hook command line. */
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** The standalone `PreToolUse` hook script, with the rules baked in. */
+export function buildGuardScript(rules) {
+    return `#!/usr/bin/env node
+// GENERATED by paseo (tool-allowlist-guard.ts). Do not edit; regenerated per session.
+import { readFileSync } from "node:fs";
+
+const RULES = ${JSON.stringify(rules)};
+const SPECIFIER_SOURCES = ${JSON.stringify(SPECIFIER_SOURCES)};
+
+const escapeLiteral = ${escapeLiteral.toString()};
+const specifierMatches = ${specifierMatches.toString()};
+const readSpecifierValue = ${readSpecifierValue.toString()};
+const isToolAllowed = ${isToolAllowed.toString()};
+
+let raw = "";
+try {
+  raw = readFileSync(0, "utf8");
+} catch {
+  raw = "";
+}
+let event = {};
+try {
+  event = JSON.parse(raw);
+} catch {
+  event = {};
+}
+const toolName = typeof event.tool_name === "string" ? event.tool_name : "";
+const toolInput = event.tool_input ?? {};
+
+// Fail closed: an unreadable event is not a licence to run an unknown tool.
+if (!toolName || !isToolAllowed(toolName, toolInput, RULES)) {
+  const listed = RULES.map((r) => (r.specifier === undefined ? r.tool : r.tool + "(" + r.specifier + ")")).join(", ");
+  process.stderr.write(
+    'Tool "' + (toolName || "<unknown>") + '" is blocked by this run\\'s tool allowlist and was not executed. ' +
+      "This run's allowlist contains only: " + listed +
+        ". Anything absent from that list is denied. Do not retry this tool; achieve the goal " +
+        "with a listed tool or report that you cannot.\\n",
+  );
+  process.exit(2);
+}
+process.exit(0);
+`;
+}
+/** The `--settings` payload that registers the guard for every tool call. */
+export function buildGuardSettings(nodeBinary, guardPath) {
+    return `${JSON.stringify({
+        hooks: {
+            PreToolUse: [
+                {
+                    matcher: "*",
+                    hooks: [
+                        {
+                            type: "command",
+                            command: `${shellQuote(nodeBinary)} ${shellQuote(guardPath)}`,
+                        },
+                    ],
+                },
+            ],
+        },
+    }, null, 2)}\n`;
+}
+/**
+ * Write the guard script + settings file for a session. Returns null when the
+ * allowlist is empty, i.e. no allowlist was configured and nothing is enforced.
+ */
+export function writeGuardArtifacts(options) {
+    if (options.rules.length === 0)
+        return null;
+    const dir = path.join(options.baseDir, `tool-allowlist-${options.sessionId}`);
+    mkdirSync(dir, { recursive: true });
+    const guardPath = path.join(dir, "guard.mjs");
+    const settingsPath = path.join(dir, "settings.json");
+    writeFileSync(guardPath, buildGuardScript(options.rules), { mode: 0o700 });
+    writeFileSync(settingsPath, buildGuardSettings(options.nodeBinary ?? process.execPath, guardPath));
+    return { dir, settingsPath, guardPath };
+}
+/** Best-effort teardown for `writeGuardArtifacts`. */
+export function removeGuardArtifacts(artifacts) {
+    if (!artifacts)
+        return;
+    try {
+        rmSync(artifacts.dir, { recursive: true, force: true });
+    }
+    catch {
+        // teardown is best effort — a leftover temp dir must never fail a session
+    }
+}
+//# sourceMappingURL=tool-allowlist-guard.js.map

package/dist/server/server/agent/providers/claude/tool-allowlist.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Per-run tool allowlist enforcement for the claude provider.
+ *
+ * WHY A HOOK AND NOT `--allowedTools`
+ * -----------------------------------
+ * `--allowedTools` (CLI) and `options.allowedTools` (SDK) are *permission allow
+ * rules*: they pre-approve a tool so it does not prompt. They do not restrict
+ * anything. Both of paseo's claude transports also run the child with
+ * `--dangerously-skip-permissions` / `allowDangerouslySkipPermissions`, under
+ * which every permission rule is moot, so passing an allowlist there would be
+ * decorative: accepted, parsed, and silently unenforcing.
+ *
+ * A `PreToolUse` hook is the one gate that still fires in that state. The Agent
+ * SDK says so explicitly (sdk.d.ts, PermissionDeniedHookInput): "PreToolUse hook
+ * denies bypass canUseTool". Verified against claude 2.1.239 with
+ * `--permission-mode acceptEdits --dangerously-skip-permissions`: a hook exiting
+ * 2 blocked a Bash call while an allowlisted Read call went through.
+ *
+ * FAIL CLOSED
+ * -----------
+ * When an allowlist is configured, anything this module cannot positively match
+ * is DENIED. A matcher that is too strict fails loudly (the model is told which
+ * rule set rejected it, and the run keeps going), while a matcher that is too
+ * lax fails silently and hands back a guarantee that is not real. Strictness is
+ * the safe direction, so unknown rule shapes and unknown specifier sources deny.
+ *
+ * Note this is *stricter* than `claude-pool launch --allowedTools`, where tools
+ * that never request permission (Read, Grep, TodoWrite, ...) were unaffected by
+ * the allowlist. Here the allowlist means exactly what it says: a tool absent
+ * from it cannot run at all.
+ */
+export interface ToolAllowRule {
+    /** Tool name, e.g. "Bash", "Read", "mcp__playwright-personal__browser_navigate". */
+    readonly tool: string;
+    /** Optional specifier from `Tool(specifier)` form, e.g. "git:*". */
+    readonly specifier?: string;
+}
+/** Tools whose specifier (the `Tool(spec)` argument) we know how to read off the input. */
+export declare const SPECIFIER_SOURCES: Record<string, string>;
+/**
+ * Parse CSV-or-array allowlist entries into rules. Entries are the same strings
+ * Claude Code permission rules use: `Bash`, `Bash(git:*)`, `Read`,
+ * `mcp__server__tool`. Blank entries are dropped.
+ */
+export declare function parseToolAllowlist(entries: readonly string[]): ToolAllowRule[];
+/** Escape a literal for use inside a RegExp, leaving `*` to be expanded by the caller. */
+export declare function escapeLiteral(value: string): string;
+/**
+ * Match a Claude-Code-style specifier pattern against a value.
+ *
+ * Supported shapes (anything else denies):
+ *  - `*`          any value
+ *  - `prefix:*`   value starts with `prefix` (Claude Code's command-prefix form)
+ *  - `glob`       `*` wildcards, everything else literal, anchored both ends
+ */
+export declare function specifierMatches(pattern: string, value: string): boolean;
+/** Read the specifier value a `Tool(spec)` rule compares against, or null when unknown. */
+export declare function readSpecifierValue(toolName: string, input: unknown): string | null;
+/**
+ * True when `toolName` (with `input`) is permitted by `rules`.
+ *
+ * An EMPTY rule list means "no allowlist configured" and allows everything; the
+ * caller is responsible for not installing the guard at all in that case.
+ */
+export declare function isToolAllowed(toolName: string, input: unknown, rules: readonly ToolAllowRule[]): boolean;
+/** The message handed back to the model when a call is blocked. */
+export declare function formatDenialMessage(toolName: string, rules: readonly ToolAllowRule[]): string;
+//# sourceMappingURL=tool-allowlist.d.ts.map

package/dist/server/server/agent/providers/claude/tool-allowlist.js

@@ -0,0 +1,133 @@
+/**
+ * Per-run tool allowlist enforcement for the claude provider.
+ *
+ * WHY A HOOK AND NOT `--allowedTools`
+ * -----------------------------------
+ * `--allowedTools` (CLI) and `options.allowedTools` (SDK) are *permission allow
+ * rules*: they pre-approve a tool so it does not prompt. They do not restrict
+ * anything. Both of paseo's claude transports also run the child with
+ * `--dangerously-skip-permissions` / `allowDangerouslySkipPermissions`, under
+ * which every permission rule is moot, so passing an allowlist there would be
+ * decorative: accepted, parsed, and silently unenforcing.
+ *
+ * A `PreToolUse` hook is the one gate that still fires in that state. The Agent
+ * SDK says so explicitly (sdk.d.ts, PermissionDeniedHookInput): "PreToolUse hook
+ * denies bypass canUseTool". Verified against claude 2.1.239 with
+ * `--permission-mode acceptEdits --dangerously-skip-permissions`: a hook exiting
+ * 2 blocked a Bash call while an allowlisted Read call went through.
+ *
+ * FAIL CLOSED
+ * -----------
+ * When an allowlist is configured, anything this module cannot positively match
+ * is DENIED. A matcher that is too strict fails loudly (the model is told which
+ * rule set rejected it, and the run keeps going), while a matcher that is too
+ * lax fails silently and hands back a guarantee that is not real. Strictness is
+ * the safe direction, so unknown rule shapes and unknown specifier sources deny.
+ *
+ * Note this is *stricter* than `claude-pool launch --allowedTools`, where tools
+ * that never request permission (Read, Grep, TodoWrite, ...) were unaffected by
+ * the allowlist. Here the allowlist means exactly what it says: a tool absent
+ * from it cannot run at all.
+ */
+/** Tools whose specifier (the `Tool(spec)` argument) we know how to read off the input. */
+export const SPECIFIER_SOURCES = {
+    Bash: "command",
+    BashOutput: "bash_id",
+    Read: "file_path",
+    Edit: "file_path",
+    Write: "file_path",
+    NotebookEdit: "notebook_path",
+    WebFetch: "url",
+    Glob: "pattern",
+    Grep: "pattern",
+};
+/**
+ * Parse CSV-or-array allowlist entries into rules. Entries are the same strings
+ * Claude Code permission rules use: `Bash`, `Bash(git:*)`, `Read`,
+ * `mcp__server__tool`. Blank entries are dropped.
+ */
+export function parseToolAllowlist(entries) {
+    const rules = [];
+    for (const raw of entries) {
+        for (const piece of raw.split(",")) {
+            const entry = piece.trim();
+            if (!entry)
+                continue;
+            const match = /^([^()\s]+)\((.*)\)$/.exec(entry);
+            if (match?.[1] !== undefined && match[2] !== undefined) {
+                rules.push({ tool: match[1], specifier: match[2].trim() });
+            }
+            else {
+                rules.push({ tool: entry });
+            }
+        }
+    }
+    return rules;
+}
+/** Escape a literal for use inside a RegExp, leaving `*` to be expanded by the caller. */
+export function escapeLiteral(value) {
+    return value.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Match a Claude-Code-style specifier pattern against a value.
+ *
+ * Supported shapes (anything else denies):
+ *  - `*`          any value
+ *  - `prefix:*`   value starts with `prefix` (Claude Code's command-prefix form)
+ *  - `glob`       `*` wildcards, everything else literal, anchored both ends
+ */
+export function specifierMatches(pattern, value) {
+    if (pattern === "*")
+        return true;
+    const prefixForm = /^(.*):\*$/.exec(pattern);
+    if (prefixForm?.[1] !== undefined) {
+        const prefix = prefixForm[1].trim();
+        if (!prefix)
+            return false;
+        return value === prefix || value.startsWith(`${prefix} `);
+    }
+    const expanded = pattern.split("*").map(escapeLiteral).join(".*");
+    return new RegExp(`^${expanded}$`).test(value);
+}
+/** Read the specifier value a `Tool(spec)` rule compares against, or null when unknown. */
+export function readSpecifierValue(toolName, input) {
+    const key = SPECIFIER_SOURCES[toolName];
+    if (!key)
+        return null;
+    if (typeof input !== "object" || input === null)
+        return null;
+    const value = input[key];
+    return typeof value === "string" ? value : null;
+}
+/**
+ * True when `toolName` (with `input`) is permitted by `rules`.
+ *
+ * An EMPTY rule list means "no allowlist configured" and allows everything; the
+ * caller is responsible for not installing the guard at all in that case.
+ */
+export function isToolAllowed(toolName, input, rules) {
+    if (rules.length === 0)
+        return true;
+    for (const rule of rules) {
+        if (rule.tool !== toolName)
+            continue;
+        if (rule.specifier === undefined)
+            return true;
+        const value = readSpecifierValue(toolName, input);
+        // Unknown specifier source: we cannot verify the rule, so we do not honor it.
+        if (value === null)
+            continue;
+        if (specifierMatches(rule.specifier, value))
+            return true;
+    }
+    return false;
+}
+/** The message handed back to the model when a call is blocked. */
+export function formatDenialMessage(toolName, rules) {
+    const listed = rules
+        .map((rule) => (rule.specifier === undefined ? rule.tool : `${rule.tool}(${rule.specifier})`))
+        .join(", ");
+    return (`Tool "${toolName}" is blocked by this run's tool allowlist and was not executed. ` +
+        `Allowed: ${listed}. Do not retry this tool; achieve the goal with an allowed tool or report that you cannot.`);
+}
+//# sourceMappingURL=tool-allowlist.js.map

package/dist/server/server/agent/providers/claude/tool-call-detail-parser.d.ts

@@ -0,0 +1,3 @@
+import type { ToolCallDetail } from "../../agent-sdk-types.js";
+export declare function deriveClaudeToolDetail(name: string, input: unknown, output: unknown): ToolCallDetail;
+//# sourceMappingURL=tool-call-detail-parser.d.ts.map