@hyperdrive.bot/paseo-cli 0.3.39 → 0.3.41

package/dist/commands/agent/run.d.ts

@@ -26,6 +26,7 @@ export interface AgentRunOptions extends CommandOptions {
     workspace?: string;
     image?: string[];
     cwd?: string;
+    allowedTools?: string[];
     env?: string[];
     label?: string[];
     waitTimeout?: string;

package/dist/commands/agent/run.js

@@ -24,6 +24,9 @@ export function addRunOptions(cmd) {
         .option("--workspace <id>", "Run in an existing workspace (default: a new workspace is created per run; falls back to $PASEO_WORKSPACE_ID)")
         .option("--image <path>", "Attach image(s) to the initial prompt (can be used multiple times)", collectMultiple, [])
         .option("--cwd <path>", "Working directory (default: current)")
+        .option("--allowed-tools <tools>", "Restrict the agent to these tools (comma separated, repeatable). " +
+        'Claude Code permission-rule syntax: "Read", "Bash(git:*)", "mcp__server__tool". ' +
+        "A tool outside the list is blocked before it runs. claude provider only.", collectMultiple, [])
         .option("--env <key=value>", "Set environment variable(s) for the agent process (can be used multiple times)", collectMultiple, [])
         .option("--label <key=value>", "Add label(s) to the agent (can be used multiple times)", collectMultiple, [])
         .option("--wait-timeout <duration>", "Maximum time to wait for agent to finish (e.g., 30s, 5m, 1h). Default: no limit")
@@ -40,6 +43,17 @@ export const agentRunSchema = {
         { header: "TITLE", field: "title", width: 20 },
     ],
 };
+/**
+ * Flatten repeated and comma-separated --allowed-tools values into the wire field.
+ * Empty stays undefined so "no flag" keeps meaning "no allowlist at all".
+ */
+function normalizeAllowedTools(values) {
+    const tools = (values ?? [])
+        .flatMap((entry) => entry.split(","))
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    return tools.length > 0 ? tools : undefined;
+}
 function toRunResult(agent, statusOverride) {
     return {
         agentId: agent.id,
@@ -355,6 +369,7 @@ export async function runRunCommand(prompt, options, _command) {
         const labels = parseRunLabels(options.label);
         const env = parseRunEnv(options.env);
         const requestEnv = Object.keys(env).length > 0 ? env : undefined;
+        const allowedTools = normalizeAllowedTools(options.allowedTools);
         const workspace = await resolveRunWorkspace(client, options, cwd);
         const workspaceId = workspace.id;
         const runCwd = workspace.cwd;
@@ -370,6 +385,7 @@ export async function runRunCommand(prompt, options, _command) {
                         modeId: options.mode,
                         model: resolvedProviderModel.model,
                         thinkingOptionId,
+                        ...(allowedTools ? { allowedTools } : {}),
                         initialPrompt: structuredPrompt,
                         outputSchema,
                         images,
@@ -424,6 +440,7 @@ export async function runRunCommand(prompt, options, _command) {
             modeId: options.mode,
             model: resolvedProviderModel.model,
             thinkingOptionId,
+            ...(allowedTools ? { allowedTools } : {}),
             initialPrompt: prompt,
             images,
             env: requestEnv,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperdrive.bot/paseo-cli",
-  "version": "0.3.39",
+  "version": "0.3.41",
   "description": "Paseo CLI - control your AI coding agents from the command line",
   "bin": {
     "paseo": "bin/paseo"
@@ -27,9 +27,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.0.0",
-    "@hyperdrive.bot/paseo-client": "0.3.39",
-    "@hyperdrive.bot/paseo-protocol": "0.3.39",
-    "@hyperdrive.bot/paseo-server": "0.3.39",
+    "@hyperdrive.bot/paseo-client": "0.3.41",
+    "@hyperdrive.bot/paseo-protocol": "0.3.41",
+    "@hyperdrive.bot/paseo-server": "0.3.41",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "mime-types": "^2.1.35",