@hyperdrive.bot/paseo-protocol 0.3.39 → 0.3.41

package/dist/agent-types.d.ts

@@ -443,6 +443,16 @@ export interface AgentSessionConfig {
         claude?: AgentMetadata;
     };
     mcpServers?: Record<string, McpServerConfig>;
+    /**
+     * Per-run tool allowlist in Claude Code permission-rule syntax, e.g.
+     * ["Read", "Grep", "Bash(git:*)", "mcp__playwright__browser_navigate"].
+     *
+     * When present, a tool absent from the list cannot run at all: it is blocked
+     * before execution and the model is told why. Undefined or empty means no
+     * allowlist is applied. Only the claude provider can enforce this; the others
+     * fail the create call rather than accept an unenforceable restriction.
+     */
+    allowedTools?: string[];
     /**
      * Internal agents are hidden from listings and don't trigger notifications.
      * They are used for ephemeral system tasks like commit/PR generation.

package/dist/messages.d.ts

@@ -1747,6 +1747,7 @@ export declare const CreateAgentRequestMessageSchema: z.ZodObject<{
             headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             alwaysLoad: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>], "type">>>;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     workspaceId: z.ZodOptional<z.ZodString>;
@@ -1935,6 +1936,7 @@ export declare const ResumeAgentRequestMessageSchema: z.ZodObject<{
             headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             alwaysLoad: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>], "type">>>>;
+        allowedTools: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
     }, z.core.$strip>>;
     requestId: z.ZodString;
 }, z.core.$strip>;
@@ -3951,6 +3953,7 @@ export declare const SessionInboundMessageSchema: z.ZodDiscriminatedUnion<[z.Zod
             headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             alwaysLoad: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>], "type">>>;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     workspaceId: z.ZodOptional<z.ZodString>;
@@ -4134,6 +4137,7 @@ export declare const SessionInboundMessageSchema: z.ZodDiscriminatedUnion<[z.Zod
             headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             alwaysLoad: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>], "type">>>>;
+        allowedTools: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
     }, z.core.$strip>>;
     requestId: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
@@ -21219,6 +21223,7 @@ export declare const WSSessionInboundSchema: z.ZodObject<{
                 headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
                 alwaysLoad: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>], "type">>>;
+            allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         workspaceId: z.ZodOptional<z.ZodString>;
@@ -21402,6 +21407,7 @@ export declare const WSSessionInboundSchema: z.ZodObject<{
                 headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
                 alwaysLoad: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>], "type">>>>;
+            allowedTools: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
         }, z.core.$strip>>;
         requestId: z.ZodString;
     }, z.core.$strip>, z.ZodObject<{
@@ -30783,6 +30789,7 @@ export declare const WSInboundMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
                 headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
                 alwaysLoad: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>], "type">>>;
+            allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         workspaceId: z.ZodOptional<z.ZodString>;
@@ -30966,6 +30973,7 @@ export declare const WSInboundMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
                 headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
                 alwaysLoad: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>], "type">>>>;
+            allowedTools: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString>>>;
         }, z.core.$strip>>;
         requestId: z.ZodString;
     }, z.core.$strip>, z.ZodObject<{

package/dist/messages.js

@@ -471,6 +471,12 @@ const AgentSessionConfigSchema = z.object({
         .optional(),
     systemPrompt: z.string().optional(),
     mcpServers: z.record(z.string(), McpServerConfigSchema).optional(),
+    // Per-run tool allowlist, in Claude Code permission-rule syntax ("Bash",
+    // "Bash(git:*)", "mcp__server__tool"). Optional: absent means "no allowlist",
+    // which is the pre-existing behaviour, so old clients keep working.
+    // Enforced by the claude provider through a PreToolUse hook; other providers
+    // reject the field rather than accept it and silently ignore it.
+    allowedTools: z.array(z.string()).optional(),
 });
 const AgentPermissionUpdateSchema = z.record(z.string(), z.unknown());
 const AgentPermissionActionSchema = z.object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperdrive.bot/paseo-protocol",
-  "version": "0.3.39",
+  "version": "0.3.41",
   "description": "Paseo shared protocol schemas and wire types",
   "files": [
     "dist",