@livx.cc/agentx 0.99.122 → 0.99.123

package/dist/{mcp-CUo-9LUe.d.ts → mcp-DZhcLur2.d.ts}

@@ -1,4 +1,4 @@
-import { A as AgentTool } from './tools-DZHZIyxh.js';
+import { A as AgentTool } from './tools-DwfeF8VQ.js';
 
 /**
  * MCP bridge — adapt a Model Context Protocol tool list into the agent's AgentTool[],

package/dist/mcp.client.d.ts

@@ -1,5 +1,5 @@
-import { e as McpToolSearchOptions, f as McpToolSpec } from './mcp-CUo-9LUe.js';
-import { A as AgentTool } from './tools-DZHZIyxh.js';
+import { e as McpToolSearchOptions, f as McpToolSpec } from './mcp-DZhcLur2.js';
+import { A as AgentTool } from './tools-DwfeF8VQ.js';
 import '@livx.cc/wcli/core';
 
 /** Hard cap for `tools/call`. NOT the 30s protocol timeout: a tool call is real work (an image render, a crawl)

package/dist/{secondChannel-BddfVzTp.d.ts → secondChannel-DES_VIeN.d.ts}

@@ -1,5 +1,5 @@
 import { IFilesystem } from '@livx.cc/wcli/core';
-import { M as Message, o as MessageContent, H as HostBridge, A as AgentTool, C as ChatLike, k as JobRegistry, U as UserQuestion } from './tools-DZHZIyxh.js';
+import { M as Message, o as MessageContent, H as HostBridge, A as AgentTool, C as ChatLike, k as JobRegistry, U as UserQuestion } from './tools-DwfeF8VQ.js';
 
 /**
  * `--model auto`: per-turn model routing. A classifier (Jev by default — injected, so a regex or
@@ -284,6 +284,12 @@ declare function composeHooks(...list: (Hooks | undefined)[]): Hooks;
 declare const WRITE_TOOLS: Set<string>;
 /** The planner also loses the shells: either one can write files. */
 declare const PLANNER_BLOCKED: Set<string>;
+/** Does the planner lose this tool? By the tool's own `writes` flag first — it survives a host rename (shraga-ee's
+ *  `Shell` → `Bash`) — then by name, case-insensitively (`Bash`, a host's own `write`). */
+declare const plannerBlocks: (t: {
+    name: string;
+    writes?: boolean;
+}) => boolean;
 declare const PLANNER_REFUSAL = "Refused: you are the planner and do not write files. Delegate the change with Task/TaskBatch (model set to the worker) and give the worker a full spec.";
 declare const PLAN_FIRST = "Refused: check your plan with `Advise` before the first write (files, data shape, the hard parts). Then write.";
 /** A build may consult at most this many times by default: plan + review + one spare. */
@@ -338,6 +344,21 @@ declare function meterWorkers<T extends ChatLike>(ai: T, main: string): {
     model: () => string | undefined;
     reset: () => void;
 };
+/** Claude Code's NATIVE file-changing tools (its own loop runs them; agentx's tool wrappers never see the call). */
+declare const CC_WRITE_TOOLS: string[];
+/**
+ * The same two modes for a claude-code/* agent. Claude Code runs its OWN tool loop, so `delegateTools`/`gate`
+ * (which wrap agentx tools) never fire there — Opus wrote with its native Write and had no worker tool.
+ * - planner: native writes, Bash and native Task/Agent are `disallowedTools` (the SDK strips them); agentx's
+ *   Task/TaskBatch reach it over the in-process bridge (ccBridge.ts), so it delegates to workers on the worker model.
+ * - advised worker: `Advise` goes over the bridge; a PreToolUse hook denies a native write until one consult
+ *   (`used()` > 0). The host's own `hooks` are kept.
+ */
+declare function ccModeOptions(kind: 'delegate' | 'advisor' | undefined, hostHooks: Record<string, unknown[]> | undefined, used: () => number): {
+    bridge: Set<string>;
+    disallow: string[];
+    hooks?: Record<string, unknown[]>;
+};
 
 /**
  * Normalized reasoning/thinking control → provider-specific request fragment.
@@ -664,6 +685,8 @@ declare class Agent {
     private activeTools;
     private meter?;
     private modeModel?;
+    private modeKind?;
+    private adv?;
     private lastTask;
     /** claude-code bridge for agentx-only tools (ccBridge.ts) + the current step's executor it calls. */
     private ccServer?;
@@ -1189,4 +1212,4 @@ declare class SecondChannel {
     private say;
 }
 
-export { ADVISE_LIMIT as A, advisorPrompt as B, type ChannelMode as C, DEFAULT_MUTATING as D, claudeCodeDisallowedTools as E, composeHooks as F, type Gender as G, type Hooks as H, delegatePrompt as I, delegateTools as J, delegateWorkerFor as K, type LineKind as L, ModelRouter as M, estimateTokens as N, jevAvailable as O, PLANNER_BLOCKED as P, jevClassifier as Q, type ReasoningEffort as R, SecondChannel as S, type Tier as T, makeAdvisor as U, meterWorkers as V, WRITE_TOOLS as W, pickTier as X, planMode as Y, reasoningToChatFragment as Z, type AdvisorSetup as a, Agent as b, AgentOptions as c, type ChatFragment as d, type ChatUsage as e, type Classification as f, type Classifier as g, type CompactResult as h, type Decider as i, type Decision as j, ModelRouterOptions as k, PLANNER_REFUSAL as l, PLAN_FIRST as m, PermissionOptions as n, PermissionPolicy as o, type PermissionRule as p, type PreToolUseDecision as q, RecordingHooks as r, RecordingLifecycle as s, type RouteDecision as t, type RouterState as u, type RunResult as v, SecondChannelOptions as w, type ToolUse as x, type ToolUseMeta as y, advisorFor as z };
+export { plannerBlocks as $, ADVISE_LIMIT as A, advisorFor as B, CC_WRITE_TOOLS as C, DEFAULT_MUTATING as D, advisorPrompt as E, ccModeOptions as F, type Gender as G, type Hooks as H, claudeCodeDisallowedTools as I, composeHooks as J, delegatePrompt as K, type LineKind as L, ModelRouter as M, delegateTools as N, delegateWorkerFor as O, PLANNER_BLOCKED as P, estimateTokens as Q, type ReasoningEffort as R, SecondChannel as S, type Tier as T, jevAvailable as U, jevClassifier as V, WRITE_TOOLS as W, makeAdvisor as X, meterWorkers as Y, pickTier as Z, planMode as _, type AdvisorSetup as a, reasoningToChatFragment as a0, Agent as b, AgentOptions as c, type ChannelMode as d, type ChatFragment as e, type ChatUsage as f, type Classification as g, type Classifier as h, type CompactResult as i, type Decider as j, type Decision as k, ModelRouterOptions as l, PLANNER_REFUSAL as m, PLAN_FIRST as n, PermissionOptions as o, PermissionPolicy as p, type PermissionRule as q, type PreToolUseDecision as r, RecordingHooks as s, RecordingLifecycle as t, type RouteDecision as u, type RouterState as v, type RunResult as w, SecondChannelOptions as x, type ToolUse as y, type ToolUseMeta as z };

package/dist/{tools-DZHZIyxh.d.ts → tools-DwfeF8VQ.d.ts}

@@ -552,6 +552,9 @@ interface AgentTool {
      * result. Omit for tools that return promptly.
      */
     maxDurationMs?: number;
+    /** This tool can change files (a file editor or a shell). Survives a host rename (`Shell` → `Bash`), so policy that
+     *  must hold whatever the tool is called — delegate mode's planner refusal — keys on it, not on the name. */
+    writes?: boolean;
     /**
      * Is `maxDurationMs` SELF-ENFORCED — does this tool abort itself at that bound and return?
      * An enforced bound cannot be overrun, so a transport above it needs only modest slack; an ADVISORY

package/dist/tools.shell.d.ts

@@ -1,4 +1,4 @@
-import { k as JobRegistry, A as AgentTool } from './tools-DZHZIyxh.js';
+import { k as JobRegistry, A as AgentTool } from './tools-DwfeF8VQ.js';
 import '@livx.cc/wcli/core';
 
 /**

package/dist/tools.shell.js

@@ -1221,6 +1221,7 @@ function makeRealShellTool(options) {
   };
   return {
     name: "Shell",
+    writes: true,
     // Rebind for an isolated child agent (git worktree): same policy/env/timeouts, new cwd. The
     // `registry` is deliberately dropped — it is bound to the PARENT's cwd (and, in hosts like
     // shraga-ee, to the parent's session), so a background job started from the child would run