@livx.cc/agentx 0.99.125 → 0.99.126

package/dist/cli.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { w as RouterState, H as Hooks, c as AgentOptions, x as RunResult, f as ChatUsage, R as ReasoningEffort, d as ChannelMode, b as Agent } from './secondChannel-GFT69ax4.js';
+import { w as RouterState, H as Hooks, c as AgentOptions, x as RunResult, f as ChatUsage, R as ReasoningEffort, d as ChannelMode, b as Agent } from './secondChannel-B76KLrf7.js';
 import { IFilesystem } from '@livx.cc/wcli/core';
 import { M as Message, U as UserQuestion, H as HostBridge, c as ContentPart, o as MessageContent } from './tools-DwfeF8VQ.js';
 

package/dist/cli.js

@@ -4719,10 +4719,15 @@ function delegateWorkerFor(planner, worker) {
 function advisorFor(worker, advisor) {
   return advisor && pairOk("advisor", worker, advisor) ? advisor : void 0;
 }
-function delegateTools(tools, planner) {
+function delegateTools(tools, planner, plannerMay) {
   return tools.map((t) => !plannerBlocks(t) ? t : {
     ...t,
-    run: async (...a) => a[1]?.model === planner ? PLANNER_REFUSAL : t.run(...a)
+    // THROWN, not returned: a returned string read as a SUCCESSFUL write in every trace (isError false), so a host
+    // counted a write that never happened (Blank prod 8834a8bd-d4b).
+    run: async (...a) => {
+      if (a[1]?.model === planner && !plannerMay?.(t.name, a[0])) throw new Error(PLANNER_REFUSAL);
+      return t.run(...a);
+    }
   });
 }
 function delegatePrompt(worker) {
@@ -5053,7 +5058,9 @@ var AgentOptions = class {
   subagents = false;
   /** DELEGATE MODE: `model` plans, `worker` writes. The planner's Write/Edit/MultiEdit/ApplyEdits/bash/Shell are
    *  refused at execution; Task/TaskBatch are on (maxDepth 1, children default to `worker`) and children get the
-   *  parent's `postToolUse` too. Off when the models are equal or either is cursor/*. Wins over `advisor`. */
+   *  parent's `postToolUse` too. Off when the models are equal or either is cursor/*. Wins over `advisor`.
+   *  `plannerMay(tool, args)`: a blocked call the planner may still make itself (the host's own carve-out, e.g. its
+   *  private notes) — say so in the host prompt, the planner prompt says it cannot write. */
   delegate;
   /** ADVISOR MODE: `model` does the work; an `Advise` tool asks `advisor.model` (≤`limit`, default 3) with only
    *  the request + `snapshot()` (host state, optional) + the question. The first write waits for one consult. */
@@ -5436,7 +5443,7 @@ var Agent = class _Agent {
         traceDir: o.traceDir,
         permissions: o.permissions,
         // a child obeys the parent's allow/deny rules (else Task is a one-call bypass)
-        tools: worker ? delegateTools([...o.tools, ...this.injectedTools], o.model) : [...o.tools, ...this.injectedTools],
+        tools: worker ? delegateTools([...o.tools, ...this.injectedTools], o.model, o.delegate?.plannerMay) : [...o.tools, ...this.injectedTools],
         systemPrompt: o.systemPrompt,
         // A child never resumes the parent's own claude-code session (the host's `resume` link is the parent's).
         providerOptionsFor: o.providerOptionsFor ?? ((m) => modelProvider(m) === modelProvider(o.model) && o.providerOptions ? { ...o.providerOptions, resume: void 0, onClaudeCodeSession: void 0 } : void 0)
@@ -5450,7 +5457,7 @@ var Agent = class _Agent {
     this.activeHooks = composeHooks(o.hooks, plan?.hooks, o.permissions?.hooks());
     this.activeTools = [...tools, ...this.injectedTools];
     if (worker) {
-      this.activeTools = delegateTools(this.activeTools, o.model);
+      this.activeTools = delegateTools(this.activeTools, o.model, o.delegate?.plannerMay);
       systemPrompt += delegatePrompt(worker);
     }
     if (adv) {