@livx.cc/agentx 0.99.127 → 0.99.128

package/dist/cli.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { w as RouterState, H as Hooks, c as AgentOptions, x as RunResult, f as ChatUsage, R as ReasoningEffort, d as ChannelMode, b as Agent } from './secondChannel-CYU9qqwr.js';
+import { w as RouterState, H as Hooks, c as AgentOptions, x as RunResult, f as ChatUsage, R as ReasoningEffort, d as ChannelMode, b as Agent } from './secondChannel-D-8AGmAT.js';
 import { IFilesystem } from '@livx.cc/wcli/core';
 import { M as Message, U as UserQuestion, H as HostBridge, c as ContentPart, o as MessageContent } from './tools-DwfeF8VQ.js';
 
@@ -170,6 +170,7 @@ interface Args {
     inputFormat?: 'stream-json';
     allowedTools?: string[];
     disallowedTools?: string[];
+    onlyTools?: string[];
     appendSystemPrompt?: string;
     voiceSystemPrompt?: string;
     addDirs?: string[];

package/dist/cli.js

@@ -4160,16 +4160,19 @@ import { join as join4 } from "path";
 
 // src/permissions.ts
 init_tools_structured();
+import { posix } from "path";
 function commandMatches(glob, cmd) {
   const pattern = glob.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
   return new RegExp("^" + pattern + "$").test(cmd);
 }
+var SHELL_CONTROL = /[;&|`$<>\n\r]/;
 function toolMatches(rule, name) {
   return rule.includes("*") ? commandMatches(rule, name) : rule === name;
 }
 var PermissionOptions = class {
   rules = [];
-  /** decision when no rule matches. */
+  /** decision when no rule matches. 'deny' = an allow-list run (`--onlyTools`): only the allow rules run, an allowed
+   *  command glob never matches shell control syntax, and claude-code enforces it by a PreToolUse hook (ccHooks). */
   default = "allow";
   /** host channel for `ask` (confirm). If absent, `ask` is treated as `deny` (fail-closed). */
   host;
@@ -4182,15 +4185,17 @@ var PermissionPolicy = class {
   /** Resolve the decision for a tool call (first matching rule, else default). */
   decide(call) {
     const names = call.name === "McpCall" && typeof call.args?.name === "string" ? [call.name, call.args.name] : [call.name];
+    if (CC_TOOL_ALIAS[call.name]) names.push(CC_TOOL_ALIAS[call.name]);
+    const strict = this.options.default === "deny";
     for (const r of this.options.rules) {
       if (r.tool && !names.some((n) => toolMatches(r.tool, n))) continue;
       if (r.pathGlob) {
         const path = typeof call.args?.path === "string" ? call.args.path : null;
         const cmd = typeof call.args?.command === "string" ? call.args.command : null;
         if (path != null) {
-          if (!globToRegExp(r.pathGlob).test(path.startsWith("/") ? path : `/${path}`)) continue;
+          if (!globToRegExp(r.pathGlob).test(posix.normalize(path.startsWith("/") ? path : `/${path}`))) continue;
         } else if (cmd != null) {
-          if (!commandMatches(r.pathGlob, cmd)) continue;
+          if (!commandMatches(r.pathGlob, cmd) || strict && r.decision === "allow" && SHELL_CONTROL.test(cmd)) continue;
         } else continue;
       }
       return r.decision;
@@ -4202,6 +4207,18 @@ var PermissionPolicy = class {
   denyRules(explicitOnly = false) {
     return this.options.rules.filter((r) => r.decision === "deny" && (!explicitOnly || r.explicit)).map((r) => `${r.tool ?? "*"}${r.pathGlob ? `(${r.pathGlob})` : ""}`);
   }
+  /** An allow-list policy (default 'deny') as Claude Code SDK hooks: claude-code runs its own tools, which never reach
+   *  {@link hooks}, and `disallowedTools` can't say "everything else". Every tool call (native and MCP) goes through
+   *  decide(); `ask` has no host there → deny. undefined for a default-allow policy (its deny rules travel as disallowedTools). */
+  ccHooks() {
+    if (this.options.default !== "deny") return void 0;
+    const gate = async (input) => {
+      const t = input?.tool_input ?? {}, path = t.file_path ?? t.notebook_path ?? t.path;
+      const d = this.decide({ name: String(input?.tool_name ?? ""), args: { ...t, ...typeof path === "string" ? { path } : {} } });
+      return d === "allow" ? {} : { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: `not on this run's tool allow-list (${input?.tool_name})` } };
+    };
+    return { PreToolUse: [{ hooks: [gate] }] };
+  }
   /** A preToolUse hook enforcing this policy (deny/ask → block; allow → proceed). */
   hooks() {
     return {
@@ -5290,6 +5307,11 @@ var Agent = class _Agent {
     }
     const denyTools = [...claudeCodeDisallowedTools(o.permissions), ...mode.disallow];
     if (mode.hooks) po.hooks = mode.hooks;
+    const allowOnly = o.permissions?.ccHooks();
+    if (allowOnly) {
+      const h = po.hooks ?? o.providerOptions?.hooks ?? {};
+      po.hooks = { ...h, PreToolUse: [...h.PreToolUse ?? [], ...allowOnly.PreToolUse] };
+    }
     if (this.modeKind && o.providerOptions?.claudeCodeSession) po.claudeCodeSession = `${o.providerOptions.claudeCodeSession}:${this.modeKind}`;
     if (denyTools.length) {
       const prior = o.providerOptions?.disallowedTools ?? [];
@@ -5647,6 +5669,8 @@ var Agent = class _Agent {
       const claudeSteerPo = this.claudeCodePo();
       if (this.ccServer) this.ccExec = hostExec;
       const cursorDeny = o.model.startsWith("cursor/") ? o.permissions?.denyRules(true) ?? [] : [];
+      if (o.model.startsWith("cursor/") && o.permissions?.options.default === "deny")
+        throw new Error("cursor/* cannot enforce --onlyTools: its native tools bypass it. Refusing to run \u2014 use a claude-code/* or API model.");
       if (cursorDeny.length)
         throw new Error(`cursor/* cannot enforce --disallowedTools (${cursorDeny.join(", ")}): its native tools bypass them. Refusing to run \u2014 use a claude-code/* or API model, or drop --disallowedTools.`);
       const reasonOpts = {
@@ -19503,6 +19527,7 @@ function parseArgs(argv) {
     } else if (x === "--think-model") a.thinkModel = val(++i, x);
     else if (x === "--no-think") a.thinkModel = false;
     else if (x === "--allowedTools" || x === "--allowed-tools") a.allowedTools = val(++i, x).split(",").map((s) => s.trim()).filter(Boolean);
+    else if (x === "--onlyTools" || x === "--only-tools") a.onlyTools = val(++i, x).split(",").map((s) => s.trim()).filter(Boolean);
     else if (x === "--disallowedTools" || x === "--disallowed-tools") a.disallowedTools = val(++i, x).split(",").map((s) => s.trim()).filter(Boolean);
     else if (x === "--append-system-prompt") a.appendSystemPrompt = val(++i, x);
     else if (x === "--voice-system-prompt") a.voiceSystemPrompt = val(++i, x);
@@ -19588,6 +19613,8 @@ Flags:
   --verbose, --debug   verbose logs (sets DEBUG=* \u2014 tool args, hook decisions, retries)
   --allowedTools <l>   comma-list of tools to allow w/o asking, e.g. "Edit,Shell(git *)"
   --disallowedTools <l> comma-list of tools to deny outright (wins over allow), e.g. "Shell(rm *)"
+  --onlyTools <l>      allow-list: ONLY these run, all else is denied (a command glob never matches shell chaining, pipes, $ or redirects),
+                       e.g. "Read(/job/**),Write(/job/**),Bash(bun /skill/cli.ts *)" \u2014 cursor/* refuses it
   --append-system-prompt <t>  extra instructions appended to the system prompt for this run
   --call               voice call (duplex v3): the main agent (-m, full tools) answers every turn; a fast model
                        (--voice-model, default Claude Haiku) only fills the wait \u2014 backchannels, fillers, bridges,
@@ -20369,9 +20396,9 @@ function optsFor(args, ai, cfg = {}, extraTools = []) {
   const perm = resolvePermMode(args, canPrompt);
   if (perm.notice) err(dim(`  \u26A0 ${perm.notice}
 `));
-  const configRules = parsePermRules(cfg.permissions);
-  const flagRules = [...parsePermRules({ deny: args.disallowedTools }, true), ...parsePermRules({ allow: args.allowedTools }, true)];
-  const askRules = perm.gate === "ask" ? ASK_MUTATING.map((t) => ({ tool: t, decision: "ask" })) : [];
+  const configRules = parsePermRules(cfg.permissions).filter((r) => !args.onlyTools || r.decision !== "allow");
+  const flagRules = [...parsePermRules({ deny: args.disallowedTools }, true), ...parsePermRules({ allow: args.onlyTools ?? args.allowedTools }, true)];
+  const askRules = perm.gate === "ask" && !args.onlyTools ? ASK_MUTATING.map((t) => ({ tool: t, decision: "ask" })) : [];
   const rules = [...flagRules, ...configRules, ...askRules];
   if (configRules.length) err(dim(`  \u2295 ${configRules.length} permission rule(s) from config
 `));
@@ -20397,7 +20424,7 @@ function optsFor(args, ai, cfg = {}, extraTools = []) {
     stream: args.stream,
     host: makeHost(args.outputFormat, { stream: true }),
     planMode: args.plan || cfg.planMode || false,
-    permissions: rules.length ? new PermissionPolicy({ rules, default: "allow", host: makeHost(), ask: makeAskResolver(resolve5(args.cwd ?? process.cwd())) }) : void 0,
+    permissions: rules.length || args.onlyTools ? new PermissionPolicy({ rules, default: args.onlyTools ? "deny" : "allow", host: makeHost(), ask: makeAskResolver(resolve5(args.cwd ?? process.cwd())) }) : void 0,
     subagents: args.subagents || cfg.subagents || false,
     maxSteps: args.maxSteps ?? cfg.maxSteps,
     reasoning: args.reasoning ?? cfg.reasoning,