@livx.cc/agentx 0.99.127 → 0.99.128

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { c as AgentOptions, H as Hooks, x as RunResult, k as Decider, b as Agent, q as PermissionPolicy, G as Gender, L as LineKind, d as ChannelMode, y as SecondChannelOptions, S as SecondChannel } from './secondChannel-CYU9qqwr.js';
-export { A as ADVISE_LIMIT, a as AdvisorSetup, C as CC_WRITE_TOOLS, e as ChatFragment, f as ChatUsage, g as Classification, h as Classifier, i as CompactResult, j as ContextFileSpec, D as DEFAULT_MUTATING, l as Decision, M as ModelRouter, m as ModelRouterOptions, P as PLANNER_BLOCKED, n as PLANNER_REFUSAL, o as PLAN_FIRST, p as PermissionOptions, r as PermissionRule, s as PreToolUseDecision, R as ReasoningEffort, t as RecordingHooks, u as RecordingLifecycle, v as RouteDecision, w as RouterState, T as Tier, z as ToolUse, B as ToolUseMeta, W as WRITE_TOOLS, E as advisorFor, F as advisorPrompt, I as ccModeOptions, J as claudeCodeDisallowedTools, K as composeHooks, N as delegatePrompt, O as delegateTools, Q as delegateWorkerFor, U as estimateTokens, V as jevAvailable, X as jevClassifier, Y as loadContextFiles, Z as loadInstructions, _ as makeAdvisor, $ as meterWorkers, a0 as pickTier, a1 as planMode, a2 as plannerBlocks, a3 as reasoningToChatFragment } from './secondChannel-CYU9qqwr.js';
+import { c as AgentOptions, H as Hooks, x as RunResult, k as Decider, b as Agent, q as PermissionPolicy, G as Gender, L as LineKind, d as ChannelMode, y as SecondChannelOptions, S as SecondChannel } from './secondChannel-D-8AGmAT.js';
+export { A as ADVISE_LIMIT, a as AdvisorSetup, C as CC_WRITE_TOOLS, e as ChatFragment, f as ChatUsage, g as Classification, h as Classifier, i as CompactResult, j as ContextFileSpec, D as DEFAULT_MUTATING, l as Decision, M as ModelRouter, m as ModelRouterOptions, P as PLANNER_BLOCKED, n as PLANNER_REFUSAL, o as PLAN_FIRST, p as PermissionOptions, r as PermissionRule, s as PreToolUseDecision, R as ReasoningEffort, t as RecordingHooks, u as RecordingLifecycle, v as RouteDecision, w as RouterState, T as Tier, z as ToolUse, B as ToolUseMeta, W as WRITE_TOOLS, E as advisorFor, F as advisorPrompt, I as ccModeOptions, J as claudeCodeDisallowedTools, K as composeHooks, N as delegatePrompt, O as delegateTools, Q as delegateWorkerFor, U as estimateTokens, V as jevAvailable, X as jevClassifier, Y as loadContextFiles, Z as loadInstructions, _ as makeAdvisor, $ as meterWorkers, a0 as pickTier, a1 as planMode, a2 as plannerBlocks, a3 as reasoningToChatFragment } from './secondChannel-D-8AGmAT.js';
 export { MODEL_ALIASES, ModelSwitch, ResolveModelSwitchOpts, latestClaude, modelShortLabel, resolveModelAlias, resolveModelSwitch } from './models.js';
 import { IFilesystem, FileMetadata } from '@livx.cc/wcli/core';
 export { CommandExecutor, FileMetadata, IFilesystem, IndexedDbFilesystem, MemFilesystem, registerHeadlessCommands } from '@livx.cc/wcli/core';

package/dist/index.js

@@ -3901,16 +3901,19 @@ import { join as join3 } from "path";
 
 // src/permissions.ts
 init_tools_structured();
+import { posix } from "path";
 function commandMatches(glob, cmd) {
   const pattern = glob.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
   return new RegExp("^" + pattern + "$").test(cmd);
 }
+var SHELL_CONTROL = /[;&|`$<>\n\r]/;
 function toolMatches(rule, name) {
   return rule.includes("*") ? commandMatches(rule, name) : rule === name;
 }
 var PermissionOptions = class {
   rules = [];
-  /** decision when no rule matches. */
+  /** decision when no rule matches. 'deny' = an allow-list run (`--onlyTools`): only the allow rules run, an allowed
+   *  command glob never matches shell control syntax, and claude-code enforces it by a PreToolUse hook (ccHooks). */
   default = "allow";
   /** host channel for `ask` (confirm). If absent, `ask` is treated as `deny` (fail-closed). */
   host;
@@ -3923,15 +3926,17 @@ var PermissionPolicy = class {
   /** Resolve the decision for a tool call (first matching rule, else default). */
   decide(call) {
     const names = call.name === "McpCall" && typeof call.args?.name === "string" ? [call.name, call.args.name] : [call.name];
+    if (CC_TOOL_ALIAS[call.name]) names.push(CC_TOOL_ALIAS[call.name]);
+    const strict = this.options.default === "deny";
     for (const r of this.options.rules) {
       if (r.tool && !names.some((n) => toolMatches(r.tool, n))) continue;
       if (r.pathGlob) {
         const path = typeof call.args?.path === "string" ? call.args.path : null;
         const cmd = typeof call.args?.command === "string" ? call.args.command : null;
         if (path != null) {
-          if (!globToRegExp(r.pathGlob).test(path.startsWith("/") ? path : `/${path}`)) continue;
+          if (!globToRegExp(r.pathGlob).test(posix.normalize(path.startsWith("/") ? path : `/${path}`))) continue;
         } else if (cmd != null) {
-          if (!commandMatches(r.pathGlob, cmd)) continue;
+          if (!commandMatches(r.pathGlob, cmd) || strict && r.decision === "allow" && SHELL_CONTROL.test(cmd)) continue;
         } else continue;
       }
       return r.decision;
@@ -3943,6 +3948,18 @@ var PermissionPolicy = class {
   denyRules(explicitOnly = false) {
     return this.options.rules.filter((r) => r.decision === "deny" && (!explicitOnly || r.explicit)).map((r) => `${r.tool ?? "*"}${r.pathGlob ? `(${r.pathGlob})` : ""}`);
   }
+  /** An allow-list policy (default 'deny') as Claude Code SDK hooks: claude-code runs its own tools, which never reach
+   *  {@link hooks}, and `disallowedTools` can't say "everything else". Every tool call (native and MCP) goes through
+   *  decide(); `ask` has no host there → deny. undefined for a default-allow policy (its deny rules travel as disallowedTools). */
+  ccHooks() {
+    if (this.options.default !== "deny") return void 0;
+    const gate = async (input) => {
+      const t = input?.tool_input ?? {}, path = t.file_path ?? t.notebook_path ?? t.path;
+      const d = this.decide({ name: String(input?.tool_name ?? ""), args: { ...t, ...typeof path === "string" ? { path } : {} } });
+      return d === "allow" ? {} : { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: `not on this run's tool allow-list (${input?.tool_name})` } };
+    };
+    return { PreToolUse: [{ hooks: [gate] }] };
+  }
   /** A preToolUse hook enforcing this policy (deny/ask → block; allow → proceed). */
   hooks() {
     return {
@@ -5181,6 +5198,11 @@ var Agent = class _Agent {
     }
     const denyTools = [...claudeCodeDisallowedTools(o.permissions), ...mode.disallow];
     if (mode.hooks) po.hooks = mode.hooks;
+    const allowOnly = o.permissions?.ccHooks();
+    if (allowOnly) {
+      const h = po.hooks ?? o.providerOptions?.hooks ?? {};
+      po.hooks = { ...h, PreToolUse: [...h.PreToolUse ?? [], ...allowOnly.PreToolUse] };
+    }
     if (this.modeKind && o.providerOptions?.claudeCodeSession) po.claudeCodeSession = `${o.providerOptions.claudeCodeSession}:${this.modeKind}`;
     if (denyTools.length) {
       const prior = o.providerOptions?.disallowedTools ?? [];
@@ -5538,6 +5560,8 @@ var Agent = class _Agent {
       const claudeSteerPo = this.claudeCodePo();
       if (this.ccServer) this.ccExec = hostExec;
       const cursorDeny = o.model.startsWith("cursor/") ? o.permissions?.denyRules(true) ?? [] : [];
+      if (o.model.startsWith("cursor/") && o.permissions?.options.default === "deny")
+        throw new Error("cursor/* cannot enforce --onlyTools: its native tools bypass it. Refusing to run \u2014 use a claude-code/* or API model.");
       if (cursorDeny.length)
         throw new Error(`cursor/* cannot enforce --disallowedTools (${cursorDeny.join(", ")}): its native tools bypass them. Refusing to run \u2014 use a claude-code/* or API model, or drop --disallowedTools.`);
       const reasonOpts = {