@livx.cc/agentx 0.99.127 → 0.99.128

package/dist/{secondChannel-CYU9qqwr.d.ts → secondChannel-D-8AGmAT.d.ts}

@@ -234,7 +234,8 @@ interface PermissionRule {
 }
 declare class PermissionOptions {
     rules: PermissionRule[];
-    /** decision when no rule matches. */
+    /** decision when no rule matches. 'deny' = an allow-list run (`--onlyTools`): only the allow rules run, an allowed
+     *  command glob never matches shell control syntax, and claude-code enforces it by a PreToolUse hook (ccHooks). */
     default: Decision;
     /** host channel for `ask` (confirm). If absent, `ask` is treated as `deny` (fail-closed). */
     host?: HostBridge;
@@ -254,6 +255,10 @@ declare class PermissionPolicy {
     /** The policy's `deny` rules as rule strings (`Tool` / `Tool(glob)`) — for delegated runtimes that run
      *  their OWN tools (claude-code/cursor) and never pass through {@link hooks}. */
     denyRules(explicitOnly?: boolean): string[];
+    /** An allow-list policy (default 'deny') as Claude Code SDK hooks: claude-code runs its own tools, which never reach
+     *  {@link hooks}, and `disallowedTools` can't say "everything else". Every tool call (native and MCP) goes through
+     *  decide(); `ask` has no host there → deny. undefined for a default-allow policy (its deny rules travel as disallowedTools). */
+    ccHooks(): Record<string, unknown[]> | undefined;
     /** A preToolUse hook enforcing this policy (deny/ask → block; allow → proceed). */
     hooks(): Hooks;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/agentx",
-  "version": "0.99.127",
+  "version": "0.99.128",
   "description": "Edge-native AI agent runtime — drives a virtual filesystem via any LLM (ai.libx.js). Same bytes run in node, browser, or edge.",
   "type": "module",
   "main": "./dist/index.js",