@livx.cc/agentx 0.99.63 → 0.99.65

package/dist/{Agent-DbqXQy5q.d.ts → Agent-BpCqDWFG.d.ts}

@@ -1,5 +1,5 @@
 import { IFilesystem } from '@livx.cc/wcli/core';
-import { M as Message, o as MessageContent, H as HostBridge, A as AgentTool, C as ChatLike, k as JobRegistry, U as UserQuestion } from './tools-HsbxgqjF.js';
+import { M as Message, o as MessageContent, H as HostBridge, A as AgentTool, C as ChatLike, k as JobRegistry, U as UserQuestion } from './tools-DV4SkkQs.js';
 
 /**
  * `--model auto`: per-turn model routing. A classifier (Jev by default — injected, so a regex or
@@ -209,6 +209,8 @@ interface PermissionRule {
     /** glob on the call's `path` arg to match (omit = any/none). */
     pathGlob?: string;
     decision: Decision;
+    /** Set by the caller for per-run rules (CLI `--disallowedTools`/`--allowedTools`), vs rules loaded from config files. */
+    explicit?: boolean;
 }
 declare class PermissionOptions {
     rules: PermissionRule[];
@@ -229,9 +231,18 @@ declare class PermissionPolicy {
     constructor(options?: Partial<PermissionOptions>);
     /** Resolve the decision for a tool call (first matching rule, else default). */
     decide(call: ToolUse): Decision;
+    /** The policy's `deny` rules as rule strings (`Tool` / `Tool(glob)`) — for delegated runtimes that run
+     *  their OWN tools (claude-code/cursor) and never pass through {@link hooks}. */
+    denyRules(explicitOnly?: boolean): string[];
     /** A preToolUse hook enforcing this policy (deny/ask → block; allow → proceed). */
     hooks(): Hooks;
 }
+/**
+ * A policy's deny rules as Claude Code `disallowedTools` entries (deduped; agentx shell names mapped to
+ * `Bash`). The Claude Agent SDK removes these from the model's context and refuses them even under
+ * `bypassPermissions`. A bare `*` (deny everything) has no CC spelling, so it throws — fail closed.
+ */
+declare function claudeCodeDisallowedTools(policy?: PermissionPolicy): string[];
 /** Tools the agent must not run before the plan is approved (sensible default). */
 declare const DEFAULT_MUTATING: string[];
 /**
@@ -732,4 +743,4 @@ declare class Agent {
  *  stub made `/compact` chase a target it could never reach and drop-oldest the conversation away. */
 declare function estimateTokens(m: Message[], keepRecentImages?: number): number;
 
-export { Agent as A, type ChatFragment as C, DEFAULT_MUTATING as D, type Hooks as H, ModelRouter as M, PermissionOptions as P, type ReasoningEffort as R, type Tier as T, AgentOptions as a, type Classification as b, type Classifier as c, type CompactResult as d, type Decision as e, ModelRouterOptions as f, PermissionPolicy as g, type PermissionRule as h, type PreToolUseDecision as i, RecordingHooks as j, RecordingLifecycle as k, type RouteDecision as l, type RouterState as m, type RunResult as n, type ToolUse as o, type ToolUseMeta as p, composeHooks as q, estimateTokens as r, jevAvailable as s, jevClassifier as t, pickTier as u, planMode as v, reasoningToChatFragment as w };
+export { Agent as A, type ChatFragment as C, DEFAULT_MUTATING as D, type Hooks as H, ModelRouter as M, PermissionOptions as P, type ReasoningEffort as R, type Tier as T, AgentOptions as a, type Classification as b, type Classifier as c, type CompactResult as d, type Decision as e, ModelRouterOptions as f, PermissionPolicy as g, type PermissionRule as h, type PreToolUseDecision as i, RecordingHooks as j, RecordingLifecycle as k, type RouteDecision as l, type RouterState as m, type RunResult as n, type ToolUse as o, type ToolUseMeta as p, claudeCodeDisallowedTools as q, composeHooks as r, estimateTokens as s, jevAvailable as t, jevClassifier as u, pickTier as v, planMode as w, reasoningToChatFragment as x };

package/dist/cli.d.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
-import { m as RouterState, H as Hooks, n as RunResult, R as ReasoningEffort, A as Agent } from './Agent-DbqXQy5q.js';
+import { m as RouterState, H as Hooks, n as RunResult, R as ReasoningEffort, A as Agent } from './Agent-BpCqDWFG.js';
 import { IFilesystem } from '@livx.cc/wcli/core';
-import { M as Message, U as UserQuestion, H as HostBridge, c as ContentPart, o as MessageContent } from './tools-HsbxgqjF.js';
+import { M as Message, U as UserQuestion, H as HostBridge, c as ContentPart, o as MessageContent } from './tools-DV4SkkQs.js';
 
 /**
  * On-disk session store for the CLI: each conversation is one JSON file at

package/dist/cli.js

@@ -3581,6 +3581,149 @@ function modelProvider(model) {
   return `?${model}`;
 }
 
+// src/permissions.ts
+init_tools_structured();
+function commandMatches(glob, cmd) {
+  const pattern = glob.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp("^" + pattern + "$").test(cmd);
+}
+function toolMatches(rule, name) {
+  return rule.includes("*") ? commandMatches(rule, name) : rule === name;
+}
+var PermissionOptions = class {
+  rules = [];
+  /** decision when no rule matches. */
+  default = "allow";
+  /** host channel for `ask` (confirm). If absent, `ask` is treated as `deny` (fail-closed). */
+  host;
+};
+var PermissionPolicy = class {
+  options;
+  constructor(options) {
+    this.options = { ...new PermissionOptions(), ...options };
+  }
+  /** Resolve the decision for a tool call (first matching rule, else default). */
+  decide(call) {
+    const names = call.name === "McpCall" && typeof call.args?.name === "string" ? [call.name, call.args.name] : [call.name];
+    for (const r of this.options.rules) {
+      if (r.tool && !names.some((n) => toolMatches(r.tool, n))) continue;
+      if (r.pathGlob) {
+        const path = typeof call.args?.path === "string" ? call.args.path : null;
+        const cmd = typeof call.args?.command === "string" ? call.args.command : null;
+        if (path != null) {
+          if (!globToRegExp(r.pathGlob).test(path.startsWith("/") ? path : `/${path}`)) continue;
+        } else if (cmd != null) {
+          if (!commandMatches(r.pathGlob, cmd)) continue;
+        } else continue;
+      }
+      return r.decision;
+    }
+    return this.options.default;
+  }
+  /** The policy's `deny` rules as rule strings (`Tool` / `Tool(glob)`) — for delegated runtimes that run
+   *  their OWN tools (claude-code/cursor) and never pass through {@link hooks}. */
+  denyRules(explicitOnly = false) {
+    return this.options.rules.filter((r) => r.decision === "deny" && (!explicitOnly || r.explicit)).map((r) => `${r.tool ?? "*"}${r.pathGlob ? `(${r.pathGlob})` : ""}`);
+  }
+  /** A preToolUse hook enforcing this policy (deny/ask → block; allow → proceed). */
+  hooks() {
+    return {
+      preToolUse: async (call) => {
+        const d = this.decide(call);
+        if (d === "allow") return;
+        if (d === "deny") return { block: true, reason: `denied by permission policy (${call.name})` };
+        if (this.options.ask) {
+          const r = await this.options.ask(call);
+          const decision = r?.decision ?? "deny";
+          const rememberTool2 = call.name === "McpCall" && typeof call.args?.name === "string" ? call.args.name : call.name;
+          if (r?.remember) this.options.rules.unshift({ tool: rememberTool2, decision });
+          return decision === "allow" ? void 0 : { block: true, reason: `not approved (${call.name})` };
+        }
+        const ok = await this.options.host?.confirm?.(`Allow ${call.name}${call.args?.path ? " on " + call.args.path : ""}?`);
+        return ok ? void 0 : { block: true, reason: `not approved (${call.name})` };
+      }
+    };
+  }
+};
+var CC_TOOL_ALIAS = { Shell: "Bash", bash: "Bash" };
+function claudeCodeDisallowedTools(policy) {
+  const out = /* @__PURE__ */ new Set();
+  for (const rule of policy?.denyRules() ?? []) {
+    const m = /^([^(]+)(\(.*\))?$/.exec(rule);
+    if (m[1] === "*") throw new Error("permission policy denies every tool (`*`) \u2014 claude-code cannot express that; refusing to run.");
+    out.add((CC_TOOL_ALIAS[m[1]] ?? m[1]) + (m[2] ?? ""));
+  }
+  return [...out];
+}
+var DEFAULT_MUTATING = ["Write", "Edit", "MultiEdit", "deleteFile", "bash"];
+function planMode(opts) {
+  const mutating = new Set(opts?.mutating ?? DEFAULT_MUTATING);
+  let approved = false;
+  const tool = {
+    name: "ExitPlanMode",
+    description: "Call when your plan is ready and you want to start making changes. Provide the `plan`. Until this is approved, edits/writes are blocked.",
+    parameters: { type: "object", required: ["plan"], properties: { plan: { type: "string", description: "the concrete steps you will take" } } },
+    async run({ plan }, _ctx) {
+      if (opts?.host?.confirm) {
+        const confirm = opts.host.confirm(`Approve this plan?
+
+${String(plan ?? "")}`);
+        const ok = await (_ctx?.parkHuman ? _ctx.parkHuman(confirm) : confirm);
+        if (!ok) return "Plan not approved. Revise it and call ExitPlanMode again.";
+      }
+      approved = true;
+      return "Plan approved \u2014 you may now make changes.";
+    }
+  };
+  const hooks = {
+    preToolUse: (call) => !approved && mutating.has(call.name) ? { block: true, reason: "plan mode: present a plan and call ExitPlanMode (approved) before editing." } : void 0
+  };
+  return { hooks, tool };
+}
+function composeHooks(...list) {
+  const hooks = list.filter(Boolean);
+  return {
+    async preToolUse(call, meta) {
+      for (const h of hooks) {
+        const d = await h.preToolUse?.(call, meta);
+        if (d?.block) return d;
+      }
+    },
+    async postToolUse(call, result, meta) {
+      for (const h of hooks) await h.postToolUse?.(call, result, meta);
+    },
+    onToolOutput(call, chunk, meta) {
+      for (const h of hooks) h.onToolOutput?.(call, chunk, meta);
+    },
+    onStop(text) {
+      for (const h of hooks) h.onStop?.(text);
+    },
+    // lifecycle: concatenate session-start context; chain prompt-submit transforms; fan out pre-compact.
+    async onSessionStart() {
+      let ctx = "";
+      for (const h of hooks) {
+        const r = await h.onSessionStart?.();
+        if (r) ctx += (ctx ? "\n\n" : "") + r;
+      }
+      return ctx || void 0;
+    },
+    async onUserPromptSubmit(text) {
+      let t = text;
+      for (const h of hooks) {
+        const r = await h.onUserPromptSubmit?.(t);
+        if (typeof r === "string") t = r;
+      }
+      return t;
+    },
+    async onPreCompact(messages) {
+      for (const h of hooks) await h.onPreCompact?.(messages);
+    },
+    async onSubagentStop(summary, info) {
+      for (const h of hooks) await h.onSubagentStop?.(summary, info);
+    }
+  };
+}
+
 // src/subagent.ts
 init_OverlayFilesystem();
 init_worktree();
@@ -3738,6 +3881,8 @@ function childOptionsFor(opts, fs, depth, maxDepth, agentType, model, root) {
   }
   const po = opts.providerOptionsFor?.(childModel);
   if (po) childOpts.providerOptions = po;
+  const deny = opts.permissions?.options.rules.filter((r) => r.decision === "deny") ?? [];
+  if (deny.length) childOpts.permissions = new PermissionPolicy({ rules: deny, default: "allow" });
   if (opts.hooks?.preToolUse) childOpts.hooks = { preToolUse: opts.hooks.preToolUse.bind(opts.hooks) };
   return childOpts;
 }
@@ -3957,133 +4102,6 @@ async function loadAgents(fs, dir) {
 
 // src/Agent.ts
 init_OverlayFilesystem();
-
-// src/permissions.ts
-init_tools_structured();
-function commandMatches(glob, cmd) {
-  const pattern = glob.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
-  return new RegExp("^" + pattern + "$").test(cmd);
-}
-var PermissionOptions = class {
-  rules = [];
-  /** decision when no rule matches. */
-  default = "allow";
-  /** host channel for `ask` (confirm). If absent, `ask` is treated as `deny` (fail-closed). */
-  host;
-};
-var PermissionPolicy = class {
-  options;
-  constructor(options) {
-    this.options = { ...new PermissionOptions(), ...options };
-  }
-  /** Resolve the decision for a tool call (first matching rule, else default). */
-  decide(call) {
-    const names = call.name === "McpCall" && typeof call.args?.name === "string" ? [call.name, call.args.name] : [call.name];
-    for (const r of this.options.rules) {
-      if (r.tool && !names.includes(r.tool)) continue;
-      if (r.pathGlob) {
-        const path = typeof call.args?.path === "string" ? call.args.path : null;
-        const cmd = typeof call.args?.command === "string" ? call.args.command : null;
-        if (path != null) {
-          if (!globToRegExp(r.pathGlob).test(path.startsWith("/") ? path : `/${path}`)) continue;
-        } else if (cmd != null) {
-          if (!commandMatches(r.pathGlob, cmd)) continue;
-        } else continue;
-      }
-      return r.decision;
-    }
-    return this.options.default;
-  }
-  /** A preToolUse hook enforcing this policy (deny/ask → block; allow → proceed). */
-  hooks() {
-    return {
-      preToolUse: async (call) => {
-        const d = this.decide(call);
-        if (d === "allow") return;
-        if (d === "deny") return { block: true, reason: `denied by permission policy (${call.name})` };
-        if (this.options.ask) {
-          const r = await this.options.ask(call);
-          const decision = r?.decision ?? "deny";
-          const rememberTool2 = call.name === "McpCall" && typeof call.args?.name === "string" ? call.args.name : call.name;
-          if (r?.remember) this.options.rules.unshift({ tool: rememberTool2, decision });
-          return decision === "allow" ? void 0 : { block: true, reason: `not approved (${call.name})` };
-        }
-        const ok = await this.options.host?.confirm?.(`Allow ${call.name}${call.args?.path ? " on " + call.args.path : ""}?`);
-        return ok ? void 0 : { block: true, reason: `not approved (${call.name})` };
-      }
-    };
-  }
-};
-var DEFAULT_MUTATING = ["Write", "Edit", "MultiEdit", "deleteFile", "bash"];
-function planMode(opts) {
-  const mutating = new Set(opts?.mutating ?? DEFAULT_MUTATING);
-  let approved = false;
-  const tool = {
-    name: "ExitPlanMode",
-    description: "Call when your plan is ready and you want to start making changes. Provide the `plan`. Until this is approved, edits/writes are blocked.",
-    parameters: { type: "object", required: ["plan"], properties: { plan: { type: "string", description: "the concrete steps you will take" } } },
-    async run({ plan }, _ctx) {
-      if (opts?.host?.confirm) {
-        const confirm = opts.host.confirm(`Approve this plan?
-
-${String(plan ?? "")}`);
-        const ok = await (_ctx?.parkHuman ? _ctx.parkHuman(confirm) : confirm);
-        if (!ok) return "Plan not approved. Revise it and call ExitPlanMode again.";
-      }
-      approved = true;
-      return "Plan approved \u2014 you may now make changes.";
-    }
-  };
-  const hooks = {
-    preToolUse: (call) => !approved && mutating.has(call.name) ? { block: true, reason: "plan mode: present a plan and call ExitPlanMode (approved) before editing." } : void 0
-  };
-  return { hooks, tool };
-}
-function composeHooks(...list) {
-  const hooks = list.filter(Boolean);
-  return {
-    async preToolUse(call, meta) {
-      for (const h of hooks) {
-        const d = await h.preToolUse?.(call, meta);
-        if (d?.block) return d;
-      }
-    },
-    async postToolUse(call, result, meta) {
-      for (const h of hooks) await h.postToolUse?.(call, result, meta);
-    },
-    onToolOutput(call, chunk, meta) {
-      for (const h of hooks) h.onToolOutput?.(call, chunk, meta);
-    },
-    onStop(text) {
-      for (const h of hooks) h.onStop?.(text);
-    },
-    // lifecycle: concatenate session-start context; chain prompt-submit transforms; fan out pre-compact.
-    async onSessionStart() {
-      let ctx = "";
-      for (const h of hooks) {
-        const r = await h.onSessionStart?.();
-        if (r) ctx += (ctx ? "\n\n" : "") + r;
-      }
-      return ctx || void 0;
-    },
-    async onUserPromptSubmit(text) {
-      let t = text;
-      for (const h of hooks) {
-        const r = await h.onUserPromptSubmit?.(t);
-        if (typeof r === "string") t = r;
-      }
-      return t;
-    },
-    async onPreCompact(messages) {
-      for (const h of hooks) await h.onPreCompact?.(messages);
-    },
-    async onSubagentStop(summary, info) {
-      for (const h of hooks) await h.onSubagentStop?.(summary, info);
-    }
-  };
-}
-
-// src/Agent.ts
 init_logging();
 
 // src/lint.ts
@@ -4603,6 +4621,8 @@ var Agent = class _Agent {
         agents,
         hooks: o.hooks,
         traceDir: o.traceDir,
+        permissions: o.permissions,
+        // a child obeys the parent's allow/deny rules (else Task is a one-call bypass)
         tools: [...o.tools, ...this.injectedTools],
         systemPrompt: o.systemPrompt,
         providerOptionsFor: o.providerOptionsFor ?? ((m) => modelProvider(m) === modelProvider(o.model) ? o.providerOptions : void 0)
@@ -4775,6 +4795,14 @@ var Agent = class _Agent {
         }
       } : void 0;
       const claudeSteerPo = o.model.startsWith("claude-code/") ? { steer: () => this.drainPendingSteers() } : void 0;
+      const denyTools = o.model.startsWith("claude-code/") ? claudeCodeDisallowedTools(o.permissions) : [];
+      if (denyTools.length) {
+        const prior = o.providerOptions?.disallowedTools ?? [];
+        claudeSteerPo.disallowedTools = [.../* @__PURE__ */ new Set([...prior, ...denyTools])];
+      }
+      const cursorDeny = o.model.startsWith("cursor/") ? o.permissions?.denyRules(true) ?? [] : [];
+      if (cursorDeny.length)
+        throw new Error(`cursor/* cannot enforce --disallowedTools (${cursorDeny.join(", ")}): its native tools bypass them. Refusing to run \u2014 use a claude-code/* or API model, or drop --disallowedTools.`);
       const reasonOpts = {
         ...frag,
         ...o.promptCache ? { promptCache: true } : {},
@@ -4891,6 +4919,9 @@ var Agent = class _Agent {
         this.transcript.push({
           role: "assistant",
           content: res.content ?? "",
+          // Record the model the adapter actually ran: aliases (`claude-code/opus`) resolve to a concrete
+          // id (e.g. `claude-opus-5-5`); fall back to the requested model if the adapter didn't report one.
+          model: res.model ?? o.model,
           ...toolCalls.length ? { tool_calls: toolCalls } : {},
           ...res.reasoningContent && passesBackReasoning(o.model) ? { reasoning_content: res.reasoningContent } : {}
         });
@@ -5053,7 +5084,9 @@ var Agent = class _Agent {
     let sawTool = false;
     let trailing = "";
     let reasoning = "";
+    let resolvedModel;
     for await (const chunk of stream) {
+      if (chunk.model) resolvedModel = chunk.model;
       poke?.();
       if (this.options.signal?.aborted) break;
       if (chunk.reasoningContent) {
@@ -5102,7 +5135,7 @@ var Agent = class _Agent {
     }
     const delegatedTools = delegatedOrder.map((k) => delegated.get(k));
     const endedWithoutClosing = sawTool && (!trailing.trim() || endsOnAnnouncedAction(trailing));
-    return { content, ...reasoning ? { reasoningContent: reasoning } : {}, ...finishReason ? { finishReason } : {}, ...toolCalls ? { toolCalls } : {}, ...usage ? { usage } : {}, ...delegatedTools.length ? { delegatedTools } : {}, ...endedWithoutClosing ? { endedWithoutClosing: true } : {} };
+    return { content, ...resolvedModel ? { model: resolvedModel } : {}, ...reasoning ? { reasoningContent: reasoning } : {}, ...finishReason ? { finishReason } : {}, ...toolCalls ? { toolCalls } : {}, ...usage ? { usage } : {}, ...delegatedTools.length ? { delegatedTools } : {}, ...endedWithoutClosing ? { endedWithoutClosing: true } : {} };
   }
   /**
    * FABRICATED TOOL USE — the failure no call-reactive layer can see, because there IS no call.
@@ -13462,20 +13495,20 @@ var GitCheckpointsOptions = class {
 import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync9 } from "fs";
 import { homedir as homedir7 } from "os";
 import { join as join10 } from "path";
-var RULE_RE = /^(\w+)(?:\((.+)\))?$/;
+var RULE_RE = /^(\w[\w*-]*)(?:\((.+)\))?$/;
 function parseOne(raw, decision) {
   const m = RULE_RE.exec(raw.trim());
   if (!m) return null;
   const [, tool, pathGlob] = m;
   return pathGlob ? { tool, pathGlob, decision } : { tool, decision };
 }
-function parsePermRules(perms) {
+function parsePermRules(perms, explicit = false) {
   if (!perms) return [];
   const out = [];
   for (const [decision, list] of [["deny", perms.deny], ["allow", perms.allow], ["ask", perms.ask]]) {
     for (const raw of list ?? []) {
       const r = parseOne(raw, decision);
-      if (r) out.push(r);
+      if (r) out.push(explicit ? { ...r, explicit } : r);
     }
   }
   return out;
@@ -16513,7 +16546,7 @@ function optsFor(args, ai, cfg = {}, extraTools = []) {
   if (perm.notice) err(dim(`  \u26A0 ${perm.notice}
 `));
   const configRules = parsePermRules(cfg.permissions);
-  const flagRules = [...parsePermRules({ deny: args.disallowedTools }), ...parsePermRules({ allow: args.allowedTools })];
+  const flagRules = [...parsePermRules({ deny: args.disallowedTools }, true), ...parsePermRules({ allow: args.allowedTools }, true)];
   const askRules = perm.gate === "ask" ? ASK_MUTATING.map((t) => ({ tool: t, decision: "ask" })) : [];
   const rules = [...flagRules, ...configRules, ...askRules];
   if (configRules.length) err(dim(`  \u2295 ${configRules.length} permission rule(s) from config
@@ -17232,8 +17265,8 @@ async function repl(args, ai, cfg, cwd) {
   const sendVia = dx ? (c, o) => dx.send(c, o) : void 0;
   const routeVia = autoRouteSend(args, agent, () => session, (m) => providerOptionsFor(m, cwd, cfg.mcpServers, mounted.map((x) => x.name)));
   const baseRules = () => [
-    ...parsePermRules({ deny: args.disallowedTools }),
-    ...parsePermRules({ allow: args.allowedTools }),
+    ...parsePermRules({ deny: args.disallowedTools }, true),
+    ...parsePermRules({ allow: args.allowedTools }, true),
     ...parsePermRules(mergePerms(loadPersistedRules(cwd), cfg.permissions))
   ];
   const askFor = (tools) => tools.map((t) => ({ tool: t, decision: "ask" }));