@livx.cc/agentx 0.99.63 → 0.99.65

package/dist/index.d.ts

@@ -1,15 +1,15 @@
-import { a as AgentOptions, H as Hooks, n as RunResult, A as Agent } from './Agent-DbqXQy5q.js';
-export { C as ChatFragment, b as Classification, c as Classifier, d as CompactResult, D as DEFAULT_MUTATING, e as Decision, M as ModelRouter, f as ModelRouterOptions, P as PermissionOptions, g as PermissionPolicy, h as PermissionRule, i as PreToolUseDecision, R as ReasoningEffort, j as RecordingHooks, k as RecordingLifecycle, l as RouteDecision, m as RouterState, T as Tier, o as ToolUse, p as ToolUseMeta, q as composeHooks, r as estimateTokens, s as jevAvailable, t as jevClassifier, u as pickTier, v as planMode, w as reasoningToChatFragment } from './Agent-DbqXQy5q.js';
+import { a as AgentOptions, H as Hooks, n as RunResult, A as Agent, g as PermissionPolicy } from './Agent-BpCqDWFG.js';
+export { C as ChatFragment, b as Classification, c as Classifier, d as CompactResult, D as DEFAULT_MUTATING, e as Decision, M as ModelRouter, f as ModelRouterOptions, P as PermissionOptions, h as PermissionRule, i as PreToolUseDecision, R as ReasoningEffort, j as RecordingHooks, k as RecordingLifecycle, l as RouteDecision, m as RouterState, T as Tier, o as ToolUse, p as ToolUseMeta, q as claudeCodeDisallowedTools, r as composeHooks, s as estimateTokens, t as jevAvailable, u as jevClassifier, v as pickTier, w as planMode, x as reasoningToChatFragment } from './Agent-BpCqDWFG.js';
 export { MODEL_ALIASES, ModelSwitch, ResolveModelSwitchOpts, modelShortLabel, resolveModelAlias, resolveModelSwitch } from './models.js';
 import { IFilesystem, FileMetadata } from '@livx.cc/wcli/core';
 export { CommandExecutor, FileMetadata, IFilesystem, IndexedDbFilesystem, MemFilesystem, registerHeadlessCommands } from '@livx.cc/wcli/core';
 import { BodDB } from '@bod.ee/db';
-import { A as AgentTool, C as ChatLike, a as ChatOptions, b as ChatResponse, r as ToolCall, H as HostBridge, U as UserQuestion, o as MessageContent } from './tools-HsbxgqjF.js';
-export { c as ContentPart, d as HostEvent, I as IMAGE_ELIDE_STUB, e as IMAGE_REF_SCHEME, f as ImageRef, J as JobCtx, g as JobHandle, h as JobInfo, i as JobKind, j as JobNotice, k as JobRegistry, l as JobRegistryOptions, n as JobTrackOptions, M as Message, m as RegistryJobStatus, R as Role, S as SandboxJobRegistry, p as StreamChunk, T as TodoItem, q as Tool, s as ToolContext, t as bashTool, u as clearImageRefs, v as contentBytes, w as contentText, x as defaultTools, y as editTool, z as elideImages, B as elideInlineImages, D as elideStaleImages, E as exitSessionTool, F as expandImagesForSend, G as formatJobNotice, K as imagePart, L as imageRefPart, N as imageRefResult, O as makeContext, P as makeJobTools, Q as messageHasImage, V as messageHasImageRef, W as messageHasInlineImage, X as mintImageRef, Y as parseImageRef, Z as readTool, _ as remintImageRefs, $ as sendBytes, a0 as sendBytesPer, a1 as toWireTools, a2 as todoWriteTool, a3 as toolImageRef, a4 as toolRegistry, a5 as toolsByName } from './tools-HsbxgqjF.js';
+import { A as AgentTool, C as ChatLike, a as ChatOptions, b as ChatResponse, r as ToolCall, H as HostBridge, U as UserQuestion, o as MessageContent } from './tools-DV4SkkQs.js';
+export { c as ContentPart, d as HostEvent, I as IMAGE_ELIDE_STUB, e as IMAGE_REF_SCHEME, f as ImageRef, J as JobCtx, g as JobHandle, h as JobInfo, i as JobKind, j as JobNotice, k as JobRegistry, l as JobRegistryOptions, n as JobTrackOptions, M as Message, m as RegistryJobStatus, R as Role, S as SandboxJobRegistry, p as StreamChunk, T as TodoItem, q as Tool, s as ToolContext, t as bashTool, u as clearImageRefs, v as contentBytes, w as contentText, x as defaultTools, y as editTool, z as elideImages, B as elideInlineImages, D as elideStaleImages, E as exitSessionTool, F as expandImagesForSend, G as formatJobNotice, K as imagePart, L as imageRefPart, N as imageRefResult, O as makeContext, P as makeJobTools, Q as messageHasImage, V as messageHasImageRef, W as messageHasInlineImage, X as mintImageRef, Y as parseImageRef, Z as readTool, _ as remintImageRefs, $ as sendBytes, a0 as sendBytesPer, a1 as toWireTools, a2 as todoWriteTool, a3 as toolImageRef, a4 as toolRegistry, a5 as toolsByName } from './tools-DV4SkkQs.js';
 import { ShellJobRegistry } from './tools.shell.js';
 import { SpokenSplitter } from '@bod.ee/voice';
 export { AudioSink, AudioSource, AuthProvider, CartesiaTTS, CartesiaTTSOptions, STT_SAMPLE_RATE, SonioxSTT, SonioxSTTOptions, SttLike, TTS_SAMPLE_RATE, TtsLike, VoiceEngine, VoiceEngineOptions, VoiceState, resolveAuth } from '@bod.ee/voice';
-export { M as McpCall, a as McpImage, b as McpRoute, c as McpRouteResolver, d as McpToolResult, e as McpToolSearchOptions, f as McpToolSpec, g as MountedMcpLike, h as buildMcpCatalog, m as makeLazyMcpToolSearch, i as makeMcpToolSearch, j as makeMcpToolSearchFromMounted, k as mcpToolToAgentTool, l as mcpToolsToAgentTools } from './mcp-CSLRyvEp.js';
+export { M as McpCall, a as McpImage, b as McpRoute, c as McpRouteResolver, d as McpToolResult, e as McpToolSearchOptions, f as McpToolSpec, g as MountedMcpLike, h as buildMcpCatalog, m as makeLazyMcpToolSearch, i as makeMcpToolSearch, j as makeMcpToolSearchFromMounted, k as mcpToolToAgentTool, l as mcpToolsToAgentTools } from './mcp-DGd2If0Z.js';
 import * as libx_js_src_modules_log from 'libx.js/src/modules/log';
 export { log } from 'libx.js/src/modules/log';
 
@@ -1417,6 +1417,8 @@ interface TaskToolOptions {
     maxParallel?: number;
     /** Parent hooks — `onSubagentStop` fires with each child's summary when it finishes. */
     hooks?: Hooks;
+    /** Parent permission policy — its DENY rules are inherited by every child (they must hold across delegation). */
+    permissions?: PermissionPolicy;
     /**
      * Wall-clock ceiling for ONE child run, in ms (default `SUBAGENT_MAX_DURATION_MS`). `maxSteps` alone is
      * not a bound: 25 steps x a 600s Shell is ~250 minutes, far past any transport deadline wrapping the
@@ -1491,4 +1493,4 @@ declare function exitWorktree(): {
     reason?: string;
 } | null;
 
-export { Agent, type AgentDef, AgentOptions, AgentTool, type AskOptions, type Attempt, BodDbFilesystem, ChatLike, ChatOptions, ChatResponse, type CommandInfo, ConsoleHostBridge, DEFAULT_DENY, DEFAULT_MAX_DEPTH, DEFAULT_SKIP_DIRS, DuplexAgent, DuplexAgentOptions, type DuplexTaskStatus, FakeAIClient, type FileScanOptions, Hooks, HostBridge, JailOptions, JailedFilesystem, type LessonOptions, LessonOptionsDefaults, type LoadMemoryOpts, MEMORY_PROMPT, MessageContent, type Mount, MountFilesystem, NodeDiskFilesystem, OverlayFilesystem, type ReflectOptions, RunResult, SCRATCH_DIR, type ScheduledJob, type ScheduledJobSnapshot, Scheduler, type SchedulerOptions, Scratch, type ScratchOptions, ScriptedHostBridge, type SiblingResolver, type SkillInfo, type TaskRecord, type TaskToolOptions, ToolCall, type ToolSpec, type Trigger, type TriggerCron, type TriggerInterval, type TriggerOneOff, UserQuestion, VOICE_MEMORY_PROMPT, VOICE_SYSTEM_PROMPT, type WebFetchOptions, type WebSearchOptions, type WorkerTier, type WorktreeInfo, type WorktreeSession, applyEditsTool, askUserQuestionTool, checkpointTool, checkpointTools, cleanupWorktree, compileSynthesizedTool, cronMatches, decodeDdgUrl, diskAgentOptions, enterWorktree, exitWorktree, expandCommand, expandEntry, expandTemplate, findGitRoot, forComponent, fullAgentOptions, getOrCreateWorktree, getWorktreeSession, globTool, grepTool, htmlToText, idfWeights, lessonCapture, loadAgents, loadCommands, loadInstructions, loadMemory, loadSkills, makeAskTool, makeGlobTool, makeGrepTool, makeScheduleTools, makeTaskBatchTool, makeTaskTool, makeWebFetchTool, makeWebSearchAnthropicTool, makeWebSearchTool, mkdirp, multiEditTool, nextCronAfter, parseCron, parseDdgHtml, raceAttempts, reflectOnRun, relevanceScore, repoIndex, repoMapTool, rollbackTool, sandboxAgentOptions, scanCommands, scanSkills, slugify, tokenize, toolCall, topByRelevance, validateToolCode, validateWorktreeSlug, webFetchTool, webSearchAnthropicTool, webSearchTool, worktreeBranchName, writeFact, writeTool };
+export { Agent, type AgentDef, AgentOptions, AgentTool, type AskOptions, type Attempt, BodDbFilesystem, ChatLike, ChatOptions, ChatResponse, type CommandInfo, ConsoleHostBridge, DEFAULT_DENY, DEFAULT_MAX_DEPTH, DEFAULT_SKIP_DIRS, DuplexAgent, DuplexAgentOptions, type DuplexTaskStatus, FakeAIClient, type FileScanOptions, Hooks, HostBridge, JailOptions, JailedFilesystem, type LessonOptions, LessonOptionsDefaults, type LoadMemoryOpts, MEMORY_PROMPT, MessageContent, type Mount, MountFilesystem, NodeDiskFilesystem, OverlayFilesystem, PermissionPolicy, type ReflectOptions, RunResult, SCRATCH_DIR, type ScheduledJob, type ScheduledJobSnapshot, Scheduler, type SchedulerOptions, Scratch, type ScratchOptions, ScriptedHostBridge, type SiblingResolver, type SkillInfo, type TaskRecord, type TaskToolOptions, ToolCall, type ToolSpec, type Trigger, type TriggerCron, type TriggerInterval, type TriggerOneOff, UserQuestion, VOICE_MEMORY_PROMPT, VOICE_SYSTEM_PROMPT, type WebFetchOptions, type WebSearchOptions, type WorkerTier, type WorktreeInfo, type WorktreeSession, applyEditsTool, askUserQuestionTool, checkpointTool, checkpointTools, cleanupWorktree, compileSynthesizedTool, cronMatches, decodeDdgUrl, diskAgentOptions, enterWorktree, exitWorktree, expandCommand, expandEntry, expandTemplate, findGitRoot, forComponent, fullAgentOptions, getOrCreateWorktree, getWorktreeSession, globTool, grepTool, htmlToText, idfWeights, lessonCapture, loadAgents, loadCommands, loadInstructions, loadMemory, loadSkills, makeAskTool, makeGlobTool, makeGrepTool, makeScheduleTools, makeTaskBatchTool, makeTaskTool, makeWebFetchTool, makeWebSearchAnthropicTool, makeWebSearchTool, mkdirp, multiEditTool, nextCronAfter, parseCron, parseDdgHtml, raceAttempts, reflectOnRun, relevanceScore, repoIndex, repoMapTool, rollbackTool, sandboxAgentOptions, scanCommands, scanSkills, slugify, tokenize, toolCall, topByRelevance, validateToolCode, validateWorktreeSlug, webFetchTool, webSearchAnthropicTool, webSearchTool, worktreeBranchName, writeFact, writeTool };

package/dist/index.js

@@ -3422,6 +3422,149 @@ function resolveModelSwitch(opts) {
   };
 }
 
+// src/permissions.ts
+init_tools_structured();
+function commandMatches(glob, cmd) {
+  const pattern = glob.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp("^" + pattern + "$").test(cmd);
+}
+function toolMatches(rule, name) {
+  return rule.includes("*") ? commandMatches(rule, name) : rule === name;
+}
+var PermissionOptions = class {
+  rules = [];
+  /** decision when no rule matches. */
+  default = "allow";
+  /** host channel for `ask` (confirm). If absent, `ask` is treated as `deny` (fail-closed). */
+  host;
+};
+var PermissionPolicy = class {
+  options;
+  constructor(options) {
+    this.options = { ...new PermissionOptions(), ...options };
+  }
+  /** Resolve the decision for a tool call (first matching rule, else default). */
+  decide(call) {
+    const names = call.name === "McpCall" && typeof call.args?.name === "string" ? [call.name, call.args.name] : [call.name];
+    for (const r of this.options.rules) {
+      if (r.tool && !names.some((n) => toolMatches(r.tool, n))) continue;
+      if (r.pathGlob) {
+        const path = typeof call.args?.path === "string" ? call.args.path : null;
+        const cmd = typeof call.args?.command === "string" ? call.args.command : null;
+        if (path != null) {
+          if (!globToRegExp(r.pathGlob).test(path.startsWith("/") ? path : `/${path}`)) continue;
+        } else if (cmd != null) {
+          if (!commandMatches(r.pathGlob, cmd)) continue;
+        } else continue;
+      }
+      return r.decision;
+    }
+    return this.options.default;
+  }
+  /** The policy's `deny` rules as rule strings (`Tool` / `Tool(glob)`) — for delegated runtimes that run
+   *  their OWN tools (claude-code/cursor) and never pass through {@link hooks}. */
+  denyRules(explicitOnly = false) {
+    return this.options.rules.filter((r) => r.decision === "deny" && (!explicitOnly || r.explicit)).map((r) => `${r.tool ?? "*"}${r.pathGlob ? `(${r.pathGlob})` : ""}`);
+  }
+  /** A preToolUse hook enforcing this policy (deny/ask → block; allow → proceed). */
+  hooks() {
+    return {
+      preToolUse: async (call) => {
+        const d = this.decide(call);
+        if (d === "allow") return;
+        if (d === "deny") return { block: true, reason: `denied by permission policy (${call.name})` };
+        if (this.options.ask) {
+          const r = await this.options.ask(call);
+          const decision = r?.decision ?? "deny";
+          const rememberTool2 = call.name === "McpCall" && typeof call.args?.name === "string" ? call.args.name : call.name;
+          if (r?.remember) this.options.rules.unshift({ tool: rememberTool2, decision });
+          return decision === "allow" ? void 0 : { block: true, reason: `not approved (${call.name})` };
+        }
+        const ok = await this.options.host?.confirm?.(`Allow ${call.name}${call.args?.path ? " on " + call.args.path : ""}?`);
+        return ok ? void 0 : { block: true, reason: `not approved (${call.name})` };
+      }
+    };
+  }
+};
+var CC_TOOL_ALIAS = { Shell: "Bash", bash: "Bash" };
+function claudeCodeDisallowedTools(policy) {
+  const out = /* @__PURE__ */ new Set();
+  for (const rule of policy?.denyRules() ?? []) {
+    const m = /^([^(]+)(\(.*\))?$/.exec(rule);
+    if (m[1] === "*") throw new Error("permission policy denies every tool (`*`) \u2014 claude-code cannot express that; refusing to run.");
+    out.add((CC_TOOL_ALIAS[m[1]] ?? m[1]) + (m[2] ?? ""));
+  }
+  return [...out];
+}
+var DEFAULT_MUTATING = ["Write", "Edit", "MultiEdit", "deleteFile", "bash"];
+function planMode(opts) {
+  const mutating = new Set(opts?.mutating ?? DEFAULT_MUTATING);
+  let approved = false;
+  const tool = {
+    name: "ExitPlanMode",
+    description: "Call when your plan is ready and you want to start making changes. Provide the `plan`. Until this is approved, edits/writes are blocked.",
+    parameters: { type: "object", required: ["plan"], properties: { plan: { type: "string", description: "the concrete steps you will take" } } },
+    async run({ plan }, _ctx) {
+      if (opts?.host?.confirm) {
+        const confirm = opts.host.confirm(`Approve this plan?
+
+${String(plan ?? "")}`);
+        const ok = await (_ctx?.parkHuman ? _ctx.parkHuman(confirm) : confirm);
+        if (!ok) return "Plan not approved. Revise it and call ExitPlanMode again.";
+      }
+      approved = true;
+      return "Plan approved \u2014 you may now make changes.";
+    }
+  };
+  const hooks = {
+    preToolUse: (call) => !approved && mutating.has(call.name) ? { block: true, reason: "plan mode: present a plan and call ExitPlanMode (approved) before editing." } : void 0
+  };
+  return { hooks, tool };
+}
+function composeHooks(...list) {
+  const hooks = list.filter(Boolean);
+  return {
+    async preToolUse(call, meta) {
+      for (const h of hooks) {
+        const d = await h.preToolUse?.(call, meta);
+        if (d?.block) return d;
+      }
+    },
+    async postToolUse(call, result, meta) {
+      for (const h of hooks) await h.postToolUse?.(call, result, meta);
+    },
+    onToolOutput(call, chunk, meta) {
+      for (const h of hooks) h.onToolOutput?.(call, chunk, meta);
+    },
+    onStop(text) {
+      for (const h of hooks) h.onStop?.(text);
+    },
+    // lifecycle: concatenate session-start context; chain prompt-submit transforms; fan out pre-compact.
+    async onSessionStart() {
+      let ctx = "";
+      for (const h of hooks) {
+        const r = await h.onSessionStart?.();
+        if (r) ctx += (ctx ? "\n\n" : "") + r;
+      }
+      return ctx || void 0;
+    },
+    async onUserPromptSubmit(text) {
+      let t = text;
+      for (const h of hooks) {
+        const r = await h.onUserPromptSubmit?.(t);
+        if (typeof r === "string") t = r;
+      }
+      return t;
+    },
+    async onPreCompact(messages) {
+      for (const h of hooks) await h.onPreCompact?.(messages);
+    },
+    async onSubagentStop(summary, info) {
+      for (const h of hooks) await h.onSubagentStop?.(summary, info);
+    }
+  };
+}
+
 // src/subagent.ts
 init_OverlayFilesystem();
 
@@ -3729,6 +3872,8 @@ function childOptionsFor(opts, fs, depth, maxDepth, agentType, model, root) {
   }
   const po = opts.providerOptionsFor?.(childModel);
   if (po) childOpts.providerOptions = po;
+  const deny = opts.permissions?.options.rules.filter((r) => r.decision === "deny") ?? [];
+  if (deny.length) childOpts.permissions = new PermissionPolicy({ rules: deny, default: "allow" });
   if (opts.hooks?.preToolUse) childOpts.hooks = { preToolUse: opts.hooks.preToolUse.bind(opts.hooks) };
   return childOpts;
 }
@@ -3948,133 +4093,6 @@ async function loadAgents(fs, dir) {
 
 // src/Agent.ts
 init_OverlayFilesystem();
-
-// src/permissions.ts
-init_tools_structured();
-function commandMatches(glob, cmd) {
-  const pattern = glob.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
-  return new RegExp("^" + pattern + "$").test(cmd);
-}
-var PermissionOptions = class {
-  rules = [];
-  /** decision when no rule matches. */
-  default = "allow";
-  /** host channel for `ask` (confirm). If absent, `ask` is treated as `deny` (fail-closed). */
-  host;
-};
-var PermissionPolicy = class {
-  options;
-  constructor(options) {
-    this.options = { ...new PermissionOptions(), ...options };
-  }
-  /** Resolve the decision for a tool call (first matching rule, else default). */
-  decide(call) {
-    const names = call.name === "McpCall" && typeof call.args?.name === "string" ? [call.name, call.args.name] : [call.name];
-    for (const r of this.options.rules) {
-      if (r.tool && !names.includes(r.tool)) continue;
-      if (r.pathGlob) {
-        const path = typeof call.args?.path === "string" ? call.args.path : null;
-        const cmd = typeof call.args?.command === "string" ? call.args.command : null;
-        if (path != null) {
-          if (!globToRegExp(r.pathGlob).test(path.startsWith("/") ? path : `/${path}`)) continue;
-        } else if (cmd != null) {
-          if (!commandMatches(r.pathGlob, cmd)) continue;
-        } else continue;
-      }
-      return r.decision;
-    }
-    return this.options.default;
-  }
-  /** A preToolUse hook enforcing this policy (deny/ask → block; allow → proceed). */
-  hooks() {
-    return {
-      preToolUse: async (call) => {
-        const d = this.decide(call);
-        if (d === "allow") return;
-        if (d === "deny") return { block: true, reason: `denied by permission policy (${call.name})` };
-        if (this.options.ask) {
-          const r = await this.options.ask(call);
-          const decision = r?.decision ?? "deny";
-          const rememberTool2 = call.name === "McpCall" && typeof call.args?.name === "string" ? call.args.name : call.name;
-          if (r?.remember) this.options.rules.unshift({ tool: rememberTool2, decision });
-          return decision === "allow" ? void 0 : { block: true, reason: `not approved (${call.name})` };
-        }
-        const ok = await this.options.host?.confirm?.(`Allow ${call.name}${call.args?.path ? " on " + call.args.path : ""}?`);
-        return ok ? void 0 : { block: true, reason: `not approved (${call.name})` };
-      }
-    };
-  }
-};
-var DEFAULT_MUTATING = ["Write", "Edit", "MultiEdit", "deleteFile", "bash"];
-function planMode(opts) {
-  const mutating = new Set(opts?.mutating ?? DEFAULT_MUTATING);
-  let approved = false;
-  const tool = {
-    name: "ExitPlanMode",
-    description: "Call when your plan is ready and you want to start making changes. Provide the `plan`. Until this is approved, edits/writes are blocked.",
-    parameters: { type: "object", required: ["plan"], properties: { plan: { type: "string", description: "the concrete steps you will take" } } },
-    async run({ plan }, _ctx) {
-      if (opts?.host?.confirm) {
-        const confirm = opts.host.confirm(`Approve this plan?
-
-${String(plan ?? "")}`);
-        const ok = await (_ctx?.parkHuman ? _ctx.parkHuman(confirm) : confirm);
-        if (!ok) return "Plan not approved. Revise it and call ExitPlanMode again.";
-      }
-      approved = true;
-      return "Plan approved \u2014 you may now make changes.";
-    }
-  };
-  const hooks = {
-    preToolUse: (call) => !approved && mutating.has(call.name) ? { block: true, reason: "plan mode: present a plan and call ExitPlanMode (approved) before editing." } : void 0
-  };
-  return { hooks, tool };
-}
-function composeHooks(...list) {
-  const hooks = list.filter(Boolean);
-  return {
-    async preToolUse(call, meta) {
-      for (const h of hooks) {
-        const d = await h.preToolUse?.(call, meta);
-        if (d?.block) return d;
-      }
-    },
-    async postToolUse(call, result, meta) {
-      for (const h of hooks) await h.postToolUse?.(call, result, meta);
-    },
-    onToolOutput(call, chunk, meta) {
-      for (const h of hooks) h.onToolOutput?.(call, chunk, meta);
-    },
-    onStop(text) {
-      for (const h of hooks) h.onStop?.(text);
-    },
-    // lifecycle: concatenate session-start context; chain prompt-submit transforms; fan out pre-compact.
-    async onSessionStart() {
-      let ctx = "";
-      for (const h of hooks) {
-        const r = await h.onSessionStart?.();
-        if (r) ctx += (ctx ? "\n\n" : "") + r;
-      }
-      return ctx || void 0;
-    },
-    async onUserPromptSubmit(text) {
-      let t = text;
-      for (const h of hooks) {
-        const r = await h.onUserPromptSubmit?.(t);
-        if (typeof r === "string") t = r;
-      }
-      return t;
-    },
-    async onPreCompact(messages) {
-      for (const h of hooks) await h.onPreCompact?.(messages);
-    },
-    async onSubagentStop(summary, info) {
-      for (const h of hooks) await h.onSubagentStop?.(summary, info);
-    }
-  };
-}
-
-// src/Agent.ts
 init_logging();
 
 // src/lint.ts
@@ -4594,6 +4612,8 @@ var Agent = class _Agent {
         agents,
         hooks: o.hooks,
         traceDir: o.traceDir,
+        permissions: o.permissions,
+        // a child obeys the parent's allow/deny rules (else Task is a one-call bypass)
         tools: [...o.tools, ...this.injectedTools],
         systemPrompt: o.systemPrompt,
         providerOptionsFor: o.providerOptionsFor ?? ((m) => modelProvider(m) === modelProvider(o.model) ? o.providerOptions : void 0)
@@ -4766,6 +4786,14 @@ var Agent = class _Agent {
         }
       } : void 0;
       const claudeSteerPo = o.model.startsWith("claude-code/") ? { steer: () => this.drainPendingSteers() } : void 0;
+      const denyTools = o.model.startsWith("claude-code/") ? claudeCodeDisallowedTools(o.permissions) : [];
+      if (denyTools.length) {
+        const prior = o.providerOptions?.disallowedTools ?? [];
+        claudeSteerPo.disallowedTools = [.../* @__PURE__ */ new Set([...prior, ...denyTools])];
+      }
+      const cursorDeny = o.model.startsWith("cursor/") ? o.permissions?.denyRules(true) ?? [] : [];
+      if (cursorDeny.length)
+        throw new Error(`cursor/* cannot enforce --disallowedTools (${cursorDeny.join(", ")}): its native tools bypass them. Refusing to run \u2014 use a claude-code/* or API model, or drop --disallowedTools.`);
       const reasonOpts = {
         ...frag,
         ...o.promptCache ? { promptCache: true } : {},
@@ -4882,6 +4910,9 @@ var Agent = class _Agent {
         this.transcript.push({
           role: "assistant",
           content: res.content ?? "",
+          // Record the model the adapter actually ran: aliases (`claude-code/opus`) resolve to a concrete
+          // id (e.g. `claude-opus-5-5`); fall back to the requested model if the adapter didn't report one.
+          model: res.model ?? o.model,
           ...toolCalls.length ? { tool_calls: toolCalls } : {},
           ...res.reasoningContent && passesBackReasoning(o.model) ? { reasoning_content: res.reasoningContent } : {}
         });
@@ -5044,7 +5075,9 @@ var Agent = class _Agent {
     let sawTool = false;
     let trailing = "";
     let reasoning = "";
+    let resolvedModel;
     for await (const chunk of stream) {
+      if (chunk.model) resolvedModel = chunk.model;
       poke?.();
       if (this.options.signal?.aborted) break;
       if (chunk.reasoningContent) {
@@ -5093,7 +5126,7 @@ var Agent = class _Agent {
     }
     const delegatedTools = delegatedOrder.map((k) => delegated.get(k));
     const endedWithoutClosing = sawTool && (!trailing.trim() || endsOnAnnouncedAction(trailing));
-    return { content, ...reasoning ? { reasoningContent: reasoning } : {}, ...finishReason ? { finishReason } : {}, ...toolCalls ? { toolCalls } : {}, ...usage ? { usage } : {}, ...delegatedTools.length ? { delegatedTools } : {}, ...endedWithoutClosing ? { endedWithoutClosing: true } : {} };
+    return { content, ...resolvedModel ? { model: resolvedModel } : {}, ...reasoning ? { reasoningContent: reasoning } : {}, ...finishReason ? { finishReason } : {}, ...toolCalls ? { toolCalls } : {}, ...usage ? { usage } : {}, ...delegatedTools.length ? { delegatedTools } : {}, ...endedWithoutClosing ? { endedWithoutClosing: true } : {} };
   }
   /**
    * FABRICATED TOOL USE — the failure no call-reactive layer can see, because there IS no call.
@@ -11008,6 +11041,7 @@ export {
   buildMcpCatalog,
   checkpointTool,
   checkpointTools,
+  claudeCodeDisallowedTools,
   cleanupWorktree,
   clearImageRefs,
   compileSynthesizedTool,