@livx.cc/agentx 0.99.64 → 0.99.66

package/dist/index.js

@@ -3422,6 +3422,149 @@ function resolveModelSwitch(opts) {
   };
 }
 
+// src/permissions.ts
+init_tools_structured();
+function commandMatches(glob, cmd) {
+  const pattern = glob.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp("^" + pattern + "$").test(cmd);
+}
+function toolMatches(rule, name) {
+  return rule.includes("*") ? commandMatches(rule, name) : rule === name;
+}
+var PermissionOptions = class {
+  rules = [];
+  /** decision when no rule matches. */
+  default = "allow";
+  /** host channel for `ask` (confirm). If absent, `ask` is treated as `deny` (fail-closed). */
+  host;
+};
+var PermissionPolicy = class {
+  options;
+  constructor(options) {
+    this.options = { ...new PermissionOptions(), ...options };
+  }
+  /** Resolve the decision for a tool call (first matching rule, else default). */
+  decide(call) {
+    const names = call.name === "McpCall" && typeof call.args?.name === "string" ? [call.name, call.args.name] : [call.name];
+    for (const r of this.options.rules) {
+      if (r.tool && !names.some((n) => toolMatches(r.tool, n))) continue;
+      if (r.pathGlob) {
+        const path = typeof call.args?.path === "string" ? call.args.path : null;
+        const cmd = typeof call.args?.command === "string" ? call.args.command : null;
+        if (path != null) {
+          if (!globToRegExp(r.pathGlob).test(path.startsWith("/") ? path : `/${path}`)) continue;
+        } else if (cmd != null) {
+          if (!commandMatches(r.pathGlob, cmd)) continue;
+        } else continue;
+      }
+      return r.decision;
+    }
+    return this.options.default;
+  }
+  /** The policy's `deny` rules as rule strings (`Tool` / `Tool(glob)`) — for delegated runtimes that run
+   *  their OWN tools (claude-code/cursor) and never pass through {@link hooks}. */
+  denyRules(explicitOnly = false) {
+    return this.options.rules.filter((r) => r.decision === "deny" && (!explicitOnly || r.explicit)).map((r) => `${r.tool ?? "*"}${r.pathGlob ? `(${r.pathGlob})` : ""}`);
+  }
+  /** A preToolUse hook enforcing this policy (deny/ask → block; allow → proceed). */
+  hooks() {
+    return {
+      preToolUse: async (call) => {
+        const d = this.decide(call);
+        if (d === "allow") return;
+        if (d === "deny") return { block: true, reason: `denied by permission policy (${call.name})` };
+        if (this.options.ask) {
+          const r = await this.options.ask(call);
+          const decision = r?.decision ?? "deny";
+          const rememberTool2 = call.name === "McpCall" && typeof call.args?.name === "string" ? call.args.name : call.name;
+          if (r?.remember) this.options.rules.unshift({ tool: rememberTool2, decision });
+          return decision === "allow" ? void 0 : { block: true, reason: `not approved (${call.name})` };
+        }
+        const ok = await this.options.host?.confirm?.(`Allow ${call.name}${call.args?.path ? " on " + call.args.path : ""}?`);
+        return ok ? void 0 : { block: true, reason: `not approved (${call.name})` };
+      }
+    };
+  }
+};
+var CC_TOOL_ALIAS = { Shell: "Bash", bash: "Bash" };
+function claudeCodeDisallowedTools(policy) {
+  const out = /* @__PURE__ */ new Set();
+  for (const rule of policy?.denyRules() ?? []) {
+    const m = /^([^(]+)(\(.*\))?$/.exec(rule);
+    if (m[1] === "*") throw new Error("permission policy denies every tool (`*`) \u2014 claude-code cannot express that; refusing to run.");
+    out.add((CC_TOOL_ALIAS[m[1]] ?? m[1]) + (m[2] ?? ""));
+  }
+  return [...out];
+}
+var DEFAULT_MUTATING = ["Write", "Edit", "MultiEdit", "deleteFile", "bash"];
+function planMode(opts) {
+  const mutating = new Set(opts?.mutating ?? DEFAULT_MUTATING);
+  let approved = false;
+  const tool = {
+    name: "ExitPlanMode",
+    description: "Call when your plan is ready and you want to start making changes. Provide the `plan`. Until this is approved, edits/writes are blocked.",
+    parameters: { type: "object", required: ["plan"], properties: { plan: { type: "string", description: "the concrete steps you will take" } } },
+    async run({ plan }, _ctx) {
+      if (opts?.host?.confirm) {
+        const confirm = opts.host.confirm(`Approve this plan?
+
+${String(plan ?? "")}`);
+        const ok = await (_ctx?.parkHuman ? _ctx.parkHuman(confirm) : confirm);
+        if (!ok) return "Plan not approved. Revise it and call ExitPlanMode again.";
+      }
+      approved = true;
+      return "Plan approved \u2014 you may now make changes.";
+    }
+  };
+  const hooks = {
+    preToolUse: (call) => !approved && mutating.has(call.name) ? { block: true, reason: "plan mode: present a plan and call ExitPlanMode (approved) before editing." } : void 0
+  };
+  return { hooks, tool };
+}
+function composeHooks(...list) {
+  const hooks = list.filter(Boolean);
+  return {
+    async preToolUse(call, meta) {
+      for (const h of hooks) {
+        const d = await h.preToolUse?.(call, meta);
+        if (d?.block) return d;
+      }
+    },
+    async postToolUse(call, result, meta) {
+      for (const h of hooks) await h.postToolUse?.(call, result, meta);
+    },
+    onToolOutput(call, chunk, meta) {
+      for (const h of hooks) h.onToolOutput?.(call, chunk, meta);
+    },
+    onStop(text) {
+      for (const h of hooks) h.onStop?.(text);
+    },
+    // lifecycle: concatenate session-start context; chain prompt-submit transforms; fan out pre-compact.
+    async onSessionStart() {
+      let ctx = "";
+      for (const h of hooks) {
+        const r = await h.onSessionStart?.();
+        if (r) ctx += (ctx ? "\n\n" : "") + r;
+      }
+      return ctx || void 0;
+    },
+    async onUserPromptSubmit(text) {
+      let t = text;
+      for (const h of hooks) {
+        const r = await h.onUserPromptSubmit?.(t);
+        if (typeof r === "string") t = r;
+      }
+      return t;
+    },
+    async onPreCompact(messages) {
+      for (const h of hooks) await h.onPreCompact?.(messages);
+    },
+    async onSubagentStop(summary, info) {
+      for (const h of hooks) await h.onSubagentStop?.(summary, info);
+    }
+  };
+}
+
 // src/subagent.ts
 init_OverlayFilesystem();
 
@@ -3729,6 +3872,8 @@ function childOptionsFor(opts, fs, depth, maxDepth, agentType, model, root) {
   }
   const po = opts.providerOptionsFor?.(childModel);
   if (po) childOpts.providerOptions = po;
+  const deny = opts.permissions?.options.rules.filter((r) => r.decision === "deny") ?? [];
+  if (deny.length) childOpts.permissions = new PermissionPolicy({ rules: deny, default: "allow" });
   if (opts.hooks?.preToolUse) childOpts.hooks = { preToolUse: opts.hooks.preToolUse.bind(opts.hooks) };
   return childOpts;
 }
@@ -3948,133 +4093,6 @@ async function loadAgents(fs, dir) {
 
 // src/Agent.ts
 init_OverlayFilesystem();
-
-// src/permissions.ts
-init_tools_structured();
-function commandMatches(glob, cmd) {
-  const pattern = glob.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
-  return new RegExp("^" + pattern + "$").test(cmd);
-}
-var PermissionOptions = class {
-  rules = [];
-  /** decision when no rule matches. */
-  default = "allow";
-  /** host channel for `ask` (confirm). If absent, `ask` is treated as `deny` (fail-closed). */
-  host;
-};
-var PermissionPolicy = class {
-  options;
-  constructor(options) {
-    this.options = { ...new PermissionOptions(), ...options };
-  }
-  /** Resolve the decision for a tool call (first matching rule, else default). */
-  decide(call) {
-    const names = call.name === "McpCall" && typeof call.args?.name === "string" ? [call.name, call.args.name] : [call.name];
-    for (const r of this.options.rules) {
-      if (r.tool && !names.includes(r.tool)) continue;
-      if (r.pathGlob) {
-        const path = typeof call.args?.path === "string" ? call.args.path : null;
-        const cmd = typeof call.args?.command === "string" ? call.args.command : null;
-        if (path != null) {
-          if (!globToRegExp(r.pathGlob).test(path.startsWith("/") ? path : `/${path}`)) continue;
-        } else if (cmd != null) {
-          if (!commandMatches(r.pathGlob, cmd)) continue;
-        } else continue;
-      }
-      return r.decision;
-    }
-    return this.options.default;
-  }
-  /** A preToolUse hook enforcing this policy (deny/ask → block; allow → proceed). */
-  hooks() {
-    return {
-      preToolUse: async (call) => {
-        const d = this.decide(call);
-        if (d === "allow") return;
-        if (d === "deny") return { block: true, reason: `denied by permission policy (${call.name})` };
-        if (this.options.ask) {
-          const r = await this.options.ask(call);
-          const decision = r?.decision ?? "deny";
-          const rememberTool2 = call.name === "McpCall" && typeof call.args?.name === "string" ? call.args.name : call.name;
-          if (r?.remember) this.options.rules.unshift({ tool: rememberTool2, decision });
-          return decision === "allow" ? void 0 : { block: true, reason: `not approved (${call.name})` };
-        }
-        const ok = await this.options.host?.confirm?.(`Allow ${call.name}${call.args?.path ? " on " + call.args.path : ""}?`);
-        return ok ? void 0 : { block: true, reason: `not approved (${call.name})` };
-      }
-    };
-  }
-};
-var DEFAULT_MUTATING = ["Write", "Edit", "MultiEdit", "deleteFile", "bash"];
-function planMode(opts) {
-  const mutating = new Set(opts?.mutating ?? DEFAULT_MUTATING);
-  let approved = false;
-  const tool = {
-    name: "ExitPlanMode",
-    description: "Call when your plan is ready and you want to start making changes. Provide the `plan`. Until this is approved, edits/writes are blocked.",
-    parameters: { type: "object", required: ["plan"], properties: { plan: { type: "string", description: "the concrete steps you will take" } } },
-    async run({ plan }, _ctx) {
-      if (opts?.host?.confirm) {
-        const confirm = opts.host.confirm(`Approve this plan?
-
-${String(plan ?? "")}`);
-        const ok = await (_ctx?.parkHuman ? _ctx.parkHuman(confirm) : confirm);
-        if (!ok) return "Plan not approved. Revise it and call ExitPlanMode again.";
-      }
-      approved = true;
-      return "Plan approved \u2014 you may now make changes.";
-    }
-  };
-  const hooks = {
-    preToolUse: (call) => !approved && mutating.has(call.name) ? { block: true, reason: "plan mode: present a plan and call ExitPlanMode (approved) before editing." } : void 0
-  };
-  return { hooks, tool };
-}
-function composeHooks(...list) {
-  const hooks = list.filter(Boolean);
-  return {
-    async preToolUse(call, meta) {
-      for (const h of hooks) {
-        const d = await h.preToolUse?.(call, meta);
-        if (d?.block) return d;
-      }
-    },
-    async postToolUse(call, result, meta) {
-      for (const h of hooks) await h.postToolUse?.(call, result, meta);
-    },
-    onToolOutput(call, chunk, meta) {
-      for (const h of hooks) h.onToolOutput?.(call, chunk, meta);
-    },
-    onStop(text) {
-      for (const h of hooks) h.onStop?.(text);
-    },
-    // lifecycle: concatenate session-start context; chain prompt-submit transforms; fan out pre-compact.
-    async onSessionStart() {
-      let ctx = "";
-      for (const h of hooks) {
-        const r = await h.onSessionStart?.();
-        if (r) ctx += (ctx ? "\n\n" : "") + r;
-      }
-      return ctx || void 0;
-    },
-    async onUserPromptSubmit(text) {
-      let t = text;
-      for (const h of hooks) {
-        const r = await h.onUserPromptSubmit?.(t);
-        if (typeof r === "string") t = r;
-      }
-      return t;
-    },
-    async onPreCompact(messages) {
-      for (const h of hooks) await h.onPreCompact?.(messages);
-    },
-    async onSubagentStop(summary, info) {
-      for (const h of hooks) await h.onSubagentStop?.(summary, info);
-    }
-  };
-}
-
-// src/Agent.ts
 init_logging();
 
 // src/lint.ts
@@ -4594,6 +4612,8 @@ var Agent = class _Agent {
         agents,
         hooks: o.hooks,
         traceDir: o.traceDir,
+        permissions: o.permissions,
+        // a child obeys the parent's allow/deny rules (else Task is a one-call bypass)
         tools: [...o.tools, ...this.injectedTools],
         systemPrompt: o.systemPrompt,
         providerOptionsFor: o.providerOptionsFor ?? ((m) => modelProvider(m) === modelProvider(o.model) ? o.providerOptions : void 0)
@@ -4766,6 +4786,14 @@ var Agent = class _Agent {
         }
       } : void 0;
       const claudeSteerPo = o.model.startsWith("claude-code/") ? { steer: () => this.drainPendingSteers() } : void 0;
+      const denyTools = o.model.startsWith("claude-code/") ? claudeCodeDisallowedTools(o.permissions) : [];
+      if (denyTools.length) {
+        const prior = o.providerOptions?.disallowedTools ?? [];
+        claudeSteerPo.disallowedTools = [.../* @__PURE__ */ new Set([...prior, ...denyTools])];
+      }
+      const cursorDeny = o.model.startsWith("cursor/") ? o.permissions?.denyRules(true) ?? [] : [];
+      if (cursorDeny.length)
+        throw new Error(`cursor/* cannot enforce --disallowedTools (${cursorDeny.join(", ")}): its native tools bypass them. Refusing to run \u2014 use a claude-code/* or API model, or drop --disallowedTools.`);
       const reasonOpts = {
         ...frag,
         ...o.promptCache ? { promptCache: true } : {},
@@ -11013,6 +11041,7 @@ export {
   buildMcpCatalog,
   checkpointTool,
   checkpointTools,
+  claudeCodeDisallowedTools,
   cleanupWorktree,
   clearImageRefs,
   compileSynthesizedTool,