@mono-agent/agent-runtime 0.5.1 → 0.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mono-agent/agent-runtime",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "description": "Agent runtime supporting Claude SDK, Claude CLI, Codex CLI, and PI SDK out of the box",
   "type": "module",
   "license": "GPL-3.0-only",

package/src/agent/tools/pi-bridge.js

@@ -309,7 +309,7 @@ function createBuiltinTool(name, label, description, parameters, execute, { cwd,
 }
 
 /**
- * Progressive skill disclosure: exposes a `read_skill` tool so the agent can pull
+ * Progressive skill disclosure: exposes a `ReadSkill` tool so the agent can pull
  * a named skill's FULL body on demand (skills are otherwise injected index-only).
  *
  * Two input shapes are accepted, matching what hosts pass:
@@ -318,7 +318,7 @@ function createBuiltinTool(name, label, description, parameters, execute, { cwd,
  *    back-compat `dataDir` (skills under `<dataDir>/skills`). This path is UNCHANGED.
  *  - pi's neutral `Skill` shape (`{name, description, content, filePath, ...}`,
  *    what worklab passes): each skill carries an absolute `filePath`. When NO shared
- *    `skillsRoot`/`dataDir` is configured, read_skill derives each skill's root from
+ *    `skillsRoot`/`dataDir` is configured, ReadSkill derives each skill's root from
  *    its own `filePath` — pi has no lazy-body equivalent, so the body is still read
  *    from disk on demand rather than injected up front.
  *
@@ -361,7 +361,7 @@ function readSkillTool(skillNames = [], { skillsRoot, dataDir, skills = [] } = {
   if (!enumNames.length) return null;
 
   return {
-    name: "read_skill",
+    name: "ReadSkill",
     label: "Read Skill",
     description: "Load the full instructions for a named skill.",
     parameters: objectSchema({ name: { type: "string", enum: enumNames } }, ["name"]),
@@ -408,9 +408,10 @@ export function createStructuredOutputTool(outputSchema, onStructuredOutput) {
 
 /**
  * @param {any} allowedTools
- * @param {{skillNames?: any[], skills?: any[], skillsRoot?: any, dataDir?: any, cwd?: any, onEvent?: (event: any) => void, toolLimits?: any, persistArtifact?: any, onTruncate?: any, toolPayloadMaxBytes?: number, imageInlineMaxBytes?: any, toolPolicy?: any, sandboxPolicy?: any, sandboxEngine?: any, approvalManager?: any, approvalModel?: any, ctx?: any}} [options]
+ * @param {{disallowedTools?: any[], skillNames?: any[], skills?: any[], skillsRoot?: any, dataDir?: any, cwd?: any, onEvent?: (event: any) => void, toolLimits?: any, persistArtifact?: any, onTruncate?: any, toolPayloadMaxBytes?: number, imageInlineMaxBytes?: any, toolPolicy?: any, sandboxPolicy?: any, sandboxEngine?: any, approvalManager?: any, approvalModel?: any, ctx?: any}} [options]
  */
 export function getPiBuiltinTools(allowedTools, {
+  disallowedTools = [],
   skillNames = [],
   skills = [],
   skillsRoot,
@@ -495,10 +496,17 @@ export function getPiBuiltinTools(allowedTools, {
       limit: { type: "integer" },
     }, ["query"]), webSearchToolImpl, toolContext),
   };
-  const names = Array.isArray(allowedTools) ? allowedTools : Object.keys(all);
+  // allowedTools honors the `"*"` allow-all sentinel (and undefined) as "every
+  // built-in"; disallowedTools is the deny-wins filter applied to the final set.
+  const allowAll = !Array.isArray(allowedTools) || allowedTools.includes("*");
+  const selected = allowAll ? Object.keys(all) : allowedTools;
+  const denied = new Set(Array.isArray(disallowedTools) ? disallowedTools : []);
+  const names = selected.filter((name) => !denied.has(name));
   const tools = names.map((name) => all[name]).filter(Boolean);
   const skillTool = readSkillTool(skillNames, { skillsRoot, dataDir, skills });
-  if (skillTool) tools.push(skillTool);
+  // Deny-check the canonical PascalCase name AND the legacy snake_case alias so
+  // an old denylist keeps disabling the tool after the rename.
+  if (skillTool && !denied.has("ReadSkill") && !denied.has("read_skill" /* legacy alias */)) tools.push(skillTool);
   const gated = approvalManager
     ? wrapToolsWithApprovalGate(tools, approvalManager, { model: approvalModel })
     : tools;

package/src/ai/providers/claude-cli.js

@@ -13,7 +13,7 @@ import { readRuntimeBrand } from "../../agent/tools/shared/runtime-context.js";
 import { buildCapabilitiesUsed } from "../runtime/capabilities-used.js";
 import {
   claudeNativeAgentDefinitions,
-  claudeToolsWithNativeSubagents,
+  resolveClaudeAllowedTools,
 } from "./claude-subagents.js";
 
 const DORMANT_CLI_CAPABILITIES = {
@@ -377,7 +377,10 @@ export function buildCliCommand({
   const normalizedEffort = typeof effort === "string" && effort.trim() ? effort : null;
   if (sdk === "claude-code") {
     const nativeAgents = claudeNativeAgentDefinitions(nativeSubagents);
-    const cliAllowedTools = claudeToolsWithNativeSubagents(allowedTools, nativeSubagents);
+    // `"*"` allow-all → defer to Claude Code's full default toolset (omit
+    // --tools); `cliAllowedTools` is the "*"-stripped explicit list so a bare
+    // "*" never reaches a flag value.
+    const { allowAll: cliAllowAll, tools: cliAllowedTools } = resolveClaudeAllowedTools(allowedTools, nativeSubagents);
     // intelligence-ramp Phase 5.1: when the coordinator hands us a parent
     // session id (recovery continuation, R12), pass --resume so the host
     // CLI can keep its own conversation cache warm. Otherwise stay
@@ -402,7 +405,7 @@ export function buildCliCommand({
       args.push("--add-dir", ...skillDirs);
     }
     if (nativeAgents) args.push("--agents", JSON.stringify(nativeAgents));
-    if (Array.isArray(cliAllowedTools) && cliAllowedTools.length) {
+    if (!cliAllowAll && Array.isArray(cliAllowedTools) && cliAllowedTools.length) {
       args.push("--tools", cliAllowedTools.join(","));
     }
     const autoAllowed = [

package/src/ai/providers/claude-sdk.js

@@ -20,7 +20,7 @@ import { readRuntimeBrand } from "../../agent/tools/shared/runtime-context.js";
 import { createApprovalManager } from "../../agent/approval.js";
 import {
   claudeNativeAgentDefinitions,
-  claudeToolsWithNativeSubagents,
+  resolveClaudeAllowedTools,
 } from "./claude-subagents.js";
 
 function thinkingForEffort(effort) {
@@ -588,6 +588,10 @@ export async function generateClaudeResponse(systemPrompt, options) {
     ? "default"
     : permissionMode;
   const nativeAgents = claudeNativeAgentDefinitions(options.nativeSubagents);
+  // `"*"` allow-all → pass `allowedTools: undefined` so the SDK uses its default
+  // toolset (every tool, incl. Task — not double-added). disallowedTools still
+  // flows through, so deny-wins holds under allow-all.
+  const { allowAll: allowAllTools, tools: resolvedAllowedTools } = resolveClaudeAllowedTools(allowedTools, options.nativeSubagents);
   // Assembled incrementally, then handed across the SDK `query` boundary
   // (outputFormat/resume/maxTurns are attached conditionally below).
   /** @type {any} */
@@ -597,7 +601,7 @@ export async function generateClaudeResponse(systemPrompt, options) {
     cwd,
     permissionMode: effectivePermissionMode,
     ...(effectivePermissionMode === "bypassPermissions" ? { allowDangerouslySkipPermissions: true } : {}),
-    allowedTools: claudeToolsWithNativeSubagents(allowedTools, options.nativeSubagents),
+    allowedTools: allowAllTools ? undefined : resolvedAllowedTools,
     disallowedTools,
     mcpServers,
     ...(approvalManager ? { canUseTool: createClaudeCanUseTool(approvalManager, model.model) } : {}),

package/src/ai/providers/claude-subagents.js

@@ -65,3 +65,24 @@ export function claudeToolsWithNativeSubagents(allowedTools, nativeSubagents) {
     ? withTaskTool(allowedTools)
     : allowedTools;
 }
+
+/**
+ * Resolve the effective allowed-tools list for the Claude bridges, honoring the
+ * `"*"` allow-all sentinel. Returns `{ allowAll, tools }` where `tools` is the
+ * native-subagent-composed list with any bare `"*"` stripped, so a literal `"*"`
+ * never reaches a CLI flag value or the SDK `query()`. When `allowAll` is true
+ * the caller MUST defer to Claude's default toolset (omit `--tools` / pass
+ * `allowedTools: undefined`) rather than pass `tools` as the tool set — the
+ * default already carries every tool, incl. `Task`, so it is not double-added.
+ * @param {any} allowedTools
+ * @param {any} nativeSubagents
+ * @returns {{allowAll: boolean, tools: any}}
+ */
+export function resolveClaudeAllowedTools(allowedTools, nativeSubagents) {
+  const composed = claudeToolsWithNativeSubagents(allowedTools, nativeSubagents);
+  const allowAll = Array.isArray(composed) && composed.includes("*");
+  const tools = Array.isArray(composed)
+    ? composed.filter((tool) => tool !== "*")
+    : composed;
+  return { allowAll, tools };
+}

package/src/ai/providers/codex-app.js

@@ -116,8 +116,7 @@ function sandboxForPermissionMode(permissionMode) {
 
 function approvalPolicyForPermissionMode(permissionMode) {
   if (permissionMode === "bypassPermissions") return "never";
-  if (permissionMode === "plan") return "on-request";
-  return "on-failure";
+  return "on-request";
 }
 
 function codexMcpConfig(mcpServers = {}) {

package/src/ai/providers/pi-native/turn-runner.js

@@ -72,13 +72,15 @@ export async function buildTurnTools(runState, {
   const builtIns = capabilities.tool_use === false
     ? []
     : getPiBuiltinTools(options.allowedTools, /** @type {any} */ ({
+      // deny-wins filter applied over the built-ins + ReadSkill inside pi-bridge.
+      disallowedTools: options.disallowedTools,
       skillNames: (options.skills || []).map((/** @type {{name: string}} */ skill) => skill.name),
-      // Full skill objects so read_skill can honor pi's neutral Skill shape
+      // Full skill objects so ReadSkill can honor pi's neutral Skill shape
       // ({name, filePath, ...}) and derive each skill's root from its own
       // filePath when no shared skillsRoot is threaded.
       skills: options.skills || [],
       // Progressive skill disclosure: when the harness threads the skills root
-      // (the directory holding `<name>/SKILL.md`) the read_skill tool resolves
+      // (the directory holding `<name>/SKILL.md`) the ReadSkill tool resolves
       // bodies directly from there. `dataDir` (skills under `<dataDir>/skills`)
       // remains the back-compat fallback; a per-skill filePath is the third path.
       skillsRoot: options.skillsRoot,

package/types/agent/tools/pi-bridge.d.ts

@@ -35,9 +35,10 @@ export function createStructuredOutputTool(outputSchema: any, onStructuredOutput
 };
 /**
  * @param {any} allowedTools
- * @param {{skillNames?: any[], skills?: any[], skillsRoot?: any, dataDir?: any, cwd?: any, onEvent?: (event: any) => void, toolLimits?: any, persistArtifact?: any, onTruncate?: any, toolPayloadMaxBytes?: number, imageInlineMaxBytes?: any, toolPolicy?: any, sandboxPolicy?: any, sandboxEngine?: any, approvalManager?: any, approvalModel?: any, ctx?: any}} [options]
+ * @param {{disallowedTools?: any[], skillNames?: any[], skills?: any[], skillsRoot?: any, dataDir?: any, cwd?: any, onEvent?: (event: any) => void, toolLimits?: any, persistArtifact?: any, onTruncate?: any, toolPayloadMaxBytes?: number, imageInlineMaxBytes?: any, toolPolicy?: any, sandboxPolicy?: any, sandboxEngine?: any, approvalManager?: any, approvalModel?: any, ctx?: any}} [options]
  */
-export function getPiBuiltinTools(allowedTools: any, { skillNames, skills, skillsRoot, dataDir, cwd, onEvent, toolLimits, persistArtifact, onTruncate, toolPayloadMaxBytes, imageInlineMaxBytes, toolPolicy, sandboxPolicy, sandboxEngine, approvalManager, approvalModel, ctx, }?: {
+export function getPiBuiltinTools(allowedTools: any, { disallowedTools, skillNames, skills, skillsRoot, dataDir, cwd, onEvent, toolLimits, persistArtifact, onTruncate, toolPayloadMaxBytes, imageInlineMaxBytes, toolPolicy, sandboxPolicy, sandboxEngine, approvalManager, approvalModel, ctx, }?: {
+    disallowedTools?: any[];
     skillNames?: any[];
     skills?: any[];
     skillsRoot?: any;

package/types/ai/providers/claude-subagents.d.ts

@@ -1,2 +1,18 @@
 export function claudeNativeAgentDefinitions(nativeSubagents: any): {};
 export function claudeToolsWithNativeSubagents(allowedTools: any, nativeSubagents: any): any;
+/**
+ * Resolve the effective allowed-tools list for the Claude bridges, honoring the
+ * `"*"` allow-all sentinel. Returns `{ allowAll, tools }` where `tools` is the
+ * native-subagent-composed list with any bare `"*"` stripped, so a literal `"*"`
+ * never reaches a CLI flag value or the SDK `query()`. When `allowAll` is true
+ * the caller MUST defer to Claude's default toolset (omit `--tools` / pass
+ * `allowedTools: undefined`) rather than pass `tools` as the tool set — the
+ * default already carries every tool, incl. `Task`, so it is not double-added.
+ * @param {any} allowedTools
+ * @param {any} nativeSubagents
+ * @returns {{allowAll: boolean, tools: any}}
+ */
+export function resolveClaudeAllowedTools(allowedTools: any, nativeSubagents: any): {
+    allowAll: boolean;
+    tools: any;
+};