@phnx-labs/agents-cli 1.20.64 → 1.20.65

package/dist/lib/versions.js

@@ -30,7 +30,7 @@ import { listResources } from './resources.js';
 import { VERSION_RE, compareVersions } from './agent-spec/primitives.js';
 import { AGENTS, agentConfigDirName, getAccountEmail, resolveAgentName, formatAgentError, findInPath, isSelfUpdatingAgent } from './agents.js';
 import { discoverPermissionGroups, getActivePermissionPresetName, readPermissionPresetRecipe, PERMISSION_PRESET_ENV_VAR } from './permissions.js';
-import { parseMcpServerConfig } from './mcp.js';
+import { parseMcpServerConfig, isProjectMcpTrusted } from './mcp.js';
 import { createVersionedAlias, removeVersionedAlias, getConfigSymlinkVersion, ensureClaudeInsideSymlink } from './shims.js';
 import { importInstallScriptBinary } from './import.js';
 import { IS_WINDOWS, composeWin32CommandLine } from './platform/index.js';
@@ -2511,20 +2511,23 @@ export function syncResourcesToVersion(agent, version, selection, options = {})
     // For Claude/Codex: uses CLI commands (claude mcp add, codex mcp add)
     // For others: edits config files directly
     //
-    // Mirror the hooks defense: exclude project-scoped MCPs from the sync. An
-    // MCP server is an executable invoked under the agent's authority, so a
-    // cloned public repo's .agents/mcp/foo.yaml could install an arbitrary
-    // command. We pre-compute the set of project-scoped names and drop them
-    // before handing the list to installMcpServers. (The deeper helper-side
-    // dedup in lib/mcp.ts still lets a project entry shadow a same-named
-    // user entry, so name-collision shadowing is not fully closed here —
-    // tracked separately for a follow-up in lib/mcp.ts.)
-    const projectScopedMcpNames = new Set(getScopedMcpResources(cwd).filter(r => r.scope === 'project').map(r => r.name));
+    // Mirror the hooks defense: an MCP server is an executable invoked under the
+    // agent's authority, so a cloned public repo's .agents/mcp/foo.yaml could
+    // install an arbitrary command (RUSH-1776). Project-scoped MCPs are UNTRUSTED
+    // by default — drop them before handing the list to installMcpServers unless
+    // the user has explicitly trusted this project (`agents mcp trust`). The
+    // register/spawn choke in lib/mcp.ts (getMcpServersByName) enforces the same
+    // trust gate and drops untrusted project entries before dedup, so a project
+    // entry can no longer shadow a same-named user entry either.
+    const projectMcpTrusted = projectAgentsDir ? isProjectMcpTrusted(projectAgentsDir) : false;
+    const untrustedProjectMcpNames = new Set(projectMcpTrusted
+        ? []
+        : getScopedMcpResources(cwd).filter(r => r.scope === 'project').map(r => r.name));
     const mcpWriter = getWriter('mcp', agent);
     const mcpToSyncAll = selection
         ? resolveSelection(selection.mcp, available.mcp)
         : (mcpWriter ? available.mcp : []);
-    const mcpToSync = mcpToSyncAll.filter(n => !projectScopedMcpNames.has(n));
+    const mcpToSync = mcpToSyncAll.filter(n => !untrustedProjectMcpNames.has(n));
     if (mcpToSync.length > 0 && mcpWriter) {
         const r = mcpWriter.write({ version, versionHome, selection: mcpToSync, cwd });
         result.mcp = r.synced;

package/dist/lib/workflows.d.ts

@@ -240,6 +240,26 @@ export declare function resolveAllowedSubagents(available: string[], allowedAgen
     allowedStems: string[];
     missing: string[];
 };
+/** The Claude tool an orchestrator uses to dispatch subagents. Must stay in a
+ *  workflow's `--tools` allowlist whenever the workflow ships dispatchable
+ *  subagents, or the orchestrator has no way to reach them. */
+export declare const SUBAGENT_DISPATCH_TOOL = "Task";
+/**
+ * Keep the subagent-dispatch tool (`Task`) in a `tools:`-restricted workflow's
+ * allowlist when the workflow actually ships subagents to dispatch.
+ *
+ * A WORKFLOW.md `tools:` list becomes Claude's `--tools` set, which *restricts*
+ * the available built-ins. An orchestrator whose `subagents/` files were just
+ * copied into the shared agents dir but whose `tools:` omits `Task` cannot
+ * reach any of them — it silently no-ops (observed: the run emits only "I'll
+ * wait for the completion notification" and exits). Omitting `Task` while
+ * shipping a `subagents/` dir is always an authoring miss, so we re-add it at
+ * the source rather than relying on every workflow author to remember.
+ *
+ * Returns `tools` unchanged when the workflow has no subagents or already lists
+ * `Task`; otherwise appends `Task`.
+ */
+export declare function ensureSubagentDispatchTool(tools: string[], hasSubagents: boolean): string[];
 /**
  * Prune stale workflow-managed subagent files from the shared per-agent agents
  * dir before a scoped run writes the permitted set (issue #401, follow-up to

package/dist/lib/workflows.js

@@ -278,6 +278,30 @@ export function resolveAllowedSubagents(available, allowedAgents) {
         missing: allowedAgents.filter(a => !present.has(a)),
     };
 }
+/** The Claude tool an orchestrator uses to dispatch subagents. Must stay in a
+ *  workflow's `--tools` allowlist whenever the workflow ships dispatchable
+ *  subagents, or the orchestrator has no way to reach them. */
+export const SUBAGENT_DISPATCH_TOOL = 'Task';
+/**
+ * Keep the subagent-dispatch tool (`Task`) in a `tools:`-restricted workflow's
+ * allowlist when the workflow actually ships subagents to dispatch.
+ *
+ * A WORKFLOW.md `tools:` list becomes Claude's `--tools` set, which *restricts*
+ * the available built-ins. An orchestrator whose `subagents/` files were just
+ * copied into the shared agents dir but whose `tools:` omits `Task` cannot
+ * reach any of them — it silently no-ops (observed: the run emits only "I'll
+ * wait for the completion notification" and exits). Omitting `Task` while
+ * shipping a `subagents/` dir is always an authoring miss, so we re-add it at
+ * the source rather than relying on every workflow author to remember.
+ *
+ * Returns `tools` unchanged when the workflow has no subagents or already lists
+ * `Task`; otherwise appends `Task`.
+ */
+export function ensureSubagentDispatchTool(tools, hasSubagents) {
+    if (!hasSubagents || tools.includes(SUBAGENT_DISPATCH_TOOL))
+        return tools;
+    return [...tools, SUBAGENT_DISPATCH_TOOL];
+}
 /**
  * Prune stale workflow-managed subagent files from the shared per-agent agents
  * dir before a scoped run writes the permitted set (issue #401, follow-up to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.64",
+  "version": "1.20.65",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -51,6 +51,7 @@
     "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh && scripts/verify-cli-binary.sh",
     "postinstall": "node scripts/postinstall.js",
     "dev": "tsx src/index.ts",
+    "changelog": "bun scripts/gen-changelog.ts",
     "start": "node dist/index.js",
     "test": "node ./node_modules/vitest/vitest.mjs run",
     "test:remote": "scripts/sandbox.sh 'bun install && bun run build && bun run test'",