@pi-agents/orchid 0.1.0-beta.0

package/src/orchestrator/tool-allowlist-constants.ts

@@ -0,0 +1,37 @@
+/**
+ * Lightweight, import-free constants module for the worker tool allowlist.
+ *
+ * This module exists so that pure-data layers (`config-schema.ts`,
+ * `types.ts`) can reference the canonical `DEFAULT_WORKER_USER_TOOLS`
+ * literal without pulling `agent-host.ts`'s heavy `child_process` / `fs`
+ * imports into the schema/types graph (which would either be circular
+ * or pull subprocess plumbing into pure-data files).
+ *
+ * **Strict invariant:** this module MUST NOT have any imports beyond
+ * TypeScript built-ins. Anything more would re-introduce the very
+ * coupling this module exists to break.
+ *
+ * The companion `agent-host.ts` re-exports `DEFAULT_WORKER_USER_TOOLS`
+ * from this module for backward compatibility — existing internal
+ * imports (e.g., `execution.ts`, `worker-tools-allowlist.test.ts`)
+ * continue to work via the agent-host re-export. New code may import
+ * from either location; this module is the source of truth.
+ *
+ * `ENGINE_BRIDGE_TOOLS` and the `buildWorkerToolsAllowlist()` helper
+ * remain in `agent-host.ts` because that's where their consumers live
+ * and there is no duplication problem to solve for them.
+ *
+ * @module orchid/tool-allowlist-constants
+ * @since TP-189 (Cluster B)
+ */
+
+/**
+ * Default user-tools portion of the worker `--tools` allowlist. This is the
+ * fallback used when neither `taskRunner.worker.tools` config nor the
+ * `TASKPLANE_WORKER_TOOLS` env var supplies a value. Engine bridge tools
+ * (review_step, notify_supervisor, escalate_to_supervisor,
+ * request_segment_expansion) are appended on top by
+ * `buildWorkerToolsAllowlist()` at the spawn site — they are NOT part of
+ * this default and should not be added by callers.
+ */
+export const DEFAULT_WORKER_USER_TOOLS = "read,write,edit,bash,grep,find,ls";