@posthog/agent 2.3.388 → 2.3.398

package/dist/server/bin.cjs

@@ -8729,7 +8729,7 @@ var import_zod3 = require("zod");
 // package.json
 var package_default = {
   name: "@posthog/agent",
-  version: "2.3.388",
+  version: "2.3.398",
   repository: "https://github.com/PostHog/code",
   description: "TypeScript agent framework wrapping Claude Agent SDK with Git-based task execution for PostHog",
   exports: {
@@ -8781,6 +8781,10 @@ var package_default = {
       types: "./dist/adapters/reasoning-effort.d.ts",
       import: "./dist/adapters/reasoning-effort.js"
     },
+    "./adapters/claude/mcp/tool-metadata": {
+      types: "./dist/adapters/claude/mcp/tool-metadata.d.ts",
+      import: "./dist/adapters/claude/mcp/tool-metadata.js"
+    },
     "./execution-mode": {
       types: "./dist/execution-mode.d.ts",
       import: "./dist/execution-mode.js"
@@ -13776,10 +13780,12 @@ async function fetchMcpToolMetadata(q, logger = new Logger({ debug: false, prefi
       for (const tool of server.tools) {
         const toolKey = buildToolKey(server.name, tool.name);
         const readOnly = tool.annotations?.readOnly === true;
+        const existing = mcpToolMetadataCache.get(toolKey);
         mcpToolMetadataCache.set(toolKey, {
           readOnly,
           name: tool.name,
-          description: tool.description
+          description: tool.description,
+          approvalState: existing?.approvalState
         });
         if (readOnly) readOnlyCount++;
       }
@@ -13821,6 +13827,23 @@ function getConnectedMcpServerNames() {
   }
   return [...names];
 }
+function getMcpToolApprovalState(toolName) {
+  return mcpToolMetadataCache.get(toolName)?.approvalState;
+}
+function setMcpToolApprovalStates(approvals) {
+  for (const [toolKey, approvalState] of Object.entries(approvals)) {
+    const existing = mcpToolMetadataCache.get(toolKey);
+    if (existing) {
+      existing.approvalState = approvalState;
+    } else {
+      mcpToolMetadataCache.set(toolKey, {
+        readOnly: false,
+        name: toolKey,
+        approvalState
+      });
+    }
+  }
+}
 
 // src/adapters/claude/conversion/tool-use-to-acp.ts
 var SYSTEM_REMINDER_REGEX = /\s*<system-reminder>[\s\S]*?<\/system-reminder>/g;
@@ -15516,6 +15539,72 @@ async function handleDefaultPermissionFlow(context) {
     return { behavior: "deny", message, interrupt: !feedback };
   }
 }
+function parseMcpToolName(toolName) {
+  const parts2 = toolName.split("__");
+  return {
+    serverName: parts2[1] ?? toolName,
+    tool: parts2.slice(2).join("__") || toolName
+  };
+}
+async function handleMcpApprovalFlow(context) {
+  const { toolName, toolInput, toolUseID, client, sessionId } = context;
+  const { serverName, tool: displayTool } = parseMcpToolName(toolName);
+  const metadata2 = getMcpToolMetadata(toolName);
+  const description = metadata2?.description ? `
+
+${metadata2.description}` : "";
+  const response = await client.requestPermission({
+    options: [
+      { kind: "allow_once", name: "Yes", optionId: "allow" },
+      {
+        kind: "allow_always",
+        name: "Yes, always allow",
+        optionId: "allow_always"
+      },
+      {
+        kind: "reject_once",
+        name: "Type here to tell the agent what to do differently",
+        optionId: "reject",
+        _meta: { customInput: true }
+      }
+    ],
+    sessionId,
+    toolCall: {
+      toolCallId: toolUseID,
+      title: `The agent wants to call ${displayTool} (${serverName})`,
+      kind: "other",
+      content: description ? [{ type: "content", content: text(description) }] : [],
+      rawInput: { ...toolInput, toolName }
+    }
+  });
+  if (context.signal?.aborted || response.outcome?.outcome === "cancelled") {
+    throw new Error("Tool use aborted");
+  }
+  if (response.outcome?.outcome === "selected" && (response.outcome.optionId === "allow" || response.outcome.optionId === "allow_always")) {
+    if (response.outcome.optionId === "allow_always") {
+      return {
+        behavior: "allow",
+        updatedInput: toolInput,
+        updatedPermissions: [
+          {
+            type: "addRules",
+            rules: [{ toolName }],
+            behavior: "allow",
+            destination: "localSettings"
+          }
+        ]
+      };
+    }
+    return {
+      behavior: "allow",
+      updatedInput: toolInput
+    };
+  }
+  const feedback = response._meta?.customInput?.trim();
+  const message = feedback ? `User refused permission to run tool with feedback: ${feedback}` : "User refused permission to run tool";
+  await emitToolDenial(context, message);
+  return { behavior: "deny", message, interrupt: !feedback };
+}
 function handlePlanFileException(context) {
   const { session, toolName, toolInput } = context;
   if (session.permissionMode !== "plan" || !WRITE_TOOLS.has(toolName)) {
@@ -15586,6 +15675,17 @@ async function canUseTool(context) {
       }
     }
   }
+  if (toolName.startsWith("mcp__")) {
+    const approvalState = getMcpToolApprovalState(toolName);
+    if (approvalState === "do_not_use") {
+      const message = "This tool has been blocked. To re-enable it, go to Settings > MCP Servers in PostHog Code.";
+      await emitToolDenial(context, message);
+      return { behavior: "deny", message, interrupt: false };
+    }
+    if (approvalState === "needs_approval") {
+      return handleMcpApprovalFlow(context);
+    }
+  }
   if (isToolAllowedForMode(toolName, session.permissionMode)) {
     return {
       behavior: "allow",
@@ -15691,7 +15791,14 @@ Only enter plan mode (EnterPlanMode) when the user is requesting a significant c
 
 When in doubt, continue executing and incorporate the feedback inline.
 `;
-var APPENDED_INSTRUCTIONS = BRANCH_NAMING + PLAN_MODE;
+var MCP_TOOLS = `
+# MCP Tool Access
+
+If an MCP tool call is explicitly denied with a message, relay that denial message to the user exactly as given. Do NOT suggest checking "Claude Code settings."
+
+If an MCP tool call returns an error, treat it as a normal tool error \u2014 troubleshoot, retry, or inform the user about the specific error. Do NOT assume it is a permissions issue and do NOT direct the user to any settings page.
+`;
+var APPENDED_INSTRUCTIONS = BRANCH_NAMING + PLAN_MODE + MCP_TOOLS;
 
 // src/adapters/claude/session/options.ts
 function buildSystemPrompt(customPrompt) {
@@ -17020,6 +17127,9 @@ var ClaudeAcpAgent = class extends BaseAcpAgent {
     const earlyModelId = settingsManager.getSettings().model || meta?.model || "";
     const mcpServers = supportsMcpInjection(earlyModelId) ? parseMcpServers(params) : {};
     const systemPrompt = buildSystemPrompt(meta?.systemPrompt);
+    if (meta?.mcpToolApprovals) {
+      setMcpToolApprovalStates(meta.mcpToolApprovals);
+    }
     const outputFormat = meta?.jsonSchema && this.options?.onStructuredOutput ? { type: "json_schema", schema: meta.jsonSchema } : void 0;
     this.logger.debug(isResume ? "Resuming session" : "Creating new session", {
       sessionId,