@posthog/agent 2.3.74 → 2.3.80

package/dist/server/bin.cjs

@@ -904,7 +904,7 @@ var import_hono = require("hono");
 // package.json
 var package_default = {
   name: "@posthog/agent",
-  version: "2.3.74",
+  version: "2.3.80",
   repository: "https://github.com/PostHog/code",
   description: "TypeScript agent framework wrapping Claude Agent SDK with Git-based task execution for PostHog",
   exports: {
@@ -3376,8 +3376,37 @@ function handlePlanFileException(context) {
     updatedInput: toolInput
   };
 }
+function extractDomainFromUrl(url) {
+  try {
+    return new URL(url).hostname;
+  } catch {
+    return null;
+  }
+}
+function isDomainAllowed(hostname, allowedDomains) {
+  return allowedDomains.some((pattern) => {
+    if (pattern.startsWith("*.")) {
+      const suffix = pattern.slice(1);
+      return hostname === pattern.slice(2) || hostname.endsWith(suffix);
+    }
+    return hostname === pattern;
+  });
+}
 async function canUseTool(context) {
-  const { toolName, toolInput, session } = context;
+  const { toolName, toolInput, session, allowedDomains } = context;
+  if (allowedDomains && allowedDomains.length > 0) {
+    if (toolName === "WebFetch" || toolName === "WebSearch") {
+      const url = toolInput.url;
+      if (url) {
+        const hostname = extractDomainFromUrl(url);
+        if (hostname && !isDomainAllowed(hostname, allowedDomains)) {
+          const message = `Domain "${hostname}" is not in the allowed list: ${allowedDomains.join(", ")}`;
+          await emitToolDenial(context, message);
+          return { behavior: "deny", message, interrupt: false };
+        }
+      }
+    }
+  }
   if (isToolAllowedForMode(toolName, session.permissionMode)) {
     return {
       behavior: "allow",
@@ -4545,7 +4574,7 @@ var ClaudeAcpAgent = class extends BaseAcpAgent {
       cwd,
       mcpServers,
       permissionMode,
-      canUseTool: this.createCanUseTool(sessionId),
+      canUseTool: this.createCanUseTool(sessionId, meta?.allowedDomains),
       logger: this.logger,
       systemPrompt,
       userProvidedOptions: meta?.claudeCode?.options,
@@ -4675,7 +4704,7 @@ var ClaudeAcpAgent = class extends BaseAcpAgent {
     );
     return { sessionId, modes, models, configOptions };
   }
-  createCanUseTool(sessionId) {
+  createCanUseTool(sessionId, allowedDomains) {
     return async (toolName, toolInput, { suggestions, toolUseID, signal }) => canUseTool({
       session: this.session,
       toolName,
@@ -4687,7 +4716,8 @@ var ClaudeAcpAgent = class extends BaseAcpAgent {
       sessionId,
       fileContentCache: this.fileContentCache,
       logger: this.logger,
-      updateConfigOption: (configId, value) => this.updateConfigOption(configId, value)
+      updateConfigOption: (configId, value) => this.updateConfigOption(configId, value),
+      allowedDomains
     });
   }
   createOnModeChange() {
@@ -12221,6 +12251,7 @@ You MUST NOT create a new branch, close the existing PR, or create a new PR.`
         sessionId: payload.run_id,
         taskRunId: payload.run_id,
         systemPrompt: this.buildSessionSystemPrompt(prUrl),
+        allowedDomains: this.config.allowedDomains,
         ...this.config.claudeCode?.plugins?.length && {
           claudeCode: {
             options: {
@@ -12909,6 +12940,9 @@ program.name("agent-server").description("PostHog cloud agent server - runs in s
 ).option("--baseBranch <branch>", "Base branch for PR creation").option(
   "--claudeCodeConfig <json>",
   "Claude Code config as JSON (systemPrompt, systemPromptAppend, plugins)"
+).option(
+  "--allowedDomains <domains>",
+  "Comma-separated list of domains allowed for web tools (WebFetch, WebSearch)"
 ).action(async (options) => {
   const envResult = envSchema.safeParse(process.env);
   if (!envResult.success) {
@@ -12929,6 +12963,7 @@ ${errors}`);
     claudeCodeConfigSchema,
     "--claudeCodeConfig"
   );
+  const allowedDomains = options.allowedDomains ? options.allowedDomains.split(",").map((d) => d.trim()).filter(Boolean) : void 0;
   const server = new AgentServer({
     port: parseInt(options.port, 10),
     jwtPublicKey: env.JWT_PUBLIC_KEY,
@@ -12941,7 +12976,8 @@ ${errors}`);
     runId: options.runId,
     mcpServers,
     baseBranch: options.baseBranch,
-    claudeCode
+    claudeCode,
+    allowedDomains
   });
   process.on("SIGINT", async () => {
     await server.stop();