@skaile/workspaces 5.8.0 → 5.10.0

package/dist/asset-manager/src/install-instances.d.ts

@@ -27,8 +27,10 @@ export interface InstallAgentInstancesResult {
     instances: InstalledAgentInstance[];
     /** Workspace-relative paths removed because their instance (or sub-agent) is gone. */
     removed: string[];
-    /** Instances that could not be rendered, and non-fatal renderer notes. */
+    /** Non-fatal renderer notes. */
     warnings: string[];
+    /** Instances that could not be rendered because their `ref` does not resolve to an agent. */
+    errors: string[];
 }
 /** Options for {@link installAgentInstances}. */
 export interface InstallAgentInstancesOptions {
@@ -40,6 +42,34 @@ export interface InstallAgentInstancesOptions {
     wsConfig?: SkWorkspaceConfig;
     log?: (msg: string) => void;
 }
+/** One agent instance of `skaile.yaml` whose `ref` does not bind to an agent. */
+export interface UnboundAgentInstance {
+    /** Instance id (`default` for the `agent:` block). */
+    id: string;
+    /** The instance's `ref`. */
+    ref: string;
+    /** Why it does not bind, as `install` prints it. */
+    error: string;
+}
+/**
+ * The instances of `skaile.yaml` that {@link installAgentInstances} cannot render because their
+ * `ref` binds to no agent: `skaile check` fails on them, and `skaile install` too. A harness
+ * without a native agent format renders nothing, so it has none. An unreadable `skaile.yaml`
+ * has none either.
+ */
+export declare function unboundAgentInstances(projectDir: string, driverTarget: DriverTarget): UnboundAgentInstance[];
+/**
+ * Remove the native agent files an earlier install rendered for the instances `ids`, as far as
+ * no other instance claims them, and drop those instances from the ledger. Only paths the ledger
+ * lists and that sit inside the harness agent dir are removed.
+ *
+ * @returns Workspace-relative paths removed.
+ */
+export declare function removeAgentInstanceRenderings(opts: {
+    projectDir: string;
+    driverTarget: DriverTarget;
+    ids: readonly string[];
+}): string[];
 /**
  * Render every agent instance of the workspace for `driverTarget`, then remove
  * the renderings this step wrote earlier that no instance claims any more.

package/dist/asset-manager/src/install-instances.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-instances.d.ts","sourceRoot":"","sources":["../../../asset-manager/src/install-instances.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAW/E,wFAAwF;AACxF,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,gDAAgD;AAChD,MAAM,WAAW,2BAA2B;IAC1C,uCAAuC;IACvC,SAAS,EAAE,sBAAsB,EAAE,CAAC;IACpC,sFAAsF;IACtF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,iDAAiD;AACjD,MAAM,WAAW,4BAA4B;IAC3C,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,YAAY,EAAE,YAAY,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,4BAA4B,GACjC,2BAA2B,CA2E7B"}
+{"version":3,"file":"install-instances.d.ts","sourceRoot":"","sources":["../../../asset-manager/src/install-instances.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAW/E,wFAAwF;AACxF,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,gDAAgD;AAChD,MAAM,WAAW,2BAA2B;IAC1C,uCAAuC;IACvC,SAAS,EAAE,sBAAsB,EAAE,CAAC;IACpC,sFAAsF;IACtF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gCAAgC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6FAA6F;IAC7F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,iDAAiD;AACjD,MAAM,WAAW,4BAA4B;IAC3C,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,YAAY,EAAE,YAAY,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AA6DD,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,YAAY,GACzB,oBAAoB,EAAE,CAcxB;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAC3B,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACxB,GAAG,MAAM,EAAE,CAiCX;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,4BAA4B,GACjC,2BAA2B,CAqE7B"}

package/dist/asset-manager/src/installer.d.ts

@@ -53,6 +53,12 @@ export interface DeployOptions {
      * for store/factory sources (no stable local path) it is a no-op (still copy).
      */
     link?: boolean;
+    /**
+     * Called once per symlink inside an asset's own directory that a copy deploy
+     * leaves out (symlinks are not part of an asset), with the asset entry and the
+     * path of the link relative to the asset directory's parent (`<dir>/<rel>`).
+     */
+    onSkippedSymlink?: (entry: DeployableEntry, path: string) => void;
 }
 /**
  * Deploy a single asset to the framework-specific directory.
@@ -93,6 +99,20 @@ export declare function deployAsset(entry: DeployableEntry, repositories: Record
  * @docLink packages/asset-manager/api-reference#installer
  */
 export declare function deployAll(resolved: DeployableEntry[], repositories: Record<string, SourceDeclaration>, patches: Record<string, string>, opts: DeployOptions, log?: Log): string[];
+/**
+ * Unified diff from a deployed agent to its source, `-` lines in the deployed copy only and `+`
+ * lines in the source only. An agent is a rendering, not a copy, so the source is rendered the way
+ * {@link deployAsset} renders it (same renderer, same workspace context) into a scratch directory
+ * and that is compared with what the harness holds: `<name>.md` for claude-code, `<name>.toml`
+ * plus the `skaile-agents/<name>.md` identity for codex, the `<name>/` directory for omp.
+ *
+ * @param entry - The agent's catalog entry (`source` is its `agent.yaml` / `AGENT.md`).
+ * @param opts - Deployment target options (must match the options used at install time).
+ * @returns `null` when none of the agent's rendered files is deployed, else the diff text
+ *   (`""` when the deployed agent matches its source).
+ * @throws When `diff(1)` itself fails (exit status other than 0/1).
+ */
+export declare function diffDeployedAgent(entry: DeployableEntry, opts: DeployOptions): string | null;
 /**
  * Remove a deployed asset from the framework directory.
  *

package/dist/asset-manager/src/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../../asset-manager/src/installer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAoBjC,OAAO,KAAK,EAAsB,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGzF,OAAO,EAAsB,KAAK,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAE9D,YAAY,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAI1C;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAU7D;AAYD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,MAAM,GACX,WAAW,GAAG,SAAS,CAEzB;AAaD;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAwDD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,+GAA+G;IAC/G,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,wFAAwF;IACxF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAuCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAC/C,IAAI,EAAE,aAAa,EACnB,GAAG,GAAE,GAAU,GACd,OAAO,CAiET;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,eAAe,EAAE,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAC/C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,aAAa,EACnB,GAAG,GAAE,GAAU,GACd,MAAM,EAAE,CAiGV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAgCpF;AA4DD,kEAAkE;AAClE,eAAO,MAAM,cAAc,qEAAsE,CAAC;AAElG,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,eAAoB,GACzB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA2C/B"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../../asset-manager/src/installer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkBH,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AA4BjC,OAAO,KAAK,EAAsB,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGzF,OAAO,EAAsB,KAAK,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAE9D,YAAY,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAI1C;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAU7D;AAYD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,MAAM,GACX,WAAW,GAAG,SAAS,CAEzB;AAaD;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD;;;;;OAKG;IACH,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAgFD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,+GAA+G;IAC/G,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,wFAAwF;IACxF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnE;AAuCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAC/C,IAAI,EAAE,aAAa,EACnB,GAAG,GAAE,GAAU,GACd,OAAO,CAET;AAoFD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,eAAe,EAAE,EAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAC/C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,aAAa,EACnB,GAAG,GAAE,GAAU,GACd,MAAM,EAAE,CAmGV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAgD5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAgCpF;AA4DD,kEAAkE;AAClE,eAAO,MAAM,cAAc,qEAAsE,CAAC;AAElG,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,eAAoB,GACzB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAuD/B"}

package/dist/asset-manager/src/renderers.d.ts

@@ -56,8 +56,10 @@ export interface AgentRenderInput {
  * @docLink packages/asset-manager/api-reference#renderers
  */
 export interface AgentRenderResult {
-    /** Paths to files/dirs created, relative to `workspaceRoot`. */
+    /** Paths to files/dirs rendered, relative to `workspaceRoot`. */
     created: string[];
+    /** The subset of `created` whose bytes differ from what was on disk before (new or edited); an identical rewrite is skipped. */
+    changed: string[];
     /** Non-fatal warnings (e.g. experimental feature notices). */
     warnings: string[];
 }
@@ -122,10 +124,7 @@ export type Log = (msg: string) => void;
  * @returns Object with `created` file paths and `warnings` list.
  * @docLink packages/asset-manager/api-reference#renderers
  */
-export declare function renderAgentToFramework(input: AgentRenderInput, driverTarget: string, log?: Log): {
-    created: string[];
-    warnings: string[];
-};
+export declare function renderAgentToFramework(input: AgentRenderInput, driverTarget: string, log?: Log): AgentRenderResult;
 /**
  * Registry mapping framework IDs to their {@link AgentRenderer} functions.
  *

package/dist/asset-manager/src/renderers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"renderers.d.ts","sourceRoot":"","sources":["../../../asset-manager/src/renderers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAI9D,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,QAAQ,EAAE,aAAa,CAAC;IACxB,qDAAqD;IACrD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,sDAAsD;IACtD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uDAAuD;IACvD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,iGAAiG;IACjG,cAAc,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,kGAAkG;IAClG,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,gGAAgG;IAChG,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,wGAAwG;IACxG,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,SAAS,EAAE,cAAc,CAAC;IAC1B,wFAAwF;IACxF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,gBAAgB,KAAK,iBAAiB,CAAC;AAsE3E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,aA4EhC,CAAC;AA2BF,sGAAsG;AACtG,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,EAAE,aAiD3B,CAAC;AAiBF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,aAoEzB,CAAC;AAIF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;AAGxC;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,gBAAgB,EACvB,YAAY,EAAE,MAAM,EACpB,GAAG,GAAE,GAAU,GACd;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAS3C;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAIzD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAExE"}
+{"version":3,"file":"renderers.d.ts","sourceRoot":"","sources":["../../../asset-manager/src/renderers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAI9D,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,QAAQ,EAAE,aAAa,CAAC;IACxB,qDAAqD;IACrD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,sDAAsD;IACtD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uDAAuD;IACvD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,iGAAiG;IACjG,cAAc,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,kGAAkG;IAClG,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,gGAAgG;IAChG,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,wGAAwG;IACxG,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,SAAS,EAAE,cAAc,CAAC;IAC1B,wFAAwF;IACxF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gIAAgI;IAChI,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,gBAAgB,KAAK,iBAAiB,CAAC;AAkF3E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,aA6EhC,CAAC;AA2BF,sGAAsG;AACtG,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,EAAE,aAkD3B,CAAC;AAiBF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,aAoEzB,CAAC;AAIF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;AAGxC;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,gBAAgB,EACvB,YAAY,EAAE,MAAM,EACpB,GAAG,GAAE,GAAU,GACd,iBAAiB,CAanB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAIzD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAExE"}

package/dist/bridge/drivers/claude-sdk.js

@@ -1,30 +1,30 @@
 import { formatDroppedToolsNotice, filterInProcessMcpServerTools, checkToolPropertyKeys } from '../../chunk-X5O56UO4.js';
 import { freshBudget, isFirstAttempt, spend, isSpent, decide, isAvailable } from '../../chunk-IZCR27MU.js';
 import { AskSlots } from '../../chunk-EPBKISS5.js';
-import { scrubPoisonedTranscript, transcriptStoreForRuntime, resolveClaudeConfigDir, claudeEndpointMode, buildClaudeEndpointEnv } from '../../chunk-S53LOR7B.js';
-import { dispatchCapability } from '../../chunk-GCICGXDD.js';
-import { fetchProviderModels } from '../../chunk-PTSGWKHR.js';
+import { scrubPoisonedTranscript, transcriptStoreForRuntime, resolveClaudeConfigDir, claudeEndpointMode, buildClaudeEndpointEnv } from '../../chunk-QG3HOJEK.js';
+import { dispatchCapability } from '../../chunk-2H73V6XR.js';
+import { fetchProviderModels } from '../../chunk-OOWHXOK6.js';
 import { ReconfigureLedger, AuthError, stripRunnerPrivateEnv, classifyClaudeSdkError, reclassifyAuthAsAccountUnavailable, AccountUnavailableError, isLongContextEntitlementRejection, LONG_CONTEXT_CREDITS_API_ERROR } from '../../chunk-B4X2N7JQ.js';
 import { agentExecRequested, wrapAgentCommand, resolveAgentExec } from '../../chunk-YROR332M.js';
-import { BUILTIN_DRIVER_CATALOG, AgentDriver, getBridgeLogger, entryCredentialValue, registryDriverConfig } from '../../chunk-AWQYXZVG.js';
+import { BUILTIN_DRIVER_CATALOG, AgentDriver, getBridgeLogger, entryCredentialValue, registryDriverConfig } from '../../chunk-HJ5MCB3L.js';
 import '../../chunk-6E6PKKAD.js';
-import { withActivityLabelShape } from '../../chunk-F3RDEH5U.js';
-import '../../chunk-B6GIW55K.js';
-import '../../chunk-36AFURKZ.js';
+import { withActivityLabelShape } from '../../chunk-F4NJDSR7.js';
+import '../../chunk-32XKCNCL.js';
+import '../../chunk-2FMEGSBN.js';
 import '../../chunk-4GY63JU6.js';
-import '../../chunk-GB7WDMH2.js';
+import '../../chunk-GFCXNFTW.js';
 import '../../chunk-PMECEZK3.js';
 import '../../chunk-5BEFNLOR.js';
 import '../../chunk-A2ULN3KX.js';
-import '../../chunk-JAKOMFC6.js';
+import '../../chunk-JZCSNEHK.js';
 import '../../chunk-L5VSIPQD.js';
 import '../../chunk-CPSIPIX7.js';
-import '../../chunk-BTE2V4IW.js';
+import '../../chunk-IXWODEED.js';
 import '../../chunk-RVRB27AN.js';
-import '../../chunk-GTILM2CI.js';
-import '../../chunk-QVNRCDTV.js';
+import '../../chunk-Y34MSWEZ.js';
+import '../../chunk-4OV5DSBB.js';
 import '../../chunk-ICSCSM5D.js';
-import '../../chunk-UMVKJM4Q.js';
+import '../../chunk-DALV4HHP.js';
 import { mergeRegistries, parseModelRef, isEntryEnabled, resolveEntryBaseUrl } from '../../chunk-MJHSLODD.js';
 import '../../chunk-C3CAXQMA.js';
 import { createLogger } from '../../chunk-BOFL7GIF.js';
@@ -164,6 +164,71 @@ function sumBucket(items) {
   return { tokens: sumTokens(items), items };
 }
 
+// bridge/src/drivers/claude-tool-allowlist.ts
+var CAPABILITY_MCP_SERVER = "skaile-capabilities";
+var CLAUDE_CODE_BUILTIN_TOOLS = /* @__PURE__ */ new Set([
+  "Agent",
+  "AskUserQuestion",
+  "Bash",
+  "BashOutput",
+  "Edit",
+  "EnterPlanMode",
+  "ExitPlanMode",
+  "Glob",
+  "Grep",
+  "KillShell",
+  "LS",
+  "ListMcpResourcesTool",
+  "Monitor",
+  "MultiEdit",
+  "NotebookEdit",
+  "NotebookRead",
+  "Read",
+  "ReadMcpResourceTool",
+  "Skill",
+  "SlashCommand",
+  "Task",
+  "TaskOutput",
+  "TaskStop",
+  "TodoWrite",
+  "ToolSearch",
+  "WebFetch",
+  "WebSearch",
+  "Write"
+]);
+function mcpServerOf(name) {
+  if (!name.startsWith("mcp__")) return null;
+  const rest = name.slice("mcp__".length);
+  const sep = rest.indexOf("__");
+  if (sep <= 0 || sep + 2 >= rest.length) return null;
+  return { server: rest.slice(0, sep), tool: rest.slice(sep + 2) };
+}
+function canonicalToolName(entry, universe) {
+  return universe.capabilityNames.includes(entry) ? `mcp__${CAPABILITY_MCP_SERVER}__${entry}` : entry;
+}
+function unknownToolNames(allowlist, universe) {
+  const unknown = [];
+  for (const entry of allowlist) {
+    if (typeof entry !== "string" || !isKnownTool(entry, universe)) unknown.push(String(entry));
+  }
+  return unknown;
+}
+function isKnownTool(name, universe) {
+  if (CLAUDE_CODE_BUILTIN_TOOLS.has(name)) return true;
+  if (universe.capabilityNames.includes(name)) return true;
+  const mcp = mcpServerOf(name);
+  if (!mcp) return false;
+  if (mcp.server === CAPABILITY_MCP_SERVER) return universe.capabilityNames.includes(mcp.tool);
+  return universe.mcpServerNames.includes(mcp.server);
+}
+function toolAllowSet(allowlist, universe) {
+  return new Set(allowlist.map((entry) => canonicalToolName(entry, universe)));
+}
+function toolAllowlistDenial(toolName, allowed) {
+  if (!allowed || allowed.has(toolName)) return null;
+  return `The tool ${toolName} is not available in this turn. Answer with the tools you have.`;
+}
+
 // bridge/src/drivers/sanitize-assistant-text.ts
 var NS = "(?:[a-z][a-z0-9]*:)?";
 var FUNCTION_CALL_BLOCK = new RegExp(
@@ -582,6 +647,16 @@ var ClaudeSdkDriver = class extends AgentDriver {
    * the tail so one failed turn cannot wedge later callers.
    */
   promptTail = Promise.resolve();
+  /**
+   * Tools the running turn may call, or `null` when it is unrestricted. Set for
+   * the whole FIFO slot of a prompt that carried an allowlist, retries included.
+   */
+  turnToolAllowlist = null;
+  /**
+   * Subagents started under a restricted turn keep that turn's allowlist after
+   * it ends: a background subagent must not gain tools when its parent turn does.
+   */
+  subagentToolAllowlists = /* @__PURE__ */ new Map();
   /** Guards against duplicate agent_end emissions per turn. */
   turnCompleted = false;
   /** Set by {@link kill}: no turn may start or replay on this driver again. */
@@ -870,10 +945,44 @@ var ClaudeSdkDriver = class extends AgentDriver {
    * occurs after a container crash that prevented the SDK from flushing its session file.
    */
   prompt(message) {
+    return this.enqueuePrompt(message, null);
+  }
+  /**
+   * Text plus an optional per-turn tool allowlist. An allowlist naming a tool
+   * this driver does not recognize is rejected before the turn is queued.
+   */
+  promptInput(input) {
+    if (input.attachments?.length) return Promise.reject(new Error("Structured input unsupported"));
+    if (input.toolAllowlist === void 0) return this.prompt(input.text);
+    if (!Array.isArray(input.toolAllowlist))
+      return Promise.reject(new Error("toolAllowlist must be an array of tool names"));
+    const unknown = this.unknownAllowlistedTools(input.toolAllowlist);
+    if (unknown.length > 0)
+      return Promise.reject(new Error(`Unknown tool(s) in toolAllowlist: ${unknown.join(", ")}`));
+    return this.enqueuePrompt(input.text, toolAllowSet(input.toolAllowlist, this.toolUniverse()));
+  }
+  get enforcesToolAllowlist() {
+    return true;
+  }
+  unknownAllowlistedTools(allowlist) {
+    return unknownToolNames(allowlist, this.toolUniverse());
+  }
+  toolUniverse() {
+    return {
+      capabilityNames: this.config.capabilities?.composeTools().map((tool) => tool.name) ?? [],
+      mcpServerNames: Object.keys(this.config.mcpServers ?? {})
+    };
+  }
+  enqueuePrompt(message, allowlist) {
     this.supersedePendingQuestion();
-    const queuedPrompt = this.promptTail.then(
-      () => this.runPrompt(message, freshBudget())
-    );
+    const queuedPrompt = this.promptTail.then(async () => {
+      this.turnToolAllowlist = allowlist;
+      try {
+        await this.runPrompt(message, freshBudget());
+      } finally {
+        this.turnToolAllowlist = null;
+      }
+    });
     this.promptTail = queuedPrompt.then(
       () => void 0,
       () => void 0
@@ -1636,7 +1745,13 @@ var ClaudeSdkDriver = class extends AgentDriver {
       ...this.config.thinking ? { thinking: this.mapThinkingConfig(this.config.thinking) } : {},
       // Reasoning effort — passed directly to the SDK
       ...this.config.effort ? { effort: this.config.effort } : {},
-      hooks: {},
+      // The per-turn tool allowlist: hooks fire for every call, subagents'
+      // included, under bypassPermissions, and read the turn's state live.
+      hooks: {
+        PreToolUse: [{ hooks: [this.handlePreToolUse] }],
+        SubagentStart: [{ hooks: [this.handleSubagentStart] }],
+        SubagentStop: [{ hooks: [this.handleSubagentStop] }]
+      },
       stderr: onStderr,
       // Spawn the CLI ourselves to capture its OS pid for snapshotDescendantPids()
       // (Query never exposes it otherwise). This replaces the SDK's own default
@@ -1762,6 +1877,8 @@ var ClaudeSdkDriver = class extends AgentDriver {
    * `options.canUseTool` by value.
    */
   handleCanUseTool = (toolName, input, opts) => {
+    const denial = this.toolAllowlistDenialFor(toolName, opts.agentID);
+    if (denial) return Promise.resolve({ behavior: "deny", message: denial });
     if (toolName !== "AskUserQuestion") {
       return Promise.resolve({ behavior: "allow", updatedInput: input });
     }
@@ -1789,6 +1906,42 @@ var ClaudeSdkDriver = class extends AgentDriver {
       this.log.debug("paused on AskUserQuestion", { questions: questionTexts.length });
     });
   };
+  /**
+   * Denial reason when the per-turn allowlist forbids `toolName`, else `null`.
+   * A subagent seen under a restricted turn is bound to that turn's allowlist
+   * for its whole life.
+   */
+  toolAllowlistDenialFor(toolName, agentId) {
+    if (agentId !== void 0 && this.turnToolAllowlist && !this.subagentToolAllowlists.has(agentId))
+      this.subagentToolAllowlists.set(agentId, this.turnToolAllowlist);
+    const allowed = (agentId !== void 0 ? this.subagentToolAllowlists.get(agentId) : void 0) ?? this.turnToolAllowlist;
+    return toolAllowlistDenial(toolName, allowed);
+  }
+  /** `PreToolUse` hook: deny a call outside the turn's allowlist. */
+  handlePreToolUse = async (input) => {
+    if (input.hook_event_name !== "PreToolUse") return {};
+    const denial = this.toolAllowlistDenialFor(input.tool_name, input.agent_id);
+    if (!denial) return {};
+    this.log.info("tool call refused by the turn's allowlist", { tool: input.tool_name });
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: denial
+      }
+    };
+  };
+  /** `SubagentStart` hook: bind a subagent started under a restricted turn to its allowlist. */
+  handleSubagentStart = async (input) => {
+    if (input.hook_event_name === "SubagentStart" && this.turnToolAllowlist)
+      this.subagentToolAllowlists.set(input.agent_id, this.turnToolAllowlist);
+    return {};
+  };
+  handleSubagentStop = async (input) => {
+    if (input.hook_event_name === "SubagentStop")
+      this.subagentToolAllowlists.delete(input.agent_id);
+    return {};
+  };
   supersedePendingQuestion() {
     this.denyPendingQuestion(QUESTION_SUPERSEDED_BY_PROMPT);
   }