@synergenius/flow-weaver 0.25.1 → 0.26.0

package/dist/agent/cli-session.js

@@ -96,7 +96,10 @@ export class CliSession {
             model,
         ];
         if (mcpConfigPath) {
-            args.push('--mcp-config', mcpConfigPath, '--strict-mcp-config');
+            args.push('--mcp-config', mcpConfigPath);
+        }
+        if (this.opts.strictMcpConfig || mcpConfigPath) {
+            args.push('--strict-mcp-config');
         }
         const { disallowedTools, tools, systemPrompt, appendSystemPrompt } = this.opts;
         if (disallowedTools && disallowedTools.length > 0) {
@@ -276,6 +279,7 @@ export class CliSession {
         return JSON.stringify({
             model: options.model,
             mcpConfigPath: options.mcpConfigPath,
+            strictMcpConfig: options.strictMcpConfig,
             disallowedTools: options.disallowedTools,
             tools: options.tools,
             systemPrompt: options.systemPrompt,

package/dist/agent/cli-spawn-config.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Centralized CLI spawn configuration — single source of truth for all
+ * Claude CLI invocations in automation contexts.
+ *
+ * RULE: Every automated CLI spawn MUST use getCliBaseArgs() or getCliSessionConfig().
+ * Never construct CLI args manually. This ensures:
+ * - --tools "" (disable all built-in tools)
+ * - --strict-mcp-config (prevent user MCP server leakage)
+ * - --dangerously-skip-permissions (no permission prompts in automation)
+ *
+ * Interactive user sessions (e.g., fw init) are exempt — they're the user's
+ * own Claude session, not automated workers.
+ */
+import type { CliSessionOptions } from './types.js';
+/**
+ * Base CLI args for ALL automated Claude CLI invocations (one-shot and session).
+ * Enforces tool isolation and MCP lockdown.
+ */
+export declare function getCliBaseArgs(options?: {
+    model?: string;
+    systemPrompt?: string;
+    appendSystemPrompt?: string;
+    outputFormat?: 'stream-json' | 'json' | 'text';
+    includePartialMessages?: boolean;
+    jsonSchema?: string;
+}): string[];
+/**
+ * CLI session options for persistent sessions.
+ * Merges caller options with mandatory lockdown config.
+ */
+export declare function getCliSessionConfig(options: {
+    binPath?: string;
+    cwd: string;
+    model: string;
+    mcpConfigPath?: string;
+    disallowedTools?: string[];
+    appendSystemPrompt?: string;
+    systemPrompt?: string;
+}): CliSessionOptions;
+//# sourceMappingURL=cli-spawn-config.d.ts.map

package/dist/agent/cli-spawn-config.js

@@ -0,0 +1,65 @@
+/**
+ * Centralized CLI spawn configuration — single source of truth for all
+ * Claude CLI invocations in automation contexts.
+ *
+ * RULE: Every automated CLI spawn MUST use getCliBaseArgs() or getCliSessionConfig().
+ * Never construct CLI args manually. This ensures:
+ * - --tools "" (disable all built-in tools)
+ * - --strict-mcp-config (prevent user MCP server leakage)
+ * - --dangerously-skip-permissions (no permission prompts in automation)
+ *
+ * Interactive user sessions (e.g., fw init) are exempt — they're the user's
+ * own Claude session, not automated workers.
+ */
+/**
+ * Base CLI args for ALL automated Claude CLI invocations (one-shot and session).
+ * Enforces tool isolation and MCP lockdown.
+ */
+export function getCliBaseArgs(options) {
+    const args = [
+        '-p',
+        '--dangerously-skip-permissions',
+        // Disable ALL built-in tools — only pack/MCP tools visible to model
+        '--tools', '',
+        // Prevent user/project MCP servers from leaking into sessions
+        '--strict-mcp-config',
+    ];
+    if (options?.outputFormat) {
+        args.push('--output-format', options.outputFormat);
+    }
+    if (options?.includePartialMessages) {
+        args.push('--include-partial-messages');
+    }
+    if (options?.model) {
+        args.push('--model', options.model);
+    }
+    if (options?.systemPrompt) {
+        args.push('--system-prompt', options.systemPrompt);
+    }
+    if (options?.appendSystemPrompt) {
+        args.push('--append-system-prompt', options.appendSystemPrompt);
+    }
+    if (options?.jsonSchema) {
+        args.push('--json-schema', options.jsonSchema);
+    }
+    return args;
+}
+/**
+ * CLI session options for persistent sessions.
+ * Merges caller options with mandatory lockdown config.
+ */
+export function getCliSessionConfig(options) {
+    return {
+        binPath: options.binPath ?? 'claude',
+        cwd: options.cwd,
+        model: options.model,
+        mcpConfigPath: options.mcpConfigPath,
+        disallowedTools: options.disallowedTools,
+        // Mandatory lockdown — cannot be overridden by callers
+        tools: '',
+        strictMcpConfig: true,
+        appendSystemPrompt: options.appendSystemPrompt,
+        systemPrompt: options.systemPrompt,
+    };
+}
+//# sourceMappingURL=cli-spawn-config.js.map

package/dist/agent/index.d.ts

@@ -16,6 +16,7 @@ export { PlatformProvider, createPlatformProvider } from './providers/platform.j
 export type { PlatformProviderOptions } from './providers/platform.js';
 export { createMcpBridge } from './mcp-bridge.js';
 export { CliSession, getOrCreateCliSession, killCliSession, killAllCliSessions, } from './cli-session.js';
+export { getCliBaseArgs, getCliSessionConfig } from './cli-spawn-config.js';
 export { buildSafeEnv, buildSafeSpawnOpts, MINIMAL_PATH, ENV_ALLOWLIST } from './env-allowlist.js';
 export { StreamJsonParser } from './streaming.js';
 export { DeviceConnection } from './device-connection.js';

package/dist/agent/index.js

@@ -17,6 +17,8 @@ export { PlatformProvider, createPlatformProvider } from './providers/platform.j
 export { createMcpBridge } from './mcp-bridge.js';
 // CLI session (warm persistent sessions)
 export { CliSession, getOrCreateCliSession, killCliSession, killAllCliSessions, } from './cli-session.js';
+// CLI spawn configuration (centralized lockdown for automated sessions)
+export { getCliBaseArgs, getCliSessionConfig } from './cli-spawn-config.js';
 // Env utilities
 export { buildSafeEnv, buildSafeSpawnOpts, MINIMAL_PATH, ENV_ALLOWLIST } from './env-allowlist.js';
 // Stream parser (for custom providers)

package/dist/agent/types.d.ts

@@ -189,6 +189,8 @@ export interface CliSessionOptions {
     model: string;
     /** Pre-configured MCP config path. */
     mcpConfigPath?: string;
+    /** When true, ignore user/project MCP servers — only use --mcp-config if provided. */
+    strictMcpConfig?: boolean;
     /** Disable specific built-in tools (e.g. ['Read', 'Edit', 'Write', 'Bash'] to force MCP tools). */
     disallowedTools?: string[];
     /**

package/dist/cli/flow-weaver.mjs

@@ -9886,7 +9886,7 @@ var VERSION;
 var init_generated_version = __esm({
   "src/generated-version.ts"() {
     "use strict";
-    VERSION = "0.25.1";
+    VERSION = "0.26.0";
   }
 });
 
@@ -95973,7 +95973,7 @@ function parseIntStrict(value) {
 // src/cli/index.ts
 init_logger();
 init_error_utils();
-var version2 = true ? "0.25.1" : "0.0.0-dev";
+var version2 = true ? "0.26.0" : "0.0.0-dev";
 var program2 = new Command();
 program2.name("fw").description("Flow Weaver Annotations - Compile and validate workflow files").option("-v, --version", "Output the current version").option("--no-color", "Disable colors").option("--color", "Force colors").on("option:version", () => {
   logger.banner(version2);

package/dist/generated-version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.25.1";
+export declare const VERSION = "0.26.0";
 //# sourceMappingURL=generated-version.d.ts.map

package/dist/generated-version.js

@@ -1,3 +1,3 @@
 // Auto-generated by scripts/generate-version.ts — do not edit manually
-export const VERSION = '0.25.1';
+export const VERSION = '0.26.0';
 //# sourceMappingURL=generated-version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synergenius/flow-weaver",
-  "version": "0.25.1",
+  "version": "0.26.0",
   "description": "Deterministic workflow compiler for AI agents. Compiles to standalone TypeScript, no runtime dependencies.",
   "private": false,
   "type": "module",