@vanillagreen/pi-claude-bridge 1.0.1 → 1.0.2

package/bundle/index.js

@@ -33642,17 +33642,28 @@ var DISALLOWED_BUILTIN_TOOLS = [
   "Read",
   "Write",
   "Edit",
+  "MultiEdit",
   "Glob",
   "Grep",
   "Bash",
   "Agent",
+  "Task",
   "NotebookEdit",
   "EnterWorktree",
   "ExitWorktree",
+  "CronList",
   "CronCreate",
   "CronDelete",
   "TeamCreate",
   "TeamDelete",
+  "TaskOutput",
+  "TaskStop",
+  "SendMessage",
+  "Skill",
+  "TodoRead",
+  "TodoWrite",
+  "ListMcpResources",
+  "ReadMcpResource",
   "WebFetch",
   "WebSearch",
   "AskUserQuestion",
@@ -33661,6 +33672,11 @@ var DISALLOWED_BUILTIN_TOOLS = [
   "ToolSearch",
   "ScheduleWakeup"
 ];
+var CLAUDE_BRIDGE_TOOL_ISOLATION = {
+  tools: [],
+  disallowedTools: DISALLOWED_BUILTIN_TOOLS,
+  allowedTools: [`mcp__${MCP_SERVER_NAME}__*`]
+};
 var sharedSession = null;
 function convertAndImportMessages(session, messages, customToolNameToSdk) {
   const { anthropicMessages, sanitizedIds } = convertPiMessages(messages, customToolNameToSdk);
@@ -34235,8 +34251,7 @@ function streamClaudeAgentSdk(model, context, options) {
   const queryOptions = {
     cwd,
     env: childEnv,
-    disallowedTools: DISALLOWED_BUILTIN_TOOLS,
-    allowedTools: [`mcp__${MCP_SERVER_NAME}__*`],
+    ...CLAUDE_BRIDGE_TOOL_ISOLATION,
     permissionMode: "bypassPermissions",
     includePartialMessages: true,
     systemPrompt: {
@@ -34418,5 +34433,7 @@ function index_default(pi) {
   }
 }
 export {
+  CLAUDE_BRIDGE_TOOL_ISOLATION,
+  DISALLOWED_BUILTIN_TOOLS,
   index_default as default
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vanillagreen/pi-claude-bridge",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Pi provider bridge that runs Claude Code through the Claude Agent SDK, with opt-in forwarding for Pi prompt context.",
   "type": "module",
   "keywords": [

package/src/index.ts

@@ -138,15 +138,29 @@ const MODELS = buildModels(getModels("anthropic"));
 
 // Disable Claude Code built-ins in the provider path. Pi owns tool execution;
 // Claude reaches Pi tools through the bridged MCP server instead.
-const DISALLOWED_BUILTIN_TOOLS = [
-	"Read", "Write", "Edit", "Glob", "Grep", "Bash", "Agent",
+//
+// `allowedTools` is a permission auto-allow list in the Claude Agent SDK, not a
+// visibility allowlist. Use `tools: []` to remove the built-in tool set, and keep
+// this disallow list as a belt-and-suspenders guard for SDK/CLI built-ins that may
+// otherwise leak into the model context (e.g. TodoWrite, CronList, SendMessage).
+export const DISALLOWED_BUILTIN_TOOLS = [
+	"Read", "Write", "Edit", "MultiEdit", "Glob", "Grep", "Bash", "Agent", "Task",
 	"NotebookEdit", "EnterWorktree", "ExitWorktree",
-	"CronCreate", "CronDelete", "TeamCreate", "TeamDelete",
+	"CronList", "CronCreate", "CronDelete", "TeamCreate", "TeamDelete",
+	"TaskOutput", "TaskStop", "SendMessage", "Skill",
+	"TodoRead", "TodoWrite",
+	"ListMcpResources", "ReadMcpResource",
 	"WebFetch", "WebSearch",
 	"AskUserQuestion", "EnterPlanMode", "ExitPlanMode",
 	"ToolSearch", "ScheduleWakeup",
 ];
 
+export const CLAUDE_BRIDGE_TOOL_ISOLATION = {
+	tools: [] as string[],
+	disallowedTools: DISALLOWED_BUILTIN_TOOLS,
+	allowedTools: [`mcp__${MCP_SERVER_NAME}__*`],
+} satisfies Pick<NonNullable<Parameters<typeof query>[0]["options"]>, "tools" | "allowedTools" | "disallowedTools">;
+
 // --- Session persistence ---
 
 interface SessionState {
@@ -987,8 +1001,7 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	const queryOptions: NonNullable<Parameters<typeof query>[0]["options"]> = {
 		cwd,
 		env: childEnv,
-		disallowedTools: DISALLOWED_BUILTIN_TOOLS,
-		allowedTools: [`mcp__${MCP_SERVER_NAME}__*`],
+		...CLAUDE_BRIDGE_TOOL_ISOLATION,
 		permissionMode: "bypassPermissions",
 		includePartialMessages: true,
 		systemPrompt: {