@vanillagreen/pi-claude-bridge 1.0.1 → 1.0.3

package/bundle/index.js

@@ -19487,8 +19487,7 @@ function popContext() {
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname2, join as join2, resolve } from "path";
-var PACKAGE_ID = "pi-claude-bridge";
-var SCOPED_PACKAGE_ID = "@vanillagreen/pi-claude-bridge";
+var PACKAGE_ID = "@vanillagreen/pi-claude-bridge";
 function expandHome(input) {
   if (input === "~") return homedir2();
   if (input.startsWith("~/")) return join2(homedir2(), input.slice(2));
@@ -19539,7 +19538,7 @@ function readManagerConfig(cwd) {
     try {
       const parsed = JSON.parse(readFileSync3(path, "utf8"));
       const configRoot = asRecord(asRecord(asRecord(parsed?.vstack)?.extensionManager)?.config);
-      const config2 = asRecord(configRoot?.[PACKAGE_ID]) ?? asRecord(configRoot?.[SCOPED_PACKAGE_ID]);
+      const config2 = asRecord(configRoot?.[PACKAGE_ID]);
       if (config2) mergeDeep(merged, config2);
     } catch {
     }
@@ -33642,17 +33641,28 @@ var DISALLOWED_BUILTIN_TOOLS = [
   "Read",
   "Write",
   "Edit",
+  "MultiEdit",
   "Glob",
   "Grep",
   "Bash",
   "Agent",
+  "Task",
   "NotebookEdit",
   "EnterWorktree",
   "ExitWorktree",
+  "CronList",
   "CronCreate",
   "CronDelete",
   "TeamCreate",
   "TeamDelete",
+  "TaskOutput",
+  "TaskStop",
+  "SendMessage",
+  "Skill",
+  "TodoRead",
+  "TodoWrite",
+  "ListMcpResources",
+  "ReadMcpResource",
   "WebFetch",
   "WebSearch",
   "AskUserQuestion",
@@ -33661,6 +33671,11 @@ var DISALLOWED_BUILTIN_TOOLS = [
   "ToolSearch",
   "ScheduleWakeup"
 ];
+var CLAUDE_BRIDGE_TOOL_ISOLATION = {
+  tools: [],
+  disallowedTools: DISALLOWED_BUILTIN_TOOLS,
+  allowedTools: [`mcp__${MCP_SERVER_NAME}__*`]
+};
 var sharedSession = null;
 function convertAndImportMessages(session, messages, customToolNameToSdk) {
   const { anthropicMessages, sanitizedIds } = convertPiMessages(messages, customToolNameToSdk);
@@ -34235,8 +34250,7 @@ function streamClaudeAgentSdk(model, context, options) {
   const queryOptions = {
     cwd,
     env: childEnv,
-    disallowedTools: DISALLOWED_BUILTIN_TOOLS,
-    allowedTools: [`mcp__${MCP_SERVER_NAME}__*`],
+    ...CLAUDE_BRIDGE_TOOL_ISOLATION,
     permissionMode: "bypassPermissions",
     includePartialMessages: true,
     systemPrompt: {
@@ -34418,5 +34432,7 @@ function index_default(pi) {
   }
 }
 export {
+  CLAUDE_BRIDGE_TOOL_ISOLATION,
+  DISALLOWED_BUILTIN_TOOLS,
   index_default as default
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vanillagreen/pi-claude-bridge",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Pi provider bridge that runs Claude Code through the Claude Agent SDK, with opt-in forwarding for Pi prompt context.",
   "type": "module",
   "keywords": [

package/src/config.ts

@@ -7,8 +7,7 @@ import { existsSync, readFileSync } from "fs";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 
-export const PACKAGE_ID = "pi-claude-bridge";
-export const SCOPED_PACKAGE_ID = "@vanillagreen/pi-claude-bridge";
+export const PACKAGE_ID = "@vanillagreen/pi-claude-bridge";
 
 export interface Config {
 	enabled?: boolean;
@@ -87,7 +86,7 @@ function readManagerConfig(cwd: string): SettingsRecord {
 		try {
 			const parsed = JSON.parse(readFileSync(path, "utf8"));
 			const configRoot = asRecord(asRecord(asRecord(parsed?.vstack)?.extensionManager)?.config);
-			const config = asRecord(configRoot?.[PACKAGE_ID]) ?? asRecord(configRoot?.[SCOPED_PACKAGE_ID]);
+			const config = asRecord(configRoot?.[PACKAGE_ID]);
 			if (config) mergeDeep(merged, config);
 		} catch {
 			// Ignore malformed optional manager config; Pi will surface settings issues elsewhere.

package/src/index.ts

@@ -138,15 +138,29 @@ const MODELS = buildModels(getModels("anthropic"));
 
 // Disable Claude Code built-ins in the provider path. Pi owns tool execution;
 // Claude reaches Pi tools through the bridged MCP server instead.
-const DISALLOWED_BUILTIN_TOOLS = [
-	"Read", "Write", "Edit", "Glob", "Grep", "Bash", "Agent",
+//
+// `allowedTools` is a permission auto-allow list in the Claude Agent SDK, not a
+// visibility allowlist. Use `tools: []` to remove the built-in tool set, and keep
+// this disallow list as a belt-and-suspenders guard for SDK/CLI built-ins that may
+// otherwise leak into the model context (e.g. TodoWrite, CronList, SendMessage).
+export const DISALLOWED_BUILTIN_TOOLS = [
+	"Read", "Write", "Edit", "MultiEdit", "Glob", "Grep", "Bash", "Agent", "Task",
 	"NotebookEdit", "EnterWorktree", "ExitWorktree",
-	"CronCreate", "CronDelete", "TeamCreate", "TeamDelete",
+	"CronList", "CronCreate", "CronDelete", "TeamCreate", "TeamDelete",
+	"TaskOutput", "TaskStop", "SendMessage", "Skill",
+	"TodoRead", "TodoWrite",
+	"ListMcpResources", "ReadMcpResource",
 	"WebFetch", "WebSearch",
 	"AskUserQuestion", "EnterPlanMode", "ExitPlanMode",
 	"ToolSearch", "ScheduleWakeup",
 ];
 
+export const CLAUDE_BRIDGE_TOOL_ISOLATION = {
+	tools: [] as string[],
+	disallowedTools: DISALLOWED_BUILTIN_TOOLS,
+	allowedTools: [`mcp__${MCP_SERVER_NAME}__*`],
+} satisfies Pick<NonNullable<Parameters<typeof query>[0]["options"]>, "tools" | "allowedTools" | "disallowedTools">;
+
 // --- Session persistence ---
 
 interface SessionState {
@@ -987,8 +1001,7 @@ function streamClaudeAgentSdk(model: Model<any>, context: Context, options?: Sim
 	const queryOptions: NonNullable<Parameters<typeof query>[0]["options"]> = {
 		cwd,
 		env: childEnv,
-		disallowedTools: DISALLOWED_BUILTIN_TOOLS,
-		allowedTools: [`mcp__${MCP_SERVER_NAME}__*`],
+		...CLAUDE_BRIDGE_TOOL_ISOLATION,
 		permissionMode: "bypassPermissions",
 		includePartialMessages: true,
 		systemPrompt: {