@warble/claude-agent-sdk 0.16.0 → 0.18.0

package/README.md

@@ -111,7 +111,11 @@ owned by the current user, with no group or other permission bits (`chmod 600`).
 `[a-z0-9_]{1,32}`, `tools` is a non-empty list of `[a-z0-9_]{1,64}`, `instruction` is one line of at
 most 300 characters, and unknown keys are rejected. The server is passed to `query()` as a stdio
 `mcpServers` entry; the read-only guardrail then allows exactly `mcp__<name>__<tool>` for the listed
-tools and still refuses every other `mcp__*` tool, and the `wren`-only Bash rule is unchanged. Keep
+tools and still refuses every other `mcp__*` tool, and the `wren`-only Bash rule is unchanged. In a
+per-step-tier split the steps run as subagents with an exhaustive tool list, so every subagent that
+has `Bash` (the data-access ones) also gets the listed host tools and the instruction line. That
+includes the subagents of a setup or mutating component with data access: the guardrail allows the
+listed host tools by exact name in every component, as it already did for the driver. Keep
 secrets out of this file — pass a token file path in `args` instead; the CLI never prints the file,
 its `args`, or the environment. Hybrid-staged plans refuse the flag. Without it, `chat` behaves
 exactly as before.

package/dist/{chunk-6GZGHFX7.js → chunk-MIW7NT66.js}

@@ -138,7 +138,7 @@ function makeReadOnlyGuard(cfg: {
   const denials: Denial[] = [];
   const hooks: never[] = [];
   const canUseTool = async (toolName: string, input: Record<string, unknown>) => {
-    if (toolName === "Read" || toolName === "Task" || toolName === "TodoWrite") {
+    if (toolName === "Read" || toolName === "Task" || toolName === "Agent" || toolName === "TodoWrite") {
       return { behavior: "allow" as const, updatedInput: input };
     }
     if (toolName === "Bash") {
@@ -514,7 +514,7 @@ var COMPONENT_TYPES = [
 ];
 var TRIGGER_KINDS = ["one_shot", "scheduled", "event"];
 var OUTCOME_KINDS = ["none", "assertion", "mutation", "dispatch"];
-var SUPPORTED_IR_VERSIONS = ["0.8"];
+var SUPPORTED_IR_VERSIONS = ["0.9"];
 function assertSupportedIrVersion(version) {
   if (!SUPPORTED_IR_VERSIONS.includes(version)) {
     throw new DispatchError(
@@ -843,6 +843,9 @@ function parseIr(json2) {
   const obj = requireObject(root, "<root>");
   const version = requireString(obj, "warble_ir_version", "<root>");
   assertSupportedIrVersion(version);
+  if (obj["context_binding"] === null) {
+    fail("context-free IR is not supported by claude-agent-sdk:local");
+  }
   const configRaw = obj["config"];
   const config = {};
   if (configRaw !== void 0) {
@@ -2118,12 +2121,17 @@ import { resolve as resolvePath, sep as pathSep } from "path";
 function withinScope(abs, scopeAbs) {
   return abs === scopeAbs || abs.startsWith(scopeAbs.endsWith(pathSep) ? scopeAbs : scopeAbs + pathSep);
 }
+var OUT_OF_BAND_DENIAL = {
+  behavior: "deny",
+  message: "the embedding host answered this permission request out-of-band, which the guardrail cannot compose with"
+};
 function composeCanUseTool(embedder, floor) {
   if (embedder === void 0) return floor;
   return async (toolName, input, options) => {
     const fromEmbedder = await embedder(toolName, input, options);
+    if (fromEmbedder === null) return OUT_OF_BAND_DENIAL;
     if (fromEmbedder.behavior !== "allow") return fromEmbedder;
-    return floor(toolName, fromEmbedder.updatedInput, options);
+    return floor(toolName, fromEmbedder.updatedInput ?? input, options);
   };
 }
 function composeHooks(embedder, guardHooks) {
@@ -2188,7 +2196,7 @@ function makeReadOnlyGuard(cfg) {
       }
       return allow(input);
     }
-    if (toolName === "Task" || toolName === "TodoWrite") {
+    if (toolName === "Task" || toolName === "Agent" || toolName === "TodoWrite") {
       return allow(input);
     }
     if (toolName === "Bash") {
@@ -2624,7 +2632,7 @@ var ChatEventMapper = class {
     return [{ t: "step_start", id: this.stepId, name: this.stepId, parent: null, depth: 0 }];
   }
   onAssistant(message) {
-    const content = message.message?.content;
+    const content = isRecord(message.message) ? message.message["content"] : void 0;
     if (!Array.isArray(content)) return [];
     const parent = message.parent_tool_use_id ?? null;
     const depth = parent ? 1 : 0;
@@ -2645,7 +2653,7 @@ var ChatEventMapper = class {
     return events;
   }
   onUser(message) {
-    const content = message.message?.content;
+    const content = isRecord(message.message) ? message.message["content"] : void 0;
     if (!Array.isArray(content)) return [];
     const events = [];
     for (const block of content) {
@@ -2717,6 +2725,20 @@ function applyHostMcp(options, hostMcp) {
     next.systemPrompt = `${options.systemPrompt}
 ${hostMcp.instruction}`;
   }
+  if (options.agents !== void 0) {
+    const hostTools = hostMcpToolNames(hostMcp);
+    next.agents = Object.fromEntries(
+      Object.entries(options.agents).map(([name, agent]) => {
+        if (!agent.tools?.includes("Bash")) return [name, agent];
+        return [name, {
+          ...agent,
+          tools: [...agent.tools, ...hostTools],
+          ...hostMcp.instruction !== void 0 ? { prompt: `${agent.prompt}
+${hostMcp.instruction}` } : {}
+        }];
+      })
+    );
+  }
   return next;
 }
 var DispatchSessionError = class extends DispatchError {
@@ -3713,7 +3735,7 @@ function componentStepSystemPrompt(run) {
 function componentTools(component) {
   const configured = component.plan.options.tools;
   if (!Array.isArray(configured)) return ["Read"];
-  return configured.filter((name) => name !== "Task" && name !== "Write" && name !== "Edit");
+  return configured.filter((name) => name !== "Task" && name !== "Agent" && name !== "Write" && name !== "Edit");
 }
 function createSdkComponentStepRunner(cfg = {}) {
   const denials = [];
@@ -3761,7 +3783,8 @@ function createSdkComponentStepRunner(cfg = {}) {
       if (!toolNames.has(name)) return originalCanUseTool(name, input, options2);
       if (!cfg.hostCanUseTool) return { behavior: "allow", updatedInput: input };
       const permission = await cfg.hostCanUseTool(name, input, options2);
-      if (permission.behavior === "allow") rememberApproval(name, permission.updatedInput);
+      if (permission === null) return OUT_OF_BAND_DENIAL;
+      if (permission.behavior === "allow") rememberApproval(name, permission.updatedInput ?? input);
       return permission;
     };
     const componentCalls = run.aliases.map((alias) => tool2(
@@ -3772,14 +3795,16 @@ function createSdkComponentStepRunner(cfg = {}) {
         const name = `mcp__${MCP_SERVER_NAME2}__${alias}`;
         let input = { request: args.request, input: args.input ?? {} };
         if (cfg.hostCanUseTool && !consumeApproval(name, input)) {
+          const toolUseID = `${run.rootRunId}:${run.callId ?? "root"}:${run.step.name}:${alias}`;
           const permission = await cfg.hostCanUseTool(name, input, {
             signal: run.signal,
-            toolUseID: `${run.rootRunId}:${run.callId ?? "root"}:${run.step.name}:${alias}`
+            toolUseID,
+            requestId: toolUseID
           });
-          if (permission.behavior !== "allow") {
+          if (permission === null || permission.behavior !== "allow") {
             throw new DispatchError("component invocation was denied by the embedding host");
           }
-          input = permission.updatedInput;
+          input = permission.updatedInput ?? input;
         }
         const result2 = await run.invoke(alias, input);
         return {
@@ -4163,8 +4188,8 @@ async function dispatch(input, runCfg) {
 
 // src/manifest.ts
 var MANIFEST_VERSION = "0.3";
-var MIN_SUPPORTED_IR_VERSION = "0.8";
-var MAX_SUPPORTED_IR_VERSION = "0.8";
+var MIN_SUPPORTED_IR_VERSION = "0.9";
+var MAX_SUPPORTED_IR_VERSION = "0.9";
 var DEFAULT_MAX_ATTEMPTS = 1;
 function classifyStep(node, stepIndex) {
   const when = node.llm_calls[stepIndex].when;
@@ -4659,4 +4684,4 @@ export {
   ChatSession,
   createChatSession
 };
-//# sourceMappingURL=chunk-6GZGHFX7.js.map
+//# sourceMappingURL=chunk-MIW7NT66.js.map