@warble/claude-agent-sdk 0.17.0 → 0.18.0

package/README.md

@@ -111,7 +111,11 @@ owned by the current user, with no group or other permission bits (`chmod 600`).
 `[a-z0-9_]{1,32}`, `tools` is a non-empty list of `[a-z0-9_]{1,64}`, `instruction` is one line of at
 most 300 characters, and unknown keys are rejected. The server is passed to `query()` as a stdio
 `mcpServers` entry; the read-only guardrail then allows exactly `mcp__<name>__<tool>` for the listed
-tools and still refuses every other `mcp__*` tool, and the `wren`-only Bash rule is unchanged. Keep
+tools and still refuses every other `mcp__*` tool, and the `wren`-only Bash rule is unchanged. In a
+per-step-tier split the steps run as subagents with an exhaustive tool list, so every subagent that
+has `Bash` (the data-access ones) also gets the listed host tools and the instruction line. That
+includes the subagents of a setup or mutating component with data access: the guardrail allows the
+listed host tools by exact name in every component, as it already did for the driver. Keep
 secrets out of this file — pass a token file path in `args` instead; the CLI never prints the file,
 its `args`, or the environment. Hybrid-staged plans refuse the flag. Without it, `chat` behaves
 exactly as before.

package/dist/{chunk-74JAAZB7.js → chunk-MIW7NT66.js}

@@ -138,7 +138,7 @@ function makeReadOnlyGuard(cfg: {
   const denials: Denial[] = [];
   const hooks: never[] = [];
   const canUseTool = async (toolName: string, input: Record<string, unknown>) => {
-    if (toolName === "Read" || toolName === "Task" || toolName === "TodoWrite") {
+    if (toolName === "Read" || toolName === "Task" || toolName === "Agent" || toolName === "TodoWrite") {
       return { behavior: "allow" as const, updatedInput: input };
     }
     if (toolName === "Bash") {
@@ -2121,12 +2121,17 @@ import { resolve as resolvePath, sep as pathSep } from "path";
 function withinScope(abs, scopeAbs) {
   return abs === scopeAbs || abs.startsWith(scopeAbs.endsWith(pathSep) ? scopeAbs : scopeAbs + pathSep);
 }
+var OUT_OF_BAND_DENIAL = {
+  behavior: "deny",
+  message: "the embedding host answered this permission request out-of-band, which the guardrail cannot compose with"
+};
 function composeCanUseTool(embedder, floor) {
   if (embedder === void 0) return floor;
   return async (toolName, input, options) => {
     const fromEmbedder = await embedder(toolName, input, options);
+    if (fromEmbedder === null) return OUT_OF_BAND_DENIAL;
     if (fromEmbedder.behavior !== "allow") return fromEmbedder;
-    return floor(toolName, fromEmbedder.updatedInput, options);
+    return floor(toolName, fromEmbedder.updatedInput ?? input, options);
   };
 }
 function composeHooks(embedder, guardHooks) {
@@ -2191,7 +2196,7 @@ function makeReadOnlyGuard(cfg) {
       }
       return allow(input);
     }
-    if (toolName === "Task" || toolName === "TodoWrite") {
+    if (toolName === "Task" || toolName === "Agent" || toolName === "TodoWrite") {
       return allow(input);
     }
     if (toolName === "Bash") {
@@ -2627,7 +2632,7 @@ var ChatEventMapper = class {
     return [{ t: "step_start", id: this.stepId, name: this.stepId, parent: null, depth: 0 }];
   }
   onAssistant(message) {
-    const content = message.message?.content;
+    const content = isRecord(message.message) ? message.message["content"] : void 0;
     if (!Array.isArray(content)) return [];
     const parent = message.parent_tool_use_id ?? null;
     const depth = parent ? 1 : 0;
@@ -2648,7 +2653,7 @@ var ChatEventMapper = class {
     return events;
   }
   onUser(message) {
-    const content = message.message?.content;
+    const content = isRecord(message.message) ? message.message["content"] : void 0;
     if (!Array.isArray(content)) return [];
     const events = [];
     for (const block of content) {
@@ -2720,6 +2725,20 @@ function applyHostMcp(options, hostMcp) {
     next.systemPrompt = `${options.systemPrompt}
 ${hostMcp.instruction}`;
   }
+  if (options.agents !== void 0) {
+    const hostTools = hostMcpToolNames(hostMcp);
+    next.agents = Object.fromEntries(
+      Object.entries(options.agents).map(([name, agent]) => {
+        if (!agent.tools?.includes("Bash")) return [name, agent];
+        return [name, {
+          ...agent,
+          tools: [...agent.tools, ...hostTools],
+          ...hostMcp.instruction !== void 0 ? { prompt: `${agent.prompt}
+${hostMcp.instruction}` } : {}
+        }];
+      })
+    );
+  }
   return next;
 }
 var DispatchSessionError = class extends DispatchError {
@@ -3716,7 +3735,7 @@ function componentStepSystemPrompt(run) {
 function componentTools(component) {
   const configured = component.plan.options.tools;
   if (!Array.isArray(configured)) return ["Read"];
-  return configured.filter((name) => name !== "Task" && name !== "Write" && name !== "Edit");
+  return configured.filter((name) => name !== "Task" && name !== "Agent" && name !== "Write" && name !== "Edit");
 }
 function createSdkComponentStepRunner(cfg = {}) {
   const denials = [];
@@ -3764,7 +3783,8 @@ function createSdkComponentStepRunner(cfg = {}) {
       if (!toolNames.has(name)) return originalCanUseTool(name, input, options2);
       if (!cfg.hostCanUseTool) return { behavior: "allow", updatedInput: input };
       const permission = await cfg.hostCanUseTool(name, input, options2);
-      if (permission.behavior === "allow") rememberApproval(name, permission.updatedInput);
+      if (permission === null) return OUT_OF_BAND_DENIAL;
+      if (permission.behavior === "allow") rememberApproval(name, permission.updatedInput ?? input);
       return permission;
     };
     const componentCalls = run.aliases.map((alias) => tool2(
@@ -3775,14 +3795,16 @@ function createSdkComponentStepRunner(cfg = {}) {
         const name = `mcp__${MCP_SERVER_NAME2}__${alias}`;
         let input = { request: args.request, input: args.input ?? {} };
         if (cfg.hostCanUseTool && !consumeApproval(name, input)) {
+          const toolUseID = `${run.rootRunId}:${run.callId ?? "root"}:${run.step.name}:${alias}`;
           const permission = await cfg.hostCanUseTool(name, input, {
             signal: run.signal,
-            toolUseID: `${run.rootRunId}:${run.callId ?? "root"}:${run.step.name}:${alias}`
+            toolUseID,
+            requestId: toolUseID
           });
-          if (permission.behavior !== "allow") {
+          if (permission === null || permission.behavior !== "allow") {
             throw new DispatchError("component invocation was denied by the embedding host");
           }
-          input = permission.updatedInput;
+          input = permission.updatedInput ?? input;
         }
         const result2 = await run.invoke(alias, input);
         return {
@@ -4662,4 +4684,4 @@ export {
   ChatSession,
   createChatSession
 };
-//# sourceMappingURL=chunk-74JAAZB7.js.map
+//# sourceMappingURL=chunk-MIW7NT66.js.map