@warble/claude-agent-sdk 0.17.0 → 0.18.0

package/dist/cli.js

@@ -16,7 +16,7 @@ import {
   preflightDispatchAssets,
   prepareDispatch,
   prepareDisplayManifest
-} from "./chunk-74JAAZB7.js";
+} from "./chunk-MIW7NT66.js";
 
 // src/cli.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { Query, Options, CanUseTool, HookCallbackMatcher, NonNullableUsage, ModelUsage, SDKMessage } from '@anthropic-ai/claude-agent-sdk';
+import { Query, Options, CanUseTool, HookCallbackMatcher, PermissionResult, NonNullableUsage, ModelUsage, SDKMessage } from '@anthropic-ai/claude-agent-sdk';
 
 /**
  * Dispatch-time error — the TS analogue of the Rust back-end's `DispatchError`.
@@ -823,9 +823,19 @@ declare function fingerprintPrompts(plan: DispatchPlan): PromptFingerprint;
  * An embedder denial returns immediately without consulting the floor, so the floor's `denials`
  * ledger stays a record of guardrail enforcement rather than a mixed log of both parties.
  *
+ * An embedder that returns `null` has answered the permission request out-of-band. The floor cannot
+ * see that answer, so it cannot compose with it: the composed callback denies instead, fail-closed.
+ * The SDK then writes that denial to the control channel too, alongside the embedder's own answer;
+ * whichever the CLI honours, the worst case is a refused tool call, never an unchecked one.
+ *
  * With no embedder callback the floor's own callback is returned unchanged, so a run without an
  * embedder behaves exactly as it did before this seam existed.
  */
+/**
+ * A `CanUseTool` that always decides: it never returns `null` (the SDK's "answered out-of-band"
+ * signal). Warble's own guard is one, and it is assignable wherever a `CanUseTool` is expected.
+ */
+type DecidingCanUseTool = (...args: Parameters<CanUseTool>) => Promise<PermissionResult>;
 declare function composeCanUseTool(embedder: CanUseTool | undefined, floor: CanUseTool): CanUseTool;
 /**
  * Merge an embedding host's `hooks` with a guardrail's `PreToolUse` matchers, appending the
@@ -902,7 +912,7 @@ interface GuardConfig {
  * Fail-closed: anything not explicitly permitted by `canUseTool` is denied with guidance.
  */
 declare function makeReadOnlyGuard(cfg: GuardConfig): {
-    canUseTool: CanUseTool;
+    canUseTool: DecidingCanUseTool;
     denials: Denial[];
     hooks: HookCallbackMatcher[];
 };

package/dist/index.js

@@ -86,7 +86,7 @@ import {
   shouldSplitPerStepTier,
   usesLocalProvider,
   validateAssets
-} from "./chunk-74JAAZB7.js";
+} from "./chunk-MIW7NT66.js";
 export {
   COMPONENT_TYPES,
   ChatSession,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warble/claude-agent-sdk",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "license": "Apache-2.0",
   "type": "module",
   "description": "Warble back-end: Claude Agent SDK query() loop dispatcher (embeddable library + CLI)",
@@ -55,7 +55,7 @@
     "test:live": "node --import tsx --test tests/*.live.ts"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.1.0",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.296",
     "yaml": "^2.9.0",
     "zod": "^4.4.3"
   },
@@ -63,8 +63,8 @@
     "@warble/ir-spec": "0.9.x"
   },
   "devDependencies": {
-    "@warble/ir-spec": "file:../../packages/ir-spec",
     "@types/node": "^22",
+    "@warble/ir-spec": "file:../../packages/ir-spec",
     "tsup": "^8",
     "tsx": "^4",
     "typescript": "^5"