@warble/claude-agent-sdk 0.17.0 → 0.19.0

package/README.md

@@ -111,7 +111,11 @@ owned by the current user, with no group or other permission bits (`chmod 600`).
 `[a-z0-9_]{1,32}`, `tools` is a non-empty list of `[a-z0-9_]{1,64}`, `instruction` is one line of at
 most 300 characters, and unknown keys are rejected. The server is passed to `query()` as a stdio
 `mcpServers` entry; the read-only guardrail then allows exactly `mcp__<name>__<tool>` for the listed
-tools and still refuses every other `mcp__*` tool, and the `wren`-only Bash rule is unchanged. Keep
+tools and still refuses every other `mcp__*` tool, and the `wren`-only Bash rule is unchanged. In a
+per-step-tier split the steps run as subagents with an exhaustive tool list, so every subagent that
+has `Bash` (the data-access ones) also gets the listed host tools and the instruction line. That
+includes the subagents of a setup or mutating component with data access: the guardrail allows the
+listed host tools by exact name in every component, as it already did for the driver. Keep
 secrets out of this file — pass a token file path in `args` instead; the CLI never prints the file,
 its `args`, or the environment. Hybrid-staged plans refuse the flag. Without it, `chat` behaves
 exactly as before.

package/dist/{chunk-74JAAZB7.js → chunk-J53WGCGG.js}

@@ -5,6 +5,12 @@ var DispatchError = class extends Error {
     this.name = "DispatchError";
   }
 };
+function boundedMessage(message) {
+  const collapsed = message.replace(/[\r\n\t]+/g, " ").replace(/\s+/g, " ").trim();
+  const withoutPaths = collapsed.replace(/(?:^|\s)\/(?:[^\s/]+\/)*[^\s]*/g, " [redacted path]");
+  const safe = /\b(select|insert|update|delete|merge|alter|drop|create)\b/i.test(withoutPaths) ? "The callee did not complete the request." : withoutPaths;
+  return (safe || "The child run did not complete.").slice(0, 240);
+}
 
 // src/codegen.ts
 function ident(verb) {
@@ -138,7 +144,7 @@ function makeReadOnlyGuard(cfg: {
   const denials: Denial[] = [];
   const hooks: never[] = [];
   const canUseTool = async (toolName: string, input: Record<string, unknown>) => {
-    if (toolName === "Read" || toolName === "Task" || toolName === "TodoWrite") {
+    if (toolName === "Read" || toolName === "Task" || toolName === "Agent" || toolName === "TodoWrite") {
       return { behavior: "allow" as const, updatedInput: input };
     }
     if (toolName === "Bash") {
@@ -2121,12 +2127,17 @@ import { resolve as resolvePath, sep as pathSep } from "path";
 function withinScope(abs, scopeAbs) {
   return abs === scopeAbs || abs.startsWith(scopeAbs.endsWith(pathSep) ? scopeAbs : scopeAbs + pathSep);
 }
+var OUT_OF_BAND_DENIAL = {
+  behavior: "deny",
+  message: "the embedding host answered this permission request out-of-band, which the guardrail cannot compose with"
+};
 function composeCanUseTool(embedder, floor) {
   if (embedder === void 0) return floor;
   return async (toolName, input, options) => {
     const fromEmbedder = await embedder(toolName, input, options);
+    if (fromEmbedder === null) return OUT_OF_BAND_DENIAL;
     if (fromEmbedder.behavior !== "allow") return fromEmbedder;
-    return floor(toolName, fromEmbedder.updatedInput, options);
+    return floor(toolName, fromEmbedder.updatedInput ?? input, options);
   };
 }
 function composeHooks(embedder, guardHooks) {
@@ -2191,7 +2202,7 @@ function makeReadOnlyGuard(cfg) {
       }
       return allow(input);
     }
-    if (toolName === "Task" || toolName === "TodoWrite") {
+    if (toolName === "Task" || toolName === "Agent" || toolName === "TodoWrite") {
       return allow(input);
     }
     if (toolName === "Bash") {
@@ -2627,7 +2638,7 @@ var ChatEventMapper = class {
     return [{ t: "step_start", id: this.stepId, name: this.stepId, parent: null, depth: 0 }];
   }
   onAssistant(message) {
-    const content = message.message?.content;
+    const content = isRecord(message.message) ? message.message["content"] : void 0;
     if (!Array.isArray(content)) return [];
     const parent = message.parent_tool_use_id ?? null;
     const depth = parent ? 1 : 0;
@@ -2648,7 +2659,7 @@ var ChatEventMapper = class {
     return events;
   }
   onUser(message) {
-    const content = message.message?.content;
+    const content = isRecord(message.message) ? message.message["content"] : void 0;
     if (!Array.isArray(content)) return [];
     const events = [];
     for (const block of content) {
@@ -2720,6 +2731,20 @@ function applyHostMcp(options, hostMcp) {
     next.systemPrompt = `${options.systemPrompt}
 ${hostMcp.instruction}`;
   }
+  if (options.agents !== void 0) {
+    const hostTools = hostMcpToolNames(hostMcp);
+    next.agents = Object.fromEntries(
+      Object.entries(options.agents).map(([name, agent]) => {
+        if (!agent.tools?.includes("Bash")) return [name, agent];
+        return [name, {
+          ...agent,
+          tools: [...agent.tools, ...hostTools],
+          ...hostMcp.instruction !== void 0 ? { prompt: `${agent.prompt}
+${hostMcp.instruction}` } : {}
+        }];
+      })
+    );
+  }
   return next;
 }
 var DispatchSessionError = class extends DispatchError {
@@ -2948,18 +2973,19 @@ async function runHybridStaged(plan, cfg) {
         continue;
       }
       if (decision.kind === "repair") {
-        let lastFailureText = artifacts[decision.target.produces ?? decision.target.name] ?? "";
+        const originalFailureText = boundedMessage(artifacts[decision.target.produces ?? decision.target.name] ?? "");
+        let lastFailureText = originalFailureText;
         const { recovered, attempts } = await runRepairLoop(DEFAULT_MAX_REPAIR_ATTEMPTS, async () => {
           const attempt = await executeStep(step, artifacts, execCtx, true);
           outcomes[step.name] = attempt.outcome;
           artifacts[artifactKey(step)] = attempt.text;
           if (attempt.outcome === "success") finalText = attempt.text;
-          else lastFailureText = attempt.text;
+          else lastFailureText = boundedMessage(attempt.text);
           return { failed: attempt.outcome === "failure" };
         });
         if (!recovered) {
           throw new DispatchError(
-            `repair step '${step.name}' did not recover '${decision.target.name}' after ${attempts} attempt(s); last failure: ${lastFailureText}`
+            `repair step '${step.name}' did not recover '${decision.target.name}' after ${attempts} attempt(s); ${decision.target.name} failed: ${originalFailureText}; last failure: ${lastFailureText}`
           );
         }
         process.stderr.write(
@@ -3071,12 +3097,6 @@ function assertSupportedComponentInvocationLimits(input) {
 function byteLength(value) {
   return Buffer.byteLength(JSON.stringify(value), "utf8");
 }
-function boundedMessage(message) {
-  const collapsed = message.replace(/[\r\n\t]+/g, " ").replace(/\s+/g, " ").trim();
-  const withoutPaths = collapsed.replace(/(?:^|\s)\/(?:[^\s/]+\/)*[^\s]*/g, " [redacted path]");
-  const safe = /\b(select|insert|update|delete|merge|alter|drop|create)\b/i.test(withoutPaths) ? "The callee did not complete the request." : withoutPaths;
-  return (safe || "The child run did not complete.").slice(0, 240);
-}
 function isJsonValue(value, seen = /* @__PURE__ */ new Set()) {
   if (value === null || typeof value === "string" || typeof value === "boolean") return true;
   if (typeof value === "number") return Number.isFinite(value);
@@ -3517,7 +3537,13 @@ var ComponentInvocationRuntime = class {
             if (result2.outcome === "success") finalText = result2.text;
             return { failed: result2.outcome === "failure" };
           });
-          if (!repair.recovered) throw new DispatchError(`callee_failed: repair step '${call.name}' did not recover`);
+          if (!repair.recovered) {
+            const target = decision.target;
+            const original = boundedMessage(artifacts[target.produces ?? target.name] ?? "");
+            throw new DispatchError(
+              `callee_failed: repair step '${call.name}' did not recover; ${target.name} failed: ${original}`
+            );
+          }
           continue;
         }
       }
@@ -3716,7 +3742,7 @@ function componentStepSystemPrompt(run) {
 function componentTools(component) {
   const configured = component.plan.options.tools;
   if (!Array.isArray(configured)) return ["Read"];
-  return configured.filter((name) => name !== "Task" && name !== "Write" && name !== "Edit");
+  return configured.filter((name) => name !== "Task" && name !== "Agent" && name !== "Write" && name !== "Edit");
 }
 function createSdkComponentStepRunner(cfg = {}) {
   const denials = [];
@@ -3764,7 +3790,8 @@ function createSdkComponentStepRunner(cfg = {}) {
       if (!toolNames.has(name)) return originalCanUseTool(name, input, options2);
       if (!cfg.hostCanUseTool) return { behavior: "allow", updatedInput: input };
       const permission = await cfg.hostCanUseTool(name, input, options2);
-      if (permission.behavior === "allow") rememberApproval(name, permission.updatedInput);
+      if (permission === null) return OUT_OF_BAND_DENIAL;
+      if (permission.behavior === "allow") rememberApproval(name, permission.updatedInput ?? input);
       return permission;
     };
     const componentCalls = run.aliases.map((alias) => tool2(
@@ -3775,14 +3802,16 @@ function createSdkComponentStepRunner(cfg = {}) {
         const name = `mcp__${MCP_SERVER_NAME2}__${alias}`;
         let input = { request: args.request, input: args.input ?? {} };
         if (cfg.hostCanUseTool && !consumeApproval(name, input)) {
+          const toolUseID = `${run.rootRunId}:${run.callId ?? "root"}:${run.step.name}:${alias}`;
           const permission = await cfg.hostCanUseTool(name, input, {
             signal: run.signal,
-            toolUseID: `${run.rootRunId}:${run.callId ?? "root"}:${run.step.name}:${alias}`
+            toolUseID,
+            requestId: toolUseID
           });
-          if (permission.behavior !== "allow") {
+          if (permission === null || permission.behavior !== "allow") {
             throw new DispatchError("component invocation was denied by the embedding host");
           }
-          input = permission.updatedInput;
+          input = permission.updatedInput ?? input;
         }
         const result2 = await run.invoke(alias, input);
         return {
@@ -4662,4 +4691,4 @@ export {
   ChatSession,
   createChatSession
 };
-//# sourceMappingURL=chunk-74JAAZB7.js.map
+//# sourceMappingURL=chunk-J53WGCGG.js.map