@wix/pathgrade 0.33.0 → 0.34.0

package/dist/agents/claude/denied-mcp-event-store.d.ts

@@ -0,0 +1,8 @@
+import type { ToolEvent } from '../../tool-events.js';
+export interface ClaudeDeniedMcpEventStore {
+    record(toolUseId: string, event: ToolEvent): void;
+    get(toolUseId: string | undefined): ToolEvent | undefined;
+    all(): ToolEvent[];
+    clear(): void;
+}
+export declare function createClaudeDeniedMcpEventStore(): ClaudeDeniedMcpEventStore;

package/dist/agents/claude/denied-mcp-event-store.js

@@ -0,0 +1,17 @@
+export function createClaudeDeniedMcpEventStore() {
+    const byToolUseId = new Map();
+    return {
+        record(toolUseId, event) {
+            byToolUseId.set(toolUseId, event);
+        },
+        get(toolUseId) {
+            return toolUseId ? byToolUseId.get(toolUseId) : undefined;
+        },
+        all() {
+            return [...byToolUseId.values()];
+        },
+        clear() {
+            byToolUseId.clear();
+        },
+    };
+}

package/dist/agents/claude/mcp-tool-name.d.ts

@@ -0,0 +1,12 @@
+import type { McpPolicyDenialReason } from '../../sdk/mcp-safety.js';
+export type ClaudeSdkMcpToolNameParseResult = {
+    kind: 'non_mcp';
+} | {
+    kind: 'mcp';
+    server: string;
+    tool: string;
+} | {
+    kind: 'unrecognized';
+    reason: Extract<McpPolicyDenialReason, 'unrecognized_mcp_tool_name'>;
+};
+export declare function parseClaudeSdkMcpToolName(providerToolName: string, configuredServerNames: readonly string[]): ClaudeSdkMcpToolNameParseResult;

package/dist/agents/claude/mcp-tool-name.js

@@ -0,0 +1,22 @@
+const MCP_TOOL_PREFIX = 'mcp__';
+export function parseClaudeSdkMcpToolName(providerToolName, configuredServerNames) {
+    if (!providerToolName.startsWith(MCP_TOOL_PREFIX))
+        return { kind: 'non_mcp' };
+    const body = providerToolName.slice(MCP_TOOL_PREFIX.length);
+    const matches = configuredServerNames
+        .filter((serverName) => {
+        if (serverName.length === 0)
+            return false;
+        const toolStart = `${serverName}__`;
+        return body.startsWith(toolStart) && body.length > toolStart.length;
+    })
+        .sort((a, b) => b.length - a.length);
+    if (matches.length !== 1) {
+        return { kind: 'unrecognized', reason: 'unrecognized_mcp_tool_name' };
+    }
+    const server = matches[0];
+    const tool = body.slice(server.length + 2);
+    if (!tool)
+        return { kind: 'unrecognized', reason: 'unrecognized_mcp_tool_name' };
+    return { kind: 'mcp', server, tool };
+}

package/dist/agents/claude/sdk-message-projector.d.ts

@@ -18,6 +18,7 @@
 import type { SDKMessage } from '@anthropic-ai/claude-agent-sdk';
 import type { AgentTurnResult } from '../../types.js';
 import type { AskUserAnswerStore } from './ask-user-answer-store.js';
+import type { ClaudeDeniedMcpEventStore } from './denied-mcp-event-store.js';
 export interface ProjectTurnInput {
     /** Buffered typed-message stream from one `query()` call. */
     messages: SDKMessage[];
@@ -34,6 +35,10 @@ export interface ProjectTurnInput {
      * `answerSource: 'unknown'` it stamped before the bridge existed.
      */
     answerStore?: AskUserAnswerStore;
+    /** Staged MCP server names from the Claude SDK mount boundary. */
+    mcpServerNames?: readonly string[];
+    /** Policy-denied MCP events recorded by the per-turn permission bridge. */
+    deniedMcpEvents?: ClaudeDeniedMcpEventStore;
 }
 export interface ProjectedTurn {
     result: AgentTurnResult;

package/dist/agents/claude/sdk-message-projector.js

@@ -22,6 +22,7 @@ const SDK_ERROR_SUBTYPES = [
     'error_max_structured_output_retries',
 ];
 import { TOOL_NAME_MAP, buildSummary, enrichSkillEvents } from '../../tool-events.js';
+import { parseClaudeSdkMcpToolName } from './mcp-tool-name.js';
 export function projectSdkMessages(input) {
     let sessionId;
     let initSkills;
@@ -59,7 +60,9 @@ export function projectSdkMessages(input) {
                         continue;
                     }
                     if (block.type === 'tool_use') {
-                        toolEvents.push(buildToolEvent(block, input.turnNumber, input.answerStore));
+                        const event = buildToolEvent(block, input.turnNumber, input.answerStore, input.mcpServerNames ?? [], input.deniedMcpEvents);
+                        if (event)
+                            toolEvents.push(event);
                     }
                 }
                 break;
@@ -109,7 +112,10 @@ export function projectSdkMessages(input) {
     const trimmedResult = resultText.trim();
     const visible = isError ? '' : (trimmedAssistant || trimmedResult);
     const rawOutput = resultText || assistantText;
-    const enriched = enrichSkillEvents(toolEvents);
+    const enriched = enrichSkillEvents([
+        ...toolEvents,
+        ...(input.deniedMcpEvents?.all() ?? []),
+    ]);
     const finalToolEvents = prependSlashCommandSkillEvent(enriched, input.firstMessage, initSkills);
     const traceOutput = input.messages.map((m) => JSON.stringify(m)).join('\n');
     const result = {
@@ -161,12 +167,14 @@ function prependSlashCommandSkillEvent(events, firstMessage, initSkills) {
         ...events,
     ];
 }
-function buildToolEvent(block, turnNumber, answerStore) {
+function buildToolEvent(block, turnNumber, answerStore, mcpServerNames, deniedMcpEvents) {
     const providerToolName = String(block.name || 'unknown');
     const rawInput = block.input ?? undefined;
     const toolUseId = typeof block.id === 'string' ? block.id : undefined;
-    const mcpTool = parseClaudeSdkMcpToolName(providerToolName);
-    if (mcpTool) {
+    const mcpTool = parseClaudeSdkMcpToolName(providerToolName, mcpServerNames);
+    if (mcpTool.kind === 'mcp') {
+        if (deniedMcpEvents?.get(toolUseId))
+            return undefined;
         const normalizedProviderToolName = `${mcpTool.server}.${mcpTool.tool}`;
         const args = {
             ...(rawInput ?? {}),
@@ -202,12 +210,6 @@ function buildToolEvent(block, turnNumber, answerStore) {
         rawSnippet,
     };
 }
-function parseClaudeSdkMcpToolName(providerToolName) {
-    const match = providerToolName.match(/^mcp__([^_].*?)__(.+)$/);
-    if (!match)
-        return undefined;
-    return { server: match[1], tool: match[2] };
-}
 /**
  * Boundary with the ask-user bridge.
  *

package/dist/agents/claude/tool-permission-bridge.d.ts

@@ -0,0 +1,18 @@
+import type { CanUseTool } from '@anthropic-ai/claude-agent-sdk';
+import type { AskBus } from '../../sdk/ask-bus/types.js';
+import { type McpSafetyOptions } from '../../sdk/mcp-safety.js';
+import type { AskUserAnswerStore } from './ask-user-answer-store.js';
+import type { ClaudeDeniedMcpEventStore } from './denied-mcp-event-store.js';
+export interface ClaudeToolPermissionBridgeDeps {
+    askBus: AskBus;
+    getTurnNumber: () => number;
+    answerStore: AskUserAnswerStore;
+    mcpServerNames: readonly string[];
+    mcpSafety?: McpSafetyOptions;
+    deniedMcpEvents?: ClaudeDeniedMcpEventStore;
+}
+export type ClaudeToolPermissionBridge = CanUseTool & {
+    lastError(): Error | null;
+    clearLastError(): void;
+};
+export declare function createClaudeToolPermissionBridge(deps: ClaudeToolPermissionBridgeDeps): ClaudeToolPermissionBridge;

package/dist/agents/claude/tool-permission-bridge.js

@@ -0,0 +1,86 @@
+import { decideMcpToolCall, redactMcpSecrets, } from '../../sdk/mcp-safety.js';
+import { createAskUserBridge, } from './ask-user-bridge.js';
+import { parseClaudeSdkMcpToolName } from './mcp-tool-name.js';
+export function createClaudeToolPermissionBridge(deps) {
+    const askUserBridge = createAskUserBridge({
+        askBus: deps.askBus,
+        getTurnNumber: deps.getTurnNumber,
+        answerStore: deps.answerStore,
+    });
+    const canUseTool = async (toolName, input, options) => {
+        if (toolName === 'AskUserQuestion') {
+            return askUserBridge(toolName, input, options);
+        }
+        const runMode = deps.mcpSafety?.runMode ?? 'mock';
+        const parsed = parseClaudeSdkMcpToolName(toolName, deps.mcpServerNames);
+        if (parsed.kind === 'non_mcp') {
+            return allow(input);
+        }
+        if (runMode === 'mock') {
+            return allow(input);
+        }
+        if (parsed.kind === 'unrecognized') {
+            return {
+                behavior: 'deny',
+                message: `unrecognized Claude SDK MCP tool name: ${toolName}`,
+            };
+        }
+        const decision = decideMcpToolCall(deps.mcpSafety, {
+            serverName: parsed.server,
+            toolName: parsed.tool,
+            arguments: asRecord(input),
+        });
+        if (decision.action === 'allow')
+            return allow(input);
+        recordDeniedMcpEvent({
+            store: deps.deniedMcpEvents,
+            toolUseId: options.toolUseID,
+            serverName: parsed.server,
+            toolName: parsed.tool,
+            input: asRecord(input),
+            decision,
+        });
+        return { behavior: 'deny', message: decision.message };
+    };
+    const bridge = canUseTool;
+    bridge.lastError = () => askUserBridge.lastError();
+    bridge.clearLastError = () => askUserBridge.clearLastError();
+    return bridge;
+}
+function allow(input) {
+    return { behavior: 'allow', updatedInput: asRecord(input) };
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function recordDeniedMcpEvent(opts) {
+    if (!opts.store)
+        return;
+    const providerToolName = `${opts.serverName}.${opts.toolName}`;
+    const args = redactMcpSecrets(opts.input);
+    const event = {
+        action: 'mcp_tool_call',
+        provider: 'claude',
+        providerToolName,
+        arguments: {
+            ...args,
+            server: opts.serverName,
+            tool: opts.toolName,
+            status: 'policy_denied',
+            policyResult: {
+                action: 'deny',
+                reason: opts.decision.reason,
+                message: opts.decision.message,
+            },
+        },
+        summary: `MCP tool ${providerToolName} policy_denied`,
+        confidence: 'high',
+        rawSnippet: JSON.stringify(redactMcpSecrets({
+            toolUseID: opts.toolUseId,
+            input: opts.input,
+        })).slice(0, 200),
+    };
+    opts.store.record(opts.toolUseId, event);
+}

package/dist/agents/claude.js

@@ -24,11 +24,12 @@
 import { query as sdkQuery, } from '@anthropic-ai/claude-agent-sdk';
 import { BaseAgent, getRuntimeEnv, getWorkspacePath, } from '../types.js';
 import { createSandboxedClaudeSpawn } from '../providers/sandboxed-claude-spawn.js';
-import { assertStdioMcpServersStartForClaudeSdk, mountMcpForClaudeSdk, } from '../providers/mcp-runtime-mounting.js';
+import { assertClaudeLiveMcpSafetyPreflight, assertStdioMcpServersStartForClaudeSdk, mountMcpForClaudeSdk, } from '../providers/mcp-runtime-mounting.js';
 import { buildClaudeSdkOptions, resolveClaudeCodeExecutable, } from './claude/sdk-options.js';
 import { projectSdkMessages } from './claude/sdk-message-projector.js';
-import { createAskUserBridge } from './claude/ask-user-bridge.js';
 import { createAskUserAnswerStore } from './claude/ask-user-answer-store.js';
+import { createClaudeToolPermissionBridge } from './claude/tool-permission-bridge.js';
+import { createClaudeDeniedMcpEventStore } from './claude/denied-mcp-event-store.js';
 import { requireAskBusForLiveBatches } from '../sdk/ask-bus/bus.js';
 function createLinkedAbortController(signal) {
     const controller = new AbortController();
@@ -76,6 +77,10 @@ export class ClaudeAgent extends BaseAgent {
             mcpConfigPath: sessionOptions?.mcpConfigPath,
             runtimeEnv: getRuntimeEnv(runtime),
         };
+        await assertClaudeLiveMcpSafetyPreflight({
+            ...mcpMountOptions,
+            mcpSafety: sessionOptions?.mcpSafety,
+        });
         await assertStdioMcpServersStartForClaudeSdk(mcpMountOptions);
         const mcpServers = await mountMcpForClaudeSdk(mcpMountOptions);
         let priorSessionId;
@@ -87,14 +92,24 @@ export class ClaudeAgent extends BaseAgent {
         // turn 2 cannot read a stale answer from turn 1 even on toolUseID
         // collisions.
         let answerStore = createAskUserAnswerStore();
-        const bridge = createAskUserBridge({
+        let deniedMcpEvents = createClaudeDeniedMcpEventStore();
+        const bridge = createClaudeToolPermissionBridge({
             askBus,
             getTurnNumber: () => turnNumber,
             answerStore: { record: (id, e) => answerStore.record(id, e), get: (id) => answerStore.get(id) },
+            mcpServerNames: mcpServers ? Object.keys(mcpServers) : [],
+            mcpSafety: sessionOptions?.mcpSafety,
+            deniedMcpEvents: {
+                record: (id, event) => deniedMcpEvents.record(id, event),
+                get: (id) => deniedMcpEvents.get(id),
+                all: () => deniedMcpEvents.all(),
+                clear: () => deniedMcpEvents.clear(),
+            },
         });
         const runTurn = async (message) => {
             turnNumber += 1;
             answerStore = createAskUserAnswerStore();
+            deniedMcpEvents = createClaudeDeniedMcpEventStore();
             // Clear any ask-bus rejection captured on a prior turn so a
             // stale error never causes a spurious result on this turn.
             bridge.clearLastError();
@@ -128,6 +143,8 @@ export class ClaudeAgent extends BaseAgent {
                 turnNumber,
                 firstMessage: projectorFirstMessage,
                 answerStore,
+                mcpServerNames: mcpServers ? Object.keys(mcpServers) : [],
+                deniedMcpEvents,
             });
             // Capture the SDK-reported session id BEFORE checking for a bus
             // rejection so the next turn's `Options.resume` points at this

package/dist/agents/cursor.js

@@ -2,7 +2,7 @@ import { BaseAgent, getWorkspacePath } from '../types.js';
 import { TOOL_NAME_MAP, buildSummary, enrichSkillEvents } from '../tool-events.js';
 import { getVisibleAssistantMessage } from '../sdk/visible-turn.js';
 import { prependRuntimePolicies } from '../sdk/runtime-policy.js';
-import { mountMcpForCursor } from '../providers/mcp-runtime-mounting.js';
+import { assertUnsupportedLiveMcpSafetyRuntime, mountMcpForCursor, } from '../providers/mcp-runtime-mounting.js';
 /**
  * Cursor tool_call discriminants observed in the discovery spike. Probed in
  * order — first present key wins. Explicit probing (vs. `Object.keys(…)[0]`)
@@ -170,6 +170,12 @@ export class CursorAgent extends BaseAgent {
         return getVisibleAssistantMessage(result);
     }
     async runTurn(instruction, workspacePath, runCommand, sessionId, options) {
+        await assertUnsupportedLiveMcpSafetyRuntime({
+            runtimeName: 'Cursor',
+            workspacePath,
+            mcpConfigPath: options?.mcpConfigPath,
+            mcpSafety: options?.mcpSafety,
+        });
         // Runtime policies are injected into the first-turn prompt only.
         // On resumed turns (sessionId set) the policy was already delivered,
         // so we skip re-prepending. The Claude SDK driver does not prepend

package/dist/providers/mcp-runtime-mounting.d.ts

@@ -1,4 +1,5 @@
 import type { McpStdioEntry } from './mcp-config.js';
+import type { McpSafetyOptions } from '../sdk/mcp-safety.js';
 export type ClaudeSdkMcpServerEntry = McpStdioEntry | {
     type: 'http';
     url: string;
@@ -25,9 +26,18 @@ interface WorkspaceMcpRuntimeMountingOptions extends McpRuntimeMountingOptions {
     workspacePath: string;
     runtimeEnv?: Record<string, string>;
 }
+interface ClaudeLiveMcpSafetyPreflightOptions extends WorkspaceMcpRuntimeMountingOptions {
+    mcpSafety?: McpSafetyOptions;
+}
+interface UnsupportedLiveMcpSafetyRuntimeOptions extends WorkspaceMcpRuntimeMountingOptions {
+    runtimeName: string;
+    mcpSafety?: McpSafetyOptions;
+}
 export interface CursorMcpRuntimeMount {
     approveMcps: boolean;
 }
+export declare function assertClaudeLiveMcpSafetyPreflight(options: ClaudeLiveMcpSafetyPreflightOptions): Promise<void>;
+export declare function assertUnsupportedLiveMcpSafetyRuntime(options: UnsupportedLiveMcpSafetyRuntimeOptions): Promise<void>;
 export declare function assertStdioMcpServersStartForClaudeSdk(options: WorkspaceMcpRuntimeMountingOptions): Promise<void>;
 export declare function mountMcpForClaudeSdk(options: WorkspaceMcpRuntimeMountingOptions): Promise<McpServersObject | undefined>;
 export declare function mountMcpForCodexAppServer(options: WorkspaceMcpRuntimeMountingOptions): Promise<CodexAppServerMcpConfig | undefined>;

package/dist/providers/mcp-runtime-mounting.js

@@ -33,6 +33,23 @@ function toCodexAppServerMcpServerEntry(entry) {
         tool_timeout_sec: entry.tool_timeout_sec,
     });
 }
+function isLiveMcpSafetyMode(options) {
+    const runMode = options?.runMode ?? 'mock';
+    return runMode === 'live-readonly' || runMode === 'live-sandbox' || runMode === 'live';
+}
+function describeClaudeIncompatibleFields(serverName, entry) {
+    if (isStdioEntry(entry))
+        return [];
+    const fields = [];
+    if (entry.env_http_headers !== undefined)
+        fields.push('env_http_headers');
+    if (entry.bearer_token_env_var !== undefined)
+        fields.push('bearer_token_env_var');
+    if (entry.headers !== undefined && entry.http_headers !== undefined) {
+        fields.push('headers and http_headers');
+    }
+    return fields.map((field) => `${serverName}: ${field}`);
+}
 function formatMcpStartupError(serverName, error, stderr) {
     const message = error instanceof Error ? error.message : String(error);
     const stderrSuffix = stderr.trim() ? `\nstderr:\n${stderr.trim()}` : '';
@@ -67,6 +84,28 @@ async function assertStdioMcpServerStarts(workspacePath, serverName, entry, runt
         await transport.close().catch(() => undefined);
     }
 }
+export async function assertClaudeLiveMcpSafetyPreflight(options) {
+    if (!options.mcpConfigPath || !isLiveMcpSafetyMode(options.mcpSafety))
+        return;
+    const mcpServers = await readStagedMcpServers(options.workspacePath, options.mcpConfigPath);
+    if (!mcpServers)
+        return;
+    if (options.mcpSafety?.liveOptIn !== true) {
+        throw new Error('Claude live MCP safety requires mcpSafety.liveOptIn: true before MCP runtime mounting.');
+    }
+    const unsupported = Object.entries(mcpServers).flatMap(([serverName, entry]) => describeClaudeIncompatibleFields(serverName, entry));
+    if (unsupported.length > 0) {
+        throw new Error(`Claude live MCP safety does not support runtime-incompatible MCP config fields: ${unsupported.join('; ')}`);
+    }
+}
+export async function assertUnsupportedLiveMcpSafetyRuntime(options) {
+    if (!options.mcpConfigPath || !isLiveMcpSafetyMode(options.mcpSafety))
+        return;
+    const mcpServers = await readStagedMcpServers(options.workspacePath, options.mcpConfigPath);
+    if (!mcpServers)
+        return;
+    throw new Error(`${options.runtimeName} live MCP safety enforcement is not supported. Use mock mode or a runtime that enforces mcpSafety before live MCP mounting.`);
+}
 export async function assertStdioMcpServersStartForClaudeSdk(options) {
     const mcpServers = await readStagedMcpServers(options.workspacePath, options.mcpConfigPath);
     if (!mcpServers)

package/dist/providers/sandbox.js

@@ -29,7 +29,8 @@ export async function createSandbox(spec) {
         const skillName = path.basename(skillPath);
         const skillFilter = (src) => {
             const rel = path.relative(skillPath, src);
-            if (rel === 'test' || rel.startsWith(`test${path.sep}`)) {
+            const [topLevelDir] = rel.split(path.sep);
+            if (topLevelDir === 'test' || topLevelDir === 'tests') {
                 return false;
             }
             return copyFilter(src);

package/dist/sdk/mcp-safety.d.ts

@@ -18,7 +18,7 @@ export interface McpToolCallRequest {
     toolName: string;
     arguments?: Record<string, unknown>;
 }
-export type McpPolicyDenialReason = 'missing_live_opt_in' | 'missing_mcp_tool_policy' | 'denylisted' | 'not_allowlisted' | 'not_marked_readonly';
+export type McpPolicyDenialReason = 'missing_live_opt_in' | 'missing_mcp_tool_policy' | 'denylisted' | 'not_allowlisted' | 'not_marked_readonly' | 'unrecognized_mcp_tool_name';
 export type McpToolPolicyDecision = {
     action: 'allow';
 } | {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/pathgrade",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Evaluate whether AI agents discover and use your skills correctly",
   "main": "./dist/sdk/index.js",
   "types": "./dist/sdk/index.d.ts",
@@ -80,7 +80,6 @@
     "vitest": "^4.0.0"
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "1.29.0",
     "@types/fs-extra": "^11.0.4",
     "@types/picomatch": "^4.0.2",
     "@vitest/coverage-v8": "^4.0.18",
@@ -90,6 +89,7 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.2.85",
+    "@modelcontextprotocol/sdk": "1.29.0",
     "@types/node": "^25.3.1",
     "fs-extra": "^11.3.3",
     "jiti": "^2.6.1",
@@ -97,5 +97,5 @@
     "typescript": "^5.9.3",
     "zod": "4.3.6"
   },
-  "falconPackageHash": "579fcca96c4242bf10bf90e92a5dd56295670fa81ccd17a0b2ca1bb7"
+  "falconPackageHash": "77ac8633dc5bff7dea81e34b2bad4228699443f0788ce2eb56a2bc36"
 }