@zhijiewang/openharness 2.37.0 → 2.38.0

package/dist/services/AgentDispatcher.d.ts

@@ -8,7 +8,7 @@
 import type { Provider } from "../providers/base.js";
 import type { Tools } from "../Tool.js";
 import type { StreamEvent, ToolCallComplete, ToolCallEnd, ToolCallStart, ToolOutputDelta } from "../types/events.js";
-import type { PermissionMode } from "../types/permissions.js";
+import { type PermissionMode } from "../types/permissions.js";
 /**
  * Forward inner-loop tool events to the outer stream, stamping parentCallId.
  * Exported for direct unit testing.
@@ -20,6 +20,15 @@ export type AgentTask = {
     description?: string;
     blockedBy?: string[];
     allowedTools?: string[];
+    /**
+     * Per-task permission mode override — narrowing-only, same contract as
+     * AgentTool's `permission_mode` (v2.36). When set, the task's effective
+     * mode is `clampSubagentPermissionMode(dispatcher.permissionMode, task.permissionMode)`,
+     * so a task can be the same strictness as the outer call or stricter,
+     * never looser. Use to mark specific tasks in a parallel batch as
+     * read-only review/audit while letting siblings keep full write access.
+     */
+    permissionMode?: PermissionMode;
 };
 export type AgentTaskResult = {
     id: string;

package/dist/services/AgentDispatcher.js

@@ -6,6 +6,7 @@
  * and triggers dependent tasks when their blockers complete.
  */
 import { createWorktree, isGitRepo, removeWorktree } from "../git/index.js";
+import { clampSubagentPermissionMode } from "../types/permissions.js";
 /**
  * Forward inner-loop tool events to the outer stream, stamping parentCallId.
  * Exported for direct unit testing.
@@ -168,11 +169,15 @@ export class AgentDispatcher {
             // matching `process.chdir(originalCwd)` in `finally` — but since
             // `process.cwd()` is process-wide, two concurrent tasks would clobber
             // each other's directory mid-execution.
+            // Per-task permission mode — narrowing-only clamp applied so a task
+            // can override only to a same-or-stricter mode than the dispatcher's
+            // outer mode (#115 contract).
+            const taskPermissionMode = clampSubagentPermissionMode(this.permissionMode, task.permissionMode);
             const config = {
                 provider: this.provider,
                 tools: taskTools,
                 systemPrompt: this.systemPrompt,
-                permissionMode: this.permissionMode,
+                permissionMode: taskPermissionMode,
                 model: this.model,
                 maxTurns: 20,
                 abortSignal: this.abortSignal,

package/dist/tools/ParallelAgentTool/index.d.ts

@@ -6,15 +6,21 @@ declare const inputSchema: z.ZodObject<{
         prompt: z.ZodString;
         description: z.ZodOptional<z.ZodString>;
         blockedBy: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        permission_mode: z.ZodOptional<z.ZodEnum<["ask", "trust", "deny", "acceptEdits", "plan", "auto", "bypassPermissions"]>>;
     }, "strip", z.ZodTypeAny, {
         id: string;
         prompt: string;
         description?: string | undefined;
+        allowed_tools?: string[] | undefined;
+        permission_mode?: "ask" | "deny" | "trust" | "acceptEdits" | "plan" | "auto" | "bypassPermissions" | undefined;
         blockedBy?: string[] | undefined;
     }, {
         id: string;
         prompt: string;
         description?: string | undefined;
+        allowed_tools?: string[] | undefined;
+        permission_mode?: "ask" | "deny" | "trust" | "acceptEdits" | "plan" | "auto" | "bypassPermissions" | undefined;
         blockedBy?: string[] | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
@@ -22,6 +28,8 @@ declare const inputSchema: z.ZodObject<{
         id: string;
         prompt: string;
         description?: string | undefined;
+        allowed_tools?: string[] | undefined;
+        permission_mode?: "ask" | "deny" | "trust" | "acceptEdits" | "plan" | "auto" | "bypassPermissions" | undefined;
         blockedBy?: string[] | undefined;
     }[];
 }, {
@@ -29,6 +37,8 @@ declare const inputSchema: z.ZodObject<{
         id: string;
         prompt: string;
         description?: string | undefined;
+        allowed_tools?: string[] | undefined;
+        permission_mode?: "ask" | "deny" | "trust" | "acceptEdits" | "plan" | "auto" | "bypassPermissions" | undefined;
         blockedBy?: string[] | undefined;
     }[];
 }>;

package/dist/tools/ParallelAgentTool/index.js

@@ -5,6 +5,11 @@ const taskSchema = z.object({
     prompt: z.string(),
     description: z.string().optional(),
     blockedBy: z.array(z.string()).optional(),
+    allowed_tools: z.array(z.string()).optional(),
+    permission_mode: z
+        .enum(["ask", "trust", "deny", "acceptEdits", "plan", "auto", "bypassPermissions"])
+        .optional()
+        .describe("Restrict THIS task's permission mode. Narrowing-only — clamps to the outer mode if a less-restrictive value is requested. Use to mark a single task as read-only review/audit while sibling tasks keep full write access."),
 });
 const inputSchema = z.object({
     tasks: z.array(taskSchema).min(1),
@@ -27,7 +32,18 @@ export const ParallelAgentTool = {
         const systemPrompt = context.systemPrompt ?? "You are a sub-agent. Complete the delegated task concisely.";
         const dispatcher = new AgentDispatcher(context.provider, context.tools, systemPrompt, context.permissionMode ?? "trust", context.model, context.workingDir, context.abortSignal, 4, // maxConcurrency default
         context.callId, context.emitChildEvent);
-        dispatcher.addTasks(input.tasks);
+        // Map snake_case input fields to the AgentTask camelCase shape — the
+        // input schema uses `allowed_tools` / `permission_mode` to stay
+        // consistent with AgentTool, but the dispatcher's task type uses
+        // `allowedTools` / `permissionMode`.
+        dispatcher.addTasks(input.tasks.map((t) => ({
+            id: t.id,
+            prompt: t.prompt,
+            description: t.description,
+            blockedBy: t.blockedBy,
+            allowedTools: t.allowed_tools,
+            permissionMode: t.permission_mode,
+        })));
         const results = await dispatcher.execute();
         const output = results
             .map((r) => {
@@ -48,12 +64,13 @@ Parameters:
   - prompt (string): Instructions for the sub-agent
   - description (string, optional): Short label
   - blockedBy (string[], optional): IDs of tasks that must complete first
+  - allowed_tools (string[], optional): Restrict THIS task's agent to specific tools
+  - permission_mode (string, optional): Override THIS task's permission mode. Narrowing-only — a less-restrictive value clamps to the outer mode. Useful for marking review/audit tasks as "plan" or "deny" while sibling tasks keep full write access.
 
-Example: Run task A and B in parallel, then task C after both complete:
+Example: parallel test-write + read-only review:
 tasks: [
-  { id: "a", prompt: "..." },
-  { id: "b", prompt: "..." },
-  { id: "c", prompt: "...", blockedBy: ["a", "b"] }
+  { id: "tests", prompt: "Add tests for the new auth module" },
+  { id: "review", prompt: "Audit the new auth module for security issues", permission_mode: "plan" }
 ]`;
     },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhijiewang/openharness",
-  "version": "2.37.0",
+  "version": "2.38.0",
   "description": "Open-source terminal coding agent. Works with any LLM.",
   "type": "module",
   "bin": {