chainlesschain 0.166.81 → 0.166.83

package/src/repl/agent-repl.js

@@ -18,6 +18,11 @@
  */
 
 import readline from "readline";
+import {
+  captureAgentExecutionPolicy,
+  resolveAgentToolSelection,
+} from "../lib/agent-execution-policy.js";
+import { createReplToolExecutor } from "./repl-tool-executor.js";
 import chalk from "chalk";
 import fs from "fs";
 import os from "os";
@@ -151,7 +156,6 @@ import {
   AGENT_TOOLS,
   buildSystemPrompt,
   chatWithTools,
-  executeTool as coreExecuteTool,
   agentLoop as coreAgentLoop,
   formatToolArgs,
   killAllBackgroundShellTasks,
@@ -486,6 +490,10 @@ let _respondToBash;
 // ApprovalGate confirm) instead of fast-pathing it. false = unset → off.
 let _classifyAllShell = false;
 let _sandbox = null;
+let _toolAdmission = null;
+let _shellPolicyOverrides = null;
+let _directToolExecutor = null;
+let _unattendedActionPolicy = null;
 // Bounded log of tool calls the agent was BLOCKED from running this session
 // (shell-policy / ApprovalGate / settings rule / hook). Surfaced by
 // `/permissions denials` and mirrored to `cc permissions recent`.
@@ -590,20 +598,9 @@ async function _persistAlwaysAllow(tool, args) {
  * Execute a tool call — delegates to agent-core with REPL's hookDb and cwd.
  */
 async function executeTool(name, args, context = {}) {
-  return coreExecuteTool(name, args, {
-    hookDb: _hookDb,
-    cwd: process.cwd(),
-    approvalGate: _approvalGate,
-    permissionRules: _permissionRules,
-    permissionRulesProvider: _permissionRulesProvider,
-    permissionConfirm: _permissionConfirm,
-    settingsHooks: _settingsHooks,
-    classifyAllShell: _classifyAllShell,
-    sandbox: _sandbox,
-    sessionId: context.sessionId || null,
-    sessionBudget: context.sessionBudget || null,
-    signal: context.signal || null,
-  });
+  if (!_directToolExecutor)
+    throw new Error("REPL tool executor is unavailable");
+  return _directToolExecutor(name, args, context);
 }
 
 /**
@@ -613,6 +610,12 @@ async function executeTool(name, args, context = {}) {
  * unit-testable via the `options._coreLoop` injection seam.
  */
 export async function agentLoop(messages, options) {
+  const executionPolicy = captureAgentExecutionPolicy(options);
+  options = {
+    ...options,
+    ...executionPolicy,
+    ...resolveAgentToolSelection(executionPolicy),
+  };
   const evolutionIngress =
     options.evolutionIngress == null
       ? null
@@ -2931,6 +2934,11 @@ export function resolveReplPermanentMemoryStorage(
 
 /** Start the agentic REPL with non-overridable production bindings. */
 export async function startAgentRepl(options = {}) {
+  const executionPolicy = captureAgentExecutionPolicy(options);
+  options = {
+    ...options,
+    ...executionPolicy,
+  };
   const evolutionIngress =
     options.evolutionIngress == null
       ? null
@@ -3284,6 +3292,10 @@ async function startAgentReplInWorkspaceOwned(
   // tier but additionally activates the autoMode.decisions classifier wrapper
   // (when settings customize it) — gateTierFor() maps mode → real gate tier.
   let _sessionTier = "strict";
+  const setSessionTier = (mode) => {
+    _sessionTier = mode;
+    _approvalGate?.setActive?.(mode === "auto");
+  };
   // `/goal <condition>`: an optional SESSION completion condition. When set, the
   // condition is evaluated + reported after each turn (interactive — no auto
   // re-drive; that autonomous loop is headless-only). null = no session goal.
@@ -3295,7 +3307,8 @@ async function startAgentReplInWorkspaceOwned(
   const _dontAskActive = () => _sessionTier === "dontAsk";
   // Resolved autoMode.decisions map (loaded once at startup); null until the
   // gate is wired. The wrapper is installed only when settings customize the
-  // map, and only bites while _sessionTier === "auto" (isActive predicate).
+  // map, and only bites while _sessionTier === "auto". All mode commits use
+  // setSessionTier so even auto → trusted → auto has an irreversible revision.
   let _autoModeResolved = null;
   // `/remote-control` (批17/18 REPL 收口): paired-device approvals for this
   // interactive session. Holds { bridge, pairing, close } while active; both
@@ -3365,6 +3378,21 @@ async function startAgentReplInWorkspaceOwned(
     ? options.additionalDirectories
     : [];
   _sandbox = options.sandbox || null;
+  _toolAdmission = options.toolAdmission;
+  _shellPolicyOverrides = options.shellPolicyOverrides;
+  _classifyAllShell = options.classifyAllShell === true;
+  const toolSelection = resolveAgentToolSelection(options);
+  _directToolExecutor = createReplToolExecutor(options, () => ({
+    hookDb: _hookDb,
+    cwd: process.cwd(),
+    approvalGate: _approvalGate,
+    permissionRules: _permissionRules,
+    permissionRulesProvider: _permissionRulesProvider,
+    permissionConfirm: _permissionConfirm,
+    settingsHooks: _settingsHooks,
+    classifyAllShell: _classifyAllShell,
+  }));
+  _unattendedActionPolicy = options.unattendedActionPolicy;
   // Snapshot the work tree before each mutating tool (git engine) so the user
   // can `cc checkpoint restore` to just before any tool call.
   const autoCheckpoint = options.autoCheckpoint === true;
@@ -3592,7 +3620,7 @@ async function startAgentReplInWorkspaceOwned(
         _approvalGate = createAutoModeApprovalGate(
           _approvalGate,
           _autoModeResolved,
-          { isActive: () => _sessionTier === "auto" },
+          { active: _sessionTier === "auto" },
         );
       }
     } catch (_err) {
@@ -3723,6 +3751,7 @@ async function startAgentReplInWorkspaceOwned(
     });
     // Claude-Code 2.1.193 autoMode.classifyAllShell (default OFF when unset).
     _classifyAllShell =
+      _classifyAllShell ||
       readBooleanSetting("autoMode.classifyAllShell", {
         cwd: process.cwd(),
       }) === true;
@@ -4684,7 +4713,7 @@ async function startAgentReplInWorkspaceOwned(
       const applied = parsePermissionTier(
         _bundleResolved.approvalPolicy.default,
       );
-      if (applied) _sessionTier = applied;
+      if (applied) setSessionTier(applied);
     } catch (error) {
       logger.warn(`Bundle approval policy was not persisted: ${error.message}`);
     }
@@ -4701,11 +4730,9 @@ async function startAgentReplInWorkspaceOwned(
       try {
         await _approvalGate.setSessionPolicy(sessionId, parsed.tier);
         await _approvalGate.awaitPersistence?.();
-        _sessionTier = parsed.auto
-          ? "auto"
-          : parsed.dontAsk
-            ? "dontAsk"
-            : parsed.tier;
+        setSessionTier(
+          parsed.auto ? "auto" : parsed.dontAsk ? "dontAsk" : parsed.tier,
+        );
       } catch (error) {
         logger.warn(`Approval policy was not persisted: ${error.message}`);
       }
@@ -5418,7 +5445,7 @@ async function startAgentReplInWorkspaceOwned(
           try {
             await _approvalGate.setSessionPolicy(sessionId, next);
             await _approvalGate.awaitPersistence?.();
-            _sessionTier = next;
+            setSessionTier(next);
             process.stdout.write(
               "\n" +
                 chalk.cyan(`⇥ approval: ${next}`) +
@@ -8850,11 +8877,9 @@ async function startAgentReplInWorkspaceOwned(
           try {
             await _approvalGate.setSessionPolicy(sessionId, parsed.tier);
             await _approvalGate.awaitPersistence?.();
-            _sessionTier = parsed.auto
-              ? "auto"
-              : parsed.dontAsk
-                ? "dontAsk"
-                : parsed.tier;
+            setSessionTier(
+              parsed.auto ? "auto" : parsed.dontAsk ? "dontAsk" : parsed.tier,
+            );
             logger.info(
               `Approval policy → ${chalk.cyan(_sessionTier)} ${chalk.gray(`(${describeTier(_sessionTier)})`)}`,
             );
@@ -9688,7 +9713,11 @@ async function startAgentReplInWorkspaceOwned(
         skillOutcomeIndex: options.skillOutcomeIndex,
         cwd: process.cwd(),
         additionalDirectories,
+        ...toolSelection,
         sandbox: _sandbox,
+        toolAdmission: _toolAdmission,
+        shellPolicyOverrides: _shellPolicyOverrides,
+        unattendedActionPolicy: _unattendedActionPolicy,
         autoCheckpoint,
         checkpointSession: sessionId,
         managedCheckpoint,

package/src/repl/repl-tool-executor.js

@@ -0,0 +1,39 @@
+import {
+  captureAgentExecutionPolicy,
+  resolveAgentToolSelection,
+} from "../lib/agent-execution-policy.js";
+import {
+  executeTool as coreExecuteTool,
+  getAgentToolDefinitions,
+} from "../runtime/agent-core.js";
+
+/** Direct /auto and /plan tools share the startup ceiling and live permissions. */
+export function createReplToolExecutor(options, readLiveContext) {
+  const policy = captureAgentExecutionPolicy(options);
+  const selection = resolveAgentToolSelection(policy);
+  const ceiling =
+    selection.enabledToolNames !== null || selection.disabledTools.length > 0
+      ? Object.freeze(
+          getAgentToolDefinitions({
+            names: selection.enabledToolNames,
+            disabledTools: selection.disabledTools,
+            exactToolNames: true,
+          }).map((tool) => tool.function.name),
+        )
+      : null;
+  return (name, args, context = {}) => {
+    const live = readLiveContext();
+    return coreExecuteTool(name, args, {
+      ...live,
+      ...policy,
+      // Managed settings may tighten the explicit startup option while the
+      // REPL loads. Neither source can turn off the other's classifier.
+      classifyAllShell:
+        policy.classifyAllShell === true || live.classifyAllShell === true,
+      effectiveAllowedToolNames: ceiling,
+      sessionId: context.sessionId || null,
+      sessionBudget: context.sessionBudget || null,
+      signal: context.signal || null,
+    });
+  };
+}