cyrus-edge-worker 0.0.28 → 0.0.30

package/dist/EdgeWorker.js

@@ -3,8 +3,9 @@ import { mkdir, readdir, readFile, rename, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { LinearClient, } from "@linear/sdk";
-import { ClaudeRunner, getAllTools, getCoordinatorTools, getReadOnlyTools, getSafeTools, } from "cyrus-claude-runner";
+import { ClaudeRunner, createCyrusToolsServer, getAllTools, getCoordinatorTools, getReadOnlyTools, getSafeTools, } from "cyrus-claude-runner";
 import { isAgentSessionCreatedWebhook, isAgentSessionPromptedWebhook, isIssueAssignedWebhook, isIssueCommentMentionWebhook, isIssueNewCommentWebhook, isIssueUnassignedWebhook, PersistenceManager, } from "cyrus-core";
+import { LinearWebhookClient } from "cyrus-linear-webhook-client";
 import { NdjsonClient } from "cyrus-ndjson-client";
 import { fileTypeFromBuffer } from "file-type";
 import { AgentSessionManager } from "./AgentSessionManager.js";
@@ -65,7 +66,7 @@ export class EdgeWorker extends EventEmitter {
                     const parentId = this.childToParentAgentSession.get(childSessionId);
                     console.log(`[Parent-Child Lookup] Child ${childSessionId} -> Parent ${parentId || "not found"}`);
                     return parentId;
-                }, async (parentSessionId, prompt) => {
+                }, async (parentSessionId, prompt, childSessionId) => {
                     console.log(`[Parent Session Resume] Child session completed, resuming parent session ${parentSessionId}`);
                     // Get the parent session and repository
                     // This works because by the time this callback runs, agentSessionManager is fully initialized
@@ -76,12 +77,23 @@ export class EdgeWorker extends EventEmitter {
                         return;
                     }
                     console.log(`[Parent Session Resume] Found parent session - Issue: ${parentSession.issueId}, Workspace: ${parentSession.workspace.path}`);
+                    // Get the child session to access its workspace path
+                    const childSession = agentSessionManager.getSession(childSessionId);
+                    const childWorkspaceDirs = [];
+                    if (childSession) {
+                        childWorkspaceDirs.push(childSession.workspace.path);
+                        console.log(`[Parent Session Resume] Adding child workspace to parent allowed directories: ${childSession.workspace.path}`);
+                    }
+                    else {
+                        console.warn(`[Parent Session Resume] Could not find child session ${childSessionId} to add workspace to parent allowed directories`);
+                    }
                     await this.postParentResumeAcknowledgment(parentSessionId, repo.id);
                     // Resume the parent session with the child's result
                     console.log(`[Parent Session Resume] Resuming parent Claude session with child results`);
                     try {
                         await this.resumeClaudeSession(parentSession, repo, parentSessionId, agentSessionManager, prompt, "", // No attachment manifest for child results
-                        false);
+                        false, // Not a new session
+                        childWorkspaceDirs);
                         console.log(`[Parent Session Resume] Successfully resumed parent session ${parentSessionId} with child results`);
                     }
                     catch (error) {
@@ -107,7 +119,9 @@ export class EdgeWorker extends EventEmitter {
             if (!firstRepo)
                 continue;
             const primaryRepoId = firstRepo.id;
-            const ndjsonClient = new NdjsonClient({
+            // Determine which client to use based on environment variable
+            const useLinearDirectWebhooks = process.env.LINEAR_DIRECT_WEBHOOKS === "true";
+            const clientConfig = {
                 proxyUrl: config.proxyUrl,
                 token: token,
                 name: repos.map((r) => r.name).join(", "), // Pass repository names
@@ -125,11 +139,20 @@ export class EdgeWorker extends EventEmitter {
                 onConnect: () => this.handleConnect(primaryRepoId, repos),
                 onDisconnect: (reason) => this.handleDisconnect(primaryRepoId, repos, reason),
                 onError: (error) => this.handleError(error),
-            });
-            // Set up webhook handler - data should be the native webhook payload
-            ndjsonClient.on("webhook", (data) => this.handleWebhook(data, repos));
-            // Optional heartbeat logging
-            if (process.env.DEBUG_EDGE === "true") {
+            };
+            // Create the appropriate client based on configuration
+            const ndjsonClient = useLinearDirectWebhooks
+                ? new LinearWebhookClient({
+                    ...clientConfig,
+                    onWebhook: (payload) => this.handleWebhook(payload, repos),
+                })
+                : new NdjsonClient(clientConfig);
+            // Set up webhook handler for NdjsonClient (LinearWebhookClient uses onWebhook in constructor)
+            if (!useLinearDirectWebhooks) {
+                ndjsonClient.on("webhook", (data) => this.handleWebhook(data, repos));
+            }
+            // Optional heartbeat logging (only for NdjsonClient)
+            if (process.env.DEBUG_EDGE === "true" && !useLinearDirectWebhooks) {
                 ndjsonClient.on("heartbeat", () => {
                     console.log(`❤️ Heartbeat received for token ending in ...${token.slice(-4)}`);
                 });
@@ -483,6 +506,7 @@ export class EdgeWorker extends EventEmitter {
         console.log(`[EdgeWorker] Configured allowed directories for ${fullIssue.identifier}:`, allowedDirectories);
         // Build allowed tools list with Linear MCP tools
         const allowedTools = this.buildAllowedTools(repository);
+        const disallowedTools = this.buildDisallowedTools(repository);
         return {
             session,
             fullIssue,
@@ -491,6 +515,7 @@ export class EdgeWorker extends EventEmitter {
             attachmentsDir,
             allowedDirectories,
             allowedTools,
+            disallowedTools,
         };
     }
     /**
@@ -508,6 +533,8 @@ export class EdgeWorker extends EventEmitter {
         // HACK: This is required since the comment body is always populated, thus there is no other way to differentiate between the two trigger events
         const AGENT_SESSION_MARKER = "This thread is for an agent session";
         const isMentionTriggered = commentBody && !commentBody.includes(AGENT_SESSION_MARKER);
+        // Check if the comment contains the /label-based-prompt command
+        const isLabelBasedPromptRequested = commentBody?.includes("/label-based-prompt");
         // Initialize the agent session in AgentSessionManager
         const agentSessionManager = this.agentSessionManagers.get(repository.id);
         if (!agentSessionManager) {
@@ -522,12 +549,12 @@ export class EdgeWorker extends EventEmitter {
         const { session, fullIssue, workspace: _workspace, attachmentResult, attachmentsDir: _attachmentsDir, allowedDirectories, } = sessionData;
         // Fetch labels (needed for both model selection and system prompt determination)
         const labels = await this.fetchIssueLabels(fullIssue);
-        // Only determine system prompt for delegation (not mentions)
+        // Only determine system prompt for delegation (not mentions) or when /label-based-prompt is requested
         let systemPrompt;
         let systemPromptVersion;
         let promptType;
-        if (!isMentionTriggered) {
-            // Determine system prompt based on labels (delegation case)
+        if (!isMentionTriggered || isLabelBasedPromptRequested) {
+            // Determine system prompt based on labels (delegation case or /label-based-prompt command)
             const systemPromptResult = await this.determineSystemPromptFromLabels(labels, repository);
             systemPrompt = systemPromptResult?.prompt;
             systemPromptVersion = systemPromptResult?.version;
@@ -542,10 +569,13 @@ export class EdgeWorker extends EventEmitter {
         }
         // Build allowed tools list with Linear MCP tools (now with prompt type context)
         const allowedTools = this.buildAllowedTools(repository, promptType);
+        const disallowedTools = this.buildDisallowedTools(repository, promptType);
         console.log(`[EdgeWorker] Configured allowed tools for ${fullIssue.identifier}:`, allowedTools);
+        if (disallowedTools.length > 0) {
+            console.log(`[EdgeWorker] Configured disallowed tools for ${fullIssue.identifier}:`, disallowedTools);
+        }
         // Create Claude runner with attachment directory access and optional system prompt
-        const runnerConfig = this.buildClaudeRunnerConfig(session, repository, linearAgentActivitySessionId, agentSessionManager, systemPrompt, allowedTools, allowedDirectories, undefined, // resumeSessionId
-        linearAgentActivitySessionId, // Pass current session ID as parent context
+        const runnerConfig = this.buildClaudeRunnerConfig(session, repository, linearAgentActivitySessionId, systemPrompt, allowedTools, allowedDirectories, disallowedTools, undefined, // resumeSessionId
         labels);
         const runner = new ClaudeRunner(runnerConfig);
         // Store runner by comment ID
@@ -559,11 +589,13 @@ export class EdgeWorker extends EventEmitter {
         console.log(`[EdgeWorker] Building initial prompt for issue ${fullIssue.identifier}`);
         try {
             // Choose the appropriate prompt builder based on trigger type and system prompt
-            const promptResult = isMentionTriggered
-                ? await this.buildMentionPrompt(fullIssue, agentSession, attachmentResult.manifest)
-                : systemPrompt
-                    ? await this.buildLabelBasedPrompt(fullIssue, repository, attachmentResult.manifest)
-                    : await this.buildPromptV2(fullIssue, repository, undefined, attachmentResult.manifest);
+            const promptResult = isMentionTriggered && isLabelBasedPromptRequested
+                ? await this.buildLabelBasedPrompt(fullIssue, repository, attachmentResult.manifest)
+                : isMentionTriggered
+                    ? await this.buildMentionPrompt(fullIssue, agentSession, attachmentResult.manifest)
+                    : systemPrompt
+                        ? await this.buildLabelBasedPrompt(fullIssue, repository, attachmentResult.manifest)
+                        : await this.buildPromptV2(fullIssue, repository, undefined, attachmentResult.manifest);
             const { prompt, version: userPromptVersion } = promptResult;
             // Update runner with version information
             if (userPromptVersion || systemPromptVersion) {
@@ -572,11 +604,13 @@ export class EdgeWorker extends EventEmitter {
                     systemPromptVersion,
                 });
             }
-            const promptType = isMentionTriggered
-                ? "mention"
-                : systemPrompt
-                    ? "label-based"
-                    : "fallback";
+            const promptType = isMentionTriggered && isLabelBasedPromptRequested
+                ? "label-based-prompt-command"
+                : isMentionTriggered
+                    ? "mention"
+                    : systemPrompt
+                        ? "label-based"
+                        : "fallback";
             console.log(`[EdgeWorker] Initial prompt built successfully using ${promptType} workflow, length: ${prompt.length} characters`);
             console.log(`[EdgeWorker] Starting Claude streaming session`);
             const sessionInfo = await runner.startStreaming(prompt);
@@ -703,7 +737,7 @@ export class EdgeWorker extends EventEmitter {
         }
         // Use the new resumeClaudeSession function
         try {
-            await this.resumeClaudeSession(session, repository, linearAgentActivitySessionId, agentSessionManager, promptBody, attachmentManifest, isNewSession);
+            await this.resumeClaudeSession(session, repository, linearAgentActivitySessionId, agentSessionManager, promptBody, attachmentManifest, isNewSession, []);
         }
         catch (error) {
             console.error("Failed to continue conversation:", error);
@@ -845,6 +879,67 @@ export class EdgeWorker extends EventEmitter {
             }
             // Determine the base branch considering parent issues
             const baseBranch = await this.determineBaseBranch(issue, repository);
+            // Fetch assignee information
+            let assigneeId = "";
+            let assigneeName = "";
+            try {
+                if (issue.assigneeId) {
+                    assigneeId = issue.assigneeId;
+                    // Fetch the full assignee object to get the name
+                    const assignee = await issue.assignee;
+                    if (assignee) {
+                        assigneeName = assignee.displayName || assignee.name || "";
+                    }
+                }
+            }
+            catch (error) {
+                console.warn(`[EdgeWorker] Failed to fetch assignee details:`, error);
+            }
+            // Get LinearClient for this repository
+            const linearClient = this.linearClients.get(repository.id);
+            if (!linearClient) {
+                console.error(`No LinearClient found for repository ${repository.id}`);
+                throw new Error(`No LinearClient found for repository ${repository.id}`);
+            }
+            // Fetch workspace teams and labels
+            let workspaceTeams = "";
+            let workspaceLabels = "";
+            try {
+                console.log(`[EdgeWorker] Fetching workspace teams and labels for repository ${repository.id}`);
+                // Fetch teams
+                const teamsConnection = await linearClient.teams();
+                const teamsArray = [];
+                for (const team of teamsConnection.nodes) {
+                    teamsArray.push({
+                        id: team.id,
+                        name: team.name,
+                        key: team.key,
+                        description: team.description || "",
+                        color: team.color,
+                    });
+                }
+                workspaceTeams = teamsArray
+                    .map((team) => `- ${team.name} (${team.key}): ${team.id}${team.description ? ` - ${team.description}` : ""}`)
+                    .join("\n");
+                // Fetch labels
+                const labelsConnection = await linearClient.issueLabels();
+                const labelsArray = [];
+                for (const label of labelsConnection.nodes) {
+                    labelsArray.push({
+                        id: label.id,
+                        name: label.name,
+                        description: label.description || "",
+                        color: label.color,
+                    });
+                }
+                workspaceLabels = labelsArray
+                    .map((label) => `- ${label.name}: ${label.id}${label.description ? ` - ${label.description}` : ""}`)
+                    .join("\n");
+                console.log(`[EdgeWorker] Fetched ${teamsArray.length} teams and ${labelsArray.length} labels`);
+            }
+            catch (error) {
+                console.warn(`[EdgeWorker] Failed to fetch workspace teams and labels:`, error);
+            }
             // Build the simplified prompt with only essential variables
             let prompt = template
                 .replace(/{{repository_name}}/g, repository.name)
@@ -853,7 +948,11 @@ export class EdgeWorker extends EventEmitter {
                 .replace(/{{issue_identifier}}/g, issue.identifier || "")
                 .replace(/{{issue_title}}/g, issue.title || "")
                 .replace(/{{issue_description}}/g, issue.description || "No description provided")
-                .replace(/{{issue_url}}/g, issue.url || "");
+                .replace(/{{issue_url}}/g, issue.url || "")
+                .replace(/{{assignee_id}}/g, assigneeId)
+                .replace(/{{assignee_name}}/g, assigneeName)
+                .replace(/{{workspace_teams}}/g, workspaceTeams)
+                .replace(/{{workspace_labels}}/g, workspaceLabels);
             if (attachmentManifest) {
                 console.log(`[EdgeWorker] Adding attachment manifest to label-based prompt, length: ${attachmentManifest.length} characters`);
                 prompt = `${prompt}\n\n${attachmentManifest}`;
@@ -1267,26 +1366,6 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
      * @param issue Full Linear issue object from Linear SDK
      * @param repositoryId Repository ID for Linear client lookup
      */
-    /**
-     * Get the repository configuration for a given session
-     */
-    getRepositoryForSession(session) {
-        // Find the repository that matches the session's workspace path
-        for (const repo of this.config.repositories) {
-            if (session.workspace.path.includes(repo.workspaceBaseDir)) {
-                return repo;
-            }
-        }
-        // Fallback: try to find by issue ID in Linear client
-        for (const [repoId, _] of this.linearClients) {
-            const repo = this.config.repositories.find((r) => r.id === repoId);
-            if (repo) {
-                // Additional checks could be added here if needed
-                return repo;
-            }
-        }
-        return undefined;
-    }
     async moveIssueToStartedState(issue, repositoryId) {
         try {
             const linearClient = this.linearClients.get(repositoryId);
@@ -1387,7 +1466,8 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
         if (!text)
             return [];
         // Match URLs that start with https://uploads.linear.app
-        const regex = /https:\/\/uploads\.linear\.app\/[^\s<>"')]+/gi;
+        // Exclude brackets and parentheses to avoid capturing malformed markdown link syntax
+        const regex = /https:\/\/uploads\.linear\.app\/[a-zA-Z0-9/_.-]+/gi;
         const matches = text.match(regex) || [];
         // Remove duplicates
         return [...new Set(matches)];
@@ -1409,7 +1489,7 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
             let imageCount = 0;
             let skippedCount = 0;
             let failedCount = 0;
-            const maxAttachments = 10;
+            const maxAttachments = 20;
             // Ensure directory exists
             await mkdir(attachmentsDir, { recursive: true });
             // Extract URLs from issue description
@@ -1574,7 +1654,7 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
         let newAttachmentCount = 0;
         let newImageCount = 0;
         let failedCount = 0;
-        const maxAttachments = 10;
+        const maxAttachments = 20;
         // Extract URLs from the comment
         const urls = this.extractAttachmentUrls(commentBody);
         if (urls.length === 0) {
@@ -1742,9 +1822,9 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
         return manifest;
     }
     /**
-     * Build MCP configuration with automatic Linear server injection
+     * Build MCP configuration with automatic Linear server injection and inline cyrus tools
      */
-    buildMcpConfig(repository) {
+    buildMcpConfig(repository, parentSessionId) {
         // Always inject the Linear MCP servers with the repository's token
         const mcpConfig = {
             linear: {
@@ -1755,14 +1835,58 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
                     LINEAR_API_TOKEN: repository.linearToken,
                 },
             },
-            "cyrus-mcp-tools": {
-                type: "stdio",
-                command: "npx",
-                args: ["-y", "cyrus-mcp-tools"],
-                env: {
-                    LINEAR_API_TOKEN: repository.linearToken,
+            "cyrus-tools": createCyrusToolsServer(repository.linearToken, {
+                parentSessionId,
+                onSessionCreated: (childSessionId, parentId) => {
+                    console.log(`[EdgeWorker] Agent session created: ${childSessionId}, mapping to parent ${parentId}`);
+                    // Map child to parent session
+                    this.childToParentAgentSession.set(childSessionId, parentId);
+                    console.log(`[EdgeWorker] Parent-child mapping updated: ${this.childToParentAgentSession.size} mappings`);
                 },
-            },
+                onFeedbackDelivery: async (childSessionId, message) => {
+                    console.log(`[EdgeWorker] Processing feedback delivery to child session ${childSessionId}`);
+                    // Find the repository containing the child session
+                    // We need to search all repositories for this child session
+                    let childRepo;
+                    let childAgentSessionManager;
+                    for (const [repoId, manager] of this.agentSessionManagers) {
+                        if (manager.hasClaudeRunner(childSessionId)) {
+                            childRepo = this.repositories.get(repoId);
+                            childAgentSessionManager = manager;
+                            break;
+                        }
+                    }
+                    if (!childRepo || !childAgentSessionManager) {
+                        console.error(`[EdgeWorker] Child session ${childSessionId} not found in any repository`);
+                        return false;
+                    }
+                    // Get the child session
+                    const childSession = childAgentSessionManager.getSession(childSessionId);
+                    if (!childSession) {
+                        console.error(`[EdgeWorker] Child session ${childSessionId} not found`);
+                        return false;
+                    }
+                    console.log(`[EdgeWorker] Found child session - Issue: ${childSession.issueId}`);
+                    // Format the feedback as a prompt for the child session with enhanced markdown formatting
+                    const feedbackPrompt = `## Received feedback from orchestrator\n\n---\n\n${message}\n\n---`;
+                    // Resume the CHILD session with the feedback from the parent
+                    // Important: We don't await the full session completion to avoid timeouts.
+                    // The feedback is delivered immediately when the session starts, so we can
+                    // return success right away while the session continues in the background.
+                    this.resumeClaudeSession(childSession, childRepo, childSessionId, childAgentSessionManager, feedbackPrompt, "", // No attachment manifest for feedback
+                    false, // Not a new session
+                    [])
+                        .then(() => {
+                        console.log(`[EdgeWorker] Child session ${childSessionId} completed processing feedback`);
+                    })
+                        .catch((error) => {
+                        console.error(`[EdgeWorker] Failed to complete child session with feedback:`, error);
+                    });
+                    // Return success immediately after initiating the session
+                    console.log(`[EdgeWorker] Feedback delivered successfully to child session ${childSessionId}`);
+                    return true;
+                },
+            }),
         };
         return mcpConfig;
     }
@@ -1808,85 +1932,20 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
     /**
      * Build Claude runner configuration with common settings
      */
-    buildClaudeRunnerConfig(session, repository, linearAgentActivitySessionId, agentSessionManager, systemPrompt, allowedTools, allowedDirectories, resumeSessionId, parentAgentSessionId, labels) {
-        // Build hooks configuration
+    buildClaudeRunnerConfig(session, repository, linearAgentActivitySessionId, systemPrompt, allowedTools, allowedDirectories, disallowedTools, resumeSessionId, labels) {
+        // Configure PostToolUse hook for playwright screenshots
         const hooks = {
             PostToolUse: [
                 {
-                    matcher: "mcp__cyrus-mcp-tools__linear_agent_session_create",
+                    matcher: "playwright_screenshot",
                     hooks: [
-                        async (input, _toolUseID, _options) => {
-                            // Check if this is the linear_agent_session_create tool
-                            if (input.tool_name ===
-                                "mcp__cyrus-mcp-tools__linear_agent_session_create") {
-                                const toolResponse = input.tool_response;
-                                // The response is an array with a single object containing type and text fields
-                                // Parse the JSON from the text field to get the agentSessionId
-                                if (Array.isArray(toolResponse) &&
-                                    toolResponse.length > 0 &&
-                                    toolResponse[0].type === "text" &&
-                                    toolResponse[0].text) {
-                                    try {
-                                        const responseData = JSON.parse(toolResponse[0].text);
-                                        const childAgentSessionId = responseData.agentSessionId;
-                                        // If there's a parent session, create the mapping
-                                        if (parentAgentSessionId && childAgentSessionId) {
-                                            console.log(`[Parent-Child Mapping] Creating: child ${childAgentSessionId} -> parent ${parentAgentSessionId}`);
-                                            this.childToParentAgentSession.set(childAgentSessionId, parentAgentSessionId);
-                                            console.log(`[Parent-Child Mapping] Successfully created. Total mappings: ${this.childToParentAgentSession.size}`);
-                                            // Save state after adding new mapping
-                                            this.savePersistedState().catch((error) => {
-                                                console.error(`[Parent-Child Mapping] Failed to save state after creating mapping:`, error);
-                                            });
-                                        }
-                                    }
-                                    catch (error) {
-                                        console.error(`[Parent-Child Mapping] Failed to parse agentSessionId from tool response:`, error);
-                                    }
-                                }
-                            }
-                            return { continue: true };
-                        },
-                    ],
-                },
-                {
-                    matcher: "mcp__cyrus-mcp-tools__linear_agent_give_feedback",
-                    hooks: [
-                        async (input, _toolUseID, _options) => {
-                            // Check if this is the give_feedback tool
-                            if (input.tool_name ===
-                                "mcp__cyrus-mcp-tools__linear_agent_give_feedback") {
-                                const toolInput = input.tool_input;
-                                const childAgentSessionId = toolInput?.agentSessionId;
-                                const feedbackMessage = toolInput?.message;
-                                if (childAgentSessionId && feedbackMessage) {
-                                    console.log(`[Give Feedback] Triggering child session resumption: ${childAgentSessionId}`);
-                                    // Get the child session
-                                    const childSession = agentSessionManager.getSession(childAgentSessionId);
-                                    if (!childSession) {
-                                        console.error(`[Give Feedback] Child session not found: ${childAgentSessionId}`);
-                                        return { continue: true };
-                                    }
-                                    // Find the repository for this session
-                                    const repo = this.getRepositoryForSession(childSession);
-                                    if (!repo) {
-                                        console.error(`[Give Feedback] Repository not found for child session: ${childAgentSessionId}`);
-                                        return { continue: true };
-                                    }
-                                    // Prepare the prompt with the feedback message and child session ID
-                                    const prompt = `Feedback from parent session regarding child agent session ${childAgentSessionId}:\n\n${feedbackMessage}`;
-                                    // Resume the child session with the feedback
-                                    try {
-                                        await this.resumeClaudeSession(childSession, repo, childAgentSessionId, agentSessionManager, prompt, "", // No attachment manifest for feedback
-                                        false);
-                                        console.log(`[Give Feedback] Successfully resumed child session ${childAgentSessionId} with feedback`);
-                                    }
-                                    catch (error) {
-                                        console.error(`[Give Feedback] Failed to resume child session ${childAgentSessionId}:`, error);
-                                    }
-                                }
-                            }
-                            return { continue: true };
+                        async (input, _toolUseID, { signal: _signal }) => {
+                            const postToolUseInput = input;
+                            console.log(`Tool ${postToolUseInput.tool_name} completed with response:`, postToolUseInput.tool_response);
+                            return {
+                                continue: true,
+                                additionalContext: "Screenshot taken successfully. You should use the Read tool to view the screenshot file to analyze the visual content.",
+                            };
                         },
                     ],
                 },
@@ -1912,7 +1971,7 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
             }
             // If a model override is found, also set a reasonable fallback
             if (modelOverride) {
-                // Set fallback to the next lower tier: opus->sonnet, sonnet->haiku, haiku->haiku
+                // Set fallback to the next lower tier: opus->sonnet, sonnet->haiku, haiku->sonnet
                 if (modelOverride === "opus") {
                     fallbackModelOverride = "sonnet";
                 }
@@ -1920,18 +1979,19 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
                     fallbackModelOverride = "haiku";
                 }
                 else {
-                    fallbackModelOverride = "haiku";
+                    fallbackModelOverride = "sonnet"; // haiku falls back to sonnet since same model retry doesn't help
                 }
             }
         }
         const config = {
             workingDirectory: session.workspace.path,
             allowedTools,
+            disallowedTools,
             allowedDirectories,
             workspaceName: session.issue?.identifier || session.issueId,
             cyrusHome: this.cyrusHome,
             mcpConfigPath: repository.mcpConfigPath,
-            mcpConfig: this.buildMcpConfig(repository),
+            mcpConfig: this.buildMcpConfig(repository, linearAgentActivitySessionId),
             appendSystemPrompt: (systemPrompt || "") + LAST_MESSAGE_MARKER,
             // Priority order: label override > repository config > global default
             model: modelOverride || repository.model || this.config.defaultModel,
@@ -1949,6 +2009,44 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
         }
         return config;
     }
+    /**
+     * Build disallowed tools list following the same hierarchy as allowed tools
+     */
+    buildDisallowedTools(repository, promptType) {
+        let disallowedTools = [];
+        let toolSource = "";
+        // Priority order (same as allowedTools):
+        // 1. Repository-specific prompt type configuration
+        if (promptType && repository.labelPrompts?.[promptType]?.disallowedTools) {
+            disallowedTools = repository.labelPrompts[promptType].disallowedTools;
+            toolSource = `repository label prompt (${promptType})`;
+        }
+        // 2. Global prompt type defaults
+        else if (promptType &&
+            this.config.promptDefaults?.[promptType]?.disallowedTools) {
+            disallowedTools = this.config.promptDefaults[promptType].disallowedTools;
+            toolSource = `global prompt defaults (${promptType})`;
+        }
+        // 3. Repository-level disallowed tools
+        else if (repository.disallowedTools) {
+            disallowedTools = repository.disallowedTools;
+            toolSource = "repository configuration";
+        }
+        // 4. Global default disallowed tools
+        else if (this.config.defaultDisallowedTools) {
+            disallowedTools = this.config.defaultDisallowedTools;
+            toolSource = "global defaults";
+        }
+        // 5. No defaults for disallowedTools (as per requirements)
+        else {
+            disallowedTools = [];
+            toolSource = "none (no defaults)";
+        }
+        if (disallowedTools.length > 0) {
+            console.log(`[EdgeWorker] Disallowed tools for ${repository.name}: ${disallowedTools.length} tools from ${toolSource}`);
+        }
+        return disallowedTools;
+    }
     /**
      * Build allowed tools list with Linear MCP tools automatically included
      */
@@ -1984,7 +2082,7 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
         }
         // Linear MCP tools that should always be available
         // See: https://docs.anthropic.com/en/docs/claude-code/iam#tool-specific-permission-rules
-        const linearMcpTools = ["mcp__linear", "mcp__cyrus-mcp-tools"];
+        const linearMcpTools = ["mcp__linear", "mcp__cyrus-tools"];
         // Combine and deduplicate
         const allTools = [...new Set([...baseTools, ...linearMcpTools])];
         console.log(`[EdgeWorker] Tool selection for ${repository.name}: ${allTools.length} tools from ${toolSource}`);
@@ -2224,7 +2322,7 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
      * @param attachmentManifest Optional attachment manifest
      * @param isNewSession Whether this is a new session
      */
-    async resumeClaudeSession(session, repository, linearAgentActivitySessionId, agentSessionManager, promptBody, attachmentManifest = "", isNewSession = false) {
+    async resumeClaudeSession(session, repository, linearAgentActivitySessionId, agentSessionManager, promptBody, attachmentManifest = "", isNewSession = false, additionalAllowedDirectories = []) {
         // Check for existing runner
         const existingRunner = session.claudeRunner;
         // If there's an existing streaming runner, add to it
@@ -2256,13 +2354,17 @@ ${newComment ? `New comment to address:\n${newComment.body}\n\n` : ""}Please ana
         const promptType = systemPromptResult?.type;
         // Build allowed tools list
         const allowedTools = this.buildAllowedTools(repository, promptType);
+        const disallowedTools = this.buildDisallowedTools(repository, promptType);
         // Set up attachments directory
         const workspaceFolderName = basename(session.workspace.path);
         const attachmentsDir = join(this.cyrusHome, workspaceFolderName, "attachments");
         await mkdir(attachmentsDir, { recursive: true });
-        const allowedDirectories = [attachmentsDir];
+        const allowedDirectories = [
+            attachmentsDir,
+            ...additionalAllowedDirectories,
+        ];
         // Create runner configuration
-        const runnerConfig = this.buildClaudeRunnerConfig(session, repository, linearAgentActivitySessionId, agentSessionManager, systemPrompt, allowedTools, allowedDirectories, needsNewClaudeSession ? undefined : session.claudeSessionId, linearAgentActivitySessionId, labels);
+        const runnerConfig = this.buildClaudeRunnerConfig(session, repository, linearAgentActivitySessionId, systemPrompt, allowedTools, allowedDirectories, disallowedTools, needsNewClaudeSession ? undefined : session.claudeSessionId, labels);
         const runner = new ClaudeRunner(runnerConfig);
         // Store runner
         agentSessionManager.addClaudeRunner(linearAgentActivitySessionId, runner);