github-router 0.3.202 → 0.3.204

package/dist/browser-ext/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "name": "github-router browser bridge",
   "short_name": "gh-router-browser",
-  "version": "0.3.202",
+  "version": "0.3.204",
   "description": "Bridge between Claude (via github-router /mcp) and the browser. Implements tab control, navigation, clicks, form fill, downloads, screenshots, devtools eval. Blocks navigation to chrome://settings.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqJElxuBlonBS3TVW9FJN0mGTtShB3L1hoaYf6k39SOr1ogGYmF90EjRxy1i21k9wQQjPf26bcBu/9X67KrQjQV0uB38CaNukgiSeoLjfptN811u+PJHx6BP+jx3Qa6/3VenNPxHC8WEU0GXql8QSjIHEyCwKb6fMASXOK94JyB5Ywov2x8mt/+9ncqBBBMVzf6r5Sagy4PL1XnryLsuADD/vOEkPet8wXgH/Oj7v5tTsQQZ7U1JT51PoDs2BFnXc5v3TkVgZwd32k3ONh+nkDw1Hof+4zwUGOyJE6eMrlYzRlKM4Qxdf9JpavQvqfieAbTRWcyKeclnHeoIfE7cDBQIDAQAB",
   "background": {

package/dist/{engine-CIt6z9K3.js → engine-DI8PNfqU.js}

@@ -1,4 +1,4 @@
-import { B as runWorkerAgent, F as EXPLORE_DEFAULT_MODEL, I as IMPLEMENT_DEFAULT_MODEL, L as PLAN_DEFAULT_MODEL, N as BROWSE_DEFAULT_MODEL, P as DEFAULT_MODEL, R as REVIEW_DEFAULT_MODEL, V as withNoOutputRetry, z as appendPlanReminder } from "./peer-mcp-personas-rik0SIrg.js";
+import { B as runWorkerAgent, F as EXPLORE_DEFAULT_MODEL, I as IMPLEMENT_DEFAULT_MODEL, L as PLAN_DEFAULT_MODEL, N as BROWSE_DEFAULT_MODEL, P as DEFAULT_MODEL, R as REVIEW_DEFAULT_MODEL, V as withNoOutputRetry, z as appendPlanReminder } from "./peer-mcp-personas-BekOx3Rp.js";
 import "./paths-BO22pMUb.js";
 import "./lifecycle-D-1CYr1Y.js";
 import "./lifecycle-bPdiXjYB.js";

package/dist/main.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as buildAdvisorStream, $t as setupCopilotToken, A as trustRepo, At as readResponseBodyCapped, Bt as buildWorkspaceHeaderJson, C as fileLastPromptStore, Ct as getTokenCount, D as repoRoot, Dt as createResponses, E as repoFingerprint, Et as pickEndpoint, Ft as extractTarGzMember, G as toolbeltEnabled, Gt as DEFAULT_CODEX_MODEL_FALLBACKS, H as buildEnv, Ht as toolbeltPathOverride, It as extractZipMember, J as TOOLBELT_TOOLS, Jt as UPSTREAM_INACTIVITY_TIMEOUT_MS, K as toolbeltSkipSet, Kt as DEFAULT_PORT, Lt as shouldUseInsecureTls, M as resolveSealedGate, Mt as provisionBrowserAssets, Nt as hasSupportedBrowserInstalled, O as stopGateEnabledForRepo, Ot as createChatCompletions, Pt as provisionAndIndexColbert, Q as ADVISOR_TOOL_INSTRUCTIONS, Qt as withInstallLock, Rt as ArtifactClient, S as fileFindingsStore, St as createMessages, T as isSubagentContext, Tt as resolveMcpToolTimeoutMs, U as availableToolCommands, Ut as DEFAULT_CLAUDE_MODEL_FALLBACKS, Vt as collapsePathKeys, W as buildToolbeltAwareness, Wt as DEFAULT_CODEX_MODEL, X as searchWeb, Xt as pickClaudeDefault, Y as assetFor, Yt as generateRandomPort, Z as ADVISOR_INTERNAL_TOOL_NAME, Zt as getPackageVersion, _ as stopGateDisabled, _n as copilotBaseUrl, _t as nativeSubagentModel, a as buildPeerAwarenessSnippet, an as cacheVSCodeVersion, at as logStreamError, b as stopReviewEnabled, bn as state, bt as shimDefaultsToXhigh, c as personasFor, cn as resolveCodexModel, ct as handleMcpDelete, d as buildStopHookCommand, dn as getModels, dt as artifactToolsEnabled, en as setupGitHubAgentToken, et as injectAdvisorTool, f as captureLaunchBaseline, fn as getGitHubUser, ft as browseAgentEnabled, g as launchBaselineKey, gn as GITHUB_API_BASE_URL, gt as geminiAvailable, h as injectStopHookIntoSettingsFile, hn as forwardError, ht as fleetToolsEnabled, i as buildAgentPrompt, in as cacheModels, it as isControllerClosedError, j as liveExec, jt as parseJsonOrDiagnose, k as stopReviewStateDir, kt as MAX_RESPONSE_BODY_BYTES, l as buildArtifactOpenHookCommand, ln as resolveModel, lt as handleMcpPost, m as fileBlockBudget, mn as HTTPError, mt as browserToolsEnabled, n as MCP_GROUPS, nn as tryRefreshAndRetry, nt as buildAnthropicErrorEvent, o as buildPeerAwarenessSummary, on as filterBetaHeader, ot as readIteratorWithTimeout, p as decideStopHook, pn as fetchWithTransientRetry, pt as browserCompoundToolsEnabled, q as vscodeRipgrepPath, qt as UPSTREAM_FETCH_TIMEOUT_MS, r as assertMcpToolSurfaceConsistent, rn as cacheCopilotVersion, rt as buildOpenAIErrorEvent, s as enumerateInjectedMcpToolNames, sn as isNullish, st as relayAnthropicStream, t as GROUP_META, tn as setupGitHubToken, tt as isAdvisorRequested, u as buildSessionBindHookCommand, un as sleep$1, ut as agentToolsEnabled, v as stopGateId, vn as copilotHeaders, vt as standInToolEnabled, w as fileReviewDebounce, wt as assembleResponsesPayload, x as fileBaselineStore, xt as countTokens, y as stopGatePlanMode, yn as githubHeaders, yt as workerToolsEnabled, zt as buildWorkspaceHeaderHelperCommand } from "./peer-mcp-personas-rik0SIrg.js";
+import { $ as buildAdvisorStream, $t as setupCopilotToken, A as trustRepo, At as readResponseBodyCapped, Bt as buildWorkspaceHeaderJson, C as fileLastPromptStore, Ct as getTokenCount, D as repoRoot, Dt as createResponses, E as repoFingerprint, Et as pickEndpoint, Ft as extractTarGzMember, G as toolbeltEnabled, Gt as DEFAULT_CODEX_MODEL_FALLBACKS, H as buildEnv, Ht as toolbeltPathOverride, It as extractZipMember, J as TOOLBELT_TOOLS, Jt as UPSTREAM_INACTIVITY_TIMEOUT_MS, K as toolbeltSkipSet, Kt as DEFAULT_PORT, Lt as shouldUseInsecureTls, M as resolveSealedGate, Mt as provisionBrowserAssets, Nt as hasSupportedBrowserInstalled, O as stopGateEnabledForRepo, Ot as createChatCompletions, Pt as provisionAndIndexColbert, Q as ADVISOR_TOOL_INSTRUCTIONS, Qt as withInstallLock, Rt as ArtifactClient, S as fileFindingsStore, St as createMessages, T as isSubagentContext, Tt as resolveMcpToolTimeoutMs, U as availableToolCommands, Ut as DEFAULT_CLAUDE_MODEL_FALLBACKS, Vt as collapsePathKeys, W as buildToolbeltAwareness, Wt as DEFAULT_CODEX_MODEL, X as searchWeb, Xt as pickClaudeDefault, Y as assetFor, Yt as generateRandomPort, Z as ADVISOR_INTERNAL_TOOL_NAME, Zt as getPackageVersion, _ as stopGateDisabled, _n as copilotBaseUrl, _t as nativeSubagentModel, a as buildPeerAwarenessSnippet, an as cacheVSCodeVersion, at as logStreamError, b as stopReviewEnabled, bn as state, bt as shimDefaultsToXhigh, c as personasFor, cn as resolveCodexModel, ct as handleMcpDelete, d as buildStopHookCommand, dn as getModels, dt as artifactToolsEnabled, en as setupGitHubAgentToken, et as injectAdvisorTool, f as captureLaunchBaseline, fn as getGitHubUser, ft as browseAgentEnabled, g as launchBaselineKey, gn as GITHUB_API_BASE_URL, gt as geminiAvailable, h as injectStopHookIntoSettingsFile, hn as forwardError, ht as fleetToolsEnabled, i as buildAgentPrompt, in as cacheModels, it as isControllerClosedError, j as liveExec, jt as parseJsonOrDiagnose, k as stopReviewStateDir, kt as MAX_RESPONSE_BODY_BYTES, l as buildArtifactOpenHookCommand, ln as resolveModel, lt as handleMcpPost, m as fileBlockBudget, mn as HTTPError, mt as browserToolsEnabled, n as MCP_GROUPS, nn as tryRefreshAndRetry, nt as buildAnthropicErrorEvent, o as buildPeerAwarenessSummary, on as filterBetaHeader, ot as readIteratorWithTimeout, p as decideStopHook, pn as fetchWithTransientRetry, pt as browserCompoundToolsEnabled, q as vscodeRipgrepPath, qt as UPSTREAM_FETCH_TIMEOUT_MS, r as assertMcpToolSurfaceConsistent, rn as cacheCopilotVersion, rt as buildOpenAIErrorEvent, s as enumerateInjectedMcpToolNames, sn as isNullish, st as relayAnthropicStream, t as GROUP_META, tn as setupGitHubToken, tt as isAdvisorRequested, u as buildSessionBindHookCommand, un as sleep$1, ut as agentToolsEnabled, v as stopGateId, vn as copilotHeaders, vt as standInToolEnabled, w as fileReviewDebounce, wt as assembleResponsesPayload, x as fileBaselineStore, xt as countTokens, y as stopGatePlanMode, yn as githubHeaders, yt as workerToolsEnabled, zt as buildWorkspaceHeaderHelperCommand } from "./peer-mcp-personas-BekOx3Rp.js";
 import { a as isUnderClaudeConfigMirror, d as writeRuntimeFileSecure, i as ensurePaths, o as removeOwnClaudeConfigMirror, r as ensureClaudeConfigMirror, t as PATHS, u as writeArtifactCredsToMirror } from "./paths-BO22pMUb.js";
 import { c as killManagedTree, d as runCommandCapture, f as runCommandVoid, l as parseBoolEnv, s as killChildProcessTree, u as resolveExecutable } from "./lifecycle-D-1CYr1Y.js";
 import { a as sweepRegistry } from "./lifecycle-bPdiXjYB.js";
@@ -1852,6 +1852,44 @@ async function sanitizeServeSettingsEnv(settingsPath) {
 */
 const NATIVE_RESEARCH_ALLOW_RULES = ["WebSearch", "WebFetch"];
 /**
+* The routine native Claude Code tools serve auto-approves so ordinary agent
+* work stays seamless (no per-call prompt) — the exact surface a coding agent
+* uses turn to turn. Seeded into CloudCLI's `localStorage['claude-settings']`
+* `allowedTools` (feeds the Agent SDK `canUseTool` fast-path + `sdkOptions.allowedTools`).
+*
+* DELIBERATELY EXCLUDES the two interaction tools `AskUserQuestion` and
+* `ExitPlanMode`. CloudCLI hard-codes both into its `TOOLS_REQUIRING_INTERACTION`
+* set (claude-sdk.js) and renders a real question widget / plan Approve-Reject
+* card for them — but ONLY when `canUseTool` runs (non-bypass) AND they are NOT
+* pre-approved. Leaving them off this list is what routes them to the human
+* instead of letting the model auto-answer its own question. This is the same
+* line the interactive Claude CLI draws: routine tools seamless, decisions to
+* the user. Never add either name here.
+*
+* A tool omitted from this list degrades to a one-off Allow/Deny prompt in
+* CloudCLI — safe, not broken — so the list is a superset of the common surface
+* rather than an exact registry match (extra names for tools this Claude build
+* lacks are harmless no-ops).
+*/
+const SEAMLESS_BUILTIN_TOOLS = [
+	"Task",
+	"Bash",
+	"BashOutput",
+	"KillShell",
+	"Glob",
+	"Grep",
+	"Read",
+	"Edit",
+	"Write",
+	"NotebookEdit",
+	"WebFetch",
+	"WebSearch",
+	"TodoWrite",
+	"Skill",
+	"SlashCommand",
+	"EnterPlanMode"
+];
+/**
 * Merge arbitrary allow rules into a mirror `settings.json` `permissions.allow`
 * so the listed tools auto-run WITHOUT a permission prompt in every mode —
 * including plan mode, where a matched allow rule bypasses the prompt for any
@@ -1893,42 +1931,42 @@ function planModeAllowRules(serverKeys) {
 	return [...[...new Set(serverKeys.filter(Boolean))].map((k) => `mcp__${k}`), ...NATIVE_RESEARCH_ALLOW_RULES];
 }
 /**
-* Set the serve mirror's `settings.json` `permissions.defaultMode` to
-* `bypassPermissions` — the web-control-plane equivalent of `github-router
-* claude`'s default `--dangerously-skip-permissions`. Without it, CloudCLI's
-* Agent-SDK `canUseTool` callback posts a browser `permission_request` and AWAITS
-* approval for every not-yet-allowed tool, stalling the chat on each injected
-* `mcp__*` and native call.
+* Ensure the serve mirror's `settings.json` `permissions.defaultMode` is NOT
+* `bypassPermissions` — the load-bearing half of serve's "seamless routine +
+* decisions to the user" model.
 *
-* PRESERVES the user's `allow`/`deny`/`ask` posture verbatim — their curated
-* permission rules carry into serve unchanged, so a session switched off bypass
-* (plan / default mode via the composer) behaves exactly as their own Claude Code
-* would. We used to CLEAR `allow` on a since-debunked theory that a non-empty
-* allow narrows the toolset; empirically it does NOT (a 13-rule allow yields the
-* full 27-tool set incl Glob/Bash/Edit), and CloudCLI's `allowedTools` comes only
-* from the client `localStorage['claude-settings']` seed (`[]`), never from
-* `permissions.allow`. The real toolset-narrowing was `CLAUDE_CODE_COORDINATOR_MODE`,
-* stripped separately by {@link sanitizeServeSettingsEnv}. Not clearing `allow`
-* is what keeps serve at parity with the user's own Claude Code permission posture.
+* Under `bypassPermissions` the Agent SDK resolves approval at the permission-mode
+* step and SKIPS the `canUseTool` callback entirely (claude-sdk.js) — the only
+* channel CloudCLI's interactive widgets ride on, so `AskUserQuestion` and
+* `ExitPlanMode` auto-resolve on a model-generated answer and never reach the human.
+* CloudCLI leaves `sdkOptions.permissionMode` unset when the composer is in default
+* mode, so the binary falls back to THIS `defaultMode` — a stale `bypassPermissions`
+* here would silently re-defeat the fix through the settings vector.
+*
+* MINIMAL override: only rewrite when the mode is absent or an explicit
+* `bypassPermissions` (→ `"default"`, keeping `canUseTool` live). A user's
+* deliberate NON-bypass posture (`plan` / `acceptEdits` / `default`) is preserved
+* verbatim — all three already keep `canUseTool` live, so there is nothing to fix
+* and no reason to override their choice. `allow`/`deny`/`ask` are always untouched.
 *
 * Only ever rewrites the per-launch serve mirror, never the operator's real
 * `~/.claude/settings.json`. Atomic temp+rename, mode 0o600. A non-object
-* settings.json throws (never clobber a file we don't understand); the caller
-* wraps this in warn-and-continue so a hiccup never blocks launch.
+* settings.json throws; the caller wraps this in warn-and-continue.
 *
-* Opt out with `GH_ROUTER_SERVE_NO_AUTO_APPROVE=1` (the caller skips this) — the
-* mirrored `defaultMode` is then left exactly as snapshotted.
+* Opt out with `GH_ROUTER_SERVE_NO_AUTO_APPROVE=1` (the caller skips this AND the
+* allow-list/localStorage seed) — the mirrored `defaultMode` is then left exactly
+* as snapshotted and CloudCLI prompts on every not-yet-approved tool.
 */
-async function configureServePermissionsBypass(settingsPath) {
+async function configureServeDefaultPermissionMode(settingsPath) {
 	const existing = await readSettingsObject(settingsPath) ?? {};
 	const permsRaw = existing.permissions;
 	const perms = permsRaw && typeof permsRaw === "object" && !Array.isArray(permsRaw) ? { ...permsRaw } : {};
-	if (perms.defaultMode === "bypassPermissions") return { written: false };
-	perms.defaultMode = "bypassPermissions";
+	if (perms.defaultMode !== void 0 && perms.defaultMode !== "bypassPermissions") return { written: false };
+	perms.defaultMode = "default";
 	await writeSettingsObject(settingsPath, {
 		...existing,
 		permissions: perms
-	}, "servebypass");
+	}, "servemode");
 	return { written: true };
 }
 
@@ -2797,7 +2835,7 @@ async function discoverGateCommands(cwd, opts) {
 	if (files.length === 0) return null;
 	let result;
 	try {
-		const { runWorkerAgent } = await import("./engine-CIt6z9K3.js");
+		const { runWorkerAgent } = await import("./engine-DI8PNfqU.js");
 		result = await runWorkerAgent({
 			mode: "explore",
 			workspace: root,
@@ -4957,7 +4995,7 @@ function initProxyFromEnv() {
 //#endregion
 //#region package.json
 var name = "github-router";
-var version$1 = "0.3.202";
+var version$1 = "0.3.204";
 
 //#endregion
 //#region src/lib/approval.ts
@@ -10778,7 +10816,7 @@ async function provisionServeEnhancements(serverUrl, opts = {}) {
 			return { removed: [] };
 		});
 		if (strip.removed.length) consola.info(`Serve: removed ${strip.removed.join(", ")} from the mirror settings (single-agent surface).`);
-		if (process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== "1") await configureServePermissionsBypass(settingsPath).catch((err) => consola.warn(`Could not set serve permission defaults: ${String(err)}`));
+		if (process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== "1") await configureServeDefaultPermissionMode(settingsPath).catch((err) => consola.warn(`Could not set serve permission defaults: ${String(err)}`));
 		await injectAllowRules(settingsPath, planModeAllowRules(injected.ok ? injected.serversAdded : [...Object.values(groupKeys).filter((k) => Boolean(k)), ...opts.codexCli === true ? ["codex-cli"] : []])).catch((err) => consola.warn(`Could not auto-approve injected tools: ${String(err)}`));
 		if (workerToolsEnabled()) {
 			await injectStopHookIntoSettingsFile(settingsPath, buildPromptSubmitHookCommand(process.execPath, process.argv[1]), "UserPromptSubmit", 45).catch((err) => consola.warn(`Could not register the UserPromptSubmit hook: ${String(err)}`));
@@ -11093,27 +11131,35 @@ const HEAD_CLOSE = "</head>";
 /** CloudCLI's localStorage key for per-tool chat permission settings. */
 const CLAUDE_SETTINGS_KEY = "claude-settings";
 /**
+* The two interaction tools CloudCLI routes to the human (its
+* `TOOLS_REQUIRING_INTERACTION`). They must NEVER appear in the seeded
+* `allowedTools` — an exact-name match there would auto-approve them and defeat
+* the question widget / plan card. Stripped defensively at the seed chokepoint
+* so no upstream list (mcp names, a future caller) can reintroduce them.
+*/
+const NEVER_AUTO_APPROVE = new Set(["AskUserQuestion", "ExitPlanMode"]);
+/**
 * Embed the token as a JS string literal. JSON.stringify escapes quotes and
 * backslashes; we additionally neutralize `<` so the value can never break out
 * of the surrounding <script> element regardless of contents.
 *
 * When `seedToolSettings` is set, also seed CloudCLI's `claude-settings`
-* localStorage with `{allowedTools:[], disallowedTools:[], skipPermissions:true}`
-* so the SDK-spawned Claude gets the FULL built-in toolset with no permission
-* prompts. This is the server-side, zero-user-action fix for two CloudCLI
-* behaviors: (1) a non-empty `allowedTools` is an availability allow-list in the
-* Agent SDK (so any tool not in it is "not enabled"), and (2) `allowedTools`
-* accumulates client-side on every "allow & remember" click — so prior approvals
-* silently clamp the toolset. Forcing empty `allowedTools` + `skipPermissions`
-* gives `github-router claude`-parity (`--dangerously-skip-permissions`).
+* localStorage with `{allowedTools:<routine+mcp>, disallowedTools:[], skipPermissions:false}`.
+* This is serve's "seamless routine + decisions to the user" model: `canUseTool`
+* stays LIVE (skipPermissions:false, NOT bypass), routine tools in `allowedTools`
+* auto-run with no prompt, and `AskUserQuestion`/`ExitPlanMode` — deliberately
+* NOT in the list and hard-cased by CloudCLI into `TOOLS_REQUIRING_INTERACTION` —
+* always reach the human as a real question widget / plan Approve-Reject card.
+* `skipPermissions:true` (bypass) would skip `canUseTool` entirely and silently
+* auto-answer those two, which is exactly what we are fixing.
 */
 function buildInjection(token, seedToolSettings = false, seedAllowedTools = []) {
 	let body = `localStorage.setItem('auth-token',${JSON.stringify(token).replace(/</g, "\\u003c")});`;
 	if (seedToolSettings) {
 		const settings = JSON.stringify({
-			allowedTools: seedAllowedTools,
+			allowedTools: seedAllowedTools.filter((t) => !NEVER_AUTO_APPROVE.has(t)),
 			disallowedTools: [],
-			skipPermissions: true
+			skipPermissions: false
 		});
 		const safeSettings = JSON.stringify(settings).replace(/</g, "\\u003c");
 		body += `localStorage.setItem('${CLAUDE_SETTINGS_KEY}',${safeSettings});`;
@@ -11542,6 +11588,7 @@ const serve$1 = defineCommand({
 			fleetOverTunnel: args["fleet-over-tunnel"] === true
 		});
 		const anthropicVars = getClaudeCodeEnvVars(serverUrl, chosenSlug);
+		delete anthropicVars.CLAUDE_CODE_FORK_SUBAGENT;
 		if (enhancements.nonce) {
 			anthropicVars.GH_ROUTER_HOOK_MCP_URL = serverUrl;
 			anthropicVars.GH_ROUTER_HOOK_NONCE = enhancements.nonce;
@@ -11650,7 +11697,7 @@ const serve$1 = defineCommand({
 				bindPort: servePort,
 				authToken: token,
 				seedToolSettings: process.env.GH_ROUTER_SERVE_NO_AUTO_APPROVE !== "1",
-				seedAllowedTools: enhancements.mcpToolNames ?? [],
+				seedAllowedTools: [...SEAMLESS_BUILTIN_TOOLS, ...enhancements.mcpToolNames ?? []],
 				extraAllowedHosts,
 				extraAllowedOrigins,
 				allowDevtunnelHosts: tunnelMode,