impel-cli 0.20.7 → 0.20.9

package/RELEASE_NOTES.md

@@ -1,5 +1,23 @@
 # Release notes
 
+## 0.20.9 — Claude managed-tool permissions
+
+- Lets eager Claude custom agents execute their fixed, tenant-bound MCP tools
+  in non-interactive `dontAsk` sessions without a permission prompt.
+- Scopes prompt bypass to custom agents whose `tools` frontmatter contains only
+  the generated Impel run/resume/recovery allowlist; fallback profiles keep the
+  host's normal permission behavior.
+- Preserves the terminal answer schema, status, and run id in the local result
+  so privacy-safe telemetry and native hosts can distinguish success from a
+  model process that merely exited cleanly.
+
+## 0.20.8 — Claude direct-answer compatibility
+
+- Publishes the bound direct-answer tool with Claude's supported closed object
+  schema while retaining the legacy `task` alias only inside the local runtime.
+- Keeps the model-visible contract to one required `question`, so qualified
+  Claude custom agents receive the exact eager tool instead of silently losing it.
+
 ## 0.20.7 — Native-agent state compatibility
 
 - Keeps profile discovery aligned with the durable transport schema so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.7",
+  "version": "0.20.9",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/agents.js

@@ -706,7 +706,15 @@ function renderClaudeAgent({ tenantId, agent, name, invocation, recoveryOnly = f
     `description: ${JSON.stringify(description)}`,
     "model: haiku",
     ...(eager
-      ? ["tools:", ...toolNames.map((tool) => `  - ${JSON.stringify(nativeToolName(tool))}`)]
+      ? [
+        // This agent receives only the exact fixed-binding MCP allowlist below,
+        // so bypassing prompts cannot grant filesystem, shell, connector, or
+        // arbitrary MCP access. It lets non-interactive/dontAsk hosts execute
+        // the selected managed adapter instead of auto-denying its sole call.
+        "permissionMode: bypassPermissions",
+        "tools:",
+        ...toolNames.map((tool) => `  - ${JSON.stringify(nativeToolName(tool))}`),
+      ]
       : []),
     "mcpServers:",
     `  - ${MANAGED_AGENT_MCP_SERVER}:`,

package/src/nativeAgentTransport.js

@@ -1735,10 +1735,13 @@ export class NativeAgentCompositeTransport {
       });
       if (result?.schema === NATIVE_AGENT_RESULT_SCHEMA && result.status === "succeeded") {
         return {
+          schema: "impel.native-agent-answer.v1",
+          status: "succeeded",
           forUser: result.finalText,
           answer: result.finalText,
           agentId: this.agentId,
           scopeParam: this.scopeParam,
+          runId: state.upstreamRunId,
         };
       }
       return result;
@@ -2136,13 +2139,9 @@ export function nativeAgentCompositeTools({ mode = "durable" } = {}) {
     inputSchema: {
       type: "object",
       additionalProperties: false,
-      anyOf: [
-        { required: ["question"], not: { required: ["task"] } },
-        { required: ["task"], not: { required: ["question"] } },
-      ],
+      required: ["question"],
       properties: {
         question: { type: "string", minLength: 1, maxLength: 40_000 },
-        task: { type: "string", minLength: 1, maxLength: 40_000 },
         context: { type: "string", maxLength: 40_000 },
         contextKeys: {
           type: "array",