impel-cli 0.20.8 → 0.20.9

package/RELEASE_NOTES.md

@@ -1,5 +1,16 @@
 # Release notes
 
+## 0.20.9 — Claude managed-tool permissions
+
+- Lets eager Claude custom agents execute their fixed, tenant-bound MCP tools
+  in non-interactive `dontAsk` sessions without a permission prompt.
+- Scopes prompt bypass to custom agents whose `tools` frontmatter contains only
+  the generated Impel run/resume/recovery allowlist; fallback profiles keep the
+  host's normal permission behavior.
+- Preserves the terminal answer schema, status, and run id in the local result
+  so privacy-safe telemetry and native hosts can distinguish success from a
+  model process that merely exited cleanly.
+
 ## 0.20.8 — Claude direct-answer compatibility
 
 - Publishes the bound direct-answer tool with Claude's supported closed object

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.8",
+  "version": "0.20.9",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/agents.js

@@ -706,7 +706,15 @@ function renderClaudeAgent({ tenantId, agent, name, invocation, recoveryOnly = f
     `description: ${JSON.stringify(description)}`,
     "model: haiku",
     ...(eager
-      ? ["tools:", ...toolNames.map((tool) => `  - ${JSON.stringify(nativeToolName(tool))}`)]
+      ? [
+        // This agent receives only the exact fixed-binding MCP allowlist below,
+        // so bypassing prompts cannot grant filesystem, shell, connector, or
+        // arbitrary MCP access. It lets non-interactive/dontAsk hosts execute
+        // the selected managed adapter instead of auto-denying its sole call.
+        "permissionMode: bypassPermissions",
+        "tools:",
+        ...toolNames.map((tool) => `  - ${JSON.stringify(nativeToolName(tool))}`),
+      ]
       : []),
     "mcpServers:",
     `  - ${MANAGED_AGENT_MCP_SERVER}:`,

package/src/nativeAgentTransport.js

@@ -1735,10 +1735,13 @@ export class NativeAgentCompositeTransport {
       });
       if (result?.schema === NATIVE_AGENT_RESULT_SCHEMA && result.status === "succeeded") {
         return {
+          schema: "impel.native-agent-answer.v1",
+          status: "succeeded",
           forUser: result.finalText,
           answer: result.finalText,
           agentId: this.agentId,
           scopeParam: this.scopeParam,
+          runId: state.upstreamRunId,
         };
       }
       return result;