labgate 0.5.33 → 0.5.34

package/dist/mcp-bundles/dataset-mcp.bundle.mjs

@@ -29999,6 +29999,9 @@ var DEFAULT_CONFIG = {
   audit: {
     enabled: true,
     log_dir: "~/.labgate/logs"
+  },
+  headless: {
+    claude_run_with_allowed_permissions: true
   }
 };
 var LABGATE_DIR = process.env.LABGATE_DIR ?? join(homedir(), ".labgate");
@@ -30034,6 +30037,7 @@ function validateConfig(config2) {
   const blockedPatterns = config2.filesystem?.blocked_patterns;
   const extraPaths = config2.filesystem?.extra_paths;
   const blacklist = config2.commands?.blacklist;
+  const headless = config2.headless;
   if (!VALID_RUNTIMES.includes(config2.runtime)) {
     errors.push(`Invalid runtime: "${config2.runtime}". Must be one of: ${VALID_RUNTIMES.join(", ")}`);
   }
@@ -30058,6 +30062,13 @@ function validateConfig(config2) {
   if (!Array.isArray(blacklist)) {
     errors.push("commands.blacklist must be an array");
   }
+  if (headless !== void 0) {
+    if (!headless || typeof headless !== "object" || Array.isArray(headless)) {
+      errors.push("headless must be an object");
+    } else if (headless.claude_run_with_allowed_permissions !== void 0 && typeof headless.claude_run_with_allowed_permissions !== "boolean") {
+      errors.push("headless.claude_run_with_allowed_permissions must be a boolean");
+    }
+  }
   const mounts = Array.isArray(extraPaths) ? extraPaths : [];
   for (const mount of mounts) {
     if (!mount || typeof mount !== "object") {
@@ -30156,6 +30167,9 @@ function loadConfig() {
       audit: {
         enabled: raw.audit?.enabled ?? DEFAULT_CONFIG.audit.enabled,
         log_dir: raw.audit?.log_dir ?? DEFAULT_CONFIG.audit.log_dir
+      },
+      headless: {
+        claude_run_with_allowed_permissions: raw.headless?.claude_run_with_allowed_permissions ?? DEFAULT_CONFIG.headless?.claude_run_with_allowed_permissions ?? true
       }
     };
     const errors = validateConfig(config2);

package/dist/mcp-bundles/explorer-mcp.bundle.mjs

@@ -7233,6 +7233,7 @@ __export(config_exports, {
   getUiSocketPath: () => getUiSocketPath,
   loadConfig: () => loadConfig,
   loadEffectiveConfig: () => loadEffectiveConfig,
+  shouldClaudeHeadlessRunWithAllowedPermissions: () => shouldClaudeHeadlessRunWithAllowedPermissions,
   validateConfig: () => validateConfig
 });
 import { readFileSync as readFileSync3, existsSync as existsSync3, chmodSync, mkdirSync } from "fs";
@@ -7311,6 +7312,9 @@ function getExplorerLockDir(experimentId) {
 function getExplorerWorktreesDir(experimentId) {
   return join3(getExplorerWorktreesRootDir(), experimentId);
 }
+function shouldClaudeHeadlessRunWithAllowedPermissions(config2) {
+  return config2.headless?.claude_run_with_allowed_permissions !== false;
+}
 function cloneConfig(config2) {
   return JSON.parse(JSON.stringify(config2));
 }
@@ -7321,6 +7325,7 @@ function validateConfig(config2) {
   const blockedPatterns = config2.filesystem?.blocked_patterns;
   const extraPaths = config2.filesystem?.extra_paths;
   const blacklist = config2.commands?.blacklist;
+  const headless = config2.headless;
   if (!VALID_RUNTIMES2.includes(config2.runtime)) {
     errors.push(`Invalid runtime: "${config2.runtime}". Must be one of: ${VALID_RUNTIMES2.join(", ")}`);
   }
@@ -7345,6 +7350,13 @@ function validateConfig(config2) {
   if (!Array.isArray(blacklist)) {
     errors.push("commands.blacklist must be an array");
   }
+  if (headless !== void 0) {
+    if (!headless || typeof headless !== "object" || Array.isArray(headless)) {
+      errors.push("headless must be an object");
+    } else if (headless.claude_run_with_allowed_permissions !== void 0 && typeof headless.claude_run_with_allowed_permissions !== "boolean") {
+      errors.push("headless.claude_run_with_allowed_permissions must be a boolean");
+    }
+  }
   const mounts = Array.isArray(extraPaths) ? extraPaths : [];
   for (const mount of mounts) {
     if (!mount || typeof mount !== "object") {
@@ -7443,6 +7455,9 @@ function loadConfig() {
       audit: {
         enabled: raw.audit?.enabled ?? DEFAULT_CONFIG.audit.enabled,
         log_dir: raw.audit?.log_dir ?? DEFAULT_CONFIG.audit.log_dir
+      },
+      headless: {
+        claude_run_with_allowed_permissions: raw.headless?.claude_run_with_allowed_permissions ?? DEFAULT_CONFIG.headless?.claude_run_with_allowed_permissions ?? true
       }
     };
     const errors = validateConfig(config2);
@@ -7576,6 +7591,9 @@ var init_config = __esm({
       audit: {
         enabled: true,
         log_dir: "~/.labgate/logs"
+      },
+      headless: {
+        claude_run_with_allowed_permissions: true
       }
     };
     LABGATE_DIR = process.env.LABGATE_DIR ?? join3(homedir3(), ".labgate");
@@ -38061,6 +38079,7 @@ function runClaudeHeadlessInWorktree(input) {
     "--output-format",
     "stream-json",
     "--include-partial-messages",
+    ...shouldClaudeHeadlessRunWithAllowedPermissions(config2) ? ["--dangerously-skip-permissions"] : [],
     ...resumeSessionId ? ["--resume", resumeSessionId] : [],
     prompt
   ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "labgate",
-  "version": "0.5.33",
+  "version": "0.5.34",
   "description": "Secure HPC wrapper for AI coding agents (Claude-first): policy controls, Apptainer sandboxes, and SLURM workflows — https://labgate.dev",
   "homepage": "https://labgate.dev",
   "keywords": [