praxis-agent 0.51.0 → 0.53.0

package/README.md

@@ -216,9 +216,18 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   tool selection defers `mcp__*` schemas behind a turn-scoped `ToolSearch`;
   each query activates at most eight deterministic matches for the next model
   request, and published MCP tool descriptions are capped at 2,048 Unicode
-  code points. Explicit concrete `--tools` selections load selected tools
-  directly, while `--disallowedTools ToolSearch` restores the complete tool
-  list.
+  code points. Text-only MCP results above 100,000 UTF-8 bytes are redacted
+  into mode-`0600` `.txt` files under the session-scoped `tool-results`
+  directory; providers and transcripts receive only a bounded instruction with
+  the absolute file path. Results at or below the limit remain inline, while
+  structured, mixed-media, and binary-resource handling is unchanged. MCP
+  tools that declare `readOnlyHint: true` default to allow through
+  provider-neutral permission metadata; explicit PreToolUse and permission
+  ask/deny decisions retain precedence, and missing or false hints retain the
+  existing default behavior. This is a Praxis permission contract, not a claim
+  of verified Claude Code 2.1.208 parity. Explicit concrete `--tools`
+  selections load selected tools directly, while
+  `--disallowedTools ToolSearch` restores the complete tool list.
 - **Provider-neutral models** — native Provider Registry/Vault routing, API
   adapters, an experimental Codex OAuth adapter, explicit capability checks,
   separate per-attempt connect, byte-idle, and absolute-total timeouts, typed

package/dist/core/runtime.d.ts

@@ -342,6 +342,7 @@ export interface ToolExecutionContext {
     toolResultDirectory?: string;
     originalCall?: ModelToolCall;
     permissionUpdates?: readonly PermissionUpdate[];
+    toolPermission?: ToolPermissionMetadata;
     permissionPhase?: 'request' | 'execute';
     permissionApproved?: boolean;
     /** Internal marker for an explicit PreToolUse allow decision. */
@@ -405,6 +406,9 @@ export type PermissionApproval = boolean | {
     message: string;
     interrupt?: boolean;
 };
+export interface ToolPermissionMetadata {
+    readonly readOnly: true;
+}
 export interface PermissionResolutionContext {
     cwd: string;
     messages?: readonly ModelMessage[];
@@ -412,6 +416,7 @@ export interface PermissionResolutionContext {
     toolResultDirectory?: string;
     originalCall?: ModelToolCall;
     permissionUpdates?: readonly PermissionUpdate[];
+    toolPermission?: ToolPermissionMetadata;
 }
 export type PermissionDecisionSource = 'auto-classifier' | 'rule' | 'mode' | 'default';
 export type AutoModePermissionOutcome = 'blocked' | 'unavailable';

package/dist/mcp/claude-mcp-tools.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { mkdir, mkdtemp, open, rm } from 'node:fs/promises';
 import { homedir, tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { join, resolve as resolvePath } from 'node:path';
 import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
@@ -26,6 +26,7 @@ function capMcpToolDescription(value) {
     return [...value].slice(0, MAX_MCP_TOOL_DESCRIPTION_CODE_POINTS).join('');
 }
 const MAX_RESOURCE_BYTES = 25 * 1024 * 1024;
+const MAX_INLINE_MCP_TEXT_RESULT_BYTES = 100_000;
 const NO_MCP_RESOURCES = 'No resources found. MCP servers may still provide tools even if they have no resources.';
 const MCP_RESOURCE_TOOL_DEFINITIONS = [
     {
@@ -458,11 +459,21 @@ async function mcpBinaryText(options, sensitiveValues, createdFiles) {
         : `Resource from ${options.serverName} at ${options.uri}`;
     return mcpTextBlock(`[${origin}] Binary content (${options.mimeType}, ${options.bytes.length} bytes) saved to ${filePath}`, sensitiveValues);
 }
+async function externalizeMcpTextResult(serverName, content, context, sensitiveValues, createdFiles) {
+    if (!context.toolResultDirectory) {
+        throw new Error('MCP large text tool result output directory is unavailable');
+    }
+    const bytes = Buffer.from(content, 'utf8');
+    const filePath = await writeToolBlob(resolvePath(context.cwd, context.toolResultDirectory), serverName, bytes, '.txt');
+    createdFiles.push(filePath);
+    return mcpTextBlock(`[MCP tool result from ${serverName}] Text content (${bytes.length} bytes) saved to ${filePath}`, sensitiveValues);
+}
 async function mcpToolResultUnchecked(serverName, result, context, sensitiveValues, createdFiles) {
     if (!Array.isArray(result.content)) {
         throw new Error('MCP tool result content must be an array');
     }
     const blocks = [];
+    let textOnly = result.structuredContent === undefined;
     let resultBytes = 0;
     const consumeBytes = (bytes) => {
         resultBytes += bytes;
@@ -487,6 +498,7 @@ async function mcpToolResultUnchecked(serverName, result, context, sensitiveValu
             }
             continue;
         }
+        textOnly = false;
         if (item.type === 'image') {
             if (typeof item.mimeType !== 'string' ||
                 !MCP_IMAGE_MEDIA_TYPES.has(item.mimeType) ||
@@ -573,6 +585,15 @@ async function mcpToolResultUnchecked(serverName, result, context, sensitiveValu
     if (Buffer.byteLength(content) > MAX_RESOURCE_BYTES) {
         throw new Error(`MCP tool result exceeded ${MAX_RESOURCE_BYTES} bytes`);
     }
+    if (textOnly &&
+        Buffer.byteLength(content) > MAX_INLINE_MCP_TEXT_RESULT_BYTES) {
+        const pointerBlock = await externalizeMcpTextResult(serverName, content, context, sensitiveValues, createdFiles);
+        return {
+            content: pointerBlock.text,
+            contentBlocks: [pointerBlock],
+            isError: result.isError === true,
+        };
+    }
     const images = blocks.filter((block) => block.type === 'image');
     return {
         content,
@@ -923,7 +944,10 @@ export class ClaudeMcpToolRegistry {
         };
     }
     async prepare(call, context) {
-        return this.connectedTools.has(call.name) ||
+        const tool = this.connectedTools.get(call.name);
+        if (tool?.readOnly === true)
+            context.toolPermission = { readOnly: true };
+        return tool ||
             MCP_RESOURCE_TOOL_DEFINITIONS.some((definition) => definition.name === call.name)
             ? call
             : this.options.base.prepare(call, context);

package/dist/permissions/claude-permission-resolver.js

@@ -613,7 +613,9 @@ export class ClaudePermissionResolver {
         if (permissionMode === 'auto' && call.name === 'Bash') {
             return annotatePermissionDecision({ behavior: 'allow' }, 'default');
         }
-        const defaultBehavior = DEFAULT_BEHAVIOR[call.name];
+        const defaultBehavior = context?.toolPermission?.readOnly === true
+            ? 'allow'
+            : DEFAULT_BEHAVIOR[call.name];
         return defaultBehavior === 'ask'
             ? this.askDecision(call, cwd, permissionMode, context, 'default', command
                 ? (subcommand) => matchingRule('allow', subcommandCall(subcommand)) === undefined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.51.0",
+  "version": "0.53.0",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",