praxis-agent 0.52.0 → 0.53.0

package/README.md

@@ -220,8 +220,13 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   into mode-`0600` `.txt` files under the session-scoped `tool-results`
   directory; providers and transcripts receive only a bounded instruction with
   the absolute file path. Results at or below the limit remain inline, while
-  structured, mixed-media, and binary-resource handling is unchanged. Explicit
-  concrete `--tools` selections load selected tools directly, while
+  structured, mixed-media, and binary-resource handling is unchanged. MCP
+  tools that declare `readOnlyHint: true` default to allow through
+  provider-neutral permission metadata; explicit PreToolUse and permission
+  ask/deny decisions retain precedence, and missing or false hints retain the
+  existing default behavior. This is a Praxis permission contract, not a claim
+  of verified Claude Code 2.1.208 parity. Explicit concrete `--tools`
+  selections load selected tools directly, while
   `--disallowedTools ToolSearch` restores the complete tool list.
 - **Provider-neutral models** — native Provider Registry/Vault routing, API
   adapters, an experimental Codex OAuth adapter, explicit capability checks,

package/dist/core/runtime.d.ts

@@ -342,6 +342,7 @@ export interface ToolExecutionContext {
     toolResultDirectory?: string;
     originalCall?: ModelToolCall;
     permissionUpdates?: readonly PermissionUpdate[];
+    toolPermission?: ToolPermissionMetadata;
     permissionPhase?: 'request' | 'execute';
     permissionApproved?: boolean;
     /** Internal marker for an explicit PreToolUse allow decision. */
@@ -405,6 +406,9 @@ export type PermissionApproval = boolean | {
     message: string;
     interrupt?: boolean;
 };
+export interface ToolPermissionMetadata {
+    readonly readOnly: true;
+}
 export interface PermissionResolutionContext {
     cwd: string;
     messages?: readonly ModelMessage[];
@@ -412,6 +416,7 @@ export interface PermissionResolutionContext {
     toolResultDirectory?: string;
     originalCall?: ModelToolCall;
     permissionUpdates?: readonly PermissionUpdate[];
+    toolPermission?: ToolPermissionMetadata;
 }
 export type PermissionDecisionSource = 'auto-classifier' | 'rule' | 'mode' | 'default';
 export type AutoModePermissionOutcome = 'blocked' | 'unavailable';

package/dist/mcp/claude-mcp-tools.js

@@ -944,7 +944,10 @@ export class ClaudeMcpToolRegistry {
         };
     }
     async prepare(call, context) {
-        return this.connectedTools.has(call.name) ||
+        const tool = this.connectedTools.get(call.name);
+        if (tool?.readOnly === true)
+            context.toolPermission = { readOnly: true };
+        return tool ||
             MCP_RESOURCE_TOOL_DEFINITIONS.some((definition) => definition.name === call.name)
             ? call
             : this.options.base.prepare(call, context);

package/dist/permissions/claude-permission-resolver.js

@@ -613,7 +613,9 @@ export class ClaudePermissionResolver {
         if (permissionMode === 'auto' && call.name === 'Bash') {
             return annotatePermissionDecision({ behavior: 'allow' }, 'default');
         }
-        const defaultBehavior = DEFAULT_BEHAVIOR[call.name];
+        const defaultBehavior = context?.toolPermission?.readOnly === true
+            ? 'allow'
+            : DEFAULT_BEHAVIOR[call.name];
         return defaultBehavior === 'ask'
             ? this.askDecision(call, cwd, permissionMode, context, 'default', command
                 ? (subcommand) => matchingRule('allow', subcommandCall(subcommand)) === undefined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",