praxis-agent 0.52.0 → 0.53.1

package/README.md

@@ -220,9 +220,18 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   into mode-`0600` `.txt` files under the session-scoped `tool-results`
   directory; providers and transcripts receive only a bounded instruction with
   the absolute file path. Results at or below the limit remain inline, while
-  structured, mixed-media, and binary-resource handling is unchanged. Explicit
-  concrete `--tools` selections load selected tools directly, while
-  `--disallowedTools ToolSearch` restores the complete tool list.
+  structured, mixed-media, and binary-resource handling is unchanged. MCP
+  tools that declare `readOnlyHint: true` default to allow through
+  provider-neutral permission metadata; explicit PreToolUse and permission
+  ask/deny decisions retain precedence, and missing or false hints retain the
+  existing default behavior. This is a Praxis permission contract, not a claim
+  of verified Claude Code 2.1.208 parity. Explicit concrete `--tools`
+  selections load selected tools directly, while
+  `--disallowedTools ToolSearch` restores the complete tool list. For each
+  context assembly, Git status is refreshed from the caller-resolved cwd while
+  environment and memory remain lifecycle-stable; collection uses
+  `--no-optional-locks`, fails closed on repository/status errors, and bounds
+  the rendered status to 2,048 UTF-8 bytes.
 - **Provider-neutral models** — native Provider Registry/Vault routing, API
   adapters, an experimental Codex OAuth adapter, explicit capability checks,
   separate per-attempt connect, byte-idle, and absolute-total timeouts, typed

package/dist/core/runtime.d.ts

@@ -342,6 +342,7 @@ export interface ToolExecutionContext {
     toolResultDirectory?: string;
     originalCall?: ModelToolCall;
     permissionUpdates?: readonly PermissionUpdate[];
+    toolPermission?: ToolPermissionMetadata;
     permissionPhase?: 'request' | 'execute';
     permissionApproved?: boolean;
     /** Internal marker for an explicit PreToolUse allow decision. */
@@ -405,6 +406,9 @@ export type PermissionApproval = boolean | {
     message: string;
     interrupt?: boolean;
 };
+export interface ToolPermissionMetadata {
+    readonly readOnly: true;
+}
 export interface PermissionResolutionContext {
     cwd: string;
     messages?: readonly ModelMessage[];
@@ -412,6 +416,7 @@ export interface PermissionResolutionContext {
     toolResultDirectory?: string;
     originalCall?: ModelToolCall;
     permissionUpdates?: readonly PermissionUpdate[];
+    toolPermission?: ToolPermissionMetadata;
 }
 export type PermissionDecisionSource = 'auto-classifier' | 'rule' | 'mode' | 'default';
 export type AutoModePermissionOutcome = 'blocked' | 'unavailable';

package/dist/mcp/claude-mcp-tools.js

@@ -944,7 +944,10 @@ export class ClaudeMcpToolRegistry {
         };
     }
     async prepare(call, context) {
-        return this.connectedTools.has(call.name) ||
+        const tool = this.connectedTools.get(call.name);
+        if (tool?.readOnly === true)
+            context.toolPermission = { readOnly: true };
+        return tool ||
             MCP_RESOURCE_TOOL_DEFINITIONS.some((definition) => definition.name === call.name)
             ? call
             : this.options.base.prepare(call, context);

package/dist/native/context.js

@@ -131,7 +131,7 @@ ${sections.join('\n\n')}`,
                 tailSections.push({
                     id: 'relocated-runtime-context',
                     placement: 'first-user',
-                    stability: 'session',
+                    stability: 'volatile',
                     content: renderClaudeDynamicUserContext({
                         environment: dynamic.environment,
                         ...(dynamic.gitStatus ? { gitStatus: dynamic.gitStatus } : {}),
@@ -143,8 +143,19 @@ ${sections.join('\n\n')}`,
                     id: 'runtime-context',
                     placement: 'system',
                     stability: 'session',
-                    content: renderClaudeDynamicSystemContext(dynamic),
+                    content: renderClaudeDynamicSystemContext({
+                        environment: dynamic.environment,
+                        ...(dynamic.memory ? { memory: dynamic.memory } : {}),
+                    }),
                 });
+                if (dynamic.gitStatus) {
+                    tailSections.push({
+                        id: 'git-status',
+                        placement: 'system',
+                        stability: 'volatile',
+                        content: dynamic.gitStatus,
+                    });
+                }
             }
         }
         const composition = this.composer.compose({
@@ -227,15 +238,22 @@ ${sections.join('\n\n')}`,
             throw new Error('Dynamic context loader is unavailable');
         if (!snapshot)
             return load(cwd);
-        if (!snapshot.dynamic) {
-            const pending = load(cwd);
-            snapshot.dynamic = pending;
+        const current = load(cwd);
+        if (!snapshot.stableDynamic) {
+            const pending = current.then(({ environment, memory }) => ({
+                environment,
+                ...(memory ? { memory } : {}),
+            }));
+            snapshot.stableDynamic = pending;
             void pending.catch(() => {
-                if (snapshot.dynamic === pending)
-                    delete snapshot.dynamic;
+                if (snapshot.stableDynamic === pending)
+                    delete snapshot.stableDynamic;
             });
         }
-        return snapshot.dynamic;
+        return Promise.all([current, snapshot.stableDynamic]).then(([fresh, stable]) => ({
+            ...stable,
+            ...(fresh.gitStatus ? { gitStatus: fresh.gitStatus } : {}),
+        }));
     }
     loadMcpInstructions(snapshot) {
         const load = this.options.loadMcpInstructions;

package/dist/native/dynamic-context.js

@@ -1,7 +1,8 @@
 import { spawn } from 'node:child_process';
 import { basename } from 'node:path';
 import { platform, release, type } from 'node:os';
-const MAX_GIT_OUTPUT_BYTES = 128 * 1024;
+const MAX_GIT_OUTPUT_BYTES = 2_048;
+const MAX_GIT_STATUS_BYTES = 2_048;
 const MAX_GIT_ERROR_BYTES = 8 * 1024;
 const GIT_TIMEOUT_MS = 5_000;
 function collectBounded(chunks, chunk, state, limit) {
@@ -16,6 +17,22 @@ function collectBounded(chunks, chunk, state, limit) {
     if (accepted.length < chunk.length)
         state.truncated = true;
 }
+function boundUtf8(value, limit, marker) {
+    if (Buffer.byteLength(value, 'utf8') <= limit)
+        return value;
+    const markerBytes = Buffer.byteLength(marker, 'utf8');
+    const prefixLimit = Math.max(0, limit - markerBytes);
+    let bytes = 0;
+    let prefix = '';
+    for (const character of value) {
+        const characterBytes = Buffer.byteLength(character, 'utf8');
+        if (bytes + characterBytes > prefixLimit)
+            break;
+        prefix += character;
+        bytes += characterBytes;
+    }
+    return `${prefix}${marker}`;
+}
 function defaultRunGit(cwd, args) {
     return new Promise((resolve, reject) => {
         const child = spawn('git', ['-C', cwd, ...args], {
@@ -93,9 +110,16 @@ async function renderGitStatus(runGit) {
         optionalGit(runGit, ['branch', '--show-current']),
         optionalGit(runGit, ['branch', '--format=%(refname:short)']),
         optionalGit(runGit, ['config', 'user.name']),
-        optionalGit(runGit, ['status', '--short', '--untracked-files=all']),
+        optionalGit(runGit, [
+            '--no-optional-locks',
+            'status',
+            '--short',
+            '--untracked-files=all',
+        ]),
         optionalGit(runGit, ['log', '-5', '--oneline']),
     ]);
+    if (!status.available)
+        return undefined;
     const branch = branchValue.output || 'HEAD';
     const sections = [
         '# gitStatus',
@@ -108,18 +132,16 @@ async function renderGitStatus(runGit) {
     if (user.available && user.output) {
         sections.push('', `Git user: ${user.output}`);
     }
-    const renderedStatus = !status.available
-        ? 'Unavailable'
-        : status.output
-            ? `${status.output}${status.truncated ? '\n... [truncated]' : ''}`
-            : status.truncated
-                ? '... [truncated]'
-                : 'Clean';
+    const renderedStatus = status.output
+        ? `${status.output}${status.truncated ? '\n... [truncated]' : ''}`
+        : status.truncated
+            ? '... [truncated]'
+            : 'Clean';
     sections.push('', 'Status:', renderedStatus);
     if (commits.available && commits.output) {
         sections.push('', 'Recent commits:', commits.output);
     }
-    return sections.join('\n');
+    return boundUtf8(sections.join('\n'), MAX_GIT_STATUS_BYTES, '\n... [truncated]');
 }
 export async function loadClaudeDynamicContext(options) {
     const configuredRunGit = options.runGit;

package/dist/permissions/claude-permission-resolver.js

@@ -613,7 +613,9 @@ export class ClaudePermissionResolver {
         if (permissionMode === 'auto' && call.name === 'Bash') {
             return annotatePermissionDecision({ behavior: 'allow' }, 'default');
         }
-        const defaultBehavior = DEFAULT_BEHAVIOR[call.name];
+        const defaultBehavior = context?.toolPermission?.readOnly === true
+            ? 'allow'
+            : DEFAULT_BEHAVIOR[call.name];
         return defaultBehavior === 'ask'
             ? this.askDecision(call, cwd, permissionMode, context, 'default', command
                 ? (subcommand) => matchingRule('allow', subcommandCall(subcommand)) === undefined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.52.0",
+  "version": "0.53.1",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",