praxis-agent 0.9.0 → 0.11.0

package/dist/core/runtime.d.ts

@@ -293,6 +293,10 @@ export interface ToolExecutionContext {
     messages?: readonly ModelMessage[];
     signal?: AbortSignal;
     toolResultDirectory?: string;
+    originalCall?: ModelToolCall;
+    permissionUpdates?: readonly PermissionUpdate[];
+    permissionPhase?: 'request' | 'execute';
+    permissionApproved?: boolean;
 }
 export interface ToolRegistry {
     definitions(): readonly ModelToolDefinition[];
@@ -300,9 +304,46 @@ export interface ToolRegistry {
     execute(call: ModelToolCall, context: ToolExecutionContext): Promise<ToolExecutionResult>;
 }
 export type PermissionBehavior = 'allow' | 'ask' | 'deny';
+export type PermissionMode = 'acceptEdits' | 'auto' | 'bypassPermissions' | 'manual' | 'dontAsk' | 'plan' | 'default';
+export type PermissionUpdateDestination = 'userSettings' | 'projectSettings' | 'localSettings' | 'session' | 'cliArg';
+export type PermissionUpdateMode = Exclude<PermissionMode, 'auto' | 'manual'>;
+export interface PermissionRuleValue {
+    toolName: string;
+    ruleContent?: string;
+}
+export type PermissionUpdate = {
+    type: 'addRules';
+    rules: readonly PermissionRuleValue[];
+    behavior: PermissionBehavior;
+    destination: PermissionUpdateDestination;
+} | {
+    type: 'replaceRules';
+    rules: readonly PermissionRuleValue[];
+    behavior: PermissionBehavior;
+    destination: PermissionUpdateDestination;
+} | {
+    type: 'removeRules';
+    rules: readonly PermissionRuleValue[];
+    behavior: PermissionBehavior;
+    destination: PermissionUpdateDestination;
+} | {
+    type: 'setMode';
+    mode: PermissionUpdateMode;
+    destination: PermissionUpdateDestination;
+} | {
+    type: 'addDirectories';
+    directories: readonly string[];
+    destination: PermissionUpdateDestination;
+} | {
+    type: 'removeDirectories';
+    directories: readonly string[];
+    destination: PermissionUpdateDestination;
+};
 export type PermissionApproval = boolean | {
     behavior: 'allow';
     updatedInput?: Record<string, unknown>;
+    updatedPermissions?: readonly PermissionUpdate[];
+    feedback?: string;
 } | {
     behavior: 'deny';
     message: string;
@@ -312,6 +353,9 @@ export interface PermissionResolutionContext {
     cwd: string;
     messages?: readonly ModelMessage[];
     signal?: AbortSignal;
+    toolResultDirectory?: string;
+    originalCall?: ModelToolCall;
+    permissionUpdates?: readonly PermissionUpdate[];
 }
 export type PermissionDecisionSource = 'auto-classifier' | 'rule' | 'mode' | 'default';
 export type AutoModePermissionOutcome = 'blocked' | 'unavailable';
@@ -321,6 +365,8 @@ export type PermissionDecision = {
 } | {
     behavior: 'ask';
     reason?: string;
+    suggestions?: readonly PermissionUpdate[];
+    metadata?: Readonly<Record<string, unknown>>;
     source?: PermissionDecisionSource;
 } | {
     behavior: 'deny';
@@ -369,7 +415,9 @@ export interface AgentRunRequest {
     toolResultDirectory?: string;
     observer?: AgentRunObserver;
     reloadMessages?: () => Promise<readonly ModelMessage[]>;
-    approveTool?: (call: ModelToolCall, originalCall?: ModelToolCall) => PermissionApproval | Promise<PermissionApproval>;
+    approveTool?: (call: ModelToolCall, originalCall?: ModelToolCall, decision?: PermissionDecision) => PermissionApproval | Promise<PermissionApproval>;
+    permissionUpdates?: readonly PermissionUpdate[];
+    onPermissionUpdates?: (updates: readonly PermissionUpdate[]) => void | Promise<void>;
     onStop?: (text: string) => Promise<readonly string[] | {
         messages: readonly string[];
         usage?: ModelUsage;
@@ -381,7 +429,7 @@ export interface AgentRunRequest {
     maxModelTurns?: number;
     betas?: readonly string[];
 }
-export interface AgentToolRecoveryRequest extends Pick<AgentRunRequest, 'approveTool' | 'cwd' | 'observer' | 'signal' | 'toolResultDirectory'> {
+export interface AgentToolRecoveryRequest extends Pick<AgentRunRequest, 'approveTool' | 'cwd' | 'observer' | 'onPermissionUpdates' | 'permissionUpdates' | 'signal' | 'toolResultDirectory'> {
     approveRecovery?: (call: ModelToolCall) => boolean | Promise<boolean>;
     messages?: readonly ModelMessage[];
 }

package/dist/core/runtime.js

@@ -444,7 +444,13 @@ export class AgentRuntime {
                 isError: true,
             };
         }
-        const context = { cwd: request.cwd ?? '', messages };
+        const context = {
+            cwd: request.cwd ?? '',
+            messages,
+            originalCall: call,
+            permissionPhase: 'request',
+            permissionUpdates: request.permissionUpdates ?? [],
+        };
         if (request.signal)
             context.signal = request.signal;
         if (request.toolResultDirectory) {
@@ -478,16 +484,26 @@ export class AgentRuntime {
         let allowed = decision.behavior === 'allow';
         let denialReason;
         let interrupt = false;
+        let approvalFeedback;
         if (decision.behavior === 'ask') {
             this.emit({ type: 'state', state: 'awaiting-permission' });
             const approval = request.approveTool
-                ? await request.approveTool(prepared, call)
+                ? await request.approveTool(prepared, call, decision)
                 : false;
             if (typeof approval === 'boolean') {
                 allowed = approval;
             }
             else if (approval.behavior === 'allow') {
                 allowed = true;
+                approvalFeedback = approval.feedback?.trim() || undefined;
+                if (approval.updatedPermissions?.length) {
+                    const updatedPermissions = [
+                        ...(context.permissionUpdates ?? []),
+                        ...approval.updatedPermissions,
+                    ];
+                    await request.onPermissionUpdates?.(approval.updatedPermissions);
+                    context.permissionUpdates = updatedPermissions;
+                }
                 if (approval.updatedInput) {
                     try {
                         prepared = await tools.prepare({ ...call, input: approval.updatedInput }, context);
@@ -521,8 +537,19 @@ export class AgentRuntime {
         if (request.signal?.aborted)
             return this.cancel();
         this.emit({ type: 'state', state: 'executing-tools' });
+        context.permissionPhase = 'execute';
+        context.permissionApproved = true;
         try {
-            return await tools.execute(prepared, context);
+            const result = await tools.execute(prepared, context);
+            if (!approvalFeedback)
+                return result;
+            return {
+                ...result,
+                followUpUserMessages: [
+                    ...(result.followUpUserMessages ?? []),
+                    approvalFeedback,
+                ],
+            };
         }
         catch (error) {
             if (request.signal?.aborted)

package/dist/extensions/claude-extension-tools.d.ts

@@ -10,7 +10,8 @@ export declare class ClaudeExtensionToolRegistry implements ToolRegistry {
 }
 export declare class ClaudeExtensionPermissionResolver implements PermissionResolver {
     private readonly base;
-    constructor(base: PermissionResolver);
-    resolve(call: ModelToolCall, context?: PermissionResolutionContext): PermissionDecision | Promise<PermissionDecision>;
+    private readonly catalog;
+    constructor(base: PermissionResolver, catalog: ClaudeExtensionCatalog);
+    resolve(call: ModelToolCall, context?: PermissionResolutionContext): Promise<PermissionDecision>;
 }
 //# sourceMappingURL=claude-extension-tools.d.ts.map

package/dist/extensions/claude-extension-tools.js

@@ -66,13 +66,23 @@ export class ClaudeExtensionToolRegistry {
 }
 export class ClaudeExtensionPermissionResolver {
     base;
-    constructor(base) {
+    catalog;
+    constructor(base, catalog) {
         this.base = base;
+        this.catalog = catalog;
     }
-    resolve(call, context) {
-        return call.name === 'Skill'
-            ? { behavior: 'allow' }
-            : this.base.resolve(call, context);
+    async resolve(call, context) {
+        const decision = await this.base.resolve(call, context);
+        if (call.name !== 'Skill' || decision.behavior !== 'ask')
+            return decision;
+        const input = skillInput(call);
+        const definition = this.catalog.skill(input.skill.replace(/^\//u, ''));
+        if (definition?.modelInvocable && definition.permissionSafe) {
+            return { behavior: 'allow' };
+        }
+        return definition
+            ? { ...decision, metadata: { command: definition } }
+            : decision;
     }
 }
 //# sourceMappingURL=claude-extension-tools.js.map

package/dist/extensions/claude-extensions.d.ts

@@ -8,6 +8,7 @@ export interface ClaudeExtensionDefinition extends ClaudeTextResource {
     description: string;
     body: string;
     modelInvocable: boolean;
+    permissionSafe: boolean;
 }
 export interface ClaudeSlashCommandDefinition {
     name: string;

package/dist/extensions/claude-extensions.js

@@ -8,6 +8,7 @@ const BUILTIN_LOOP = {
     name: 'loop',
     description: 'Run a prompt or slash command on a recurring interval; defaults to 10 minutes.',
     modelInvocable: true,
+    permissionSafe: true,
     body: `# /loop — schedule a recurring prompt
 
 Parse the input into an optional interval followed by a prompt, then schedule it with CronCreate.
@@ -128,6 +129,14 @@ function parseDefinition(kind, resource) {
             ? metadata.name
             : defaultName(kind, resource.path);
     const description = typeof metadata.description === 'string' ? metadata.description : '';
+    const allowedTools = metadata['allowed-tools'];
+    const hasAllowedTools = Array.isArray(allowedTools)
+        ? allowedTools.length > 0
+        : typeof allowedTools === 'string' && allowedTools.trim().length > 0;
+    const hooks = metadata.hooks;
+    const hasHooks = hooks !== undefined &&
+        hooks !== null &&
+        (typeof hooks !== 'object' || Object.keys(hooks).length > 0);
     return {
         ...resource,
         kind,
@@ -135,6 +144,7 @@ function parseDefinition(kind, resource) {
         description,
         body,
         modelInvocable: metadata['disable-model-invocation'] !== true,
+        permissionSafe: !hasAllowedTools && !hasHooks,
     };
 }
 function indexed(kind, resources) {

package/dist/hooks/claude-hook-tools.js

@@ -62,7 +62,7 @@ export class ClaudeHookToolCoordinator {
             tool_name: call.name,
             tool_input: prepared?.hookInput ?? call.input,
             tool_use_id: call.id,
-            permission_suggestions: [],
+            permission_suggestions: decision.suggestions ?? [],
         }, call.name, prepared?.signal);
         await this.options.recordOutcome(outcome);
         if (outcome.blockedReason || outcome.permissionDecision === 'deny') {

package/dist/mcp/claude-mcp-tools.js

@@ -8,6 +8,7 @@ import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { ElicitRequestSchema, ElicitationCompleteNotificationSchema, PromptListChangedNotificationSchema, } from '@modelcontextprotocol/sdk/types.js';
 import { redactSensitiveError, redactSensitiveText, redactSensitiveValue, sanitizeChildEnvironment, sensitiveEnvironmentValues, } from '../platform/sensitive-data.js';
+import { parsePermissionUpdates } from '../permissions/permission-updates.js';
 import { loadMcpOAuthProvider, mcpOAuthServerIdentity, } from './claude-mcp-oauth.js';
 const MAX_TOOL_PAGES = 100;
 const MAX_TOOLS = 10_000;
@@ -270,20 +271,25 @@ function toolContent(result, sensitiveValues) {
     }
     return redactSensitiveText(parts.join('\n'), sensitiveValues);
 }
-const INVALID_PERMISSION_RESULT = "The permission prompt tool returned an invalid permission result. Expected {behavior: 'allow', updatedInput?: object} or {behavior: 'deny', message: string}.";
+const INVALID_PERMISSION_RESULT = "The permission prompt tool returned an invalid permission result. Expected {behavior: 'allow', updatedInput: object} or {behavior: 'deny', message: string}.";
 function invalidPermissionResult() {
     return { behavior: 'deny', message: INVALID_PERMISSION_RESULT };
 }
-function parsePermissionResult(source) {
+function parsePermissionResult(source, currentInput) {
     const value = JSON.parse(source);
     if (!isRecord(value))
         return invalidPermissionResult();
     if (value.behavior === 'allow') {
-        if (value.updatedInput === undefined)
-            return { behavior: 'allow' };
         if (!isRecord(value.updatedInput))
             return invalidPermissionResult();
-        return { behavior: 'allow', updatedInput: value.updatedInput };
+        const updatedPermissions = parsePermissionUpdates(value.updatedPermissions);
+        return {
+            behavior: 'allow',
+            updatedInput: Object.keys(value.updatedInput).length === 0
+                ? currentInput
+                : value.updatedInput,
+            ...(updatedPermissions ? { updatedPermissions } : {}),
+        };
     }
     if (value.behavior === 'deny' && typeof value.message === 'string') {
         return {
@@ -812,7 +818,7 @@ export class ClaudeMcpToolRegistry {
                 return invalidPermissionResult();
             }
             try {
-                return parsePermissionResult(toolContent(result, tool.sensitiveValues));
+                return parsePermissionResult(toolContent(result, tool.sensitiveValues), call.input);
             }
             catch {
                 return invalidPermissionResult();

package/dist/permissions/bash-ast.d.ts

@@ -0,0 +1,39 @@
+export declare const MAX_BASH_PERMISSION_COMMANDS = 50;
+export type BashSemanticResult = {
+    safe: true;
+} | {
+    safe: false;
+    reason: string;
+};
+export type BashWrapperResult = {
+    ok: true;
+    argv: string[];
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function normalizeBashWrapperArgv(input: readonly string[]): BashWrapperResult;
+export interface BashStaticCommand {
+    text: string;
+    argv: readonly string[];
+}
+export interface BashStaticRedirect {
+    operator: '>' | '>>' | '<' | '>&' | '<&' | '>|' | '&>' | '&>>' | '<<<';
+    target: string;
+}
+export type BashStaticAnalysis = {
+    parsed: true;
+    commands: readonly BashStaticCommand[];
+    redirects: readonly BashStaticRedirect[];
+} | {
+    parsed: false;
+    reason: string;
+};
+export declare function analyzeBashStructure(source: string): BashStaticAnalysis;
+export declare function validateBashSemantics(source: string): BashSemanticResult;
+export interface BashCommandAnalysis {
+    commands: readonly string[];
+    parsed: boolean;
+}
+export declare function analyzeBashCommands(source: string): BashCommandAnalysis;
+//# sourceMappingURL=bash-ast.d.ts.map