superagent-claude 0.3.0 → 0.4.0

package/README.md

@@ -20,7 +20,7 @@ It needs Node.js 22.19 or later. `npx superagent-claude start --config superagen
 
 `auth.mode` picks which one (`api-key` or `subscription`); Bedrock and Vertex also work. See [docs/authentication.md](docs/authentication.md) for both modes and the subscription terms warning.
 
-The config needs `repositories`, `policy.allowed` and `auth.mode`. See [docs/getting-started.md](docs/getting-started.md), which also covers building from source.
+The config needs `repositories` and `policy.allowed`; `auth.mode` defaults to `api-key` and needs its credential. See [docs/getting-started.md](docs/getting-started.md), which also covers building from source.
 
 A container image is published as `ghcr.io/ok0/superagent-claude`. See [Docker](docs/deploy.md#docker) to run it.
 

package/lib/cli.js

@@ -55,7 +55,7 @@ const exitSoon = () => {
 		process.exit();
 	}, EXIT_GRACE_MS).unref();
 };
-import("./main-CX62QQM7.js").then(({ main }) => main(argv, {
+import("./main-B3cWj580.js").then(({ main }) => main(argv, {
 	out: (s) => {
 		process.stdout.write(s);
 	},

package/lib/{main-CX62QQM7.js → main-B3cWj580.js}

@@ -13,7 +13,7 @@ import { DatabaseSync } from "node:sqlite";
 import { checkSync, lockSync } from "proper-lockfile";
 import { fileURLToPath } from "node:url";
 // package.json
-var version = "0.3.0";
+var version = "0.4.0";
 // src/infra/env.ts
 /**
 * Environment for subprocesses: only the inherited whitelist (PATH, HOME, LANG) plus explicitly named variables.
@@ -394,10 +394,6 @@ function sdkOptions(spec, ctx) {
 		} : spec.instructions,
 		allowedTools: allowed,
 		disallowedTools: spec.role === "worker" ? tools.disallowed : [...tools.disallowed, AGENT_TOOL],
-		canUseTool: async (toolName) => ({
-			behavior: "deny",
-			message: `${toolName} is not allowed in this session`
-		}),
 		mcpServers: ctx.mcp ? { superagent: ctx.mcp } : {},
 		strictMcpConfig: true,
 		...agents ? { agents } : {},
@@ -415,7 +411,10 @@ function sdkOptions(spec, ctx) {
 			failIfUnavailable: true,
 			allowUnsandboxedCommands: false,
 			autoAllowBashIfSandboxed: true,
-			network: { allowedDomains: [...spec.network.allow] },
+			network: {
+				allowedDomains: [...spec.network.allow],
+				allowLocalBinding: ctx.allowLocalBinding ?? true
+			},
 			...ctx.weakerNestedSandbox ? {
 				enableWeakerNestedSandbox: true,
 				filesystem: { denyRead: ["/proc"] }
@@ -2955,11 +2954,13 @@ const ConfigSchema = z.object({
 	security: z.object({
 		trustRepoConfig: z.boolean().default(false),
 		allowUnsandboxed: z.boolean().default(false),
-		weakerNestedSandbox: z.boolean().default(false)
+		weakerNestedSandbox: z.boolean().default(false),
+		allowLocalBinding: z.boolean().default(true)
 	}).strict().default({
 		trustRepoConfig: false,
 		allowUnsandboxed: false,
-		weakerNestedSandbox: false
+		weakerNestedSandbox: false,
+		allowLocalBinding: true
 	}),
 	retention: z.object({ endedTicketDays: z.number().int().min(1).default(14) }).strict().default({ endedTicketDays: 14 }),
 	models: z.object({
@@ -3066,18 +3067,8 @@ const SUBSCRIPTION_POLICY_WARNING = "auth.mode subscription runs the agent on a
 const SHARED_USE_WARNING = "ToS risk: with auth.mode subscription, people other than the subscription owner (policy.allowed is not exactly [auth.owner]) can make the agent work on the owner's subscription; this shared use may violate the subscription terms.";
 const SANDBOX_DOC = "docs/deploy.md#sandbox-in-containers";
 const UNSANDBOXED_WARNING = `security.allowUnsandboxed is true and the runtime sandbox is unavailable here: sessions run without the sandbox, network.allow is not enforced and commands can read the agent's tokens from other processes; restrict egress outside the agent (see ${SANDBOX_DOC})`;
-const RULE_NUMBER = {
-	credential: 1,
-	"allowed-empty": 2,
-	"repositories-empty": 3,
-	"agent-allowed": 4,
-	"subscription-shared": 6,
-	unsandboxed: 7,
-	"no-repository": 8
-};
 function refused(rule, text) {
-	const number = RULE_NUMBER[rule];
-	return new StartupRefused(rule, number ? `Startup refused (rule ${number}, ${rule}): ${text}` : `Startup refused (${rule}): ${text}`);
+	return new StartupRefused(rule, `Startup refused (${rule}): ${text}`);
 }
 const present = (value) => typeof value === "string" && value.trim() !== "";
 function resolveCredential(mode, env) {
@@ -4260,6 +4251,7 @@ var ClaudeSession = class {
 			configDir: config.configDir,
 			sandbox: config.sandbox,
 			weakerNestedSandbox: config.weakerNestedSandbox,
+			allowLocalBinding: config.allowLocalBinding,
 			sessionId: spec.resume ? void 0 : this.id,
 			mcp: spec.tools.length ? mcpServer(spec.tools, this.abort.signal) : void 0,
 			onRead: () => this.emitAll(this.mapper.read()),
@@ -4414,6 +4406,7 @@ var ClaudeRuntime = class {
 			env: this.options.env ?? process.env,
 			sandbox: (this.options.sandbox ?? true) && (!this.options.allowUnsandboxed || this.sandboxUsable()),
 			weakerNestedSandbox: this.options.weakerNestedSandbox ?? false,
+			allowLocalBinding: this.options.allowLocalBinding ?? true,
 			stderr: this.options.stderr,
 			trustRepoConfig: this.options.trustRepoConfig ?? false,
 			onDeny: this.options.onDeny,
@@ -4686,6 +4679,7 @@ function createAgent(o) {
 			env: agentEnv(o.credential, o.env),
 			trustRepoConfig: o.config.security.trustRepoConfig,
 			weakerNestedSandbox: o.config.security.weakerNestedSandbox,
+			allowLocalBinding: o.config.security.allowLocalBinding,
 			allowUnsandboxed: o.config.security.allowUnsandboxed,
 			children: join(o.config.stateDir, "children.json"),
 			...o.query ? { query: o.query } : {},
@@ -8113,7 +8107,12 @@ const COMMON_HOST_RULES = [
 ];
 const HOST_RULES = {
 	router: [...COMMON_HOST_RULES, "- You route and relay; you do not edit files or run commands."].join("\n"),
-	worker: [...COMMON_HOST_RULES, "- Work only inside your ticket worktree, the current directory."].join("\n")
+	worker: [
+		...COMMON_HOST_RULES,
+		"- Work only inside your ticket worktree, the current directory.",
+		"- If the sandbox blocks an action (for example EPERM, or a network host that is not allowed), say in the PR description or your report what was blocked and what you could not verify because of it. Never ask or advise a person to change your CLI or sandbox settings, sandbox options or settings files such as .claude/settings.json; if a person must act, name only superagent-claude config keys: `security.allowLocalBinding` or `network.allow`. This rule takes precedence over any default guidance that says otherwise.",
+		"- A missing UI capture alone does not make the work incomplete: never report blocked or leave the PR as draft for that reason. Without a real capture, add one line to the PR description saying there is no visual evidence and what a person should check visually. Never invent a capture or refer to one that does not exist."
+	].join("\n")
 };
 const WRITE_ACCESS_NOTE_LEAD = "Host note: the agent account cannot push to";
 function writeAccessNote(repository, access) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superagent-claude",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "A proactive agent for GitHub repositories. Powered by Claude.",
   "license": "MIT",
   "repository": {

package/prompts/team/delivery.md

@@ -1,11 +1,8 @@
 <!-- Ported from dsh-superagent-prototype (MIT) prompts/team/delivery.md -->
-For every ticket that changes UI, the PR description must contain BOTH Before and After visual evidence, clearly labelled, with the baseline and changed revision identified.
-Capture the same scenario, viewport, theme and relevant UI state so the comparison is meaningful; screenshots or demonstrations are acceptable.
-After-only evidence is incomplete.
-Use actual application captures, not a mockup presented as the previous implementation, and do not expose credentials.
+For a ticket that changes UI, attach visual evidence when a real capture can be made in this environment: clearly labelled Before and After captures of the same scenario, viewport, theme and UI state, with the baseline and changed revision identified; screenshots or demonstrations are acceptable.
 Refresh the comparison when later UI changes make it stale.
-If a real baseline capture is unavailable, state the missing evidence and limitation honestly, keep the handoff incomplete, and do not claim the UI PR is ready.
-Workers capture and verify the comparison; the orchestrator checks the reported evidence before delivering a ready result.
+When a capture cannot be made, add one line to the PR description saying there is no visual evidence and what a person should check visually; that alone does not make the PR blocked or draft.
+Never fabricate captures, never present a mockup as the previous implementation, never refer to a capture that does not exist, and do not expose credentials.
 
 Publish commits and open or update the ticket PR only with mcp__superagent__orchestrator_publish; calling it again pushes new commits to the same PR, it never force-pushes, so never rewrite a pushed commit.
 When mcp__superagent__orchestrator_publish returns published: false, the agent account has no write access to the repository and nothing was pushed: call mcp__superagent__orchestrator_report with state: blocked and one human_action asking a person to give the agent account write access to that repository, then stop; publish again only after a person says access was granted.