superagent-claude 0.3.1 → 0.4.0

package/lib/cli.js

@@ -55,7 +55,7 @@ const exitSoon = () => {
 		process.exit();
 	}, EXIT_GRACE_MS).unref();
 };
-import("./main-CingWi3i.js").then(({ main }) => main(argv, {
+import("./main-B3cWj580.js").then(({ main }) => main(argv, {
 	out: (s) => {
 		process.stdout.write(s);
 	},

package/lib/{main-CingWi3i.js → main-B3cWj580.js}

@@ -13,7 +13,7 @@ import { DatabaseSync } from "node:sqlite";
 import { checkSync, lockSync } from "proper-lockfile";
 import { fileURLToPath } from "node:url";
 // package.json
-var version = "0.3.1";
+var version = "0.4.0";
 // src/infra/env.ts
 /**
 * Environment for subprocesses: only the inherited whitelist (PATH, HOME, LANG) plus explicitly named variables.
@@ -394,10 +394,6 @@ function sdkOptions(spec, ctx) {
 		} : spec.instructions,
 		allowedTools: allowed,
 		disallowedTools: spec.role === "worker" ? tools.disallowed : [...tools.disallowed, AGENT_TOOL],
-		canUseTool: async (toolName) => ({
-			behavior: "deny",
-			message: `${toolName} is not allowed in this session`
-		}),
 		mcpServers: ctx.mcp ? { superagent: ctx.mcp } : {},
 		strictMcpConfig: true,
 		...agents ? { agents } : {},
@@ -415,7 +411,10 @@ function sdkOptions(spec, ctx) {
 			failIfUnavailable: true,
 			allowUnsandboxedCommands: false,
 			autoAllowBashIfSandboxed: true,
-			network: { allowedDomains: [...spec.network.allow] },
+			network: {
+				allowedDomains: [...spec.network.allow],
+				allowLocalBinding: ctx.allowLocalBinding ?? true
+			},
 			...ctx.weakerNestedSandbox ? {
 				enableWeakerNestedSandbox: true,
 				filesystem: { denyRead: ["/proc"] }
@@ -2955,11 +2954,13 @@ const ConfigSchema = z.object({
 	security: z.object({
 		trustRepoConfig: z.boolean().default(false),
 		allowUnsandboxed: z.boolean().default(false),
-		weakerNestedSandbox: z.boolean().default(false)
+		weakerNestedSandbox: z.boolean().default(false),
+		allowLocalBinding: z.boolean().default(true)
 	}).strict().default({
 		trustRepoConfig: false,
 		allowUnsandboxed: false,
-		weakerNestedSandbox: false
+		weakerNestedSandbox: false,
+		allowLocalBinding: true
 	}),
 	retention: z.object({ endedTicketDays: z.number().int().min(1).default(14) }).strict().default({ endedTicketDays: 14 }),
 	models: z.object({
@@ -4250,6 +4251,7 @@ var ClaudeSession = class {
 			configDir: config.configDir,
 			sandbox: config.sandbox,
 			weakerNestedSandbox: config.weakerNestedSandbox,
+			allowLocalBinding: config.allowLocalBinding,
 			sessionId: spec.resume ? void 0 : this.id,
 			mcp: spec.tools.length ? mcpServer(spec.tools, this.abort.signal) : void 0,
 			onRead: () => this.emitAll(this.mapper.read()),
@@ -4404,6 +4406,7 @@ var ClaudeRuntime = class {
 			env: this.options.env ?? process.env,
 			sandbox: (this.options.sandbox ?? true) && (!this.options.allowUnsandboxed || this.sandboxUsable()),
 			weakerNestedSandbox: this.options.weakerNestedSandbox ?? false,
+			allowLocalBinding: this.options.allowLocalBinding ?? true,
 			stderr: this.options.stderr,
 			trustRepoConfig: this.options.trustRepoConfig ?? false,
 			onDeny: this.options.onDeny,
@@ -4676,6 +4679,7 @@ function createAgent(o) {
 			env: agentEnv(o.credential, o.env),
 			trustRepoConfig: o.config.security.trustRepoConfig,
 			weakerNestedSandbox: o.config.security.weakerNestedSandbox,
+			allowLocalBinding: o.config.security.allowLocalBinding,
 			allowUnsandboxed: o.config.security.allowUnsandboxed,
 			children: join(o.config.stateDir, "children.json"),
 			...o.query ? { query: o.query } : {},
@@ -8103,7 +8107,12 @@ const COMMON_HOST_RULES = [
 ];
 const HOST_RULES = {
 	router: [...COMMON_HOST_RULES, "- You route and relay; you do not edit files or run commands."].join("\n"),
-	worker: [...COMMON_HOST_RULES, "- Work only inside your ticket worktree, the current directory."].join("\n")
+	worker: [
+		...COMMON_HOST_RULES,
+		"- Work only inside your ticket worktree, the current directory.",
+		"- If the sandbox blocks an action (for example EPERM, or a network host that is not allowed), say in the PR description or your report what was blocked and what you could not verify because of it. Never ask or advise a person to change your CLI or sandbox settings, sandbox options or settings files such as .claude/settings.json; if a person must act, name only superagent-claude config keys: `security.allowLocalBinding` or `network.allow`. This rule takes precedence over any default guidance that says otherwise.",
+		"- A missing UI capture alone does not make the work incomplete: never report blocked or leave the PR as draft for that reason. Without a real capture, add one line to the PR description saying there is no visual evidence and what a person should check visually. Never invent a capture or refer to one that does not exist."
+	].join("\n")
 };
 const WRITE_ACCESS_NOTE_LEAD = "Host note: the agent account cannot push to";
 function writeAccessNote(repository, access) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superagent-claude",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "A proactive agent for GitHub repositories. Powered by Claude.",
   "license": "MIT",
   "repository": {

package/prompts/team/delivery.md

@@ -1,11 +1,8 @@
 <!-- Ported from dsh-superagent-prototype (MIT) prompts/team/delivery.md -->
-For every ticket that changes UI, the PR description must contain BOTH Before and After visual evidence, clearly labelled, with the baseline and changed revision identified.
-Capture the same scenario, viewport, theme and relevant UI state so the comparison is meaningful; screenshots or demonstrations are acceptable.
-After-only evidence is incomplete.
-Use actual application captures, not a mockup presented as the previous implementation, and do not expose credentials.
+For a ticket that changes UI, attach visual evidence when a real capture can be made in this environment: clearly labelled Before and After captures of the same scenario, viewport, theme and UI state, with the baseline and changed revision identified; screenshots or demonstrations are acceptable.
 Refresh the comparison when later UI changes make it stale.
-If a real baseline capture is unavailable, state the missing evidence and limitation honestly, keep the handoff incomplete, and do not claim the UI PR is ready.
-Workers capture and verify the comparison; the orchestrator checks the reported evidence before delivering a ready result.
+When a capture cannot be made, add one line to the PR description saying there is no visual evidence and what a person should check visually; that alone does not make the PR blocked or draft.
+Never fabricate captures, never present a mockup as the previous implementation, never refer to a capture that does not exist, and do not expose credentials.
 
 Publish commits and open or update the ticket PR only with mcp__superagent__orchestrator_publish; calling it again pushes new commits to the same PR, it never force-pushes, so never rewrite a pushed commit.
 When mcp__superagent__orchestrator_publish returns published: false, the agent account has no write access to the repository and nothing was pushed: call mcp__superagent__orchestrator_report with state: blocked and one human_action asking a person to give the agent account write access to that repository, then stop; publish again only after a person says access was granted.