toolcraft 0.0.383 → 0.0.385

package/README.md

@@ -33,7 +33,7 @@ const result = await shell.exec("tools list-users --limit 10 --output json");
 await shell.dispose();
 ```
 
-Each root name and alias becomes a virtual command. Nested groups, command aliases,
+Each root name, its kebab-case spelling and aliases become virtual commands. Nested groups, command aliases,
 default commands, positional arguments, schema defaults, scalar/enum/array/object/
 record/union inputs and CLI scope filtering reuse Toolcraft's CLI parser. Hidden
 commands are excluded from this surface. Standalone CLI behavior remains unchanged.
@@ -98,9 +98,15 @@ provider and effective limits as `ctx.regex.executor` and `ctx.regex.limits`.
 safe-bash exports; missing regex never gains a native JavaScript fallback. Native
 handlers can use `signal`, byte `stdin`/`stdout`/`stderr`, `cwd`, `inputBudget`,
 `invoke` and `registerCleanup`. Dry-run readback uses an explicitly supplied mock
-or overlay filesystem. Library services combine with invocation services; runtime
-capability names are reserved and cannot be replaced through services.
-Schema pattern validation currently follows Toolcraft's existing validator.
+or overlay filesystem. Library services combine with invocation services, with
+invocation-owned services taking precedence on name collisions. Runtime capability
+names are reserved and cannot be replaced through services. Explicitly revoking
+`humanInLoop` also disables a library-configured approval provider.
+Schema `pattern` and `patternProperties` validation is unsupported in this native
+surface: registration rejects these keywords in parameter and stream-event schemas,
+including nested JSON Schema definitions, instead of using the host regex engine.
+Tools that need regex work can use the injected bounded provider in their handlers.
+CLI-excluded roots are also inaccessible through the public command executor.
 
 ## What the owner decides
 

package/composition.json

@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.383",
+      "version": "0.0.385",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.383",
+      "version": "0.0.385",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.383",
+      "version": "0.0.385",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.383",
+      "version": "0.0.385",
       "license": "MIT"
     },
     {

package/dist/safe-bash.d.ts

@@ -17,7 +17,7 @@ export interface ToolcraftInvocation<TServices extends object = Record<string, n
     signal: AbortSignal;
     services?: TServices;
     fetch?: typeof globalThis.fetch;
-    humanInLoop?: HumanInLoopRuntime;
+    humanInLoop?: HumanInLoopRuntime | undefined;
 }
 declare module "./index.js" {
     interface HandlerInvocationCapabilities {

package/dist/safe-bash.js

@@ -1,5 +1,5 @@
 import path from "node:path";
-import { cloneDefaultValue, validate } from "toolcraft-schema";
+import { cloneDefaultValue, toJsonSchema, validate } from "toolcraft-schema";
 import { executeCLICommand, formatCLIName } from "./cli.js";
 import { validateServices } from "./runtime/io.js";
 /** Checks paths, parameter names and values against a library's inferred definitions. */
@@ -79,11 +79,42 @@ function handlerFileSystem(invocation) {
         }
     };
 }
+function assertNativeSchema(schema, commandPath) {
+    if (schema === null || typeof schema !== "object" || Array.isArray(schema))
+        return;
+    const document = schema;
+    if (document.pattern !== undefined || document.patternProperties !== undefined) {
+        throw new TypeError(`Schema regex validation is unsupported in native Toolcraft commands: ${commandPath}; use the invocation's bounded regex capability in the handler`);
+    }
+    // Visit schema positions only: parameter names and literal defaults are not keywords.
+    for (const key of ["properties", "$defs", "definitions", "dependentSchemas", "dependencies"]) {
+        const map = document[key];
+        if (map !== null && typeof map === "object" && !Array.isArray(map)) {
+            for (const child of Object.values(map))
+                assertNativeSchema(child, commandPath);
+        }
+    }
+    for (const key of ["allOf", "anyOf", "oneOf", "prefixItems", "items", "additionalItems", "additionalProperties", "contains", "if", "then", "else", "not", "propertyNames", "unevaluatedItems", "unevaluatedProperties"]) {
+        const child = document[key];
+        if (Array.isArray(child)) {
+            for (const item of child)
+                assertNativeSchema(item, commandPath);
+        }
+        else
+            assertNativeSchema(child, commandPath);
+    }
+}
 /** Executes already-tokenized argv in process, using the same parser and dispatch as runCLI. */
 export function createToolcraftCommandExecutor(library, options = {}) {
-    const roots = Array.isArray(library) ? library : [library];
+    const roots = (Array.isArray(library) ? library : [library])
+        .filter(root => !root.scope || root.scope.includes("cli"));
     const multiple = Array.isArray(library);
     const commands = new Map(roots.flatMap(root => [...discoverCommands(root, multiple ? `${root.name}/` : "")]));
+    for (const [commandPath, command] of commands) {
+        assertNativeSchema(toJsonSchema(command.params), commandPath);
+        if (command.stream)
+            assertNativeSchema(toJsonSchema(command.stream.event), commandPath);
+    }
     const defaults = cloneDefaultValue(options.defaults ?? {});
     for (const [commandPath, values] of Object.entries(defaults)) {
         const command = commands.get(commandPath);
@@ -106,9 +137,9 @@ export function createToolcraftCommandExecutor(library, options = {}) {
             let root;
             try {
                 const configuredServices = typeof options.services === "function" ? options.services(invocation) : options.services;
-                services = { ...invocation.services, ...configuredServices };
+                services = { ...configuredServices, ...invocation.services };
                 const rootName = multiple ? argv[0] : roots[0]?.name;
-                const selectedRoot = multiple ? roots.find(candidate => candidate.name === rootName || candidate.aliases.includes(rootName ?? "")) : roots[0];
+                const selectedRoot = multiple ? roots.find(candidate => candidate.name === rootName || formatCLIName(candidate.name, "kebab") === rootName || candidate.aliases.includes(rootName ?? "")) : roots[0];
                 if (!selectedRoot)
                     throw new TypeError(`Unknown toolcraft root: ${rootName}`);
                 root = selectedRoot;
@@ -152,7 +183,7 @@ export function createToolcraftCommandExecutor(library, options = {}) {
                 env: { ...invocation.env },
                 fs: handlerFileSystem(invocation),
                 fetch: invocation.fetch ?? deniedFetch,
-                humanInLoop: invocation.humanInLoop ?? options.humanInLoop,
+                humanInLoop: Object.prototype.hasOwnProperty.call(invocation, "humanInLoop") ? invocation.humanInLoop : options.humanInLoop,
                 controls: { output: true, yes: true, ...options.controls },
                 errorReports: false,
                 outputEmitter: entry => runtime.write(`${entry}\n`)
@@ -173,7 +204,7 @@ export function toolcraftCommands(library, options = {}) {
             for (const root of roots) {
                 if (root.scope && !root.scope.includes("cli"))
                     continue;
-                for (const name of [root.name, ...root.aliases]) {
+                for (const name of new Set([root.name, formatCLIName(root.name, "kebab"), ...root.aliases])) {
                     host.commands.register({
                         name,
                         description: root.description,
@@ -184,7 +215,7 @@ export function toolcraftCommands(library, options = {}) {
                                 services: capabilities?.services,
                                 fetch: capabilities?.fetch,
                                 regex: capabilities?.regex,
-                                humanInLoop: capabilities?.humanInLoop
+                                ...(Object.prototype.hasOwnProperty.call(capabilities ?? {}, "humanInLoop") ? { humanInLoop: capabilities?.humanInLoop } : {})
                             });
                         }
                     });

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.383",
+      "version": "0.0.385",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.383",
+  "version": "0.0.385",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.383",
+  "version": "0.0.385",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -162,7 +162,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.383",
+    "toolcraft-schema": "0.0.385",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",