devops-bot-sdk 1.6.4__tar.gz → 1.6.8__tar.gz

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.4
+Version: 1.6.8
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.6.4
+Version: 1.6.8
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -97,7 +97,9 @@ tests/test_agent_listing.py
 tests/test_agent_prompt_async.py
 tests/test_agent_prompt_models.py
 tests/test_agent_run_ticket.py
+tests/test_agent_workspace_settings.py
 tests/test_agents_connectors_builder.py
+tests/test_allowed_tools_config.py
 tests/test_git_action.py
 tests/test_github_ingest.py
 tests/test_health.py

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.6.4
+Version: 1.6.8
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -30,7 +30,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.6.4"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.6.8"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/sdk/agentd.py

@@ -543,7 +543,7 @@ class AgentDaemon:
         validate) is logged and skipped — it must never prevent PERSONAL
         agents from loading.
         """
-        from sdk.agents.manifest import AgentManifest
+        from sdk.agents.manifest import manifest_from_backend_row
 
         try:
             rows = await self.client.list_department_agents()
@@ -555,13 +555,15 @@ class AgentDaemon:
         for row in rows:
             if row.get("status") != "active":
                 continue
-            try:
-                manifests.append(AgentManifest(**row["manifest"]))
-            except Exception as exc:  # noqa: BLE001
+            # Prompt-based rows: the `manifest` column this used to read was
+            # dropped from the table, so every row raised KeyError here.
+            manifest = manifest_from_backend_row(row)
+            if manifest is None:
                 logger.warning(
-                    "agentd.department_agent_manifest_invalid name=%s err=%s",
-                    row.get("name"), exc,
+                    "agentd.department_agent_not_runnable name=%s", row.get("name"),
                 )
+                continue
+            manifests.append(manifest)
         return manifests
 
     async def watch_tickets(self) -> None:

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/sdk/agents/chat.py

@@ -41,14 +41,60 @@ def _tee_events(log_path, on_event: "EventHandler | None") -> "EventHandler":
 EventHandler = Callable[[dict], Awaitable[None]]
 
 
-def _find_agent(name: str) -> AgentManifest:
-    match = next((m for m in load_agents() if m.name == name), None)
-    if match is None:
-        raise LookupError(
-            f"no local agent named '{name}' — install it first "
-            f"(agentos agent add / default-agents activate)"
-        )
-    return match
+def _find_agent(name: str) -> AgentManifest | None:
+    """A LOCAL manifest by name (``~/.agentos/agents``), or None."""
+    return next((m for m in load_agents() if m.name == name), None)
+
+
+async def resolve_agent(name: str, client=None) -> AgentManifest:
+    """Find the agent to run: local manifest → your backend agents → department.
+
+    The BACKEND is where agents live now — they are authored in the web app, and
+    nothing writes ``~/.agentos/agents`` anymore. Resolving only locally meant
+    every agent the UI could list was unrunnable ("no local agent named …"), for
+    department defaults as much as personal ones. A local manifest still wins when
+    present, so a hand-written one keeps overriding its backend namesake.
+
+    ``client`` lets a caller that already has one pass it in rather than having a
+    second one built here behind its back.
+
+    Raises ``LookupError`` naming every place that was checked and why.
+    """
+    local = _find_agent(name)
+    if local is not None:
+        return local
+
+    from sdk.agents.manifest import manifest_from_backend_row
+
+    if client is None:
+        from sdk.client import BackendClient
+        client = BackendClient.from_config()
+
+    reasons: list[str] = []
+    for label, attr in (("your agents", "list_custom_agents"),
+                        ("department defaults", "list_department_agents")):
+        fetch = getattr(client, attr, None)
+        if fetch is None:
+            continue
+        try:
+            rows = await fetch() or []
+        except Exception as exc:  # noqa: BLE001 — a fetch failure is not "not found"
+            reasons.append(f"{label} could not be fetched ({str(exc) or type(exc).__name__})")
+            continue
+        for row in rows:
+            if row.get("name") == name:
+                manifest = manifest_from_backend_row(row)
+                if manifest is not None:
+                    return manifest
+                reasons.append(
+                    f"'{name}' is in your {label} but its prompt is empty, so there "
+                    f"is no instruction to run — add one in the web app"
+                )
+
+    detail = "; ".join(reasons) if reasons else (
+        "not in ~/.agentos/agents/, your backend agents, or your department defaults"
+    )
+    raise LookupError(f"no agent named '{name}' — {detail}")
 
 
 def _render_conversation(history: list[dict] | None, message: str) -> str:
@@ -87,7 +133,7 @@ async def chat_with_agent(
     ``files_changed``, ``error``). ``claude_code``/``model`` engines run through
     the local Claude executor; ``shell`` runs the composed prompt as a command.
     """
-    manifest = _find_agent(name)
+    manifest = await resolve_agent(name)
 
     skills = load_skills()
     skill_text = resolve_skill_text(manifest, skills)
@@ -164,7 +210,7 @@ async def run_agent(
     ``{{variable}}`` is left unfilled — the UI gates the Run button on this, and
     this is the server-side backstop.
     """
-    manifest = _find_agent(name)
+    manifest = await resolve_agent(name)
 
     skills = load_skills()
     skill_text = resolve_skill_text(manifest, skills)

devops_bot_sdk-1.6.8/sdk/agents/engines/claude_code.py

@@ -0,0 +1,122 @@
+"""claude_code engine -- a thin adapter from an agent manifest onto ``sdk.local_exec.run_claude_local``."""
+from __future__ import annotations
+
+import json
+import logging
+from pathlib import Path
+from typing import TYPE_CHECKING, Any, Awaitable, Callable
+
+from sdk import config
+from sdk.local_exec import run_claude_local
+
+if TYPE_CHECKING:
+    from sdk.agents.manifest import AgentManifest
+
+logger = logging.getLogger("sdk.agents.engines.claude_code")
+
+# Same shape as sdk.local_exec.EventHandler -- kept local so this module doesn't
+# need to reach into local_exec for a type alias.
+EventHandler = Callable[[dict], Awaitable[None]]
+
+# Directory every agent without a real code workspace runs in.
+AGENT_RUNS_DIR = Path.home() / ".agentos" / "runs"
+
+
+def ensure_agent_workspace(agent_name: str) -> Path:
+    """The working directory for ``agent_name``, with its Claude settings in place.
+
+    Returns ``~/.agentos/runs/<agent>`` and makes sure
+    ``<that>/.claude/settings.json`` grants the configured tools
+    (``config.get_allowed_tools()``) under ``permissions.allow``.
+
+    Why write it at all when ``run_claude_local`` already passes
+    ``--allowedTools``: that flag covers the headless run, but the run directory IS
+    a Claude Code project, so anything reading project settings — a resumed
+    session, a nested/interactive invocation, a hook — sees the same grants instead
+    of falling back to prompting in a place where nobody can answer.
+
+    MERGES rather than overwrites: existing keys and any extra entries already in
+    ``permissions.allow`` are preserved, so a hand-added rule survives, and a tool
+    added to the configured list later shows up on the next run. Best-effort — a
+    write failure is logged and the run proceeds on ``--allowedTools`` alone.
+
+    Applies to CUSTOM and DEPARTMENT agents alike: both arrive as prompt-based
+    backend rows and both run through here.
+    """
+    workspace = AGENT_RUNS_DIR / agent_name
+    workspace.mkdir(parents=True, exist_ok=True)
+
+    settings_path = workspace / ".claude" / "settings.json"
+    try:
+        settings: dict = {}
+        if settings_path.exists():
+            try:
+                loaded = json.loads(settings_path.read_text(encoding="utf-8"))
+                if isinstance(loaded, dict):
+                    settings = loaded
+            except (OSError, json.JSONDecodeError) as exc:
+                # A corrupt file silently disables ALL settings from it, so replace
+                # it rather than leave the agent running with none.
+                logger.warning("rewriting unparseable %s: %s", settings_path, exc)
+
+        permissions = settings.get("permissions")
+        if not isinstance(permissions, dict):
+            permissions = {}
+        allow = [t for t in (permissions.get("allow") or []) if isinstance(t, str)]
+        for tool in config.get_allowed_tools():
+            if tool not in allow:
+                allow.append(tool)
+        permissions["allow"] = allow
+        settings["permissions"] = permissions
+
+        settings_path.parent.mkdir(parents=True, exist_ok=True)
+        settings_path.write_text(json.dumps(settings, indent=2) + "\n", encoding="utf-8")
+    except OSError as exc:
+        logger.warning("could not write %s: %s", settings_path, exc)
+
+    return workspace
+
+
+async def run(
+    manifest: "AgentManifest",
+    skill_text: str,
+    mcp_config: dict[str, Any] | None,
+    project_path: str | None = None,
+    on_event: EventHandler | None = None,
+    extra_env: dict[str, str] | None = None,
+) -> dict[str, Any]:
+    """Run a custom agent's manifest through the local ``claude`` CLI.
+
+    This does not reimplement any of ``run_claude_local``'s subprocess handling,
+    stream-json parsing, or crucial-hook logic -- it only assembles the prompt
+    and a working directory, then delegates.
+
+    ``skill_text`` is expected to already be the resolved skill body (see
+    ``sdk.agents.manifest.resolve_skill_text``), concatenated by the caller
+    where needed. To be safe, the final prompt is (re-)assembled here from
+    ``manifest.prompt`` plus, when ``skill_text`` is truthy, two newlines and
+    the skill body.
+    """
+    full_prompt = manifest.prompt
+    if skill_text:
+        full_prompt = f"{full_prompt}\n\n{skill_text}"
+
+    if project_path is None:
+        # Most custom agents (e.g. "summarise my PRs daily") have no real code
+        # workspace -- Claude Code still needs a valid current-working-directory
+        # to run in, so fall back to a per-agent scratch directory.
+        project_path = str(ensure_agent_workspace(manifest.name))
+
+    # mcp_config: accepted here for forward compatibility only. Wiring an
+    # --mcp-config flag into run_claude_local's subprocess command is a later
+    # follow-up, once run_claude_local itself grows an mcp_config parameter --
+    # this module does not attempt to work around that in the meantime, so the
+    # argument is currently unused.
+
+    return await run_claude_local(
+        prompt=full_prompt,
+        project_path=project_path,
+        allowed_tools=manifest.allowed_tools or None,
+        on_event=on_event,
+        extra_env=extra_env,
+    )

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/sdk/agents/manifest.py

@@ -23,8 +23,14 @@ INTEGRATIONS_DIR = Path.home() / ".agentos" / "integrations"
 # Full-string match: ${ENV_VAR_NAME} — no inline secrets allowed in integration env.
 _ENV_PLACEHOLDER_RE = re.compile(r"^\$\{[A-Za-z_][A-Za-z0-9_]*\}$")
 
-# Agent names: letters, digits, hyphen, underscore only.
-_AGENT_NAME_RE = re.compile(r"^[A-Za-z0-9_-]+$")
+# Agent names. Agents are authored in the WEB APP now, where names are free text
+# — "AI Research Agent", "Jira & Confluence Project Management Agent". A rule of
+# `[A-Za-z0-9_-]+` rejected every one of them, so a backend agent could not be
+# materialized into a manifest and therefore could not be run at all. Spaces and
+# ordinary punctuation are allowed; what stays banned is anything that could
+# escape a path or break a log line, since the name is used to derive filenames
+# (see agents/secrets.py, varstore.py, run_log.py — all of which sanitize too).
+_AGENT_NAME_RE = re.compile(r"^[^\x00-\x1f/\\<>:\"|?*]+$")
 
 # Flags an inline secret like `token: abc123...` in free-text fields while
 # allowing the ${ENV_VAR} placeholder form. Mirrors the backend
@@ -210,6 +216,57 @@ def assert_secret_free(obj: object, _where: str = "payload") -> None:
             )
 
 
+def manifest_from_backend_row(row: dict) -> AgentManifest | None:
+    """Materialize a runnable manifest from a backend prompt-based ``agents`` row.
+
+    Agents are authored in the web app, so the row — not a local YAML file — is
+    what the engine has to run. The row shape (docs/DATABASE_SCHEMA.md §4) is
+    ``{name, status, prompt: {system_prompt, variables:[…]}, skills:[{name,
+    description, …}]}``; there is no ``engine``/``trigger``/``manifest`` column
+    anymore, so those are supplied here:
+
+      * ``engine="claude_code"`` — the only engine a web-app agent targets.
+      * ``trigger=manual`` — the row carries no trigger; scheduled and
+        ticket-label dispatch stay a local-manifest feature.
+
+    Each attached skill's description is folded into the prompt rather than left
+    in ``manifest.skills``: skill names on the row refer to backend ``skills``
+    rows, which ``resolve_skill_text`` (local ``~/.agentos/skills``) would drop as
+    dangling references, silently losing the instruction text.
+
+    Returns ``None`` if the row cannot make a valid manifest (no name, or an empty
+    / too-short prompt), so a malformed row is skipped rather than raising.
+    """
+    name = str((row or {}).get("name") or "").strip()
+    if not name:
+        return None
+
+    prompt_obj = row.get("prompt") or {}
+    if not isinstance(prompt_obj, dict):
+        prompt_obj = {}
+    prompt = str(prompt_obj.get("system_prompt") or "").strip()
+
+    for skill in row.get("skills") or []:
+        if not isinstance(skill, dict):
+            continue
+        s_name = str(skill.get("name") or "").strip()
+        s_body = str(skill.get("description") or "").strip()
+        if s_name and s_body:
+            prompt = f"{prompt}\n\n## Skill: {s_name}\n\n{s_body}"
+
+    try:
+        return AgentManifest(
+            name=name,
+            description=prompt[:200],
+            engine="claude_code",
+            trigger=TriggerSpec(type="manual"),
+            prompt=prompt,
+        )
+    except ValidationError as exc:
+        logger.warning("backend agent '%s' is not runnable: %s", name, exc)
+        return None
+
+
 def load_agents(dir: Path = AGENTS_DIR) -> list[AgentManifest]:
     """Load every agent manifest under `dir`.
 

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/sdk/agents/secrets.py

@@ -34,7 +34,15 @@ SECRETS_DIR = Path.home() / ".agentos" / "agent_secrets"
 
 
 def _path(agent_name: str) -> Path:
-    return SECRETS_DIR / f"{agent_name}.json.enc"
+    """Store file for an agent's keys.
+
+    The name is sanitized because agent names are free text from the web app now
+    ("Jira & Confluence Project Management Agent") — an unsanitized name
+    containing a path separator would resolve outside SECRETS_DIR. Mirrors
+    ``varstore._path`` so the two stores key the same way.
+    """
+    safe = "".join(c for c in (agent_name or "") if c.isalnum() or c in "-_") or "agent"
+    return SECRETS_DIR / f"{safe}.json.enc"
 
 
 def load_secrets(agent_name: str) -> dict[str, str]:

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/sdk/agents/ticket_run.py

@@ -25,15 +25,19 @@ async def resolve_manifest(
 ) -> "AgentManifest | None":
     """Find the agent manifest to run, by ``scope``.
 
-    * ``custom`` (default) — a personal agent from the local manifests
-      (``~/.agentos/agents``).
     * ``department`` — an ACTIVE department default pulled from the backend
-      (``list_department_agents``), materialized read-only (never written back),
-      exactly as ``agentd._load_department_agents`` does.
+      (``list_department_agents``) and materialized read-only (never written back).
+    * ``custom`` (default) — a local manifest, then the caller's own backend
+      agents, then their department defaults, via ``chat.resolve_agent``.
 
-    Returns None when no matching agent is found.
+    Backend rows are prompt-based (``prompt.system_prompt`` + attached skills);
+    the ``manifest`` column this used to read no longer exists on the table, so
+    reading it raised ``KeyError`` and made every department agent unrunnable.
+
+    Returns None when no matching agent is found, so the caller reports it.
     """
-    from sdk.agents.manifest import AgentManifest, load_agents
+    from sdk.agents.chat import resolve_agent
+    from sdk.agents.manifest import manifest_from_backend_row
 
     name = (name or "").strip()
     if scope == "department":
@@ -43,16 +47,13 @@ async def resolve_manifest(
             return None
         for row in rows:
             if row.get("name") == name and row.get("status") == "active":
-                try:
-                    return AgentManifest(**row["manifest"])
-                except Exception:  # noqa: BLE001 — invalid manifest → not runnable
-                    return None
+                return manifest_from_backend_row(row)
         return None
 
-    for m in load_agents():
-        if m.name == name:
-            return m
-    return None
+    try:
+        return await resolve_agent(name, client)
+    except LookupError:
+        return None
 
 
 async def run_on_ticket(

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/sdk/cli.py

@@ -333,35 +333,27 @@ def _agent_run_ticket(name: str, flags: list[str]) -> None:
 
 
 def _agent_run(name: str) -> None:
-    from sdk.agents.manifest import AgentManifest, load_agents
+    """`agentos agent run NAME` — dispatch one run locally.
+
+    Resolution order is shared with the UI and `agent chat` (see
+    ``sdk.agents.chat.resolve_agent``): a local manifest wins, then the caller's
+    own backend agents, then their department defaults. It used to check local
+    manifests and department rows only — and read a `manifest` column the
+    prompt-based `agents` table no longer has — so nothing authored in the web app
+    could be run.
+    """
+    from sdk.agents.chat import resolve_agent
     from sdk.client import BackendClient
     from sdk import agentd
 
     client = BackendClient.from_config()
-
-    matched = next((m for m in load_agents() if m.name == name), None)
-    if matched is not None:
-        asyncio.run(agentd._dispatch_agent_run(matched, client))
-        return
-
-    # Not a local personal agent -- check this user's department defaults
-    # (read-only, pulled from the backend; see AgentDaemon._load_department_agents).
     try:
-        dept_row = next(
-            (r for r in asyncio.run(client.list_department_agents()) if r.get("name") == name),
-            None,
-        )
-    except Exception as exc:  # noqa: BLE001
-        print(f"error: could not fetch department agents ({exc})")
-        sys.exit(1)
-
-    if dept_row is None:
-        print(f"error: no agent named '{name}' (checked ~/.agentos/agents/ and "
-              f"this user's department default agents)")
+        manifest = asyncio.run(resolve_agent(name, client))
+    except LookupError as exc:
+        print(f"error: {exc}")
         sys.exit(1)
 
-    dept_manifest = AgentManifest(**dept_row["manifest"])
-    asyncio.run(agentd._dispatch_agent_run(dept_manifest, client))
+    asyncio.run(agentd._dispatch_agent_run(manifest, client))
 
 
 def _agent_logs(name: str) -> None:

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/sdk/config.py

@@ -156,20 +156,29 @@ def _dotenv_value(key: str) -> str:
 _DEFAULT_ALLOWED_IPS: list[str] = ["20.12.201.148"]
 
 
-def _parse_ip_list(raw: str) -> list[str]:
-    """Split an IP allowlist string, tolerant of JSON-ish list syntax.
+def _parse_token_list(raw: str) -> list[str]:
+    """Split a comma/space-separated list, tolerant of JSON-ish syntax.
 
-    Accepts ``"1.2.3.4, 5.6.7.8"``, ``1.2.3.4 5.6.7.8``, or ``["1.2.3.4","5.6.7.8"]``.
+    Accepts ``"a, b"``, ``a b``, or ``["a","b"]``. De-duplicates, order-preserving.
+    Used for every list-shaped setting (IP allowlist, tool allowlist).
     """
     raw = (raw or "").strip().strip("[]")
     out: list[str] = []
     for token in re.split(r"[,\s]+", raw):
-        ip = token.strip().strip('"').strip("'")
-        if ip and ip not in out:
-            out.append(ip)
+        item = token.strip().strip('"').strip("'")
+        if item and item not in out:
+            out.append(item)
     return out
 
 
+def _parse_ip_list(raw: str) -> list[str]:
+    """Split an IP allowlist string, tolerant of JSON-ish list syntax.
+
+    Accepts ``"1.2.3.4, 5.6.7.8"``, ``1.2.3.4 5.6.7.8``, or ``["1.2.3.4","5.6.7.8"]``.
+    """
+    return _parse_token_list(raw)
+
+
 def get_allowed_ips() -> list[str]:
     """Client IPs permitted to reach the ``agentos-ui`` API (``/api/ui/*``).
 
@@ -201,6 +210,55 @@ def get_allowed_ips() -> list[str]:
     return out
 
 
+# Built-in baseline of tools a headless agent run may use. Kept here (not in
+# local_exec) so it is one configurable setting rather than a literal buried in the
+# spawn code: the set WILL grow, and a new tool must be addable without editing
+# and re-releasing the SDK — see get_allowed_tools().
+_DEFAULT_ALLOWED_TOOLS: list[str] = [
+    "Read", "Write", "Edit", "Glob", "Grep", "Bash", "Skill", "WebSearch", "WebFetch",
+]
+
+
+def get_allowed_tools() -> list[str]:
+    """Tools a headless ``claude -p`` agent run is allowed to use.
+
+    A headless run cannot answer a permission prompt, so anything missing from
+    this list is silently UNAVAILABLE to the agent — which is how a research agent
+    ended up reporting it could not search the web. The baseline therefore covers
+    the file, shell, skill, and web tools, and everything else is configuration.
+
+    Sources, merged additively (all optional), each accepting a comma/space-separated
+    or bracketed list:
+      - the built-in baseline ``_DEFAULT_ALLOWED_TOOLS``
+      - ``.env`` key ``AGENTOS_ALLOWED_TOOLS`` (``~/.agentos/.env`` or CWD ``.env``)
+      - process env ``AGENTOS_ALLOWED_TOOLS``
+      - config.toml key ``allowed_tools``
+
+    Additive, like ``get_allowed_ips``: naming a tool ANYWHERE adds it, so granting
+    a newly-shipped Claude Code tool is a config line on the box, not a code change
+    and a release. Read at spawn time, so an edit applies to the next run without
+    restarting the daemon or the UI server. MCP/plugin tools are NOT listed here —
+    they are discovered per-machine at spawn time (see
+    ``local_exec._discover_mcp_allow_entries``).
+
+    To run with a REDUCED set, pass ``allowed_tools`` explicitly to
+    ``local_exec.run_claude_local`` (an agent manifest's ``allowed_tools`` does
+    exactly that) — that overrides this list rather than extending it.
+    """
+    sources = [
+        ",".join(_DEFAULT_ALLOWED_TOOLS),
+        _dotenv_value("AGENTOS_ALLOWED_TOOLS"),
+        os.environ.get("AGENTOS_ALLOWED_TOOLS", ""),
+        _load_raw().get("allowed_tools", ""),
+    ]
+    out: list[str] = []
+    for src in sources:
+        for tool in _parse_token_list(src):
+            if tool not in out:
+                out.append(tool)
+    return out
+
+
 class PermanentAllowlistEntry(ValueError):
     """Raised when trying to disable an IP that is permanently whitelisted via ``.env``."""
 

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/sdk/design_verify/loop.py

@@ -24,7 +24,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Awaitable, Callable
 
-from sdk.local_exec import DEFAULT_ALLOWED_TOOLS, run_claude_local
+from sdk.local_exec import run_claude_local
 
 from .bootstrap import ensure_agent_browser
 from .browser import BrowserError, diff_baseline, render_screenshot
@@ -67,9 +67,10 @@ async def _default_coder(project_path: str, correction_prompt: str) -> None:
         "unrelated code.\n\n"
         f"{correction_prompt}"
     )
-    result = await run_claude_local(
-        prompt, project_path, allowed_tools=DEFAULT_ALLOWED_TOOLS
-    )
+    # allowed_tools omitted on purpose: run_claude_local then uses the configured
+    # allowlist (config.get_allowed_tools), so this run picks up any tool the box
+    # grants instead of a snapshot taken at import.
+    result = await run_claude_local(prompt, project_path)
     if not result.get("ok"):
         raise RuntimeError(f"correction run failed: {result.get('error')}")
 

{devops_bot_sdk-1.6.4 → devops_bot_sdk-1.6.8}/sdk/local_exec.py

@@ -28,15 +28,22 @@ from datetime import datetime, timedelta
 from pathlib import Path
 from typing import Any, Awaitable, Callable
 
-# Default tool allowlist. Bash is included so the agent runs ALL its commands
-# locally — git clone, install, build, test, and `gh pr create` for PRs — on the
-# user's machine, not the server. ``Skill`` lets the agent invoke installed
-# plugin/user Skills (e.g. the Figma skills), which DO load in headless ``-p`` runs
-# even when a plugin's MCP server can't authenticate there. MCP/plugin *tools* are
-# NOT hard-coded here — they are discovered per-machine and appended at spawn time;
-# see ``_discover_mcp_allow_entries`` / ``_local_mcp_servers`` and their use in
-# ``run_claude_local``.
-DEFAULT_ALLOWED_TOOLS = ["Read", "Write", "Edit", "Glob", "Grep", "Bash", "Skill"]
+from sdk import config   # tool allowlist lives there (config.get_allowed_tools)
+
+# The tool allowlist is a SETTING, not a literal here: see
+# ``sdk.config.get_allowed_tools`` for the baseline and the ways to extend it
+# (.env / process env ``AGENTOS_ALLOWED_TOOLS`` / config.toml ``allowed_tools``).
+# It is read at spawn time inside ``run_claude_local`` so a change applies to the
+# next run without a restart, and so granting a newly-shipped Claude Code tool
+# never needs an SDK edit and release.
+#
+# Bash is in the baseline so the agent runs ALL its commands locally — git clone,
+# install, build, test, and `gh pr create` for PRs — on the user's machine, not the
+# server. ``Skill`` lets it invoke installed plugin/user Skills (e.g. the Figma
+# skills), which DO load in headless ``-p`` runs even when a plugin's MCP server
+# can't authenticate there. MCP/plugin *tools* are not configured there either —
+# they are discovered per-machine and appended at spawn time; see
+# ``_discover_mcp_allow_entries`` / ``_local_mcp_servers`` below.
 
 # Run limits. The OLD design capped TOTAL runtime at 30 min, which killed long
 # but healthy runs (big builds, many steps) mid-work. Instead we use an IDLE
@@ -445,7 +452,8 @@ async def run_claude_local(
     Spawns ``claude -p <prompt> --output-format stream-json …`` with the working
     directory set to the project so all edits land on the real local files.
     ``--permission-mode acceptEdits`` lets file edits apply unattended (no
-    interactive prompt); read/write/edit are the only tools enabled by default.
+    interactive prompt). The tools enabled come from ``config.get_allowed_tools()``
+    unless ``allowed_tools`` is given, which replaces that list.
 
     ``on_event`` (optional, async) is called for each streamed JSON event — used
     by the sidecar to forward live progress (tool calls, assistant text) to the
@@ -477,7 +485,11 @@ async def run_claude_local(
     path = Path(project_path).expanduser()
     path.mkdir(parents=True, exist_ok=True)
 
-    tools = list(allowed_tools or DEFAULT_ALLOWED_TOOLS)
+    # Read the allowlist per spawn (not at import) so a config/.env change takes
+    # effect on the next run — the UI server and agentd are long-lived processes.
+    # An explicit `allowed_tools` (e.g. a manifest's) REPLACES it, so an agent can
+    # still be restricted to fewer tools than the configured set.
+    tools = list(allowed_tools or config.get_allowed_tools())
     # Append per-server MCP allow-entries so installed+authenticated plugins/MCP
     # servers are usable in this headless run. Discovered once and cached; no-ops
     # (adds nothing) when no servers are configured or discovery fails, so a machine