dotagents-cli 0.9.0__tar.gz → 0.9.1__tar.gz

{dotagents_cli-0.9.0 → dotagents_cli-0.9.1}/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.9.1] - 2026-11-06
+
+### Fixed
+
+- The Claude Code PowerShell-tool env loader (`init --powershell-env-hook`) no longer
+  answers `permissionDecision: "allow"`, which ran calls that would have asked and, under
+  `--permission-mode dontAsk` or with no way to ask, calls that would have been refused.
+  It now only rewrites the call and the permission system decides. A PowerShell call
+  therefore asks unless `PowerShell` itself is allowed, since rules judge the rewritten
+  command. An `init --powershell-env-hook` replaces a loader already wired.
+
 ## [0.9.0] - 2026-11-04
 
 dotagents implements the [Agent Overlay Specification](https://boriken-dev.github.io/agent-overlay-spec/)
@@ -1743,7 +1754,8 @@ Patch release: the PATH/POSIX-conversion fix above (the only change since 0.3.0)
   affected module sources (`dotagents.cli`, `duho.presets`) to extracted temp files
   before dispatch; a no-op for a plain install.
 
-[Unreleased]: https://github.com/jose-pr/dotagents/compare/v0.9.0...HEAD
+[Unreleased]: https://github.com/jose-pr/dotagents/compare/v0.9.1...HEAD
+[0.9.1]: https://github.com/jose-pr/dotagents/compare/v0.9.0...v0.9.1
 [0.9.0]: https://github.com/jose-pr/dotagents/compare/v0.8.3...v0.9.0
 [0.8.3]: https://github.com/jose-pr/dotagents/compare/v0.8.2...v0.8.3
 [0.8.2]: https://github.com/jose-pr/dotagents/compare/v0.8.1...v0.8.2

{dotagents_cli-0.9.0 → dotagents_cli-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dotagents-cli
-Version: 0.9.0
+Version: 0.9.1
 Summary: The dotagents CLI: install and manage a portable ~/.agents config for AI coding agents
 Project-URL: Homepage, https://github.com/jose-pr/dotagents/
 Project-URL: Repository, https://github.com/jose-pr/dotagents

{dotagents_cli-0.9.0 → dotagents_cli-0.9.1}/docs/guide/commands.md

@@ -144,10 +144,12 @@ Claude Code's PowerShell tool never reads `$CLAUDE_ENV_FILE`, so its commands do
 see the env layers. On Windows, `init --powershell-env-hook` adds a `PreToolUse` hook
 (matched on the `PowerShell` tool) that prepends the `dotagents env` change set to each
 PowerShell call (`env --diff --cache`, so an unchanged environment is not reassembled
-on every call). **It auto-approves every PowerShell tool call**: rewriting a command
-without a prompt on each one requires `permissionDecision: "allow"`, which skips the
-approval prompt (your deny and ask rules still apply). It is off by default, and a
-plain `init` removes one an earlier release wired.
+on every call). It states no permission decision, so a call asks, is denied or runs as
+your rules say. **Your rules judge the rewritten command**: a narrow allow rule such as
+`PowerShell(Get-Location:*)`, or a command that would pass as read-only, no longer
+matches once the loader leads it, so each PowerShell call asks unless `PowerShell`
+itself is in your allow rules. It is off by default, and a plain `init` removes one an
+earlier release wired.
 
 The env half never truncates the file and is guarded by `[ -n "$CLAUDE_ENV_FILE" ]`
 (see the [hooks docs](https://code.claude.com/docs/en/hooks#persist-environment-variables)):

{dotagents_cli-0.9.0 → dotagents_cli-0.9.1}/src/dotagents/__init__.py

@@ -1,3 +1,3 @@
 """dotagents: installable CLI for the dotagents agent-config payload."""
 
-__version__ = "0.9.0"
+__version__ = "0.9.1"

{dotagents_cli-0.9.0 → dotagents_cli-0.9.1}/src/dotagents/_agents.py

@@ -619,7 +619,8 @@ class ClaudeAgent(Agent):
     # calls only, so the SessionStart hook never reaches PowerShell tool calls.
     # Closed via a PreToolUse hook (no matcher -- fires for every tool) that,
     # for a PowerShell call specifically, prepends a guarded env-loader to that
-    # call's OWN command via `updatedInput`.
+    # call's OWN command via `updatedInput`. It states no `permissionDecision`:
+    # "allow" would run what the permission system would have asked about.
     #
     # INLINE `-Command`, deliberately NOT a `.ps1` file: a `.ps1` is subject to
     # PowerShell's script execution policy (AllSigned, or a locked-down
@@ -654,7 +655,7 @@ class ClaudeAgent(Agent):
         r"""'if (-not $env:AGENTS_RUNTIME_SET) { $env:AGENTS_RUNTIME_SET = "1"; $s = if ($env:AGENTS_HOME) { $env:AGENTS_HOME } else { "$HOME\.agents" }; $c = "$s\bin\dotagents.cmd"; if (-not (Test-Path $c)) { $c = (Get-Command dotagents -ErrorAction SilentlyContinue).Source }; if ($c) { $oe = [Console]::OutputEncoding; [Console]::OutputEncoding = [Text.UTF8Encoding]::new($false); try { & $c env --diff --format powershell --cache 2>$null | Invoke-Expression } finally { [Console]::OutputEncoding = $oe } } }; '; """
         r'$u = $h.tool_input.PSObject.Copy(); '
         r'$u.command = $p + $h.tool_input.command; '
-        r'@{hookSpecificOutput=@{hookEventName="PreToolUse";permissionDecision="allow";updatedInput=$u}} | ConvertTo-Json -Depth 10 -Compress '
+        r'@{hookSpecificOutput=@{hookEventName="PreToolUse";updatedInput=$u}} | ConvertTo-Json -Depth 10 -Compress '
         r'}'
     )
 
@@ -757,11 +758,11 @@ class ClaudeAgent(Agent):
 
     #: Identity (statusMessage) of the PowerShell PreToolUse env-loader entry.
     PRETOOLUSE_STATUS = "Checking PowerShell env"
-    #: Opt-in (`init --powershell-env-hook`): the loader returns
-    #: `permissionDecision: "allow"` -- the only documented way for PreToolUse
-    #: to rewrite a command without prompting on every call -- which skips the
-    #: approval prompt for EVERY PowerShell tool call (deny/ask rules still
-    #: apply). Off, `init` removes an entry an earlier release wired.
+    #: Opt-in (`init --powershell-env-hook`): the loader states no permission
+    #: decision, and Claude Code judges the rewritten command, so a PowerShell
+    #: call asks unless the tool as a whole is allowed: a narrow allow rule or
+    #: a read-only command no longer matches once the loader leads it.
+    #: Off, `init` removes an entry an earlier release wired.
     powershell_env_hook: bool = False
 
     def _wire_powershell_pretooluse(self, hooks: dict) -> bool:

{dotagents_cli-0.9.0 → dotagents_cli-0.9.1}/src/dotagents/cli/init.py

@@ -70,8 +70,9 @@ class Init(DotAgentsArgs):
 
     powershell_env_hook: bool = False
     (
-        "Windows, Claude Code: also wire the PowerShell-tool env loader. It "
-        "AUTO-APPROVES every PowerShell tool call (skips the permission prompt)."
+        "Windows, Claude Code: also wire the PowerShell-tool env loader. Rules then "
+        "judge the rewritten command, so a PowerShell call asks unless PowerShell "
+        "itself is allowed."
     )
     ("--powershell-env-hook",)
 

{dotagents_cli-0.9.0 → dotagents_cli-0.9.1}/tests/test_powershell_env_hook.py

@@ -1,12 +1,14 @@
 """The PowerShell-tool env loader is opt-in (`init --powershell-env-hook`).
 
-It rewrites each PowerShell tool call through PreToolUse `updatedInput`, which
-Claude Code documents only together with `permissionDecision: "allow"` (skip
-the prompt) or `"ask"` (prompt every call). Wired by default it silently
-auto-approved every PowerShell call after `init -g` on Windows.
+It rewrites each PowerShell tool call through PreToolUse `updatedInput` and states no
+permission decision: Claude Code evaluates its rules against the rewritten command and
+asks, denies or runs as it would without a hook. `"allow"` would skip the prompt.
 """
 
 import json
+import os
+import shutil
+import subprocess
 from pathlib import Path
 
 import pytest
@@ -53,10 +55,29 @@ def test_the_wired_line_names_pretooluse_only_when_it_was_wired(tmp_path, caplog
     assert ("PreToolUse" in wired[0]) is opted_in, wired[0]
 
 
-def test_the_opted_in_loader_auto_approves_and_says_so():
-    # Pinned so the auto-approve cannot change silently: the flag's help and
-    # the docs state it.
-    assert 'permissionDecision="allow"' in ClaudeAgent.PRETOOLUSE_POWERSHELL_COMMAND
+def test_the_loader_states_no_permission_decision():
+    assert "permissionDecision" not in ClaudeAgent.PRETOOLUSE_POWERSHELL_COMMAND
+
+
+POWERSHELL = shutil.which("powershell")
+
+
+@pytest.mark.skipif(POWERSHELL is None, reason="Windows PowerShell only")
+def test_the_hook_rewrites_the_call_and_leaves_the_decision_to_the_permission_system(tmp_path):
+    call = {"tool_name": "PowerShell", "tool_input": {"command": "Remove-Item x.txt", "description": "d", "timeout": 5}}
+    env = {name: value for name, value in os.environ.items() if name.upper() != "AGENTS_RUNTIME_SET"}
+    hook = subprocess.run(
+        [POWERSHELL, "-NoProfile", "-NonInteractive", "-Command", ClaudeAgent.PRETOOLUSE_POWERSHELL_COMMAND],
+        input=json.dumps(call).encode(), env=env, capture_output=True, cwd=tmp_path,
+    )
+    assert hook.returncode == 0, hook.stderr
+    output = json.loads(hook.stdout)["hookSpecificOutput"]
+    assert output["hookEventName"] == "PreToolUse"
+    assert "permissionDecision" not in output, "a decision here would answer for the permission system"
+    updated = output["updatedInput"]
+    assert updated["command"].startswith("if (-not $env:AGENTS_RUNTIME_SET)")
+    assert updated["command"].endswith("; Remove-Item x.txt")
+    assert (updated["description"], updated["timeout"]) == ("d", 5), "the whole input is replaced, so the rest must survive"
 
 
 def test_init_flag_reaches_the_adapter(tmp_path, monkeypatch):