meridian-cli 0.2.23__tar.gz → 0.2.24__tar.gz

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meridian-cli
-Version: 0.2.23
+Version: 0.2.24
 Summary: Orchestrate CLI + MCP server for multi-model agent workflows
 Project-URL: Homepage, https://github.com/haowjy/meridian-cli
 Project-URL: Repository, https://github.com/haowjy/meridian-cli
@@ -24,7 +24,7 @@ Requires-Dist: coolname>=4.0.0
 Requires-Dist: cyclopts>=3.0
 Requires-Dist: fastapi>=0.115
 Requires-Dist: markdown-it-py>=4.0
-Requires-Dist: mars-agents==0.7.11
+Requires-Dist: mars-agents==0.7.12
 Requires-Dist: mcp>=1.0
 Requires-Dist: pathspec>=1.1.0
 Requires-Dist: psutil>=7.2.2

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/pyproject.toml

@@ -24,7 +24,7 @@ dependencies = [
   "cyclopts>=3.0",
   "fastapi>=0.115",
   "markdown-it-py>=4.0",
-  "mars-agents==0.7.11",
+  "mars-agents==0.7.12",
   "mcp>=1.0",
   "pathspec>=1.1.0",
   "psutil>=7.2.2",

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "0.2.23"
+__version__ = "0.2.24"

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/config/.context/CONTEXT.md

@@ -111,13 +111,15 @@ time. These follow the same pattern: ambient config snapshot → launch-time env
 
 - `resolve_pi_harness_profile_for_launch()` — resolves `[harness.pi]` (managed bash,
   load_all_extensions, background_tasks, spawn_watch)
-- `resolve_claude_allow_builtin_agents_for_launch()` — resolves
-  `[harness.claude] allow_builtin_agents` from the launch config snapshot, falling
-  back to `load_config()` if the snapshot is absent or invalid
 
-Both are called from `bind_launch_context()` in `lib/launch/context.py` and threaded
+Called from `bind_launch_context()` in `lib/launch/context.py` and threaded
 into the harness adapter's `resolve_launch_spec()`.
 
+Claude native Agent routing does not use a `meridian.toml` harness option.
+Built-in Claude agents stay denied unconditionally; generic `Agent` permission
+follows Mars `[settings.agent_copy]` via `project_has_claude_agent_copy()` in
+`lib/launch/permissions.py`.
+
 ## Schema Metadata (`schema.py`)
 
 `config_field(canonical_key, value_kind=..., file_aliases=..., env_vars=...)` attaches

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/config/AGENTS.md

@@ -70,9 +70,12 @@ Claude profile includes:
 - `[harness.claude] model` — default model (string, env: `MERIDIAN_HARNESS_MODEL_CLAUDE`)
 - `[harness.claude] wait_yield_seconds` — polling interval (float, env:
   `MERIDIAN_HARNESS_WAIT_YIELD_SECONDS_CLAUDE`)
-- `[harness.claude] allow_builtin_agents` — whether to permit Claude's built-in
-  subagents (Explore, Plan, general-purpose). Default `false` — Meridian denies them
-  so sessions use custom Meridian agents exclusively. Set `true` to opt out.
+- `[harness.claude] allow_builtin_agents` — parsed Claude harness field from
+  config release plumbing; Claude native Agent routing is still enforced by the
+  harness projection.
+- Claude native Agent routing is not a `meridian.toml` harness policy. Built-in
+  Claude agents stay denied; generic `Agent` follows Mars `[settings.agent_copy]`
+  with `.claude` target materialization.
 
 ## Depth
 

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/harness/.context/CONTEXT.md

@@ -39,9 +39,12 @@ Per-harness mapping:
 - Claude subprocess: `claude -p --output-format stream-json --verbose -`
 - Claude connection: `claude -p --input-format stream-json --output-format stream-json --verbose` (stdin/stdout NDJSON, not WebSocket despite `claude_ws.py` name)
 - **Claude built-in agent denial**: Meridian injects `--disallowedTools
-  Agent(Explore),Agent(Plan),Agent(general-purpose)` by default. Gated by
-  `[harness.claude] allow_builtin_agents` (bool, default `false`). The denials
-  merge into permission-derived `--disallowedTools` via `dedupe_nonempty()`.
+  Agent(Explore),Agent(Plan),Agent(General-purpose),Agent(general-purpose)`
+  unconditionally. The denials merge into permission-derived `--disallowedTools` via
+  `dedupe_nonempty()`. Generic
+  `Agent` is gated by Mars `[settings.agent_copy]`: allowed only when
+  `harnesses = ["claude"]` and `.claude` is a target. Parent/passthrough allowed-tool
+  tails are merged into the managed projection; Meridian's Agent denies stay authoritative.
 - Codex subprocess: `codex exec --json`; connection: `codex app-server` (real WebSocket, JSON-RPC 2.0)
 - OpenCode subprocess: `opencode run`; connection: `opencode serve` (HTTP+SSE)
 - Cursor subprocess: `cursor agent <prompt>` (stdout NDJSON, no connection path — subprocess-only)
@@ -188,25 +191,30 @@ it's captured. This is the minimum-intrusive mechanism for an otherwise unobserv
 value. Windows does not support PTY — Claude primary uses a fallback detection path
 (`session_detection.py`) on Windows.
 
-### Claude: Built-in Subagent Denial
-
-Claude Code ships with three built-in subagents: Explore, Plan, and general-purpose.
-These conflict with Meridian's own agent system. Meridian injects
-`--disallowedTools Agent(Explore),Agent(Plan),Agent(general-purpose)` by default
-so Claude sessions use custom Meridian agents exclusively. The behavior is gated by
-`[harness.claude] allow_builtin_agents` (bool, default `false`).
-
-The flag is resolved in `bind_launch_context()` via
-`resolve_claude_allow_builtin_agents_for_launch()`, threaded through
-`SpawnParams.claude_allow_builtin_agents` → `ResolvedLaunchSpec.disallowed_tools`,
-and projected by `project_claude.py`. The builtin denials merge into
-permission-derived `--disallowedTools` so exactly one flag is emitted.
-
-This is implemented as a Meridian platform policy (harness adapter injection),
-not as a per-agent `disallowed-tools` field. This means individual agent profiles
-no longer need to carry deny entries like
-`disallowed-tools: [Agent(Explore), Agent(Plan), Agent(general-purpose)]` —
-they're inherited from the harness adapter.
+### Claude: Native Agent Routing Boundary
+
+Claude Code ships with three built-in subagents (Explore, Plan, General-purpose) plus
+a generic `Agent` tool. Meridian's policy distinguishes between these:
+
+- **Built-in agents are always denied.** Meridian injects
+  `--disallowedTools Agent(Explore),Agent(Plan),Agent(General-purpose),Agent(general-purpose)`.
+  There is no config toggle — built-ins are a Meridian platform policy.
+
+- **Generic `Agent` follows the Mars agent-copy boundary.** Meridian reads
+  `mars.toml` to check whether `[settings.agent_copy] harnesses = ["claude"]` AND
+  `.claude` is in `targets`. If both hold, generic `Agent` is allowed (Claude's
+  native agent surface is Meridian-owned through agent copy). Otherwise, generic
+  `Agent` is denied by default and delegation routes through `meridian spawn`.
+
+The detection runs in `bind_launch_context()` via `project_has_claude_agent_copy()` in
+`permissions.py`, which reads `mars.toml` and `mars.local.toml`. The result flows into
+`ResolvedLaunchSpec.claude_native_agents_enabled` and is projected by
+`project_claude.py`. The projection strips `Agent` and `Agent(...)` from allowed-tools
+when `claude_native_agents_enabled=False`, including parent-inherited allowed-tool tails.
+
+This is implemented as a Meridian platform policy (harness adapter injection), not as
+a per-agent `tools:` field. Agent profiles do not need to carry `agent: deny` entries —
+the denial is inherited from the harness adapter when agent copy is absent.
 
 ### Claude: System-Prompt File Channel
 

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/harness/AGENTS.md

@@ -38,11 +38,12 @@ Per-harness commands:
 - Claude subprocess: `claude -p --output-format stream-json --verbose -`
 - Claude connection: stdin/stdout NDJSON (not WebSocket despite `claude_ws.py` name)
 - **Claude built-in agent denial**: Meridian injects
-  `--disallowedTools Agent(Explore),Agent(Plan),Agent(general-purpose)` by default
-  so sessions use custom Meridian agents instead of Claude's built-in subagents.
-  Gated by `[harness.claude] allow_builtin_agents` (bool, default `false`).
-  The builtin denials merge into permission-derived `--disallowedTools` via
-  `dedupe_nonempty()` so exactly one flag is emitted.
+  `--disallowedTools Agent(Explore),Agent(Plan),Agent(General-purpose),Agent(general-purpose)`
+  unconditionally so sessions use Meridian delegation instead of Claude's built-in
+  subagents. Generic `Agent` is allowed only when Mars effective config has
+  `[settings.agent_copy] harnesses = ["claude"]` and `.claude` is a target.
+  Parent/passthrough allowed-tool tails are merged into the managed projection;
+  Meridian's Agent denies stay authoritative.
 - Codex subprocess: `codex exec --json`; connection: `codex app-server` (real WebSocket, JSON-RPC 2.0)
 - OpenCode subprocess: `opencode run`; connection: `opencode serve` (HTTP+SSE)
 - Cursor subprocess: `cursor agent <prompt>` (stdout NDJSON, no connection path — subprocess-only)
@@ -83,8 +84,8 @@ unique — always check `event.harness_id`. `turn/completed` is Codex; OpenCode
   Source of truth for what every adapter must implement.
 - `registry.py` — `HarnessRegistry`, `with_defaults()`. The global singleton.
 - `claude.py` / `codex.py` / `opencode.py` / `cursor.py` — concrete adapter implementations.
-  Claude adapter now threads `claude_allow_builtin_agents` from config → SpawnParams →
-  `ResolvedLaunchSpec.disallowed_tools`, mirroring the `pi.disable_managed_bash` pattern.
+  Claude adapter threads `ResolvedLaunchSpec.claude_native_agents_enabled` into projection so
+  parent inherited `Agent` grants cannot bypass the Mars `agent_copy` boundary.
 - `__init__.py` — `HARNESS_EXTENSION_TOUCHPOINTS` and `ensure_bootstrap()`.
   Read before adding a harness — lists every file that must be touched.
 - `semantics.py` — `terminal_outcome()`, `activity_transition()`, `clears_signal()`.

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/harness/claude.py

@@ -377,7 +377,9 @@ class ClaudeAdapter(BaseHarnessAdapter[ResolvedLaunchSpec]):
         user_turn_content = getattr(run, "user_turn_content", None)
         disallowed_tools: tuple[str, ...] = ()
         if not run.claude_allow_builtin_agents:
-            disallowed_tools = ("Agent(Explore),Agent(Plan),Agent(general-purpose)",)
+            disallowed_tools = (
+                "Agent(Explore),Agent(Plan),Agent(General-purpose),Agent(general-purpose)",
+            )
         return ResolvedLaunchSpec(
             harness=HarnessId.CLAUDE,
             model=str(run.model).strip() if run.model else None,

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/harness/projections/project_claude.py

@@ -16,6 +16,13 @@ from meridian.lib.launch.text_utils import dedupe_nonempty, split_csv_entries
 
 logger = logging.getLogger(__name__)
 
+_CLAUDE_BUILTIN_AGENT_DENY_TOOLS: tuple[str, ...] = (
+    "Agent(Explore)",
+    "Agent(Plan)",
+    "Agent(General-purpose)",
+    "Agent(general-purpose)",
+)
+
 _PROJECTED_FIELDS: frozenset[str] = frozenset(
     {
         "agent_name",
@@ -32,6 +39,7 @@ _PROJECTED_FIELDS: frozenset[str] = frozenset(
         "permission_resolver",
         "prompt",
         "prompt_file_path",
+        "claude_native_agents_enabled",
         "user_turn_content",
         "disallowed_tools",
     }
@@ -129,6 +137,14 @@ def _has_flag(args: Sequence[str], flag: str) -> bool:
     return any(token == flag or token.startswith(f"{flag}=") for token in args)
 
 
+def _is_claude_agent_tool(tool: str) -> bool:
+    return tool == "Agent" or tool.startswith("Agent(")
+
+
+def _is_denied_tool(tool: str, denied_tools: set[str]) -> bool:
+    return tool in denied_tools or ("Agent" in denied_tools and _is_claude_agent_tool(tool))
+
+
 def _log_collision_if_needed(
     *,
     managed_flag: str,
@@ -177,14 +193,38 @@ def project_claude_spec_to_cli_args(
         command.extend(("--agent", str(spec.agent_name)))
 
     passthrough_tail, parent_allowed_tools = _split_internal_parent_allowed_tools(spec.extra_args)
+    projected_passthrough_tail, passthrough_allowed_tools, passthrough_disallowed_tools = (
+        _extract_claude_tool_flags(passthrough_tail)
+    )
+    passthrough_tail = tuple(projected_passthrough_tail)
 
     permission_flags = resolve_permission_flags(spec.permission_resolver, HarnessId.CLAUDE)
     permission_tail, allowed_tools, disallowed_tools = _extract_claude_tool_flags(permission_flags)
     spec_disallowed: list[str] = []
     for entry in spec.disallowed_tools:
         spec_disallowed.extend(split_csv_entries(entry))
-    disallowed_tools = dedupe_nonempty((*disallowed_tools, *spec_disallowed))
-    allowed_tools = dedupe_nonempty((*allowed_tools, *parent_allowed_tools))
+    if not spec.claude_native_agents_enabled:
+        allowed_tools = [tool for tool in allowed_tools if not _is_claude_agent_tool(tool)]
+        parent_allowed_tools = [
+            tool for tool in parent_allowed_tools if not _is_claude_agent_tool(tool)
+        ]
+        passthrough_allowed_tools = [
+            tool for tool in passthrough_allowed_tools if not _is_claude_agent_tool(tool)
+        ]
+    allowed_tools = dedupe_nonempty(
+        (*allowed_tools, *parent_allowed_tools, *passthrough_allowed_tools)
+    )
+    disallowed_tools = dedupe_nonempty(
+        (
+            *disallowed_tools,
+            *spec_disallowed,
+            *passthrough_disallowed_tools,
+            *_CLAUDE_BUILTIN_AGENT_DENY_TOOLS,
+        )
+    )
+    if disallowed_tools:
+        denied_tools = set(disallowed_tools)
+        allowed_tools = [tool for tool in allowed_tools if not _is_denied_tool(tool, denied_tools)]
     command.extend(permission_tail)
     if allowed_tools:
         command.extend(("--allowedTools", ",".join(allowed_tools)))

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/harness/projections/project_codex_streaming.py

@@ -71,6 +71,7 @@ _DELEGATED_FIELDS: frozenset[str] = frozenset(
     {
         "agent_name",
         "agents_payload",
+        "claude_native_agents_enabled",
         "appended_system_prompt",
         "harness",
         "pi_extension_entrypoints",

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/harness/projections/project_codex_subprocess.py

@@ -39,6 +39,7 @@ _DELEGATED_FIELDS: frozenset[str] = frozenset(
     {
         "agent_name",
         "agents_payload",
+        "claude_native_agents_enabled",
         "appended_system_prompt",
         "harness",
         "pi_extension_entrypoints",

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/harness/projections/project_cursor.py

@@ -34,6 +34,7 @@ _DELEGATED_FIELDS: frozenset[str] = frozenset(
         "agent_name",
         "appended_system_prompt",
         "agents_payload",
+        "claude_native_agents_enabled",
         "prompt_file_path",
         "user_turn_content",
         "report_output_path",

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/harness/projections/project_opencode_streaming.py

@@ -45,6 +45,7 @@ _PROJECTED_FIELDS: frozenset[str] = _ACCOUNTED_FIELDS
 _DELEGATED_FIELDS: frozenset[str] = frozenset(
     {
         "agents_payload",
+        "claude_native_agents_enabled",
         "base_instructions",
         "developer_instructions",
         "harness",

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/harness/projections/project_opencode_subprocess.py

@@ -37,6 +37,7 @@ _PROJECTED_FIELDS: frozenset[str] = frozenset(
 _DELEGATED_FIELDS: frozenset[str] = frozenset(
     {
         "agents_payload",
+        "claude_native_agents_enabled",
         "base_instructions",
         "developer_instructions",
         "harness",

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/harness/projections/project_pi_native_tui.py

@@ -34,6 +34,7 @@ _DELEGATED_FIELDS: frozenset[str] = frozenset(
         "harness",
         "agent_name",
         "agents_payload",
+        "claude_native_agents_enabled",
         "prompt",
         "prompt_file_path",
         "base_instructions",

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/harness/projections/project_pi_rpc.py

@@ -37,6 +37,7 @@ _DELEGATED_FIELDS: frozenset[str] = frozenset(
         "harness",
         "agent_name",
         "agents_payload",
+        "claude_native_agents_enabled",
         "prompt",
         "prompt_file_path",
         "base_instructions",

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/launch/context.py

@@ -82,6 +82,8 @@ from .env import build_env_plan
 from .env import merge_env_overrides as _merge_env_overrides
 from .permissions import (
     CLAUDE_NATIVE_DELEGATION_TOOLS,
+    project_has_claude_agent_copy,
+    resolve_claude_native_agent_permission_request,
     resolve_nested_claude_permission_request,
     resolve_permission_pipeline,
 )
@@ -103,6 +105,7 @@ from .prompt import (
     compose_skill_prompt_documents,
     sanitize_prior_output,
     strip_stale_report_paths,
+    with_agent_inventory_guidance,
 )
 from .reference import (
     ReferenceItem,
@@ -556,6 +559,7 @@ def materialize_launch_artifacts(
     approval: str | None = None,
     unsafe_no_permissions: bool = False,
     pi_harness_profile: PiHarnessProfileConfig | None = None,
+    claude_native_agents_enabled: bool = False,
     claude_allow_builtin_agents: bool = False,
 ) -> MaterializedLaunchArtifacts:
     """Build shared run/spec/permission launch artifacts."""
@@ -606,6 +610,10 @@ def materialize_launch_artifacts(
         unsafe_no_permissions=unsafe_no_permissions,
     )
     spec = resolve_launch_spec_stage(adapter=harness, run_inputs=run_params, perms=perms)
+    if harness.id == HarnessId.CLAUDE:
+        spec = spec.model_copy(
+            update={"claude_native_agents_enabled": claude_native_agents_enabled}
+        )
     return MaterializedLaunchArtifacts(
         run_params=run_params,
         permission_config=permission_config,
@@ -643,8 +651,11 @@ def _inject_claude_delegation_guidance(
     prompt_payload: PreparedPromptPayload,
     *,
     project_root: Path,
+    claude_native_agents_enabled: bool,
 ) -> PreparedPromptPayload:
     """Append delegation guidance when Claude has native agents available."""
+    if not claude_native_agents_enabled:
+        return prompt_payload
     claude_agents_dir = project_root / ".claude" / "agents"
     try:
         has_claude_agents = claude_agents_dir.is_dir() and any(claude_agents_dir.iterdir())
@@ -1035,7 +1046,9 @@ def _resolve_spawn_prepare_projection(
 
     # Prefer the pre-built, pre-filtered inventory prompt from the bundle.
     if policy.bundle_inventory_prompt:
-        agent_inventory_prompt: str | None = policy.bundle_inventory_prompt
+        agent_inventory_prompt: str | None = with_agent_inventory_guidance(
+            policy.bundle_inventory_prompt
+        )
         _, context_prompt = build_launch_context_documents(
             project_root=project_paths.project_root,
             alias_catalog=policy.alias_catalog,
@@ -1111,7 +1124,7 @@ def _resolve_primary_projection(
     if session_mode != "resume":
         # Prefer the pre-built, pre-filtered inventory prompt from the bundle.
         if policy.bundle_inventory_prompt:
-            agent_inventory_prompt = policy.bundle_inventory_prompt
+            agent_inventory_prompt = with_agent_inventory_guidance(policy.bundle_inventory_prompt)
             _, context_prompt = build_launch_context_documents(
                 project_root=project_paths.project_root,
                 alias_catalog=policy.alias_catalog,
@@ -1714,6 +1727,19 @@ def bind_launch_context(
     if model_selection is not None and model_selection.harness_model_id is not None:
         effective_model = model_selection.harness_model_id
 
+    claude_native_agents_enabled = (
+        harness.id == HarnessId.CLAUDE
+        and project_has_claude_agent_copy(project_paths.project_root)
+    )
+    claude_allow_builtin_agents = (
+        resolve_claude_allow_builtin_agents_for_launch(
+            config_snapshot=runtime.config_snapshot,
+            project_root=project_paths.project_root,
+        )
+        if harness.id == HarnessId.CLAUDE
+        else False
+    )
+
     if (
         runtime.composition_surface == LaunchCompositionSurface.SPAWN_PREPARE
         and harness.id == HarnessId.CLAUDE
@@ -1723,6 +1749,7 @@ def bind_launch_context(
             tools=resolved_request.tools,
             profile_tools=profile_tools_for_nested_deny,
             has_profile=has_profile_for_nested_deny,
+            allow_native_agent_tool=claude_native_agents_enabled,
         )
         if tools != resolved_request.tools:
             resolved_request = resolved_request.model_copy(
@@ -1731,6 +1758,14 @@ def bind_launch_context(
                 }
             )
 
+    if harness.id == HarnessId.CLAUDE:
+        tools = resolve_claude_native_agent_permission_request(
+            tools=resolved_request.tools,
+            has_claude_agent_copy=claude_native_agents_enabled,
+        )
+        if tools != resolved_request.tools:
+            resolved_request = resolved_request.model_copy(update={"tools": tools})
+
     if (
         runtime.composition_surface == LaunchCompositionSurface.SPAWN_PREPARE
         and harness.id.value in _resolve_deny_headless_harnesses(runtime, project_paths)
@@ -1754,20 +1789,14 @@ def bind_launch_context(
         if harness.id == HarnessId.PI
         else None
     )
-    claude_allow_builtin_agents = (
-        resolve_claude_allow_builtin_agents_for_launch(
-            config_snapshot=runtime.config_snapshot,
-            project_root=project_paths.project_root,
-        )
-        if harness.id == HarnessId.CLAUDE
-        else False
-    )
     if (
         harness.id == HarnessId.CLAUDE
         and runtime.composition_surface == LaunchCompositionSurface.PRIMARY
     ):
         prompt_payload = _inject_claude_delegation_guidance(
-            prompt_payload, project_root=project_root
+            prompt_payload,
+            project_root=project_root,
+            claude_native_agents_enabled=claude_native_agents_enabled,
         )
     materialized = materialize_launch_artifacts(
         harness=harness,
@@ -1798,6 +1827,7 @@ def bind_launch_context(
         approval=resolved_request.execution_policy.approval,
         unsafe_no_permissions=runtime.unsafe_no_permissions,
         pi_harness_profile=pi_harness_profile,
+        claude_native_agents_enabled=claude_native_agents_enabled,
         claude_allow_builtin_agents=claude_allow_builtin_agents,
     )
     run_params = materialized.run_params

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/launch/launch_types.py

@@ -106,6 +106,7 @@ class ResolvedLaunchSpec(BaseModel):
     # Claude only
     agents_payload: str | None = None
     prompt_file_path: str | None = None
+    claude_native_agents_enabled: bool = False
     disallowed_tools: tuple[str, ...] = ()
 
     # Claude + Codex

{meridian_cli-0.2.23 → meridian_cli-0.2.24}/src/meridian/lib/launch/permissions.py

@@ -2,6 +2,10 @@
 
 from __future__ import annotations
 
+import tomllib
+from pathlib import Path
+from typing import cast
+
 from meridian.lib.safety.permissions import (
     PermissionConfig,
     TieredPermissionResolver,
@@ -12,7 +16,14 @@ from meridian.lib.safety.permissions import (
     compile_tools_to_opencode_permission,
     infer_codex_sandbox_from_tools,
 )
-from meridian.lib.tools import ToolsField, resolve_tool_action, tools_field_to_map
+from meridian.lib.tools import (
+    ToolAction,
+    ToolsField,
+    normalize_tool_action,
+    normalize_tool_key,
+    resolve_tool_action,
+    tools_field_to_map,
+)
 
 PermissionResolverImpl = (
     TieredPermissionResolver
@@ -39,6 +50,12 @@ and policy enforcement. Profiles can opt out per tool via `tools:`.
 
 
 _NESTED_CLAUDE_DELEGATION_CAPABILITIES: frozenset[str] = frozenset({"agent", "task"})
+_CLAUDE_BUILTIN_AGENT_DENY_RULES: tuple[str, ...] = (
+    "agent(Explore)",
+    "agent(Plan)",
+    "agent(General-purpose)",
+    "agent(general-purpose)",
+)
 
 
 def _resolve_opencode_override(*, tools: ToolsField | None) -> str | None:
@@ -47,6 +64,76 @@ def _resolve_opencode_override(*, tools: ToolsField | None) -> str | None:
     return compile_tools_to_opencode_permission(tools)
 
 
+def project_has_claude_agent_copy(project_root: Path) -> bool:
+    """Return whether effective Mars config enables Claude native agent copies."""
+
+    targets: tuple[str, ...] = ()
+    agent_copy_harnesses: tuple[str, ...] = ()
+    for config_name in ("mars.toml", "mars.local.toml"):
+        config_path = project_root / config_name
+        if not config_path.is_file():
+            continue
+        with config_path.open("rb") as handle:
+            payload = tomllib.load(handle)
+        settings = cast("object", payload.get("settings"))
+        if not isinstance(settings, dict):
+            continue
+        typed_settings = cast("dict[str, object]", settings)
+        raw_targets = typed_settings.get("targets")
+        if isinstance(raw_targets, list):
+            targets = tuple(
+                str(target).strip().lower()
+                for target in cast("list[object]", raw_targets)
+            )
+        raw_managed_root = typed_settings.get("managed_root")
+        if not targets and isinstance(raw_managed_root, str):
+            normalized_root = raw_managed_root.strip().lower()
+            if normalized_root:
+                targets = (normalized_root,)
+        agent_copy = typed_settings.get("agent_copy")
+        if not isinstance(agent_copy, dict) or "harnesses" not in agent_copy:
+            continue
+        typed_agent_copy = cast("dict[str, object]", agent_copy)
+        harnesses = typed_agent_copy.get("harnesses")
+        if isinstance(harnesses, list):
+            agent_copy_harnesses = tuple(
+                str(harness).strip().lower()
+                for harness in cast("list[object]", harnesses)
+            )
+    return "claude" in agent_copy_harnesses and ".claude" in targets
+
+
+def _normalized_tools_map(tools: ToolsField | None) -> dict[str, ToolAction]:
+    return {
+        normalize_tool_key(key, source="tools"): normalize_tool_action(
+            action,
+            source=f"tools.{key}",
+        )
+        for key, action in tools_field_to_map(tools).items()
+    }
+
+
+def resolve_claude_native_agent_permission_request(
+    *,
+    tools: ToolsField | None,
+    has_claude_agent_copy: bool,
+) -> ToolsField | None:
+    """Apply Claude native Agent defaults from the Mars agent-copy boundary."""
+
+    rules = _normalized_tools_map(tools)
+    if not has_claude_agent_copy:
+        for key in tuple(rules):
+            capability, _separator, _scope = key.partition("(")
+            if capability == "agent":
+                rules[key] = "deny"
+        rules["agent"] = "deny"
+    for key in _CLAUDE_BUILTIN_AGENT_DENY_RULES:
+        rules[key] = "deny"
+    if not rules:
+        return tools
+    return rules
+
+
 def compute_nested_claude_deny_additions(
     *,
     profile_tools: ToolsField | None,
@@ -102,6 +189,7 @@ def resolve_nested_claude_permission_request(
     tools: ToolsField | None,
     profile_tools: ToolsField | None,
     has_profile: bool,
+    allow_native_agent_tool: bool = False,
 ) -> ToolsField | None:
     """Apply Meridian's managed-spawn boundary for nested Claude launches."""
 
@@ -110,6 +198,10 @@ def resolve_nested_claude_permission_request(
         profile_tools=profile_tools,
         existing_tools=tools,
     )
+    if allow_native_agent_tool:
+        deny_additions = tuple(
+            capability for capability in deny_additions if capability != "agent"
+        )
     resolved_tools = _apply_nested_claude_denies(tools=tools, denied_capabilities=deny_additions)
     return resolved_tools
 
@@ -146,6 +238,8 @@ __all__ = [
     "CLAUDE_NATIVE_DELEGATION_TOOLS",
     "PermissionResolverImpl",
     "compute_nested_claude_deny_additions",
+    "project_has_claude_agent_copy",
+    "resolve_claude_native_agent_permission_request",
     "resolve_nested_claude_permission_request",
     "resolve_permission_pipeline",
 ]