playmaker-cli 0.4.0__tar.gz → 0.5.0__tar.gz

{playmaker_cli-0.4.0 → playmaker_cli-0.5.0}/CHANGELOG.md

@@ -5,6 +5,37 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.0] - 2026-07-27
+
+### Changed
+
+- **Sub-agent permissions are configurable, and Claude no longer skips them by
+  default.** 0.4 passed `--dangerously-skip-permissions` to every Claude
+  dispatch because the alternative was believed to be a run that stalls on the
+  first prompt. That is not what happens: a headless `claude -p` without
+  permissions answers "I need your permission" and returns immediately, having
+  changed nothing. There is also a middle tier, verified against claude 2.x:
+  `--permission-mode acceptEdits` lets the agent edit files and run commands
+  inside the dispatch `--cwd` while claude itself refuses anything outside it.
+
+  That is the new default. `[agents.claude]` now accepts `permission_mode`,
+  `allowed_tools` and `disallowed_tools`, and `yolo = true` restores the old
+  no-boundary behaviour in one line. The 0.4 spelling `skip_permissions = true`
+  is still honoured; `skip_permissions = false` now falls through to the
+  default mode instead of producing a run that does nothing.
+
+  **Upgrade note:** a subtask that needs to write outside its `--cwd` will now
+  be refused. Point `--cwd` at the right directory, or set `yolo = true`.
+
+### Added
+
+- `[agents.codex] sandbox` — forwarded to `codex exec -s`
+  (`read-only` / `workspace-write` / `danger-full-access`). Codex needs no
+  permission-skipping flag: `codex exec` is already non-interactive and
+  sandboxes the model's shell itself, and playmaker never passed it one.
+- `[agents.agy] sandbox` — forwarded to `agy --sandbox`. agy has no per-mode
+  permission flag, so it keeps `yolo = true` as its default.
+
 ## [0.4.0] - 2026-07-27
 
 ### Added

{playmaker_cli-0.4.0 → playmaker_cli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: playmaker-cli
-Version: 0.4.0
+Version: 0.5.0
 Summary: Playing-coach CLI for orchestrating Claude Code, Codex and Antigravity sub-agents in parallel.
 Project-URL: Homepage, https://github.com/vladsafedev/playmaker
 Project-URL: Repository, https://github.com/vladsafedev/playmaker
@@ -22,7 +22,7 @@ Classifier: Topic :: Software Development
 Classifier: Topic :: Utilities
 Requires-Python: >=3.11
 Requires-Dist: rich>=13.7
-Requires-Dist: typer>=0.12
+Requires-Dist: typer>=0.27.0
 Description-Content-Type: text/markdown
 
 # playmaker
@@ -87,28 +87,54 @@ The catch: doing this by hand — terminal tabs, jumping between tools,
 copy-pasting context — is friction. `playmaker` removes the friction; the
 [coach skill](#the-coach-skill) provides the discipline.
 
-## ⚠️ Sub-agents skip permission prompts by default
+## Permissions
 
-By default, playmaker launches Claude and Antigravity sub-agents with
-`--dangerously-skip-permissions` (and Gemini with `--yolo`). This is
-deliberate: a headless agent has no human at the keyboard, so without these
-flags a detached run stalls at the first tool-approval prompt and finishes
-having written nothing.
+A detached agent has nobody at the keyboard to approve a tool prompt, so you
+decide up front what it may do. Left alone, a headless Claude simply answers
+*"I need your permission"* and finishes having changed nothing — so the choice
+is real, not a formality.
 
-It also means a dispatched agent can run commands and edit files **without
-asking**. Only dispatch prompts you'd be comfortable running unattended, in
-working directories you trust.
+By default playmaker asks for the weakest setting that still lets the work
+finish: **the agent is free inside the directory you dispatched it to, and
+Claude itself refuses anything outside it.**
 
-To opt out for Claude, set this in `~/.playmaker/config.toml`:
+| `[agents.claude] permission_mode` | inside `--cwd` | outside `--cwd` |
+|---|---|---|
+| `"plan"` | reads and plans, no writes | — |
+| `"acceptEdits"` *(default)* | edits files, runs commands | refused |
+| `"bypassPermissions"` | anything | anything |
+
+Narrow it further with an allowlist — Claude Code's own tool syntax:
 
 ```toml
 [agents.claude]
-skip_permissions = false
+permission_mode = "acceptEdits"
+allowed_tools = ["Read", "Edit", "Write", "Bash(pytest:*)"]
+disallowed_tools = ["WebFetch"]
 ```
 
-— with the caveat above: detached runs will then stall on the first permission
-prompt, so this only really makes sense alongside `--sync` workflows or
-allowlist rules you've configured in Claude Code itself.
+**Or skip the whole thing.** One line, no boundary, including the
+working-directory one:
+
+```toml
+[agents.claude]
+yolo = true
+```
+
+That is a reasonable trade for prompts and directories you'd run unattended
+anyway — just make it a decision rather than a default you inherited.
+
+The other agents differ, because their CLIs do:
+
+- **codex** needs none of this. `codex exec` is already non-interactive and
+  sandboxes the model's shell itself, so playmaker passes no bypass flag at
+  all. Override its policy with `sandbox = "read-only" | "workspace-write" |
+  "danger-full-access"`.
+- **agy** has no middle tier — no per-mode flag exists, so a detached run
+  either auto-approves or comes back having done nothing. It therefore
+  defaults to `yolo = true`; layer `sandbox = true` on top for agy's own
+  terminal restrictions.
+- **gemini** (legacy) runs with `--yolo`.
 
 ## Install
 
@@ -203,13 +229,15 @@ still live — that's the cheap path for "almost right, fix Y". Start fresh with
 
 ```mermaid
 flowchart LR
-    C["🧑‍🏫 coach<br/>your Claude Code session"] -->|dispatch| P(("playmaker"))
-    P --> A1["claude -p<br/><i>--model sonnet</i>"]
+    C["coach<br/>your Claude Code session"] -->|dispatch| P(("playmaker"))
+    P --> A1["claude -p<br/>--model sonnet"]
     P --> A2["codex exec"]
     P --> A3["agy -p"]
-    A1 & A2 & A3 --> S[("state.db<br/>outputs/ · logs/")]
-    S -->|list · thread · summary| C
-    S -.->|batch drained| N["🔔 one ping"]
+    A1 --> S[("state.db<br/>outputs/ + logs/")]
+    A2 --> S
+    A3 --> S
+    S -->|"list / thread / summary"| C
+    S -.->|"batch drained"| N["one ping"]
 ```
 
 Each dispatch is a detached OS process with its own quota; playmaker owns the
@@ -324,6 +352,8 @@ input the coach skill uses to route each subtask.
 Handlers for other agent CLIs are especially welcome — see
 [CONTRIBUTING.md](CONTRIBUTING.md) for the `AgentHandler` contract and what you
 need to know about a CLI before writing one.
+[SECURITY.md](SECURITY.md) covers which credentials the quota probes read and
+what a dispatched agent is allowed to do.
 
 ```bash
 uv run pytest

{playmaker_cli-0.4.0 → playmaker_cli-0.5.0}/README.md

@@ -60,28 +60,54 @@ The catch: doing this by hand — terminal tabs, jumping between tools,
 copy-pasting context — is friction. `playmaker` removes the friction; the
 [coach skill](#the-coach-skill) provides the discipline.
 
-## ⚠️ Sub-agents skip permission prompts by default
+## Permissions
 
-By default, playmaker launches Claude and Antigravity sub-agents with
-`--dangerously-skip-permissions` (and Gemini with `--yolo`). This is
-deliberate: a headless agent has no human at the keyboard, so without these
-flags a detached run stalls at the first tool-approval prompt and finishes
-having written nothing.
+A detached agent has nobody at the keyboard to approve a tool prompt, so you
+decide up front what it may do. Left alone, a headless Claude simply answers
+*"I need your permission"* and finishes having changed nothing — so the choice
+is real, not a formality.
 
-It also means a dispatched agent can run commands and edit files **without
-asking**. Only dispatch prompts you'd be comfortable running unattended, in
-working directories you trust.
+By default playmaker asks for the weakest setting that still lets the work
+finish: **the agent is free inside the directory you dispatched it to, and
+Claude itself refuses anything outside it.**
 
-To opt out for Claude, set this in `~/.playmaker/config.toml`:
+| `[agents.claude] permission_mode` | inside `--cwd` | outside `--cwd` |
+|---|---|---|
+| `"plan"` | reads and plans, no writes | — |
+| `"acceptEdits"` *(default)* | edits files, runs commands | refused |
+| `"bypassPermissions"` | anything | anything |
+
+Narrow it further with an allowlist — Claude Code's own tool syntax:
 
 ```toml
 [agents.claude]
-skip_permissions = false
+permission_mode = "acceptEdits"
+allowed_tools = ["Read", "Edit", "Write", "Bash(pytest:*)"]
+disallowed_tools = ["WebFetch"]
 ```
 
-— with the caveat above: detached runs will then stall on the first permission
-prompt, so this only really makes sense alongside `--sync` workflows or
-allowlist rules you've configured in Claude Code itself.
+**Or skip the whole thing.** One line, no boundary, including the
+working-directory one:
+
+```toml
+[agents.claude]
+yolo = true
+```
+
+That is a reasonable trade for prompts and directories you'd run unattended
+anyway — just make it a decision rather than a default you inherited.
+
+The other agents differ, because their CLIs do:
+
+- **codex** needs none of this. `codex exec` is already non-interactive and
+  sandboxes the model's shell itself, so playmaker passes no bypass flag at
+  all. Override its policy with `sandbox = "read-only" | "workspace-write" |
+  "danger-full-access"`.
+- **agy** has no middle tier — no per-mode flag exists, so a detached run
+  either auto-approves or comes back having done nothing. It therefore
+  defaults to `yolo = true`; layer `sandbox = true` on top for agy's own
+  terminal restrictions.
+- **gemini** (legacy) runs with `--yolo`.
 
 ## Install
 
@@ -176,13 +202,15 @@ still live — that's the cheap path for "almost right, fix Y". Start fresh with
 
 ```mermaid
 flowchart LR
-    C["🧑‍🏫 coach<br/>your Claude Code session"] -->|dispatch| P(("playmaker"))
-    P --> A1["claude -p<br/><i>--model sonnet</i>"]
+    C["coach<br/>your Claude Code session"] -->|dispatch| P(("playmaker"))
+    P --> A1["claude -p<br/>--model sonnet"]
     P --> A2["codex exec"]
     P --> A3["agy -p"]
-    A1 & A2 & A3 --> S[("state.db<br/>outputs/ · logs/")]
-    S -->|list · thread · summary| C
-    S -.->|batch drained| N["🔔 one ping"]
+    A1 --> S[("state.db<br/>outputs/ + logs/")]
+    A2 --> S
+    A3 --> S
+    S -->|"list / thread / summary"| C
+    S -.->|"batch drained"| N["one ping"]
 ```
 
 Each dispatch is a detached OS process with its own quota; playmaker owns the
@@ -297,6 +325,8 @@ input the coach skill uses to route each subtask.
 Handlers for other agent CLIs are especially welcome — see
 [CONTRIBUTING.md](CONTRIBUTING.md) for the `AgentHandler` contract and what you
 need to know about a CLI before writing one.
+[SECURITY.md](SECURITY.md) covers which credentials the quota probes read and
+what a dispatched agent is allowed to do.
 
 ```bash
 uv run pytest

{playmaker_cli-0.4.0 → playmaker_cli-0.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "playmaker-cli"
-version = "0.4.0"
+version = "0.5.0"
 description = "Playing-coach CLI for orchestrating Claude Code, Codex and Antigravity sub-agents in parallel."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -35,7 +35,7 @@ classifiers = [
     "Topic :: Utilities",
 ]
 dependencies = [
-    "typer>=0.12",
+    "typer>=0.27.0",
     "rich>=13.7",
 ]
 
@@ -50,7 +50,7 @@ playmaker = "playmaker.cli:app"
 [dependency-groups]
 dev = [
     "ruff>=0.4",
-    "pytest>=8",
+    "pytest>=9.1.1",
 ]
 
 [build-system]

{playmaker_cli-0.4.0 → playmaker_cli-0.5.0}/skills/playmaker-coach/SKILL.md

@@ -20,7 +20,7 @@ All Claude work — coach, internal sub-agents, external `claude -p` — draws f
 2. **Internal sub-agents — the `Task`/`Agent` tool in THIS session.** Run inside this session, **write files** (they inherit the coach's permission mode), return their result straight into the coach's context, and run in parallel. They draw on the same subscription, so the gate is "is weekly quota healthy?" — glance at `playmaker quotas`. **Use them freely** for Claude-side chunks the coach will fold back in directly; spawn several at once, don't be shy.
 
 3. **External dispatch — `playmaker dispatch <agent>`.** Separate OS processes, tracked in playmaker (`list`/`watch`/`thread`/`continue`):
-   - **`claude -p` (sibling Claude):** same subscription. Its key lever is the model bucket — **Sonnet is a separate weekly bucket from Opus**, usually idle while Opus depletes, so default **`--model sonnet`** to spare the scarce Opus bucket (**`--model haiku`** for trivial mechanical work). It **can write files** (playmaker forwards `--dangerously-skip-permissions`; see §10). Use it over an internal sub-agent when you want a **tracked, detached work-stream** you can monitor/continue independently of the coach's turn.
+   - **`claude -p` (sibling Claude):** same subscription. Its key lever is the model bucket — **Sonnet is a separate weekly bucket from Opus**, usually idle while Opus depletes, so default **`--model sonnet`** to spare the scarce Opus bucket (**`--model haiku`** for trivial mechanical work). It **can write files** — playmaker runs it in `acceptEdits`, so it edits and runs commands freely inside `--cwd` and is refused outside it (see §10). Use it over an internal sub-agent when you want a **tracked, detached work-stream** you can monitor/continue independently of the coach's turn.
    - **`codex` / `agy`:** each on its own subscription/quota — the right home for **write-heavy** parallel implementation that can leave the Anthropic subscription. `agy` is special: besides Gemini tiers it carries **Claude Sonnet/Opus 4.6 (Thinking)** on Google's pool, so even "must be Claude-quality" work can leave the Anthropic quota.
 
 **Routing cheat-sheet for Claude-side work:**
@@ -219,14 +219,14 @@ Read `summary` first. If you need more context to judge: `playmaker thread <id>`
 
 If `playmaker dispatch` returns an error (binary missing, auth bad, agent unavailable), don't silently retry. Surface it, propose a re-routed plan ("Codex unavailable; want me to give the backend to Claude instead?"), and wait for user confirmation.
 
-**Sibling-Claude writes are enabled** — playmaker forwards `--dangerously-skip-permissions`, so external `claude -p` dispatch/resume runs headless with permissions skipped and *can* edit files in a detached session. (This is configurable; a user who set `skip_permissions = false` will see detached runs stall on the first tool prompt.)
+**Sibling-Claude writes are enabled, but bounded.** playmaker dispatches `claude -p` with `--permission-mode acceptEdits` by default: it edits files and runs commands inside the dispatch `--cwd` without asking, and claude itself refuses anything outside that directory. So **keep every path in the prompt inside `--cwd`** — a subtask that legitimately needs to touch a sibling repo or a dotfile in `$HOME` will come back refused, and the fix is a different `--cwd` (or the user's `yolo = true`), not a re-prompt.
 
 Both Claude lanes are on the subscription, so pick by **where the work lives**, not cost:
 - **Coach folds the result in directly → internal sub-agent (Task tool).** In-session, write-capable, returns into context. Default choice for "more Claude."
 - **Independent stream you'll monitor / continue separately → `playmaker dispatch claude --model sonnet`.** Tracked, detached; Sonnet's separate weekly bucket spares Opus.
 - **Work that can leave the Claude family → Codex / agy** (their own quotas).
 
-If a dispatch comes back with zero file changes, check `playmaker summary <id>`: a leftover "click Allow" pivot means the local `claude` is older than the skip-permissions wiring or overrides it — fall back to an internal sub-agent or Codex/agy for that subtask. For **agy** specifically, a "done" with no file changes usually means the files landed in agy's private scratch dir (`~/.gemini/antigravity-cli/scratch/`) — the prompt referred to "the current directory" instead of workspace paths; re-dispatch with explicit paths.
+If a dispatch comes back with zero file changes, check `playmaker summary <id>`. Two common causes for Claude: the subtask tried to write outside `--cwd` and was refused (re-dispatch with the right `--cwd`), or the run needed a permission the configured mode doesn't grant — a "I need your permission" answer, not a crash. For **agy** specifically, a "done" with no file changes usually means the files landed in agy's private scratch dir (`~/.gemini/antigravity-cli/scratch/`) — the prompt referred to "the current directory" instead of workspace paths; re-dispatch with explicit paths.
 
 ## Reading discipline
 

{playmaker_cli-0.4.0 → playmaker_cli-0.5.0}/src/playmaker/agents/agy.py

@@ -34,7 +34,7 @@ import time
 from pathlib import Path
 
 from playmaker.agents.base import DispatchResult, SessionStartedCallback, Turn
-from playmaker.config import agent_setting
+from playmaker.config import agent_setting, yolo_enabled
 
 AGY_BRAIN_ROOT = Path("~/.gemini/antigravity-cli/brain").expanduser()
 
@@ -146,10 +146,13 @@ class AgyHandler:
         cmd = ["agy", "-p", full_prompt, "--log-file", str(log_path)]
         if conversation_id:
             cmd += ["--conversation", conversation_id]
-        # Detached runs have no human to approve tool prompts (same rationale
-        # as the claude handler). Opt out via [agents.agy] skip_permissions.
-        if agent_setting("agy", "skip_permissions", True):
+        # agy has no middle tier: unlike claude there is no per-mode permission
+        # flag, so a detached run either skips the prompts or answers nothing.
+        # `--sandbox` is orthogonal and can be layered on top.
+        if yolo_enabled("agy", default=True):
             cmd.append("--dangerously-skip-permissions")
+        if agent_setting("agy", "sandbox", False):
+            cmd.append("--sandbox")
         # agy's built-in print timeout is 5m — too short for real subtasks.
         cmd += ["--print-timeout", str(agent_setting("agy", "print_timeout", "60m"))]
         if model:

{playmaker_cli-0.4.0 → playmaker_cli-0.5.0}/src/playmaker/agents/claude.py

@@ -17,7 +17,36 @@ import subprocess
 from pathlib import Path
 
 from playmaker.agents.base import DispatchResult, SessionStartedCallback, Turn
-from playmaker.config import agent_setting
+from playmaker.config import agent_list_setting, agent_setting, yolo_enabled
+
+# What a sub-agent is allowed to do without a human at the keyboard.
+# Verified against claude 2.x in `-p` mode:
+#   default       -> the agent writes nothing and answers "I need permission";
+#                    it does NOT hang, it just returns having done nothing.
+#   acceptEdits   -> edits and commands proceed inside the working directory,
+#                    and anything outside it is refused by claude itself.
+#   bypassPermissions / --dangerously-skip-permissions -> no boundary at all.
+# acceptEdits is the default here because it is the weakest mode that still
+# lets a detached run finish its work.
+DEFAULT_PERMISSION_MODE = "acceptEdits"
+
+
+def permission_args() -> list[str]:
+    """Permission flags for a headless run, from [agents.claude] in config.toml."""
+    if yolo_enabled("claude"):
+        return ["--dangerously-skip-permissions"]
+
+    mode = agent_setting("claude", "permission_mode", DEFAULT_PERMISSION_MODE)
+    args = ["--permission-mode", str(mode)]
+    # Comma-separated rather than variadic: `--allowedTools A B` would swallow
+    # the positional prompt that follows.
+    allowed = agent_list_setting("claude", "allowed_tools")
+    if allowed:
+        args += ["--allowedTools", ",".join(allowed)]
+    disallowed = agent_list_setting("claude", "disallowed_tools")
+    if disallowed:
+        args += ["--disallowedTools", ",".join(disallowed)]
+    return args
 
 
 class ClaudeHandler:
@@ -53,13 +82,7 @@ class ClaudeHandler:
             "stream-json",
             "--verbose",
         ]
-        # Detached runs have no human to approve tool prompts; without this
-        # the agent stalls on the first file write and ends its turn with
-        # zero changes. Skipping permissions is what makes sibling-Claude
-        # usable for write-heavy subtasks in headless mode. Opt out via
-        # [agents.claude] skip_permissions = false in ~/.playmaker/config.toml.
-        if agent_setting("claude", "skip_permissions", True):
-            cmd.append("--dangerously-skip-permissions")
+        cmd += permission_args()
         if model:
             cmd += ["--model", model]
         cmd.append(full_prompt)
@@ -169,9 +192,8 @@ class ClaudeHandler:
             "--output-format",
             "json",
         ]
-        # See dispatch(): detached resume has no human to approve prompts.
-        if agent_setting("claude", "skip_permissions", True):
-            cmd.append("--dangerously-skip-permissions")
+        # See dispatch(): detached resume has no human to approve prompts either.
+        cmd += permission_args()
         if model:
             cmd += ["--model", model]
         cmd.append(full_prompt)

{playmaker_cli-0.4.0 → playmaker_cli-0.5.0}/src/playmaker/agents/codex.py

@@ -23,10 +23,23 @@ import time
 from pathlib import Path
 
 from playmaker.agents.base import DispatchResult, SessionStartedCallback, Turn
+from playmaker.config import agent_setting
 
 CODEX_SESSIONS_ROOT = Path("~/.codex/sessions").expanduser()
 
 
+def sandbox_args() -> list[str]:
+    """Codex's own sandbox policy, from [agents.codex] sandbox in config.toml.
+
+    Unlike claude and agy, codex needs no permission-skipping flag: `codex exec`
+    is already non-interactive and confines the model's shell commands with its
+    own sandbox. We pass `-s` only when a specific policy was configured;
+    otherwise codex's own default applies.
+    """
+    policy = agent_setting("codex", "sandbox")
+    return ["-s", str(policy)] if policy else []
+
+
 class CodexHandler:
     name = "codex"
 
@@ -58,6 +71,7 @@ class CodexHandler:
             "-o",
             str(last_msg_path),
         ]
+        cmd += sandbox_args()
         if model:
             cmd += ["-m", model]
         cmd.append(full_prompt)

{playmaker_cli-0.4.0 → playmaker_cli-0.5.0}/src/playmaker/cli.py

@@ -949,22 +949,43 @@ sound = true
 # (terminal-notifier only). Any app name `open -a` accepts.
 editor = "Zed"
 
+# How much each sub-agent may do while nobody is watching. A detached agent
+# cannot answer a permission prompt, so every agent needs *some* answer here.
+
 [agents.claude]
 binary = "claude"
-# Headless dispatch passes --dangerously-skip-permissions so unattended runs
-# are not blocked by tool-permission prompts. Set to false to keep Claude
-# Code's normal permission checks (detached runs will then stall on the first
-# tool prompt and finish without writing anything).
-skip_permissions = true
+# "acceptEdits" (default): the agent edits files and runs commands freely
+#   inside the dispatch --cwd, and claude itself refuses anything outside it.
+# "plan": read and plan only, no writes.
+# "bypassPermissions": no boundary at all — same as yolo below.
+permission_mode = "acceptEdits"
+# Optional allowlist/denylist, narrower than the mode. Tool syntax is Claude
+# Code's own, e.g. "Bash(pytest:*)" to permit one command family.
+# allowed_tools = ["Read", "Edit", "Write", "Bash(pytest:*)"]
+# disallowed_tools = ["WebFetch"]
+#
+# Escape hatch: skip every check, including the working-directory boundary.
+# Only for prompts and directories you would run unattended.
+# yolo = true
 
 [agents.codex]
 binary = "codex"
+# codex exec is already non-interactive and sandboxes the model's shell itself,
+# so it needs no permission flag. Set a policy to override its default:
+# "read-only" | "workspace-write" | "danger-full-access"
+# sandbox = "workspace-write"
 
 [agents.agy]
 binary = "agy"
 # Antigravity CLI. Model names are display strings from `agy models`,
 # e.g. "Claude Opus 4.6 (Thinking)", "Gemini 3.5 Flash (High)".
-skip_permissions = true
+#
+# agy has no per-mode permission flag — a detached run either auto-approves or
+# comes back having done nothing — so this defaults to on.
+yolo = true
+# Layer agy's own terminal restrictions on top.
+# sandbox = true
+#
 # Forwarded to agy --print-timeout; the CLI's own default (5m) is too short
 # for real subtasks.
 print_timeout = "60m"

{playmaker_cli-0.4.0 → playmaker_cli-0.5.0}/src/playmaker/config.py

@@ -28,3 +28,25 @@ def setting(section: str, key: str, default: Any = None) -> Any:
     """Look up [<section>] <key>, falling back to `default`."""
     value = load_config().get(section, {})
     return value.get(key, default) if isinstance(value, dict) else default
+
+
+def yolo_enabled(agent: str, *, default: bool = False) -> bool:
+    """Whether this agent is configured to skip its permission checks entirely.
+
+    `yolo` is the current spelling; `skip_permissions` is the 0.4 name and is
+    still honoured so existing configs keep working.
+    """
+    value = agent_setting(agent, "yolo")
+    if value is None:
+        value = agent_setting(agent, "skip_permissions")
+    return default if value is None else bool(value)
+
+
+def agent_list_setting(agent: str, key: str) -> list[str]:
+    """A list-valued agent setting, tolerating a plain string in the TOML."""
+    value = agent_setting(agent, key)
+    if value is None:
+        return []
+    if isinstance(value, str):
+        return [v.strip() for v in value.split(",") if v.strip()]
+    return [str(v) for v in value]

playmaker_cli-0.5.0/tests/test_claude.py

@@ -0,0 +1,148 @@
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+import playmaker.config as config
+from playmaker.agents.claude import ClaudeHandler
+
+
+class _FakeStream:
+    def __init__(self, lines: list[str]) -> None:
+        self._lines = lines
+
+    def __iter__(self):
+        return iter(self._lines)
+
+    def read(self) -> str:
+        return "".join(self._lines)
+
+
+class _FakePopen:
+    """Stand-in for subprocess.Popen over claude's stream-json output."""
+
+    def __init__(self, lines: list[str], returncode: int = 0, stderr: str = "") -> None:
+        self._lines = lines
+        self.returncode = returncode
+        self._stderr = stderr
+        self.cmd: list[str] = []
+        self.stdout = None
+        self.stderr = None
+
+    def __call__(self, cmd, **kwargs):
+        self.cmd = cmd
+        self.stdout = _FakeStream(self._lines)
+        self.stderr = _FakeStream([self._stderr])
+        return self
+
+    def wait(self) -> int:
+        return self.returncode
+
+
+def _events(*objs: dict) -> list[str]:
+    return [json.dumps(o) + "\n" for o in objs]
+
+
+INIT = {"type": "system", "subtype": "init", "session_id": "sess-123"}
+
+
+def test_dispatch_returns_the_result_event_text(monkeypatch, tmp_path) -> None:
+    fake = _FakePopen(
+        _events(
+            INIT,
+            {"type": "assistant", "message": {"content": [{"type": "text", "text": "hi"}]}},
+            {"type": "result", "subtype": "success", "result": "DONE", "total_cost_usd": 0.12},
+        )
+    )
+    monkeypatch.setattr("playmaker.agents.claude.subprocess.Popen", fake)
+
+    result = ClaudeHandler().dispatch(prompt="do it", cwd=tmp_path)
+
+    assert result.agent_session_id == "sess-123"
+    assert result.initial_output == "DONE"
+    assert result.cost_usd == 0.12
+
+
+def test_dispatch_fires_the_session_callback_before_the_run_ends(monkeypatch, tmp_path) -> None:
+    # The early callback is what lets `playmaker get` find a detached session
+    # within a second instead of after the agent finishes.
+    fake = _FakePopen(_events(INIT, {"type": "result", "subtype": "success", "result": "ok"}))
+    monkeypatch.setattr("playmaker.agents.claude.subprocess.Popen", fake)
+    seen: list[str] = []
+
+    ClaudeHandler().dispatch(prompt="p", cwd=tmp_path, on_session_started=seen.append)
+
+    assert seen == ["sess-123"]
+
+
+def test_dispatch_surfaces_the_error_from_the_result_event(monkeypatch, tmp_path) -> None:
+    # claude -p reports overload/rate-limit/refusal in the final result event
+    # with an EMPTY stderr, so without this the failure was a blank message.
+    fake = _FakePopen(
+        _events(
+            INIT,
+            {"type": "result", "subtype": "error_during_execution", "is_error": True,
+             "result": "Claude AI usage limit reached"},
+        ),
+        returncode=1,
+    )
+    monkeypatch.setattr("playmaker.agents.claude.subprocess.Popen", fake)
+
+    with pytest.raises(RuntimeError, match="usage limit reached"):
+        ClaudeHandler().dispatch(prompt="p", cwd=tmp_path)
+
+
+def test_dispatch_falls_back_to_raw_stdout_rather_than_failing_blank(
+    monkeypatch, tmp_path
+) -> None:
+    # No stderr, no result event: the raw first lines are the only diagnostic
+    # left, and they beat the blank "claude failed (exit 1):" this replaced.
+    fake = _FakePopen(_events(INIT), returncode=1)
+    monkeypatch.setattr("playmaker.agents.claude.subprocess.Popen", fake)
+
+    with pytest.raises(RuntimeError, match="sess-123"):
+        ClaudeHandler().dispatch(prompt="p", cwd=tmp_path)
+
+
+def test_dispatch_prefers_stderr_over_the_stream_events(monkeypatch, tmp_path) -> None:
+    fake = _FakePopen(_events(INIT), returncode=1, stderr="command not found: claude")
+    monkeypatch.setattr("playmaker.agents.claude.subprocess.Popen", fake)
+
+    with pytest.raises(RuntimeError, match="command not found"):
+        ClaudeHandler().dispatch(prompt="p", cwd=tmp_path)
+
+
+def test_dispatch_without_a_session_id_is_an_error(monkeypatch, tmp_path) -> None:
+    fake = _FakePopen(_events({"type": "result", "subtype": "success", "result": "ok"}))
+    monkeypatch.setattr("playmaker.agents.claude.subprocess.Popen", fake)
+
+    with pytest.raises(RuntimeError, match="missing session_id"):
+        ClaudeHandler().dispatch(prompt="p", cwd=tmp_path)
+
+
+def test_dispatch_bounds_the_agent_to_the_cwd_by_default(monkeypatch, tmp_path) -> None:
+    fake = _FakePopen(_events(INIT, {"type": "result", "subtype": "success", "result": "ok"}))
+    monkeypatch.setattr("playmaker.agents.claude.subprocess.Popen", fake)
+    monkeypatch.setattr(config, "load_config", dict)
+
+    ClaudeHandler().dispatch(prompt="p", cwd=tmp_path, model="sonnet")
+
+    assert "--dangerously-skip-permissions" not in fake.cmd
+    assert fake.cmd[fake.cmd.index("--permission-mode") + 1] == "acceptEdits"
+    assert fake.cmd[fake.cmd.index("--model") + 1] == "sonnet"
+
+
+def test_dispatch_yolo_is_opt_in(monkeypatch, tmp_path) -> None:
+    fake = _FakePopen(_events(INIT, {"type": "result", "subtype": "success", "result": "ok"}))
+    monkeypatch.setattr("playmaker.agents.claude.subprocess.Popen", fake)
+    monkeypatch.setattr(config, "load_config", lambda: {"agents": {"claude": {"yolo": True}}})
+
+    ClaudeHandler().dispatch(prompt="p", cwd=tmp_path)
+
+    assert "--dangerously-skip-permissions" in fake.cmd
+    assert "--permission-mode" not in fake.cmd

playmaker_cli-0.5.0/tests/test_permissions.py

@@ -0,0 +1,127 @@
+"""How each handler answers 'what may this agent do unattended?'."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+import playmaker.config as config
+from playmaker.agents.claude import permission_args
+from playmaker.agents.codex import sandbox_args
+
+
+@pytest.fixture
+def configured(monkeypatch):
+    """Install a fake config.toml body for the duration of a test."""
+
+    def _set(cfg: dict) -> None:
+        monkeypatch.setattr(config, "load_config", lambda: cfg)
+
+    return _set
+
+
+def test_claude_defaults_to_accept_edits(configured) -> None:
+    configured({})
+
+    assert permission_args() == ["--permission-mode", "acceptEdits"]
+
+
+def test_claude_permission_mode_is_configurable(configured) -> None:
+    configured({"agents": {"claude": {"permission_mode": "plan"}}})
+
+    assert permission_args() == ["--permission-mode", "plan"]
+
+
+def test_claude_yolo_replaces_the_mode_entirely(configured) -> None:
+    configured({"agents": {"claude": {"yolo": True, "permission_mode": "plan"}}})
+
+    assert permission_args() == ["--dangerously-skip-permissions"]
+
+
+def test_claude_honours_the_legacy_skip_permissions_name(configured) -> None:
+    # 0.4 configs in the wild say skip_permissions; they must keep working.
+    configured({"agents": {"claude": {"skip_permissions": True}}})
+
+    assert permission_args() == ["--dangerously-skip-permissions"]
+
+
+def test_claude_skip_permissions_false_no_longer_means_do_nothing(configured) -> None:
+    # In 0.4 this produced a run that wrote nothing. It now falls through to
+    # the default mode, which can actually finish the work.
+    configured({"agents": {"claude": {"skip_permissions": False}}})
+
+    assert permission_args() == ["--permission-mode", "acceptEdits"]
+
+
+def test_claude_tool_lists_are_comma_joined(configured) -> None:
+    # Comma-joined on purpose: claude's --allowedTools is variadic and would
+    # otherwise swallow the positional prompt that follows it.
+    configured(
+        {
+            "agents": {
+                "claude": {
+                    "allowed_tools": ["Read", "Edit", "Bash(pytest:*)"],
+                    "disallowed_tools": ["WebFetch"],
+                }
+            }
+        }
+    )
+
+    args = permission_args()
+
+    assert args[args.index("--allowedTools") + 1] == "Read,Edit,Bash(pytest:*)"
+    assert args[args.index("--disallowedTools") + 1] == "WebFetch"
+
+
+def test_claude_tool_list_accepts_a_plain_string(configured) -> None:
+    configured({"agents": {"claude": {"allowed_tools": "Read, Edit"}}})
+
+    args = permission_args()
+
+    assert args[args.index("--allowedTools") + 1] == "Read,Edit"
+
+
+def test_codex_passes_no_sandbox_flag_by_default(configured) -> None:
+    configured({})
+
+    assert sandbox_args() == []
+
+
+def test_codex_sandbox_policy_is_forwarded(configured) -> None:
+    configured({"agents": {"codex": {"sandbox": "read-only"}}})
+
+    assert sandbox_args() == ["-s", "read-only"]
+
+
+def test_agy_yolo_defaults_on_because_it_has_no_middle_tier(configured) -> None:
+    configured({})
+
+    assert config.yolo_enabled("agy", default=True) is True
+    assert config.yolo_enabled("claude") is False
+
+
+def test_agy_yolo_can_be_turned_off(configured) -> None:
+    configured({"agents": {"agy": {"yolo": False}}})
+
+    assert config.yolo_enabled("agy", default=True) is False
+
+
+def test_shipped_config_template_is_valid_toml_and_matches_the_defaults() -> None:
+    # `playmaker init` writes this verbatim, so a typo here reaches every new
+    # user, and a drift from the handler defaults is a documentation lie.
+    import tomllib
+
+    from playmaker.agents.claude import DEFAULT_PERMISSION_MODE
+    from playmaker.cli import _DEFAULT_CONFIG
+
+    cfg = tomllib.loads(_DEFAULT_CONFIG)
+
+    assert cfg["agents"]["claude"]["permission_mode"] == DEFAULT_PERMISSION_MODE
+    assert cfg["agents"]["agy"]["yolo"] is True
+    assert "yolo" not in cfg["agents"]["claude"]  # the escape hatch stays commented out
+    assert "sandbox" not in cfg["agents"]["codex"]
+    assert cfg["notifications"]["editor"]

playmaker_cli-0.5.0/tests/test_state.py

@@ -0,0 +1,157 @@
+from __future__ import annotations
+
+import sqlite3
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+import playmaker.state as state
+
+
+@pytest.fixture
+def db(monkeypatch, tmp_path: Path):
+    """Point the module-level paths at a throwaway home and initialise it."""
+    home = tmp_path / ".playmaker"
+    monkeypatch.setattr(state, "PLAYMAKER_HOME", home)
+    monkeypatch.setattr(state, "DB_PATH", home / "state.db")
+    monkeypatch.setattr(state, "LOGS_DIR", home / "logs")
+    monkeypatch.setattr(state, "OUTPUTS_DIR", home / "outputs")
+    monkeypatch.setattr(state, "AGENTS_DIR", home / "agents")
+    state.init_db()
+    return home
+
+
+def test_init_db_creates_the_directory_layout(db: Path) -> None:
+    assert (db / "state.db").is_file()
+    assert (db / "logs").is_dir()
+    assert (db / "outputs").is_dir()
+    assert (db / "agents").is_dir()
+
+
+def test_init_db_is_idempotent(db: Path) -> None:
+    sid = state.insert_session(agent="codex", prompt="p", cwd="/tmp")
+
+    state.init_db()
+
+    assert state.get_session(sid) is not None
+
+
+def test_insert_and_get_round_trip(db: Path) -> None:
+    sid = state.insert_session(
+        agent="agy",
+        prompt="do the thing",
+        cwd="/repo",
+        files=["a.py", "b.py"],
+        model="Claude Opus 4.6 (Thinking)",
+        batch_id="dash",
+    )
+
+    row = state.get_session(sid)
+
+    assert row is not None
+    assert row["agent"] == "agy"
+    assert row["status"] == "pending"
+    assert row["model"] == "Claude Opus 4.6 (Thinking)"
+    assert row["batch_id"] == "dash"
+    assert row["files"] == '["a.py", "b.py"]'
+
+
+def test_get_session_accepts_the_short_id_the_cli_prints(db: Path) -> None:
+    # `playmaker list` shows only the first 8 characters, so lookup by prefix
+    # is the normal way a user refers to a session.
+    sid = state.insert_session(agent="codex", prompt="p", cwd="/repo")
+
+    row = state.get_session(sid[:8])
+
+    assert row is not None
+    assert row["id"] == sid
+
+
+def test_get_session_unknown_id_returns_none(db: Path) -> None:
+    assert state.get_session("nope-not-here") is None
+
+
+def test_update_session_writes_only_named_fields(db: Path) -> None:
+    sid = state.insert_session(agent="claude", prompt="p", cwd="/repo")
+
+    state.update_session(sid, status="done", exit_code=0, cost_usd=0.42)
+
+    row = state.get_session(sid)
+    assert row is not None
+    assert (row["status"], row["exit_code"], row["cost_usd"]) == ("done", 0, 0.42)
+    assert row["prompt"] == "p"
+
+
+def test_update_session_with_no_fields_is_a_noop(db: Path) -> None:
+    sid = state.insert_session(agent="claude", prompt="p", cwd="/repo")
+
+    state.update_session(sid)
+
+    assert state.get_session(sid)["status"] == "pending"
+
+
+def test_list_sessions_filters_and_orders_newest_first(db: Path) -> None:
+    old = state.insert_session(agent="codex", prompt="old", cwd="/repo")
+    new = state.insert_session(agent="codex", prompt="new", cwd="/repo")
+    other = state.insert_session(agent="agy", prompt="other", cwd="/repo")
+    state.update_session(old, status="done", started_at="2020-01-01T00:00:00")
+    state.update_session(new, status="running", started_at="2030-01-01T00:00:00")
+
+    assert [r["id"] for r in state.list_sessions(agent="codex")] == [new, old]
+    assert [r["id"] for r in state.list_sessions(status="done")] == [old]
+    assert {r["id"] for r in state.list_sessions()} == {old, new, other}
+    assert len(state.list_sessions(limit=1)) == 1
+
+
+def test_list_batch_returns_only_that_batch_oldest_first(db: Path) -> None:
+    first = state.insert_session(agent="codex", prompt="a", cwd="/r", batch_id="dash")
+    second = state.insert_session(agent="agy", prompt="b", cwd="/r", batch_id="dash")
+    state.insert_session(agent="claude", prompt="c", cwd="/r", batch_id="other")
+    state.update_session(first, started_at="2020-01-01T00:00:00")
+    state.update_session(second, started_at="2030-01-01T00:00:00")
+
+    assert [r["id"] for r in state.list_batch("dash")] == [first, second]
+    assert state.list_batch("nothing") == []
+
+
+def test_init_db_migrates_a_database_without_model_and_batch_columns(
+    monkeypatch, tmp_path: Path
+) -> None:
+    # Databases created before 0.3/0.4 lack these columns; init_db must add
+    # them in place rather than leaving every query broken.
+    home = tmp_path / ".playmaker"
+    home.mkdir()
+    monkeypatch.setattr(state, "PLAYMAKER_HOME", home)
+    monkeypatch.setattr(state, "DB_PATH", home / "state.db")
+    monkeypatch.setattr(state, "LOGS_DIR", home / "logs")
+    monkeypatch.setattr(state, "OUTPUTS_DIR", home / "outputs")
+    monkeypatch.setattr(state, "AGENTS_DIR", home / "agents")
+    legacy = sqlite3.connect(home / "state.db")
+    legacy.execute(
+        """
+        CREATE TABLE sessions (
+            id TEXT PRIMARY KEY, agent TEXT NOT NULL, agent_session_id TEXT,
+            prompt TEXT NOT NULL, cwd TEXT NOT NULL, files TEXT,
+            status TEXT NOT NULL, started_at TEXT NOT NULL, finished_at TEXT,
+            exit_code INTEGER, cost_usd REAL, duration_seconds REAL,
+            output_path TEXT, session_file_path TEXT, parent_id TEXT, pid INTEGER
+        )
+        """
+    )
+    legacy.execute(
+        "INSERT INTO sessions (id, agent, prompt, cwd, status, started_at) "
+        "VALUES ('old-1', 'codex', 'p', '/repo', 'done', '2020-01-01T00:00:00')"
+    )
+    legacy.commit()
+    legacy.close()
+
+    state.init_db()
+
+    row = state.get_session("old-1")
+    assert row is not None
+    assert row["model"] is None
+    assert row["batch_id"] is None
+    assert state.insert_session(agent="agy", prompt="p", cwd="/r", batch_id="b")