python-agent-harness 1.5.5.3__tar.gz → 1.5.5.5__tar.gz

{python_agent_harness-1.5.5.3/python_agent_harness.egg-info → python_agent_harness-1.5.5.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-agent-harness
-Version: 1.5.5.3
+Version: 1.5.5.5
 Summary: A lightweight, hackable mini-OpenCode written in Python.
 Author-email: Huming Chen <chenhuming@gmail.com>
 License-Expression: MIT
@@ -243,13 +243,32 @@ Custom commands from `prompts/commands/*.md` are registered as slash commands as
 
 Agent prompt files are markdown files (`.md`) placed in the `prompts/agents/` directory. Each file becomes a switchable agent profile available via the `/agent` TUI command. 
 
+An agent file may carry YAML frontmatter with two optional keys:
+
+- `name:` — override the agent name (defaults to the file stem)
+- `exclude_tools:` — a list of tool names the agent must not see. An entry matches a tool by exact name, glob pattern (`mcp__git__*`), or `__`-delimited prefix (`mcp__git` hides `mcp__git__list_repos` but `Write` does NOT hide `TodoWrite`). The built-in `default` agent always sees all tools.
+
+```markdown
+---
+name: assistant
+exclude_tools:
+  - Bash
+  - Edit
+  - Write
+  - mcp__git__*
+---
+
+# Role and Behavior
+You are a personal assistant. You do NOT modify files or run shell commands.
+```
+
 #### Commands vs Agents
 
 | | Commands (`/review`) | Agents (`/agent reviewer`) |
 |---|---|---|
 | **Scope** | One-shot (prompt resets after run) | Persistent (stays until next `/agent`) |
 | **Kickoff** | Hardcoded kickoff message | User types their own prompt |
-| **Tools** | Can restrict (`allow_planexit=False`) | All tools |
+| **Tools** | Can restrict (`allow_planexit=False`) | All tools, minus the agent's `exclude_tools` |
 | **Ctrl-C** | Restores to default prompt | Stays on the custom agent |
 
 ## Project layout

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/README.md

@@ -209,13 +209,32 @@ Custom commands from `prompts/commands/*.md` are registered as slash commands as
 
 Agent prompt files are markdown files (`.md`) placed in the `prompts/agents/` directory. Each file becomes a switchable agent profile available via the `/agent` TUI command. 
 
+An agent file may carry YAML frontmatter with two optional keys:
+
+- `name:` — override the agent name (defaults to the file stem)
+- `exclude_tools:` — a list of tool names the agent must not see. An entry matches a tool by exact name, glob pattern (`mcp__git__*`), or `__`-delimited prefix (`mcp__git` hides `mcp__git__list_repos` but `Write` does NOT hide `TodoWrite`). The built-in `default` agent always sees all tools.
+
+```markdown
+---
+name: assistant
+exclude_tools:
+  - Bash
+  - Edit
+  - Write
+  - mcp__git__*
+---
+
+# Role and Behavior
+You are a personal assistant. You do NOT modify files or run shell commands.
+```
+
 #### Commands vs Agents
 
 | | Commands (`/review`) | Agents (`/agent reviewer`) |
 |---|---|---|
 | **Scope** | One-shot (prompt resets after run) | Persistent (stays until next `/agent`) |
 | **Kickoff** | Hardcoded kickoff message | User types their own prompt |
-| **Tools** | Can restrict (`allow_planexit=False`) | All tools |
+| **Tools** | Can restrict (`allow_planexit=False`) | All tools, minus the agent's `exclude_tools` |
 | **Ctrl-C** | Restores to default prompt | Stays on the custom agent |
 
 ## Project layout

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-agent-harness"
-version = "1.5.5.3"
+version = "1.5.5.5"
 description = "A lightweight, hackable mini-OpenCode written in Python."
 authors = [
     {name = "Huming Chen", email = "chenhuming@gmail.com"}

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/python_agent_harness/__init__.py

@@ -5,7 +5,7 @@ from .mcp.manager import MCPManager
 from .models import AgentMode, Message, ToolCall, ToolSpec
 from .session import Session
 
-__version__ = "1.5.5.3"
+__version__ = "1.5.5.5"
 
 __all__ = [
     "Session",

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/python_agent_harness/cli.py

@@ -125,7 +125,11 @@ def make_session(
     )
     if default_agent and default_agent != RESERVED_AGENT_NAME:
         ok, msg = session.switch_agent(default_agent)
-        if not ok:
+        if ok:
+            # record the applied agent so saved sessions restore it;
+            # switch_agent("default") clears it again
+            session.store.agent = default_agent
+        else:
             # A typo'd/missing default_agent must not silently start the
             # session with the built-in prompt — record the config error
             # so the TUI can surface it (see Tui.run).

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/python_agent_harness/persistence.py

@@ -112,9 +112,11 @@ class SessionPersistence:
         max_tokens: int | None = None,
         tool_names: list[str] | None = None,
         round_times: list[float] | None = None,
+        agent: str | None = None,
     ) -> None:
         self.project_dir = project_dir
         self.model = model
+        self.agent = agent
         self.system_prompt = system_prompt
         self.temperature = temperature
         self.max_tokens = max_tokens
@@ -171,6 +173,7 @@ class SessionPersistence:
         pairs = [
             ("python-agent-harness--project-dir", self.project_dir),
             ("python-agent-harness--model", self.model),
+            ("python-agent-harness--agent", self.agent),
         ]
         for name, value in pairs:
             if value is None:

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/python_agent_harness/prompts/agents/reviewer.md

@@ -1,3 +1,13 @@
+---
+name: reviewer
+exclude_tools:
+  - Bash
+  - Edit
+  - Insert
+  - Write
+  - Mkdir
+---
+
 # Role and Behavior
 You are a code reviewer agent. Your job is to review code changes
 thoroughly and provide constructive feedback.

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/python_agent_harness/prompts.py

@@ -35,7 +35,7 @@ def read_prompt_file(name: str) -> str:
     return path.read_text(encoding="utf-8")
 
 
-_FRONTMATTER_RE = re.compile(r"\A---\n.*?\n---\n?", re.DOTALL)
+_FRONTMATTER_RE = re.compile(r"\A---\r?\n.*?\r?\n---\r?\n?", re.DOTALL)
 _SKILLS_PLACEHOLDER_RE = re.compile(r"\{\{\s*SKILLS\s*\}\}")
 _SKILLS_FALLBACK = (
     "Invoke with a skill name and optional args; the tool reports an "
@@ -509,30 +509,78 @@ def compacted_messages(summary: str, prompts: list[str]) -> list[Message]:
 # ``prompts/agents/``.  Each file becomes a switchable agent profile
 # available via the ``/agent`` TUI command.  The file's stem (e.g.
 # ``reviewer.md`` → ``reviewer``) is the agent name; an optional YAML
-# frontmatter ``name:`` can override it.  The built-in ``default``
-# agent (``prompts/agent.md``) is always available and cannot be
-# overridden by a file in this directory.
+# frontmatter ``name:`` can override it, and an optional
+# ``exclude_tools:`` list restricts which tools the agent sees (an
+# entry matches by exact name, glob pattern, or ``__``-delimited
+# prefix, e.g. ``mcp__git`` or ``mcp__git__*``).  The built-in
+# ``default`` agent (``prompts/agent.md``) is always available and
+# cannot be overridden by a file in this directory.
 
 
-def _agent_name_from_file(path: Path) -> str:
-    """Derive agent name from a file: frontmatter ``name:`` if present,
-    otherwise the file stem (lowercased, non-alphanumerics → ``-``)."""
+def _agent_frontmatter(path: Path) -> dict[str, Any]:
+    """Parse the YAML frontmatter of an agent prompt file.
+
+    Supports ``name:`` (string) and ``exclude_tools:`` (a YAML list —
+    either block form with ``- item`` lines or inline ``[a, b]``).
+    Unknown keys are ignored; a missing or unreadable frontmatter
+    yields an empty dict.
+    """
     try:
         text = path.read_text(encoding="utf-8", errors="replace")
     except OSError:
-        return ""
+        return {}
     m = _FRONTMATTER_RE.match(text)
-    if m:
-        for line in m.group(0).splitlines():
-            if line.startswith("name:"):
-                name = line[len("name:") :].strip()
-                if name:
-                    return name
+    if not m:
+        return {}
+    data: dict[str, Any] = {}
+    lines = m.group(0).splitlines()
+    i = 0
+    while i < len(lines):
+        line = lines[i]
+        if line.startswith("name:"):
+            data["name"] = line[len("name:") :].strip()
+        elif line.startswith("exclude_tools:"):
+            rest = line[len("exclude_tools:") :].strip()
+            tools: list[str] = []
+            if rest.startswith("[") and rest.endswith("]"):
+                tools = [
+                    item.strip().strip("'\"") for item in rest[1:-1].split(",") if item.strip()
+                ]
+            else:
+                j = i + 1
+                while j < len(lines) and lines[j].lstrip().startswith("- "):
+                    tools.append(lines[j].lstrip()[2:].strip().strip("'\""))
+                    j += 1
+                i = j - 1
+            data["exclude_tools"] = tools
+        i += 1
+    return data
+
+
+def _agent_name_from_file(path: Path) -> str:
+    """Derive agent name from a file: frontmatter ``name:`` if present,
+    otherwise the file stem (lowercased, non-alphanumerics → ``-``)."""
+    name = _agent_frontmatter(path).get("name", "")
+    if name:
+        return name
     base = path.stem.lower()
     base = re.sub(r"[^a-z0-9]+", "-", base)
     return base.strip("-")
 
 
+def agent_exclude_tools(path: Path | str) -> tuple[str, ...]:
+    """Tool name substrings/patterns the agent profile excludes.
+
+    Reads the ``exclude_tools:`` frontmatter list of an agent prompt
+    file.  An entry matches a tool by exact name, glob pattern
+    (``mcp__git__*``), or ``__``-delimited prefix (``mcp__git`` hides
+    ``mcp__git__list_repos``); matching happens in
+    ``Session.tool_specs``.  Returns an empty tuple when the key is
+    absent.
+    """
+    return tuple(_agent_frontmatter(Path(path)).get("exclude_tools", ()))
+
+
 def discover_agents() -> dict[str, str]:
     """Discover all custom agents in the ``prompts/agents/`` directory.
 

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/python_agent_harness/session.py

@@ -9,6 +9,7 @@ provide interactive confirmations.
 from __future__ import annotations
 
 import contextlib
+import fnmatch
 import os
 import threading
 import time
@@ -31,6 +32,21 @@ from .tools.filesystem import cleanup_spooled_files
 from .tools.mcp import mcp_tools_from_manager
 
 
+def _tool_excluded(pattern: str, name: str) -> bool:
+    """True when *pattern* excludes tool *name*.
+
+    A pattern matches when it is the exact tool name, a glob pattern
+    (``mcp__git__*``), or a prefix delimited by ``__`` (``mcp__git``
+    hides ``mcp__git__list_repos`` but ``Write`` does NOT hide
+    ``TodoWrite``).
+    """
+    if "*" in pattern:
+        return fnmatch.fnmatchcase(name, pattern)
+    if pattern == name:
+        return True
+    return name.startswith(pattern + "__")
+
+
 def find_skill_dir(project_dir: str, configured: str | None = None) -> str | None:
     """Locate the skill directory.
 
@@ -162,6 +178,12 @@ class Session:
         # cache build simultaneously — double-checked locking prevents
         # redundant filesystem scans and the data race on the cache tuple
         self._skill_index_lock = threading.Lock()
+        # NOTE: the store does NOT record ``default_agent`` here: the
+        # store's agent must reflect the agent actually applied, and
+        # only a successful switch_agent() can guarantee that (a typo'd
+        # default_agent is reported as a startup warning and the session
+        # keeps the built-in prompt).  cli.make_session applies the
+        # default_agent right after construction, which sets it.
         self.store = SessionPersistence(
             project_dir=project_dir,
             model=model,
@@ -195,6 +217,11 @@ class Session:
         # Original system prompt assembled at session start — used by
         # /agent default to restore the original agent.md prompt.
         self._default_system_prompt = system_prompt
+        # Tool exclusions from the active agent profile's
+        # ``exclude_tools`` frontmatter (substrings or glob patterns).
+        # The built-in default agent excludes nothing; switch_agent
+        # replaces this tuple when a custom agent is activated.
+        self._agent_excluded_tools: tuple[str, ...] = ()
         # Monotonic cancel identity: cancel() bumps this counter, so a
         # worker from a cancelled run can tell it was cancelled even
         # after the next run clears the shared event.
@@ -245,9 +272,26 @@ class Session:
     # tools
     # ------------------------------------------------------------------
     def tool_specs(self, exclude: tuple[str, ...] = ()) -> list:
-        """Tool specs exposed to the model; ``exclude`` drops tools by
-        name (e.g. one-shot/interactive tools for sub-agent runs)."""
-        return [spec for spec in self.registry.specs() if spec.name not in exclude]
+        """Tool specs exposed to the model.
+
+        ``exclude`` drops tools by name (e.g. one-shot/interactive tools
+        for sub-agent runs).  The active agent profile's own
+        ``exclude_tools`` frontmatter is applied on top: an entry
+        matches a tool by exact name, glob pattern (``mcp__git__*``),
+        or ``__``-delimited prefix (``mcp__git`` hides
+        ``mcp__git__list_repos`` but ``Write`` does NOT hide
+        ``TodoWrite``).
+        """
+        excluded = set(exclude)
+        specs = self.registry.specs()
+        patterns = self._agent_excluded_tools
+        if not patterns:
+            return [spec for spec in specs if spec.name not in excluded]
+        return [
+            spec
+            for spec in specs
+            if spec.name not in excluded and not any(_tool_excluded(p, spec.name) for p in patterns)
+        ]
 
     def execute_tool(
         self, name: str, args: dict[str, Any], call_id: str | None = None
@@ -731,6 +775,8 @@ class Session:
         if name == RESERVED_AGENT_NAME:
             self.system_prompt = self._default_system_prompt
             self.store.system_prompt = self._default_system_prompt
+            self.store.agent = None
+            self._agent_excluded_tools = ()
             return True, "switched to default agent"
 
         agents = discover_agents()
@@ -738,17 +784,20 @@ class Session:
         if prompt_file is None:
             available = ", ".join(sorted([RESERVED_AGENT_NAME, *agents.keys()]))
             return False, f"unknown agent: {name} (available: {available})"
-        from .prompts import assemble_agent_prompt, load_agent_prompt
+        from .prompts import agent_exclude_tools, assemble_agent_prompt, load_agent_prompt
 
         agent_prompt = load_agent_prompt(prompt_file, skill_dir=self._skill_dir)
         if agent_prompt is None:
             return False, f"agent {name}: prompt file not found or empty: {prompt_file}"
+        new_exclusions = agent_exclude_tools(prompt_file)
         self.system_prompt = assemble_agent_prompt(
             self.project_dir,
             agent_prompt,
             context_path=self._configured_context_path,
         )
         self.store.system_prompt = self.system_prompt
+        self.store.agent = name
+        self._agent_excluded_tools = new_exclusions
         return True, f"switched to {name}"
 
     # ------------------------------------------------------------------

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/python_agent_harness/tools/diffapply.py

@@ -48,7 +48,7 @@ class _Hunk:
         """(kind, content-without-newline) for the lines that must exist
         in the old file (' ' context and '-' removed lines)."""
         return [
-            (kind, content.rstrip("\n")) for kind, content, _ in self.body if kind in (" ", "-")
+            (kind, content.rstrip("\r\n")) for kind, content, _ in self.body if kind in (" ", "-")
         ]
 
 
@@ -142,7 +142,7 @@ def _match_hunk(hunk: _Hunk, file_lines: list[str]) -> int | None:
         mismatches = 0
         ok = True
         for i, (kind, content) in enumerate(old_seq):
-            file_content = file_lines[p + i].rstrip("\n")
+            file_content = file_lines[p + i].rstrip("\r\n")
             if kind == "-":
                 if file_content != content:
                     ok = False

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/python_agent_harness/tools/grep_win.py

@@ -98,12 +98,17 @@ class GrepWindows(Grep):
             files = [Path(path)]
         else:
             root = Path(path)
-            files = (
-                p
-                for p in root.rglob("*")
-                if p.is_file()
-                and not any(part.startswith(".") for part in p.relative_to(root).parts[:-1])
-            )
+            collected: list[Path] = []
+            try:
+                for p in root.rglob("*"):
+                    if not p.is_file():
+                        continue
+                    if any(part.startswith(".") for part in p.relative_to(root).parts[:-1]):
+                        continue
+                    collected.append(p)
+            except OSError:
+                pass
+            files = collected
 
         for file_path in files:
             if match_count >= max_matches:
@@ -124,7 +129,7 @@ class GrepWindows(Grep):
                         start = max(0, i - 1 - context)
                         end = min(len(lines), i + context)
                         for j in range(start, end):
-                            marker = ":" if j + 1 != i else ":"
+                            marker = "-" if j + 1 != i else ":"
                             results.append(f"{file_path}:{j + 1}{marker}{lines[j].rstrip()}")
                         results.append("")  # blank line between matches with context
                     else:

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/python_agent_harness/tui/commands.py

@@ -119,7 +119,7 @@ class CommandMixin:
                 "/review [project] [commit|branch|PR] review code changes\n"
                 "/explain [project] [target]          explain code\n"
                 "/sessions                            list saved sessions\n"
-                "/restore [path | title | --latest | latest]   restore a saved session\n"
+                "/restore [path | title | --latest | latest]   restore a saved session (conversation + agent + model)\n"
                 "/model [name]                        switch LLM model profile\n"
                 "/agent [name]                        switch agent system prompt\n"
                 "Ctrl-C cancels the current execution (app stays open); "
@@ -642,6 +642,62 @@ class CommandMixin:
         title = title_from_filename(path)
         if title:
             self.session.store.title = title
+        # Restore agent if saved
+        agent = meta.get("python-agent-harness--agent")
+        if agent:
+            try:
+                success, msg = self.session.switch_agent(agent)
+                if success:
+                    self.console.print(f"[green]{msg}[/green]")
+                else:
+                    # Agent no longer exists: reset to default to avoid
+                    # stale exclusions from the previously active agent
+                    self.session.switch_agent("default")
+                    self.console.print(f"[yellow]warning: {msg}[/yellow]")
+            except Exception as e:
+                self.console.print(f"[yellow]warning: could not restore agent: {e}[/yellow]")
+        # Restore model if saved: /model's profile switching is the
+        # canonical path — it also fixes base_url/api_key/temperature
+        # and other settings that a bare model-name change would leave
+        # pointing at the wrong endpoint.  The metadata stores the raw
+        # model name, so first try it as a profile name, then fall back
+        # to a profile whose model matches; without a matching profile
+        # the current model stays active (profile names are not saved).
+        model = meta.get("python-agent-harness--model")
+        if model:
+            try:
+                if model == self.session.model:
+                    # Already the active model: nothing to do, no noise.
+                    pass
+                elif model == self.session.llm_settings.get("model"):
+                    # The saved model is the session-start default: the
+                    # "default" pseudo-profile restores exactly those
+                    # original llm settings (profile names were not saved,
+                    # so there is no better match).
+                    success, msg = self.session.switch_model("default")
+                    self.console.print(f"[green]{msg}[/green]")
+                else:
+                    success, msg = self.session.switch_model(model)
+                    if not success:
+                        profile = next(
+                            (
+                                name
+                                for name, p in self.session.model_profiles.items()
+                                if p.get("model") == model
+                            ),
+                            None,
+                        )
+                        if profile:
+                            success, msg = self.session.switch_model(profile)
+                    if success:
+                        self.console.print(f"[green]{msg}[/green]")
+                    else:
+                        self.console.print(
+                            f"[yellow]warning: model {model!r} has no matching profile, "
+                            f"keeping current model[/yellow]"
+                        )
+            except Exception as e:
+                self.console.print(f"[yellow]warning: could not restore model: {e}[/yellow]")
         # Replace conversation history: a new generation.  Invalidate any
         # worker still winding down from a cancelled run so its salvaged
         # history can't clobber the restored session.
@@ -650,11 +706,11 @@ class CommandMixin:
         self.session.last_messages = list(messages)
         self.session.clear_todos()
         self._history_dirty = True
-        model = meta.get("python-agent-harness--model", "?")
         project = meta.get("python-agent-harness--project-dir", "?")
+        agent_display = meta.get("python-agent-harness--agent", "default")
         self.console.print(
             f"[green]restored:[/green] {os.path.basename(path)} "
-            f"(model={model}, project={project}, {len(messages)} messages)"
+            f"(model={model}, agent={agent_display}, project={project}, {len(messages)} messages)"
         )
 
     @staticmethod
@@ -664,13 +720,15 @@ class CommandMixin:
         The save format is markdown with **role**: content blocks
         separated by blank lines.
 
-        ``tool`` blocks are dropped: the saved markdown does not keep
-        ``tool_call_id``/``name`` (assistant tool calls are flattened to
-        plain text), so a restored ``role="tool"`` message would form an
-        API-invalid payload (a tool message with no preceding assistant
-        ``tool_calls``).  The following assistant reply already
-        summarizes the results, so dropping them loses no essential
-        context.
+        ``tool`` and ``system`` blocks are dropped: the saved markdown
+        does not keep ``tool_call_id``/``name`` (assistant tool calls are
+        flattened to plain text), so a restored ``role="tool"`` message
+        would form an API-invalid payload (a tool message with no
+        preceding assistant ``tool_calls``).  A restored ``system``
+        message would duplicate the live system prompt the client
+        prepends on every request.  The following assistant reply
+        already summarizes the results, so dropping them loses no
+        essential context.
 
         Body lines that merely look like a block header are escaped by
         the renderer (see `escape_role_headers`) and unescaped here, so
@@ -687,9 +745,10 @@ class CommandMixin:
             header = split_role_header(line)
             if header is not None:
                 role, rest = header
-                # Save the previous block (tool blocks are dropped:
-                # their tool_call_id/name were not persisted)
-                if current_role is not None and current_role != "tool":
+                # Save the previous block (tool blocks lose their
+                # tool_call_id/name; system blocks would duplicate the
+                # live system prompt the client prepends per request)
+                if current_role is not None and current_role not in ("tool", "system"):
                     content = "\n".join(current_lines).strip()
                     if content:
                         messages.append(Message(role=current_role, content=content))
@@ -698,8 +757,8 @@ class CommandMixin:
                 continue
             current_lines.append(unescape_role_header(line))
 
-        # Don't forget the last block (tool blocks are dropped)
-        if current_role is not None and current_role != "tool":
+        # Don't forget the last block (tool/system blocks dropped, see above)
+        if current_role is not None and current_role not in ("tool", "system"):
             content = "\n".join(current_lines).strip()
             if content:
                 messages.append(Message(role=current_role, content=content))

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5/python_agent_harness.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-agent-harness
-Version: 1.5.5.3
+Version: 1.5.5.5
 Summary: A lightweight, hackable mini-OpenCode written in Python.
 Author-email: Huming Chen <chenhuming@gmail.com>
 License-Expression: MIT
@@ -243,13 +243,32 @@ Custom commands from `prompts/commands/*.md` are registered as slash commands as
 
 Agent prompt files are markdown files (`.md`) placed in the `prompts/agents/` directory. Each file becomes a switchable agent profile available via the `/agent` TUI command. 
 
+An agent file may carry YAML frontmatter with two optional keys:
+
+- `name:` — override the agent name (defaults to the file stem)
+- `exclude_tools:` — a list of tool names the agent must not see. An entry matches a tool by exact name, glob pattern (`mcp__git__*`), or `__`-delimited prefix (`mcp__git` hides `mcp__git__list_repos` but `Write` does NOT hide `TodoWrite`). The built-in `default` agent always sees all tools.
+
+```markdown
+---
+name: assistant
+exclude_tools:
+  - Bash
+  - Edit
+  - Write
+  - mcp__git__*
+---
+
+# Role and Behavior
+You are a personal assistant. You do NOT modify files or run shell commands.
+```
+
 #### Commands vs Agents
 
 | | Commands (`/review`) | Agents (`/agent reviewer`) |
 |---|---|---|
 | **Scope** | One-shot (prompt resets after run) | Persistent (stays until next `/agent`) |
 | **Kickoff** | Hardcoded kickoff message | User types their own prompt |
-| **Tools** | Can restrict (`allow_planexit=False`) | All tools |
+| **Tools** | Can restrict (`allow_planexit=False`) | All tools, minus the agent's `exclude_tools` |
 | **Ctrl-C** | Restores to default prompt | Stays on the custom agent |
 
 ## Project layout

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/tests/test_custom_agents.py

@@ -163,6 +163,25 @@ class TestSwitchAgent(unittest.TestCase):
         session.switch_agent("default")
         self.assertEqual(session.store.system_prompt, "original prompt")
 
+    def test_switch_updates_store_agent(self):
+        """switch_agent must keep store.agent in sync so every auto-save
+        records the currently active agent in the metadata block."""
+        session = _make_session(system_prompt="original prompt")
+        self.assertIsNone(session.store.agent)  # no custom agent yet
+        session.switch_agent("reviewer")
+        self.assertEqual(session.store.agent, "reviewer")
+        session.switch_agent("default")
+        self.assertIsNone(session.store.agent)  # default = no custom agent
+
+    def test_failed_switch_leaves_store_agent_untouched(self):
+        """A failed switch (unknown name) must not change store.agent:
+        the metadata must never record an agent that is not active."""
+        session = _make_session(system_prompt="original prompt")
+        session.switch_agent("reviewer")
+        ok, _ = session.switch_agent("nonexistent")
+        self.assertFalse(ok)
+        self.assertEqual(session.store.agent, "reviewer")
+
 
 class TestDefaultAgentConfig(unittest.TestCase):
     """config.load_default_agent: reading the default_agent setting."""
@@ -286,6 +305,30 @@ class TestMakeSessionWithDefaultAgent(unittest.TestCase):
             p.write_text(json.dumps({"default_agent": "reviewer"}), encoding="utf-8")
             session = make_session("/tmp", config_path=str(p))
             self.assertEqual(session.startup_warnings, [])
+            session.close()
+
+    def test_valid_default_agent_recorded_in_store(self):
+        """A successfully applied default_agent is recorded in store.agent,
+        so saved sessions restore it.  A typo'd one must NOT be recorded:
+        the metadata must never name an agent that is not active."""
+        from python_agent_harness.cli import make_session
+
+        with tempfile.TemporaryDirectory() as d:
+            p = Path(d) / "config.json"
+            p.write_text(json.dumps({"default_agent": "reviewer"}), encoding="utf-8")
+            session = make_session("/tmp", config_path=str(p))
+            try:
+                self.assertEqual(session.store.agent, "reviewer")
+            finally:
+                session.close()
+        with tempfile.TemporaryDirectory() as d:
+            p = Path(d) / "config.json"
+            p.write_text(json.dumps({"default_agent": "no-such-agent"}), encoding="utf-8")
+            session = make_session("/tmp", config_path=str(p))
+            try:
+                self.assertIsNone(session.store.agent)
+            finally:
+                session.close()
 
 
 class TestMcpFailuresAsStartupWarnings(unittest.TestCase):
@@ -344,6 +387,229 @@ class TestMcpFailuresAsStartupWarnings(unittest.TestCase):
                     os.environ[k] = v
 
 
+class TestAgentExcludeTools(unittest.TestCase):
+    """Agent profile ``exclude_tools`` frontmatter: parsing and effect
+    on the tool specs exposed to the model."""
+
+    def _write_agent(
+        self, name: str, frontmatter: str, body: str = "You are a test agent."
+    ) -> Path:
+        p = AGENTS_DIR / f"{name}.md"
+        p.write_text(f"---\n{frontmatter}---\n{body}", encoding="utf-8")
+        return p
+
+    def test_parse_exclude_tools(self):
+        """agent_exclude_tools reads the frontmatter list."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = self._write_agent(
+            "test-exclude-parse",
+            "name: test-exclude-parse\nexclude_tools:\n  - Bash\n  - Edit\n  - mcp__git__*\n",
+        )
+        try:
+            self.assertEqual(
+                agent_exclude_tools(p),
+                ("Bash", "Edit", "mcp__git__*"),
+            )
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_parse_exclude_tools_inline(self):
+        """agent_exclude_tools reads an inline ``[a, b]`` list too."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = self._write_agent(
+            "test-exclude-inline",
+            "name: test-exclude-inline\nexclude_tools: [Bash, mcp__git__*]\n",
+        )
+        try:
+            self.assertEqual(
+                agent_exclude_tools(p),
+                ("Bash", "mcp__git__*"),
+            )
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_no_exclude_tools_returns_empty(self):
+        """An agent without the key excludes nothing."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = self._write_agent("test-exclude-none", "name: test-exclude-none\n")
+        try:
+            self.assertEqual(agent_exclude_tools(p), ())
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_switch_agent_applies_exclusions(self):
+        """switch_agent activates the profile's excluded tools."""
+        p = self._write_agent(
+            "test-exclude-switch",
+            "name: test-exclude-switch\nexclude_tools:\n  - Bash\n  - Edit\n",
+        )
+        try:
+            session = _make_session()
+            ok, msg = session.switch_agent("test-exclude-switch")
+            self.assertTrue(ok, msg)
+            names = {s.name for s in session.tool_specs()}
+            self.assertNotIn("Bash", names)
+            self.assertNotIn("Edit", names)
+            self.assertIn("Read", names)
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_switch_to_default_clears_exclusions(self):
+        """/agent default restores the full tool set."""
+        p = self._write_agent(
+            "test-exclude-default",
+            "name: test-exclude-default\nexclude_tools:\n  - Bash\n",
+        )
+        try:
+            session = _make_session()
+            session.switch_agent("test-exclude-default")
+            self.assertNotIn("Bash", {s.name for s in session.tool_specs()})
+            ok, msg = session.switch_agent("default")
+            self.assertTrue(ok, msg)
+            self.assertIn("Bash", {s.name for s in session.tool_specs()})
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_glob_pattern_excludes_mcp_tools(self):
+        """mcp__<server>__* patterns hide every tool of one server."""
+        from python_agent_harness.tools.base import Tool
+
+        class FakeMcpTool(Tool):
+            name = "mcp__git__list_repos"
+            description = "fake"
+
+            def run(self, args, ctx):
+                return ""
+
+        p = self._write_agent(
+            "test-exclude-glob",
+            "name: test-exclude-glob\nexclude_tools:\n  - mcp__git__*\n",
+        )
+        try:
+            session = _make_session()
+            session.registry.register(FakeMcpTool())
+            self.assertIn("mcp__git__list_repos", {s.name for s in session.tool_specs()})
+            session.switch_agent("test-exclude-glob")
+            names = {s.name for s in session.tool_specs()}
+            self.assertNotIn("mcp__git__list_repos", names)
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_substring_pattern_excludes_mcp_tools(self):
+        """A ``__``-delimited prefix (mcp__git) hides every tool of one
+        server, but does NOT accidentally match unrelated tools."""
+        from python_agent_harness.tools.base import Tool
+
+        class FakeMcpTool(Tool):
+            name = "mcp__git__list_repos"
+            description = "fake"
+
+            def run(self, args, ctx):
+                return ""
+
+        p = self._write_agent(
+            "test-exclude-substr",
+            "name: test-exclude-substr\nexclude_tools:\n  - mcp__git\n",
+        )
+        try:
+            session = _make_session()
+            session.registry.register(FakeMcpTool())
+            self.assertIn("mcp__git__list_repos", {s.name for s in session.tool_specs()})
+            session.switch_agent("test-exclude-substr")
+            names = {s.name for s in session.tool_specs()}
+            self.assertNotIn("mcp__git__list_repos", names)
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_write_does_not_exclude_todowrite(self):
+        """``Write`` must not accidentally hide ``TodoWrite``: matching
+        is by exact name or ``__``-delimited prefix, not raw substring."""
+        p = self._write_agent(
+            "test-exclude-no-false-match",
+            "name: test-exclude-no-false-match\nexclude_tools:\n  - Write\n",
+        )
+        try:
+            session = _make_session()
+            session.switch_agent("test-exclude-no-false-match")
+            names = {s.name for s in session.tool_specs()}
+            self.assertNotIn("Write", names)
+            self.assertIn("TodoWrite", names)
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_explicit_exclude_still_works(self):
+        """The caller's exclude argument composes with the profile's."""
+        p = self._write_agent(
+            "test-exclude-compose",
+            "name: test-exclude-compose\nexclude_tools:\n  - Bash\n",
+        )
+        try:
+            session = _make_session()
+            session.switch_agent("test-exclude-compose")
+            names = {s.name for s in session.tool_specs(exclude=("Edit",))}
+            self.assertNotIn("Bash", names)
+            self.assertNotIn("Edit", names)
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_failed_switch_leaves_exclusions_untouched(self):
+        """A failed switch (unknown name) must not change the active
+        exclusions: the caller's tool set must never silently shift."""
+        p = self._write_agent(
+            "test-exclude-fail",
+            "name: test-exclude-fail\nexclude_tools:\n  - Bash\n",
+        )
+        try:
+            session = _make_session()
+            session.switch_agent("test-exclude-fail")
+            self.assertNotIn("Bash", {s.name for s in session.tool_specs()})
+            ok, _ = session.switch_agent("nonexistent")
+            self.assertFalse(ok)
+            self.assertNotIn("Bash", {s.name for s in session.tool_specs()})
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_quoted_items_stripped(self):
+        """Quoted frontmatter items lose their quotes during parsing."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = self._write_agent(
+            "test-exclude-quoted",
+            "name: test-exclude-quoted\nexclude_tools:\n  - \"Bash\"\n  - 'Edit'\n",
+        )
+        try:
+            self.assertEqual(agent_exclude_tools(p), ("Bash", "Edit"))
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_no_frontmatter_at_all(self):
+        """A file with no frontmatter block excludes nothing."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = self._write_agent("test-no-frontmatter", "")
+        p.write_text("You are a simple agent with no frontmatter.", encoding="utf-8")
+        try:
+            self.assertEqual(agent_exclude_tools(p), ())
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_crlf_line_endings(self):
+        """CRLF line endings must not break frontmatter parsing."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = AGENTS_DIR / "test-crlf-agent.md"
+        p.write_bytes(
+            b"---\r\nname: test-crlf-agent\r\nexclude_tools:\r\n  - Bash\r\n  - Edit\r\n---\r\nYou are a CRLF agent.\r\n"
+        )
+        try:
+            self.assertEqual(agent_exclude_tools(p), ("Bash", "Edit"))
+        finally:
+            p.unlink(missing_ok=True)
+
+
 class TestReviewerAgentContent(unittest.TestCase):
     """Verify the bundled reviewer.md agent has expected content."""
 

{python_agent_harness-1.5.5.3 → python_agent_harness-1.5.5.5}/tests/test_persistence.py

@@ -59,6 +59,22 @@ class TestSession(unittest.TestCase):
         store = SessionPersistence(project_dir="/tmp/proj", model="m")
         self.assertNotIn("round-times", store.metadata_block())
 
+    def test_agent_persisted_in_metadata(self):
+        """A session with an active custom agent records it in the
+        metadata block so /restore can reapply it."""
+        store = SessionPersistence(project_dir="/tmp/proj", model="m", agent="reviewer")
+        meta = store.metadata_block()
+        self.assertIn("python-agent-harness--agent", meta)
+        text = "conversation...\n\n" + meta + "\n"
+        parsed = SessionPersistence.parse_metadata(text)
+        self.assertEqual(parsed["python-agent-harness--agent"], "reviewer")
+
+    def test_agent_absent_when_none(self):
+        """No custom agent -> no agent line in the metadata block, so
+        old sessions and default-agent sessions parse identically."""
+        store = SessionPersistence(project_dir="/tmp/proj", model="m", agent=None)
+        self.assertNotIn("python-agent-harness--agent", store.metadata_block())
+
     def test_save_and_restore_flow(self):
         import os
         import tempfile