python-agent-harness 1.5.5.4__tar.gz → 1.5.5.5__tar.gz

{python_agent_harness-1.5.5.4/python_agent_harness.egg-info → python_agent_harness-1.5.5.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-agent-harness
-Version: 1.5.5.4
+Version: 1.5.5.5
 Summary: A lightweight, hackable mini-OpenCode written in Python.
 Author-email: Huming Chen <chenhuming@gmail.com>
 License-Expression: MIT
@@ -243,13 +243,32 @@ Custom commands from `prompts/commands/*.md` are registered as slash commands as
 
 Agent prompt files are markdown files (`.md`) placed in the `prompts/agents/` directory. Each file becomes a switchable agent profile available via the `/agent` TUI command. 
 
+An agent file may carry YAML frontmatter with two optional keys:
+
+- `name:` — override the agent name (defaults to the file stem)
+- `exclude_tools:` — a list of tool names the agent must not see. An entry matches a tool by exact name, glob pattern (`mcp__git__*`), or `__`-delimited prefix (`mcp__git` hides `mcp__git__list_repos` but `Write` does NOT hide `TodoWrite`). The built-in `default` agent always sees all tools.
+
+```markdown
+---
+name: assistant
+exclude_tools:
+  - Bash
+  - Edit
+  - Write
+  - mcp__git__*
+---
+
+# Role and Behavior
+You are a personal assistant. You do NOT modify files or run shell commands.
+```
+
 #### Commands vs Agents
 
 | | Commands (`/review`) | Agents (`/agent reviewer`) |
 |---|---|---|
 | **Scope** | One-shot (prompt resets after run) | Persistent (stays until next `/agent`) |
 | **Kickoff** | Hardcoded kickoff message | User types their own prompt |
-| **Tools** | Can restrict (`allow_planexit=False`) | All tools |
+| **Tools** | Can restrict (`allow_planexit=False`) | All tools, minus the agent's `exclude_tools` |
 | **Ctrl-C** | Restores to default prompt | Stays on the custom agent |
 
 ## Project layout

{python_agent_harness-1.5.5.4 → python_agent_harness-1.5.5.5}/README.md

@@ -209,13 +209,32 @@ Custom commands from `prompts/commands/*.md` are registered as slash commands as
 
 Agent prompt files are markdown files (`.md`) placed in the `prompts/agents/` directory. Each file becomes a switchable agent profile available via the `/agent` TUI command. 
 
+An agent file may carry YAML frontmatter with two optional keys:
+
+- `name:` — override the agent name (defaults to the file stem)
+- `exclude_tools:` — a list of tool names the agent must not see. An entry matches a tool by exact name, glob pattern (`mcp__git__*`), or `__`-delimited prefix (`mcp__git` hides `mcp__git__list_repos` but `Write` does NOT hide `TodoWrite`). The built-in `default` agent always sees all tools.
+
+```markdown
+---
+name: assistant
+exclude_tools:
+  - Bash
+  - Edit
+  - Write
+  - mcp__git__*
+---
+
+# Role and Behavior
+You are a personal assistant. You do NOT modify files or run shell commands.
+```
+
 #### Commands vs Agents
 
 | | Commands (`/review`) | Agents (`/agent reviewer`) |
 |---|---|---|
 | **Scope** | One-shot (prompt resets after run) | Persistent (stays until next `/agent`) |
 | **Kickoff** | Hardcoded kickoff message | User types their own prompt |
-| **Tools** | Can restrict (`allow_planexit=False`) | All tools |
+| **Tools** | Can restrict (`allow_planexit=False`) | All tools, minus the agent's `exclude_tools` |
 | **Ctrl-C** | Restores to default prompt | Stays on the custom agent |
 
 ## Project layout

{python_agent_harness-1.5.5.4 → python_agent_harness-1.5.5.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-agent-harness"
-version = "1.5.5.4"
+version = "1.5.5.5"
 description = "A lightweight, hackable mini-OpenCode written in Python."
 authors = [
     {name = "Huming Chen", email = "chenhuming@gmail.com"}

{python_agent_harness-1.5.5.4 → python_agent_harness-1.5.5.5}/python_agent_harness/__init__.py

@@ -5,7 +5,7 @@ from .mcp.manager import MCPManager
 from .models import AgentMode, Message, ToolCall, ToolSpec
 from .session import Session
 
-__version__ = "1.5.5.4"
+__version__ = "1.5.5.5"
 
 __all__ = [
     "Session",

{python_agent_harness-1.5.5.4 → python_agent_harness-1.5.5.5}/python_agent_harness/prompts/agents/reviewer.md

@@ -1,3 +1,13 @@
+---
+name: reviewer
+exclude_tools:
+  - Bash
+  - Edit
+  - Insert
+  - Write
+  - Mkdir
+---
+
 # Role and Behavior
 You are a code reviewer agent. Your job is to review code changes
 thoroughly and provide constructive feedback.

{python_agent_harness-1.5.5.4 → python_agent_harness-1.5.5.5}/python_agent_harness/prompts.py

@@ -35,7 +35,7 @@ def read_prompt_file(name: str) -> str:
     return path.read_text(encoding="utf-8")
 
 
-_FRONTMATTER_RE = re.compile(r"\A---\n.*?\n---\n?", re.DOTALL)
+_FRONTMATTER_RE = re.compile(r"\A---\r?\n.*?\r?\n---\r?\n?", re.DOTALL)
 _SKILLS_PLACEHOLDER_RE = re.compile(r"\{\{\s*SKILLS\s*\}\}")
 _SKILLS_FALLBACK = (
     "Invoke with a skill name and optional args; the tool reports an "
@@ -509,30 +509,78 @@ def compacted_messages(summary: str, prompts: list[str]) -> list[Message]:
 # ``prompts/agents/``.  Each file becomes a switchable agent profile
 # available via the ``/agent`` TUI command.  The file's stem (e.g.
 # ``reviewer.md`` → ``reviewer``) is the agent name; an optional YAML
-# frontmatter ``name:`` can override it.  The built-in ``default``
-# agent (``prompts/agent.md``) is always available and cannot be
-# overridden by a file in this directory.
+# frontmatter ``name:`` can override it, and an optional
+# ``exclude_tools:`` list restricts which tools the agent sees (an
+# entry matches by exact name, glob pattern, or ``__``-delimited
+# prefix, e.g. ``mcp__git`` or ``mcp__git__*``).  The built-in
+# ``default`` agent (``prompts/agent.md``) is always available and
+# cannot be overridden by a file in this directory.
 
 
-def _agent_name_from_file(path: Path) -> str:
-    """Derive agent name from a file: frontmatter ``name:`` if present,
-    otherwise the file stem (lowercased, non-alphanumerics → ``-``)."""
+def _agent_frontmatter(path: Path) -> dict[str, Any]:
+    """Parse the YAML frontmatter of an agent prompt file.
+
+    Supports ``name:`` (string) and ``exclude_tools:`` (a YAML list —
+    either block form with ``- item`` lines or inline ``[a, b]``).
+    Unknown keys are ignored; a missing or unreadable frontmatter
+    yields an empty dict.
+    """
     try:
         text = path.read_text(encoding="utf-8", errors="replace")
     except OSError:
-        return ""
+        return {}
     m = _FRONTMATTER_RE.match(text)
-    if m:
-        for line in m.group(0).splitlines():
-            if line.startswith("name:"):
-                name = line[len("name:") :].strip()
-                if name:
-                    return name
+    if not m:
+        return {}
+    data: dict[str, Any] = {}
+    lines = m.group(0).splitlines()
+    i = 0
+    while i < len(lines):
+        line = lines[i]
+        if line.startswith("name:"):
+            data["name"] = line[len("name:") :].strip()
+        elif line.startswith("exclude_tools:"):
+            rest = line[len("exclude_tools:") :].strip()
+            tools: list[str] = []
+            if rest.startswith("[") and rest.endswith("]"):
+                tools = [
+                    item.strip().strip("'\"") for item in rest[1:-1].split(",") if item.strip()
+                ]
+            else:
+                j = i + 1
+                while j < len(lines) and lines[j].lstrip().startswith("- "):
+                    tools.append(lines[j].lstrip()[2:].strip().strip("'\""))
+                    j += 1
+                i = j - 1
+            data["exclude_tools"] = tools
+        i += 1
+    return data
+
+
+def _agent_name_from_file(path: Path) -> str:
+    """Derive agent name from a file: frontmatter ``name:`` if present,
+    otherwise the file stem (lowercased, non-alphanumerics → ``-``)."""
+    name = _agent_frontmatter(path).get("name", "")
+    if name:
+        return name
     base = path.stem.lower()
     base = re.sub(r"[^a-z0-9]+", "-", base)
     return base.strip("-")
 
 
+def agent_exclude_tools(path: Path | str) -> tuple[str, ...]:
+    """Tool name substrings/patterns the agent profile excludes.
+
+    Reads the ``exclude_tools:`` frontmatter list of an agent prompt
+    file.  An entry matches a tool by exact name, glob pattern
+    (``mcp__git__*``), or ``__``-delimited prefix (``mcp__git`` hides
+    ``mcp__git__list_repos``); matching happens in
+    ``Session.tool_specs``.  Returns an empty tuple when the key is
+    absent.
+    """
+    return tuple(_agent_frontmatter(Path(path)).get("exclude_tools", ()))
+
+
 def discover_agents() -> dict[str, str]:
     """Discover all custom agents in the ``prompts/agents/`` directory.
 

{python_agent_harness-1.5.5.4 → python_agent_harness-1.5.5.5}/python_agent_harness/session.py

@@ -9,6 +9,7 @@ provide interactive confirmations.
 from __future__ import annotations
 
 import contextlib
+import fnmatch
 import os
 import threading
 import time
@@ -31,6 +32,21 @@ from .tools.filesystem import cleanup_spooled_files
 from .tools.mcp import mcp_tools_from_manager
 
 
+def _tool_excluded(pattern: str, name: str) -> bool:
+    """True when *pattern* excludes tool *name*.
+
+    A pattern matches when it is the exact tool name, a glob pattern
+    (``mcp__git__*``), or a prefix delimited by ``__`` (``mcp__git``
+    hides ``mcp__git__list_repos`` but ``Write`` does NOT hide
+    ``TodoWrite``).
+    """
+    if "*" in pattern:
+        return fnmatch.fnmatchcase(name, pattern)
+    if pattern == name:
+        return True
+    return name.startswith(pattern + "__")
+
+
 def find_skill_dir(project_dir: str, configured: str | None = None) -> str | None:
     """Locate the skill directory.
 
@@ -201,6 +217,11 @@ class Session:
         # Original system prompt assembled at session start — used by
         # /agent default to restore the original agent.md prompt.
         self._default_system_prompt = system_prompt
+        # Tool exclusions from the active agent profile's
+        # ``exclude_tools`` frontmatter (substrings or glob patterns).
+        # The built-in default agent excludes nothing; switch_agent
+        # replaces this tuple when a custom agent is activated.
+        self._agent_excluded_tools: tuple[str, ...] = ()
         # Monotonic cancel identity: cancel() bumps this counter, so a
         # worker from a cancelled run can tell it was cancelled even
         # after the next run clears the shared event.
@@ -251,9 +272,26 @@ class Session:
     # tools
     # ------------------------------------------------------------------
     def tool_specs(self, exclude: tuple[str, ...] = ()) -> list:
-        """Tool specs exposed to the model; ``exclude`` drops tools by
-        name (e.g. one-shot/interactive tools for sub-agent runs)."""
-        return [spec for spec in self.registry.specs() if spec.name not in exclude]
+        """Tool specs exposed to the model.
+
+        ``exclude`` drops tools by name (e.g. one-shot/interactive tools
+        for sub-agent runs).  The active agent profile's own
+        ``exclude_tools`` frontmatter is applied on top: an entry
+        matches a tool by exact name, glob pattern (``mcp__git__*``),
+        or ``__``-delimited prefix (``mcp__git`` hides
+        ``mcp__git__list_repos`` but ``Write`` does NOT hide
+        ``TodoWrite``).
+        """
+        excluded = set(exclude)
+        specs = self.registry.specs()
+        patterns = self._agent_excluded_tools
+        if not patterns:
+            return [spec for spec in specs if spec.name not in excluded]
+        return [
+            spec
+            for spec in specs
+            if spec.name not in excluded and not any(_tool_excluded(p, spec.name) for p in patterns)
+        ]
 
     def execute_tool(
         self, name: str, args: dict[str, Any], call_id: str | None = None
@@ -738,6 +776,7 @@ class Session:
             self.system_prompt = self._default_system_prompt
             self.store.system_prompt = self._default_system_prompt
             self.store.agent = None
+            self._agent_excluded_tools = ()
             return True, "switched to default agent"
 
         agents = discover_agents()
@@ -745,11 +784,12 @@ class Session:
         if prompt_file is None:
             available = ", ".join(sorted([RESERVED_AGENT_NAME, *agents.keys()]))
             return False, f"unknown agent: {name} (available: {available})"
-        from .prompts import assemble_agent_prompt, load_agent_prompt
+        from .prompts import agent_exclude_tools, assemble_agent_prompt, load_agent_prompt
 
         agent_prompt = load_agent_prompt(prompt_file, skill_dir=self._skill_dir)
         if agent_prompt is None:
             return False, f"agent {name}: prompt file not found or empty: {prompt_file}"
+        new_exclusions = agent_exclude_tools(prompt_file)
         self.system_prompt = assemble_agent_prompt(
             self.project_dir,
             agent_prompt,
@@ -757,6 +797,7 @@ class Session:
         )
         self.store.system_prompt = self.system_prompt
         self.store.agent = name
+        self._agent_excluded_tools = new_exclusions
         return True, f"switched to {name}"
 
     # ------------------------------------------------------------------

{python_agent_harness-1.5.5.4 → python_agent_harness-1.5.5.5}/python_agent_harness/tui/commands.py

@@ -650,6 +650,9 @@ class CommandMixin:
                 if success:
                     self.console.print(f"[green]{msg}[/green]")
                 else:
+                    # Agent no longer exists: reset to default to avoid
+                    # stale exclusions from the previously active agent
+                    self.session.switch_agent("default")
                     self.console.print(f"[yellow]warning: {msg}[/yellow]")
             except Exception as e:
                 self.console.print(f"[yellow]warning: could not restore agent: {e}[/yellow]")

{python_agent_harness-1.5.5.4 → python_agent_harness-1.5.5.5/python_agent_harness.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-agent-harness
-Version: 1.5.5.4
+Version: 1.5.5.5
 Summary: A lightweight, hackable mini-OpenCode written in Python.
 Author-email: Huming Chen <chenhuming@gmail.com>
 License-Expression: MIT
@@ -243,13 +243,32 @@ Custom commands from `prompts/commands/*.md` are registered as slash commands as
 
 Agent prompt files are markdown files (`.md`) placed in the `prompts/agents/` directory. Each file becomes a switchable agent profile available via the `/agent` TUI command. 
 
+An agent file may carry YAML frontmatter with two optional keys:
+
+- `name:` — override the agent name (defaults to the file stem)
+- `exclude_tools:` — a list of tool names the agent must not see. An entry matches a tool by exact name, glob pattern (`mcp__git__*`), or `__`-delimited prefix (`mcp__git` hides `mcp__git__list_repos` but `Write` does NOT hide `TodoWrite`). The built-in `default` agent always sees all tools.
+
+```markdown
+---
+name: assistant
+exclude_tools:
+  - Bash
+  - Edit
+  - Write
+  - mcp__git__*
+---
+
+# Role and Behavior
+You are a personal assistant. You do NOT modify files or run shell commands.
+```
+
 #### Commands vs Agents
 
 | | Commands (`/review`) | Agents (`/agent reviewer`) |
 |---|---|---|
 | **Scope** | One-shot (prompt resets after run) | Persistent (stays until next `/agent`) |
 | **Kickoff** | Hardcoded kickoff message | User types their own prompt |
-| **Tools** | Can restrict (`allow_planexit=False`) | All tools |
+| **Tools** | Can restrict (`allow_planexit=False`) | All tools, minus the agent's `exclude_tools` |
 | **Ctrl-C** | Restores to default prompt | Stays on the custom agent |
 
 ## Project layout

{python_agent_harness-1.5.5.4 → python_agent_harness-1.5.5.5}/tests/test_custom_agents.py

@@ -387,6 +387,229 @@ class TestMcpFailuresAsStartupWarnings(unittest.TestCase):
                     os.environ[k] = v
 
 
+class TestAgentExcludeTools(unittest.TestCase):
+    """Agent profile ``exclude_tools`` frontmatter: parsing and effect
+    on the tool specs exposed to the model."""
+
+    def _write_agent(
+        self, name: str, frontmatter: str, body: str = "You are a test agent."
+    ) -> Path:
+        p = AGENTS_DIR / f"{name}.md"
+        p.write_text(f"---\n{frontmatter}---\n{body}", encoding="utf-8")
+        return p
+
+    def test_parse_exclude_tools(self):
+        """agent_exclude_tools reads the frontmatter list."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = self._write_agent(
+            "test-exclude-parse",
+            "name: test-exclude-parse\nexclude_tools:\n  - Bash\n  - Edit\n  - mcp__git__*\n",
+        )
+        try:
+            self.assertEqual(
+                agent_exclude_tools(p),
+                ("Bash", "Edit", "mcp__git__*"),
+            )
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_parse_exclude_tools_inline(self):
+        """agent_exclude_tools reads an inline ``[a, b]`` list too."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = self._write_agent(
+            "test-exclude-inline",
+            "name: test-exclude-inline\nexclude_tools: [Bash, mcp__git__*]\n",
+        )
+        try:
+            self.assertEqual(
+                agent_exclude_tools(p),
+                ("Bash", "mcp__git__*"),
+            )
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_no_exclude_tools_returns_empty(self):
+        """An agent without the key excludes nothing."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = self._write_agent("test-exclude-none", "name: test-exclude-none\n")
+        try:
+            self.assertEqual(agent_exclude_tools(p), ())
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_switch_agent_applies_exclusions(self):
+        """switch_agent activates the profile's excluded tools."""
+        p = self._write_agent(
+            "test-exclude-switch",
+            "name: test-exclude-switch\nexclude_tools:\n  - Bash\n  - Edit\n",
+        )
+        try:
+            session = _make_session()
+            ok, msg = session.switch_agent("test-exclude-switch")
+            self.assertTrue(ok, msg)
+            names = {s.name for s in session.tool_specs()}
+            self.assertNotIn("Bash", names)
+            self.assertNotIn("Edit", names)
+            self.assertIn("Read", names)
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_switch_to_default_clears_exclusions(self):
+        """/agent default restores the full tool set."""
+        p = self._write_agent(
+            "test-exclude-default",
+            "name: test-exclude-default\nexclude_tools:\n  - Bash\n",
+        )
+        try:
+            session = _make_session()
+            session.switch_agent("test-exclude-default")
+            self.assertNotIn("Bash", {s.name for s in session.tool_specs()})
+            ok, msg = session.switch_agent("default")
+            self.assertTrue(ok, msg)
+            self.assertIn("Bash", {s.name for s in session.tool_specs()})
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_glob_pattern_excludes_mcp_tools(self):
+        """mcp__<server>__* patterns hide every tool of one server."""
+        from python_agent_harness.tools.base import Tool
+
+        class FakeMcpTool(Tool):
+            name = "mcp__git__list_repos"
+            description = "fake"
+
+            def run(self, args, ctx):
+                return ""
+
+        p = self._write_agent(
+            "test-exclude-glob",
+            "name: test-exclude-glob\nexclude_tools:\n  - mcp__git__*\n",
+        )
+        try:
+            session = _make_session()
+            session.registry.register(FakeMcpTool())
+            self.assertIn("mcp__git__list_repos", {s.name for s in session.tool_specs()})
+            session.switch_agent("test-exclude-glob")
+            names = {s.name for s in session.tool_specs()}
+            self.assertNotIn("mcp__git__list_repos", names)
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_substring_pattern_excludes_mcp_tools(self):
+        """A ``__``-delimited prefix (mcp__git) hides every tool of one
+        server, but does NOT accidentally match unrelated tools."""
+        from python_agent_harness.tools.base import Tool
+
+        class FakeMcpTool(Tool):
+            name = "mcp__git__list_repos"
+            description = "fake"
+
+            def run(self, args, ctx):
+                return ""
+
+        p = self._write_agent(
+            "test-exclude-substr",
+            "name: test-exclude-substr\nexclude_tools:\n  - mcp__git\n",
+        )
+        try:
+            session = _make_session()
+            session.registry.register(FakeMcpTool())
+            self.assertIn("mcp__git__list_repos", {s.name for s in session.tool_specs()})
+            session.switch_agent("test-exclude-substr")
+            names = {s.name for s in session.tool_specs()}
+            self.assertNotIn("mcp__git__list_repos", names)
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_write_does_not_exclude_todowrite(self):
+        """``Write`` must not accidentally hide ``TodoWrite``: matching
+        is by exact name or ``__``-delimited prefix, not raw substring."""
+        p = self._write_agent(
+            "test-exclude-no-false-match",
+            "name: test-exclude-no-false-match\nexclude_tools:\n  - Write\n",
+        )
+        try:
+            session = _make_session()
+            session.switch_agent("test-exclude-no-false-match")
+            names = {s.name for s in session.tool_specs()}
+            self.assertNotIn("Write", names)
+            self.assertIn("TodoWrite", names)
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_explicit_exclude_still_works(self):
+        """The caller's exclude argument composes with the profile's."""
+        p = self._write_agent(
+            "test-exclude-compose",
+            "name: test-exclude-compose\nexclude_tools:\n  - Bash\n",
+        )
+        try:
+            session = _make_session()
+            session.switch_agent("test-exclude-compose")
+            names = {s.name for s in session.tool_specs(exclude=("Edit",))}
+            self.assertNotIn("Bash", names)
+            self.assertNotIn("Edit", names)
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_failed_switch_leaves_exclusions_untouched(self):
+        """A failed switch (unknown name) must not change the active
+        exclusions: the caller's tool set must never silently shift."""
+        p = self._write_agent(
+            "test-exclude-fail",
+            "name: test-exclude-fail\nexclude_tools:\n  - Bash\n",
+        )
+        try:
+            session = _make_session()
+            session.switch_agent("test-exclude-fail")
+            self.assertNotIn("Bash", {s.name for s in session.tool_specs()})
+            ok, _ = session.switch_agent("nonexistent")
+            self.assertFalse(ok)
+            self.assertNotIn("Bash", {s.name for s in session.tool_specs()})
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_quoted_items_stripped(self):
+        """Quoted frontmatter items lose their quotes during parsing."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = self._write_agent(
+            "test-exclude-quoted",
+            "name: test-exclude-quoted\nexclude_tools:\n  - \"Bash\"\n  - 'Edit'\n",
+        )
+        try:
+            self.assertEqual(agent_exclude_tools(p), ("Bash", "Edit"))
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_no_frontmatter_at_all(self):
+        """A file with no frontmatter block excludes nothing."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = self._write_agent("test-no-frontmatter", "")
+        p.write_text("You are a simple agent with no frontmatter.", encoding="utf-8")
+        try:
+            self.assertEqual(agent_exclude_tools(p), ())
+        finally:
+            p.unlink(missing_ok=True)
+
+    def test_crlf_line_endings(self):
+        """CRLF line endings must not break frontmatter parsing."""
+        from python_agent_harness.prompts import agent_exclude_tools
+
+        p = AGENTS_DIR / "test-crlf-agent.md"
+        p.write_bytes(
+            b"---\r\nname: test-crlf-agent\r\nexclude_tools:\r\n  - Bash\r\n  - Edit\r\n---\r\nYou are a CRLF agent.\r\n"
+        )
+        try:
+            self.assertEqual(agent_exclude_tools(p), ("Bash", "Edit"))
+        finally:
+            p.unlink(missing_ok=True)
+
+
 class TestReviewerAgentContent(unittest.TestCase):
     """Verify the bundled reviewer.md agent has expected content."""